6.0.3-rc1 review
Subsystems (10)
Greg Kroah-Hartman
maintainerPATCH 703/862 regulator: core: Prevent integer underflow
In reply to Greg Kroah-HartmanFrom: Patrick Rudolph <[email protected]>
[ Upstream commit 8d8e16592022c9650df8aedfe6552ed478d7135b ]
By using a ratio of delay to poll_enabled_time that is not integer time_remaining underflows and does not exit the loop as expected. As delay could be derived from DT and poll_enabled_time is defined in the driver this can easily happen.
Use a signed iterator to make sure that the loop exits once the remaining time is negative.
--- drivers/regulator/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/regulator/core.c +1 -1
@@ -2681,7 +2681,7 @@ static int _regulator_do_enable(struct regulator_dev *rdev)* return -ETIMEDOUT. */ if (rdev->desc->poll_enabled_time) { -unsigned int time_remaining = delay; +int time_remaining = delay;while (time_remaining >0 ) {_regulator_delay_helper (rdev->desc->poll_enabled_time);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 704/862 wifi: ath11k: mhi: fix potential memory leak in ath11k_mhi_register()
In reply to Greg Kroah-HartmanFrom: Jianglei Nie <[email protected]>
[ Upstream commit 43e7c3505ec70db3d3c6458824d5fa40f62e3e7b ]
mhi_alloc_controller() allocates a memory space for mhi_ctrl. When gets some error, mhi_ctrl should be freed with mhi_free_controller(). But when ath11k_mhi_read_addr_from_dt() fails, the function returns without calling mhi_free_controller(), which will lead to a memory leak.
We can fix it by calling mhi_free_controller() when ath11k_mhi_read_addr_from_dt() fails.
--- drivers/net/wireless/ath/ath11k/mhi.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-)
drivers/net/wireless/ath/ath11k/mhi.c +10 -7
@@ -402,8 +402,7 @@ int ath11k_mhi_register(struct ath11k_pci *ab_pci) ret =ath11k_mhi_get_msi (ab_pci);if (ret) {ath11k_err (ab,"failed to get msi for mhi\n" ); -mhi_free_controller (mhi_ctrl); -return ret; + goto free_controller; }if (!test_bit (ATH11K_FLAG_MULTI_MSI_VECTORS , &ab->dev_flags))
@@ -412,7 +411,7 @@ int ath11k_mhi_register(struct ath11k_pci *ab_pci)if (test_bit (ATH11K_FLAG_FIXED_MEM_RGN , &ab->dev_flags)) { ret =ath11k_mhi_read_addr_from_dt (mhi_ctrl);if (ret <0 ) -return ret; + goto free_controller; }else { mhi_ctrl->iova_start =0 ; mhi_ctrl->iova_stop =0xFFFFFFFF ;
@@ -440,18 +439,22 @@ int ath11k_mhi_register(struct ath11k_pci *ab_pci)default :ath11k_err (ab,"failed assign mhi_config for unknown hw rev %d\n" , ab->hw_rev); -mhi_free_controller (mhi_ctrl); -return -EINVAL ; + ret = -EINVAL ; + goto free_controller; } ret =mhi_register_controller (mhi_ctrl, ath11k_mhi_config);if (ret) {ath11k_err (ab,"failed to register to mhi bus, err = %d\n" , ret); -mhi_free_controller (mhi_ctrl); -return ret; + goto free_controller; }return 0 ; + +free_controller: +mhi_free_controller (mhi_ctrl); + ab_pci->mhi_ctrl =NULL ; +return ret; }void ath11k_mhi_unregister (struct ath11k_pci *ab_pci)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 705/862 wifi: mt76: mt7921: reset msta->airtime_ac while clearing up hw value
In reply to Greg Kroah-HartmanFrom: Sean Wang <[email protected]>
[ Upstream commit 1bf66dc31032ff5292f4d5b76436653f269fcfbd ]
We should reset mstat->airtime_ac along with clear up the entries in the hardware WLAN table for the Rx and Rx accumulative airtime. Otherwsie, the value msta->airtime_ac - [tx, rx]_last may be a negative and that is not the actual airtime the device took in the last run.
--- drivers/net/wireless/mediatek/mt76/mt7921/main.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/mediatek/mt76/mt7921/main.c +1 -0
@@ -752,6 +752,7 @@ void mt7921_mac_sta_assoc(struct mt76_dev *mdev, struct ieee80211_vif *vif,mt7921_mac_wtbl_update (dev, msta->wcid.idx,MT_WTBL_UPDATE_ADM_COUNT_CLEAR ); +memset (msta->airtime_ac,0 ,sizeof (msta->airtime_ac));mt7921_mcu_sta_update (dev, sta, vif, true,MT76_STA_INFO_STATE_ASSOC );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 706/862 wifi: rtw89: free unused skb to prevent memory leak
In reply to Greg Kroah-HartmanFrom: Po-Hao Huang <[email protected]>
[ Upstream commit eae672f386049146058b9e5d3d33e9e4af9dca1d ]
This avoid potential memory leak under power saving mode.
--- drivers/net/wireless/realtek/rtw89/core.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/realtek/rtw89/core.c +1 -0
@@ -872,6 +872,7 @@ int rtw89_h2c_tx(struct rtw89_dev *rtwdev,rtw89_debug (rtwdev,RTW89_DBG_FW ,"ignore h2c due to power is off with firmware state=%d\n" ,test_bit (RTW89_FLAG_FW_RDY , rtwdev->flags)); +dev_kfree_skb (skb);return 0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 707/862 wifi: rtw89: fix rx filter after scan
In reply to Greg Kroah-HartmanFrom: Po-Hao Huang <[email protected]>
[ Upstream commit 812825c2b204c491f1a5586c602e4ac75060493a ]
In monitor mode we should be able to received all packets even if it's not destined to us. But after scan, the configuration was wrongly set, so we fix it.
--- drivers/net/wireless/realtek/rtw89/fw.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-)
drivers/net/wireless/realtek/rtw89/fw.c +5 -7
@@ -2289,6 +2289,7 @@ void rtw89_hw_scan_start(struct rtw89_dev *rtwdev, struct ieee80211_vif *vif, {struct rtw89_vif *rtwvif = (struct rtw89_vif *)vif->drv_priv;struct cfg80211_scan_request *req = &scan_req->req; +u32 rx_fltr = rtwdev->hal.rx_fltr;u8 mac_addr[ETH_ALEN ]; rtwdev->scan_info.scanning_vif = vif;
@@ -2303,13 +2304,13 @@ void rtw89_hw_scan_start(struct rtw89_dev *rtwdev, struct ieee80211_vif *vif,ether_addr_copy (mac_addr, vif->addr);rtw89_core_scan_start (rtwdev, rtwvif, mac_addr, true); - rtwdev->hal.rx_fltr &= ~B_AX_A_BCN_CHK_EN ; - rtwdev->hal.rx_fltr &= ~B_AX_A_BC ; - rtwdev->hal.rx_fltr &= ~B_AX_A_A1_MATCH ; + rx_fltr &= ~B_AX_A_BCN_CHK_EN ; + rx_fltr &= ~B_AX_A_BC ; + rx_fltr &= ~B_AX_A_A1_MATCH ;rtw89_write32_mask (rtwdev,rtw89_mac_reg_by_idx (R_AX_RX_FLTR_OPT ,RTW89_MAC_0 ),B_AX_RX_FLTR_CFG_MASK , - rtwdev->hal.rx_fltr); + rx_fltr); } void rtw89_hw_scan_complete(struct rtw89_dev *rtwdev, struct ieee80211_vif *vif,
@@ -2323,9 +2324,6 @@ void rtw89_hw_scan_complete(struct rtw89_dev *rtwdev, struct ieee80211_vif *vif,if (!vif)return ; - rtwdev->hal.rx_fltr |=B_AX_A_BCN_CHK_EN ; - rtwdev->hal.rx_fltr |=B_AX_A_BC ; - rtwdev->hal.rx_fltr |=B_AX_A_A1_MATCH ; rtw89_write32_mask(rtwdev, rtw89_mac_reg_by_idx(R_AX_RX_FLTR_OPT, RTW89_MAC_0), B_AX_RX_FLTR_CFG_MASK,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 708/862 Bluetooth: L2CAP: initialize delayed works at l2cap_chan_create()
In reply to Greg Kroah-HartmanFrom: Tetsuo Handa <[email protected]>
[ Upstream commit 2d2cb3066f2c90cd8ca540b36ba7a55e7f2406e0 ]
syzbot is reporting cancel_delayed_work() without INIT_DELAYED_WORK() at l2cap_chan_del() [1], for CONF_NOT_COMPLETE flag (which meant to prevent l2cap_chan_del() from calling cancel_delayed_work()) is cleared by timer which fires before l2cap_chan_del() is called by closing file descriptor created by socket(AF_BLUETOOTH, SOCK_STREAM, BTPROTO_L2CAP).
l2cap_bredr_sig_cmd(L2CAP_CONF_REQ) and l2cap_bredr_sig_cmd(L2CAP_CONF_RSP) are calling l2cap_ertm_init(chan), and they call l2cap_chan_ready() (which clears CONF_NOT_COMPLETE flag) only when l2cap_ertm_init(chan) succeeded.
l2cap_sock_init() does not call l2cap_ertm_init(chan), and it instead sets CONF_NOT_COMPLETE flag by calling l2cap_chan_set_defaults(). However, when connect() is requested, "command 0x0409 tx timeout" happens after 2 seconds
from connect() request, and CONF_NOT_COMPLETE flag is cleared after 4
seconds from connect() request, for l2cap_conn_start() from l2cap_info_timeout() callback scheduled by
schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
in l2cap_connect() is calling l2cap_chan_ready().
Fix this problem by initializing delayed works used by L2CAP_MODE_ERTM mode as soon as l2cap_chan_create() allocates a channel, like I did in commit be8597239379f0f5 ("Bluetooth: initialize skb_queue_head at l2cap_chan_create()").
--- net/bluetooth/l2cap_core.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
net/bluetooth/l2cap_core.c +6 -4
@@ -61,6 +61,9 @@ static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err);static void l2cap_tx (struct l2cap_chan *chan,struct l2cap_ctrl *control,struct sk_buff_head *skbs,u8 event); +static void l2cap_retrans_timeout (struct work_struct *work); +static void l2cap_monitor_timeout (struct work_struct *work); +static void l2cap_ack_timeout (struct work_struct *work);static inline u8 bdaddr_type (u8 link_type,u8 bdaddr_type) {
@@ -476,6 +479,9 @@ struct l2cap_chan *l2cap_chan_create(void)write_unlock (&chan_list_lock);INIT_DELAYED_WORK (&chan->chan_timer, l2cap_chan_timeout); +INIT_DELAYED_WORK (&chan->retrans_timer, l2cap_retrans_timeout); +INIT_DELAYED_WORK (&chan->monitor_timer, l2cap_monitor_timeout); +INIT_DELAYED_WORK (&chan->ack_timer, l2cap_ack_timeout); chan->state =BT_OPEN ;
@@ -3320,10 +3326,6 @@ int l2cap_ertm_init(struct l2cap_chan *chan) chan->rx_state =L2CAP_RX_STATE_RECV ; chan->tx_state =L2CAP_TX_STATE_XMIT ; -INIT_DELAYED_WORK (&chan->retrans_timer, l2cap_retrans_timeout); -INIT_DELAYED_WORK (&chan->monitor_timer, l2cap_monitor_timeout); -INIT_DELAYED_WORK (&chan->ack_timer, l2cap_ack_timeout); -skb_queue_head_init (&chan->srej_q); err =l2cap_seq_list_init (&chan->srej_list, chan->tx_win);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 709/862 Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times
In reply to Greg Kroah-HartmanFrom: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 448a496f760664d3e2e79466aa1787e6abc922b5 ]
device_add shall not be called multiple times as stated in its documentation:
'Do not call this routine or device_register() more than once for any device structure'
Syzkaller reports a bug as follows [1]:
------------[ cut here ]------------ kernel BUG at lib/list_debug.c:33! invalid opcode: 0000 [#1] PREEMPT SMP KASAN [...] Call Trace: <TASK> __list_add include/linux/list.h:69 [inline] list_add_tail include/linux/list.h:102 [inline] kobj_kset_join lib/kobject.c:164 [inline] kobject_add_internal+0x18f/0x8f0 lib/kobject.c:214 kobject_add_varg lib/kobject.c:358 [inline] kobject_add+0x150/0x1c0 lib/kobject.c:410 device_add+0x368/0x1e90 drivers/base/core.c:3452 hci_conn_add_sysfs+0x9b/0x1b0 net/bluetooth/hci_sysfs.c:53 hci_le_cis_estabilished_evt+0x57c/0xae0 net/bluetooth/hci_event.c:6799 hci_le_meta_evt+0x2b8/0x510 net/bluetooth/hci_event.c:7110 hci_event_func net/bluetooth/hci_event.c:7440 [inline] hci_event_packet+0x63d/0xfd0 net/bluetooth/hci_event.c:7495 hci_rx_work+0xae7/0x1230 net/bluetooth/hci_core.c:4007 process_one_work+0x991/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e4/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306 </TASK>
--- net/bluetooth/hci_sysfs.c | 3 +++ 1 file changed, 3 insertions(+)
net/bluetooth/hci_sysfs.c +3 -0
@@ -48,6 +48,9 @@ void hci_conn_add_sysfs(struct hci_conn *conn)BT_DBG ("conn %p" , conn); +if (device_is_registered (&conn->dev)) +return ; +dev_set_name (&conn->dev,"%s:%d" , hdev->name, conn->handle);if (device_add (&conn->dev) <0 ) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 710/862 Bluetooth: hci_event: Make sure ISO events dont affect non-ISO connections
In reply to Greg Kroah-HartmanFrom: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit ed680f925aea76ac666f34d9923cb40558f4e97b ]
ISO events (CIS/BIS) shall only be relevant for connection with link type of ISO_LINK, otherwise the controller is probably buggy or it is the result of fuzzer tools such as syzkaller.
--- net/bluetooth/hci_event.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
net/bluetooth/hci_event.c +14 -0
@@ -6778,6 +6778,13 @@ static void hci_le_cis_estabilished_evt(struct hci_dev *hdev, void *data, goto unlock; } +if (conn->type !=ISO_LINK ) { +bt_dev_err (hdev, +"Invalid connection link type handle 0x%4.4x" , + handle); + goto unlock; + } +if (conn->role ==HCI_ROLE_SLAVE ) {__le32 interval;
@@ -6898,6 +6905,13 @@ static void hci_le_create_big_complete_evt(struct hci_dev *hdev, void *data,if (!conn) goto unlock; +if (conn->type !=ISO_LINK ) { +bt_dev_err (hdev, +"Invalid connection link type handle 0x%2.2x" , + ev->handle); + goto unlock; + } +if (ev->num_bis) conn->handle =__le16_to_cpu (ev->bis_handle[0 ]);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 711/862 bnxt_en: replace reset with config timestamps
In reply to Greg Kroah-HartmanFrom: Vadim Fedorenko <[email protected]>
[ Upstream commit 8db3d514e96715c897fe793c4d5fc0fd86aca517 ]
Any change to the hardware timestamps configuration triggers nic restart, which breaks transmition and reception of network packets for a while. But there is no need to fully restart the device because while configuring hardware timestamps. The code for changing configuration runs after all of the initialisation, when the NIC is actually up and running. This patch changes the code that ioctl will only update configuration registers and will not trigger carrier status change, but in case of timestamps for all rx packetes it fallbacks to close()/open() sequnce because of synchronization issues in the hardware. Tested on BCM57504.
--- drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c +7 -3
@@ -505,9 +505,13 @@ static int bnxt_hwrm_ptp_cfg(struct bnxt *bp) ptp->tstamp_filters = flags;if (netif_running (bp->dev)) { - rc =bnxt_close_nic (bp, false, false); -if (!rc) - rc =bnxt_open_nic (bp, false, false); +if (ptp->rx_filter ==HWTSTAMP_FILTER_ALL ) { + rc =bnxt_close_nic (bp, false, false); +if (!rc) + rc =bnxt_open_nic (bp, false, false); + }else { +bnxt_ptp_cfg_tstamp_filters (bp); + }if (!rc && !ptp->tstamp_filters) rc = -EIO ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 712/862 selftests/bpf: Free the allocated resources after test case succeeds
In reply to Greg Kroah-HartmanFrom: Hou Tao <[email protected]>
[ Upstream commit 103d002fb7d548fb1187e350f2b73788558128b9 ]
Free the created fd or allocated bpf_object after test case succeeds, else there will be resource leaks.
Spotted by using address sanitizer and checking the content of /proc/$pid/fd directory.
--- .../bpf/map_tests/array_map_batch_ops.c | 2 ++ .../bpf/map_tests/htab_map_batch_ops.c | 2 ++ .../bpf/map_tests/lpm_trie_map_batch_ops.c | 2 ++ tools/testing/selftests/bpf/test_maps.c | 24 ++++++++++++------- 4 files changed, 21 insertions(+), 9 deletions(-)
tools/testing/selftests/bpf/map_tests/array_map_batch_ops.c +2 -0
@@ -3,6 +3,7 @@#include <stdio.h> #include <errno.h> #include <string.h> +#include <unistd.h> #include <bpf/bpf.h> #include <bpf/libbpf.h>
@@ -137,6 +138,7 @@ static void __test_map_lookup_and_update_batch(bool is_pcpu)free (keys);free (values);free (visited); +close (map_fd); }static void array_map_batch_ops (void )
tools/testing/selftests/bpf/map_tests/htab_map_batch_ops.c +2 -0
@@ -3,6 +3,7 @@#include <stdio.h> #include <errno.h> #include <string.h> +#include <unistd.h> #include <bpf/bpf.h> #include <bpf/libbpf.h>
@@ -255,6 +256,7 @@ void __test_map_lookup_and_delete_batch(bool is_pcpu)free (visited);if (!is_pcpu)free (values); +close (map_fd); }void htab_map_batch_ops (void )
tools/testing/selftests/bpf/map_tests/lpm_trie_map_batch_ops.c +2 -0
@@ -7,6 +7,7 @@#include <errno.h> #include <string.h> #include <stdlib.h> +#include <unistd.h> #include <bpf/bpf.h> #include <bpf/libbpf.h>
@@ -150,4 +151,5 @@ void test_lpm_trie_map_batch_ops(void)free (keys);free (values);free (visited); +close (map_fd); }
tools/testing/selftests/bpf/test_maps.c +15 -9
@@ -658,13 +658,13 @@ static void test_sockmap(unsigned int tasks, void *data) {struct bpf_map *bpf_map_rx, *bpf_map_tx, *bpf_map_msg, *bpf_map_break;int map_fd_msg =0 , map_fd_rx =0 , map_fd_tx =0 , map_fd_break; +struct bpf_object *parse_obj, *verdict_obj, *msg_obj;int ports[] = {50200 ,50201 ,50202 ,50204 };int err, i, fd, udp, sfd[6 ] = {0xdeadbeef };u8 buf[20 ] = {0x0 ,0x5 ,0x3 ,0x2 ,0x1 ,0x0 };int parse_prog, verdict_prog, msg_prog;struct sockaddr_in addr;int one =1 , s, sc, rc; -struct bpf_object *obj;struct timeval to;__u32 key, value;pid_t pid[tasks];
@@ -760,6 +760,7 @@ static void test_sockmap(unsigned int tasks, void *data) i, udp); goto out_sockmap; } +close (udp);/* Test update without programs */ for (i =0 ; i <6 ; i++) {
@@ -822,27 +823,27 @@ static void test_sockmap(unsigned int tasks, void *data)/* Load SK_SKB program and Attach */ err =bpf_prog_test_load (SOCKMAP_PARSE_PROG , -BPF_PROG_TYPE_SK_SKB , &obj, &parse_prog); +BPF_PROG_TYPE_SK_SKB , &parse_obj, &parse_prog);if (err) {printf ("Failed to load SK_SKB parse prog\n" ); goto out_sockmap; } err =bpf_prog_test_load (SOCKMAP_TCP_MSG_PROG , -BPF_PROG_TYPE_SK_MSG , &obj, &msg_prog); +BPF_PROG_TYPE_SK_MSG , &msg_obj, &msg_prog);if (err) {printf ("Failed to load SK_SKB msg prog\n" ); goto out_sockmap; } err =bpf_prog_test_load (SOCKMAP_VERDICT_PROG , -BPF_PROG_TYPE_SK_SKB , &obj, &verdict_prog); +BPF_PROG_TYPE_SK_SKB , &verdict_obj, &verdict_prog);if (err) {printf ("Failed to load SK_SKB verdict prog\n" ); goto out_sockmap; } - bpf_map_rx =bpf_object__find_map_by_name (obj,"sock_map_rx" ); + bpf_map_rx =bpf_object__find_map_by_name (verdict_obj,"sock_map_rx" );if (!bpf_map_rx) {printf ("Failed to load map rx from verdict prog\n" ); goto out_sockmap;
@@ -854,7 +855,7 @@ static void test_sockmap(unsigned int tasks, void *data) goto out_sockmap; } - bpf_map_tx =bpf_object__find_map_by_name (obj,"sock_map_tx" ); + bpf_map_tx =bpf_object__find_map_by_name (verdict_obj,"sock_map_tx" );if (!bpf_map_tx) {printf ("Failed to load map tx from verdict prog\n" ); goto out_sockmap;
@@ -866,7 +867,7 @@ static void test_sockmap(unsigned int tasks, void *data) goto out_sockmap; } - bpf_map_msg =bpf_object__find_map_by_name (obj,"sock_map_msg" ); + bpf_map_msg =bpf_object__find_map_by_name (verdict_obj,"sock_map_msg" );if (!bpf_map_msg) {printf ("Failed to load map msg from msg_verdict prog\n" ); goto out_sockmap;
@@ -878,7 +879,7 @@ static void test_sockmap(unsigned int tasks, void *data) goto out_sockmap; } - bpf_map_break =bpf_object__find_map_by_name (obj,"sock_map_break" ); + bpf_map_break =bpf_object__find_map_by_name (verdict_obj,"sock_map_break" );if (!bpf_map_break) {printf ("Failed to load map tx from verdict prog\n" ); goto out_sockmap;
@@ -1124,7 +1125,9 @@ static void test_sockmap(unsigned int tasks, void *data) }close (fd);close (map_fd_rx); -bpf_object__close (obj); +bpf_object__close (parse_obj); +bpf_object__close (msg_obj); +bpf_object__close (verdict_obj);return ; out:for (i =0 ; i <6 ; i++)
@@ -1282,8 +1285,11 @@ static void test_map_in_map(void)printf ("Inner map mim.inner was not destroyed\n" ); goto out_map_in_map; } + +close (fd); } +bpf_object__close (obj);return ; out_map_in_map:
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 713/862 can: bcm: check the result of can_send() in bcm_can_tx()
In reply to Greg Kroah-HartmanFrom: Ziyang Xuan <[email protected]>
[ Upstream commit 3fd7bfd28cfd68ae80a2fe92ea1615722cc2ee6e ]
If can_send() fail, it should not update frames_abs counter in bcm_can_tx(). Add the result check for can_send() in bcm_can_tx().
--- net/can/bcm.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
net/can/bcm.c +4 -3
@@ -274,6 +274,7 @@ static void bcm_can_tx(struct bcm_op *op)struct sk_buff *skb;struct net_device *dev;struct canfd_frame *cf = op->frames + op->cfsiz * op->currframe; +int err;/* no target device? => exit */ if (!op->ifindex)
@@ -298,11 +299,11 @@ static void bcm_can_tx(struct bcm_op *op)/* send with loopback */ skb->dev = dev;can_skb_set_owner (skb, op->sk); -can_send (skb,1 ); + err =can_send (skb,1 ); +if (!err) + op->frames_abs++; -/* update statistics */ op->currframe++; - op->frames_abs++;/* reached last frame? */ if (op->currframe >= op->nframes)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 714/862 wifi: rt2x00: dont run Rt5592 IQ calibration on MT7620
In reply to Greg Kroah-HartmanFrom: Daniel Golle <[email protected]>
[ Upstream commit d3aad83d05aec0cfd7670cf0028f2ad4b81de92e ]
The function rt2800_iq_calibrate is intended for Rt5592 only. Don't call it for MT7620 which has it's own calibration functions.
--- drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/wireless/ralink/rt2x00/rt2800lib.c +2 -1
@@ -4365,7 +4365,8 @@ static void rt2800_config_channel(struct rt2x00_dev *rt2x00dev, reg = (rf->channel <=14 ?0x1c :0x24 ) +2 *rt2x00dev->lna_gain;rt2800_bbp_write_with_rx_chain (rt2x00dev,66 , reg); -rt2800_iq_calibrate (rt2x00dev, rf->channel); +if (rt2x00_rt (rt2x00dev,RT5592 )) +rt2800_iq_calibrate (rt2x00dev, rf->channel); } bbp =rt2800_bbp_read (rt2x00dev,4 );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 715/862 wifi: rt2x00: set correct TX_SW_CFG1 MAC register for MT7620
In reply to Greg Kroah-HartmanFrom: Daniel Golle <[email protected]>
[ Upstream commit eeb50acf15762b61921f9df18663f839f387c054 ]
Set correct TX_SW_CFG1 MAC register as it is done also in v3 of the vendor driver[1].
--- drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/ralink/rt2x00/rt2800lib.c +1 -1
@@ -5868,7 +5868,7 @@ static int rt2800_init_registers(struct rt2x00_dev *rt2x00dev)rt2800_register_write (rt2x00dev,TX_SW_CFG0 ,0x00000404 ); }else if (rt2x00_rt (rt2x00dev,RT6352 )) {rt2800_register_write (rt2x00dev,TX_SW_CFG0 ,0x00000401 ); -rt2800_register_write (rt2x00dev,TX_SW_CFG1 ,0x000C0000 ); +rt2800_register_write (rt2x00dev,TX_SW_CFG1 ,0x000C0001 );rt2800_register_write (rt2x00dev,TX_SW_CFG2 ,0x00000000 );rt2800_register_write (rt2x00dev,TX_ALC_VGA3 ,0x00000000 );rt2800_register_write (rt2x00dev,TX0_BB_GAIN_ATTEN ,0x0 );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 716/862 wifi: rt2x00: set VGC gain for both chains of MT7620
In reply to Greg Kroah-HartmanFrom: Daniel Golle <[email protected]>
[ Upstream commit 0e09768c085709e10ece3b68f6ac921d3f6a9caa ]
Set bbp66 for all chains of the MT7620.
--- drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/wireless/ralink/rt2x00/rt2800lib.c +2 -1
@@ -5645,7 +5645,8 @@ static inline void rt2800_set_vgc(struct rt2x00_dev *rt2x00dev,if (qual->vgc_level != vgc_level) {if (rt2x00_rt (rt2x00dev,RT3572 ) ||rt2x00_rt (rt2x00dev,RT3593 ) || -rt2x00_rt (rt2x00dev,RT3883 )) { +rt2x00_rt (rt2x00dev,RT3883 ) || +rt2x00_rt (rt2x00dev,RT6352 )) {rt2800_bbp_write_with_rx_chain (rt2x00dev,66 , vgc_level); }else if (rt2x00_rt (rt2x00dev,RT5592 )) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 717/862 wifi: rt2x00: set SoC wmac clock register
In reply to Greg Kroah-HartmanFrom: Daniel Golle <[email protected]>
[ Upstream commit cbde6ed406a51092d9e8a2df058f5f8490f27443 ]
Instead of using the default value 33 (pci), set US_CYC_CNT init based on Programming guide:
If available, set chipset bus clock with fallback to cpu clock/3.
--- .../net/wireless/ralink/rt2x00/rt2800lib.c | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+)
drivers/net/wireless/ralink/rt2x00/rt2800lib.c +21 -0
@@ -6131,6 +6131,27 @@ static int rt2800_init_registers(struct rt2x00_dev *rt2x00dev) reg =rt2800_register_read (rt2x00dev,US_CYC_CNT );rt2x00_set_field32 (®,US_CYC_CNT_CLOCK_CYCLE ,125 );rt2800_register_write (rt2x00dev,US_CYC_CNT , reg); + }else if (rt2x00_is_soc (rt2x00dev)) { +struct clk *clk =clk_get_sys ("bus" ,NULL ); +int rate; + +if (IS_ERR (clk)) { + clk =clk_get_sys ("cpu" ,NULL ); + +if (IS_ERR (clk)) { + rate =125 ; + }else { + rate =clk_get_rate (clk) /3000000 ; +clk_put (clk); + } + }else { + rate =clk_get_rate (clk) /1000000 ; +clk_put (clk); + } + + reg =rt2800_register_read (rt2x00dev,US_CYC_CNT ); +rt2x00_set_field32 (®,US_CYC_CNT_CLOCK_CYCLE , rate); +rt2800_register_write (rt2x00dev,US_CYC_CNT , reg); } reg =rt2800_register_read (rt2x00dev,HT_FBK_CFG0 );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 718/862 wifi: rt2x00: correctly set BBP register 86 for MT7620
In reply to Greg Kroah-HartmanFrom: Daniel Golle <[email protected]>
[ Upstream commit c9aada64fe6493461127f1522d7e2f01792d2424 ]
Instead of 0 set the correct value for BBP register 86 for MT7620.
--- drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/wireless/ralink/rt2x00/rt2800lib.c +4 -1
@@ -4164,7 +4164,10 @@ static void rt2800_config_channel(struct rt2x00_dev *rt2x00dev,rt2800_bbp_write (rt2x00dev,62 ,0x37 - rt2x00dev->lna_gain);rt2800_bbp_write (rt2x00dev,63 ,0x37 - rt2x00dev->lna_gain);rt2800_bbp_write (rt2x00dev,64 ,0x37 - rt2x00dev->lna_gain); -rt2800_bbp_write (rt2x00dev,86 ,0 ); +if (rt2x00_rt (rt2x00dev,RT6352 )) +rt2800_bbp_write (rt2x00dev,86 ,0x38 ); +else +rt2800_bbp_write (rt2x00dev,86 ,0 ); }if (rf->channel <=14 ) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 719/862 hwmon: (sht4x) do not overflow clamping operation on 32-bit platforms
In reply to Greg Kroah-HartmanFrom: Jason A. Donenfeld <[email protected]>
[ Upstream commit f9c0cf8f26de367c58e48b02b1cdb9c377626e6f ]
On 32-bit platforms, long is 32 bits, so (long)UINT_MAX is less than (long)SHT4X_MIN_POLL_INTERVAL, which means the clamping operation is bogus. Fix this by clamping at INT_MAX, so that the upperbound is the same on all platforms.
--- drivers/hwmon/sht4x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwmon/sht4x.c +1 -1
@@ -129,7 +129,7 @@ static int sht4x_read_values(struct sht4x_data *data)static ssize_t sht4x_interval_write (struct sht4x_data *data,long val) { - data->update_interval =clamp_val (val,SHT4X_MIN_POLL_INTERVAL ,UINT_MAX ); + data->update_interval =clamp_val (val,SHT4X_MIN_POLL_INTERVAL ,INT_MAX );return 0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 720/862 net: If sock is dead dont access socks sk_wq in sk_stream_wait_memory
In reply to Greg Kroah-HartmanFrom: Liu Jian <[email protected]>
[ Upstream commit 3f8ef65af927db247418d4e1db49164d7a158fc5 ]
Fixes the below NULL pointer dereference:
[...]
[ 14.471200] Call Trace: [ 14.471562] <TASK> [ 14.471882] lock_acquire+0x245/0x2e0 [ 14.472416] ? remove_wait_queue+0x12/0x50 [ 14.473014] ? _raw_spin_lock_irqsave+0x17/0x50 [ 14.473681] _raw_spin_lock_irqsave+0x3d/0x50 [ 14.474318] ? remove_wait_queue+0x12/0x50 [ 14.474907] remove_wait_queue+0x12/0x50 [ 14.475480] sk_stream_wait_memory+0x20d/0x340 [ 14.476127] ? do_wait_intr_irq+0x80/0x80 [ 14.476704] do_tcp_sendpages+0x287/0x600 [ 14.477283] tcp_bpf_push+0xab/0x260 [ 14.477817] tcp_bpf_sendmsg_redir+0x297/0x500 [ 14.478461] ? __local_bh_enable_ip+0x77/0xe0 [ 14.479096] tcp_bpf_send_verdict+0x105/0x470 [ 14.479729] tcp_bpf_sendmsg+0x318/0x4f0 [ 14.480311] sock_sendmsg+0x2d/0x40 [ 14.480822] ____sys_sendmsg+0x1b4/0x1c0 [ 14.481390] ? copy_msghdr_from_user+0x62/0x80 [ 14.482048] ___sys_sendmsg+0x78/0xb0 [ 14.482580] ? vmf_insert_pfn_prot+0x91/0x150 [ 14.483215] ? __do_fault+0x2a/0x1a0 [ 14.483738] ? do_fault+0x15e/0x5d0 [ 14.484246] ? __handle_mm_fault+0x56b/0x1040 [ 14.484874] ? lock_is_held_type+0xdf/0x130 [ 14.485474] ? find_held_lock+0x2d/0x90 [ 14.486046] ? __sys_sendmsg+0x41/0x70 [ 14.486587] __sys_sendmsg+0x41/0x70 [ 14.487105] ? intel_pmu_drain_pebs_core+0x350/0x350 [ 14.487822] do_syscall_64+0x34/0x80 [ 14.488345] entry_SYSCALL_64_after_hwframe+0x63/0xcd [...]
The test scenario has the following flow:
thread1 thread2
----------- ---------------
tcp_bpf_sendmsg
tcp_bpf_send_verdict
tcp_bpf_sendmsg_redir sock_close
tcp_bpf_push_locked __sock_release
tcp_bpf_push //inet_release
do_tcp_sendpages sock->ops->release
sk_stream_wait_memory // tcp_close
sk_wait_event sk->sk_prot->close
release_sock(__sk);
***
lock_sock(sk);
__tcp_close
sock_orphan(sk)
sk->sk_wq = NULL
release_sock
****
lock_sock(__sk);
remove_wait_queue(sk_sleep(sk), &wait);
sk_sleep(sk)
//NULL pointer dereference
&rcu_dereference_raw(sk->sk_wq)->waitWhile waiting for memory in thread1, the socket is released with its wait queue because thread2 has closed it. This caused by tcp_bpf_send_verdict didn't increase the f_count of psock->sk_redir->sk_socket->file in thread1.
We should check if SOCK_DEAD flag is set on wakeup in sk_stream_wait_memory before accessing the wait queue.
--- net/core/stream.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/core/stream.c +2 -1
@@ -159,7 +159,8 @@ int sk_stream_wait_memory(struct sock *sk, long *timeo_p) *timeo_p = current_timeo; } out: -remove_wait_queue (sk_sleep (sk), &wait); +if (!sock_flag (sk,SOCK_DEAD )) +remove_wait_queue (sk_sleep (sk), &wait);return err; do_error:
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 721/862 bpf: Adjust kprobe_multi entry_ip for CONFIG_X86_KERNEL_IBT
In reply to Greg Kroah-HartmanFrom: Jiri Olsa <[email protected]>
[ Upstream commit c09eb2e578eb1668bbc84dc07e8d8bd6f04b9a02 ]
Martynas reported bpf_get_func_ip returning +4 address when CONFIG_X86_KERNEL_IBT option is enabled.
When CONFIG_X86_KERNEL_IBT is enabled we'll have endbr instruction at the function entry, which screws return value of bpf_get_func_ip() helper that should return the function address.
There's short term workaround for kprobe_multi bpf program made by Alexei [1], but we need this fixup also for bpf_get_attach_cookie, that returns cookie based on the entry_ip value.
Moving the fixup in the fprobe handler, so both bpf_get_func_ip and bpf_get_attach_cookie get expected function address when CONFIG_X86_KERNEL_IBT option is enabled.
Also renaming kprobe_multi_link_handler entry_ip argument to fentry_ip so it's clearer this is an ftrace __fentry__ ip.
[1] commit 7f0059b58f02 ("selftests/bpf: Fix kprobe_multi test.")
--- kernel/trace/bpf_trace.c | 20 +++++++++++++++++-- .../selftests/bpf/progs/kprobe_multi.c | 4 +--- 2 files changed, 19 insertions(+), 5 deletions(-)
kernel/trace/bpf_trace.c +18 -2
@@ -1026,6 +1026,22 @@ static const struct bpf_func_proto bpf_get_func_ip_proto_tracing = { .arg1_type = ARG_PTR_TO_CTX, }; +#ifdef CONFIG_X86_KERNEL_IBT +static unsigned long get_entry_ip (unsigned long fentry_ip) +{ +u32 instr; + +/* Being extra safe in here in case entry ip is on the page-edge. */ +if (get_kernel_nofault (instr, (u32 *) fentry_ip -1 )) +return fentry_ip; +if (is_endbr (instr)) + fentry_ip -=ENDBR_INSN_SIZE ; +return fentry_ip; +} +#else +#define get_entry_ip (fentry_ip) fentry_ip +#endif + BPF_CALL_1(bpf_get_func_ip_kprobe, struct pt_regs *, regs) {struct kprobe *kp =kprobe_running ();
@@ -2414,13 +2430,13 @@ kprobe_multi_link_prog_run(struct bpf_kprobe_multi_link *link, }static void -kprobe_multi_link_handler (struct fprobe *fp,unsigned long entry_ip, +kprobe_multi_link_handler (struct fprobe *fp,unsigned long fentry_ip,struct pt_regs *regs) {struct bpf_kprobe_multi_link *link; link = container_of(fp, struct bpf_kprobe_multi_link, fp); -kprobe_multi_link_prog_run (link, entry_ip, regs); +kprobe_multi_link_prog_run (link,get_entry_ip (fentry_ip), regs); }static int symbols_cmp_r (const void *a,const void *b,const void *priv)
tools/testing/selftests/bpf/progs/kprobe_multi.c +1 -3
@@ -36,15 +36,13 @@ __u64 kretprobe_test6_result = 0;__u64 kretprobe_test7_result =0 ;__u64 kretprobe_test8_result =0 ; -extern bool CONFIG_X86_KERNEL_IBT __kconfig __weak; -static void kprobe_multi_check (void *ctx,bool is_return) {if (bpf_get_current_pid_tgid () >>32 != pid)return ;__u64 cookie = test_cookie ?bpf_get_attach_cookie (ctx) :0 ; -__u64 addr =bpf_get_func_ip (ctx) - (CONFIG_X86_KERNEL_IBT ?4 :0 ); +__u64 addr =bpf_get_func_ip (ctx);#define SET (__var, __addr, __cookie) ({ \ if (((const void *) addr == __addr) && \
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 722/862 bpf: use bpf_prog_pack for bpf_dispatcher
In reply to Greg Kroah-HartmanFrom: Song Liu <[email protected]>
[ Upstream commit 19c02415da2345d0dda2b5c4495bc17cc14b18b5 ]
Allocate bpf_dispatcher with bpf_prog_pack_alloc so that bpf_dispatcher can share pages with bpf programs.
arch_prepare_bpf_dispatcher() is updated to provide a RW buffer as working area for arch code to write to.
This also fixes CPA W^X warnning like:
CPA refuse W^X violation: 8000000000000163 -> 0000000000000163 range: ...
--- arch/x86/net/bpf_jit_comp.c | 16 ++++++++-------- include/linux/bpf.h | 3 ++- include/linux/filter.h | 5 +++++ kernel/bpf/core.c | 9 +++++++-- kernel/bpf/dispatcher.c | 27 +++++++++++++++++++++------ 5 files changed, 43 insertions(+), 17 deletions(-)
arch/x86/net/bpf_jit_comp.c +8 -8
@@ -2209,7 +2209,7 @@ int arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, void *image, void *ireturn ret; } -static int emit_bpf_dispatcher (u8 **pprog,int a,int b,s64 *progs) +static int emit_bpf_dispatcher (u8 **pprog,int a,int b,s64 *progs,u8 *image,u8 *buf) {u8 *jg_reloc, *prog = *pprog;int pivot, err, jg_bytes =1 ;
@@ -2225,12 +2225,12 @@ static int emit_bpf_dispatcher(u8 **pprog, int a, int b, s64 *progs)EMIT2_off32 (0x81 ,add_1reg (0xF8 ,BPF_REG_3 ), progs[a]); err =emit_cond_near_jump (&prog,/* je func */ - (void *)progs[a], prog, + (void *)progs[a], image + (prog - buf),X86_JE );if (err)return err; -emit_indirect_jump (&prog,2 /* rdx */ , prog); +emit_indirect_jump (&prog,2 /* rdx */ , image + (prog - buf)); *pprog = prog;return 0 ;
@@ -2255,7 +2255,7 @@ static int emit_bpf_dispatcher(u8 **pprog, int a, int b, s64 *progs) jg_reloc = prog; err =emit_bpf_dispatcher (&prog, a, a + pivot,/* emit lower_part */ - progs); + progs, image, buf);if (err)return err;
@@ -2269,7 +2269,7 @@ static int emit_bpf_dispatcher(u8 **pprog, int a, int b, s64 *progs)emit_code (jg_reloc - jg_bytes, jg_offset, jg_bytes); err =emit_bpf_dispatcher (&prog, a + pivot +1 ,/* emit upper_part */ - b, progs); + b, progs, image, buf);if (err)return err;
@@ -2289,12 +2289,12 @@ static int cmp_ips(const void *a, const void *b)return 0 ; } -int arch_prepare_bpf_dispatcher (void *image,s64 *funcs,int num_funcs) +int arch_prepare_bpf_dispatcher (void *image,void *buf,s64 *funcs,int num_funcs) { -u8 *prog = image; +u8 *prog = buf;sort (funcs, num_funcs,sizeof (funcs[0 ]), cmp_ips,NULL ); -return emit_bpf_dispatcher (&prog,0 , num_funcs -1 , funcs); +return emit_bpf_dispatcher (&prog,0 , num_funcs -1 , funcs, image, buf); }struct x64_jit_data {
include/linux/bpf.h +2 -1
@@ -891,6 +891,7 @@ struct bpf_dispatcher {struct bpf_dispatcher_prog progs[BPF_DISPATCHER_MAX ];int num_progs;void *image; +void *rw_image;u32 image_off;struct bpf_ksym ksym; };
@@ -909,7 +910,7 @@ int bpf_trampoline_unlink_prog(struct bpf_tramp_link *link, struct bpf_trampolinstruct bpf_trampoline *bpf_trampoline_get (u64 key,struct bpf_attach_target_info *tgt_info);void bpf_trampoline_put (struct bpf_trampoline *tr); -int arch_prepare_bpf_dispatcher (void *image,s64 *funcs,int num_funcs); +int arch_prepare_bpf_dispatcher (void *image,void *buf,s64 *funcs,int num_funcs);#define BPF_DISPATCHER_INIT (_name) { \ .mutex = __MUTEX_INITIALIZER(_name.mutex), \ .func = &_name##_func, \
include/linux/filter.h +5 -0
@@ -1018,6 +1018,8 @@ extern long bpf_jit_limit_max;typedef void (*bpf_jit_fill_hole_t )(void *area,unsigned int size); +void bpf_jit_fill_hole_with_zero (void *area,unsigned int size); +struct bpf_binary_header * bpf_jit_binary_alloc(unsigned int proglen, u8 **image_ptr, unsigned int alignment,
@@ -1030,6 +1032,9 @@ void bpf_jit_free(struct bpf_prog *fp);struct bpf_binary_header *bpf_jit_binary_pack_hdr (const struct bpf_prog *fp); +void *bpf_prog_pack_alloc (u32 size,bpf_jit_fill_hole_t bpf_fill_ill_insns); +void bpf_prog_pack_free (struct bpf_binary_header *hdr); +static inline bool bpf_prog_kallsyms_verify_off (const struct bpf_prog *fp) { return list_empty(&fp->aux->ksym.lnode) ||
kernel/bpf/core.c +7 -2
@@ -825,6 +825,11 @@ struct bpf_prog_pack {unsigned long bitmap[]; }; +void bpf_jit_fill_hole_with_zero (void *area,unsigned int size) +{ +memset (area,0 , size); +} +#define BPF_PROG_SIZE_TO_NBITS (size) (round_up(size, BPF_PROG_CHUNK_SIZE) / BPF_PROG_CHUNK_SIZE)static DEFINE_MUTEX (pack_mutex);
@@ -864,7 +869,7 @@ static struct bpf_prog_pack *alloc_new_pack(bpf_jit_fill_hole_t bpf_fill_ill_insreturn pack; } -static void *bpf_prog_pack_alloc (u32 size,bpf_jit_fill_hole_t bpf_fill_ill_insns) +void *bpf_prog_pack_alloc (u32 size,bpf_jit_fill_hole_t bpf_fill_ill_insns) {unsigned int nbits =BPF_PROG_SIZE_TO_NBITS (size);struct bpf_prog_pack *pack;
@@ -905,7 +910,7 @@ static void *bpf_prog_pack_alloc(u32 size, bpf_jit_fill_hole_t bpf_fill_ill_insnreturn ptr; } -static void bpf_prog_pack_free (struct bpf_binary_header *hdr) +void bpf_prog_pack_free (struct bpf_binary_header *hdr) {struct bpf_prog_pack *pack =NULL , *tmp;unsigned int nbits;
kernel/bpf/dispatcher.c +21 -6
@@ -85,12 +85,12 @@ static bool bpf_dispatcher_remove_prog(struct bpf_dispatcher *d,return false; } -int __weak arch_prepare_bpf_dispatcher (void *image,s64 *funcs,int num_funcs) +int __weak arch_prepare_bpf_dispatcher (void *image,void *buf,s64 *funcs,int num_funcs) {return -ENOTSUPP ; } -static int bpf_dispatcher_prepare (struct bpf_dispatcher *d,void *image) +static int bpf_dispatcher_prepare (struct bpf_dispatcher *d,void *image,void *buf) {s64 ips[BPF_DISPATCHER_MAX ] = {}, *ipsp = &ips[0 ];int i;
@@ -99,12 +99,12 @@ static int bpf_dispatcher_prepare(struct bpf_dispatcher *d, void *image)if (d->progs[i].prog) *ipsp++ = (s64 )(uintptr_t )d->progs[i].prog->bpf_func; } -return arch_prepare_bpf_dispatcher (image, &ips[0 ], d->num_progs); +return arch_prepare_bpf_dispatcher (image, buf, &ips[0 ], d->num_progs); }static void bpf_dispatcher_update (struct bpf_dispatcher *d,int prev_num_progs) { -void *old, *new; +void *old, *new, *tmp;u32 noff;int err;
@@ -117,8 +117,14 @@ static void bpf_dispatcher_update(struct bpf_dispatcher *d, int prev_num_progs) } new = d->num_progs ? d->image + noff :NULL ; + tmp = d->num_progs ? d->rw_image + noff :NULL ;if (new) { -if (bpf_dispatcher_prepare (d, new)) +/* Prepare the dispatcher in d->rw_image. Then use +* bpf_arch_text_copy to update d->image, which is RO+X. +*/ +if (bpf_dispatcher_prepare (d, new, tmp)) +return ; +if (IS_ERR (bpf_arch_text_copy (new, tmp,PAGE_SIZE /2 )))return ; }
@@ -140,9 +146,18 @@ void bpf_dispatcher_change_prog(struct bpf_dispatcher *d, struct bpf_prog *from,mutex_lock (&d->mutex);if (!d->image) { - d->image =bpf_jit_alloc_exec_page (); + d->image =bpf_prog_pack_alloc (PAGE_SIZE , bpf_jit_fill_hole_with_zero);if (!d->image) goto out; + d->rw_image =bpf_jit_alloc_exec (PAGE_SIZE ); +if (!d->rw_image) { +u32 size =PAGE_SIZE ; + +bpf_arch_text_copy (d->image, &size,sizeof (size)); +bpf_prog_pack_free ((struct bpf_binary_header *)d->image); + d->image =NULL ; + goto out; + }bpf_image_ksym_add (d->image, &d->ksym); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 723/862 Bluetooth: L2CAP: Fix user-after-free
In reply to Greg Kroah-HartmanFrom: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 35fcbc4243aad7e7d020b7c1dfb14bb888b20a4f ]
This uses l2cap_chan_hold_unless_zero() after calling __l2cap_get_chan_blah() to prevent the following trace:
Bluetooth: l2cap_core.c:static void l2cap_chan_destroy(struct kref *kref)
Bluetooth: chan 0000000023c4974d
Bluetooth: parent 00000000ae861c08
==================================================================
BUG: KASAN: use-after-free in __mutex_waiter_is_first kernel/locking/mutex.c:191 [inline] BUG: KASAN: use-after-free in __mutex_lock_common kernel/locking/mutex.c:671 [inline] BUG: KASAN: use-after-free in __mutex_lock+0x278/0x400 kernel/locking/mutex.c:729 Read of size 8 at addr ffff888006a49b08 by task kworker/u3:2/389
--- net/bluetooth/l2cap_core.c | 7 +++++++ 1 file changed, 7 insertions(+)
net/bluetooth/l2cap_core.c +7 -0
@@ -4309,6 +4309,12 @@ static int l2cap_connect_create_rsp(struct l2cap_conn *conn, } } + chan =l2cap_chan_hold_unless_zero (chan); +if (!chan) { + err = -EBADSLT ; + goto unlock; + } + err =0 ;l2cap_chan_lock (chan);
@@ -4338,6 +4344,7 @@ static int l2cap_connect_create_rsp(struct l2cap_conn *conn, }l2cap_chan_unlock (chan); +l2cap_chan_put (chan); unlock:mutex_unlock (&conn->chan_lock);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 724/862 net: sched: cls_u32: Avoid memcpy() false-positive warning
In reply to Greg Kroah-HartmanFrom: Kees Cook <[email protected]>
[ Upstream commit 7cba18332e3635aaae60e4e7d4e52849de50d91b ]
To work around a misbehavior of the compiler's ability to see into composite flexible array structs (as detailed in the coming memcpy() hardening series[1]), use unsafe_memcpy(), as the sizing, bounds-checking, and allocation are all very tightly coupled here. This silences the false-positive reported by syzbot:
memcpy: detected field-spanning write (size 80) of single field "&n->sel" at net/sched/cls_u32.c:1043 (size 16)
[1] https://lore.kernel.org/linux-hardening/[email protected]
--- net/sched/cls_u32.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
net/sched/cls_u32.c +5 -1
@@ -1040,7 +1040,11 @@ static int u32_change(struct net *net, struct sk_buff *in_skb, }#endif -memcpy (&n->sel, s, sel_size); +unsafe_memcpy (&n->sel, s, sel_size, +/* A composite flex-array structure destination, +* which was correctly sized with struct_size(), +* bounds-checked against nla_len(), and allocated + * above. */);RCU_INIT_POINTER (n->ht_up, ht); n->handle = handle; n->fshift = s->hmask ?ffs (ntohl (s->hmask)) -1 :0 ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 725/862 libbpf: Fix overrun in netlink attribute iteration
In reply to Greg Kroah-HartmanFrom: Xin Liu <[email protected]>
[ Upstream commit 51e05a8cf8eb34da7473823b7f236a77adfef0b4 ]
I accidentally found that a change in commit 1045b03e07d8 ("netlink: fix overrun in attribute iteration") was not synchronized to the function nla_ok in tools/lib/bpf/nlattr.c, I think it is necessary to modify, this patch will do it.
--- tools/lib/bpf/nlattr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/lib/bpf/nlattr.c +1 -1
@@ -32,7 +32,7 @@ static struct nlattr *nla_next(const struct nlattr *nla, int *remaining)static int nla_ok (const struct nlattr *nla,int remaining) { -return remaining >=sizeof (*nla) && +return remaining >= (int )sizeof (*nla) && nla->nla_len >=sizeof (*nla) && nla->nla_len <= remaining; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 726/862 i2c: designware-pci: Group AMD NAVI quirk parts together
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
[ Upstream commit 65769162ae4b7f2d82e54998be446226b05fcd8f ]
The code is ogranized in a way that all related parts to the certain platform quirk go together. This is not the case for AMD NAVI. Shuffle code to make it happen.
While at it, drop the frequency definition and use hard coded value as it's done for other platforms and add a comment to the PCI ID list.
--- drivers/i2c/busses/i2c-designware-pcidrv.c | 30 +++++++++++----------- 1 file changed, 15 insertions(+), 15 deletions(-)
drivers/i2c/busses/i2c-designware-pcidrv.c +15 -15
@@ -27,7 +27,6 @@#include "i2c-ccgx-ucsi.h" #define DRIVER_NAME "i2c-designware-pci" -#define AMD_CLK_RATE_HZ 100000enum dw_pci_ctl_id_t { medfield,
@@ -100,11 +99,6 @@ static u32 mfld_get_clk_rate_khz(struct dw_i2c_dev *dev)return 25000 ; } -static u32 navi_amd_get_clk_rate_khz (struct dw_i2c_dev *dev) -{ -return AMD_CLK_RATE_HZ ; -} -static int mfld_setup (struct pci_dev *pdev,struct dw_pci_controller *c) {struct dw_i2c_dev *dev =dev_get_drvdata (&pdev->dev);
@@ -126,15 +120,6 @@ static int mfld_setup(struct pci_dev *pdev, struct dw_pci_controller *c)return -ENODEV ; } -static int navi_amd_setup (struct pci_dev *pdev,struct dw_pci_controller *c) -{ -struct dw_i2c_dev *dev =dev_get_drvdata (&pdev->dev); - - dev->flags |=MODEL_AMD_NAVI_GPU ; - dev->timings.bus_freq_hz =I2C_MAX_STANDARD_MODE_FREQ ; -return 0 ; -} -static int mrfld_setup (struct pci_dev *pdev,struct dw_pci_controller *c) {/*
@@ -159,6 +144,20 @@ static u32 ehl_get_clk_rate_khz(struct dw_i2c_dev *dev)return 100000 ; } +static u32 navi_amd_get_clk_rate_khz (struct dw_i2c_dev *dev) +{ +return 100000 ; +} + +static int navi_amd_setup (struct pci_dev *pdev,struct dw_pci_controller *c) +{ +struct dw_i2c_dev *dev =dev_get_drvdata (&pdev->dev); + + dev->flags |=MODEL_AMD_NAVI_GPU ; + dev->timings.bus_freq_hz =I2C_MAX_STANDARD_MODE_FREQ ; +return 0 ; +} +static struct dw_pci_controller dw_pci_controllers[] = { [medfield] = { .bus_num =-1 ,
@@ -389,6 +388,7 @@ static const struct pci_device_id i2_designware_pci_ids[] = { { PCI_VDEVICE(INTEL, 0x4bbe), elkhartlake }, { PCI_VDEVICE(INTEL, 0x4bbf), elkhartlake }, { PCI_VDEVICE(INTEL, 0x4bc0), elkhartlake }, +/* AMD NAVI */ { PCI_VDEVICE(ATI, 0x7314), navi_amd }, { PCI_VDEVICE(ATI, 0x73a4), navi_amd }, { PCI_VDEVICE(ATI, 0x73e4), navi_amd },
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 727/862 r8152: Rate limit overflow messages
In reply to Greg Kroah-HartmanFrom: Andrew Gaul <[email protected]>
[ Upstream commit 93e2be344a7db169b7119de21ac1bf253b8c6907 ]
My system shows almost 10 million of these messages over a 24-hour period which pollutes my logs.
--- drivers/net/usb/r8152.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/usb/r8152.c +3 -1
@@ -1874,7 +1874,9 @@ static void intr_callback(struct urb *urb) "Stop submitting intr, status %d\n", status);return ;case -EOVERFLOW : -netif_info (tp, intr, tp->netdev,"intr status -EOVERFLOW\n" ); +if (net_ratelimit ()) +netif_info (tp, intr, tp->netdev, +"intr status -EOVERFLOW\n" ); goto resubmit;/* -EPIPE: should clear the halt */ default :
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 728/862 drm/nouveau/nouveau_bo: fix potential memory leak in nouveau_bo_alloc()
In reply to Greg Kroah-HartmanFrom: Jianglei Nie <[email protected]>
[ Upstream commit 6dc548745d5b5102e3c53dc5097296ac270b6c69 ]
nouveau_bo_alloc() allocates a memory chunk for "nvbo" with kzalloc(). When some error occurs, "nvbo" should be released. But when WARN_ON(pi < 0)) equals true, the function return ERR_PTR without releasing the "nvbo", which will lead to a memory leak.
We should release the "nvbo" with kfree() if WARN_ON(pi < 0)) equals true.
--- drivers/gpu/drm/nouveau/nouveau_bo.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/nouveau/nouveau_bo.c +3 -1
@@ -281,8 +281,10 @@ nouveau_bo_alloc(struct nouveau_cli *cli, u64 *size, int *align, u32 domain,break ; } -if (WARN_ON (pi <0 )) +if (WARN_ON (pi <0 )) { +kfree (nvbo);return ERR_PTR (-EINVAL ); + }/* Disable compression if suitable settings couldn't be found. */ if (nvbo->comp && !vmm->page[pi].comp) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 729/862 drm: Use size_t type for len variable in drm_copy_field()
In reply to Greg Kroah-HartmanFrom: Javier Martinez Canillas <[email protected]>
[ Upstream commit 94dc3471d1b2b58b3728558d0e3f264e9ce6ff59 ]
The strlen() function returns a size_t which is an unsigned int on 32-bit arches and an unsigned long on 64-bit arches. But in the drm_copy_field() function, the strlen() return value is assigned to an 'int len' variable.
Later, the len variable is passed as copy_from_user() third argument that is an unsigned long parameter as well.
In theory, this can lead to an integer overflow via type conversion. Since the assignment happens to a signed int lvalue instead of a size_t lvalue.
In practice though, that's unlikely since the values copied are set by DRM drivers and not controlled by userspace. But using a size_t for len is the correct thing to do anyways.
--- drivers/gpu/drm/drm_ioctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/drm_ioctl.c +1 -1
@@ -472,7 +472,7 @@ EXPORT_SYMBOL(drm_invalid_op);*/ static int drm_copy_field (char __user *buf,size_t *buf_len,const char *value) { -int len; +size_t len;/* don't overflow userbuf */ len =strlen (value);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 730/862 drm: Prevent drm_copy_field() to attempt copying a NULL pointer
In reply to Greg Kroah-HartmanFrom: Javier Martinez Canillas <[email protected]>
[ Upstream commit f6ee30407e883042482ad4ad30da5eaba47872ee ]
There are some struct drm_driver fields that are required by drivers since drm_copy_field() attempts to copy them to user-space via DRM_IOCTL_VERSION.
But it can be possible that a driver has a bug and did not set some of the fields, which leads to drm_copy_field() attempting to copy a NULL pointer:
[ +10.395966] Unable to handle kernel access to user memory outside uaccess routines at virtual address 0000000000000000
[ +0.010955] Mem abort info: [ +0.002835] ESR = 0x0000000096000004 [ +0.003872] EC = 0x25: DABT (current EL), IL = 32 bits [ +0.005395] SET = 0, FnV = 0 [ +0.003113] EA = 0, S1PTW = 0 [ +0.003182] FSC = 0x04: level 0 translation fault [ +0.004964] Data abort info: [ +0.002919] ISV = 0, ISS = 0x00000004 [ +0.003886] CM = 0, WnR = 0 [ +0.003040] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000115dad000 [ +0.006536] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 [ +0.006925] Internal error: Oops: 96000004 [#1] SMP ... [ +0.011113] pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ +0.007061] pc : __pi_strlen+0x14/0x150 [ +0.003895] lr : drm_copy_field+0x30/0x1a4 [ +0.004156] sp : ffff8000094b3a50 [ +0.003355] x29: ffff8000094b3a50 x28: ffff8000094b3b70 x27: 0000000000000040 [ +0.007242] x26: ffff443743c2ba00 x25: 0000000000000000 x24: 0000000000000040 [ +0.007243] x23: ffff443743c2ba00 x22: ffff8000094b3b70 x21: 0000000000000000 [ +0.007241] x20: 0000000000000000 x19: ffff8000094b3b90 x18: 0000000000000000 [ +0.007241] x17: 0000000000000000 x16: 0000000000000000 x15: 0000aaab14b9af40 [ +0.007241] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 [ +0.007239] x11: 0000000000000000 x10: 0000000000000000 x9 : ffffa524ad67d4d8 [ +0.007242] x8 : 0101010101010101 x7 : 7f7f7f7f7f7f7f7f x6 : 6c6e6263606e7141 [ +0.007239] x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 [ +0.007241] x2 : 0000000000000000 x1 : ffff8000094b3b90 x0 : 0000000000000000 [ +0.007240] Call trace: [ +0.002475] __pi_strlen+0x14/0x150 [ +0.003537] drm_version+0x84/0xac [ +0.003448] drm_ioctl_kernel+0xa8/0x16c [ +0.003975] drm_ioctl+0x270/0x580 [ +0.003448] __arm64_sys_ioctl+0xb8/0xfc [ +0.003978] invoke_syscall+0x78/0x100 [ +0.003799] el0_svc_common.constprop.0+0x4c/0xf4 [ +0.004767] do_el0_svc+0x38/0x4c [ +0.003357] el0_svc+0x34/0x100 [ +0.003185] el0t_64_sync_handler+0x11c/0x150 [ +0.004418] el0t_64_sync+0x190/0x194 [ +0.003716] Code: 92402c04 b200c3e8 f13fc09f 5400088c (a9400c02) [ +0.006180] ---[ end trace 0000000000000000 ]---
--- drivers/gpu/drm/drm_ioctl.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/gpu/drm/drm_ioctl.c +6 -0
@@ -474,6 +474,12 @@ static int drm_copy_field(char __user *buf, size_t *buf_len, const char *value) {size_t len; +/* don't attempt to copy a NULL pointer */ +if (WARN_ONCE (!value,"BUG: the value to copy was not set!" )) { + *buf_len =0 ; +return 0 ; + } +/* don't overflow userbuf */ len =strlen (value);if (len > *buf_len)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 731/862 drm/komeda: Fix handling of atomic commits in the atomic_commit_tail hook
In reply to Greg Kroah-HartmanFrom: Liviu Dudau <[email protected]>
[ Upstream commit eaa225b6b52233d45457fd33730e1528c604d92d ]
Komeda driver relies on the generic DRM atomic helper functions to handle commits. It only implements an atomic_commit_tail hook for the mode_config_helper_funcs and even that one is pretty close to the generic implementation with the exception of additional dma_fence signalling.
What the generic helper framework doesn't do is waiting for the actual hardware to signal that the commit parameters have been written into the appropriate registers. As we signal CRTC events only on the irq handlers, we need to flush the configuration and wait for the hardware to respond.
Add the Komeda specific implementation for atomic_commit_hw_done() that flushes and waits for flip done before calling drm_atomic_helper_commit_hw_done().
The fix was prompted by a patch from Carsten Haitzler where he was trying to solve the same issue but in a different way that I think can lead to wrong event signaling to userspace.
--- .../gpu/drm/arm/display/komeda/komeda_crtc.c | 4 ++-- .../gpu/drm/arm/display/komeda/komeda_kms.c | 21 ++++++++++++++++++- .../gpu/drm/arm/display/komeda/komeda_kms.h | 2 ++ 3 files changed, 24 insertions(+), 3 deletions(-)
drivers/gpu/drm/arm/display/komeda/komeda_crtc.c +2 -2
@@ -235,7 +235,7 @@ void komeda_crtc_handle_event(struct komeda_crtc *kcrtc, crtc->state->event =NULL ;drm_crtc_send_vblank_event (crtc, event); }else { -DRM_WARN ("CRTC[%d]: FLIP happen but no pending commit.\n" , +DRM_WARN ("CRTC[%d]: FLIP happened but no pending commit.\n" ,drm_crtc_index (&kcrtc->base)); }spin_unlock_irqrestore (&crtc->dev->event_lock, flags);
@@ -286,7 +286,7 @@ komeda_crtc_atomic_enable(struct drm_crtc *crtc,komeda_crtc_do_flush (crtc, old); } -static void +void komeda_crtc_flush_and_wait_for_flip_done (struct komeda_crtc *kcrtc,struct completion *input_flip_done) {
drivers/gpu/drm/arm/display/komeda/komeda_kms.c +20 -1
@@ -69,6 +69,25 @@ static const struct drm_driver komeda_kms_driver = { .minor = 1, }; +static void komeda_kms_atomic_commit_hw_done (struct drm_atomic_state *state) +{ +struct drm_device *dev = state->dev; +struct komeda_kms_dev *kms =to_kdev (dev); +int i; + +for (i =0 ; i < kms->n_crtcs; i++) { +struct komeda_crtc *kcrtc = &kms->crtcs[i]; + +if (kcrtc->base.state->active) { +struct completion *flip_done =NULL ; +if (kcrtc->base.state->event) + flip_done = kcrtc->base.state->event->base.completion; +komeda_crtc_flush_and_wait_for_flip_done (kcrtc, flip_done); + } + } +drm_atomic_helper_commit_hw_done (state); +} +static void komeda_kms_commit_tail (struct drm_atomic_state *old_state) {struct drm_device *dev = old_state->dev;
@@ -81,7 +100,7 @@ static void komeda_kms_commit_tail(struct drm_atomic_state *old_state)drm_atomic_helper_commit_modeset_enables (dev, old_state); -drm_atomic_helper_commit_hw_done (old_state); +komeda_kms_atomic_commit_hw_done (old_state);drm_atomic_helper_wait_for_flip_done (dev, old_state);
drivers/gpu/drm/arm/display/komeda/komeda_kms.h +2 -0
@@ -183,6 +183,8 @@ void komeda_kms_cleanup_private_objs(struct komeda_kms_dev *kms);void komeda_crtc_handle_event (struct komeda_crtc *kcrtc,struct komeda_events *evts); +void komeda_crtc_flush_and_wait_for_flip_done (struct komeda_crtc *kcrtc, +struct completion *input_flip_done);struct komeda_kms_dev *komeda_kms_attach (struct komeda_dev *mdev);void komeda_kms_detach (struct komeda_kms_dev *kms);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 732/862 gpu: lontium-lt9611: Fix NULL pointer dereference in lt9611_connector_init()
In reply to Greg Kroah-HartmanFrom: Zeng Jingxiang <[email protected]>
[ Upstream commit ef8886f321c5dab8124b9153d25afa2a71d05323 ]
A NULL check for bridge->encoder shows that it may be NULL, but it already been dereferenced on all paths leading to the check.
812 if (!bridge->encoder) {
Dereference the pointer bridge->encoder.
810 drm_connector_attach_encoder(<9611->connector, bridge->encoder);
--- drivers/gpu/drm/bridge/lontium-lt9611.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/bridge/lontium-lt9611.c +2 -1
@@ -813,13 +813,14 @@ static int lt9611_connector_init(struct drm_bridge *bridge, struct lt9611 *lt961drm_connector_helper_add (<9611->connector, <9611_bridge_connector_helper_funcs); -drm_connector_attach_encoder (<9611->connector, bridge->encoder);if (!bridge->encoder) {DRM_ERROR ("Parent encoder object not found" );return -ENODEV ; } +drm_connector_attach_encoder (<9611->connector, bridge->encoder); +return 0 ; }
Signature · 1 line
2.35.1
Quoted 7 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.0.3 release. There are 862 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 21 Oct 2022 08:30:19 +0000. Anything received after that time might be too late.
Hi Greg,
6.0.3-rc1 tested.
Run tested on:
- Intel Alder Lake x86_64 (nuc12 i7-1260P)
In addition - build tested for:
- Allwinner A64
- Allwinner H3
- Allwinner H5
- Allwinner H6
- NXP iMX6
- NXP iMX8
- Qualcomm Dragonboard
- Rockchip RK3288
- Rockchip RK3328
- Rockchip RK3399pro
- Samsung Exynos5422
--
Rudi
Greg Kroah-Hartman
maintainerPATCH 733/862 drm/amd/display: fix overflow on MIN_I64 definition
In reply to Greg Kroah-HartmanFrom: David Gow <[email protected]>
[ Upstream commit 6ae0632d17759852c07e2d1e0a31c728eb6ba246 ]
The definition of MIN_I64 in bw_fixed.c can cause gcc to whinge about integer overflow, because it is treated as a positive value, which is then negated. The temporary positive value is not necessarily representable.
This causes the following warning:../drivers/gpu/drm/amd/amdgpu/../display/dc/dml/calcs/bw_fixed.c:30:19:
warning: integer overflow in expression ‘-9223372036854775808’ of type ‘long long int’ results in ‘-9223372036854775808’ [-Woverflow]
30 | (int64_t)(-(1LL << 63))
| ^
Writing out (-MAX_I64 - 1) works instead.
--- drivers/gpu/drm/amd/display/dc/dml/calcs/bw_fixed.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/display/dc/dml/calcs/bw_fixed.c +3 -3
@@ -26,12 +26,12 @@#include "bw_fixed.h" -#define MIN_I64 \ - (int64_t)(-(1LL << 63)) -#define MAX_I64 \ (int64_t)((1ULL << 63) - 1) +#define MIN_I64 \ + (-MAX_I64 - 1) +#define FRACTIONAL_PART_MASK \ ((1ULL << BW_FIXED_BITS_PER_FRACTIONAL_PART) - 1)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 734/862 ALSA: hda: Fix page fault in snd_hda_codec_shutdown()
In reply to Greg Kroah-HartmanFrom: Cezary Rojewski <[email protected]>
[ Upstream commit f2bd1c5ae2cb0cf9525c9bffc0038c12dd7e1338 ]
If early probe of HDAudio bus driver fails e.g.: due to missing firmware file, snd_hda_codec_shutdown() ends in manipulating uninitialized codec->pcm_list_head causing page fault.
Initialization of HDAudio codec in ASoC is split in two:
- snd_hda_codec_device_init()
- snd_hda_codec_device_new()
snd_hda_codec_device_init() is called during probe_codecs() by HDAudio bus driver while snd_hda_codec_device_new() is called by codec-component's ->probe(). The second call will not happen until all components required by related sound card are present within the ASoC framework. With firmware failing to load during the PCI's deferred initialization i.e.: probe_work(), no platform components are ever registered. HDAudio codec enumeration is done at that point though, so the codec components became registered to ASoC framework, calling snd_hda_codec_device_init() in the process.
Now, during platform reboot snd_hda_codec_shutdown() is called for every codec found on the HDAudio bus causing oops if any of them has not completed both of their initialization steps. Relocating field initialization fixes the issue.
--- sound/pci/hda/hda_codec.c | 41 +++++++++++++++++++-------------------- 1 file changed, 20 insertions(+), 21 deletions(-)
sound/pci/hda/hda_codec.c +20 -21
@@ -931,8 +931,28 @@ snd_hda_codec_device_init(struct hda_bus *bus, unsigned int codec_addr, } codec->bus = bus; + codec->depop_delay =-1 ; + codec->fixup_id =HDA_FIXUP_ID_NOT_SET ; + codec->core.dev.release = snd_hda_codec_dev_release; + codec->core.exec_verb = codec_exec_verb; codec->core.type =HDA_DEV_LEGACY ; +mutex_init (&codec->spdif_mutex); +mutex_init (&codec->control_mutex); +snd_array_init (&codec->mixers,sizeof (struct hda_nid_item ),32 ); +snd_array_init (&codec->nids,sizeof (struct hda_nid_item ),32 ); +snd_array_init (&codec->init_pins,sizeof (struct hda_pincfg ),16 ); +snd_array_init (&codec->driver_pins,sizeof (struct hda_pincfg ),16 ); +snd_array_init (&codec->cvt_setups,sizeof (struct hda_cvt_setup ),8 ); +snd_array_init (&codec->spdif_out,sizeof (struct hda_spdif_out ),16 ); +snd_array_init (&codec->jacktbl,sizeof (struct hda_jack_tbl ),16 ); +snd_array_init (&codec->verbs,sizeof (struct hda_verb *),8 ); +INIT_LIST_HEAD (&codec->conn_list); +INIT_LIST_HEAD (&codec->pcm_list_head); +INIT_DELAYED_WORK (&codec->jackpoll_work, hda_jackpoll_work); +refcount_set (&codec->pcm_ref,1 ); +init_waitqueue_head (&codec->remove_sleep); +return codec; }EXPORT_SYMBOL_GPL (snd_hda_codec_device_init);
@@ -985,29 +1005,8 @@ int snd_hda_codec_device_new(struct hda_bus *bus, struct snd_card *card,if (snd_BUG_ON (codec_addr >HDA_MAX_CODEC_ADDRESS ))return -EINVAL ; - codec->core.dev.release = snd_hda_codec_dev_release; - codec->core.exec_verb = codec_exec_verb; - codec->card = card; codec->addr = codec_addr; -mutex_init (&codec->spdif_mutex); -mutex_init (&codec->control_mutex); -snd_array_init (&codec->mixers,sizeof (struct hda_nid_item ),32 ); -snd_array_init (&codec->nids,sizeof (struct hda_nid_item ),32 ); -snd_array_init (&codec->init_pins,sizeof (struct hda_pincfg ),16 ); -snd_array_init (&codec->driver_pins,sizeof (struct hda_pincfg ),16 ); -snd_array_init (&codec->cvt_setups,sizeof (struct hda_cvt_setup ),8 ); -snd_array_init (&codec->spdif_out,sizeof (struct hda_spdif_out ),16 ); -snd_array_init (&codec->jacktbl,sizeof (struct hda_jack_tbl ),16 ); -snd_array_init (&codec->verbs,sizeof (struct hda_verb *),8 ); -INIT_LIST_HEAD (&codec->conn_list); -INIT_LIST_HEAD (&codec->pcm_list_head); -refcount_set (&codec->pcm_ref,1 ); -init_waitqueue_head (&codec->remove_sleep); - -INIT_DELAYED_WORK (&codec->jackpoll_work, hda_jackpoll_work); - codec->depop_delay =-1 ; - codec->fixup_id =HDA_FIXUP_ID_NOT_SET ;#ifdef CONFIG_PM codec->power_jiffies = jiffies;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 735/862 ALSA: usb-audio: Add quirk to enable Avid Mbox 3 support
In reply to Greg Kroah-HartmanFrom: Conner Knox <[email protected]>
[ Upstream commit b01104fc62b6194c852124f6c6df1c0a5c031fc1 ]
Add support for Avid Mbox3 USB audio interface at 48kHz
--- sound/usb/quirks-table.h | 76 ++++++++++ sound/usb/quirks.c | 302 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 378 insertions(+)
sound/usb/quirks-table.h +76 -0
@@ -2985,6 +2985,82 @@ YAMAHA_DEVICE(0x7010, "UB99"), } } }, +/* DIGIDESIGN MBOX 3 */ +{ + USB_DEVICE(0x0dba, 0x5000), + .driver_info = (unsigned long ) &(const struct snd_usb_audio_quirk ) { + .vendor_name ="Digidesign" , + .product_name ="Mbox 3" , + .ifnum =QUIRK_ANY_INTERFACE , + .type =QUIRK_COMPOSITE , + .data = (const struct snd_usb_audio_quirk []) { + { + .ifnum =0 , + .type =QUIRK_IGNORE_INTERFACE + }, + { + .ifnum =1 , + .type =QUIRK_IGNORE_INTERFACE + }, + { + .ifnum =2 , + .type =QUIRK_AUDIO_FIXED_ENDPOINT , + .data = &(const struct audioformat ) { + .formats =SNDRV_PCM_FMTBIT_S24_3LE , + .channels =4 , + .iface =2 , + .altsetting =1 , + .altset_idx =1 , + .attributes =0x00 , + .endpoint =0x01 , + .ep_attr =USB_ENDPOINT_XFER_ISOC | +USB_ENDPOINT_SYNC_ASYNC , + .rates =SNDRV_PCM_RATE_48000 , + .rate_min =48000 , + .rate_max =48000 , + .nr_rates =1 , + .rate_table = (unsigned int []) { +48000 + } + } + }, + { + .ifnum =3 , + .type =QUIRK_AUDIO_FIXED_ENDPOINT , + .data = &(const struct audioformat ) { + .formats =SNDRV_PCM_FMTBIT_S24_3LE , + .channels =4 , + .iface =3 , + .altsetting =1 , + .altset_idx =1 , + .endpoint =0x81 , + .attributes =0x00 , + .ep_attr =USB_ENDPOINT_XFER_ISOC | +USB_ENDPOINT_SYNC_ASYNC , + .maxpacksize =0x009c , + .rates =SNDRV_PCM_RATE_48000 , + .rate_min =48000 , + .rate_max =48000 , + .nr_rates =1 , + .rate_table = (unsigned int []) { +48000 + } + } + }, + { + .ifnum =4 , + .type =QUIRK_MIDI_FIXED_ENDPOINT , + .data = &(const struct snd_usb_midi_endpoint_info ) { + .out_cables =0x0001 , + .in_cables =0x0001 + } + }, + { + .ifnum =-1 + } + } + } +}, {/* Tascam US122 MKII - playback-only support */ USB_DEVICE_VENDOR_SPEC(0x0644, 0x8021),
sound/usb/quirks.c +302 -0
314 lines not on this page · raw message
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 736/862 udmabuf: Set ubuf->sg = NULL if the creation of sg table fails
In reply to Greg Kroah-HartmanFrom: Vivek Kasireddy <[email protected]>
[ Upstream commit d9c04a1b7a15b5e74b2977461d9511e497f05d8f ]
When userspace tries to map the dmabuf and if for some reason (e.g. OOM) the creation of the sg table fails, ubuf->sg needs to be set to NULL. Otherwise, when the userspace subsequently closes the dmabuf fd, we'd try to erroneously free the invalid sg table from release_udmabuf resulting in the following crash reported by syzbot:
general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 0 PID: 3609 Comm: syz-executor487 Not tainted 5.19.0-syzkaller-13930-g7ebfc85e2cd7 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022 RIP: 0010:dma_unmap_sgtable include/linux/dma-mapping.h:378 [inline] RIP: 0010:put_sg_table drivers/dma-buf/udmabuf.c:89 [inline] RIP: 0010:release_udmabuf+0xcb/0x4f0 drivers/dma-buf/udmabuf.c:114 Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 2b 04 00 00 48 8d 7d 0c 4c 8b 63 30 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 e2 RSP: 0018:ffffc900037efd30 EFLAGS: 00010246 RAX: dffffc0000000000 RBX: ffffffff8cb67800 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff84ad27e0 RDI: 0000000000000000 RBP: fffffffffffffff4 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000000 R11: 000000000008c07c R12: ffff88801fa05000 R13: ffff888073db07e8 R14: ffff888025c25440 R15: 0000000000000000 FS: 0000555555fc4300(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fc1c0ce06e4 CR3: 00000000715e6000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> dma_buf_release+0x157/0x2d0 drivers/dma-buf/dma-buf.c:78 __dentry_kill+0x42b/0x640 fs/dcache.c:612 dentry_kill fs/dcache.c:733 [inline] dput+0x806/0xdb0 fs/dcache.c:913 __fput+0x39c/0x9d0 fs/file_table.c:333 task_work_run+0xdd/0x1a0 kernel/task_work.c:177 ptrace_notify+0x114/0x140 kernel/signal.c:2353 ptrace_report_syscall include/linux/ptrace.h:420 [inline] ptrace_report_syscall_exit include/linux/ptrace.h:482 [inline] syscall_exit_work kernel/entry/common.c:249 [inline] syscall_exit_to_user_mode_prepare+0x129/0x280 kernel/entry/common.c:276 __syscall_exit_to_user_mode_work kernel/entry/common.c:281 [inline] syscall_exit_to_user_mode+0x9/0x50 kernel/entry/common.c:294 do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fc1c0c35b6b Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24
0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44
RSP: 002b:00007ffd78a06090 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000007 RCX: 00007fc1c0c35b6b
RDX: 0000000020000280 RSI: 0000000040086200 RDI: 0000000000000006
RBP: 0000000000000007 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000293 R12: 000000000000000c
R13: 0000000000000003 R14: 00007fc1c0cfe4a0 R15: 00007ffd78a06140
</TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:dma_unmap_sgtable include/linux/dma-mapping.h:378 [inline] RIP: 0010:put_sg_table drivers/dma-buf/udmabuf.c:89 [inline] RIP: 0010:release_udmabuf+0xcb/0x4f0 drivers/dma-buf/udmabuf.c:114
--- drivers/dma-buf/udmabuf.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/dma-buf/udmabuf.c +6 -3
@@ -124,17 +124,20 @@ static int begin_cpu_udmabuf(struct dma_buf *buf, {struct udmabuf *ubuf = buf->priv;struct device *dev = ubuf->device->this_device; +int ret =0 ;if (!ubuf->sg) { ubuf->sg =get_sg_table (dev, buf, direction); -if (IS_ERR (ubuf->sg)) -return PTR_ERR (ubuf->sg); +if (IS_ERR (ubuf->sg)) { + ret =PTR_ERR (ubuf->sg); + ubuf->sg =NULL ; + } }else {dma_sync_sg_for_cpu (dev, ubuf->sg->sgl, ubuf->sg->nents, direction); } -return 0 ; +return ret; } static int end_cpu_udmabuf(struct dma_buf *buf,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 737/862 platform/x86: pmc_atom: Improve quirk message to be less cryptic
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
[ Upstream commit 32c9b75640aeb1b144f9e2963c1640f4cef7c6f2 ]
Not everyone can get what "critclks" means in the message, improve it to make less cryptic.
--- drivers/platform/x86/pmc_atom.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/platform/x86/pmc_atom.c +1 -1
@@ -354,7 +354,7 @@ static bool pmc_clk_is_critical = true;static int dmi_callback (const struct dmi_system_id *d) { -pr_info ("%s critclks quirk enabled\n" , d->ident); +pr_info ("%s: PMC critical clocks quirk enabled\n" , d->ident);return 1 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 738/862 drm/amd: fix potential memory leak
In reply to Greg Kroah-HartmanFrom: Bernard Zhao <[email protected]>
[ Upstream commit 6160216fd2c97107e8a9ab39863b056d677fcd85 ]
This patch fix potential memory leak (clk_src) when function run into last return NULL.
s/free/kfree/ - Alex
--- drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c +1 -0
@@ -1720,6 +1720,7 @@ static struct clock_source *dcn30_clock_source_create( }BREAK_TO_DEBUGGER (); +kfree (clk_src);return NULL ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 739/862 drm: bridge: dw_hdmi: only trigger hotplug event on link change
In reply to Greg Kroah-HartmanFrom: Lucas Stach <[email protected]>
[ Upstream commit da09daf881082266e4075657fac53c7966de8e4d ]
There are two events that signal a real change of the link state: HPD going high means the sink is newly connected or wants the source to re-read the EDID, RX sense going low is a indication that the link has been disconnected.
Ignore the other two events that also trigger interrupts, but don't need immediate attention: HPD going low does not necessarily mean the link has been lost and should not trigger a immediate read of the status. RX sense going high also does not require a detect cycle, as HPD going high is the right point in time to read the EDID.
--- drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
drivers/gpu/drm/bridge/synopsys/dw-hdmi.c +8 -5
@@ -3096,6 +3096,7 @@ static irqreturn_t dw_hdmi_irq(int irq, void *dev_id) {struct dw_hdmi *hdmi = dev_id;u8 intr_stat, phy_int_pol, phy_pol_mask, phy_stat; +enum drm_connector_status status = connector_status_unknown; intr_stat =hdmi_readb (hdmi,HDMI_IH_PHY_STAT0 ); phy_int_pol =hdmi_readb (hdmi,HDMI_PHY_POL0 );
@@ -3134,13 +3135,15 @@ static irqreturn_t dw_hdmi_irq(int irq, void *dev_id)cec_notifier_phys_addr_invalidate (hdmi->cec_notifier);mutex_unlock (&hdmi->cec_notifier_mutex); } - } -if (intr_stat &HDMI_IH_PHY_STAT0_HPD ) { -enum drm_connector_status status = phy_int_pol &HDMI_PHY_HPD - ? connector_status_connected - : connector_status_disconnected; +if (phy_stat &HDMI_PHY_HPD ) + status = connector_status_connected; + +if (!(phy_stat & (HDMI_PHY_HPD |HDMI_PHY_RX_SENSE ))) + status = connector_status_disconnected; + } +if (status != connector_status_unknown) {dev_dbg (hdmi->dev,"EVENT=%s\n" , status == connector_status_connected ?"plugin" :"plugout" );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 740/862 drm/amd/display: Fix variable dereferenced before check
In reply to Greg Kroah-HartmanFrom: sunliming <[email protected]>
[ Upstream commit 45a92f45f4578ff89da7dc5ef50bab4ef870f3b7 ]
Fixes the following smatch warning:
drivers/gpu/drm/amd/amdgpu/../display/dc/dc_dmub_srv.c:311 dc_dmub_srv_p_state_delegate()
warn: variable dereferenced before check 'dc' (see line 309)
--- drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c +3 -1
@@ -323,11 +323,13 @@ bool dc_dmub_srv_p_state_delegate(struct dc *dc, bool should_manage_pstate, strustruct dmub_cmd_fw_assisted_mclk_switch_config *config_data = &cmd.fw_assisted_mclk_switch.config_data;int i =0 ;int ramp_up_num_steps =1 ;// TODO: Ramp is currently disabled. Reenable it. -uint8_t visual_confirm_enabled = dc->debug.visual_confirm ==VISUAL_CONFIRM_FAMS ; +uint8_t visual_confirm_enabled;if (dc ==NULL )return false; + visual_confirm_enabled = dc->debug.visual_confirm ==VISUAL_CONFIRM_FAMS ; +// Format command. cmd.fw_assisted_mclk_switch.header.type =DMUB_CMD__FW_ASSISTED_MCLK_SWITCH ; cmd.fw_assisted_mclk_switch.header.sub_type =DMUB_CMD__FAMS_SETUP_FW_CTRL ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 741/862 drm/amdgpu: Skip the program of MMMC_VM_AGP_* in SRIOV on MMHUB v3_0_0
In reply to Greg Kroah-HartmanFrom: Yifan Zha <[email protected]>
[ Upstream commit c1026c6f319724dc88fc08d9d9d35bcbdf492b42 ]
[Why]
VF should not program these registers, the value were defined in the host.
[How]
Skip writing them in SRIOV environment and program them on host side.
--- drivers/gpu/drm/amd/amdgpu/mmhub_v3_0.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/gpu/drm/amd/amdgpu/mmhub_v3_0.c +5 -5
@@ -169,17 +169,17 @@ static void mmhub_v3_0_init_system_aperture_regs(struct amdgpu_device *adev)uint64_t value;uint32_t tmp; -/* Disable AGP. */ -WREG32_SOC15 (MMHUB ,0 , regMMMC_VM_AGP_BASE,0 ); -WREG32_SOC15 (MMHUB ,0 , regMMMC_VM_AGP_TOP,0 ); -WREG32_SOC15 (MMHUB ,0 , regMMMC_VM_AGP_BOT,0x00FFFFFF ); -if (!amdgpu_sriov_vf (adev)) {/* * the new L1 policy will block SRIOV guest from writing * these regs, and they will be programed at host. * so skip programing these regs. */ +/* Disable AGP. */ +WREG32_SOC15 (MMHUB ,0 , regMMMC_VM_AGP_BASE,0 ); +WREG32_SOC15 (MMHUB ,0 , regMMMC_VM_AGP_TOP,0 ); +WREG32_SOC15 (MMHUB ,0 , regMMMC_VM_AGP_BOT,0x00FFFFFF ); +/* Program the system aperture low logical page number. */ WREG32_SOC15 (MMHUB ,0 , regMMMC_VM_SYSTEM_APERTURE_LOW_ADDR, adev->gmc.vram_start >>18 );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 742/862 drm/admgpu: Skip CG/PG on SOC21 under SRIOV VF
In reply to Greg Kroah-HartmanFrom: Yifan Zha <[email protected]>
[ Upstream commit 828418259254863e0af5805bd712284e2bd88e3b ]
[Why]
There is no CG(Clock Gating)/PG(Power Gating) requirement on SRIOV VF. For multi VF, VF should not enable any CG/PG features.
For one VF, PF will program CG/PG related registers.
[How]
Do not set any cg/pg flag bit at early init under sriov.
--- drivers/gpu/drm/amd/amdgpu/soc21.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/gpu/drm/amd/amdgpu/soc21.c +4 -0
@@ -583,6 +583,10 @@ static int soc21_common_early_init(void *handle)AMD_PG_SUPPORT_JPEG |AMD_PG_SUPPORT_ATHUB |AMD_PG_SUPPORT_MMHUB ; +if (amdgpu_sriov_vf (adev)) { + adev->cg_flags =0 ; + adev->pg_flags =0 ; + } adev->external_rev_id = adev->rev_id +0x1 ;// TODO: need update break ;case IP_VERSION (11 ,0 ,2 ):
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 743/862 ALSA: usb-audio: Register card at the last interface
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
[ Upstream commit 6392dcd1d0c7034ccf630ec55fc9e5810ecadf3b ]
The USB-audio driver matches per interface, and as default, it registers the card instance at the very first instance. This can be a problem for the devices that have multiple interfaces to be probed, as the udev rule isn't applied properly for the later appearing interfaces. Although we introduced the delayed_register option and the quirks for covering those shortcomings, it's nothing but a workaround for specific devices.
This patch is an another attempt to fix the problem in a more generic way. Now the driver checks the whole USB device descriptor at the very first time when an interface is attached to a sound card. It looks at each matching interface in the descriptor and remembers the last matching one. The snd_card_register() is invoked only when this last interface is probed.
After this change, the quirks for the delayed registration become superfluous, hence they are removed along with the patch. OTOH, the delayed_register option is still kept, as it might be useful for some corner cases (e.g. a special driver overtakes the interface probe from the standard driver, and the last interface probe may miss).
--- sound/usb/card.c | 32 +++++++++++++++++++++++++------- sound/usb/quirks.c | 42 ------------------------------------------ sound/usb/quirks.h | 2 -- sound/usb/usbaudio.h | 1 + 4 files changed, 26 insertions(+), 51 deletions(-)
sound/usb/card.c +25 -7
@@ -690,7 +690,7 @@ static bool get_alias_id(struct usb_device *dev, unsigned int *id)return false; } -static bool check_delayed_register_option (struct snd_usb_audio *chip,int iface) +static int check_delayed_register_option (struct snd_usb_audio *chip) {int i;unsigned int id, inum;
@@ -699,14 +699,31 @@ static bool check_delayed_register_option(struct snd_usb_audio *chip, int iface)if (delayed_register[i] &&sscanf (delayed_register[i],"%x:%x" , &id, &inum) ==2 && id == chip->usb_id) -return iface < inum; +return inum; } -return false; +return -1 ; }static const struct usb_device_id usb_audio_ids[];/* defined below */ +/* look for the last interface that matches with our ids and remember it */ +static void find_last_interface (struct snd_usb_audio *chip) +{ +struct usb_host_config *config = chip->dev->actconfig; +struct usb_interface *intf; +int i; + +if (!config) +return ; +for (i =0 ; i < config->desc.bNumInterfaces; i++) { + intf = config->interface[i]; +if (usb_match_id (intf, usb_audio_ids)) + chip->last_iface = intf->altsetting[0 ].desc.bInterfaceNumber; + } +usb_audio_dbg (chip,"Found last interface = %d\n" , chip->last_iface); +} +/* look for the corresponding quirk */ static const struct snd_usb_audio_quirk *get_alias_quirk (struct usb_device *dev,unsigned int id)
@@ -813,6 +830,7 @@ static int usb_audio_probe(struct usb_interface *intf, err = -ENODEV ; goto __error; } +find_last_interface (chip); }if (chip->num_interfaces >=MAX_CARD_INTERFACES ) {
@@ -862,11 +880,11 @@ static int usb_audio_probe(struct usb_interface *intf, chip->need_delayed_register = false;/* clear again */ } -/* we are allowed to call snd_card_register() many times, but first -* check to see if a device needs to skip it or do anything special +/* register card if we reach to the last interface or to the specified +* one given via option */ -if (!snd_usb_registration_quirk (chip, ifnum) && - !check_delayed_register_option (chip, ifnum)) { +if (check_delayed_register_option (chip) == ifnum || + chip->last_iface == ifnum) { err =snd_card_register (chip->card);if (err <0 ) goto __error;
sound/usb/quirks.c +0 -42
48 lines not on this page · raw message
sound/usb/quirks.h +0 -2
@@ -48,8 +48,6 @@ void snd_usb_audioformat_attributes_quirk(struct snd_usb_audio *chip,struct audioformat *fp, int stream); -bool snd_usb_registration_quirk (struct snd_usb_audio *chip,int iface); -void snd_usb_init_quirk_flags (struct snd_usb_audio *chip);#endif /* __USBAUDIO_QUIRKS_H */
sound/usb/usbaudio.h +1 -0
@@ -37,6 +37,7 @@ struct snd_usb_audio {unsigned int quirk_flags; unsigned int need_delayed_register:1; /* warn for delayed registration */int num_interfaces; +int last_iface;int num_suspended_intf;int sample_rate_read_error;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 744/862 drm/vc4: vec: Fix timings for VEC modes
In reply to Greg Kroah-HartmanFrom: Mateusz Kwiatkowski <[email protected]>
[ Upstream commit 30d7565be96b3946c18a1ce3fd538f7946839092 ]
This commit fixes vertical timings of the VEC (composite output) modes to accurately represent the 525-line ("NTSC") and 625-line ("PAL") ITU-R standards.
Previous timings were actually defined as 502 and 601 lines, resulting in non-standard 62.69 Hz and 52 Hz signals being generated, respectively.
--- drivers/gpu/drm/vc4/vc4_vec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/vc4/vc4_vec.c +2 -2
@@ -256,7 +256,7 @@ static void vc4_vec_ntsc_j_mode_set(struct vc4_vec *vec)static const struct drm_display_mode ntsc_mode = {DRM_MODE ("720x480" ,DRM_MODE_TYPE_DRIVER ,13500 ,720 ,720 +14 ,720 +14 +64 ,720 +14 +64 +60 ,0 , -480 ,480 +3 ,480 +3 +3 ,480 +3 +3 +16 ,0 , +480 ,480 +7 ,480 +7 +6 ,525 ,0 ,DRM_MODE_FLAG_INTERLACE ) };
@@ -278,7 +278,7 @@ static void vc4_vec_pal_m_mode_set(struct vc4_vec *vec)static const struct drm_display_mode pal_mode = {DRM_MODE ("720x576" ,DRM_MODE_TYPE_DRIVER ,13500 ,720 ,720 +20 ,720 +20 +64 ,720 +20 +64 +60 ,0 , -576 ,576 +2 ,576 +2 +3 ,576 +2 +3 +20 ,0 , +576 ,576 +4 ,576 +4 +6 ,625 ,0 ,DRM_MODE_FLAG_INTERLACE ) };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 745/862 drm: panel-orientation-quirks: Add quirk for Anbernic Win600
In reply to Greg Kroah-HartmanFrom: Maya Matuszczyk <[email protected]>
[ Upstream commit 770e19076065e079a32f33eb11be2057c87f1cde ]
This device is another x86 gaming handheld, and as (hopefully) there is only one set of DMI IDs it's using DMI_EXACT_MATCH
--- drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/gpu/drm/drm_panel_orientation_quirks.c +6 -0
@@ -128,6 +128,12 @@ static const struct dmi_system_id orientation_data[] = { DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "One S1003"), }, .driver_data = (void *)&lcd800x1280_rightside_up, + }, { /* Anbernic Win600 */ + .matches = { +DMI_EXACT_MATCH (DMI_BOARD_VENDOR ,"Anbernic" ), + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Win600"), + }, + .driver_data = (void *)&lcd720x1280_rightside_up, }, { /* Asus T100HA */ .matches = { DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 746/862 drm: panel-orientation-quirks: Add quirk for Aya Neo Air
In reply to Greg Kroah-HartmanFrom: Maya Matuszczyk <[email protected]>
[ Upstream commit e10ea7b9b90219da305a16b3c1252169715a807b ]
Yet another x86 gaming handheld.
This one has many SKUs with quite a few of DMI strings, so let's just use a catchall, just as with Aya Neo Next.
--- drivers/gpu/drm/drm_panel_orientation_quirks.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/gpu/drm/drm_panel_orientation_quirks.c +12 -0
@@ -103,6 +103,12 @@ static const struct drm_dmi_panel_orientation_data lcd800x1280_rightside_up = { .orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP, }; +static const struct drm_dmi_panel_orientation_data lcd1080x1920_leftside_up = { + .width =1080 , + .height =1920 , + .orientation =DRM_MODE_PANEL_ORIENTATION_LEFT_UP , +}; +static const struct drm_dmi_panel_orientation_data lcd1200x1920_rightside_up = { .width =1200 , .height =1920 ,
@@ -158,6 +164,12 @@ static const struct dmi_system_id orientation_data[] = { DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "AYA NEO 2021"), }, .driver_data = (void *)&lcd800x1280_rightside_up, + }, { /* AYA NEO AIR */ + .matches = { +DMI_EXACT_MATCH (DMI_SYS_VENDOR ,"AYANEO" ), + DMI_MATCH(DMI_BOARD_NAME, "AIR"), + }, + .driver_data = (void *)&lcd1080x1920_leftside_up, }, { /* AYA NEO NEXT */ .matches = { DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "AYANEO"),
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 747/862 platform/chrome: cros_ec: Notify the PM of wake events during resume
In reply to Greg Kroah-HartmanFrom: Jameson Thies <[email protected]>
[ Upstream commit 8edd2752b0aa498b3a61f3caee8f79f7e0567fad ]
cros_ec_handle_event in the cros_ec driver can notify the PM of wake events. When a device is suspended, cros_ec_handle_event will not check MKBP events. Instead, received MKBP events are checked during resume by cros_ec_report_events_during_suspend. But cros_ec_report_events_during_suspend cannot notify the PM if received events are wake events, causing wake events to not be reported if received while the device is suspended.
Update cros_ec_report_events_during_suspend to notify the PM of wake events during resume by calling pm_wakeup_event.
--- drivers/platform/chrome/cros_ec.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/platform/chrome/cros_ec.c +7 -1
@@ -349,10 +349,16 @@ EXPORT_SYMBOL(cros_ec_suspend);static void cros_ec_report_events_during_suspend (struct cros_ec_device *ec_dev) { +bool wake_event; +while (ec_dev->mkbp_event_supported && -cros_ec_get_next_event (ec_dev,NULL ,NULL ) >0 ) +cros_ec_get_next_event (ec_dev, &wake_event,NULL ) >0 ) {blocking_notifier_call_chain (&ec_dev->event_notifier,1 , ec_dev); + +if (wake_event &&device_may_wakeup (ec_dev->dev)) +pm_wakeup_event (ec_dev->dev,0 ); + } }/**
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 748/862 platform/x86: hp-wmi: Setting thermal profile fails with 0x06
In reply to Greg Kroah-HartmanFrom: Jorge Lopez <[email protected]>
[ Upstream commit 00b1829294b7c88ecba92c661fbe6fe347b364d2 ]
Error 0x06 (invalid command parameter) is reported by hp-wmi module when reading the current thermal profile and then proceed to set it back. The failing condition occurs in Linux NixOS after user configures the thermal profile to ‘quiet mode’ in Windows. Quiet Fan Mode is supported in Windows but was not supported in hp-wmi module.
This fix adds support for PLATFORM_PROFILE_QUIET in hp-wmi module for HP notebooks other than HP Omen series. Quiet thermal profile is not supported in HP Omen series notebooks.
--- drivers/platform/x86/hp-wmi.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
drivers/platform/x86/hp-wmi.c +10 -1
@@ -177,7 +177,8 @@ enum hp_thermal_profile_omen_v1 {enum hp_thermal_profile {HP_THERMAL_PROFILE_PERFORMANCE =0x00 ,HP_THERMAL_PROFILE_DEFAULT =0x01 , -HP_THERMAL_PROFILE_COOL =0x02 +HP_THERMAL_PROFILE_COOL =0x02 , +HP_THERMAL_PROFILE_QUIET =0x03 , };#define IS_HWBLOCKED (x) ((x & HPWMI_POWER_FW_OR_HW) != HPWMI_POWER_FW_OR_HW)
@@ -1194,6 +1195,9 @@ static int hp_wmi_platform_profile_get(struct platform_profile_handler *pprof,case HP_THERMAL_PROFILE_COOL : *profile =PLATFORM_PROFILE_COOL ;break ; +case HP_THERMAL_PROFILE_QUIET : + *profile =PLATFORM_PROFILE_QUIET ; +break ;default :return -EINVAL ; }
@@ -1216,6 +1220,9 @@ static int hp_wmi_platform_profile_set(struct platform_profile_handler *pprof,case PLATFORM_PROFILE_COOL : tp =HP_THERMAL_PROFILE_COOL ;break ; +case PLATFORM_PROFILE_QUIET : + tp =HP_THERMAL_PROFILE_QUIET ; +break ;default :return -EOPNOTSUPP ; }
@@ -1263,6 +1270,8 @@ static int thermal_profile_setup(void) platform_profile_handler.profile_get = hp_wmi_platform_profile_get; platform_profile_handler.profile_set = hp_wmi_platform_profile_set; + +set_bit (PLATFORM_PROFILE_QUIET , platform_profile_handler.choices); }set_bit (PLATFORM_PROFILE_COOL , platform_profile_handler.choices);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 749/862 platform/x86: msi-laptop: Change DMI match / alias strings to fix module autoloading
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit 2a2565272a3628e45d61625e36ef17af7af4e3de ]
On a MSI S270 with Fedora 37 x86_64 / systemd-251.4 the module does not properly autoload.
This is likely caused by issues with how systemd-udevd handles the single quote char (') which is part of the sys_vendor / chassis_vendor strings on this laptop. As a workaround remove the single quote char + everything behind it from the sys_vendor + chassis_vendor matches. This fixes the module not autoloading.
--- drivers/platform/x86/msi-laptop.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
drivers/platform/x86/msi-laptop.c +3 -5
@@ -596,11 +596,10 @@ static const struct dmi_system_id msi_dmi_table[] __initconst = { { .ident = "MSI S270", .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"MICRO-STAR INT'L CO.,LTD" ), +DMI_MATCH (DMI_SYS_VENDOR ,"MICRO-STAR INT" ),DMI_MATCH (DMI_PRODUCT_NAME ,"MS-1013" ),DMI_MATCH (DMI_PRODUCT_VERSION ,"0131" ), -DMI_MATCH (DMI_CHASSIS_VENDOR , -"MICRO-STAR INT'L CO.,LTD" ) +DMI_MATCH (DMI_CHASSIS_VENDOR ,"MICRO-STAR INT" ) }, .driver_data = &quirk_old_ec_model, .callback = dmi_check_cb
@@ -633,8 +632,7 @@ static const struct dmi_system_id msi_dmi_table[] __initconst = {DMI_MATCH (DMI_SYS_VENDOR ,"NOTEBOOK" ),DMI_MATCH (DMI_PRODUCT_NAME ,"SAM2000" ),DMI_MATCH (DMI_PRODUCT_VERSION ,"0131" ), -DMI_MATCH (DMI_CHASSIS_VENDOR , -"MICRO-STAR INT'L CO.,LTD" ) +DMI_MATCH (DMI_CHASSIS_VENDOR ,"MICRO-STAR INT" ) }, .driver_data = &quirk_old_ec_model, .callback = dmi_check_cb
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 750/862 ALSA: intel-dspconfig: add ES8336 support for AlderLake-PS
In reply to Greg Kroah-HartmanFrom: Muralidhar Reddy <[email protected]>
[ Upstream commit 9db1c9fa214ef41d098633ff40a87284ca6e1870 ]
added quirks for ESS8336 for AlderLake-PS
--- sound/hda/intel-dsp-config.c | 5 +++++ 1 file changed, 5 insertions(+)
sound/hda/intel-dsp-config.c +5 -0
@@ -427,6 +427,11 @@ static const struct config_entry config_table[] = { .device = 0x51cd, },/* Alderlake-PS */ + { + .flags = FLAG_SOF, + .device = 0x51c9, + .codec_hid = &essx_83x6, + }, { .flags = FLAG_SOF | FLAG_SOF_ONLY_IF_DMIC_OR_SOUNDWIRE, .device = 0x51c9,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 751/862 ASoC: SOF: pci: Change DMI match info to support all Chrome platforms
In reply to Greg Kroah-HartmanFrom: Jairaj Arava <[email protected]>
[ Upstream commit c1c1fc8103f794a10c5c15e3c17879caf4f42c8f ]
In some Chrome platforms if OEM's use their own string as SYS_VENDOR than "Google", it leads to firmware load failure from intel/sof/community path.
Hence, changing SYS_VENDOR to PRODUCT_FAMILY in which "Google" is used as common prefix and is supported in all Chrome platforms.
--- sound/soc/sof/sof-pci-dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/sof/sof-pci-dev.c +1 -1
@@ -138,7 +138,7 @@ static const struct dmi_system_id community_key_platforms[] = { .ident = "Google Chromebooks", .callback = chromebook_use_community_key, .matches = { - DMI_MATCH(DMI_SYS_VENDOR, "Google"), + DMI_MATCH(DMI_PRODUCT_FAMILY, "Google"), } }, {},
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 752/862 ASoC: sunxi: sun4i-codec: set debugfs_prefix for CPU DAI component
In reply to Greg Kroah-HartmanFrom: Mikhail Rudenko <[email protected]>
[ Upstream commit 717a8ff20f32792d6a94f2883e771482c37d844b ]
At present, succesfull probing of H3 Codec results in an error
debugfs: Directory '1c22c00.codec' with parent 'H3 Audio Codec' already present!
This is caused by a directory name conflict between codec components. Fix it by setting debugfs_prefix for the CPU DAI component.
--- sound/soc/sunxi/sun4i-codec.c | 3 +++ 1 file changed, 3 insertions(+)
sound/soc/sunxi/sun4i-codec.c +3 -0
@@ -1232,6 +1232,9 @@ static const struct snd_soc_component_driver sun8i_a23_codec_codec = {static const struct snd_soc_component_driver sun4i_codec_component = { .name ="sun4i-codec" , .legacy_dai_naming =1 , +#ifdef CONFIG_DEBUG_FS + .debugfs_prefix ="cpu" , +#endif };#define SUN4I_CODEC_RATES SNDRV_PCM_RATE_CONTINUOUS
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 753/862 ASoC: SOF: add quirk to override topology mclk_id
In reply to Greg Kroah-HartmanFrom: Pierre-Louis Bossart <[email protected]>
[ Upstream commit d136949dd8e2e309dc2f186507486b71cbe9acdb ]
Some Intel-based platforms rely on a topology file that hard-codes the use of MCLK0. This is incorrect in 10% of the cases. Rather than generating yet another set of topology files, this patch adds a kernel module parameter to override the topology value.
In hindsight, we should never have allowed mclks to be specified in topology, this is a hardware-level information that should not have been visible in the topology.
Future patches will try to set this value automagically, e.g. by parsing the NHLT content.
--- sound/soc/sof/intel/hda.c | 11 +++++++++++ sound/soc/sof/ipc3-topology.c | 7 +++++++ sound/soc/sof/sof-priv.h | 4 ++++ 3 files changed, 22 insertions(+)
sound/soc/sof/intel/hda.c +11 -0
@@ -376,6 +376,10 @@ static int dmic_num_override = -1;module_param_named (dmic_num, dmic_num_override, int,0444 );MODULE_PARM_DESC (dmic_num,"SOF HDA DMIC number" ); +static int mclk_id_override =-1 ; +module_param_named (mclk_id, mclk_id_override, int,0444 ); +MODULE_PARM_DESC (mclk_id,"SOF SSP mclk_id" ); +#if IS_ENABLED (CONFIG_SND_SOC_SOF_HDA )static bool hda_codec_use_common_hdmi =IS_ENABLED (CONFIG_SND_HDA_CODEC_HDMI );module_param_named (use_common_hdmi, hda_codec_use_common_hdmi, bool,0444 );
@@ -1565,6 +1569,13 @@ struct snd_soc_acpi_mach *hda_machine_select(struct snd_sof_dev *sdev) sof_pdata->tplg_filename = tplg_filename; } + +/* check if mclk_id should be modified from topology defaults */ +if (mclk_id_override >=0 ) { +dev_info (sdev->dev,"Overriding topology with MCLK %d from kernel_parameter\n" , mclk_id_override); + sdev->mclk_id_override = true; + sdev->mclk_id_quirk = mclk_id_override; + } }/*
sound/soc/sof/ipc3-topology.c +7 -0
@@ -1249,6 +1249,7 @@ static int sof_link_afe_load(struct snd_soc_component *scomp, struct snd_sof_daistatic int sof_link_ssp_load (struct snd_soc_component *scomp,struct snd_sof_dai_link *slink,struct sof_ipc_dai_config *config,struct snd_sof_dai *dai) { +struct snd_sof_dev *sdev =snd_soc_component_get_drvdata (scomp);struct snd_soc_tplg_hw_config *hw_config = slink->hw_configs;struct sof_dai_private_data *private = dai->private;u32 size =sizeof (*config);
@@ -1273,6 +1274,12 @@ static int sof_link_ssp_load(struct snd_soc_component *scomp, struct snd_sof_dai config[i].hdr.size = size; +if (sdev->mclk_id_override) { +dev_dbg (scomp->dev,"tplg: overriding topology mclk_id %d by quirk %d\n" , + config[i].ssp.mclk_id, sdev->mclk_id_quirk); + config[i].ssp.mclk_id = sdev->mclk_id_quirk; + } +/* copy differentiating hw configs to ipc structs */ config[i].ssp.mclk_rate =le32_to_cpu (hw_config[i].mclk_rate); config[i].ssp.bclk_rate =le32_to_cpu (hw_config[i].bclk_rate);
sound/soc/sof/sof-priv.h +4 -0
@@ -594,6 +594,10 @@ struct snd_sof_dev {/* to protect the ipc_rx_handler_list and dsp_state_handler_list list */ struct mutex client_event_handler_mutex; +/* quirks to override topology values */ +bool mclk_id_override; +u16 mclk_id_quirk;/* same size as in IPC3 definitions */ +void *private;/* core does not touch this */ };
Signature · 1 line
2.35.1
Works on my Arch Linux homeserver
with Intel(R) Core(TM) i5-6400 CPU @ 2.70GHz
Quoted 3,620 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.0.3 release. There are 862 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 21 Oct 2022 08:30:19 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.0.3-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
linux-6.0.y
and the diffstat can be found below.thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:Greg Kroah-Hartman <[email protected]>
Linux 6.0.3-rc1Nathan Chancellor <[email protected]>
lib/Kconfig.debug: Add check for non-constant .{s,u}leb128 support to
DWARF5Masahiro Yamada <[email protected]>
Kconfig.debug: add toolchain checks forDEBUG_INFO_DWARF_TOOLCHAIN_DEFAULTMasahiro Yamada <[email protected]>
Kconfig.debug: simplify the dependency of DEBUG_INFO_DWARF4/5Jens Axboe <[email protected]>
io_uring/rw: ensurekiocb_end_write()is always calledPavel Begunkov <[email protected]>
io_uring: fix fdinfo sqe offsets calculationNathan Chancellor <[email protected]>
drm/amd/display: Fix build breakage withCONFIG_DEBUG_FS=nNicholas Piggin <[email protected]>
powerpc/64s/interrupt: Fix lost interrupts when returning to soft-masked
contextTetsuo Handa <[email protected]>
net/ieee802154: don't warn zero-sized raw_sendmsg()Alexander Aring <[email protected]>
Revert "net/ieee802154: reject zero-sizedraw_sendmsg()"Aric Cyr <[email protected]>
Revert "drm/amd/display: correct hostvm flag"Randy Dunlap <[email protected]>
net: ethernet: ti:davinci_mdio: fix build for mdio bitbang usesYu Kuai <[email protected]>
blk-wbt: fix that 'rwb->wc' is always set to 1 in wbt_init()Takashi Iwai <[email protected]>
ALSA: usb-audio: Fix last interface check for registrationAlexander Aring <[email protected]>
net: ieee802154: return-EINVALfor unknown addr typeLiu Shixin <[email protected]>
mm: hugetlb: fix UAF inhugetlb_handle_userfaultPavel Begunkov <[email protected]>
io_uring/net: fix notif cqe reorderingPavel Begunkov <[email protected]>
io_uring/net: don't skip notifs for failed requestsPavel Begunkov <[email protected]>
io_uring/net: renameio_sendzc()Pavel Begunkov <[email protected]>
io_uring/net: don't lose partialsend_zcon failPavel Begunkov <[email protected]>
io_uring/net: useio_sr_msgfor sendzcPavel Begunkov <[email protected]>
io_uring/net: refactorio_sr_msgtypesAdrian Hunter <[email protected]>
perf intel-pt: Fixsystem_widedummy event for hybridAdrian Hunter <[email protected]>
perf intel-pt: Fix segfault inintel_pt_print_info()with uClibcRob Herring <[email protected]>
perf: Skip and warn on unknown format 'configN' attrsIvan T. Ivanov <[email protected]>
clk: bcm2835: Round UART input clock upWayne Chang <[email protected]>
usb: typec: ucsi: Don't warn on probe deferralManivannan Sadhasivam <[email protected]>
dmaengine: dw-edma: Remove runtime PM supportLv Ruyi <[email protected]>
fsi: master-ast-cf: Fix missingof_node_putinfsi_master_acf_probeEddie James <[email protected]>
fsi: occ: Prevent use after freeEddie James <[email protected]>
hwmon (occ): Retry for checksum failureKeith Busch <[email protected]>
blk-mq: use quiesced elevator switch when reinitializing queuesDongliang Mu <[email protected]>
usb: idmouse: fix an uninit-value inidmouse_openVarun Prakash <[email protected]>
nvmet-tcp: add bounds check on Transfer TagKeith Busch <[email protected]>
nvme: copyfirmware_revon each initKeith Busch <[email protected]>
nvme: handle effects after freeing the requestJan Kara <[email protected]>
ext2: Usekvmalloc()for group descriptor arrayArun Easi <[email protected]>
scsi: tracing: Fix compile error intrace_arraycalls when TRACING is
disabledXiaoke Wang <[email protected]>
staging: rtl8723bs: fix a potential memory leak inrtw_init_cmd_priv()Xiaoke Wang <[email protected]>
staging: rtl8723bs: fix potential memory leak inrtw_init_drv_sw()Pavel Begunkov <[email protected]>
io_uring: fix CQE reorderingsunghwan jung <[email protected]>
Revert "usb: storage: Add quirk for Samsung Fit flash"Piyush Mehta <[email protected]>
usb: dwc3: core: Enable GUCTL1 bit 10 for fixing termination error after
resume bugAlexander Stein <[email protected]>
arm64: dts: imx8mp: Add snps,gfladj-refclk-lpm-sel quirk to USB nodesAlexander Stein <[email protected]>
usb: dwc3: core: addgfladj_refclk_lpm_selquirkRobin Guo <[email protected]>
usb: musb: Fixmusb_gadget.crxstate overflow bugJianglei Nie <[email protected]>
usb: host: xhci: Fix potential memory leak inxhci_alloc_stream_info()Logan Gunthorpe <[email protected]>
md/raid5: Wait forMD_SB_CHANGE_PENDINGin raid5dJohnothan King <[email protected]>
HID: nintendo: check analog user calibration for plausibilityJianglei Nie <[email protected]>
HSI:ssi_protocol: fix potential resource leak inssip_pn_open()Hyunwoo Kim <[email protected]>
HID: roccat: Fix use-after-free inroccat_read()Harry Stern <[email protected]>
hid: topre: Add driver fixing report descriptorPierre-Louis Bossart <[email protected]>
soundwire: intel: fix error handling on dai registration issuesRichard Fitzgerald <[email protected]>
soundwire: cadence: Don't overwrite msg->buf during write commandsColy Li <[email protected]>
bcache: fixset_at_max_writeback_rate()for multiple attached devicesSerge Semin <[email protected]>
ata:libahci_platform: Sanity check the DT child nodes numberYu Kuai <[email protected]>
blk-throttle: prevent overflow while calculating wait timeNam Cao <[email protected]>
staging: vt6655: fix potential memory leakWei Yongjun <[email protected]>
power: supply: adp5061: fix out-of-bounds read inadp5061_get_chg_type()Michael Grzeschik <[email protected]>
usb: gadget: uvc: increase worker prio toWQ_HIGHPRIYicong Yang <[email protected]>
iommu/arm-smmu-v3: Make default domain type of HiSilicon PTT device to
identityShigeru Yoshida <[email protected]>
nbd: Fix hung when signal interruptsnbd_start_device_ioctl()Letu Ren <[email protected]>
scsi: 3w-9xxx: Avoid disabling device if failing to enable itVaishnav Achath <[email protected]>
dmaengine: ti: k3-udma: ResetUDMA_CHAN_RTbyte counters to prevent
overflowJames Smart <[email protected]>
scsi: lpfc: Fix null ndlp ptr dereference in abnormal exit path forGFT_IDJustin Chen <[email protected]>
usb: host: xhci-plat: suspend/resume clks for brcmJustin Chen <[email protected]>
usb: host: xhci-plat: suspend and resume clocksDaisuke Matsuda <[email protected]>
RDMA/rxe: Delete error messages triggered by incoming Read requestsQuanyang Wang <[email protected]>
clk: zynqmp: pll: rectify rate rounding inzynqmp_pll_round_rateHangyu Hua <[email protected]>
media: platform: fix some double free in meson-ge2d and mtk-jpeg and
s5p-mfcZheyu Ma <[email protected]>
media: cx88: Fix a null-ptr-deref bug inbuffer_prepare()Ian Nam <[email protected]>
clk: zynqmp: Fix stack-out-of-bounds in strncpy`Alex Sverdlin <[email protected]>
ARM: 9242/1: kasan: Only map modules ifCONFIG_KASAN_VMALLOC=nLi Huafei <[email protected]>
ARM: 9234/1: stacktrace: Avoid duplicate saving of exception PC valueLi Huafei <[email protected]>
ARM: 9233/1: stacktrace: Skip frame pointer boundary check forcall_with_stack()Kunihiko Hayashi <[email protected]>
arm64: dts: uniphier: Add USB-device support for PXs3 reference boardJosef Bacik <[email protected]>
btrfs: call__btrfs_remove_free_space_cache_lockedon cache load
failureMaciej S. Szmigiero <[email protected]>
btrfs: don't print information about space cache or tree every remountQu Wenruo <[email protected]>
btrfs: scrub: try to fix super block errorsQu Wenruo <[email protected]>
btrfs: scrub: properly report super block errors in system logQu Wenruo <[email protected]>
btrfs: dump extra info if one free space cache has more bitmaps than it
shouldArnd Bergmann <[email protected]>
ARM: orion: fix include pathSebastian Krzyszkowiak <[email protected]>
arm64: dts: imx8mq-librem5: Add bq25895 as max17055's power supplyFrieder Schrempf <[email protected]>
arm64: dts: imx8mm-kontron: Use the VSELECT signal to switch SD card IO
voltageMark Brown <[email protected]>
kselftest/arm64: Fix validatation termination record afterEXTRA_CONTEXTMarcel Ziswiler <[email protected]>
ARM: dts: imx6sx-udoo-neo: don't use multiple blank linesMarcel Ziswiler <[email protected]>
ARM: dts: imx6sl: use tabs for code indentAlexander Stein <[email protected]>
ARM: dts: imx6sx: add missing properties for sramAlexander Stein <[email protected]>
ARM: dts: imx6sll: add missing properties for sramAlexander Stein <[email protected]>
ARM: dts: imx6sl: add missing properties for sramAlexander Stein <[email protected]>
ARM: dts: imx6qp: add missing properties for sramAlexander Stein <[email protected]>
ARM: dts: imx6dl: add missing properties for sramAlexander Stein <[email protected]>
ARM: dts: imx6q: add missing properties for sramKrzysztof Kozlowski <[email protected]>
arm64: dts: qcom: sc7280-idp: correct ADC channel node name and unit
addressHaibo Chen <[email protected]>
ARM: dts: imx7d-sdb: config the max pressure for tsc2046Alexander Stein <[email protected]>
ARM: dts: imx6: delete interrupts property if interrupts-extended is
setFelix Kuehling <[email protected]>
drm/amdkfd: Fix UBSAN shift-out-of-bounds warningWenjing Liu <[email protected]>
drm/amd/display: polling vid stream status in hpo dp blankAric Cyr <[email protected]>
drm/amd/display: Remove interface for periodic interrupt 1Khaled Almahallawy <[email protected]>
drm/dp: Don't rewrite link config when setting phy test patternRichard Acayan <[email protected]>
mmc: sdhci-msm: add compatible string check for sdm670Adrián Larumbe <[email protected]>
drm/meson: remove drm bridges at aggregate driver unbind timeAdrián Larumbe <[email protected]>
drm/meson: explicitly remove aggregate driver at module unload timeAdrián Larumbe <[email protected]>
drm/meson: reorder driver deinit sequence to fix use-after-free bugMario Limonciello <[email protected]>
ASoC: amd: yc: Add Lenovo Yoga Slim 7 Pro X to quirks tableXiaoyan Li <[email protected]>
ASoC: amd: yc: Add ASUS UM5302TA into DMI tablehongao <[email protected]>
drm/amdgpu: fix initial connector audio valueSherry Wang <[email protected]>
drm/amd/display: correct hostvm flagGeorge Shen <[email protected]>
drm/amd/display: Fix urgent latency override for DCN32/DCN321Philip Yang <[email protected]>
drm/amdgpu: SDMA update use unlocked iteratorPierre-Louis Bossart <[email protected]>
ASoC: SOF: add quirk to override topologymclk_idMikhail Rudenko <[email protected]>
ASoC: sunxi: sun4i-codec: setdebugfs_prefixfor CPU DAI componentJairaj Arava <[email protected]>
ASoC: SOF: pci: Change DMI match info to support all Chrome platformsMuralidhar Reddy <[email protected]>
ALSA: intel-dspconfig: add ES8336 support for AlderLake-PSHans de Goede <[email protected]>
platform/x86: msi-laptop: Change DMI match / alias strings to fix module
autoloadingJorge Lopez <[email protected]>
platform/x86: hp-wmi: Setting thermal profile fails with 0x06Jameson Thies <[email protected]>
platform/chrome:cros_ec: Notify the PM of wake events during resumeMaya Matuszczyk <[email protected]>
drm: panel-orientation-quirks: Add quirk for Aya Neo AirMaya Matuszczyk <[email protected]>
drm: panel-orientation-quirks: Add quirk for Anbernic Win600Mateusz Kwiatkowski <[email protected]>
drm/vc4: vec: Fix timings for VEC modesTakashi Iwai <[email protected]>
ALSA: usb-audio: Register card at the last interfaceYifan Zha <[email protected]>
drm/admgpu: Skip CG/PG on SOC21 under SRIOV VFYifan Zha <[email protected]>
drm/amdgpu: Skip the program of MMMC_VM_AGP_* in SRIOV on MMHUBv3_0_0sunliming <[email protected]>
drm/amd/display: Fix variable dereferenced before checkLucas Stach <[email protected]>
drm: bridge:dw_hdmi: only trigger hotplug event on link changeBernard Zhao <[email protected]>
drm/amd: fix potential memory leakAndy Shevchenko <[email protected]>
platform/x86:pmc_atom: Improve quirk message to be less crypticVivek Kasireddy <[email protected]>
udmabuf: Set ubuf->sg = NULL if the creation of sg table failsConner Knox <[email protected]>
ALSA: usb-audio: Add quirk to enable Avid Mbox 3 supportCezary Rojewski <[email protected]>
ALSA: hda: Fix page fault insnd_hda_codec_shutdown()David Gow <[email protected]>
drm/amd/display: fix overflow onMIN_I64definitionZeng Jingxiang <[email protected]>
gpu: lontium-lt9611: Fix NULL pointer dereference inlt9611_connector_init()Liviu Dudau <[email protected]>
drm/komeda: Fix handling of atomic commits in theatomic_commit_tail
hookJavier Martinez Canillas <[email protected]>
drm: Preventdrm_copy_field()to attempt copying a NULL pointerJavier Martinez Canillas <[email protected]>
drm: Usesize_ttype for len variable indrm_copy_field()Jianglei Nie <[email protected]>
drm/nouveau/nouveau_bo: fix potential memory leak innouveau_bo_alloc()Andrew Gaul <[email protected]>
r8152: Rate limit overflow messagesAndy Shevchenko <[email protected]>
i2c: designware-pci: Group AMD NAVI quirk parts togetherXin Liu <[email protected]>
libbpf: Fix overrun in netlink attribute iterationKees Cook <[email protected]>
net: sched:cls_u32: Avoidmemcpy()false-positive warningLuiz Augusto von Dentz <[email protected]>
Bluetooth: L2CAP: Fix user-after-freeSong Liu <[email protected]>
bpf: usebpf_prog_packforbpf_dispatcherJiri Olsa <[email protected]>
bpf: Adjustkprobe_multientry_ipforCONFIG_X86_KERNEL_IBTLiu Jian <[email protected]>
net: If sock is dead don't access sock'ssk_wqinsk_stream_wait_memoryJason A. Donenfeld <[email protected]>
hwmon: (sht4x) do not overflow clamping operation on 32-bit platformsDaniel Golle <[email protected]>
wifi: rt2x00: correctly set BBP register 86 for MT7620Daniel Golle <[email protected]>
wifi: rt2x00: set SoC wmac clock registerDaniel Golle <[email protected]>
wifi: rt2x00: set VGC gain for both chains of MT7620Daniel Golle <[email protected]>
wifi: rt2x00: set correctTX_SW_CFG1MAC register for MT7620Daniel Golle <[email protected]>
wifi: rt2x00: don't run Rt5592 IQ calibration on MT7620Ziyang Xuan <[email protected]>
can: bcm: check the result ofcan_send()inbcm_can_tx()Hou Tao <[email protected]>
selftests/bpf: Free the allocated resources after test case succeedsVadim Fedorenko <[email protected]>
bnxt_en: replace reset with config timestampsLuiz Augusto von Dentz <[email protected]>
Bluetooth:hci_event: Make sure ISO events don't affect non-ISO
connectionsLuiz Augusto von Dentz <[email protected]>
Bluetooth:hci_sysfs: Fix attempting to calldevice_addmultiple timesTetsuo Handa <[email protected]>
Bluetooth: L2CAP: initialize delayed works atl2cap_chan_create()Po-Hao Huang <[email protected]>
wifi: rtw89: fix rx filter after scanPo-Hao Huang <[email protected]>
wifi: rtw89: free unused skb to prevent memory leakSean Wang <[email protected]>
wifi: mt76: mt7921: reset msta->airtime_ac while clearing up hw valueJianglei Nie <[email protected]>
wifi: ath11k: mhi: fix potential memory leak inath11k_mhi_register()Patrick Rudolph <[email protected]>
regulator: core: Prevent integer underflowKiran K <[email protected]>
Bluetooth: btintel: Mark Intel controller to supportLE_STATESquirkAlexander Coffin <[email protected]>
wifi: brcmfmac: fix use-after-free bug inbrcmf_netdev_start_xmit()Michal Jaron <[email protected]>
iavf: Fix race betweeniavf_closeandiavf_reset_taskSergei Antonov <[email protected]>
net: ftmac100: fix endianness-related issues from 'sparse'Zong-Zhe Yang <[email protected]>
rtw89: ser: leave lps with mutexManikanta Pubbisetty <[email protected]>
wifi: ath11k: Register shutdown handler for WCN6750Khalid Masum <[email protected]>
xfrm: Updateipcomp_scratcheswith NULL when freedRichard Gobert <[email protected]>
net-next: FixIP_UNICAST_IFoption behavior for connected socketsRobert Hancock <[email protected]>
net: axienet: Switch to 64-bit RX/TX statisticsDaniel Sneddon <[email protected]>
x86/apic: Don't disable x2APIC if lockedMika Westerberg <[email protected]>
thunderbolt: Add back Intel Falcon Ridge end-to-end flow control
workaroundTetsuo Handa <[email protected]>
wifi: ath9k: avoid uninit memory read inath9k_htc_rx_msg()Jane Chu <[email protected]>
x86/mce: Retrieve poison range from hardwareJohannes Berg <[email protected]>
wifi: mac80211: accept STA changes without link changesJerry Ray <[email protected]>
micrel: ksz8851: fixes struct pointer issueEric Dumazet <[email protected]>
tcp: annotate data-race aroundtcp_md5sig_pool_populatedMike Pattrick <[email protected]>
openvswitch: Fix overreporting of drops in dropwatchMike Pattrick <[email protected]>
openvswitch: Fix double reporting of drops in dropwatchRavi Gunasekaran <[email protected]>
net: ethernet: ti:davinci_mdio: Add workaround for errata i2329Quentin Monnet <[email protected]>
bpftool: Clear errno after libcap's checksWright Feng <[email protected]>
wifi: brcmfmac: fix invalid address access when enabling SCAN log levelZong-Zhe Yang <[email protected]>
wifi: rtw88: phy: fix warning of possible buffer overflowHengqi Chen <[email protected]>
libbpf: Do not require executable permission for shared librariesJames Hilliard <[email protected]>
libbpf: Ensure functions withalways_inlineattribute are inlineDai Ngo <[email protected]>
NFSD: fix use-after-free on source server when doing inter-server copyAnna Schumaker <[email protected]>
NFSD: Return nfserr_serverfault if splice_ok but buf->pages have dataKees Cook <[email protected]>
x86/entry: Work around Clang__bdos()bugMario Limonciello <[email protected]>
ACPI: x86: Add a quirk for Dell Inspiron 14 2-in-1 for StorageD3EnableKees Cook <[email protected]>
ARM: decompressor: Include .data.rel.ro.localSrinivas Pandruvada <[email protected]>
thermal:intel_powerclamp: Useget_cpu()instead ofsmp_processor_id()
to avoid crashChao Qin <[email protected]>
powercap:intel_rapl: fix UBSAN shift-out-of-bounds issueKees Cook <[email protected]>
MIPS: BCM47XX: Castmemcmp()of function to (void *)Doug Smythies <[email protected]>
cpufreq:intel_pstate: Add Tigerlake support in no-HWP modeHans de Goede <[email protected]>
ACPI: tables: FPDT: Don't callacpi_os_map_memory()on invalid phys
addressKees Cook <[email protected]>
fortify: Fix__compiletime_strlen()underUBSAN_BOUNDS_LOCALArvid Norlander <[email protected]>
ACPI: video: Add Toshiba Satellite/Portege Z830 quirkPerry Yuan <[email protected]>
cpufreq:amd_pstate: fix wrong lowest perf fetchPaul E. McKenney <[email protected]>
rcu-tasks: Ensure RCU Tasks Trace loops have quiescent statesZqiang <[email protected]>
rcu-tasks: ConvertRCU_LOCKDEP_WARN()toWARN_ONCE()Michal Hocko <[email protected]>
rcu: Back off uponfill_page_cache_func()allocation failureZqiang <[email protected]>
rcu: Avoid triggering strict-GP irq-work when RCU is idleAlexander Aring <[email protected]>
fs: dlm: fix race in lowcommsAaron Tomlin <[email protected]>
module: tracking: Keep a record of tainted unloaded modules onlyChristoph Hellwig <[email protected]>
ARM/dma-mappіng: don't override ->dma_coherent when set from a busnotifier
Stefan Berger <[email protected]>
selftest: tpm2: AddClient.__del__()to close/dev/tpm*handleZhang Rui <[email protected]>
tools/powerturbostat: Use standard Energy Unit for SPR Dram RAPL
domainChao Yu <[email protected]>
f2fs: fix to accountFS_CP_DATA_IOcorrectlyZhang Qilong <[email protected]>
f2fs: fix race condition on settingFI_NO_EXTENTflagShuai Xue <[email protected]>
ACPI: APEI: do not addtask_workto kernel thread to avoid memory leakVincent Knecht <[email protected]>
thermal/drivers/qcom/tsens-v0_1: Fix MSM8939 fourth sensorhw_idJason A. Donenfeld <[email protected]>
random: schedule jitter credit for next jiffy, not in two jiffiesDan Carpenter <[email protected]>
crypto: cavium - prevent integer overflow loading firmwareDan Carpenter <[email protected]>
crypto: marvell/octeontx - prevent integer overflowsJanis Schoetterl-Glausch <[email protected]>
kbuild: rpm-pkg: fix breakage when V=1 is usedMasahiro Yamada <[email protected]>
linux/export: use inline assembler to populate symbol CRCsMasahiro Yamada <[email protected]>
kbuild: remove the target in signal traps when interruptedSong Liu <[email protected]>
ftrace: Fix recursive lockingdirect_mutexinftrace_modify_direct_callerNico Pache <[email protected]>
tracing/osnoise: Fix possible recursive locking instop_per_cpu_kthreadsYipeng Zou <[email protected]>
tracing: kprobe: Make gen test module work in arm and riscvYipeng Zou <[email protected]>
tracing: kprobe: Fix kprobe event gen test module on exitRobin Murphy <[email protected]>
iommu/iova: Fix module config properlyEnzo Matsumiya <[email protected]>
cifs: return correct error in ->calc_signature()Lin Yujun <[email protected]>
clocksource/drivers/timer-gxp: Add missing error handling ingxp_timer_probeKunkun Jiang <[email protected]>
clocksource/drivers/arm_arch_timer: Fix handling of ARM erratum 858921Damian Muszynski <[email protected]>
crypto: qat - fix DMA transfer directionPeter Harliman Liem <[email protected]>
crypto: inside-secure - Change swab to swab32Koba Ko <[email protected]>
crypto: ccp - Release dma channels before dmaengine unrgisterIgnat Korchagin <[email protected]>
crypto: akcipher - default implementation for setting a private keyDan Carpenter <[email protected]>
iommu/omap: Fix buffer overflow in debugfsWaiman Long <[email protected]>
cgroup/cpuset: Enableupdate_tasks_cpumask()ontop_cpusetWeili Qian <[email protected]>
crypto: hisilicon/qm - fix missing put dfx accessLucas Segarra Fernandez <[email protected]>
crypto: qat - fix default value of WDT timerKshitiz Varshney <[email protected]>
hwrng: imx-rngc - Moving IRQ handler registering afterimx_rngc_irq_mask_clear()Martin Kaiser <[email protected]>
hwrng: imx-rngc - usedevm_clk_get_enabledMichal Koutný <[email protected]>
cgroup: Honor caller's cgroup NS when resolving pathJacky Li <[email protected]>
crypto: ccp - Fail the PSP initialization when writing psp data file
failedJames Cowgill <[email protected]>
hwrng: arm-smccc-trng - fixNO_ENTROPYhandlingYe Weihua <[email protected]>
crypto: hisilicon/zip - fix mismatch in get/setsgl_sge_nrZhengchao Shao <[email protected]>
crypto: sahara - don't sleep when in softirqHaren Myneni <[email protected]>
powerpc/pseries/vas: Passhw_cpu_idto node associativity HCALLLi Huafei <[email protected]>
powerpc/kprobes: Fix null pointer reference inarch_prepare_kprobe()Pali Rohár <[email protected]>
powerpc: Fix SPE Power ISA properties for e500v1 platformsNicholas Piggin <[email protected]>
powerpc/64/interrupt: Fix return to masked context after hard-mask irq
becomes pendingNicholas Piggin <[email protected]>
powerpc/64: mark irqs hard disabled in boot pacaNicholas Piggin <[email protected]>
powerpc/64/interrupt: Fix false warning in context tracking due to idle
stateNicholas Piggin <[email protected]>
powerpc/64s: FixGENERIC_CPUbuild flags for PPC970 / G5Vitaly Kuznetsov <[email protected]>
x86/hyperv: Fix 'structhv_enlightened_vmcs' definitionRohan McLure <[email protected]>
powerpc: Fix fallocate andfadvise64_64compat parameter combinationPali Rohár <[email protected]>
powerpc: dts:turris1x.dts: Fix labels in DSA cpu port nodesPali Rohár <[email protected]>
powerpc: dts:turris1x.dts: Fix NOR partitions labelsAnup Patel <[email protected]>
cpuidle: riscv-sbi: FixCPU_PM_CPU_IDLE_ENTER_xyz()macro usageZheng Yongjun <[email protected]>
powerpc/powernv: add missingof_node_put()inopal_export_attrs()Liang He <[email protected]>
powerpc/pci_dn: Add missingof_node_put()Liang He <[email protected]>
powerpc/sysdev/fsl_msi: Add missingof_node_put()Nathan Chancellor <[email protected]>
powerpc/math_emu/efp: Includemodule.hMichael Ellerman <[email protected]>
powerpc/configs: Properly enablePAPR_SCMinpseries_defconfigHangyu Hua <[email protected]>
ipc: mqueue: fix possible memory leak ininit_mqueue_fs()Jack Wang <[email protected]>
mailbox: bcm-ferxrm-mailbox: Fix error check fordma_map_sgConor Dooley <[email protected]>
mailbox: mpfs: account for mbox offsets while sendingConor Dooley <[email protected]>
mailbox: mpfs: fix handling of the reg propertyPeng Fan <[email protected]>
mailbox: imx: fix RST channel supportJoel Stanley <[email protected]>
clk: ast2600: BCLK comes from EPLLMiaoqian Lin <[email protected]>
clk: ti: dra7-atl: Fix reference leak inof_dra7_atl_clk_probeLiang He <[email protected]>
clk: ti: Balanceof_node_get()calls forof_find_node_by_name()Lin Yujun <[email protected]>
clk: imx: scu: fix memleak onplatform_device_add()failsPeng Fan <[email protected]>
clk: imx8mp: tune the order ofenet_qos_root_clkStefan Wahren <[email protected]>
clk: bcm2835: fixbcm2835_clock_rate_from_divisordeclarationMaxime Ripard <[email protected]>
clk: bcm2835: Make peripheral PLLC criticalSerge Semin <[email protected]>
clk: baikal-t1: Add SATA internal ref clock bufferSerge Semin <[email protected]>
clk: baikal-t1: Add shared xGMAC ref/ptp clocks internal parentSerge Semin <[email protected]>
clk: baikal-t1: Fix invalid xGMAC PTP clock dividerSerge Semin <[email protected]>
clk: vc5: Fix 5P49V6901 outputs disabling when enabling FODDavid Collins <[email protected]>
spmi: pmic-arb: correct duplicate APID to PPID mapping logicChunfeng Yun <[email protected]>
usb: mtu3: fix failed runtime suspend in host only modeBasavaraj Natikar <[email protected]>
HID:amd_sfh: Handle condition of "no sensors" for SFH1.1Dave Jiang <[email protected]>
dmaengine: ioat: stopmod_timerfrom resurrecting deleted timer in__cleanup()Jens Axboe <[email protected]>
io_uring/rw: defer fsnotify calls to task contextDmitry Baryshkov <[email protected]>
phy: qcom-qmp-pcie: fix resource mapping for SDM845 QHP PHYChen-Yu Tsai <[email protected]>
clk: mediatek: Migrate remaining clk_unregister_*() to
clk_hw_unregister_*()Chen-Yu Tsai <[email protected]>
clk: mediatek: fix unregister function inmtk_clk_register_dividers
cleanupAngeloGioacchino Del Regno <[email protected]>
clk: mediatek: clk-mt8195-mfg: Reparentmfg_bg3dand propagate rate
changesChen-Yu Tsai <[email protected]>
clk: mediatek: mt8183: mfgcfg: Propagate rate changes to parentJens Hillenstedt <[email protected]>
mfd: da9061: Fix Failed to set Two-Wire Bus Mode.Jiasheng Jiang <[email protected]>
mfd: sm501: Add check forplatform_driver_register()Dan Carpenter <[email protected]>
mfd: fsl-imx25: Fix check forplatform_get_irq()errorsChristophe JAILLET <[email protected]>
mfd: lp8788: Fix an error handling path inlp8788_irq_init()andlp8788_irq_init()Christophe JAILLET <[email protected]>
mfd: lp8788: Fix an error handling path inlp8788_probe()Christophe JAILLET <[email protected]>
mfd: fsl-imx25: Fix an error handling path inmx25_tsadc_setup_irq()Christophe JAILLET <[email protected]>
mfd:intel_soc_pmic: Fix an error handling path inintel_soc_pmic_i2c_probe()Jiasheng Jiang <[email protected]>
fsi: core: Check error number after callingida_simple_getBob Pearson <[email protected]>
RDMA/rxe: Fixresize_finish()inrxe_queue.cBob Pearson <[email protected]>
RDMA/rxe: Set pd early in mr alloc routinesChristoph Hellwig <[email protected]>
nvmet-auth: don't try to cancel a non-initializedwork_structAdam Skladowski <[email protected]>
clk: qcom: gcc-sm6115: Override default Alpha PLL regsRobert Marko <[email protected]>
clk: qcom: apss-ipq6018: markapcs_alias0_core_clkas criticalMike Christie <[email protected]>
scsi: iscsi:iscsi_tcp: Fix null-ptr-deref while callinggetpeername()John Garry <[email protected]>
scsi: pm8001: Fixrunning_reqfor internal abort commandsDuoming Zhou <[email protected]>
scsi: libsas: Fix use-after-free bug insmp_execute_task_sg()Pali Rohár <[email protected]>
serial: 8250: Fix restoring termios speed after suspendGuilherme G. Piccoli <[email protected]>
firmware: google: Test spinlock on panic path to avoid lockupsLin Yujun <[email protected]>
slimbus: qcom-ngd: Add error handling inof_qcom_slim_ngd_registerNam Cao <[email protected]>
staging: vt6655: fix some erroneous memory clean-up loopsDongliang Mu <[email protected]>
phy: qualcomm: callclk_disable_unpreparein the error handlingSherry Sun <[email protected]>
tty: serial:fsl_lpuart: disable dma rx/tx use flags inlpuart_dma_shutdownIlpo Järvinen <[email protected]>
serial: 8250: Toggle IER bits on only after irq has been set upDan Carpenter <[email protected]>
drivers: serial: jsm: fix some leaks in probeDan Carpenter <[email protected]>
usb: dwc3: core: fix some leaks in probeLiang He <[email protected]>
usb: typec: anx7411: Useof_get_child_by_name()instead ofof_find_node_by_name()Albert Briscoe <[email protected]>
usb: gadget: function: fix danglingpnp_stringinf_printer.cMario Limonciello <[email protected]>
xhci: Don't show warning for reinit on known broken suspendDaisuke Matsuda <[email protected]>
IB: Set IOVA/LENGTH onIB_MRin core/uverbs layersMark Zhang <[email protected]>
RDMA/cm: Use SLID in the work completion as the DLID in responder sideLogan Gunthorpe <[email protected]>
md: Remove extramddev_get()inmd_seq_start()David Sloan <[email protected]>
md/raid5: Remove unnecessarybio_put()inraid5_read_one_chunk()Logan Gunthorpe <[email protected]>
md/raid5: Ensurestripe_fillhappens on non-read IO with journalSaurabh Sengar <[email protected]>
md: Replace snprintf with scnprintfJens Axboe <[email protected]>
io_uring/fdinfo: fix sqe dumping forIORING_SETUP_SQE128Dylan Yudaken <[email protected]>
eventfd: guardwake_upin eventfd fs calls as wellBart Van Assche <[email protected]>
block: Fix the enumblk_eh_timer_returndocumentationDan Carpenter <[email protected]>
mtd: rawnand: meson: fix bit map use inmeson_nfc_ecc_correct()Niklas Cassel <[email protected]>
ata: fixata_id_has_dipm()Niklas Cassel <[email protected]>
ata: fixata_id_has_ncq_autosense()Niklas Cassel <[email protected]>
ata: fixata_id_has_devslp()Niklas Cassel <[email protected]>
ata: fixata_id_sense_reporting_enabled()andata_id_has_sense_reporting()Bernard Metzler <[email protected]>
RDMA/siw: Fix QP destroy to wait for all references dropped.Bernard Metzler <[email protected]>
RDMA/siw: Always consume all skbuf data insk_data_ready()upcall.Bart Van Assche <[email protected]>
RDMA/srp: Fixsrp_abort()Shiraz Saleem <[email protected]>
RDMA/irdma: Validate udata inlen and outlenSindhu-Devale <[email protected]>
RDMA/irdma: Align AE id codes to correct flush code and eventPali Rohár <[email protected]>
mtd: rawnand:fsl_elbc: Fix none ECC modeMartin Blumenstingl <[email protected]>
mtd: rawnand: intel: Remove undocumented compatible stringMartin Blumenstingl <[email protected]>
mtd: rawnand: intel: Read the chip-select line from the correct OF nodeChunfeng Yun <[email protected]>
phy: phy-mtk-tphy: fix the phy type setting issueLiang He <[email protected]>
phy: amlogic: phy-meson-axg-mipi-pcie-analog: Hold reference returned byof_get_parent()Johan Hovold <[email protected]>
phy: qcom-qmp-usb: fix memleak on probe deferralJohan Hovold <[email protected]>
phy: qcom-qmp-ufs: fix memleak on probe deferralJohan Hovold <[email protected]>
phy: qcom-qmp-combo: fix memleak on probe deferralJohan Hovold <[email protected]>
phy: qcom-qmp-pcie-msm8996: fix memleak on probe deferralJohan Hovold <[email protected]>
phy: qcom-qmp-pcie: fix memleak on probe deferralJohan Hovold <[email protected]>
phy: qcom-qmp-pcie: addpcs_miscsanity checkJohan Hovold <[email protected]>
phy: qcom-qmp-usb: disable runtime PM on unbindDan Carpenter <[email protected]>
remoteproc: Hardenrproc_handle_vdev()against integer overflowWilliam Dean <[email protected]>
mtd: devices: docg3: check the return value ofdevm_ioremap()in the
probeJames Smart <[email protected]>
scsi: lpfc: Fix various issues reported by toolsDang Huynh <[email protected]>
clk: qcom: sm6115: SelectQCOM_GDSCJan Kara <[email protected]>
sbitmap: Avoid leaving waitqueue in invalid state in__sbq_wake_up()Jim Cromie <[email protected]>
dyndbg: drop EXPORTeddynamic_debug_exec_queriesJim Cromie <[email protected]>
dyndbg: let query-modname override actual module nameJim Cromie <[email protected]>
dyndbg: fix module.dyndbg handlingJim Cromie <[email protected]>
dyndbg: fixstatic_branchmanipulationDan Carpenter <[email protected]>
usb: gadget:f_fs: stricter integer overflow checksVincent Whitchurch <[email protected]>
iio: Use per-device lockdep class for mlockJie Hai <[email protected]>
dmaengine: hisilicon: Add multi-thread support for a DMA channelJie Hai <[email protected]>
dmaengine: hisilicon: Fix CQ head updateJie Hai <[email protected]>
dmaengine: hisilicon: Disable channels when unregisterhisi_dmaJerry Snitselaar <[email protected]>
dmaengine: idxd: avoid deadlock inprocess_misc_interrupts()Peter Geis <[email protected]>
phy: rockchip-inno-usb2: Return zero after otg syncDan Carpenter <[email protected]>
fpga: prevent integer overflow indfl_feature_ioctl_set_irq()Matthew Gerlach <[email protected]>
fpga: dfl-pci: Add IDs for Intel N6000, N6001 and C6100 cardsHangyu Hua <[email protected]>
misc: ocxl: fix possible refcount leak inafu_ioctl()AngeloGioacchino Del Regno <[email protected]>
clk: mediatek: mt8195-infra_ao: Set pwrmcu clocks as criticalAngeloGioacchino Del Regno <[email protected]>
clk: mediatek: clk-mt8195-vdo1: Reparent and set rate on vdo1_dpintf's
parentAngeloGioacchino Del Regno <[email protected]>
clk: mediatek: clk-mt8195-vdo0: Set rate on vdo0_dp_intf0_dp_intf'sparent
Zhu Yanjun <[email protected]>
RDMA/rxe: Fix the error caused by qp->skZhu Yanjun <[email protected]>
RDMA/rxe: Fix "kernel NULL pointer dereference" errorMiaoqian Lin <[email protected]>
media: xilinx: vipp: Fix refcount leak inxvip_graph_dma_initYunke Cao <[email protected]>
media: uvcvideo: Use entityget_curinuvc_ctrl_setJosé Expósito <[email protected]>
media: uvcvideo: Fix memory leak inuvc_gpio_parseXu Qiang <[email protected]>
media: meson: vdec: add missingclk_disable_unprepareon error invdec_hevc_start()Ming Qian <[email protected]>
media: amphion: fix a bug that vpu core may not resume after suspendMing Qian <[email protected]>
media: amphion: don't change the colorspace reported by decoder.Ming Qian <[email protected]>
media: amphion: adjust the encoder's value range of gop sizeMing Qian <[email protected]>
media: amphion: insert picture startcode after seek for vc1g formatHirokazu Honda <[email protected]>
media: mediatek: vcodec: Skip non CBR bitrate modeShubhrajyoti Datta <[email protected]>
tty:xilinx_uartps: Fix theignore_statusShubhrajyoti Datta <[email protected]>
tty:xilinx_uartps: Checkclk_enablereturn valueDongliang Mu <[email protected]>
media: airspy: fix memory leak in airspy probeLiang He <[email protected]>
media: exynos4-is: fimc-is: Addof_node_put()when breaking out of loopMarijn Suijten <[email protected]>
clk: qcom: gcc-sdm660: Use floor ops for SDCC1 clockJack Wang <[email protected]>
HSI:omap_ssi_port: Fixdma_map_sgerror checkMiaoqian Lin <[email protected]>
HSI:omap_ssi: Fix refcount leak inssi_probeJosé Expósito <[email protected]>
HID: uclogic: Fix warning inuclogic_rdesc_template_applyJosé Expósito <[email protected]>
HID: uclogic: Add missing suffix for digitalizersYu Kuai <[email protected]>
sbitmap: fix possible io hung due to lost wakeupChanho Park <[email protected]>
clk: samsung: exynosautov9: correct register offsets of peric0/c1Miaoqian Lin <[email protected]>
clk: tegra20: Fix refcount leak integra20_clock_initMiaoqian Lin <[email protected]>
clk: tegra: Fix refcount leak integra114_clock_initMiaoqian Lin <[email protected]>
clk: tegra: Fix refcount leak integra210_clock_initChristophe JAILLET <[email protected]>
coresight: docs: Fix a broken referenceLiang He <[email protected]>
clk: sprd: Hold reference returned byof_get_parent()Liang He <[email protected]>
clk: berlin: Addof_node_put()forof_get_parent()Liang He <[email protected]>
clk: qoriq: Hold reference returned byof_get_parent()Liang He <[email protected]>
clk: oxnas: Hold reference returned byof_get_parent()Liang He <[email protected]>
clk: st: Hold reference returned byof_get_parent()Liang He <[email protected]>
clk: meson: Hold reference returned byof_get_parent()Thinh Nguyen <[email protected]>
usb: common: debug: Check non-standard control requestsChristophe JAILLET <[email protected]>
usb: common: usb-conn-gpio: Simplify some error messageAharon Landau <[email protected]>
RDMA/mlx5: Don't compare mkey tags in DEVX indirect mkeyJakob Hauser <[email protected]>
iio: magnetometer: yas530: Change data type ofhard_offsetsto signedJonathan Cameron <[email protected]>
iio: ABI: Fix wrong format of differential capacitance channel ABI.Nuno Sá <[email protected]>
iio: inkern: fix return value indevm_of_iio_channel_get_by_name()Nuno Sá <[email protected]>
iio: inkern: only release the device node when done with itClaudiu Beznea <[email protected]>
iio: adc: at91-sama5d2_adc: disable/prepare buffer on suspend/resumeClaudiu Beznea <[email protected]>
iio: adc: at91-sama5d2_adc: lock around oversampling and sample freqClaudiu Beznea <[email protected]>
iio: adc: at91-sama5d2_adc: check return status for pressure and touchClaudiu Beznea <[email protected]>
iio: adc: at91-sama5d2_adc: fix AT91_SAMA5D2_MR_TRACKTIM_MAXZhao Gongyi <[email protected]>
selftests/cpu-hotplug: Reserve one cpu online at leastZhao Gongyi <[email protected]>
selftests/cpu-hotplug: Delete fault injection related codeZhao Gongyi <[email protected]>
selftests/cpu-hotplug: Use return instead of exitDarrick J. Wong <[email protected]>
iomap: iomap: fix memory corruption when recording errors during
writebackDmitry Torokhov <[email protected]>
ARM: dts: exynos: fix polarity of VBUS GPIO of OrigenDmitry Torokhov <[email protected]>
arm64: dts: exynos: fix polarity of "enable" line of NFC chip in TM2Mark Rutland <[email protected]>
arm64: ftrace: fix module PLTs with mcountJosh Triplett <[email protected]>
ext4: don't run ext4lazyinit for read-only filesystemsJerry Lee 李修賢 <[email protected]>
ext4: continue to expand file system when the target size doesn't reachGeert Uytterhoeven <[email protected]>
ARM: Drop CMDLINE_* dependency on ATAGSDmitry Torokhov <[email protected]>
ARM: dts: exynos: correct s5k6a3 reset polarity on Midas familyMatt Ranostay <[email protected]>
arm64: dts: ti: k3-j7200: fix main pinmux rangeJohan Hovold <[email protected]>
arm64: dts: qcom: sm8450: fix UFS PHY serdes sizeJohan Hovold <[email protected]>
arm64: dts: qcom: ipq8074: fix PCIe PHY serdes sizeDmitry Osipenko <[email protected]>
soc/tegra: fuse: DropKconfigdependency onTEGRA20_APB_DMALiang He <[email protected]>
soc/tegra: fuse: Add missingof_node_put()integra_init_fuse()Krzysztof Kozlowski <[email protected]>
arm64: dts: qcom: sm8350-sagami: correct TS pin propertyRandy Dunlap <[email protected]>
ia64: exportmemory_add_physaddr_to_nidto fix cxl build errorBhupesh Sharma <[email protected]>
arm64: dts: qcom: sc8280xp-pmics: Remove reg entry & use correct nodename for
pmc8280c_lpgnodeChris Packham <[email protected]>
arm64: dts: marvell: 98dx25xx: use correct property for i2c gpiosMichael Walle <[email protected]>
ARM: dts: kirkwood: lsxl: remove first ethernet portMichael Walle <[email protected]>
ARM: dts: kirkwood: lsxl: fix serial lineMarek Behún <[email protected]>
ARM: dts: turris-omnia: Fix mpp26 pin name and commentStephen Boyd <[email protected]>
arm64: dts: qcom: sc7180-trogdor: Keeppm6150_adcenabled for TZBryan O'Donoghue <[email protected]>
arm64: dts: qcom: pm8350c: Drop PWM reg declarationJohan Hovold <[email protected]>
arm64: dts: qcom: sa8295p-adp: disallow regulator mode switchesJohan Hovold <[email protected]>
arm64: dts: qcom: sc8280xp-lenovo-thinkpad-x13s: disallow regulator modeswitches
Johan Hovold <[email protected]>
arm64: dts: qcom: sc8280xp-crd: disallow regulator mode switchesSatya Priya <[email protected]>
arm64: dts: qcom: sc7280: Update lpasscore nodeSatya Priya <[email protected]>
arm64: dts: qcom: sc7280: Cleanup the lpasscc nodeGeert Uytterhoeven <[email protected]>
arm64: dts: qcom: sdm845-xiaomi-polaris: Fixsde_dsi_activepinctrlChanho Park <[email protected]>
dt-bindings: clock: exynosautov9: correct clock numbering of peric0/c1Biju Das <[email protected]>
arm64: dts: renesas: r9a07g043: Fix SCI{Rx,Tx} interrupt typesBiju Das <[email protected]>
arm64: dts: renesas: r9a07g054: Fix SCI{Rx,Tx} interrupt typesBiju Das <[email protected]>
arm64: dts: renesas: r9a07g044: Fix SCI{Rx,Tx} interrupt typesLucas Stach <[email protected]>
ARM: dts: imx6qdl-kontron-samx6i: hook up DDC i2c busLiang He <[email protected]>
soc: qcom: smem_state: Add refcounting for the 'state->of_node'Liang He <[email protected]>
soc: qcom: smsm: Fix refcount leak bugs inqcom_smsm_probe()Amir Goldstein <[email protected]>
locks: fix TOCTOU race when granting write leaseLiang He <[email protected]>
memory: of: Fix refcount leak bug inof_lpddr3_get_ddr_timings()Liang He <[email protected]>
memory: of: Fix refcount leak bug inof_get_ddr_timings()Liang He <[email protected]>
memory: pl353-smc: Fix refcount leak bug inpl353_smc_probe()Takashi Iwai <[email protected]>
ALSA: hda/hdmi: Don't skip notification handling during PM operationJudy Hsiao <[email protected]>
ASoC: rockchip: i2s: useregmap_read_poll_timeout_atomicto pollI2S_CLRZhang Qilong <[email protected]>
ASoC: mt6660: Fix PM disable depth imbalance inmt6660_i2c_probeZhang Qilong <[email protected]>
ASoC: wm5102: Fix PM disable depth imbalance inwm5102_probeZhang Qilong <[email protected]>
ASoC: wm5110: Fix PM disable depth imbalance inwm5110_probeZhang Qilong <[email protected]>
ASoC: wm8997: Fix PM disable depth imbalance inwm8997_probeKrzysztof Kozlowski <[email protected]>
ASoC: wcd-mbhc-v2: Revert "ASoC: wcd-mbhc-v2: usepm_runtime_resume_and_get()"Zhang Qilong <[email protected]>
ASoC: stm: Fix PM disable depth imbalance instm32_i2s_probeZhang Qilong <[email protected]>
ASoC: stm32: spdifrx: Fix PM disable depth imbalance instm32_spdifrx_probeZhang Qilong <[email protected]>
ASoC: stm32: dfsdm: Fix PM disable depth imbalance instm32_adfsdm_probeChristophe JAILLET <[email protected]>
mmc: wmt-sdmmc: Fix an error handling path inwmt_mci_probe()Andreas Pape <[email protected]>
ALSA: dmaengine: increment buffer pointer atomicallyChristophe JAILLET <[email protected]>
ASoC: da7219: Fix an error handling path inda7219_register_dai_clks()Srinivas Kandagatla <[email protected]>
ASoC: codecs: tx-macro: fix kcontrol putDan Carpenter <[email protected]>
virtio-gpu: fix shift wrapping bug invirtio_gpu_fence_event_create()Rafael Mendonca <[email protected]>
drm/vmwgfx: Fix memory leak invmw_mksstat_add_ioctl()Peter Ujfalusi <[email protected]>
ASoC: SOF: ipc4-topology: Free the ida when IPC fails insof_ipc4_widget_setup()Takashi Iwai <[email protected]>
ALSA: usb-audio: Properly refcounting clock rateJaroslav Kysela <[email protected]>
ALSA: hda/hdmi: Fix the converter allocation for the silent streamJaroslav Kysela <[email protected]>
ALSA: hda/hdmi: change type for the 'assigned' variableKuogee Hsieh <[email protected]>
drm/msm/dp: correct 1.62G link rate atdp_catalog_ctrl_config_msa()Dmitry Baryshkov <[email protected]>
drm/msm/dpu: index dpu_kms->hw_vbif using vbif_idxDmitry Baryshkov <[email protected]>
drm/msm: lookup the ICC paths in both mdp5/dpu and mdss devicesLiang He <[email protected]>
ASoC: eureka-tlv320: Hold reference returned fromof_find_xxxAPIChristophe JAILLET <[email protected]>
mmc: au1xmmc: Fix an error handling path inau1xmmc_probe()Judy Hsiao <[email protected]>
ASoC: rockchip: i2s: useregmap_read_poll_timeoutto pollI2S_CLRRafael Mendonca <[email protected]>
drm/amdgpu: Fix memory leak inhpd_rx_irq_create_workqueue()Liang He <[email protected]>
drm/omap: dss: Fix refcount leak bugsAngeloGioacchino Del Regno <[email protected]>
ASoC: SOF: mediatek: mt8195: Import namespaceSND_SOC_SOF_MTK_COMMONAngeloGioacchino Del Regno <[email protected]>
ASoC: mediatek: mt8195-mt6359: Properly register sound card for SOFGerd Hoffmann <[email protected]>
drm/bochs: fix blankingChia-I Wu <[email protected]>
drm/virtio: setfb_modifiers_not_supportedTakashi Iwai <[email protected]>
ALSA: hda: beep: Simplify keep-power-at-enable behaviorCristian Ciocaltea <[email protected]>
ASoC:wm_adsp: Handle optional legacy supportJiasheng Jiang <[email protected]>
ASoC: rsnd: Add check forrsnd_mod_power_onPin-yen Lin <[email protected]>
drm/bridge: it6505: Fix the order ofDP_SET_POWERcommandsZheyu Ma <[email protected]>
drm/bridge: megachips: Fix a null pointer dereference bugYang Yingliang <[email protected]>
drm/amdgpu: add missingpci_disable_device()inamdgpu_pmops_runtime_resume()Prashant Malani <[email protected]>
platform/chrome:cros_ec_typec: Correct alt mode indexPrashant Malani <[email protected]>
platform/chrome:cros_ec_typec: Add bit offset for DP VDORandy Dunlap <[email protected]>
drm: fixdrm_mipi_dbibuild errorsRandy Dunlap <[email protected]>
drm/panel: use 'select' for Ili9341 panel driver helpersHans de Goede <[email protected]>
platform/x86: msi-laptop: Fix resource cleanupHans de Goede <[email protected]>
platform/x86: msi-laptop: Fix old-ec check for backlight registeringMartin Povišer <[email protected]>
ASoC: tas2764: Fix mute/unmuteMartin Povišer <[email protected]>
ASoC: tas2764: Drop conflictingset_bias_levelpower settingMartin Povišer <[email protected]>
ASoC: tas2764: Allow mono streamsKuninori Morimoto <[email protected]>
ASoC:soc-pcm.c: call__soc_pcm_close()insoc_pcm_close()Rob Clark <[email protected]>
drm/virtio: Fix same-context optimizationStanislav Lisovskiy <[email protected]>
drm/i915/dg2: Bump up CDCLK for DG2Dan Carpenter <[email protected]>
platform/chrome: fix memory corruption in ioctlRustam Subkhankulov <[email protected]>
platform/chrome: fix double-free inchromeos_laptop_prepare()Javier Martinez Canillas <[email protected]>
drm/msm: Make .remove and .shutdown HW shutdown consistentYang Yingliang <[email protected]>
ASoC: amd: acp: add missingplatform_device_unregister()inacp_pci_probe()Dan Carpenter <[email protected]>
ASoC: mt6359: fix tests forplatform_get_irq()failureLiang He <[email protected]>
drm:pl111: Addof_node_put()when breaking out offor_each_available_child_of_node()Simon Ser <[email protected]>
drm/dp_mst: fixdrm_dp_dpcd_readreturn value checksJosé Expósito <[email protected]>
drm/format-helper: Fix test on big endian architecturesChen-Yu Tsai <[email protected]>
drm/bridge: parade-ps8640: Fix regulator supply orderLiang He <[email protected]>
drm/bridge: tc358767: Addof_node_put()when breaking out of loopLiang He <[email protected]>
drm/bridge: anx7625: Fix refcount bug in anx7625_parse_dt()Dmitry Osipenko <[email protected]>
drm/virtio: Correctdrm_gem_shmem_get_sg_table()error handlingThomas Zimmermann <[email protected]>
video/aperture: Disable and unregister sysfb devices via aperture
helpersPin-Yen Lin <[email protected]>
drm/bridge: it6505: Power on downstream device in .atomic_enableMaxime Ripard <[email protected]>
drm/vc4: drv: Callcomponent_unbind_all()Maxime Ripard <[email protected]>
drm/mipi-dsi: Detach devices when removing the hostDan Carpenter <[email protected]>
drm/bridge: Avoid uninitialized variable warningAlvin Šipraga <[email protected]>
drm: bridge: adv7511: unregister cec i2c device after cec adapterAlvin Šipraga <[email protected]>
drm: bridge: adv7511: fix CEC power down control register offsetRussell King (Oracle) <[email protected]>
net: mvpp2: fix mvpp2 debugfs leakEric Dumazet <[email protected]>
once: addDO_ONCE_SLOW()for sleepable contextsTetsuo Handa <[email protected]>
net/ieee802154: reject zero-sized raw_sendmsg()Maxim Mikityanskiy <[email protected]>
net: wwan: iosm: Callmutex_initbefore locking itZheng Wang <[email protected]>
eth: sp7021: fix use after free bug inspl2sw_nvmem_get_mac_addressJianglei Nie <[email protected]>
bnx2x: fix potential memory leak inbnx2x_tpa_stop()Raju Lakkaraju <[email protected]>
eth: lan743x: reject extts for non-pci11x1x devicesJiasheng Jiang <[email protected]>
net: prestera: acl: Add check for kmemdupKuniyuki Iwashima <[email protected]>
af_unix: Fix memory leaks of the whole sk due to OOB skb.Tetsuo Handa <[email protected]>
net: rds: don't hold sock lock when cancelling work fromrds_tcp_reset_callbacks()Oleksandr Shamray <[email protected]>
hwmon: (pmbus/mp2888) Fix sensors readouts for MPS Multi-phase mp2888
controllerLuiz Augusto von Dentz <[email protected]>
Bluetooth:hci_sync: Fix not indicating power stateMarek Szyprowski <[email protected]>
spi: Ensure thatsg_tablewon't be used after being freedNeal Cardwell <[email protected]>
tcp: fixtcp_cwnd_validate()to not forgetis_cwnd_limitedXin Long <[email protected]>
sctp: handle the error returned fromsctp_auth_asoc_init_active_keyDuoming Zhou <[email protected]>
mISDN: fix use-after-free bugs in l1oip timer handlersJakub Kicinski <[email protected]>
eth: alx: takertnl_lockon resumeJunichi Uekawa <[email protected]>
vhost/vsock: Use kvmalloc/kvfree for larger packets.Bitterblue Smith <[email protected]>
wifi: rtl8xxxu: Fix AIFS written to REG_EDCA_*_PARAMBitterblue Smith <[email protected]>
wifi: rtl8xxxu: gen2: Enable 40 MHz channel widthAbhishek Pandit-Subedi <[email protected]>
Bluetooth: Prevent double register of suspendVincent Whitchurch <[email protected]>
spi: s3c64xx: Fix large transfers with DMAPhil Sutter <[email protected]>
netfilter:nft_fib: Fix for rpath check with VRF devicesLiu Jian <[email protected]>
xfrm: Reinject transport-mode packets through workqueueLuiz Augusto von Dentz <[email protected]>
Bluetooth:hci_core: Fix not handling link timeouts propertlyAsmaa Mnebhi <[email protected]>
i2c: mlxbf: support lock mechanismAndrii Nakryiko <[email protected]>
libbpf: Don't require full struct enum64 in UAPI headersXiaomeng Tong <[email protected]>
cw1200: fix incorrect check to determine if no element is found in listLiu Jian <[email protected]>
skmsg: Schedule psock work if the cached skb exists on the psockZhang Qilong <[email protected]>
spi/omap100k:Fix PM disable depth imbalance inomap1_spi100k_probeZhang Qilong <[email protected]>
spi: dw: Fix PM disable depth imbalance indw_spi_bt1_probeZhang Qilong <[email protected]>
spi: cadence-quadspi: Fix PM disable depth imbalance incqspi_probeLuciano Leão <[email protected]>
x86/cpu: Include the header of init_ia32_feat_ctl()'s prototypeChristian Marangi <[email protected]>
wifi: ath11k: fix peer addition/deletion error on sta band migrationAndrii Nakryiko <[email protected]>
libbpf: restore memory layout ofbpf_object_open_optsKees Cook <[email protected]>
x86/microcode/AMD: Track patch allocation size explicitlyArınç ÜNAL <[email protected]>
mips: dts: ralink: mt7621: fix external phy on GB-PC2Jesus Fernandez Manzano <[email protected]>
wifi: ath11k: fix number of VHT beamformee spatial streamsWen Gong <[email protected]>
wifi: ath11k: fix failed to find the peer withpeer_id0 when
disconnectedDuoming Zhou <[email protected]>
mwifiex: fix sleep in atomic context bugs caused bydev_coredumpvQingqing Yang <[email protected]>
flow_dissector: Do not count vlan tags inside tunnel payloadPu Lehui <[email protected]>
selftests/bpf: Adapt cgroup effective query uapi changePu Lehui <[email protected]>
bpftool: Fix wrong cgroup attach flags being assigned to effective
progsPu Lehui <[email protected]>
bpf, cgroup: Rejectprog_attach_flagsarray when effective queryAntoine Tenart <[email protected]>
netfilter: conntrack: revisit the gc initial rescheduling biasAntoine Tenart <[email protected]>
netfilter: conntrack: fix the gc rescheduling delayXin Liu <[email protected]>
libbpf: Fix NULL pointer exception in APIbtf_dump__dump_type_dataTetsuo Handa <[email protected]>
Bluetooth: hci_{ldisc,serdev}: checkpercpu_init_rwsem()failureBaochen Qiang <[email protected]>
wifi: ath11k: IncludeSTA_KEEPALIVE_ARP_RESPONSETLV header by defaultAndrii Nakryiko <[email protected]>
libbpf: Fix crash ifSEC("freplace")programs don't haveattach_prog_fd
setLee Jones <[email protected]>
bpf: Ensure correct locking around vulnerable functionfind_vpid()Zheng Yongjun <[email protected]>
net:fs_enet: Fix wrong check indo_pd_setupLuiz Augusto von Dentz <[email protected]>
Bluetooth: RFCOMM: Fix possible deadlock on socket shutdown/releaseDeren Wu <[email protected]>
wifi: mt76: mt7921e: fix rmmod crash in driver reload testHoward Hsu <[email protected]>
wifi: mt76: mt7915: do not check state before configuring implicit
beamformLorenzo Bianconi <[email protected]>
wifi: mt76: fix uninitialized pointer inmt7921_mac_fill_rxHoward Hsu <[email protected]>
wifi: mt76: mt7915: fix mcs value in ht modeSean Wang <[email protected]>
wifi: mt76: mt7921: fix the firmware version reportSean Wang <[email protected]>
wifi: mt76: mt7921: add mt7921_mutex_acquire at
mt7921_sta_set_decap_offloadSean Wang <[email protected]>
wifi: mt76: mt7921: add mt7921_mutex_acquire at mt7921_[start, stop]_apLorenzo Bianconi <[email protected]>
wifi: mt76: connac: fix possible unaligned access inmt76_connac_mcu_add_nested_tlvLorenzo Bianconi <[email protected]>
wifi: mt76: mt7915: fix possible unaligned access inmt7915_mac_add_twt_setupLorenzo Bianconi <[email protected]>
wifi: mt76: mt7615: add mt7615_mutex_acquire/release in
mt7615_sta_set_decap_offloadYN Chen <[email protected]>
wifi: mt76: sdio: fix transmitting packet hangsDan Carpenter <[email protected]>
wifi: mt76: mt7921: fix use after free in mt7921_acpi_read()Dan Carpenter <[email protected]>
wifi: mt76: mt7915: fix an uninitialized variable bugSean Wang <[email protected]>
wifi: mt76: sdio: poll sta stat when device transmits dataSean Wang <[email protected]>
wifi: mt76: sdio: fix the deadlock caused by sdio->stat_workSean Wang <[email protected]>
wifi: mt76: mt7921u: fix race issue between reset and suspend/resumeSean Wang <[email protected]>
wifi: mt76: mt7921s: fix race issue between reset and suspend/resumeSean Wang <[email protected]>
wifi: mt76: mt7921e: fix race issue between reset and suspend/resumeTetsuo Handa <[email protected]>
Bluetooth: avoidhci_dev_test_and_set_flag()inmgmt_init_hdev()Bitterblue Smith <[email protected]>
wifi: rtl8xxxu: Remove copy-paste leftover ingen2_update_rate_maskBitterblue Smith <[email protected]>
wifi: rtl8xxxu: gen2: Fix mistake in path B IQ calibrationLorenz Bauer <[email protected]>
bpf: btf: fix truncatedlast_member_type_idinbtf_struct_resolveNeil Armstrong <[email protected]>
spi: meson-spicc: do not rely on busy flag in pow2 clk opsBitterblue Smith <[email protected]>
wifi: rtl8xxxu: Fix skb misuse in TX queue selectionXu Qiang <[email protected]>
spi: qup: add missingclk_disable_unprepareon error inspi_qup_pm_resume_runtime()Xu Qiang <[email protected]>
spi: qup: add missingclk_disable_unprepareon error inspi_qup_resume()Johannes Berg <[email protected]>
wifi: mac80211: mlme: assign link address correctlyIan Rogers <[email protected]>
selftests/xsk: Avoid use-after-free on ctxYang Yingliang <[email protected]>
wifi: rtw88: add missingdestroy_workqueue()on error path inrtw_core_init()Dan Carpenter <[email protected]>
wifi: wfx: prevent underflow inwfx_send_pds()Dan Carpenter <[email protected]>
wifi: rtl8xxxu: tighten bounds checking inrtl8xxxu_read_efuse()Ping-Ke Shih <[email protected]>
wifi: rtw89: pci: correct TX resource checking in low power modePing-Ke Shih <[email protected]>
wifi: rtw89: pci: fix interrupt stuck after leaving low power modeHou Tao <[email protected]>
bpf: Only add BTF IDs for socket security hooks whenCONFIG_SECURITY_NETWORKis onSean Wang <[email protected]>
Bluetooth: btusb: mediatek: fix WMT failure during runtime suspendHou Tao <[email protected]>
bpf: Use this_cpu_{inc_return|dec} for prog->activeHou Tao <[email protected]>
bpf: Use this_cpu_{inc|dec|inc_return} forbpf_task_storage_busyManikanta Pubbisetty <[email protected]>
wifi: ath11k: Fix incorrect QMI message ID mappingsHou Tao <[email protected]>
bpf: Propagate error fromhtab_lock_bucket()to userspaceHou Tao <[email protected]>
bpf: Disable preemption when increasing per-cpumap_lockedMaciej Fijalkowski <[email protected]>
selftests/xsk: Add missingclose()on netns fdMaciej Fijalkowski <[email protected]>
xsk: Fix backpressure mechanism on TxKohei Tarumizu <[email protected]>
x86/resctrl: Fix to restore to original value when re-enabling hardware
prefetch registerChristophe JAILLET <[email protected]>
spi: mt7621: Fix an error message in mt7621_spi_probe()Sabrina Dubroca <[email protected]>
esp: choose the correct inner protocol for GSO on inter address family
tunnelsRichard Guy Briggs <[email protected]>
audit: freeaudit_proctitleonly on task exitRichard Guy Briggs <[email protected]>
audit: explicitly check audit_context->context enum valueJacob Keller <[email protected]>
ice: settx_tstampswhen creating new Tx rings via ethtoolLam Thai <[email protected]>
bpftool: Fix a wrong type cast inbtf_dumper_intHari Chandrakanthan <[email protected]>
wifi: mac80211: allow bw change during channel switch in meshJohannes Berg <[email protected]>
wifi:mac80211_hwsim: fix link change handlingMordechay Goodstein <[email protected]>
wifi: mac80211: mlme: don't add empty EML capabilitiesJohannes Berg <[email protected]>
wifi: mac80211: fix use-after-freeShaul Triebitz <[email protected]>
wifi: cfg80211: get correct AP link chandefShaul Triebitz <[email protected]>
wifi: mac80211: properly setold_linkswhen removing a linkKumar Kartikeya Dwivedi <[email protected]>
bpf: Fix reference state management for synchronous callbacksMaksym Glubokiy <[email protected]>
net: prestera: cache port state for non-phylink ports tooGerhard Engleder <[email protected]>
tsnep: FixTSNEP_INFO_TX_TIMEregister defineUwe Kleine-König <[email protected]>
leds: lm3601x: Don't use mutex after it was destroyedJoanne Koong <[email protected]>
bpf: Fixref_obj_idfor dynptr data slices in verifierDave Marchevsky <[email protected]>
bpf: Cleanupcheck_refcount_okWen Gong <[email protected]>
wifi: ath10k: add peer map clean up for peer delete inath10k_sta_state()Youghandhar Chintala <[email protected]>
wifi: ath10k: Set tx credit to one for WCN3990 snoc based devicesPing-Ke Shih <[email protected]>
wifi: rtlwifi: 8192de: correct checking of IQK reloadFlorian Fainelli <[email protected]>
libbpf: Initialize err inprobe_map_createJason A. Donenfeld <[email protected]>
m68k: Process bootinfo records before saving themBill Wendling <[email protected]>
x86/paravirt: add extra clobbers withZERO_CALL_USED_REGSenabledChuck Lever <[email protected]>
NFSD: Fix handling of oversized NFSv4 COMPOUND requestsChuck Lever <[email protected]>
NFSD: Protect against send buffer overflow in NFSv2 READDIRChuck Lever <[email protected]>
SUNRPC: Fix svcxdr_init_encode's buflen calculationChuck Lever <[email protected]>
SUNRPC: Fix svcxdr_init_decode's end-of-buffer calculationChristophe JAILLET <[email protected]>
nfsd: Fix a memory leak in an error handling pathSami Tolvanen <[email protected]>
objtool: Preserve specialst_shndxindexes inelf_update_symbolHuisong Li <[email protected]>
ACPI: PCC: Fix Tx acknowledge in the PCC address space handlerHuisong Li <[email protected]>
ACPI: PCC: replacewait_for_completion()Rafael Mendonca <[email protected]>
ACPI: PCC: Release resources on address space setup failure pathWang Kefeng <[email protected]>
ARM: 9247/1: mm: set readonly forMT_MEMORY_ROwithARM_LPAEWang Kefeng <[email protected]>
ARM: 9244/1: dump: Fix wrong pg_level in walk_pmd()Bart Van Assche <[email protected]>
ARM: 9243/1: riscpc: Unbreak the buildJia Zhu <[email protected]>
erofs: usekill_anon_super()to kill super in fscache modeGao Xiang <[email protected]>
erofs: fix order >=MAX_ORDERwarning due to crafted negativei_sizeLin Yujun <[email protected]>
MIPS: SGI-IP27: Fix platform-device leak inbridge_platform_create()Lin Yujun <[email protected]>
MIPS: SGI-IP30: Fix platform-device leak inbridge_platform_create()Kees Cook <[email protected]>
sh: machvec: Use char[] for section boundariesPerry Yuan <[email protected]>
cpufreq: amd-pstate: Fix initialhighest_perfvalueXuewen Yan <[email protected]>
thermal:cpufreq_cooling: Check the policy first incpufreq_cooling_register()Christian Brauner <[email protected]>
acl: return EOPNOTSUPP inposix_acl_fix_xattr_common()Christian Brauner <[email protected]>
ntfs3: rework xattr handlers and switch to POSIX ACL VFS helpersOndrej Mosnacek <[email protected]>
userfaultfd: open userfaultfds withO_RDONLYMimi Zohar <[email protected]>
ima: fix blocking of security.ima xattrs of unsupported algorithmsGreg Kroah-Hartman <[email protected]>
selinux: use "grep -E" instead of "egrep"Steve French <[email protected]>
smb3: must initialize two ACL struct fields to zeroRuili Ji <[email protected]>
drm/amdgpu: EnableF32_WPTR_POLL_ENABLEin mqdSonny Jiang <[email protected]>
drm/amdgpu: Enable VCN PG onGC11_0_1Shirish S <[email protected]>
drm/amd/display: explicitly disablepsr_feature_enableappropriatelyAurabindo Pillai <[email protected]>
drm/amd/display: Add HUBP surface flip interrupt handlerYunxiang Li <[email protected]>
drm/amd/display: Fix vblank refcount in vrr transitionRodrigo Siqueira <[email protected]>
drm/amd/display: Enable 2 to 1 ODM policy if supportedRoman Li <[email protected]>
drm/amd/display: Enable dpia support for dcn314Fangzhi Zuo <[email protected]>
drm/amd/display: Validate DSC After Enable All New CRTCsMartin Leung <[email protected]>
drm/amd/display: zeromem mypipe heap struct before using itNicholas Kazlauskas <[email protected]>
drm/amd/display: Update PMFW z-state interface for DCN314Alvin Lee <[email protected]>
drm/amd/display: Fix watermark calculationThomas Hellström <[email protected]>
drm/i915: Fix display problems after resumeVille Syrjälä <[email protected]>
drm/i915: Fix watermark calculations for DG2 CCS+CC modifierVille Syrjälä <[email protected]>
drm/i915: Fix watermark calculations for DG2 CCS modifiersVille Syrjälä <[email protected]>
drm/i915: Fix watermark calculations for gen12+ CCS+CC modifierVille Syrjälä <[email protected]>
drm/i915: Fix watermark calculations for gen12+ MC CCS modifierVille Syrjälä <[email protected]>
drm/i915: Fix watermark calculations for gen12+ RC CCS modifierTvrtko Ursulin <[email protected]>
drm/i915/guc: Fix revocation of non-persistent contextsChris Wilson <[email protected]>
drm/i915/gt: Usei915_vm_putonppgtt_createerror pathsJianglei Nie <[email protected]>
drm/nouveau: fix a use-after-free innouveau_gem_prime_import_sg_table()Lyude Paul <[email protected]>
drm/nouveau/kms/nv140-: Disable interlacingGreg Kroah-Hartman <[email protected]>
staging: greybus:audio_helper: remove unused and wrong debugfs usageSean Christopherson <[email protected]>
KVM: VMX: Drop bits 31:16 when shoving exception error code into VMCSSean Christopherson <[email protected]>
KVM: x86: Treat #DBs from the emulator as fault-like (code and
DR7.GD=1)Sean Christopherson <[email protected]>
KVM: nVMX: Don't propagate vmcs12'sPERF_GLOBAL_CTRLsettings to vmcs02Sean Christopherson <[email protected]>
KVM: nVMX: Unconditionally purge queued/injected events on nested
"exit"Michal Luczaj <[email protected]>
KVM: x86/emulator: Fix handing of POP SS to correctly set
interruptibilityYu Kuai <[email protected]>
blk-wbt: callrq_qos_add()afterwb_normalis initializedYu Kuai <[email protected]>
blk-throttle: fix that io throttle can only work for single bioDmitry Osipenko <[email protected]>
media: cedrus: Fix endless loop incedrus_h265_skip_bits()Dmitry Osipenko <[email protected]>
media: cedrus: Set the platform driver data earlierNicolas Dufresne <[email protected]>
media: cedrus: Fix watchdog race conditionArd Biesheuvel <[email protected]>
efi: libstub: drop pointlessget_memory_map()callMario Limonciello <[email protected]>
thunderbolt: Explicitly enable lane adapter hotplug events at startupShengjiu Wang <[email protected]>
rpmsg: char: Avoid double destroy of default endpointSteven Rostedt (Google) <[email protected]>
tracing: Fix reading strings from synthetic eventsSteven Rostedt (Google) <[email protected]>
tracing: Add "(fault)" name injection to kernel probesSteven Rostedt (Google) <[email protected]>
tracing: Move duplicate code oftrace_kprobe/eprobe.cinto headerSteven Rostedt (Google) <[email protected]>
tracing: Do not free snapshot if tracer is on cmdlineSteven Rostedt (Google) <[email protected]>
tracing: Addioctl()to force ring buffer waiters to wake upSteven Rostedt (Google) <[email protected]>
tracing: Wake up waiters when tracing is disabledSteven Rostedt (Google) <[email protected]>
tracing: Wake up ring buffer waiters on closing of the fileWaiman Long <[email protected]>
tracing: Disable interrupt or preemption before acquiringarch_spinlock_tTao Chen <[email protected]>
tracing/eprobe: Fix alloc event dir failed when event name no setSteven Rostedt (Google) <[email protected]>
ring-buffer: Fix race between reset page and reading pageSteven Rostedt (Google) <[email protected]>
ring-buffer: Addring_buffer_wake_waiters()Steven Rostedt (Google) <[email protected]>
ring-buffer: Check pending waiters when doing wake ups as wellSteven Rostedt (Google) <[email protected]>
ring-buffer: Have theshortest_fullqueue be the shortest not longestSteven Rostedt (Google) <[email protected]>
ring-buffer: Allow splice to read previous partially read pagesSteven Rostedt (Google) <[email protected]>
ftrace: Still disable enabled records marked as disabledZheng Yejian <[email protected]>
ftrace: Properly unsetFTRACE_HASH_FL_MODRik van Riel <[email protected]>
livepatch: fix race between fork and KLP transitionYe Bin <[email protected]>
ext4: update 'state->fc_regions_size' after successful memoryallocation
Ye Bin <[email protected]>
ext4: fix potential memory leak inext4_fc_record_regions()Ye Bin <[email protected]>
ext4: fix potential memory leak inext4_fc_record_modified_inode()Ye Bin <[email protected]>
ext4: fix miss release buffer head inext4_fc_write_inodeZhihao Cheng <[email protected]>
ext4: fix dir corruption whenext4_dx_add_entry()failsJeff Layton <[email protected]>
ext4: fixi_versionhandling in ext4Jinke Han <[email protected]>
ext4: place buffer head allocation before handle startZhang Yi <[email protected]>
ext4:ext4_read_bh_lock()should submit IO if the buffer isn't uptodateJeff Layton <[email protected]>
ext4: unconditionally enable thei_versioncounterLukas Czerner <[email protected]>
ext4: don't increase iversion counter forea_inodesJan Kara <[email protected]>
ext4: fix check for block being out of directory sizeLalith Rajendran <[email protected]>
ext4: makeext4_lazyinit_threadfreezableBaokun Li <[email protected]>
ext4: fix null-ptr-deref inext4_write_infoJan Kara <[email protected]>
ext4: avoid crash when inline data creation follows DIO writeJan Kara <[email protected]>
ext2: Add sanity checks for group and filesystem sizeYe Bin <[email protected]>
jbd2: add miss release buffer head infc_do_one_pass()Ye Bin <[email protected]>
jbd2: fix potential use-after-free injbd2_fc_wait_bufsYe Bin <[email protected]>
jbd2: fix potential buffer head reference count leakAndrew Perepechko <[email protected]>
jbd2: wake up journal waiters in FIFO order, not LIFOJaegeuk Kim <[email protected]>
f2fs: allow direct read for zoned deviceChao Yu <[email protected]>
f2fs: fix to do sanity check on summary infoChao Yu <[email protected]>
f2fs: fix to do sanity check on destination blkaddr during recoveryJaegeuk Kim <[email protected]>
f2fs: increase the limit forreserve_rootJaegeuk Kim <[email protected]>
f2fs: flush pending checkpoints when freezing superJaegeuk Kim <[email protected]>
f2fs: complete checkpoints during remountJaegeuk Kim <[email protected]>
f2fs: fix wrong continue condition in GCTetsuo Handa <[email protected]>
btrfs: set generation before callingbtrfs_clean_tree_blockinbtrfs_init_new_bufferFilipe Manana <[email protected]>
btrfs: fix missed extent on fsync after dropping extent mapsFilipe Manana <[email protected]>
btrfs: fix race between quota enable and quota rescan ioctlQu Wenruo <[email protected]>
btrfs: enhance unsupported compat RO flags handlingAlexander Zhu <[email protected]>
btrfs: fix alignment of VMA for memory mapped files on THPLukas Czerner <[email protected]>
fs: recordI_DIRTY_TIMEeven if inode already hasI_DIRTY_INODEMickaël Salaün <[email protected]>
ksmbd: Fix user namespace mappingZhang Xiaoxu <[email protected]>
ksmbd: Fix wrong return value and message length check insmb2_ioctl()Namjae Jeon <[email protected]>
ksmbd: fix endless loop when encryption for response failsNamjae Jeon <[email protected]>
ksmbd: fix incorrect handling ofiterate_dirSteve French <[email protected]>
smb3: do not log confusing message when server returns no network
interfacesJason A. Donenfeld <[email protected]>
hwrng: core - let sleep be interrupted when unregistering hwrngHyunwoo Kim <[email protected]>
fbdev: smscufx: Fix use-after-free inufx_ops_open()Quentin Schulz <[email protected]>
pinctrl: rockchip: add pinmux_ops.gpio_set_direction callbackQuentin Schulz <[email protected]>
gpio: rockchip: request GPIO mux to pinctrl when setting directionSaurav Kashyap <[email protected]>
scsi: qedf: Populate sysfs attributes for vportJames Smart <[email protected]>
scsi: lpfc: Rework MIB Rx Monitor debug info logicKrzysztof Kozlowski <[email protected]>
slimbus: qcom-ngd: cleanup in probe error pathKrzysztof Kozlowski <[email protected]>
slimbus: qcom-ngd: use correct error in message ofpdr_add_lookup()
failurePali Rohár <[email protected]>
powerpc/boot: Explicitly disable usage of SPE instructionsChristophe Leroy <[email protected]>
powerpc/Kconfig: Fix non existingCONFIG_PPC_FSL_BOOKEZhang Rui <[email protected]>
powercap:intel_rapl: Use standard Energy Unit for SPR Dram RAPL domainMatthias Kaehlcke <[email protected]>
LoadPin: FixKconfigdoc about format of file with verity digestsViresh Kumar <[email protected]>
cpufreq: qcom-cpufreq-hw: Fix uninitializedthrottled_freqwarningChuck Lever <[email protected]>
NFSD: Protect against send buffer overflow in NFSv3 READChuck Lever <[email protected]>
NFSD: Protect against send buffer overflow in NFSv2 READChuck Lever <[email protected]>
NFSD: Protect against send buffer overflow in NFSv3 READDIRMaciej W. Rozycki <[email protected]>
serial: 8250: Request full 16550A feature probing for OxSemi PCIe
devicesMaciej W. Rozycki <[email protected]>
serial: 8250: Let drivers request full 16550A feature probingLukas Wunner <[email protected]>
serial: ar933x: Deassert Transmit Enable on ->rs485_config()Lukas Wunner <[email protected]>
serial: Deassert Transmit Enable on probe in driver-specific wayLukas Wunner <[email protected]>
serial: stm32: Deassert Transmit Enable on ->rs485_config()Christophe Leroy <[email protected]>
serial:cpm_uart: Don't request IRQ too early for console portMaciej W. Rozycki <[email protected]>
PCI: Sanitise firmware BAR assignments behind a PCI-PCI bridgeM. Vefa Bicakci <[email protected]>
xen/gntdev: Accommodate VMA splittingM. Vefa Bicakci <[email protected]>
xen/gntdev: Prevent leaking grantsCarlos Llamas <[email protected]>
mm/mmap: undo ->mmap() when arch_validate_flags() failsPeter Xu <[email protected]>
mm/uffd: fix warning withoutPTE_MARKER_UFFD_WPcompiled inBaolin Wang <[email protected]>
mm/damon: validate if the pmd entry is present before accessingBaolin Wang <[email protected]>
mm/hugetlb: fix races when looking up a CONT-PTE/PMD size hugetlb pageYang Guo <[email protected]>
clocksource/drivers/arm_arch_timer: FixCNTPCT_LOandCNTVCT_LOvalueJames Morse <[email protected]>
arm64: errata: Add Cortex-A55 to the repeat tlbi listCatalin Marinas <[email protected]>
arm64: mte: Avoid settingPG_mte_taggedif no tags cleared or restoredPeter Collingbourne <[email protected]>
arm64: mte: move register initialization to CTakashi Iwai <[email protected]>
drm/udl: Restore display mode on resumeDmitry Osipenko <[email protected]>
drm/virtio: Use appropriate atomic state invirtio_gpu_plane_cleanup_fb()Dmitry Osipenko <[email protected]>
drm/virtio: Unlock reservations ondma_resv_reserve_fences()errorDmitry Osipenko <[email protected]>
drm/virtio: Unlock reservations onvirtio_gpu_object_shmem_init()errorDmitry Osipenko <[email protected]>
drm/virtio: Check whether transferred 2D BO is shmemChristian Marangi <[email protected]>
dmaengine: qcom-adm: fix wrong calling convention forprep_slave_sgChristian Marangi <[email protected]>
dmaengine: qcom-adm: fix wrong sizeof config inslave_configDario Binacchi <[email protected]>
dmaengine: mxs: useplatform_driver_registerMatthias Kaehlcke <[email protected]>
dm: verity-loadpin: Only trust verity targets with enforcementHamza Mahfooz <[email protected]>
Revert "drm/amdgpu: use dirty framebuffer helper"Sagi Grimberg <[email protected]>
nvme-multipath: fix possible hang in live ns resize with ANA accessGaosheng Cui <[email protected]>
nvmem: core: Fix memleak innvmem_register()Huacai Chen <[email protected]>
UM: cpuinfo: Fix a warning forCONFIG_CPUMASK_OFFSTACKFangrui Song <[email protected]>
riscv: Pass -mno-relax only on lld < 15.0.0Wenting Zhang <[email protected]>
riscv: always honor theCONFIG_CMDLINE_FORCEwhen parsing dtbAndrew Bresticker <[email protected]>
riscv: MakeVM_WRITEimplyVM_READAndrew Bresticker <[email protected]>
riscv: Allow PROT_WRITE-onlymmap()Jisheng Zhang <[email protected]>
riscv: vdso: fix NULL deference invdso_join_timens()when vforkHelge Deller <[email protected]>
parisc: Fix userspace graphics card breakage due to pgtable special bitHelge Deller <[email protected]>
parisc: fbdev/stifb: Align graphics memory size to 4MBMaciej W. Rozycki <[email protected]>
RISC-V: Make port I/O string accessors actually workPalmer Dabbelt <[email protected]>
RISC-V: Re-enable counter access from userspaceConor Dooley <[email protected]>
riscv: topology: fix default topology reportingConor Dooley <[email protected]>
arm64: topology: movestore_cpu_topology()to shared codeLinus Walleij <[email protected]>
regulator:qcom_rpm: Fix circular deferral regressionMika Westerberg <[email protected]>
net: thunderbolt: Enable DMA paths only after rings are enabledLiang He <[email protected]>
hwmon: (gsc-hwmon) Callof_node_get()beforeof_find_xxxAPIKrzysztof Kozlowski <[email protected]>
ASoC: wcd934x: fix order of Slimbus unprepare/disableKrzysztof Kozlowski <[email protected]>
ASoC: wcd9335: fix order of Slimbus unprepare/disableKrzysztof Kozlowski <[email protected]>
arm64: dts: qcom: sdm845-mtp: correct ADC settle timePatryk Duda <[email protected]>
platform/chrome:cros_ec_proto: Update version onGET_NEXT_EVENT
failureZhihao Cheng <[email protected]>
quota: Check next/prev free block number after reading from quota fileAndri Yngvason <[email protected]>
HID: multitouch: Add memory barriersJan Kara <[email protected]>
mbcache: Avoid nesting of cache->c_list_lock under bit locksRoberto Sassu <[email protected]>
btf: Exportbpf_dynptrdefinitionAlexander Aring <[email protected]>
fs: dlm: fix invalid derefence ofsb_lvbptrAlexander Aring <[email protected]>
fs: dlm: handle-EBUSYfirst in lock arg validationAlexander Aring <[email protected]>
fs: dlm: fix race betweentest_bit()andqueue_work()Jarkko Nikula <[email protected]>
i2c: designware: Fix handling of real but unexpected device interruptsWenchao Chen <[email protected]>
mmc: sdhci-sprd: Fix minimum clock limitPrathamesh Shete <[email protected]>
mmc: sdhci-tegra: Use actual clock rate for SW tuning correctionBiju Das <[email protected]>
mmc:renesas_sdhi: Fix rounding errorsAnssi Hannula <[email protected]>
can:kvaser_usb_leaf: Fix CAN state after restartAnssi Hannula <[email protected]>
can:kvaser_usb_leaf: Fix TX queue out of sync after restartAnssi Hannula <[email protected]>
can:kvaser_usb_leaf: Fix overread with an invalid commandAnssi Hannula <[email protected]>
can:kvaser_usb: Fix use of uninitialized completionAvri Altman <[email protected]>
mmc: core: Add SD card quirk for broken discardJean-Francois Le Fillatre <[email protected]>
usb: add quirks for Lenovo OneLink+ DockNathan Chancellor <[email protected]>
usb: gadget: uvc: Fix argument tosizeof()inuvc_register_video()Rafael Mendonca <[email protected]>
xhci: dbc: Fix memory leak inxhci_alloc_dbc()Eddie James <[email protected]>
iio: pressure: dps310: Reset chip after timeoutEddie James <[email protected]>
iio: pressure: dps310: Refactor startup procedureNuno Sá <[email protected]>
iio: adc: ad7923: fix channel readings for some variantsUwe Kleine-König <[email protected]>
iio: ltc2497: Fix reading conversion resultsMichael Hennerich <[email protected]>
iio: dac: ad5593r: Fix i2c read protocol requirementsZhang Xiaoxu <[email protected]>
cifs: Fix the error length ofVALIDATE_NEGOTIATE_INFOmessageRonnie Sahlberg <[email protected]>
cifs: destage dirty pages before re-reading them for cache=noneGaurav Kohli <[email protected]>
hv_netvsc: Fix race between VF offering and VF association message from
hostPavel Begunkov <[email protected]>
io_uring: correctpinned_vmaccountingPavel Begunkov <[email protected]>
io_uring/af_unix: defer registered files gc toio_uringreleaseJens Axboe <[email protected]>
io_uring/net: handle-EINPROGRESScorrect forIORING_OP_CONNECTPavel Begunkov <[email protected]>
io_uring: limit registration w/SINGLE_ISSUERPavel Begunkov <[email protected]>
io_uring/net: don't updatemsg_nameif not providedStefan Metzmacher <[email protected]>
io_uring/net: fixfast_iovassignment inio_setup_async_msg()Pavel Begunkov <[email protected]>
io_uring/rw: don't lose short results onio_setup_async_rw()Pavel Begunkov <[email protected]>
io_uring/rw: fix unexpected link breakagePavel Begunkov <[email protected]>
io_uring/net: don't lose partial send/recv on failPavel Begunkov <[email protected]>
io_uring/rw: don't lose partial IO result on failPavel Begunkov <[email protected]>
io_uring: add custom opcode hooks on failTudor Ambarus <[email protected]>
mtd: rawnand: atmel: Unmap streaming DMA mappingsSaranya Gopal <[email protected]>
ALSA: hda/realtek: Add Intel Reference SSID to support headset keysLuke D. Jones <[email protected]>
ALSA: hda/realtek: Add quirk for ASUS GV601R laptopLuke D. Jones <[email protected]>
ALSA: hda/realtek: Correct pin configs for ASUS G533ZCallum Osmotherly <[email protected]>
ALSA: hda/realtek: removeALC289_FIXUP_DUAL_SPKfor Dell 5530Takashi Iwai <[email protected]>
ALSA: usb-audio: Fix NULL dererence at error pathTakashi Iwai <[email protected]>
ALSA: usb-audio: Fix potential memory leaksTakashi Iwai <[email protected]>
ALSA: rawmidi: Dropregister_mutexinsnd_rawmidi_free()Takashi Iwai <[email protected]>
ALSA: oss: Fix potential deadlock at unregistration-------------
Diffstat:
Documentation/ABI/testing/sysfs-bus-iio | 2 +- Documentation/admin-guide/kernel-parameters.txt | 4 + Documentation/arm64/silicon-errata.rst | 2 + Documentation/filesystems/vfs.rst | 3 + .../trace/coresight/coresight-cpu-debug.rst | 3 +- Makefile | 4 +- arch/arm/Kconfig | 1 - arch/arm/boot/compressed/misc.c | 2 + arch/arm/boot/compressed/vmlinux.lds.S | 2 + arch/arm/boot/dts/armada-385-turris-omnia.dts | 4 +- arch/arm/boot/dts/exynos4412-midas.dtsi | 2 +- arch/arm/boot/dts/exynos4412-origen.dts | 2 +- arch/arm/boot/dts/imx6dl-riotboard.dts | 1 + arch/arm/boot/dts/imx6dl.dtsi | 3 + arch/arm/boot/dts/imx6q-arm2.dts | 1 + arch/arm/boot/dts/imx6q-evi.dts | 1 + arch/arm/boot/dts/imx6q-mccmon6.dts | 1 + arch/arm/boot/dts/imx6q.dtsi | 3 + arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi | 6 +- arch/arm/boot/dts/imx6qdl-nit6xlite.dtsi | 1 + arch/arm/boot/dts/imx6qdl-nitrogen6_max.dtsi | 1 + arch/arm/boot/dts/imx6qdl-nitrogen6_som2.dtsi | 1 + arch/arm/boot/dts/imx6qdl-nitrogen6x.dtsi | 1 + arch/arm/boot/dts/imx6qdl-sabreauto.dtsi | 1 + arch/arm/boot/dts/imx6qdl-tqma6a.dtsi | 1 + arch/arm/boot/dts/imx6qdl-ts7970.dtsi | 1 + arch/arm/boot/dts/imx6qp.dtsi | 6 + arch/arm/boot/dts/imx6sl.dtsi | 23 +- arch/arm/boot/dts/imx6sll.dtsi | 3 + arch/arm/boot/dts/imx6sx-udoo-neo.dtsi | 14 +- arch/arm/boot/dts/imx6sx.dtsi | 6 + arch/arm/boot/dts/imx7d-sdb.dts | 7 +- arch/arm/boot/dts/kirkwood-lsxl.dtsi | 16 +- arch/arm/boot/dts/uniphier-pinctrl.dtsi | 10 + arch/arm/include/asm/stacktrace.h | 6 + arch/arm/kernel/return_address.c | 1 + arch/arm/kernel/stacktrace.c | 84 +++-- arch/arm/lib/call_with_stack.S | 2 + arch/arm/mm/dma-mapping.c | 12 +- arch/arm/mm/dump.c | 2 +- arch/arm/mm/kasan_init.c | 9 +- arch/arm/mm/mmu.c | 4 + arch/arm/plat-orion/Makefile | 2 +- arch/arm64/Kconfig | 17 + .../boot/dts/exynos/exynos5433-tm2-common.dtsi | 2 +- .../boot/dts/freescale/imx8mm-kontron-n801x-s.dts | 3 + .../dts/freescale/imx8mm-kontron-n801x-som.dtsi | 2 - arch/arm64/boot/dts/freescale/imx8mp.dtsi | 4 +- arch/arm64/boot/dts/freescale/imx8mq-librem5.dtsi | 1 + arch/arm64/boot/dts/marvell/ac5-98dx25xx.dtsi | 8 +- arch/arm64/boot/dts/qcom/ipq8074.dtsi | 4 +- arch/arm64/boot/dts/qcom/pm8350c.dtsi | 3 +- arch/arm64/boot/dts/qcom/sa8295p-adp.dts | 11 - .../boot/dts/qcom/sc7180-trogdor-coachz-r1.dts | 2 - arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor.dtsi | 2 - arch/arm64/boot/dts/qcom/sc7280-idp.dts | 2 +- arch/arm64/boot/dts/qcom/sc7280-idp.dtsi | 2 +- arch/arm64/boot/dts/qcom/sc7280.dtsi | 9 +- arch/arm64/boot/dts/qcom/sc8280xp-crd.dts | 9 - .../dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts | 10 - arch/arm64/boot/dts/qcom/sc8280xp-pmics.dtsi | 3 +- arch/arm64/boot/dts/qcom/sdm845-mtp.dts | 12 +- arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts | 2 +- .../boot/dts/qcom/sm8350-sony-xperia-sagami.dtsi | 2 +- arch/arm64/boot/dts/qcom/sm8450.dtsi | 2 +- arch/arm64/boot/dts/renesas/r9a07g043.dtsi | 8 +- arch/arm64/boot/dts/renesas/r9a07g044.dtsi | 8 +- arch/arm64/boot/dts/renesas/r9a07g054.dtsi | 8 +- arch/arm64/boot/dts/socionext/Makefile | 4 +- .../dts/socionext/uniphier-pxs3-ref-gadget0.dts | 41 +++ .../dts/socionext/uniphier-pxs3-ref-gadget1.dts | 40 +++ .../boot/dts/ti/k3-j7200-common-proc-board.dts | 10 +- arch/arm64/boot/dts/ti/k3-j7200-main.dtsi | 11 +- arch/arm64/include/asm/mte.h | 5 + arch/arm64/kernel/cpu_errata.c | 5 + arch/arm64/kernel/cpufeature.c | 3 +- arch/arm64/kernel/ftrace.c | 17 +- arch/arm64/kernel/mte.c | 60 +++- arch/arm64/kernel/suspend.c | 2 + arch/arm64/kernel/topology.c | 40 --- arch/arm64/mm/mteswap.c | 7 +- arch/arm64/mm/proc.S | 46 +-- arch/ia64/mm/numa.c | 1 + arch/m68k/kernel/setup_mm.c | 5 +- arch/mips/bcm47xx/prom.c | 4 +- arch/mips/boot/dts/ralink/mt7621-gnubee-gb-pc2.dts | 6 +- arch/mips/sgi-ip27/ip27-xtalk.c | 70 +++-- arch/mips/sgi-ip30/ip30-xtalk.c | 70 +++-- arch/parisc/include/asm/pgtable.h | 7 +- arch/parisc/kernel/entry.S | 8 + arch/powerpc/Kconfig | 2 +- arch/powerpc/Makefile | 2 +- arch/powerpc/boot/Makefile | 1 + arch/powerpc/boot/dts/fsl/e500v1_power_isa.dtsi | 51 +++ arch/powerpc/boot/dts/fsl/mpc8540ads.dts | 2 +- arch/powerpc/boot/dts/fsl/mpc8541cds.dts | 2 +- arch/powerpc/boot/dts/fsl/mpc8555cds.dts | 2 +- arch/powerpc/boot/dts/fsl/mpc8560ads.dts | 2 +- arch/powerpc/boot/dts/turris1x.dts | 14 +- arch/powerpc/configs/pseries_defconfig | 1 + arch/powerpc/include/asm/interrupt.h | 3 +- arch/powerpc/include/asm/syscalls.h | 12 + arch/powerpc/kernel/interrupt.c | 10 - arch/powerpc/kernel/interrupt_64.S | 45 ++- arch/powerpc/kernel/kprobes.c | 8 +- arch/powerpc/kernel/pci_dn.c | 1 + arch/powerpc/kernel/setup_64.c | 4 +- arch/powerpc/kernel/sys_ppc32.c | 14 +- arch/powerpc/kernel/syscalls.c | 4 +- arch/powerpc/math-emu/math_efp.c | 1 + arch/powerpc/platforms/powernv/opal.c | 1 + arch/powerpc/platforms/pseries/vas.c | 2 +- arch/powerpc/sysdev/fsl_msi.c | 2 + arch/riscv/Kconfig | 2 +- arch/riscv/Makefile | 2 + arch/riscv/include/asm/io.h | 16 +- arch/riscv/include/asm/mmu.h | 1 - arch/riscv/kernel/setup.c | 4 +- arch/riscv/kernel/smpboot.c | 3 +- arch/riscv/kernel/sys_riscv.c | 3 - arch/riscv/kernel/vdso.c | 13 +- arch/riscv/mm/fault.c | 3 +- arch/sh/include/asm/sections.h | 2 +- arch/sh/kernel/machvec.c | 10 +- arch/um/kernel/um_arch.c | 2 +- arch/x86/Kconfig | 7 +- arch/x86/include/asm/cpu.h | 2 + arch/x86/include/asm/hyperv-tlfs.h | 4 +- arch/x86/include/asm/microcode.h | 1 + arch/x86/include/asm/msr-index.h | 13 + arch/x86/include/asm/paravirt_types.h | 11 +- arch/x86/kernel/apic/apic.c | 44 ++- arch/x86/kernel/cpu/feat_ctl.c | 2 +- arch/x86/kernel/cpu/mce/apei.c | 13 +- arch/x86/kernel/cpu/microcode/amd.c | 3 +- arch/x86/kernel/cpu/resctrl/pseudo_lock.c | 12 +- arch/x86/kvm/emulate.c | 2 +- arch/x86/kvm/vmx/nested.c | 37 ++- arch/x86/kvm/vmx/vmx.c | 12 +- arch/x86/kvm/x86.c | 27 +- arch/x86/net/bpf_jit_comp.c | 16 +- arch/x86/xen/enlighten_pv.c | 3 +- block/bio.c | 2 - block/blk-mq.c | 6 +- block/blk-throttle.c | 28 +- block/blk-throttle.h | 2 +- block/blk-wbt.c | 10 +- block/blk.h | 3 +- block/elevator.c | 4 +- crypto/akcipher.c | 8 + drivers/acpi/acpi_fpdt.c | 22 ++ drivers/acpi/acpi_pcc.c | 28 +- drivers/acpi/acpi_video.c | 16 + drivers/acpi/apei/ghes.c | 2 +- drivers/acpi/x86/utils.c | 19 +- drivers/ata/libahci_platform.c | 14 +- drivers/base/arch_topology.c | 19 ++ drivers/block/nbd.c | 6 +- drivers/bluetooth/btintel.c | 17 +- drivers/bluetooth/btusb.c | 14 + drivers/bluetooth/hci_ldisc.c | 7 +- drivers/bluetooth/hci_serdev.c | 10 +- drivers/char/hw_random/arm_smccc_trng.c | 4 +- drivers/char/hw_random/core.c | 19 +- drivers/char/hw_random/imx-rngc.c | 37 +-- drivers/char/random.c | 4 +- drivers/clk/baikal-t1/ccu-div.c | 65 ++++ drivers/clk/baikal-t1/ccu-div.h | 10 + drivers/clk/baikal-t1/clk-ccu-div.c | 26 +- drivers/clk/bcm/clk-bcm2835.c | 43 ++- drivers/clk/berlin/bg2.c | 5 +- drivers/clk/berlin/bg2q.c | 6 +- drivers/clk/clk-ast2600.c | 2 +- drivers/clk/clk-oxnas.c | 6 +- drivers/clk/clk-qoriq.c | 10 +- drivers/clk/clk-versaclock5.c | 2 +- drivers/clk/imx/clk-imx8mp.c | 2 +- drivers/clk/imx/clk-scu.c | 6 +- drivers/clk/mediatek/clk-mt8183-mfgcfg.c | 6 +- drivers/clk/mediatek/clk-mt8195-infra_ao.c | 13 +- drivers/clk/mediatek/clk-mt8195-mfg.c | 6 +- drivers/clk/mediatek/clk-mt8195-vdo0.c | 7 +- drivers/clk/mediatek/clk-mt8195-vdo1.c | 6 +- drivers/clk/mediatek/clk-mtk.c | 12 +- drivers/clk/meson/meson-aoclk.c | 5 +- drivers/clk/meson/meson-eeclk.c | 5 +- drivers/clk/meson/meson8b.c | 5 +- drivers/clk/qcom/Kconfig | 1 + drivers/clk/qcom/apss-ipq6018.c | 2 +- drivers/clk/qcom/gcc-sdm660.c | 2 +- drivers/clk/qcom/gcc-sm6115.c | 46 ++- drivers/clk/samsung/clk-exynosautov9.c | 20 +- drivers/clk/sprd/common.c | 9 +- drivers/clk/st/clkgen-fsyn.c | 5 +- drivers/clk/st/clkgen-mux.c | 5 +- drivers/clk/tegra/clk-tegra114.c | 1 + drivers/clk/tegra/clk-tegra20.c | 1 + drivers/clk/tegra/clk-tegra210.c | 1 + drivers/clk/ti/clk-dra7-atl.c | 9 +- drivers/clk/ti/clk.c | 5 +- drivers/clk/zynqmp/clkc.c | 7 + drivers/clk/zynqmp/pll.c | 31 +- drivers/clocksource/arm_arch_timer.c | 6 +- drivers/clocksource/timer-gxp.c | 7 +- drivers/cpufreq/amd-pstate.c | 16 +- drivers/cpufreq/intel_pstate.c | 1 + drivers/cpufreq/qcom-cpufreq-hw.c | 10 +- drivers/cpuidle/cpuidle-riscv-sbi.c | 7 +- drivers/crypto/cavium/cpt/cptpf_main.c | 6 +- drivers/crypto/ccp/ccp-dmaengine.c | 6 +- drivers/crypto/ccp/sev-dev.c | 26 +- drivers/crypto/hisilicon/qm.c | 6 +- drivers/crypto/hisilicon/zip/zip_crypto.c | 4 +- drivers/crypto/inside-secure/safexcel_hash.c | 8 +- drivers/crypto/marvell/octeontx/otx_cptpf_ucode.c | 18 +- drivers/crypto/qat/qat_common/adf_gen4_hw_data.h | 2 +- drivers/crypto/qat/qat_common/qat_algs.c | 18 +- drivers/crypto/sahara.c | 18 +- drivers/dma-buf/udmabuf.c | 9 +- drivers/dma/dw-edma/dw-edma-core.c | 12 - drivers/dma/hisi_dma.c | 28 +- drivers/dma/idxd/irq.c | 2 - drivers/dma/ioat/dma.c | 6 +- drivers/dma/mxs-dma.c | 11 +- drivers/dma/qcom/qcom_adm.c | 22 +- drivers/dma/ti/k3-udma.c | 25 +- drivers/firmware/efi/libstub/fdt.c | 8 - drivers/firmware/google/gsmi.c | 9 + drivers/fpga/dfl-pci.c | 18 ++ drivers/fpga/dfl.c | 2 +- drivers/fsi/fsi-core.c | 3 + drivers/fsi/fsi-master-ast-cf.c | 2 + drivers/fsi/fsi-occ.c | 18 +- drivers/gpio/gpio-rockchip.c | 7 + drivers/gpu/drm/Kconfig | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | 7 +- drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 14 +- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 5 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm_sdma.c | 9 +- drivers/gpu/drm/amd/amdgpu/mmhub_v3_0.c | 10 +- drivers/gpu/drm/amd/amdgpu/sdma_v6_0.c | 3 +- drivers/gpu/drm/amd/amdgpu/soc21.c | 5 + .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 45 ++- drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c | 3 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 83 ++--- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_psr.c | 8 +- .../drm/amd/display/dc/clk_mgr/dcn314/dcn314_smu.c | 11 +- drivers/gpu/drm/amd/display/dc/core/dc.c | 16 +- drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 6 +- drivers/gpu/drm/amd/display/dc/dc_stream.h | 6 +- .../drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c | 35 +-- .../drm/amd/display/dc/dcn10/dcn10_hw_sequencer.h | 3 +- .../display/dc/dcn31/dcn31_hpo_dp_stream_encoder.c | 6 +- .../drm/amd/display/dc/dcn314/dcn314_resource.c | 4 +- drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hubp.c | 1 + drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c | 4 + .../gpu/drm/amd/display/dc/dml/calcs/bw_fixed.c | 6 +- .../gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c | 1 + .../amd/display/dc/dml/dcn32/display_mode_vba_32.c | 2 + .../gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c | 1 + drivers/gpu/drm/amd/display/dc/inc/hw_sequencer.h | 8 +- drivers/gpu/drm/arm/display/komeda/komeda_crtc.c | 4 +- drivers/gpu/drm/arm/display/komeda/komeda_kms.c | 21 +- drivers/gpu/drm/arm/display/komeda/komeda_kms.h | 2 + drivers/gpu/drm/bridge/adv7511/adv7511.h | 5 +- drivers/gpu/drm/bridge/adv7511/adv7511_cec.c | 4 +- drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 5 +- drivers/gpu/drm/bridge/analogix/anx7625.c | 1 + drivers/gpu/drm/bridge/ite-it6505.c | 5 +- drivers/gpu/drm/bridge/lontium-lt9611.c | 3 +- .../drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c | 4 +- drivers/gpu/drm/bridge/parade-ps8640.c | 4 +- drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 13 +- drivers/gpu/drm/bridge/tc358767.c | 5 +- drivers/gpu/drm/display/drm_dp_helper.c | 9 - drivers/gpu/drm/display/drm_dp_mst_topology.c | 6 +- drivers/gpu/drm/drm_bridge.c | 4 +- drivers/gpu/drm/drm_ioctl.c | 8 +- drivers/gpu/drm/drm_mipi_dsi.c | 1 + drivers/gpu/drm/drm_panel_orientation_quirks.c | 18 ++ drivers/gpu/drm/i915/display/intel_cdclk.c | 4 +- drivers/gpu/drm/i915/gem/i915_gem_context.c | 8 +- drivers/gpu/drm/i915/gt/gen6_ppgtt.c | 16 +- drivers/gpu/drm/i915/gt/gen8_ppgtt.c | 58 ++-- drivers/gpu/drm/i915/gt/intel_context.c | 5 +- drivers/gpu/drm/i915/gt/intel_context.h | 3 +- drivers/gpu/drm/i915/gt/intel_ggtt.c | 8 +- drivers/gpu/drm/i915/gt/intel_gtt.c | 3 + drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c | 26 +- drivers/gpu/drm/i915/intel_pm.c | 16 +- drivers/gpu/drm/meson/meson_drv.c | 14 +- drivers/gpu/drm/meson/meson_drv.h | 7 + drivers/gpu/drm/meson/meson_encoder_cvbs.c | 13 + drivers/gpu/drm/meson/meson_encoder_cvbs.h | 1 + drivers/gpu/drm/meson/meson_encoder_hdmi.c | 13 + drivers/gpu/drm/meson/meson_encoder_hdmi.h | 1 + drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 19 +- drivers/gpu/drm/msm/disp/dpu1/dpu_vbif.c | 29 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_kms.c | 9 +- drivers/gpu/drm/msm/dp/dp_catalog.c | 2 +- drivers/gpu/drm/msm/msm_drv.c | 13 +- drivers/gpu/drm/msm/msm_drv.h | 2 + drivers/gpu/drm/msm/msm_io_utils.c | 22 ++ drivers/gpu/drm/nouveau/nouveau_bo.c | 4 +- drivers/gpu/drm/nouveau/nouveau_connector.c | 3 +- drivers/gpu/drm/nouveau/nouveau_prime.c | 1 - drivers/gpu/drm/omapdrm/dss/dss.c | 3 + drivers/gpu/drm/panel/Kconfig | 4 +- drivers/gpu/drm/pl111/pl111_versatile.c | 1 + drivers/gpu/drm/tests/drm_format_helper_test.c | 23 +- drivers/gpu/drm/tiny/bochs.c | 2 + drivers/gpu/drm/udl/udl_modeset.c | 3 - drivers/gpu/drm/vc4/vc4_drv.c | 14 +- drivers/gpu/drm/vc4/vc4_drv.h | 1 + drivers/gpu/drm/vc4/vc4_vec.c | 4 +- drivers/gpu/drm/virtio/virtgpu_display.c | 2 + drivers/gpu/drm/virtio/virtgpu_gem.c | 4 +- drivers/gpu/drm/virtio/virtgpu_ioctl.c | 4 +- drivers/gpu/drm/virtio/virtgpu_object.c | 3 + drivers/gpu/drm/virtio/virtgpu_plane.c | 6 +- drivers/gpu/drm/virtio/virtgpu_vq.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_msg.c | 1 + drivers/hid/Kconfig | 6 + drivers/hid/Makefile | 1 + drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c | 2 + drivers/hid/hid-ids.h | 3 + drivers/hid/hid-multitouch.c | 8 +- drivers/hid/hid-nintendo.c | 55 ++-- drivers/hid/hid-roccat.c | 4 + drivers/hid/hid-topre.c | 49 +++ drivers/hid/hid-uclogic-core.c | 1 + drivers/hid/hid-uclogic-rdesc.c | 2 +- drivers/hsi/clients/ssi_protocol.c | 1 + drivers/hsi/controllers/omap_ssi_core.c | 1 + drivers/hsi/controllers/omap_ssi_port.c | 8 +- drivers/hwmon/gsc-hwmon.c | 1 + drivers/hwmon/occ/p9_sbe.c | 17 +- drivers/hwmon/pmbus/mp2888.c | 13 +- drivers/hwmon/sht4x.c | 2 +- drivers/i2c/busses/i2c-designware-core.h | 7 +- drivers/i2c/busses/i2c-designware-master.c | 13 + drivers/i2c/busses/i2c-designware-pcidrv.c | 30 +- drivers/i2c/busses/i2c-mlxbf.c | 44 ++- drivers/iio/adc/ad7923.c | 4 +- drivers/iio/adc/at91-sama5d2_adc.c | 28 +- drivers/iio/adc/ltc2497.c | 13 + drivers/iio/dac/ad5593r.c | 46 +-- drivers/iio/industrialio-core.c | 5 + drivers/iio/inkern.c | 8 +- drivers/iio/magnetometer/yamaha-yas530.c | 2 +- drivers/iio/pressure/dps310.c | 262 ++++++++++------ drivers/infiniband/core/cm.c | 14 +- drivers/infiniband/core/uverbs_cmd.c | 5 +- drivers/infiniband/core/verbs.c | 2 + drivers/infiniband/hw/hns/hns_roce_mr.c | 1 - drivers/infiniband/hw/irdma/defs.h | 1 + drivers/infiniband/hw/irdma/hw.c | 51 +-- drivers/infiniband/hw/irdma/type.h | 1 + drivers/infiniband/hw/irdma/user.h | 1 + drivers/infiniband/hw/irdma/utils.c | 3 + drivers/infiniband/hw/irdma/verbs.c | 69 ++++- drivers/infiniband/hw/mlx4/mr.c | 1 - drivers/infiniband/hw/mlx5/main.c | 3 + drivers/infiniband/hw/mlx5/odp.c | 3 +- drivers/infiniband/sw/rxe/rxe_loc.h | 6 +- drivers/infiniband/sw/rxe/rxe_mr.c | 11 +- drivers/infiniband/sw/rxe/rxe_qp.c | 10 +- drivers/infiniband/sw/rxe/rxe_queue.c | 12 +- drivers/infiniband/sw/rxe/rxe_resp.c | 10 +- drivers/infiniband/sw/rxe/rxe_verbs.c | 12 +- drivers/infiniband/sw/siw/siw.h | 1 + drivers/infiniband/sw/siw/siw_qp.c | 2 +- drivers/infiniband/sw/siw/siw_qp_rx.c | 27 +- drivers/infiniband/sw/siw/siw_verbs.c | 3 + drivers/infiniband/ulp/srp/ib_srp.c | 4 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 21 ++ drivers/iommu/omap-iommu-debug.c | 6 +- drivers/isdn/mISDN/l1oip.h | 1 + drivers/isdn/mISDN/l1oip_core.c | 13 +- drivers/leds/flash/leds-lm3601x.c | 2 - drivers/mailbox/bcm-flexrm-mailbox.c | 8 +- drivers/mailbox/imx-mailbox.c | 10 +- drivers/mailbox/mailbox-mpfs.c | 25 +- drivers/md/bcache/writeback.c | 73 +++-- drivers/md/dm-verity-loadpin.c | 8 + drivers/md/dm-verity-target.c | 16 + drivers/md/dm-verity.h | 1 + drivers/md/md.c | 1 - drivers/md/raid0.c | 2 +- drivers/md/raid5.c | 15 +- drivers/media/pci/cx88/cx88-vbi.c | 9 +- drivers/media/pci/cx88/cx88-video.c | 43 +-- drivers/media/platform/amlogic/meson-ge2d/ge2d.c | 1 - drivers/media/platform/amphion/vdec.c | 16 +- drivers/media/platform/amphion/venc.c | 2 +- drivers/media/platform/amphion/vpu.h | 1 - drivers/media/platform/amphion/vpu_core.c | 84 ++--- drivers/media/platform/amphion/vpu_core.h | 1 + drivers/media/platform/amphion/vpu_dbg.c | 9 +- drivers/media/platform/amphion/vpu_malone.c | 2 +- .../media/platform/mediatek/jpeg/mtk_jpeg_core.c | 1 - .../platform/mediatek/vcodec/mtk_vcodec_enc.c | 3 +- .../media/platform/samsung/exynos4-is/fimc-is.c | 1 + drivers/media/platform/samsung/s5p-mfc/s5p_mfc.c | 3 +- drivers/media/platform/xilinx/xilinx-vipp.c | 9 +- drivers/media/usb/airspy/airspy.c | 4 + drivers/media/usb/uvc/uvc_ctrl.c | 83 ++--- drivers/media/usb/uvc/uvc_driver.c | 8 +- drivers/memory/of_memory.c | 2 + drivers/memory/pl353-smc.c | 1 + drivers/mfd/da9062-core.c | 1 + drivers/mfd/fsl-imx25-tsadc.c | 34 +- drivers/mfd/intel_soc_pmic_core.c | 1 + drivers/mfd/lp8788-irq.c | 3 + drivers/mfd/lp8788.c | 12 +- drivers/mfd/sm501.c | 7 +- drivers/misc/ocxl/file.c | 2 + drivers/mmc/core/block.c | 6 +- drivers/mmc/core/card.h | 6 + drivers/mmc/core/quirks.h | 6 + drivers/mmc/host/au1xmmc.c | 3 +- drivers/mmc/host/renesas_sdhi_core.c | 21 +- drivers/mmc/host/sdhci-msm.c | 1 + drivers/mmc/host/sdhci-sprd.c | 2 +- drivers/mmc/host/sdhci-tegra.c | 2 +- drivers/mmc/host/wmt-sdmmc.c | 5 +- drivers/mtd/devices/docg3.c | 7 +- drivers/mtd/nand/raw/atmel/nand-controller.c | 1 + drivers/mtd/nand/raw/fsl_elbc_nand.c | 28 +- drivers/mtd/nand/raw/intel-nand-controller.c | 12 +- drivers/mtd/nand/raw/meson_nand.c | 4 +- drivers/net/can/usb/kvaser_usb/kvaser_usb.h | 2 + drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c | 3 +- drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 2 +- drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 79 +++++ drivers/net/ethernet/atheros/alx/main.c | 5 + drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 1 + drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c | 10 +- drivers/net/ethernet/engleder/tsnep_hw.h | 3 +- drivers/net/ethernet/faraday/ftmac100.h | 12 +- drivers/net/ethernet/freescale/fs_enet/mac-fec.c | 2 +- drivers/net/ethernet/intel/iavf/iavf_main.c | 177 ++++++++--- drivers/net/ethernet/intel/ice/ice_ethtool.c | 1 + drivers/net/ethernet/marvell/mvpp2/mvpp2.h | 1 + drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c | 10 +- drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 13 +- .../net/ethernet/marvell/prestera/prestera_acl.c | 8 +- .../net/ethernet/marvell/prestera/prestera_acl.h | 4 +- .../ethernet/marvell/prestera/prestera_flower.c | 6 +- .../net/ethernet/marvell/prestera/prestera_main.c | 36 +-- drivers/net/ethernet/micrel/ks8851_spi.c | 5 +- drivers/net/ethernet/microchip/lan743x_ptp.c | 7 + drivers/net/ethernet/sunplus/spl2sw_driver.c | 2 +- drivers/net/ethernet/ti/Kconfig | 1 + drivers/net/ethernet/ti/davinci_mdio.c | 242 ++++++++++++++- drivers/net/ethernet/xilinx/xilinx_axienet.h | 12 + drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 37 ++- drivers/net/hyperv/hyperv_net.h | 3 +- drivers/net/hyperv/netvsc.c | 4 + drivers/net/hyperv/netvsc_drv.c | 19 ++ drivers/net/thunderbolt.c | 28 +- drivers/net/usb/r8152.c | 4 +- drivers/net/wireless/ath/ath10k/core.c | 16 + drivers/net/wireless/ath/ath10k/htc.c | 11 +- drivers/net/wireless/ath/ath10k/hw.h | 2 + drivers/net/wireless/ath/ath10k/mac.c | 54 ++-- drivers/net/wireless/ath/ath11k/ahb.c | 58 +++- drivers/net/wireless/ath/ath11k/core.c | 2 + drivers/net/wireless/ath/ath11k/dp_rx.c | 3 +- drivers/net/wireless/ath/ath11k/mac.c | 25 +- drivers/net/wireless/ath/ath11k/mhi.c | 17 +- drivers/net/wireless/ath/ath11k/peer.c | 30 +- drivers/net/wireless/ath/ath11k/qmi.c | 38 ++- drivers/net/wireless/ath/ath11k/qmi.h | 10 +- drivers/net/wireless/ath/ath11k/wmi.c | 9 +- drivers/net/wireless/ath/ath11k/wmi.h | 2 +- drivers/net/wireless/ath/ath9k/htc_hst.c | 43 ++- drivers/net/wireless/ath/ath9k/rng.c | 3 +- .../wireless/broadcom/brcm80211/brcmfmac/core.c | 3 +- .../net/wireless/broadcom/brcm80211/brcmfmac/pno.c | 12 +- drivers/net/wireless/mac80211_hwsim.c | 7 +- drivers/net/wireless/marvell/mwifiex/init.c | 9 +- drivers/net/wireless/marvell/mwifiex/main.h | 3 +- drivers/net/wireless/marvell/mwifiex/sta_event.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7615/main.c | 4 + .../net/wireless/mediatek/mt76/mt76_connac_mcu.c | 10 +- .../net/wireless/mediatek/mt76/mt7915/debugfs.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7915/mac.c | 12 +- drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 10 +- .../net/wireless/mediatek/mt76/mt7921/acpi_sar.c | 5 +- drivers/net/wireless/mediatek/mt76/mt7921/mac.c | 7 +- drivers/net/wireless/mediatek/mt76/mt7921/main.c | 26 +- drivers/net/wireless/mediatek/mt76/mt7921/pci.c | 15 +- drivers/net/wireless/mediatek/mt76/mt7921/sdio.c | 13 +- drivers/net/wireless/mediatek/mt76/mt7921/usb.c | 28 +- drivers/net/wireless/mediatek/mt76/sdio.c | 8 +- drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 34 +- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h | 6 +- .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 96 ++++-- .../net/wireless/realtek/rtlwifi/rtl8192de/phy.c | 9 +- drivers/net/wireless/realtek/rtw88/main.c | 8 +- drivers/net/wireless/realtek/rtw88/phy.c | 21 +- drivers/net/wireless/realtek/rtw89/core.c | 1 + drivers/net/wireless/realtek/rtw89/fw.c | 12 +- drivers/net/wireless/realtek/rtw89/pci.c | 5 +- drivers/net/wireless/realtek/rtw89/ser.c | 3 + drivers/net/wireless/silabs/wfx/main.c | 2 +- drivers/net/wireless/st/cw1200/queue.c | 18 +- drivers/net/wwan/iosm/iosm_ipc_wwan.c | 5 +- drivers/nvme/host/core.c | 20 +- drivers/nvme/host/ioctl.c | 9 +- drivers/nvme/host/multipath.c | 1 + drivers/nvme/host/nvme.h | 4 +- drivers/nvme/target/core.c | 1 + drivers/nvme/target/fabrics-cmd-auth.c | 13 +- drivers/nvme/target/fabrics-cmd.c | 6 +- drivers/nvme/target/nvmet.h | 7 +- drivers/nvme/target/passthru.c | 7 +- drivers/nvme/target/tcp.c | 11 +- drivers/nvmem/core.c | 15 +- drivers/pci/setup-res.c | 11 + drivers/perf/riscv_pmu_sbi.c | 7 +- .../phy/amlogic/phy-meson-axg-mipi-pcie-analog.c | 6 +- drivers/phy/mediatek/phy-mtk-tphy.c | 7 +- drivers/phy/qualcomm/phy-qcom-qmp-combo.c | 32 +- drivers/phy/qualcomm/phy-qcom-qmp-pcie-msm8996.c | 23 +- drivers/phy/qualcomm/phy-qcom-qmp-pcie.c | 39 ++- drivers/phy/qualcomm/phy-qcom-qmp-ufs.c | 30 +- drivers/phy/qualcomm/phy-qcom-qmp-usb.c | 64 ++-- drivers/phy/qualcomm/phy-qcom-usb-hsic.c | 6 +- drivers/phy/rockchip/phy-rockchip-inno-usb2.c | 10 +- drivers/pinctrl/pinctrl-rockchip.c | 13 + drivers/platform/chrome/chromeos_laptop.c | 24 +- drivers/platform/chrome/cros_ec.c | 8 +- drivers/platform/chrome/cros_ec_chardev.c | 3 + drivers/platform/chrome/cros_ec_proto.c | 32 ++ drivers/platform/chrome/cros_ec_typec.c | 5 +- drivers/platform/x86/hp-wmi.c | 11 +- drivers/platform/x86/msi-laptop.c | 14 +- drivers/platform/x86/pmc_atom.c | 2 +- drivers/power/supply/adp5061.c | 6 +- drivers/powercap/intel_rapl_common.c | 4 +- drivers/regulator/core.c | 2 +- drivers/regulator/qcom_rpm-regulator.c | 24 +- drivers/remoteproc/remoteproc_core.c | 5 +- drivers/rpmsg/rpmsg_char.c | 4 +- drivers/scsi/3w-9xxx.c | 2 +- drivers/scsi/iscsi_tcp.c | 73 +++-- drivers/scsi/iscsi_tcp.h | 3 + drivers/scsi/libsas/sas_expander.c | 2 +- drivers/scsi/lpfc/lpfc.h | 14 +- drivers/scsi/lpfc/lpfc_crtn.h | 8 + drivers/scsi/lpfc/lpfc_ct.c | 7 +- drivers/scsi/lpfc/lpfc_debugfs.c | 61 +--- drivers/scsi/lpfc/lpfc_debugfs.h | 2 +- drivers/scsi/lpfc/lpfc_hbadisc.c | 4 +- drivers/scsi/lpfc/lpfc_init.c | 332 ++++++++++---------- drivers/scsi/lpfc/lpfc_mem.c | 9 +- drivers/scsi/lpfc/lpfc_sli.c | 193 +++++++++++- drivers/scsi/lpfc/lpfc_sli4.h | 4 +- drivers/scsi/lpfc/lpfc_vmid.c | 4 +- drivers/scsi/pm8001/pm8001_hwi.c | 4 + drivers/scsi/qedf/qedf_main.c | 21 ++ drivers/slimbus/qcom-ngd-ctrl.c | 22 +- drivers/soc/qcom/smem_state.c | 3 +- drivers/soc/qcom/smsm.c | 20 +- drivers/soc/tegra/Kconfig | 1 - drivers/soc/tegra/fuse/fuse-tegra.c | 1 + drivers/soundwire/cadence_master.c | 9 +- drivers/soundwire/intel.c | 1 - drivers/spi/spi-cadence-quadspi.c | 3 +- drivers/spi/spi-dw-bt1.c | 4 +- drivers/spi/spi-meson-spicc.c | 6 +- drivers/spi/spi-mt7621.c | 8 +- drivers/spi/spi-omap-100k.c | 1 + drivers/spi/spi-qup.c | 21 +- drivers/spi/spi-s3c64xx.c | 9 + drivers/spi/spi.c | 2 + drivers/spmi/spmi-pmic-arb.c | 13 +- drivers/staging/greybus/audio_helper.c | 11 - drivers/staging/media/meson/vdec/vdec_hevc.c | 6 +- drivers/staging/media/sunxi/cedrus/cedrus.c | 4 +- drivers/staging/media/sunxi/cedrus/cedrus_dec.c | 4 +- drivers/staging/media/sunxi/cedrus/cedrus_h265.c | 5 +- drivers/staging/rtl8723bs/core/rtw_cmd.c | 16 +- drivers/staging/rtl8723bs/os_dep/os_intfs.c | 60 ++-- drivers/staging/vt6655/device_main.c | 8 +- drivers/thermal/cpufreq_cooling.c | 10 +- drivers/thermal/intel/intel_powerclamp.c | 6 +- drivers/thermal/qcom/tsens-v0_1.c | 2 +- drivers/thunderbolt/nhi.c | 49 ++- drivers/thunderbolt/switch.c | 24 ++ drivers/thunderbolt/tb.h | 1 + drivers/thunderbolt/tb_regs.h | 1 + drivers/thunderbolt/usb4.c | 20 ++ drivers/tty/serial/8250/8250_core.c | 16 +- drivers/tty/serial/8250/8250_omap.c | 3 + drivers/tty/serial/8250/8250_pci.c | 14 +- drivers/tty/serial/8250/8250_port.c | 30 +- drivers/tty/serial/ar933x_uart.c | 7 + drivers/tty/serial/cpm_uart/cpm_uart_core.c | 22 +- drivers/tty/serial/fsl_lpuart.c | 12 +- drivers/tty/serial/imx.c | 8 +- drivers/tty/serial/jsm/jsm_driver.c | 3 +- drivers/tty/serial/serial_core.c | 36 ++- drivers/tty/serial/stm32-usart.c | 100 +++--- drivers/tty/serial/xilinx_uartps.c | 14 +- drivers/usb/common/debug.c | 96 ++++-- drivers/usb/common/usb-conn-gpio.c | 6 +- drivers/usb/core/quirks.c | 4 + drivers/usb/dwc3/core.c | 83 +++-- drivers/usb/dwc3/core.h | 6 + drivers/usb/gadget/function/f_fs.c | 4 +- drivers/usb/gadget/function/f_printer.c | 12 +- drivers/usb/gadget/function/f_uvc.c | 6 +- drivers/usb/gadget/function/uvc.h | 1 + drivers/usb/gadget/function/uvc_v4l2.c | 2 +- drivers/usb/gadget/function/uvc_video.c | 9 +- drivers/usb/host/xhci-dbgcap.c | 2 +- drivers/usb/host/xhci-mem.c | 7 +- drivers/usb/host/xhci-plat.c | 18 +- drivers/usb/host/xhci.c | 3 +- drivers/usb/host/xhci.h | 1 + drivers/usb/misc/idmouse.c | 8 +- drivers/usb/mtu3/mtu3_core.c | 2 - drivers/usb/mtu3/mtu3_plat.c | 2 + drivers/usb/musb/musb_gadget.c | 3 + drivers/usb/storage/unusual_devs.h | 6 - drivers/usb/typec/anx7411.c | 4 +- drivers/usb/typec/ucsi/ucsi.c | 8 +- drivers/vhost/vsock.c | 2 +- drivers/video/aperture.c | 14 + drivers/video/fbdev/core/fbmem.c | 12 - drivers/video/fbdev/smscufx.c | 14 +- drivers/video/fbdev/stifb.c | 2 +- drivers/xen/gntdev-common.h | 3 +- drivers/xen/gntdev.c | 80 ++--- fs/btrfs/block-group.c | 11 +- fs/btrfs/extent-tree.c | 3 + fs/btrfs/file.c | 59 +++- fs/btrfs/free-space-cache.c | 59 ++-- fs/btrfs/qgroup.c | 15 + fs/btrfs/scrub.c | 69 +++-- fs/btrfs/super.c | 20 +- fs/cifs/cifsproto.h | 2 +- fs/cifs/connect.c | 2 +- fs/cifs/file.c | 9 + fs/cifs/smb2ops.c | 23 +- fs/cifs/smb2pdu.c | 7 +- fs/cifs/smb2transport.c | 10 +- fs/dlm/ast.c | 6 +- fs/dlm/lock.c | 20 +- fs/dlm/lowcomms.c | 4 + fs/erofs/inode.c | 2 +- fs/erofs/super.c | 2 +- fs/eventfd.c | 10 +- fs/ext2/super.c | 22 +- fs/ext4/fast_commit.c | 40 ++- fs/ext4/file.c | 6 + fs/ext4/inode.c | 17 +- fs/ext4/ioctl.c | 4 + fs/ext4/namei.c | 17 +- fs/ext4/resize.c | 2 +- fs/ext4/super.c | 47 +-- fs/ext4/xattr.c | 1 + fs/f2fs/checkpoint.c | 47 ++- fs/f2fs/data.c | 4 +- fs/f2fs/extent_cache.c | 3 +- fs/f2fs/f2fs.h | 16 +- fs/f2fs/gc.c | 22 +- fs/f2fs/recovery.c | 23 +- fs/f2fs/segment.c | 2 +- fs/f2fs/super.c | 15 +- fs/file_table.c | 7 +- fs/fs-writeback.c | 37 ++- fs/internal.h | 10 + fs/iomap/buffered-io.c | 2 +- fs/jbd2/commit.c | 2 +- fs/jbd2/journal.c | 10 +- fs/jbd2/recovery.c | 1 + fs/jbd2/transaction.c | 6 +- fs/ksmbd/server.c | 4 +- fs/ksmbd/smb2pdu.c | 27 +- fs/ksmbd/smb_common.c | 6 +- fs/mbcache.c | 17 +- fs/nfsd/nfs3proc.c | 11 +- fs/nfsd/nfs4proc.c | 19 +- fs/nfsd/nfs4recover.c | 4 +- fs/nfsd/nfs4state.c | 5 + fs/nfsd/nfs4xdr.c | 14 +- fs/nfsd/nfsproc.c | 6 +- fs/nfsd/xdr4.h | 3 +- fs/ntfs3/inode.c | 2 - fs/ntfs3/xattr.c | 102 +----- fs/open.c | 11 +- fs/posix_acl.c | 25 +- fs/quota/quota_tree.c | 38 +++ fs/userfaultfd.c | 4 +- fs/xfs/xfs_super.c | 10 +- include/dt-bindings/clock/samsung,exynosautov9.h | 56 ++-- include/linux/ata.h | 39 +-- include/linux/bio.h | 2 +- include/linux/blk-mq.h | 11 +- include/linux/blk_types.h | 2 +- include/linux/bpf.h | 3 +- include/linux/bpf_verifier.h | 11 + include/linux/dynamic_debug.h | 11 +- include/linux/eventfd.h | 2 +- include/linux/export-internal.h | 6 +- include/linux/filter.h | 5 + include/linux/fortify-string.h | 3 +- include/linux/fs.h | 9 +- include/linux/hugetlb.h | 8 +- include/linux/hw_random.h | 3 + include/linux/iio/iio-opaque.h | 2 + include/linux/iova.h | 2 +- include/linux/mmc/card.h | 1 + include/linux/once.h | 28 ++ include/linux/ring_buffer.h | 2 +- include/linux/sched.h | 2 +- include/linux/serial_8250.h | 1 + include/linux/serial_core.h | 4 +- include/linux/skbuff.h | 2 + include/linux/sunrpc/svc.h | 19 +- include/linux/tcp.h | 2 +- include/linux/trace.h | 36 ++- include/linux/trace_events.h | 1 + include/net/ieee802154_netdev.h | 12 +- include/net/tcp.h | 5 +- include/uapi/linux/bpf.h | 7 +- include/uapi/rdma/mlx5-abi.h | 1 + io_uring/fdinfo.c | 32 +- io_uring/io_uring.c | 29 +- io_uring/io_uring.h | 12 +- io_uring/net.c | 107 ++++--- io_uring/net.h | 9 +- io_uring/opdef.c | 17 +- io_uring/opdef.h | 1 + io_uring/rsrc.c | 1 + io_uring/rw.c | 47 ++- io_uring/rw.h | 1 + ipc/mqueue.c | 1 + kernel/auditsc.c | 4 +- kernel/bpf/bpf_local_storage.c | 4 +- kernel/bpf/bpf_lsm.c | 6 + kernel/bpf/bpf_task_storage.c | 8 +- kernel/bpf/btf.c | 2 +- kernel/bpf/cgroup.c | 28 +- kernel/bpf/core.c | 9 +- kernel/bpf/dispatcher.c | 27 +- kernel/bpf/hashtab.c | 30 +- kernel/bpf/helpers.c | 2 + kernel/bpf/syscall.c | 2 + kernel/bpf/trampoline.c | 8 +- kernel/bpf/verifier.c | 146 +++++---- kernel/cgroup/cgroup.c | 6 +- kernel/cgroup/cpuset.c | 18 +- kernel/livepatch/transition.c | 18 +- kernel/module/tracking.c | 3 + kernel/rcu/tasks.h | 5 +- kernel/rcu/tree.c | 17 +- kernel/rcu/tree_plugin.h | 3 +- kernel/trace/bpf_trace.c | 20 +- kernel/trace/ftrace.c | 34 +- kernel/trace/kprobe_event_gen_test.c | 49 ++- kernel/trace/ring_buffer.c | 87 +++++- kernel/trace/trace.c | 76 ++++- kernel/trace/trace_eprobe.c | 63 +--- kernel/trace/trace_events_synth.c | 23 +- kernel/trace/trace_kprobe.c | 60 +--- kernel/trace/trace_osnoise.c | 3 +- kernel/trace/trace_probe_kernel.h | 115 +++++++ lib/Kconfig.debug | 10 +- lib/dynamic_debug.c | 45 +-- lib/once.c | 30 ++ lib/sbitmap.c | 69 +++-- mm/damon/vaddr.c | 10 + mm/gup.c | 14 +- mm/hugetlb.c | 68 ++-- mm/memory.c | 2 + mm/mmap.c | 5 +- mm/mprotect.c | 2 + net/bluetooth/hci_core.c | 38 ++- net/bluetooth/hci_event.c | 14 + net/bluetooth/hci_sock.c | 3 - net/bluetooth/hci_sync.c | 1 + net/bluetooth/hci_sysfs.c | 3 + net/bluetooth/l2cap_core.c | 17 +- net/bluetooth/mgmt.c | 4 +- net/bluetooth/rfcomm/sock.c | 3 + net/can/bcm.c | 7 +- net/core/flow_dissector.c | 4 +- net/core/skmsg.c | 12 +- net/core/stream.c | 3 +- net/ieee802154/socket.c | 4 + net/ipv4/datagram.c | 2 + net/ipv4/esp4_offload.c | 5 +- net/ipv4/inet_hashtables.c | 4 +- net/ipv4/netfilter/nft_fib_ipv4.c | 3 + net/ipv4/tcp.c | 16 +- net/ipv4/tcp_output.c | 19 +- net/ipv6/esp6_offload.c | 5 +- net/ipv6/netfilter/nft_fib_ipv6.c | 6 +- net/mac80211/cfg.c | 17 +- net/mac80211/mlme.c | 20 +- net/mac80211/sta_info.c | 4 +- net/netfilter/nf_conntrack_core.c | 18 +- net/openvswitch/datapath.c | 18 +- net/rds/tcp.c | 2 +- net/sched/cls_u32.c | 6 +- net/sctp/auth.c | 18 +- net/unix/af_unix.c | 13 +- net/unix/garbage.c | 20 ++ net/vmw_vsock/virtio_transport_common.c | 2 +- net/wireless/reg.c | 4 + net/xdp/xsk.c | 22 +- net/xdp/xsk_queue.h | 22 +- net/xfrm/xfrm_input.c | 18 +- net/xfrm/xfrm_ipcomp.c | 1 + scripts/Kbuild.include | 23 +- scripts/package/mkspec | 4 +- scripts/selinux/install_policy.sh | 2 +- security/integrity/ima/ima_appraise.c | 12 +- security/loadpin/Kconfig | 2 +- sound/core/pcm_dmaengine.c | 8 +- sound/core/rawmidi.c | 2 - sound/core/sound_oss.c | 13 +- sound/hda/intel-dsp-config.c | 5 + sound/pci/hda/hda_beep.c | 15 +- sound/pci/hda/hda_beep.h | 1 + sound/pci/hda/hda_codec.c | 41 ++- sound/pci/hda/patch_hdmi.c | 36 +-- sound/pci/hda/patch_realtek.c | 11 +- sound/pci/hda/patch_sigmatel.c | 25 +- sound/soc/amd/acp/acp-pci.c | 1 + sound/soc/amd/yc/acp6x-mach.c | 14 + sound/soc/codecs/da7219.c | 5 +- sound/soc/codecs/lpass-tx-macro.c | 13 +- sound/soc/codecs/mt6359-accdet.c | 6 +- sound/soc/codecs/mt6660.c | 8 +- sound/soc/codecs/tas2764.c | 78 ++--- sound/soc/codecs/wcd-mbhc-v2.c | 10 +- sound/soc/codecs/wcd9335.c | 2 +- sound/soc/codecs/wcd934x.c | 2 +- sound/soc/codecs/wm5102.c | 6 +- sound/soc/codecs/wm5110.c | 6 +- sound/soc/codecs/wm8997.c | 6 +- sound/soc/codecs/wm_adsp.c | 4 +- sound/soc/fsl/eukrea-tlv320.c | 8 +- sound/soc/mediatek/mt8195/mt8195-mt6359.c | 6 + sound/soc/rockchip/rockchip_i2s.c | 41 +-- sound/soc/sh/rcar/ctu.c | 6 +- sound/soc/sh/rcar/dvc.c | 6 +- sound/soc/sh/rcar/mix.c | 6 +- sound/soc/sh/rcar/src.c | 5 +- sound/soc/sh/rcar/ssi.c | 4 +- sound/soc/soc-pcm.c | 2 +- sound/soc/sof/intel/hda.c | 11 + sound/soc/sof/ipc3-topology.c | 7 + sound/soc/sof/ipc4-topology.c | 9 +- sound/soc/sof/mediatek/mt8195/mt8195.c | 1 + sound/soc/sof/sof-pci-dev.c | 2 +- sound/soc/sof/sof-priv.h | 4 + sound/soc/stm/stm32_adfsdm.c | 8 +- sound/soc/stm/stm32_i2s.c | 4 +- sound/soc/stm/stm32_spdifrx.c | 4 +- sound/soc/sunxi/sun4i-codec.c | 3 + sound/usb/card.c | 32 +- sound/usb/endpoint.c | 17 +- sound/usb/quirks-table.h | 76 +++++ sound/usb/quirks.c | 344 ++++++++++++++++++--- sound/usb/quirks.h | 2 - sound/usb/usbaudio.h | 1 + tools/bpf/bpftool/btf_dumper.c | 2 +- tools/bpf/bpftool/cgroup.c | 54 +++- tools/bpf/bpftool/main.c | 10 + tools/include/uapi/linux/bpf.h | 7 +- tools/lib/bpf/bpf_tracing.h | 14 +- tools/lib/bpf/btf.h | 25 +- tools/lib/bpf/btf_dump.c | 2 +- tools/lib/bpf/libbpf.c | 21 +- tools/lib/bpf/libbpf.h | 4 +- tools/lib/bpf/libbpf_probes.c | 2 +- tools/lib/bpf/nlattr.c | 2 +- tools/lib/bpf/usdt.bpf.h | 4 +- tools/objtool/elf.c | 7 +- tools/perf/arch/x86/util/intel-pt.c | 2 +- tools/perf/util/intel-pt.c | 9 +- tools/perf/util/parse-events.c | 3 + tools/perf/util/pmu.c | 17 + tools/perf/util/pmu.h | 2 + tools/perf/util/pmu.l | 2 - tools/perf/util/pmu.y | 15 +- tools/power/x86/turbostat/turbostat.c | 1 - .../selftests/arm64/signal/testcases/testcases.c | 2 +- .../selftests/bpf/map_tests/array_map_batch_ops.c | 2 + .../selftests/bpf/map_tests/htab_map_batch_ops.c | 2 + .../bpf/map_tests/lpm_trie_map_batch_ops.c | 2 + .../testing/selftests/bpf/prog_tests/cgroup_link.c | 11 +- tools/testing/selftests/bpf/progs/kprobe_multi.c | 4 +- tools/testing/selftests/bpf/test_maps.c | 24 +- tools/testing/selftests/bpf/xsk.c | 6 +- tools/testing/selftests/bpf/xskxceiver.c | 4 + tools/testing/selftests/cpu-hotplug/config | 1 - .../selftests/cpu-hotplug/cpu-on-off-test.sh | 138 +++------ tools/testing/selftests/net/fcnal-test.sh | 30 ++ tools/testing/selftests/net/nettest.c | 16 +- tools/testing/selftests/tpm2/tpm2.py | 4 + 908 files changed, 8789 insertions(+), 4121 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 754/862 drm/amdgpu: SDMA update use unlocked iterator
In reply to Greg Kroah-HartmanFrom: Philip Yang <[email protected]>
[ Upstream commit 3913f0179ba366f7d7d160c506ce00de1602bbc4 ]
SDMA update page table may be called from unlocked context, this generate below warning. Use unlocked iterator to handle this case.
WARNING: CPU: 0 PID: 1475 at drivers/dma-buf/dma-resv.c:483 dma_resv_iter_next Call Trace: dma_resv_iter_first+0x43/0xa0 amdgpu_vm_sdma_update+0x69/0x2d0 [amdgpu] amdgpu_vm_ptes_update+0x29c/0x870 [amdgpu] amdgpu_vm_update_range+0x2f6/0x6c0 [amdgpu] svm_range_unmap_from_gpus+0x115/0x300 [amdgpu] svm_range_cpu_invalidate_pagetables+0x510/0x5e0 [amdgpu] __mmu_notifier_invalidate_range_start+0x1d3/0x230 unmap_vmas+0x140/0x150 unmap_region+0xa8/0x110
--- drivers/gpu/drm/amd/amdgpu/amdgpu_vm_sdma.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_vm_sdma.c +6 -3
@@ -211,12 +211,15 @@ static int amdgpu_vm_sdma_update(struct amdgpu_vm_update_params *p,int r;/* Wait for PD/PT moves to be completed */ -dma_resv_for_each_fence (&cursor, bo->tbo.base.resv, -DMA_RESV_USAGE_KERNEL , fence) { +dma_resv_iter_begin (&cursor, bo->tbo.base.resv,DMA_RESV_USAGE_KERNEL ); +dma_resv_for_each_fence_unlocked (&cursor, fence) { r =amdgpu_sync_fence (&p->job->sync, fence); -if (r) +if (r) { +dma_resv_iter_end (&cursor);return r; + } } +dma_resv_iter_end (&cursor); do { ndw = p->num_dw_left;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 755/862 drm/amd/display: Fix urgent latency override for DCN32/DCN321
In reply to Greg Kroah-HartmanFrom: George Shen <[email protected]>
[ Upstream commit e7f2f4cd67443ce308480ca461806fcc3456e0ba ]
[Why]
The urgent latency override is useful when debugging issues relating to underflow.
Current overridden variable is not correct and has no effect on DCN3.2 and DCN3.21 DML calculations.
[How]
For DCN3.2 and DCN3.21, override the correct urgent latency variable when bounding box override is present.
--- drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c | 1 + drivers/gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c | 1 + 2 files changed, 2 insertions(+)
drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c +1 -0
@@ -2199,6 +2199,7 @@ void dcn32_update_bw_bounding_box_fpu(struct dc *dc, struct clk_bw_params *bw_paif ((int )(dcn3_2_soc.urgent_latency_us *1000 ) != dc->bb_overrides.urgent_latency_ns && dc->bb_overrides.urgent_latency_ns) { dcn3_2_soc.urgent_latency_us = dc->bb_overrides.urgent_latency_ns /1000.0 ; + dcn3_2_soc.urgent_latency_pixel_data_only_us = dc->bb_overrides.urgent_latency_ns /1000.0 ; } if ((int)(dcn3_2_soc.dram_clock_change_latency_us * 1000)
drivers/gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c +1 -0
@@ -489,6 +489,7 @@ void dcn321_update_bw_bounding_box_fpu(struct dc *dc, struct clk_bw_params *bw_pif ((int )(dcn3_21_soc.urgent_latency_us *1000 ) != dc->bb_overrides.urgent_latency_ns && dc->bb_overrides.urgent_latency_ns) { dcn3_21_soc.urgent_latency_us = dc->bb_overrides.urgent_latency_ns /1000.0 ; + dcn3_21_soc.urgent_latency_pixel_data_only_us = dc->bb_overrides.urgent_latency_ns /1000.0 ; } if ((int)(dcn3_21_soc.dram_clock_change_latency_us * 1000)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 756/862 drm/amd/display: correct hostvm flag
In reply to Greg Kroah-HartmanFrom: Sherry Wang <[email protected]>
[ Upstream commit 796d6a37ff5ffaf9f2dc0f3f4bf9f4a1034c00de ]
[Why]
Hostvm should be enabled/disabled accordding to the status of riommu_active, but hostvm always be disabled on DCN31 which causes underflow
[How]
Set correct hostvm flag on DCN31
--- drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c +1 -1
@@ -891,7 +891,7 @@ static const struct dc_debug_options debug_defaults_drv = { .optimize_edp_link_rate = true, .enable_sw_cntl_psr = true, .enable_z9_disable_interface = true, /* Allow support for the PMFW interface for disable Z9*/ - .dml_hostvm_override = DML_HOSTVM_OVERRIDE_FALSE, + .dml_hostvm_override = DML_HOSTVM_NO_OVERRIDE, };static const struct dc_debug_options debug_defaults_diags = {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 757/862 drm/amdgpu: fix initial connector audio value
In reply to Greg Kroah-HartmanFrom: hongao <[email protected]>
[ Upstream commit 4bb71fce58f30df3f251118291d6b0187ce531e6 ]
This got lost somewhere along the way, This fixes
audio not working until set_property was called.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c +6 -1
@@ -1674,10 +1674,12 @@ amdgpu_connector_add(struct amdgpu_device *adev, adev->mode_info.dither_property, AMDGPU_FMT_DITHER_DISABLE); -if (amdgpu_audio !=0 ) +if (amdgpu_audio !=0 ) {drm_object_attach_property (&amdgpu_connector->base.base, adev->mode_info.audio_property,AMDGPU_AUDIO_AUTO ); + amdgpu_connector->audio =AMDGPU_AUDIO_AUTO ; + } subpixel_order = SubPixelHorizontalRGB; connector->interlace_allowed = true;
@@ -1799,6 +1801,7 @@ amdgpu_connector_add(struct amdgpu_device *adev,drm_object_attach_property (&amdgpu_connector->base.base, adev->mode_info.audio_property,AMDGPU_AUDIO_AUTO ); + amdgpu_connector->audio =AMDGPU_AUDIO_AUTO ; } drm_object_attach_property(&amdgpu_connector->base.base, adev->mode_info.dither_property,
@@ -1852,6 +1855,7 @@ amdgpu_connector_add(struct amdgpu_device *adev,drm_object_attach_property (&amdgpu_connector->base.base, adev->mode_info.audio_property,AMDGPU_AUDIO_AUTO ); + amdgpu_connector->audio =AMDGPU_AUDIO_AUTO ; } drm_object_attach_property(&amdgpu_connector->base.base, adev->mode_info.dither_property,
@@ -1902,6 +1906,7 @@ amdgpu_connector_add(struct amdgpu_device *adev,drm_object_attach_property (&amdgpu_connector->base.base, adev->mode_info.audio_property,AMDGPU_AUDIO_AUTO ); + amdgpu_connector->audio =AMDGPU_AUDIO_AUTO ; } drm_object_attach_property(&amdgpu_connector->base.base, adev->mode_info.dither_property,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 758/862 ASoC: amd: yc: Add ASUS UM5302TA into DMI table
In reply to Greg Kroah-HartmanFrom: Xiaoyan Li <[email protected]>
[ Upstream commit 4df5b13dec9e1b5a12db47ee92eb3f7da5c3deb5 ]
ASUS Zenbook S 13 OLED (UM5302TA) needs this quirk to get the built-in microphone working properly.
--- sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ 1 file changed, 7 insertions(+)
sound/soc/amd/yc/acp6x-mach.c +7 -0
@@ -171,6 +171,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { DMI_MATCH(DMI_PRODUCT_NAME, "21J6"), } }, + { + .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK COMPUTER INC."), + DMI_MATCH(DMI_PRODUCT_NAME, "UM5302TA"), + } + }, {} };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 759/862 ASoC: amd: yc: Add Lenovo Yoga Slim 7 Pro X to quirks table
In reply to Greg Kroah-HartmanFrom: Mario Limonciello <[email protected]>
[ Upstream commit 2232b2dd8cd4f1e6d554b2c3f6899ce36f791b67 ]
Lenovo Yoga Slim 7 Pro X has an ACP DMIC that isn't specified in the ASL or existing quirk list. Add it to the quirk table to let DMIC work on these systems.
--- sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ 1 file changed, 7 insertions(+)
sound/soc/amd/yc/acp6x-mach.c +7 -0
@@ -171,6 +171,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { DMI_MATCH(DMI_PRODUCT_NAME, "21J6"), } }, + { + .driver_data = &acp6x_card, + .matches = { +DMI_MATCH (DMI_BOARD_VENDOR ,"LENOVO" ), + DMI_MATCH(DMI_PRODUCT_NAME, "82"), + } + }, { .driver_data = &acp6x_card, .matches = {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 760/862 drm/meson: reorder driver deinit sequence to fix use-after-free bug
In reply to Greg Kroah-HartmanFrom: Adrián Larumbe <[email protected]>
[ Upstream commit 31c519981eb141c7ec39bfd5be25d35f02edb868 ]
Unloading the driver triggers the following KASAN warning:
[ +0.006275] ============================================================= [ +0.000029] BUG: KASAN: use-after-free in __list_del_entry_valid+0xe0/0x1a0 [ +0.000026] Read of size 8 at addr ffff000020c395e0 by task rmmod/2695
[ +0.000019] CPU: 5 PID: 2695 Comm: rmmod Tainted: G C O 5.19.0-rc6-lrmbkasan+ #1 [ +0.000013] Hardware name: Hardkernel ODROID-N2Plus (DT) [ +0.000008] Call trace: [ +0.000007] dump_backtrace+0x1ec/0x280 [ +0.000013] show_stack+0x24/0x80 [ +0.000008] dump_stack_lvl+0x98/0xd4 [ +0.000011] print_address_description.constprop.0+0x80/0x520 [ +0.000011] print_report+0x128/0x260 [ +0.000007] kasan_report+0xb8/0xfc [ +0.000008] __asan_report_load8_noabort+0x3c/0x50 [ +0.000010] __list_del_entry_valid+0xe0/0x1a0 [ +0.000009] drm_atomic_private_obj_fini+0x30/0x200 [drm] [ +0.000172] drm_bridge_detach+0x94/0x260 [drm] [ +0.000145] drm_encoder_cleanup+0xa4/0x290 [drm] [ +0.000144] drm_mode_config_cleanup+0x118/0x740 [drm] [ +0.000143] drm_mode_config_init_release+0x1c/0x2c [drm] [ +0.000144] drm_managed_release+0x170/0x414 [drm] [ +0.000142] drm_dev_put.part.0+0xc0/0x124 [drm] [ +0.000143] drm_dev_put+0x20/0x30 [drm] [ +0.000142] meson_drv_unbind+0x1d8/0x2ac [meson_drm] [ +0.000028] take_down_aggregate_device+0xb0/0x160 [ +0.000016] component_del+0x18c/0x360 [ +0.000009] meson_dw_hdmi_remove+0x28/0x40 [meson_dw_hdmi] [ +0.000015] platform_remove+0x64/0xb0 [ +0.000009] device_remove+0xb8/0x154 [ +0.000009] device_release_driver_internal+0x398/0x5b0 [ +0.000009] driver_detach+0xac/0x1b0 [ +0.000009] bus_remove_driver+0x158/0x29c [ +0.000009] driver_unregister+0x70/0xb0 [ +0.000008] platform_driver_unregister+0x20/0x2c [ +0.000008] meson_dw_hdmi_platform_driver_exit+0x1c/0x30 [meson_dw_hdmi] [ +0.000012] __do_sys_delete_module+0x288/0x400 [ +0.000011] __arm64_sys_delete_module+0x5c/0x80 [ +0.000009] invoke_syscall+0x74/0x260 [ +0.000009] el0_svc_common.constprop.0+0xcc/0x260 [ +0.000009] do_el0_svc+0x50/0x70 [ +0.000007] el0_svc+0x68/0x1a0 [ +0.000012] el0t_64_sync_handler+0x11c/0x150 [ +0.000008] el0t_64_sync+0x18c/0x190
[ +0.000018] Allocated by task 0:
[ +0.000007] (stack is not available)
[ +0.000011] Freed by task 2695: [ +0.000008] kasan_save_stack+0x2c/0x5c [ +0.000011] kasan_set_track+0x2c/0x40 [ +0.000008] kasan_set_free_info+0x28/0x50 [ +0.000009] ____kasan_slab_free+0x128/0x1d4 [ +0.000008] __kasan_slab_free+0x18/0x24 [ +0.000007] slab_free_freelist_hook+0x108/0x230 [ +0.000011] kfree+0x110/0x35c [ +0.000008] release_nodes+0xf0/0x16c [ +0.000009] devres_release_group+0x180/0x270 [ +0.000008] component_unbind+0x128/0x1e0 [ +0.000010] component_unbind_all+0x1b8/0x264 [ +0.000009] meson_drv_unbind+0x1a0/0x2ac [meson_drm] [ +0.000025] take_down_aggregate_device+0xb0/0x160 [ +0.000009] component_del+0x18c/0x360 [ +0.000009] meson_dw_hdmi_remove+0x28/0x40 [meson_dw_hdmi] [ +0.000012] platform_remove+0x64/0xb0 [ +0.000008] device_remove+0xb8/0x154 [ +0.000009] device_release_driver_internal+0x398/0x5b0 [ +0.000009] driver_detach+0xac/0x1b0 [ +0.000009] bus_remove_driver+0x158/0x29c [ +0.000008] driver_unregister+0x70/0xb0 [ +0.000008] platform_driver_unregister+0x20/0x2c [ +0.000008] meson_dw_hdmi_platform_driver_exit+0x1c/0x30 [meson_dw_hdmi] [ +0.000011] __do_sys_delete_module+0x288/0x400 [ +0.000010] __arm64_sys_delete_module+0x5c/0x80 [ +0.000008] invoke_syscall+0x74/0x260 [ +0.000008] el0_svc_common.constprop.0+0xcc/0x260 [ +0.000008] do_el0_svc+0x50/0x70 [ +0.000007] el0_svc+0x68/0x1a0 [ +0.000009] el0t_64_sync_handler+0x11c/0x150 [ +0.000009] el0t_64_sync+0x18c/0x190
[ +0.000014] The buggy address belongs to the object at ffff000020c39000
which belongs to the cache kmalloc-4k of size 4096
[ +0.000008] The buggy address is located 1504 bytes inside of
4096-byte region [ffff000020c39000, ffff000020c3a000)
[ +0.000016] The buggy address belongs to the physical page: [ +0.000009] page:fffffc0000830e00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x20c38 [ +0.000013] head:fffffc0000830e00 order:3 compound_mapcount:0 compound_pincount:0 [ +0.000008] flags: 0xffff00000010200(slab|head|node=0|zone=0|lastcpupid=0xffff) [ +0.000019] raw: 0ffff00000010200 fffffc0000fd4808 fffffc0000126208 ffff000000002e80 [ +0.000009] raw: 0000000000000000 0000000000020002 00000001ffffffff 0000000000000000 [ +0.000008] page dumped because: kasan: bad access detected
[ +0.000011] Memory state around the buggy address: [ +0.000008] ffff000020c39480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ +0.000007] ffff000020c39500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ +0.000007] >ffff000020c39580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ +0.000007] ^ [ +0.000007] ffff000020c39600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ +0.000007] ffff000020c39680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ +0.000006] ==================================================================
The reason this is happening is unloading meson-dw-hdmi will cause the component API to take down the aggregate device, which in turn will cause all devres-managed memory to be freed, including the struct dw_hdmi allocated in dw_hdmi_probe. This struct embeds a struct drm_bridge that is added at the end of the function, and which is later on picked up in meson_encoder_hdmi_init.
However, when attaching the bridge to the encoder created in meson_encoder_hdmi_init, it's linked to the encoder's bridge chain, from where it never leaves, even after devres_release_group is called when the driver's components are unbound and the embedding structure freed.
Then, when calling drm_dev_put in the aggregate driver's unbind function, drm_bridge_detach is called for every single bridge linked to the encoder, including the one whose memory had already been deallocated.
Fix by calling component_unbind_all after drm_dev_put.
--- drivers/gpu/drm/meson/meson_drv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/meson/meson_drv.c +1 -1
@@ -388,9 +388,9 @@ static void meson_drv_unbind(struct device *dev)drm_dev_unregister (drm);drm_kms_helper_poll_fini (drm);drm_atomic_helper_shutdown (drm); -component_unbind_all (dev, drm);free_irq (priv->vsync_irq, drm);drm_dev_put (drm); +component_unbind_all (dev, drm);if (priv->afbcd.ops) priv->afbcd.ops->exit (priv);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 761/862 drm/meson: explicitly remove aggregate driver at module unload time
In reply to Greg Kroah-HartmanFrom: Adrián Larumbe <[email protected]>
[ Upstream commit 8616f2a0589a80e08434212324250eb22f6a66ce ]
Because component_master_del wasn't being called when unloading the meson_drm module, the aggregate device would linger forever in the global aggregate_devices list. That means when unloading and reloading the meson_dw_hdmi module, component_add would call into try_to_bring_up_aggregate_device and find the unbound meson_drm aggregate device.
This would in turn dereference some of the aggregate_device's struct entries which point to memory automatically freed by the devres API when unbinding the aggregate device from meson_drv_unbind, and trigger an use-after-free bug:
[ +0.000014] ============================================================= [ +0.000007] BUG: KASAN: use-after-free in find_components+0x468/0x500 [ +0.000017] Read of size 8 at addr ffff000006731688 by task modprobe/2536 [ +0.000018] CPU: 4 PID: 2536 Comm: modprobe Tainted: G C O 5.19.0-rc6-lrmbkasan+ #1 [ +0.000010] Hardware name: Hardkernel ODROID-N2Plus (DT) [ +0.000008] Call trace: [ +0.000005] dump_backtrace+0x1ec/0x280 [ +0.000011] show_stack+0x24/0x80 [ +0.000007] dump_stack_lvl+0x98/0xd4 [ +0.000010] print_address_description.constprop.0+0x80/0x520 [ +0.000011] print_report+0x128/0x260 [ +0.000007] kasan_report+0xb8/0xfc [ +0.000007] __asan_report_load8_noabort+0x3c/0x50 [ +0.000009] find_components+0x468/0x500 [ +0.000008] try_to_bring_up_aggregate_device+0x64/0x390 [ +0.000009] __component_add+0x1dc/0x49c [ +0.000009] component_add+0x20/0x30 [ +0.000008] meson_dw_hdmi_probe+0x28/0x34 [meson_dw_hdmi] [ +0.000013] platform_probe+0xd0/0x220 [ +0.000008] really_probe+0x3ac/0xa80 [ +0.000008] __driver_probe_device+0x1f8/0x400 [ +0.000008] driver_probe_device+0x68/0x1b0 [ +0.000008] __driver_attach+0x20c/0x480 [ +0.000009] bus_for_each_dev+0x114/0x1b0 [ +0.000007] driver_attach+0x48/0x64 [ +0.000009] bus_add_driver+0x390/0x564 [ +0.000007] driver_register+0x1a8/0x3e4 [ +0.000009] __platform_driver_register+0x6c/0x94 [ +0.000007] meson_dw_hdmi_platform_driver_init+0x30/0x1000 [meson_dw_hdmi] [ +0.000014] do_one_initcall+0xc4/0x2b0 [ +0.000008] do_init_module+0x154/0x570 [ +0.000010] load_module+0x1a78/0x1ea4 [ +0.000008] __do_sys_init_module+0x184/0x1cc [ +0.000008] __arm64_sys_init_module+0x78/0xb0 [ +0.000008] invoke_syscall+0x74/0x260 [ +0.000008] el0_svc_common.constprop.0+0xcc/0x260 [ +0.000009] do_el0_svc+0x50/0x70 [ +0.000008] el0_svc+0x68/0x1a0 [ +0.000009] el0t_64_sync_handler+0x11c/0x150 [ +0.000009] el0t_64_sync+0x18c/0x190
[ +0.000014] Allocated by task 902: [ +0.000007] kasan_save_stack+0x2c/0x5c [ +0.000009] __kasan_kmalloc+0x90/0xd0 [ +0.000007] __kmalloc_node+0x240/0x580 [ +0.000010] memcg_alloc_slab_cgroups+0xa4/0x1ac [ +0.000010] memcg_slab_post_alloc_hook+0xbc/0x4c0 [ +0.000008] kmem_cache_alloc_node+0x1d0/0x490 [ +0.000009] __alloc_skb+0x1d4/0x310 [ +0.000010] alloc_skb_with_frags+0x8c/0x620 [ +0.000008] sock_alloc_send_pskb+0x5ac/0x6d0 [ +0.000010] unix_dgram_sendmsg+0x2e0/0x12f0 [ +0.000010] sock_sendmsg+0xcc/0x110 [ +0.000007] sock_write_iter+0x1d0/0x304 [ +0.000008] new_sync_write+0x364/0x460 [ +0.000007] vfs_write+0x420/0x5ac [ +0.000008] ksys_write+0x19c/0x1f0 [ +0.000008] __arm64_sys_write+0x78/0xb0 [ +0.000007] invoke_syscall+0x74/0x260 [ +0.000008] el0_svc_common.constprop.0+0x1a8/0x260 [ +0.000009] do_el0_svc+0x50/0x70 [ +0.000007] el0_svc+0x68/0x1a0 [ +0.000008] el0t_64_sync_handler+0x11c/0x150 [ +0.000008] el0t_64_sync+0x18c/0x190
[ +0.000013] Freed by task 2509: [ +0.000008] kasan_save_stack+0x2c/0x5c [ +0.000007] kasan_set_track+0x2c/0x40 [ +0.000008] kasan_set_free_info+0x28/0x50 [ +0.000008] ____kasan_slab_free+0x128/0x1d4 [ +0.000008] __kasan_slab_free+0x18/0x24 [ +0.000007] slab_free_freelist_hook+0x108/0x230 [ +0.000010] kfree+0x110/0x35c [ +0.000008] release_nodes+0xf0/0x16c [ +0.000008] devres_release_all+0xfc/0x180 [ +0.000008] device_unbind_cleanup+0x24/0x164 [ +0.000008] device_release_driver_internal+0x3e8/0x5b0 [ +0.000010] driver_detach+0xac/0x1b0 [ +0.000008] bus_remove_driver+0x158/0x29c [ +0.000008] driver_unregister+0x70/0xb0 [ +0.000009] platform_driver_unregister+0x20/0x2c [ +0.000007] 0xffff800003722d98 [ +0.000012] __do_sys_delete_module+0x288/0x400 [ +0.000009] __arm64_sys_delete_module+0x5c/0x80 [ +0.000008] invoke_syscall+0x74/0x260 [ +0.000008] el0_svc_common.constprop.0+0xcc/0x260 [ +0.000008] do_el0_svc+0x50/0x70 [ +0.000007] el0_svc+0x68/0x1a0 [ +0.000008] el0t_64_sync_handler+0x11c/0x150 [ +0.000009] el0t_64_sync+0x18c/0x190
[ +0.000013] Last potentially related work creation: [ +0.000007] kasan_save_stack+0x2c/0x5c [ +0.000007] __kasan_record_aux_stack+0xb8/0xf0 [ +0.000009] kasan_record_aux_stack_noalloc+0x14/0x20 [ +0.000008] insert_work+0x54/0x290 [ +0.000009] __queue_work+0x48c/0xd24 [ +0.000008] queue_work_on+0x90/0x11c [ +0.000008] call_usermodehelper_exec+0x188/0x404 [ +0.000010] kobject_uevent_env+0x5a8/0x794 [ +0.000010] kobject_uevent+0x14/0x20 [ +0.000008] driver_register+0x230/0x3e4 [ +0.000009] __platform_driver_register+0x6c/0x94 [ +0.000007] gxbb_driver_init+0x28/0x34 [ +0.000010] do_one_initcall+0xc4/0x2b0 [ +0.000008] do_initcalls+0x20c/0x24c [ +0.000010] kernel_init_freeable+0x22c/0x278 [ +0.000009] kernel_init+0x3c/0x170 [ +0.000008] ret_from_fork+0x10/0x20
[ +0.000013] The buggy address belongs to the object at ffff000006731600
which belongs to the cache kmalloc-256 of size 256
[ +0.000009] The buggy address is located 136 bytes inside of
256-byte region [ffff000006731600, ffff000006731700)
[ +0.000015] The buggy address belongs to the physical page: [ +0.000008] page:fffffc000019cc00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff000006730a00 pfn:0x6730 [ +0.000011] head:fffffc000019cc00 order:2 compound_mapcount:0 compound_pincount:0 [ +0.000008] flags: 0xffff00000010200(slab|head|node=0|zone=0|lastcpupid=0xffff) [ +0.000016] raw: 0ffff00000010200 fffffc00000c3d08 fffffc0000ef2b08 ffff000000002680 [ +0.000009] raw: ffff000006730a00 0000000000150014 00000001ffffffff 0000000000000000 [ +0.000006] page dumped because: kasan: bad access detected
[ +0.000011] Memory state around the buggy address: [ +0.000007] ffff000006731580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ +0.000007] ffff000006731600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ +0.000007] >ffff000006731680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ +0.000007] ^ [ +0.000006] ffff000006731700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ +0.000007] ffff000006731780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ +0.000006] ==================================================================
Fix by adding 'remove' driver callback for meson-drm, and explicitly deleting the aggregate device.
--- drivers/gpu/drm/meson/meson_drv.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/gpu/drm/meson/meson_drv.c +8 -0
@@ -493,6 +493,13 @@ static int meson_drv_probe(struct platform_device *pdev)return 0 ; }; +static int meson_drv_remove (struct platform_device *pdev) +{ +component_master_del (&pdev->dev, &meson_drv_master_ops); + +return 0 ; +} +static struct meson_drm_match_data meson_drm_gxbb_data = { .compat =VPU_COMPATIBLE_GXBB , };
@@ -530,6 +537,7 @@ static const struct dev_pm_ops meson_drv_pm_ops = {static struct platform_driver meson_drm_platform_driver = { .probe = meson_drv_probe, + .remove = meson_drv_remove, .shutdown = meson_drv_shutdown, .driver = { .name ="meson-drm" ,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 762/862 drm/meson: remove drm bridges at aggregate driver unbind time
In reply to Greg Kroah-HartmanFrom: Adrián Larumbe <[email protected]>
[ Upstream commit 09847723c12fc2753749cec3939a02ee92dac468 ]
drm bridges added by meson_encoder_hdmi_init and meson_encoder_cvbs_init were not manually removed at module unload time, which caused dangling references to freed memory to remain linked in the global bridge_list.
When loading the driver modules back in, the same functions would again call drm_bridge_add, and when traversing the global bridge_list, would end up peeking into freed memory.
Once again KASAN revealed the problem:
[ +0.000095] ============================================================= [ +0.000008] BUG: KASAN: use-after-free in __list_add_valid+0x9c/0x120 [ +0.000018] Read of size 8 at addr ffff00003da291f0 by task modprobe/2483
[ +0.000018] CPU: 3 PID: 2483 Comm: modprobe Tainted: G C O 5.19.0-rc6-lrmbkasan+ #1 [ +0.000011] Hardware name: Hardkernel ODROID-N2Plus (DT) [ +0.000008] Call trace: [ +0.000006] dump_backtrace+0x1ec/0x280 [ +0.000012] show_stack+0x24/0x80 [ +0.000008] dump_stack_lvl+0x98/0xd4 [ +0.000011] print_address_description.constprop.0+0x80/0x520 [ +0.000011] print_report+0x128/0x260 [ +0.000008] kasan_report+0xb8/0xfc [ +0.000008] __asan_report_load8_noabort+0x3c/0x50 [ +0.000009] __list_add_valid+0x9c/0x120 [ +0.000009] drm_bridge_add+0x6c/0x104 [drm] [ +0.000165] dw_hdmi_probe+0x1900/0x2360 [dw_hdmi] [ +0.000022] meson_dw_hdmi_bind+0x520/0x814 [meson_dw_hdmi] [ +0.000014] component_bind+0x174/0x520 [ +0.000012] component_bind_all+0x1a8/0x38c [ +0.000010] meson_drv_bind_master+0x5e8/0xb74 [meson_drm] [ +0.000032] meson_drv_bind+0x20/0x2c [meson_drm] [ +0.000027] try_to_bring_up_aggregate_device+0x19c/0x390 [ +0.000010] component_master_add_with_match+0x1c8/0x284 [ +0.000009] meson_drv_probe+0x274/0x280 [meson_drm] [ +0.000026] platform_probe+0xd0/0x220 [ +0.000009] really_probe+0x3ac/0xa80 [ +0.000009] __driver_probe_device+0x1f8/0x400 [ +0.000009] driver_probe_device+0x68/0x1b0 [ +0.000009] __driver_attach+0x20c/0x480 [ +0.000008] bus_for_each_dev+0x114/0x1b0 [ +0.000009] driver_attach+0x48/0x64 [ +0.000008] bus_add_driver+0x390/0x564 [ +0.000009] driver_register+0x1a8/0x3e4 [ +0.000009] __platform_driver_register+0x6c/0x94 [ +0.000008] meson_drm_platform_driver_init+0x3c/0x1000 [meson_drm] [ +0.000027] do_one_initcall+0xc4/0x2b0 [ +0.000011] do_init_module+0x154/0x570 [ +0.000011] load_module+0x1a78/0x1ea4 [ +0.000008] __do_sys_init_module+0x184/0x1cc [ +0.000009] __arm64_sys_init_module+0x78/0xb0 [ +0.000009] invoke_syscall+0x74/0x260 [ +0.000009] el0_svc_common.constprop.0+0xcc/0x260 [ +0.000008] do_el0_svc+0x50/0x70 [ +0.000007] el0_svc+0x68/0x1a0 [ +0.000012] el0t_64_sync_handler+0x11c/0x150 [ +0.000008] el0t_64_sync+0x18c/0x190
[ +0.000016] Allocated by task 879: [ +0.000008] kasan_save_stack+0x2c/0x5c [ +0.000011] __kasan_kmalloc+0x90/0xd0 [ +0.000007] __kmalloc+0x278/0x4a0 [ +0.000011] mpi_resize+0x13c/0x1d0 [ +0.000011] mpi_powm+0xd24/0x1570 [ +0.000009] rsa_enc+0x1a4/0x30c [ +0.000009] pkcs1pad_verify+0x3f0/0x580 [ +0.000009] public_key_verify_signature+0x7a8/0xba4 [ +0.000010] public_key_verify_signature_2+0x40/0x60 [ +0.000008] verify_signature+0xb4/0x114 [ +0.000008] pkcs7_validate_trust_one.constprop.0+0x3b8/0x574 [ +0.000009] pkcs7_validate_trust+0xb8/0x15c [ +0.000008] verify_pkcs7_message_sig+0xec/0x1b0 [ +0.000012] verify_pkcs7_signature+0x78/0xac [ +0.000007] mod_verify_sig+0x110/0x190 [ +0.000009] module_sig_check+0x114/0x1e0 [ +0.000009] load_module+0xa0/0x1ea4 [ +0.000008] __do_sys_init_module+0x184/0x1cc [ +0.000008] __arm64_sys_init_module+0x78/0xb0 [ +0.000008] invoke_syscall+0x74/0x260 [ +0.000009] el0_svc_common.constprop.0+0x1a8/0x260 [ +0.000008] do_el0_svc+0x50/0x70 [ +0.000007] el0_svc+0x68/0x1a0 [ +0.000009] el0t_64_sync_handler+0x11c/0x150 [ +0.000009] el0t_64_sync+0x18c/0x190
[ +0.000013] Freed by task 2422: [ +0.000008] kasan_save_stack+0x2c/0x5c [ +0.000009] kasan_set_track+0x2c/0x40 [ +0.000007] kasan_set_free_info+0x28/0x50 [ +0.000009] ____kasan_slab_free+0x128/0x1d4 [ +0.000008] __kasan_slab_free+0x18/0x24 [ +0.000007] slab_free_freelist_hook+0x108/0x230 [ +0.000010] kfree+0x110/0x35c [ +0.000008] release_nodes+0xf0/0x16c [ +0.000009] devres_release_group+0x180/0x270 [ +0.000008] take_down_aggregate_device+0xcc/0x160 [ +0.000010] component_del+0x18c/0x360 [ +0.000009] meson_dw_hdmi_remove+0x28/0x40 [meson_dw_hdmi] [ +0.000013] platform_remove+0x64/0xb0 [ +0.000008] device_remove+0xb8/0x154 [ +0.000009] device_release_driver_internal+0x398/0x5b0 [ +0.000009] driver_detach+0xac/0x1b0 [ +0.000009] bus_remove_driver+0x158/0x29c [ +0.000008] driver_unregister+0x70/0xb0 [ +0.000009] platform_driver_unregister+0x20/0x2c [ +0.000007] meson_dw_hdmi_platform_driver_exit+0x1c/0x30 [meson_dw_hdmi] [ +0.000012] __do_sys_delete_module+0x288/0x400 [ +0.000009] __arm64_sys_delete_module+0x5c/0x80 [ +0.000009] invoke_syscall+0x74/0x260 [ +0.000008] el0_svc_common.constprop.0+0xcc/0x260 [ +0.000008] do_el0_svc+0x50/0x70 [ +0.000007] el0_svc+0x68/0x1a0 [ +0.000008] el0t_64_sync_handler+0x11c/0x150 [ +0.000009] el0t_64_sync+0x18c/0x190
[ +0.000013] The buggy address belongs to the object at ffff00003da29000
which belongs to the cache kmalloc-1k of size 1024
[ +0.000008] The buggy address is located 496 bytes inside of
1024-byte region [ffff00003da29000, ffff00003da29400)
[ +0.000015] The buggy address belongs to the physical page: [ +0.000009] page:fffffc0000f68a00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3da28 [ +0.000012] head:fffffc0000f68a00 order:3 compound_mapcount:0 compound_pincount:0 [ +0.000009] flags: 0xffff00000010200(slab|head|node=0|zone=0|lastcpupid=0xffff) [ +0.000019] raw: 0ffff00000010200 fffffc0000eb5c08 fffffc0000d96608 ffff000000002a80 [ +0.000008] raw: 0000000000000000 00000000000a000a 00000001ffffffff 0000000000000000 [ +0.000008] page dumped because: kasan: bad access detected
[ +0.000011] Memory state around the buggy address: [ +0.000009] ffff00003da29080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ +0.000007] ffff00003da29100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ +0.000007] >ffff00003da29180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ +0.000007] ^ [ +0.000008] ffff00003da29200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ +0.000006] ffff00003da29280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ +0.000007] ==================================================================
Fix by keeping track of which encoders were initialised in the meson_drm structure and manually removing their bridges at aggregate driver's unbind time.
--- drivers/gpu/drm/meson/meson_drv.c | 4 ++++ drivers/gpu/drm/meson/meson_drv.h | 7 +++++++ drivers/gpu/drm/meson/meson_encoder_cvbs.c | 13 +++++++++++++ drivers/gpu/drm/meson/meson_encoder_cvbs.h | 1 + drivers/gpu/drm/meson/meson_encoder_hdmi.c | 13 +++++++++++++ drivers/gpu/drm/meson/meson_encoder_hdmi.h | 1 + 6 files changed, 39 insertions(+)
drivers/gpu/drm/meson/meson_drv.c +4 -0
@@ -390,6 +390,10 @@ static void meson_drv_unbind(struct device *dev)drm_atomic_helper_shutdown (drm);free_irq (priv->vsync_irq, drm);drm_dev_put (drm); + +meson_encoder_hdmi_remove (priv); +meson_encoder_cvbs_remove (priv); +component_unbind_all (dev, drm);if (priv->afbcd.ops)
drivers/gpu/drm/meson/meson_drv.h +7 -0
@@ -25,6 +25,12 @@ enum vpu_compatible { VPU_COMPATIBLE_G12A = 3, }; +enum { +MESON_ENC_CVBS =0 , +MESON_ENC_HDMI , +MESON_ENC_LAST , +}; +struct meson_drm_match_data {enum vpu_compatible compat;struct meson_afbcd_ops *afbcd_ops;
@@ -51,6 +57,7 @@ struct meson_drm {struct drm_crtc *crtc;struct drm_plane *primary_plane;struct drm_plane *overlay_plane; +void *encoders[MESON_ENC_LAST ];const struct meson_drm_soc_limits *limits;
drivers/gpu/drm/meson/meson_encoder_cvbs.c +13 -0
@@ -281,5 +281,18 @@ int meson_encoder_cvbs_init(struct meson_drm *priv) }drm_connector_attach_encoder (connector, &meson_encoder_cvbs->encoder); + priv->encoders[MESON_ENC_CVBS ] = meson_encoder_cvbs; +return 0 ; } + +void meson_encoder_cvbs_remove (struct meson_drm *priv) +{ +struct meson_encoder_cvbs *meson_encoder_cvbs; + +if (priv->encoders[MESON_ENC_CVBS ]) { + meson_encoder_cvbs = priv->encoders[MESON_ENC_CVBS ]; +drm_bridge_remove (&meson_encoder_cvbs->bridge); +drm_bridge_remove (meson_encoder_cvbs->next_bridge); + } +}
drivers/gpu/drm/meson/meson_encoder_cvbs.h +1 -0
@@ -25,5 +25,6 @@ struct meson_cvbs_mode {extern struct meson_cvbs_mode meson_cvbs_modes[MESON_CVBS_MODES_COUNT ];int meson_encoder_cvbs_init (struct meson_drm *priv); +void meson_encoder_cvbs_remove (struct meson_drm *priv);#endif /* __MESON_VENC_CVBS_H */
drivers/gpu/drm/meson/meson_encoder_hdmi.c +13 -0
@@ -452,6 +452,8 @@ int meson_encoder_hdmi_init(struct meson_drm *priv) meson_encoder_hdmi->cec_notifier = notifier; } + priv->encoders[MESON_ENC_HDMI ] = meson_encoder_hdmi; +dev_dbg (priv->dev,"HDMI encoder initialized\n" );return 0 ;
@@ -460,3 +462,14 @@ int meson_encoder_hdmi_init(struct meson_drm *priv)of_node_put (remote);return ret; } + +void meson_encoder_hdmi_remove (struct meson_drm *priv) +{ +struct meson_encoder_hdmi *meson_encoder_hdmi; + +if (priv->encoders[MESON_ENC_HDMI ]) { + meson_encoder_hdmi = priv->encoders[MESON_ENC_HDMI ]; +drm_bridge_remove (&meson_encoder_hdmi->bridge); +drm_bridge_remove (meson_encoder_hdmi->next_bridge); + } +}
drivers/gpu/drm/meson/meson_encoder_hdmi.h +1 -0
@@ -8,5 +8,6 @@#define __MESON_ENCODER_HDMI_Hint meson_encoder_hdmi_init (struct meson_drm *priv); +void meson_encoder_hdmi_remove (struct meson_drm *priv);#endif /* __MESON_ENCODER_HDMI_H */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 763/862 mmc: sdhci-msm: add compatible string check for sdm670
In reply to Greg Kroah-HartmanFrom: Richard Acayan <[email protected]>
[ Upstream commit 4de95950d970c71a9e82a24573bb7a44fd95baa1 ]
The Snapdragon 670 has the same quirk as Snapdragon 845 (needing to restore the dll config). Add a compatible string check to detect the need for this.
--- drivers/mmc/host/sdhci-msm.c | 1 + 1 file changed, 1 insertion(+)
drivers/mmc/host/sdhci-msm.c +1 -0
@@ -2441,6 +2441,7 @@ static const struct of_device_id sdhci_msm_dt_match[] = {*/ {.compatible = "qcom,sdhci-msm-v4", .data = &sdhci_msm_mci_var}, {.compatible = "qcom,sdhci-msm-v5", .data = &sdhci_msm_v5_var}, + {.compatible = "qcom,sdm670-sdhci", .data = &sdm845_sdhci_var}, {.compatible = "qcom,sdm845-sdhci", .data = &sdm845_sdhci_var}, {.compatible = "qcom,sc7180-sdhci", .data = &sdm845_sdhci_var}, {},
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 764/862 drm/dp: Dont rewrite link config when setting phy test pattern
In reply to Greg Kroah-HartmanFrom: Khaled Almahallawy <[email protected]>
[ Upstream commit 7b4d8db657192066bc6f1f6635d348413dac1e18 ]
The sequence for Source DP PHY CTS automation is [2][1]:
1- Emulate successful Link Training(LT)
2- Short HPD and change link rates and number of lanes by LT. (This is same flow for Link Layer CTS)
3- Short HPD and change PHY test pattern and swing/pre-emphasis levels (This step should not trigger LT)
The problem is with DP PHY compliance setup as follow:
[DPTX + on board LTTPR]------Main Link--->[Scope]
^ |
| |
| |
----------Aux Ch------>[Aux Emulator]At step 3, before writing TRAINING_LANEx_SET/LINK_QUAL_PATTERN_SET to declare the pattern/swing requested by scope, we write link config in LINK_BW_SET/LANE_COUNT_SET on a port that has LTTPR. As LTTPR snoops aux transaction, LINK_BW_SET/LANE_COUNT_SET writes indicate a LT will start [Check DP 2.0 E11 -Sec 3.6.8.2 & 3.6.8.6.3], and LTTPR will reset the link and stop sending DP signals to DPTX/Scope causing the measurements to fail. Note that step 3 will not trigger LT and DP link will never recovered by the
Aux Emulator/Scope.
The reset of link can be tested with a monitor connected to LTTPR port simply by writing to LINK_BW_SET or LANE_COUNT_SET as follow
igt/tools/dpcd_reg write --offset=0x100 --value 0x14 --device=2
OR
printf '\x14' | sudo dd of=/dev/drm_dp_aux2 bs=1 count=1 conv=notrunc seek=$((0x100))
This single aux write causes the screen to blank, sending short HPD to DPTX, setting LINK_STATUS_UPDATE = 1 in DPCD 0x204, and triggering LT.
As stated in [1]:
"Before any TX electrical testing can be performed, the link between a DPTX and DPRX (in this case, a piece of test equipment), including all LTTPRs within the path, shall be trained as defined in this Standard."
In addition, changing Phy pattern/Swing/Pre-emphasis (Step 3) uses the same link rate and lane count applied on step 2, so no need to redo LT.
The fix is to not rewrite link config in step 3, and just writes TRAINING_LANEx_SET and LINK_QUAL_PATTERN_SET
[1]: DP 2.0 E11 - 3.6.11.1 LTTPR DPTX_PHY Electrical Compliance
[2]: Configuring UnigrafDPTC Controller - Automation Test Sequence
https://www.keysight.com/us/en/assets/9922-01244/help-files/
D9040DPPC-DisplayPort-Test-Software-Online-Help-latest.chm
--- drivers/gpu/drm/display/drm_dp_helper.c | 9 --------- 1 file changed, 9 deletions(-)
drivers/gpu/drm/display/drm_dp_helper.c +0 -9
@@ -2638,17 +2638,8 @@ int drm_dp_set_phy_test_pattern(struct drm_dp_aux *aux, struct drm_dp_phy_test_params *data, u8 dp_rev) { int err, i; -u8 link_config[2 ];u8 test_pattern; - link_config[0 ] =drm_dp_link_rate_to_bw_code (data->link_rate); - link_config[1 ] = data->num_lanes; -if (data->enhanced_frame_cap) - link_config[1 ] |=DP_LANE_COUNT_ENHANCED_FRAME_EN ; - err =drm_dp_dpcd_write (aux,DP_LINK_BW_SET , link_config,2 ); -if (err <0 ) -return err; - test_pattern = data->phy_pattern;if (dp_rev <0x12 ) { test_pattern = (test_pattern << 2) &
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 765/862 drm/amd/display: Remove interface for periodic interrupt 1
In reply to Greg Kroah-HartmanFrom: Aric Cyr <[email protected]>
[ Upstream commit 97d8d6f075bd8f988589be02b91f6fa644d0b0b8 ]
[why]
Only a single VLINE interrupt is available so interface should not expose the second one which is used by DMU firmware.
[how]
Remove references to periodic_interrupt1 and VLINE1 from DC interfaces.
--- drivers/gpu/drm/amd/display/dc/core/dc.c | 16 +++------ drivers/gpu/drm/amd/display/dc/dc_stream.h | 6 ++-- .../amd/display/dc/dcn10/dcn10_hw_sequencer.c | 35 ++++++------------- .../amd/display/dc/dcn10/dcn10_hw_sequencer.h | 3 +- .../gpu/drm/amd/display/dc/inc/hw_sequencer.h | 8 +---- 5 files changed, 18 insertions(+), 50 deletions(-)
drivers/gpu/drm/amd/display/dc/core/dc.c +4 -12
@@ -2753,11 +2753,8 @@ static void copy_stream_update_to_stream(struct dc *dc,if (update->abm_level) stream->abm_level = *update->abm_level; -if (update->periodic_interrupt0) - stream->periodic_interrupt0 = *update->periodic_interrupt0; - -if (update->periodic_interrupt1) - stream->periodic_interrupt1 = *update->periodic_interrupt1; +if (update->periodic_interrupt) + stream->periodic_interrupt = *update->periodic_interrupt;if (update->gamut_remap) stream->gamut_remap_matrix = *update->gamut_remap;
@@ -2987,13 +2984,8 @@ static void commit_planes_do_stream_update(struct dc *dc,if (!pipe_ctx->top_pipe && !pipe_ctx->prev_odm_pipe && pipe_ctx->stream == stream) { -if (stream_update->periodic_interrupt0 && - dc->hwss.setup_periodic_interrupt) - dc->hwss.setup_periodic_interrupt (dc, pipe_ctx,VLINE0 ); - -if (stream_update->periodic_interrupt1 && - dc->hwss.setup_periodic_interrupt) - dc->hwss.setup_periodic_interrupt (dc, pipe_ctx,VLINE1 ); +if (stream_update->periodic_interrupt && dc->hwss.setup_periodic_interrupt) + dc->hwss.setup_periodic_interrupt (dc, pipe_ctx); if ((stream_update->hdr_static_metadata && !stream->use_dynamic_meta) || stream_update->vrr_infopacket ||
drivers/gpu/drm/amd/display/dc/dc_stream.h +2 -4
@@ -212,8 +212,7 @@ struct dc_stream_state {/* DMCU info */ unsigned int abm_level; -struct periodic_interrupt_config periodic_interrupt0; -struct periodic_interrupt_config periodic_interrupt1; +struct periodic_interrupt_config periodic_interrupt;/* from core_stream struct */ struct dc_context *ctx;
@@ -283,8 +282,7 @@ struct dc_stream_update {struct dc_info_packet *hdr_static_metadata;unsigned int *abm_level; -struct periodic_interrupt_config *periodic_interrupt0; -struct periodic_interrupt_config *periodic_interrupt1; +struct periodic_interrupt_config *periodic_interrupt;struct dc_info_packet *vrr_infopacket;struct dc_info_packet *vsc_infopacket;
drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c +10 -25
@@ -3768,7 +3768,7 @@ void dcn10_calc_vupdate_position( {const struct dc_crtc_timing *dc_crtc_timing = &pipe_ctx->stream->timing;int vline_int_offset_from_vupdate = - pipe_ctx->stream->periodic_interrupt0.lines_offset; + pipe_ctx->stream->periodic_interrupt.lines_offset;int vupdate_offset_from_vsync = dc->hwss.get_vupdate_offset_from_vsync (pipe_ctx);int start_position;
@@ -3793,18 +3793,10 @@ void dcn10_calc_vupdate_position(static void dcn10_cal_vline_position (struct dc *dc,struct pipe_ctx *pipe_ctx, -enum vline_select vline,uint32_t *start_line,uint32_t *end_line) { -enum vertical_interrupt_ref_point ref_point =INVALID_POINT ; - -if (vline ==VLINE0 ) - ref_point = pipe_ctx->stream->periodic_interrupt0.ref_point; -else if (vline ==VLINE1 ) - ref_point = pipe_ctx->stream->periodic_interrupt1.ref_point; - -switch (ref_point) { +switch (pipe_ctx->stream->periodic_interrupt.ref_point) {case START_V_UPDATE : dcn10_calc_vupdate_position( dc,
@@ -3813,7 +3805,9 @@ static void dcn10_cal_vline_position( end_line);break ;case START_V_SYNC : -// Suppose to do nothing because vsync is 0; +// vsync is line 0 so start_line is just the requested line offset + *start_line = pipe_ctx->stream->periodic_interrupt.lines_offset; + *end_line = *start_line +2 ;break ;default :ASSERT (0 );
@@ -3823,24 +3817,15 @@ static void dcn10_cal_vline_position(void dcn10_setup_periodic_interrupt (struct dc *dc, -struct pipe_ctx *pipe_ctx, -enum vline_select vline) +struct pipe_ctx *pipe_ctx) {struct timing_generator *tg = pipe_ctx->stream_res.tg; +uint32_t start_line =0 ; +uint32_t end_line =0 ; -if (vline ==VLINE0 ) { -uint32_t start_line =0 ; -uint32_t end_line =0 ; +dcn10_cal_vline_position (dc, pipe_ctx, &start_line, &end_line); -dcn10_cal_vline_position (dc, pipe_ctx, vline, &start_line, &end_line); - - tg->funcs->setup_vertical_interrupt0 (tg, start_line, end_line); - - }else if (vline ==VLINE1 ) { - pipe_ctx->stream_res.tg->funcs->setup_vertical_interrupt1 ( - tg, - pipe_ctx->stream->periodic_interrupt1.lines_offset); - } + tg->funcs->setup_vertical_interrupt0 (tg, start_line, end_line); }void dcn10_setup_vupdate_interrupt (struct dc *dc,struct pipe_ctx *pipe_ctx)
drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.h +1 -2
@@ -175,8 +175,7 @@ void dcn10_set_cursor_attribute(struct pipe_ctx *pipe_ctx);void dcn10_set_cursor_sdr_white_level (struct pipe_ctx *pipe_ctx);void dcn10_setup_periodic_interrupt (struct dc *dc, -struct pipe_ctx *pipe_ctx, -enum vline_select vline); +struct pipe_ctx *pipe_ctx); enum dc_status dcn10_set_clock(struct dc *dc, enum dc_clock_type clock_type, uint32_t clk_khz,
drivers/gpu/drm/amd/display/dc/inc/hw_sequencer.h +1 -7
@@ -32,11 +32,6 @@#include "inc/hw/link_encoder.h" #include "core_status.h" -enum vline_select { -VLINE0 , -VLINE1 -}; -struct pipe_ctx ;struct dc_state ;struct dc_stream_status ;
@@ -116,8 +111,7 @@ struct hw_sequencer_funcs { int group_index, int group_size, struct pipe_ctx *grouped_pipes[]);void (*setup_periodic_interrupt)(struct dc *dc, -struct pipe_ctx *pipe_ctx, -enum vline_select vline); +struct pipe_ctx *pipe_ctx);void (*set_drr)(struct pipe_ctx **pipe_ctx,int num_pipes,struct dc_crtc_timing_adjust adjust); void (*set_static_screen_control)(struct pipe_ctx **pipe_ctx,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 766/862 drm/amd/display: polling vid stream status in hpo dp blank
In reply to Greg Kroah-HartmanFrom: Wenjing Liu <[email protected]>
[ Upstream commit e32df0c7ecead95d70ca89f39b1b2b02a59ff691 ]
[why]
vid stream control is double bufferred, if we don't wait for video stream enable set to 0, we may get temporary image corruption showing on the stream when setting PIXEL_TO_SYMBOL_FIFO_ENABLE to 0.
--- .../drm/amd/display/dc/dcn31/dcn31_hpo_dp_stream_encoder.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/display/dc/dcn31/dcn31_hpo_dp_stream_encoder.c +3 -3
@@ -150,9 +150,9 @@ static void dcn31_hpo_dp_stream_enc_dp_blank(* 10us*5000=50ms. This covers 41.7ms of minimum 24 Hz mode + * a little more because we may not trust delay accuracy. */ -//REG_WAIT(DP_SYM32_ENC_VID_STREAM_CONTROL, -// VID_STREAM_STATUS, 0, -// 10, 5000); +REG_WAIT (DP_SYM32_ENC_VID_STREAM_CONTROL , +VID_STREAM_STATUS ,0 , +10 ,5000 );/* Disable SDP tranmission */ REG_UPDATE(DP_SYM32_ENC_SDP_CONTROL,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 767/862 drm/amdkfd: Fix UBSAN shift-out-of-bounds warning
In reply to Greg Kroah-HartmanFrom: Felix Kuehling <[email protected]>
[ Upstream commit b292cafe2dd02d96a07147e4b160927e8399d5cc ]
This was fixed in initialize_cpsch before, but not in initialize_nocpsch. Factor sdma bitmap initialization into a helper function to apply the correct implementation in both cases without duplicating it.
v2: Added a range check
--- .../drm/amd/amdkfd/kfd_device_queue_manager.c | 45 +++++++++---------- 1 file changed, 21 insertions(+), 24 deletions(-)
drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c +21 -24
@@ -1242,6 +1242,24 @@ static void init_interrupts(struct device_queue_manager *dqm) dqm->dev->kfd2kgd->init_interrupts (dqm->dev->adev, i); } +static void init_sdma_bitmaps (struct device_queue_manager *dqm) +{ +unsigned int num_sdma_queues = + min_t(unsigned int, sizeof(dqm->sdma_bitmap)*8, +get_num_sdma_queues (dqm)); +unsigned int num_xgmi_sdma_queues = + min_t(unsigned int, sizeof(dqm->xgmi_sdma_bitmap)*8, +get_num_xgmi_sdma_queues (dqm)); + +if (num_sdma_queues) + dqm->sdma_bitmap =GENMASK_ULL (num_sdma_queues-1 ,0 ); +if (num_xgmi_sdma_queues) + dqm->xgmi_sdma_bitmap =GENMASK_ULL (num_xgmi_sdma_queues-1 ,0 ); + + dqm->sdma_bitmap &= ~get_reserved_sdma_queues_bitmap (dqm); +pr_info ("sdma_bitmap: %llx\n" , dqm->sdma_bitmap); +} +static int initialize_nocpsch (struct device_queue_manager *dqm) {int pipe, queue;
@@ -1270,11 +1288,7 @@ static int initialize_nocpsch(struct device_queue_manager *dqm)memset (dqm->vmid_pasid,0 ,sizeof (dqm->vmid_pasid)); - dqm->sdma_bitmap = ~0ULL >> (64 -get_num_sdma_queues (dqm)); - dqm->sdma_bitmap &= ~(get_reserved_sdma_queues_bitmap (dqm)); -pr_info ("sdma_bitmap: %llx\n" , dqm->sdma_bitmap); - - dqm->xgmi_sdma_bitmap = ~0ULL >> (64 -get_num_xgmi_sdma_queues (dqm)); +init_sdma_bitmaps (dqm);return 0 ; }
@@ -1452,9 +1466,6 @@ static int set_sched_resources(struct device_queue_manager *dqm)static int initialize_cpsch (struct device_queue_manager *dqm) { -uint64_t num_sdma_queues; -uint64_t num_xgmi_sdma_queues; -pr_debug ("num of pipes: %d\n" ,get_pipes_per_mec (dqm));mutex_init (&dqm->lock_hidden);
@@ -1463,24 +1474,10 @@ static int initialize_cpsch(struct device_queue_manager *dqm) dqm->active_cp_queue_count =0 ; dqm->gws_queue_count =0 ; dqm->active_runlist = false; - - num_sdma_queues =get_num_sdma_queues (dqm); -if (num_sdma_queues >=BITS_PER_TYPE (dqm->sdma_bitmap)) - dqm->sdma_bitmap =ULLONG_MAX ; -else - dqm->sdma_bitmap = (BIT_ULL (num_sdma_queues) -1 ); - - dqm->sdma_bitmap &= ~(get_reserved_sdma_queues_bitmap (dqm)); -pr_info ("sdma_bitmap: %llx\n" , dqm->sdma_bitmap); - - num_xgmi_sdma_queues =get_num_xgmi_sdma_queues (dqm); -if (num_xgmi_sdma_queues >=BITS_PER_TYPE (dqm->xgmi_sdma_bitmap)) - dqm->xgmi_sdma_bitmap =ULLONG_MAX ; -else - dqm->xgmi_sdma_bitmap = (BIT_ULL (num_xgmi_sdma_queues) -1 ); -INIT_WORK (&dqm->hw_exception_work, kfd_process_hw_exception); +init_sdma_bitmaps (dqm); +return 0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 768/862 ARM: dts: imx6: delete interrupts property if interrupts-extended is set
In reply to Greg Kroah-HartmanFrom: Alexander Stein <[email protected]>
[ Upstream commit c9d38ff7080b2c4fa6786b82210fa13115895aae ]
In most cases this is related to fsl,err006687-workaround-present, which requires a GPIO interrupt next a GIC interrupt.
This fixes the dtbs_check warning:
imx6dl-mba6a.dtb: ethernet@2188000: More than one condition true in oneOf schema:
{'$filename': 'Documentation/devicetree/bindings/net/fsl,fec.yaml',
[...]
--- arch/arm/boot/dts/imx6dl-riotboard.dts | 1 + arch/arm/boot/dts/imx6q-arm2.dts | 1 + arch/arm/boot/dts/imx6q-evi.dts | 1 + arch/arm/boot/dts/imx6q-mccmon6.dts | 1 + arch/arm/boot/dts/imx6qdl-nit6xlite.dtsi | 1 + arch/arm/boot/dts/imx6qdl-nitrogen6_max.dtsi | 1 + arch/arm/boot/dts/imx6qdl-nitrogen6_som2.dtsi | 1 + arch/arm/boot/dts/imx6qdl-nitrogen6x.dtsi | 1 + arch/arm/boot/dts/imx6qdl-sabreauto.dtsi | 1 + arch/arm/boot/dts/imx6qdl-tqma6a.dtsi | 1 + arch/arm/boot/dts/imx6qdl-ts7970.dtsi | 1 + 11 files changed, 11 insertions(+)
arch/arm/boot/dts/imx6dl-riotboard.dts +1 -0
@@ -90,6 +90,7 @@ pinctrl-0 = <&pinctrl_enet>; phy-mode = "rgmii-id"; phy-handle = <&rgmii_phy>; + /delete-property/ interrupts; interrupts-extended = <&gpio1 6 IRQ_TYPE_LEVEL_HIGH>, <&intc 0 119 IRQ_TYPE_LEVEL_HIGH>; fsl,err006687-workaround-present;
arch/arm/boot/dts/imx6q-arm2.dts +1 -0
@@ -178,6 +178,7 @@ pinctrl-names = "default"; pinctrl-0 = <&pinctrl_enet>; phy-mode = "rgmii"; + /delete-property/ interrupts; interrupts-extended = <&gpio1 6 IRQ_TYPE_LEVEL_HIGH>, <&intc 0 119 IRQ_TYPE_LEVEL_HIGH>; fsl,err006687-workaround-present;
arch/arm/boot/dts/imx6q-evi.dts +1 -0
@@ -146,6 +146,7 @@ pinctrl-0 = <&pinctrl_enet>; phy-mode = "rgmii"; phy-reset-gpios = <&gpio1 25 GPIO_ACTIVE_LOW>; + /delete-property/ interrupts; interrupts-extended = <&gpio1 6 IRQ_TYPE_LEVEL_HIGH>, <&intc 0 119 IRQ_TYPE_LEVEL_HIGH>; fsl,err006687-workaround-present;
arch/arm/boot/dts/imx6q-mccmon6.dts +1 -0
@@ -100,6 +100,7 @@ pinctrl-0 = <&pinctrl_enet>; phy-mode = "rgmii"; phy-reset-gpios = <&gpio1 27 GPIO_ACTIVE_LOW>; + /delete-property/ interrupts; interrupts-extended = <&gpio1 6 IRQ_TYPE_LEVEL_HIGH>, <&intc 0 119 IRQ_TYPE_LEVEL_HIGH>; status = "okay";
arch/arm/boot/dts/imx6qdl-nit6xlite.dtsi +1 -0
@@ -192,6 +192,7 @@ phy-mode = "rgmii"; phy-handle = <ðphy>; phy-reset-gpios = <&gpio1 27 GPIO_ACTIVE_LOW>; + /delete-property/ interrupts; interrupts-extended = <&gpio1 6 IRQ_TYPE_LEVEL_HIGH>, <&intc 0 119 IRQ_TYPE_LEVEL_HIGH>; fsl,err006687-workaround-present;
arch/arm/boot/dts/imx6qdl-nitrogen6_max.dtsi +1 -0
@@ -334,6 +334,7 @@ phy-mode = "rgmii"; phy-handle = <ðphy>; phy-reset-gpios = <&gpio1 27 GPIO_ACTIVE_LOW>; + /delete-property/ interrupts; interrupts-extended = <&gpio1 6 IRQ_TYPE_LEVEL_HIGH>, <&intc 0 119 IRQ_TYPE_LEVEL_HIGH>; fsl,err006687-workaround-present;
arch/arm/boot/dts/imx6qdl-nitrogen6_som2.dtsi +1 -0
@@ -263,6 +263,7 @@ pinctrl-names = "default"; pinctrl-0 = <&pinctrl_enet>; phy-mode = "rgmii"; + /delete-property/ interrupts; interrupts-extended = <&gpio1 6 IRQ_TYPE_LEVEL_HIGH>, <&intc 0 119 IRQ_TYPE_LEVEL_HIGH>; fsl,err006687-workaround-present;
arch/arm/boot/dts/imx6qdl-nitrogen6x.dtsi +1 -0
@@ -267,6 +267,7 @@ phy-mode = "rgmii"; phy-handle = <ðphy>; phy-reset-gpios = <&gpio1 27 GPIO_ACTIVE_LOW>; + /delete-property/ interrupts; interrupts-extended = <&gpio1 6 IRQ_TYPE_LEVEL_HIGH>, <&intc 0 119 IRQ_TYPE_LEVEL_HIGH>; fsl,err006687-workaround-present;
arch/arm/boot/dts/imx6qdl-sabreauto.dtsi +1 -0
@@ -295,6 +295,7 @@ pinctrl-names = "default"; pinctrl-0 = <&pinctrl_enet>; phy-mode = "rgmii-id"; + /delete-property/ interrupts; interrupts-extended = <&gpio1 6 IRQ_TYPE_LEVEL_HIGH>, <&intc 0 119 IRQ_TYPE_LEVEL_HIGH>; fsl,err006687-workaround-present;
arch/arm/boot/dts/imx6qdl-tqma6a.dtsi +1 -0
@@ -7,6 +7,7 @@ #include <dt-bindings/gpio/gpio.h> &fec { + /delete-property/ interrupts; interrupts-extended = <&gpio1 6 IRQ_TYPE_LEVEL_HIGH>, <&intc 0 119 IRQ_TYPE_LEVEL_HIGH>; fsl,err006687-workaround-present;
arch/arm/boot/dts/imx6qdl-ts7970.dtsi +1 -0
@@ -192,6 +192,7 @@ pinctrl-names = "default"; pinctrl-0 = <&pinctrl_enet>; phy-mode = "rgmii"; + /delete-property/ interrupts; interrupts-extended = <&gpio1 6 IRQ_TYPE_LEVEL_HIGH>, <&intc 0 119 IRQ_TYPE_LEVEL_HIGH>; fsl,err006687-workaround-present;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 769/862 ARM: dts: imx7d-sdb: config the max pressure for tsc2046
In reply to Greg Kroah-HartmanFrom: Haibo Chen <[email protected]>
[ Upstream commit e7c4ebe2f9cd68588eb24ba4ed122e696e2d5272 ]
Use the general touchscreen method to config the max pressure for touch tsc2046(data sheet suggest 8 bit pressure), otherwise, for ABS_PRESSURE, when config the same max and min value, weston will meet the following issue,
[17:19:39.183] event1 - ADS7846 Touchscreen: is tagged by udev as: Touchscreen [17:19:39.183] event1 - ADS7846 Touchscreen: kernel bug: device has min == max on ABS_PRESSURE [17:19:39.183] event1 - ADS7846 Touchscreen: was rejected [17:19:39.183] event1 - not using input device '/dev/input/event1'
This will then cause the APP weston-touch-calibrator can't list touch devices.
root@imx6ul7d:~# weston-touch-calibrator could not load cursor 'dnd-move' could not load cursor 'dnd-copy' could not load cursor 'dnd-none' No devices listed.
And accroding to binding Doc, "ti,x-max", "ti,y-max", "ti,pressure-max" belong to the deprecated properties, so remove them. Also for "ti,x-min", "ti,y-min", "ti,x-plate-ohms", the value set in dts equal to the default value in driver, so are redundant, also remove here.
--- arch/arm/boot/dts/imx7d-sdb.dts | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-)
arch/arm/boot/dts/imx7d-sdb.dts +1 -6
@@ -206,12 +206,7 @@ interrupt-parent = <&gpio2>; interrupts = <29 0>; pendown-gpio = <&gpio2 29 GPIO_ACTIVE_HIGH>; - ti,x-min = /bits/ 16 <0>; - ti,x-max = /bits/ 16 <0>; - ti,y-min = /bits/ 16 <0>; - ti,y-max = /bits/ 16 <0>; - ti,pressure-max = /bits/ 16 <0>; - ti,x-plate-ohms = /bits/ 16 <400>; + touchscreen-max-pressure = <255>; wakeup-source; }; };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 770/862 arm64: dts: qcom: sc7280-idp: correct ADC channel node name and unit address
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 5589ffb2da2a66988ab3a68334dad3e68b42e3a9 ]
Correct SPMI PMIC VADC channel node name:
1. Use hyphens instead of underscores,
2. Add missing unit address.
This fixes make dtbs_check warnings like:
qcom/sc7280-idp.dtb: pmic@0: adc@3100: 'pmk8350_die_temp', 'pmr735a_die_temp' do not match any of the regexes: '^.*@[0-9a-f]+$', 'pinctrl-[0-9]+'
--- arch/arm64/boot/dts/qcom/sc7280-idp.dts | 2 +- arch/arm64/boot/dts/qcom/sc7280-idp.dtsi | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/qcom/sc7280-idp.dts +1 -1
@@ -78,7 +78,7 @@ }; &pmk8350_vadc { - pmr735a_die_temp { + pmr735a-die-temp@403 { reg = <PMR735A_ADC7_DIE_TEMP>; label = "pmr735a_die_temp"; qcom,pre-scaling = <1 1>;
arch/arm64/boot/dts/qcom/sc7280-idp.dtsi +1 -1
@@ -264,7 +264,7 @@ }; &pmk8350_vadc { - pmk8350_die_temp { + pmk8350-die-temp@3 { reg = <PMK8350_ADC7_DIE_TEMP>; label = "pmk8350_die_temp"; qcom,pre-scaling = <1 1>;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 771/862 ARM: dts: imx6q: add missing properties for sram
In reply to Greg Kroah-HartmanFrom: Alexander Stein <[email protected]>
[ Upstream commit b11d083c5dcec7c42fe982c854706d404ddd3a5f ]
All 3 properties are required by sram.yaml. Fixes the dtbs_check warning:
sram@900000: '#address-cells' is a required property sram@900000: '#size-cells' is a required property sram@900000: 'ranges' is a required property
--- arch/arm/boot/dts/imx6q.dtsi | 3 +++ 1 file changed, 3 insertions(+)
arch/arm/boot/dts/imx6q.dtsi +3 -0
@@ -163,6 +163,9 @@ ocram: sram@900000 { compatible = "mmio-sram"; reg = <0x00900000 0x40000>; + ranges = <0 0x00900000 0x40000>; + #address-cells = <1>; + #size-cells = <1>; clocks = <&clks IMX6QDL_CLK_OCRAM>; };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 772/862 ARM: dts: imx6dl: add missing properties for sram
In reply to Greg Kroah-HartmanFrom: Alexander Stein <[email protected]>
[ Upstream commit f5848b95633d598bacf0500e0108dc5961af88c0 ]
All 3 properties are required by sram.yaml. Fixes the dtbs_check warning:
sram@900000: '#address-cells' is a required property sram@900000: '#size-cells' is a required property sram@900000: 'ranges' is a required property
--- arch/arm/boot/dts/imx6dl.dtsi | 3 +++ 1 file changed, 3 insertions(+)
arch/arm/boot/dts/imx6dl.dtsi +3 -0
@@ -84,6 +84,9 @@ ocram: sram@900000 { compatible = "mmio-sram"; reg = <0x00900000 0x20000>; + ranges = <0 0x00900000 0x20000>; + #address-cells = <1>; + #size-cells = <1>; clocks = <&clks IMX6QDL_CLK_OCRAM>; };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 773/862 ARM: dts: imx6qp: add missing properties for sram
In reply to Greg Kroah-HartmanFrom: Alexander Stein <[email protected]>
[ Upstream commit 088fe5237435ee2f7ed4450519b2ef58b94c832f ]
All 3 properties are required by sram.yaml. Fixes the dtbs_check warning:
sram@940000: '#address-cells' is a required property sram@940000: '#size-cells' is a required property sram@940000: 'ranges' is a required property
--- arch/arm/boot/dts/imx6qp.dtsi | 6 ++++++ 1 file changed, 6 insertions(+)
arch/arm/boot/dts/imx6qp.dtsi +6 -0
@@ -9,12 +9,18 @@ ocram2: sram@940000 { compatible = "mmio-sram"; reg = <0x00940000 0x20000>; + ranges = <0 0x00940000 0x20000>; + #address-cells = <1>; + #size-cells = <1>; clocks = <&clks IMX6QDL_CLK_OCRAM>; }; ocram3: sram@960000 { compatible = "mmio-sram"; reg = <0x00960000 0x20000>; + ranges = <0 0x00960000 0x20000>; + #address-cells = <1>; + #size-cells = <1>; clocks = <&clks IMX6QDL_CLK_OCRAM>; };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 774/862 ARM: dts: imx6sl: add missing properties for sram
In reply to Greg Kroah-HartmanFrom: Alexander Stein <[email protected]>
[ Upstream commit 60c9213a1d9941a8b33db570796c3f9be8984974 ]
All 3 properties are required by sram.yaml. Fixes the dtbs_check warning:
sram@900000: '#address-cells' is a required property sram@900000: '#size-cells' is a required property sram@900000: 'ranges' is a required property
--- arch/arm/boot/dts/imx6sl.dtsi | 3 +++ 1 file changed, 3 insertions(+)
arch/arm/boot/dts/imx6sl.dtsi +3 -0
@@ -115,6 +115,9 @@ ocram: sram@900000 { compatible = "mmio-sram"; reg = <0x00900000 0x20000>; + ranges = <0 0x00900000 0x20000>; + #address-cells = <1>; + #size-cells = <1>; clocks = <&clks IMX6SL_CLK_OCRAM>; };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 775/862 ARM: dts: imx6sll: add missing properties for sram
In reply to Greg Kroah-HartmanFrom: Alexander Stein <[email protected]>
[ Upstream commit 7492a83ed9b7a151e2dd11d64b06da7a7f0fa7f9 ]
All 3 properties are required by sram.yaml. Fixes the dtbs_check warning:
sram@900000: '#address-cells' is a required property sram@900000: '#size-cells' is a required property sram@900000: 'ranges' is a required property
--- arch/arm/boot/dts/imx6sll.dtsi | 3 +++ 1 file changed, 3 insertions(+)
arch/arm/boot/dts/imx6sll.dtsi +3 -0
@@ -115,6 +115,9 @@ ocram: sram@900000 { compatible = "mmio-sram"; reg = <0x00900000 0x20000>; + ranges = <0 0x00900000 0x20000>; + #address-cells = <1>; + #size-cells = <1>; }; intc: interrupt-controller@a01000 {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 776/862 ARM: dts: imx6sx: add missing properties for sram
In reply to Greg Kroah-HartmanFrom: Alexander Stein <[email protected]>
[ Upstream commit 415432c008b2bce8138841356ba444631cabaa50 ]
All 3 properties are required by sram.yaml. Fixes the dtbs_check warning:
sram@900000: '#address-cells' is a required property sram@900000: '#size-cells' is a required property sram@900000: 'ranges' is a required property
--- arch/arm/boot/dts/imx6sx.dtsi | 6 ++++++ 1 file changed, 6 insertions(+)
arch/arm/boot/dts/imx6sx.dtsi +6 -0
@@ -164,12 +164,18 @@ ocram_s: sram@8f8000 { compatible = "mmio-sram"; reg = <0x008f8000 0x4000>; + ranges = <0 0x008f8000 0x4000>; + #address-cells = <1>; + #size-cells = <1>; clocks = <&clks IMX6SX_CLK_OCRAM_S>; }; ocram: sram@900000 { compatible = "mmio-sram"; reg = <0x00900000 0x20000>; + ranges = <0 0x00900000 0x20000>; + #address-cells = <1>; + #size-cells = <1>; clocks = <&clks IMX6SX_CLK_OCRAM>; };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 777/862 ARM: dts: imx6sl: use tabs for code indent
In reply to Greg Kroah-HartmanFrom: Marcel Ziswiler <[email protected]>
[ Upstream commit 218db824a7519856d0eaaeb5c41ca504ed550210 ]
This fixes the following error:
arch/arm/boot/dts/imx6sl.dtsi:714: error: code indent should use tabs where possible
--- arch/arm/boot/dts/imx6sl.dtsi | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-)
arch/arm/boot/dts/imx6sl.dtsi +10 -10
@@ -61,10 +61,10 @@ <792000 1175000>, <396000 975000>; fsl,soc-operating-points = - /* ARM kHz SOC-PU uV */ - <996000 1225000>, - <792000 1175000>, - <396000 1175000>; + /* ARM kHz SOC-PU uV */ + <996000 1225000>, + <792000 1175000>, + <396000 1175000>; clock-latency = <61036>; /* two CLK32 periods */ #cooling-cells = <2>; clocks = <&clks IMX6SL_CLK_ARM>, <&clks IMX6SL_CLK_PLL2_PFD2>,
@@ -225,7 +225,7 @@ uart5: serial@2018000 { compatible = "fsl,imx6sl-uart", - "fsl,imx6q-uart", "fsl,imx21-uart"; + "fsl,imx6q-uart", "fsl,imx21-uart"; reg = <0x02018000 0x4000>; interrupts = <0 30 IRQ_TYPE_LEVEL_HIGH>; clocks = <&clks IMX6SL_CLK_UART>,
@@ -238,7 +238,7 @@ uart1: serial@2020000 { compatible = "fsl,imx6sl-uart", - "fsl,imx6q-uart", "fsl,imx21-uart"; + "fsl,imx6q-uart", "fsl,imx21-uart"; reg = <0x02020000 0x4000>; interrupts = <0 26 IRQ_TYPE_LEVEL_HIGH>; clocks = <&clks IMX6SL_CLK_UART>,
@@ -251,7 +251,7 @@ uart2: serial@2024000 { compatible = "fsl,imx6sl-uart", - "fsl,imx6q-uart", "fsl,imx21-uart"; + "fsl,imx6q-uart", "fsl,imx21-uart"; reg = <0x02024000 0x4000>; interrupts = <0 27 IRQ_TYPE_LEVEL_HIGH>; clocks = <&clks IMX6SL_CLK_UART>,
@@ -312,7 +312,7 @@ uart3: serial@2034000 { compatible = "fsl,imx6sl-uart", - "fsl,imx6q-uart", "fsl,imx21-uart"; + "fsl,imx6q-uart", "fsl,imx21-uart"; reg = <0x02034000 0x4000>; interrupts = <0 28 IRQ_TYPE_LEVEL_HIGH>; clocks = <&clks IMX6SL_CLK_UART>,
@@ -325,7 +325,7 @@ uart4: serial@2038000 { compatible = "fsl,imx6sl-uart", - "fsl,imx6q-uart", "fsl,imx21-uart"; + "fsl,imx6q-uart", "fsl,imx21-uart"; reg = <0x02038000 0x4000>; interrupts = <0 29 IRQ_TYPE_LEVEL_HIGH>; clocks = <&clks IMX6SL_CLK_UART>,
@@ -714,7 +714,7 @@ #power-domain-cells = <0>; power-supply = <®_pu>; clocks = <&clks IMX6SL_CLK_GPU2D_OVG>, - <&clks IMX6SL_CLK_GPU2D_PODF>; + <&clks IMX6SL_CLK_GPU2D_PODF>; }; pd_disp: power-domain@2 {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 778/862 ARM: dts: imx6sx-udoo-neo: dont use multiple blank lines
In reply to Greg Kroah-HartmanFrom: Marcel Ziswiler <[email protected]>
[ Upstream commit fd2dd7077c7498765e7326c1b7f34bde85f1a975 ]
This fixes the following warning:
arch/arm/boot/dts/imx6sx-udoo-neo.dtsi:309: check: Please don't use multiple blank lines
While at it, use tabs indent for some pinctrl entries.
--- arch/arm/boot/dts/imx6sx-udoo-neo.dtsi | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-)
arch/arm/boot/dts/imx6sx-udoo-neo.dtsi +6 -8
@@ -226,7 +226,7 @@ &iomuxc { pinctrl_bt_reg: btreggrp { fsl,pins = - <MX6SX_PAD_KEY_ROW2__GPIO2_IO_17 0x15059>; + <MX6SX_PAD_KEY_ROW2__GPIO2_IO_17 0x15059>; }; pinctrl_enet1: enet1grp {
@@ -306,7 +306,6 @@ >; }; - pinctrl_uart1: uart1grp { fsl,pins = <MX6SX_PAD_GPIO1_IO04__UART1_DCE_TX 0x1b0b1>,
@@ -347,24 +346,23 @@ pinctrl_otg1_reg: otg1grp { fsl,pins = - <MX6SX_PAD_GPIO1_IO09__GPIO1_IO_9 0x10b0>; + <MX6SX_PAD_GPIO1_IO09__GPIO1_IO_9 0x10b0>; }; - pinctrl_otg2_reg: otg2grp { fsl,pins = - <MX6SX_PAD_NAND_RE_B__GPIO4_IO_12 0x10b0>; + <MX6SX_PAD_NAND_RE_B__GPIO4_IO_12 0x10b0>; }; pinctrl_usb_otg1: usbotg1grp { fsl,pins = - <MX6SX_PAD_GPIO1_IO10__ANATOP_OTG1_ID 0x17059>, - <MX6SX_PAD_GPIO1_IO08__USB_OTG1_OC 0x10b0>; + <MX6SX_PAD_GPIO1_IO10__ANATOP_OTG1_ID 0x17059>, + <MX6SX_PAD_GPIO1_IO08__USB_OTG1_OC 0x10b0>; }; pinctrl_usb_otg2: usbot2ggrp { fsl,pins = - <MX6SX_PAD_QSPI1A_DATA0__USB_OTG2_OC 0x10b0>; + <MX6SX_PAD_QSPI1A_DATA0__USB_OTG2_OC 0x10b0>; }; pinctrl_usdhc2: usdhc2grp {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 779/862 kselftest/arm64: Fix validatation termination record after EXTRA_CONTEXT
In reply to Greg Kroah-HartmanFrom: Mark Brown <[email protected]>
[ Upstream commit 5c152c2f66f9368394b89ac90dc7483476ef7b88 ]
When arm64 signal context data overflows the base struct sigcontext it gets placed in an extra buffer pointed to by a record of type EXTRA_CONTEXT in the base struct sigcontext which is required to be the last record in the base struct sigframe. The current validation code attempts to check this by using GET_RESV_NEXT_HEAD() to step forward from the current record to the next but that is a macro which assumes it is being provided with a struct _aarch64_ctx and uses the size there to skip forward to the next record. Instead validate_extra_context() passes it a struct extra_context which has a separate size field. This compiles but results in us trying to validate a termination record in completely the wrong place, at best failing validation and at worst just segfaulting. Fix this by passing the struct _aarch64_ctx we meant to into the macro.
--- tools/testing/selftests/arm64/signal/testcases/testcases.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/arm64/signal/testcases/testcases.c +1 -1
@@ -33,7 +33,7 @@ bool validate_extra_context(struct extra_context *extra, char **err)return false;fprintf (stderr,"Validating EXTRA...\n" ); - term =GET_RESV_NEXT_HEAD (extra); + term =GET_RESV_NEXT_HEAD (&extra->head);if (!term || term->magic || term->size) { *err ="Missing terminator after EXTRA context" ;return false;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 780/862 arm64: dts: imx8mm-kontron: Use the VSELECT signal to switch SD card IO voltage
In reply to Greg Kroah-HartmanFrom: Frieder Schrempf <[email protected]>
[ Upstream commit eef2c0217e02b6c7ed5b10b82ea944127145e113 ]
It turns out that it is not necessary to declare the VSELECT signal as GPIO and let the PMIC driver set it to a fixed high level. This switches the voltage between 3.3V and 1.8V by setting the PMIC register for LDO5 accordingly.
Instead we can do it like other boards already do and simply mux the VSELECT signal of the USDHC interface to the pin. This makes sure that the correct voltage is selected by setting the PMIC's SD_VSEL input to high or low accordingly.
--- arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-s.dts | 3 +++ arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-som.dtsi | 2 -- 2 files changed, 3 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-s.dts +3 -0
@@ -321,6 +321,7 @@ MX8MM_IOMUXC_SD2_DATA2_USDHC2_DATA2 0x1d0 MX8MM_IOMUXC_SD2_DATA3_USDHC2_DATA3 0x1d0 MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12 0x019 + MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT 0x1d0 >; };
@@ -333,6 +334,7 @@ MX8MM_IOMUXC_SD2_DATA2_USDHC2_DATA2 0x1d4 MX8MM_IOMUXC_SD2_DATA3_USDHC2_DATA3 0x1d4 MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12 0x019 + MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT 0x1d0 >; };
@@ -345,6 +347,7 @@ MX8MM_IOMUXC_SD2_DATA2_USDHC2_DATA2 0x1d6 MX8MM_IOMUXC_SD2_DATA3_USDHC2_DATA3 0x1d6 MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12 0x019 + MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT 0x1d0 >; }; };
arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-som.dtsi +0 -2
@@ -86,7 +86,6 @@ pinctrl-0 = <&pinctrl_pmic>; interrupt-parent = <&gpio1>; interrupts = <0 IRQ_TYPE_LEVEL_LOW>; - sd-vsel-gpios = <&gpio1 4 GPIO_ACTIVE_HIGH>; regulators { reg_vdd_soc: BUCK1 {
@@ -229,7 +228,6 @@ pinctrl_pmic: pmicgrp { fsl,pins = < MX8MM_IOMUXC_GPIO1_IO00_GPIO1_IO0 0x141 - MX8MM_IOMUXC_GPIO1_IO04_GPIO1_IO4 0x141 >; };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 781/862 arm64: dts: imx8mq-librem5: Add bq25895 as max17055s power supply
In reply to Greg Kroah-HartmanFrom: Sebastian Krzyszkowiak <[email protected]>
[ Upstream commit 6effe295e1a87408033c29dbcea9d5a5c8b937d5 ]
This allows the userspace to notice that there's not enough current provided to charge the battery, and also fixes issues with 0% SOC values being considered invalid.
--- arch/arm64/boot/dts/freescale/imx8mq-librem5.dtsi | 1 + 1 file changed, 1 insertion(+)
arch/arm64/boot/dts/freescale/imx8mq-librem5.dtsi +1 -0
@@ -1077,6 +1077,7 @@ interrupts = <20 IRQ_TYPE_LEVEL_LOW>; pinctrl-names = "default"; pinctrl-0 = <&pinctrl_gauge>; + power-supplies = <&bq25895>; maxim,over-heat-temp = <700>; maxim,over-volt = <4500>; maxim,rsns-microohm = <5000>;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 782/862 ARM: orion: fix include path
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
[ Upstream commit 63872304bdb3decd5454f4dd210c25395278ed13 ]
Now that CONFIG_ARCH_MULTIPLATFORM can be disabled anywhere, there is a build failure for plat-orion:
arch/arm/plat-orion/irq.c:19:10: fatal error: plat/irq.h: No such file or directory
Make the include path unconditional.
--- arch/arm/plat-orion/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/plat-orion/Makefile +1 -1
@@ -2,7 +2,7 @@ # # Makefile for the linux kernel. # -ccflags-$(CONFIG_ARCH_MULTIPLATFORM) := -I$(srctree)/$(src)/include +ccflags-y := -I$(srctree)/$(src)/include orion-gpio-$(CONFIG_GPIOLIB) += gpio.o obj-$(CONFIG_PLAT_ORION_LEGACY) += irq.o pcie.o time.o common.o mpp.o
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 783/862 btrfs: dump extra info if one free space cache has more bitmaps than it should
In reply to Greg Kroah-HartmanFrom: Qu Wenruo <[email protected]>
[ Upstream commit 62cd9d4474282a1eb84f945955c56cbfc42e1ffe ]
There is an internal report on hitting the following ASSERT() in recalculate_thresholds():
ASSERT(ctl->total_bitmaps <= max_bitmaps);
Above @max_bitmaps is calculated using the following variables:
- bytes_per_bg
8 * 4096 * 4096 (128M) for x86_64/x86.
- block_group->length
The length of the block group.
@max_bitmaps is the rounded up value of block_group->length / 128M.
Normally one free space cache should not have more bitmaps than above value, but when it happens the ASSERT() can be triggered if CONFIG_BTRFS_ASSERT is also enabled.
But the ASSERT() itself won't provide enough info to know which is going wrong.
Is the bg too small thus it only allows one bitmap?
Or is there something else wrong?
So although I haven't found extra reports or crash dump to do further investigation, add the extra info to make it more helpful to debug.
--- fs/btrfs/free-space-cache.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/btrfs/free-space-cache.c +6 -0
@@ -693,6 +693,12 @@ static void recalculate_thresholds(struct btrfs_free_space_ctl *ctl) max_bitmaps =max_t (u64, max_bitmaps,1 ); +if (ctl->total_bitmaps > max_bitmaps) +btrfs_err (block_group->fs_info, +"invalid free space control: bg start=%llu len=%llu total_bitmaps=%u unit=%u max_bitmaps=%llu bytes_per_bg=%llu" , + block_group->start, block_group->length, + ctl->total_bitmaps, ctl->unit, max_bitmaps, + bytes_per_bg);ASSERT (ctl->total_bitmaps <= max_bitmaps);/*
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 784/862 btrfs: scrub: properly report super block errors in system log
In reply to Greg Kroah-HartmanFrom: Qu Wenruo <[email protected]>
[ Upstream commit e69bf81c9a339f1b2c041b112a6fbb9f60fc9340 ]
[PROBLEM]
Unlike data/metadata corruption, if scrub detected some error in the super block, the only error message is from the updated device status:
BTRFS info (device dm-1): scrub: started on devid 2
BTRFS error (device dm-1): bdev /dev/mapper/test-scratch2 errs: wr 0, rd 0, flush 0, corrupt 1, gen 0 BTRFS info (device dm-1): scrub: finished on devid 2 with status: 0
This is not helpful at all.
[CAUSE]
Unlike data/metadata error reporting, there is no visible report in kernel dmesg to report supper block errors.
In fact, return value of scrub_checksum_super() is intentionally skipped, thus scrub_handle_errored_block() will never be called for super blocks.
[FIX]
Make super block errors to output an error message, now the full dmesg would looks like this:
BTRFS info (device dm-1): scrub: started on devid 2
BTRFS warning (device dm-1): super block error on device /dev/mapper/test-scratch2, physical 67108864 BTRFS error (device dm-1): bdev /dev/mapper/test-scratch2 errs: wr 0, rd 0, flush 0, corrupt 1, gen 0 BTRFS info (device dm-1): scrub: finished on devid 2 with status: 0
BTRFS info (device dm-1): scrub: started on devid 2
This fix involves:
- Move the super_errors reporting to scrub_handle_errored_block() This allows the device status message to show after the super block error message.
But now we no longer distinguish super block corruption and generation mismatch, now all counted as corruption.
- Properly check the return value from scrub_checksum_super()
- Add extra super block error reporting for scrub_print_warning().
--- fs/btrfs/scrub.c | 33 ++++++++++++--------------------- 1 file changed, 12 insertions(+), 21 deletions(-)
fs/btrfs/scrub.c +12 -21
@@ -729,6 +729,13 @@ static void scrub_print_warning(const char *errstr, struct scrub_block *sblock) dev = sblock->sectors[0 ]->dev; fs_info = sblock->sctx->fs_info; +/* Super block error, no need to search extent tree. */ +if (sblock->sectors[0 ]->flags &BTRFS_EXTENT_FLAG_SUPER ) { +btrfs_warn_in_rcu (fs_info,"%s on device %s, physical %llu" , + errstr,rcu_str_deref (dev->name), + sblock->sectors[0 ]->physical); +return ; + } path =btrfs_alloc_path ();if (!path)return ;
@@ -804,7 +811,7 @@ static inline void scrub_put_recover(struct btrfs_fs_info *fs_info,static int scrub_handle_errored_block (struct scrub_block *sblock_to_check) {struct scrub_ctx *sctx = sblock_to_check->sctx; -struct btrfs_device *dev; +struct btrfs_device *dev = sblock_to_check->sectors[0 ]->dev;struct btrfs_fs_info *fs_info;u64 logical;unsigned int failed_mirror_index;
@@ -825,13 +832,15 @@ static int scrub_handle_errored_block(struct scrub_block *sblock_to_check) fs_info = sctx->fs_info;if (sblock_to_check->sectors[0 ]->flags &BTRFS_EXTENT_FLAG_SUPER ) {/* -* if we find an error in a super block, we just report it. +* If we find an error in a super block, we just report it. * They will get written with the next transaction commit * anyway */ +scrub_print_warning ("super block error" , sblock_to_check);spin_lock (&sctx->stat_lock); ++sctx->stat.super_errors;spin_unlock (&sctx->stat_lock); +btrfs_dev_stat_inc_and_print (dev,BTRFS_DEV_STAT_CORRUPTION_ERRS );return 0 ; } logical = sblock_to_check->sectors[0 ]->logical;
@@ -840,7 +849,6 @@ static int scrub_handle_errored_block(struct scrub_block *sblock_to_check) is_metadata = !(sblock_to_check->sectors[0 ]->flags &BTRFS_EXTENT_FLAG_DATA ); have_csum = sblock_to_check->sectors[0 ]->have_csum; - dev = sblock_to_check->sectors[0 ]->dev;if (!sctx->is_dev_replace &&btrfs_repair_one_zone (fs_info, logical))return 0 ;
@@ -1762,7 +1770,7 @@ static int scrub_checksum(struct scrub_block *sblock)else if (flags &BTRFS_EXTENT_FLAG_TREE_BLOCK ) ret =scrub_checksum_tree_block (sblock);else if (flags &BTRFS_EXTENT_FLAG_SUPER ) - (void )scrub_checksum_super (sblock); + ret =scrub_checksum_super (sblock);else WARN_ON (1 );if (ret)
@@ -1901,23 +1909,6 @@ static int scrub_checksum_super(struct scrub_block *sblock)if (memcmp (calculated_csum, s->csum, sctx->fs_info->csum_size)) ++fail_cor; -if (fail_cor + fail_gen) { -/* -* if we find an error in a super block, we just report it. -* They will get written with the next transaction commit -* anyway -*/ -spin_lock (&sctx->stat_lock); - ++sctx->stat.super_errors; -spin_unlock (&sctx->stat_lock); -if (fail_cor) -btrfs_dev_stat_inc_and_print (sector->dev, -BTRFS_DEV_STAT_CORRUPTION_ERRS ); -else -btrfs_dev_stat_inc_and_print (sector->dev, -BTRFS_DEV_STAT_GENERATION_ERRS ); - } -return fail_cor + fail_gen; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 785/862 btrfs: scrub: try to fix super block errors
In reply to Greg Kroah-HartmanFrom: Qu Wenruo <[email protected]>
[ Upstream commit f9eab5f0bba76742af654f33d517bf62a0db8f12 ]
[BUG]
The following script shows that, although scrub can detect super block errors, it never tries to fix it:
mkfs.btrfs -f -d raid1 -m raid1 $dev1 $dev2 xfs_io -c "pwrite 67108864 4k" $dev2
mount $dev1 $mnt
btrfs scrub start -B $dev2
btrfs scrub start -Br $dev2
umount $mnt
The first scrub reports the super error correctly:
scrub done for f3289218-abd3-41ac-a630-202f766c0859
Scrub started: Tue Aug 2 14:44:11 2022
Status: finished
Duration: 0:00:00
Total to scrub: 1.26GiB
Rate: 0.00B/s
Error summary: super=1
Corrected: 0
Uncorrectable: 0
Unverified: 0But the second read-only scrub still reports the same super error:
Scrub started: Tue Aug 2 14:44:11 2022
Status: finished
Duration: 0:00:00
Total to scrub: 1.26GiB
Rate: 0.00B/s
Error summary: super=1
Corrected: 0
Uncorrectable: 0
Unverified: 0[CAUSE]
The comments already shows that super block can be easily fixed by committing a transaction:
/*
* If we find an error in a super block, we just report it.
* They will get written with the next transaction commit
* anyway
*/
But the truth is, such assumption is not always true, and since scrub should try to repair every error it found (except for read-only scrub), we should really actively commit a transaction to fix this.
[FIX]
Just commit a transaction if we found any super block errors, after everything else is done.
We cannot do this just after scrub_supers(), as btrfs_commit_transaction() will try to pause and wait for the running scrub, thus we can not call it with scrub_lock hold.
--- fs/btrfs/scrub.c | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+)
fs/btrfs/scrub.c +36 -0
@@ -4093,6 +4093,7 @@ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start,int ret;struct btrfs_device *dev;unsigned int nofs_flag; +bool need_commit = false;if (btrfs_fs_closing (fs_info))return -EAGAIN ;
@@ -4196,6 +4197,12 @@ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start,*/ nofs_flag =memalloc_nofs_save ();if (!is_dev_replace) { +u64 old_super_errors; + +spin_lock (&sctx->stat_lock); + old_super_errors = sctx->stat.super_errors; +spin_unlock (&sctx->stat_lock); +btrfs_info (fs_info,"scrub: started on devid %llu" , devid);/* * by holding device list mutex, we can
@@ -4204,6 +4211,16 @@ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start,mutex_lock (&fs_info->fs_devices->device_list_mutex); ret =scrub_supers (sctx, dev);mutex_unlock (&fs_info->fs_devices->device_list_mutex); + +spin_lock (&sctx->stat_lock); +/* +* Super block errors found, but we can not commit transaction +* at current context, since btrfs_commit_transaction() needs +* to pause the current running scrub (hold by ourselves). +*/ +if (sctx->stat.super_errors > old_super_errors && !sctx->readonly) + need_commit = true; +spin_unlock (&sctx->stat_lock); }if (!ret)
@@ -4230,6 +4247,25 @@ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start,scrub_workers_put (fs_info);scrub_put_ctx (sctx); +/* +* We found some super block errors before, now try to force a +* transaction commit, as scrub has finished. +*/ +if (need_commit) { +struct btrfs_trans_handle *trans; + + trans =btrfs_start_transaction (fs_info->tree_root,0 ); +if (IS_ERR (trans)) { + ret =PTR_ERR (trans); +btrfs_err (fs_info, +"scrub: failed to start transaction to fix super block errors: %d" , ret); +return ret; + } + ret =btrfs_commit_transaction (trans); +if (ret <0 ) +btrfs_err (fs_info, +"scrub: failed to commit transaction to fix super block errors: %d" , ret); + }return ret; out:scrub_workers_put (fs_info);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 786/862 btrfs: dont print information about space cache or tree every remount
In reply to Greg Kroah-HartmanFrom: Maciej S. Szmigiero <[email protected]>
[ Upstream commit dbecac26630014d336a8e5ea67096ff18210fb9c ]
btrfs currently prints information about space cache or free space tree being in use on every remount, regardless whether such remount actually enabled or disabled one of these features.
This is actually unnecessary since providing remount options changing the state of these features will explicitly print the appropriate notice.
Let's instead print such unconditional information just on an initial mount to avoid filling the kernel log when, for example, laptop-mode-tools remount the fs on some events.
--- fs/btrfs/super.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
fs/btrfs/super.c +7 -4
@@ -626,6 +626,7 @@ int btrfs_parse_options(struct btrfs_fs_info *info, char *options,int saved_compress_level;bool saved_compress_force;int no_compress =0 ; +const bool remounting =test_bit (BTRFS_FS_STATE_REMOUNTING , &info->fs_state);if (btrfs_fs_compat_ro (info,FREE_SPACE_TREE ))btrfs_set_opt (info->mount_opt,FREE_SPACE_TREE );
@@ -1137,10 +1138,12 @@ int btrfs_parse_options(struct btrfs_fs_info *info, char *options, }if (!ret) ret =btrfs_check_mountopts_zoned (info); -if (!ret &&btrfs_test_opt (info,SPACE_CACHE )) -btrfs_info (info,"disk space caching is enabled" ); -if (!ret &&btrfs_test_opt (info,FREE_SPACE_TREE )) -btrfs_info (info,"using free space tree" ); +if (!ret && !remounting) { +if (btrfs_test_opt (info,SPACE_CACHE )) +btrfs_info (info,"disk space caching is enabled" ); +if (btrfs_test_opt (info,FREE_SPACE_TREE )) +btrfs_info (info,"using free space tree" ); + }return ret; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 787/862 btrfs: call __btrfs_remove_free_space_cache_locked on cache load failure
In reply to Greg Kroah-HartmanFrom: Josef Bacik <[email protected]>
[ Upstream commit 8a1ae2781dee9fc21ca82db682d37bea4bd074ad ]
Now that lockdep is staying enabled through our entire CI runs I started seeing the following stack in generic/475
------------[ cut here ]------------ WARNING: CPU: 1 PID: 2171864 at fs/btrfs/discard.c:604 btrfs_discard_update_discardable+0x98/0xb0 CPU: 1 PID: 2171864 Comm: kworker/u4:0 Not tainted 5.19.0-rc8+ #789 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-2.fc32 04/01/2014 Workqueue: btrfs-cache btrfs_work_helper RIP: 0010:btrfs_discard_update_discardable+0x98/0xb0 RSP: 0018:ffffb857c2f7bad0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff8c85c605c200 RCX: 0000000000000001 RDX: 0000000000000000 RSI: ffffffff86807c5b RDI: ffffffff868a831e RBP: ffff8c85c4c54000 R08: 0000000000000000 R09: 0000000000000000 R10: ffff8c85c66932f0 R11: 0000000000000001 R12: ffff8c85c3899010 R13: ffff8c85d5be4f40 R14: ffff8c85c4c54000 R15: ffff8c86114bfa80 FS: 0000000000000000(0000) GS:ffff8c863bd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f2e7f168160 CR3: 000000010289a004 CR4: 0000000000370ee0 Call Trace: __btrfs_remove_free_space_cache+0x27/0x30 load_free_space_cache+0xad2/0xaf0 caching_thread+0x40b/0x650 ? lock_release+0x137/0x2d0 btrfs_work_helper+0xf2/0x3e0 ? lock_is_held_type+0xe2/0x140 process_one_work+0x271/0x590 ? process_one_work+0x590/0x590 worker_thread+0x52/0x3b0 ? process_one_work+0x590/0x590 kthread+0xf0/0x120 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30
This is the code
ctl = block_group->free_space_ctl;
discard_ctl = &block_group->fs_info->discard_ctl;
lockdep_assert_held(&ctl->tree_lock);We have a temporary free space ctl for loading the free space cache in order to avoid having allocations happening while we're loading the cache. When we hit an error we free it all up, however this also calls btrfs_discard_update_discardable, which requires block_group->free_space_ctl->tree_lock to be held. However this is our temporary ctl so this lock isn't held. Fix this by calling __btrfs_remove_free_space_cache_locked instead so that we only clean up the entries and do not mess with the discardable stats.
--- fs/btrfs/free-space-cache.c | 53 +++++++++++++++++++++++++++----------------- 1 file changed, 33 insertions(+), 20 deletions(-)
fs/btrfs/free-space-cache.c +33 -20
@@ -48,6 +48,25 @@ static void bitmap_clear_bits(struct btr struct btrfs_free_space *info, u64 offset, u64 bytes, bool update_stats); +static void __btrfs_remove_free_space_cache_locked ( +struct btrfs_free_space_ctl *ctl) +{ +struct btrfs_free_space *info; +struct rb_node *node; + +while ((node =rb_last (&ctl->free_space_offset)) !=NULL ) { + info = rb_entry(node, struct btrfs_free_space, offset_index); +if (!info->bitmap) { +unlink_free_space (ctl, info, true); +kmem_cache_free (btrfs_free_space_cachep, info); + }else { +free_bitmap (ctl, info); + } + +cond_resched_lock (&ctl->tree_lock); + } +} +static struct inode *__lookup_free_space_inode (struct btrfs_root *root,struct btrfs_path *path,u64 offset)
@@ -881,7 +900,14 @@ out:return ret; free_cache:io_ctl_drop_pages (&io_ctl); -__btrfs_remove_free_space_cache (ctl); + +/* +* We need to call the _locked variant so we don't try to update the +* discard counters. +*/ +spin_lock (&ctl->tree_lock); +__btrfs_remove_free_space_cache_locked (ctl); +spin_unlock (&ctl->tree_lock); goto out; }
@@ -1007,7 +1033,13 @@ int load_free_space_cache(struct btrfs_bif (ret ==0 ) ret =1 ; }else { +/* +* We need to call the _locked variant so we don't try to update +* the discard counters. +*/ +spin_lock (&tmp_ctl.tree_lock);__btrfs_remove_free_space_cache (&tmp_ctl); +spin_unlock (&tmp_ctl.tree_lock);btrfs_warn (fs_info,"block group %llu has wrong amount of free space" , block_group->start);
@@ -2970,25 +3002,6 @@ static void __btrfs_return_cluster_to_frbtrfs_put_block_group (block_group); } -static void __btrfs_remove_free_space_cache_locked ( -struct btrfs_free_space_ctl *ctl) -{ -struct btrfs_free_space *info; -struct rb_node *node; - -while ((node =rb_last (&ctl->free_space_offset)) !=NULL ) { - info = rb_entry(node, struct btrfs_free_space, offset_index); -if (!info->bitmap) { -unlink_free_space (ctl, info, true); -kmem_cache_free (btrfs_free_space_cachep, info); - }else { -free_bitmap (ctl, info); - } - -cond_resched_lock (&ctl->tree_lock); - } -} -void __btrfs_remove_free_space_cache (struct btrfs_free_space_ctl *ctl) {spin_lock (&ctl->tree_lock);
Greg Kroah-Hartman
maintainerPATCH 788/862 arm64: dts: uniphier: Add USB-device support for PXs3 reference board
In reply to Greg Kroah-HartmanFrom: Kunihiko Hayashi <[email protected]>
[ Upstream commit 19fee1a1096d21ab1f1e712148b5417bda2939a2 ]
PXs3 reference board can change each USB port 0 and 1 to device mode with jumpers. Prepare devicetree sources for USB port 0 and 1.
This specifies dr_mode, pinctrl, and some quirks and removes nodes for unused phys and vbus-supply properties.
--- arch/arm/boot/dts/uniphier-pinctrl.dtsi | 10 +++++ arch/arm64/boot/dts/socionext/Makefile | 4 +- .../socionext/uniphier-pxs3-ref-gadget0.dts | 41 +++++++++++++++++++ .../socionext/uniphier-pxs3-ref-gadget1.dts | 40 ++++++++++++++++++ 4 files changed, 94 insertions(+), 1 deletion(-) create mode 100644 arch/arm64/boot/dts/socionext/uniphier-pxs3-ref-gadget0.dts create mode 100644 arch/arm64/boot/dts/socionext/uniphier-pxs3-ref-gadget1.dts
arch/arm/boot/dts/uniphier-pinctrl.dtsi +10 -0
@@ -196,11 +196,21 @@ function = "usb0"; }; + pinctrl_usb0_device: usb0-device { + groups = "usb0_device"; + function = "usb0"; + }; + pinctrl_usb1: usb1 { groups = "usb1"; function = "usb1"; }; + pinctrl_usb1_device: usb1-device { + groups = "usb1_device"; + function = "usb1"; + }; + pinctrl_usb2: usb2 { groups = "usb2"; function = "usb2";
arch/arm64/boot/dts/socionext/Makefile +3 -1
@@ -5,4 +5,6 @@ dtb-$(CONFIG_ARCH_UNIPHIER) += \ uniphier-ld20-akebi96.dtb \ uniphier-ld20-global.dtb \ uniphier-ld20-ref.dtb \ - uniphier-pxs3-ref.dtb + uniphier-pxs3-ref.dtb \ + uniphier-pxs3-ref-gadget0.dtb \ + uniphier-pxs3-ref-gadget1.dtb
arch/arm64/boot/dts/socionext/uniphier-pxs3-ref-gadget0.dts new file +41 -0
41 lines not on this page · raw message
arch/arm64/boot/dts/socionext/uniphier-pxs3-ref-gadget1.dts new file +40 -0
@@ -0,0 +1,40 @@ +// SPDX-License-Identifier: GPL-2.0-or-later OR MIT +// +// Device Tree Source for UniPhier PXs3 Reference Board (for USB-Device #1) +// +// Copyright (C) 2021 Socionext Inc. +// Author: Kunihiko Hayashi <[email protected]> + +/dts-v1/; +#include "uniphier-pxs3-ref.dts" + +/ { + model = "UniPhier PXs3 Reference Board (USB-Device #1)"; +}; + +/* I2C3 pinctrl is shared with USB*VBUSIN */ +&i2c3 { + status = "disabled"; +}; + +&usb1 { + status = "okay"; + dr_mode = "peripheral"; + pinctrl-0 = <&pinctrl_usb1_device>; + snps,dis_enblslpm_quirk; + snps,dis_u2_susphy_quirk; + snps,dis_u3_susphy_quirk; + snps,usb2_gadget_lpm_disable; + phy-names = "usb2-phy", "usb3-phy"; + phys = <&usb1_hsphy0>, <&usb1_ssphy0>; +}; + +&usb1_hsphy0 { + /delete-property/ vbus-supply; +}; + +&usb1_ssphy0 { + /delete-property/ vbus-supply; +}; + +/delete-node/ &usb1_hsphy1;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 789/862 ARM: 9233/1: stacktrace: Skip frame pointer boundary check for call_with_stack()
In reply to Greg Kroah-HartmanFrom: Li Huafei <[email protected]>
[ Upstream commit 5854e4d8530e6ed4c2532a71a6b0474e199d44dd ]
When using the frame pointer unwinder, it was found that the stack trace output of stack_trace_save() is incomplete if the stack contains call_with_stack():
[0x7f00002c] dump_stack_task+0x2c/0x90 [hrtimer]
[0x7f0000a0] hrtimer_hander+0x10/0x18 [hrtimer]
[0x801a67f0] __hrtimer_run_queues+0x1b0/0x3b4
[0x801a7350] hrtimer_run_queues+0xc4/0xd8
[0x801a597c] update_process_times+0x3c/0x88
[0x801b5a98] tick_periodic+0x50/0xd8
[0x801b5bf4] tick_handle_periodic+0x24/0x84
[0x8010ffc4] twd_handler+0x38/0x48
[0x8017d220] handle_percpu_devid_irq+0xa8/0x244
[0x80176e9c] generic_handle_domain_irq+0x2c/0x3c
[0x8052e3a8] gic_handle_irq+0x7c/0x90
[0x808ab15c] generic_handle_arch_irq+0x60/0x80
[0x8051191c] call_with_stack+0x1c/0x20
For the frame pointer unwinder, unwind_frame() checks stackframe::fp by stackframe::sp. Since call_with_stack() switches the SP from one stack to another, stackframe::fp and stackframe: :sp will point to different stacks, so we can no longer check stackframe::fp by stackframe::sp. Skip checking stackframe::fp at this point to avoid this problem.
--- arch/arm/kernel/stacktrace.c | 40 ++++++++++++++++++++++++++++------ arch/arm/lib/call_with_stack.S | 2 ++ 2 files changed, 35 insertions(+), 7 deletions(-)
arch/arm/kernel/stacktrace.c +33 -7
@@ -9,6 +9,8 @@#include <asm/stacktrace.h> #include <asm/traps.h> +#include "reboot.h" +#if defined(CONFIG_FRAME_POINTER ) && !defined(CONFIG_ARM_UNWIND )/* * Unwind the current stack frame and store the new register values in the
@@ -39,29 +41,53 @@* Note that with framepointer enabled, even the leaf functions have the same * prologue and epilogue, therefore we can ignore the LR value in this case. */ -int notrace unwind_frame(struct stackframe *frame) + +extern unsigned long call_with_stack_end; + +static int frame_pointer_check (struct stackframe *frame) {unsigned long high, low;unsigned long fp = frame->fp; +unsigned long pc = frame->pc; + +/* +* call_with_stack() is the only place we allow SP to jump from one +* stack to another, with FP and SP pointing to different stacks, +* skipping the FP boundary check at this point. +*/ +if (pc >= (unsigned long )&call_with_stack && + pc < (unsigned long )&call_with_stack_end) +return 0 ;/* only go to a higher address on the stack */ low = frame->sp; high =ALIGN (low,THREAD_SIZE ); -#ifdef CONFIG_CC_IS_CLANG /* check current frame pointer is within bounds */ +#ifdef CONFIG_CC_IS_CLANG if (fp < low +4 || fp > high -4 )return -EINVAL ; - - frame->sp = frame->fp; - frame->fp =READ_ONCE_NOCHECK (*(unsigned long *)(fp)); - frame->pc =READ_ONCE_NOCHECK (*(unsigned long *)(fp +4 ));#else -/* check current frame pointer is within bounds */ if (fp < low +12 || fp > high -4 )return -EINVAL ; +#endif + +return 0 ; +} + +int notrace unwind_frame(struct stackframe *frame) +{ +unsigned long fp = frame->fp; + +if (frame_pointer_check (frame)) +return -EINVAL ;/* restore the registers from the stack frame */ +#ifdef CONFIG_CC_IS_CLANG + frame->sp = frame->fp; + frame->fp =READ_ONCE_NOCHECK (*(unsigned long *)(fp)); + frame->pc =READ_ONCE_NOCHECK (*(unsigned long *)(fp +4 )); +#else frame->fp =READ_ONCE_NOCHECK (*(unsigned long *)(fp -12 )); frame->sp =READ_ONCE_NOCHECK (*(unsigned long *)(fp -8 )); frame->pc =READ_ONCE_NOCHECK (*(unsigned long *)(fp -4 ));
arch/arm/lib/call_with_stack.S +2 -0
@@ -46,4 +46,6 @@ UNWIND( .setfp fpreg, sp ) pop {fpreg, pc} UNWIND( .fnend ) #endif + .globl call_with_stack_end +call_with_stack_end: ENDPROC(call_with_stack)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 790/862 ARM: 9234/1: stacktrace: Avoid duplicate saving of exception PC value
In reply to Greg Kroah-HartmanFrom: Li Huafei <[email protected]>
[ Upstream commit 752ec621ef5c30777958cc5eb5f1cf394f7733f4 ]
Because an exception stack frame is not created in the exception entry, save_trace() does special handling for the exception PC, but this is only needed when CONFIG_FRAME_POINTER_UNWIND=y. When CONFIG_ARM_UNWIND=y, unwind annotations have been added to the exception entry and save_trace() will repeatedly save the exception PC:
[0x7f000090] hrtimer_hander+0x8/0x10 [hrtimer]
[0x8019ec50] __hrtimer_run_queues+0x18c/0x394
[0x8019f760] hrtimer_run_queues+0xbc/0xd0
[0x8019def0] update_process_times+0x34/0x80
[0x801ad2a4] tick_periodic+0x48/0xd0
[0x801ad3dc] tick_handle_periodic+0x1c/0x7c
[0x8010f2e0] twd_handler+0x30/0x40
[0x80177620] handle_percpu_devid_irq+0xa0/0x23c
[0x801718d0] generic_handle_domain_irq+0x24/0x34
[0x80502d28] gic_handle_irq+0x74/0x88
[0x8085817c] generic_handle_arch_irq+0x58/0x78
[0x80100ba8] __irq_svc+0x88/0xc8
[0x80108114] arch_cpu_idle+0x38/0x3c
[0x80108114] arch_cpu_idle+0x38/0x3c <==== duplicate saved exception PC
[0x80861bf8] default_idle_call+0x38/0x130
[0x8015d5cc] do_idle+0x150/0x214
[0x8015d978] cpu_startup_entry+0x18/0x1c
[0x808589c0] rest_init+0xd8/0xdc
[0x80c00a44] arch_post_acpi_subsys_init+0x0/0x8We can move the special handling of the exception PC in save_trace() to the unwind_frame() of the frame pointer unwinder.
--- arch/arm/include/asm/stacktrace.h | 6 +++++ arch/arm/kernel/return_address.c | 1 + arch/arm/kernel/stacktrace.c | 44 +++++++++++++++++++++---------- 3 files changed, 37 insertions(+), 14 deletions(-)
arch/arm/include/asm/stacktrace.h +6 -0
@@ -21,6 +21,9 @@ struct stackframe {struct llist_node *kr_cur;struct task_struct *tsk;#endif +#ifdef CONFIG_UNWINDER_FRAME_POINTER +bool ex_frame; +#endif }; static __always_inline
@@ -34,6 +37,9 @@ void arm_get_current_stackframe(struct pt_regs *regs, struct stackframe *frame) frame->kr_cur =NULL ; frame->tsk = current;#endif +#ifdef CONFIG_UNWINDER_FRAME_POINTER + frame->ex_frame =in_entry_text (frame->pc); +#endif }extern int unwind_frame (struct stackframe *frame);
arch/arm/kernel/return_address.c +1 -0
@@ -47,6 +47,7 @@ void *return_address(unsigned int level) frame.kr_cur =NULL ; frame.tsk = current;#endif + frame.ex_frame = false;walk_stackframe (&frame, save_return_addr, &data);
arch/arm/kernel/stacktrace.c +30 -14
80 lines not on this page · raw message
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 791/862 ARM: 9242/1: kasan: Only map modules if CONFIG_KASAN_VMALLOC=n
In reply to Greg Kroah-HartmanFrom: Alex Sverdlin <[email protected]>
[ Upstream commit 823f606ab6b4759a1faf0388abcf4fb0776710d2 ]
In case CONFIG_KASAN_VMALLOC=y kasan_populate_vmalloc() allocates the shadow pages dynamically. But even worse is that kasan_release_vmalloc() releases them, which is not compatible with create_mapping() of MODULES_VADDR..MODULES_END range:
BUG: Bad page state in process kworker/9:1 pfn:2068b page:e5e06160 refcount:0 mapcount:0 mapping:00000000 index:0x0 flags: 0x1000(reserved) raw: 00001000 e5e06164 e5e06164 00000000 00000000 00000000 ffffffff 00000000 page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set bad because of flags: 0x1000(reserved) Modules linked in: ip_tables CPU: 9 PID: 154 Comm: kworker/9:1 Not tainted 5.4.188-... #1 Hardware name: LSI Axxia AXM55XX Workqueue: events do_free_init
unwind_backtraceshow_stackdump_stackbad_pagefree_pcp_preparefree_unref_pagekasan_depopulate_vmalloc_pte__apply_to_page_rangeapply_to_existing_page_rangekasan_release_vmalloc__purge_vmap_area_lazy
_vm_unmap_aliases.part.0__vunmapdo_free_initprocess_one_workworker_thread
kthread
--- arch/arm/mm/kasan_init.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
arch/arm/mm/kasan_init.c +7 -2
@@ -268,12 +268,17 @@ void __init kasan_init(void)/* * 1. The module global variables are in MODULES_VADDR ~ MODULES_END, -* so we need to map this area. +* so we need to map this area if CONFIG_KASAN_VMALLOC=n. With +* VMALLOC support KASAN will manage this region dynamically, +* refer to kasan_populate_vmalloc() and ARM's implementation of +* module_alloc(). * 2. PKMAP_BASE ~ PKMAP_BASE+PMD_SIZE's shadow and MODULES_VADDR * ~ MODULES_END's shadow is in the same PMD_SIZE, so we can't * use kasan_populate_zero_shadow. */ -create_mapping ((void *)MODULES_VADDR , (void *)(PKMAP_BASE +PMD_SIZE )); +if (!IS_ENABLED (CONFIG_KASAN_VMALLOC ) &&IS_ENABLED (CONFIG_MODULES )) +create_mapping ((void *)MODULES_VADDR , (void *)(MODULES_END )); +create_mapping ((void *)PKMAP_BASE , (void *)(PKMAP_BASE +PMD_SIZE ));/* * KAsan may reuse the contents of kasan_early_shadow_pte directly, so
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 792/862 clk: zynqmp: Fix stack-out-of-bounds in strncpy`
In reply to Greg Kroah-HartmanFrom: Ian Nam <[email protected]>
[ Upstream commit dd80fb2dbf1cd8751efbe4e53e54056f56a9b115 ]
"BUG: KASAN: stack-out-of-bounds in strncpy+0x30/0x68"
Linux-ATF interface is using 16 bytes of SMC payload. In case clock name is longer than 15 bytes, string terminated NULL character will not be received by Linux. Add explicit NULL character at last byte to fix issues when clock name is longer.
This fixes below bug reported by KASAN:
==================================================================
BUG: KASAN: stack-out-of-bounds in strncpy+0x30/0x68 Read of size 1 at addr ffff0008c89a7410 by task swapper/0/1 CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.4.0-00396-g81ef9e7-dirty #3 Hardware name: Xilinx Versal vck190 Eval board revA (QSPI) (DT) Call trace: dump_backtrace+0x0/0x1e8 show_stack+0x14/0x20 dump_stack+0xd4/0x108 print_address_description.isra.0+0xbc/0x37c __kasan_report+0x144/0x198 kasan_report+0xc/0x18 __asan_load1+0x5c/0x68 strncpy+0x30/0x68 zynqmp_clock_probe+0x238/0x7b8 platform_drv_probe+0x6c/0xc8 really_probe+0x14c/0x418 driver_probe_device+0x74/0x130 __device_attach_driver+0xc4/0xe8 bus_for_each_drv+0xec/0x150 __device_attach+0x160/0x1d8 device_initial_probe+0x10/0x18 bus_probe_device+0xe0/0xf0 device_add+0x528/0x950 of_device_add+0x5c/0x80 of_platform_device_create_pdata+0x120/0x168 of_platform_bus_create+0x244/0x4e0 of_platform_populate+0x50/0xe8 zynqmp_firmware_probe+0x370/0x3a8 platform_drv_probe+0x6c/0xc8 really_probe+0x14c/0x418 driver_probe_device+0x74/0x130 device_driver_attach+0x94/0xa0 __driver_attach+0x70/0x108 bus_for_each_dev+0xe4/0x158 driver_attach+0x30/0x40 bus_add_driver+0x21c/0x2b8 driver_register+0xbc/0x1d0 __platform_driver_register+0x7c/0x88 zynqmp_firmware_driver_init+0x1c/0x24 do_one_initcall+0xa4/0x234 kernel_init_freeable+0x1b0/0x24c kernel_init+0x10/0x110 ret_from_fork+0x10/0x18 The buggy address belongs to the page: page:ffff0008f9be1c88 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 raw: 0008d00000000000 ffff0008f9be1c90 ffff0008f9be1c90 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff page dumped because: kasan: bad access detected
addr ffff0008c89a7410 is located in stack of task swapper/0/1 at offset 112 in frame:
zynqmp_clock_probe+0x0/0x7b8
this frame has 3 objects:
[32, 44) 'response'
[64, 80) 'ret_payload'
[96, 112) 'name'
Memory state around the buggy address:
ffff0008c89a7300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff0008c89a7380: 00 00 00 00 f1 f1 f1 f1 00 04 f2 f2 00 00 f2 f2
>ffff0008c89a7400: 00 00 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
^
ffff0008c89a7480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff0008c89a7500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================--- drivers/clk/zynqmp/clkc.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/clk/zynqmp/clkc.c +7 -0
@@ -710,6 +710,13 @@ static void zynqmp_get_clock_info(void)FIELD_PREP (CLK_ATTR_NODE_INDEX , i);zynqmp_pm_clock_get_name (clock[i].clk_id, &name); + +/* +* Terminate with NULL character in case name provided by firmware +* is longer and truncated due to size limit. +*/ + name.name[sizeof (name.name) -1 ] ='\0' ; +if (!strcmp (name.name,RESERVED_CLK_NAME ))continue ;strncpy (clock[i].clk_name, name.name,MAX_NAME_LEN );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 793/862 media: cx88: Fix a null-ptr-deref bug in buffer_prepare()
In reply to Greg Kroah-HartmanFrom: Zheyu Ma <[email protected]>
[ Upstream commit 2b064d91440b33fba5b452f2d1b31f13ae911d71 ]
When the driver calls cx88_risc_buffer() to prepare the buffer, the function call may fail, resulting in a empty buffer and null-ptr-deref later in buffer_queue().
The following log can reveal it:
[ 41.822762] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI [ 41.824488] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 41.828027] RIP: 0010:buffer_queue+0xc2/0x500 [ 41.836311] Call Trace: [ 41.836945] __enqueue_in_driver+0x141/0x360 [ 41.837262] vb2_start_streaming+0x62/0x4a0 [ 41.838216] vb2_core_streamon+0x1da/0x2c0 [ 41.838516] __vb2_init_fileio+0x981/0xbc0 [ 41.839141] __vb2_perform_fileio+0xbf9/0x1120 [ 41.840072] vb2_fop_read+0x20e/0x400 [ 41.840346] v4l2_read+0x215/0x290 [ 41.840603] vfs_read+0x162/0x4c0
Fix this by checking the return value of cx88_risc_buffer()
[hverkuil: fix coding style issues]
--- drivers/media/pci/cx88/cx88-vbi.c | 9 +++--- drivers/media/pci/cx88/cx88-video.c | 43 +++++++++++++++-------------- 2 files changed, 26 insertions(+), 26 deletions(-)
drivers/media/pci/cx88/cx88-vbi.c +4 -5
@@ -144,11 +144,10 @@ static int buffer_prepare(struct vb2_buffer *vb)return -EINVAL ;vb2_set_plane_payload (vb,0 , size); -cx88_risc_buffer (dev->pci, &buf->risc, sgt->sgl, -0 ,VBI_LINE_LENGTH * lines, -VBI_LINE_LENGTH ,0 , - lines); -return 0 ; +return cx88_risc_buffer (dev->pci, &buf->risc, sgt->sgl, +0 ,VBI_LINE_LENGTH * lines, +VBI_LINE_LENGTH ,0 , + lines); }static void buffer_finish (struct vb2_buffer *vb)
drivers/media/pci/cx88/cx88-video.c +22 -21
70 lines not on this page · raw message
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 794/862 media: platform: fix some double free in meson-ge2d and mtk-jpeg and s5p-mfc
In reply to Greg Kroah-HartmanFrom: Hangyu Hua <[email protected]>
[ Upstream commit c65c3f3a2cbf21ed429d9b9c725bdb5dc6abf4cf ]
video_unregister_device will release device internally. There is no need to call video_device_release after video_unregister_device.
--- drivers/media/platform/amlogic/meson-ge2d/ge2d.c | 1 - drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c | 1 - drivers/media/platform/samsung/s5p-mfc/s5p_mfc.c | 3 +-- 3 files changed, 1 insertion(+), 4 deletions(-)
drivers/media/platform/amlogic/meson-ge2d/ge2d.c +0 -1
@@ -1030,7 +1030,6 @@ static int ge2d_remove(struct platform_device *pdev)video_unregister_device (ge2d->vfd);v4l2_m2m_release (ge2d->m2m_dev); -video_device_release (ge2d->vfd);v4l2_device_unregister (&ge2d->v4l2_dev);clk_disable_unprepare (ge2d->clk);
drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c +0 -1
@@ -1414,7 +1414,6 @@ static int mtk_jpeg_remove(struct platform_device *pdev)pm_runtime_disable (&pdev->dev);video_unregister_device (jpeg->vdev); -video_device_release (jpeg->vdev);v4l2_m2m_release (jpeg->m2m_dev);v4l2_device_unregister (&jpeg->v4l2_dev);
drivers/media/platform/samsung/s5p-mfc/s5p_mfc.c +1 -2
@@ -1399,6 +1399,7 @@ static int s5p_mfc_probe(struct platform_device *pdev)/* Deinit MFC if probe had failed */ err_enc_reg:video_unregister_device (dev->vfd_dec); + dev->vfd_dec =NULL ; err_dec_reg:video_device_release (dev->vfd_enc); err_enc_alloc:
@@ -1444,8 +1445,6 @@ static int s5p_mfc_remove(struct platform_device *pdev)video_unregister_device (dev->vfd_enc);video_unregister_device (dev->vfd_dec); -video_device_release (dev->vfd_enc); -video_device_release (dev->vfd_dec);v4l2_device_unregister (&dev->v4l2_dev);s5p_mfc_unconfigure_dma_memory (dev);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 795/862 clk: zynqmp: pll: rectify rate rounding in zynqmp_pll_round_rate
In reply to Greg Kroah-HartmanFrom: Quanyang Wang <[email protected]>
[ Upstream commit 30eaf02149ecc3c5815e45d27187bf09e925071d ]
The function zynqmp_pll_round_rate is used to find a most appropriate PLL frequency which the hardware can generate according to the desired frequency. For example, if the desired frequency is 297MHz, considering the limited range from PS_PLL_VCO_MIN (1.5GHz) to PS_PLL_VCO_MAX (3.0GHz) of PLL, zynqmp_pll_round_rate should return 1.872GHz (297MHz * 5).
There are two problems with the current code of zynqmp_pll_round_rate:
1) When the rate is below PS_PLL_VCO_MIN, it can't find a correct rate when the parameter "rate" is an integer multiple of *prate, in other words, if "f" is zero, zynqmp_pll_round_rate won't return a valid frequency which is from PS_PLL_VCO_MIN to PS_PLL_VCO_MAX. For example, *prate is 33MHz and the rate is 660MHz, zynqmp_pll_round_rate will not boost up rate and just return 660MHz, and this will cause clk_calc_new_rates failure since zynqmp_pll_round_rate returns an invalid rate out of its boundaries.
2) Even if the rate is higher than PS_PLL_VCO_MIN, there is still a risk that zynqmp_pll_round_rate returns an invalid rate because the function DIV_ROUND_CLOSEST makes some loss in the fractional part. If the parent clock *prate is 33333333Hz and we want to set the PLL rate to 1.5GHz, this function will return 1499999985Hz by using the formula below:
value = *prate * DIV_ROUND_CLOSEST(rate, *prate)).
This value is also invalid since it's slightly smaller than PS_PLL_VCO_MIN. because DIV_ROUND_CLOSEST makes some loss in the fractional part.
--- drivers/clk/zynqmp/pll.c | 31 +++++++++++++++---------------- 1 file changed, 15 insertions(+), 16 deletions(-)
drivers/clk/zynqmp/pll.c +15 -16
@@ -102,26 +102,25 @@ static long zynqmp_pll_round_rate(struct clk_hw *hw, unsigned long rate, unsigned long *prate) {u32 fbdiv; -long rate_div, f; +u32 mult, div; -/* Enable the fractional mode if needed */ - rate_div = (rate *FRAC_DIV ) / *prate; - f = rate_div %FRAC_DIV ; -if (f) { -if (rate >PS_PLL_VCO_MAX ) { - fbdiv = rate /PS_PLL_VCO_MAX ; - rate = rate / (fbdiv +1 ); - } -if (rate <PS_PLL_VCO_MIN ) { - fbdiv =DIV_ROUND_UP (PS_PLL_VCO_MIN , rate); - rate = rate * fbdiv; - } -return rate; +/* Let rate fall inside the range PS_PLL_VCO_MIN ~ PS_PLL_VCO_MAX */ +if (rate >PS_PLL_VCO_MAX ) { + div =DIV_ROUND_UP (rate,PS_PLL_VCO_MAX ); + rate = rate / div; + } +if (rate <PS_PLL_VCO_MIN ) { + mult =DIV_ROUND_UP (PS_PLL_VCO_MIN , rate); + rate = rate * mult; } fbdiv =DIV_ROUND_CLOSEST (rate, *prate); - fbdiv =clamp_t (u32, fbdiv,PLL_FBDIV_MIN ,PLL_FBDIV_MAX ); -return *prate * fbdiv; +if (fbdiv <PLL_FBDIV_MIN || fbdiv >PLL_FBDIV_MAX ) { + fbdiv =clamp_t (u32, fbdiv,PLL_FBDIV_MIN ,PLL_FBDIV_MAX ); + rate = *prate * fbdiv; + } + +return rate; }/**
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 796/862 RDMA/rxe: Delete error messages triggered by incoming Read requests
In reply to Greg Kroah-HartmanFrom: Daisuke Matsuda <[email protected]>
[ Upstream commit 2c02249fcbfc066bd33e2a7375c7006d4cb367f6 ]
An incoming Read request causes multiple Read responses. If a user MR to copy data from is unavailable or responder cannot send a reply, then the error messages can be printed for each response attempt, resulting in message overflow.
--- drivers/infiniband/sw/rxe/rxe_resp.c | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-)
drivers/infiniband/sw/rxe/rxe_resp.c +3 -7
@@ -809,10 +809,8 @@ static enum resp_states read_reply(struct rxe_qp *qp,if (!skb)return RESPST_ERR_RNR ; - err =rxe_mr_copy (mr, res->read.va,payload_addr (&ack_pkt), - payload,RXE_FROM_MR_OBJ ); -if (err) -pr_err ("Failed copying memory\n" ); +rxe_mr_copy (mr, res->read.va,payload_addr (&ack_pkt), + payload,RXE_FROM_MR_OBJ );if (mr)rxe_put (mr);
@@ -823,10 +821,8 @@ static enum resp_states read_reply(struct rxe_qp *qp, } err =rxe_xmit_packet (qp, &ack_pkt, skb); -if (err) { -pr_err ("Failed sending RDMA reply.\n" ); +if (err)return RESPST_ERR_RNR ; - } res->read.va += payload; res->read.resid -= payload;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 797/862 usb: host: xhci-plat: suspend and resume clocks
In reply to Greg Kroah-HartmanFrom: Justin Chen <[email protected]>
[ Upstream commit 8bd954c56197caf5e3a804d989094bc3fe6329aa ]
Introduce XHCI_SUSPEND_RESUME_CLKS quirk as a means to suspend and resume clocks if the hardware is capable of doing so. We assume that clocks will be needed if the device may wake.
--- drivers/usb/host/xhci-plat.c | 16 +++++++++++++++- drivers/usb/host/xhci.h | 1 + 2 files changed, 16 insertions(+), 1 deletion(-)
drivers/usb/host/xhci-plat.c +15 -1
@@ -437,7 +437,16 @@ static int __maybe_unused xhci_plat_suspend(struct device *dev)* xhci_suspend() needs `do_wakeup` to know whether host is allowed * to do wakeup during suspend. */ -return xhci_suspend (xhci,device_may_wakeup (dev)); + ret =xhci_suspend (xhci,device_may_wakeup (dev)); +if (ret) +return ret; + +if (!device_may_wakeup (dev) && (xhci->quirks &XHCI_SUSPEND_RESUME_CLKS )) { +clk_disable_unprepare (xhci->clk); +clk_disable_unprepare (xhci->reg_clk); + } + +return 0 ; }static int __maybe_unused xhci_plat_resume (struct device *dev)
@@ -446,6 +455,11 @@ static int __maybe_unused xhci_plat_resume(struct device *dev)struct xhci_hcd *xhci =hcd_to_xhci (hcd);int ret; +if (!device_may_wakeup (dev) && (xhci->quirks &XHCI_SUSPEND_RESUME_CLKS )) { +clk_prepare_enable (xhci->clk); +clk_prepare_enable (xhci->reg_clk); + } + ret =xhci_priv_resume_quirk (hcd);if (ret)return ret;
drivers/usb/host/xhci.h +1 -0
@@ -1899,6 +1899,7 @@ struct xhci_hcd {#define XHCI_NO_SOFT_RETRY BIT_ULL(40)#define XHCI_BROKEN_D3COLD BIT_ULL(41)#define XHCI_EP_CTX_BROKEN_DCS BIT_ULL(42) +#define XHCI_SUSPEND_RESUME_CLKS BIT_ULL(43)unsigned int num_active_eps;unsigned int limit_active_eps;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 798/862 usb: host: xhci-plat: suspend/resume clks for brcm
In reply to Greg Kroah-HartmanFrom: Justin Chen <[email protected]>
[ Upstream commit c69400b09e471a3f1167adead55a808f0da6534a ]
The xhci_plat_brcm xhci block can enter suspend with clock disabled to save power and re-enable them on resume. Make use of the XHCI_SUSPEND_RESUME_CLKS quirk to do so.
--- drivers/usb/host/xhci-plat.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/host/xhci-plat.c +1 -1
@@ -123,7 +123,7 @@ static const struct xhci_plat_priv xhci_plat_renesas_rcar_gen3 = { };static const struct xhci_plat_priv xhci_plat_brcm = { - .quirks =XHCI_RESET_ON_RESUME , + .quirks =XHCI_RESET_ON_RESUME |XHCI_SUSPEND_RESUME_CLKS , };static const struct of_device_id usb_xhci_of_match[] = {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 799/862 scsi: lpfc: Fix null ndlp ptr dereference in abnormal exit path for GFT_ID
In reply to Greg Kroah-HartmanFrom: James Smart <[email protected]>
[ Upstream commit 59b7e210a522b836a01516c71ee85d1d92c1f075 ]
An error case exit from lpfc_cmpl_ct_cmd_gft_id() results in a call to lpfc_nlp_put() with a null pointer to a nodelist structure.
Changed lpfc_cmpl_ct_cmd_gft_id() to initialize nodelist pointer upon entry.
--- drivers/scsi/lpfc/lpfc_ct.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-)
drivers/scsi/lpfc/lpfc_ct.c +2 -5
@@ -1509,7 +1509,7 @@ lpfc_cmpl_ct_cmd_gft_id(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,struct lpfc_sli_ct_request *CTrsp;int did;struct lpfc_nodelist *ndlp =NULL ; -struct lpfc_nodelist *ns_ndlp =NULL ; +struct lpfc_nodelist *ns_ndlp = cmdiocb->ndlp;uint32_t fc4_data_0, fc4_data_1;u32 ulp_status =get_job_ulpstatus (phba, rspiocb);u32 ulp_word4 =get_job_word4 (phba, rspiocb);
@@ -1522,15 +1522,12 @@ lpfc_cmpl_ct_cmd_gft_id(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, ulp_status, ulp_word4, did);/* Ignore response if link flipped after this request was made */ -if ((uint32_t ) cmdiocb->event_tag != phba->fc_eventTag) { +if ((uint32_t )cmdiocb->event_tag != phba->fc_eventTag) {lpfc_printf_vlog (vport,KERN_INFO ,LOG_DISCOVERY ,"9046 Event tag mismatch. Ignoring NS rsp\n" ); goto out; } -/* Preserve the nameserver node to release the reference. */ - ns_ndlp = cmdiocb->ndlp; -if (ulp_status ==IOSTAT_SUCCESS ) {/* Good status, continue checking */ CTrsp = (struct lpfc_sli_ct_request *)outp->virt;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 800/862 dmaengine: ti: k3-udma: Reset UDMA_CHAN_RT byte counters to prevent overflow
In reply to Greg Kroah-HartmanFrom: Vaishnav Achath <[email protected]>
[ Upstream commit 7c94dcfa8fcff2dba53915f1dabfee49a3df8b88 ]
UDMA_CHAN_RT_*BCNT_REG stores the real-time channel bytecount statistics. These registers are 32-bit hardware counters and the driver uses these counters to monitor the operational progress status for a channel, when transferring more than 4GB of data it was observed that these counters overflow and completion calculation of a operation gets affected and the transfer hangs indefinitely.
This commit adds changes to decrease the byte count for every complete transaction so that these registers never overflow and the proper byte count statistics is maintained for ongoing transaction by the RT counters.
Earlier uc->bcnt used to maintain a count of the completed bytes at driver side, since the RT counters maintain the statistics of current transaction now, the maintenance of uc->bcnt is not necessary.
--- drivers/dma/ti/k3-udma.c | 25 +++++++++++++++++-------- 1 file changed, 17 insertions(+), 8 deletions(-)
drivers/dma/ti/k3-udma.c +17 -8
@@ -300,8 +300,6 @@ struct udma_chan {struct udma_tx_drain tx_drain; -u32 bcnt;/* number of bytes completed since the start of the channel */ -/* Channel configuration parameters */ struct udma_chan_config config;
@@ -757,6 +755,20 @@ static void udma_reset_rings(struct udma_chan *uc) } } +static void udma_decrement_byte_counters (struct udma_chan *uc,u32 val) +{ +if (uc->desc->dir ==DMA_DEV_TO_MEM ) { +udma_rchanrt_write (uc,UDMA_CHAN_RT_BCNT_REG , val); +udma_rchanrt_write (uc,UDMA_CHAN_RT_SBCNT_REG , val); +udma_rchanrt_write (uc,UDMA_CHAN_RT_PEER_BCNT_REG , val); + }else { +udma_tchanrt_write (uc,UDMA_CHAN_RT_BCNT_REG , val); +udma_tchanrt_write (uc,UDMA_CHAN_RT_SBCNT_REG , val); +if (!uc->bchan) +udma_tchanrt_write (uc,UDMA_CHAN_RT_PEER_BCNT_REG , val); + } +} +static void udma_reset_counters (struct udma_chan *uc) {u32 val;
@@ -790,8 +802,6 @@ static void udma_reset_counters(struct udma_chan *uc) val =udma_rchanrt_read (uc,UDMA_CHAN_RT_PEER_BCNT_REG );udma_rchanrt_write (uc,UDMA_CHAN_RT_PEER_BCNT_REG , val); } - - uc->bcnt =0 ; }static int udma_reset_chan (struct udma_chan *uc,bool hard)
@@ -1115,7 +1125,7 @@ static void udma_check_tx_completion(struct work_struct *work)if (uc->desc) {struct udma_desc *d = uc->desc; - uc->bcnt += d->residue; +udma_decrement_byte_counters (uc, d->residue);udma_start (uc);vchan_cookie_complete (&d->vd);break ;
@@ -1168,7 +1178,7 @@ static irqreturn_t udma_ring_irq_handler(int irq, void *data)vchan_cyclic_callback (&d->vd); }else {if (udma_is_desc_really_done (uc, d)) { - uc->bcnt += d->residue; +udma_decrement_byte_counters (uc, d->residue);udma_start (uc);vchan_cookie_complete (&d->vd); }else {
@@ -1204,7 +1214,7 @@ static irqreturn_t udma_udma_irq_handler(int irq, void *data)vchan_cyclic_callback (&d->vd); }else {/* TODO: figure out the real amount of data */ - uc->bcnt += d->residue; +udma_decrement_byte_counters (uc, d->residue);udma_start (uc);vchan_cookie_complete (&d->vd); }
@@ -3809,7 +3819,6 @@ static enum dma_status udma_tx_status(struct dma_chan *chan, bcnt =udma_tchanrt_read (uc,UDMA_CHAN_RT_BCNT_REG ); } - bcnt -= uc->bcnt;if (bcnt && !(bcnt % uc->desc->residue)) residue =0 ;else
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 801/862 scsi: 3w-9xxx: Avoid disabling device if failing to enable it
In reply to Greg Kroah-HartmanFrom: Letu Ren <[email protected]>
[ Upstream commit 7eff437b5ee1309b34667844361c6bbb5c97df05 ]
The original code will "goto out_disable_device" and call pci_disable_device() if pci_enable_device() fails. The kernel will generate a warning message like "3w-9xxx 0000:00:05.0: disabling already-disabled device".
We shouldn't disable a device that failed to be enabled. A simple return is fine.
--- drivers/scsi/3w-9xxx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/3w-9xxx.c +1 -1
@@ -2006,7 +2006,7 @@ static int twa_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) retval =pci_enable_device (pdev);if (retval) {TW_PRINTK (host,TW_DRIVER ,0x34 ,"Failed to enable pci device" ); - goto out_disable_device; +return -ENODEV ; }pci_set_master (pdev);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 802/862 nbd: Fix hung when signal interrupts nbd_start_device_ioctl()
In reply to Greg Kroah-HartmanFrom: Shigeru Yoshida <[email protected]>
[ Upstream commit 1de7c3cf48fc41cd95adb12bd1ea9033a917798a ]
syzbot reported hung task [1]. The following program is a simplified version of the reproducer:
int main(void)
{
int sv[2], fd;
if (socketpair(AF_UNIX, SOCK_STREAM, 0, sv) < 0)
return 1;
if ((fd = open("/dev/nbd0", 0)) < 0)
return 1;
if (ioctl(fd, NBD_SET_SIZE_BLOCKS, 0x81) < 0)
return 1;
if (ioctl(fd, NBD_SET_SOCK, sv[0]) < 0)
return 1;
if (ioctl(fd, NBD_DO_IT) < 0)
return 1;
return 0;
}When signal interrupt nbd_start_device_ioctl() waiting the condition atomic_read(&config->recv_threads) == 0, the task can hung because it waits the completion of the inflight IOs.
This patch fixes the issue by clearing queue, not just shutdown, when signal interrupt nbd_start_device_ioctl().
--- drivers/block/nbd.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/block/nbd.c +4 -2
@@ -1413,10 +1413,12 @@ static int nbd_start_device_ioctl(struct nbd_device *nbd)mutex_unlock (&nbd->config_lock); ret =wait_event_interruptible (config->recv_wq,atomic_read (&config->recv_threads) ==0 ); -if (ret) +if (ret) {sock_shutdown (nbd); -flush_workqueue (nbd->recv_workq); +nbd_clear_que (nbd); + } +flush_workqueue (nbd->recv_workq);mutex_lock (&nbd->config_lock);nbd_bdev_reset (nbd);/* user requested, ignore socket errors */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 803/862 iommu/arm-smmu-v3: Make default domain type of HiSilicon PTT device to identity
In reply to Greg Kroah-HartmanFrom: Yicong Yang <[email protected]>
[ Upstream commit 24b6c7798a0122012ca848ea0d25e973334266b0 ]
The DMA operations of HiSilicon PTT device can only work properly with identical mappings. So add a quirk for the device to force the domain as passthrough.
--- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+)
drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +21 -0
@@ -2817,6 +2817,26 @@ static int arm_smmu_dev_disable_feature(struct device *dev, } } +/* +* HiSilicon PCIe tune and trace device can be used to trace TLP headers on the +* PCIe link and save the data to memory by DMA. The hardware is restricted to +* use identity mapping only. +*/ +#define IS_HISI_PTT_DEVICE (pdev) ((pdev)->vendor == PCI_VENDOR_ID_HUAWEI && \ + (pdev)->device == 0xa12e) + +static int arm_smmu_def_domain_type (struct device *dev) +{ +if (dev_is_pci (dev)) { +struct pci_dev *pdev =to_pci_dev (dev); + +if (IS_HISI_PTT_DEVICE (pdev)) +return IOMMU_DOMAIN_IDENTITY ; + } + +return 0 ; +} +static struct iommu_ops arm_smmu_ops = { .capable = arm_smmu_capable, .domain_alloc = arm_smmu_domain_alloc,
@@ -2831,6 +2851,7 @@ static struct iommu_ops arm_smmu_ops = { .sva_unbind = arm_smmu_sva_unbind, .sva_get_pasid = arm_smmu_sva_get_pasid, .page_response = arm_smmu_page_response, + .def_domain_type = arm_smmu_def_domain_type, .pgsize_bitmap = -1UL, /* Restricted during device attach */ .owner = THIS_MODULE, .default_domain_ops = &(const struct iommu_domain_ops ) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 804/862 usb: gadget: uvc: increase worker prio to WQ_HIGHPRI
In reply to Greg Kroah-HartmanFrom: Michael Grzeschik <[email protected]>
[ Upstream commit 9b91a65230784a9ef644b8bdbb82a79ba4ae9456 ]
This patch is changing the simple workqueue in the gadget driver to be allocated as async_wq with a higher priority. The pump worker, that is filling the usb requests, will have a higher priority and will not be scheduled away so often while the video stream is handled. This will lead to fewer streaming underruns.
--- drivers/usb/gadget/function/f_uvc.c | 4 ++++ drivers/usb/gadget/function/uvc.h | 1 + drivers/usb/gadget/function/uvc_v4l2.c | 2 +- drivers/usb/gadget/function/uvc_video.c | 9 +++++++-- 4 files changed, 13 insertions(+), 3 deletions(-)
drivers/usb/gadget/function/f_uvc.c +4 -0
@@ -897,10 +897,14 @@ static void uvc_function_unbind(struct usb_configuration *c, {struct usb_composite_dev *cdev = c->cdev;struct uvc_device *uvc =to_uvc (f); +struct uvc_video *video = &uvc->video;long wait_ret =1 ;uvcg_info (f,"%s()\n" , __func__); +if (video->async_wq) +destroy_workqueue (video->async_wq); +/* * If we know we're connected via v4l2, then there should be a cleanup * of the device from userspace either via UVC_EVENT_DISCONNECT or
drivers/usb/gadget/function/uvc.h +1 -0
@@ -88,6 +88,7 @@ struct uvc_video {struct usb_ep *ep;struct work_struct pump; +struct workqueue_struct *async_wq;/* Frame parameters */ u8 bpp;
drivers/usb/gadget/function/uvc_v4l2.c +1 -1
@@ -170,7 +170,7 @@ uvc_v4l2_qbuf(struct file *file, void *fh, struct v4l2_buffer *b)return ret;if (uvc->state ==UVC_STATE_STREAMING ) -schedule_work (&video->pump); +queue_work (video->async_wq, &video->pump);return ret; }
drivers/usb/gadget/function/uvc_video.c +7 -2
@@ -277,7 +277,7 @@ uvc_video_complete(struct usb_ep *ep, struct usb_request *req)spin_unlock_irqrestore (&video->req_lock, flags);if (uvc->state ==UVC_STATE_STREAMING ) -schedule_work (&video->pump); +queue_work (video->async_wq, &video->pump); } static int
@@ -485,7 +485,7 @@ int uvcg_video_enable(struct uvc_video *video, int enable) video->req_int_count =0 ; -schedule_work (&video->pump); +queue_work (video->async_wq, &video->pump);return ret; }
@@ -499,6 +499,11 @@ int uvcg_video_init(struct uvc_video *video, struct uvc_device *uvc)spin_lock_init (&video->req_lock);INIT_WORK (&video->pump, uvcg_video_pump); +/* Allocate a work queue for asynchronous video pump handler. */ + video->async_wq =alloc_workqueue ("uvcgadget" ,WQ_UNBOUND |WQ_HIGHPRI ,0 ); +if (!video->async_wq) +return -EINVAL ; + video->uvc = uvc; video->fcc =V4L2_PIX_FMT_YUYV ; video->bpp =16 ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 805/862 power: supply: adp5061: fix out-of-bounds read in adp5061_get_chg_type()
In reply to Greg Kroah-HartmanFrom: Wei Yongjun <[email protected]>
[ Upstream commit 9d47e01b9d807808224347935562f7043a358054 ]
ADP5061_CHG_STATUS_1_CHG_STATUS is masked with 0x07, which means a length of 8, but adp5061_chg_type array size is 4, may end up reading 4 elements beyond the end of the adp5061_chg_type[] array.
--- drivers/power/supply/adp5061.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/power/supply/adp5061.c +3 -3
@@ -427,11 +427,11 @@ static int adp5061_get_chg_type(struct adp5061_state *st,if (ret <0 )return ret; - chg_type = adp5061_chg_type[ADP5061_CHG_STATUS_1_CHG_STATUS (status1)]; -if (chg_type >ADP5061_CHG_FAST_CV ) + chg_type =ADP5061_CHG_STATUS_1_CHG_STATUS (status1); +if (chg_type >=ARRAY_SIZE (adp5061_chg_type)) val->intval =POWER_SUPPLY_STATUS_UNKNOWN ;else - val->intval = chg_type; + val->intval = adp5061_chg_type[chg_type];return ret; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 806/862 staging: vt6655: fix potential memory leak
In reply to Greg Kroah-HartmanFrom: Nam Cao <[email protected]>
[ Upstream commit c8ff91535880d41b49699b3829fb6151942de29e ]
In function device_init_td0_ring, memory is allocated for member td_info of priv->apTD0Rings[i], with i increasing from 0. In case of allocation failure, the memory is freed in reversed order, with i decreasing to 0. However, the case i=0 is left out and thus memory is leaked.
Modify the memory freeing loop to include the case i=0.
--- drivers/staging/vt6655/device_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/vt6655/device_main.c +1 -1
@@ -694,7 +694,7 @@ static int device_init_td0_ring(struct vnt_private *priv)return 0 ; err_free_desc: -while (--i) { +while (i--) { desc = &priv->apTD0Rings[i];kfree (desc->td_info); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 807/862 blk-throttle: prevent overflow while calculating wait time
In reply to Greg Kroah-HartmanFrom: Yu Kuai <[email protected]>
[ Upstream commit 8d6bbaada2e0a65f9012ac4c2506460160e7237a ]
There is a problem found by code review in tg_with_in_bps_limit() that 'bps_limit * jiffy_elapsed_rnd' might overflow. Fix the problem by calling mul_u64_u64_div_u64() instead.
--- block/blk-throttle.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
block/blk-throttle.c +3 -5
@@ -806,7 +806,7 @@ static bool tg_with_in_bps_limit(struct throtl_grp *tg, struct bio *bio, u64 bps_limit, unsigned long *wait) { bool rw = bio_data_dir(bio); -u64 bytes_allowed, extra_bytes, tmp; +u64 bytes_allowed, extra_bytes;unsigned long jiffy_elapsed, jiffy_wait, jiffy_elapsed_rnd;unsigned int bio_size =throtl_bio_data_size (bio);
@@ -824,10 +824,8 @@ static bool tg_with_in_bps_limit(struct throtl_grp *tg, struct bio *bio, jiffy_elapsed_rnd = tg->td->throtl_slice; jiffy_elapsed_rnd =roundup (jiffy_elapsed_rnd, tg->td->throtl_slice); - - tmp = bps_limit * jiffy_elapsed_rnd; -do_div (tmp,HZ ); - bytes_allowed = tmp; + bytes_allowed =mul_u64_u64_div_u64 (bps_limit, (u64 )jiffy_elapsed_rnd, + (u64 )HZ );if (tg->bytes_disp[rw] + bio_size <= bytes_allowed) {if (wait)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 808/862 ata: libahci_platform: Sanity check the DT child nodes number
In reply to Greg Kroah-HartmanFrom: Serge Semin <[email protected]>
[ Upstream commit 3c132ea6508b34956e5ed88d04936983ec230601 ]
Having greater than AHCI_MAX_PORTS (32) ports detected isn't that critical from the further AHCI-platform initialization point of view since exceeding the ports upper limit will cause allocating more resources than will be used afterwards. But detecting too many child DT-nodes doesn't seem right since it's very unlikely to have it on an ordinary platform. In accordance with the AHCI specification there can't be more than 32 ports implemented at least due to having the CAP.NP field of 5 bits wide and the PI register of dword size. Thus if such situation is found the DTB must have been corrupted and the data read from it shouldn't be reliable. Let's consider that as an erroneous situation and halt further resources allocation.
Note it's logically more correct to have the nports set only after the initialization value is checked for being sane. So while at it let's make sure nports is assigned with a correct value.
--- drivers/ata/libahci_platform.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
drivers/ata/libahci_platform.c +12 -2
@@ -451,14 +451,24 @@ struct ahci_host_priv *ahci_platform_get_resources(struct platform_device *pdev, } } - hpriv->nports = child_nodes =of_get_child_count (dev->of_node); +/* +* Too many sub-nodes most likely means having something wrong with +* the firmware. +*/ + child_nodes =of_get_child_count (dev->of_node); +if (child_nodes >AHCI_MAX_PORTS ) { + rc = -EINVAL ; + goto err_out; + }/* * If no sub-node was found, we still need to set nports to * one in order to be able to use the * ahci_platform_[en|dis]able_[phys|regulators] functions. */ -if (!child_nodes) +if (child_nodes) + hpriv->nports = child_nodes; +else hpriv->nports =1 ; hpriv->phys =devm_kcalloc (dev, hpriv->nports,sizeof (*hpriv->phys),GFP_KERNEL );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 809/862 bcache: fix set_at_max_writeback_rate() for multiple attached devices
In reply to Greg Kroah-HartmanFrom: Coly Li <[email protected]>
[ Upstream commit d2d05b88035d2d51a5bb6c5afec88a0880c73df4 ]
Inside set_at_max_writeback_rate() the calculation in following if() check is wrong,
if (atomic_inc_return(&c->idle_counter) < atomic_read(&c->attached_dev_nr) * 6)
Because each attached backing device has its own writeback thread running and increasing c->idle_counter, the counter increates much faster than expected. The correct calculation should be,
(counter / dev_nr) < dev_nr * 6
which equals to,
counter < dev_nr * dev_nr * 6
This patch fixes the above mistake with correct calculation, and helper routine idle_counter_exceeded() is added to make code be more clear.
--- drivers/md/bcache/writeback.c | 73 +++++++++++++++++++++++++---------- 1 file changed, 52 insertions(+), 21 deletions(-)
drivers/md/bcache/writeback.c +52 -21
@@ -157,6 +157,53 @@ static void __update_writeback_rate(struct cached_dev *dc) dc->writeback_rate_target = target; } +static bool idle_counter_exceeded (struct cache_set *c) +{ +int counter, dev_nr; + +/* +* If c->idle_counter is overflow (idel for really long time), +* reset as 0 and not set maximum rate this time for code +* simplicity. +*/ + counter =atomic_inc_return (&c->idle_counter); +if (counter <=0 ) { +atomic_set (&c->idle_counter,0 ); +return false; + } + + dev_nr =atomic_read (&c->attached_dev_nr); +if (dev_nr ==0 ) +return false; + +/* +* c->idle_counter is increased by writeback thread of all +* attached backing devices, in order to represent a rough +* time period, counter should be divided by dev_nr. +* Otherwise the idle time cannot be larger with more backing +* device attached. +* The following calculation equals to checking +* (counter / dev_nr) < (dev_nr * 6) +*/ +if (counter < (dev_nr * dev_nr *6 )) +return false; + +return true; +} + +/* +* Idle_counter is increased every time when update_writeback_rate() is +* called. If all backing devices attached to the same cache set have +* identical dc->writeback_rate_update_seconds values, it is about 6 +* rounds of update_writeback_rate() on each backing device before +* c->at_max_writeback_rate is set to 1, and then max wrteback rate set +* to each dc->writeback_rate.rate. +* In order to avoid extra locking cost for counting exact dirty cached +* devices number, c->attached_dev_nr is used to calculate the idle +* throushold. It might be bigger if not all cached device are in write- +* back mode, but it still works well with limited extra rounds of +* update_writeback_rate(). +*/ static bool set_at_max_writeback_rate (struct cache_set *c,struct cached_dev *dc) {
@@ -167,21 +214,8 @@ static bool set_at_max_writeback_rate(struct cache_set *c,/* Don't set max writeback rate if gc is running */ if (!c->gc_mark_valid)return false; -/* -* Idle_counter is increased everytime when update_writeback_rate() is -* called. If all backing devices attached to the same cache set have -* identical dc->writeback_rate_update_seconds values, it is about 6 -* rounds of update_writeback_rate() on each backing device before -* c->at_max_writeback_rate is set to 1, and then max wrteback rate set -* to each dc->writeback_rate.rate. -* In order to avoid extra locking cost for counting exact dirty cached -* devices number, c->attached_dev_nr is used to calculate the idle -* throushold. It might be bigger if not all cached device are in write- -* back mode, but it still works well with limited extra rounds of -* update_writeback_rate(). -*/ -if (atomic_inc_return (&c->idle_counter) < -atomic_read (&c->attached_dev_nr) *6 ) + +if (!idle_counter_exceeded (c))return false;if (atomic_read (&c->at_max_writeback_rate) !=1 )
@@ -195,13 +229,10 @@ static bool set_at_max_writeback_rate(struct cache_set *c, dc->writeback_rate_change =0 ;/* -* Check c->idle_counter and c->at_max_writeback_rate agagain in case -* new I/O arrives during before set_at_max_writeback_rate() returns. -* Then the writeback rate is set to 1, and its new value should be -* decided via __update_writeback_rate(). +* In case new I/O arrives during before +* set_at_max_writeback_rate() returns. */ -if ((atomic_read (&c->idle_counter) < -atomic_read (&c->attached_dev_nr) *6 ) || +if (!idle_counter_exceeded (c) || !atomic_read (&c->at_max_writeback_rate))return false;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 810/862 soundwire: cadence: Dont overwrite msg->buf during write commands
In reply to Greg Kroah-HartmanFrom: Richard Fitzgerald <[email protected]>
[ Upstream commit ba05b39d265bdd16913f7684600d9d41e2796745 ]
The buf passed in struct sdw_msg must only be written for a READ, in that case the RDATA part of the response is the data value of the register.
For a write command there is no RDATA, and buf should be assumed to be const and unmodifable. The original caller should not expect its data buffer to be corrupted by an sdw_nwrite().
--- drivers/soundwire/cadence_master.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/soundwire/cadence_master.c +6 -3
@@ -544,9 +544,12 @@ cdns_fill_msg_resp(struct sdw_cdns *cdns,return SDW_CMD_IGNORED ; } -/* fill response */ -for (i =0 ; i < count; i++) - msg->buf[i + offset] =FIELD_GET (CDNS_MCP_RESP_RDATA , cdns->response_buf[i]); +if (msg->flags ==SDW_MSG_FLAG_READ ) { +/* fill response */ +for (i =0 ; i < count; i++) + msg->buf[i + offset] =FIELD_GET (CDNS_MCP_RESP_RDATA , + cdns->response_buf[i]); + }return SDW_CMD_OK ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 811/862 soundwire: intel: fix error handling on dai registration issues
In reply to Greg Kroah-HartmanFrom: Pierre-Louis Bossart <[email protected]>
[ Upstream commit c6867cda906aadbce5e71efde9c78a26108b2bad ]
The call to intel_register_dai() may fail because of memory allocation issues or problems reported by the ASoC core. In all cases, when a error is thrown the component is not registered, it's invalid to unregister it.
--- drivers/soundwire/intel.c | 1 - 1 file changed, 1 deletion(-)
drivers/soundwire/intel.c +0 -1
@@ -1429,7 +1429,6 @@ int intel_link_startup(struct auxiliary_device *auxdev) ret =intel_register_dai (sdw);if (ret) {dev_err (dev,"DAI registration failed: %d\n" , ret); -snd_soc_unregister_component (dev); goto err_interrupt; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 812/862 hid: topre: Add driver fixing report descriptor
In reply to Greg Kroah-HartmanFrom: Harry Stern <[email protected]>
[ Upstream commit a109d5c45b3d6728b9430716b915afbe16eef27c ]
The Topre REALFORCE R2 firmware incorrectly reports that interface descriptor number 1, input report descriptor 2's events are array events rather than variable events. That particular report descriptor is used to report keypresses when there are more than 6 keys held at a time. This bug prevents events from this interface from being registered properly, so only 6 keypresses (from a different interface) can be registered at once, rather than full n-key rollover.
This commit fixes the bug by setting the correct value in a report_fixup function.
The original bug report can be found here:
Thanks to Benjamin Tissoires for diagnosing the issue with the report descriptor.
--- drivers/hid/Kconfig | 6 +++++ drivers/hid/Makefile | 1 + drivers/hid/hid-ids.h | 3 +++ drivers/hid/hid-topre.c | 49 +++++++++++++++++++++++++++++++++++++++++ 4 files changed, 59 insertions(+) create mode 100644 drivers/hid/hid-topre.c
drivers/hid/Kconfig +6 -0
@@ -1141,6 +1141,12 @@ config HID_TOPSEED Say Y if you have a TopSeed Cyberlink or BTC Emprex or Conceptronic CLLRCMCE remote control. +config HID_TOPRE + tristate "Topre REALFORCE keyboards" + depends on HID + help + Say Y for N-key rollover support on Topre REALFORCE R2 108 key keyboards. + config HID_THINGM tristate "ThingM blink(1) USB RGB LED" depends on HID
drivers/hid/Makefile +1 -0
@@ -123,6 +123,7 @@ obj-$(CONFIG_HID_GREENASIA) += hid-gaff.o obj-$(CONFIG_HID_THRUSTMASTER) += hid-tmff.o hid-thrustmaster.o obj-$(CONFIG_HID_TIVO) += hid-tivo.o obj-$(CONFIG_HID_TOPSEED) += hid-topseed.o +obj-$(CONFIG_HID_TOPRE) += hid-topre.o obj-$(CONFIG_HID_TWINHAN) += hid-twinhan.o obj-$(CONFIG_HID_U2FZERO) += hid-u2fzero.o hid-uclogic-objs := hid-uclogic-core.o \
drivers/hid/hid-ids.h +3 -0
@@ -1231,6 +1231,9 @@#define USB_DEVICE_ID_TIVO_SLIDE 0x1201#define USB_DEVICE_ID_TIVO_SLIDE_PRO 0x1203 +#define USB_VENDOR_ID_TOPRE 0x0853 +#define USB_DEVICE_ID_TOPRE_REALFORCE_R2_108 0x0148 +#define USB_VENDOR_ID_TOPSEED 0x0766#define USB_DEVICE_ID_TOPSEED_CYBERLINK 0x0204
drivers/hid/hid-topre.c new file +49 -0
49 lines not on this page · raw message
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 813/862 HID: roccat: Fix use-after-free in roccat_read()
In reply to Greg Kroah-HartmanFrom: Hyunwoo Kim <[email protected]>
[ Upstream commit cacdb14b1c8d3804a3a7d31773bc7569837b71a4 ]
roccat_report_event() is responsible for registering roccat-related reports in struct roccat_device.
int roccat_report_event(int minor, u8 const *data)
{
struct roccat_device *device;
struct roccat_reader *reader;
struct roccat_report *report;
uint8_t *new_value;
device = devices[minor];
new_value = kmemdup(data, device->report_size, GFP_ATOMIC);
if (!new_value)
return -ENOMEM;
report = &device->cbuf[device->cbuf_end];
/* passing NULL is safe */
kfree(report->value);
...The registered report is stored in the struct roccat_device member "struct roccat_report cbuf[ROCCAT_CBUF_SIZE];".
If more reports are received than the "ROCCAT_CBUF_SIZE" value, kfree() the saved report from cbuf[0] and allocates a new reprot. Since there is no lock when this kfree() is performed, kfree() can be performed even while reading the saved report.
static ssize_t roccat_read(struct file *file, char __user *buffer,
size_t count, loff_t *ppos)
{
struct roccat_reader *reader = file->private_data;
struct roccat_device *device = reader->device;
struct roccat_report *report;
ssize_t retval = 0, len;
DECLARE_WAITQUEUE(wait, current);
mutex_lock(&device->cbuf_lock);
...
report = &device->cbuf[reader->cbuf_start];
/*
* If report is larger than requested amount of data, rest of report
* is lost!
*/
len = device->report_size > count ? count : device->report_size;
if (copy_to_user(buffer, report->value, len)) {
retval = -EFAULT;
goto exit_unlock;
}
...The roccat_read() function receives the device->cbuf report and delivers it to the user through copy_to_user().
If the N+ROCCAT_CBUF_SIZE th report is received while copying of the Nth report->value is in progress, the pointer that copy_to_user() is working on is kfree()ed and UAF read may occur. (race condition)
Since the device node of this driver does not set separate permissions, this is not a security vulnerability, but because it is used for requesting screen display of profile or dpi settings,
a user using the roccat device can apply udev to this device node or There is a possibility to use it by giving.
--- drivers/hid/hid-roccat.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/hid/hid-roccat.c +4 -0
@@ -257,6 +257,8 @@ int roccat_report_event(int minor, u8 const *data)if (!new_value)return -ENOMEM ; +mutex_lock (&device->cbuf_lock); + report = &device->cbuf[device->cbuf_end];/* passing NULL is safe */
@@ -276,6 +278,8 @@ int roccat_report_event(int minor, u8 const *data) reader->cbuf_start = (reader->cbuf_start +1 ) %ROCCAT_CBUF_SIZE ; } +mutex_unlock (&device->cbuf_lock); +wake_up_interruptible (&device->wait);return 0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 814/862 HSI: ssi_protocol: fix potential resource leak in ssip_pn_open()
In reply to Greg Kroah-HartmanFrom: Jianglei Nie <[email protected]>
[ Upstream commit b28dbcb379e6a7f80262c2732a57681b1ee548ca ]
ssip_pn_open() claims the HSI client's port with hsi_claim_port(). When hsi_register_port_event() gets some error and returns a negetive value, the HSI client's port should be released with hsi_release_port().
Fix it by calling hsi_release_port() when hsi_register_port_event() fails.
--- drivers/hsi/clients/ssi_protocol.c | 1 + 1 file changed, 1 insertion(+)
drivers/hsi/clients/ssi_protocol.c +1 -0
@@ -931,6 +931,7 @@ static int ssip_pn_open(struct net_device *dev)if (err <0 ) {dev_err (&cl->device,"Register HSI port event failed (%d)\n" , err); +hsi_release_port (cl);return err; }dev_dbg (&cl->device,"Configuring SSI port\n" );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 815/862 HID: nintendo: check analog user calibration for plausibility
In reply to Greg Kroah-HartmanFrom: Johnothan King <[email protected]>
[ Upstream commit 50503e360eeb968a3d00234c9cc4057d774c3e9a ]
Arne Wendt writes:
Cheap clone controllers may (falsely) report as having a user calibration for the analog sticks in place, but return wrong/impossible values for the actual calibration data. In the present case at mine, the controller reports having a user calibration in place and successfully executes the read commands. The reported user calibration however is min = center = max = 0.
This pull request addresses problems of this kind by checking the provided user calibration-data for plausibility (min < center < max) and falling back to the default values if implausible.
I'll note that I was experiencing a crash because of this bug when using the GuliKit KingKong 2 controller. The crash manifests as a divide by zero error in the kernel logs:
kernel: divide error: 0000 [#1] PREEMPT SMP NOPTI
--- drivers/hid/hid-nintendo.c | 55 +++++++++++++++++++++----------------- 1 file changed, 30 insertions(+), 25 deletions(-)
drivers/hid/hid-nintendo.c +30 -25
@@ -760,12 +760,31 @@ static int joycon_read_stick_calibration(struct joycon_ctlr *ctlr, u16 cal_addr, cal_y->max = cal_y->center + y_max_above; cal_y->min = cal_y->center - y_min_below; -return 0 ; +/* check if calibration values are plausible */ +if (cal_x->min >= cal_x->center || cal_x->center >= cal_x->max || + cal_y->min >= cal_y->center || cal_y->center >= cal_y->max) + ret = -EINVAL ; + +return ret; }static const u16 DFLT_STICK_CAL_CEN =2000 ;static const u16 DFLT_STICK_CAL_MAX =3500 ;static const u16 DFLT_STICK_CAL_MIN =500 ; +static void joycon_use_default_calibration (struct hid_device *hdev, +struct joycon_stick_cal *cal_x, +struct joycon_stick_cal *cal_y, +const char *stick,int ret) +{ +hid_warn (hdev, +"Failed to read %s stick cal, using defaults; e=%d\n" , + stick, ret); + + cal_x->center = cal_y->center =DFLT_STICK_CAL_CEN ; + cal_x->max = cal_y->max =DFLT_STICK_CAL_MAX ; + cal_x->min = cal_y->min =DFLT_STICK_CAL_MIN ; +} +static int joycon_request_calibration (struct joycon_ctlr *ctlr) {u16 left_stick_addr =JC_CAL_FCT_DATA_LEFT_ADDR ;
@@ -793,38 +812,24 @@ static int joycon_request_calibration(struct joycon_ctlr *ctlr) &ctlr->left_stick_cal_x, &ctlr->left_stick_cal_y, true); -if (ret) { -hid_warn (ctlr->hdev, -"Failed to read left stick cal, using dflts; e=%d\n" , - ret); - - ctlr->left_stick_cal_x.center =DFLT_STICK_CAL_CEN ; - ctlr->left_stick_cal_x.max =DFLT_STICK_CAL_MAX ; - ctlr->left_stick_cal_x.min =DFLT_STICK_CAL_MIN ; - ctlr->left_stick_cal_y.center =DFLT_STICK_CAL_CEN ; - ctlr->left_stick_cal_y.max =DFLT_STICK_CAL_MAX ; - ctlr->left_stick_cal_y.min =DFLT_STICK_CAL_MIN ; - } +if (ret) +joycon_use_default_calibration (ctlr->hdev, + &ctlr->left_stick_cal_x, + &ctlr->left_stick_cal_y, +"left" , ret);/* read the right stick calibration data */ ret =joycon_read_stick_calibration (ctlr, right_stick_addr, &ctlr->right_stick_cal_x, &ctlr->right_stick_cal_y, false); -if (ret) { -hid_warn (ctlr->hdev, -"Failed to read right stick cal, using dflts; e=%d\n" , - ret); - - ctlr->right_stick_cal_x.center =DFLT_STICK_CAL_CEN ; - ctlr->right_stick_cal_x.max =DFLT_STICK_CAL_MAX ; - ctlr->right_stick_cal_x.min =DFLT_STICK_CAL_MIN ; - ctlr->right_stick_cal_y.center =DFLT_STICK_CAL_CEN ; - ctlr->right_stick_cal_y.max =DFLT_STICK_CAL_MAX ; - ctlr->right_stick_cal_y.min =DFLT_STICK_CAL_MIN ; - } +if (ret) +joycon_use_default_calibration (ctlr->hdev, + &ctlr->right_stick_cal_x, + &ctlr->right_stick_cal_y, +"right" , ret);hid_dbg (ctlr->hdev,"calibration:\n" "l_x_c=%d l_x_max=%d l_x_min=%d\n"
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 816/862 md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d
In reply to Greg Kroah-HartmanFrom: Logan Gunthorpe <[email protected]>
[ Upstream commit 5e2cf333b7bd5d3e62595a44d598a254c697cd74 ]
A complicated deadlock exists when using the journal and an elevated group_thrtead_cnt. It was found with loop devices, but its not clear whether it can be seen with real disks. The deadlock can occur simply by writing data with an fio script.
When the deadlock occurs, multiple threads will hang in different ways:
1) The group threads will hang in the blk-wbt code with bios waiting to
be submitted to the block layer:
io_schedule+0x70/0xb0
rq_qos_wait+0x153/0x210
wbt_wait+0x115/0x1b0
io_schedule+0x70/0xb0
rq_qos_wait+0x153/0x210
wbt_wait+0x115/0x1b0
__rq_qos_throttle+0x38/0x60
blk_mq_submit_bio+0x589/0xcd0
wbt_wait+0x115/0x1b0
__rq_qos_throttle+0x38/0x60
blk_mq_submit_bio+0x589/0xcd0
__submit_bio+0xe6/0x100
submit_bio_noacct_nocheck+0x42e/0x470
submit_bio_noacct+0x4c2/0xbb0
ops_run_io+0x46b/0x1a30
handle_stripe+0xcd3/0x36b0
handle_active_stripes.constprop.0+0x6f6/0xa60
raid5_do_work+0x177/0x330
Or:
io_schedule+0x70/0xb0
rq_qos_wait+0x153/0x210
wbt_wait+0x115/0x1b0
__rq_qos_throttle+0x38/0x60
blk_mq_submit_bio+0x589/0xcd0
__submit_bio+0xe6/0x100
submit_bio_noacct_nocheck+0x42e/0x470
submit_bio_noacct+0x4c2/0xbb0
flush_deferred_bios+0x136/0x170
raid5_do_work+0x262/0x330 2) The r5l_reclaim thread will hang in the same way, submitting a
bio to the block layer:
io_schedule+0x70/0xb0
rq_qos_wait+0x153/0x210
wbt_wait+0x115/0x1b0
__rq_qos_throttle+0x38/0x60
blk_mq_submit_bio+0x589/0xcd0
__submit_bio+0xe6/0x100
submit_bio_noacct_nocheck+0x42e/0x470
submit_bio_noacct+0x4c2/0xbb0
submit_bio+0x3f/0xf0
md_super_write+0x12f/0x1b0
md_update_sb.part.0+0x7c6/0xff0
md_update_sb+0x30/0x60
r5l_do_reclaim+0x4f9/0x5e0
r5l_reclaim_thread+0x69/0x30b
However, before hanging, the MD_SB_CHANGE_PENDING flag will be
set for sb_flags in r5l_write_super_and_discard_space(). This
flag will never be cleared because the submit_bio() call never
returns. 3) Due to the MD_SB_CHANGE_PENDING flag being set, handle_stripe() will do no processing on any pending stripes and re-set STRIPE_HANDLE. This will cause the raid5d thread to enter an infinite loop, constantly trying to handle the same stripes stuck in the queue.
The raid5d thread has a blk_plug that holds a number of bios that are also stuck waiting seeing the thread is in a loop that never schedules. These bios have been accounted for by blk-wbt thus preventing the other threads above from continuing when they try to submit bios. --Deadlock.
To fix this, add the same wait_event() that is used in raid5_do_work() to raid5d() such that if MD_SB_CHANGE_PENDING is set, the thread will schedule and wait until the flag is cleared. The schedule action will flush the plug which will allow the r5l_reclaim thread to continue, thus preventing the deadlock.
However, md_check_recovery() calls can also clear MD_SB_CHANGE_PENDING from the same thread and can thus deadlock if the thread is put to sleep. So avoid waiting if md_check_recovery() is being called in the loop.
It's not clear when the deadlock was introduced, but the similar wait_event() call in raid5_do_work() was added in 2017 by this commit:
16d997b78b15 ("md/raid5: simplfy delaying of writes while metadata
is updated.")
--- drivers/md/raid5.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/md/raid5.c +12 -0
@@ -36,6 +36,7 @@*/ #include <linux/blkdev.h> +#include <linux/delay.h> #include <linux/kthread.h> #include <linux/raid/pq.h> #include <linux/async_tx.h>
@@ -6780,7 +6781,18 @@ static void raid5d(struct md_thread *thread)spin_unlock_irq (&conf->device_lock);md_check_recovery (mddev);spin_lock_irq (&conf->device_lock); + +/* +* Waiting on MD_SB_CHANGE_PENDING below may deadlock +* seeing md_check_recovery() is needed to clear +* the flag when using mdmon. +*/ +continue ; } + +wait_event_lock_irq (mddev->sb_wait, + !test_bit (MD_SB_CHANGE_PENDING , &mddev->sb_flags), + conf->device_lock); }pr_debug ("%d stripes handled\n" , handled);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 817/862 usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info()
In reply to Greg Kroah-HartmanFrom: Jianglei Nie <[email protected]>
[ Upstream commit 7e271f42a5cc3768cd2622b929ba66859ae21f97 ]
xhci_alloc_stream_info() allocates stream context array for stream_info ->stream_ctx_array with xhci_alloc_stream_ctx(). When some error occurs, stream_info->stream_ctx_array is not released, which will lead to a memory leak.
We can fix it by releasing the stream_info->stream_ctx_array with xhci_free_stream_ctx() on the error path to avoid the potential memory leak.
--- drivers/usb/host/xhci-mem.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/usb/host/xhci-mem.c +6 -1
@@ -641,7 +641,7 @@ struct xhci_stream_info *xhci_alloc_stream_info(struct xhci_hcd *xhci, num_stream_ctxs, &stream_info->ctx_array_dma, mem_flags);if (!stream_info->stream_ctx_array) - goto cleanup_ctx; + goto cleanup_ring_array;memset (stream_info->stream_ctx_array,0 ,sizeof (struct xhci_stream_ctx )*num_stream_ctxs);
@@ -702,6 +702,11 @@ struct xhci_stream_info *xhci_alloc_stream_info(struct xhci_hcd *xhci, }xhci_free_command (xhci, stream_info->free_streams_command); cleanup_ctx: +xhci_free_stream_ctx (xhci, + stream_info->num_stream_ctxs, + stream_info->stream_ctx_array, + stream_info->ctx_array_dma); +cleanup_ring_array:kfree (stream_info->stream_rings); cleanup_info:kfree (stream_info);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 818/862 usb: musb: Fix musb_gadget.c rxstate overflow bug
In reply to Greg Kroah-HartmanFrom: Robin Guo <[email protected]>
[ Upstream commit eea4c860c3b366369eff0489d94ee4f0571d467d ]
The usb function device call musb_gadget_queue() adds the passed request to musb_ep::req_list,If the (request->length > musb_ep->packet_sz) and (is_buffer_mapped(req) return false),the rxstate() will copy all data in fifo to request->buf which may cause request->buf out of bounds.
Fix it by add the length check :
fifocnt = min_t(unsigned, request->length - request->actual, fifocnt);
--- drivers/usb/musb/musb_gadget.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/musb/musb_gadget.c +3 -0
@@ -760,6 +760,9 @@ static void rxstate(struct musb *musb, struct musb_request *req)musb_writew (epio,MUSB_RXCSR , csr); buffer_aint_mapped: + fifo_count = min_t(unsigned int, + request->length - request->actual, + (unsigned int )fifo_count);musb_read_fifo (musb_ep->hw_ep, fifo_count, (u8 *) (request->buf + request->actual)); request->actual += fifo_count;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 819/862 usb: dwc3: core: add gfladj_refclk_lpm_sel quirk
In reply to Greg Kroah-HartmanFrom: Alexander Stein <[email protected]>
[ Upstream commit a6fc2f1b092787e9d7dbe472d720cede81680315 ]
This selects the SOF/ITP counter be running on ref_clk. As documented U2_FREECLK_EXISTS has to be set to 0 as well.
--- drivers/usb/dwc3/core.c | 8 +++++++- drivers/usb/dwc3/core.h | 2 ++ 2 files changed, 9 insertions(+), 1 deletion(-)
drivers/usb/dwc3/core.c +7 -1
@@ -407,6 +407,10 @@ static void dwc3_ref_clk_period(struct dwc3 *dwc) reg |=FIELD_PREP (DWC3_GFLADJ_REFCLK_FLADJ_MASK , fladj) |FIELD_PREP (DWC3_GFLADJ_240MHZDECR , decr >>1 ) |FIELD_PREP (DWC3_GFLADJ_240MHZDECR_PLS1 , decr &1 ); + +if (dwc->gfladj_refclk_lpm_sel) + reg |=DWC3_GFLADJ_REFCLK_LPM_SEL ; +dwc3_writel (dwc->regs,DWC3_GFLADJ , reg); }
@@ -788,7 +792,7 @@ static int dwc3_phy_setup(struct dwc3 *dwc)else reg |=DWC3_GUSB2PHYCFG_ENBLSLPM ; -if (dwc->dis_u2_freeclk_exists_quirk) +if (dwc->dis_u2_freeclk_exists_quirk || dwc->gfladj_refclk_lpm_sel) reg &= ~DWC3_GUSB2PHYCFG_U2_FREECLK_EXISTS ;dwc3_writel (dwc->regs,DWC3_GUSB2PHYCFG (0 ), reg);
@@ -1524,6 +1528,8 @@ static void dwc3_get_properties(struct dwc3 *dwc) "snps,dis-tx-ipgap-linecheck-quirk"); dwc->parkmode_disable_ss_quirk =device_property_read_bool (dev,"snps,parkmode-disable-ss-quirk" ); + dwc->gfladj_refclk_lpm_sel =device_property_read_bool (dev, +"snps,gfladj-refclk-lpm-sel-quirk" ); dwc->tx_de_emphasis_quirk =device_property_read_bool (dev,"snps,tx_de_emphasis_quirk" );
drivers/usb/dwc3/core.h +2 -0
@@ -391,6 +391,7 @@#define DWC3_GFLADJ_30MHZ_SDBND_SEL BIT(7)#define DWC3_GFLADJ_30MHZ_MASK 0x3f#define DWC3_GFLADJ_REFCLK_FLADJ_MASK GENMASK(21, 8) +#define DWC3_GFLADJ_REFCLK_LPM_SEL BIT(23)#define DWC3_GFLADJ_240MHZDECR GENMASK(30, 24)#define DWC3_GFLADJ_240MHZDECR_PLS1 BIT(31)
@@ -1312,6 +1313,7 @@ struct dwc3 { unsigned dis_del_phy_power_chg_quirk:1; unsigned dis_tx_ipgap_linecheck_quirk:1; unsigned parkmode_disable_ss_quirk:1; + unsigned gfladj_refclk_lpm_sel:1; unsigned tx_de_emphasis_quirk:1; unsigned tx_de_emphasis:2;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 820/862 arm64: dts: imx8mp: Add snps,gfladj-refclk-lpm-sel quirk to USB nodes
In reply to Greg Kroah-HartmanFrom: Alexander Stein <[email protected]>
[ Upstream commit 5c3d5ecf48ab06c709c012bf1e8f0c91e1fcd7ad ]
With this set the SOF/ITP counter is based on ref_clk when 2.0 ports are suspended.
snps,dis-u2-freeclk-exists-quirk can be removed as snps,gfladj-refclk-lpm-sel also clears the free running clock configuration bit.
--- arch/arm64/boot/dts/freescale/imx8mp.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/freescale/imx8mp.dtsi +2 -2
@@ -1189,7 +1189,7 @@ interrupts = <GIC_SPI 40 IRQ_TYPE_LEVEL_HIGH>; phys = <&usb3_phy0>, <&usb3_phy0>; phy-names = "usb2-phy", "usb3-phy"; - snps,dis-u2-freeclk-exists-quirk; + snps,gfladj-refclk-lpm-sel-quirk; }; };
@@ -1231,7 +1231,7 @@ interrupts = <GIC_SPI 41 IRQ_TYPE_LEVEL_HIGH>; phys = <&usb3_phy1>, <&usb3_phy1>; phy-names = "usb2-phy", "usb3-phy"; - snps,dis-u2-freeclk-exists-quirk; + snps,gfladj-refclk-lpm-sel-quirk; }; };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 821/862 usb: dwc3: core: Enable GUCTL1 bit 10 for fixing termination error after resume bug
In reply to Greg Kroah-HartmanFrom: Piyush Mehta <[email protected]>
[ Upstream commit 63d7f9810a38102cdb8cad214fac98682081e1a7 ]
When configured in HOST mode, after issuing U3/L2 exit controller fails to send proper CRC checksum in CRC5 field. Because of this behavior Transaction Error is generated, resulting in reset and re-enumeration of usb device attached. Enabling chicken bit 10 of GUCTL1 will correct this problem.
When this bit is set to '1', the UTMI/ULPI opmode will be changed to "normal" along with HS terminations, term, and xcvr signals after EOR. This option is to support certain legacy UTMI/ULPI PHYs.
Added "snps,resume-hs-terminations" quirk to resolved the above issue.
--- drivers/usb/dwc3/core.c | 17 +++++++++++++++++ drivers/usb/dwc3/core.h | 4 ++++ 2 files changed, 21 insertions(+)
drivers/usb/dwc3/core.c +17 -0
@@ -1183,6 +1183,21 @@ static int dwc3_core_init(struct dwc3 *dwc)dwc3_writel (dwc->regs,DWC3_GUCTL2 , reg); } +/* +* When configured in HOST mode, after issuing U3/L2 exit controller +* fails to send proper CRC checksum in CRC5 feild. Because of this +* behaviour Transaction Error is generated, resulting in reset and +* re-enumeration of usb device attached. All the termsel, xcvrsel, +* opmode becomes 0 during end of resume. Enabling bit 10 of GUCTL1 +* will correct this problem. This option is to support certain +* legacy ULPI PHYs. +*/ +if (dwc->resume_hs_terminations) { + reg =dwc3_readl (dwc->regs,DWC3_GUCTL1 ); + reg |=DWC3_GUCTL1_RESUME_OPMODE_HS_HOST ; +dwc3_writel (dwc->regs,DWC3_GUCTL1 , reg); + } + if (!DWC3_VER_IS_PRIOR(DWC3, 250A)) { reg =dwc3_readl (dwc->regs,DWC3_GUCTL1 );
@@ -1526,6 +1541,8 @@ static void dwc3_get_properties(struct dwc3 *dwc) "snps,dis-del-phy-power-chg-quirk"); dwc->dis_tx_ipgap_linecheck_quirk =device_property_read_bool (dev,"snps,dis-tx-ipgap-linecheck-quirk" ); + dwc->resume_hs_terminations =device_property_read_bool (dev, +"snps,resume-hs-terminations" ); dwc->parkmode_disable_ss_quirk =device_property_read_bool (dev,"snps,parkmode-disable-ss-quirk" ); dwc->gfladj_refclk_lpm_sel = device_property_read_bool(dev,
drivers/usb/dwc3/core.h +4 -0
@@ -263,6 +263,7 @@#define DWC3_GUCTL1_DEV_FORCE_20_CLK_FOR_30_CLK BIT(26)#define DWC3_GUCTL1_DEV_L1_EXIT_BY_HW BIT(24)#define DWC3_GUCTL1_PARKMODE_DISABLE_SS BIT(17) +#define DWC3_GUCTL1_RESUME_OPMODE_HS_HOST BIT(10)/* Global Status Register */ #define DWC3_GSTS_OTG_IP BIT(10)
@@ -1097,6 +1098,8 @@ struct dwc3_scratchpad_array {* change quirk. * @dis_tx_ipgap_linecheck_quirk: set if we disable u2mac linestate * check during HS transmit. +* @resume-hs-terminations: Set if we enable quirk for fixing improper crc +* generation after resume from suspend. * @parkmode_disable_ss_quirk: set if we need to disable all SuperSpeed * instances in park mode. * @tx_de_emphasis_quirk: set if we enable Tx de-emphasis quirk
@@ -1312,6 +1315,7 @@ struct dwc3 { unsigned dis_u2_freeclk_exists_quirk:1; unsigned dis_del_phy_power_chg_quirk:1; unsigned dis_tx_ipgap_linecheck_quirk:1; + unsigned resume_hs_terminations:1; unsigned parkmode_disable_ss_quirk:1; unsigned gfladj_refclk_lpm_sel:1;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 822/862 Revert "usb: storage: Add quirk for Samsung Fit flash"
In reply to Greg Kroah-HartmanFrom: sunghwan jung <[email protected]>
[ Upstream commit ad5dbfc123e6ffbbde194e2a4603323e09f741ee ]
This reverts commit 86d92f5465958752481269348d474414dccb1552, which fix the timeout issue for "Samsung Fit Flash".
But the commit affects not only "Samsung Fit Flash" but also other usb storages that use the same controller and causes severe performance regression.
# hdparm -t /dev/sda (without the quirk) Timing buffered disk reads: 622 MB in 3.01 seconds = 206.66 MB/sec
# hdparm -t /dev/sda (with the quirk) Timing buffered disk reads: 220 MB in 3.00 seconds = 73.32 MB/sec
The commit author mentioned that "Issue was reproduced after device has bad block", so this quirk should be applied when we have the timeout issue with a device that has bad blocks.
We revert the commit so that we apply this quirk by adding kernel paramters using a bootloader or other ways when we really need it, without the performance regression with devices that don't have the issue.
--- drivers/usb/storage/unusual_devs.h | 6 ------ 1 file changed, 6 deletions(-)
drivers/usb/storage/unusual_devs.h +0 -6
@@ -1275,12 +1275,6 @@ UNUSUAL_DEV( 0x090a, 0x1200, 0x0000, 0x9999, USB_SC_RBC, USB_PR_BULK, NULL, 0 ), -UNUSUAL_DEV (0x090c ,0x1000 ,0x1100 ,0x1100 , -"Samsung" , -"Flash Drive FIT" , -USB_SC_DEVICE ,USB_PR_DEVICE ,NULL , -US_FL_MAX_SECTORS_64 ), -/* aeb */ UNUSUAL_DEV( 0x090c, 0x1132, 0x0000, 0xffff, "Feiya",
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 823/862 io_uring: fix CQE reordering
In reply to Greg Kroah-HartmanFrom: Pavel Begunkov <[email protected]>
[ Upstream commit aa1df3a360a0c50e0f0086a785d75c2785c29967 ]
Overflowing CQEs may result in reordering, which is buggy in case of links, F_MORE and so on. If we guarantee that we don't reorder for the unlikely event of a CQ ring overflow, then we can further extend this to not have to terminate multishot requests if it happens. For other operations, like zerocopy sends, we have no choice but to honor CQE ordering.
--- io_uring/io_uring.c | 12 ++++++++++-- io_uring/io_uring.h | 12 +++++++++--- 2 files changed, 19 insertions(+), 5 deletions(-)
io_uring/io_uring.c +10 -2
@@ -567,7 +567,7 @@ static bool __io_cqring_overflow_flush(struct io_ring_ctx *ctx, bool force)io_cq_lock (ctx);while (!list_empty (&ctx->cq_overflow_list)) { -struct io_uring_cqe *cqe =io_get_cqe (ctx); +struct io_uring_cqe *cqe =io_get_cqe_overflow (ctx, true);struct io_overflow_cqe *ocqe;if (!cqe && !force)
@@ -694,12 +694,19 @@ bool io_req_cqe_overflow(struct io_kiocb *req)* control dependency is enough as we're using WRITE_ONCE to * fill the cq entry */ -struct io_uring_cqe *__io_get_cqe (struct io_ring_ctx *ctx) +struct io_uring_cqe *__io_get_cqe (struct io_ring_ctx *ctx,bool overflow) {struct io_rings *rings = ctx->rings;unsigned int off = ctx->cached_cq_tail & (ctx->cq_entries -1 );unsigned int free, queued, len; +/* +* Posting into the CQ when there are pending overflowed CQEs may break +* ordering guarantees, which will affect links, F_MORE users and more. +* Force overflow the completion. +*/ +if (!overflow && (ctx->check_cq &BIT (IO_CHECK_CQ_OVERFLOW_BIT ))) +return NULL ;/* userspace may cheat modifying the tail, be safe and do min */ queued =min (__io_cqring_events (ctx), ctx->cq_entries);
@@ -2232,6 +2239,7 @@ static int io_cqring_wait(struct io_ring_ctx *ctx, int min_events, do { io_cqring_overflow_flush(ctx); + if (io_cqring_events(ctx) >= min_events) return 0; if (!io_run_task_work())
io_uring/io_uring.h +9 -3
@@ -24,7 +24,7 @@ enum { IOU_STOP_MULTISHOT = -ECANCELED, }; -struct io_uring_cqe *__io_get_cqe (struct io_ring_ctx *ctx); +struct io_uring_cqe *__io_get_cqe (struct io_ring_ctx *ctx,bool overflow);bool io_req_cqe_overflow (struct io_kiocb *req);int io_run_task_work_sig (void );void io_req_complete_failed (struct io_kiocb *req,s32 res);
@@ -91,7 +91,8 @@ static inline void io_cq_lock(struct io_ring_ctx *ctx)void io_cq_unlock_post (struct io_ring_ctx *ctx); -static inline struct io_uring_cqe *io_get_cqe (struct io_ring_ctx *ctx) +static inline struct io_uring_cqe *io_get_cqe_overflow (struct io_ring_ctx *ctx, +bool overflow) {if (likely (ctx->cqe_cached < ctx->cqe_sentinel)) {struct io_uring_cqe *cqe = ctx->cqe_cached;
@@ -103,7 +104,12 @@ static inline struct io_uring_cqe *io_get_cqe(struct io_ring_ctx *ctx)return cqe; } -return __io_get_cqe (ctx); +return __io_get_cqe (ctx, overflow); +} + +static inline struct io_uring_cqe *io_get_cqe (struct io_ring_ctx *ctx) +{ +return io_get_cqe_overflow (ctx, false); } static inline bool __io_fill_cqe_req(struct io_ring_ctx *ctx,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 824/862 staging: rtl8723bs: fix potential memory leak in rtw_init_drv_sw()
In reply to Greg Kroah-HartmanFrom: Xiaoke Wang <[email protected]>
[ Upstream commit 5a5aa9cce621e2c0e25a1e5d72d6be1749167cc0 ]
In rtw_init_drv_sw(), there are various init functions are called to populate the padapter structure and some checks for their return value. However, except for the first one error path, the other five error paths do not properly release the previous allocated resources, which leads to various memory leaks.
This patch fixes them and keeps the success and error separate. Note that these changes keep the form of rtw_init_drv_sw() in "drivers/staging/r8188eu/os_dep/os_intfs.c". As there is no proper device to test with, no runtime testing was performed.
--- drivers/staging/rtl8723bs/os_dep/os_intfs.c | 60 +++++++++++---------- 1 file changed, 31 insertions(+), 29 deletions(-)
drivers/staging/rtl8723bs/os_dep/os_intfs.c +31 -29
@@ -664,51 +664,36 @@ void rtw_reset_drv_sw(struct adapter *padapter)u8 rtw_init_drv_sw (struct adapter *padapter) { -u8 ret8 = _SUCCESS; -rtw_init_default_value (padapter);rtw_init_hal_com_default_value (padapter); -if (rtw_init_cmd_priv (&padapter->cmdpriv)) { - ret8 = _FAIL; - goto exit; - } +if (rtw_init_cmd_priv (&padapter->cmdpriv)) +return _FAIL; padapter->cmdpriv.padapter = padapter; -if (rtw_init_evt_priv (&padapter->evtpriv)) { - ret8 = _FAIL; - goto exit; - } +if (rtw_init_evt_priv (&padapter->evtpriv)) + goto free_cmd_priv; - -if (rtw_init_mlme_priv (padapter) == _FAIL) { - ret8 = _FAIL; - goto exit; - } +if (rtw_init_mlme_priv (padapter) == _FAIL) + goto free_evt_priv;init_mlme_ext_priv (padapter); -if (_rtw_init_xmit_priv (&padapter->xmitpriv, padapter) == _FAIL) { - ret8 = _FAIL; - goto exit; - } +if (_rtw_init_xmit_priv (&padapter->xmitpriv, padapter) == _FAIL) + goto free_mlme_ext; -if (_rtw_init_recv_priv (&padapter->recvpriv, padapter) == _FAIL) { - ret8 = _FAIL; - goto exit; - } +if (_rtw_init_recv_priv (&padapter->recvpriv, padapter) == _FAIL) + goto free_xmit_priv;/* add for CONFIG_IEEE80211W, none 11w also can use */ spin_lock_init (&padapter->security_key_mutex);/* We don't need to memset padapter->XXX to zero, because adapter is allocated by vzalloc(). */ /* memset((unsigned char *)&padapter->securitypriv, 0, sizeof (struct security_priv)); */ -if (_rtw_init_sta_priv (&padapter->stapriv) == _FAIL) { - ret8 = _FAIL; - goto exit; - } +if (_rtw_init_sta_priv (&padapter->stapriv) == _FAIL) + goto free_recv_priv; padapter->stapriv.padapter = padapter; padapter->setband =GHZ24_50 ;
@@ -719,9 +704,26 @@ u8 rtw_init_drv_sw(struct adapter *padapter)rtw_hal_dm_init (padapter); -exit: +return _SUCCESS; + +free_recv_priv: +_rtw_free_recv_priv (&padapter->recvpriv); + +free_xmit_priv: +_rtw_free_xmit_priv (&padapter->xmitpriv); + +free_mlme_ext: +free_mlme_ext_priv (&padapter->mlmeextpriv); -return ret8; +rtw_free_mlme_priv (&padapter->mlmepriv); + +free_evt_priv: +rtw_free_evt_priv (&padapter->evtpriv); + +free_cmd_priv: +rtw_free_cmd_priv (&padapter->cmdpriv); + +return _FAIL; }void rtw_cancel_all_timer (struct adapter *padapter)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 825/862 staging: rtl8723bs: fix a potential memory leak in rtw_init_cmd_priv()
In reply to Greg Kroah-HartmanFrom: Xiaoke Wang <[email protected]>
[ Upstream commit 708056fba733a73d926772ea4ce9a42d240345da ]
In rtw_init_cmd_priv(), if pcmdpriv->rsp_allocated_buf is allocated in failure, then pcmdpriv->cmd_allocated_buf will be not properly released. Besides, considering there are only two error paths and the first one can directly return, so we do not need implicitly jump to the exit tag to execute the error handler.
So this patch added kfree(pcmdpriv->cmd_allocated_buf); on the error path to release the resource and simplified the return logic of rtw_init_cmd_priv(). As there is no proper device to test with, no runtime testing was performed.
--- drivers/staging/rtl8723bs/core/rtw_cmd.c | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-)
drivers/staging/rtl8723bs/core/rtw_cmd.c +6 -10
@@ -161,8 +161,6 @@ static struct cmd_hdl wlancmds[] = {int rtw_init_cmd_priv (struct cmd_priv *pcmdpriv) { -int res =0 ; -init_completion (&pcmdpriv->cmd_queue_comp);init_completion (&pcmdpriv->terminate_cmdthread_comp);
@@ -175,18 +173,16 @@ int rtw_init_cmd_priv(struct cmd_priv *pcmdpriv) pcmdpriv->cmd_allocated_buf =rtw_zmalloc (MAX_CMDSZ +CMDBUFF_ALIGN_SZ ); -if (!pcmdpriv->cmd_allocated_buf) { - res = -ENOMEM ; - goto exit; - } +if (!pcmdpriv->cmd_allocated_buf) +return -ENOMEM ; pcmdpriv->cmd_buf = pcmdpriv->cmd_allocated_buf +CMDBUFF_ALIGN_SZ - ((SIZE_PTR )(pcmdpriv->cmd_allocated_buf) & (CMDBUFF_ALIGN_SZ -1 )); pcmdpriv->rsp_allocated_buf =rtw_zmalloc (MAX_RSPSZ +4 );if (!pcmdpriv->rsp_allocated_buf) { - res = -ENOMEM ; - goto exit; +kfree (pcmdpriv->cmd_allocated_buf); +return -ENOMEM ; } pcmdpriv->rsp_buf = pcmdpriv->rsp_allocated_buf +4 - ((SIZE_PTR )(pcmdpriv->rsp_allocated_buf) &3 );
@@ -196,8 +192,8 @@ int rtw_init_cmd_priv(struct cmd_priv *pcmdpriv) pcmdpriv->rsp_cnt =0 ;mutex_init (&pcmdpriv->sctx_mutex); -exit: -return res; + +return 0 ; }static void c2h_wk_callback (struct work_struct *work);
Signature · 1 line
2.35.1