5.15.174-rc1 review
Subsystems (4)
Greg Kroah-Hartman
maintainercover 5.15.174-rc1 review
This is the start of the stable review cycle for the 5.15.174 release. There are 565 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 14 Dec 2024 14:41:35 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.174-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.15.174-rc1
Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_core: Fix calling mgmt_device_connected
Karsten Graul <[email protected]>
net/smc: Fix af_ops of child socket pointing to released memory
Ameer Hamza <[email protected]>
media: venus: vdec: fixed possible memory leak issue
Arnd Bergmann <[email protected]>
serial: amba-pl011: fix build regression
Alex Deucher <[email protected]>
drm/amdgpu: rework resume handling for display (v2)
Wayne Lin <[email protected]>
drm/amd/display: Correct the defined value for AMDGPU_DMUB_NOTIFICATION_MAX
Tristram Ha <[email protected]>
net: dsa: microchip: correct KSZ8795 static MAC table access
Luiz Augusto von Dentz <[email protected]>
Bluetooth: L2CAP: Fix uaf in l2cap_connect
Mark Rutland <[email protected]>
arm64: smccc: Remove broken support for SMCCCv1.3 SVE discard hint
Mark Brown <[email protected]>
arm64/sve: Discard stale CPU state when handling SVE traps
Ziwei Xiao <[email protected]>
gve: Fixes for napi_poll when budget is 0
Damien Le Moal <[email protected]>
scsi: core: Fix scsi_mode_select() buffer length handling
Zhang Zekun <[email protected]>
Revert "drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read()"
Willem de Bruijn <[email protected]>
fou: remove warn in gue_gro_receive on unsupported protocol
Stefan Berger <[email protected]>
ima: Fix use-after-free on a dentry's dname.name
Weili Qian <[email protected]>
crypto: hisilicon/qm - inject error before stopping queue
Heming Zhao <[email protected]>
ocfs2: Revert "ocfs2: fix the la space leak when unmounting an ocfs2 volume"
Alex Hung <[email protected]>
drm/amd/display: Check BIOS images before it is used
Andy-ld Lu <[email protected]>
mmc: mtk-sd: Fix error handle of probe function
Mathias Nyman <[email protected]>
xhci: dbc: Fix STALL transfer event handling
Zheng Yejian <[email protected]>
mm/damon/vaddr: fix issue in damon_va_evenly_split_region()
SeongJae Park <[email protected]>
mm/damon/vaddr-test: split a test function having >1024 bytes frame size
Richard Weinberger <[email protected]>
jffs2: Fix rtime decompressor
Kinsey Moore <[email protected]>
jffs2: Prevent rtime decompress memory corruption
Kunkun Jiang <[email protected]>
KVM: arm64: vgic-its: Clear ITE when DISCARD frees an ITE
Kunkun Jiang <[email protected]>
KVM: arm64: vgic-its: Clear DTE when MAPD unmaps a device
Jing Zhang <[email protected]>
KVM: arm64: vgic-its: Add a data length check in vgic_its_save_*
Linus Torvalds <[email protected]>
Revert "unicode: Don't special case ignorable code points"
Masami Hiramatsu (Google) <[email protected]>
tracing/eprobe: Fix to release eprobe when failed to add dyn_event
Filipe Manana <[email protected]>
btrfs: fix missing snapshot drew unlock when root is dead during swap activation
K Prateek Nayak <[email protected]>
sched/core: Prevent wakeup of ksoftirqd during idle load balance
K Prateek Nayak <[email protected]>
sched/fair: Check idle_cpu() before need_resched() to detect ilb CPU turning busy
Valentin Schneider <[email protected]>
sched/fair: Add NOHZ balancer flag for nohz.next_balance updates
K Prateek Nayak <[email protected]>
sched/core: Remove the unnecessary need_resched() check in nohz_csd_func()
Thomas Gleixner <[email protected]>
modpost: Add .irqentry.text to OTHER_SECTIONS
Nathan Chancellor <[email protected]>
modpost: Include '.text.*' in TEXT_SECTIONS
Parker Newman <[email protected]>
misc: eeprom: eeprom_93cx6: Add quirk for extra read clock cycle
Michael Ellerman <[email protected]>
powerpc/prom_init: Fixup missing powermac #size-cells
Xi Ruoyao <[email protected]>
MIPS: Loongson64: DTS: Really fix PCIe port nodes for ls7a
Xu Yang <[email protected]>
usb: chipidea: udc: handle USB Error Interrupt if IOC not set
Defa Li <[email protected]>
i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to avoid deadlock
Mengyuan Lou <[email protected]>
PCI: Add ACS quirk for Wangxun FF5xxx NICs
Keith Busch <[email protected]>
PCI: Add 'reset_subordinate' to reset hierarchy below bridge
Esther Shimanovich <[email protected]>
PCI: Detect and trust built-in Thunderbolt chips
Jarkko Nikula <[email protected]>
i3c: mipi-i3c-hci: Mask ring interrupts before ring stop request
Qi Han <[email protected]>
f2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inode.
Yi Yang <[email protected]>
nvdimm: rectify the illogical code within nd_dax_probe()
Barnabás Czémán <[email protected]>
pinctrl: qcom-pmic-gpio: add support for PM8937
Kai Mäkisara <[email protected]>
scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset
Kai Mäkisara <[email protected]>
scsi: st: Don't modify unknown block number in MTIOCGET
Mukesh Ojha <[email protected]>
leds: class: Protect brightness_show() with led_cdev->led_access mutex
Yihang Li <[email protected]>
scsi: hisi_sas: Add cond_resched() for no forced preemption model
Uros Bizjak <[email protected]>
tracing: Use atomic64_inc_return() in trace_clock_counter()
Esben Haabendal <[email protected]>
pinctrl: freescale: fix COMPILE_TEST error with PINCTRL_IMX_SCU
Breno Leitao <[email protected]>
netpoll: Use rcu_access_pointer() in __netpoll_setup
Jakub Kicinski <[email protected]>
net/neighbor: clear error in case strict check is not set
Dmitry Antipov <[email protected]>
rocker: fix link status detection in rocker_carrier_init()
Jonas Karlman <[email protected]>
ASoC: hdmi-codec: reorder channel allocation list
Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet
Norbert van Bolhuis <[email protected]>
wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw()
Jiapeng Chong <[email protected]>
wifi: ipw2x00: libipw_rx_any(): fix bad alignment
Prike Liang <[email protected]>
drm/amdgpu: set the right AMDGPU sg segment limitation
Victor Zhao <[email protected]>
drm/amdgpu: skip amdgpu_device_cache_pci_state under sriov
Nihar Chaithanya <[email protected]>
jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree
Ghanshyam Agrawal <[email protected]>
jfs: fix array-index-out-of-bounds in jfs_readdir
Ghanshyam Agrawal <[email protected]>
jfs: fix shift-out-of-bounds in dbSplit
Ghanshyam Agrawal <[email protected]>
jfs: array-index-out-of-bounds fix in dtReadFirst
Levi Yun <[email protected]>
dma-debug: fix a possible deadlock on radix_lock
Lang Yu <[email protected]>
drm/amdgpu: refine error handling in amdgpu_ttm_tt_pin_userptr
Prike Liang <[email protected]>
drm/amdgpu: Dereference the ATCS ACPI buffer
Victor Lu <[email protected]>
drm/amdgpu: clear RB_OVERFLOW bit when enabling interrupts for vega20_ih
Manikandan Muralidharan <[email protected]>
drm/panel: simple: Add Microchip AC69T88A LVDS Display panel
Rosen Penev <[email protected]>
wifi: ath5k: add PCI ID for Arcadyan devices
Rosen Penev <[email protected]>
wifi: ath5k: add PCI ID for SX76X
Ignat Korchagin <[email protected]>
net: inet6: do not leave a dangling sk pointer in inet6_create()
Ignat Korchagin <[email protected]>
net: inet: do not leave a dangling sk pointer in inet_create()
Ignat Korchagin <[email protected]>
net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()
Ignat Korchagin <[email protected]>
net: af_can: do not leave a dangling sk pointer in can_create()
Ignat Korchagin <[email protected]>
Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create()
Ignat Korchagin <[email protected]>
af_packet: avoid erroring out after sock_init_data() in packet_create()
Elena Salomatkina <[email protected]>
net/sched: cbs: Fix integer overflow in cbs_set_port_rate()
Simon Horman <[email protected]>
net: ethernet: fs_enet: Use %pa to format resource_size_t
Simon Horman <[email protected]>
net: fec_mpc52xx_phy: Use %pa to format resource_size_t
Zhu Jun <[email protected]>
samples/bpf: Fix a resource leak
Heiner Kallweit <[email protected]>
r8169: don't apply UDP padding quirk on RTL8126A
Igor Artemiev <[email protected]>
drm/radeon/r600_cs: Fix possible int overflow in r600_packet3_check()
Liao Chen <[email protected]>
drm/mcde: Enable module autoloading
Joaquín Ignacio Aramendía <[email protected]>
drm: panel-orientation-quirks: Add quirk for AYA NEO 2 model
Dave Stevenson <[email protected]>
drm/vc4: hvs: Set AXI panic modes for the HVS
Marek Vasut <[email protected]>
soc: imx8m: Probe the SoC driver as platform driver
Rohan Barar <[email protected]>
media: cx231xx: Add support for Dexatek USB Video Grabber 1d19:6108
David Given <[email protected]>
media: uvcvideo: Add a quirk for the Kaiweets KTI-W02 infrared camera
Marco Elver <[email protected]>
kcsan: Turn report_filterlist_lock into a raw_spinlock
Mark Brown <[email protected]>
kselftest/arm64: Don't leak pipe fds in pac.exec_sign_all()
Qu Wenruo <[email protected]>
btrfs: avoid unnecessary device path update for the same device
Thomas Richter <[email protected]>
s390/cpum_sf: Handle CPU hotplug remove during sampling
Christian Brauner <[email protected]>
epoll: annotate racy check
Pratyush Brahma <[email protected]>
iommu/arm-smmu: Defer probe of clients after smmu device bound
Wengang Wang <[email protected]>
ocfs2: update seq_file index in ocfs2_dlm_seq_next
Ulf Hansson <[email protected]>
mmc: core: Further prevent card detect during shutdown
Hans de Goede <[email protected]>
mmc: sdhci-pci: Add DMI quirk for missing CD GPIO on Vexia Edu Atla 10 tablet
Cosmin Tanislav <[email protected]>
regmap: detach regmap from dev on regmap_exit
Maciej Fijalkowski <[email protected]>
xsk: fix OOB map writes when deleting elements
Christian König <[email protected]>
dma-buf: fix dma_fence_array_signaled v4
Maciej Fijalkowski <[email protected]>
bpf: fix OOB devmap writes when deleting elements
Liequan Che <[email protected]>
bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again
Ryusuke Konishi <[email protected]>
nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry()
Gwendal Grignou <[email protected]>
scsi: ufs: core: sysfs: Prevent div by zero
Saurav Kashyap <[email protected]>
scsi: qla2xxx: Remove check req_sg_cnt should be equal to rsp_sg_cnt
Quinn Tran <[email protected]>
scsi: qla2xxx: Fix use after free on unload
Anil Gurumurthy <[email protected]>
scsi: qla2xxx: Supported speed displayed incorrectly for VPorts
Quinn Tran <[email protected]>
scsi: qla2xxx: Fix NVMe and NPIV connect issue
Quinn Tran <[email protected]>
scsi: qla2xxx: Fix abort in bsg timeout
Sahas Leelodharry <[email protected]>
ALSA: hda/realtek: Add support for Samsung Galaxy Book3 360 (NP730QFG)
Nazar Bilinskyi <[email protected]>
ALSA: hda/realtek: Enable mute and micmute LED on HP ProBook 430 G8
Marie Ramlow <[email protected]>
ALSA: usb-audio: add mixer mapping for Corsair HS80
Mark Rutland <[email protected]>
arm64: ptrace: fix partial SETREGSET for NT_ARM_TAGGED_ADDR_CTRL
Kuan-Wei Chiu <[email protected]>
tracing: Fix cmp_entries_dup() to respect sort() comparison rules
Marc Kleine-Budde <[email protected]>
can: dev: can_set_termination(): allow sleeping GPIOs
Alexander Sverdlin <[email protected]>
watchdog: rti: of: honor timeout-sec property
WangYuli <[email protected]>
HID: wacom: fix when get product name maybe null pointer
Hou Tao <[email protected]>
bpf: Fix exact match conditions in trie_get_next_key()
Hou Tao <[email protected]>
bpf: Handle BPF_EXIST and BPF_NOEXIST for LPM trie
Tetsuo Handa <[email protected]>
ocfs2: free inode when ocfs2_get_init_inode() fails
Maíra Canal <[email protected]>
drm/v3d: Enable Performance Counters before clearing them
Pei Xiao <[email protected]>
spi: mpc52xx: Add cancel_work_sync before module remove
Björn Töpel <[email protected]>
tools: Override makefile ARCH variable if defined, but empty
Takashi Iwai <[email protected]>
ALSA: usb-audio: Notify xrun for low-latency mode
Takashi Iwai <[email protected]>
ALSA: pcm: Avoid reference to status->state
Takashi Iwai <[email protected]>
ALSA: pcm: Add more disconnection checks at file ops
Zijian Zhang <[email protected]>
tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg
Pei Xiao <[email protected]>
drm/sti: Add __iomem for mixer_dbg_mxn's parameter
Amir Mohammadi <[email protected]>
bpftool: fix potential NULL pointer dereferencing in prog_dump()
Quentin Monnet <[email protected]>
bpftool: Remove asserts from JIT disassembler
Kartik Rajput <[email protected]>
serial: amba-pl011: Fix RX stall when DMA is used
Thomas Gleixner <[email protected]>
serial: amba-pl011: Use port lock wrappers
Michal Simek <[email protected]>
dt-bindings: serial: rs485: Fix rs485-rts-delay property
Lino Sanfilippo <[email protected]>
dt_bindings: rs485: Correct delay values
Charles Han <[email protected]>
gpio: grgpio: Add NULL check in grgpio_probe
Bartosz Golaszewski <[email protected]>
gpio: grgpio: use a helper variable to store the address of ofdev->dev
Eric Dumazet <[email protected]>
geneve: do not assume mac header is set in geneve_xmit_skb()
Kory Maincent <[email protected]>
ethtool: Fix wrong mod state in case of verbose and no_mask bitset
Pablo Neira Ayuso <[email protected]>
netfilter: nft_set_hash: skip duplicated elements pending gc run
Phil Sutter <[email protected]>
netfilter: ipset: Hold module reference while requesting a module
Xin Long <[email protected]>
net: sched: fix erspan_opt settings in cls_flower
Yuan Can <[email protected]>
igb: Fix potential invalid memory access in igb_init_module()
Louis Leseur <[email protected]>
net/qed: allow old cards not supporting "num_images" to work
Wen Gu <[email protected]>
net/smc: fix LGR and link use-after-free issue
D. Wythe <[email protected]>
net/smc: Limit backlog connections
Kuniyuki Iwashima <[email protected]>
tipc: Fix use-after-free of kernel socket in cleanup_bearer().
Ivan Solodovnikov <[email protected]>
dccp: Fix memory leak in dccp_feat_change_recv
Jiri Wiesner <[email protected]>
net/ipv6: release expired exception dst cached in socket
Dmitry Antipov <[email protected]>
can: j1939: j1939_session_new(): fix skb reference counting
Eric Dumazet <[email protected]>
net: hsr: avoid potential out-of-bound access in fill_frame_info()
Martin Ottens <[email protected]>
net/sched: tbf: correct backlog statistic for GSO packets
Ajay Kaher <[email protected]>
ptp: Add error handling for adjfine callback in ptp_clock_adjtime
Dmitry Antipov <[email protected]>
netfilter: x_tables: fix LED ID check in led_tg_check()
Jinghao Jia <[email protected]>
ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init()
Dario Binacchi <[email protected]>
can: ems_usb: ems_usb_rx_err(): fix {rx,tx}_errors statistics
Dario Binacchi <[email protected]>
can: sun4i_can: sun4i_can_err(): fix {rx,tx}_errors statistics
Dario Binacchi <[email protected]>
can: ifi_canfd: ifi_canfd_handle_lec_err(): fix {rx,tx}_errors statistics
Dario Binacchi <[email protected]>
can: m_can: m_can_handle_lec_err(): fix {rx,tx}_errors statistics
Dario Binacchi <[email protected]>
can: sun4i_can: sun4i_can_err(): call can_change_state() even if cf is NULL
Dario Binacchi <[email protected]>
can: c_can: c_can_handle_bus_err(): update statistics if skb allocation fails
Vincent Mailhol <[email protected]>
can: do not increase rx statistics when generating a CAN rx error message frame
Stephane Grosjean <[email protected]>
can: peak_usb: CANFD: store 64-bits hw timestamps
Yassine Oudjana <[email protected]>
watchdog: mediatek: Make sure system reset gets asserted in mtk_wdt_restart()
Oleksandr Ocheretnyi <[email protected]>
iTCO_wdt: mask NMI_NOW bit for update_no_reboot_bit() call
Lucas Stach <[email protected]>
drm/etnaviv: flush shader L1 cache after user commandstream
Ma Ke <[email protected]>
drm/sti: avoid potential dereference of error pointers
Ma Ke <[email protected]>
drm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_check
Ma Ke <[email protected]>
drm/sti: avoid potential dereference of error pointers in sti_hqvdp_atomic_check
Josef Bacik <[email protected]>
btrfs: don't BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc()
Yang Erkun <[email protected]>
nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur
Yang Erkun <[email protected]>
nfsd: make sure exp active before svc_export_show
Damien Le Moal <[email protected]>
PCI: rockchip-ep: Fix address translation unit programming
Yuan Can <[email protected]>
dm thin: Add missing destroy_work_on_stack()
Oleksandr Tymoshenko <[email protected]>
ovl: properly handle large files in ovl_security_fileattr
Kishon Vijay Abraham I <[email protected]>
PCI: keystone: Add link up check to ks_pcie_other_map_bus()
Frank Li <[email protected]>
i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs()
Peter Griffin <[email protected]>
scsi: ufs: exynos: Fix hibern8 notify callbacks
Alexandru Ardelean <[email protected]>
util_macros.h: fix/rework find_closest() macros
Vasily Gorbik <[email protected]>
s390/entry: Mark IRQ entries to fix stack depot warnings
Zicheng Qu <[email protected]>
ad7780: fix division by zero in ad7780_write_raw()
Filipe Manana <[email protected]>
btrfs: ref-verify: fix use-after-free after invalid ref action
Lizhi Xu <[email protected]>
btrfs: add a sanity check for btrfs root in btrfs_search_slot()
ChenXiaoSong <[email protected]>
btrfs: add might_sleep() annotations
Ojaswin Mujoo <[email protected]>
quota: flush quota_release_work upon quota writeback
Long Li <[email protected]>
xfs: remove unknown compat feature check in superblock write validation
Darrick J. Wong <[email protected]>
xfs: fix log recovery when unknown rocompat bits are set
Shengjiu Wang <[email protected]>
ASoC: fsl_micfil: fix the naming style for mask definition
Dan Carpenter <[email protected]>
sh: intc: Fix use-after-free bug in register_intc_controller()
Liu Jian <[email protected]>
sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport
Trond Myklebust <[email protected]>
SUNRPC: Replace internal use of SOCKWQ_ASYNC_NOSPACE
Thiago Rafael Becker <[email protected]>
sunrpc: remove unnecessary test in rpc_task_set_client()
Li Lingfeng <[email protected]>
nfs: ignore SB_RDONLY when mounting nfs
Masahiro Yamada <[email protected]>
modpost: remove incorrect code in do_eisa_entry()
Maxime Chevallier <[email protected]>
rtc: ab-eoz9: don't fail temperature reads on undervoltage notification
Alex Zenla <[email protected]>
9p/xen: fix release of IRQ
Alex Zenla <[email protected]>
9p/xen: fix init sequence
Christoph Hellwig <[email protected]>
block: return unsigned int from bdev_io_min
Qingfang Deng <[email protected]>
jffs2: fix use of uninitialized variable
Waqar Hameed <[email protected]>
ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit
Zhihao Cheng <[email protected]>
ubi: fastmap: Fix duplicate slab cache names while attaching
Zhihao Cheng <[email protected]>
ubifs: Correct the total block count by deducting journal reservation
Yongliang Gao <[email protected]>
rtc: check if __rtc_read_time was successful in rtc_timer_do_work()
Nobuhiro Iwamatsu <[email protected]>
rtc: abx80x: Fix WDT bit position of the status register
Jinjie Ruan <[email protected]>
rtc: st-lpc: Use IRQF_NO_AUTOEN flag in request_irq()
Trond Myklebust <[email protected]>
NFSv4.0: Fix a use-after-free problem in the asynchronous open()
Tiwei Bie <[email protected]>
um: Always dump trace for specified task in show_stack
Tiwei Bie <[email protected]>
um: Fix the return value of elf_core_copy_task_fpregs
Tiwei Bie <[email protected]>
um: Fix potential integer overflow during physmem setup
Bjorn Andersson <[email protected]>
rpmsg: glink: Propagate TX failures in intentless mode as well
Yang Erkun <[email protected]>
SUNRPC: make sure cache entry active before cache_show
Chuck Lever <[email protected]>
NFSD: Prevent a potential integer overflow
Bartosz Golaszewski <[email protected]>
lib: string_helpers: silence snprintf() output truncation warning
Thinh Nguyen <[email protected]>
usb: dwc3: gadget: Fix looping of queued SG entries
Thinh Nguyen <[email protected]>
usb: dwc3: gadget: Fix checking for number of TRBs left
Takashi Iwai <[email protected]>
ALSA: hda/realtek: Apply quirk for Medion E15433
Dinesh Kumar <[email protected]>
ALSA: hda/realtek: Fix Internal Speaker and Mic boost of Infinix Y4 Max
Kailang Yang <[email protected]>
ALSA: hda/realtek: Set PCBeep to default value for ALC274
Kailang Yang <[email protected]>
ALSA: hda/realtek: Update ALC225 depop procedure
Takashi Iwai <[email protected]>
ALSA: pcm: Add sanity NULL check for the default mmap fault handler
Hans Verkuil <[email protected]>
media: v4l2-core: v4l2-dv-timings: check cvt/gtf result
Javier Carrasco <[email protected]>
soc: fsl: rcpm: fix missing of_node_put() in copy_ippdexpcr1_setting()
Qiu-ji Chen <[email protected]>
media: wl128x: Fix atomicity violation in fmc_send_cmd()
Jason Gerecke <[email protected]>
HID: wacom: Interpret tilt data from Intuos Pro BT as signed values
Muchun Song <[email protected]>
block: fix ordering between checking BLK_MQ_S_STOPPED request adding
Will Deacon <[email protected]>
arm64: tls: Fix context-switching of tpidrro_el0 when kpti is enabled
Huacai Chen <[email protected]>
sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
Tiwei Bie <[email protected]>
um: vector: Do not use drvdata in release
Bin Liu <[email protected]>
serial: 8250: omap: Move pm_runtime_get_sync
Tiwei Bie <[email protected]>
um: net: Do not use drvdata in release
Tiwei Bie <[email protected]>
um: ubd: Do not use drvdata in release
Zhihao Cheng <[email protected]>
ubi: wl: Put source PEB into correct list if trying locking LEB failed
Javier Carrasco <[email protected]>
platform/chrome: cros_ec_typec: fix missing fwnode reference decrement
Jinjie Ruan <[email protected]>
cpufreq: mediatek-hw: Fix wrong return value in mtk_cpufreq_get_cpu_power()
Cheng Ming Lin <[email protected]>
mtd: spi-nor: core: replace dummy buswidth from addr to data
Stanislaw Gruszka <[email protected]>
spi: Fix acpi deferred irq probe
Jeongjun Park <[email protected]>
netfilter: ipset: add missing range check in bitmap_ip_uadt
Sai Kumar Cholleti <[email protected]>
gpio: exar: set value when external pull-up or pull-down is present
Greg Kroah-Hartman <[email protected]>
Revert "serial: sh-sci: Clean sci_ports[0] after at earlycon exit"
Claudiu Beznea <[email protected]>
serial: sh-sci: Clean sci_ports[0] after at earlycon exit
Michal Vrastil <[email protected]>
Revert "usb: gadget: composite: fix OS descriptors w_value logic"
Zijun Hu <[email protected]>
driver core: bus: Fix double free in driver API bus_register()
Michal Pecio <[email protected]>
usb: xhci: Fix TD invalidation under pending Set TR Dequeue
Andrej Shadura <[email protected]>
Bluetooth: Fix type of len in rfcomm_sock_getsockopt{,_old}()
Namjae Jeon <[email protected]>
exfat: fix uninit-value in __exfat_get_dentry_set
Ahmed Ehab <[email protected]>
locking/lockdep: Avoid creating new name string literals in lockdep_set_subclass()
Nicolas Bouchinet <[email protected]>
tty: ldsic: fix tty_ldisc_autoload sysctl's proc_handler
Jinjie Ruan <[email protected]>
apparmor: test: Fix memory leak for aa_unpack_strdup()
Jann Horn <[email protected]>
comedi: Flush partial mappings in error case
Amir Goldstein <[email protected]>
fsnotify: fix sending inotify event with unexpected filename
Lukas Wunner <[email protected]>
PCI: Fix use-after-free of slot->bus on hot remove
Raghavendra Rao Ananta <[email protected]>
KVM: arm64: Ignore PMCNTENSET_EL0 while checking for overflow status
Gautam Menghani <[email protected]>
powerpc/pseries: Fix KVM guest detection for disabling hardlockup detector
Eric Biggers <[email protected]>
crypto: x86/aegis128 - access 32-bit arguments as 32-bit
Adrian Hunter <[email protected]>
perf/x86/intel/pt: Fix buffer full but size is 0 case
Qiu-ji Chen <[email protected]>
ASoC: codecs: Fix atomicity violation in snd_soc_component_get_drvdata()
Artem Sadovnikov <[email protected]>
jfs: xattr: check invalid xattr size more strictly
Theodore Ts'o <[email protected]>
ext4: fix FS_IOC_GETFSMAP handling
Jeongjun Park <[email protected]>
ext4: supress data-race warnings in ext4_free_inodes_{count,set}()
Benoît Sevens <[email protected]>
ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices
Manikanta Mylavarapu <[email protected]>
soc: qcom: socinfo: fix revision check in qcom_socinfo_probe()
Hans de Goede <[email protected]>
ASoC: Intel: sst: Fix used of uninitialized ctx to log an error
Joel Guittet <[email protected]>
Revert "drivers: clk: zynqmp: update divider round rate logic"
Vitalii Mordan <[email protected]>
usb: ehci-spear: fix call balance of sehci clk handling routines
Takashi Iwai <[email protected]>
ALSA: usb-audio: Fix out of bounds reads when finding clock sources
Qiu-ji Chen <[email protected]>
xen: Fix the issue of resource not being properly released in xenbus_dev_probe()
Namjae Jeon <[email protected]>
ksmbd: fix slab-use-after-free in smb3_preauth_hash_rsp
Mikulas Patocka <[email protected]>
parisc: fix a possible DMA corruption
chao liu <[email protected]>
apparmor: fix 'Do simple duplicate message elimination'
Kailang Yang <[email protected]>
ALSA: hda/realtek: Update ALC256 depop procedure
Jiasheng Jiang <[email protected]>
counter: stm32-timer-cnt: Add check for clk_enable()
Jinjie Ruan <[email protected]>
misc: apds990x: Fix missing pm_runtime_disable()
Edward Adam Davis <[email protected]>
USB: chaoskey: Fix possible deadlock chaoskey_list_lock
Oliver Neukum <[email protected]>
USB: chaoskey: fail open after removal
Oliver Neukum <[email protected]>
usb: yurex: make waiting on yurex_write interruptible
Jeongjun Park <[email protected]>
usb: using mutex lock and supporting O_NONBLOCK flag in iowarrior_read()
Christophe JAILLET <[email protected]>
iio: light: al3010: Fix an error handling path in al3010_probe()
Kuniyuki Iwashima <[email protected]>
tcp: Fix use-after-free of nreq in reqsk_timer_handler().
Saravanan Vajravel <[email protected]>
bnxt_en: Reserve rings after PCIe AER recovery if NIC interface is down
Eric Dumazet <[email protected]>
net: hsr: fix hsr_init_sk() vs network/transport headers.
Csókás, Bence <[email protected]>
spi: atmel-quadspi: Fix register name in verbose logging function
Hariprasad Kelam <[email protected]>
octeontx2-af: RPM: Fix mismatch in lmac type
Maxime Chevallier <[email protected]>
net: stmmac: dwmac-socfpga: Set RX watchdog interrupt as broken
Vitalii Mordan <[email protected]>
marvell: pxa168_eth: fix call balance of pep->clk handling routines
Rosen Penev <[email protected]>
net: mdio-ipq4019: add missing error check
Oleksij Rempel <[email protected]>
net: usb: lan78xx: Fix refcounting and autosuspend on invalid WoL configuration
Pavan Chebbi <[email protected]>
tg3: Set coherent DMA mask bits to 31 for BCM57766 chipsets
Oleksij Rempel <[email protected]>
net: usb: lan78xx: Fix memory leak on device unplug by freeing PHY device
Barnabás Czémán <[email protected]>
power: supply: bq27xxx: Fix registers of bq27426
Bart Van Assche <[email protected]>
power: supply: core: Remove might_sleep() from power_supply_put()
Randy Dunlap <[email protected]>
fs_parser: update mount_api doc to match function signature
Avihai Horon <[email protected]>
vfio/pci: Properly hide first-in-list PCIe extended capability
Michael Ellerman <[email protected]>
selftests/mount_setattr: Fix failures on 64K PAGE_SIZE kernels
Si-Wei Liu <[email protected]>
vdpa/mlx5: Fix suboptimal range on iotlb iteration
Murad Masimov <[email protected]>
hwmon: (tps23861) Fix reporting of negative temperatures
Chuck Lever <[email protected]>
NFSD: Fix nfsd4_shutdown_copy()
Ye Bin <[email protected]>
svcrdma: fix miss destroy percpu_counter in svc_rdma_proc_init()
Luis Chamberlain <[email protected]>
sunrpc: simplify two-level sysctl registration for svcrdma_parm_table
Chuck Lever <[email protected]>
NFSD: Cap the number of bytes copied by nfs4_reset_recoverydir()
Chuck Lever <[email protected]>
NFSD: Prevent NULL dereference in nfsd4_process_cb_update()
Sibi Sankar <[email protected]>
remoteproc: qcom_q6v5_mss: Re-order writes to the IMEM region
Jonathan Marek <[email protected]>
rpmsg: glink: use only lower 16-bits of param2 for CMD_OPEN name length
Bjorn Andersson <[email protected]>
rpmsg: glink: Fix GLINK command prefix
Arun Kumar Neelakantam <[email protected]>
rpmsg: glink: Send READ_NOTIFY command in FIFO full case
Arun Kumar Neelakantam <[email protected]>
rpmsg: glink: Add TX_DATA_CONT command while sending
Benjamin Peterson <[email protected]>
perf trace: Avoid garbage when not printing a syscall's arguments
Benjamin Peterson <[email protected]>
perf trace: Do not lose last events in a race
Chuck Lever <[email protected]>
svcrdma: Address an integer overflow
Antonio Quartulli <[email protected]>
m68k: coldfire/device.c: only build FEC when HW macros are defined
Jean-Michel Hautbois <[email protected]>
m68k: mcfgpio: Fix incorrect register offset for CONFIG_M5441x
Benjamin Peterson <[email protected]>
perf trace: avoid garbage when not printing a trace event's arguments
Yongpeng Yang <[email protected]>
f2fs: check curseg->inited before write_sum_page in change_curseg
Christoph Hellwig <[email protected]>
f2fs: remove the unused flush argument to change_curseg
Christoph Hellwig <[email protected]>
f2fs: open code allocate_segment_by_default
Christoph Hellwig <[email protected]>
f2fs: remove struct segment_allocation default_salloc_ops
LongPing Wei <[email protected]>
f2fs: fix the wrong f2fs_bug_on condition in f2fs_do_replace_block
Ilpo Järvinen <[email protected]>
PCI: cpqphp: Fix PCIBIOS_* return value confusion
weiyufeng <[email protected]>
PCI: cpqphp: Use PCI_POSSIBLE_ERROR() to check config reads
Leo Yan <[email protected]>
perf probe: Correct demangled symbols in C++ program
Ian Rogers <[email protected]>
perf probe: Fix libdw memory leak
Todd Kjos <[email protected]>
PCI: Fix reset_method_store() memory leak
James Clark <[email protected]>
perf cs-etm: Don't flush when packet_queue fills up
Dan Carpenter <[email protected]>
mailbox: arm_mhuv2: clean up loop in get_irq_chan_comb()
zhang jiao <[email protected]>
pinctrl: k210: Undef K210_PC_DEFAULT
Nuno Sa <[email protected]>
clk: clk-axi-clkgen: make sure to enable the AXI bus clock
Nuno Sa <[email protected]>
dt-bindings: clock: axi-clkgen: include AXI clk
Zhen Lei <[email protected]>
fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem()
Thomas Zimmermann <[email protected]>
fbdev/sh7760fb: Alloc DMA memory from hardware device
Zhang Zekun <[email protected]>
powerpc/kexec: Fix return of uninitialized variable
Michal Suchanek <[email protected]>
powerpc/sstep: make emulate_vsx_load and emulate_vsx_store static
Dmitry Antipov <[email protected]>
ocfs2: fix uninitialized value in ocfs2_file_read_iter()
Junxian Huang <[email protected]>
RDMA/hns: Fix NULL pointer derefernce in hns_roce_map_mr_sg()
Junxian Huang <[email protected]>
RDMA/hns: Fix out-of-order issue of requester when setting FENCE
Zhen Lei <[email protected]>
scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb()
Zhen Lei <[email protected]>
scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb()
Zeng Heng <[email protected]>
scsi: fusion: Remove unused variable 'rc'
Ye Bin <[email protected]>
scsi: bfa: Fix use-after-free in bfad_im_module_exit()
Zhang Changzhong <[email protected]>
mfd: rt5033: Fix missing regmap_del_irq_chip()
Dong Aisheng <[email protected]>
clk: imx: clk-scu: fix clk enable state save and restore
Peng Fan <[email protected]>
clk: imx: lpcg-scu: SW workaround for errata (e10858)
Kashyap Desai <[email protected]>
RDMA/bnxt_re: Check cqe flags to know imm_data vs inv_irkey
Michael Ellerman <[email protected]>
powerpc/pseries: Fix dtl_access_lock to be a rw_semaphore
Ritesh Harjani (IBM) <[email protected]>
powerpc/mm/fault: Fix kfence page fault reporting
Miquel Raynal <[email protected]>
mtd: rawnand: atmel: Fix possible memory leak
Yuan Can <[email protected]>
cpufreq: loongson2: Unregister platform_driver on failure
Andy Shevchenko <[email protected]>
mfd: intel_soc_pmic_bxtwc: Use IRQ domain for PMIC devices
Andy Shevchenko <[email protected]>
mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device
Andy Shevchenko <[email protected]>
mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device
Andy Shevchenko <[email protected]>
mfd: intel_soc_pmic_bxtwc: Use dev_err_probe()
Marcus Folkesson <[email protected]>
mfd: da9052-spi: Change read-mask to write-mask
Jinjie Ruan <[email protected]>
mfd: tps65010: Use IRQF_NO_AUTOEN flag in request_irq() to fix race
Christophe Leroy <[email protected]>
powerpc/vdso: Flag VDSO64 entry points as functions
Bartosz Golaszewski <[email protected]>
pinctrl: zynqmp: drop excess struct member description
Levi Yun <[email protected]>
trace/trace_event_perf: remove duplicate samples on the first tracepoint event
Jiayuan Chen <[email protected]>
bpf: fix recursive lock when verdict program return SK_PASS
Hangbin Liu <[email protected]>
wireguard: selftests: load nf_conntrack if not present
Breno Leitao <[email protected]>
netpoll: Use rcu_access_pointer() in netpoll_poll_lock
Dmitry Antipov <[email protected]>
Bluetooth: fix use-after-free in device_for_each_child()
Andy Shevchenko <[email protected]>
driver core: Introduce device_find_any_child() helper
Takashi Iwai <[email protected]>
ALSA: 6fire: Release resources at card release
Takashi Iwai <[email protected]>
ALSA: caiaq: Use snd_card_free_when_closed() at disconnection
Takashi Iwai <[email protected]>
ALSA: us122l: Use snd_card_free_when_closed() at disconnection
Takashi Iwai <[email protected]>
ALSA: usx2y: Use snd_card_free_when_closed() at disconnection
Mingwei Zheng <[email protected]>
net: rfkill: gpio: Add check for clk_enable()
Yuan Can <[email protected]>
drm/amdkfd: Fix wrong usage of INIT_WORK()
Paolo Abeni <[email protected]>
selftests: net: really check for bg process completion
Zijian Zhang <[email protected]>
bpf, sockmap: Fix sk_msg_reset_curr
Zijian Zhang <[email protected]>
bpf, sockmap: Several fixes to bpf_msg_pop_data
Zijian Zhang <[email protected]>
bpf, sockmap: Several fixes to bpf_msg_push_data
Zijian Zhang <[email protected]>
selftests/bpf: Add push/pop checking for msg_verify_data in test_sockmap
Zijian Zhang <[email protected]>
selftests/bpf: Fix total_bytes in msg_loop_rx in test_sockmap
Liu Jian <[email protected]>
selftests, bpf: Add one test for sockmap with strparser
Zijian Zhang <[email protected]>
selftests/bpf: Fix SENDPAGE data logic in test_sockmap
Zijian Zhang <[email protected]>
selftests/bpf: Add txmsg_pass to pull/push/pop in test_sockmap
Maurice Lambert <[email protected]>
netlink: typographical error in nlmsg_type constants definition
Florian Westphal <[email protected]>
netfilter: nf_tables: must hold rcu read lock while iterating object type list
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: skip transaction if update object is not implemented
Zichen Xie <[email protected]>
drm/msm/dpu: cast crtc_clk calculation to u64 in _dpu_core_perf_calc_clk()
Yuan Can <[email protected]>
wifi: wfx: Fix error handling in wfx_core_init()
Lucas Stach <[email protected]>
drm/etnaviv: hold GPU lock across perfmon sampling
Doug Brown <[email protected]>
drm/etnaviv: fix power register offset on GC300
Xiaolei Wang <[email protected]>
drm/etnaviv: Request pages from DMA32 zone on addressing_limited
Jinjie Ruan <[email protected]>
drm/msm/adreno: Use IRQF_NO_AUTOEN flag in request_irq()
Steven Price <[email protected]>
drm/panfrost: Remove unused id_mask from struct panfrost_model
Dipendra Khadka <[email protected]>
octeontx2-pf: handle otx2_mbox_get_rsp errors in cn10k.c
Dipendra Khadka <[email protected]>
octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.c
Dipendra Khadka <[email protected]>
octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_common.c
Matthias Schiffer <[email protected]>
drm: fsl-dcu: enable PIXCLK on LS1021A
Alper Nebi Yasak <[email protected]>
wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan()
Zijian Zhang <[email protected]>
selftests/bpf: Fix txmsg_redir of test_txmsg_pull in test_sockmap
Zijian Zhang <[email protected]>
selftests/bpf: Fix msg_verify_data in test_sockmap
Tomi Valkeinen <[email protected]>
drm/bridge: tc358767: Fix link properties discovery
Hangbin Liu <[email protected]>
netdevsim: copy addresses for both in and out paths
Leon Romanovsky <[email protected]>
netdevsim: rely on XFRM state direction instead of flags
Leon Romanovsky <[email protected]>
xfrm: store and rely on direction to construct offload flags
Leon Romanovsky <[email protected]>
xfrm: rename xfrm_state_offload struct to allow reuse
Andrii Nakryiko <[email protected]>
libbpf: fix sym_is_subprog() logic for weak global subprogs
Yuan Chen <[email protected]>
bpf: Fix the xdp_adjust_tail sample prog issue
Tony Ambardar <[email protected]>
libbpf: Fix output .symtab byte-order during linking
Pin-yen Lin <[email protected]>
drm/bridge: anx7625: Drop EDID cache on bridge power off
Macpaul Lin <[email protected]>
ASoC: dt-bindings: mt6359: Update generic node name and dmic-mode
Shengjiu Wang <[email protected]>
ASoC: fsl_micfil: fix regmap_write_bits usage
Sascha Hauer <[email protected]>
ASoC: fsl_micfil: use GENMASK to define register bit fields
Sascha Hauer <[email protected]>
ASoC: fsl_micfil: do not define SHIFT/MASK for single bits
Sascha Hauer <[email protected]>
ASoC: fsl_micfil: Drop unnecessary register read
Igor Prusov <[email protected]>
dt-bindings: vendor-prefixes: Add NeoFidelity, Inc
Baochen Qiang <[email protected]>
wifi: ath10k: fix invalid VHT parameters in supported_vht_mcs_rate_nss2
Baochen Qiang <[email protected]>
wifi: ath10k: fix invalid VHT parameters in supported_vht_mcs_rate_nss1
Maíra Canal <[email protected]>
drm/v3d: Address race-condition in MMU flush
Jinjie Ruan <[email protected]>
drm/imx/ipuv3: Use IRQF_NO_AUTOEN flag in request_irq()
Jinjie Ruan <[email protected]>
drm/imx/dcss: Use IRQF_NO_AUTOEN flag in request_irq()
Jinjie Ruan <[email protected]>
wifi: mwifiex: Use IRQF_NO_AUTOEN flag in request_irq()
Jinjie Ruan <[email protected]>
wifi: p54: Use IRQF_NO_AUTOEN flag in request_irq()
Tomi Valkeinen <[email protected]>
drm/omap: Fix locking in omap_gem_new_dmabuf()
Tomi Valkeinen <[email protected]>
drm/omap: Fix possible NULL dereference
Jeongjun Park <[email protected]>
wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service()
Andy Shevchenko <[email protected]>
drm/mm: Mark drm_mm_interval_tree*() functions with __maybe_unused
Yao Zi <[email protected]>
platform/x86: panasonic-laptop: Return errno correctly in show callback
Qing Wang <[email protected]>
platform/x86: panasonic-laptop: Replace snprintf in show functions with sysfs_emit
Li Huafei <[email protected]>
media: atomisp: Add check for rgby_data memory allocation failure
Mauro Carvalho Chehab <[email protected]>
media: atomisp: remove #ifdef HAS_NO_HMEM
Sergey Senozhatsky <[email protected]>
media: venus: provide ctx queue lock for ioctl synchronization
Dikshita Agarwal <[email protected]>
venus: venc: add handling for VIDIOC_ENCODER_CMD
Dikshita Agarwal <[email protected]>
media: venus : Addition of support for VIDIOC_TRY_ENCODER_CMD
Viswanath Boma <[email protected]>
media: venus : Addition of EOS Event support for Encoder
Mansur Alisha Shaik <[email protected]>
media: venus: vdec: decoded picture buffer handling during reconfig sequence
Stanimir Varbanov <[email protected]>
media: venus: venc: Use pmruntime autosuspend
Luo Qiu <[email protected]>
firmware: arm_scpi: Check the DVFS OPP count returned by the firmware
Reinette Chatre <[email protected]>
selftests/resctrl: Protect against array overrun during iMC config parsing
Chen-Yu Tsai <[email protected]>
arm64: dts: mediatek: mt8183-kukui-jacuzzi: Add supplies for fixed regulators
Chen-Yu Tsai <[email protected]>
arm64: dts: mediatek: mt8183-kukui-jacuzzi: Fix DP bridge supply names
Hsin-Yi Wang <[email protected]>
arm64: dts: mt8183: jacuzzi: Move panel under aux-bus
Hsin-Yi Wang <[email protected]>
arm64: dts: mt8183: jacuzzi: remove unused ddc-i2c-bus
Andy Shevchenko <[email protected]>
regmap: irq: Set lockdep class for hierarchical IRQ domains
Jinjie Ruan <[email protected]>
spi: zynqmp-gqspi: Undo runtime PM changes at driver exit time
Breno Leitao <[email protected]>
spi: tegra210-quad: Avoid shift-out-of-bounds
Zhang Zekun <[email protected]>
pmdomain: ti-sci: Add missing of_node_put() for args.np
Andre Przywara <[email protected]>
ARM: dts: cubieboard4: Fix DCDC5 regulator constraints
Clark Wang <[email protected]>
pwm: imx27: Workaround of the pwm output bug when decrease the duty cycle
Daolong Zhu <[email protected]>
arm64: dts: mt8183: Damu: add i2c2's i2c-scl-internal-delay-ns
Daolong Zhu <[email protected]>
arm64: dts: mt8183: burnet: add i2c2's i2c-scl-internal-delay-ns
Daolong Zhu <[email protected]>
arm64: dts: mt8183: fennel: add i2c2's i2c-scl-internal-delay-ns
Chen Ridong <[email protected]>
cgroup/bpf: only cgroup v2 can be attached by bpf programs
Chen Ridong <[email protected]>
Revert "cgroup: Fix memory leak caused by missing cgroup_bpf_offline"
Chen-Yu Tsai <[email protected]>
arm64: dts: mediatek: mt8173-elm-hana: Add vdd-supply to second source trackpad
Hsin-Te Yuan <[email protected]>
arm64: dts: mt8183: kukui: Fix the address of eeprom at i2c4
Hsin-Te Yuan <[email protected]>
arm64: dts: mt8183: krane: Fix the address of eeprom at i2c4
Gregory Price <[email protected]>
tpm: fix signed/unsigned bug when checking event logs
Bartosz Golaszewski <[email protected]>
mmc: mmc_spi: drop buggy snprintf()
Dan Carpenter <[email protected]>
soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get()
Jinjie Ruan <[email protected]>
soc: ti: smartreflex: Use IRQF_NO_AUTOEN flag in request_irq()
Jinjie Ruan <[email protected]>
spi: spi-fsl-lpspi: Use IRQF_NO_AUTOEN flag in request_irq()
Alexander Stein <[email protected]>
spi: spi-fsl-lpspi: downgrade log level for pio mode
Mark Brown <[email protected]>
clocksource/drivers:sp804: Make user selectable
Marco Elver <[email protected]>
kcsan, seqlock: Fix incorrect assumption in read_seqbegin()
Marco Elver <[email protected]>
kcsan, seqlock: Support seqcount_latch_t
Peter Zijlstra <[email protected]>
seqlock/latch: Provide raw_read_seqcount_latch_retry()
Thomas Gleixner <[email protected]>
timekeeping: Consolidate fast timekeeper
Miguel Ojeda <[email protected]>
time: Fix references to _msecs_to_jiffies() handling of values
Christophe JAILLET <[email protected]>
crypto: cavium - Fix an error handling path in cpt_ucode_load_fw()
Chen Ridong <[email protected]>
crypto: bcm - add error check in the ahash_hmac_init function
Chen Ridong <[email protected]>
crypto: caam - add error check to caam_rsa_set_priv_key_form
Lifeng Zheng <[email protected]>
ACPI: CPPC: Fix _CPC register setting issue
Orange Kao <[email protected]>
EDAC/igen6: Avoid segmentation fault on module unload
Everest K.C <[email protected]>
crypto: cavium - Fix the if condition to exit loop after timeout
Yi Yang <[email protected]>
crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY
Priyanka Singh <[email protected]>
EDAC/fsl_ddr: Fix bad bit shift operations
Rafael J. Wysocki <[email protected]>
thermal: core: Initialize thermal zones before registering them
Ahsan Atta <[email protected]>
crypto: qat - remove faulty arbiter config reset
David Thompson <[email protected]>
EDAC/bluefield: Fix potential integer overflow
Yuan Can <[email protected]>
firmware: google: Unregister driver_info on failure
Christophe JAILLET <[email protected]>
crypto: caam - Fix the pointer passed to caam_qi_shutdown()
Thadeu Lima de Souza Cascardo <[email protected]>
hfsplus: don't query the device logical block size multiple times
Masahiro Yamada <[email protected]>
s390/syscalls: Avoid creation of arch/arch/ directory
Aleksandr Mishin <[email protected]>
acpi/arm64: Adjust error handling procedure in gtdt_parse_timer_block()
Masahiro Yamada <[email protected]>
arm64: fix .data.rel.ro size assertion when CONFIG_LTO_CLANG
Daniel Palmer <[email protected]>
m68k: mvme147: Reinstate early console
Geert Uytterhoeven <[email protected]>
m68k: mvme16x: Add and use "mvme16x.h"
Daniel Palmer <[email protected]>
m68k: mvme147: Fix SCSI controller IRQ numbers
Christoph Hellwig <[email protected]>
nvme-pci: fix freeing of the HMB descriptor table
David Disseldorp <[email protected]>
initramfs: avoid filename buffer overrun
Jonas Gorski <[email protected]>
mips: asm: fix warning when disabling MIPS_FP_SUPPORT
Yang Erkun <[email protected]>
brd: defer automatic disk creation until module initialization succeeds
Tetsuo Handa <[email protected]>
brd: remove brd_devices_mutex mutex
Vineeth Vijayan <[email protected]>
s390/cio: Do not unregister the subchannel based on DNV
Andre Przywara <[email protected]>
kselftest/arm64: mte: fix printf type warnings about longs
Borislav Petkov (AMD) <[email protected]>
x86/barrier: Do not serialize MSR accesses on AMD
Puranjay Mohan <[email protected]>
nvme: fix metadata handling in nvme-passthrough
Pali Rohár <[email protected]>
cifs: Fix buffer overflow when parsing NFS reparse points
Ard Biesheuvel <[email protected]>
x86/stackprotector: Work around strict Clang TLS symbol requirements
Paul E. McKenney <[email protected]>
rcu-tasks: Idle tasks on offline CPUs are in quiescent states
Breno Leitao <[email protected]>
ipmr: Fix access to mfc_cache_list without lock held
Harith G <[email protected]>
ARM: 9420/1: smp: Fix SMP for xip kernels
Eryk Zagorski <[email protected]>
ALSA: usb-audio: Fix Yamaha P-125 Quirk Entry
David Wang <[email protected]>
proc/softirqs: replace seq_printf with seq_put_decimal_ull_width
Luo Yifan <[email protected]>
ASoC: stm: Prevent potential division by zero in stm32_sai_get_clk_div()
Luo Yifan <[email protected]>
ASoC: stm: Prevent potential division by zero in stm32_sai_mclk_round_rate()
Alexander Hölzl <[email protected]>
can: j1939: fix error in J1939 documentation.
Kurt Borja <[email protected]>
platform/x86: dell-wmi-base: Handle META key Lock/Unlock events
Kurt Borja <[email protected]>
platform/x86: dell-smbios-base: Extends support to Alienware products
Mikhail Rudenko <[email protected]>
regulator: rk808: Add apply_bit for BUCK3 on RK809
Charles Han <[email protected]>
soc: qcom: Add check devm_kasprintf() returned value
Benoît Monin <[email protected]>
net: usb: qmi_wwan: add Quectel RG650V
Arnd Bergmann <[email protected]>
x86/amd_nb: Fix compile-testing without CONFIG_AMD_NB
Piyush Raj Chouhan <[email protected]>
ALSA: hda/realtek: Add subwoofer quirk for Infinix ZERO BOOK 13
Li Zhijian <[email protected]>
selftests/watchdog-test: Fix system accidentally reset after watchdog-test
Benjamin Große <[email protected]>
usb: add support for new USB device ID 0x17EF:0x3098 for the r8152 driver
Ben Greear <[email protected]>
mac80211: fix user-power when emulating chanctx
Daniel Gabay <[email protected]>
wifi: iwlwifi: mvm: Use the sync timepoint API in suspend
Hans de Goede <[email protected]>
ASoC: Intel: sst: Support LPE0F28 ACPI HID
Hans de Goede <[email protected]>
ASoC: Intel: bytcr_rt5640: Add DMI quirk for Vexia Edu Atla 10 tablet
Hans de Goede <[email protected]>
ASoC: Intel: bytcr_rt5640: Add support for non ACPI instantiated codec
Trond Myklebust <[email protected]>
NFS: nfs_async_write_reschedule_io must not recurse into the writeback code
Lorenzo Stoakes <[email protected]>
mm: resolve faulty mmap_region() error path behaviour
Lorenzo Stoakes <[email protected]>
mm: refactor arch_calc_vm_flag_bits() and arm64 MTE handling
Lorenzo Stoakes <[email protected]>
mm: unconditionally close VMAs on error
Lorenzo Stoakes <[email protected]>
mm: avoid unsafe VMA hook invocation when error arises on mmap hook
Andrew Morton <[email protected]>
mm: revert "mm: shmem: fix data-race in shmem_getattr()"
Paolo Abeni <[email protected]>
mptcp: cope racing subflow creation in mptcp_rcv_space_adjust
Chuck Lever <[email protected]>
NFSD: Never decrement pending_async_copies on error
Chuck Lever <[email protected]>
NFSD: Initialize struct nfsd4_copy earlier
Chuck Lever <[email protected]>
NFSD: Limit the number of concurrent async COPY operations
Chuck Lever <[email protected]>
NFSD: Async COPY result needs to return a write verifier
Dai Ngo <[email protected]>
NFSD: initialize copy->cp_clp early in nfsd4_copy for use by trace point
Mauro Carvalho Chehab <[email protected]>
media: dvbdev: fix the logic when DVB_DYNAMIC_MINORS is not set
Jiri Olsa <[email protected]>
lib/buildid: Fix build ID parsing logic
Andre Przywara <[email protected]>
mmc: sunxi-mmc: Fix A100 compatible description
Samuel Holland <[email protected]>
mmc: sunxi-mmc: Add D1 MMC variant
Francesco Dolcini <[email protected]>
drm/bridge: tc358768: Fix DSI command tx
Aurelien Jarno <[email protected]>
Revert "mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K"
Ryusuke Konishi <[email protected]>
nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint
Dmitry Antipov <[email protected]>
ocfs2: fix UBSAN warning in ocfs2_verify_volume()
Ryusuke Konishi <[email protected]>
nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint
Sean Christopherson <[email protected]>
KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN
Sean Christopherson <[email protected]>
KVM: nVMX: Treat vpid01 as current if L2 is active, but with VPID disabled
Si-Wei Liu <[email protected]>
vdpa/mlx5: Fix PA offset with unaligned starting iotlb map
Dmitry Antipov <[email protected]>
ocfs2: uncache inode which has failed entering the group
Jinjiang Tu <[email protected]>
mm: fix NULL pointer dereference in alloc_pages_bulk_noprof
Baoquan He <[email protected]>
x86/mm: Fix a kdump kernel failure on SME system when CONFIG_IMA_KEXEC=y
Harith G <[email protected]>
ARM: 9419/1: mm: Fix kernel memory mapping for xip kernels
Wei Fang <[email protected]>
samples: pktgen: correct dev to DEV
Moshe Shemesh <[email protected]>
net/mlx5e: CT: Fix null-ptr-deref in add rule err flow
Dragos Tatulea <[email protected]>
net/mlx5e: kTLS, Fix incorrect page refcounting
Mark Bloch <[email protected]>
net/mlx5: fs, lock FTE when checking if active
Andy Yan <[email protected]>
drm/rockchip: vop: Fix a dereferenced before check warning
Jakub Kicinski <[email protected]>
netlink: terminate outstanding dump on socket close
Gabor Juhos <[email protected]>
clk: qcom: gcc-qcs404: fix initial rate of GPLL3
Michal Vokáč <[email protected]>
leds: lp55xx: Remove redundant test for invalid channel number
Mostafa Saleh <[email protected]>
iommu/io-pgtable-arm: Fix stage-2 map/unmap for concatenated tables
MengEn Sun <[email protected]>
vmstat: call fold_vm_zone_numa_events() before show per zone NUMA event
guoweikang <[email protected]>
ftrace: Fix regression with module command in stack_trace_filter
Vasiliy Kovalev <[email protected]>
ovl: Filter invalid inodes with missing lookup function
Thadeu Lima de Souza Cascardo <[email protected]>
media: uvcvideo: Require entities to have a non-zero unique ID
Ricardo Ribalda <[email protected]>
media: uvcvideo: Stop stream during unregister
Gaosheng Cui <[email protected]>
media: platform: allegro-dvt: Fix possible memory leak in allocate_buffers_internal()
Jinjie Ruan <[email protected]>
media: gspca: ov534-ov772x: Fix off-by-one error in set_frame_rate()
Jinjie Ruan <[email protected]>
media: venus: Fix pm_runtime_set_suspended() with runtime pm enabled
Li Zetao <[email protected]>
media: ts2020: fix null-ptr-deref in ts2020_probe()
Ming Qian <[email protected]>
media: imx-jpeg: Ensure power suppliers be suspended before detach them
Alexander Shiyan <[email protected]>
media: i2c: tc358743: Fix crash in the probe error path when using polling
Ming Qian <[email protected]>
media: imx-jpeg: Set video drvdata before register video device
Dragan Simic <[email protected]>
arm64: dts: allwinner: pinephone: Add mount matrix to accelerometer
-------------
Diffstat:
Documentation/ABI/testing/sysfs-bus-pci | 11 + .../devicetree/bindings/clock/adi,axi-clkgen.yaml | 22 +- .../devicetree/bindings/serial/rs485.yaml | 19 +- .../devicetree/bindings/sound/mt6359.yaml | 10 +- .../devicetree/bindings/vendor-prefixes.yaml | 2 + Documentation/filesystems/mount_api.rst | 3 +- Documentation/locking/seqlock.rst | 2 +- Documentation/networking/j1939.rst | 2 +- Makefile | 4 +- arch/arm/boot/dts/sun9i-a80-cubieboard4.dts | 4 +- arch/arm/kernel/head.S | 12 +- arch/arm/kernel/psci_smp.c | 7 + arch/arm/mm/idmap.c | 7 + arch/arm/mm/mmu.c | 34 +- .../boot/dts/allwinner/sun50i-a64-pinephone.dtsi | 3 + arch/arm64/boot/dts/mediatek/mt8173-elm-hana.dtsi | 8 + .../dts/mediatek/mt8183-kukui-jacuzzi-burnet.dts | 3 + .../dts/mediatek/mt8183-kukui-jacuzzi-damu.dts | 3 + .../dts/mediatek/mt8183-kukui-jacuzzi-fennel.dtsi | 3 + .../boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi | 57 +- .../boot/dts/mediatek/mt8183-kukui-kakadu.dtsi | 4 +- .../boot/dts/mediatek/mt8183-kukui-kodama.dtsi | 4 +- .../boot/dts/mediatek/mt8183-kukui-krane.dtsi | 4 +- arch/arm64/include/asm/mman.h | 10 +- arch/arm64/kernel/fpsimd.c | 1 + arch/arm64/kernel/process.c | 2 +- arch/arm64/kernel/ptrace.c | 6 +- arch/arm64/kernel/smccc-call.S | 35 +- arch/arm64/kernel/vmlinux.lds.S | 6 +- arch/arm64/kvm/pmu-emul.c | 1 - arch/arm64/kvm/vgic/vgic-its.c | 32 +- arch/arm64/kvm/vgic/vgic.h | 24 + arch/m68k/coldfire/device.c | 8 +- arch/m68k/include/asm/mcfgpio.h | 2 +- arch/m68k/include/asm/mvme147hw.h | 4 +- arch/m68k/kernel/early_printk.c | 9 +- arch/m68k/mvme147/config.c | 30 + arch/m68k/mvme147/mvme147.h | 6 + arch/m68k/mvme16x/config.c | 2 + arch/m68k/mvme16x/mvme16x.h | 6 + arch/mips/boot/dts/loongson/ls7a-pch.dtsi | 73 +- arch/mips/include/asm/switch_to.h | 2 +- arch/parisc/Kconfig | 1 + arch/parisc/include/asm/cache.h | 11 +- arch/powerpc/include/asm/dtl.h | 4 +- arch/powerpc/include/asm/sstep.h | 5 - arch/powerpc/include/asm/vdso.h | 1 + arch/powerpc/kernel/prom_init.c | 29 +- arch/powerpc/kernel/setup_64.c | 1 + arch/powerpc/kexec/file_load_64.c | 9 +- arch/powerpc/lib/sstep.c | 12 +- arch/powerpc/mm/fault.c | 10 +- arch/powerpc/platforms/pseries/dtl.c | 8 +- arch/powerpc/platforms/pseries/lpar.c | 8 +- arch/s390/kernel/entry.S | 4 + arch/s390/kernel/kprobes.c | 6 + arch/s390/kernel/perf_cpum_sf.c | 4 +- arch/s390/kernel/syscalls/Makefile | 2 +- arch/sh/kernel/cpu/proc.c | 2 +- arch/um/drivers/net_kern.c | 2 +- arch/um/drivers/ubd_kern.c | 2 +- arch/um/drivers/vector_kern.c | 3 +- arch/um/kernel/physmem.c | 6 +- arch/um/kernel/process.c | 2 +- arch/um/kernel/sysrq.c | 2 +- arch/x86/Makefile | 3 +- arch/x86/crypto/aegis128-aesni-asm.S | 29 +- arch/x86/entry/entry.S | 15 + arch/x86/events/intel/pt.c | 11 +- arch/x86/events/intel/pt.h | 2 + arch/x86/include/asm/amd_nb.h | 5 +- arch/x86/include/asm/asm-prototypes.h | 3 + arch/x86/include/asm/barrier.h | 18 - arch/x86/include/asm/cpufeatures.h | 1 + arch/x86/include/asm/processor.h | 18 + arch/x86/kernel/cpu/amd.c | 3 + arch/x86/kernel/cpu/common.c | 9 + arch/x86/kernel/cpu/hygon.c | 3 + arch/x86/kernel/vmlinux.lds.S | 3 + arch/x86/kvm/vmx/nested.c | 30 +- arch/x86/kvm/vmx/vmx.c | 6 +- arch/x86/mm/ioremap.c | 6 +- arch/x86/pci/acpi.c | 119 + block/blk-mq.c | 6 + block/blk-mq.h | 13 + crypto/pcrypt.c | 12 +- drivers/acpi/arm64/gtdt.c | 2 +- drivers/acpi/cppc_acpi.c | 1 - drivers/base/bus.c | 2 + drivers/base/core.c | 20 + drivers/base/regmap/regmap-irq.c | 4 + drivers/base/regmap/regmap.c | 12 + drivers/block/brd.c | 99 +- drivers/clk/clk-axi-clkgen.c | 22 +- drivers/clk/imx/clk-lpcg-scu.c | 37 +- drivers/clk/imx/clk-scu.c | 2 +- drivers/clk/qcom/gcc-qcs404.c | 1 + drivers/clk/zynqmp/divider.c | 66 +- drivers/clocksource/Kconfig | 3 +- drivers/comedi/comedi_fops.c | 12 + drivers/counter/stm32-timer-cnt.c | 16 +- drivers/cpufreq/loongson2_cpufreq.c | 4 +- drivers/cpufreq/mediatek-cpufreq-hw.c | 2 +- drivers/crypto/bcm/cipher.c | 5 +- drivers/crypto/caam/caampkc.c | 11 +- drivers/crypto/caam/qi.c | 2 +- drivers/crypto/cavium/cpt/cptpf_main.c | 6 +- drivers/crypto/hisilicon/qm.c | 51 +- drivers/crypto/qat/qat_common/adf_hw_arbiter.c | 4 - drivers/dma-buf/dma-fence-array.c | 28 +- drivers/edac/bluefield_edac.c | 2 +- drivers/edac/fsl_ddr_edac.c | 22 +- drivers/edac/igen6_edac.c | 2 + drivers/firmware/arm_scpi.c | 3 + drivers/firmware/efi/tpm.c | 17 +- drivers/firmware/google/gsmi.c | 6 +- drivers/firmware/smccc/smccc.c | 4 - drivers/gpio/gpio-exar.c | 10 +- drivers/gpio/gpio-grgpio.c | 26 +- drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 48 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 5 +- drivers/gpu/drm/amd/amdgpu/vega20_ih.c | 27 + drivers/gpu/drm/amd/amdkfd/kfd_process.c | 5 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h | 2 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | 14 + drivers/gpu/drm/bridge/analogix/anx7625.c | 2 + drivers/gpu/drm/bridge/tc358767.c | 7 + drivers/gpu/drm/bridge/tc358768.c | 21 +- drivers/gpu/drm/drm_mm.c | 2 +- drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 + drivers/gpu/drm/etnaviv/etnaviv_buffer.c | 3 +- drivers/gpu/drm/etnaviv/etnaviv_drv.c | 10 + drivers/gpu/drm/etnaviv/etnaviv_dump.c | 7 +- drivers/gpu/drm/etnaviv/etnaviv_gpu.c | 48 +- drivers/gpu/drm/etnaviv/etnaviv_gpu.h | 21 + drivers/gpu/drm/fsl-dcu/Kconfig | 1 + drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c | 15 + drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.h | 3 + drivers/gpu/drm/imx/dcss/dcss-crtc.c | 6 +- drivers/gpu/drm/imx/ipuv3-crtc.c | 6 +- drivers/gpu/drm/mcde/mcde_drv.c | 1 + drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 4 +- drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c | 2 +- drivers/gpu/drm/omapdrm/dss/base.c | 25 +- drivers/gpu/drm/omapdrm/dss/omapdss.h | 3 +- drivers/gpu/drm/omapdrm/omap_drv.c | 4 +- drivers/gpu/drm/omapdrm/omap_gem.c | 10 +- drivers/gpu/drm/panel/panel-simple.c | 28 + drivers/gpu/drm/panfrost/panfrost_gpu.c | 1 - drivers/gpu/drm/radeon/r600_cs.c | 2 +- drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 8 +- drivers/gpu/drm/sti/sti_cursor.c | 3 + drivers/gpu/drm/sti/sti_gdp.c | 3 + drivers/gpu/drm/sti/sti_hqvdp.c | 3 + drivers/gpu/drm/sti/sti_mixer.c | 2 +- drivers/gpu/drm/v3d/v3d_mmu.c | 29 +- drivers/gpu/drm/v3d/v3d_perfmon.c | 2 +- drivers/gpu/drm/vc4/vc4_hvs.c | 11 + drivers/hid/wacom_sys.c | 3 +- drivers/hid/wacom_wac.c | 4 +- drivers/hwmon/tps23861.c | 2 +- drivers/i3c/master.c | 5 +- drivers/i3c/master/mipi-i3c-hci/dma.c | 2 +- drivers/iio/adc/ad7780.c | 2 +- drivers/iio/light/al3010.c | 11 +- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 7 +- drivers/infiniband/hw/bnxt_re/qplib_fp.h | 2 +- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 2 +- drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 1 + drivers/infiniband/hw/hns/hns_roce_mr.c | 7 +- drivers/iommu/arm/arm-smmu/arm-smmu.c | 11 + drivers/iommu/io-pgtable-arm.c | 18 +- drivers/leds/led-class.c | 14 +- drivers/leds/leds-lp55xx-common.c | 3 - drivers/mailbox/arm_mhuv2.c | 8 +- drivers/md/bcache/super.c | 2 +- drivers/md/dm-thin.c | 1 + drivers/media/dvb-core/dvbdev.c | 15 +- drivers/media/dvb-frontends/ts2020.c | 8 +- drivers/media/i2c/adv7604.c | 5 +- drivers/media/i2c/adv7842.c | 13 +- drivers/media/i2c/tc358743.c | 4 +- drivers/media/platform/allegro-dvt/allegro-core.c | 4 +- drivers/media/platform/imx-jpeg/mxc-jpeg.c | 4 +- drivers/media/platform/qcom/venus/core.c | 2 +- drivers/media/platform/qcom/venus/core.h | 12 + drivers/media/platform/qcom/venus/helpers.c | 53 +- drivers/media/platform/qcom/venus/helpers.h | 3 + drivers/media/platform/qcom/venus/vdec.c | 11 +- drivers/media/platform/qcom/venus/venc.c | 191 +- drivers/media/radio/wl128x/fmdrv_common.c | 3 +- drivers/media/test-drivers/vivid/vivid-vid-cap.c | 15 +- drivers/media/usb/cx231xx/cx231xx-cards.c | 2 + drivers/media/usb/gspca/ov534.c | 2 +- drivers/media/usb/uvc/uvc_driver.c | 113 +- drivers/media/v4l2-core/v4l2-dv-timings.c | 132 +- drivers/message/fusion/mptsas.c | 4 +- drivers/mfd/da9052-spi.c | 2 +- drivers/mfd/intel_soc_pmic_bxtwc.c | 208 +- drivers/mfd/rt5033.c | 4 +- drivers/mfd/tps65010.c | 8 +- drivers/misc/apds990x.c | 12 +- drivers/misc/eeprom/eeprom_93cx6.c | 10 + drivers/mmc/core/bus.c | 2 + drivers/mmc/core/core.c | 3 + drivers/mmc/host/dw_mmc.c | 4 +- drivers/mmc/host/mmc_spi.c | 9 +- drivers/mmc/host/mtk-sd.c | 9 +- drivers/mmc/host/sdhci-pci-core.c | 72 + drivers/mmc/host/sdhci-pci.h | 1 + drivers/mmc/host/sunxi-mmc.c | 15 +- drivers/mtd/nand/raw/atmel/pmecc.c | 8 +- drivers/mtd/nand/raw/atmel/pmecc.h | 2 - drivers/mtd/spi-nor/core.c | 2 +- drivers/mtd/ubi/attach.c | 12 +- drivers/mtd/ubi/wl.c | 9 +- drivers/net/can/at91_can.c | 6 - drivers/net/can/c_can/c_can_main.c | 31 +- drivers/net/can/cc770/cc770.c | 3 - drivers/net/can/dev/dev.c | 6 +- drivers/net/can/dev/rx-offload.c | 6 +- drivers/net/can/ifi_canfd/ifi_canfd.c | 63 +- drivers/net/can/kvaser_pciefd.c | 5 - drivers/net/can/m_can/m_can.c | 38 +- drivers/net/can/mscan/mscan.c | 9 +- drivers/net/can/pch_can.c | 3 - drivers/net/can/peak_canfd/peak_canfd.c | 4 - drivers/net/can/rcar/rcar_can.c | 6 +- drivers/net/can/rcar/rcar_canfd.c | 4 - drivers/net/can/sja1000/sja1000.c | 2 - drivers/net/can/sun4i_can.c | 29 +- drivers/net/can/usb/ems_usb.c | 60 +- drivers/net/can/usb/esd_usb2.c | 2 - drivers/net/can/usb/etas_es58x/es58x_core.c | 7 - drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c | 2 - drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 8 - drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 4 - drivers/net/can/usb/peak_usb/pcan_usb.c | 2 - drivers/net/can/usb/peak_usb/pcan_usb_core.c | 13 + drivers/net/can/usb/peak_usb/pcan_usb_core.h | 1 + drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 12 +- drivers/net/can/usb/peak_usb/pcan_usb_pro.c | 2 - drivers/net/can/usb/ucan.c | 6 +- drivers/net/can/usb/usb_8dev.c | 2 - drivers/net/can/xilinx_can.c | 9 +- drivers/net/dsa/microchip/ksz8795.c | 18 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 8 +- drivers/net/ethernet/broadcom/tg3.c | 3 + drivers/net/ethernet/freescale/fec_mpc52xx_phy.c | 2 +- .../net/ethernet/freescale/fs_enet/mii-bitbang.c | 2 +- drivers/net/ethernet/google/gve/gve_main.c | 7 + drivers/net/ethernet/google/gve/gve_rx.c | 4 - drivers/net/ethernet/google/gve/gve_tx.c | 4 - drivers/net/ethernet/intel/igb/igb_main.c | 4 + drivers/net/ethernet/marvell/octeontx2/af/rpm.c | 2 +- drivers/net/ethernet/marvell/octeontx2/nic/cn10k.c | 5 + .../ethernet/marvell/octeontx2/nic/otx2_common.c | 4 + .../ethernet/marvell/octeontx2/nic/otx2_ethtool.c | 10 + drivers/net/ethernet/marvell/pxa168_eth.c | 14 +- drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c | 2 +- .../ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c | 8 +- drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 19 +- drivers/net/ethernet/qlogic/qed/qed_mcp.c | 4 +- drivers/net/ethernet/realtek/r8169_main.c | 14 +- drivers/net/ethernet/rocker/rocker_main.c | 2 +- .../net/ethernet/stmicro/stmmac/dwmac-socfpga.c | 2 + drivers/net/geneve.c | 2 +- drivers/net/mdio/mdio-ipq4019.c | 5 +- drivers/net/netdevsim/ipsec.c | 11 +- drivers/net/usb/lan78xx.c | 11 +- drivers/net/usb/qmi_wwan.c | 1 + drivers/net/usb/r8152.c | 1 + drivers/net/wireless/ath/ath10k/mac.c | 4 +- drivers/net/wireless/ath/ath5k/pci.c | 2 + drivers/net/wireless/ath/ath9k/htc_hst.c | 3 + .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 2 +- drivers/net/wireless/intel/ipw2x00/libipw_rx.c | 8 +- drivers/net/wireless/intel/iwlwifi/fw/init.c | 4 +- drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 2 + drivers/net/wireless/intersil/p54/p54spi.c | 4 +- drivers/net/wireless/marvell/mwifiex/fw.h | 2 +- drivers/net/wireless/marvell/mwifiex/main.c | 4 +- drivers/nvdimm/dax_devs.c | 4 +- drivers/nvdimm/nd.h | 7 + drivers/nvme/host/ioctl.c | 7 +- drivers/nvme/host/pci.c | 16 +- drivers/pci/controller/dwc/pci-keystone.c | 11 + drivers/pci/controller/pcie-rockchip-ep.c | 16 +- drivers/pci/controller/pcie-rockchip.h | 4 + drivers/pci/hotplug/cpqphp_pci.c | 19 +- drivers/pci/pci-sysfs.c | 26 + drivers/pci/pci.c | 7 +- drivers/pci/pci.h | 1 + drivers/pci/probe.c | 30 +- drivers/pci/quirks.c | 15 +- drivers/pci/slot.c | 4 +- drivers/pinctrl/freescale/Kconfig | 2 +- drivers/pinctrl/pinctrl-k210.c | 2 +- drivers/pinctrl/pinctrl-zynqmp.c | 1 - drivers/pinctrl/qcom/pinctrl-spmi-gpio.c | 2 + drivers/platform/chrome/cros_ec_typec.c | 1 + drivers/platform/x86/dell/dell-smbios-base.c | 1 + drivers/platform/x86/dell/dell-wmi-base.c | 6 + drivers/platform/x86/intel/bxtwc_tmu.c | 22 +- drivers/platform/x86/panasonic-laptop.c | 26 +- drivers/power/supply/bq27xxx_battery.c | 37 +- drivers/power/supply/power_supply_core.c | 2 - drivers/ptp/ptp_clock.c | 3 +- drivers/pwm/pwm-imx27.c | 98 +- drivers/regulator/rk808-regulator.c | 2 + drivers/remoteproc/qcom_q6v5_mss.c | 3 + drivers/rpmsg/qcom_glink_native.c | 175 +- drivers/rtc/interface.c | 7 +- drivers/rtc/rtc-ab-eoz9.c | 7 - drivers/rtc/rtc-abx80x.c | 2 +- drivers/rtc/rtc-st-lpc.c | 5 +- drivers/s390/cio/cio.c | 6 +- drivers/s390/cio/device.c | 18 +- drivers/scsi/bfa/bfad.c | 3 +- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 1 + drivers/scsi/qedf/qedf_main.c | 1 + drivers/scsi/qedi/qedi_main.c | 1 + drivers/scsi/qla2xxx/qla_attr.c | 1 + drivers/scsi/qla2xxx/qla_bsg.c | 124 +- drivers/scsi/qla2xxx/qla_mid.c | 1 + drivers/scsi/qla2xxx/qla_os.c | 15 +- drivers/scsi/scsi_lib.c | 21 +- drivers/scsi/st.c | 31 +- drivers/scsi/ufs/ufs-exynos.c | 16 +- drivers/scsi/ufs/ufs-sysfs.c | 6 + drivers/sh/intc/core.c | 2 +- drivers/soc/fsl/rcpm.c | 1 + drivers/soc/imx/soc-imx8m.c | 107 +- drivers/soc/qcom/qcom-geni-se.c | 3 +- drivers/soc/qcom/socinfo.c | 8 +- drivers/soc/ti/smartreflex.c | 4 +- drivers/soc/ti/ti_sci_pm_domains.c | 4 + drivers/spi/atmel-quadspi.c | 2 +- drivers/spi/spi-fsl-lpspi.c | 14 +- drivers/spi/spi-mpc52xx.c | 1 + drivers/spi/spi-tegra210-quad.c | 2 +- drivers/spi/spi-zynqmp-gqspi.c | 2 + drivers/spi/spi.c | 13 +- .../pci/isp/kernels/bh/bh_2/ia_css_bh.host.c | 2 - .../raw_aa_binning_1.0/ia_css_raa.host.c | 2 - .../pci/isp/kernels/s3a/s3a_1.0/ia_css_s3a.host.c | 5 - .../media/atomisp/pci/runtime/binary/src/binary.c | 4 - drivers/staging/media/atomisp/pci/sh_css_params.c | 12 +- drivers/staging/wfx/main.c | 17 +- drivers/thermal/thermal_core.c | 2 +- drivers/tty/serial/8250/8250_omap.c | 4 +- drivers/tty/serial/amba-pl011.c | 79 +- drivers/tty/tty_ldisc.c | 2 +- drivers/usb/chipidea/udc.c | 2 +- drivers/usb/dwc3/gadget.c | 15 +- drivers/usb/gadget/composite.c | 18 +- drivers/usb/host/ehci-spear.c | 7 +- drivers/usb/host/xhci-dbgcap.c | 135 +- drivers/usb/host/xhci-dbgcap.h | 2 +- drivers/usb/host/xhci-ring.c | 18 +- drivers/usb/misc/chaoskey.c | 35 +- drivers/usb/misc/iowarrior.c | 50 +- drivers/usb/misc/yurex.c | 5 +- drivers/usb/typec/tcpm/wcove.c | 4 - drivers/vdpa/mlx5/core/mr.c | 12 +- drivers/vfio/pci/vfio_pci_config.c | 16 +- drivers/video/fbdev/sh7760fb.c | 11 +- drivers/watchdog/iTCO_wdt.c | 21 +- drivers/watchdog/mtk_wdt.c | 6 + drivers/watchdog/rti_wdt.c | 3 +- drivers/xen/xenbus/xenbus_probe.c | 8 +- fs/btrfs/ctree.c | 10 +- fs/btrfs/extent-tree.c | 1 - fs/btrfs/inode.c | 1 + fs/btrfs/ref-verify.c | 1 + fs/btrfs/volumes.c | 38 +- fs/cifs/smb2ops.c | 6 + fs/eventpoll.c | 6 +- fs/exfat/namei.c | 1 + fs/ext4/fsmap.c | 54 +- fs/ext4/mballoc.c | 18 +- fs/ext4/mballoc.h | 1 + fs/ext4/super.c | 8 +- fs/f2fs/inode.c | 4 +- fs/f2fs/segment.c | 74 +- fs/f2fs/segment.h | 6 - fs/hfsplus/hfsplus_fs.h | 3 +- fs/hfsplus/wrapper.c | 2 + fs/jffs2/compr_rtime.c | 3 + fs/jffs2/erase.c | 7 +- fs/jfs/jfs_dmap.c | 6 + fs/jfs/jfs_dtree.c | 15 + fs/jfs/xattr.c | 2 +- fs/ksmbd/server.c | 4 +- fs/nfs/internal.h | 2 +- fs/nfs/nfs4proc.c | 8 +- fs/nfs/write.c | 2 - fs/nfsd/export.c | 5 +- fs/nfsd/netns.h | 1 + fs/nfsd/nfs4callback.c | 16 +- fs/nfsd/nfs4proc.c | 43 +- fs/nfsd/nfs4recover.c | 3 +- fs/nfsd/nfs4state.c | 20 + fs/nfsd/xdr4.h | 1 + fs/nilfs2/btnode.c | 2 - fs/nilfs2/dir.c | 2 +- fs/nilfs2/gcinode.c | 4 +- fs/nilfs2/mdt.c | 1 - fs/nilfs2/page.c | 2 +- fs/notify/fsnotify.c | 23 +- fs/ocfs2/aops.h | 2 + fs/ocfs2/dlmglue.c | 1 + fs/ocfs2/file.c | 4 + fs/ocfs2/localalloc.c | 19 - fs/ocfs2/namei.c | 4 +- fs/ocfs2/resize.c | 2 + fs/ocfs2/super.c | 13 +- fs/overlayfs/inode.c | 7 +- fs/overlayfs/util.c | 3 + fs/proc/softirqs.c | 2 +- fs/quota/dquot.c | 2 + fs/ubifs/super.c | 6 +- fs/ubifs/tnc_commit.c | 2 + fs/unicode/mkutf8data.c | 70 + fs/unicode/utf8data.h_shipped | 6703 ++++++++++---------- fs/xfs/libxfs/xfs_sb.c | 10 +- fs/xfs/xfs_log.c | 17 - include/linux/arm-smccc.h | 30 +- include/linux/blkdev.h | 2 +- include/linux/device.h | 2 + include/linux/eeprom_93cx6.h | 11 + include/linux/eventpoll.h | 2 +- include/linux/jiffies.h | 2 +- include/linux/leds.h | 2 +- include/linux/lockdep.h | 2 +- include/linux/mman.h | 7 +- include/linux/netpoll.h | 2 +- include/linux/pci.h | 6 + include/linux/rbtree_latch.h | 2 +- include/linux/seqlock.h | 107 +- include/linux/sunrpc/xprtsock.h | 1 + include/linux/util_macros.h | 56 +- include/media/v4l2-dv-timings.h | 18 +- include/net/xfrm.h | 16 +- include/sound/pcm.h | 20 +- include/uapi/linux/rtnetlink.h | 2 +- init/initramfs.c | 15 + kernel/bpf/devmap.c | 6 +- kernel/bpf/lpm_trie.c | 27 +- kernel/cgroup/cgroup.c | 21 +- kernel/dma/debug.c | 8 +- kernel/kcsan/debugfs.c | 74 +- kernel/printk/printk.c | 2 +- kernel/rcu/tasks.h | 2 +- kernel/sched/core.c | 4 +- kernel/sched/fair.c | 26 +- kernel/sched/sched.h | 8 +- kernel/time/sched_clock.c | 2 +- kernel/time/time.c | 2 +- kernel/time/timekeeping.c | 24 +- kernel/trace/ftrace.c | 3 + kernel/trace/trace_clock.c | 2 +- kernel/trace/trace_eprobe.c | 5 + kernel/trace/trace_event_perf.c | 6 + kernel/trace/tracing_map.c | 6 +- lib/buildid.c | 2 +- lib/string_helpers.c | 2 +- mm/damon/vaddr-test.h | 94 +- mm/damon/vaddr.c | 4 +- mm/internal.h | 19 + mm/mmap.c | 86 +- mm/nommu.c | 9 +- mm/page_alloc.c | 3 +- mm/shmem.c | 5 - mm/util.c | 33 + mm/vmstat.c | 1 + net/9p/trans_xen.c | 9 +- net/bluetooth/hci_core.c | 13 +- net/bluetooth/hci_event.c | 2 +- net/bluetooth/hci_sysfs.c | 15 +- net/bluetooth/l2cap_core.c | 9 - net/bluetooth/l2cap_sock.c | 1 + net/bluetooth/rfcomm/sock.c | 10 +- net/can/af_can.c | 1 + net/can/j1939/transport.c | 2 +- net/core/filter.c | 88 +- net/core/neighbour.c | 1 + net/core/netpoll.c | 2 +- net/core/skmsg.c | 4 +- net/dccp/feat.c | 6 +- net/ethtool/bitset.c | 48 +- net/hsr/hsr_device.c | 4 +- net/hsr/hsr_forward.c | 2 + net/ieee802154/socket.c | 12 +- net/ipv4/af_inet.c | 22 +- net/ipv4/fou.c | 2 +- net/ipv4/inet_connection_sock.c | 2 +- net/ipv4/ipmr_base.c | 3 +- net/ipv4/tcp_bpf.c | 11 +- net/ipv6/af_inet6.c | 22 +- net/ipv6/route.c | 6 +- net/mac80211/main.c | 2 + net/mptcp/protocol.c | 3 +- net/netfilter/ipset/ip_set_bitmap_ip.c | 7 +- net/netfilter/ipset/ip_set_core.c | 5 + net/netfilter/ipvs/ip_vs_proto.c | 4 +- net/netfilter/nf_tables_api.c | 19 +- net/netfilter/nft_set_hash.c | 16 + net/netfilter/xt_LED.c | 4 +- net/netlink/af_netlink.c | 31 +- net/netlink/af_netlink.h | 2 - net/packet/af_packet.c | 12 +- net/rfkill/rfkill-gpio.c | 8 +- net/sched/cls_flower.c | 5 +- net/sched/sch_cbs.c | 2 +- net/sched/sch_tbf.c | 18 +- net/smc/af_smc.c | 57 + net/smc/smc.h | 6 +- net/sunrpc/cache.c | 4 +- net/sunrpc/clnt.c | 33 +- net/sunrpc/xprtrdma/svc_rdma.c | 40 +- net/sunrpc/xprtrdma/svc_rdma_recvfrom.c | 8 +- net/sunrpc/xprtsock.c | 23 +- net/tipc/udp_media.c | 2 +- net/xdp/xskmap.c | 2 +- net/xfrm/xfrm_device.c | 10 +- net/xfrm/xfrm_state.c | 4 +- net/xfrm/xfrm_user.c | 5 +- samples/bpf/test_cgrp2_sock.c | 4 +- samples/bpf/xdp_adjust_tail_kern.c | 1 + samples/pktgen/pktgen_sample01_simple.sh | 2 +- scripts/mod/file2alias.c | 5 +- scripts/mod/modpost.c | 6 +- security/apparmor/capability.c | 2 + security/apparmor/policy_unpack_test.c | 6 + security/integrity/ima/ima_api.c | 16 +- security/integrity/ima/ima_template_lib.c | 17 +- sound/core/oss/pcm_oss.c | 42 +- sound/core/pcm.c | 9 +- sound/core/pcm_compat.c | 4 +- sound/core/pcm_lib.c | 16 +- sound/core/pcm_native.c | 132 +- sound/hda/intel-dsp-config.c | 4 + sound/pci/hda/patch_realtek.c | 157 +- sound/soc/codecs/da7219.c | 9 +- sound/soc/codecs/hdmi-codec.c | 144 +- sound/soc/fsl/fsl_micfil.c | 74 +- sound/soc/fsl/fsl_micfil.h | 270 +- sound/soc/intel/atom/sst/sst_acpi.c | 64 +- sound/soc/intel/boards/bytcr_rt5640.c | 48 +- sound/soc/stm/stm32_sai_sub.c | 6 +- sound/usb/6fire/chip.c | 10 +- sound/usb/caiaq/audio.c | 10 +- sound/usb/caiaq/audio.h | 1 + sound/usb/caiaq/device.c | 19 +- sound/usb/caiaq/input.c | 12 +- sound/usb/caiaq/input.h | 1 + sound/usb/clock.c | 24 +- sound/usb/endpoint.c | 14 +- sound/usb/mixer_maps.c | 10 + sound/usb/quirks-table.h | 14 +- sound/usb/quirks.c | 19 +- sound/usb/usx2y/us122l.c | 5 +- sound/usb/usx2y/usbusx2y.c | 2 +- tools/bpf/bpftool/jit_disasm.c | 51 +- tools/bpf/bpftool/main.h | 25 +- tools/bpf/bpftool/map.c | 1 - tools/bpf/bpftool/prog.c | 22 +- tools/lib/bpf/libbpf.c | 2 +- tools/lib/bpf/linker.c | 2 + tools/perf/builtin-trace.c | 16 +- tools/perf/util/cs-etm.c | 25 +- tools/perf/util/probe-finder.c | 21 +- tools/perf/util/probe-finder.h | 4 +- tools/scripts/Makefile.arch | 4 +- .../selftests/arm64/mte/check_tags_inclusion.c | 4 +- tools/testing/selftests/arm64/pauth/pac.c | 3 + tools/testing/selftests/bpf/test_sockmap.c | 194 +- .../selftests/mount_setattr/mount_setattr_test.c | 2 +- tools/testing/selftests/net/pmtu.sh | 2 +- tools/testing/selftests/resctrl/resctrl_val.c | 3 +- tools/testing/selftests/vDSO/parse_vdso.c | 3 +- tools/testing/selftests/watchdog/watchdog-test.c | 6 + tools/testing/selftests/wireguard/netns.sh | 1 + 586 files changed, 9034 insertions(+), 6190 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/565 arm64: dts: allwinner: pinephone: Add mount matrix to accelerometer
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dragan Simic <[email protected]>
commit 2496b2aaacf137250f4ca449f465e2cadaabb0e8 upstream.
The way InvenSense MPU-6050 accelerometer is mounted on the user-facing side of the Pine64 PinePhone mainboard, which makes it rotated 90 degrees counter- clockwise, [1] requires the accelerometer's x- and y-axis to be swapped, and the direction of the accelerometer's y-axis to be inverted.
Rectify this by adding a mount-matrix to the accelerometer definition in the Pine64 PinePhone dtsi file.
--- arch/arm64/boot/dts/allwinner/sun50i-a64-pinephone.dtsi | 3 +++ 1 file changed, 3 insertions(+)
arch/arm64/boot/dts/allwinner/sun50i-a64-pinephone.dtsi +3 -0
@@ -200,6 +200,9 @@ interrupts = <7 5 IRQ_TYPE_EDGE_RISING>; /* PH5 */ vdd-supply = <®_dldo1>; vddio-supply = <®_dldo1>; + mount-matrix = "0", "1", "0", + "-1", "0", "0", + "0", "0", "1"; }; };
Greg Kroah-Hartman
maintainerPATCH 2/565 media: imx-jpeg: Set video drvdata before register video device
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Qian <[email protected]>
commit d2b7ecc26bd5406d5ba927be1748aa99c568696c upstream.
The video drvdata should be set before the video device is registered, otherwise video_drvdata() may return NULL in the open() file ops, and led to oops.
--- drivers/media/platform/imx-jpeg/mxc-jpeg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/platform/imx-jpeg/mxc-jpeg.c +1 -1
@@ -2155,6 +2155,7 @@ static int mxc_jpeg_probe(struct platfor jpeg->dec_vdev->vfl_dir =VFL_DIR_M2M ; jpeg->dec_vdev->device_caps =V4L2_CAP_STREAMING |V4L2_CAP_VIDEO_M2M_MPLANE ; +video_set_drvdata (jpeg->dec_vdev, jpeg);if (mode ==MXC_JPEG_ENCODE ) {v4l2_disable_ioctl (jpeg->dec_vdev,VIDIOC_DECODER_CMD );v4l2_disable_ioctl (jpeg->dec_vdev,VIDIOC_TRY_DECODER_CMD );
@@ -2167,7 +2168,6 @@ static int mxc_jpeg_probe(struct platfordev_err (dev,"failed to register video device\n" ); goto err_vdev_register; } -video_set_drvdata (jpeg->dec_vdev, jpeg);if (mode ==MXC_JPEG_ENCODE ) v4l2_info(&jpeg->v4l2_dev, "encoder device registered as /dev/video%d (%d,%d)\n",
Greg Kroah-Hartman
maintainerPATCH 3/565 media: i2c: tc358743: Fix crash in the probe error path when using polling
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Shiyan <[email protected]>
commit 869f38ae07f7df829da4951c3d1f7a2be09c2e9a upstream.
If an error occurs in the probe() function, we should remove the polling timer that was alarmed earlier, otherwise the timer is called with arguments that are already freed, which results in a crash.
------------[ cut here ]------------ WARNING: CPU: 3 PID: 0 at kernel/time/timer.c:1830 __run_timers+0x244/0x268 Modules linked in: CPU: 3 UID: 0 PID: 0 Comm: swapper/3 Not tainted 6.11.0 #226 Hardware name: Diasom DS-RK3568-SOM-EVB (DT) pstate: 804000c9 (Nzcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __run_timers+0x244/0x268 lr : __run_timers+0x1d4/0x268
sp : ffffff80eff2baf0
x29: ffffff80eff2bb50 x28: 7fffffffffffffff x27: ffffff80eff2bb00
x26: ffffffc080f669c0 x25: ffffff80efef6bf0 x24: ffffff80eff2bb00
x23: 0000000000000000 x22: dead000000000122 x21: 0000000000000000
x20: ffffff80efef6b80 x19: ffffff80041c8bf8 x18: ffffffffffffffff
x17: ffffffc06f146000 x16: ffffff80eff27dc0 x15: 000000000000003e
x14: 0000000000000000 x13: 00000000000054da x12: 0000000000000000
x11: 00000000000639c0 x10: 000000000000000c x9 : 0000000000000009 x8 : ffffff80eff2cb40 x7 : ffffff80eff2cb40 x6 : ffffff8002bee480 x5 : ffffffc080cb2220 x4 : ffffffc080cb2150 x3 : 00000000000f4240 x2 : 0000000000000102 x1 : ffffff80eff2bb00 x0 : ffffff80041c8bf0
Call trace: __run_timers+0x244/0x268 timer_expire_remote+0x50/0x68 tmigr_handle_remote+0x388/0x39c run_timer_softirq+0x38/0x44 handle_softirqs+0x138/0x298 __do_softirq+0x14/0x20 ____do_softirq+0x10/0x1c call_on_irq_stack+0x24/0x4c do_softirq_own_stack+0x1c/0x2c irq_exit_rcu+0x9c/0xcc el1_interrupt+0x48/0xc0 el1h_64_irq_handler+0x18/0x24 el1h_64_irq+0x7c/0x80 default_idle_call+0x34/0x68 do_idle+0x23c/0x294 cpu_startup_entry+0x38/0x3c secondary_start_kernel+0x128/0x160 __secondary_switched+0xb8/0xbc ---[ end trace 0000000000000000 ]---
--- drivers/media/i2c/tc358743.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/media/i2c/tc358743.c +3 -1
@@ -2176,8 +2176,10 @@ static int tc358743_probe(struct i2c_cli err_work_queues:cec_unregister_adapter (state->cec_adap); -if (!state->i2c_client->irq) +if (!state->i2c_client->irq) { +del_timer (&state->timer);flush_work (&state->work_i2c_poll); + }cancel_delayed_work (&state->delayed_work_enable_hotplug);mutex_destroy (&state->confctl_mutex); err_hdl:
Greg Kroah-Hartman
maintainerPATCH 4/565 media: imx-jpeg: Ensure power suppliers be suspended before detach them
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Qian <[email protected]>
commit fd0af4cd35da0eb550ef682b71cda70a4e36f6b9 upstream.
The power suppliers are always requested to suspend asynchronously, dev_pm_domain_detach() requires the caller to ensure proper synchronization of this function with power management callbacks. otherwise the detach may led to kernel panic, like below:
[ 1457.107934] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000040 [ 1457.116777] Mem abort info: [ 1457.119589] ESR = 0x0000000096000004 [ 1457.123358] EC = 0x25: DABT (current EL), IL = 32 bits [ 1457.128692] SET = 0, FnV = 0 [ 1457.131764] EA = 0, S1PTW = 0 [ 1457.134920] FSC = 0x04: level 0 translation fault [ 1457.139812] Data abort info: [ 1457.142707] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [ 1457.148196] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 1457.153256] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 1457.158563] user pgtable: 4k pages, 48-bit VAs, pgdp=00000001138b6000 [ 1457.165000] [0000000000000040] pgd=0000000000000000, p4d=0000000000000000 [ 1457.171792] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP [ 1457.178045] Modules linked in: v4l2_jpeg wave6_vpu_ctrl(-) [last unloaded: mxc_jpeg_encdec] [ 1457.186383] CPU: 0 PID: 51938 Comm: kworker/0:3 Not tainted 6.6.36-gd23d64eea511 #66 [ 1457.194112] Hardware name: NXP i.MX95 19X19 board (DT) [ 1457.199236] Workqueue: pm pm_runtime_work [ 1457.203247] pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 1457.210188] pc : genpd_runtime_suspend+0x20/0x290 [ 1457.214886] lr : __rpm_callback+0x48/0x1d8 [ 1457.218968] sp : ffff80008250bc50 [ 1457.222270] x29: ffff80008250bc50 x28: 0000000000000000 x27: 0000000000000000 [ 1457.229394] x26: 0000000000000000 x25: 0000000000000008 x24: 00000000000f4240 [ 1457.236518] x23: 0000000000000000 x22: ffff00008590f0e4 x21: 0000000000000008 [ 1457.243642] x20: ffff80008099c434 x19: ffff00008590f000 x18: ffffffffffffffff [ 1457.250766] x17: 5300326563697665 x16: 645f676e696c6f6f x15: 63343a6d726f6674 [ 1457.257890] x14: 0000000000000004 x13: 00000000000003a4 x12: 0000000000000002 [ 1457.265014] x11: 0000000000000000 x10: 0000000000000a60 x9 : ffff80008250bbb0 [ 1457.272138] x8 : ffff000092937200 x7 : ffff0003fdf6af80 x6 : 0000000000000000 [ 1457.279262] x5 : 00000000410fd050 x4 : 0000000000200000 x3 : 0000000000000000 [ 1457.286386] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff00008590f000 [ 1457.293510] Call trace: [ 1457.295946] genpd_runtime_suspend+0x20/0x290 [ 1457.300296] __rpm_callback+0x48/0x1d8 [ 1457.304038] rpm_callback+0x6c/0x78 [ 1457.307515] rpm_suspend+0x10c/0x570 [ 1457.311077] pm_runtime_work+0xc4/0xc8 [ 1457.314813] process_one_work+0x138/0x248 [ 1457.318816] worker_thread+0x320/0x438 [ 1457.322552] kthread+0x110/0x114 [ 1457.325767] ret_from_fork+0x10/0x20
--- drivers/media/platform/imx-jpeg/mxc-jpeg.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/media/platform/imx-jpeg/mxc-jpeg.c +2 -0
@@ -1997,6 +1997,8 @@ static void mxc_jpeg_detach_pm_domains(sint i;for (i =0 ; i < jpeg->num_domains; i++) { +if (jpeg->pd_dev[i] && !pm_runtime_suspended (jpeg->pd_dev[i])) +pm_runtime_force_suspend (jpeg->pd_dev[i]);if (jpeg->pd_link[i] && !IS_ERR (jpeg->pd_link[i]))device_link_del (jpeg->pd_link[i]);if (jpeg->pd_dev[i] && !IS_ERR (jpeg->pd_dev[i]))
Greg Kroah-Hartman
maintainerPATCH 5/565 media: ts2020: fix null-ptr-deref in ts2020_probe()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Zetao <[email protected]>
commit 4a058b34b52ed3feb1f3ff6fd26aefeeeed20cba upstream.
KASAN reported a null-ptr-deref issue when executing the following command:
# echo ts2020 0x20 > /sys/bus/i2c/devices/i2c-0/new_device
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
CPU: 53 UID: 0 PID: 970 Comm: systemd-udevd Not tainted 6.12.0-rc2+ #24
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009)
RIP: 0010:ts2020_probe+0xad/0xe10 [ts2020]
RSP: 0018:ffffc9000abbf598 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffffc0714809
RDX: 0000000000000002 RSI: ffff88811550be00 RDI: 0000000000000010
RBP: ffff888109868800 R08: 0000000000000001 R09: fffff52001577eb6
R10: 0000000000000000 R11: ffffc9000abbff50 R12: ffffffffc0714790
R13: 1ffff92001577eb8 R14: ffffffffc07190d0 R15: 0000000000000001
FS: 00007f95f13b98c0(0000) GS:ffff888149280000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555d2634b000 CR3: 0000000152236000 CR4: 00000000000006f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
ts2020_probe+0xad/0xe10 [ts2020]
i2c_device_probe+0x421/0xb40
really_probe+0x266/0x850
...The cause of the problem is that when using sysfs to dynamically register an i2c device, there is no platform data, but the probe process of ts2020 needs to use platform data, resulting in a null pointer being accessed.
Solve this problem by adding checks to platform data.
--- drivers/media/dvb-frontends/ts2020.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/media/dvb-frontends/ts2020.c +7 -1
@@ -554,13 +554,19 @@ static int ts2020_probe(struct i2c_clien const struct i2c_device_id *id) {struct ts2020_config *pdata = client->dev.platform_data; -struct dvb_frontend *fe = pdata->fe; +struct dvb_frontend *fe;struct ts2020_priv *dev;int ret;u8 u8tmp;unsigned int utmp;char *chip_str; +if (!pdata) { +dev_err (&client->dev,"platform data is mandatory\n" ); +return -EINVAL ; + } + + fe = pdata->fe; dev =kzalloc (sizeof (*dev),GFP_KERNEL );if (!dev) { ret = -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 6/565 media: venus: Fix pm_runtime_set_suspended() with runtime pm enabled
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
commit 2a20869f7d798aa2b69e45b863eaf1b1ecf98278 upstream.
It is not valid to call pm_runtime_set_suspended() for devices with runtime PM enabled because it returns -EAGAIN if it is enabled already and working. So, call pm_runtime_disable() before to fix it.
--- drivers/media/platform/qcom/venus/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/platform/qcom/venus/core.c +1 -1
@@ -391,8 +391,8 @@ err_of_depopulate:of_platform_depopulate (dev); err_runtime_disable:pm_runtime_put_noidle (dev); -pm_runtime_set_suspended (dev);pm_runtime_disable (dev); +pm_runtime_set_suspended (dev);hfi_destroy (core); err_core_deinit:hfi_core_deinit (core, false);
Greg Kroah-Hartman
maintainerPATCH 7/565 media: gspca: ov534-ov772x: Fix off-by-one error in set_frame_rate()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
commit d2842dec577900031826dc44e9bf0c66416d7173 upstream.
In set_frame_rate(), select a rate in rate_0 or rate_1 by checking sd->frame_rate >= r->fps in a loop, but the loop condition terminates when the index reaches zero, which fails to check the last elememt in rate_0 or rate_1.
Check for >= 0 so that the last one in rate_0 or rate_1 is also checked.
--- drivers/media/usb/gspca/ov534.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/usb/gspca/ov534.c +1 -1
@@ -847,7 +847,7 @@ static void set_frame_rate(struct gspca_ r = rate_1; i =ARRAY_SIZE (rate_1); } -while (--i >0 ) { +while (--i >=0 ) {if (sd->frame_rate >= r->fps)break ; r++;
Greg Kroah-Hartman
maintainerPATCH 8/565 media: platform: allegro-dvt: Fix possible memory leak in allocate_buffers_internal()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gaosheng Cui <[email protected]>
commit 0f514068fbc5d4d189c817adc7c4e32cffdc2e47 upstream.
The buffer in the loop should be released under the exception path, otherwise there may be a memory leak here.
To mitigate this, free the buffer when allegro_alloc_buffer fails.
--- drivers/media/platform/allegro-dvt/allegro-core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/media/platform/allegro-dvt/allegro-core.c +3 -1
@@ -1431,8 +1431,10 @@ static int allocate_buffers_internal(strINIT_LIST_HEAD (&buffer->head); err =allegro_alloc_buffer (dev, buffer, size); -if (err) +if (err) { +kfree (buffer); goto err; + }list_add (&buffer->head, list); }
Greg Kroah-Hartman
maintainerPATCH 9/565 media: uvcvideo: Stop stream during unregister
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <[email protected]>
commit c9ec6f1736363b2b2bb4e266997389740f628441 upstream.
uvc_unregister_video() can be called asynchronously from uvc_disconnect(). If the device is still streaming when that happens, a plethora of race conditions can occur.
Make sure that the device has stopped streaming before exiting this function.
If the user still holds handles to the driver's file descriptors, any ioctl will return -ENODEV from the v4l2 core.
This change makes uvc more consistent with the rest of the v4l2 drivers using the vb2_fop_* and vb2_ioctl_* helpers.
This driver (and many other usb drivers) always had this problem, but it wasn't possible to easily fix this until the vb2_video_unregister_device() helper was added. So the Fixes tag points to the creation of that helper.
--- drivers/media/usb/uvc/uvc_driver.c | 32 +++++++++++++++++++++++++++++++- 1 file changed, 31 insertions(+), 1 deletion(-)
drivers/media/usb/uvc/uvc_driver.c +31 -1
@@ -2153,11 +2153,41 @@ static void uvc_unregister_video(structstruct uvc_streaming *stream;list_for_each_entry (stream, &dev->streams, list) { +/* Nothing to do here, continue. */ if (!video_is_registered (&stream->vdev))continue ; +/* +* For stream->vdev we follow the same logic as: +* vb2_video_unregister_device(). +*/ + +/* 1. Take a reference to vdev */ +get_device (&stream->vdev.dev); + +/* 2. Ensure that no new ioctls can be called. */ video_unregister_device (&stream->vdev); -video_unregister_device (&stream->meta.vdev); + +/* 3. Wait for old ioctls to finish. */ +mutex_lock (&stream->mutex); + +/* 4. Stop streaming. */ +uvc_queue_release (&stream->queue); + +mutex_unlock (&stream->mutex); + +put_device (&stream->vdev.dev); + +/* +* For stream->meta.vdev we can directly call: +* vb2_video_unregister_device(). +*/ +vb2_video_unregister_device (&stream->meta.vdev); + +/* +* Now both vdevs are not streaming and all the ioctls will +* return -ENODEV. +*/ uvc_debugfs_cleanup_stream (stream); }
Greg Kroah-Hartman
maintainerPATCH 10/565 media: uvcvideo: Require entities to have a non-zero unique ID
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thadeu Lima de Souza Cascardo <[email protected]>
commit 3dd075fe8ebbc6fcbf998f81a75b8c4b159a6195 upstream.
Per UVC 1.1+ specification 3.7.2, units and terminals must have a non-zero unique ID.
``` Each Unit and Terminal within the video function is assigned a unique identification number, the Unit ID (UID) or Terminal ID (TID), contained in the bUnitID or bTerminalID field of the descriptor. The value 0x00 is reserved for undefined ID, ```
So, deny allocating an entity with ID 0 or an ID that belongs to a unit that is already added to the list of entities.
This also prevents some syzkaller reproducers from triggering warnings due to a chain of entities referring to themselves. In one particular case, an Output Unit is connected to an Input Unit, both with the same ID of 1. But when looking up for the source ID of the Output Unit, that same entity is found instead of the input entity, which leads to such warnings.
In another case, a backward chain was considered finished as the source ID was 0. Later on, that entity was found, but its pads were not valid.
Here is a sample stack trace for one of those cases.
[ 20.650953] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 20.830206] usb 1-1: Using ep0 maxpacket: 8 [ 20.833501] usb 1-1: config 0 descriptor?? [ 21.038518] usb 1-1: string descriptor 0 read error: -71 [ 21.038893] usb 1-1: Found UVC 0.00 device <unnamed> (2833:0201) [ 21.039299] uvcvideo 1-1:0.0: Entity type for entity Output 1 was not initialized! [ 21.041583] uvcvideo 1-1:0.0: Entity type for entity Input 1 was not initialized! [ 21.042218] ------------[ cut here ]------------ [ 21.042536] WARNING: CPU: 0 PID: 9 at drivers/media/mc/mc-entity.c:1147 media_create_pad_link+0x2c4/0x2e0 [ 21.043195] Modules linked in: [ 21.043535] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:1 Not tainted 6.11.0-rc7-00030-g3480e43aeccf #444 [ 21.044101] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 [ 21.044639] Workqueue: usb_hub_wq hub_event [ 21.045100] RIP: 0010:media_create_pad_link+0x2c4/0x2e0 [ 21.045508] Code: fe e8 20 01 00 00 b8 f4 ff ff ff 48 83 c4 30 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc 0f 0b eb e9 0f 0b eb 0a 0f 0b eb 06 <0f> 0b eb 02 0f 0b b8 ea ff ff ff eb d4 66 2e 0f 1f 84 00 00 00 00 [ 21.046801] RSP: 0018:ffffc9000004b318 EFLAGS: 00010246 [ 21.047227] RAX: ffff888004e5d458 RBX: 0000000000000000 RCX: ffffffff818fccf1 [ 21.047719] RDX: 000000000000007b RSI: 0000000000000000 RDI: ffff888004313290 [ 21.048241] RBP: ffff888004313290 R08: 0001ffffffffffff R09: 0000000000000000 [ 21.048701] R10: 0000000000000013 R11: 0001888004313290 R12: 0000000000000003 [ 21.049138] R13: ffff888004313080 R14: ffff888004313080 R15: 0000000000000000 [ 21.049648] FS: 0000000000000000(0000) GS:ffff88803ec00000(0000) knlGS:0000000000000000 [ 21.050271] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 21.050688] CR2: 0000592cc27635b0 CR3: 000000000431c000 CR4: 0000000000750ef0 [ 21.051136] PKRU: 55555554 [ 21.051331] Call Trace: [ 21.051480] <TASK> [ 21.051611] ? __warn+0xc4/0x210 [ 21.051861] ? media_create_pad_link+0x2c4/0x2e0 [ 21.052252] ? report_bug+0x11b/0x1a0 [ 21.052540] ? trace_hardirqs_on+0x31/0x40 [ 21.052901] ? handle_bug+0x3d/0x70 [ 21.053197] ? exc_invalid_op+0x1a/0x50 [ 21.053511] ? asm_exc_invalid_op+0x1a/0x20 [ 21.053924] ? media_create_pad_link+0x91/0x2e0 [ 21.054364] ? media_create_pad_link+0x2c4/0x2e0 [ 21.054834] ? media_create_pad_link+0x91/0x2e0 [ 21.055131] ? _raw_spin_unlock+0x1e/0x40 [ 21.055441] ? __v4l2_device_register_subdev+0x202/0x210 [ 21.055837] uvc_mc_register_entities+0x358/0x400 [ 21.056144] uvc_register_chains+0x1fd/0x290 [ 21.056413] uvc_probe+0x380e/0x3dc0 [ 21.056676] ? __lock_acquire+0x5aa/0x26e0 [ 21.056946] ? find_held_lock+0x33/0xa0 [ 21.057196] ? kernfs_activate+0x70/0x80 [ 21.057533] ? usb_match_dynamic_id+0x1b/0x70 [ 21.057811] ? find_held_lock+0x33/0xa0 [ 21.058047] ? usb_match_dynamic_id+0x55/0x70 [ 21.058330] ? lock_release+0x124/0x260 [ 21.058657] ? usb_match_one_id_intf+0xa2/0x100 [ 21.058997] usb_probe_interface+0x1ba/0x330 [ 21.059399] really_probe+0x1ba/0x4c0 [ 21.059662] __driver_probe_device+0xb2/0x180 [ 21.059944] driver_probe_device+0x5a/0x100 [ 21.060170] __device_attach_driver+0xe9/0x160 [ 21.060427] ? __pfx___device_attach_driver+0x10/0x10 [ 21.060872] bus_for_each_drv+0xa9/0x100 [ 21.061312] __device_attach+0xed/0x190 [ 21.061812] device_initial_probe+0xe/0x20 [ 21.062229] bus_probe_device+0x4d/0xd0 [ 21.062590] device_add+0x308/0x590 [ 21.062912] usb_set_configuration+0x7b6/0xaf0 [ 21.063403] usb_generic_driver_probe+0x36/0x80 [ 21.063714] usb_probe_device+0x7b/0x130 [ 21.063936] really_probe+0x1ba/0x4c0 [ 21.064111] __driver_probe_device+0xb2/0x180 [ 21.064577] driver_probe_device+0x5a/0x100 [ 21.065019] __device_attach_driver+0xe9/0x160 [ 21.065403] ? __pfx___device_attach_driver+0x10/0x10 [ 21.065820] bus_for_each_drv+0xa9/0x100 [ 21.066094] __device_attach+0xed/0x190 [ 21.066535] device_initial_probe+0xe/0x20 [ 21.066992] bus_probe_device+0x4d/0xd0 [ 21.067250] device_add+0x308/0x590 [ 21.067501] usb_new_device+0x347/0x610 [ 21.067817] hub_event+0x156b/0x1e30 [ 21.068060] ? process_scheduled_works+0x48b/0xaf0 [ 21.068337] process_scheduled_works+0x5a3/0xaf0 [ 21.068668] worker_thread+0x3cf/0x560 [ 21.068932] ? kthread+0x109/0x1b0 [ 21.069133] kthread+0x197/0x1b0 [ 21.069343] ? __pfx_worker_thread+0x10/0x10 [ 21.069598] ? __pfx_kthread+0x10/0x10 [ 21.069908] ret_from_fork+0x32/0x40 [ 21.070169] ? __pfx_kthread+0x10/0x10 [ 21.070424] ret_from_fork_asm+0x1a/0x30 [ 21.070737] </TASK>
--- drivers/media/usb/uvc/uvc_driver.c | 70 ++++++++++++++++++++++--------------- 1 file changed, 43 insertions(+), 27 deletions(-)
drivers/media/usb/uvc/uvc_driver.c +43 -27
@@ -1026,14 +1026,27 @@ static const u8 uvc_media_transport_inpuUVC_GUID_UVC_MEDIA_TRANSPORT_INPUT ;static const u8 uvc_processing_guid[16 ] =UVC_GUID_UVC_PROCESSING ; -static struct uvc_entity *uvc_alloc_entity (u16 type,u16 id, -unsigned int num_pads,unsigned int extra_size) +static struct uvc_entity *uvc_alloc_new_entity (struct uvc_device *dev,u16 type, +u16 id,unsigned int num_pads, +unsigned int extra_size) {struct uvc_entity *entity;unsigned int num_inputs;unsigned int size;unsigned int i; +/* Per UVC 1.1+ spec 3.7.2, the ID should be non-zero. */ +if (id ==0 ) { +dev_err (&dev->udev->dev,"Found Unit with invalid ID 0.\n" ); +return ERR_PTR (-EINVAL ); + } + +/* Per UVC 1.1+ spec 3.7.2, the ID is unique. */ +if (uvc_entity_by_id (dev, id)) { +dev_err (&dev->udev->dev,"Found multiple Units with ID %u\n" , id); +return ERR_PTR (-EINVAL ); + } + extra_size =roundup (extra_size,sizeof (*entity->pads));if (num_pads) num_inputs = type &UVC_TERM_OUTPUT ? num_pads : num_pads -1 ;
@@ -1043,7 +1056,7 @@ static struct uvc_entity *uvc_alloc_enti + num_inputs; entity =kzalloc (size,GFP_KERNEL );if (entity ==NULL ) -return NULL ; +return ERR_PTR (-ENOMEM ); entity->id = id; entity->type = type;
@@ -1133,10 +1146,10 @@ static int uvc_parse_vendor_control(strubreak ; } - unit =uvc_alloc_entity (UVC_VC_EXTENSION_UNIT , buffer[3 ], - p +1 ,2 *n); -if (unit ==NULL ) -return -ENOMEM ; + unit =uvc_alloc_new_entity (dev,UVC_VC_EXTENSION_UNIT , + buffer[3 ], p +1 ,2 * n); +if (IS_ERR (unit)) +return PTR_ERR (unit);memcpy (unit->guid, &buffer[4 ],16 ); unit->extension.bNumControls = buffer[20 ];
@@ -1246,10 +1259,10 @@ static int uvc_parse_standard_control(streturn -EINVAL ; } - term =uvc_alloc_entity (type |UVC_TERM_INPUT , buffer[3 ], -1 , n + p); -if (term ==NULL ) -return -ENOMEM ; + term =uvc_alloc_new_entity (dev, type |UVC_TERM_INPUT , + buffer[3 ],1 , n + p); +if (IS_ERR (term)) +return PTR_ERR (term);if (UVC_ENTITY_TYPE (term) ==UVC_ITT_CAMERA ) { term->camera.bControlSize = n;
@@ -1305,10 +1318,10 @@ static int uvc_parse_standard_control(streturn 0 ; } - term =uvc_alloc_entity (type |UVC_TERM_OUTPUT , buffer[3 ], -1 ,0 ); -if (term ==NULL ) -return -ENOMEM ; + term =uvc_alloc_new_entity (dev, type |UVC_TERM_OUTPUT , + buffer[3 ],1 ,0 ); +if (IS_ERR (term)) +return PTR_ERR (term);memcpy (term->baSourceID, &buffer[7 ],1 );
@@ -1329,9 +1342,10 @@ static int uvc_parse_standard_control(streturn -EINVAL ; } - unit =uvc_alloc_entity (buffer[2 ], buffer[3 ], p +1 ,0 ); -if (unit ==NULL ) -return -ENOMEM ; + unit =uvc_alloc_new_entity (dev, buffer[2 ], buffer[3 ], + p +1 ,0 ); +if (IS_ERR (unit)) +return PTR_ERR (unit);memcpy (unit->baSourceID, &buffer[5 ], p);
@@ -1353,9 +1367,9 @@ static int uvc_parse_standard_control(streturn -EINVAL ; } - unit =uvc_alloc_entity (buffer[2 ], buffer[3 ],2 , n); -if (unit ==NULL ) -return -ENOMEM ; + unit =uvc_alloc_new_entity (dev, buffer[2 ], buffer[3 ],2 , n); +if (IS_ERR (unit)) +return PTR_ERR (unit);memcpy (unit->baSourceID, &buffer[4 ],1 ); unit->processing.wMaxMultiplier =
@@ -1384,9 +1398,10 @@ static int uvc_parse_standard_control(streturn -EINVAL ; } - unit =uvc_alloc_entity (buffer[2 ], buffer[3 ], p +1 , n); -if (unit ==NULL ) -return -ENOMEM ; + unit =uvc_alloc_new_entity (dev, buffer[2 ], buffer[3 ], + p +1 , n); +if (IS_ERR (unit)) +return PTR_ERR (unit);memcpy (unit->guid, &buffer[4 ],16 ); unit->extension.bNumControls = buffer[20 ];
@@ -1528,9 +1543,10 @@ static int uvc_gpio_parse(struct uvc_devreturn irq; } - unit =uvc_alloc_entity (UVC_EXT_GPIO_UNIT ,UVC_EXT_GPIO_UNIT_ID ,0 ,1 ); -if (!unit) -return -ENOMEM ; + unit =uvc_alloc_new_entity (dev,UVC_EXT_GPIO_UNIT , +UVC_EXT_GPIO_UNIT_ID ,0 ,1 ); +if (IS_ERR (unit)) +return PTR_ERR (unit); unit->gpio.gpio_privacy = gpio_privacy; unit->gpio.irq = irq;
Greg Kroah-Hartman
maintainerPATCH 11/565 ovl: Filter invalid inodes with missing lookup function
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasiliy Kovalev <[email protected]>
commit c8b359dddb418c60df1a69beea01d1b3322bfe83 upstream.
Add a check to the ovl_dentry_weird() function to prevent the processing of directory inodes that lack the lookup function. This is important because such inodes can cause errors in overlayfs when passed to the lowerstack.
--- fs/overlayfs/util.c | 3 +++ 1 file changed, 3 insertions(+)
fs/overlayfs/util.c +3 -0
@@ -135,6 +135,9 @@ void ovl_dentry_init_flags(struct dentrybool ovl_dentry_weird (struct dentry *dentry) { +if (!d_can_lookup (dentry) && !d_is_file (dentry) && !d_is_symlink (dentry)) +return true; + return dentry->d_flags & (DCACHE_NEED_AUTOMOUNT | DCACHE_MANAGE_TRANSIT | DCACHE_OP_HASH |
Greg Kroah-Hartman
maintainerPATCH 12/565 ftrace: Fix regression with module command in stack_trace_filter
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: guoweikang <[email protected]>
commit 45af52e7d3b8560f21d139b3759735eead8b1653 upstream.
When executing the following command:
# echo "write*:mod:ext3" > /sys/kernel/tracing/stack_trace_filter
The current mod command causes a null pointer dereference. While commit 0f17976568b3f ("ftrace: Fix regression with module command in stack_trace_filter") has addressed part of the issue, it left a corner case unhandled, which still results in a kernel crash.
--- kernel/trace/ftrace.c | 3 +++ 1 file changed, 3 insertions(+)
kernel/trace/ftrace.c +3 -0
@@ -4305,6 +4305,9 @@ ftrace_mod_callback(struct trace_array *char *func;int ret; +if (!tr) +return -ENODEV ; +/* match_records() modifies func, and we need the original */ func =kstrdup (func_orig,GFP_KERNEL );if (!func)
Greg Kroah-Hartman
maintainerPATCH 13/565 vmstat: call fold_vm_zone_numa_events() before show per zone NUMA event
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: MengEn Sun <[email protected]>
commit 2ea80b039b9af0b71c00378523b71c254fb99c23 upstream.
Since 5.14-rc1, NUMA events will only be folded from per-CPU statistics to per zone and global statistics when the user actually needs it.
Currently, the kernel has performs the fold operation when reading /proc/vmstat, but does not perform the fold operation in /proc/zoneinfo. This can lead to inaccuracies in the following statistics in zoneinfo:
- numa_hit
- numa_miss
- numa_foreign
- numa_interleave
- numa_local
- numa_other
Therefore, before printing per-zone vm_numa_event when reading /proc/zoneinfo, we should also perform the fold operation.
--- mm/vmstat.c | 1 + 1 file changed, 1 insertion(+)
mm/vmstat.c +1 -0
@@ -1690,6 +1690,7 @@ static void zoneinfo_show_print(struct s zone_page_state(zone, i));#ifdef CONFIG_NUMA +fold_vm_zone_numa_events (zone);for (i =0 ; i <NR_VM_NUMA_EVENT_ITEMS ; i++)seq_printf (m,"\n %-12s %lu" ,numa_stat_name (i),zone_numa_event_state (zone, i));
Greg Kroah-Hartman
maintainerPATCH 14/565 iommu/io-pgtable-arm: Fix stage-2 map/unmap for concatenated tables
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mostafa Saleh <[email protected]>
commit d71fa842d33c48ac2809ae11d2379b5a788792cb upstream.
ARM_LPAE_LVL_IDX() takes into account concatenated PGDs and can return an index spanning multiple page-table pages given a sufficiently large input address. However, when the resulting index is used to calculate the number of remaining entries in the page, the possibility of concatenation is ignored and we end up computing a negative upper bound:
max_entries = ARM_LPAE_PTES_PER_TABLE(data) - map_idx_start;
On the map path, this results in a negative 'mapped' value being returned but on the unmap path we can leak child tables if they are skipped in __arm_lpae_free_pgtable().
Introduce an arm_lpae_max_entries() helper to convert a table index into the remaining number of entries within a single page-table page.
--- drivers/iommu/io-pgtable-arm.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-)
drivers/iommu/io-pgtable-arm.c +15 -3
@@ -183,6 +183,18 @@ static phys_addr_t iopte_to_paddr(arm_lpreturn (paddr | (paddr << (48 -12 ))) & (ARM_LPAE_PTE_ADDR_MASK <<4 ); } +/* +* Convert an index returned by ARM_LPAE_PGD_IDX(), which can point into +* a concatenated PGD, into the maximum number of entries that can be +* mapped in the same table page. +*/ +static inline int arm_lpae_max_entries (int i,struct arm_lpae_io_pgtable *data) +{ +int ptes_per_table =ARM_LPAE_PTES_PER_TABLE (data); + +return ptes_per_table - (i & (ptes_per_table -1 )); +} +static bool selftest_running = false;static dma_addr_t __arm_lpae_dma_addr (void *pages)
@@ -361,7 +373,7 @@ static int __arm_lpae_map(struct arm_lpa/* If we can install a leaf entry at this level, then do so */ if (size == block_size) { - max_entries =ARM_LPAE_PTES_PER_TABLE (data) - map_idx_start; + max_entries =arm_lpae_max_entries (map_idx_start, data); num_entries =min_t (int, pgcount, max_entries); ret =arm_lpae_init_pte (data, iova, paddr, prot, lvl, num_entries, ptep);if (!ret && mapped)
@@ -578,7 +590,7 @@ static size_t arm_lpae_split_blk_unmap(sif (size == split_sz) { unmap_idx_start =ARM_LPAE_LVL_IDX (iova, lvl, data); - max_entries = ptes_per_table - unmap_idx_start; + max_entries =arm_lpae_max_entries (unmap_idx_start, data); num_entries =min_t (int, pgcount, max_entries); }
@@ -636,7 +648,7 @@ static size_t __arm_lpae_unmap(struct ar/* If the size matches this level, we're in the right place */ if (size ==ARM_LPAE_BLOCK_SIZE (lvl, data)) { - max_entries =ARM_LPAE_PTES_PER_TABLE (data) - unmap_idx_start; + max_entries =arm_lpae_max_entries (unmap_idx_start, data); num_entries =min_t (int, pgcount, max_entries);while (i < num_entries) {
Greg Kroah-Hartman
maintainerPATCH 15/565 leds: lp55xx: Remove redundant test for invalid channel number
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Vokáč <[email protected]>
commit 09b1ef9813a0742674f7efe26104403ca94a1b4a upstream.
Since commit 92a81562e695 ("leds: lp55xx: Add multicolor framework support to lp55xx") there are two subsequent tests if the chan_nr (reg property) is in valid range. One in the lp55xx_init_led() function and one in the lp55xx_parse_common_child() function that was added with the mentioned commit.
There are two issues with that.
First is in the lp55xx_parse_common_child() function where the reg property is tested right after it is read from the device tree. Test for the upper range is not correct though. Valid reg values are 0 to (max_channel - 1) so it should be >=.
Second issue is that in case the parsed value is out of the range the probe just fails and no error message is shown as the code never reaches the second test that prints and error message.
Remove the test form lp55xx_parse_common_child() function completely and keep the one in lp55xx_init_led() function to deal with it.
--- drivers/leds/leds-lp55xx-common.c | 3 --- 1 file changed, 3 deletions(-)
drivers/leds/leds-lp55xx-common.c +0 -3
@@ -580,9 +580,6 @@ static int lp55xx_parse_common_child(strif (ret)return ret; -if (*chan_nr <0 || *chan_nr > cfg->max_channel) -return -EINVAL ; -return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 16/565 clk: qcom: gcc-qcs404: fix initial rate of GPLL3
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabor Juhos <[email protected]>
commit 36d202241d234fa4ac50743510d098ad52bd193a upstream.
The comment before the config of the GPLL3 PLL says that the PLL should run at 930 MHz. In contrary to this, calculating the frequency from the current configuration values by using 19.2 MHz as input frequency defined in 'qcs404.dtsi', it gives 921.6 MHz:
$ xo=19200000; l=48; alpha=0x0; alpha_hi=0x0 $ echo "$xo * ($((l)) + $(((alpha_hi << 32 | alpha) >> 8)) / 2^32)" | bc -l 921600000.00000000000000000000
Set 'alpha_hi' in the configuration to a value used in downstream kernels [1][2] in order to get the correct output rate:
$ xo=19200000; l=48; alpha=0x0; alpha_hi=0x70 $ echo "$xo * ($((l)) + $(((alpha_hi << 32 | alpha) >> 8)) / 2^32)" | bc -l 930000000.00000000000000000000
The change is based on static code analysis, compile tested only.
[1] https://git.codelinaro.org/clo/la/kernel/msm-5.4/-/blob/kernel.lnx.5.4.r56-rel/drivers/clk/qcom/gcc-qcs404.c?ref_type=heads#L335
[2} https://git.codelinaro.org/clo/la/kernel/msm-5.15/-/blob/kernel.lnx.5.15.r49-rel/drivers/clk/qcom/gcc-qcs404.c?ref_type=heads#L127
--- drivers/clk/qcom/gcc-qcs404.c | 1 + 1 file changed, 1 insertion(+)
drivers/clk/qcom/gcc-qcs404.c +1 -0
@@ -337,6 +337,7 @@ static struct clk_alpha_pll gpll1_out_ma/* 930MHz configuration */ static const struct alpha_pll_config gpll3_config = { .l =48 , + .alpha_hi =0x70 , .alpha =0x0 , .alpha_en_mask =BIT (24 ), .post_div_mask =0xf <<8 ,
Greg Kroah-Hartman
maintainerPATCH 17/565 netlink: terminate outstanding dump on socket close
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit 1904fb9ebf911441f90a68e96b22aa73e4410505 ]
Netlink supports iterative dumping of data. It provides the families the following ops:
- start - (optional) kicks off the dumping process
- dump - actual dump helper, keeps getting called until it returns 0
- done - (optional) pairs with .start, can be used for cleanup
The whole process is asynchronous and the repeated calls to .dump don't actually happen in a tight loop, but rather are triggered in response to recvmsg() on the socket.
This gives the user full control over the dump, but also means that the user can close the socket without getting to the end of the dump. To make sure .start is always paired with .done we check if there is an ongoing dump before freeing the socket, and if so call .done.
The complication is that sockets can get freed from BH and .done is allowed to sleep. So we use a workqueue to defer the call, when needed.
Unfortunately this does not work correctly. What we defer is not the cleanup but rather releasing a reference on the socket. We have no guarantee that we own the last reference, if someone else holds the socket they may release it in BH and we're back to square one.
The whole dance, however, appears to be unnecessary. Only the user can interact with dumps, so we can clean up when socket is closed. And close always happens in process context. Some async code may still access the socket after close, queue notification skbs to it etc. but no dumps can start, end or otherwise make progress.
Delete the workqueue and flush the dump state directly from the release handler. Note that further cleanup is possible in -next, for instance we now always call .done before releasing the main module reference, so dump doesn't have to take a reference of its own.
--- net/netlink/af_netlink.c | 31 ++++++++----------------------- net/netlink/af_netlink.h | 2 -- 2 files changed, 8 insertions(+), 25 deletions(-)
net/netlink/af_netlink.c +8 -23
@@ -393,15 +393,6 @@ static void netlink_skb_set_owner_r(struct sk_buff *skb, struct sock *sk)static void netlink_sock_destruct (struct sock *sk) { -struct netlink_sock *nlk =nlk_sk (sk); - -if (nlk->cb_running) { -if (nlk->cb.done) - nlk->cb.done (&nlk->cb); -module_put (nlk->cb.module); -kfree_skb (nlk->cb.skb); - } -skb_queue_purge (&sk->sk_receive_queue);if (!sock_flag (sk,SOCK_DEAD )) {
@@ -414,14 +405,6 @@ static void netlink_sock_destruct(struct sock *sk)WARN_ON (nlk_sk (sk)->groups); } -static void netlink_sock_destruct_work (struct work_struct *work) -{ - struct netlink_sock *nlk = container_of(work, struct netlink_sock, - work); - -sk_free (&nlk->sk); -} -/* This lock without WQ_FLAG_EXCLUSIVE is good on UP and it is _very_ bad on * SMP. Look, when several writers sleep and reader wakes them up, all but one * immediately hit write lock and grab all the cpus. Exclusive sleep solves
@@ -736,12 +719,6 @@ static void deferred_put_nlk_sk(struct rcu_head *head)if (!refcount_dec_and_test (&sk->sk_refcnt))return ; -if (nlk->cb_running && nlk->cb.done) { -INIT_WORK (&nlk->work, netlink_sock_destruct_work); -schedule_work (&nlk->work); -return ; - } -sk_free (sk); }
@@ -791,6 +768,14 @@ static int netlink_release(struct socket *sock) NETLINK_URELEASE, &n); } +/* Terminate any outstanding dump */ +if (nlk->cb_running) { +if (nlk->cb.done) + nlk->cb.done (&nlk->cb); +module_put (nlk->cb.module); +kfree_skb (nlk->cb.skb); + } +module_put (nlk->module);if (netlink_is_kernel (sk)) {
net/netlink/af_netlink.h +0 -2
@@ -4,7 +4,6 @@#include <linux/rhashtable.h> #include <linux/atomic.h> -#include <linux/workqueue.h> #include <net/sock.h> /* flags */
@@ -46,7 +45,6 @@ struct netlink_sock {struct rhash_head node;struct rcu_head rcu; -struct work_struct work; };static inline struct netlink_sock *nlk_sk (struct sock *sk)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 18/565 drm/rockchip: vop: Fix a dereferenced before check warning
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Yan <[email protected]>
[ Upstream commit ab1c793f457f740ab7108cc0b1340a402dbf484d ]
The 'state' can't be NULL, we should check crtc_state.
Fix warning:drivers/gpu/drm/rockchip/rockchip_drm_vop.c:1096 vop_plane_atomic_async_check() warn: variable dereferenced before check 'state' (see line 1077)
--- drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/gpu/drm/rockchip/rockchip_drm_vop.c +4 -4
@@ -1065,10 +1065,10 @@ static int vop_plane_atomic_async_check(struct drm_plane *plane,if (!plane->state->fb)return -EINVAL ; -if (state) - crtc_state =drm_atomic_get_existing_crtc_state (state, - new_plane_state->crtc); -else /* Special case for asynchronous cursor updates. */ + crtc_state =drm_atomic_get_existing_crtc_state (state, new_plane_state->crtc); + +/* Special case for asynchronous cursor updates. */ +if (!crtc_state) crtc_state = plane->crtc->state; return drm_atomic_helper_check_plane_state(plane->state, crtc_state,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 19/565 net/mlx5: fs, lock FTE when checking if active
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Bloch <[email protected]>
[ Upstream commit 9ca314419930f9135727e39d77e66262d5f7bef6 ]
The referenced commits introduced a two-step process for deleting FTEs:
- Lock the FTE, delete it from hardware, set the hardware deletion function to NULL and unlock the FTE.
- Lock the parent flow group, delete the software copy of the FTE, and remove it from the xarray.
However, this approach encounters a race condition if a rule with the same match value is added simultaneously. In this scenario, fs_core may set the hardware deletion function to NULL prematurely, causing a panic during subsequent rule deletions.
To prevent this, ensure the active flag of the FTE is checked under a lock, which will prevent the fs_core layer from attaching a new steering rule to an FTE that is in the process of deletion.
[ 438.967589] MOSHE: 2496 mlx5_del_flow_rules del_hw_func [ 438.968205] ------------[ cut here ]------------ [ 438.968654] refcount_t: decrement hit 0; leaking memory. [ 438.969249] WARNING: CPU: 0 PID: 8957 at lib/refcount.c:31 refcount_warn_saturate+0xfb/0x110 [ 438.970054] Modules linked in: act_mirred cls_flower act_gact sch_ingress openvswitch nsh mlx5_vdpa vringh vhost_iotlb vdpa mlx5_ib mlx5_core xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcgss oid_registry overlay rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm ib_uverbs ib_core zram zsmalloc fuse [last unloaded: cls_flower] [ 438.973288] CPU: 0 UID: 0 PID: 8957 Comm: tc Not tainted 6.12.0-rc1+ #8 [ 438.973888] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [ 438.974874] RIP: 0010:refcount_warn_saturate+0xfb/0x110 [ 438.975363] Code: 40 66 3b 82 c6 05 16 e9 4d 01 01 e8 1f 7c a0 ff 0f 0b c3 cc cc cc cc 48 c7 c7 10 66 3b 82 c6 05 fd e8 4d 01 01 e8 05 7c a0 ff <0f> 0b c3 cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 90 [ 438.976947] RSP: 0018:ffff888124a53610 EFLAGS: 00010286 [ 438.977446] RAX: 0000000000000000 RBX: ffff888119d56de0 RCX: 0000000000000000 [ 438.978090] RDX: ffff88852c828700 RSI: ffff88852c81b3c0 RDI: ffff88852c81b3c0 [ 438.978721] RBP: ffff888120fa0e88 R08: 0000000000000000 R09: ffff888124a534b0 [ 438.979353] R10: 0000000000000001 R11: 0000000000000001 R12: ffff888119d56de0 [ 438.979979] R13: ffff888120fa0ec0 R14: ffff888120fa0ee8 R15: ffff888119d56de0 [ 438.980607] FS: 00007fe6dcc0f800(0000) GS:ffff88852c800000(0000) knlGS:0000000000000000 [ 438.983984] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 438.984544] CR2: 00000000004275e0 CR3: 0000000186982001 CR4: 0000000000372eb0 [ 438.985205] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 438.985842] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 438.986507] Call Trace: [ 438.986799] <TASK> [ 438.987070] ? __warn+0x7d/0x110 [ 438.987426] ? refcount_warn_saturate+0xfb/0x110 [ 438.987877] ? report_bug+0x17d/0x190 [ 438.988261] ? prb_read_valid+0x17/0x20 [ 438.988659] ? handle_bug+0x53/0x90 [ 438.989054] ? exc_invalid_op+0x14/0x70 [ 438.989458] ? asm_exc_invalid_op+0x16/0x20 [ 438.989883] ? refcount_warn_saturate+0xfb/0x110 [ 438.990348] mlx5_del_flow_rules+0x2f7/0x340 [mlx5_core] [ 438.990932] __mlx5_eswitch_del_rule+0x49/0x170 [mlx5_core] [ 438.991519] ? mlx5_lag_is_sriov+0x3c/0x50 [mlx5_core] [ 438.992054] ? xas_load+0x9/0xb0 [ 438.992407] mlx5e_tc_rule_unoffload+0x45/0xe0 [mlx5_core] [ 438.993037] mlx5e_tc_del_fdb_flow+0x2a6/0x2e0 [mlx5_core] [ 438.993623] mlx5e_flow_put+0x29/0x60 [mlx5_core] [ 438.994161] mlx5e_delete_flower+0x261/0x390 [mlx5_core] [ 438.994728] tc_setup_cb_destroy+0xb9/0x190 [ 438.995150] fl_hw_destroy_filter+0x94/0xc0 [cls_flower] [ 438.995650] fl_change+0x11a4/0x13c0 [cls_flower] [ 438.996105] tc_new_tfilter+0x347/0xbc0 [ 438.996503] ? ___slab_alloc+0x70/0x8c0 [ 438.996929] rtnetlink_rcv_msg+0xf9/0x3e0 [ 438.997339] ? __netlink_sendskb+0x4c/0x70 [ 438.997751] ? netlink_unicast+0x286/0x2d0 [ 438.998171] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 438.998625] netlink_rcv_skb+0x54/0x100 [ 438.999020] netlink_unicast+0x203/0x2d0 [ 438.999421] netlink_sendmsg+0x1e4/0x420 [ 438.999820] __sock_sendmsg+0xa1/0xb0 [ 439.000203] ____sys_sendmsg+0x207/0x2a0 [ 439.000600] ? copy_msghdr_from_user+0x6d/0xa0 [ 439.001072] ___sys_sendmsg+0x80/0xc0 [ 439.001459] ? ___sys_recvmsg+0x8b/0xc0 [ 439.001848] ? generic_update_time+0x4d/0x60 [ 439.002282] __sys_sendmsg+0x51/0x90 [ 439.002658] do_syscall_64+0x50/0x110 [ 439.003040] entry_SYSCALL_64_after_hwframe+0x76/0x7e
--- drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/fs_core.c +12 -3
@@ -1806,13 +1806,22 @@ lookup_fte_locked(struct mlx5_flow_group *g, fte_tmp =NULL ; goto out; } + +nested_down_write_ref_node (&fte_tmp->node,FS_LOCK_CHILD ); +if (!fte_tmp->node.active) { +up_write_ref_node (&fte_tmp->node, false); + +if (take_write) +up_write_ref_node (&g->node, false); +else +up_read_ref_node (&g->node); +tree_put_node (&fte_tmp->node, false); - fte_tmp =NULL ; - goto out; + +return NULL ; } -nested_down_write_ref_node (&fte_tmp->node,FS_LOCK_CHILD ); out:if (take_write)up_write_ref_node (&g->node, false);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 20/565 net/mlx5e: kTLS, Fix incorrect page refcounting
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dragos Tatulea <[email protected]>
[ Upstream commit dd6e972cc5890d91d6749bb48e3912721c4e4b25 ]
The kTLS tx handling code is using a mix of get_page() and page_ref_inc() APIs to increment the page reference. But on the release path (mlx5e_ktls_tx_handle_resync_dump_comp()), only put_page() is used.
This is an issue when using pages from large folios: the get_page() references are stored on the folio page while the page_ref_inc() references are stored directly in the given page. On release the folio page will be dereferenced too many times.
This was found while doing kTLS testing with sendfile() + ZC when the served file was read from NFS on a kernel with NFS large folios support (commit 49b29a573da8 ("nfs: add support for large folios")).
--- .../net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c +4 -4
@@ -269,7 +269,7 @@ tx_sync_info_get(struct mlx5e_ktls_offload_context_tx *priv_tx,while (remaining >0 ) {skb_frag_t *frag = &record->frags[i]; -get_page (skb_frag_page (frag)); +page_ref_inc (skb_frag_page (frag)); remaining -=skb_frag_size (frag); info->frags[i++] = *frag; }
@@ -356,7 +356,7 @@ void mlx5e_ktls_tx_handle_resync_dump_comp(struct mlx5e_txqsq *sq, stats = sq->stats;mlx5e_tx_dma_unmap (sq->pdev, dma); -put_page (wi->resync_dump_frag_page); +page_ref_dec (wi->resync_dump_frag_page); stats->tls_dump_packets++; stats->tls_dump_bytes += wi->num_bytes; }
@@ -437,12 +437,12 @@ mlx5e_ktls_tx_handle_ooo(struct mlx5e_ktls_offload_context_tx *priv_tx, err_out:for (; i < info.nr_frags; i++) -/* The put_page() here undoes the page ref obtained in tx_sync_info_get(). +/* The page_ref_dec() here undoes the page ref obtained in tx_sync_info_get(). * Page refs obtained for the DUMP WQEs above (by page_ref_add) will be * released only upon their completions (or in mlx5e_free_txqsq_descs, * if channel closes). */ -put_page (skb_frag_page (&info.frags[i])); +page_ref_dec (skb_frag_page (&info.frags[i]));return MLX5E_KTLS_SYNC_FAIL ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 21/565 net/mlx5e: CT: Fix null-ptr-deref in add rule err flow
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Moshe Shemesh <[email protected]>
[ Upstream commit e99c6873229fe0482e7ceb7d5600e32d623ed9d9 ]
In error flow of mlx5_tc_ct_entry_add_rule(), in case ct_rule_add() callback returns error, zone_rule->attr is used uninitiated. Fix it to use attr which has the needed pointer value.
Kernel log:
BUG: kernel NULL pointer dereference, address: 0000000000000110 RIP: 0010:mlx5_tc_ct_entry_add_rule+0x2b1/0x2f0 [mlx5_core] … Call Trace: <TASK> ? __die+0x20/0x70 ? page_fault_oops+0x150/0x3e0 ? exc_page_fault+0x74/0x140 ? asm_exc_page_fault+0x22/0x30 ? mlx5_tc_ct_entry_add_rule+0x2b1/0x2f0 [mlx5_core] ? mlx5_tc_ct_entry_add_rule+0x1d5/0x2f0 [mlx5_core] mlx5_tc_ct_block_flow_offload+0xc6a/0xf90 [mlx5_core] ? nf_flow_offload_tuple+0xd8/0x190 [nf_flow_table] nf_flow_offload_tuple+0xd8/0x190 [nf_flow_table] flow_offload_work_handler+0x142/0x320 [nf_flow_table] ? finish_task_switch.isra.0+0x15b/0x2b0 process_one_work+0x16c/0x320 worker_thread+0x28c/0x3a0 ? __pfx_worker_thread+0x10/0x10 kthread+0xb8/0xf0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2d/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK>
--- drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c +1 -1
@@ -784,7 +784,7 @@ mlx5_tc_ct_entry_add_rule(struct mlx5_tc_ct_priv *ct_priv,return 0 ; err_rule: -mlx5_tc_ct_entry_destroy_mod_hdr (ct_priv, zone_rule->attr, zone_rule->mh); +mlx5_tc_ct_entry_destroy_mod_hdr (ct_priv, attr, zone_rule->mh);mlx5_put_label_mapping (ct_priv, attr->ct_attr.ct_labels_id); err_mod_hdr:kfree (attr);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 22/565 samples: pktgen: correct dev to DEV
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Fang <[email protected]>
[ Upstream commit 3342dc8b4623d835e7dd76a15cec2e5a94fe2f93 ]
In the pktgen_sample01_simple.sh script, the device variable is uppercase 'DEV' instead of lowercase 'dev'. Because of this typo, the script cannot enable UDP tx checksum.
--- samples/pktgen/pktgen_sample01_simple.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
samples/pktgen/pktgen_sample01_simple.sh +1 -1
@@ -72,7 +72,7 @@ if [ -n "$DST_PORT" ]; then pg_set $DEV "udp_dst_max $UDP_DST_MAX" fi -[ ! -z "$UDP_CSUM" ] && pg_set $dev "flag UDPCSUM" +[ ! -z "$UDP_CSUM" ] && pg_set $DEV "flag UDPCSUM" # Setup random UDP port src range pg_set $DEV "flag UDPSRC_RND"
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 23/565 ARM: 9419/1: mm: Fix kernel memory mapping for xip kernels
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harith G <[email protected]>
[ Upstream commit ed6cbe6e5563452f305e89c15846820f2874e431 ]
The patchset introducing kernel_sec_start/end variables to separate the kernel/lowmem memory mappings, broke the mapping of the kernel memory for xipkernels.
kernel_sec_start/end variables are in RO area before the MMU is switched on for xipkernels.
So these cannot be set early in boot in head.S. Fix this by setting these after MMU is switched on.
xipkernels need two different mappings for kernel text (starting at CONFIG_XIP_PHYS_ADDR) and data (starting at CONFIG_PHYS_OFFSET). Also, move the kernel code mapping from devicemaps_init() to map_kernel().
--- arch/arm/kernel/head.S | 8 ++++++-- arch/arm/mm/mmu.c | 34 +++++++++++++++++++++------------- 2 files changed, 27 insertions(+), 15 deletions(-)
arch/arm/kernel/head.S +6 -2
@@ -252,11 +252,15 @@ __create_page_tables: */ add r0, r4, #KERNEL_OFFSET >> (SECTION_SHIFT - PMD_ORDER) ldr r6, =(_end - 1) + + /* For XIP, kernel_sec_start/kernel_sec_end are currently in RO memory */ +#ifndef CONFIG_XIP_KERNEL adr_l r5, kernel_sec_start @ _pa(kernel_sec_start) #if defined CONFIG_CPU_ENDIAN_BE8 || defined CONFIG_CPU_ENDIAN_BE32 str r8, [r5, #4] @ Save physical start of kernel (BE) #else str r8, [r5] @ Save physical start of kernel (LE) +#endif #endif orr r3, r8, r7 @ Add the MMU flags add r6, r4, r6, lsr #(SECTION_SHIFT - PMD_ORDER)
@@ -264,6 +268,7 @@ __create_page_tables: add r3, r3, #1 << SECTION_SHIFT cmp r0, r6 bls 1b +#ifndef CONFIG_XIP_KERNEL eor r3, r3, r7 @ Remove the MMU flags adr_l r5, kernel_sec_end @ _pa(kernel_sec_end) #if defined CONFIG_CPU_ENDIAN_BE8 || defined CONFIG_CPU_ENDIAN_BE32
@@ -271,8 +276,7 @@ __create_page_tables: #else str r3, [r5] @ Save physical end of kernel (LE) #endif - -#ifdef CONFIG_XIP_KERNEL +#else /* * Map the kernel image separately as it is not located in RAM. */
arch/arm/mm/mmu.c +21 -13
@@ -1381,18 +1381,6 @@ static void __init devicemaps_init(const struct machine_desc *mdesc)create_mapping (&map); } -/* -* Map the kernel if it is XIP. -* It is always first in the modulearea. -*/ -#ifdef CONFIG_XIP_KERNEL - map.pfn =__phys_to_pfn (CONFIG_XIP_PHYS_ADDR &SECTION_MASK ); - map.virtual =MODULES_VADDR ; - map.length = ((unsigned long )_exiprom - map.virtual + ~SECTION_MASK ) &SECTION_MASK ; - map.type =MT_ROM ; -create_mapping (&map); -#endif -/* * Map the cache flushing regions. */
@@ -1582,12 +1570,27 @@ static void __init map_kernel(void)* This will only persist until we turn on proper memory management later on * and we remap the whole kernel with page granularity. */ +#ifdef CONFIG_XIP_KERNEL +phys_addr_t kernel_nx_start = kernel_sec_start; +#else phys_addr_t kernel_x_start = kernel_sec_start;phys_addr_t kernel_x_end =round_up (__pa (__init_end),SECTION_SIZE );phys_addr_t kernel_nx_start = kernel_x_end; +#endif phys_addr_t kernel_nx_end = kernel_sec_end;struct map_desc map; +/* +* Map the kernel if it is XIP. +* It is always first in the modulearea. +*/ +#ifdef CONFIG_XIP_KERNEL + map.pfn =__phys_to_pfn (CONFIG_XIP_PHYS_ADDR &SECTION_MASK ); + map.virtual =MODULES_VADDR ; + map.length = ((unsigned long )_exiprom - map.virtual + ~SECTION_MASK ) &SECTION_MASK ; + map.type =MT_ROM ; +create_mapping (&map); +#else map.pfn =__phys_to_pfn (kernel_x_start); map.virtual =__phys_to_virt (kernel_x_start); map.length = kernel_x_end - kernel_x_start;
@@ -1597,7 +1600,7 @@ static void __init map_kernel(void)/* If the nx part is small it may end up covered by the tail of the RWX section */ if (kernel_x_end == kernel_nx_end)return ; - +#endif map.pfn =__phys_to_pfn (kernel_nx_start); map.virtual =__phys_to_virt (kernel_nx_start); map.length = kernel_nx_end - kernel_nx_start;
@@ -1742,6 +1745,11 @@ void __init paging_init(const struct machine_desc *mdesc) {void *zero_page; +#ifdef CONFIG_XIP_KERNEL +/* Store the kernel RW RAM region start/end in these variables */ + kernel_sec_start =CONFIG_PHYS_OFFSET &SECTION_MASK ; + kernel_sec_end =round_up (__pa (_end),SECTION_SIZE ); +#endif pr_debug ("physical kernel sections: 0x%08llx-0x%08llx\n" , kernel_sec_start, kernel_sec_end);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 24/565 x86/mm: Fix a kdump kernel failure on SME system when CONFIG_IMA_KEXEC=y
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baoquan He <[email protected]>
commit 8d9ffb2fe65a6c4ef114e8d4f947958a12751bbe upstream.
The kdump kernel is broken on SME systems with CONFIG_IMA_KEXEC=y enabled. Debugging traced the issue back to
b69a2afd5afc ("x86/kexec: Carry forward IMA measurement log on kexec").
Testing was previously not conducted on SME systems with CONFIG_IMA_KEXEC enabled, which led to the oversight, with the following incarnation:
...
ima: No TPM chip found, activating TPM-bypass!
Loading compiled-in module X.509 certificates
Loaded X.509 cert 'Build time autogenerated kernel key: 18ae0bc7e79b64700122bb1d6a904b070fef2656'
ima: Allocated hash algorithm: sha256
Oops: general protection fault, probably for non-canonical address 0xcfacfdfe6660003e: 0000 [#1] PREEMPT SMP NOPTI CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.11.0-rc2+ #14 Hardware name: Dell Inc. PowerEdge R7425/02MJ3T, BIOS 1.20.0 05/03/2023 RIP: 0010:ima_restore_measurement_list Call Trace: <TASK> ? show_trace_log_lvl ? show_trace_log_lvl ? ima_load_kexec_buffer ? __die_body.cold ? die_addr ? exc_general_protection ? asm_exc_general_protection ? ima_restore_measurement_list ? vprintk_emit ? ima_load_kexec_buffer ima_load_kexec_buffer ima_init ? __pfx_init_ima init_ima ? __pfx_init_ima do_one_initcall do_initcalls ? __pfx_kernel_init kernel_init_freeable kernel_init ret_from_fork ? __pfx_kernel_init ret_from_fork_asm </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- ... Kernel panic - not syncing: Fatal exception Kernel Offset: disabled Rebooting in 10 seconds..
Adding debug printks showed that the stored addr and size of ima_kexec buffer are not decrypted correctly like:
ima: ima_load_kexec_buffer, buffer:0xcfacfdfe6660003e, size:0xe48066052d5df359
Three types of setup_data info
— SETUP_EFI,
- SETUP_IMA, and
- SETUP_RNG_SEED
are passed to the kexec/kdump kernel. Only the ima_kexec buffer experienced incorrect decryption. Debugging identified a bug in early_memremap_is_setup_data(), where an incorrect range calculation occurred due to the len variable in struct setup_data ended up only representing the length of the data field, excluding the struct's size, and thus leading to miscalculation.
Address a similar issue in memremap_is_setup_data() while at it.
[ bp: Heavily massage. ]
--- arch/x86/mm/ioremap.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
arch/x86/mm/ioremap.c +4 -2
@@ -641,7 +641,8 @@ static bool memremap_is_setup_data(resou paddr_next = data->next; len = data->len; -if ((phys_addr > paddr) && (phys_addr < (paddr + len))) { +if ((phys_addr > paddr) && + (phys_addr < (paddr +sizeof (struct setup_data ) + len))) {memunmap (data);return true; }
@@ -703,7 +704,8 @@ static bool __init early_memremap_is_set paddr_next = data->next; len = data->len; -if ((phys_addr > paddr) && (phys_addr < (paddr + len))) { +if ((phys_addr > paddr) && + (phys_addr < (paddr +sizeof (struct setup_data ) + len))) {early_memunmap (data,sizeof (*data));return true; }
Greg Kroah-Hartman
maintainerPATCH 25/565 mm: fix NULL pointer dereference in alloc_pages_bulk_noprof
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjiang Tu <[email protected]>
commit 8ce41b0f9d77cca074df25afd39b86e2ee3aa68e upstream.
We triggered a NULL pointer dereference for ac.preferred_zoneref->zone in alloc_pages_bulk_noprof() when the task is migrated between cpusets.
When cpuset is enabled, in prepare_alloc_pages(), ac->nodemask may be ¤t->mems_allowed. when first_zones_zonelist() is called to find preferred_zoneref, the ac->nodemask may be modified concurrently if the task is migrated between different cpusets. Assuming we have 2 NUMA Node, when traversing Node1 in ac->zonelist, the nodemask is 2, and when traversing Node2 in ac->zonelist, the nodemask is 1. As a result, the ac->preferred_zoneref points to NULL zone.
In alloc_pages_bulk_noprof(), for_each_zone_zonelist_nodemask() finds a allowable zone and calls zonelist_node_idx(ac.preferred_zoneref), leading to NULL pointer dereference.
__alloc_pages_noprof() fixes this issue by checking NULL pointer in commit ea57485af8f4 ("mm, page_alloc: fix check for NULL preferred_zone") and commit df76cee6bbeb ("mm, page_alloc: remove redundant checks from alloc fastpath").
To fix it, check NULL pointer for preferred_zoneref->zone.
--- mm/page_alloc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
mm/page_alloc.c +2 -1
@@ -5336,7 +5336,8 @@ unsigned long __alloc_pages_bulk(gfp_t g gfp = alloc_gfp;/* Find an allowed local zone that meets the low watermark. */ -for_each_zone_zonelist_nodemask (zone, z, ac.zonelist, ac.highest_zoneidx, ac.nodemask) { + z = ac.preferred_zoneref; + for_next_zone_zonelist_nodemask(zone, z, ac.highest_zoneidx, ac.nodemask) {unsigned long mark; if (cpusets_enabled() && (alloc_flags & ALLOC_CPUSET) &&
Greg Kroah-Hartman
maintainerPATCH 26/565 ocfs2: uncache inode which has failed entering the group
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
commit 737f34137844d6572ab7d473c998c7f977ff30eb upstream.
Syzbot has reported the following BUG:
kernel BUG at fs/ocfs2/uptodate.c:509!
...
Call Trace: <TASK> ? __die_body+0x5f/0xb0 ? die+0x9e/0xc0 ? do_trap+0x15a/0x3a0 ? ocfs2_set_new_buffer_uptodate+0x145/0x160 ? do_error_trap+0x1dc/0x2c0 ? ocfs2_set_new_buffer_uptodate+0x145/0x160 ? __pfx_do_error_trap+0x10/0x10 ? handle_invalid_op+0x34/0x40 ? ocfs2_set_new_buffer_uptodate+0x145/0x160 ? exc_invalid_op+0x38/0x50 ? asm_exc_invalid_op+0x1a/0x20 ? ocfs2_set_new_buffer_uptodate+0x2e/0x160 ? ocfs2_set_new_buffer_uptodate+0x144/0x160 ? ocfs2_set_new_buffer_uptodate+0x145/0x160 ocfs2_group_add+0x39f/0x15a0 ? __pfx_ocfs2_group_add+0x10/0x10 ? __pfx_lock_acquire+0x10/0x10 ? mnt_get_write_access+0x68/0x2b0 ? __pfx_lock_release+0x10/0x10 ? rcu_read_lock_any_held+0xb7/0x160 ? __pfx_rcu_read_lock_any_held+0x10/0x10 ? smack_log+0x123/0x540 ? mnt_get_write_access+0x68/0x2b0 ? mnt_get_write_access+0x68/0x2b0 ? mnt_get_write_access+0x226/0x2b0 ocfs2_ioctl+0x65e/0x7d0 ? __pfx_ocfs2_ioctl+0x10/0x10 ? smack_file_ioctl+0x29e/0x3a0 ? __pfx_smack_file_ioctl+0x10/0x10 ? lockdep_hardirqs_on_prepare+0x43d/0x780 ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 ? __pfx_ocfs2_ioctl+0x10/0x10 __se_sys_ioctl+0xfb/0x170 do_syscall_64+0xf3/0x230 entry_SYSCALL_64_after_hwframe+0x77/0x7f ... </TASK>
When 'ioctl(OCFS2_IOC_GROUP_ADD, ...)' has failed for the particular inode in 'ocfs2_verify_group_and_input()', corresponding buffer head remains cached and subsequent call to the same 'ioctl()' for the same inode issues the BUG() in 'ocfs2_set_new_buffer_uptodate()' (trying to cache the same buffer head of that inode). Fix this by uncaching the buffer head with 'ocfs2_remove_from_cache()' on error path in 'ocfs2_group_add()'.
--- fs/ocfs2/resize.c | 2 ++ 1 file changed, 2 insertions(+)
fs/ocfs2/resize.c +2 -0
@@ -566,6 +566,8 @@ out_commit:ocfs2_commit_trans (osb, handle); out_free_group_bh: +if (ret <0 ) +ocfs2_remove_from_cache (INODE_CACHE (inode), group_bh);brelse (group_bh); out_unlock:
Greg Kroah-Hartman
maintainerPATCH 27/565 vdpa/mlx5: Fix PA offset with unaligned starting iotlb map
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Si-Wei Liu <[email protected]>
commit 29ce8b8a4fa74e841342c8b8f8941848a3c6f29f upstream.
When calculating the physical address range based on the iotlb and mr [start,end) ranges, the offset of mr->start relative to map->start is not taken into account. This leads to some incorrect and duplicate mappings.
For the case when mr->start < map->start the code is already correct:
the range in [mr->start, map->start) was handled by a different iteration.
Message-Id: <[email protected]>
--- drivers/vdpa/mlx5/core/mr.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/vdpa/mlx5/core/mr.c +5 -3
@@ -232,7 +232,7 @@ static int map_direct_mr(struct mlx5_vdpstruct page *pg;unsigned int nsg;int sglen; -u64 pa; +u64 pa, offset;u64 paend;struct scatterlist *sg;struct device *dma = mvdev->vdev.dma_dev;
@@ -255,8 +255,10 @@ static int map_direct_mr(struct mlx5_vdp sg = mr->sg_head.sgl;for (map =vhost_iotlb_itree_first (iotlb, mr->start, mr->end -1 ); map; map =vhost_iotlb_itree_next (map, mr->start, mr->end -1 )) { - paend = map->addr +maplen (map, mr); -for (pa = map->addr; pa < paend; pa += sglen) { + offset = mr->start > map->start ? mr->start - map->start :0 ; + pa = map->addr + offset; + paend = map->addr + offset +maplen (map, mr); +for (; pa < paend; pa += sglen) { pg =pfn_to_page (__phys_to_pfn (pa));if (!sg) { mlx5_vdpa_warn(mvdev, "sg null. start 0x%llx, end 0x%llx\n",
Greg Kroah-Hartman
maintainerPATCH 28/565 KVM: nVMX: Treat vpid01 as current if L2 is active, but with VPID disabled
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit 2657b82a78f18528bef56dc1b017158490970873 upstream.
When getting the current VPID, e.g. to emulate a guest TLB flush, return vpid01 if L2 is running but with VPID disabled, i.e. if VPID is disabled in vmcs12. Architecturally, if VPID is disabled, then the guest and host effectively share VPID=0. KVM emulates this behavior by using vpid01 when running an L2 with VPID disabled (see prepare_vmcs02_early_rare()), and so KVM must also treat vpid01 as the current VPID while L2 is active.
Unconditionally treating vpid02 as the current VPID when L2 is active causes KVM to flush TLB entries for vpid02 instead of vpid01, which results in TLB entries from L1 being incorrectly preserved across nested VM-Enter to L2 (L2=>L1 isn't problematic, because the TLB flush after nested VM-Exit flushes vpid01).
The bug manifests as failures in the vmx_apicv_test KVM-Unit-Test, as KVM incorrectly retains TLB entries for the APIC-access page across a nested VM-Enter.
Opportunisticaly add comments at various touchpoints to explain the architectural requirements, and also why KVM uses vpid01 instead of vpid02.
All credit goes to Chao, who root caused the issue and identified the fix.
--- arch/x86/kvm/vmx/nested.c | 30 +++++++++++++++++++++++++----- arch/x86/kvm/vmx/vmx.c | 2 +- 2 files changed, 26 insertions(+), 6 deletions(-)
arch/x86/kvm/vmx/nested.c +25 -5
@@ -1158,11 +1158,14 @@ static void nested_vmx_transition_tlb_flstruct vcpu_vmx *vmx =to_vmx (vcpu);/* -* If vmcs12 doesn't use VPID, L1 expects linear and combined mappings -* for *all* contexts to be flushed on VM-Enter/VM-Exit, i.e. it's a -* full TLB flush from the guest's perspective. This is required even -* if VPID is disabled in the host as KVM may need to synchronize the -* MMU in response to the guest TLB flush. +* If VPID is disabled, then guest TLB accesses use VPID=0, i.e. the +* same VPID as the host, and so architecturally, linear and combined +* mappings for VPID=0 must be flushed at VM-Enter and VM-Exit. KVM +* emulates L2 sharing L1's VPID=0 by using vpid01 while running L2, +* and so KVM must also emulate TLB flush of VPID=0, i.e. vpid01. This +* is required if VPID is disabled in KVM, as a TLB flush (there are no +* VPIDs) still occurs from L1's perspective, and KVM may need to +* synchronize the MMU in response to the guest TLB flush. * * Note, using TLB_FLUSH_GUEST is correct even if nested EPT is in use. * EPT is a special snowflake, as guest-physical mappings aren't
@@ -2189,6 +2192,17 @@ static void prepare_vmcs02_early_rare(stvmcs_write64 (VMCS_LINK_POINTER ,-1ull ); +/* +* If VPID is disabled, then guest TLB accesses use VPID=0, i.e. the +* same VPID as the host. Emulate this behavior by using vpid01 for L2 +* if VPID is disabled in vmcs12. Note, if VPID is disabled, VM-Enter +* and VM-Exit are architecturally required to flush VPID=0, but *only* +* VPID=0. I.e. using vpid02 would be ok (so long as KVM emulates the +* required flushes), but doing so would cause KVM to over-flush. E.g. +* if L1 runs L2 X with VPID12=1, then runs L2 Y with VPID12 disabled, +* and then runs L2 X again, then KVM can and should retain TLB entries +* for VPID12=1. +*/ if (enable_vpid) {if (nested_cpu_has_vpid (vmcs12) && vmx->nested.vpid02)vmcs_write16 (VIRTUAL_PROCESSOR_ID , vmx->nested.vpid02);
@@ -5591,6 +5605,12 @@ static int handle_invvpid(struct kvm_vcpreturn nested_vmx_fail (vcpu,VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID ); +/* +* Always flush the effective vpid02, i.e. never flush the current VPID +* and never explicitly flush vpid01. INVVPID targets a VPID, not a +* VMCS, and so whether or not the current vmcs12 has VPID enabled is +* irrelevant (and there may not be a loaded vmcs12). +*/ vpid02 =nested_get_vpid02 (vcpu);switch (type) {case VMX_VPID_EXTENT_INDIVIDUAL_ADDR :
arch/x86/kvm/vmx/vmx.c +1 -1
@@ -3019,7 +3019,7 @@ static void vmx_flush_tlb_all(struct kvmstatic inline int vmx_get_current_vpid (struct kvm_vcpu *vcpu) { -if (is_guest_mode (vcpu)) +if (is_guest_mode (vcpu) &&nested_cpu_has_vpid (get_vmcs12 (vcpu)))return nested_get_vpid02 (vcpu);return to_vmx (vcpu)->vpid; }
Greg Kroah-Hartman
maintainerPATCH 29/565 KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit aa0d42cacf093a6fcca872edc954f6f812926a17 upstream.
Hide KVM's pt_mode module param behind CONFIG_BROKEN, i.e. disable support for virtualizing Intel PT via guest/host mode unless BROKEN=y. There are myriad bugs in the implementation, some of which are fatal to the guest, and others which put the stability and health of the host at risk.
For guest fatalities, the most glaring issue is that KVM fails to ensure tracing is disabled, and *stays* disabled prior to VM-Enter, which is necessary as hardware disallows loading (the guest's) RTIT_CTL if tracing is enabled (enforced via a VMX consistency check). Per the SDM:
If the logical processor is operating with Intel PT enabled (if IA32_RTIT_CTL.TraceEn = 1) at the time of VM entry, the "load IA32_RTIT_CTL" VM-entry control must be 0.
On the host side, KVM doesn't validate the guest CPUID configuration provided by userspace, and even worse, uses the guest configuration to decide what MSRs to save/load at VM-Enter and VM-Exit. E.g. configuring guest CPUID to enumerate more address ranges than are supported in hardware will result in KVM trying to passthrough, save, and load non-existent MSRs, which generates a variety of WARNs, ToPA ERRORs in the host, a potential deadlock, etc.
Message-ID: <[email protected]>
--- arch/x86/kvm/vmx/vmx.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/x86/kvm/vmx/vmx.c +3 -1
@@ -200,9 +200,11 @@ module_param(ple_window_shrink, uint, 04static unsigned int ple_window_max =KVM_VMX_DEFAULT_PLE_WINDOW_MAX ;module_param (ple_window_max, uint,0444 ); -/* Default is SYSTEM mode, 1 for host-guest mode */ +/* Default is SYSTEM mode, 1 for host-guest mode (which is BROKEN) */ int __read_mostly pt_mode =PT_MODE_SYSTEM ; +#ifdef CONFIG_BROKEN module_param (pt_mode, int,S_IRUGO ); +#endif static DEFINE_STATIC_KEY_FALSE (vmx_l1d_should_flush);static DEFINE_STATIC_KEY_FALSE (vmx_l1d_flush_cond);
Greg Kroah-Hartman
maintainerPATCH 30/565 nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <[email protected]>
commit cd45e963e44b0f10d90b9e6c0e8b4f47f3c92471 upstream.
Patch series "nilfs2: fix null-ptr-deref bugs on block tracepoints".
This series fixes null pointer dereference bugs that occur when using nilfs2 and two block-related tracepoints.
This patch (of 2):
It has been reported that when using "block:block_touch_buffer" tracepoint, touch_buffer() called from __nilfs_get_folio_block() causes a NULL pointer dereference, or a general protection fault when KASAN is enabled.
This happens because since the tracepoint was added in touch_buffer(), it references the dev_t member bh->b_bdev->bd_dev regardless of whether the buffer head has a pointer to a block_device structure. In the current implementation, the block_device structure is set after the function returns to the caller.
Here, touch_buffer() is used to mark the folio/page that owns the buffer head as accessed, but the common search helper for folio/page used by the caller function was optimized to mark the folio/page as accessed when it was reimplemented a long time ago, eliminating the need to call touch_buffer() here in the first place.
So this solves the issue by eliminating the touch_buffer() call itself.
--- fs/nilfs2/page.c | 1 - 1 file changed, 1 deletion(-)
fs/nilfs2/page.c +0 -1
@@ -39,7 +39,6 @@ __nilfs_get_page_block(struct page *page first_block = (unsigned long )index << (PAGE_SHIFT - blkbits); bh =nilfs_page_get_nth_block (page, block - first_block); -touch_buffer (bh);wait_on_buffer (bh);return bh; }
Greg Kroah-Hartman
maintainerPATCH 31/565 ocfs2: fix UBSAN warning in ocfs2_verify_volume()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
commit 23aab037106d46e6168ce1214a958ce9bf317f2e upstream.
Syzbot has reported the following splat triggered by UBSAN:
UBSAN: shift-out-of-bounds in fs/ocfs2/super.c:2336:10 shift exponent 32768 is too large for 32-bit type 'int' CPU: 2 UID: 0 PID: 5255 Comm: repro Not tainted 6.12.0-rc4-syzkaller-00047-gc2ee9f594da8 #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x241/0x360 ? __pfx_dump_stack_lvl+0x10/0x10 ? __pfx__printk+0x10/0x10 ? __asan_memset+0x23/0x50 ? lockdep_init_map_type+0xa1/0x910 __ubsan_handle_shift_out_of_bounds+0x3c8/0x420 ocfs2_fill_super+0xf9c/0x5750 ? __pfx_ocfs2_fill_super+0x10/0x10 ? __pfx_validate_chain+0x10/0x10 ? __pfx_validate_chain+0x10/0x10 ? validate_chain+0x11e/0x5920 ? __lock_acquire+0x1384/0x2050 ? __pfx_validate_chain+0x10/0x10 ? string+0x26a/0x2b0 ? widen_string+0x3a/0x310 ? string+0x26a/0x2b0 ? bdev_name+0x2b1/0x3c0 ? pointer+0x703/0x1210 ? __pfx_pointer+0x10/0x10 ? __pfx_format_decode+0x10/0x10 ? __lock_acquire+0x1384/0x2050 ? vsnprintf+0x1ccd/0x1da0 ? snprintf+0xda/0x120 ? __pfx_lock_release+0x10/0x10 ? do_raw_spin_lock+0x14f/0x370 ? __pfx_snprintf+0x10/0x10 ? set_blocksize+0x1f9/0x360 ? sb_set_blocksize+0x98/0xf0 ? setup_bdev_super+0x4e6/0x5d0 mount_bdev+0x20c/0x2d0 ? __pfx_ocfs2_fill_super+0x10/0x10 ? __pfx_mount_bdev+0x10/0x10 ? vfs_parse_fs_string+0x190/0x230 ? __pfx_vfs_parse_fs_string+0x10/0x10 legacy_get_tree+0xf0/0x190 ? __pfx_ocfs2_mount+0x10/0x10 vfs_get_tree+0x92/0x2b0 do_new_mount+0x2be/0xb40 ? __pfx_do_new_mount+0x10/0x10 __se_sys_mount+0x2d6/0x3c0 ? __pfx___se_sys_mount+0x10/0x10 ? do_syscall_64+0x100/0x230 ? __x64_sys_mount+0x20/0xc0 do_syscall_64+0xf3/0x230 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f37cae96fda Code: 48 8b 0d 51 ce 0c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 1e ce 0c 00 f7 d8 64 89 01 48 RSP: 002b:00007fff6c1aa228 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007fff6c1aa240 RCX: 00007f37cae96fda RDX: 00000000200002c0 RSI: 0000000020000040 RDI: 00007fff6c1aa240 RBP: 0000000000000004 R08: 00007fff6c1aa280 R09: 0000000000000000 R10: 00000000000008c0 R11: 0000000000000206 R12: 00000000000008c0 R13: 00007fff6c1aa280 R14: 0000000000000003 R15: 0000000001000000 </TASK>
For a really damaged superblock, the value of 'i_super.s_blocksize_bits' may exceed the maximum possible shift for an underlying 'int'. So add an extra check whether the aforementioned field represents the valid block size, which is 512 bytes, 1K, 2K, or 4K.
--- fs/ocfs2/super.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
fs/ocfs2/super.c +9 -4
@@ -2325,6 +2325,7 @@ static int ocfs2_verify_volume(struct oc struct ocfs2_blockcheck_stats *stats) {int status = -EAGAIN ; +u32 blksz_bits;if (memcmp (di->i_signature,OCFS2_SUPER_BLOCK_SIGNATURE ,strlen (OCFS2_SUPER_BLOCK_SIGNATURE )) ==0 ) {
@@ -2339,11 +2340,15 @@ static int ocfs2_verify_volume(struct oc goto out; } status = -EINVAL ; -if ((1 <<le32_to_cpu (di->id2.i_super.s_blocksize_bits)) != blksz) { +/* Acceptable block sizes are 512 bytes, 1K, 2K and 4K. */ + blksz_bits =le32_to_cpu (di->id2.i_super.s_blocksize_bits); +if (blksz_bits <9 || blksz_bits >12 ) {mlog (ML_ERROR ,"found superblock with incorrect block " -"size: found %u, should be %u\n" , -1 <<le32_to_cpu (di->id2.i_super.s_blocksize_bits), - blksz); +"size bits: found %u, should be 9, 10, 11, or 12\n" , + blksz_bits); + }else if ((1 <<le32_to_cpu (blksz_bits)) != blksz) { +mlog (ML_ERROR ,"found superblock with incorrect block " +"size: found %u, should be %u\n" ,1 << blksz_bits, blksz); }else if (le16_to_cpu (di->id2.i_super.s_major_rev_level) !=OCFS2_MAJOR_REV_LEVEL || le16_to_cpu(di->id2.i_super.s_minor_rev_level) !=
Greg Kroah-Hartman
maintainerPATCH 32/565 nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <[email protected]>
commit 2026559a6c4ce34db117d2db8f710fe2a9420d5a upstream.
When using the "block:block_dirty_buffer" tracepoint, mark_buffer_dirty() may cause a NULL pointer dereference, or a general protection fault when KASAN is enabled.
This happens because, since the tracepoint was added in mark_buffer_dirty(), it references the dev_t member bh->b_bdev->bd_dev regardless of whether the buffer head has a pointer to a block_device structure.
In the current implementation, nilfs_grab_buffer(), which grabs a buffer to read (or create) a block of metadata, including b-tree node blocks, does not set the block device, but instead does so only if the buffer is not in the "uptodate" state for each of its caller block reading functions. However, if the uptodate flag is set on a folio/page, and the buffer heads are detached from it by try_to_free_buffers(), and new buffer heads are then attached by create_empty_buffers(), the uptodate flag may be restored to each buffer without the block device being set to bh->b_bdev, and mark_buffer_dirty() may be called later in that state, resulting in the bug mentioned above.
Fix this issue by making nilfs_grab_buffer() always set the block device of the super block structure to the buffer head, regardless of the state of the buffer's uptodate flag.
--- fs/nilfs2/btnode.c | 2 -- fs/nilfs2/gcinode.c | 4 +--- fs/nilfs2/mdt.c | 1 - fs/nilfs2/page.c | 1 + 4 files changed, 2 insertions(+), 6 deletions(-)
fs/nilfs2/btnode.c +0 -2
@@ -68,7 +68,6 @@ nilfs_btnode_create_block(struct address goto failed; }memset (bh->b_data,0 ,i_blocksize (inode)); - bh->b_bdev = inode->i_sb->s_bdev; bh->b_blocknr = blocknr;set_buffer_mapped (bh);set_buffer_uptodate (bh);
@@ -133,7 +132,6 @@ int nilfs_btnode_submit_block(struct add goto found; }set_buffer_mapped (bh); - bh->b_bdev = inode->i_sb->s_bdev; bh->b_blocknr = pblocknr;/* set block address for read */ bh->b_end_io = end_buffer_read_sync;get_bh (bh);
fs/nilfs2/gcinode.c +1 -3
@@ -83,10 +83,8 @@ int nilfs_gccache_submit_read_data(struc goto out; } -if (!buffer_mapped (bh)) { - bh->b_bdev = inode->i_sb->s_bdev; +if (!buffer_mapped (bh))set_buffer_mapped (bh); - } bh->b_blocknr = pbn; bh->b_end_io = end_buffer_read_sync;get_bh (bh);
fs/nilfs2/mdt.c +0 -1
@@ -89,7 +89,6 @@ static int nilfs_mdt_create_block(structif (buffer_uptodate (bh)) goto failed_bh; - bh->b_bdev = sb->s_bdev; err =nilfs_mdt_insert_new_block (inode, block, bh, init_block);if (likely (!err)) {get_bh (bh);
fs/nilfs2/page.c +1 -0
@@ -63,6 +63,7 @@ struct buffer_head *nilfs_grab_buffer(stput_page (page);return NULL ; } + bh->b_bdev = inode->i_sb->s_bdev;return bh; }
Greg Kroah-Hartman
maintainerPATCH 33/565 Revert "mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K"
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aurelien Jarno <[email protected]>
commit 1635e407a4a64d08a8517ac59ca14ad4fc785e75 upstream.
The commit 8396c793ffdf ("mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K") increased the max_req_size, even for 4K pages, causing various issues:
- Panic booting the kernel/rootfs from an SD card on Rockchip RK3566
- Panic booting the kernel/rootfs from an SD card on StarFive JH7100
- "swiotlb buffer is full" and data corruption on StarFive JH7110
At this stage no fix have been found, so it's probably better to just revert the change.
This reverts commit 8396c793ffdf28bb8aee7cfe0891080f8cab7890.
Message-ID: <[email protected]>
--- drivers/mmc/host/dw_mmc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/mmc/host/dw_mmc.c +2 -2
@@ -2903,8 +2903,8 @@ static int dw_mci_init_slot(struct dw_mcif (host->use_dma ==TRANS_MODE_IDMAC ) { mmc->max_segs = host->ring_size; mmc->max_blk_size =65535 ; - mmc->max_req_size =DW_MCI_DESC_DATA_LENGTH * host->ring_size; - mmc->max_seg_size = mmc->max_req_size; + mmc->max_seg_size =0x1000 ; + mmc->max_req_size = mmc->max_seg_size * host->ring_size; mmc->max_blk_count = mmc->max_req_size /512 ; }else if (host->use_dma ==TRANS_MODE_EDMAC ) { mmc->max_segs =64 ;
Greg Kroah-Hartman
maintainerPATCH 34/565 drm/bridge: tc358768: Fix DSI command tx
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Dolcini <[email protected]>
commit 32c4514455b2b8fde506f8c0962f15c7e4c26f1d upstream.
Wait for the command transmission to be completed in the DSI transfer function polling for the dc_start bit to go back to idle state after the transmission is started.
This is documented in the datasheet and failures to do so lead to commands corruption.
--- drivers/gpu/drm/bridge/tc358768.c | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-)
drivers/gpu/drm/bridge/tc358768.c +19 -2
@@ -124,6 +124,9 @@#define TC358768_DSI_CONFW_MODE_CLR (6 << 29)#define TC358768_DSI_CONFW_ADDR_DSI_CONTROL (0x3 << 24) +/* TC358768_DSICMD_TX (0x0600) register */ +#define TC358768_DSI_CMDTX_DC_START BIT(0) +static const char *const tc358768_supplies[] = {"vddc" ,"vddmipi" ,"vddio" };
@@ -227,6 +230,21 @@ static void tc358768_update_bits(structtc358768_write (priv, reg, tmp); } +static void tc358768_dsicmd_tx (struct tc358768_priv *priv) +{ +u32 val; + +/* start transfer */ +tc358768_write (priv,TC358768_DSICMD_TX ,TC358768_DSI_CMDTX_DC_START ); +if (priv->error) +return ; + +/* wait transfer completion */ + priv->error =regmap_read_poll_timeout (priv->regmap,TC358768_DSICMD_TX , val, + (val &TC358768_DSI_CMDTX_DC_START ) ==0 , +100 ,100000 ); +} +static int tc358768_sw_reset (struct tc358768_priv *priv) {/* Assert Reset */
@@ -507,8 +525,7 @@ static ssize_t tc358768_dsi_host_transfe } } -/* start transfer */ -tc358768_write (priv,TC358768_DSICMD_TX ,1 ); +tc358768_dsicmd_tx (priv); ret =tc358768_clear_error (priv);if (ret)
Greg Kroah-Hartman
maintainerPATCH 35/565 mmc: sunxi-mmc: Add D1 MMC variant
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samuel Holland <[email protected]>
[ Upstream commit 75a2f412d0aed4a4a80ab2a2d96d040b17acb6d6 ]
D1's MMC controllers are unique in that they have the DMA address shift (like A100) with a 13-bit descriptor size field (like sun4i). Add the compatible and parameters for this new variant.
Stable-dep-of: 85b580afc2c2 ("mmc: sunxi-mmc: Fix A100 compatible description")
--- drivers/mmc/host/sunxi-mmc.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/mmc/host/sunxi-mmc.c +9 -0
@@ -1168,6 +1168,14 @@ static const struct sunxi_mmc_cfg sun9i_a80_cfg = { .can_calibrate = false, }; +static const struct sunxi_mmc_cfg sun20i_d1_cfg = { + .idma_des_size_bits =13 , + .idma_des_shift =2 , + .can_calibrate = true, + .mask_data0 = true, + .needs_new_timings = true, +}; +static const struct sunxi_mmc_cfg sun50i_a64_cfg = { .idma_des_size_bits =16 , .clk_delays =NULL ,
@@ -1206,6 +1214,7 @@ static const struct of_device_id sunxi_mmc_of_match[] = { { .compatible = "allwinner,sun7i-a20-mmc", .data = &sun7i_a20_cfg }, { .compatible = "allwinner,sun8i-a83t-emmc", .data = &sun8i_a83t_emmc_cfg }, { .compatible = "allwinner,sun9i-a80-mmc", .data = &sun9i_a80_cfg }, + { .compatible = "allwinner,sun20i-d1-mmc", .data = &sun20i_d1_cfg }, { .compatible = "allwinner,sun50i-a64-mmc", .data = &sun50i_a64_cfg }, { .compatible = "allwinner,sun50i-a64-emmc", .data = &sun50i_a64_emmc_cfg }, { .compatible = "allwinner,sun50i-a100-mmc", .data = &sun50i_a100_cfg },
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 36/565 mmc: sunxi-mmc: Fix A100 compatible description
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andre Przywara <[email protected]>
[ Upstream commit 85b580afc2c215394e08974bf033de9face94955 ]
It turns out that the Allwinner A100/A133 SoC only supports 8K DMA blocks (13 bits wide), for both the SD/SDIO and eMMC instances. And while this alone would make a trivial fix, the H616 falls back to the A100 compatible string, so we have to now match the H616 compatible string explicitly against the description advertising 64K DMA blocks.
As the A100 is now compatible with the D1 description, let the A100 compatible string point to that block instead, and introduce an explicit match against the H616 string, pointing to the old description. Also remove the redundant setting of clk_delays to NULL on the way.
Message-ID: <[email protected]>
--- drivers/mmc/host/sunxi-mmc.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/mmc/host/sunxi-mmc.c +3 -3
@@ -1191,10 +1191,9 @@ static const struct sunxi_mmc_cfg sun50i_a64_emmc_cfg = { .needs_new_timings = true, }; -static const struct sunxi_mmc_cfg sun50i_a100_cfg = { +static const struct sunxi_mmc_cfg sun50i_h616_cfg = { .idma_des_size_bits =16 , .idma_des_shift =2 , - .clk_delays =NULL , .can_calibrate = true, .mask_data0 = true, .needs_new_timings = true,
@@ -1217,8 +1216,9 @@ static const struct of_device_id sunxi_mmc_of_match[] = { { .compatible = "allwinner,sun20i-d1-mmc", .data = &sun20i_d1_cfg }, { .compatible = "allwinner,sun50i-a64-mmc", .data = &sun50i_a64_cfg }, { .compatible = "allwinner,sun50i-a64-emmc", .data = &sun50i_a64_emmc_cfg }, - { .compatible = "allwinner,sun50i-a100-mmc", .data = &sun50i_a100_cfg }, + { .compatible = "allwinner,sun50i-a100-mmc", .data = &sun20i_d1_cfg }, { .compatible = "allwinner,sun50i-a100-emmc", .data = &sun50i_a100_emmc_cfg }, + { .compatible = "allwinner,sun50i-h616-mmc", .data = &sun50i_h616_cfg }, {/* sentinel */ } };MODULE_DEVICE_TABLE (of, sunxi_mmc_of_match);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 37/565 lib/buildid: Fix build ID parsing logic
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Olsa <[email protected]>
The parse_build_id_buf does not account Elf32_Nhdr header size when getting the build id data pointer and returns wrong build id data as result.
This is problem only stable trees that merged 8fa2b6817a95 fix, the upstream build id code was refactored and returns proper build id.
--- lib/buildid.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
lib/buildid.c +1 -1
@@ -40,7 +40,7 @@ static int parse_build_id_buf(unsigned c name_sz == note_name_sz && memcmp(nhdr + 1, note_name, note_name_sz) == 0 && desc_sz > 0 && desc_sz <= BUILD_ID_SIZE_MAX) { - data = note_start + note_off +ALIGN (note_name_sz,4 ); + data = note_start + note_off +sizeof (Elf32_Nhdr) +ALIGN (note_name_sz,4 );memcpy (build_id, data, desc_sz);memset (build_id + desc_sz,0 ,BUILD_ID_SIZE_MAX - desc_sz);if (size)
Greg Kroah-Hartman
maintainerPATCH 38/565 media: dvbdev: fix the logic when DVB_DYNAMIC_MINORS is not set
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mauro Carvalho Chehab <[email protected]>
commit a4aebaf6e6efff548b01a3dc49b4b9074751c15b upstream.
When CONFIG_DVB_DYNAMIC_MINORS, ret is not initialized, and a semaphore is left at the wrong state, in case of errors.
Make the code simpler and avoid mistakes by having just one error check logic used weather DVB_DYNAMIC_MINORS is used or not.
--- drivers/media/dvb-core/dvbdev.c | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-)
drivers/media/dvb-core/dvbdev.c +4 -11
@@ -544,6 +544,9 @@ int dvb_register_device(struct dvb_adaptfor (minor =0 ; minor <MAX_DVB_MINORS ; minor++)if (dvb_minors[minor] ==NULL )break ; +#else + minor =nums2minor (adap->num, type, id); +#endif if (minor >=MAX_DVB_MINORS ) {if (new_node) {list_del (&new_node->list_head);
@@ -557,17 +560,7 @@ int dvb_register_device(struct dvb_adaptmutex_unlock (&dvbdev_register_lock);return -EINVAL ; } -#else - minor =nums2minor (adap->num, type, id); -if (minor >=MAX_DVB_MINORS ) { -dvb_media_device_free (dvbdev); -list_del (&dvbdev->list_head); -kfree (dvbdev); - *pdvbdev =NULL ; -mutex_unlock (&dvbdev_register_lock); -return ret; - } -#endif + dvbdev->minor = minor; dvb_minors[minor] =dvb_device_get (dvbdev);up_write (&minor_rwsem);
Greg Kroah-Hartman
maintainerPATCH 39/565 NFSD: initialize copy->cp_clp early in nfsd4_copy for use by trace point
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dai Ngo <[email protected]>
[ Upstream commit 15d1975b7279693d6f09398e0e2e31aca2310275 ]
Prepare for adding server copy trace points.
Stable-dep-of: 9ed666eba4e0 ("NFSD: Async COPY result needs to return a write verifier")
--- fs/nfsd/nfs4proc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nfsd/nfs4proc.c +1 -1
@@ -1769,6 +1769,7 @@ nfsd4_copy(struct svc_rqst *rqstp, struc__be32 status;struct nfsd4_copy *async_copy =NULL ; + copy->cp_clp = cstate->clp;if (nfsd4_ssc_is_inter (copy)) {if (!inter_copy_offload_enable ||nfsd4_copy_is_sync (copy)) { status = nfserr_notsupp;
@@ -1783,7 +1784,6 @@ nfsd4_copy(struct svc_rqst *rqstp, strucreturn status; } - copy->cp_clp = cstate->clp;memcpy (©->fh, &cstate->current_fh.fh_handle,sizeof (struct knfsd_fh ));if (nfsd4_copy_is_async (copy)) {
Greg Kroah-Hartman
maintainerPATCH 40/565 NFSD: Async COPY result needs to return a write verifier
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
[ Upstream commit 9ed666eba4e0a2bb8ffaa3739d830b64d4f2aaad ]
Currently, when NFSD handles an asynchronous COPY, it returns a zero write verifier, relying on the subsequent CB_OFFLOAD callback to pass the write verifier and a stable_how4 value to the client.
However, if the CB_OFFLOAD never arrives at the client (for example, if a network partition occurs just as the server sends the CB_OFFLOAD operation), the client will never receive this verifier. Thus, if the client sends a follow-up COMMIT, there is no way for the client to assess the COMMIT result.
The usual recovery for a missing CB_OFFLOAD is for the client to send an OFFLOAD_STATUS operation, but that operation does not carry a write verifier in its result. Neither does it carry a stable_how4 value, so the client /must/ send a COMMIT in this case -- which will always fail because currently there's still no write verifier in the COPY result.
Thus the server needs to return a normal write verifier in its COPY result even if the COPY operation is to be performed asynchronously.
If the server recognizes the callback stateid in subsequent OFFLOAD_STATUS operations, then obviously it has not restarted, and the write verifier the client received in the COPY result is still valid and can be used to assess a COMMIT of the copied data, if one is needed.
--- fs/nfsd/nfs4proc.c | 23 ++++++++--------------- 1 file changed, 8 insertions(+), 15 deletions(-)
fs/nfsd/nfs4proc.c +8 -15
@@ -718,15 +718,6 @@ nfsd4_access(struct svc_rqst *rqstp, str &access->ac_supported); } -static void gen_boot_verifier (nfs4_verifier *verifier,struct net *net) -{ -__be32 *verf = (__be32 *)verifier->data; - -BUILD_BUG_ON (2 *sizeof (*verf) !=sizeof (verifier->data)); - -nfsd_copy_write_verifier (verf,net_generic (net, nfsd_net_id)); -} -static __be32 nfsd4_commit (struct svc_rqst *rqstp,struct nfsd4_compound_state *cstate,union nfsd4_op_u *u)
@@ -1594,7 +1585,6 @@ static void nfsd4_init_copy_res(struct ntest_bit (NFSD4_COPY_F_COMMITTED , ©->cp_flags) ?NFS_FILE_SYNC :NFS_UNSTABLE ;nfsd4_copy_set_sync (copy, sync); -gen_boot_verifier (©->cp_res.wr_verifier, copy->cp_clp->net); } static ssize_t _nfsd_copy_file_range(struct nfsd4_copy *copy,
@@ -1765,9 +1755,14 @@ static __be32 nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, union nfsd4_op_u *u) { + struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id); +struct nfsd4_copy *async_copy =NULL ;struct nfsd4_copy *copy = &u->copy; +struct nfsd42_write_res *result;__be32 status; -struct nfsd4_copy *async_copy =NULL ; + + result = ©->cp_res; +nfsd_copy_write_verifier ((__be32 *)&result->wr_verifier.data, nn); copy->cp_clp = cstate->clp;if (nfsd4_ssc_is_inter (copy)) {
@@ -1787,8 +1782,6 @@ nfsd4_copy(struct svc_rqst *rqstp, strucmemcpy (©->fh, &cstate->current_fh.fh_handle,sizeof (struct knfsd_fh ));if (nfsd4_copy_is_async (copy)) { -struct nfsd_net *nn =net_generic (SVC_NET (rqstp), nfsd_net_id); - status =nfserrno (-ENOMEM ); async_copy =kzalloc (sizeof (struct nfsd4_copy ),GFP_KERNEL );if (!async_copy)
@@ -1800,8 +1793,8 @@ nfsd4_copy(struct svc_rqst *rqstp, struc goto out_err;if (!nfs4_init_copy_state (nn, copy)) goto out_err; -memcpy (©->cp_res.cb_stateid, ©->cp_stateid.cs_stid, -sizeof (copy->cp_res.cb_stateid)); +memcpy (&result->cb_stateid, ©->cp_stateid.cs_stid, +sizeof (result->cb_stateid));dup_copy_fields (copy, async_copy); async_copy->copy_task =kthread_create (nfsd4_do_async_copy, async_copy,"%s" ,"copy thread" );
Greg Kroah-Hartman
maintainerPATCH 41/565 NFSD: Limit the number of concurrent async COPY operations
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
[ Upstream commit aadc3bbea163b6caaaebfdd2b6c4667fbc726752 ]
Nothing appears to limit the number of concurrent async COPY operations that clients can start. In addition, AFAICT each async COPY can copy an unlimited number of 4MB chunks, so can run for a long time. Thus IMO async COPY can become a DoS vector.
Add a restriction mechanism that bounds the number of concurrent background COPY operations. Start simple and try to be fair -- this patch implements a per-namespace limit.
An async COPY request that occurs while this limit is exceeded gets NFS4ERR_DELAY. The requesting client can choose to send the request again after a delay or fall back to a traditional read/write style copy.
If there is need to make the mechanism more sophisticated, we can visit that in future patches.
--- fs/nfsd/netns.h | 1 + fs/nfsd/nfs4proc.c | 11 +++++++++-- fs/nfsd/nfs4state.c | 1 + fs/nfsd/xdr4.h | 1 + 4 files changed, 12 insertions(+), 2 deletions(-)
fs/nfsd/netns.h +1 -0
@@ -152,6 +152,7 @@ struct nfsd_net {u32 s2s_cp_cl_id;struct idr s2s_cp_stateids;spinlock_t s2s_cp_lock; +atomic_t pending_async_copies;/* * Version information
fs/nfsd/nfs4proc.c +9 -2
@@ -1244,6 +1244,7 @@ static void nfs4_put_copy(struct nfsd4_c {if (!refcount_dec_and_test (©->refcount))return ; +atomic_dec (©->cp_nn->pending_async_copies);kfree (copy->cp_src);kfree (copy); }
@@ -1782,10 +1783,16 @@ nfsd4_copy(struct svc_rqst *rqstp, strucmemcpy (©->fh, &cstate->current_fh.fh_handle,sizeof (struct knfsd_fh ));if (nfsd4_copy_is_async (copy)) { - status =nfserrno (-ENOMEM ); async_copy =kzalloc (sizeof (struct nfsd4_copy ),GFP_KERNEL );if (!async_copy) goto out_err; + async_copy->cp_nn = nn; +/* Arbitrary cap on number of pending async copy operations */ +if (atomic_inc_return (&nn->pending_async_copies) > + (int )rqstp->rq_pool->sp_nrthreads) { +atomic_dec (&nn->pending_async_copies); + goto out_err; + }INIT_LIST_HEAD (&async_copy->copies);refcount_set (&async_copy->refcount,1 ); async_copy->cp_src =kmalloc (sizeof (*async_copy->cp_src),GFP_KERNEL );
@@ -1824,7 +1831,7 @@ out_err: }if (async_copy)cleanup_async_copy (async_copy); - status =nfserrno (-ENOMEM ); + status = nfserr_jukebox; goto out; }
fs/nfsd/nfs4state.c +1 -0
@@ -8079,6 +8079,7 @@ static int nfs4_state_create_net(structspin_lock_init (&nn->client_lock);spin_lock_init (&nn->s2s_cp_lock);idr_init (&nn->s2s_cp_stateids); +atomic_set (&nn->pending_async_copies,0 );spin_lock_init (&nn->blocked_locks_lock);INIT_LIST_HEAD (&nn->blocked_locks_lru);
fs/nfsd/xdr4.h +1 -0
@@ -574,6 +574,7 @@ struct nfsd4_copy {struct nfsd4_ssc_umount_item *ss_nsui;struct nfs_fh c_fh;nfs4_stateid stateid; +struct nfsd_net *cp_nn; };static inline void nfsd4_copy_set_sync (struct nfsd4_copy *copy,bool sync)
Greg Kroah-Hartman
maintainerPATCH 42/565 NFSD: Initialize struct nfsd4_copy earlier
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
[ Upstream commit 63fab04cbd0f96191b6e5beedc3b643b01c15889 ]
Ensure the refcount and async_copies fields are initialized early. cleanup_async_copy() will reference these fields if an error occurs in nfsd4_copy(). If they are not correctly initialized, at the very least, a refcount underflow occurs.
--- fs/nfsd/nfs4proc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/nfsd/nfs4proc.c +2 -2
@@ -1787,14 +1787,14 @@ nfsd4_copy(struct svc_rqst *rqstp, strucif (!async_copy) goto out_err; async_copy->cp_nn = nn; +INIT_LIST_HEAD (&async_copy->copies); +refcount_set (&async_copy->refcount,1 );/* Arbitrary cap on number of pending async copy operations */ if (atomic_inc_return (&nn->pending_async_copies) > (int )rqstp->rq_pool->sp_nrthreads) {atomic_dec (&nn->pending_async_copies); goto out_err; } -INIT_LIST_HEAD (&async_copy->copies); -refcount_set (&async_copy->refcount,1 ); async_copy->cp_src =kmalloc (sizeof (*async_copy->cp_src),GFP_KERNEL );if (!async_copy->cp_src) goto out_err;
Greg Kroah-Hartman
maintainerPATCH 43/565 NFSD: Never decrement pending_async_copies on error
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
[ Upstream commit 8286f8b622990194207df9ab852e0f87c60d35e9 ]
The error flow in nfsd4_copy() calls cleanup_async_copy(), which already decrements nn->pending_async_copies.
--- fs/nfsd/nfs4proc.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
fs/nfsd/nfs4proc.c +1 -3
@@ -1791,10 +1791,8 @@ nfsd4_copy(struct svc_rqst *rqstp, strucrefcount_set (&async_copy->refcount,1 );/* Arbitrary cap on number of pending async copy operations */ if (atomic_inc_return (&nn->pending_async_copies) > - (int )rqstp->rq_pool->sp_nrthreads) { -atomic_dec (&nn->pending_async_copies); + (int )rqstp->rq_pool->sp_nrthreads) goto out_err; - } async_copy->cp_src =kmalloc (sizeof (*async_copy->cp_src),GFP_KERNEL );if (!async_copy->cp_src) goto out_err;
Greg Kroah-Hartman
maintainerPATCH 44/565 mptcp: cope racing subflow creation in mptcp_rcv_space_adjust
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <[email protected]>
commit ce7356ae35943cc6494cc692e62d51a734062b7d upstream.
Additional active subflows - i.e. created by the in kernel path manager - are included into the subflow list before starting the 3whs.
A racing recvmsg() spooling data received on an already established subflow would unconditionally call tcp_cleanup_rbuf() on all the current subflows, potentially hitting a divide by zero error on the newly created ones.
Explicitly check that the subflow is in a suitable state before invoking tcp_cleanup_rbuf().
[ Conflicts in protocol.c, because commit f410cbea9f3d ("tcp: annotate
data-races around tp->window_clamp") has not been backported to this version. The conflict is easy to resolve, because only the context is different, but not the line to modify. ]
--- net/mptcp/protocol.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/mptcp/protocol.c +2 -1
@@ -1986,7 +1986,8 @@ static void mptcp_rcv_space_adjust(struc slow =lock_sock_fast (ssk);WRITE_ONCE (ssk->sk_rcvbuf, rcvbuf);tcp_sk (ssk)->window_clamp = window_clamp; -tcp_cleanup_rbuf (ssk,1 ); +if (tcp_can_send_ack (ssk)) +tcp_cleanup_rbuf (ssk,1 );unlock_sock_fast (ssk, slow); } }
Greg Kroah-Hartman
maintainerPATCH 45/565 mm: revert "mm: shmem: fix data-race in shmem_getattr()"
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Morton <[email protected]>
commit d1aa0c04294e29883d65eac6c2f72fe95cc7c049 upstream.
Revert d949d1d14fa2 ("mm: shmem: fix data-race in shmem_getattr()") as suggested by Chuck [1]. It is causing deadlocks when accessing tmpfs over NFS.
As Hugh commented, "added just to silence a syzbot sanitizer splat: added where there has never been any practical problem".
--- mm/shmem.c | 2 -- 1 file changed, 2 deletions(-)
mm/shmem.c +0 -2
@@ -1077,9 +1077,7 @@ static int shmem_getattr(struct user_namshmem_recalc_inode (inode);spin_unlock_irq (&info->lock); } -inode_lock_shared (inode);generic_fillattr (&init_user_ns, inode, stat); -inode_unlock_shared (inode);if (shmem_is_huge (NULL , inode,0 )) stat->blksize =HPAGE_PMD_SIZE ;
Greg Kroah-Hartman
maintainerPATCH 46/565 mm: avoid unsafe VMA hook invocation when error arises on mmap hook
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Stoakes <[email protected]>
[ Upstream commit 3dd6ed34ce1f2356a77fb88edafb5ec96784e3cf ]
Patch series "fix error handling in mmap_region() and refactor (hotfixes)", v4.
mmap_region() is somewhat terrifying, with spaghetti-like control flow and numerous means by which issues can arise and incomplete state, memory leaks and other unpleasantness can occur.
A large amount of the complexity arises from trying to handle errors late in the process of mapping a VMA, which forms the basis of recently observed issues with resource leaks and observable inconsistent state.
This series goes to great lengths to simplify how mmap_region() works and to avoid unwinding errors late on in the process of setting up the VMA for the new mapping, and equally avoids such operations occurring while the VMA is in an inconsistent state.
The patches in this series comprise the minimal changes required to resolve existing issues in mmap_region() error handling, in order that they can be hotfixed and backported. There is additionally a follow up series which goes further, separated out from the v1 series and sent and updated separately.
This patch (of 5):
After an attempted mmap() fails, we are no longer in a situation where we can safely interact with VMA hooks. This is currently not enforced, meaning that we need complicated handling to ensure we do not incorrectly call these hooks.
We can avoid the whole issue by treating the VMA as suspect the moment that the file->f_ops->mmap() function reports an error by replacing whatever VMA operations were installed with a dummy empty set of VMA operations.
We do so through a new helper function internal to mm - mmap_file() - which is both more logically named than the existing call_mmap() function and correctly isolates handling of the vm_op reassignment to mm.
All the existing invocations of call_mmap() outside of mm are ultimately nested within the call_mmap() from mm, which we now replace.
It is therefore safe to leave call_mmap() in place as a convenience
function (and to avoid churn). The invokers are:
ovl_file_operations -> mmap -> ovl_mmap() -> backing_file_mmap()
coda_file_operations -> mmap -> coda_file_mmap()
shm_file_operations -> shm_mmap()
shm_file_operations_huge -> shm_mmap()
dma_buf_fops -> dma_buf_mmap_internal -> i915_dmabuf_ops
-> i915_gem_dmabuf_mmap()None of these callers interact with vm_ops or mappings in a problematic way on error, quickly exiting out.
--- mm/internal.h | 12 ++++++++++++ mm/mmap.c | 4 ++-- mm/nommu.c | 4 ++-- mm/util.c | 18 ++++++++++++++++++ 4 files changed, 34 insertions(+), 4 deletions(-)
mm/internal.h +12 -0
@@ -34,6 +34,18 @@void page_writeback_init (void ); +/* +* This is a file-backed mapping, and is about to be memory mapped - invoke its +* mmap hook and safely handle error conditions. On error, VMA hooks will be +* mutated. +* +* @file: File which backs the mapping. +* @vma: VMA which we are mapping. +* +* Returns: 0 if success, error otherwise. +*/ +int mmap_file (struct file *file,struct vm_area_struct *vma); +vm_fault_t do_swap_page (struct vm_fault *vmf); void free_pgtables(struct mmu_gather *tlb, struct vm_area_struct *start_vma,
mm/mmap.c +2 -2
@@ -1788,7 +1788,7 @@ unsigned long mmap_region(struct file *f } vma->vm_file =get_file (file); - error =call_mmap (file, vma); + error =mmap_file (file, vma);if (error) goto unmap_and_free_vma;
@@ -1803,7 +1803,7 @@ unsigned long mmap_region(struct file *f addr = vma->vm_start; -/* If vm_flags changed after call_mmap(), we should try merge vma again +/* If vm_flags changed after mmap_file(), we should try merge vma again * as we may succeed this time. */ if (unlikely (vm_flags != vma->vm_flags && prev)) {
mm/nommu.c +2 -2
@@ -942,7 +942,7 @@ static int do_mmap_shared_file(struct vm {int ret; - ret =call_mmap (vma->vm_file, vma); + ret =mmap_file (vma->vm_file, vma);if (ret ==0 ) { vma->vm_region->vm_top = vma->vm_region->vm_end;return 0 ;
@@ -973,7 +973,7 @@ static int do_mmap_private(struct vm_are* - VM_MAYSHARE will be set if it may attempt to share */ if (capabilities &NOMMU_MAP_DIRECT ) { - ret =call_mmap (vma->vm_file, vma); + ret =mmap_file (vma->vm_file, vma);if (ret ==0 ) {/* shouldn't return success if we're not sharing */ BUG_ON (!(vma->vm_flags &VM_MAYSHARE ));
mm/util.c +18 -0
@@ -1086,6 +1086,24 @@ int __weak memcmp_pages(struct page *pagreturn ret; } +int mmap_file (struct file *file,struct vm_area_struct *vma) +{ +static const struct vm_operations_struct dummy_vm_ops = {}; +int err =call_mmap (file, vma); + +if (likely (!err)) +return 0 ; + +/* +* OK, we tried to call the file hook for mmap(), but an error +* arose. The mapping is in an inconsistent state and we most not invoke +* any further hooks on it. +*/ + vma->vm_ops = &dummy_vm_ops; + +return err; +} +#ifdef CONFIG_PRINTK /** * mem_dump_obj - Print available provenance information
Greg Kroah-Hartman
maintainerPATCH 47/565 mm: unconditionally close VMAs on error
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Stoakes <[email protected]>
[ Upstream commit 4080ef1579b2413435413988d14ac8c68e4d42c8 ]
Incorrect invocation of VMA callbacks when the VMA is no longer in a consistent state is bug prone and risky to perform.
With regards to the important vm_ops->close() callback We have gone to great lengths to try to track whether or not we ought to close VMAs.
Rather than doing so and risking making a mistake somewhere, instead unconditionally close and reset vma->vm_ops to an empty dummy operations set with a NULL .close operator.
We introduce a new function to do so - vma_close() - and simplify existing vms logic which tracked whether we needed to close or not.
This simplifies the logic, avoids incorrect double-calling of the .close() callback and allows us to update error paths to simply call vma_close() unconditionally - making VMA closure idempotent.
--- mm/internal.h | 7 +++++++ mm/mmap.c | 9 +++------ mm/nommu.c | 3 +-- mm/util.c | 15 +++++++++++++++ 4 files changed, 26 insertions(+), 8 deletions(-)
mm/internal.h +7 -0
@@ -46,6 +46,13 @@ void page_writeback_init(void);*/ int mmap_file (struct file *file,struct vm_area_struct *vma); +/* +* If the VMA has a close hook then close it, and since closing it might leave +* it in an inconsistent state which makes the use of any hooks suspect, clear +* them down by installing dummy empty hooks. +*/ +void vma_close (struct vm_area_struct *vma); +vm_fault_t do_swap_page (struct vm_fault *vmf); void free_pgtables(struct mmu_gather *tlb, struct vm_area_struct *start_vma,
mm/mmap.c +3 -6
@@ -180,8 +180,7 @@ static struct vm_area_struct *remove_vmastruct vm_area_struct *next = vma->vm_next;might_sleep (); -if (vma->vm_ops && vma->vm_ops->close) - vma->vm_ops->close (vma); +vma_close (vma);if (vma->vm_file)fput (vma->vm_file);mpol_put (vma_policy (vma));
@@ -1877,8 +1876,7 @@ out:return addr; close_and_free_vma: -if (vma->vm_ops && vma->vm_ops->close) - vma->vm_ops->close (vma); +vma_close (vma); unmap_and_free_vma:fput (vma->vm_file); vma->vm_file =NULL ;
@@ -2762,8 +2760,7 @@ int __split_vma(struct mm_struct *mm, streturn 0 ;/* Clean everything up if vma_adjust failed. */ -if (new->vm_ops && new->vm_ops->close) - new->vm_ops->close (new); +vma_close (new);if (new->vm_file)fput (new->vm_file);unlink_anon_vmas (new);
mm/nommu.c +1 -2
@@ -652,8 +652,7 @@ static void delete_vma_from_mm(struct vm*/ static void delete_vma (struct mm_struct *mm,struct vm_area_struct *vma) { -if (vma->vm_ops && vma->vm_ops->close) - vma->vm_ops->close (vma); +vma_close (vma);if (vma->vm_file)fput (vma->vm_file);put_nommu_region (vma->vm_region);
mm/util.c +15 -0
@@ -1104,6 +1104,21 @@ int mmap_file(struct file *file, structreturn err; } +void vma_close (struct vm_area_struct *vma) +{ +static const struct vm_operations_struct dummy_vm_ops = {}; + +if (vma->vm_ops && vma->vm_ops->close) { + vma->vm_ops->close (vma); + +/* +* The mapping is in an inconsistent state, and no further hooks +* may be invoked upon it. +*/ + vma->vm_ops = &dummy_vm_ops; + } +} +#ifdef CONFIG_PRINTK /** * mem_dump_obj - Print available provenance information
Greg Kroah-Hartman
maintainerPATCH 48/565 mm: refactor arch_calc_vm_flag_bits() and arm64 MTE handling
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Stoakes <[email protected]>
[ Upstream commit 5baf8b037debf4ec60108ccfeccb8636d1dbad81 ]
Currently MTE is permitted in two circumstances (desiring to use MTE having been specified by the VM_MTE flag) - where MAP_ANONYMOUS is specified, as checked by arch_calc_vm_flag_bits() and actualised by setting the VM_MTE_ALLOWED flag, or if the file backing the mapping is shmem, in which case we set VM_MTE_ALLOWED in shmem_mmap() when the mmap hook is activated in mmap_region().
The function that checks that, if VM_MTE is set, VM_MTE_ALLOWED is also set is the arm64 implementation of arch_validate_flags().
Unfortunately, we intend to refactor mmap_region() to perform this check earlier, meaning that in the case of a shmem backing we will not have invoked shmem_mmap() yet, causing the mapping to fail spuriously.
It is inappropriate to set this architecture-specific flag in general mm code anyway, so a sensible resolution of this issue is to instead move the check somewhere else.
We resolve this by setting VM_MTE_ALLOWED much earlier in do_mmap(), via the arch_calc_vm_flag_bits() call.
This is an appropriate place to do this as we already check for the MAP_ANONYMOUS case here, and the shmem file case is simply a variant of the same idea - we permit RAM-backed memory.
This requires a modification to the arch_calc_vm_flag_bits() signature to pass in a pointer to the struct file associated with the mapping, however this is not too egregious as this is only used by two architectures anyway
- arm64 and parisc.
So this patch performs this adjustment and removes the unnecessary assignment of VM_MTE_ALLOWED in shmem_mmap().
--- arch/arm64/include/asm/mman.h | 10 +++++++--- include/linux/mman.h | 7 ++++--- mm/mmap.c | 2 +- mm/nommu.c | 2 +- mm/shmem.c | 3 --- 5 files changed, 13 insertions(+), 11 deletions(-)
arch/arm64/include/asm/mman.h +7 -3
@@ -3,6 +3,8 @@#define __ASM_MMAN_H__#include <linux/compiler.h> +#include <linux/fs.h> +#include <linux/shmem_fs.h> #include <linux/types.h> #include <uapi/asm/mman.h>
@@ -21,19 +23,21 @@ static inline unsigned long arch_calc_vm }#define arch_calc_vm_prot_bits (prot, pkey) arch_calc_vm_prot_bits(prot, pkey) -static inline unsigned long arch_calc_vm_flag_bits (unsigned long flags) +static inline unsigned long arch_calc_vm_flag_bits (struct file *file, +unsigned long flags) {/* * Only allow MTE on anonymous mappings as these are guaranteed to be * backed by tags-capable memory. The vm_flags may be overridden by a * filesystem supporting MTE (RAM-based). */ -if (system_supports_mte () && (flags &MAP_ANONYMOUS )) +if (system_supports_mte () && + ((flags &MAP_ANONYMOUS ) ||shmem_file (file)))return VM_MTE_ALLOWED ;return 0 ; } -#define arch_calc_vm_flag_bits (flags) arch_calc_vm_flag_bits(flags) +#define arch_calc_vm_flag_bits (file, flags) arch_calc_vm_flag_bits(file, flags)static inline pgprot_t arch_vm_get_page_prot (unsigned long vm_flags) {
include/linux/mman.h +4 -3
@@ -2,6 +2,7 @@#ifndef _LINUX_MMAN_H#define _LINUX_MMAN_H +#include <linux/fs.h> #include <linux/mm.h> #include <linux/percpu_counter.h>
@@ -90,7 +91,7 @@ static inline void vm_unacct_memory(long#endif #ifndef arch_calc_vm_flag_bits -#define arch_calc_vm_flag_bits (flags) 0 +#define arch_calc_vm_flag_bits (file, flags) 0#endif #ifndef arch_vm_get_page_prot
@@ -151,12 +152,12 @@ calc_vm_prot_bits(unsigned long prot, un* Combine the mmap "flags" argument into "vm_flags" used internally. */ static inline unsigned long -calc_vm_flag_bits (unsigned long flags) +calc_vm_flag_bits (struct file *file,unsigned long flags) {return _calc_vm_trans (flags,MAP_GROWSDOWN ,VM_GROWSDOWN ) |_calc_vm_trans (flags,MAP_LOCKED ,VM_LOCKED ) |_calc_vm_trans (flags,MAP_SYNC ,VM_SYNC ) | -arch_calc_vm_flag_bits (flags); +arch_calc_vm_flag_bits (file, flags); }unsigned long vm_commit_limit (void );
mm/mmap.c +1 -1
@@ -1466,7 +1466,7 @@ unsigned long do_mmap(struct file *file,* to. we assume access permissions have been handled by the open * of the memory object, so we don't do any here. */ - vm_flags =calc_vm_prot_bits (prot, pkey) |calc_vm_flag_bits (flags) | + vm_flags =calc_vm_prot_bits (prot, pkey) |calc_vm_flag_bits (file, flags) | mm->def_flags |VM_MAYREAD |VM_MAYWRITE |VM_MAYEXEC ;if (flags &MAP_LOCKED )
mm/nommu.c +1 -1
@@ -906,7 +906,7 @@ static unsigned long determine_vm_flags( {unsigned long vm_flags; - vm_flags =calc_vm_prot_bits (prot,0 ) |calc_vm_flag_bits (flags); + vm_flags =calc_vm_prot_bits (prot,0 ) |calc_vm_flag_bits (file, flags);/* vm_flags |= mm->def_flags; */ if (!(capabilities &NOMMU_MAP_DIRECT )) {
mm/shmem.c +0 -3
@@ -2266,9 +2266,6 @@ static int shmem_mmap(struct file *file,if (ret)return ret; -/* arm64 - allow memory tagging on RAM-based files */ - vma->vm_flags |=VM_MTE_ALLOWED ; -file_accessed (file); vma->vm_ops = &shmem_vm_ops; if (IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE) &&
Greg Kroah-Hartman
maintainerPATCH 49/565 mm: resolve faulty mmap_region() error path behaviour
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Stoakes <[email protected]>
[ Upstream commit 5de195060b2e251a835f622759550e6202167641 ]
The mmap_region() function is somewhat terrifying, with spaghetti-like control flow and numerous means by which issues can arise and incomplete state, memory leaks and other unpleasantness can occur.
A large amount of the complexity arises from trying to handle errors late in the process of mapping a VMA, which forms the basis of recently observed issues with resource leaks and observable inconsistent state.
Taking advantage of previous patches in this series we move a number of checks earlier in the code, simplifying things by moving the core of the logic into a static internal function __mmap_region().
Doing this allows us to perform a number of checks up front before we do any real work, and allows us to unwind the writable unmap check unconditionally as required and to perform a CONFIG_DEBUG_VM_MAPLE_TREE validation unconditionally also.
We move a number of things here:
1. We preallocate memory for the iterator before we call the file-backed memory hook, allowing us to exit early and avoid having to perform complicated and error-prone close/free logic. We carefully free iterator state on both success and error paths.
2. The enclosing mmap_region() function handles the mapping_map_writable() logic early. Previously the logic had the mapping_map_writable() at the point of mapping a newly allocated file-backed VMA, and a matching mapping_unmap_writable() on success and error paths.
We now do this unconditionally if this is a file-backed, shared writable mapping. If a driver changes the flags to eliminate VM_MAYWRITE, however doing so does not invalidate the seal check we just performed, and we in any case always decrement the counter in the wrapper.
We perform a debug assert to ensure a driver does not attempt to do the opposite.
3. We also move arch_validate_flags() up into the mmap_region() function. This is only relevant on arm64 and sparc64, and the check is only meaningful for SPARC with ADI enabled. We explicitly add a warning for this arch if a driver invalidates this check, though the code ought eventually to be fixed to eliminate the need for this.
With all of these measures in place, we no longer need to explicitly close the VMA on error paths, as we place all checks which might fail prior to a call to any driver mmap hook.
This eliminates an entire class of errors, makes the code easier to reason about and more robust.
--- mm/mmap.c | 73 +++++++++++++++++++++++++++++++++++++++----------------------- 1 file changed, 47 insertions(+), 26 deletions(-)
mm/mmap.c +47 -26
@@ -1716,7 +1716,7 @@ static inline int accountable_mapping(streturn (vm_flags & (VM_NORESERVE |VM_SHARED |VM_WRITE )) ==VM_WRITE ; } -unsigned long mmap_region (struct file *file,unsigned long addr, +static unsigned long __mmap_region (struct file *file,unsigned long addr,unsigned long len,vm_flags_t vm_flags,unsigned long pgoff,struct list_head *uf) {
@@ -1780,16 +1780,10 @@ unsigned long mmap_region(struct file *f vma->vm_pgoff = pgoff;if (file) { -if (vm_flags &VM_SHARED ) { - error =mapping_map_writable (file->f_mapping); -if (error) - goto free_vma; - } - vma->vm_file =get_file (file); error =mmap_file (file, vma);if (error) - goto unmap_and_free_vma; + goto unmap_and_free_file_vma;/* Can addr have changed?? *
@@ -1800,6 +1794,14 @@ unsigned long mmap_region(struct file *f*/ WARN_ON_ONCE (addr != vma->vm_start); +/* +* Drivers should not permit writability when previously it was +* disallowed. +*/ +VM_WARN_ON_ONCE (vm_flags != vma->vm_flags && + !(vm_flags &VM_MAYWRITE ) && + (vma->vm_flags &VM_MAYWRITE )); + addr = vma->vm_start;/* If vm_flags changed after mmap_file(), we should try merge vma again
@@ -1818,7 +1820,7 @@ unsigned long mmap_region(struct file *f vma = merge;/* Update vm_flags to pick up the change. */ vm_flags = vma->vm_flags; - goto unmap_writable; + goto file_expanded; } }
@@ -1831,20 +1833,13 @@ unsigned long mmap_region(struct file *fvma_set_anonymous (vma); } -/* Allow architectures to sanity-check the vm_flags */ -if (!arch_validate_flags (vma->vm_flags)) { - error = -EINVAL ; -if (file) - goto close_and_free_vma; -else - goto free_vma; - } +#ifdef CONFIG_SPARC64 +/* TODO: Fix SPARC ADI! */ +WARN_ON_ONCE (!arch_validate_flags (vm_flags)); +#endif vma_link (mm, vma, prev, rb_link, rb_parent); -/* Once vma denies write, undo our temporary denial count */ -unmap_writable: -if (file && vm_flags &VM_SHARED ) -mapping_unmap_writable (file->f_mapping); +file_expanded: file = vma->vm_file; out:perf_event_mmap (vma);
@@ -1875,16 +1870,12 @@ out:return addr; -close_and_free_vma: -vma_close (vma); -unmap_and_free_vma: +unmap_and_free_file_vma:fput (vma->vm_file); vma->vm_file =NULL ;/* Undo any partial mapping done by a device driver. */ unmap_region (mm, vma, prev, vma->vm_start, vma->vm_end); -if (vm_flags &VM_SHARED ) -mapping_unmap_writable (file->f_mapping); free_vma:vm_area_free (vma); unacct_error:
@@ -2907,6 +2898,36 @@ int do_munmap(struct mm_struct *mm, unsireturn __do_munmap (mm, start, len, uf, false); } +unsigned long mmap_region (struct file *file,unsigned long addr, +unsigned long len,vm_flags_t vm_flags,unsigned long pgoff, +struct list_head *uf) +{ +unsigned long ret; +bool writable_file_mapping = false; + +/* Allow architectures to sanity-check the vm_flags. */ +if (!arch_validate_flags (vm_flags)) +return -EINVAL ; + +/* Map writable and ensure this isn't a sealed memfd. */ +if (file && (vm_flags &VM_SHARED )) { +int error =mapping_map_writable (file->f_mapping); + +if (error) +return error; + writable_file_mapping = true; + } + + ret =__mmap_region (file, addr, len, vm_flags, pgoff, uf); + +/* Clear our write mapping regardless of error. */ +if (writable_file_mapping) +mapping_unmap_writable (file->f_mapping); + +validate_mm (current->mm); +return ret; +} +static int __vm_munmap (unsigned long start,size_t len,bool downgrade) {int ret;
Greg Kroah-Hartman
maintainerPATCH 50/565 NFS: nfs_async_write_reschedule_io must not recurse into the writeback code
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
commit b1a28f2eb9ea7a5a1763fe53fe699aa0feae4231 upstream.
It is not safe to call filemap_fdatawrite_range() from nfs_async_write_reschedule_io(), since we're often calling from a page reclaim context. Just let fsync() redrive the writeback for us.
--- fs/nfs/write.c | 2 -- 1 file changed, 2 deletions(-)
fs/nfs/write.c +0 -2
@@ -1422,8 +1422,6 @@ static void nfs_async_write_error(structstatic void nfs_async_write_reschedule_io (struct nfs_pgio_header *hdr) {nfs_async_write_error (&hdr->pages,0 ); -filemap_fdatawrite_range (hdr->inode->i_mapping, hdr->args.offset, - hdr->args.offset + hdr->args.count -1 ); }static const struct nfs_pgio_completion_ops nfs_async_write_completion_ops = {
Greg Kroah-Hartman
maintainerPATCH 51/565 ASoC: Intel: bytcr_rt5640: Add support for non ACPI instantiated codec
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit d48696b915527b5bcdd207a299aec03fb037eb17 ]
On some x86 Bay Trail tablets which shipped with Android as factory OS, the DSDT is so broken that the codec needs to be manually instantatiated by the special x86-android-tablets.ko "fixup" driver for cases like this.
This means that the codec-dev cannot be retrieved through its ACPI fwnode, add support to the bytcr_rt5640 machine driver for such manually instantiated rt5640 i2c_clients.
An example of a tablet which needs this is the Vexia EDU ATLA 10 tablet, which has been distributed to schools in the Spanish Andalucía region.
--- sound/soc/intel/boards/bytcr_rt5640.c | 33 ++++++++++++++++++++++++--- 1 file changed, 30 insertions(+), 3 deletions(-)
sound/soc/intel/boards/bytcr_rt5640.c +30 -3
@@ -17,6 +17,7 @@#include <linux/acpi.h> #include <linux/clk.h> #include <linux/device.h> +#include <linux/device/bus.h> #include <linux/dmi.h> #include <linux/gpio/consumer.h> #include <linux/gpio/machine.h>
@@ -32,6 +33,8 @@#include "../atom/sst-atom-controls.h" #include "../common/soc-intel-quirks.h" +#define BYT_RT5640_FALLBACK_CODEC_DEV_NAME "i2c-rt5640" +enum {BYT_RT5640_DMIC1_MAP ,BYT_RT5640_DMIC2_MAP ,
@@ -1616,9 +1619,33 @@ static int snd_byt_rt5640_mc_probe(struct platform_device *pdev) codec_dev =acpi_get_first_physical_node (adev);acpi_dev_put (adev); -if (!codec_dev) -return -EPROBE_DEFER ; - priv->codec_dev =get_device (codec_dev); + +if (codec_dev) { + priv->codec_dev =get_device (codec_dev); + }else { +/* +* Special case for Android tablets where the codec i2c_client +* has been manually instantiated by x86_android_tablets.ko due +* to a broken DSDT. +*/ + codec_dev =bus_find_device_by_name (&i2c_bus_type,NULL , +BYT_RT5640_FALLBACK_CODEC_DEV_NAME ); +if (!codec_dev) +return -EPROBE_DEFER ; + +if (!i2c_verify_client (codec_dev)) { +dev_err (dev,"Error '%s' is not an i2c_client\n" , +BYT_RT5640_FALLBACK_CODEC_DEV_NAME ); +put_device (codec_dev); + } + +/* fixup codec name */ +strscpy (byt_rt5640_codec_name,BYT_RT5640_FALLBACK_CODEC_DEV_NAME , +sizeof (byt_rt5640_codec_name)); + +/* bus_find_device() returns a reference no need to get() */ + priv->codec_dev = codec_dev; + }/* * swap SSP0 if bytcr is detected
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 52/565 ASoC: Intel: bytcr_rt5640: Add DMI quirk for Vexia Edu Atla 10 tablet
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 0107f28f135231da22a9ad5756bb16bd5cada4d5 ]
The Vexia Edu Atla 10 tablet mostly uses the BYTCR tablet defaults, but as happens on more models it is using IN1 instead of IN3 for its internal mic and JD_SRC_JD2_IN4N instead of JD_SRC_JD1_IN4P for jack-detection.
Add a DMI quirk for this to fix the internal-mic and jack-detection.
--- sound/soc/intel/boards/bytcr_rt5640.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
sound/soc/intel/boards/bytcr_rt5640.c +15 -0
@@ -1102,6 +1102,21 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = {BYT_RT5640_SSP0_AIF2 | BYT_RT5640_MCLK_EN), }, + { /* Vexia Edu Atla 10 tablet */ + .matches = { +DMI_MATCH (DMI_BOARD_VENDOR ,"AMI Corporation" ), +DMI_MATCH (DMI_BOARD_NAME ,"Aptio CRB" ), +/* Above strings are too generic, also match on BIOS date */ + DMI_MATCH(DMI_BIOS_DATE, "08/25/2014"), + }, + .driver_data = (void *)(BYT_RT5640_IN1_MAP | +BYT_RT5640_JD_SRC_JD2_IN4N | +BYT_RT5640_OVCD_TH_2000UA | +BYT_RT5640_OVCD_SF_0P75 | +BYT_RT5640_DIFF_MIC | +BYT_RT5640_SSP0_AIF2 | + BYT_RT5640_MCLK_EN), + }, { /* Voyo Winpad A15 */ .matches = { DMI_MATCH(DMI_BOARD_VENDOR, "AMI Corporation"),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 53/565 ASoC: Intel: sst: Support LPE0F28 ACPI HID
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 6668610b4d8ce9a3ee3ed61a9471f62fb5f05bf9 ]
Some old Bay Trail tablets which shipped with Android as factory OS have the SST/LPE audio engine described by an ACPI device with a HID (Hardware-ID) of LPE0F28 instead of 80860F28.
Add support for this. Note this uses a new sst_res_info for just the LPE0F28 case because it has a different layout for the IO-mem ACPI resources then the 80860F28.
An example of a tablet which needs this is the Vexia EDU ATLA 10 tablet, which has been distributed to schools in the Spanish Andalucía region.
--- sound/hda/intel-dsp-config.c | 4 ++ sound/soc/intel/atom/sst/sst_acpi.c | 64 +++++++++++++++++++++++++---- 2 files changed, 59 insertions(+), 9 deletions(-)
sound/hda/intel-dsp-config.c +4 -0
@@ -559,6 +559,10 @@ static const struct config_entry acpi_config_table[] = { #if IS_ENABLED(CONFIG_SND_SST_ATOM_HIFI2_PLATFORM_ACPI) || \ IS_ENABLED(CONFIG_SND_SOC_SOF_BAYTRAIL) /* BayTrail */ + { + .flags = FLAG_SST_OR_SOF_BYT, + .acpi_hid = "LPE0F28", + }, { .flags = FLAG_SST_OR_SOF_BYT, .acpi_hid = "80860F28",
sound/soc/intel/atom/sst/sst_acpi.c +55 -9
88 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 54/565 wifi: iwlwifi: mvm: Use the sync timepoint API in suspend
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Gabay <[email protected]>
[ Upstream commit 9715246ca0bfc9feaec1b4ff5b3d38de65a7025d ]
When starting the suspend flow, HOST_D3_START triggers an _async_ firmware dump collection for debugging purposes. The async worker may race with suspend flow and fail to get NIC access, resulting in the following warning:
"Timeout waiting for hardware access (CSR_GP_CNTRL 0xffffffff)"
Fix this by switching to the sync version to ensure the dump completes before proceeding with the suspend flow, avoiding potential race issues.
--- drivers/net/wireless/intel/iwlwifi/fw/init.c | 4 +++- drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 2 ++ 2 files changed, 5 insertions(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/fw/init.c +3 -1
@@ -35,10 +35,12 @@ void iwl_fw_runtime_init(struct iwl_fw_runtime *fwrt, struct iwl_trans *trans, }IWL_EXPORT_SYMBOL (iwl_fw_runtime_init); +/* Assumes the appropriate lock is held by the caller */ void iwl_fw_runtime_suspend (struct iwl_fw_runtime *fwrt) {iwl_fw_suspend_timestamp (fwrt); -iwl_dbg_tlv_time_point (fwrt,IWL_FW_INI_TIME_POINT_HOST_D3_START ,NULL ); +iwl_dbg_tlv_time_point_sync (fwrt,IWL_FW_INI_TIME_POINT_HOST_D3_START , +NULL ); }IWL_EXPORT_SYMBOL (iwl_fw_runtime_suspend);
drivers/net/wireless/intel/iwlwifi/mvm/d3.c +2 -0
@@ -1380,7 +1380,9 @@ int iwl_mvm_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)iwl_mvm_pause_tcm (mvm, true); +mutex_lock (&mvm->mutex);iwl_fw_runtime_suspend (&mvm->fwrt); +mutex_unlock (&mvm->mutex);return __iwl_mvm_suspend (hw, wowlan, false); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 55/565 mac80211: fix user-power when emulating chanctx
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Greear <[email protected]>
[ Upstream commit 9b15c6cf8d2e82c8427cd06f535d8de93b5b995c ]
ieee80211_calc_hw_conf_chan was ignoring the configured user_txpower. If it is set, use it to potentially decrease txpower as requested.
--- net/mac80211/main.c | 2 ++ 1 file changed, 2 insertions(+)
net/mac80211/main.c +2 -0
@@ -144,6 +144,8 @@ static u32 ieee80211_hw_conf_chan(struct ieee80211_local *local) } power =ieee80211_chandef_max_power (&chandef); +if (local->user_power_level !=IEEE80211_UNSET_POWER_LEVEL ) + power =min (local->user_power_level, power);rcu_read_lock ();list_for_each_entry_rcu (sdata, &local->interfaces, list) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 56/565 usb: add support for new USB device ID 0x17EF:0x3098 for the r8152 driver
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Große <[email protected]>
[ Upstream commit 94c11e852955b2eef5c4f0b36cfeae7dcf11a759 ]
This patch adds support for another Lenovo Mini dock 0x17EF:0x3098 to the r8152 driver. The device has been tested on NixOS, hotplugging and sleep included.
--- drivers/net/usb/r8152.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/usb/r8152.c +1 -0
@@ -9843,6 +9843,7 @@ static const struct usb_device_id rtl8152_table[] = { { USB_DEVICE(VENDOR_ID_LENOVO, 0x3062) }, { USB_DEVICE(VENDOR_ID_LENOVO, 0x3069) }, { USB_DEVICE(VENDOR_ID_LENOVO, 0x3082) }, + { USB_DEVICE(VENDOR_ID_LENOVO, 0x3098) }, { USB_DEVICE(VENDOR_ID_LENOVO, 0x7205) }, { USB_DEVICE(VENDOR_ID_LENOVO, 0x720c) }, { USB_DEVICE(VENDOR_ID_LENOVO, 0x7214) },
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 57/565 selftests/watchdog-test: Fix system accidentally reset after watchdog-test
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Zhijian <[email protected]>
[ Upstream commit dc1308bee1ed03b4d698d77c8bd670d399dcd04d ]
When running watchdog-test with 'make run_tests', the watchdog-test will be terminated by a timeout signal(SIGTERM) due to the test timemout.
And then, a system reboot would happen due to watchdog not stop. see the dmesg as below:
``` [ 1367.185172] watchdog: watchdog0: watchdog did not stop! ```
Fix it by registering more signals(including SIGTERM) in watchdog-test, where its signal handler will stop the watchdog.
After that
# timeout 1 ./watchdog-test Watchdog Ticking Away! . Stopping watchdog ticks...
--- tools/testing/selftests/watchdog/watchdog-test.c | 6 ++++++ 1 file changed, 6 insertions(+)
tools/testing/selftests/watchdog/watchdog-test.c +6 -0
@@ -242,7 +242,13 @@ int main(int argc, char *argv[])printf ("Watchdog Ticking Away!\n" ); +/* +* Register the signals +*/ signal (SIGINT , term); +signal (SIGTERM , term); +signal (SIGKILL , term); +signal (SIGQUIT , term);while (1 ) {keep_alive ();
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 58/565 ALSA: hda/realtek: Add subwoofer quirk for Infinix ZERO BOOK 13
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Piyush Raj Chouhan <[email protected]>
[ Upstream commit ef5fbdf732a158ec27eeba69d8be851351f29f73 ]
Infinix ZERO BOOK 13 has a 2+2 speaker system which isn't probed correctly. This patch adds a quirk with the proper pin connections.
Also The mic in this laptop suffers too high gain resulting in mostly fan noise being recorded,
This patch Also limit mic boost.
HW Probe for device; https://linux-hardware.org/?probe=a2e892c47b
Test: All 4 speaker works, Mic has low noise.
--- sound/pci/hda/patch_realtek.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
sound/pci/hda/patch_realtek.c +12 -0
@@ -6935,6 +6935,7 @@ enum {ALC290_FIXUP_SUBWOOFER_HSJACK ,ALC269_FIXUP_THINKPAD_ACPI ,ALC269_FIXUP_DMIC_THINKPAD_ACPI , +ALC269VB_FIXUP_INFINIX_ZERO_BOOK_13 ,ALC269VB_FIXUP_CHUWI_COREBOOK_XPRO ,ALC255_FIXUP_ACER_MIC_NO_PRESENCE , ALC255_FIXUP_ASUS_MIC_NO_PRESENCE,
@@ -7237,6 +7238,16 @@ static const struct hda_fixup alc269_fixups[] = { .type = HDA_FIXUP_FUNC, .v.func = alc269_fixup_pincfg_U7x7_headset_mic, }, + [ALC269VB_FIXUP_INFINIX_ZERO_BOOK_13] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl []) { + {0x14 ,0x90170151 },/* use as internal speaker (LFE) */ + {0x1b ,0x90170152 },/* use as internal speaker (back) */ + { } + }, + .chained = true, + .chain_id =ALC269_FIXUP_LIMIT_INT_MIC_BOOST + }, [ALC269VB_FIXUP_CHUWI_COREBOOK_XPRO] = { .type = HDA_FIXUP_PINS, .v.pins = (const struct hda_pintbl []) {
@@ -9533,6 +9544,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x1d72 ,0x1945 ,"Redmi G" ,ALC256_FIXUP_ASUS_HEADSET_MIC ),SND_PCI_QUIRK (0x1d72 ,0x1947 ,"RedmiBook Air" ,ALC255_FIXUP_XIAOMI_HEADSET_MIC ),SND_PCI_QUIRK (0x2782 ,0x0214 ,"VAIO VJFE-CL" ,ALC269_FIXUP_LIMIT_INT_MIC_BOOST ), +SND_PCI_QUIRK (0x2782 ,0x0228 ,"Infinix ZERO BOOK 13" ,ALC269VB_FIXUP_INFINIX_ZERO_BOOK_13 ),SND_PCI_QUIRK (0x2782 ,0x0232 ,"CHUWI CoreBook XPro" ,ALC269VB_FIXUP_CHUWI_COREBOOK_XPRO ),SND_PCI_QUIRK (0x2782 ,0x1707 ,"Vaio VJFE-ADL" ,ALC298_FIXUP_SPK_VOLUME ), SND_PCI_QUIRK(0x8086, 0x2074, "Intel NUC 8", ALC233_FIXUP_INTEL_NUC8_DMIC),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 59/565 x86/amd_nb: Fix compile-testing without CONFIG_AMD_NB
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit fce9642c765a18abd1db0339a7d832c29b68456a ]
node_to_amd_nb() is defined to NULL in non-AMD configs:
drivers/platform/x86/amd/hsmp/plat.c: In function 'init_platform_device':
drivers/platform/x86/amd/hsmp/plat.c:165:68: error: dereferencing 'void *' pointer [-Werror]
165 | sock->root = node_to_amd_nb(i)->root;
| ^~ drivers/platform/x86/amd/hsmp/plat.c:165:68: error: request for member 'root' in something not a structure or union
Users of the interface who also allow COMPILE_TEST will cause the above build error so provide an inline stub to fix that.
[ bp: Massage commit message. ]
--- arch/x86/include/asm/amd_nb.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
arch/x86/include/asm/amd_nb.h +4 -1
@@ -118,7 +118,10 @@ static inline bool amd_gart_present(void)#define amd_nb_num (x) 0#define amd_nb_has_feature (x) false -#define node_to_amd_nb (x) NULL +static inline struct amd_northbridge *node_to_amd_nb (int node) +{ +return NULL ; +}#define amd_gart_present (x) false#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 60/565 net: usb: qmi_wwan: add Quectel RG650V
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benoît Monin <[email protected]>
[ Upstream commit 6b3f18a76be6bbd237c7594cf0bf2912b68084fe ]
Add support for Quectel RG650V which is based on Qualcomm SDX65 chip. The composition is DIAG / NMEA / AT / AT / QMI.
T: Bus=02 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#= 4 Spd=5000 MxCh= 0
D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1
P: Vendor=2c7c ProdID=0122 Rev=05.15
S: Manufacturer=Quectel
S: Product=RG650V-EU
S: SerialNumber=xxxxxxx
C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=896mA
I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=9ms
I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=85(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=9ms
I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
E: Ad=05(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=87(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=88(I) Atr=03(Int.) MxPS= 8 Ivl=9ms
--- drivers/net/usb/qmi_wwan.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/usb/qmi_wwan.c +1 -0
@@ -1081,6 +1081,7 @@ static const struct usb_device_id products[] = { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0x581d, USB_CLASS_VENDOR_SPEC, 1, 7), .driver_info = (unsigned long )&qmi_wwan_info, }, + {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0122)}, /* Quectel RG650V */ {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0125)}, /* Quectel EC25, EC20 R2.0 Mini PCIe */ {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0306)}, /* Quectel EP06/EG06/EM06 */ {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0512)}, /* Quectel EG12/EM12 */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 61/565 soc: qcom: Add check devm_kasprintf() returned value
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Han <[email protected]>
[ Upstream commit e694d2b5c58ba2d1e995d068707c8d966e7f5f2a ]
devm_kasprintf() can return a NULL pointer on failure but this returned value in qcom_socinfo_probe() is not checked.
--- drivers/soc/qcom/socinfo.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/soc/qcom/socinfo.c +7 -1
@@ -614,10 +614,16 @@ static int qcom_socinfo_probe(struct platform_device *pdev) qs->attr.revision =devm_kasprintf (&pdev->dev,GFP_KERNEL ,"%u.%u" ,SOCINFO_MAJOR (le32_to_cpu (info->ver)),SOCINFO_MINOR (le32_to_cpu (info->ver))); -if (offsetof(struct socinfo , serial_num) <= item_size) +if (!qs->attr.soc_id || qs->attr.revision) +return -ENOMEM ; + +if (offsetof(struct socinfo , serial_num) <= item_size) { qs->attr.serial_number =devm_kasprintf (&pdev->dev,GFP_KERNEL ,"%u" ,le32_to_cpu (info->serial_num)); +if (!qs->attr.serial_number) +return -ENOMEM ; + } qs->soc_dev =soc_device_register (&qs->attr);if (IS_ERR (qs->soc_dev))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 62/565 regulator: rk808: Add apply_bit for BUCK3 on RK809
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikhail Rudenko <[email protected]>
[ Upstream commit 5e53e4a66bc7430dd2d11c18a86410e3a38d2940 ]
Currently, RK809's BUCK3 regulator is modelled in the driver as a configurable regulator with 0.5-2.4V voltage range. But the voltage setting is not actually applied, because when bit 6 of PMIC_POWER_CONFIG register is set to 0 (default), BUCK3 output voltage is determined by the external feedback resistor. Fix this, by setting bit 6 when voltage selection is set. Existing users which do not specify voltage constraints in their device trees will not be affected by this change, since no voltage setting is applied in those cases, and bit 6 is not enabled.
--- drivers/regulator/rk808-regulator.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/regulator/rk808-regulator.c +2 -0
@@ -906,6 +906,8 @@ static const struct regulator_desc rk809_reg[] = { .n_linear_ranges = ARRAY_SIZE(rk817_buck1_voltage_ranges), .vsel_reg = RK817_BUCK3_ON_VSEL_REG, .vsel_mask = RK817_BUCK_VSEL_MASK, + .apply_reg = RK817_POWER_CONFIG, + .apply_bit = RK817_BUCK3_FB_RES_INTER, .enable_reg = RK817_POWER_EN_REG(0), .enable_mask = ENABLE_MASK(RK817_ID_DCDC3), .enable_val = ENABLE_MASK(RK817_ID_DCDC3),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 63/565 platform/x86: dell-smbios-base: Extends support to Alienware products
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kurt Borja <[email protected]>
[ Upstream commit a36b8b84ac4327b90ef5a22bc97cc96a92073330 ]
Fixes the following error:
dell_smbios: Unable to run on non-Dell system
Which is triggered after dell-wmi driver fails to initialize on Alienware systems, as it depends on dell-smbios.
This effectively extends dell-wmi, dell-smbios and dcdbas support to Alienware devices, that might share some features of the SMBIOS intereface calling interface with other Dell products.
Tested on an Alienware X15 R1.
--- drivers/platform/x86/dell/dell-smbios-base.c | 1 + 1 file changed, 1 insertion(+)
drivers/platform/x86/dell/dell-smbios-base.c +1 -0
@@ -543,6 +543,7 @@ static int __init dell_smbios_init(void)int ret, wmi, smm;if (!dmi_find_device (DMI_DEV_TYPE_OEM_STRING ,"Dell System" ,NULL ) && + !dmi_find_device (DMI_DEV_TYPE_OEM_STRING ,"Alienware" ,NULL ) && !dmi_find_device (DMI_DEV_TYPE_OEM_STRING ,"www.dell.com" ,NULL )) {pr_err ("Unable to run on non-Dell system\n" );return -ENODEV ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 64/565 platform/x86: dell-wmi-base: Handle META key Lock/Unlock events
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kurt Borja <[email protected]>
[ Upstream commit ec61f0bb4feec3345626a2b93b970b6719743997 ]
Some Alienware devices have a key that locks/unlocks the Meta key. This key triggers a WMI event that should be ignored by the kernel, as it's handled by internally the firmware.
There is no known way of changing this default behavior. The firmware would lock/unlock the Meta key, regardless of how the event is handled.
Tested on an Alienware x15 R1.
--- drivers/platform/x86/dell/dell-wmi-base.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/platform/x86/dell/dell-wmi-base.c +6 -0
@@ -79,6 +79,12 @@ static const struct dmi_system_id dell_wmi_smbios_list[] __initconst = {static const struct key_entry dell_wmi_keymap_type_0000[] = { {KE_IGNORE ,0x003a , {KEY_CAPSLOCK } }, +/* Meta key lock */ + {KE_IGNORE ,0xe000 , {KEY_RIGHTMETA } }, + +/* Meta key unlock */ + {KE_IGNORE ,0xe001 , {KEY_RIGHTMETA } }, +/* Key code is followed by brightness level */ {KE_KEY ,0xe005 , {KEY_BRIGHTNESSDOWN } }, {KE_KEY ,0xe006 , {KEY_BRIGHTNESSUP } },
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 65/565 can: j1939: fix error in J1939 documentation.
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Hölzl <[email protected]>
[ Upstream commit b6ec62e01aa4229bc9d3861d1073806767ea7838 ]
The description of PDU1 format usage mistakenly referred to PDU2 format.
--- Documentation/networking/j1939.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Documentation/networking/j1939.rst +1 -1
@@ -121,7 +121,7 @@ format, the Group Extension is set in the PS-field. On the other hand, when using PDU1 format, the PS-field contains a so-called Destination Address, which is _not_ part of the PGN. When communicating a PGN -from user space to kernel (or vice versa) and PDU2 format is used, the PS-field +from user space to kernel (or vice versa) and PDU1 format is used, the PS-field of the PGN shall be set to zero. The Destination Address shall be set elsewhere.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 66/565 ASoC: stm: Prevent potential division by zero in stm32_sai_mclk_round_rate()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luo Yifan <[email protected]>
[ Upstream commit 63c1c87993e0e5bb11bced3d8224446a2bc62338 ]
This patch checks if div is less than or equal to zero (div <= 0). If div is zero or negative, the function returns -EINVAL, ensuring the division operation (*prate / div) is safe to perform.
--- sound/soc/stm/stm32_sai_sub.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/stm/stm32_sai_sub.c +2 -2
@@ -380,8 +380,8 @@ static long stm32_sai_mclk_round_rate(struct clk_hw *hw, unsigned long rate,int div; div =stm32_sai_get_clk_div (sai, *prate, rate); -if (div <0 ) -return div; +if (div <=0 ) +return -EINVAL ; mclk->freq = *prate / div;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 67/565 ASoC: stm: Prevent potential division by zero in stm32_sai_get_clk_div()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luo Yifan <[email protected]>
[ Upstream commit 23569c8b314925bdb70dd1a7b63cfe6100868315 ]
This patch checks if div is less than or equal to zero (div <= 0). If div is zero or negative, the function returns -EINVAL, ensuring the division operation is safe to perform.
--- sound/soc/stm/stm32_sai_sub.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/stm/stm32_sai_sub.c +1 -1
@@ -319,7 +319,7 @@ static int stm32_sai_get_clk_div(struct stm32_sai_sub_data *sai,int div; div =DIV_ROUND_CLOSEST (input_rate, output_rate); -if (div >SAI_XCR1_MCKDIV_MAX (version)) { +if (div >SAI_XCR1_MCKDIV_MAX (version) || div <=0 ) {dev_err (&sai->pdev->dev,"Divider %d out of range\n" , div);return -EINVAL ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 68/565 proc/softirqs: replace seq_printf with seq_put_decimal_ull_width
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Wang <[email protected]>
[ Upstream commit 84b9749a3a704dcc824a88aa8267247c801d51e4 ]
seq_printf is costy, on a system with n CPUs, reading /proc/softirqs would yield 10*n decimal values, and the extra cost parsing format string grows linearly with number of cpus. Replace seq_printf with seq_put_decimal_ull_width have significant performance improvement. On an 8CPUs system, reading /proc/softirqs show ~40% performance gain with this patch.
--- fs/proc/softirqs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/proc/softirqs.c +1 -1
@@ -19,7 +19,7 @@ static int show_softirqs(struct seq_file *p, void *v)for (i =0 ; i <NR_SOFTIRQS ; i++) {seq_printf (p,"%12s:" , softirq_to_name[i]);for_each_possible_cpu (j) -seq_printf (p," %10u" ,kstat_softirqs_cpu (i, j)); +seq_put_decimal_ull_width (p," " ,kstat_softirqs_cpu (i, j),10 );seq_putc (p,'\n' ); }return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 69/565 ALSA: usb-audio: Fix Yamaha P-125 Quirk Entry
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eryk Zagorski <[email protected]>
[ Upstream commit 6f891ca15b017707840c9e7f5afd9fc6cfd7d8b1 ]
This patch switches the P-125 quirk entry to use a composite quirk as the P-125 supplies both MIDI and Audio like many of the other Yamaha keyboards
--- sound/usb/quirks-table.h | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
sound/usb/quirks-table.h +13 -1
@@ -350,7 +350,6 @@ YAMAHA_DEVICE(0x105a, NULL), YAMAHA_DEVICE(0x105b, NULL), YAMAHA_DEVICE(0x105c, NULL), YAMAHA_DEVICE(0x105d, NULL), -YAMAHA_DEVICE(0x1718, "P-125"), { USB_DEVICE(0x0499, 0x1503), .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
@@ -485,6 +484,19 @@ YAMAHA_DEVICE(0x1718, "P-125"), } } }, +{ +USB_DEVICE (0x0499 ,0x1718 ), + QUIRK_DRIVER_INFO { +/* .vendor_name = "Yamaha", */ +/* .product_name = "P-125", */ + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_AUDIO(1) }, + { QUIRK_DATA_STANDARD_AUDIO(2) }, + { QUIRK_DATA_MIDI_YAMAHA(3) }, + QUIRK_COMPOSITE_END + } + } +},YAMAHA_DEVICE (0x2000 ,"DGP-7" ),YAMAHA_DEVICE (0x2001 ,"DGP-5" ), YAMAHA_DEVICE(0x2002, NULL),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 70/565 ARM: 9420/1: smp: Fix SMP for xip kernels
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harith G <[email protected]>
[ Upstream commit 9e9b0cf9319b4db143014477b0bc4b39894248f1 ]
Fix the physical address calculation of the following to get smp working on xip kernels.
- secondary_data needed for secondary cpu bootup.
- secondary_startup address passed through psci.
- identity mapped code region needed for enabling mmu for secondary cpus.
--- arch/arm/kernel/head.S | 4 ++++ arch/arm/kernel/psci_smp.c | 7 +++++++ arch/arm/mm/idmap.c | 7 +++++++ 3 files changed, 18 insertions(+)
arch/arm/kernel/head.S +4 -0
@@ -411,7 +411,11 @@ ENTRY(secondary_startup) /* * Use the page tables supplied from __cpu_up. */ +#ifdef CONFIG_XIP_KERNEL + ldr r3, =(secondary_data + PLAT_PHYS_OFFSET - PAGE_OFFSET) +#else adr_l r3, secondary_data +#endif mov_l r12, __secondary_switched ldrd r4, r5, [r3, #0] @ get secondary_data.pgdir ARM_BE8(eor r4, r4, r5) @ Swap r5 and r4 in BE:
arch/arm/kernel/psci_smp.c +7 -0
@@ -45,8 +45,15 @@ extern void secondary_startup(void);static int psci_boot_secondary (unsigned int cpu,struct task_struct *idle) { if (psci_ops.cpu_on) +#ifdef CONFIG_XIP_KERNEL +return psci_ops.cpu_on (cpu_logical_map (cpu), + ((phys_addr_t)(&secondary_startup) + -XIP_VIRT_ADDR (CONFIG_XIP_PHYS_ADDR ) + +CONFIG_XIP_PHYS_ADDR )); +#else return psci_ops.cpu_on (cpu_logical_map (cpu),virt_to_idmap (&secondary_startup)); +#endif return -ENODEV ; }
arch/arm/mm/idmap.c +7 -0
@@ -84,8 +84,15 @@ static void identity_mapping_add(pgd_t *pgd, const char *text_start,unsigned long addr, end;unsigned long next; +#ifdef CONFIG_XIP_KERNEL + addr = (phys_addr_t)(text_start) -XIP_VIRT_ADDR (CONFIG_XIP_PHYS_ADDR ) + +CONFIG_XIP_PHYS_ADDR ; + end = (phys_addr_t)(text_end) -XIP_VIRT_ADDR (CONFIG_XIP_PHYS_ADDR ) + +CONFIG_XIP_PHYS_ADDR ; +#else addr =virt_to_idmap (text_start); end =virt_to_idmap (text_end); +#endif pr_info ("Setting up static identity map for 0x%lx - 0x%lx\n" , addr, end); prot |=PMD_TYPE_SECT |PMD_SECT_AP_WRITE |PMD_SECT_AF ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 71/565 ipmr: Fix access to mfc_cache_list without lock held
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <[email protected]>
[ Upstream commit e28acc9c1ccfcb24c08e020828f69d0a915b06ae ]
Accessing mr_table->mfc_cache_list is protected by an RCU lock. In the following code flow, the RCU read lock is not held, causing the following error when RCU_PROVE is not held. The same problem might show up in the IPv6 code path.
6.12.0-rc5-kbuilder-01145-gbac17284bdcb #33 Tainted: G E N
-----------------------------
net/ipv4/ipmr_base.c:313 RCU-list traversed in non-reader section!!
rcu_scheduler_active = 2, debug_locks = 1
2 locks held by RetransmitAggre/3519:
#0: ffff88816188c6c0 (nlk_cb_mutex-ROUTE){+.+.}-{3:3}, at: __netlink_dump_start+0x8a/0x290
#1: ffffffff83fcf7a8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_dumpit+0x6b/0x90
stack backtrace:
lockdep_rcu_suspicious
mr_table_dump
ipmr_rtm_dumproute
rtnl_dump_all
rtnl_dumpit
netlink_dump
__netlink_dump_start
rtnetlink_rcv_msg
netlink_rcv_skb
netlink_unicast
netlink_sendmsgThis is not a problem per see, since the RTNL lock is held here, so, it is safe to iterate in the list without the RCU read lock, as suggested by Eric.
To alleviate the concern, modify the code to use list_for_each_entry_rcu() with the RTNL-held argument.
The annotation will raise an error only if RTNL or RCU read lock are missing during iteration, signaling a legitimate problem, otherwise it will avoid this false positive.
This will solve the IPv6 case as well, since ip6mr_rtm_dumproute() calls this function as well.
--- net/ipv4/ipmr_base.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/ipv4/ipmr_base.c +2 -1
@@ -301,7 +301,8 @@ int mr_table_dump(struct mr_table *mrt, struct sk_buff *skb,if (filter->filter_set) flags |=NLM_F_DUMP_FILTERED ; -list_for_each_entry_rcu (mfc, &mrt->mfc_cache_list, list) { +list_for_each_entry_rcu (mfc, &mrt->mfc_cache_list, list, +lockdep_rtnl_is_held ()) {if (e < s_e) goto next_entry; if (filter->dev &&
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 72/565 rcu-tasks: Idle tasks on offline CPUs are in quiescent states
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul E. McKenney <[email protected]>
commit 5c9a9ca44fda41c5e82f50efced5297a9c19760d upstream.
Any idle task corresponding to an offline CPU is in an RCU Tasks Trace quiescent state. This commit causes rcu_tasks_trace_postscan() to ignore idle tasks for offline CPUs, which it can do safely due to CPU-hotplug operations being disabled.
--- kernel/rcu/tasks.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/rcu/tasks.h +1 -1
@@ -1090,7 +1090,7 @@ static void rcu_tasks_trace_postscan(struct list_head *hop) {int cpu; -for_each_possible_cpu (cpu) +for_each_online_cpu (cpu)rcu_tasks_trace_pertask (idle_task (cpu), hop);// Re-enable CPU hotplug now that the tasklist scan has completed.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 73/565 x86/stackprotector: Work around strict Clang TLS symbol requirements
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <[email protected]>
[ Upstream commit 577c134d311b9b94598d7a0c86be1f431f823003 ]
GCC and Clang both implement stack protector support based on Thread Local Storage (TLS) variables, and this is used in the kernel to implement per-task stack cookies, by copying a task's stack cookie into a per-CPU variable every time it is scheduled in.
Both now also implement -mstack-protector-guard-symbol=, which permits the TLS variable to be specified directly. This is useful because it will allow to move away from using a fixed offset of 40 bytes into the per-CPU area on x86_64, which requires a lot of special handling in the per-CPU code and the runtime relocation code.
However, while GCC is rather lax in its implementation of this command line option, Clang actually requires that the provided symbol name refers to a TLS variable (i.e., one declared with __thread), although it also permits the variable to be undeclared entirely, in which case it will use an implicit declaration of the right type.
The upshot of this is that Clang will emit the correct references to the stack cookie variable in most cases, e.g.,
10d: 64 a1 00 00 00 00 mov %fs:0x0,%eax
10f: R_386_32 __stack_chk_guard
However, if a non-TLS definition of the symbol in question is visible in the same compilation unit (which amounts to the whole of vmlinux if LTO is enabled), it will drop the per-CPU prefix and emit a load from a bogus address.
Work around this by using a symbol name that never occurs in C code, and emit it as an alias in the linker script.
--- arch/x86/Makefile | 3 ++- arch/x86/entry/entry.S | 15 +++++++++++++++ arch/x86/include/asm/asm-prototypes.h | 3 +++ arch/x86/kernel/cpu/common.c | 2 ++ arch/x86/kernel/vmlinux.lds.S | 3 +++ 5 files changed, 25 insertions(+), 1 deletion(-)
arch/x86/Makefile +2 -1
@@ -81,7 +81,8 @@ ifeq ($(CONFIG_X86_32),y) ifeq ($(CONFIG_STACKPROTECTOR),y) ifeq ($(CONFIG_SMP),y) - KBUILD_CFLAGS += -mstack-protector-guard-reg=fs -mstack-protector-guard-symbol=__stack_chk_guard + KBUILD_CFLAGS += -mstack-protector-guard-reg=fs \ + -mstack-protector-guard-symbol=__ref_stack_chk_guard else KBUILD_CFLAGS += -mstack-protector-guard=global endif
arch/x86/entry/entry.S +15 -0
@@ -48,3 +48,18 @@ EXPORT_SYMBOL_GPL(mds_verw_sel); .popsection +#ifndef CONFIG_X86_64 +/* + * Clang's implementation of TLS stack cookies requires the variable in + * question to be a TLS variable. If the variable happens to be defined as an + * ordinary variable with external linkage in the same compilation unit (which + * amounts to the whole of vmlinux with LTO enabled), Clang will drop the + * segment register prefix from the references, resulting in broken code. Work + * around this by avoiding the symbol used in -mstack-protector-guard-symbol= + * entirely in the C code, and use an alias emitted by the linker script + * instead. + */ +#ifdef CONFIG_STACKPROTECTOR +EXPORT_SYMBOL(__ref_stack_chk_guard); +#endif +#endif
arch/x86/include/asm/asm-prototypes.h +3 -0
@@ -18,3 +18,6 @@extern void cmpxchg8b_emu (void );#endif +#if defined(__GENKSYMS__) && defined(CONFIG_STACKPROTECTOR ) +extern unsigned long __ref_stack_chk_guard; +#endif
arch/x86/kernel/cpu/common.c +2 -0
@@ -2000,8 +2000,10 @@ EXPORT_PER_CPU_SYMBOL(cpu_current_top_of_stack);#ifdef CONFIG_STACKPROTECTOR DEFINE_PER_CPU(unsigned long, __stack_chk_guard); +#ifndef CONFIG_SMP EXPORT_PER_CPU_SYMBOL (__stack_chk_guard);#endif +#endif #endif /* CONFIG_X86_64 */
arch/x86/kernel/vmlinux.lds.S +3 -0
@@ -490,6 +490,9 @@ SECTIONS ASSERT(SIZEOF(.rela.dyn) == 0, "Unexpected run-time relocations (.rela) detected!") } +/* needed for Clang - see arch/x86/entry/entry.S */ +PROVIDE(__ref_stack_chk_guard = __stack_chk_guard); + /* * The ASSERT() sink to . is intentional, for binutils 2.14 compatibility: */
Signature · 1 line
2.43.0
Re: [PATCH 5.15 073/565] x86/stackprotector: Work around strict Clang TLS symbol requirements
Quoted 9 lines · Greg Kroah-Hartman
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <[email protected]>
[ Upstream commit
577c134d311b9b94598d7a0c86be1f431f823003]
Please drop this for now - see my reply to the v6.1 version.
Quoted 131 lines
GCC and Clang both implement stack protector support based on Thread Local Storage (TLS) variables, and this is used in the kernel to implement per-task stack cookies, by copying a task's stack cookie into a per-CPU variable every time it is scheduled in.
Both now also implement -mstack-protector-guard-symbol=, which permits the TLS variable to be specified directly. This is useful because it will allow to move away from using a fixed offset of 40 bytes into the per-CPU area on
x86_64, which requires a lot of special handling in the per-CPU code and the runtime relocation code.However, while GCC is rather lax in its implementation of this command line option, Clang actually requires that the provided symbol name refers to a TLS variable (i.e., one declared with
__thread), although it also permits the variable to be undeclared entirely, in which case it will use an implicit declaration of the right type.The upshot of this is that Clang will emit the correct references to the stack cookie variable in most cases, e.g.,
10d: 64 a1 00 00 00 00 mov %fs:0x0,%eax
10f: R_386_32 __stack_chk_guardHowever, if a non-TLS definition of the symbol in question is visible in the same compilation unit (which amounts to the whole of vmlinux if LTO is enabled), it will drop the per-CPU prefix and emit a load from a bogus address.
Work around this by using a symbol name that never occurs in C code, and emit it as an alias in the linker script.
Fixes 3fb0fdb3bbe7 ("x86/stackprotector/32: Make the canary into a regular percpu variable")Signed-off-by Ard Biesheuvel <[email protected]>Signed-off-by Brian Gerst <[email protected]>Signed-off-by Borislav Petkov (AMD) <[email protected]>Reviewed-by Nathan Chancellor <[email protected]>Tested-by Nathan Chancellor <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- arch/x86/Makefile | 3 ++- arch/x86/entry/entry.S | 15 +++++++++++++++ arch/x86/include/asm/asm-prototypes.h | 3 +++ arch/x86/kernel/cpu/common.c | 2 ++ arch/x86/kernel/vmlinux.lds.S | 3 +++ 5 files changed, 25 insertions(+), 1 deletion(-)arch/x86/Makefile +2
-1@@ -81,7 +81,8 @@ ifeq ($(CONFIG_X86_32),y) ifeq ($(CONFIG_STACKPROTECTOR),y) ifeq ($(CONFIG_SMP),y) - KBUILD_CFLAGS += -mstack-protector-guard-reg=fs -mstack-protector-guard-symbol=__stack_chk_guard + KBUILD_CFLAGS += -mstack-protector-guard-reg=fs \ + -mstack-protector-guard-symbol=__ref_stack_chk_guard else KBUILD_CFLAGS += -mstack-protector-guard=global endifarch/x86/entry/entry.S +15
-0@@ -48,3 +48,18 @@ EXPORT_SYMBOL_GPL(mds_verw_sel); .popsection +#ifndef CONFIG_X86_64 +/* + * Clang's implementation of TLS stack cookies requires the variable in + * question to be a TLS variable. If the variable happens to be defined as an + * ordinary variable with external linkage in the same compilation unit (which + * amounts to the whole of vmlinux with LTO enabled), Clang will drop the + * segment register prefix from the references, resulting in broken code. Work + * around this by avoiding the symbol used in -mstack-protector-guard-symbol= + * entirely in the C code, and use an alias emitted by the linker script + * instead. + */ +#ifdef CONFIG_STACKPROTECTOR +EXPORT_SYMBOL(__ref_stack_chk_guard); +#endif +#endifarch/x86/include/asm/asm-prototypes.h +3
-0@@ -18,3 +18,6 @@extern void cmpxchg8b_emu (void );#endif +#if defined(__GENKSYMS__) && defined(CONFIG_STACKPROTECTOR ) +extern unsigned long __ref_stack_chk_guard; +#endif arch/x86/kernel/cpu/common.c +2
-0@@ -2000,8 +2000,10 @@ EXPORT_PER_CPU_SYMBOL(cpu_current_top_of_stack);#ifdef CONFIG_STACKPROTECTOR DEFINE_PER_CPU(unsigned long, __stack_chk_guard); +#ifndef CONFIG_SMP EXPORT_PER_CPU_SYMBOL (__stack_chk_guard);#endif +#endif #endif /* CONFIG_X86_64 */ arch/x86/kernel/vmlinux.lds.S +3
-1@@ -490,6 +490,9 @@ SECTIONS ASSERT(SIZEOF(.rela.dyn) == 0, "Unexpected run-time relocations (.rela) detected!") } +/* needed for Clang - see arch/x86/entry/entry.S */ +PROVIDE(__ref_stack_chk_guard = __stack_chk_guard); + /* * The ASSERT() sink to . is intentional, for binutils 2.14 compatibility: */ --2.43.0
Greg Kroah-Hartman
maintainerPATCH 74/565 cifs: Fix buffer overflow when parsing NFS reparse points
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pali Rohár <[email protected]>
commit e2a8910af01653c1c268984855629d71fb81f404 upstream.
ReparseDataLength is sum of the InodeType size and DataBuffer size. So to get DataBuffer size it is needed to subtract InodeType's size from ReparseDataLength.
Function cifs_strndup_from_utf16() is currentlly accessing buf->DataBuffer at position after the end of the buffer because it does not subtract InodeType size from the length. Fix this problem and correctly subtract variable len.
Member InodeType is present only when reparse buffer is large enough. Check for ReparseDataLength before accessing InodeType to prevent another invalid memory access.
Major and minor rdev values are present also only when reparse buffer is large enough. Check for reparse buffer size before calling reparse_mkdev().
[use variable name symlink_buf, the other buf->InodeType accesses are not used in current version so skip]
--- fs/cifs/smb2ops.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/cifs/smb2ops.c +6 -0
@@ -2971,6 +2971,12 @@ parse_reparse_posix(struct reparse_posix_data *symlink_buf,/* See MS-FSCC 2.1.2.6 for the 'NFS' style reparse tags */ len =le16_to_cpu (symlink_buf->ReparseDataLength); +if (len <sizeof (symlink_buf->InodeType)) { +cifs_dbg (VFS ,"srv returned malformed nfs buffer\n" ); +return -EIO ; + } + + len -=sizeof (symlink_buf->InodeType);if (le64_to_cpu (symlink_buf->InodeType) !=NFS_SPECFILE_LNK ) { cifs_dbg(VFS, "%lld not a supported symlink type\n",
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 75/565 nvme: fix metadata handling in nvme-passthrough
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Puranjay Mohan <[email protected]>
[ Upstream commit 7c2fd76048e95dd267055b5f5e0a48e6e7c81fd9 ]
On an NVMe namespace that does not support metadata, it is possible to send an IO command with metadata through io-passthru. This allows issues like [1] to trigger in the completion code path. nvme_map_user_request() doesn't check if the namespace supports metadata before sending it forward. It also allows admin commands with metadata to be processed as it ignores metadata when bdev == NULL and may report success.
Reject an IO command with metadata when the NVMe namespace doesn't support it and reject an admin command if it has metadata.
[1] https://lore.kernel.org/all/[email protected]/
[ Move the changes from nvme_map_user_request() to nvme_submit_user_cmd()
to make it work on 5.15 ]
--- drivers/nvme/host/ioctl.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/nvme/host/ioctl.c +6 -1
@@ -61,11 +61,16 @@ static int nvme_submit_user_cmd(struct request_queue *q,bool write =nvme_is_write (cmd);struct nvme_ns *ns = q->queuedata;struct block_device *bdev = ns ? ns->disk->part0 :NULL ; +bool supports_metadata = bdev &&blk_get_integrity (bdev->bd_disk); +bool has_metadata = meta_buffer && meta_len;struct request *req;struct bio *bio =NULL ;void *meta =NULL ;int ret; +if (has_metadata && !supports_metadata) +return -EINVAL ; + req =nvme_alloc_request (q, cmd,0 );if (IS_ERR (req))return PTR_ERR (req);
@@ -82,7 +87,7 @@ static int nvme_submit_user_cmd(struct request_queue *q, bio = req->bio;if (bdev)bio_set_dev (bio, bdev); -if (bdev && meta_buffer && meta_len) { +if (has_metadata) { meta =nvme_add_user_metadata (bio, meta_buffer, meta_len, meta_seed, write);if (IS_ERR (meta)) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 76/565 x86/barrier: Do not serialize MSR accesses on AMD
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Borislav Petkov (AMD) <[email protected]>
commit 04c3024560d3a14acd18d0a51a1d0a89d29b7eb5 upstream.
AMD does not have the requirement for a synchronization barrier when acccessing a certain group of MSRs. Do not incur that unnecessary penalty there.
There will be a CPUID bit which explicitly states that a MFENCE is not needed. Once that bit is added to the APM, this will be extended with it.
While at it, move to processor.h to avoid include hell. Untangling that file properly is a matter for another day.
Some notes on the performance aspect of why this is relevant, courtesy of Kishon VijayAbraham <[email protected]>:
On a AMD Zen4 system with 96 cores, a modified ipi-bench[1] on a VM shows x2AVIC IPI rate is 3% to 4% lower than AVIC IPI rate. The ipi-bench is modified so that the IPIs are sent between two vCPUs in the same CCX. This also requires to pin the vCPU to a physical core to prevent any latencies. This simulates the use case of pinning vCPUs to the thread of a single CCX to avoid interrupt IPI latency.
In order to avoid run-to-run variance (for both x2AVIC and AVIC), the below configurations are done:
1) Disable Power States in BIOS (to prevent the system from going to lower power state)
2) Run the system at fixed frequency 2500MHz (to prevent the system from increasing the frequency when the load is more)
With the above configuration:
*) Performance measured using ipi-bench for AVIC:
Average Latency: 1124.98ns [Time to send IPI from one vCPU to another vCPU]
Cumulative throughput: 42.6759M/s [Total number of IPIs sent in a second from
48 vCPUs simultaneously]
*) Performance measured using ipi-bench for x2AVIC:
Average Latency: 1172.42ns [Time to send IPI from one vCPU to another vCPU]
Cumulative throughput: 40.9432M/s [Total number of IPIs sent in a second from
48 vCPUs simultaneously]
Quoted 1 line
From above, x2AVIC latency is ~4% more than AVIC. However, the expectation is
x2AVIC performance to be better or equivalent to AVIC. Upon analyzing the perf captures, it is observed significant time is spent in weak_wrmsr_fence() invoked by x2apic_send_IPI().
With the fix to skip weak_wrmsr_fence()
*) Performance measured using ipi-bench for x2AVIC:
Average Latency: 1117.44ns [Time to send IPI from one vCPU to another vCPU]
Cumulative throughput: 42.9608M/s [Total number of IPIs sent in a second from
48 vCPUs simultaneously]
Comparing the performance of x2AVIC with and without the fix, it can be seen the performance improves by ~4%.
Performance captured using an unmodified ipi-bench using the 'mesh-ipi' option with and without weak_wrmsr_fence() on a Zen4 system also showed significant performance improvement without weak_wrmsr_fence(). The 'mesh-ipi' option ignores CCX or CCD and just picks random vCPU.
Average throughput (10 iterations) with weak_wrmsr_fence(),
Cumulative throughput: 4933374 IPI/s
Average throughput (10 iterations) without weak_wrmsr_fence(),
Cumulative throughput: 6355156 IPI/s
[1] https://github.com/bytedance/kvm-utils/tree/master/microbenchmark/ipi-bench
--- arch/x86/include/asm/barrier.h | 18 ------------------ arch/x86/include/asm/cpufeatures.h | 1 + arch/x86/include/asm/processor.h | 18 ++++++++++++++++++ arch/x86/kernel/cpu/amd.c | 3 +++ arch/x86/kernel/cpu/common.c | 7 +++++++ arch/x86/kernel/cpu/hygon.c | 3 +++ 6 files changed, 32 insertions(+), 18 deletions(-)
arch/x86/include/asm/barrier.h +0 -18
@@ -81,22 +81,4 @@ do { \#include <asm-generic/barrier.h> -/* -* Make previous memory operations globally visible before -* a WRMSR. -* -* MFENCE makes writes visible, but only affects load/store -* instructions. WRMSR is unfortunately not a load/store -* instruction and is unaffected by MFENCE. The LFENCE ensures -* that the WRMSR is not reordered. -* -* Most WRMSRs are full serializing instructions themselves and -* do not require this barrier. This is only required for the -* IA32_TSC_DEADLINE and X2APIC MSRs. -*/ -static inline void weak_wrmsr_fence (void ) -{ - asmvolatile ("mfence; lfence" : : :"memory" ); -} -#endif /* _ASM_X86_BARRIER_H */
arch/x86/include/asm/cpufeatures.h +1 -0
@@ -309,6 +309,7 @@#define X86_FEATURE_SRSO (11*32+24)/* "" AMD BTB untrain RETs */ #define X86_FEATURE_SRSO_ALIAS (11*32+25)/* "" AMD BTB untrain RETs through aliasing */ #define X86_FEATURE_IBPB_ON_VMEXIT (11*32+26)/* "" Issue an IBPB only on VMEXIT */ +#define X86_FEATURE_APIC_MSRS_FENCE (11*32+27)/* "" IA32_TSC_DEADLINE and X2APIC MSRs need fencing */ /* Intel-defined CPU features, CPUID level 0x00000007:1 (EAX), word 12 */ #define X86_FEATURE_AVX_VNNI (12*32+ 4)/* AVX VNNI instructions */
arch/x86/include/asm/processor.h +18 -0
@@ -860,4 +860,22 @@ enum mds_mitigations {extern bool gds_ucode_mitigated (void ); +/* +* Make previous memory operations globally visible before +* a WRMSR. +* +* MFENCE makes writes visible, but only affects load/store +* instructions. WRMSR is unfortunately not a load/store +* instruction and is unaffected by MFENCE. The LFENCE ensures +* that the WRMSR is not reordered. +* +* Most WRMSRs are full serializing instructions themselves and +* do not require this barrier. This is only required for the +* IA32_TSC_DEADLINE and X2APIC MSRs. +*/ +static inline void weak_wrmsr_fence (void ) +{ +alternative ("mfence; lfence" ,"" ,ALT_NOT (X86_FEATURE_APIC_MSRS_FENCE )); +} +#endif /* _ASM_X86_PROCESSOR_H */
arch/x86/kernel/cpu/amd.c +3 -0
@@ -1158,6 +1158,9 @@ static void init_amd(struct cpuinfo_x86 *c)if (!cpu_has (c,X86_FEATURE_HYPERVISOR ) &&cpu_has_amd_erratum (c, amd_erratum_1485))msr_set_bit (MSR_ZEN4_BP_CFG ,MSR_ZEN4_BP_CFG_SHARED_BTB_FIX_BIT ); + +/* AMD CPUs don't need fencing after x2APIC/TSC_DEADLINE MSR writes. */ +clear_cpu_cap (c,X86_FEATURE_APIC_MSRS_FENCE ); }#ifdef CONFIG_X86_32
arch/x86/kernel/cpu/common.c +7 -0
@@ -1733,6 +1733,13 @@ static void identify_cpu(struct cpuinfo_x86 *c) c->apicid = apic->phys_pkg_id (c->initial_apicid,0 );#endif + +/* +* Set default APIC and TSC_DEADLINE MSR fencing flag. AMD and +* Hygon will clear it in ->c_init() below. +*/ +set_cpu_cap (c,X86_FEATURE_APIC_MSRS_FENCE ); +/* * Vendor-specific initialization. In this section we * canonicalize the feature flags, meaning if there are
arch/x86/kernel/cpu/hygon.c +3 -0
@@ -347,6 +347,9 @@ static void init_hygon(struct cpuinfo_x86 *c)set_cpu_bug (c,X86_BUG_SYSRET_SS_ATTRS );check_null_seg_clears_base (c); + +/* Hygon CPUs don't need fencing after x2APIC/TSC_DEADLINE MSR writes. */ +clear_cpu_cap (c,X86_FEATURE_APIC_MSRS_FENCE ); }static void cpu_detect_tlb_hygon (struct cpuinfo_x86 *c)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 77/565 kselftest/arm64: mte: fix printf type warnings about longs
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andre Przywara <[email protected]>
[ Upstream commit 96dddb7b9406259baace9a1831e8da155311be6f ]
When checking MTE tags, we print some diagnostic messages when the tests fail. Some variables uses there are "longs", however we only use "%x" for the format specifier.
Update the format specifiers to "%lx", to match the variable types they are supposed to print.
--- tools/testing/selftests/arm64/mte/check_tags_inclusion.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/testing/selftests/arm64/mte/check_tags_inclusion.c +2 -2
@@ -57,7 +57,7 @@ static int check_single_included_tags(int mem_type, int mode) ptr = (char *)mte_insert_tags (ptr,BUFFER_SIZE );/* Check tag value */ if (MT_FETCH_TAG ((uintptr_t )ptr) == tag) { -ksft_print_msg ("FAIL: wrong tag = 0x%x with include mask=0x%x\n" , +ksft_print_msg ("FAIL: wrong tag = 0x%lx with include mask=0x%x\n" ,MT_FETCH_TAG ((uintptr_t )ptr),MT_INCLUDE_VALID_TAG (tag)); result =KSFT_FAIL ;
@@ -89,7 +89,7 @@ static int check_multiple_included_tags(int mem_type, int mode) ptr = (char *)mte_insert_tags (ptr,BUFFER_SIZE );/* Check tag value */ if (MT_FETCH_TAG ((uintptr_t )ptr) < tag) { -ksft_print_msg ("FAIL: wrong tag = 0x%x with include mask=0x%x\n" , +ksft_print_msg ("FAIL: wrong tag = 0x%lx with include mask=0x%lx\n" ,MT_FETCH_TAG ((uintptr_t )ptr),MT_INCLUDE_VALID_TAGS (excl_mask)); result =KSFT_FAIL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 78/565 s390/cio: Do not unregister the subchannel based on DNV
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vineeth Vijayan <[email protected]>
[ Upstream commit 8c58a229688ce3a097b3b1a2efe1b4f5508c2123 ]
Starting with commit 2297791c92d0 ("s390/cio: dont unregister subchannel from child-drivers"), CIO does not unregister subchannels when the attached device is invalid or unavailable. Instead, it allows subchannels to exist without a connected device. However, if the DNV value is 0, such as, when all the CHPIDs of a subchannel are configured in standby state, the subchannel is unregistered, which contradicts the current subchannel specification.
Update the logic so that subchannels are not unregistered based on the DNV value. Also update the SCHIB information even if the DNV bit is zero.
--- drivers/s390/cio/cio.c | 6 +++++- drivers/s390/cio/device.c | 18 +++++++++++++++++- 2 files changed, 22 insertions(+), 2 deletions(-)
drivers/s390/cio/cio.c +5 -1
@@ -459,10 +459,14 @@ int cio_update_schib(struct subchannel *sch) {struct schib schib; -if (stsch (sch->schid, &schib) || !css_sch_is_valid (&schib)) +if (stsch (sch->schid, &schib))return -ENODEV ;memcpy (&sch->schib, &schib,sizeof (schib)); + +if (!css_sch_is_valid (&schib)) +return -EACCES ; +return 0 ; }EXPORT_SYMBOL_GPL (cio_update_schib);
drivers/s390/cio/device.c +17 -1
@@ -1390,14 +1390,18 @@ enum io_sch_action {IO_SCH_VERIFY ,IO_SCH_DISC ,IO_SCH_NOP , + IO_SCH_ORPH_CDEV, };static enum io_sch_action sch_get_action (struct subchannel *sch) {struct ccw_device *cdev; +int rc; cdev =sch_get_cdev (sch); -if (cio_update_schib (sch)) { + rc =cio_update_schib (sch); + +if (rc == -ENODEV ) {/* Not operational. */ if (!cdev)return IO_SCH_UNREG ;
@@ -1405,6 +1409,16 @@ static enum io_sch_action sch_get_action(struct subchannel *sch)return IO_SCH_UNREG ;return IO_SCH_ORPH_UNREG ; } + +/* Avoid unregistering subchannels without working device. */ +if (rc == -EACCES ) { +if (!cdev) +return IO_SCH_NOP ; +if (ccw_device_notify (cdev,CIO_GONE ) !=NOTIFY_OK ) +return IO_SCH_UNREG_CDEV ; +return IO_SCH_ORPH_CDEV ; + } +/* Operational. */ if (!cdev)return IO_SCH_ATTACH ;
@@ -1474,6 +1488,7 @@ static int io_subchannel_sch_event(struct subchannel *sch, int process) rc =0 ; goto out_unlock;case IO_SCH_ORPH_UNREG : +case IO_SCH_ORPH_CDEV :case IO_SCH_ORPH_ATTACH :ccw_device_set_disconnected (cdev);break ;
@@ -1505,6 +1520,7 @@ static int io_subchannel_sch_event(struct subchannel *sch, int process)/* Handle attached ccw device. */ switch (action) {case IO_SCH_ORPH_UNREG : +case IO_SCH_ORPH_CDEV :case IO_SCH_ORPH_ATTACH :/* Move ccw device to orphanage. */ rc =ccw_device_move_to_orph (cdev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 79/565 brd: remove brd_devices_mutex mutex
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <[email protected]>
[ Upstream commit 00358933f66c44d511368a57eb421e172447cfb9 ]
If brd_alloc() from brd_probe() is called before brd_alloc() from brd_init() is called, module loading will fail with -EEXIST error. To close this race, call __register_blkdev() just before leaving brd_init().
Then, we can remove brd_devices_mutex mutex, for brd_device list will no longer be accessed concurrently.
Stable-dep-of: 826cc42adf44 ("brd: defer automatic disk creation until module initialization succeeds")
--- drivers/block/brd.c | 73 +++++++++++++++++++-------------------------- 1 file changed, 30 insertions(+), 43 deletions(-)
drivers/block/brd.c +30 -43
@@ -362,7 +362,6 @@ __setup("ramdisk_size=", ramdisk_size);* (should share code eventually). */ static LIST_HEAD (brd_devices); -static DEFINE_MUTEX (brd_devices_mutex);static struct dentry *brd_debugfs_dir;static int brd_alloc (int i)
@@ -372,21 +371,14 @@ static int brd_alloc(int i)char buf[DISK_NAME_LEN ];int err = -ENOMEM ; -mutex_lock (&brd_devices_mutex); -list_for_each_entry (brd, &brd_devices, brd_list) { -if (brd->brd_number == i) { -mutex_unlock (&brd_devices_mutex); +list_for_each_entry (brd, &brd_devices, brd_list) +if (brd->brd_number == i)return -EEXIST ; - } - } brd =kzalloc (sizeof (*brd),GFP_KERNEL ); -if (!brd) { -mutex_unlock (&brd_devices_mutex); +if (!brd)return -ENOMEM ; - } brd->brd_number = i;list_add_tail (&brd->brd_list, &brd_devices); -mutex_unlock (&brd_devices_mutex);spin_lock_init (&brd->brd_lock);INIT_RADIX_TREE (&brd->brd_pages,GFP_ATOMIC );
@@ -431,9 +423,7 @@ static int brd_alloc(int i) out_cleanup_disk:blk_cleanup_disk (disk); out_free_dev: -mutex_lock (&brd_devices_mutex);list_del (&brd->brd_list); -mutex_unlock (&brd_devices_mutex);kfree (brd);return err; }
@@ -443,15 +433,19 @@ static void brd_probe(dev_t dev)brd_alloc (MINOR (dev) / max_part); } -static void brd_del_one (struct brd_device *brd) +static void brd_cleanup (void ) { -del_gendisk (brd->brd_disk); -blk_cleanup_disk (brd->brd_disk); -brd_free_pages (brd); -mutex_lock (&brd_devices_mutex); -list_del (&brd->brd_list); -mutex_unlock (&brd_devices_mutex); -kfree (brd); +struct brd_device *brd, *next; + +debugfs_remove_recursive (brd_debugfs_dir); + +list_for_each_entry_safe (brd, next, &brd_devices, brd_list) { +del_gendisk (brd->brd_disk); +blk_cleanup_disk (brd->brd_disk); +brd_free_pages (brd); +list_del (&brd->brd_list); +kfree (brd); + } }static inline void brd_check_and_reset_par (void )
@@ -475,9 +469,18 @@ static inline void brd_check_and_reset_par(void)static int __init brd_init (void ) { -struct brd_device *brd, *next;int err, i; +brd_check_and_reset_par (); + + brd_debugfs_dir =debugfs_create_dir ("ramdisk_pages" ,NULL ); + +for (i =0 ; i < rd_nr; i++) { + err =brd_alloc (i); +if (err) + goto out_free; + } +/* * brd module now has a feature to instantiate underlying device * structure on-demand, provided that there is an access dev node.
@@ -493,28 +496,16 @@ static int __init brd_init(void)* dynamically. */ -if (__register_blkdev (RAMDISK_MAJOR ,"ramdisk" , brd_probe)) -return -EIO ; - -brd_check_and_reset_par (); - - brd_debugfs_dir =debugfs_create_dir ("ramdisk_pages" ,NULL ); - -for (i =0 ; i < rd_nr; i++) { - err =brd_alloc (i); -if (err) - goto out_free; +if (__register_blkdev (RAMDISK_MAJOR ,"ramdisk" , brd_probe)) { + err = -EIO ; + goto out_free; }pr_info ("brd: module loaded\n" );return 0 ; out_free: -unregister_blkdev (RAMDISK_MAJOR ,"ramdisk" ); -debugfs_remove_recursive (brd_debugfs_dir); - -list_for_each_entry_safe (brd, next, &brd_devices, brd_list) -brd_del_one (brd); +brd_cleanup ();pr_info ("brd: module NOT loaded !!!\n" );return err;
@@ -522,13 +513,9 @@ static int __init brd_init(void) static void __exit brd_exit(void) { -struct brd_device *brd, *next;unregister_blkdev (RAMDISK_MAJOR ,"ramdisk" ); -debugfs_remove_recursive (brd_debugfs_dir); - -list_for_each_entry_safe (brd, next, &brd_devices, brd_list) -brd_del_one (brd); +brd_cleanup ();pr_info ("brd: module unloaded\n" ); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 80/565 brd: defer automatic disk creation until module initialization succeeds
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Erkun <[email protected]>
[ Upstream commit 826cc42adf44930a633d11a5993676d85ddb0842 ]
My colleague Wupeng found the following problems during fault injection:
BUG: unable to handle page fault for address: fffffbfff809d073 PGD 6e648067 P4D 123ec8067 PUD 123ec4067 PMD 100e38067 PTE 0 Oops: Oops: 0000 [#1] PREEMPT SMP KASAN NOPTI CPU: 5 UID: 0 PID: 755 Comm: modprobe Not tainted 6.12.0-rc3+ #17 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 RIP: 0010:__asan_load8+0x4c/0xa0 ... Call Trace: <TASK> blkdev_put_whole+0x41/0x70 bdev_release+0x1a3/0x250 blkdev_release+0x11/0x20 __fput+0x1d7/0x4a0 task_work_run+0xfc/0x180 syscall_exit_to_user_mode+0x1de/0x1f0 do_syscall_64+0x6b/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e
loop_init() is calling loop_add() after __register_blkdev() succeeds and is ignoring disk_add() failure from loop_add(), for loop_add() failure is not fatal and successfully created disks are already visible to bdev_open().
brd_init() is currently calling brd_alloc() before __register_blkdev() succeeds and is releasing successfully created disks when brd_init() returns an error. This can cause UAF for the latter two case:
case 1:
T1:
modprobe brd
brd_init
brd_alloc(0) // success
add_disk
disk_scan_partitions
bdev_file_open_by_dev // alloc file fput // won't free until back to userspace
brd_alloc(1) // failed since mem alloc error inject
// error path for modprobe will release code segment // back to userspace
__fput
blkdev_release
bdev_release
blkdev_put_whole
bdev->bd_disk->fops->release // fops is freed now, UAF!case 2:
T1: T2:
modprobe brd
brd_init
brd_alloc(0) // success
open(/dev/ram0)
brd_alloc(1) // fail// error path for modprobe
close(/dev/ram0)
...
/* UAF! */
bdev->bd_disk->fops->releaseFix this problem by following what loop_init() does. Besides, reintroduce brd_devices_mutex to help serialize modifications to brd_list.
--- drivers/block/brd.c | 66 ++++++++++++++++++++++++++++++--------------- 1 file changed, 44 insertions(+), 22 deletions(-)
drivers/block/brd.c +44 -22
@@ -362,8 +362,40 @@ __setup("ramdisk_size=", ramdisk_size);* (should share code eventually). */ static LIST_HEAD (brd_devices); +static DEFINE_MUTEX (brd_devices_mutex);static struct dentry *brd_debugfs_dir; +static struct brd_device *brd_find_or_alloc_device (int i) +{ +struct brd_device *brd; + +mutex_lock (&brd_devices_mutex); +list_for_each_entry (brd, &brd_devices, brd_list) { +if (brd->brd_number == i) { +mutex_unlock (&brd_devices_mutex); +return ERR_PTR (-EEXIST ); + } + } + + brd =kzalloc (sizeof (*brd),GFP_KERNEL ); +if (!brd) { +mutex_unlock (&brd_devices_mutex); +return ERR_PTR (-ENOMEM ); + } + brd->brd_number = i; +list_add_tail (&brd->brd_list, &brd_devices); +mutex_unlock (&brd_devices_mutex); +return brd; +} + +static void brd_free_device (struct brd_device *brd) +{ +mutex_lock (&brd_devices_mutex); +list_del (&brd->brd_list); +mutex_unlock (&brd_devices_mutex); +kfree (brd); +} +static int brd_alloc (int i) {struct brd_device *brd;
@@ -371,14 +403,9 @@ static int brd_alloc(int i)char buf[DISK_NAME_LEN ];int err = -ENOMEM ; -list_for_each_entry (brd, &brd_devices, brd_list) -if (brd->brd_number == i) -return -EEXIST ; - brd =kzalloc (sizeof (*brd),GFP_KERNEL ); -if (!brd) -return -ENOMEM ; - brd->brd_number = i; -list_add_tail (&brd->brd_list, &brd_devices); + brd =brd_find_or_alloc_device (i); +if (IS_ERR (brd)) +return PTR_ERR (brd);spin_lock_init (&brd->brd_lock);INIT_RADIX_TREE (&brd->brd_pages,GFP_ATOMIC );
@@ -423,8 +450,7 @@ static int brd_alloc(int i) out_cleanup_disk:blk_cleanup_disk (disk); out_free_dev: -list_del (&brd->brd_list); -kfree (brd); +brd_free_device (brd);return err; }
@@ -443,8 +469,7 @@ static void brd_cleanup(void)del_gendisk (brd->brd_disk);blk_cleanup_disk (brd->brd_disk);brd_free_pages (brd); -list_del (&brd->brd_list); -kfree (brd); +brd_free_device (brd); } }
@@ -471,16 +496,6 @@ static int __init brd_init(void) {int err, i; -brd_check_and_reset_par (); - - brd_debugfs_dir =debugfs_create_dir ("ramdisk_pages" ,NULL ); - -for (i =0 ; i < rd_nr; i++) { - err =brd_alloc (i); -if (err) - goto out_free; - } -/* * brd module now has a feature to instantiate underlying device * structure on-demand, provided that there is an access dev node.
@@ -496,11 +511,18 @@ static int __init brd_init(void)* dynamically. */ +brd_check_and_reset_par (); + + brd_debugfs_dir =debugfs_create_dir ("ramdisk_pages" ,NULL ); +if (__register_blkdev (RAMDISK_MAJOR ,"ramdisk" , brd_probe)) { err = -EIO ; goto out_free; } +for (i =0 ; i < rd_nr; i++) +brd_alloc (i); +pr_info ("brd: module loaded\n" );return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 81/565 mips: asm: fix warning when disabling MIPS_FP_SUPPORT
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <[email protected]>
[ Upstream commit da09935975c8f8c90d6f57be2422dee5557206cd ]
When MIPS_FP_SUPPORT is disabled, __sanitize_fcr31() is defined as nothing, which triggers a gcc warning:
In file included from kernel/sched/core.c:79:
kernel/sched/core.c: In function 'context_switch':
./arch/mips/include/asm/switch_to.h:114:39: warning: suggest braces around empty body in an 'if' statement [-Wempty-body]
114 | __sanitize_fcr31(next); \
| ^
kernel/sched/core.c:5316:9: note: in expansion of macro 'switch_to'
5316 | switch_to(prev, next, prev);
| ^~~~~~~~~
Fix this by providing an empty body for __sanitize_fcr31() like one is defined for __mips_mt_fpaff_switch_to().
--- arch/mips/include/asm/switch_to.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/mips/include/asm/switch_to.h +1 -1
@@ -97,7 +97,7 @@ do { \ } \ } while (0)#else -# define __sanitize_fcr31 (next) +# define __sanitize_fcr31 (next) do { (void) (next); } while (0)#endif /*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 82/565 initramfs: avoid filename buffer overrun
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Disseldorp <[email protected]>
[ Upstream commit e017671f534dd3f568db9e47b0583e853d2da9b5 ]
The initramfs filename field is defined in Documentation/driver-api/early-userspace/buffer-format.rst as:
37 cpio_file := ALGN(4) + cpio_header + filename + "\0" + ALGN(4) + data
...
55 ============= ================== =========================
56 Field name Field size Meaning
57 ============= ================== =========================
...
70 c_namesize 8 bytes Length of filename, including final \0
When extracting an initramfs cpio archive, the kernel's do_name() path handler assumes a zero-terminated path at @collected, passing it directly to filp_open() / init_mkdir() / init_mknod().
If a specially crafted cpio entry carries a non-zero-terminated filename and is followed by uninitialized memory, then a file may be created with trailing characters that represent the uninitialized memory. The ability to create an initramfs entry would imply already having full control of the system, so the buffer overrun shouldn't be considered a security vulnerability.
Append the output of the following bash script to an existing initramfs and observe any created /initramfs_test_fname_overrunAA* path. E.g.
./reproducer.sh | gzip >> /myinitramfs
It's easiest to observe non-zero uninitialized memory when the output is gzipped, as it'll overflow the heap allocated @out_buf in __gunzip(), rather than the initrd_start+initrd_size block.
---- reproducer.sh ----
nilchar="A" # change to "\0" to properly zero terminate / pad
magic="070701"
ino=1
mode=$(( 0100777 ))
uid=0
gid=0
nlink=1
mtime=1
filesize=0
devmajor=0
devminor=1
rdevmajor=0
rdevminor=0
csum=0
fname="initramfs_test_fname_overrun"
namelen=$(( ${#fname} + 1 )) # plus one to account for terminator
printf "%s%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%s" \ $magic $ino $mode $uid $gid $nlink $mtime $filesize \ $devmajor $devminor $rdevmajor $rdevminor $namelen $csum $fname
termpadlen=$(( 1 + ((4 - ((110 + $namelen) & 3)) % 4) )) printf "%.s${nilchar}" $(seq 1 $termpadlen) ---- reproducer.sh ----
Symlink filename fields handled in do_symlink() won't overrun past the data segment, due to the explicit zero-termination of the symlink target.
Fix filename buffer overrun by aborting the initramfs FSM if any cpio entry doesn't carry a zero-terminator at the expected (name_len - 1) offset.
--- init/initramfs.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
init/initramfs.c +15 -0
@@ -338,6 +338,15 @@ static int __init do_name(void) { state = SkipIt; next_state = Reset; + +/* name_len > 0 && name_len <= PATH_MAX checked in do_header */ +if (collected[name_len -1 ] !='\0' ) { +pr_err ("initramfs name without nulterm: %.*s\n" , + (int )name_len, collected); +error ("malformed archive" ); +return 1 ; + } +if (strcmp (collected,"TRAILER!!!" ) ==0 ) {free_hash ();return 0 ;
@@ -403,6 +412,12 @@ static int __init do_copy(void)static int __init do_symlink (void ) { +if (collected[name_len -1 ] !='\0' ) { +pr_err ("initramfs symlink without nulterm: %.*s\n" , + (int )name_len, collected); +error ("malformed archive" ); +return 1 ; + } collected[N_ALIGN (name_len) + body_len] ='\0' ;clean_path (collected,0 );init_symlink (collected +N_ALIGN (name_len), collected);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 83/565 nvme-pci: fix freeing of the HMB descriptor table
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit 3c2fb1ca8086eb139b2a551358137525ae8e0d7a ]
The HMB descriptor table is sized to the maximum number of descriptors that could be used for a given device, but __nvme_alloc_host_mem could break out of the loop earlier on memory allocation failure and end up using less descriptors than planned for, which leads to an incorrect size passed to dma_free_coherent.
In practice this was not showing up because the number of descriptors tends to be low and the dma coherent allocator always allocates and frees at least a page.
--- drivers/nvme/host/pci.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
drivers/nvme/host/pci.c +9 -7
@@ -150,6 +150,7 @@ struct nvme_dev {/* host memory buffer support: */ u64 host_mem_size;u32 nr_host_mem_descs; +u32 host_mem_descs_size;dma_addr_t host_mem_descs_dma;struct nvme_host_mem_buf_desc *host_mem_descs;void **host_mem_desc_bufs;
@@ -1921,10 +1922,10 @@ static void nvme_free_host_mem(struct nvme_dev *dev)kfree (dev->host_mem_desc_bufs); dev->host_mem_desc_bufs =NULL ; -dma_free_coherent (dev->dev, - dev->nr_host_mem_descs *sizeof (*dev->host_mem_descs), +dma_free_coherent (dev->dev, dev->host_mem_descs_size, dev->host_mem_descs, dev->host_mem_descs_dma); dev->host_mem_descs =NULL ; + dev->host_mem_descs_size =0 ; dev->nr_host_mem_descs =0 ; }
@@ -1932,7 +1933,7 @@ static int __nvme_alloc_host_mem(struct nvme_dev *dev, u64 preferred, u32 chunk_size) {struct nvme_host_mem_buf_desc *descs; -u32 max_entries, len; +u32 max_entries, len, descs_size;dma_addr_t descs_dma;int i =0 ;void **bufs;
@@ -1945,8 +1946,9 @@ static int __nvme_alloc_host_mem(struct nvme_dev *dev, u64 preferred,if (dev->ctrl.hmmaxd && dev->ctrl.hmmaxd < max_entries) max_entries = dev->ctrl.hmmaxd; - descs =dma_alloc_coherent (dev->dev, max_entries *sizeof (*descs), - &descs_dma,GFP_KERNEL ); + descs_size = max_entries *sizeof (*descs); + descs =dma_alloc_coherent (dev->dev, descs_size, &descs_dma, +GFP_KERNEL );if (!descs) goto out;
@@ -1975,6 +1977,7 @@ static int __nvme_alloc_host_mem(struct nvme_dev *dev, u64 preferred, dev->host_mem_size = size; dev->host_mem_descs = descs; dev->host_mem_descs_dma = descs_dma; + dev->host_mem_descs_size = descs_size; dev->host_mem_desc_bufs = bufs;return 0 ;
@@ -1989,8 +1992,7 @@ static int __nvme_alloc_host_mem(struct nvme_dev *dev, u64 preferred,kfree (bufs); out_free_descs: -dma_free_coherent (dev->dev, max_entries *sizeof (*descs), descs, - descs_dma); +dma_free_coherent (dev->dev, descs_size, descs, descs_dma); out: dev->host_mem_descs =NULL ;return -ENOMEM ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 84/565 m68k: mvme147: Fix SCSI controller IRQ numbers
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Palmer <[email protected]>
[ Upstream commit 47bc874427382018fa2e3e982480e156271eee70 ]
Sometime long ago the m68k IRQ code was refactored and the interrupt numbers for SCSI controller on this board ended up wrong, and it hasn't worked since.
The PCC adds 0x40 to the vector for its interrupts so they end up in the user interrupt range. Hence, the kernel number should be the kernel offset for user interrupt range + the PCC interrupt number.
--- arch/m68k/include/asm/mvme147hw.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/m68k/include/asm/mvme147hw.h +2 -2
@@ -93,8 +93,8 @@ struct pcc_regs {#define M147_SCC_B_ADDR 0xfffe3000#define M147_SCC_PCLK 5000000 -#define MVME147_IRQ_SCSI_PORT (IRQ_USER+0x45) -#define MVME147_IRQ_SCSI_DMA (IRQ_USER+0x46) +#define MVME147_IRQ_SCSI_PORT (IRQ_USER + 5) +#define MVME147_IRQ_SCSI_DMA (IRQ_USER + 6)/* SCC interrupts, for MVME147 */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 85/565 m68k: mvme16x: Add and use "mvme16x.h"
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
[ Upstream commit dcec33c1fc4ab63983d93ffb0d82b68fc5775b88 ]
When building with W=1:
arch/m68k/mvme16x/config.c:208:6: warning: no previous prototype for ‘mvme16x_cons_write’ [-Wmissing-prototypes]
208 | void mvme16x_cons_write(struct console *co, const char *str, unsigned count)
| ^~~~~~~~~~~~~~~~~~
Fix this by introducing a new header file "mvme16x.h" for holding the prototypes of functions implemented in arch/m68k/mvme16x/.
Stable-dep-of: 077b33b9e283 ("m68k: mvme147: Reinstate early console")
--- arch/m68k/kernel/early_printk.c | 4 ++-- arch/m68k/mvme16x/config.c | 2 ++ arch/m68k/mvme16x/mvme16x.h | 6 ++++++ 3 files changed, 10 insertions(+), 2 deletions(-) create mode 100644 arch/m68k/mvme16x/mvme16x.h
arch/m68k/kernel/early_printk.c +2 -2
@@ -12,8 +12,8 @@#include <linux/string.h> #include <asm/setup.h> -extern void mvme16x_cons_write (struct console *co, -const char *str,unsigned count); + +#include "../mvme16x/mvme16x.h" asmlinkage void __init debug_cons_nputs(const char *s, unsigned n);
arch/m68k/mvme16x/config.c +2 -0
@@ -38,6 +38,8 @@#include <asm/machdep.h> #include <asm/mvme16xhw.h> +#include "mvme16x.h" +extern t_bdid mvme_bdid;static MK48T08ptr_t volatile rtc = (MK48T08ptr_t )MVME_RTC_BASE ;
arch/m68k/mvme16x/mvme16x.h new file +6 -0
@@ -0,0 +1,6 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ + +struct console ; + +/* config.c */ +void mvme16x_cons_write (struct console *co,const char *str,unsigned count);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 86/565 m68k: mvme147: Reinstate early console
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Palmer <[email protected]>
[ Upstream commit 077b33b9e2833ff25050d986178a2c4c4036cbac ]
Commit a38eaa07a0ce ("m68k/mvme147: config.c - Remove unused functions"), removed the console functionality for the mvme147 instead of wiring it up to an early console. Put the console write function back and wire it up like mvme16x does so it's possible to see Linux boot on this fine hardware once more.
--- arch/m68k/kernel/early_printk.c | 5 ++++- arch/m68k/mvme147/config.c | 30 ++++++++++++++++++++++++++++++ arch/m68k/mvme147/mvme147.h | 6 ++++++ 3 files changed, 40 insertions(+), 1 deletion(-) create mode 100644 arch/m68k/mvme147/mvme147.h
arch/m68k/kernel/early_printk.c +4 -1
@@ -13,6 +13,7 @@#include <asm/setup.h> +#include "../mvme147/mvme147.h" #include "../mvme16x/mvme16x.h" asmlinkage void __init debug_cons_nputs(const char *s, unsigned n);
@@ -22,7 +23,9 @@ static void __ref debug_cons_write(struct console *c, {#if !(defined(CONFIG_SUN3 ) || defined(CONFIG_M68000 ) || \ defined(CONFIG_COLDFIRE )) -if (MACH_IS_MVME16x) +if (MACH_IS_MVME147 ) +mvme147_scc_write (c, s, n); +else if (MACH_IS_MVME16x)mvme16x_cons_write (c, s, n);else debug_cons_nputs (s, n);
arch/m68k/mvme147/config.c +30 -0
@@ -35,6 +35,7 @@#include <asm/machdep.h> #include <asm/mvme147hw.h> +#include "mvme147.h" static void mvme147_get_model (char *model);extern void mvme147_sched_init (void );
@@ -188,3 +189,32 @@ int mvme147_hwclk(int op, struct rtc_time *t) }return 0 ; } + +static void scc_delay (void ) +{ + __asm__ __volatile__ ("nop; nop;" ); +} + +static void scc_write (char ch) +{ +do { +scc_delay (); + }while (!(in_8 (M147_SCC_A_ADDR ) &BIT (2 ))); +scc_delay (); +out_8 (M147_SCC_A_ADDR ,8 ); +scc_delay (); +out_8 (M147_SCC_A_ADDR , ch); +} + +void mvme147_scc_write (struct console *co,const char *str,unsigned int count) +{ +unsigned long flags; + +local_irq_save (flags); +while (count--) { +if (*str =='\n' ) +scc_write ('\r' ); +scc_write (*str++); + } +local_irq_restore (flags); +}
arch/m68k/mvme147/mvme147.h new file +6 -0
@@ -0,0 +1,6 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ + +struct console ; + +/* config.c */ +void mvme147_scc_write (struct console *co,const char *str,unsigned int count);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 87/565 arm64: fix .data.rel.ro size assertion when CONFIG_LTO_CLANG
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masahiro Yamada <[email protected]>
[ Upstream commit 340fd66c856651d8c1d29f392dd26ad674d2db0e ]
Commit be2881824ae9 ("arm64/build: Assert for unwanted sections") introduced an assertion to ensure that the .data.rel.ro section does not exist.
However, this check does not work when CONFIG_LTO_CLANG is enabled, because .data.rel.ro matches the .data.[0-9a-zA-Z_]* pattern in the DATA_MAIN macro.
Move the ASSERT() above the RW_DATA() line.
--- arch/arm64/kernel/vmlinux.lds.S | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/arm64/kernel/vmlinux.lds.S +3 -3
@@ -258,6 +258,9 @@ SECTIONS __initdata_end = .; __init_end = .; + .data.rel.ro : { *(.data.rel.ro) } + ASSERT(SIZEOF(.data.rel.ro) == 0, "Unexpected RELRO detected!") + _data = .; _sdata = .; RW_DATA(L1_CACHE_BYTES, PAGE_SIZE, THREAD_ALIGN)
@@ -309,9 +312,6 @@ SECTIONS *(.plt) *(.plt.*) *(.iplt) *(.igot .igot.plt) } ASSERT(SIZEOF(.plt) == 0, "Unexpected run-time procedure linkages detected!") - - .data.rel.ro : { *(.data.rel.ro) } - ASSERT(SIZEOF(.data.rel.ro) == 0, "Unexpected RELRO detected!") } #include "image-vars.h"
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 88/565 acpi/arm64: Adjust error handling procedure in gtdt_parse_timer_block()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Mishin <[email protected]>
[ Upstream commit 1a9de2f6fda69d5f105dd8af776856a66abdaa64 ]
In case of error in gtdt_parse_timer_block() invalid 'gtdt_frame' will be used in 'do {} while (i-- >= 0 && gtdt_frame--);' statement block because do{} block will be executed even if 'i == 0'.
Adjust error handling procedure by replacing 'i-- >= 0' with 'i-- > 0'.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/acpi/arm64/gtdt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/acpi/arm64/gtdt.c +1 -1
@@ -283,7 +283,7 @@ static int __init gtdt_parse_timer_block(struct acpi_gtdt_timer_block *block,if (frame->virt_irq >0 )acpi_unregister_gsi (gtdt_frame->virtual_timer_interrupt); frame->virt_irq =0 ; - }while (i-- >=0 && gtdt_frame--); + }while (i-- >0 && gtdt_frame--);return -EINVAL ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 89/565 s390/syscalls: Avoid creation of arch/arch/ directory
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masahiro Yamada <[email protected]>
[ Upstream commit 0708967e2d56e370231fd07defa0d69f9ad125e8 ]
Building the kernel with ARCH=s390 creates a weird arch/arch/ directory.
$ find arch/arch arch/arch arch/arch/s390 arch/arch/s390/include arch/arch/s390/include/generated arch/arch/s390/include/generated/asm arch/arch/s390/include/generated/uapi arch/arch/s390/include/generated/uapi/asm
The root cause is 'targets' in arch/s390/kernel/syscalls/Makefile, where the relative path is incorrect.
Strictly speaking, 'targets' was not necessary in the first place because this Makefile uses 'filechk' instead of 'if_changed'.
However, this commit keeps it, as it will be useful when converting 'filechk' to 'if_changed' later.
--- arch/s390/kernel/syscalls/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/s390/kernel/syscalls/Makefile +1 -1
@@ -12,7 +12,7 @@ kapi-hdrs-y := $(kapi)/unistd_nr.h uapi-hdrs-y := $(uapi)/unistd_32.h uapi-hdrs-y += $(uapi)/unistd_64.h -targets += $(addprefix ../../../,$(gen-y) $(kapi-hdrs-y) $(uapi-hdrs-y)) +targets += $(addprefix ../../../../,$(gen-y) $(kapi-hdrs-y) $(uapi-hdrs-y)) PHONY += kapi uapi
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 90/565 hfsplus: dont query the device logical block size multiple times
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thadeu Lima de Souza Cascardo <[email protected]>
[ Upstream commit 1c82587cb57687de3f18ab4b98a8850c789bedcf ]
Devices block sizes may change. One of these cases is a loop device by using ioctl LOOP_SET_BLOCK_SIZE.
While this may cause other issues like IO being rejected, in the case of hfsplus, it will allocate a block by using that size and potentially write out-of-bounds when hfsplus_read_wrapper calls hfsplus_submit_bio and the latter function reads a different io_size.
Using a new min_io_size initally set to sb_min_blocksize works for the purposes of the original fix, since it will be set to the max between HFSPLUS_SECTOR_SIZE and the first seen logical block size. We still use the max between HFSPLUS_SECTOR_SIZE and min_io_size in case the latter is not initialized.
Tested by mounting an hfsplus filesystem with loop block sizes 512, 1024 and 4096.
The produced KASAN report before the fix looks like this:
[ 419.944641] ================================================================== [ 419.945655] BUG: KASAN: slab-use-after-free in hfsplus_read_wrapper+0x659/0xa0a [ 419.946703] Read of size 2 at addr ffff88800721fc00 by task repro/10678 [ 419.947612] [ 419.947846] CPU: 0 UID: 0 PID: 10678 Comm: repro Not tainted 6.12.0-rc5-00008-gdf56e0f2f3ca #84 [ 419.949007] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 [ 419.950035] Call Trace: [ 419.950384] <TASK> [ 419.950676] dump_stack_lvl+0x57/0x78 [ 419.951212] ? hfsplus_read_wrapper+0x659/0xa0a [ 419.951830] print_report+0x14c/0x49e [ 419.952361] ? __virt_addr_valid+0x267/0x278 [ 419.952979] ? kmem_cache_debug_flags+0xc/0x1d [ 419.953561] ? hfsplus_read_wrapper+0x659/0xa0a [ 419.954231] kasan_report+0x89/0xb0 [ 419.954748] ? hfsplus_read_wrapper+0x659/0xa0a [ 419.955367] hfsplus_read_wrapper+0x659/0xa0a [ 419.955948] ? __pfx_hfsplus_read_wrapper+0x10/0x10 [ 419.956618] ? do_raw_spin_unlock+0x59/0x1a9 [ 419.957214] ? _raw_spin_unlock+0x1a/0x2e [ 419.957772] hfsplus_fill_super+0x348/0x1590 [ 419.958355] ? hlock_class+0x4c/0x109 [ 419.958867] ? __pfx_hfsplus_fill_super+0x10/0x10 [ 419.959499] ? __pfx_string+0x10/0x10 [ 419.960006] ? lock_acquire+0x3e2/0x454 [ 419.960532] ? bdev_name.constprop.0+0xce/0x243 [ 419.961129] ? __pfx_bdev_name.constprop.0+0x10/0x10 [ 419.961799] ? pointer+0x3f0/0x62f [ 419.962277] ? __pfx_pointer+0x10/0x10 [ 419.962761] ? vsnprintf+0x6c4/0xfba [ 419.963178] ? __pfx_vsnprintf+0x10/0x10 [ 419.963621] ? setup_bdev_super+0x376/0x3b3 [ 419.964029] ? snprintf+0x9d/0xd2 [ 419.964344] ? __pfx_snprintf+0x10/0x10 [ 419.964675] ? lock_acquired+0x45c/0x5e9 [ 419.965016] ? set_blocksize+0x139/0x1c1 [ 419.965381] ? sb_set_blocksize+0x6d/0xae [ 419.965742] ? __pfx_hfsplus_fill_super+0x10/0x10 [ 419.966179] mount_bdev+0x12f/0x1bf [ 419.966512] ? __pfx_mount_bdev+0x10/0x10 [ 419.966886] ? vfs_parse_fs_string+0xce/0x111 [ 419.967293] ? __pfx_vfs_parse_fs_string+0x10/0x10 [ 419.967702] ? __pfx_hfsplus_mount+0x10/0x10 [ 419.968073] legacy_get_tree+0x104/0x178 [ 419.968414] vfs_get_tree+0x86/0x296 [ 419.968751] path_mount+0xba3/0xd0b [ 419.969157] ? __pfx_path_mount+0x10/0x10 [ 419.969594] ? kmem_cache_free+0x1e2/0x260 [ 419.970311] do_mount+0x99/0xe0 [ 419.970630] ? __pfx_do_mount+0x10/0x10 [ 419.971008] __do_sys_mount+0x199/0x1c9 [ 419.971397] do_syscall_64+0xd0/0x135 [ 419.971761] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 419.972233] RIP: 0033:0x7c3cb812972e [ 419.972564] Code: 48 8b 0d f5 46 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d c2 46 0d 00 f7 d8 64 89 01 48 [ 419.974371] RSP: 002b:00007ffe30632548 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5 [ 419.975048] RAX: ffffffffffffffda RBX: 00007ffe306328d8 RCX: 00007c3cb812972e [ 419.975701] RDX: 0000000020000000 RSI: 0000000020000c80 RDI: 00007ffe306325d0 [ 419.976363] RBP: 00007ffe30632720 R08: 00007ffe30632610 R09: 0000000000000000 [ 419.977034] R10: 0000000000200008 R11: 0000000000000286 R12: 0000000000000000 [ 419.977713] R13: 00007ffe306328e8 R14: 00005a0eb298bc68 R15: 00007c3cb8356000 [ 419.978375] </TASK> [ 419.978589]
--- fs/hfsplus/hfsplus_fs.h | 3 ++- fs/hfsplus/wrapper.c | 2 ++ 2 files changed, 4 insertions(+), 1 deletion(-)
fs/hfsplus/hfsplus_fs.h +2 -1
@@ -156,6 +156,7 @@ struct hfsplus_sb_info {/* Runtime variables */ u32 blockoffset; +u32 min_io_size;sector_t part_start;sector_t sect_count;int fs_shift;
@@ -306,7 +307,7 @@ struct hfsplus_readdir_data {*/ static inline unsigned short hfsplus_min_io_size (struct super_block *sb) { - return max_t(unsigned short, bdev_logical_block_size(sb->s_bdev), + return max_t(unsigned short, HFSPLUS_SB(sb)->min_io_size,HFSPLUS_SECTOR_SIZE ); }
fs/hfsplus/wrapper.c +2 -0
@@ -173,6 +173,8 @@ int hfsplus_read_wrapper(struct super_block *sb)if (!blocksize) goto out; + sbi->min_io_size = blocksize; +if (hfsplus_get_last_session (sb, &part_start, &part_size)) goto out;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 91/565 crypto: caam - Fix the pointer passed to caam_qi_shutdown()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit ad980b04f51f7fb503530bd1cb328ba5e75a250e ]
The type of the last parameter given to devm_add_action_or_reset() is "struct caam_drv_private *", but in caam_qi_shutdown(), it is casted to "struct device *".
Pass the correct parameter to devm_add_action_or_reset() so that the resources are released as expected.
--- drivers/crypto/caam/qi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/crypto/caam/qi.c +1 -1
@@ -765,7 +765,7 @@ int caam_qi_init(struct platform_device *caam_pdev)caam_debugfs_qi_init (ctrlpriv); - err =devm_add_action_or_reset (qidev, caam_qi_shutdown, ctrlpriv); + err =devm_add_action_or_reset (qidev, caam_qi_shutdown, qidev);if (err)return err;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 92/565 firmware: google: Unregister driver_info on failure
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuan Can <[email protected]>
[ Upstream commit 32b0901e141f6d4cf49d820b53eb09b88b1f72f7 ]
When platform_device_register_full() returns error, the gsmi_init() returns without unregister gsmi_driver_info, fix by add missing platform_driver_unregister() when platform_device_register_full() failed.
--- drivers/firmware/google/gsmi.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/firmware/google/gsmi.c +4 -2
@@ -918,7 +918,8 @@ static __init int gsmi_init(void) gsmi_dev.pdev =platform_device_register_full (&gsmi_dev_info);if (IS_ERR (gsmi_dev.pdev)) {printk (KERN_ERR "gsmi: unable to register platform device\n" ); -return PTR_ERR (gsmi_dev.pdev); + ret =PTR_ERR (gsmi_dev.pdev); + goto out_unregister; }/* SMI access needs to be serialized */
@@ -1056,10 +1057,11 @@ static __init int gsmi_init(void)gsmi_buf_free (gsmi_dev.name_buf);kmem_cache_destroy (gsmi_dev.mem_pool);platform_device_unregister (gsmi_dev.pdev); -pr_info ("gsmi: failed to load: %d\n" , ret); +out_unregister:#ifdef CONFIG_PM platform_driver_unregister (&gsmi_driver_info);#endif +pr_info ("gsmi: failed to load: %d\n" , ret);return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 93/565 EDAC/bluefield: Fix potential integer overflow
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Thompson <[email protected]>
[ Upstream commit 1fe774a93b46bb029b8f6fa9d1f25affa53f06c6 ]
The 64-bit argument for the "get DIMM info" SMC call consists of mem_ctrl_idx left-shifted 16 bits and OR-ed with DIMM index. With mem_ctrl_idx defined as 32-bits wide the left-shift operation truncates the upper 16 bits of information during the calculation of the SMC argument.
The mem_ctrl_idx stack variable must be defined as 64-bits wide to prevent any potential integer overflow, i.e. loss of data from upper 16 bits.
--- drivers/edac/bluefield_edac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/edac/bluefield_edac.c +1 -1
@@ -180,7 +180,7 @@ static void bluefield_edac_check(struct mem_ctl_info *mci)static void bluefield_edac_init_dimms (struct mem_ctl_info *mci) {struct bluefield_edac_priv *priv = mci->pvt_info; -int mem_ctrl_idx = mci->mc_idx; +u64 mem_ctrl_idx = mci->mc_idx;struct dimm_info *dimm;u64 smc_info, smc_arg;int is_empty =1 , i;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 94/565 crypto: qat - remove faulty arbiter config reset
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ahsan Atta <[email protected]>
[ Upstream commit 70199359902f1c7187dcb28a1be679a7081de7cc ]
Resetting the service arbiter config can cause potential issues related to response ordering and ring flow control check in the event of AER or device hang. This is because it results in changing the default response ring size from 32 bytes to 16 bytes. The service arbiter config reset also disables response ring flow control check. Thus, by removing this reset we can prevent the service arbiter from being configured inappropriately, which leads to undesired device behaviour in the event of errors.
--- drivers/crypto/qat/qat_common/adf_hw_arbiter.c | 4 ---- 1 file changed, 4 deletions(-)
drivers/crypto/qat/qat_common/adf_hw_arbiter.c +0 -4
@@ -90,10 +90,6 @@ void adf_exit_arb(struct adf_accel_dev *accel_dev) hw_data->get_arb_info (&info); -/* Reset arbiter configuration */ -for (i =0 ; i <ADF_ARB_NUM ; i++) -WRITE_CSR_ARB_SARCONFIG (csr, arb_off, i,0 ); -/* Unmap worker threads to service arbiters */ for (i =0 ; i < hw_data->num_engines; i++)WRITE_CSR_ARB_WT2SAM (csr, arb_off, wt_off, i,0 );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 95/565 thermal: core: Initialize thermal zones before registering them
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit 662f920f7e390db5d1a6792a2b0ffa59b6c962fc ]
Since user space can start interacting with a new thermal zone as soon as device_register() called by thermal_zone_device_register_with_trips() returns, it is better to initialize the thermal zone before calling device_register() on it.
--- drivers/thermal/thermal_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/thermal/thermal_core.c +1 -1
@@ -1271,6 +1271,7 @@ thermal_zone_device_register(const char *type, int num_trips, int mask,thermal_zone_destroy_device_groups (tz); goto remove_id; } +thermal_zone_device_init (tz); result =device_register (&tz->device);if (result) goto release_device;
@@ -1313,7 +1314,6 @@ thermal_zone_device_register(const char *type, int num_trips, int mask,INIT_DELAYED_WORK (&tz->poll_queue, thermal_zone_device_check); -thermal_zone_device_init (tz);/* Update the new thermal zone and mark it as already updated. */ if (atomic_cmpxchg (&tz->need_update,1 ,0 ))thermal_zone_device_update (tz,THERMAL_EVENT_UNSPECIFIED );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 96/565 EDAC/fsl_ddr: Fix bad bit shift operations
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Priyanka Singh <[email protected]>
[ Upstream commit 9ec22ac4fe766c6abba845290d5139a3fbe0153b ]
Fix undefined behavior caused by left-shifting a negative value in the expression:
cap_high ^ (1 << (bad_data_bit - 32))
The variable bad_data_bit ranges from 0 to 63. When it is less than 32, bad_data_bit - 32 becomes negative, and left-shifting by a negative value in C is undefined behavior.
Fix this by combining cap_high and cap_low into a 64-bit variable.
[ bp: Massage commit message, simplify error bits handling. ]
--- drivers/edac/fsl_ddr_edac.c | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-)
drivers/edac/fsl_ddr_edac.c +13 -9
@@ -331,21 +331,25 @@ static void fsl_mc_check(struct mem_ctl_info *mci)* TODO: Add support for 32-bit wide buses */ if ((err_detect &DDR_EDE_SBE ) && (bus_width ==64 )) { +u64 cap = (u64 )cap_high <<32 | cap_low; +u32 s = syndrome; +sbe_ecc_decode (cap_high, cap_low, syndrome, &bad_data_bit, &bad_ecc_bit); -if (bad_data_bit !=-1 ) -fsl_mc_printk (mci,KERN_ERR , -"Faulty Data bit: %d\n" , bad_data_bit); -if (bad_ecc_bit !=-1 ) -fsl_mc_printk (mci,KERN_ERR , -"Faulty ECC bit: %d\n" , bad_ecc_bit); +if (bad_data_bit >=0 ) { +fsl_mc_printk (mci,KERN_ERR ,"Faulty Data bit: %d\n" , bad_data_bit); + cap ^=1ULL << bad_data_bit; + } + +if (bad_ecc_bit >=0 ) { +fsl_mc_printk (mci,KERN_ERR ,"Faulty ECC bit: %d\n" , bad_ecc_bit); + s ^=1 << bad_ecc_bit; + }fsl_mc_printk (mci,KERN_ERR ,"Expected Data / ECC:\t%#8.8x_%08x / %#2.2x\n" , - cap_high ^ (1 << (bad_data_bit -32 )), - cap_low ^ (1 << bad_data_bit), - syndrome ^ (1 << bad_ecc_bit)); +upper_32_bits (cap),lower_32_bits (cap), s); } fsl_mc_printk(mci, KERN_ERR,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 97/565 crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yi Yang <[email protected]>
[ Upstream commit 662f2f13e66d3883b9238b0b96b17886179e60e2 ]
Since commit 8f4f68e788c3 ("crypto: pcrypt - Fix hungtask for PADATA_RESET"), the pcrypt encryption and decryption operations return -EAGAIN when the CPU goes online or offline. In alg_test(), a WARN is generated when pcrypt_aead_decrypt() or pcrypt_aead_encrypt() returns -EAGAIN, the unnecessary panic will occur when panic_on_warn set 1. Fix this issue by calling crypto layer directly without parallelization in that case.
--- crypto/pcrypt.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
crypto/pcrypt.c +8 -4
@@ -117,8 +117,10 @@ static int pcrypt_aead_encrypt(struct aead_request *req) err =padata_do_parallel (ictx->psenc, padata, &ctx->cb_cpu);if (!err)return -EINPROGRESS ; -if (err == -EBUSY ) -return -EAGAIN ; +if (err == -EBUSY ) { +/* try non-parallel mode */ +return crypto_aead_encrypt (creq); + }return err; }
@@ -166,8 +168,10 @@ static int pcrypt_aead_decrypt(struct aead_request *req) err =padata_do_parallel (ictx->psdec, padata, &ctx->cb_cpu);if (!err)return -EINPROGRESS ; -if (err == -EBUSY ) -return -EAGAIN ; +if (err == -EBUSY ) { +/* try non-parallel mode */ +return crypto_aead_decrypt (creq); + }return err; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 98/565 crypto: cavium - Fix the if condition to exit loop after timeout
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Everest K.C <[email protected]>
[ Upstream commit 53d91ca76b6c426c546542a44c78507b42008c9e ]
The while loop breaks in the first run because of incorrect if condition. It also causes the statements after the if to appear dead.
Fix this by changing the condition from if(timeout--) to if(!timeout--).
This bug was reported by Coverity Scan.
Report:
CID 1600859: (#1 of 1): Logically dead code (DEADCODE)dead_error_line: Execution cannot reach this statement: udelay(30UL);
--- drivers/crypto/cavium/cpt/cptpf_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/crypto/cavium/cpt/cptpf_main.c +2 -2
@@ -44,7 +44,7 @@ static void cpt_disable_cores(struct cpt_device *cpt, u64 coremask,dev_err (dev,"Cores still busy %llx" , coremask); grp =cpt_read_csr64 (cpt->reg_base,CPTX_PF_EXEC_BUSY (0 )); -if (timeout--) +if (!timeout--)break ;udelay (CSR_DELAY );
@@ -394,7 +394,7 @@ static void cpt_disable_all_cores(struct cpt_device *cpt)dev_err (dev,"Cores still busy" ); grp =cpt_read_csr64 (cpt->reg_base,CPTX_PF_EXEC_BUSY (0 )); -if (timeout--) +if (!timeout--)break ;udelay (CSR_DELAY );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 99/565 EDAC/igen6: Avoid segmentation fault on module unload
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Orange Kao <[email protected]>
[ Upstream commit fefaae90398d38a1100ccd73b46ab55ff4610fba ]
The segmentation fault happens because:
During modprobe:
1. In igen6_probe(), igen6_pvt will be allocated with kzalloc()
2. In igen6_register_mci(), mci->pvt_info will point to &igen6_pvt->imc[mc]
During rmmod:
1. In mci_release() in edac_mc.c, it will kfree(mci->pvt_info)
2. In igen6_remove(), it will kfree(igen6_pvt);
Fix this issue by setting mci->pvt_info to NULL to avoid the double kfree.
--- drivers/edac/igen6_edac.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/edac/igen6_edac.c +2 -0
@@ -1075,6 +1075,7 @@ static int igen6_register_mci(int mc, u64 mchbar, struct pci_dev *pdev) imc->mci = mci;return 0 ; fail3: + mci->pvt_info =NULL ;kfree (mci->ctl_name); fail2:edac_mc_free (mci);
@@ -1099,6 +1100,7 @@ static void igen6_unregister_mcis(void)edac_mc_del_mc (mci->pdev);kfree (mci->ctl_name); + mci->pvt_info =NULL ;edac_mc_free (mci);iounmap (imc->window); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 100/565 ACPI: CPPC: Fix _CPC register setting issue
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lifeng Zheng <[email protected]>
[ Upstream commit 2388b266c9fcc7c9169ba85c7f9ebe325b7622d7 ]
Since commit 60949b7b8054 ("ACPI: CPPC: Fix MASK_VAL() usage"), _CPC registers cannot be changed from 1 to 0.
It turns out that there is an extra OR after MASK_VAL_WRITE(), which has already ORed prev_val with the register mask.
Remove the extra OR to fix the problem.
--- drivers/acpi/cppc_acpi.c | 1 - 1 file changed, 1 deletion(-)
drivers/acpi/cppc_acpi.c +0 -1
@@ -1067,7 +1067,6 @@ static int cpc_write(int cpu, struct cpc_register_resource *reg_res, u64 val)return -EFAULT ; } val =MASK_VAL_WRITE (reg, prev_val, val); - val |= prev_val; }switch (size) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 101/565 crypto: caam - add error check to caam_rsa_set_priv_key_form
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ridong <[email protected]>
[ Upstream commit b64140c74e954f1db6eae5548ca3a1f41b6fad79 ]
The caam_rsa_set_priv_key_form did not check for memory allocation errors. Add the checks to the caam_rsa_set_priv_key_form functions.
--- drivers/crypto/caam/caampkc.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
drivers/crypto/caam/caampkc.c +7 -4
@@ -979,7 +979,7 @@ static int caam_rsa_set_pub_key(struct crypto_akcipher *tfm, const void *key,return -ENOMEM ; } -static void caam_rsa_set_priv_key_form (struct caam_rsa_ctx *ctx, +static int caam_rsa_set_priv_key_form (struct caam_rsa_ctx *ctx,struct rsa_key *raw_key) {struct caam_rsa_key *rsa_key = &ctx->key;
@@ -988,7 +988,7 @@ static void caam_rsa_set_priv_key_form(struct caam_rsa_ctx *ctx, rsa_key->p =caam_read_raw_data (raw_key->p, &p_sz);if (!rsa_key->p) -return ; +return -ENOMEM ; rsa_key->p_sz = p_sz; rsa_key->q =caam_read_raw_data (raw_key->q, &q_sz);
@@ -1021,7 +1021,7 @@ static void caam_rsa_set_priv_key_form(struct caam_rsa_ctx *ctx, rsa_key->priv_form =FORM3 ; -return ; +return 0 ; free_dq:kfree_sensitive (rsa_key->dq);
@@ -1035,6 +1035,7 @@ static void caam_rsa_set_priv_key_form(struct caam_rsa_ctx *ctx,kfree_sensitive (rsa_key->q); free_p:kfree_sensitive (rsa_key->p); +return -ENOMEM ; } static int caam_rsa_set_priv_key(struct crypto_akcipher *tfm, const void *key,
@@ -1080,7 +1081,9 @@ static int caam_rsa_set_priv_key(struct crypto_akcipher *tfm, const void *key, rsa_key->e_sz = raw_key.e_sz; rsa_key->n_sz = raw_key.n_sz; -caam_rsa_set_priv_key_form (ctx, &raw_key); + ret =caam_rsa_set_priv_key_form (ctx, &raw_key); +if (ret) + goto err;return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 102/565 crypto: bcm - add error check in the ahash_hmac_init function
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ridong <[email protected]>
[ Upstream commit 19630cf57233e845b6ac57c9c969a4888925467b ]
The ahash_init functions may return fails. The ahash_hmac_init should not return ok when ahash_init returns error. For an example, ahash_init will return -ENOMEM when allocation memory is error.
--- drivers/crypto/bcm/cipher.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/crypto/bcm/cipher.c +4 -1
@@ -2415,6 +2415,7 @@ static int ahash_hmac_setkey(struct crypto_ahash *ahash, const u8 *key,static int ahash_hmac_init (struct ahash_request *req) { +int ret;struct iproc_reqctx_s *rctx =ahash_request_ctx (req);struct crypto_ahash *tfm =crypto_ahash_reqtfm (req);struct iproc_ctx_s *ctx =crypto_ahash_ctx (tfm);
@@ -2424,7 +2425,9 @@ static int ahash_hmac_init(struct ahash_request *req)flow_log ("ahash_hmac_init()\n" );/* init the context as a hash */ -ahash_init (req); + ret =ahash_init (req); +if (ret) +return ret;if (!spu_no_incr_hash (ctx)) {/* SPU-M can do incr hashing but needs sw for outer HMAC */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 103/565 crypto: cavium - Fix an error handling path in cpt_ucode_load_fw()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit 572b7cf08403b6c67dfe0dc3e0f2efb42443254f ]
If do_cpt_init() fails, a previous dma_alloc_coherent() call needs to be undone.
Add the needed dma_free_coherent() before returning.
--- drivers/crypto/cavium/cpt/cptpf_main.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/crypto/cavium/cpt/cptpf_main.c +2 -0
@@ -302,6 +302,8 @@ static int cpt_ucode_load_fw(struct cpt_device *cpt, const u8 *fw, bool is_ae) ret =do_cpt_init (cpt, mcode);if (ret) { +dma_free_coherent (&cpt->pdev->dev, mcode->code_size, + mcode->code, mcode->phys_base);dev_err (dev,"do_cpt_init failed with ret: %d\n" , ret); goto fw_release; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 104/565 time: Fix references to _msecs_to_jiffies() handling of values
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miguel Ojeda <[email protected]>
[ Upstream commit 92b043fd995a63a57aae29ff85a39b6f30cd440c ]
The details about the handling of the "normal" values were moved to the _msecs_to_jiffies() helpers in commit ca42aaf0c861 ("time:
Refactor msecs_to_jiffies"). However, the same commit still mentioned __msecs_to_jiffies() in the added documentation.
Thus point to _msecs_to_jiffies() instead.
--- include/linux/jiffies.h | 2 +- kernel/time/time.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
include/linux/jiffies.h +1 -1
@@ -349,7 +349,7 @@ static inline unsigned long _msecs_to_jiffies(const unsigned int m)* - all other values are converted to jiffies by either multiplying * the input value by a factor or dividing it with a factor and * handling any 32-bit overflows. -* for the details see __msecs_to_jiffies() +* for the details see _msecs_to_jiffies() * * msecs_to_jiffies() checks for the passed in value being a constant * via __builtin_constant_p() allowing gcc to eliminate most of the
kernel/time/time.c +1 -1
@@ -539,7 +539,7 @@ EXPORT_SYMBOL(ns_to_timespec64);* - all other values are converted to jiffies by either multiplying * the input value by a factor or dividing it with a factor and * handling any 32-bit overflows. -* for the details see __msecs_to_jiffies() +* for the details see _msecs_to_jiffies() * * msecs_to_jiffies() checks for the passed in value being a constant * via __builtin_constant_p() allowing gcc to eliminate most of the
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 105/565 timekeeping: Consolidate fast timekeeper
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
[ Upstream commit 90be8d6c1f91e1e5121c219726524c91b52bfc20 ]
Provide a inline function which replaces the copy & pasta.
Stable-dep-of: 5c1806c41ce0 ("kcsan, seqlock: Support seqcount_latch_t")
--- kernel/time/timekeeping.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-)
kernel/time/timekeeping.c +10 -10
@@ -431,6 +431,14 @@ static void update_fast_timekeeper(const struct tk_read_base *tkr,memcpy (base +1 , base,sizeof (*base)); } +static __always_inline u64 fast_tk_get_delta_ns(struct tk_read_base *tkr) +{ +u64 delta, cycles =tk_clock_read (tkr); + + delta =clocksource_delta (cycles, tkr->cycle_last, tkr->mask); +return timekeeping_delta_to_ns (tkr, delta); +} + static __always_inline u64 __ktime_get_fast_ns(struct tk_fast *tkf) {struct tk_read_base *tkr;
@@ -441,12 +449,7 @@ static __always_inline u64 __ktime_get_fast_ns(struct tk_fast *tkf) seq =raw_read_seqcount_latch (&tkf->seq); tkr = tkf->base + (seq &0x01 ); now =ktime_to_ns (tkr->base); - - now +=timekeeping_delta_to_ns (tkr, -clocksource_delta ( -tk_clock_read (tkr), - tkr->cycle_last, - tkr->mask)); + now +=fast_tk_get_delta_ns (tkr); }while (read_seqcount_latch_retry (&tkf->seq, seq));return now;
@@ -545,10 +548,7 @@ static __always_inline u64 __ktime_get_real_fast(struct tk_fast *tkf, u64 *mono) tkr = tkf->base + (seq &0x01 ); basem =ktime_to_ns (tkr->base); baser =ktime_to_ns (tkr->base_real); - - delta =timekeeping_delta_to_ns (tkr, -clocksource_delta (tk_clock_read (tkr), - tkr->cycle_last, tkr->mask)); + delta =fast_tk_get_delta_ns (tkr); }while (read_seqcount_latch_retry (&tkf->seq, seq));if (mono)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 106/565 seqlock/latch: Provide raw_read_seqcount_latch_retry()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
[ Upstream commit d16317de9b412aa7bd3598c607112298e36b4352 ]
The read side of seqcount_latch consists of:
do {
seq = raw_read_seqcount_latch(&latch->seq);
...
} while (read_seqcount_latch_retry(&latch->seq, seq));which is asymmetric in the raw_ department, and sure enough, read_seqcount_latch_retry() includes (explicit) instrumentation where raw_read_seqcount_latch() does not.
This inconsistency becomes a problem when trying to use it from noinstr code. As such, fix it by renaming and re-implementing raw_read_seqcount_latch_retry() without the instrumentation.
Specifically the instrumentation in question is kcsan_atomic_next(0) in do___read_seqcount_retry(). Loosing this annotation is not a problem because raw_read_seqcount_latch() does not pass through kcsan_atomic_next(KCSAN_SEQLOCK_REGION_MAX).
Stable-dep-of: 5c1806c41ce0 ("kcsan, seqlock: Support seqcount_latch_t")
--- include/linux/rbtree_latch.h | 2 +- include/linux/seqlock.h | 15 ++++++++------- kernel/printk/printk.c | 2 +- kernel/time/sched_clock.c | 2 +- kernel/time/timekeeping.c | 4 ++-- 5 files changed, 13 insertions(+), 12 deletions(-)
include/linux/rbtree_latch.h +1 -1
@@ -206,7 +206,7 @@ latch_tree_find(void *key, struct latch_tree_root *root,do { seq =raw_read_seqcount_latch (&root->seq); node =__lt_find (key, root, seq &1 , ops->comp); - }while (read_seqcount_latch_retry (&root->seq, seq)); + }while (raw_read_seqcount_latch_retry (&root->seq, seq));return node; }
include/linux/seqlock.h +8 -7
@@ -675,9 +675,9 @@ typedef struct {* * Return: sequence counter raw value. Use the lowest bit as an index for * picking which data copy to read. The full counter must then be checked -* with read_seqcount_latch_retry(). +* with raw_read_seqcount_latch_retry(). */ -static inline unsigned raw_read_seqcount_latch (const seqcount_latch_t *s) +static __always_inline unsigned raw_read_seqcount_latch (const seqcount_latch_t *s) {/* * Pairs with the first smp_wmb() in raw_write_seqcount_latch().
@@ -687,16 +687,17 @@ static inline unsigned raw_read_seqcount_latch(const seqcount_latch_t *s) }/** -* read_seqcount_latch_retry() - end a seqcount_latch_t read section +* raw_read_seqcount_latch_retry() - end a seqcount_latch_t read section * @s: Pointer to seqcount_latch_t * @start: count, from raw_read_seqcount_latch() * * Return: true if a read section retry is required, else false */ -static inline int -read_seqcount_latch_retry (const seqcount_latch_t *s,unsigned start) +static __always_inline int +raw_read_seqcount_latch_retry (const seqcount_latch_t *s,unsigned start) { -return read_seqcount_retry (&s->seqcount, start); +smp_rmb (); +return unlikely (READ_ONCE (s->seqcount.sequence) != start); }/**
@@ -756,7 +757,7 @@ read_seqcount_latch_retry(const seqcount_latch_t *s, unsigned start)* entry = data_query(latch->data[idx], ...); * * // This includes needed smp_rmb() -* } while (read_seqcount_latch_retry(&latch->seq, seq)); +* } while (raw_read_seqcount_latch_retry(&latch->seq, seq)); * * return entry; * }
kernel/printk/printk.c +1 -1
@@ -457,7 +457,7 @@ static u64 latched_seq_read_nolock(struct latched_seq *ls) seq =raw_read_seqcount_latch (&ls->latch); idx = seq &0x1 ; val = ls->val[idx]; - }while (read_seqcount_latch_retry (&ls->latch, seq)); + }while (raw_read_seqcount_latch_retry (&ls->latch, seq));return val; }
kernel/time/sched_clock.c +1 -1
@@ -76,7 +76,7 @@ notrace struct clock_read_data *sched_clock_read_begin(unsigned int *seq) notrace int sched_clock_read_retry(unsigned int seq) { -return read_seqcount_latch_retry (&cd.seq, seq); +return raw_read_seqcount_latch_retry (&cd.seq, seq); }unsigned long long notrace sched_clock (void )
kernel/time/timekeeping.c +2 -2
@@ -450,7 +450,7 @@ static __always_inline u64 __ktime_get_fast_ns(struct tk_fast *tkf) tkr = tkf->base + (seq &0x01 ); now =ktime_to_ns (tkr->base); now +=fast_tk_get_delta_ns (tkr); - }while (read_seqcount_latch_retry (&tkf->seq, seq)); + }while (raw_read_seqcount_latch_retry (&tkf->seq, seq));return now; }
@@ -549,7 +549,7 @@ static __always_inline u64 __ktime_get_real_fast(struct tk_fast *tkf, u64 *mono) basem =ktime_to_ns (tkr->base); baser =ktime_to_ns (tkr->base_real); delta =fast_tk_get_delta_ns (tkr); - }while (read_seqcount_latch_retry (&tkf->seq, seq)); + }while (raw_read_seqcount_latch_retry (&tkf->seq, seq));if (mono) *mono = basem + delta;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 107/565 kcsan, seqlock: Support seqcount_latch_t
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marco Elver <[email protected]>
[ Upstream commit 5c1806c41ce0a0110db5dd4c483cf2dc28b3ddf0 ]
While fuzzing an arm64 kernel, Alexander Potapenko reported:
| BUG: KCSAN: data-race in ktime_get_mono_fast_ns / timekeeping_update | | write to 0xffffffc082e74248 of 56 bytes by interrupt on cpu 0: | update_fast_timekeeper kernel/time/timekeeping.c:430 [inline] | timekeeping_update+0x1d8/0x2d8 kernel/time/timekeeping.c:768 | timekeeping_advance+0x9e8/0xb78 kernel/time/timekeeping.c:2344 | update_wall_time+0x18/0x38 kernel/time/timekeeping.c:2360 | [...] | | read to 0xffffffc082e74258 of 8 bytes by task 5260 on cpu 1: | __ktime_get_fast_ns kernel/time/timekeeping.c:372 [inline] | ktime_get_mono_fast_ns+0x88/0x174 kernel/time/timekeeping.c:489 | init_srcu_struct_fields+0x40c/0x530 kernel/rcu/srcutree.c:263 | init_srcu_struct+0x14/0x20 kernel/rcu/srcutree.c:311 | [...] | | value changed: 0x000002f875d33266 -> 0x000002f877416866 | | Reported by Kernel Concurrency Sanitizer on: | CPU: 1 UID: 0 PID: 5260 Comm: syz.2.7483 Not tainted 6.12.0-rc3-dirty #78
This is a false positive data race between a seqcount latch writer and a reader accessing stale data. Since its introduction, KCSAN has never understood the seqcount_latch interface (due to being unannotated).
Unlike the regular seqlock interface, the seqcount_latch interface for latch writers never has had a well-defined critical section, making it difficult to teach tooling where the critical section starts and ends.
Introduce an instrumentable (non-raw) seqcount_latch interface, with which we can clearly denote writer critical sections. This both helps readability and tooling like KCSAN to understand when the writer is done updating all latch copies.
--- Documentation/locking/seqlock.rst | 2 +- include/linux/seqlock.h | 86 +++++++++++++++++++++++++------ 2 files changed, 72 insertions(+), 16 deletions(-)
Documentation/locking/seqlock.rst +1 -1
@@ -153,7 +153,7 @@ Use seqcount_latch_t when the write side sections cannot be protected from interruption by readers. This is typically the case when the read side can be invoked from NMI handlers. -Check `raw_write_seqcount_latch()` for more information. +Check `write_seqcount_latch()` for more information. .. _seqlock_t:
include/linux/seqlock.h +71 -15
127 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 108/565 kcsan, seqlock: Fix incorrect assumption in read_seqbegin()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marco Elver <[email protected]>
[ Upstream commit 183ec5f26b2fc97a4a9871865bfe9b33c41fddb2 ]
During testing of the preceding changes, I noticed that in some cases, current->kcsan_ctx.in_flat_atomic remained true until task exit. This is obviously wrong, because _all_ accesses for the given task will be treated as atomic, resulting in false negatives i.e. missed data races.
Debugging led to fs/dcache.c, where we can see this usage of seqlock:
struct dentry *d_lookup(const struct dentry *parent, const struct qstr *name)
{
struct dentry *dentry;
unsigned seq;
do {
seq = read_seqbegin(&rename_lock);
dentry = __d_lookup(parent, name);
if (dentry)
break;
} while (read_seqretry(&rename_lock, seq));
[...]As can be seen, read_seqretry() is never called if dentry != NULL; consequently, current->kcsan_ctx.in_flat_atomic will never be reset to false by read_seqretry().
Give up on the wrong assumption of "assume closing read_seqretry()", and rely on the already-present annotations in read_seqcount_begin/retry().
--- include/linux/seqlock.h | 12 +----------- 1 file changed, 1 insertion(+), 11 deletions(-)
include/linux/seqlock.h +1 -11
@@ -894,11 +894,7 @@ typedef struct {*/ static inline unsigned read_seqbegin (const seqlock_t *sl) { -unsigned ret =read_seqcount_begin (&sl->seqcount); - -kcsan_atomic_next (0 );/* non-raw usage, assume closing read_seqretry() */ -kcsan_flat_atomic_begin (); -return ret; +return read_seqcount_begin (&sl->seqcount); }/**
@@ -914,12 +910,6 @@ static inline unsigned read_seqbegin(const seqlock_t *sl)*/ static inline unsigned read_seqretry (const seqlock_t *sl,unsigned start) { -/* -* Assume not nested: read_seqretry() may be called multiple times when -* completing read critical section. -*/ -kcsan_flat_atomic_end (); -return read_seqcount_retry (&sl->seqcount, start); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 109/565 clocksource/drivers:sp804: Make user selectable
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Brown <[email protected]>
[ Upstream commit 0309f714a0908e947af1c902cf6a330cb593e75e ]
The sp804 is currently only user selectable if COMPILE_TEST, this was done by commit dfc82faad725 ("clocksource/drivers/sp804: Add COMPILE_TEST to CONFIG_ARM_TIMER_SP804") in order to avoid it being spuriously offered on platforms that won't have the hardware since it's generally only seen on Arm based platforms. This config is overly restrictive, while platforms that rely on the SP804 do select it in their Kconfig there are others such as the Arm fast models which have a SP804 available but currently unused by Linux. Relax the dependency to allow it to be user selectable on arm and arm64 to avoid surprises and in case someone comes up with a use for extra timer hardware.
--- drivers/clocksource/Kconfig | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/clocksource/Kconfig +2 -1
@@ -375,7 +375,8 @@ config ARM_GT_INITIAL_PRESCALER_VAL This affects CPU_FREQ max delta from the initial frequency. config ARM_TIMER_SP804 - bool "Support for Dual Timer SP804 module" if COMPILE_TEST + bool "Support for Dual Timer SP804 module" + depends on ARM || ARM64 || COMPILE_TEST depends on GENERIC_SCHED_CLOCK && HAVE_CLK select CLKSRC_MMIO select TIMER_OF if OF
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 110/565 spi: spi-fsl-lpspi: downgrade log level for pio mode
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Stein <[email protected]>
[ Upstream commit d5786c88cacbb859f465e8e93c26154585c1008d ]
Having no DMA is not an error. The simplest reason is not having it configured. SPI will still be usable, so raise a warning instead to get still some attention.
Stable-dep-of: 003c7e01916c ("spi: spi-fsl-lpspi: Use IRQF_NO_AUTOEN flag in request_irq()")
--- drivers/spi/spi-fsl-lpspi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-fsl-lpspi.c +1 -1
@@ -909,7 +909,7 @@ static int fsl_lpspi_probe(struct platform_device *pdev)if (ret == -EPROBE_DEFER ) goto out_pm_get;if (ret <0 ) -dev_err (&pdev->dev,"dma setup error %d, use pio\n" , ret); +dev_warn (&pdev->dev,"dma setup error %d, use pio\n" , ret);else /* * disable LPSPI module IRQ when enable DMA mode successfully,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 111/565 spi: spi-fsl-lpspi: Use IRQF_NO_AUTOEN flag in request_irq()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit 003c7e01916c5e2af95add9b0cbda2e6163873e8 ]
disable_irq() after request_irq() still has a time gap in which interrupts can come. request_irq() with IRQF_NO_AUTOEN flag will disable IRQ auto-enable when request IRQ.
--- drivers/spi/spi-fsl-lpspi.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-)
drivers/spi/spi-fsl-lpspi.c +4 -8
@@ -871,7 +871,7 @@ static int fsl_lpspi_probe(struct platform_device *pdev) goto out_controller_put; } - ret =devm_request_irq (&pdev->dev, irq, fsl_lpspi_isr,0 , + ret =devm_request_irq (&pdev->dev, irq, fsl_lpspi_isr,IRQF_NO_AUTOEN ,dev_name (&pdev->dev), fsl_lpspi);if (ret) {dev_err (&pdev->dev,"can't get irq%d: %d\n" , irq, ret);
@@ -908,14 +908,10 @@ static int fsl_lpspi_probe(struct platform_device *pdev) ret =fsl_lpspi_dma_init (&pdev->dev, fsl_lpspi, controller);if (ret == -EPROBE_DEFER ) goto out_pm_get; -if (ret <0 ) +if (ret <0 ) {dev_warn (&pdev->dev,"dma setup error %d, use pio\n" , ret); -else -/* -* disable LPSPI module IRQ when enable DMA mode successfully, -* to prevent the unexpected LPSPI module IRQ events. -*/ -disable_irq (irq); +enable_irq (irq); + } ret =devm_spi_register_controller (&pdev->dev, controller);if (ret <0 ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 112/565 soc: ti: smartreflex: Use IRQF_NO_AUTOEN flag in request_irq()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit 16a0a69244240cfa32c525c021c40f85e090557a ]
If request_irq() fails in sr_late_init(), there is no need to enable the irq, and if it succeeds, disable_irq() after request_irq() still has a time gap in which interrupts can come.
request_irq() with IRQF_NO_AUTOEN flag will disable IRQ auto-enable when request IRQ.
--- drivers/soc/ti/smartreflex.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/soc/ti/smartreflex.c +2 -2
@@ -203,10 +203,10 @@ static int sr_late_init(struct omap_sr *sr_info)if (sr_class->notify && sr_class->notify_flags && sr_info->irq) { ret =devm_request_irq (&sr_info->pdev->dev, sr_info->irq, - sr_interrupt,0 , sr_info->name, sr_info); + sr_interrupt,IRQF_NO_AUTOEN , + sr_info->name, sr_info);if (ret) goto error; -disable_irq (sr_info->irq); }if (pdata && pdata->enable_on_init)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 113/565 soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 78261cb08f06c93d362cab5c5034bf5899bc7552 ]
This loop is supposed to break if the frequency returned from clk_round_rate() is the same as on the previous iteration. However, that check doesn't make sense on the first iteration through the loop. It leads to reading before the start of these->clk_perf_tbl[] array.
--- drivers/soc/qcom/qcom-geni-se.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/soc/qcom/qcom-geni-se.c +2 -1
@@ -594,7 +594,8 @@ int geni_se_clk_tbl_get(struct geni_se *se, unsigned long **tbl)for (i =0 ; i <MAX_CLK_PERF_LEVEL ; i++) { freq =clk_round_rate (se->clk, freq +1 ); -if (freq <=0 || freq == se->clk_perf_tbl[i -1 ]) +if (freq <=0 || + (i >0 && freq == se->clk_perf_tbl[i -1 ]))break ; se->clk_perf_tbl[i] = freq; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 114/565 mmc: mmc_spi: drop buggy snprintf()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <[email protected]>
[ Upstream commit 328bda09cc91b3d93bc64f4a4dadc44313dd8140 ]
GCC 13 complains about the truncated output of snprintf():
drivers/mmc/host/mmc_spi.c: In function ‘mmc_spi_response_get’:drivers/mmc/host/mmc_spi.c:227:64: error: ‘snprintf’ output may be truncated before the last format character [-Werror=format-truncation=]
227 | snprintf(tag, sizeof(tag), " ... CMD%d response SPI_%s",
| ^drivers/mmc/host/mmc_spi.c:227:9: note: ‘snprintf’ output between 26 and 43 bytes into a destination of size 32
227 | snprintf(tag, sizeof(tag), " ... CMD%d response SPI_%s",
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
228 | cmd->opcode, maptype(cmd));Drop it and fold the string it generates into the only place where it's emitted - the dev_dbg() call at the end of the function.
--- drivers/mmc/host/mmc_spi.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-)
drivers/mmc/host/mmc_spi.c +3 -6
@@ -223,10 +223,6 @@ static int mmc_spi_response_get(struct mmc_spi_host *host,u8 leftover =0 ;unsigned short rotator;int i; -char tag[32 ]; - -snprintf (tag,sizeof (tag)," ... CMD%d response SPI_%s" , - cmd->opcode,maptype (cmd));/* Except for data block reads, the whole response will already * be stored in the scratch buffer. It's somewhere after the
@@ -379,8 +375,9 @@ static int mmc_spi_response_get(struct mmc_spi_host *host, }if (value <0 ) -dev_dbg (&host->spi->dev,"%s: resp %04x %08x\n" , - tag, cmd->resp[0 ], cmd->resp[1 ]); +dev_dbg (&host->spi->dev, +" ... CMD%d response SPI_%s: resp %04x %08x\n" , + cmd->opcode,maptype (cmd), cmd->resp[0 ], cmd->resp[1 ]);/* disable chipselect on errors and some success cases */ if (value >=0 && cs_on)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 115/565 tpm: fix signed/unsigned bug when checking event logs
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gregory Price <[email protected]>
[ Upstream commit e6d654e9f5a97742cfe794b1c4bb5d3fb2d25e98 ]
A prior bugfix that fixes a signed/unsigned error causes another signed unsigned error.
A situation where log_tbl->size is invalid can cause the size passed to memblock_reserve to become negative.
log_size from the main event log is an unsigned int, and the code reduces to the following
u64 value = (int)unsigned_value;
This results in sign extension, and the value sent to memblock_reserve becomes effectively negative.
--- drivers/firmware/efi/tpm.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-)
drivers/firmware/efi/tpm.c +9 -8
@@ -40,7 +40,8 @@ int __init efi_tpm_eventlog_init(void) {struct linux_efi_tpm_eventlog *log_tbl;struct efi_tcg2_final_events_table *final_tbl; -int tbl_size; +unsigned int tbl_size; +int final_tbl_size;int ret =0 ;if (efi.tpm_log ==EFI_INVALID_TABLE_ADDR ) {
@@ -80,26 +81,26 @@ int __init efi_tpm_eventlog_init(void) goto out; } - tbl_size =0 ; + final_tbl_size =0 ;if (final_tbl->nr_events !=0 ) {void *events = (void *)efi.tpm_final_log +sizeof (final_tbl->version) +sizeof (final_tbl->nr_events); - tbl_size =tpm2_calc_event_log_size (events, - final_tbl->nr_events, - log_tbl->log); + final_tbl_size =tpm2_calc_event_log_size (events, + final_tbl->nr_events, + log_tbl->log); } -if (tbl_size <0 ) { +if (final_tbl_size <0 ) {pr_err (FW_BUG "Failed to parse event in TPM Final Events Log\n" ); ret = -EINVAL ; goto out_calc; }memblock_reserve (efi.tpm_final_log, - tbl_size +sizeof (*final_tbl)); - efi_tpm_final_log_size = tbl_size; + final_tbl_size +sizeof (*final_tbl)); + efi_tpm_final_log_size = final_tbl_size; out_calc:early_memunmap (final_tbl,sizeof (*final_tbl));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 116/565 arm64: dts: mt8183: krane: Fix the address of eeprom at i2c4
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hsin-Te Yuan <[email protected]>
[ Upstream commit e9c60c34948662b5d47573490ee538439b29e462 ]
The address of eeprom should be 50.
--- arch/arm64/boot/dts/mediatek/mt8183-kukui-krane.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/mediatek/mt8183-kukui-krane.dtsi +2 -2
@@ -88,9 +88,9 @@ &i2c4 { clock-frequency = <400000>; vbus-supply = <&mt6358_vcn18_reg>; - eeprom@54 { + eeprom@50 { compatible = "atmel,24c32"; - reg = <0x54>; + reg = <0x50>; pagesize = <32>; vcc-supply = <&mt6358_vcn18_reg>; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 117/565 arm64: dts: mt8183: kukui: Fix the address of eeprom at i2c4
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hsin-Te Yuan <[email protected]>
[ Upstream commit edbde4923f208aa83abb48d4b2463299e5fc2586 ]
The address of eeprom should be 50.
--- arch/arm64/boot/dts/mediatek/mt8183-kukui-kakadu.dtsi | 4 ++-- arch/arm64/boot/dts/mediatek/mt8183-kukui-kodama.dtsi | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-)
arch/arm64/boot/dts/mediatek/mt8183-kukui-kakadu.dtsi +2 -2
@@ -105,9 +105,9 @@ &i2c4 { clock-frequency = <400000>; vbus-supply = <&mt6358_vcn18_reg>; - eeprom@54 { + eeprom@50 { compatible = "atmel,24c32"; - reg = <0x54>; + reg = <0x50>; pagesize = <32>; vcc-supply = <&mt6358_vcn18_reg>; };
arch/arm64/boot/dts/mediatek/mt8183-kukui-kodama.dtsi +2 -2
@@ -79,9 +79,9 @@ &i2c4 { clock-frequency = <400000>; vbus-supply = <&mt6358_vcn18_reg>; - eeprom@54 { + eeprom@50 { compatible = "atmel,24c64"; - reg = <0x54>; + reg = <0x50>; pagesize = <32>; vcc-supply = <&mt6358_vcn18_reg>; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 118/565 arm64: dts: mediatek: mt8173-elm-hana: Add vdd-supply to second source trackpad
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <[email protected]>
[ Upstream commit f766fae08f6a2eaeb45d8d2c053724c91526835c ]
The Hana device has a second source option trackpad, but it is missing its regulator supply. It only works because the regulator is marked as always-on.
Add the regulator supply, but leave out the post-power-on delay. Instead, document the post-power-on delay along with the reason for not adding it in a comment.
--- arch/arm64/boot/dts/mediatek/mt8173-elm-hana.dtsi | 8 ++++++++ 1 file changed, 8 insertions(+)
arch/arm64/boot/dts/mediatek/mt8173-elm-hana.dtsi +8 -0
@@ -43,6 +43,14 @@ trackpad2: trackpad@2c { interrupts = <117 IRQ_TYPE_LEVEL_LOW>; reg = <0x2c>; hid-descr-addr = <0x0020>; + /* + * The trackpad needs a post-power-on delay of 100ms, + * but at time of writing, the power supply for it on + * this board is always on. The delay is therefore not + * added to avoid impacting the readiness of the + * trackpad. + */ + vdd-supply = <&mt6397_vgp6_reg>; wakeup-source; }; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 119/565 Revert "cgroup: Fix memory leak caused by missing cgroup_bpf_offline"
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ridong <[email protected]>
[ Upstream commit feb301c60970bd2a1310a53ce2d6e4375397a51b ]
This reverts commit 04f8ef5643bcd8bcde25dfdebef998aea480b2ba.
Only cgroup v2 can be attached by cgroup by BPF programs. Revert this commit and cgroup_bpf_inherit and cgroup_bpf_offline won't be called in cgroup v1. The memory leak issue will be fixed with next patch.
--- kernel/cgroup/cgroup.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
kernel/cgroup/cgroup.c +1 -3
@@ -2228,10 +2228,8 @@ static void cgroup_kill_sb(struct super_block *sb)* And don't kill the default root. */ if (list_empty (&root->cgrp.self.children) && root != &cgrp_dfl_root && - !percpu_ref_is_dying (&root->cgrp.self.refcnt)) { -cgroup_bpf_offline (&root->cgrp); + !percpu_ref_is_dying (&root->cgrp.self.refcnt))percpu_ref_kill (&root->cgrp.self.refcnt); - }cgroup_put (&root->cgrp);kernfs_kill_sb (sb); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 120/565 cgroup/bpf: only cgroup v2 can be attached by bpf programs
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ridong <[email protected]>
[ Upstream commit 2190df6c91373fdec6db9fc07e427084f232f57e ]
Only cgroup v2 can be attached by bpf programs, so this patch introduces that cgroup_bpf_inherit and cgroup_bpf_offline can only be called in cgroup v2, and this can fix the memleak mentioned by commit 04f8ef5643bc ("cgroup: Fix memory leak caused by missing cgroup_bpf_offline"), which has been reverted.
--- kernel/cgroup/cgroup.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-)
kernel/cgroup/cgroup.c +11 -6
@@ -2058,8 +2058,10 @@ int cgroup_setup_root(struct cgroup_root *root, u16 ss_mask)if (ret) goto exit_stats; - ret =cgroup_bpf_inherit (root_cgrp); -WARN_ON_ONCE (ret); +if (root == &cgrp_dfl_root) { + ret =cgroup_bpf_inherit (root_cgrp); +WARN_ON_ONCE (ret); + }trace_cgroup_setup_root (root);
@@ -5446,9 +5448,11 @@ static struct cgroup *cgroup_create(struct cgroup *parent, const char *name,if (ret) goto out_kernfs_remove; - ret =cgroup_bpf_inherit (cgrp); -if (ret) - goto out_psi_free; +if (cgrp->root == &cgrp_dfl_root) { + ret =cgroup_bpf_inherit (cgrp); +if (ret) + goto out_psi_free; + }/* * New cgroup inherits effective freeze counter, and
@@ -5766,7 +5770,8 @@ static int cgroup_destroy_locked(struct cgroup *cgrp)cgroup1_check_for_release (parent); -cgroup_bpf_offline (cgrp); +if (cgrp->root == &cgrp_dfl_root) +cgroup_bpf_offline (cgrp);/* put the base reference */ percpu_ref_kill (&cgrp->self.refcnt);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 121/565 arm64: dts: mt8183: fennel: add i2c2s i2c-scl-internal-delay-ns
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daolong Zhu <[email protected]>
[ Upstream commit c802db127dfb9602aaa9338e433c0553d34f1a9c ]
Add i2c2's i2c-scl-internal-delay-ns.
Reviewed-by:
--- arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-fennel.dtsi | 3 +++ 1 file changed, 3 insertions(+)
arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-fennel.dtsi +3 -0
@@ -25,3 +25,6 @@ trackpad@2c { }; }; +&i2c2 { + i2c-scl-internal-delay-ns = <21500>; +};
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 122/565 arm64: dts: mt8183: burnet: add i2c2s i2c-scl-internal-delay-ns
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daolong Zhu <[email protected]>
[ Upstream commit 85af64983889c621e8868b744c8ca03bd5038c02 ]
Add i2c2's i2c-scl-internal-delay-ns.
--- arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-burnet.dts | 3 +++ 1 file changed, 3 insertions(+)
arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-burnet.dts +3 -0
@@ -28,3 +28,6 @@ touchscreen@2c { }; }; +&i2c2 { + i2c-scl-internal-delay-ns = <4100>; +};
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 123/565 arm64: dts: mt8183: Damu: add i2c2s i2c-scl-internal-delay-ns
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daolong Zhu <[email protected]>
[ Upstream commit 6ff2d45f2121c698a57c959ae21885a048615908 ]
Add i2c2's i2c-scl-internal-delay-ns.
--- arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-damu.dts | 3 +++ 1 file changed, 3 insertions(+)
arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-damu.dts +3 -0
@@ -29,3 +29,6 @@ &qca_wifi { qcom,ath10k-calibration-variant = "GO_DAMU"; }; +&i2c2 { + i2c-scl-internal-delay-ns = <20000>; +};
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 124/565 pwm: imx27: Workaround of the pwm output bug when decrease the duty cycle
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Clark Wang <[email protected]>
[ Upstream commit a25351e4c7740eb22561a3ee4ef17611c6f410b0 ]
Implement workaround for ERR051198
(https://www.nxp.com/docs/en/errata/IMX8MN_0N14Y.pdf)
PWM output may not function correctly if the FIFO is empty when a new SAR value is programmed.
Description:
When the PWM FIFO is empty, a new value programmed to the PWM Sample register (PWM_PWMSAR) will be directly applied even if the current timer period has not expired. If the new SAMPLE value programmed in the PWM_PWMSAR register is less than the previous value, and the PWM counter register (PWM_PWMCNR) that contains the current COUNT value is greater than the new programmed SAMPLE value, the current period will not flip the level. This may result in an output pulse with a duty cycle of 100%.
Workaround:
Program the current SAMPLE value in the PWM_PWMSAR register before updating the new duty cycle to the SAMPLE value in the PWM_PWMSAR register. This will ensure that the new SAMPLE value is modified during a non-empty FIFO, and can be successfully updated after the period expires.
Write the old SAR value before updating the new duty cycle to SAR. This avoids writing the new value into an empty FIFO.
This only resolves the issue when the PWM period is longer than 2us (or <500kHz) because write register is not quick enough when PWM period is very short.
Reproduce steps:
cd /sys/class/pwm/pwmchip1/pwm0
echo 2000000000 > period # It is easy to observe by using long period
echo 1000000000 > duty_cycle
echo 1 > enable
echo 8000 > duty_cycle # One full high pulse will be seen by scope
--- drivers/pwm/pwm-imx27.c | 98 ++++++++++++++++++++++++++++++++++++++++- 1 file changed, 96 insertions(+), 2 deletions(-)
drivers/pwm/pwm-imx27.c +96 -2
@@ -26,6 +26,7 @@#define MX3_PWMSR 0x04/* PWM Status Register */ #define MX3_PWMSAR 0x0C/* PWM Sample Register */ #define MX3_PWMPR 0x10/* PWM Period Register */ +#define MX3_PWMCNR 0x14/* PWM Counter Register */ #define MX3_PWMCR_FWM GENMASK(27, 26)#define MX3_PWMCR_STOPEN BIT(25)
@@ -215,11 +216,13 @@ static void pwm_imx27_wait_fifo_slot(struct pwm_chip *chip,static int pwm_imx27_apply (struct pwm_chip *chip,struct pwm_device *pwm,const struct pwm_state *state) { -unsigned long period_cycles, duty_cycles, prescale; +unsigned long period_cycles, duty_cycles, prescale, period_us, tmp;struct pwm_imx27_chip *imx =to_pwm_imx27_chip (chip);struct pwm_state cstate;unsigned long long c;unsigned long long clkrate; +unsigned long flags; +int val;int ret;u32 cr;
@@ -262,7 +265,98 @@ static int pwm_imx27_apply(struct pwm_chip *chip, struct pwm_device *pwm,pwm_imx27_sw_reset (chip); } -writel (duty_cycles, imx->mmio_base +MX3_PWMSAR ); + val =readl (imx->mmio_base +MX3_PWMPR ); + val = val >=MX3_PWMPR_MAX ?MX3_PWMPR_MAX : val; + cr =readl (imx->mmio_base +MX3_PWMCR ); + tmp =NSEC_PER_SEC * (u64)(val +2 ) *MX3_PWMCR_PRESCALER_GET (cr); + tmp =DIV_ROUND_UP_ULL (tmp, clkrate); + period_us =DIV_ROUND_UP_ULL (tmp,1000 ); + +/* +* ERR051198: +* PWM: PWM output may not function correctly if the FIFO is empty when +* a new SAR value is programmed +* +* Description: +* When the PWM FIFO is empty, a new value programmed to the PWM Sample +* register (PWM_PWMSAR) will be directly applied even if the current +* timer period has not expired. +* +* If the new SAMPLE value programmed in the PWM_PWMSAR register is +* less than the previous value, and the PWM counter register +* (PWM_PWMCNR) that contains the current COUNT value is greater than +* the new programmed SAMPLE value, the current period will not flip +* the level. This may result in an output pulse with a duty cycle of +* 100%. +* +* Consider a change from +* ________ +* / \______/ +* ^ * ^ +* to +* ____ +* / \__________/ +* ^ ^ +* At the time marked by *, the new write value will be directly applied +* to SAR even the current period is not over if FIFO is empty. +* +* ________ ____________________ +* / \______/ \__________/ +* ^ ^ * ^ ^ +* |<-- old SAR -->| |<-- new SAR -->| +* +* That is the output is active for a whole period. +* +* Workaround: +* Check new SAR less than old SAR and current counter is in errata +* windows, write extra old SAR into FIFO and new SAR will effect at +* next period. +* +* Sometime period is quite long, such as over 1 second. If add old SAR +* into FIFO unconditional, new SAR have to wait for next period. It +* may be too long. +* +* Turn off the interrupt to ensure that not IRQ and schedule happen +* during above operations. If any irq and schedule happen, counter +* in PWM will be out of data and take wrong action. +* +* Add a safety margin 1.5us because it needs some time to complete +* IO write. +* +* Use writel_relaxed() to minimize the interval between two writes to +* the SAR register to increase the fastest PWM frequency supported. +* +* When the PWM period is longer than 2us(or <500kHz), this workaround +* can solve this problem. No software workaround is available if PWM +* period is shorter than IO write. Just try best to fill old data +* into FIFO. +*/ + c = clkrate *1500 ; +do_div (c,NSEC_PER_SEC ); + +local_irq_save (flags); + val =FIELD_GET (MX3_PWMSR_FIFOAV ,readl_relaxed (imx->mmio_base +MX3_PWMSR )); + +if (duty_cycles < imx->duty_cycle && (cr &MX3_PWMCR_EN )) { +if (period_us <2 ) {/* 2us = 500 kHz */ +/* Best effort attempt to fix up >500 kHz case */ +udelay (3 * period_us); +writel_relaxed (imx->duty_cycle, imx->mmio_base +MX3_PWMSAR ); +writel_relaxed (imx->duty_cycle, imx->mmio_base +MX3_PWMSAR ); + }else if (val <MX3_PWMSR_FIFOAV_2WORDS ) { + val =readl_relaxed (imx->mmio_base +MX3_PWMCNR ); +/* +* If counter is close to period, controller may roll over when +* next IO write. +*/ +if ((val + c >= duty_cycles && val < imx->duty_cycle) || + val + c >= period_cycles) +writel_relaxed (imx->duty_cycle, imx->mmio_base +MX3_PWMSAR ); + } + } +writel_relaxed (duty_cycles, imx->mmio_base +MX3_PWMSAR ); +local_irq_restore (flags); +writel (period_cycles, imx->mmio_base +MX3_PWMPR );/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 125/565 ARM: dts: cubieboard4: Fix DCDC5 regulator constraints
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andre Przywara <[email protected]>
[ Upstream commit dd36ad71ad65968f97630808bc8d605c929b128e ]
The DCDC5 voltage rail in the X-Powers AXP809 PMIC has a resolution of 50mV, so the currently enforced limits of 1.475 and 1.525 volts cannot be set, when the existing regulator value is beyond this range.
This will lead to the whole regulator driver to give up and fail probing, which in turn will hang the system, as essential devices depend on the PMIC.
In this case a bug in U-Boot set the voltage to 1.75V (meant for DCDC4), and the AXP driver's attempt to correct this lead to this error:
==================
[ 4.447653] axp20x-rsb sunxi-rsb-3a3: AXP20X driver loaded [ 4.450066] vcc-dram: Bringing 1750000uV into 1575000-1575000uV [ 4.460272] vcc-dram: failed to apply 1575000-1575000uV constraint: -EINVAL [ 4.474788] axp20x-regulator axp20x-regulator.0: Failed to register dcdc5 [ 4.482276] axp20x-regulator axp20x-regulator.0: probe with driver axp20x-regulator failed with error -22
==================
Set the limits to values that can be programmed, so any correction will be successful.
--- arch/arm/boot/dts/sun9i-a80-cubieboard4.dts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/boot/dts/sun9i-a80-cubieboard4.dts +2 -2
@@ -280,8 +280,8 @@ reg_dcdc4: dcdc4 { reg_dcdc5: dcdc5 { regulator-always-on; - regulator-min-microvolt = <1425000>; - regulator-max-microvolt = <1575000>; + regulator-min-microvolt = <1450000>; + regulator-max-microvolt = <1550000>; regulator-name = "vcc-dram"; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 126/565 pmdomain: ti-sci: Add missing of_node_put() for args.np
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Zekun <[email protected]>
[ Upstream commit afc2331ef81657493c074592c409dac7c3cb8ccc ]
of_parse_phandle_with_args() needs to call of_node_put() to decrement the refcount of args.np. So, Add the missing of_node_put() in the loop.
Message-ID: <[email protected]>
--- drivers/soc/ti/ti_sci_pm_domains.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/soc/ti/ti_sci_pm_domains.c +4 -0
@@ -165,6 +165,7 @@ static int ti_sci_pm_domain_probe(struct platform_device *pdev)break ;if (args.args_count >=1 && args.np == dev->of_node) { +of_node_put (args.np);if (args.args[0 ] > max_id) { max_id = args.args[0 ]; }else {
@@ -192,7 +193,10 @@ static int ti_sci_pm_domain_probe(struct platform_device *pdev)pm_genpd_init (&pd->pd,NULL , true);list_add (&pd->node, &pd_provider->pd_list); + }else { +of_node_put (args.np); } + index++; } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 127/565 spi: tegra210-quad: Avoid shift-out-of-bounds
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <[email protected]>
[ Upstream commit f399051ec1ff02e74ae5c2517aed2cc486fd005b ]
A shift-out-of-bounds issue was identified by UBSAN in the tegra_qspi_fill_tx_fifo_from_client_txbuf() function.
UBSAN: shift-out-of-bounds in drivers/spi/spi-tegra210-quad.c:345:27 shift exponent 32 is too large for 32-bit type 'u32' (aka 'unsigned int') Call trace: tegra_qspi_start_cpu_based_transfer
The problem arises when shifting the contents of tx_buf left by 8 times the value of i, which can exceed 4 and result in an exponent larger than 32 bits.
Resolve this by restrict the value of i to be less than 4, preventing the shift operation from overflowing.
--- drivers/spi/spi-tegra210-quad.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-tegra210-quad.c +1 -1
@@ -298,7 +298,7 @@ tegra_qspi_fill_tx_fifo_from_client_txbuf(struct tegra_qspi *tqspi, struct spi_tfor (count =0 ; count < max_n_32bit; count++) {u32 x =0 ; -for (i =0 ; len && (i < bytes_per_word); i++, len--) +for (i =0 ; len && (i <min (4 , bytes_per_word)); i++, len--) x |= (u32)(*tx_buf++) << (i *8 );tegra_qspi_writel (tqspi, x,QSPI_TX_FIFO ); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 128/565 spi: zynqmp-gqspi: Undo runtime PM changes at driver exit time
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit 2219576883e709737f3100aa9ded84976be49bd7 ]
It's important to undo pm_runtime_use_autosuspend() with pm_runtime_dont_use_autosuspend() at driver exit time.
So, call pm_runtime_dont_use_autosuspend() at driver exit time to fix it.
--- drivers/spi/spi-zynqmp-gqspi.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/spi/spi-zynqmp-gqspi.c +2 -0
@@ -1200,6 +1200,7 @@ static int zynqmp_qspi_probe(struct platform_device *pdev) clk_dis_all:pm_runtime_disable (&pdev->dev); +pm_runtime_dont_use_autosuspend (&pdev->dev);pm_runtime_put_noidle (&pdev->dev);pm_runtime_set_suspended (&pdev->dev);clk_disable_unprepare (xqspi->refclk);
@@ -1230,6 +1231,7 @@ static void zynqmp_qspi_remove(struct platform_device *pdev)zynqmp_gqspi_write (xqspi,GQSPI_EN_OFST ,0x0 );pm_runtime_disable (&pdev->dev); +pm_runtime_dont_use_autosuspend (&pdev->dev);pm_runtime_put_noidle (&pdev->dev);pm_runtime_set_suspended (&pdev->dev);clk_disable_unprepare (xqspi->refclk);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 129/565 regmap: irq: Set lockdep class for hierarchical IRQ domains
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 953e549471cabc9d4980f1da2e9fa79f4c23da06 ]
Lockdep gives a false positive splat as it can't distinguish the lock which is taken by different IRQ descriptors from different IRQ chips that are organized in a way of a hierarchy:
======================================================
WARNING: possible circular locking dependency detected
6.12.0-rc5-next-20241101-00148-g9fabf8160b53 #562 Tainted: G W
------------------------------------------------------
modprobe/141 is trying to acquire lock:
ffff899446947868 (intel_soc_pmic_bxtwc:502:(&bxtwc_regmap_config)->lock){+.+.}-{4:4}, at: regmap_update_bits_base+0x33/0x90
but task is already holding lock:
ffff899446947c68 (&d->lock){+.+.}-{4:4}, at: __setup_irq+0x682/0x790
which lock already depends on the new lock.
-> #3 (&d->lock){+.+.}-{4:4}:
-> #2 (&desc->request_mutex){+.+.}-{4:4}:
-> #1 (ipclock){+.+.}-{4:4}:
-> #0 (intel_soc_pmic_bxtwc:502:(&bxtwc_regmap_config)->lock){+.+.}-{4:4}:
Chain exists of:
intel_soc_pmic_bxtwc:502:(&bxtwc_regmap_config)->lock --> &desc->request_mutex --> &d->lock
Possible unsafe locking scenario: CPU0 CPU1
---- ----
lock(&d->lock);
lock(&desc->request_mutex);
lock(&d->lock);
lock(intel_soc_pmic_bxtwc:502:(&bxtwc_regmap_config)->lock);
*** DEADLOCK ***3 locks held by modprobe/141:
#0: ffff8994419368f8 (&dev->mutex){....}-{4:4}, at: __driver_attach+0xf6/0x250
#1: ffff89944690b250 (&desc->request_mutex){+.+.}-{4:4}, at: __setup_irq+0x1a2/0x790
#2: ffff899446947c68 (&d->lock){+.+.}-{4:4}, at: __setup_irq+0x682/0x790Set a lockdep class when we map the IRQ so that it doesn't warn about a lockdep bug that doesn't exist.
--- drivers/base/regmap/regmap-irq.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/base/regmap/regmap-irq.c +4 -0
@@ -587,12 +587,16 @@ static irqreturn_t regmap_irq_thread(int irq, void *d)return IRQ_NONE ; } +static struct lock_class_key regmap_irq_lock_class; +static struct lock_class_key regmap_irq_request_class; +static int regmap_irq_map (struct irq_domain *h,unsigned int virq,irq_hw_number_t hw) {struct regmap_irq_chip_data *data = h->host_data;irq_set_chip_data (virq, data); +irq_set_lockdep_class (virq, ®map_irq_lock_class, ®map_irq_request_class);irq_set_chip (virq, &data->irq_chip);irq_set_nested_thread (virq,1 );irq_set_parent (virq, data->irq);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 130/565 arm64: dts: mt8183: jacuzzi: remove unused ddc-i2c-bus
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hsin-Yi Wang <[email protected]>
[ Upstream commit 2706707b225d29aae6f79a21eff277b53b7b05e9 ]
EDID is read from bridge, so the ddc-i2c-bus is unused.
Stable-dep-of: c4e8cf13f174 ("arm64: dts: mediatek: mt8183-kukui-jacuzzi: Fix DP bridge supply names")
--- arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi | 1 - 1 file changed, 1 deletion(-)
arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi +0 -1
@@ -11,7 +11,6 @@ / { panel: panel { compatible = "auo,b116xw03"; power-supply = <&pp3300_panel>; - ddc-i2c-bus = <&i2c4>; backlight = <&backlight_lcd0>; port {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 131/565 arm64: dts: mt8183: jacuzzi: Move panel under aux-bus
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hsin-Yi Wang <[email protected]>
[ Upstream commit 474c162878ba3dbd620538d129f576f2bca7b9e1 ]
Read edp panel edid through aux bus, which is a more preferred way. Also use a more generic compatible since each jacuzzi models use different panels.
Stable-dep-of: c4e8cf13f174 ("arm64: dts: mediatek: mt8183-kukui-jacuzzi: Fix DP bridge supply names")
--- .../dts/mediatek/mt8183-kukui-jacuzzi.dtsi | 26 ++++++++++--------- 1 file changed, 14 insertions(+), 12 deletions(-)
arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi +14 -12
@@ -8,18 +8,6 @@ #include <arm/cros-ec-keyboard.dtsi> / { - panel: panel { - compatible = "auo,b116xw03"; - power-supply = <&pp3300_panel>; - backlight = <&backlight_lcd0>; - - port { - panel_in: endpoint { - remote-endpoint = <&anx7625_out>; - }; - }; - }; - pp1200_mipibrdg: pp1200-mipibrdg { compatible = "regulator-fixed"; regulator-name = "pp1200_mipibrdg";
@@ -188,6 +176,20 @@ anx7625_out: endpoint { }; }; }; + + aux-bus { + panel: panel { + compatible = "edp-panel"; + power-supply = <&pp3300_panel>; + backlight = <&backlight_lcd0>; + + port { + panel_in: endpoint { + remote-endpoint = <&anx7625_out>; + }; + }; + }; + }; }; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 132/565 arm64: dts: mediatek: mt8183-kukui-jacuzzi: Fix DP bridge supply names
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <[email protected]>
[ Upstream commit c4e8cf13f1740037483565d5b802764e2426515b ]
Some of the regulator supplies for the MIPI-DPI-to-DP bridge and their associated nodes are incorrectly named. In particular, the 1.0V supply was modeled as a 1.2V supply.
Fix all the incorrect names, and also fix the voltage of the 1.0V regulator.
--- .../dts/mediatek/mt8183-kukui-jacuzzi.dtsi | 26 ++++++++++--------- 1 file changed, 14 insertions(+), 12 deletions(-)
arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi +14 -12
@@ -8,11 +8,13 @@ #include <arm/cros-ec-keyboard.dtsi> / { - pp1200_mipibrdg: pp1200-mipibrdg { + pp1000_mipibrdg: pp1000-mipibrdg { compatible = "regulator-fixed"; - regulator-name = "pp1200_mipibrdg"; + regulator-name = "pp1000_mipibrdg"; + regulator-min-microvolt = <1000000>; + regulator-max-microvolt = <1000000>; pinctrl-names = "default"; - pinctrl-0 = <&pp1200_mipibrdg_en>; + pinctrl-0 = <&pp1000_mipibrdg_en>; enable-active-high; regulator-boot-on;
@@ -24,7 +26,7 @@ pp1800_mipibrdg: pp1800-mipibrdg { compatible = "regulator-fixed"; regulator-name = "pp1800_mipibrdg"; pinctrl-names = "default"; - pinctrl-0 = <&pp1800_lcd_en>; + pinctrl-0 = <&pp1800_mipibrdg_en>; enable-active-high; regulator-boot-on;
@@ -46,11 +48,11 @@ pp3300_panel: pp3300-panel { gpio = <&pio 35 GPIO_ACTIVE_HIGH>; }; - vddio_mipibrdg: vddio-mipibrdg { + pp3300_mipibrdg: pp3300-mipibrdg { compatible = "regulator-fixed"; - regulator-name = "vddio_mipibrdg"; + regulator-name = "pp3300_mipibrdg"; pinctrl-names = "default"; - pinctrl-0 = <&vddio_mipibrdg_en>; + pinctrl-0 = <&pp3300_mipibrdg_en>; enable-active-high; regulator-boot-on;
@@ -152,9 +154,9 @@ anx_bridge: anx7625@58 { panel_flags = <1>; enable-gpios = <&pio 45 GPIO_ACTIVE_HIGH>; reset-gpios = <&pio 73 GPIO_ACTIVE_HIGH>; - vdd10-supply = <&pp1200_mipibrdg>; + vdd10-supply = <&pp1000_mipibrdg>; vdd18-supply = <&pp1800_mipibrdg>; - vdd33-supply = <&vddio_mipibrdg>; + vdd33-supply = <&pp3300_mipibrdg>; ports { #address-cells = <1>;
@@ -397,14 +399,14 @@ &pio { "", ""; - pp1200_mipibrdg_en: pp1200-mipibrdg-en { + pp1000_mipibrdg_en: pp1000-mipibrdg-en { pins1 { pinmux = <PINMUX_GPIO54__FUNC_GPIO54>; output-low; }; }; - pp1800_lcd_en: pp1800-lcd-en { + pp1800_mipibrdg_en: pp1800-mipibrdg-en { pins1 { pinmux = <PINMUX_GPIO36__FUNC_GPIO36>; output-low;
@@ -466,7 +468,7 @@ trackpad-int { }; }; - vddio_mipibrdg_en: vddio-mipibrdg-en { + pp3300_mipibrdg_en: pp3300-mipibrdg-en { pins1 { pinmux = <PINMUX_GPIO37__FUNC_GPIO37>; output-low;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 133/565 arm64: dts: mediatek: mt8183-kukui-jacuzzi: Add supplies for fixed regulators
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <[email protected]>
[ Upstream commit aaecb1da58a72bfbd2c35d4aadc43caa02f11862 ]
When the fixed regulators for the LCD panel and DP bridge were added, their supplies were not modeled in. These, except for the 1.0V supply, are just load switches, and need and have a supply.
Add the supplies for each of the fixed regulators.
--- arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi | 4 ++++ 1 file changed, 4 insertions(+)
arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi +4 -0
@@ -20,6 +20,7 @@ pp1000_mipibrdg: pp1000-mipibrdg { regulator-boot-on; gpio = <&pio 54 GPIO_ACTIVE_HIGH>; + vin-supply = <&pp1800_alw>; }; pp1800_mipibrdg: pp1800-mipibrdg {
@@ -32,6 +33,7 @@ pp1800_mipibrdg: pp1800-mipibrdg { regulator-boot-on; gpio = <&pio 36 GPIO_ACTIVE_HIGH>; + vin-supply = <&pp1800_alw>; }; pp3300_panel: pp3300-panel {
@@ -46,6 +48,7 @@ pp3300_panel: pp3300-panel { regulator-boot-on; gpio = <&pio 35 GPIO_ACTIVE_HIGH>; + vin-supply = <&pp3300_alw>; }; pp3300_mipibrdg: pp3300-mipibrdg {
@@ -58,6 +61,7 @@ pp3300_mipibrdg: pp3300-mipibrdg { regulator-boot-on; gpio = <&pio 37 GPIO_ACTIVE_HIGH>; + vin-supply = <&pp3300_alw>; }; volume_buttons: volume-buttons {
Signature · 1 line
2.43.0