Linux 6.19.3
Greg Kroah-Hartman
maintainerI'm announcing the release of the 6.19.3 kernel.
All users of the 6.19 kernel series must upgrade.
The updated 6.19.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.19.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 arch/arm64/boot/dts/mediatek/mt8183.dtsi | 37 ++++++++++-- arch/loongarch/mm/kasan_init.c | 78 +++++++++++++------------ drivers/iommu/arm/arm-smmu/arm-smmu-impl.c | 14 ++++ drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c | 14 +++- drivers/iommu/arm/arm-smmu/arm-smmu.c | 24 +++++++ drivers/iommu/arm/arm-smmu/arm-smmu.h | 5 + drivers/scsi/qla2xxx/qla_bsg.c | 28 +++++---- drivers/usb/serial/option.c | 6 + drivers/video/fbdev/riva/riva_hw.c | 3 drivers/video/fbdev/smscufx.c | 8 +- fs/f2fs/data.c | 53 ++++++++++++----- fs/f2fs/f2fs.h | 69 ++++++++++++++++------ fs/f2fs/gc.c | 24 ++++--- fs/f2fs/node.c | 50 ++++++++++------ fs/f2fs/node.h | 8 -- fs/f2fs/recovery.c | 6 - fs/f2fs/segment.c | 88 +++++++++++++++-------------- fs/f2fs/segment.h | 9 +- fs/f2fs/super.c | 64 ++++++--------------- fs/f2fs/sysfs.c | 62 +++++++++++++++++--- include/linux/f2fs_fs.h | 73 ++++++++++++++---------- 22 files changed, 460 insertions(+), 265 deletions(-)
Anil Gurumurthy (1):
scsi: qla2xxx: Fix bsg_done() causing double free
Chao Yu (6):
f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly
f2fs: fix to avoid UAF in f2fs_write_end_io()
f2fs: fix to avoid mapping wrong physical block for swapfile Revert "f2fs: block cache/dio write during f2fs_enable_checkpoint()"
f2fs: fix to do sanity check on node footer in __write_node_folio()
f2fs: fix to do sanity check on node footer in {read,write}_end_io
Daeho Jeong (2):
f2fs: support non-4KB block size without packed_ssa feature
f2fs: fix incomplete block usage in compact SSA summaries
Danilo Krummrich (1):
iommu/arm-smmu-qcom: do not register driver in probe()
Fabio Porcedda (1):
USB: serial: option: add Telit FN920C04 RNDIS compositions
Greg Kroah-Hartman (2):
fbdev: smscufx: properly copy ioctl memory to kernelspace Linux 6.19.3
Guangshuo Li (1):
fbdev: rivafb: fix divide error in nv3_arb()
Otto Pflüger (1):
arm64: dts: mediatek: mt8183: Add missing endpoint IDs to display graph
Tiezhu Yang (1):
LoongArch: Rework KASAN initialization for PTW-enabled systems
Yeongjin Gil (1):
f2fs: optimize f2fs_overwrite_io() for f2fs_iomap_begin
Yongpeng Yang (2):
f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes
f2fs: fix out-of-bounds access in sysfs attribute read/write
Zhiguo Niu (1):
f2fs: fix to add gc count stat in f2fs_gc_range
Greg Kroah-Hartman
maintainerMakefile +1 -1
@@ -1,7 +1,7 @@ # SPDX-License-Identifier: GPL-2.0 VERSION = 6 PATCHLEVEL = 19 -SUBLEVEL = 2 +SUBLEVEL = 3 EXTRAVERSION = NAME = Baby Opossum Posse
arch/arm64/boot/dts/mediatek/mt8183.dtsi +31 -6
@@ -1812,15 +1812,23 @@ ports { #size-cells = <0>; port@0 { + #address-cells = <1>; + #size-cells = <0>; reg = <0>; - ovl_2l1_in: endpoint { + + ovl_2l1_in: endpoint@1 { + reg = <1>; remote-endpoint = <&mmsys_ep_ext>; }; }; port@1 { + #address-cells = <1>; + #size-cells = <0>; reg = <1>; - ovl_2l1_out: endpoint { + + ovl_2l1_out: endpoint@1 { + reg = <1>; remote-endpoint = <&rdma1_in>; }; };
@@ -1872,15 +1880,23 @@ ports { #size-cells = <0>; port@0 { + #address-cells = <1>; + #size-cells = <0>; reg = <0>; - rdma1_in: endpoint { + + rdma1_in: endpoint@1 { + reg = <1>; remote-endpoint = <&ovl_2l1_out>; }; }; port@1 { + #address-cells = <1>; + #size-cells = <0>; reg = <1>; - rdma1_out: endpoint { + + rdma1_out: endpoint@1 { + reg = <1>; remote-endpoint = <&dpi_in>; }; };
@@ -2076,15 +2092,24 @@ ports { #size-cells = <0>; port@0 { + #address-cells = <1>; + #size-cells = <0>; reg = <0>; - dpi_in: endpoint { + + dpi_in: endpoint@1 { + reg = <1>; remote-endpoint = <&rdma1_out>; }; }; port@1 { + #address-cells = <1>; + #size-cells = <0>; reg = <1>; - dpi_out: endpoint { }; + + dpi_out: endpoint@1 { + reg = <1>; + }; }; }; };
arch/loongarch/mm/kasan_init.c +40 -38
107 lines not on this page · raw message
drivers/iommu/arm/arm-smmu/arm-smmu-impl.c +14 -0
@@ -228,3 +228,17 @@ struct arm_smmu_device *arm_smmu_impl_init(struct arm_smmu_device *smmu)return smmu; } + +int __init arm_smmu_impl_module_init (void ) +{ +if (IS_ENABLED (CONFIG_ARM_SMMU_QCOM )) +return qcom_smmu_module_init (); + +return 0 ; +} + +void __exit arm_smmu_impl_module_exit(void) +{ +if (IS_ENABLED (CONFIG_ARM_SMMU_QCOM )) +qcom_smmu_module_exit (); +}
drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c +10 -4
@@ -774,10 +774,6 @@ struct arm_smmu_device *qcom_smmu_impl_init(struct arm_smmu_device *smmu) {const struct device_node *np = smmu->dev->of_node;const struct of_device_id *match; -static u8 tbu_registered; - -if (!tbu_registered++) -platform_driver_register (&qcom_smmu_tbu_driver);#ifdef CONFIG_ACPI if (np ==NULL ) {
@@ -802,3 +798,13 @@ struct arm_smmu_device *qcom_smmu_impl_init(struct arm_smmu_device *smmu)return smmu; } + +int __init qcom_smmu_module_init (void ) +{ +return platform_driver_register (&qcom_smmu_tbu_driver); +} + +void __exit qcom_smmu_module_exit(void) +{ +platform_driver_unregister (&qcom_smmu_tbu_driver); +}
drivers/iommu/arm/arm-smmu/arm-smmu.c +23 -1
@@ -2365,7 +2365,29 @@ static struct platform_driver arm_smmu_driver = { .remove = arm_smmu_device_remove, .shutdown = arm_smmu_device_shutdown, }; -module_platform_driver (arm_smmu_driver); + +static int __init arm_smmu_init (void ) +{ +int ret; + + ret =platform_driver_register (&arm_smmu_driver); +if (ret) +return ret; + + ret =arm_smmu_impl_module_init (); +if (ret) +platform_driver_unregister (&arm_smmu_driver); + +return ret; +} +module_init (arm_smmu_init); + +static void __exit arm_smmu_exit(void) +{ +arm_smmu_impl_module_exit (); +platform_driver_unregister (&arm_smmu_driver); +} +module_exit (arm_smmu_exit);MODULE_DESCRIPTION ("IOMMU API for ARM architected SMMU implementations" );MODULE_AUTHOR ("Will Deacon <[email protected]>" );
drivers/iommu/arm/arm-smmu/arm-smmu.h +5 -0
@@ -540,6 +540,11 @@ struct arm_smmu_device *arm_smmu_impl_init(struct arm_smmu_device *smmu);struct arm_smmu_device *nvidia_smmu_impl_init (struct arm_smmu_device *smmu);struct arm_smmu_device *qcom_smmu_impl_init (struct arm_smmu_device *smmu); +int __init arm_smmu_impl_module_init (void ); +void __exit arm_smmu_impl_module_exit(void); +int __init qcom_smmu_module_init (void ); +void __exit qcom_smmu_module_exit(void); +void arm_smmu_write_context_bank (struct arm_smmu_device *smmu,int idx);int arm_mmu500_reset (struct arm_smmu_device *smmu);
drivers/scsi/qla2xxx/qla_bsg.c +17 -11
@@ -1546,8 +1546,9 @@ qla2x00_update_optrom(struct bsg_job *bsg_job) ha->optrom_buffer =NULL ; ha->optrom_state =QLA_SWAITING ;mutex_unlock (&ha->optrom_mutex); -bsg_job_done (bsg_job, bsg_reply->result, - bsg_reply->reply_payload_rcv_len); +if (!rval) +bsg_job_done (bsg_job, bsg_reply->result, + bsg_reply->reply_payload_rcv_len);return rval; }
@@ -2612,8 +2613,9 @@ qla2x00_manage_host_stats(struct bsg_job *bsg_job) sizeof(struct ql_vnd_mng_host_stats_resp)); bsg_reply->result =DID_OK ; -bsg_job_done (bsg_job, bsg_reply->result, - bsg_reply->reply_payload_rcv_len); +if (!ret) +bsg_job_done (bsg_job, bsg_reply->result, + bsg_reply->reply_payload_rcv_len);return ret; }
@@ -2702,8 +2704,9 @@ qla2x00_get_host_stats(struct bsg_job *bsg_job) bsg_job->reply_payload.sg_cnt, data, response_len); bsg_reply->result =DID_OK ; -bsg_job_done (bsg_job, bsg_reply->result, - bsg_reply->reply_payload_rcv_len); +if (!ret) +bsg_job_done (bsg_job, bsg_reply->result, + bsg_reply->reply_payload_rcv_len);kfree (data); host_stat_out:
@@ -2802,8 +2805,9 @@ qla2x00_get_tgt_stats(struct bsg_job *bsg_job) bsg_job->reply_payload.sg_cnt, data, response_len); bsg_reply->result =DID_OK ; -bsg_job_done (bsg_job, bsg_reply->result, - bsg_reply->reply_payload_rcv_len); +if (!ret) +bsg_job_done (bsg_job, bsg_reply->result, + bsg_reply->reply_payload_rcv_len); tgt_stat_out:kfree (data);
@@ -2864,8 +2868,9 @@ qla2x00_manage_host_port(struct bsg_job *bsg_job) bsg_job->reply_payload.sg_cnt, &rsp_data, sizeof(struct ql_vnd_mng_host_port_resp)); bsg_reply->result =DID_OK ; -bsg_job_done (bsg_job, bsg_reply->result, - bsg_reply->reply_payload_rcv_len); +if (!ret) +bsg_job_done (bsg_job, bsg_reply->result, + bsg_reply->reply_payload_rcv_len);return ret; }
@@ -3240,7 +3245,8 @@ int qla2x00_mailbox_passthru(struct bsg_job *bsg_job) bsg_job->reply_len =sizeof (*bsg_job->reply); bsg_reply->result =DID_OK <<16 ; -bsg_job_done (bsg_job, bsg_reply->result, bsg_reply->reply_payload_rcv_len); +if (!ret) +bsg_job_done (bsg_job, bsg_reply->result, bsg_reply->reply_payload_rcv_len);kfree (req_data);
drivers/usb/serial/option.c +6 -0
@@ -1401,12 +1401,16 @@ static const struct usb_device_id option_ids[] = { .driver_info = NCTRL(0) | RSVD(1) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a0, 0xff), /* Telit FN20C04 (rmnet) */ .driver_info = RSVD(0) | NCTRL(3) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a1, 0xff), /* Telit FN20C04 (RNDIS) */ + .driver_info = NCTRL(4) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a2, 0xff), /* Telit FN920C04 (MBIM) */ .driver_info = NCTRL(4) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a3, 0xff), /* Telit FN920C04 (ECM) */ .driver_info = NCTRL(4) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a4, 0xff), /* Telit FN20C04 (rmnet) */ .driver_info = RSVD(0) | NCTRL(3) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a6, 0xff), /* Telit FN920C04 (RNDIS) */ + .driver_info = NCTRL(4) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a7, 0xff), /* Telit FN920C04 (MBIM) */ .driver_info = NCTRL(4) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a8, 0xff), /* Telit FN920C04 (ECM) */
@@ -1415,6 +1419,8 @@ static const struct usb_device_id option_ids[] = { .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10aa, 0xff), /* Telit FN920C04 (MBIM) */ .driver_info = NCTRL(3) | RSVD(4) | RSVD(5) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10ab, 0xff), /* Telit FN920C04 (RNDIS) */ + .driver_info = NCTRL(3) | RSVD(4) | RSVD(5) }, { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b0, 0xff, 0xff, 0x30), /* Telit FE990B (rmnet) */ .driver_info = NCTRL(5) }, { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b0, 0xff, 0xff, 0x40) },
drivers/video/fbdev/riva/riva_hw.c +3 -0
@@ -436,6 +436,9 @@ static char nv3_arb(nv3_fifo_info * res_info, nv3_sim_state * state, nv3_arb_in vmisses =2 ; eburst_size = state->memory_width *1 ; mburst_size =32 ; +if (!state->mclk_khz) +return (0 ); + gns =1000000 * (gmisses*state->mem_page_miss + state->mem_latency)/state->mclk_khz; ainfo->by_gfacc = gns*ainfo->gdrain_rate/1000000 ; ainfo->wcmocc =0 ;
drivers/video/fbdev/smscufx.c +6 -2
@@ -932,7 +932,6 @@ static int ufx_ops_ioctl(struct fb_info *info, unsigned int cmd, unsigned long arg) {struct ufx_data *dev = info->par; -struct dloarea *area =NULL ;if (!atomic_read (&dev->usb_active))return 0 ;
@@ -947,6 +946,10 @@ static int ufx_ops_ioctl(struct fb_info *info, unsigned int cmd,/* TODO: Help propose a standard fb.h ioctl to report mmap damage */ if (cmd ==UFX_IOCTL_REPORT_DAMAGE ) { + struct dloarea *area __free(kfree) = kmalloc(sizeof(*area), GFP_KERNEL); +if (!area) +return -ENOMEM ; +/* If we have a damage-aware client, turn fb_defio "off" * To avoid perf imact of unnecessary page fault handling. * Done by resetting the delay for this fb_info to a very
@@ -956,7 +959,8 @@ static int ufx_ops_ioctl(struct fb_info *info, unsigned int cmd,if (info->fbdefio) info->fbdefio->delay =UFX_DEFIO_WRITE_DISABLE ; - area = (struct dloarea *)arg; +if (copy_from_user (area, (u8 __user *)arg,sizeof (*area))) +return -EFAULT ;if (area->x <0 ) area->x =0 ;
fs/f2fs/data.c +37 -16
124 lines not on this page · raw message
fs/f2fs/f2fs.h +51 -18
123 lines not on this page · raw message
fs/f2fs/gc.c +13 -11
@@ -1769,8 +1769,8 @@ static int do_garbage_collect(struct f2fs_sb_info *sbi,sanity_check_seg_type (sbi,get_seg_entry (sbi, segno)->type); - segno =rounddown (segno,SUMS_PER_BLOCK ); - sum_blk_cnt =DIV_ROUND_UP (end_segno - segno,SUMS_PER_BLOCK ); + segno =rounddown (segno, sbi->sums_per_block); + sum_blk_cnt =DIV_ROUND_UP (end_segno - segno, sbi->sums_per_block);/* readahead multi ssa blocks those have contiguous address */ if (__is_large_section (sbi)) f2fs_ra_meta_pages(sbi, GET_SUM_BLOCK(sbi, segno),
@@ -1780,17 +1780,17 @@ static int do_garbage_collect(struct f2fs_sb_info *sbi,while (segno < end_segno) {struct folio *sum_folio =f2fs_get_sum_folio (sbi, segno); - segno +=SUMS_PER_BLOCK ; + segno += sbi->sums_per_block;if (IS_ERR (sum_folio)) {int err =PTR_ERR (sum_folio); - end_segno = segno -SUMS_PER_BLOCK ; - segno =rounddown (start_segno,SUMS_PER_BLOCK ); + end_segno = segno - sbi->sums_per_block; + segno =rounddown (start_segno, sbi->sums_per_block);while (segno < end_segno) { sum_folio =filemap_get_folio (META_MAPPING (sbi),GET_SUM_BLOCK (sbi, segno));folio_put_refs (sum_folio,2 ); - segno +=SUMS_PER_BLOCK ; + segno += sbi->sums_per_block; }return err; }
@@ -1806,8 +1806,8 @@ static int do_garbage_collect(struct f2fs_sb_info *sbi,/* find segment summary of victim */ struct folio *sum_folio =filemap_get_folio (META_MAPPING (sbi),GET_SUM_BLOCK (sbi, segno)); -unsigned int block_end_segno =rounddown (segno,SUMS_PER_BLOCK ) - +SUMS_PER_BLOCK ; +unsigned int block_end_segno =rounddown (segno, sbi->sums_per_block) + + sbi->sums_per_block;if (block_end_segno > end_segno) block_end_segno = end_segno;
@@ -1833,12 +1833,13 @@ static int do_garbage_collect(struct f2fs_sb_info *sbi, migrated >= sbi->migration_granularity)continue ; - sum =SUM_BLK_PAGE_ADDR (sum_folio, cur_segno); -if (type !=GET_SUM_TYPE ((&sum->footer))) { + sum =SUM_BLK_PAGE_ADDR (sbi, sum_folio, cur_segno); +if (type !=GET_SUM_TYPE (sum_footer (sbi, sum))) {f2fs_err (sbi,"Inconsistent segment (%u) type " "[%d, %d] in SSA and SIT" , cur_segno, type, -GET_SUM_TYPE ((&sum->footer))); +GET_SUM_TYPE ( +sum_footer (sbi, sum)));f2fs_stop_checkpoint (sbi, false,STOP_CP_REASON_CORRUPTED_SUMMARY );continue ;
@@ -2096,6 +2097,7 @@ int f2fs_gc_range(struct f2fs_sb_info *sbi,if (unlikely (f2fs_cp_error (sbi)))return -EIO ; +stat_inc_gc_call_count (sbi,FOREGROUND );for (segno = start_seg; segno <= end_seg; segno +=SEGS_PER_SEC (sbi)) {struct gc_inode_list gc_list = { .ilist =LIST_HEAD_INIT (gc_list.ilist),
fs/f2fs/node.c +31 -19
124 lines not on this page · raw message
fs/f2fs/node.h +0 -8
@@ -52,14 +52,6 @@ enum { IS_PREALLOC, /* nat entry is preallocated */ }; -/* For node type in __get_node_folio() */ -enum node_type { -NODE_TYPE_REGULAR , -NODE_TYPE_INODE , -NODE_TYPE_XATTR , -NODE_TYPE_NON_INODE , -}; -/* * For node information */
fs/f2fs/recovery.c +3 -3
@@ -514,7 +514,7 @@ static int check_index_in_prev_nodes(struct f2fs_sb_info *sbi,struct curseg_info *curseg =CURSEG_I (sbi, i);if (curseg->segno == segno) { - sum = curseg->sum_blk->entries[blkoff]; + sum =sum_entries (curseg->sum_blk)[blkoff]; goto got_it; } }
@@ -522,8 +522,8 @@ static int check_index_in_prev_nodes(struct f2fs_sb_info *sbi, sum_folio =f2fs_get_sum_folio (sbi, segno);if (IS_ERR (sum_folio))return PTR_ERR (sum_folio); - sum_node =SUM_BLK_PAGE_ADDR (sum_folio, segno); - sum = sum_node->entries[blkoff]; + sum_node =SUM_BLK_PAGE_ADDR (sbi, sum_folio, segno); + sum =sum_entries (sum_node)[blkoff];f2fs_folio_put (sum_folio, true); got_it:/* Use the locked dnode page and inode */
fs/f2fs/segment.c +47 -41
248 lines not on this page · raw message
fs/f2fs/segment.h +4 -5
@@ -90,12 +90,11 @@ static inline void sanity_check_seg_type(struct f2fs_sb_info *sbi,#define GET_ZONE_FROM_SEG (sbi, segno) \ GET_ZONE_FROM_SEC(sbi, GET_SEC_FROM_SEG(sbi, segno)) -#define SUMS_PER_BLOCK (F2FS_BLKSIZE / F2FS_SUM_BLKSIZE)#define GET_SUM_BLOCK (sbi, segno) \ - (SM_I(sbi)->ssa_blkaddr + (segno / SUMS_PER_BLOCK)) -#define GET_SUM_BLKOFF (segno) (segno % SUMS_PER_BLOCK) -#define SUM_BLK_PAGE_ADDR (folio, segno) \ - (folio_address(folio) + GET_SUM_BLKOFF(segno) * F2FS_SUM_BLKSIZE) + (SM_I(sbi)->ssa_blkaddr + (segno / (sbi)->sums_per_block)) +#define GET_SUM_BLKOFF (sbi, segno) (segno % (sbi)->sums_per_block) +#define SUM_BLK_PAGE_ADDR (sbi, folio, segno) \ + (folio_address(folio) + GET_SUM_BLKOFF(sbi, segno) * (sbi)->sum_blocksize)#define GET_SUM_TYPE (footer) ((footer)->entry_type)#define SET_SUM_TYPE (footer, type) ((footer)->entry_type = (type))
fs/f2fs/super.c +20 -44
112 lines not on this page · raw message
fs/f2fs/sysfs.c +53 -9
117 lines not on this page · raw message
include/linux/f2fs_fs.h +45 -28
118 lines not on this page · raw message