5.10.67-rc1 review

From: Randy Dunlap <[email protected]>

[ Upstream commit 946e1052cdcc7e585ee5d1e72528ca49fb295243 ]

Don't call printk() when CONFIG_PRINTK is not set. Fixes the following build errors:

or1k-linux-ld: arch/openrisc/kernel/entry.o: in function `_external_irq_handler':
(.text+0x804): undefined reference to `printk'
(.text+0x804): relocation truncated to fit: R_OR1K_INSN_REL_26 against undefined symbol `printk'

---
 arch/openrisc/kernel/entry.S | 2 ++
 1 file changed, 2 insertions(+)

index bc657e55c15f..98e4f97db515 100644
@@ -547,6 +547,7 @@ EXCEPTION_ENTRY(_external_irq_handler)
 	l.bnf	1f			// ext irq enabled, all ok.
 	l.nop
 
+#ifdef CONFIG_PRINTK
 	l.addi  r1,r1,-0x8
 	l.movhi r3,hi(42f)
 	l.ori	r3,r3,lo(42f)

@@ -560,6 +561,7 @@ EXCEPTION_ENTRY(_external_irq_handler)
 		.string "\n\rESR interrupt bug: in _external_irq_handler (ESR %x)\n\r"
 		.align 4
 	.previous
+#endif
 
 	l.ori	r4,r4,SPR_SR_IEE	// fix the bug
 //	l.sw	PT_SR(r1),r4

2.30.2

From: Dmitry Osipenko <[email protected]>

commit 8d448fa0a8bb1c8d94eef7647edffe9ac81a281e upstream.

The TPS65910 RTC driver module doesn't auto-load because of the wrong module alias that doesn't match the device name, fix it.

---
 drivers/rtc/rtc-tps65910.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -469,6 +469,6 @@ static struct platform_driver tps65910_r
 };
 
 module_platform_driver(tps65910_rtc_driver);
-MODULE_ALIAS("platform:rtc-tps65910");
+MODULE_ALIAS("platform:tps65910-rtc");
 MODULE_AUTHOR("Venu Byravarasu <[email protected]>");
 MODULE_LICENSE("GPL");

From: Niklas Cassel <[email protected]>

commit 4d643b66089591b4769bcdb6fd1bfeff2fe301b8 upstream.

A user space process should not need the CAP_SYS_ADMIN capability set in order to perform a BLKREPORTZONE ioctl.

Getting the zone report is required in order to get the write pointer. Neither read() nor write() requires CAP_SYS_ADMIN, so it is reasonable that a user space process that can read/write from/to the device, also can get the write pointer. (Since e.g. writes have to be at the write pointer.)

---
 block/blk-zoned.c |    3 ---
 1 file changed, 3 deletions(-)

@@ -296,9 +296,6 @@ int blkdev_report_zones_ioctl(struct blo
 	if (!blk_queue_is_zoned(q))
 		return -ENOTTY;
 
-	if (!capable(CAP_SYS_ADMIN))
-		return -EACCES;
-
 	if (copy_from_user(&rep, argp, sizeof(struct blk_zone_report)))
 		return -EFAULT;
 

From: Marek Marczykowski-Górecki <[email protected]>

commit 1a519dc7a73c977547d8b5108d98c6e769c89f4b upstream.

When running as Xen PV guest, masking MSI-X is a responsibility of the hypervisor. The guest has no write access to the relevant BAR at all - when it tries to, it results in a crash like this:

    BUG: unable to handle page fault for address: ffffc9004069100c
    #PF: supervisor write access in kernel mode
    #PF: error_code(0x0003) - permissions violation
    RIP: e030:__pci_enable_msix_range.part.0+0x26b/0x5f0
     e1000e_set_interrupt_capability+0xbf/0xd0 [e1000e]
     e1000_probe+0x41f/0xdb0 [e1000e]
     local_pci_probe+0x42/0x80
    (...)

The recently introduced function msix_mask_all() does not check the global variable pci_msi_ignore_mask which is set by XEN PV to bypass the masking of MSI[-X] interrupts.

Add the check to make this function XEN PV compatible.

---
 drivers/pci/msi.c |    3 +++
 1 file changed, 3 insertions(+)

@@ -783,6 +783,9 @@ static void msix_mask_all(void __iomem *
 	u32 ctrl = PCI_MSIX_ENTRY_CTRL_MASKBIT;
 	int i;
 
+	if (pci_msi_ignore_mask)
+		return;
+
 	for (i = 0; i < tsize; i++, base += PCI_MSIX_ENTRY_SIZE)
 		writel(ctrl, base + PCI_MSIX_ENTRY_VECTOR_CTRL);
 }

From: Kajol Jain <[email protected]>

commit f9addd85fbfacf0d155e83dbee8696d6df5ed0c7 upstream.

H_GetPerformanceCounterInfo (0xF080) hcall returns the counter data in the result buffer. Result buffer has specific format defined in the PAPR specification. One of the fields is counter offset and width of the counter data returned.

Counter data are returned in a unsigned char array in big endian byte order. To get the final counter data, the values must be left shifted byte at a time. But commit 220a0c609ad17 ("powerpc/perf: Add support for the hv gpci (get performance counter info) interface") made the shifting bitwise and also assumed little endian order. Because of that, hcall counters values are reported incorrectly.

In particular this can lead to counters go backwards which messes up the counter prev vs now calculation and leads to huge counter value reporting:

#: perf stat -e hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
-C 0 -I 1000
time counts unit events
1.000078854 18,446,744,073,709,535,232 hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
2.000213293 0 hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
3.000320107 0 hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
4.000428392 0 hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
5.000537864 0 hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
6.000649087 0 hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
7.000760312 0 hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
8.000865218 16,448 hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
9.000978985 18,446,744,073,709,535,232 hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
10.001088891 16,384 hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
11.001201435 0 hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
12.001307937 18,446,744,073,709,535,232 hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/

Fix the shifting logic to correct match the format, ie. read bytes in big endian order.

---
 arch/powerpc/perf/hv-gpci.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -175,7 +175,7 @@ static unsigned long single_gpci_request
 	 */
 	count = 0;
 	for (i = offset; i < offset + length; i++)
-		count |= arg->bytes[i] << (i - offset);
+		count |= (u64)(arg->bytes[i]) << ((length - 1 - (i - offset)) * 8);
 
 	*value = count;
 out:

From: Juergen Gross <[email protected]>

commit 4b511d5bfa74b1926daefd1694205c7f1bcf677f upstream.

Xen PV guests are specifying the highest used PFN via the max_pfn field in shared_info. This value is used by the Xen tools when saving or migrating the guest.

Unfortunately this field is misnamed, as in reality it is specifying the number of pages (including any memory holes) of the guest, so it is the highest used PFN + 1. Renaming isn't possible, as this is a public Xen hypervisor interface which needs to be kept stable.

The kernel will set the value correctly initially at boot time, but when adding more pages (e.g. due to memory hotplug or ballooning) a real PFN number is stored in max_pfn. This is done when expanding the p2m array, and the PFN stored there is even possibly wrong, as it should be the last possible PFN of the just added P2M frame, and not one which led to the P2M expansion.

Fix that by setting shared_info->max_pfn to the last possible PFN + 1.

---
 arch/x86/xen/p2m.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

@@ -618,8 +618,8 @@ int xen_alloc_p2m_entry(unsigned long pf
 	}
 
 	/* Expanded the p2m? */
-	if (pfn > xen_p2m_last_pfn) {
-		xen_p2m_last_pfn = pfn;
+	if (pfn >= xen_p2m_last_pfn) {
+		xen_p2m_last_pfn = ALIGN(pfn + 1, P2M_PER_PAGE);
 		HYPERVISOR_shared_info->arch.max_pfn = xen_p2m_last_pfn;
 	}
 

From: Harshvardhan Jha <[email protected]>

commit 732b33d0dbf17e9483f0b50385bf606f724f50a2 upstream.

This patch addresses the following problems:
- priv can never be NULL, so this part of the check is useless
- if the loop ran through the whole list, priv->client is invalid and
it is more appropriate and sufficient to check for the end of list_for_each_entry loop condition.

---
 net/9p/trans_xen.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

@@ -138,7 +138,7 @@ static bool p9_xen_write_todo(struct xen
 
 static int p9_xen_request(struct p9_client *client, struct p9_req_t *p9_req)
 {
-	struct xen_9pfs_front_priv *priv = NULL;
+	struct xen_9pfs_front_priv *priv;
 	RING_IDX cons, prod, masked_cons, masked_prod;
 	unsigned long flags;
 	u32 size = p9_req->tc.size;

@@ -151,7 +151,7 @@ static int p9_xen_request(struct p9_clie
 			break;
 	}
 	read_unlock(&xen_9pfs_lock);
-	if (!priv || priv->client != client)
+	if (list_entry_is_head(priv, &xen_9pfs_devs, list))
 		return -EINVAL;
 
 	num = p9_req->tc.tag % priv->num_rings;

From: Steven Rostedt (VMware) <[email protected]>

commit 210f9df02611cbe641ced3239122b270fd907d86 upstream.

The selftest for ftrace checks some features by checking if the README has text that states the feature is supported by that kernel. Unfortunately, this check gives false positives because it many not be checked if there's spaces in the string to check. This is due to the compare between the required variable with the ":README" string stripped, because neither has quotes around them.

---
 tools/testing/selftests/ftrace/test.d/functions |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -115,7 +115,7 @@ check_requires() { # Check required file
                 echo "Required tracer $t is not configured."
                 exit_unsupported
             fi
-        elif [ $r != $i ]; then
+        elif [ "$r" != "$i" ]; then
             if ! grep -Fq "$r" README ; then
                 echo "Required feature pattern \"$r\" is not in README."
                 exit_unsupported

From: Rolf Eike Beer <[email protected]>

commit b5f7912bb604b47a0fe024560488a7556dce8ee7 upstream.

Default to prefixed pkg-config when crosscompiling, this matches what other parts of the tools/ directory already do.

[dlezcano] : Reworked description

---
 tools/thermal/tmon/Makefile |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -10,7 +10,7 @@ override CFLAGS+= $(call cc-option,-O3,-
 # Add "-fstack-protector" only if toolchain supports it.
 override CFLAGS+= $(call cc-option,-fstack-protector-strong)
 CC?= $(CROSS_COMPILE)gcc
-PKG_CONFIG?= pkg-config
+PKG_CONFIG?= $(CROSS_COMPILE)pkg-config
 
 override CFLAGS+=-D VERSION=\"$(VERSION)\"
 LDFLAGS+=

From: Dinh Nguyen <[email protected]>

commit 9d563236cca43fc4fe190b3be173444bd48e2a3b upstream.

The psi_ref_clk comes from the C2 node of the main_pll and periph_pll, not the C3.

---
 drivers/clk/socfpga/clk-agilex.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

@@ -107,10 +107,10 @@ static const struct clk_parent_data gpio
 };
 
 static const struct clk_parent_data psi_ref_free_mux[] = {
-	{ .fw_name = "main_pll_c3",
-	  .name = "main_pll_c3", },
-	{ .fw_name = "peri_pll_c3",
-	  .name = "peri_pll_c3", },
+	{ .fw_name = "main_pll_c2",
+	  .name = "main_pll_c2", },
+	{ .fw_name = "peri_pll_c2",
+	  .name = "peri_pll_c2", },
 	{ .fw_name = "osc1",
 	  .name = "osc1", },
 	{ .fw_name = "cb-intosc-hs-div2-clk",

From: Colin Ian King <[email protected]>

commit 05a444d3f90a3c3e6362e88a1bf13e1a60f8cace upstream.

Currently in the case where kmem_cache_alloc fails the null pointer cf is dereferenced when assigning cf->is_capsnap = false. Fix this by adding a null pointer check and return path.

Cc: [email protected]
Addresses-Coverity: ("Dereference null return")

---
 fs/ceph/caps.c |    3 +++
 1 file changed, 3 insertions(+)

@@ -1755,6 +1755,9 @@ struct ceph_cap_flush *ceph_alloc_cap_fl
 	struct ceph_cap_flush *cf;
 
 	cf = kmem_cache_alloc(ceph_cap_flush_cachep, GFP_KERNEL);
+	if (!cf)
+		return NULL;
+
 	cf->is_capsnap = false;
 	return cf;
 }

From: Dinh Nguyen <[email protected]>

commit f817c132db679d492d96c60993fa2f2c67ab18d0 upstream.

Correct the s2f_user0_mux clock representation.

---
 drivers/clk/socfpga/clk-agilex.c |    9 +++++++++
 1 file changed, 9 insertions(+)

@@ -193,6 +193,13 @@ static const struct clk_parent_data sdmm
 	  .name = "boot_clk", },
 };
 
+static const struct clk_parent_data s2f_user0_mux[] = {
+	{ .fw_name = "s2f_user0_free_clk",
+	  .name = "s2f_user0_free_clk", },
+	{ .fw_name = "boot_clk",
+	  .name = "boot_clk", },
+};
+
 static const struct clk_parent_data s2f_user1_mux[] = {
 	{ .fw_name = "s2f_user1_free_clk",
 	  .name = "s2f_user1_free_clk", },

@@ -306,6 +313,8 @@ static const struct stratix10_gate_clock
 	  4, 0x98, 0, 16, 0x88, 3, 0},
 	{ AGILEX_SDMMC_CLK, "sdmmc_clk", NULL, sdmmc_mux, ARRAY_SIZE(sdmmc_mux), 0, 0x7C,
 	  5, 0, 0, 0, 0x88, 4, 4},
+	{ AGILEX_S2F_USER0_CLK, "s2f_user0_clk", NULL, s2f_user0_mux, ARRAY_SIZE(s2f_user0_mux), 0, 0x24,
+	  6, 0, 0, 0, 0x30, 2, 0},
 	{ AGILEX_S2F_USER1_CLK, "s2f_user1_clk", NULL, s2f_user1_mux, ARRAY_SIZE(s2f_user1_mux), 0, 0x7C,
 	  6, 0, 0, 0, 0x88, 5, 0},
 	{ AGILEX_PSI_REF_CLK, "psi_ref_clk", NULL, psi_mux, ARRAY_SIZE(psi_mux), 0, 0x7C,

From: Pavel Begunkov <[email protected]>

Limit the number of files in io_uring fixed tables by RLIMIT_NOFILE, that's the first and the simpliest restriction that we should impose.

---
 fs/io_uring.c |    2 ++
 1 file changed, 2 insertions(+)

@@ -7579,6 +7579,8 @@ static int io_sqe_files_register(struct
 		return -EINVAL;
 	if (nr_args > IORING_MAX_FIXED_FILES)
 		return -EMFILE;
+	if (nr_args > rlimit(RLIMIT_NOFILE))
+		return -EMFILE;
 
 	file_data = kzalloc(sizeof(*ctx->file_data), GFP_KERNEL);
 	if (!file_data)

From: Marc Zyngier <[email protected]>

commit 1b73e588f47397dee6e4bdfd953e0306c60b5fe5 upstream.

Casting a small array of u8 to an unsigned long is *never* OK:

- it does funny thing when the array size is less than that of a long, as it accesses random places in the stack
- it makes everything even more fun with a BE kernel

Fix this by building the unsigned long used as a bitmap byte by byte, in a way that works across endianess and has no undefined behaviours.

An extra BUILD_BUG_ON() catches the unlikely case where the array would be larger than a single unsigned long.

---
 drivers/pinctrl/pinctrl-stmfx.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

@@ -566,7 +566,7 @@ static irqreturn_t stmfx_pinctrl_irq_thr
 	u8 pending[NR_GPIO_REGS];
 	u8 src[NR_GPIO_REGS] = {0, 0, 0};
 	unsigned long n, status;
-	int ret;
+	int i, ret;
 
 	ret = regmap_bulk_read(pctl->stmfx->map, STMFX_REG_IRQ_GPI_PENDING,
 			       &pending, NR_GPIO_REGS);

@@ -576,7 +576,9 @@ static irqreturn_t stmfx_pinctrl_irq_thr
 	regmap_bulk_write(pctl->stmfx->map, STMFX_REG_IRQ_GPI_SRC,
 			  src, NR_GPIO_REGS);
 
-	status = *(unsigned long *)pending;
+	BUILD_BUG_ON(NR_GPIO_REGS > sizeof(status));
+	for (i = 0, status = 0; i < NR_GPIO_REGS; i++)
+		status |= (unsigned long)pending[i] << (i * 8);
 	for_each_set_bit(n, &status, gc->ngpio) {
 		handle_nested_irq(irq_find_mapping(gc->irq.domain, n));
 		stmfx_pinctrl_irq_toggle_trigger(pctl, n);

From: Paul Cercueil <[email protected]>

commit d5e931403942b3af39212960c2592b5ba741b2bf upstream.

Fix the pull up/down info for both the JZ4760 and JZ4770 SoCs, as the previous values sometimes contradicted what's written in the programming manual.

---
 drivers/pinctrl/pinctrl-ingenic.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

@@ -363,7 +363,7 @@ static const struct ingenic_chip_info jz
 };
 
 static const u32 jz4760_pull_ups[6] = {
-	0xffffffff, 0xfffcf3ff, 0xffffffff, 0xffffcfff, 0xfffffb7c, 0xfffff00f,
+	0xffffffff, 0xfffcf3ff, 0xffffffff, 0xffffcfff, 0xfffffb7c, 0x0000000f,
 };
 
 static const u32 jz4760_pull_downs[6] = {

@@ -618,11 +618,11 @@ static const struct ingenic_chip_info jz
 };
 
 static const u32 jz4770_pull_ups[6] = {
-	0x3fffffff, 0xfff0030c, 0xffffffff, 0xffff4fff, 0xfffffb7c, 0xffa7f00f,
+	0x3fffffff, 0xfff0f3fc, 0xffffffff, 0xffff4fff, 0xfffffb7c, 0x0024f00f,
 };
 
 static const u32 jz4770_pull_downs[6] = {
-	0x00000000, 0x000f0c03, 0x00000000, 0x0000b000, 0x00000483, 0x00580ff0,
+	0x00000000, 0x000f0c03, 0x00000000, 0x0000b000, 0x00000483, 0x005b0ff0,
 };
 
 static int jz4770_uart0_data_pins[] = { 0xa0, 0xa3, };

From: Iwona Winiarska <[email protected]>

commit 8b07e990fb254fcbaa919616ac77f981cb48c73d upstream.

The check mixes pages (vm_pgoff) with bytes (vm_start, vm_end) on one side of the comparison, and uses resource address (rather than just the resource size) on the other side of the comparison.
This can allow malicious userspace to easily bypass the boundary check and map pages that are located outside memory-region reserved by the driver.

---
 drivers/soc/aspeed/aspeed-p2a-ctrl.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -110,7 +110,7 @@ static int aspeed_p2a_mmap(struct file *
 	vsize = vma->vm_end - vma->vm_start;
 	prot = vma->vm_page_prot;
 
-	if (vma->vm_pgoff + vsize > ctrl->mem_base + ctrl->mem_size)
+	if (vma->vm_pgoff + vma_pages(vma) > ctrl->mem_size >> PAGE_SHIFT)
 		return -EINVAL;
 
 	/* ast2400/2500 AHB accesses are not cache coherent */

From: Will Deacon <[email protected]>

commit 5e10f9887ed85d4f59266d5c60dd09be96b5dbd4 upstream.

When switching to an 'mm_struct' for the first time following an ASID rollover, a new ASID may be allocated and assigned to 'mm->context.id'. This reassignment can happen concurrently with other operations on the mm, such as unmapping pages and subsequently issuing TLB invalidation.

Consequently, we need to ensure that (a) accesses to 'mm->context.id' are atomic and (b) all page-table updates made prior to a TLBI using the old ASID are guaranteed to be visible to CPUs running with the new ASID.

This was found by inspection after reviewing the VMID changes from Shameer but it looks like a real (yet hard to hit) bug.

---
 arch/arm64/include/asm/mmu.h      |   29 +++++++++++++++++++++++++----
 arch/arm64/include/asm/tlbflush.h |   11 ++++++-----
 2 files changed, 31 insertions(+), 9 deletions(-)

@@ -30,11 +30,32 @@ typedef struct {
 } mm_context_t;
 
 /*
- * This macro is only used by the TLBI and low-level switch_mm() code,
- * neither of which can race with an ASID change. We therefore don't
- * need to reload the counter using atomic64_read().
+ * We use atomic64_read() here because the ASID for an 'mm_struct' can
+ * be reallocated when scheduling one of its threads following a
+ * rollover event (see new_context() and flush_context()). In this case,
+ * a concurrent TLBI (e.g. via try_to_unmap_one() and ptep_clear_flush())
+ * may use a stale ASID. This is fine in principle as the new ASID is
+ * guaranteed to be clean in the TLB, but the TLBI routines have to take
+ * care to handle the following race:
+ *
+ *    CPU 0                    CPU 1                          CPU 2
+ *
+ *    // ptep_clear_flush(mm)
+ *    xchg_relaxed(pte, 0)
+ *    DSB ISHST
+ *    old = ASID(mm)
+ *         |                                                  <rollover>
+ *         |                   new = new_context(mm)
+ *         \-----------------> atomic_set(mm->context.id, new)
+ *                             cpu_switch_mm(mm)
+ *                             // Hardware walk of pte using new ASID
+ *    TLBI(old)
+ *
+ * In this scenario, the barrier on CPU 0 and the dependency on CPU 1
+ * ensure that the page-table walker on CPU 1 *must* see the invalid PTE
+ * written by CPU 0.
  */
-#define ASID(mm)	((mm)->context.id.counter & 0xffff)
+#define ASID(mm)	(atomic64_read(&(mm)->context.id) & 0xffff)
 
 static inline bool arm64_kernel_unmapped_at_el0(void)
 {

@@ -245,9 +245,10 @@ static inline void flush_tlb_all(void)
 
 static inline void flush_tlb_mm(struct mm_struct *mm)
 {
-	unsigned long asid = __TLBI_VADDR(0, ASID(mm));
+	unsigned long asid;
 
 	dsb(ishst);
+	asid = __TLBI_VADDR(0, ASID(mm));
 	__tlbi(aside1is, asid);
 	__tlbi_user(aside1is, asid);
 	dsb(ish);

@@ -256,9 +257,10 @@ static inline void flush_tlb_mm(struct m
 static inline void flush_tlb_page_nosync(struct vm_area_struct *vma,
 					 unsigned long uaddr)
 {
-	unsigned long addr = __TLBI_VADDR(uaddr, ASID(vma->vm_mm));
+	unsigned long addr;
 
 	dsb(ishst);
+	addr = __TLBI_VADDR(uaddr, ASID(vma->vm_mm));
 	__tlbi(vale1is, addr);
 	__tlbi_user(vale1is, addr);
 }

@@ -283,9 +285,7 @@ static inline void __flush_tlb_range(str
 {
 	int num = 0;
 	int scale = 0;
-	unsigned long asid = ASID(vma->vm_mm);
-	unsigned long addr;
-	unsigned long pages;
+	unsigned long asid, addr, pages;
 
 	start = round_down(start, stride);
 	end = round_up(end, stride);

@@ -305,6 +305,7 @@ static inline void __flush_tlb_range(str
 	}
 
 	dsb(ishst);
+	asid = ASID(vma->vm_mm);
 
 	/*
 	 * When the CPU does not support TLB range operations, flush the TLB

From: Iwona Winiarska <[email protected]>

commit b49a0e69a7b1a68c8d3f64097d06dabb770fec96 upstream.

The check mixes pages (vm_pgoff) with bytes (vm_start, vm_end) on one side of the comparison, and uses resource address (rather than just the resource size) on the other side of the comparison.
This can allow malicious userspace to easily bypass the boundary check and map pages that are located outside memory-region reserved by the driver.

---
 drivers/soc/aspeed/aspeed-lpc-ctrl.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -46,7 +46,7 @@ static int aspeed_lpc_ctrl_mmap(struct f
 	unsigned long vsize = vma->vm_end - vma->vm_start;
 	pgprot_t prot = vma->vm_page_prot;
 
-	if (vma->vm_pgoff + vsize > lpc_ctrl->mem_base + lpc_ctrl->mem_size)
+	if (vma->vm_pgoff + vma_pages(vma) > lpc_ctrl->mem_size >> PAGE_SHIFT)
 		return -EINVAL;
 
 	/* ast2400/2500 AHB accesses are not cache coherent */

From: Manivannan Sadhasivam <[email protected]>

commit a89f355e469dcda129c2522be4fdba00c1c74c83 upstream.

In "qmp_cooling_devices_register", the count value is initially QMP_NUM_COOLING_RESOURCES, which is 2. Based on the initial count value, the memory for cooling_devs is allocated. Then while calling the "qmp_cooling_device_add" function, count value is post-incremented for each child node.

This makes the out of bound access to the cooling_dev array. Fix it by passing the QMP_NUM_COOLING_RESOURCES definition to devm_kzalloc() and initializing the count to 0.

While at it, let's also free the memory allocated to cooling_dev if no cooling device is found in DT and during unroll phase.

---
 drivers/soc/qcom/qcom_aoss.c |    8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

@@ -476,12 +476,12 @@ static int qmp_cooling_device_add(struct
 static int qmp_cooling_devices_register(struct qmp *qmp)
 {
 	struct device_node *np, *child;
-	int count = QMP_NUM_COOLING_RESOURCES;
+	int count = 0;
 	int ret;
 
 	np = qmp->dev->of_node;
 
-	qmp->cooling_devs = devm_kcalloc(qmp->dev, count,
+	qmp->cooling_devs = devm_kcalloc(qmp->dev, QMP_NUM_COOLING_RESOURCES,
 					 sizeof(*qmp->cooling_devs),
 					 GFP_KERNEL);
 

@@ -497,12 +497,16 @@ static int qmp_cooling_devices_register(
 			goto unroll;
 	}
 
+	if (!count)
+		devm_kfree(qmp->dev, qmp->cooling_devs);
+
 	return 0;
 
 unroll:
 	while (--count >= 0)
 		thermal_cooling_device_unregister
 			(qmp->cooling_devs[count].cdev);
+	devm_kfree(qmp->dev, qmp->cooling_devs);
 
 	return ret;
 }

From: Mark Rutland <[email protected]>

commit 90268574a3e8a6b883bd802d702a2738577e1006 upstream.

The compute_indices and populate_entries macros operate on inclusive bounds, and thus the map_memory macro which uses them also operates on inclusive bounds.

We pass _end and _idmap_text_end to map_memory, but these are exclusive bounds, and if one of these is sufficiently aligned (as a result of kernel configuration, physical placement, and KASLR), then:

* In compute_indices, the computed iend will be in the page/block *after* the final byte of the intended mapping.

* In populate_entries, an unnecessary entry will be created at the end of each level of table. At the leaf level, this entry will map up to SWAPPER_BLOCK_SIZE bytes of physical addresses that we did not intend to map.

As we may map up to SWAPPER_BLOCK_SIZE bytes more than intended, we may violate the boot protocol and map physical address past the 2MiB-aligned end address we are permitted to map. As we map these with Normal memory attributes, this may result in further problems depending on what these physical addresses correspond to.

The final entry at each level may require an additional table at that level. As EARLY_ENTRIES() calculates an inclusive bound, we allocate enough memory for this.

Avoid the extraneous mapping by having map_memory convert the exclusive end address to an inclusive end address by subtracting one, and do likewise in EARLY_ENTRIES() when calculating the number of required tables. For clarity, comments are updated to more clearly document which boundaries the macros operate on. For consistency with the other macros, the comments in map_memory are also updated to describe vstart and vend as virtual addresses.

---
 arch/arm64/include/asm/kernel-pgtable.h |    4 ++--
 arch/arm64/kernel/head.S                |   11 ++++++-----
 2 files changed, 8 insertions(+), 7 deletions(-)

@@ -65,8 +65,8 @@
 #define EARLY_KASLR	(0)
 #endif
 
-#define EARLY_ENTRIES(vstart, vend, shift) (((vend) >> (shift)) \
-					- ((vstart) >> (shift)) + 1 + EARLY_KASLR)
+#define EARLY_ENTRIES(vstart, vend, shift) \
+	((((vend) - 1) >> (shift)) - ((vstart) >> (shift)) + 1 + EARLY_KASLR)
 
 #define EARLY_PGDS(vstart, vend) (EARLY_ENTRIES(vstart, vend, PGDIR_SHIFT))
 

@@ -191,7 +191,7 @@ SYM_CODE_END(preserve_boot_args)
  * to be composed of multiple pages. (This effectively scales the end index).
  *
  *	vstart:	virtual address of start of range
- *	vend:	virtual address of end of range
+ *	vend:	virtual address of end of range - we map [vstart, vend]
  *	shift:	shift used to transform virtual address into index
  *	ptrs:	number of entries in page table
  *	istart:	index in table corresponding to vstart

@@ -228,17 +228,18 @@ SYM_CODE_END(preserve_boot_args)
  *
  *	tbl:	location of page table
  *	rtbl:	address to be used for first level page table entry (typically tbl + PAGE_SIZE)
- *	vstart:	start address to map
- *	vend:	end address to map - we map [vstart, vend]
+ *	vstart:	virtual address of start of range
+ *	vend:	virtual address of end of range - we map [vstart, vend - 1]
  *	flags:	flags to use to map last level entries
  *	phys:	physical address corresponding to vstart - physical memory is contiguous
  *	pgds:	the number of pgd entries
  *
  * Temporaries:	istart, iend, tmp, count, sv - these need to be different registers
- * Preserves:	vstart, vend, flags
- * Corrupts:	tbl, rtbl, istart, iend, tmp, count, sv
+ * Preserves:	vstart, flags
+ * Corrupts:	tbl, rtbl, vend, istart, iend, tmp, count, sv
  */
 	.macro map_memory, tbl, rtbl, vstart, vend, flags, phys, pgds, istart, iend, tmp, count, sv
+	sub \vend, \vend, #1
 	add \rtbl, \tbl, #PAGE_SIZE
 	mov \sv, \rtbl
 	mov \count, #0

From: Dinh Nguyen <[email protected]>

commit d17929eb1066d1c1653aae9bb4396a9f1d6602ac upstream.

Add the bypass register for the s2f_user0_clk.

---
 drivers/clk/socfpga/clk-agilex.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -267,7 +267,7 @@ static const struct stratix10_perip_cnt_
 	{ AGILEX_SDMMC_FREE_CLK, "sdmmc_free_clk", NULL, sdmmc_free_mux,
 	  ARRAY_SIZE(sdmmc_free_mux), 0, 0xE4, 0, 0, 0},
 	{ AGILEX_S2F_USER0_FREE_CLK, "s2f_user0_free_clk", NULL, s2f_usr0_free_mux,
-	  ARRAY_SIZE(s2f_usr0_free_mux), 0, 0xE8, 0, 0, 0},
+	  ARRAY_SIZE(s2f_usr0_free_mux), 0, 0xE8, 0, 0x30, 2},
 	{ AGILEX_S2F_USER1_FREE_CLK, "s2f_user1_free_clk", NULL, s2f_usr1_free_mux,
 	  ARRAY_SIZE(s2f_usr1_free_mux), 0, 0xEC, 0, 0x88, 5},
 	{ AGILEX_PSI_REF_FREE_CLK, "psi_ref_free_clk", NULL, psi_ref_free_mux,

From: Nuno Sá <[email protected]>

commit b76d26d69ecc97ebb24aaf40427a13c808a4f488 upstream.

There is no reason to assume that the IRQ rising edge (indicating that the device start up phase is done) will happen after we request the IRQ. If the device is already up by the time we request it, the call to 'wait_for_completion_timeout()' will timeout and we will fail the device probe even though there's nothing wrong.

Fix it by just polling the status register until we get the indication that the device is up and running. As a side effect of this fix, requesting the IRQ is also moved to after the setup function.

---
 drivers/iio/temperature/ltc2983.c |   30 ++++++++++++++----------------
 1 file changed, 14 insertions(+), 16 deletions(-)

@@ -89,6 +89,8 @@
 
 #define	LTC2983_STATUS_START_MASK	BIT(7)
 #define	LTC2983_STATUS_START(x)		FIELD_PREP(LTC2983_STATUS_START_MASK, x)
+#define	LTC2983_STATUS_UP_MASK		GENMASK(7, 6)
+#define	LTC2983_STATUS_UP(reg)		FIELD_GET(LTC2983_STATUS_UP_MASK, reg)
 
 #define	LTC2983_STATUS_CHAN_SEL_MASK	GENMASK(4, 0)
 #define	LTC2983_STATUS_CHAN_SEL(x) \

@@ -1362,17 +1364,16 @@ put_child:
 
 static int ltc2983_setup(struct ltc2983_data *st, bool assign_iio)
 {
-	u32 iio_chan_t = 0, iio_chan_v = 0, chan, iio_idx = 0;
+	u32 iio_chan_t = 0, iio_chan_v = 0, chan, iio_idx = 0, status;
 	int ret;
-	unsigned long time;
-
-	/* make sure the device is up */
-	time = wait_for_completion_timeout(&st->completion,
-					    msecs_to_jiffies(250));
 
-	if (!time) {
+	/* make sure the device is up: start bit (7) is 0 and done bit (6) is 1 */
+	ret = regmap_read_poll_timeout(st->regmap, LTC2983_STATUS_REG, status,
+				       LTC2983_STATUS_UP(status) == 1, 25000,
+				       25000 * 10);
+	if (ret) {
 		dev_err(&st->spi->dev, "Device startup timed out\n");
-		return -ETIMEDOUT;
+		return ret;
 	}
 
 	st->iio_chan = devm_kzalloc(&st->spi->dev,

@@ -1492,10 +1493,11 @@ static int ltc2983_probe(struct spi_devi
 	ret = ltc2983_parse_dt(st);
 	if (ret)
 		return ret;
-	/*
-	 * let's request the irq now so it is used to sync the device
-	 * startup in ltc2983_setup()
-	 */
+
+	ret = ltc2983_setup(st, true);
+	if (ret)
+		return ret;
+
 	ret = devm_request_irq(&spi->dev, spi->irq, ltc2983_irq_handler,
 			       IRQF_TRIGGER_RISING, name, st);
 	if (ret) {

@@ -1503,10 +1505,6 @@ static int ltc2983_probe(struct spi_devi
 		return ret;
 	}
 
-	ret = ltc2983_setup(st, true);
-	if (ret)
-		return ret;
-
 	indio_dev->name = name;
 	indio_dev->num_channels = st->iio_channels;
 	indio_dev->channels = st->iio_chan;

From: Joseph Gates <[email protected]>

commit d195d7aac09bddabc2c8326fb02fcec2b0a2de02 upstream.

If the operating channel is the first in the scan list, it was seen that a finish scan request would be sent before a start scan request was sent, causing the firmware to fail all future scans. Track the current channel being scanned to avoid requesting the scan finish before it starts.

---
 drivers/net/wireless/ath/wcn36xx/main.c    |    5 ++++-
 drivers/net/wireless/ath/wcn36xx/wcn36xx.h |    1 +
 2 files changed, 5 insertions(+), 1 deletion(-)

@@ -405,13 +405,14 @@ static int wcn36xx_config(struct ieee802
 		wcn36xx_dbg(WCN36XX_DBG_MAC, "wcn36xx_config channel switch=%d\n",
 			    ch);
 
-		if (wcn->sw_scan_opchannel == ch) {
+		if (wcn->sw_scan_opchannel == ch && wcn->sw_scan_channel) {
 			/* If channel is the initial operating channel, we may
 			 * want to receive/transmit regular data packets, then
 			 * simply stop the scan session and exit PS mode.
 			 */
 			wcn36xx_smd_finish_scan(wcn, HAL_SYS_MODE_SCAN,
 						wcn->sw_scan_vif);
+			wcn->sw_scan_channel = 0;
 		} else if (wcn->sw_scan) {
 			/* A scan is ongoing, do not change the operating
 			 * channel, but start a scan session on the channel.

@@ -419,6 +420,7 @@ static int wcn36xx_config(struct ieee802
 			wcn36xx_smd_init_scan(wcn, HAL_SYS_MODE_SCAN,
 					      wcn->sw_scan_vif);
 			wcn36xx_smd_start_scan(wcn, ch);
+			wcn->sw_scan_channel = ch;
 		} else {
 			wcn36xx_change_opchannel(wcn, ch);
 		}

@@ -699,6 +701,7 @@ static void wcn36xx_sw_scan_start(struct
 
 	wcn->sw_scan = true;
 	wcn->sw_scan_vif = vif;
+	wcn->sw_scan_channel = 0;
 	if (vif_priv->sta_assoc)
 		wcn->sw_scan_opchannel = WCN36XX_HW_CHANNEL(wcn);
 	else

@@ -232,6 +232,7 @@ struct wcn36xx {
 	struct cfg80211_scan_request *scan_req;
 	bool			sw_scan;
 	u8			sw_scan_opchannel;
+	u8			sw_scan_channel;
 	struct ieee80211_vif	*sw_scan_vif;
 	struct mutex		scan_lock;
 	bool			scan_aborted;

From: Pavel Begunkov <[email protected]>

commit 0bea96f59ba40e63c0ae93ad6a02417b95f22f4d upstream.

Fixed tables may be large enough, place all of them together with allocated tags under memcg limits.

---
 fs/io_uring.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

@@ -7383,7 +7383,7 @@ static int io_sqe_alloc_file_tables(stru
 
 		this_files = min(nr_files, IORING_MAX_FILES_TABLE);
 		table->files = kcalloc(this_files, sizeof(struct file *),
-					GFP_KERNEL);
+					GFP_KERNEL_ACCOUNT);
 		if (!table->files)
 			break;
 		nr_files -= this_files;

@@ -7582,7 +7582,7 @@ static int io_sqe_files_register(struct
 	if (nr_args > rlimit(RLIMIT_NOFILE))
 		return -EMFILE;
 
-	file_data = kzalloc(sizeof(*ctx->file_data), GFP_KERNEL);
+	file_data = kzalloc(sizeof(*ctx->file_data), GFP_KERNEL_ACCOUNT);
 	if (!file_data)
 		return -ENOMEM;
 	file_data->ctx = ctx;

@@ -7592,7 +7592,7 @@ static int io_sqe_files_register(struct
 
 	nr_tables = DIV_ROUND_UP(nr_args, IORING_MAX_FILES_TABLE);
 	file_data->table = kcalloc(nr_tables, sizeof(*file_data->table),
-				   GFP_KERNEL);
+				   GFP_KERNEL_ACCOUNT);
 	if (!file_data->table)
 		goto out_free;
 

From: Damien Le Moal <[email protected]>

commit a680dd72ec336b81511e3bff48efac6dbfa563e7 upstream.

For a request that has a priority level equal to or larger than IOPRIO_BE_NR, bfq_set_next_ioprio_data() prints a critical warning but defaults to setting the request new_ioprio field to IOPRIO_BE_NR. This is not consistent with the warning and the allowed values for priority levels. Fix this by setting the request new_ioprio field to IOPRIO_BE_NR - 1, the lowest priority level allowed.

---
 block/bfq-iosched.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -5011,7 +5011,7 @@ bfq_set_next_ioprio_data(struct bfq_queu
 	if (bfqq->new_ioprio >= IOPRIO_BE_NR) {
 		pr_crit("bfq_set_next_ioprio_data: new_ioprio %d\n",
 			bfqq->new_ioprio);
-		bfqq->new_ioprio = IOPRIO_BE_NR;
+		bfqq->new_ioprio = IOPRIO_BE_NR - 1;
 	}
 
 	bfqq->entity.new_weight = bfq_ioprio_to_weight(bfqq->new_ioprio);

From: Pavel Begunkov <[email protected]>

commit 26578cda3db983b17cabe4e577af26306beb9987 upstream.

->splice_fd_in is used only by splice/tee, but no other request checks it for validity. Add the check for most of request types excluding reads/writes/sends/recvs, we don't want overhead for them and can leave them be as is until the field is actually used.

---
 fs/io_uring.c |   40 ++++++++++++++++++++++++----------------
 1 file changed, 24 insertions(+), 16 deletions(-)

@@ -3746,7 +3746,8 @@ static int io_prep_fsync(struct io_kiocb
 
 	if (unlikely(ctx->flags & IORING_SETUP_IOPOLL))
 		return -EINVAL;
-	if (unlikely(sqe->addr || sqe->ioprio || sqe->buf_index))
+	if (unlikely(sqe->addr || sqe->ioprio || sqe->buf_index ||
+		     sqe->splice_fd_in))
 		return -EINVAL;
 
 	req->sync.flags = READ_ONCE(sqe->fsync_flags);

@@ -3779,7 +3780,8 @@ static int io_fsync(struct io_kiocb *req
 static int io_fallocate_prep(struct io_kiocb *req,
 			     const struct io_uring_sqe *sqe)
 {
-	if (sqe->ioprio || sqe->buf_index || sqe->rw_flags)
+	if (sqe->ioprio || sqe->buf_index || sqe->rw_flags ||
+	    sqe->splice_fd_in)
 		return -EINVAL;
 	if (unlikely(req->ctx->flags & IORING_SETUP_IOPOLL))
 		return -EINVAL;

@@ -3810,7 +3812,7 @@ static int __io_openat_prep(struct io_ki
 	const char __user *fname;
 	int ret;
 
-	if (unlikely(sqe->ioprio || sqe->buf_index))
+	if (unlikely(sqe->ioprio || sqe->buf_index || sqe->splice_fd_in))
 		return -EINVAL;
 	if (unlikely(req->flags & REQ_F_FIXED_FILE))
 		return -EBADF;

@@ -3926,7 +3928,8 @@ static int io_remove_buffers_prep(struct
 	struct io_provide_buf *p = &req->pbuf;
 	u64 tmp;
 
-	if (sqe->ioprio || sqe->rw_flags || sqe->addr || sqe->len || sqe->off)
+	if (sqe->ioprio || sqe->rw_flags || sqe->addr || sqe->len || sqe->off ||
+	    sqe->splice_fd_in)
 		return -EINVAL;
 
 	tmp = READ_ONCE(sqe->fd);

@@ -4002,7 +4005,7 @@ static int io_provide_buffers_prep(struc
 	struct io_provide_buf *p = &req->pbuf;
 	u64 tmp;
 
-	if (sqe->ioprio || sqe->rw_flags)
+	if (sqe->ioprio || sqe->rw_flags || sqe->splice_fd_in)
 		return -EINVAL;
 
 	tmp = READ_ONCE(sqe->fd);

@@ -4095,7 +4098,7 @@ static int io_epoll_ctl_prep(struct io_k
 			     const struct io_uring_sqe *sqe)
 {
 #if defined(CONFIG_EPOLL)
-	if (sqe->ioprio || sqe->buf_index)
+	if (sqe->ioprio || sqe->buf_index || sqe->splice_fd_in)
 		return -EINVAL;
 	if (unlikely(req->ctx->flags & (IORING_SETUP_IOPOLL | IORING_SETUP_SQPOLL)))
 		return -EINVAL;

@@ -4141,7 +4144,7 @@ static int io_epoll_ctl(struct io_kiocb
 static int io_madvise_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
 {
 #if defined(CONFIG_ADVISE_SYSCALLS) && defined(CONFIG_MMU)
-	if (sqe->ioprio || sqe->buf_index || sqe->off)
+	if (sqe->ioprio || sqe->buf_index || sqe->off || sqe->splice_fd_in)
 		return -EINVAL;
 	if (unlikely(req->ctx->flags & IORING_SETUP_IOPOLL))
 		return -EINVAL;

@@ -4176,7 +4179,7 @@ static int io_madvise(struct io_kiocb *r
 
 static int io_fadvise_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
 {
-	if (sqe->ioprio || sqe->buf_index || sqe->addr)
+	if (sqe->ioprio || sqe->buf_index || sqe->addr || sqe->splice_fd_in)
 		return -EINVAL;
 	if (unlikely(req->ctx->flags & IORING_SETUP_IOPOLL))
 		return -EINVAL;

@@ -4214,7 +4217,7 @@ static int io_statx_prep(struct io_kiocb
 {
 	if (unlikely(req->ctx->flags & (IORING_SETUP_IOPOLL | IORING_SETUP_SQPOLL)))
 		return -EINVAL;
-	if (sqe->ioprio || sqe->buf_index)
+	if (sqe->ioprio || sqe->buf_index || sqe->splice_fd_in)
 		return -EINVAL;
 	if (req->flags & REQ_F_FIXED_FILE)
 		return -EBADF;

@@ -4261,7 +4264,7 @@ static int io_close_prep(struct io_kiocb
 	if (unlikely(req->ctx->flags & (IORING_SETUP_IOPOLL|IORING_SETUP_SQPOLL)))
 		return -EINVAL;
 	if (sqe->ioprio || sqe->off || sqe->addr || sqe->len ||
-	    sqe->rw_flags || sqe->buf_index)
+	    sqe->rw_flags || sqe->buf_index || sqe->splice_fd_in)
 		return -EINVAL;
 	if (req->flags & REQ_F_FIXED_FILE)
 		return -EBADF;

@@ -4317,7 +4320,8 @@ static int io_prep_sfr(struct io_kiocb *
 
 	if (unlikely(ctx->flags & IORING_SETUP_IOPOLL))
 		return -EINVAL;
-	if (unlikely(sqe->addr || sqe->ioprio || sqe->buf_index))
+	if (unlikely(sqe->addr || sqe->ioprio || sqe->buf_index ||
+		     sqe->splice_fd_in))
 		return -EINVAL;
 
 	req->sync.off = READ_ONCE(sqe->off);

@@ -4760,7 +4764,7 @@ static int io_accept_prep(struct io_kioc
 
 	if (unlikely(req->ctx->flags & (IORING_SETUP_IOPOLL|IORING_SETUP_SQPOLL)))
 		return -EINVAL;
-	if (sqe->ioprio || sqe->len || sqe->buf_index)
+	if (sqe->ioprio || sqe->len || sqe->buf_index || sqe->splice_fd_in)
 		return -EINVAL;
 
 	accept->addr = u64_to_user_ptr(READ_ONCE(sqe->addr));

@@ -4801,7 +4805,8 @@ static int io_connect_prep(struct io_kio
 
 	if (unlikely(req->ctx->flags & (IORING_SETUP_IOPOLL|IORING_SETUP_SQPOLL)))
 		return -EINVAL;
-	if (sqe->ioprio || sqe->len || sqe->buf_index || sqe->rw_flags)
+	if (sqe->ioprio || sqe->len || sqe->buf_index || sqe->rw_flags ||
+	    sqe->splice_fd_in)
 		return -EINVAL;
 
 	conn->addr = u64_to_user_ptr(READ_ONCE(sqe->addr));

@@ -5553,7 +5558,8 @@ static int io_timeout_remove_prep(struct
 		return -EINVAL;
 	if (unlikely(req->flags & (REQ_F_FIXED_FILE | REQ_F_BUFFER_SELECT)))
 		return -EINVAL;
-	if (sqe->ioprio || sqe->buf_index || sqe->len || sqe->timeout_flags)
+	if (sqe->ioprio || sqe->buf_index || sqe->len || sqe->timeout_flags |
+	    sqe->splice_fd_in)
 		return -EINVAL;
 
 	req->timeout_rem.addr = READ_ONCE(sqe->addr);

@@ -5590,7 +5596,8 @@ static int io_timeout_prep(struct io_kio
 
 	if (unlikely(req->ctx->flags & IORING_SETUP_IOPOLL))
 		return -EINVAL;
-	if (sqe->ioprio || sqe->buf_index || sqe->len != 1)
+	if (sqe->ioprio || sqe->buf_index || sqe->len != 1 ||
+	    sqe->splice_fd_in)
 		return -EINVAL;
 	if (off && is_timeout_link)
 		return -EINVAL;

@@ -5734,7 +5741,8 @@ static int io_async_cancel_prep(struct i
 		return -EINVAL;
 	if (unlikely(req->flags & (REQ_F_FIXED_FILE | REQ_F_BUFFER_SELECT)))
 		return -EINVAL;
-	if (sqe->ioprio || sqe->off || sqe->len || sqe->cancel_flags)
+	if (sqe->ioprio || sqe->off || sqe->len || sqe->cancel_flags ||
+	    sqe->splice_fd_in)
 		return -EINVAL;
 
 	req->cancel.addr = READ_ONCE(sqe->addr);

From: Pavel Begunkov <[email protected]>

commit 2ae2eb9dde18979b40629dd413b9adbd6c894cdf upstream.

When we cancel a timeout we should mark it with REQ_F_FAIL, so linked requests are cancelled as well, but not queued for further execution.

---
 fs/io_uring.c |    2 ++
 1 file changed, 2 insertions(+)

@@ -1498,6 +1498,8 @@ static void io_kill_timeout(struct io_ki
 
 	ret = hrtimer_try_to_cancel(&io->timer);
 	if (ret != -1) {
+		if (status)
+			req_set_fail_links(req);
 		atomic_set(&req->ctx->cq_timeouts,
 			atomic_read(&req->ctx->cq_timeouts) + 1);
 		list_del_init(&req->timeout.list);

From: zhenwei pi <[email protected]>

commit f985911b7bc75d5c98ed24d8aaa8b94c590f7c6a upstream.

Hit kernel warning like this, it can be reproduced by verifying 256 bytes datafile by keyctl command, run script:
RAWDATA=rawdata
SIGDATA=sigdata

modprobe pkcs8_key_parser

rm -rf *.der *.pem *.pfx
rm -rf $RAWDATA
dd if=/dev/random of=$RAWDATA bs=256 count=1

openssl req -nodes -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem \
-subj "/C=CN/ST=GD/L=SZ/O=vihoo/OU=dev/CN=xx.com/[email protected]"

KEY_ID=`openssl pkcs8 -in key.pem -topk8 -nocrypt -outform DER | keyctl \
padd asymmetric 123 @s`

keyctl pkey_sign $KEY_ID 0 $RAWDATA enc=pkcs1 hash=sha1 > $SIGDATA keyctl pkey_verify $KEY_ID 0 $RAWDATA $SIGDATA enc=pkcs1 hash=sha1

Then the kernel reports:

 WARNING: CPU: 5 PID: 344556 at crypto/rsa-pkcs1pad.c:540
   pkcs1pad_verify+0x160/0x190
 ...
 Call Trace:
  public_key_verify_signature+0x282/0x380
  ? software_key_query+0x12d/0x180
  ? keyctl_pkey_params_get+0xd6/0x130
  asymmetric_key_verify_signature+0x66/0x80
  keyctl_pkey_verify+0xa5/0x100
  do_syscall_64+0x35/0xb0
  entry_SYSCALL_64_after_hwframe+0x44/0xae

The reason of this issue, in function 'asymmetric_key_verify_signature':
'.digest_size(u8) = params->in_len(u32)' leads overflow of an u8 value, so use u32 instead of u8 for digest_size field. And reorder struct public_key_signature, it saves 8 bytes on a 64-bit machine.

---
 include/crypto/public_key.h |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

@@ -39,9 +39,9 @@ extern void public_key_free(struct publi
 struct public_key_signature {
 	struct asymmetric_key_id *auth_ids[2];
 	u8 *s;			/* Signature */
-	u32 s_size;		/* Number of bytes in signature */
 	u8 *digest;
-	u8 digest_size;		/* Number of bytes in digest */
+	u32 s_size;		/* Number of bytes in signature */
+	u32 digest_size;	/* Number of bytes in digest */
 	const char *pkey_algo;
 	const char *hash_algo;
 	const char *encoding;

From: Jens Axboe <[email protected]>

commit 87df7fb922d18e96992aa5e824aa34b2065fef59 upstream.

When new work is added, io_wqe_enqueue() checks if we need to wake or create a new worker. But that check is done outside the lock that otherwise synchronizes us with a worker going to sleep, so we can end up in the following situation:

CPU0 CPU1
lock
insert work
unlock
atomic_read(nr_running) != 0
lock atomic_dec(nr_running)
no wakeup needed

Hold the wqe lock around the "need to wakeup" check. Then we can also get rid of the temporary work_flags variable, as we know the work will remain valid as long as we hold the lock.

---
 fs/io-wq.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

@@ -895,7 +895,7 @@ append:
 static void io_wqe_enqueue(struct io_wqe *wqe, struct io_wq_work *work)
 {
 	struct io_wqe_acct *acct = io_work_get_acct(wqe, work);
-	int work_flags;
+	bool do_wake;
 	unsigned long flags;
 
 	/*

@@ -909,14 +909,14 @@ static void io_wqe_enqueue(struct io_wqe
 		return;
 	}
 
-	work_flags = work->flags;
 	raw_spin_lock_irqsave(&wqe->lock, flags);
 	io_wqe_insert_work(wqe, work);
 	wqe->flags &= ~IO_WQE_FLAG_STALLED;
+	do_wake = (work->flags & IO_WQ_WORK_CONCURRENT) ||
+			!atomic_read(&acct->nr_running);
 	raw_spin_unlock_irqrestore(&wqe->lock, flags);
 
-	if ((work_flags & IO_WQ_WORK_CONCURRENT) ||
-	    !atomic_read(&acct->nr_running))
+	if (do_wake)
 		io_wqe_wake_worker(wqe, acct);
 }
 

From: Josef Bacik <[email protected]>

commit ac98141d140444fe93e26471d3074c603b70e2ca upstream.

We use the async_delalloc_pages mechanism to make sure that we've completed our async work before trying to continue our delalloc flushing. The reason for this is we need to see any ordered extents that were created by our delalloc flushing. However we're waking up before we do the submit work, which is before we create the ordered extents. This is a pretty wide race window where we could potentially think there are no ordered extents and thus exit shrink_delalloc prematurely. Fix this by waking us up after we've done the work to create ordered extents.

---
 fs/btrfs/inode.c |   10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

@@ -1202,11 +1202,6 @@ static noinline void async_cow_submit(st
 	nr_pages = (async_chunk->end - async_chunk->start + PAGE_SIZE) >>
 		PAGE_SHIFT;
 
-	/* atomic_sub_return implies a barrier */
-	if (atomic_sub_return(nr_pages, &fs_info->async_delalloc_pages) <
-	    5 * SZ_1M)
-		cond_wake_up_nomb(&fs_info->async_submit_wait);
-
 	/*
 	 * ->inode could be NULL if async_chunk_start has failed to compress,
 	 * in which case we don't have anything to submit, yet we need to

@@ -1215,6 +1210,11 @@ static noinline void async_cow_submit(st
 	 */
 	if (async_chunk->inode)
 		submit_compressed_extents(async_chunk);
+
+	/* atomic_sub_return implies a barrier */
+	if (atomic_sub_return(nr_pages, &fs_info->async_delalloc_pages) <
+	    5 * SZ_1M)
+		cond_wake_up_nomb(&fs_info->async_submit_wait);
 }
 
 static noinline void async_cow_free(struct btrfs_work *work)

From: Desmond Cheong Zhi Xi <[email protected]>

commit 0d977e0eba234e01a60bdde27314dc21374201b3 upstream.

This crash was observed with a failed assertion on device close:

BTRFS: Transaction aborted (error -28)

  WARNING: CPU: 1 PID: 3902 at fs/btrfs/extent-tree.c:2150 btrfs_run_delayed_refs+0x1d2/0x1e0 [btrfs]
  Modules linked in: btrfs blake2b_generic libcrc32c crc32c_intel xor zstd_decompress zstd_compress xxhash lzo_compress lzo_decompress raid6_pq loop
  CPU: 1 PID: 3902 Comm: kworker/u8:4 Not tainted 5.14.0-rc5-default+ #1532
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba527-rebuilt.opensuse.org 04/01/2014
  Workqueue: events_unbound btrfs_async_reclaim_metadata_space [btrfs]
  RIP: 0010:btrfs_run_delayed_refs+0x1d2/0x1e0 [btrfs]
  RSP: 0018:ffffb7a5452d7d80 EFLAGS: 00010282
  RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000
  RDX: 0000000000000001 RSI: ffffffffabee13c4 RDI: 00000000ffffffff
  RBP: ffff97834176a378 R08: 0000000000000001 R09: 0000000000000001
  R10: 0000000000000000 R11: 0000000000000001 R12: ffff97835195d388
  R13: 0000000005b08000 R14: ffff978385484000 R15: 000000000000016c
  FS:  0000000000000000(0000) GS:ffff9783bd800000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 000056190d003fe8 CR3: 000000002a81e005 CR4: 0000000000170ea0
  Call Trace:
   flush_space+0x197/0x2f0 [btrfs]
   btrfs_async_reclaim_metadata_space+0x139/0x300 [btrfs]
   process_one_work+0x262/0x5e0
   worker_thread+0x4c/0x320
   ? process_one_work+0x5e0/0x5e0
   kthread+0x144/0x170
   ? set_kthread_struct+0x40/0x40
   ret_from_fork+0x1f/0x30
  irq event stamp: 19334989
  hardirqs last  enabled at (19334997): [<ffffffffab0e0c87>] console_unlock+0x2b7/0x400
  hardirqs last disabled at (19335006): [<ffffffffab0e0d0d>] console_unlock+0x33d/0x400
  softirqs last  enabled at (19334900): [<ffffffffaba0030d>] __do_softirq+0x30d/0x574
  softirqs last disabled at (19334893): [<ffffffffab0721ec>] irq_exit_rcu+0x12c/0x140
  ---[ end trace 45939e308e0dd3c7 ]---
  BTRFS: error (device vdd) in btrfs_run_delayed_refs:2150: errno=-28 No space left
  BTRFS info (device vdd): forced readonly
  BTRFS warning (device vdd): failed setting block group ro: -30
  BTRFS info (device vdd): suspending dev_replace for unmount
  assertion failed: !test_bit(BTRFS_DEV_STATE_REPLACE_TGT, &device->dev_state), in fs/btrfs/volumes.c:1150
  ------------[ cut here ]------------
  kernel BUG at fs/btrfs/ctree.h:3431!
  invalid opcode: 0000 [#1] PREEMPT SMP
  CPU: 1 PID: 3982 Comm: umount Tainted: G        W         5.14.0-rc5-default+ #1532
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba527-rebuilt.opensuse.org 04/01/2014
  RIP: 0010:assertfail.constprop.0+0x18/0x1a [btrfs]
  RSP: 0018:ffffb7a5454c7db8 EFLAGS: 00010246
  RAX: 0000000000000068 RBX: ffff978364b91c00 RCX: 0000000000000000
  RDX: 0000000000000000 RSI: ffffffffabee13c4 RDI: 00000000ffffffff
  RBP: ffff9783523a4c00 R08: 0000000000000001 R09: 0000000000000001
  R10: 0000000000000000 R11: 0000000000000001 R12: ffff9783523a4d18
  R13: 0000000000000000 R14: 0000000000000004 R15: 0000000000000003
  FS:  00007f61c8f42800(0000) GS:ffff9783bd800000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 000056190cffa810 CR3: 0000000030b96002 CR4: 0000000000170ea0
  Call Trace:
   btrfs_close_one_device.cold+0x11/0x55 [btrfs]
   close_fs_devices+0x44/0xb0 [btrfs]
   btrfs_close_devices+0x48/0x160 [btrfs]
   generic_shutdown_super+0x69/0x100
   kill_anon_super+0x14/0x30
   btrfs_kill_super+0x12/0x20 [btrfs]
   deactivate_locked_super+0x2c/0xa0
   cleanup_mnt+0x144/0x1b0
   task_work_run+0x59/0xa0
   exit_to_user_mode_loop+0xe7/0xf0
   exit_to_user_mode_prepare+0xaf/0xf0
   syscall_exit_to_user_mode+0x19/0x50
   do_syscall_64+0x4a/0x90
   entry_SYSCALL_64_after_hwframe+0x44/0xae

This happens when close_ctree is called while a dev_replace hasn't completed. In close_ctree, we suspend the dev_replace, but keep the replace target around so that we can resume the dev_replace procedure when we mount the root again. This is the call trace:

  close_ctree():
    btrfs_dev_replace_suspend_for_unmount();
    btrfs_close_devices():
      btrfs_close_fs_devices():
        btrfs_close_one_device():
          ASSERT(!test_bit(BTRFS_DEV_STATE_REPLACE_TGT,
                 &device->dev_state));

However, since the replace target sticks around, there is a device with BTRFS_DEV_STATE_REPLACE_TGT set on close, and we fail the assertion in btrfs_close_one_device.

To fix this, if we come across the replace target device when closing, we should properly reset it back to allocation state. This fix also ensures that if a non-target device has a corrupted state and has the BTRFS_DEV_STATE_REPLACE_TGT bit set, the assertion will still catch the error.

---
 fs/btrfs/volumes.c |    3 +++
 1 file changed, 3 insertions(+)

@@ -1129,6 +1129,9 @@ static void btrfs_close_one_device(struc
 		fs_devices->rw_devices--;
 	}
 
+	if (device->devid == BTRFS_DEV_REPLACE_DEVID)
+		clear_bit(BTRFS_DEV_STATE_REPLACE_TGT, &device->dev_state);
+
 	if (test_bit(BTRFS_DEV_STATE_MISSING, &device->dev_state))
 		fs_devices->missing_devices--;
 

From: Niklas Cassel <[email protected]>

commit ead3b768bb51259e3a5f2287ff5fc9041eb6f450 upstream.

Zone management send operations (BLKRESETZONE, BLKOPENZONE, BLKCLOSEZONE and BLKFINISHZONE) should be allowed under the same permissions as write(). (write() does not require CAP_SYS_ADMIN).

Additionally, other ioctls like BLKSECDISCARD and BLKZEROOUT only check if the fd was successfully opened with FMODE_WRITE.
(They do not require CAP_SYS_ADMIN).

Currently, zone management send operations require both CAP_SYS_ADMIN and that the fd was successfully opened with FMODE_WRITE.

Remove the CAP_SYS_ADMIN requirement, so that zone management send operations match the access control requirement of write(), BLKSECDISCARD and BLKZEROOUT.

---
 block/blk-zoned.c |    3 ---
 1 file changed, 3 deletions(-)

@@ -357,9 +357,6 @@ int blkdev_zone_mgmt_ioctl(struct block_
 	if (!blk_queue_is_zoned(q))
 		return -ENOTTY;
 
-	if (!capable(CAP_SYS_ADMIN))
-		return -EACCES;
-
 	if (!(mode & FMODE_WRITE))
 		return -EBADF;
 

This is the start of the stable review cycle for the 5.10.67 release. There are 306 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Sat, 18 Sep 2021 15:57:06 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.67-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 5.10.67-rc1

Amir Goldstein <[email protected]>
fanotify: limit number of event merge attempts

Alyssa Rosenzweig <[email protected]>
drm/panfrost: Clamp lock region to Bifrost minimum

Alyssa Rosenzweig <[email protected]>
drm/panfrost: Use u64 for size in lock_region

Alyssa Rosenzweig <[email protected]>
drm/panfrost: Simplify lock_region calculation

Jerry (Fangzhi) Zuo <[email protected]>
drm/amd/display: Update bounding box states (v2)

Aurabindo Pillai <[email protected]>
drm/amd/display: Update number of DCN3 clock states

Andrey Grodzovsky <[email protected]>
drm/amdgpu: Fix BUG_ON assert

Boris Brezillon <[email protected]>
drm/panfrost: Make sure MMU context lifetime is not bound to panfrost_priv

Rajkumar Subbiah <[email protected]>
drm/dp_mst: Fix return code on sideband message failure

David Heidelberg <[email protected]>

    drm/msi/mdp4: populate priv->kms in mdp4_kms_init

Thomas Zimmermann <[email protected]>
drm/mgag200: Select clock in PLL update functions

Jan Hoffmann <[email protected]>
net: dsa: lantiq_gswip: fix maximum frame length

Kees Cook <[email protected]>
lib/test_stackinit: Fix static initializer test

Patryk Duda <[email protected]>
platform/chrome: cros_ec_proto: Send command again when timeout occurs

sumiyawang <[email protected]>
libnvdimm/pmem: Fix crash triggered when I/O in-flight during unbind

Vasily Averin <[email protected]>
memcg: enable accounting for pids in nested pid namespaces

Rik van Riel <[email protected]>
mm,vmscan: fix divide by zero in get_scan_count

Liu Zixian <[email protected]>
mm/hugetlb: initialize hugetlb_usage in mm_init

Li Zhijian <[email protected]>
mm/hmm: bypass devmap pte when all pfn requested flags are fulfilled

Mike Kravetz <[email protected]>
hugetlb: fix hugetlb cgroup refcounting during vma split

Halil Pasic <[email protected]>
s390/pv: fix the forcing of the swiotlb

Pratik R. Sampat <[email protected]>
cpufreq: powernv: Fix init_chip_info initialization in numa=off

Saurav Kashyap <[email protected]>
scsi: qla2xxx: Sync queue idx with queue_pair_map idx

Saurav Kashyap <[email protected]>
scsi: qla2xxx: Changes to support kdump kernel

Maciej W. Rozycki <[email protected]>
scsi: BusLogic: Fix missing pr_cont() use

chenying <[email protected]>
ovl: fix BUG_ON() in may_delete() when called from ovl_cleanup()

Mikulas Patocka <[email protected]>
parisc: fix crash with signals and alloca

Pavel Begunkov <[email protected]>
io_uring: remove duplicated io_size from rw

David Laight <[email protected]>
fs/io_uring Don't use the return value from import_iovec().

Guojia Liao <[email protected]>
net: hns3: clean up a type mismatch warning

Yang Yingliang <[email protected]>
net: w5100: check return value after calling platform_get_resource()

Haimin Zhang <[email protected]>
fix array-index-out-of-bounds in taprio_change

王贇 <[email protected]>
net: fix NULL pointer reference in cipso_v4_doi_free

Miaoqing Pan <[email protected]>
ath9k: fix sleeping in atomic context

Zekun Shen <[email protected]>
ath9k: fix OOB read ar9300_eeprom_restore_internal

Loic Poulain <[email protected]>
wcn36xx: Fix missing frame timestamp for beacon/probe-resp

Chengfeng Ye <[email protected]>
selftests/bpf: Fix potential unreleased lock

Colin Ian King <[email protected]>
parport: remove non-zero check on count

Yevgeny Kliteynik <[email protected]>
net/mlx5: DR, Enable QP retransmission

Wentao_Liang <[email protected]>
net/mlx5: DR, fix a potential use-after-free bug

Ilan Peer <[email protected]>
iwlwifi: mvm: Fix scan channel flags settings

Johannes Berg <[email protected]>
iwlwifi: fw: correctly limit to monitor dump

Johannes Berg <[email protected]>
iwlwifi: mvm: fix access to BSS elements

Johannes Berg <[email protected]>
iwlwifi: mvm: avoid static queue number aliasing

Zhang Qilong <[email protected]>
iwlwifi: mvm: fix a memory leak in iwl_mvm_mac_ctxt_beacon_changed

Johannes Berg <[email protected]>
iwlwifi: pcie: free RBs during configure

J. Bruce Fields <[email protected]>
nfsd: fix crash on LOCKT on reexported NFSv3

Sean Keely <[email protected]>
drm/amdkfd: Account for SH/SE count when setting up cu masks.

Xiaotan Luo <[email protected]>
ASoC: rockchip: i2s: Fixup config for DAIFMT_DSP_A/B

Sugar Zhang <[email protected]>
ASoC: rockchip: i2s: Fix regmap_ops hang

Shuah Khan <[email protected]>
usbip:vhci_hcd USB port can get stuck in the disabled state

Anirudh Rayabharam <[email protected]>
usbip: give back URBs for unsent unlink requests during cleanup

Nadezda Lutovinova <[email protected]>
usb: musb: musb_dsps: request_irq() after initializing musb

Mathias Nyman <[email protected]>
Revert "USB: xhci: fix U1/U2 handling for hardware with XHCI_INTEL_HOST quirk set"

Ding Hui <[email protected]>
cifs: fix wrong release in sess_alloc_buffer() failed path

Nishad Kamdar <[email protected]>
mmc: core: Return correct emmc response in case of ioctl error

Li Zhijian <[email protected]>
selftests/bpf: Enlarge select() timeout for test_maps

Thomas Hebb <[email protected]>
mmc: rtsx_pci: Fix long reads when clock is prescaled

Manish Narani <[email protected]>
mmc: sdhci-of-arasan: Check return value of non-void funtions

Manish Narani <[email protected]>
mmc: sdhci-of-arasan: Modified SD default speed to 19MHz for ZynqMP

Marc Zyngier <[email protected]>
of: Don't allow __of_attached_node_sysfs() without CONFIG_SYSFS

Gustaw Lewandowski <[email protected]>
ASoC: Intel: Skylake: Fix passing loadable flag for module

Cezary Rojewski <[email protected]>
ASoC: Intel: Skylake: Fix module configuration for KPB and MIXER

Pierre-Louis Bossart <[email protected]>
soundwire: intel: fix potential race condition during power down

Marcos Paulo de Souza <[email protected]>
btrfs: tree-log: check btrfs_lookup_data_extent return value

Arnd Bergmann <[email protected]>
m68knommu: only set CONFIG_ISA_DMA_API for ColdFire sub-arch

Subbaraya Sundeep <[email protected]>
octeontx2-pf: Fix NIX1_RX interface backpressure

Chin-Yen Lee <[email protected]>
rtw88: wow: fix size access error of probe request

Ping-Ke Shih <[email protected]>
rtw88: wow: build wow function only if CONFIG_PM is on

Chin-Yen Lee <[email protected]>
rtw88: use read_poll_timeout instead of fixed sleep

Chris Chiu <[email protected]>
rtl8xxxu: Fix the handling of TX A-MPDU aggregation

Nathan Chancellor <[email protected]>
drm/exynos: Always initialize mapping in exynos_drm_register_dma()

J. Bruce Fields <[email protected]>
lockd: lockd server-side shouldn't set fl_ops

Li Jun <[email protected]>
usb: chipidea: host: fix port index underflow and UBSAN complains

Bob Peterson <[email protected]>
gfs2: Don't call dlm after protocol is unmounted

Mark Brown <[email protected]>
kselftest/arm64: pac: Fix skipping of tests on systems without PAC

Mark Brown <[email protected]>
kselftest/arm64: mte: Fix misleading output when skipping tests

Eli Cohen <[email protected]>
net: Fix offloading indirect devices dependency on qdisc order creation

Kees Cook <[email protected]>
staging: rts5208: Fix get_ms_information() heap buffer size

Brandon Wyman <[email protected]>
hwmon: (pmbus/ibm-cffps) Fix write bits for LED control

Yonghong Song <[email protected]>
selftests/bpf: Fix flaky send_signal test

J. Bruce Fields <[email protected]>
rpc: fix gss_svc_init cleanup on failure

Luke Hsiao <[email protected]>
tcp: enable data-less, empty-cookie SYN with TFO_SERVER_COOKIE_NOT_REQD

Darrick J. Wong <[email protected]>
iomap: pass writeback errors to the mapping

Ulrich Hecht <[email protected]>
serial: sh-sci: fix break handling for sysrq

Rajendra Nayak <[email protected]>
opp: Don't print an error if required-opps is missing

Luiz Augusto von Dentz <[email protected]>
Bluetooth: Fix handling of LE Enhanced Connection Complete

Sagi Grimberg <[email protected]>
nvme: code command_id with a genctr for use-after-free validation

Sagi Grimberg <[email protected]>
nvme-tcp: don't check blk_mq_tag_to_rq when receiving pdu data

Raag Jadav <[email protected]>
arm64: dts: ls1046a: fix eeprom entries

Thierry Reding <[email protected]>
arm64: tegra: Fix compatible string for Tegra132 CPUs

Andreas Obergschwandtner <[email protected]>
ARM: tegra: tamonten: Fix UART pad setting

Dmitry Osipenko <[email protected]>
ARM: tegra: acer-a500: Remove bogus USB VBUS regulators

Johan Almbladh <[email protected]>
mac80211: Fix monitor MTU limit so that A-MSDUs get through

Tuo Li <[email protected]>
drm/display: fix possible null-pointer dereference in dcn10_set_clock()

Tuo Li <[email protected]>
gpu: drm: amd: amdgpu: amdgpu_i2c: fix possible uninitialized-variable access in amdgpu_i2c_router_select_ddc_port()

Eran Ben Elisha <[email protected]>
net/mlx5: Fix variable type to match 64bit

Kuogee Hsieh <[email protected]>
drm/msm/dp: return correct edid checksum after corrupted edid checksum read

Desmond Cheong Zhi Xi <[email protected]>
Bluetooth: avoid circular locks in sco_sock_connect

Desmond Cheong Zhi Xi <[email protected]>
Bluetooth: schedule SCO timeouts with delayed_work

Desmond Cheong Zhi Xi <[email protected]>
drm/vmwgfx: fix potential UAF in vmwgfx_surface.c

Jussi Maki <[email protected]>
selftests/bpf: Fix xdp_tx.c prog section name

Roy Chan <[email protected]>
drm/amd/display: fix incorrect CM/TF programming sequence in dwb

Roy Chan <[email protected]>
drm/amd/display: fix missing writeback disablement if plane is removed

Sanjay R Mehta <[email protected]>
thunderbolt: Fix port linking by checking all adapters

Quanyang Wang <[email protected]>
drm: xlnx: zynqmp: release reset to DP controller before accessing DP registers

Quanyang Wang <[email protected]>
drm: xlnx: zynqmp_dpsub: Call pm_runtime_get_sync before setting pixel clock

Konrad Dybcio <[email protected]>
drm/msm/dsi: Fix DSI and DSI PHY regulator config from SDM660

David Heidelberg <[email protected]>
drm/msm: mdp4: drop vblank get/put from prepare/complete_commit

Nathan Chancellor <[email protected]>
net: ethernet: stmmac: Do not use unreachable() in ipq806x_gmac_probe()

Rajendra Nayak <[email protected]>
nvmem: qfprom: Fix up qfprom_disable_fuse_blowing() ordering

Georgi Djakov <[email protected]>
arm64: dts: qcom: sm8250: Fix epss_l3 unit address

Vinod Koul <[email protected]>
arm64: dts: qcom: msm8996: don't use underscore in node name

Vinod Koul <[email protected]>
arm64: dts: qcom: msm8994: don't use underscore in node name

Vinod Koul <[email protected]>
arm64: dts: qcom: sdm630: don't use underscore in node name

Vinod Koul <[email protected]>

    arm64: dts: qcom: ipq6018: drop '0x' from unit address

Vinod Koul <[email protected]>
arm64: dts: qcom: sdm660: use reg value for memory node

Vinod Koul <[email protected]>
arm64: dts: qcom: ipq8074: fix pci node reg property

Sebastian Reichel <[email protected]>
ARM: dts: imx53-ppd: Fix ACHC entry

Tony Lindgren <[email protected]>
serial: 8250_omap: Handle optional overrun-throttle-ms property

AngeloGioacchino Del Regno <[email protected]>
arm64: dts: qcom: sdm630: Fix TLMM node and pinctrl configuration

AngeloGioacchino Del Regno <[email protected]>
arm64: dts: qcom: sdm630: Rewrite memory map

Bob Peterson <[email protected]>
gfs2: Fix glock recursion in freeze_go_xmote_bh

Evgeny Novikov <[email protected]>
media: tegra-cec: Handle errors of clk_prepare_enable()

Krzysztof Hałasa <[email protected]>
media: TDA1997x: fix tda1997x_query_dv_timings() return value

Hans Verkuil <[email protected]>
media: v4l2-dv-timings.c: fix wrong condition in two for-loops

Umang Jain <[email protected]>
media: imx258: Limit the max analogue gain to 480

Laurent Pinchart <[email protected]>
media: imx258: Rectify mismatch of VTS value

Pierre-Louis Bossart <[email protected]>
ASoC: Intel: update sof_pcm512x quirks

Hans de Goede <[email protected]>
ASoC: Intel: bytcr_rt5640: Move "Platform Clock" routes to the maps for the matching in-/output

Vidya Sagar <[email protected]>
arm64: tegra: Fix Tegra194 PCIe EP compatible string

Nicolas Ferre <[email protected]>
ARM: dts: at91: use the right property for shutdown controller

Yufeng Mo <[email protected]>
bonding: 3ad: fix the concurrency between __bond_release_one() and bond_3ad_state_machine_handler()

Marek Vasut <[email protected]>
ARM: dts: stm32: Update AV96 adv7513 node per dtbs_check

Marek Vasut <[email protected]>
ARM: dts: stm32: Set {bitclock,frame}-master phandles on ST DKx

Marek Vasut <[email protected]>
ARM: dts: stm32: Set {bitclock,frame}-master phandles on DHCOM SoM

Zhen Lei <[email protected]>
workqueue: Fix possible memory leaks in wq_numa_init()

Desmond Cheong Zhi Xi <[email protected]>
Bluetooth: skip invalid hci_sync_conn_complete_evt

Andy Shevchenko <[email protected]>
ata: sata_dwc_460ex: No need to call phy_exit() befre phy_init()

Martynas Pumputis <[email protected]>
libbpf: Fix race when pinning maps in parallel

Juhee Kang <[email protected]>
samples: bpf: Fix tracex7 error raised on the missing argument

Christophe JAILLET <[email protected]>
staging: ks7010: Fix the initialization of the 'sleep_status' structure

Greg Kroah-Hartman <[email protected]>
serial: 8250_pci: make setup_port() parameters explicitly unsigned

Jiri Slaby <[email protected]>
hvsi: don't panic on tty_register_driver failure

Jiri Slaby <[email protected]>
xtensa: ISS: don't panic in rs_init

Maciej W. Rozycki <[email protected]>
serial: 8250: Define RX trigger levels for OxSemi 950 devices

Niklas Schnelle <[email protected]>
s390: make PCI mio support a machine flag

Heiko Carstens <[email protected]>
s390/jump_label: print real address in a case of a jump label bug

Gustavo A. R. Silva <[email protected]>
flow_dissector: Fix out-of-bounds warnings

Gustavo A. R. Silva <[email protected]>
ipv4: ip_output.c: Fix out-of-bounds warning in ip_copy_addrs()

Zheyu Ma <[email protected]>
video: fbdev: riva: Error out if 'pixclock' equals zero

Zheyu Ma <[email protected]>
video: fbdev: kyro: Error out if 'pixclock' equals zero

Zheyu Ma <[email protected]>
video: fbdev: asiliantfb: Error out if 'pixclock' equals zero

Jernej Skrabec <[email protected]>
arm64: dts: allwinner: h6: tanix-tx6: Fix regulator node names

Geert Uytterhoeven <[email protected]>
drm/bridge: nwl-dsi: Avoid potential multiplication overflow on 32-bit

Johan Almbladh <[email protected]>
bpf/tests: Do not PASS tests without actually testing the result

Johan Almbladh <[email protected]>
bpf/tests: Fix copy-and-paste error in double word test

Anson Jacob <[email protected]>
drm/amd/amdgpu: Update debugfs link_settings output link_rate field in hex

Oak Zeng <[email protected]>
drm/amdgpu: Fix a printing message

Arnd Bergmann <[email protected]>
ethtool: improve compat ioctl handling

Niklas Söderlund <[email protected]>
nfp: fix return statement in nfp_net_parse_meta()

Yang Yingliang <[email protected]>
media: atomisp: pci: fix error return code in atomisp_pci_probe()

Dinghao Liu <[email protected]>
media: atomisp: Fix runtime PM imbalance in atomisp_pci_probe

Evgeny Novikov <[email protected]>
media: platform: stm32: unprepare clocks at handling errors in probe

Ezequiel Garcia <[email protected]>
media: hantro: vp8: Move noisy WARN_ON to vpu_debug

Oliver Logush <[email protected]>
drm/amd/display: Fix timer_per_pixel unit error

Shuah Khan <[email protected]>
selftests: firmware: Fix ignored return val of asprintf() warn

Laurentiu Tudor <[email protected]>
bus: fsl-mc: fix mmio base address for child DPRCs

Zheyu Ma <[email protected]>
tty: serial: jsm: hold port lock when reporting modem line changes

Geert Uytterhoeven <[email protected]>
staging: board: Fix uninitialized spinlock when attaching genpd

Jack Pham <[email protected]>
usb: gadget: composite: Allow bMaxPower=0 if self-powered

Evgeny Novikov <[email protected]>
USB: EHCI: ehci-mv: improve error handling in mv_ehci_enable()

Maciej Żenczykowski <[email protected]>
usb: gadget: u_ether: fix a potential null pointer dereference

Kelly Devilliv <[email protected]>
usb: host: fotg210: fix the actual_length of an iso packet

Kelly Devilliv <[email protected]>
usb: host: fotg210: fix the endpoint's transactional opportunities calculation

Sasha Neftin <[email protected]>
igc: Check if num of q_vectors is smaller than max before array access

Zhouyi Zhou <[email protected]>
rcu: Fix macro name CONFIG_TASKS_RCU_TRACE

Desmond Cheong Zhi Xi <[email protected]>
drm: protect drm_master pointers in drm_lease.c

Desmond Cheong Zhi Xi <[email protected]>
drm: serialize drm_file.master with a new spinlock

Desmond Cheong Zhi Xi <[email protected]>
drm: avoid blocking in drm_clients_info's rcu section

Tianjia Zhang <[email protected]>
Smack: Fix wrong semantics in smk_access_entry()

Yajun Deng <[email protected]>
netlink: Deal with ESRCH error in nlmsg_notify()

Zheyu Ma <[email protected]>
video: fbdev: kyro: fix a DoS bug by restricting user input

David Heidelberg <[email protected]>
ARM: dts: qcom: apq8064: correct clock names

Stefan Assmann <[email protected]>
iavf: fix locking of critical sections

Stefan Assmann <[email protected]>
iavf: do not override the adapter state in the watchdog task

Jonathan Cameron <[email protected]>
iio: dac: ad5624r: Fix incorrect handling of an optional regulator.

Marek Vasut <[email protected]>

    net: phy: Fix data type in DP83822 dp8382x_disable_wol()

Xin Long <[email protected]>
tipc: keep the skb in rcv queue until the whole data is read

Rafael J. Wysocki <[email protected]>
PCI: Use pci_update_current_state() in pci_enable_device_flags()

Sean Anderson <[email protected]>
crypto: mxs-dcp - Use sg_mapping_iter to copy data

Ani Sinha <[email protected]>
x86/hyperv: fix for unwanted manipulation of sched_clock when TSC marked unstable

Martynas Pumputis <[email protected]>
libbpf: Fix reuse of pinned map on older kernel

Mauro Carvalho Chehab <[email protected]>
media: dib8000: rewrite the init prbs logic

Randy Dunlap <[email protected]>
ASoC: atmel: ATMEL drivers don't need HAS_DMA

Luben Tuikov <[email protected]>
drm/amdgpu: Fix amdgpu_ras_eeprom_init()

Dom Cobley <[email protected]>
drm/vc4: hdmi: Set HD_CTL_WHOLSMP and HD_CTL_CHALIGN_SET

Nadav Amit <[email protected]>
userfaultfd: prevent concurrent API initialization

Masahiro Yamada <[email protected]>
kbuild: Fix 'no symbols' warning when CONFIG_TRIM_UNUSD_KSYMS=y

Oleksij Rempel <[email protected]>
MIPS: Malta: fix alignment of the devicetree buffer

Jaegeuk Kim <[email protected]>
f2fs: should put a page beyond EOF when preparing a write

Jaegeuk Kim <[email protected]>
f2fs: deallocate compressed pages when error happens

Chao Yu <[email protected]>
f2fs: fix to unmap pages from userspace process in punch_hole()

Chao Yu <[email protected]>
f2fs: fix unexpected ENOENT comes from f2fs_map_blocks()

Chao Yu <[email protected]>
f2fs: fix to account missing .skipped_gc_rwsem

Yongqiang Niu <[email protected]>
soc: mediatek: cmdq: add address shift in jump

Alexey Kardashevskiy <[email protected]>
KVM: PPC: Fix clearing never mapped TCEs in realmode

Codrin Ciubotariu <[email protected]>
clk: at91: clk-generated: Limit the requested rate to our range

David Howells <[email protected]>
fscache: Fix cookie key hashing

Wenpeng Liang <[email protected]>
RDMA/hns: Fix QP's resp incomplete assignment

Srikar Dronamraju <[email protected]>
powerpc/smp: Update cpu_core_map on all PowerPc systems

Hans de Goede <[email protected]>
platform/x86: dell-smbios-wmi: Add missing kfree in error-exit from run_smbios_call

Nicholas Piggin <[email protected]>
KVM: PPC: Book3S HV Nested: Reflect guest PMU in-use to L0 when guest SPRs are live

Alim Akhtar <[email protected]>
scsi: ufs: ufs-exynos: Fix static checker warning

Fabiano Rosas <[email protected]>
KVM: PPC: Book3S HV: Fix copy_tofrom_guest routines

Ahmad Fatoum <[email protected]>
clk: imx8m: fix clock tree update of TF-A managed clocks

Jim Broadus <[email protected]>
HID: i2c-hid: Fix Elan touchpad regression

Lu Baolu <[email protected]>
iommu/vt-d: Update the virtual command related registers

Joel Stanley <[email protected]>
powerpc/config: Renable MTD_PHYSMAP_OF

Dan Carpenter <[email protected]>
scsi: qedf: Fix error codes in qedf_alloc_global_queues()

Dan Carpenter <[email protected]>
scsi: qedi: Fix error codes in qedi_alloc_global_queues()

Dan Carpenter <[email protected]>
scsi: smartpqi: Fix an error code in pqi_get_raid_map()

Laurent Dufour <[email protected]>
powerpc/numa: Consider the max NUMA node for migratable LPAR

Zhen Lei <[email protected]>
pinctrl: single: Fix error return code in pcs_parse_bits_in_pinctrl_entry()

Wei Li <[email protected]>
scsi: fdomain: Fix error return code in fdomain_probe()

Anna Schumaker <[email protected]>
sunrpc: Fix return value of get_srcport()

Olga Kornievskaia <[email protected]>
SUNRPC query transport's source port

Trond Myklebust <[email protected]>
SUNRPC/xprtrdma: Fix reconnection locking

Trond Myklebust <[email protected]>
SUNRPC: Fix potential memory corruption

Trond Myklebust <[email protected]>
NFSv4/pnfs: The layout barrier indicate a minimal value for the seqid

Trond Myklebust <[email protected]>
NFSv4/pNFS: Always allow update of a zero valued layout barrier

Trond Myklebust <[email protected]>
NFSv4/pNFS: Fix a layoutget livelock loop

Anthony Iliopoulos <[email protected]>
dma-debug: fix debugfs initialization order

Randy Dunlap <[email protected]>
openrisc: don't printk() unconditionally

Yangtao Li <[email protected]>

    f2fs: reduce the scope of setting fsck tag when de->name_len is zero

Nathan Chancellor <[email protected]>
cpuidle: pseries: Mark pseries_idle_proble() as __init

Leon Romanovsky <[email protected]>
RDMA/mlx5: Delete not-available udata check

Leon Romanovsky <[email protected]>
RDMA/efa: Remove double QP type assignment

Michal Suchanek <[email protected]>
powerpc/stacktrace: Include linux/delay.h

Gautham R. Shenoy <[email protected]>
cpuidle: pseries: Fixup CEDE0 latency only for POWER10 onwards

Bart Van Assche <[email protected]>
scsi: ufs: Fix memory corruption by ufshcd_read_desc_param()

Jason Gunthorpe <[email protected]>
vfio: Use config not menuconfig for VFIO_NOIOMMU

Jaehyoung Choi <[email protected]>
pinctrl: samsung: Fix pinctrl bank pin count

Colin Ian King <[email protected]>
scsi: BusLogic: Use %X for u32 sized integer rather than %lX

Leon Romanovsky <[email protected]>
docs: Fix infiniband uverbs minor number

Leon Romanovsky <[email protected]>
RDMA/iwcm: Release resources if iw_cm module initialization fails

Mike Marciniszyn <[email protected]>
IB/hfi1: Adjust pkey entry in index 0

Peter Geis <[email protected]>
clk: rockchip: drop GRF dependency for rk3328/rk3036 pll types

Christoph Hellwig <[email protected]>
scsi: bsg: Remove support for SCSI_IOCTL_SEND_COMMAND

Marek Behún <[email protected]>
pinctrl: armada-37xx: Correct PWM pins definitions

Zhaoyu Liu <[email protected]>
pinctrl: remove empty lines in pinctrl subsystem

Chao Yu <[email protected]>
f2fs: quota: fix potential deadlock

Dmitry Torokhov <[email protected]>
HID: input: do not report stylus battery state as "full"

Pali Rohár <[email protected]>
PCI: aardvark: Fix masking and unmasking legacy INTx interrupts

Evan Wang <[email protected]>
PCI: aardvark: Fix checking for PIO status

Jianjun Wang <[email protected]>
PCI: Export pci_pio_to_address() for module use

Pali Rohár <[email protected]>
PCI: aardvark: Configure PCIe resources from 'ranges' DT property

Hyun Kwon <[email protected]>
PCI: xilinx-nwl: Enable the clock through CCF

Krzysztof Wilczyński <[email protected]>
PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure

Marek Behún <[email protected]>
PCI: Restrict ASMedia ASM1062 SATA Max Payload Size Supported

Stuart Hayes <[email protected]>
PCI/portdrv: Enable Bandwidth Notification only if port supports it

Chao Yu <[email protected]>
f2fs: fix to do sanity check for sb/cp fields correctly

David Heidelberg <[email protected]>
ARM: 9105/1: atags_to_fdt: don't warn about stack size

Hans de Goede <[email protected]>
libata: add ATA_HORKAGE_NO_NCQ_TRIM for Samsung 860 and 870 SSDs

Robin Gong <[email protected]>
dmaengine: imx-sdma: remove duplicated sdma_load_context

Robin Gong <[email protected]>
Revert "dmaengine: imx-sdma: refine to load context only once"

Julian Wiedmann <[email protected]>
s390/qdio: cancel the ESTABLISH ccw after timeout

Julian Wiedmann <[email protected]>
s390/qdio: fix roll-back after timeout on ESTABLISH ccw

Sean Young <[email protected]>
media: rc-loopback: return number of emitters rather than error

Mauro Carvalho Chehab <[email protected]>
media: uvc: don't do DMA on stack

Wang Hai <[email protected]>
VMCI: fix NULL pointer dereference when unmapping queue pair

Brijesh Singh <[email protected]>
crypto: ccp - shutdown SEV firmware on kexec

Arne Welzel <[email protected]>
dm crypt: Avoid percpu_counter spinlock contention in crypt_page_alloc()

Kevin Hao <[email protected]>
cpufreq: schedutil: Use kobject release() method to free sugov_tunables

Krzysztof Kozlowski <[email protected]>
power: supply: max17042: handle fails of reading status register

Damien Le Moal <[email protected]>
block: bfq: fix bfq_set_next_ioprio_data()

zhenwei pi <[email protected]>
crypto: public_key: fix overflow during implicit conversion

Joseph Gates <[email protected]>
wcn36xx: Ensure finish scan is not requested before start scan

Nuno Sá <[email protected]>
iio: ltc2983: fix device probe

Mark Rutland <[email protected]>
arm64: head: avoid over-mapping in map_memory

Will Deacon <[email protected]>
arm64: mm: Fix TLBI vs ASID rollover

Iwona Winiarska <[email protected]>
soc: aspeed: p2a-ctrl: Fix boundary check for mmap

Iwona Winiarska <[email protected]>
soc: aspeed: lpc-ctrl: Fix boundary check for mmap

Manivannan Sadhasivam <[email protected]>
soc: qcom: aoss: Fix the out of bound usage of cooling_devs

Paul Cercueil <[email protected]>
pinctrl: ingenic: Fix incorrect pull up/down info

Marc Zyngier <[email protected]>

    pinctrl: stmfx: Fix hazardous u8[] to unsigned long cast

Dinh Nguyen <[email protected]>
clk: socfpga: agilex: add the bypass register for s2f_usr0 clock

Dinh Nguyen <[email protected]>
clk: socfpga: agilex: fix up s2f_user0_clk representation

Dinh Nguyen <[email protected]>
clk: socfpga: agilex: fix the parents of the psi_ref_clk

Rolf Eike Beer <[email protected]>
tools/thermal/tmon: Add cross compiling support

Steven Rostedt (VMware) <[email protected]>
selftests/ftrace: Fix requirement check of README file

Colin Ian King <[email protected]>
ceph: fix dereference of null pointer cf

Harshvardhan Jha <[email protected]>
9p/xen: Fix end of loop tests for list_for_each_entry

Juergen Gross <[email protected]>
xen: fix setting of max_pfn in shared_info

Kajol Jain <[email protected]>
powerpc/perf/hv-gpci: Fix counter value parsing

Marek Marczykowski-Górecki <[email protected]>
PCI/MSI: Skip masking MSI-X on Xen PV

Niklas Cassel <[email protected]>
blk-zoned: allow BLKREPORTZONE without CAP_SYS_ADMIN

Niklas Cassel <[email protected]>
blk-zoned: allow zone management send operations without CAP_SYS_ADMIN

Desmond Cheong Zhi Xi <[email protected]>
btrfs: reset replace target device to allocation state on close

Josef Bacik <[email protected]>
btrfs: wake up async_delalloc_pages waiters after submit

Jens Axboe <[email protected]>
io-wq: fix wakeup race when adding new work

Pavel Begunkov <[email protected]>
io_uring: fail links of cancelled timeouts

Pavel Begunkov <[email protected]>

    io_uring: add ->splice_fd_in checks

Pavel Begunkov <[email protected]>
io_uring: place fixed tables under memcg limits

Pavel Begunkov <[email protected]>
io_uring: limit fixed table size by RLIMIT_NOFILE

Dmitry Osipenko <[email protected]>
rtc: tps65910: Correct driver module alias

-------------

Diffstat:

 Documentation/admin-guide/devices.txt              |   6 +-
 .../pinctrl/marvell,armada-37xx-pinctrl.txt        |   8 +-
 Makefile                                           |   4 +-
 arch/arm/boot/compressed/Makefile                  |   2 +
 arch/arm/boot/dts/at91-kizbox3_common.dtsi         |   2 +-
 arch/arm/boot/dts/at91-sam9x60ek.dts               |   2 +-
 arch/arm/boot/dts/at91-sama5d27_som1_ek.dts        |   2 +-
 arch/arm/boot/dts/at91-sama5d27_wlsom1_ek.dts      |   2 +-
 arch/arm/boot/dts/at91-sama5d2_icp.dts             |   2 +-
 arch/arm/boot/dts/at91-sama5d2_ptc_ek.dts          |   2 +-
 arch/arm/boot/dts/at91-sama5d2_xplained.dts        |   2 +-
 arch/arm/boot/dts/imx53-ppd.dts                    |  23 +-
 arch/arm/boot/dts/qcom-apq8064.dtsi                |   6 +-
 arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi      |   8 +-
 arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi |   6 +-
 arch/arm/boot/dts/stm32mp15xx-dkx.dtsi             |   8 +-
 arch/arm/boot/dts/tegra20-acer-a500-picasso.dts    |  25 +-
 arch/arm/boot/dts/tegra20-tamonten.dtsi            |  14 +-
 .../boot/dts/allwinner/sun50i-h6-tanix-tx6.dts     |   4 +-
 arch/arm64/boot/dts/freescale/fsl-ls1046a-frwy.dts |   8 +-
 arch/arm64/boot/dts/freescale/fsl-ls1046a-rdb.dts  |   7 +-
 arch/arm64/boot/dts/nvidia/tegra132.dtsi           |   4 +-
 arch/arm64/boot/dts/nvidia/tegra194.dtsi           |   6 +-
 arch/arm64/boot/dts/qcom/ipq6018.dtsi              |   2 +-
 arch/arm64/boot/dts/qcom/ipq8074-hk01.dts          |   2 +-
 arch/arm64/boot/dts/qcom/ipq8074.dtsi              |  16 +-
 arch/arm64/boot/dts/qcom/msm8994.dtsi              |   6 +-
 arch/arm64/boot/dts/qcom/msm8996.dtsi              |   4 +-
 arch/arm64/boot/dts/qcom/sdm630.dtsi               | 257 ++++++++++++--------
 arch/arm64/boot/dts/qcom/sm8250.dtsi               |   2 +-
 arch/arm64/include/asm/kernel-pgtable.h            |   4 +-
 arch/arm64/include/asm/mmu.h                       |  29 ++-
 arch/arm64/include/asm/tlbflush.h                  |  11 +-
 arch/arm64/kernel/head.S                           |  11 +-
 arch/m68k/Kconfig.bus                              |   2 +-
 arch/mips/mti-malta/malta-dtshim.c                 |   2 +-
 arch/openrisc/kernel/entry.S                       |   2 +
 arch/parisc/kernel/signal.c                        |   6 +
 arch/powerpc/configs/mpc885_ads_defconfig          |   1 +
 arch/powerpc/include/asm/pmc.h                     |   7 +
 arch/powerpc/kernel/smp.c                          |  11 +-
 arch/powerpc/kernel/stacktrace.c                   |   1 +
 arch/powerpc/kvm/book3s_64_mmu_radix.c             |   6 +-
 arch/powerpc/kvm/book3s_64_vio_hv.c                |   9 +-
 arch/powerpc/kvm/book3s_hv.c                       |  20 ++
 arch/powerpc/mm/numa.c                             |  13 +-
 arch/powerpc/perf/hv-gpci.c                        |   2 +-
 arch/s390/include/asm/setup.h                      |   2 +
 arch/s390/kernel/early.c                           |   4 +
 arch/s390/kernel/jump_label.c                      |   2 +-
 arch/s390/mm/init.c                                |   2 +-
 arch/s390/pci/pci.c                                |   5 +-
 arch/x86/kernel/cpu/mshyperv.c                     |   9 +-
 arch/x86/xen/p2m.c                                 |   4 +-
 arch/xtensa/platforms/iss/console.c                |  17 +-
 block/bfq-iosched.c                                |   2 +-
 block/blk-zoned.c                                  |   6 -
 block/bsg.c                                        |   5 +-
 drivers/ata/libata-core.c                          |   4 +
 drivers/ata/sata_dwc_460ex.c                       |  12 +-
 drivers/bus/fsl-mc/fsl-mc-bus.c                    |  24 +-
 drivers/clk/at91/clk-generated.c                   |   6 +
 drivers/clk/imx/clk-composite-8m.c                 |   3 +-
 drivers/clk/imx/clk-imx8mm.c                       |   7 +-
 drivers/clk/imx/clk-imx8mn.c                       |   7 +-
 drivers/clk/imx/clk-imx8mq.c                       |   7 +-
 drivers/clk/imx/clk.h                              |  16 +-
 drivers/clk/rockchip/clk-pll.c                     |   2 +-
 drivers/clk/socfpga/clk-agilex.c                   |  19 +-
 drivers/cpufreq/powernv-cpufreq.c                  |  16 +-
 drivers/cpuidle/cpuidle-pseries.c                  |  18 +-
 drivers/crypto/ccp/sev-dev.c                       |  49 ++--
 drivers/crypto/ccp/sp-pci.c                        |  12 +
 drivers/crypto/mxs-dcp.c                           |  36 +--
 drivers/dma/imx-sdma.c                             |  13 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_i2c.c            |   2 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_object.c         |   2 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c     |   2 +-
 drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c              |   2 +-
 drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c              |   2 +-
 drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c              |   2 +-
 drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c              |   2 +-
 drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c       |  84 +++++--
 drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.h       |   1 +
 .../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c  |  16 +-
 .../drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c  |  11 +-
 drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c |  14 +-
 .../gpu/drm/amd/display/dc/dcn20/dcn20_resource.c  |   2 +-
 .../gpu/drm/amd/display/dc/dcn30/dcn30_dwb_cm.c    |  90 +++++--
 drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c |  12 +-
 .../gpu/drm/amd/display/dc/dcn30/dcn30_resource.c  |  42 +++-
 drivers/gpu/drm/bridge/nwl-dsi.c                   |   2 +-
 drivers/gpu/drm/drm_auth.c                         |  42 +++-
 drivers/gpu/drm/drm_debugfs.c                      |   3 +-
 drivers/gpu/drm/drm_dp_mst_topology.c              |  10 +-
 drivers/gpu/drm/drm_file.c                         |   1 +
 drivers/gpu/drm/drm_lease.c                        |  81 +++++--
 drivers/gpu/drm/exynos/exynos_drm_dma.c            |   2 +
 drivers/gpu/drm/mgag200/mgag200_drv.h              |  16 ++
 drivers/gpu/drm/mgag200/mgag200_mode.c             |  20 +-
 drivers/gpu/drm/mgag200/mgag200_reg.h              |   9 +-
 drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c           |  17 +-
 drivers/gpu/drm/msm/dp/dp_panel.c                  |   9 +-
 drivers/gpu/drm/msm/dsi/dsi_cfg.c                  |   1 -
 drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c         |   2 +-
 drivers/gpu/drm/panfrost/panfrost_device.h         |   8 +-
 drivers/gpu/drm/panfrost/panfrost_drv.c            |  50 +---
 drivers/gpu/drm/panfrost/panfrost_gem.c            |  20 +-
 drivers/gpu/drm/panfrost/panfrost_job.c            |   4 +-
 drivers/gpu/drm/panfrost/panfrost_mmu.c            | 191 +++++++++------
 drivers/gpu/drm/panfrost/panfrost_mmu.h            |   5 +-
 drivers/gpu/drm/panfrost/panfrost_regs.h           |   2 +
 drivers/gpu/drm/vc4/vc4_hdmi.c                     |   4 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_surface.c            |   4 +-
 drivers/gpu/drm/xlnx/zynqmp_disp.c                 |   3 +-
 drivers/gpu/drm/xlnx/zynqmp_dp.c                   |  22 +-
 drivers/hid/hid-input.c                            |   2 -
 drivers/hid/i2c-hid/i2c-hid-core.c                 |   5 +-
 drivers/hwmon/pmbus/ibm-cffps.c                    |   6 +-
 drivers/iio/dac/ad5624r_spi.c                      |  18 +-
 drivers/iio/temperature/ltc2983.c                  |  30 ++-
 drivers/infiniband/core/iwcm.c                     |  19 +-
 drivers/infiniband/hw/efa/efa_verbs.c              |   1 -
 drivers/infiniband/hw/hfi1/init.c                  |   7 +-
 drivers/infiniband/hw/hns/hns_roce_qp.c            |   3 +-
 drivers/infiniband/hw/mlx5/qp.c                    |   3 -
 drivers/iommu/intel/pasid.h                        |  10 +-
 drivers/mailbox/mtk-cmdq-mailbox.c                 |   3 +-
 drivers/md/dm-crypt.c                              |   7 +-
 drivers/media/cec/platform/stm32/stm32-cec.c       |  26 +-
 drivers/media/cec/platform/tegra/tegra_cec.c       |  10 +-
 drivers/media/dvb-frontends/dib8000.c              |  58 +++--
 drivers/media/i2c/imx258.c                         |   4 +-
 drivers/media/i2c/tda1997x.c                       |   5 +-
 drivers/media/rc/rc-loopback.c                     |   2 +-
 drivers/media/usb/uvc/uvc_v4l2.c                   |  34 ++-
 drivers/media/v4l2-core/v4l2-dv-timings.c          |   4 +-
 drivers/misc/vmw_vmci/vmci_queue_pair.c            |   6 +-
 drivers/mmc/core/block.c                           |   3 +-
 drivers/mmc/host/rtsx_pci_sdmmc.c                  |  36 ++-
 drivers/mmc/host/sdhci-of-arasan.c                 |  36 ++-
 drivers/net/bonding/bond_main.c                    |   3 +-
 drivers/net/dsa/lantiq_gswip.c                     |   3 +-
 .../net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c |   9 +-
 drivers/net/ethernet/intel/iavf/iavf_main.c        |  58 ++++-
 drivers/net/ethernet/intel/igc/igc_main.c          |   9 +-
 .../ethernet/marvell/octeontx2/nic/otx2_common.c   |  15 ++
 drivers/net/ethernet/mellanox/mlx5/core/cmd.c      |   8 +-
 .../ethernet/mellanox/mlx5/core/steering/dr_rule.c |   2 +-
 .../ethernet/mellanox/mlx5/core/steering/dr_send.c |   1 +
 .../net/ethernet/netronome/nfp/nfp_net_common.c    |   2 +-
 .../net/ethernet/stmicro/stmmac/dwmac-ipq806x.c    |  18 +-
 drivers/net/ethernet/wiznet/w5100.c                |   2 +
 drivers/net/phy/dp83822.c                          |   8 +-
 drivers/net/wireless/ath/ath9k/ar9003_eeprom.c     |   3 +-
 drivers/net/wireless/ath/ath9k/hw.c                |  12 +-
 drivers/net/wireless/ath/wcn36xx/main.c            |   5 +-
 drivers/net/wireless/ath/wcn36xx/txrx.c            |   4 +
 drivers/net/wireless/ath/wcn36xx/wcn36xx.h         |   1 +
 drivers/net/wireless/intel/iwlwifi/fw/dbg.c        |   2 +-
 drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c  |   4 +-
 drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c  |   8 +-
 drivers/net/wireless/intel/iwlwifi/mvm/ops.c       |  24 +-
 drivers/net/wireless/intel/iwlwifi/mvm/scan.c      |   2 +-
 drivers/net/wireless/intel/iwlwifi/mvm/sta.c       |  30 ++-
 drivers/net/wireless/intel/iwlwifi/pcie/rx.c       |   5 +-
 drivers/net/wireless/intel/iwlwifi/pcie/trans.c    |   3 +
 drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h   |   2 +
 .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c  |  33 ++-
 drivers/net/wireless/realtek/rtw88/Makefile        |   2 +-
 drivers/net/wireless/realtek/rtw88/fw.c            |   8 +-
 drivers/net/wireless/realtek/rtw88/fw.h            |   1 +
 drivers/net/wireless/realtek/rtw88/wow.c           |  21 +-
 drivers/nvdimm/pmem.c                              |   4 +-
 drivers/nvme/host/core.c                           |   3 +-
 drivers/nvme/host/nvme.h                           |  47 +++-
 drivers/nvme/host/pci.c                            |   2 +-
 drivers/nvme/host/rdma.c                           |   4 +-
 drivers/nvme/host/tcp.c                            |  38 ++-
 drivers/nvme/target/loop.c                         |   4 +-
 drivers/nvmem/qfprom.c                             |   6 +-
 drivers/of/kobj.c                                  |   2 +-
 drivers/opp/of.c                                   |  12 +-
 drivers/parport/ieee1284_ops.c                     |   2 +-
 drivers/pci/controller/pci-aardvark.c              | 266 ++++++++++++++++++++-
 drivers/pci/controller/pcie-xilinx-nwl.c           |  12 +
 drivers/pci/msi.c                                  |   3 +
 drivers/pci/pci.c                                  |   7 +-
 drivers/pci/pcie/portdrv_core.c                    |   9 +-
 drivers/pci/quirks.c                               |   1 +
 drivers/pci/syscall.c                              |   4 +-
 drivers/pinctrl/actions/pinctrl-owl.c              |   1 -
 drivers/pinctrl/core.c                             |   1 -
 drivers/pinctrl/freescale/pinctrl-imx1-core.c      |   1 -
 drivers/pinctrl/mvebu/pinctrl-armada-37xx.c        |  17 +-
 drivers/pinctrl/pinctrl-at91.c                     |   1 -
 drivers/pinctrl/pinctrl-ingenic.c                  |   6 +-
 drivers/pinctrl/pinctrl-single.c                   |   1 +
 drivers/pinctrl/pinctrl-st.c                       |   1 -
 drivers/pinctrl/pinctrl-stmfx.c                    |   6 +-
 drivers/pinctrl/pinctrl-sx150x.c                   |   1 -
 drivers/pinctrl/qcom/pinctrl-sdm845.c              |   1 -
 drivers/pinctrl/qcom/pinctrl-ssbi-mpp.c            |   1 -
 drivers/pinctrl/renesas/pfc-r8a77950.c             |   1 -
 drivers/pinctrl/renesas/pfc-r8a77951.c             |   1 -
 drivers/pinctrl/renesas/pfc-r8a7796.c              |   1 -
 drivers/pinctrl/renesas/pfc-r8a77965.c             |   1 -
 drivers/pinctrl/samsung/pinctrl-samsung.c          |   2 +-
 drivers/platform/chrome/cros_ec_proto.c            |   9 +
 drivers/platform/x86/dell-smbios-wmi.c             |   1 +
 drivers/power/supply/max17042_battery.c            |   6 +-
 drivers/rtc/rtc-tps65910.c                         |   2 +-
 drivers/s390/cio/qdio_main.c                       |  82 ++++---
 drivers/scsi/BusLogic.c                            |   6 +-
 drivers/scsi/pcmcia/fdomain_cs.c                   |   4 +-
 drivers/scsi/qedf/qedf_main.c                      |  10 +-
 drivers/scsi/qedi/qedi_main.c                      |  14 +-
 drivers/scsi/qla2xxx/qla_nvme.c                    |   5 +-
 drivers/scsi/qla2xxx/qla_os.c                      |   6 +
 drivers/scsi/smartpqi/smartpqi_init.c              |   1 +
 drivers/scsi/ufs/ufs-exynos.c                      |   4 +-
 drivers/scsi/ufs/ufs-exynos.h                      |   2 +-
 drivers/scsi/ufs/ufshcd.c                          |   8 +-
 drivers/soc/aspeed/aspeed-lpc-ctrl.c               |   2 +-
 drivers/soc/aspeed/aspeed-p2a-ctrl.c               |   2 +-
 drivers/soc/qcom/qcom_aoss.c                       |   8 +-
 drivers/soundwire/intel.c                          |  23 +-
 drivers/staging/board/board.c                      |   7 +-
 drivers/staging/ks7010/ks7010_sdio.c               |   2 +-
 drivers/staging/media/atomisp/pci/atomisp_v4l2.c   |   4 +-
 drivers/staging/media/hantro/hantro_g1_vp8_dec.c   |  13 +-
 .../staging/media/hantro/rk3399_vpu_hw_vp8_dec.c   |  13 +-
 drivers/staging/rts5208/rtsx_scsi.c                |  10 +-
 drivers/thunderbolt/switch.c                       |   2 +-
 drivers/tty/hvc/hvsi.c                             |  19 +-
 drivers/tty/serial/8250/8250_omap.c                |  25 +-
 drivers/tty/serial/8250/8250_pci.c                 |   2 +-
 drivers/tty/serial/8250/8250_port.c                |   3 +-
 drivers/tty/serial/jsm/jsm_neo.c                   |   2 +
 drivers/tty/serial/jsm/jsm_tty.c                   |   3 +
 drivers/tty/serial/sh-sci.c                        |   7 +-
 drivers/usb/chipidea/host.c                        |  14 +-
 drivers/usb/gadget/composite.c                     |   8 +-
 drivers/usb/gadget/function/u_ether.c              |   5 +-
 drivers/usb/host/ehci-mv.c                         |  23 +-
 drivers/usb/host/fotg210-hcd.c                     |  41 ++--
 drivers/usb/host/fotg210.h                         |   5 -
 drivers/usb/host/xhci.c                            |  24 +-
 drivers/usb/musb/musb_dsps.c                       |  13 +-
 drivers/usb/usbip/vhci_hcd.c                       |  32 ++-
 drivers/vfio/Kconfig                               |   2 +-
 drivers/video/fbdev/asiliantfb.c                   |   3 +
 drivers/video/fbdev/kyro/fbdev.c                   |   8 +
 drivers/video/fbdev/riva/fbdev.c                   |   3 +
 fs/btrfs/inode.c                                   |  10 +-
 fs/btrfs/tree-log.c                                |   4 +-
 fs/btrfs/volumes.c                                 |   3 +
 fs/ceph/caps.c                                     |   3 +
 fs/cifs/sess.c                                     |   2 +-
 fs/f2fs/compress.c                                 |  12 +-
 fs/f2fs/data.c                                     |  16 ++
 fs/f2fs/dir.c                                      |  14 +-
 fs/f2fs/file.c                                     |   4 +-
 fs/f2fs/gc.c                                       |   4 +-
 fs/f2fs/super.c                                    | 106 ++++----
 fs/fscache/cookie.c                                |  14 +-
 fs/fscache/internal.h                              |   2 +
 fs/fscache/main.c                                  |  39 +++
 fs/gfs2/glops.c                                    |  17 +-
 fs/gfs2/lock_dlm.c                                 |   5 +
 fs/io-wq.c                                         |   8 +-
 fs/io_uring.c                                      |  70 +++---
 fs/iomap/buffered-io.c                             |   2 +-
 fs/lockd/svclock.c                                 |  30 +--
 fs/nfs/pnfs.c                                      |  16 +-
 fs/nfsd/nfs4state.c                                |   5 +-
 fs/notify/fanotify/fanotify.c                      |   6 +
 fs/overlayfs/dir.c                                 |   6 +-
 fs/userfaultfd.c                                   |  91 ++++---
 include/crypto/public_key.h                        |   4 +-
 include/drm/drm_auth.h                             |   1 +
 include/drm/drm_file.h                             |  18 +-
 include/linux/ethtool.h                            |   4 -
 include/linux/hugetlb.h                            |   9 +
 include/linux/hugetlb_cgroup.h                     |  12 +
 include/linux/intel-iommu.h                        |   6 +-
 include/linux/rcupdate.h                           |   2 +-
 include/linux/sunrpc/xprt.h                        |   1 +
 include/linux/sunrpc/xprtsock.h                    |   1 +
 include/net/flow_offload.h                         |   1 +
 include/uapi/linux/serial_reg.h                    |   1 +
 kernel/dma/debug.c                                 |   7 +-
 kernel/fork.c                                      |   1 +
 kernel/pid_namespace.c                             |   3 +-
 kernel/rcu/tree_plugin.h                           |   8 +-
 kernel/sched/cpufreq_schedutil.c                   |  16 +-
 kernel/workqueue.c                                 |  12 +-
 lib/test_bpf.c                                     |  13 +-
 lib/test_stackinit.c                               |  20 +-
 mm/hmm.c                                           |   5 +-
 mm/hugetlb.c                                       |   4 +-
 mm/vmscan.c                                        |   2 +-
 net/9p/trans_xen.c                                 |   4 +-
 net/bluetooth/hci_event.c                          | 108 ++++++---
 net/bluetooth/sco.c                                |  74 +++---
 net/core/flow_dissector.c                          |  12 +-
 net/core/flow_offload.c                            |  89 ++++++-
 net/ethtool/ioctl.c                                | 136 +++++++++--
 net/ipv4/ip_output.c                               |   5 +-
 net/ipv4/tcp_fastopen.c                            |   3 +-
 net/mac80211/iface.c                               |  11 +-
 net/netfilter/nf_flow_table_offload.c              |   1 +
 net/netfilter/nf_tables_offload.c                  |   1 +
 net/netlabel/netlabel_cipso_v4.c                   |   4 +-
 net/netlink/af_netlink.c                           |   4 +-
 net/sched/cls_api.c                                |   1 +
 net/sched/sch_taprio.c                             |   4 +-
 net/socket.c                                       | 125 +---------
 net/sunrpc/auth_gss/svcauth_gss.c                  |   2 +-
 net/sunrpc/xprt.c                                  |   8 +-
 net/sunrpc/xprtrdma/transport.c                    |  11 +-
 net/sunrpc/xprtsock.c                              |   7 +
 net/tipc/socket.c                                  |  36 ++-
 samples/bpf/test_override_return.sh                |   1 +
 samples/bpf/tracex7_user.c                         |   5 +
 scripts/gen_ksymdeps.sh                            |   8 +-
 security/smack/smack_access.c                      |  17 +-
 sound/soc/atmel/Kconfig                            |   1 -
 sound/soc/intel/boards/bytcr_rt5640.c              |   9 +-
 sound/soc/intel/boards/sof_pcm512x.c               |  13 +-
 sound/soc/intel/skylake/skl-messages.c             |  11 +-
 sound/soc/intel/skylake/skl-pcm.c                  |  25 +-
 sound/soc/rockchip/rockchip_i2s.c                  |  35 ++-
 tools/lib/bpf/libbpf.c                             |  63 ++++-
 .../testing/selftests/arm64/mte/mte_common_util.c  |   2 +-
 tools/testing/selftests/arm64/pauth/pac.c          |  10 +-
 .../testing/selftests/bpf/prog_tests/send_signal.c |  16 ++
 .../selftests/bpf/prog_tests/sockopt_inherit.c     |   4 +-
 tools/testing/selftests/bpf/progs/xdp_tx.c         |   2 +-
 tools/testing/selftests/bpf/test_maps.c            |   2 +-
 tools/testing/selftests/bpf/test_xdp_veth.sh       |   2 +-
 tools/testing/selftests/firmware/fw_namespace.c    |   3 +-
 tools/testing/selftests/ftrace/test.d/functions    |   2 +-
 tools/thermal/tmon/Makefile                        |   2 +-
 344 files changed, 3181 insertions(+), 1644 deletions(-)

From: Krzysztof Wilczyński <[email protected]>

commit a8bd29bd49c4156ea0ec5a97812333e2aeef44e7 upstream.

The pciconfig_read() syscall reads PCI configuration space using hardware-dependent config accessors.

If the read fails on PCI, most accessors don't return an error; they pretend the read was successful and got ~0 data from the device, so the syscall returns success with ~0 data in the buffer.

When the accessor does return an error, pciconfig_read() normally fills the user's buffer with ~0 and returns an error in errno. But after e4585da22ad0 ("pci syscall.c: Switch to refcounting API"), we don't fill the buffer with ~0 for the EPERM "user lacks CAP_SYS_ADMIN" error.

Userspace may rely on the ~0 data to detect errors, but after e4585da22ad0, that would not detect CAP_SYS_ADMIN errors.

Restore the original behaviour of filling the buffer with ~0 when the CAP_SYS_ADMIN check fails.

[bhelgaas: commit log, fold in Nathan's fix
https://lore.kernel.org/r/[email protected]]

---
 drivers/pci/syscall.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

@@ -22,8 +22,10 @@ SYSCALL_DEFINE5(pciconfig_read, unsigned
 	long err;
 	int cfg_ret;
 
+	err = -EPERM;
+	dev = NULL;
 	if (!capable(CAP_SYS_ADMIN))
-		return -EPERM;
+		goto error;
 
 	err = -ENODEV;
 	dev = pci_get_domain_bus_and_slot(0, bus, dfn);

From: Marek Behún <[email protected]>

commit b12d93e9958e028856cbcb061b6e64728ca07755 upstream.

The ASMedia ASM1062 SATA controller advertises Max_Payload_Size_Supported of 512, but in fact it cannot handle incoming TLPs with payload size of 512.

We discovered this issue on PCIe controllers capable of MPS = 512 (Aardvark and DesignWare), where the issue presents itself as an External Abort. Bjorn Helgaas says:

Probably ASM1062 reports a Malformed TLP error when it receives a data payload of 512 bytes, and Aardvark, DesignWare, etc convert this to an arm64 External Abort. [1]

To avoid this problem, limit the ASM1062 Max Payload Size Supported to 256 bytes, so we set the Max Payload Size of devices that may send TLPs to the ASM1062 to 256 or less.

[1] https://lore.kernel.org/linux-pci/20210601170907.GA1949035@bjorn-Precision-5520/

---
 drivers/pci/quirks.c |    1 +
 1 file changed, 1 insertion(+)

@@ -3252,6 +3252,7 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SO
 			PCI_DEVICE_ID_SOLARFLARE_SFC4000A_1, fixup_mpss_256);
 DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SOLARFLARE,
 			PCI_DEVICE_ID_SOLARFLARE_SFC4000B, fixup_mpss_256);
+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_ASMEDIA, 0x0612, fixup_mpss_256);
 
 /*
  * Intel 5000 and 5100 Memory controllers have an erratum with read completion

From: Stuart Hayes <[email protected]>

commit 00823dcbdd415c868390feaca16f0265101efab4 upstream.

Previously we assumed that all Root Ports and Switch Downstream Ports supported Link Bandwidth Notification. Per spec, this is only required for Ports supporting Links wider than x1 and/or multiple Link speeds (PCIe r5.0, sec 7.5.3.6).

Because we assumed all Ports supported it, we tried to set up a Bandwidth Notification IRQ, which failed for devices that don't support IRQs at all, which meant pcieport didn't attach to the Port at all.

Check the Link Bandwidth Notification Capability bit and enable the service only when the Port supports it.

---
 drivers/pci/pcie/portdrv_core.c |    9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

@@ -260,8 +260,13 @@ static int get_port_device_capability(st
 		services |= PCIE_PORT_SERVICE_DPC;
 
 	if (pci_pcie_type(dev) == PCI_EXP_TYPE_DOWNSTREAM ||
-	    pci_pcie_type(dev) == PCI_EXP_TYPE_ROOT_PORT)
-		services |= PCIE_PORT_SERVICE_BWNOTIF;
+	    pci_pcie_type(dev) == PCI_EXP_TYPE_ROOT_PORT) {
+		u32 linkcap;
+
+		pcie_capability_read_dword(dev, PCI_EXP_LNKCAP, &linkcap);
+		if (linkcap & PCI_EXP_LNKCAP_LBNC)
+			services |= PCIE_PORT_SERVICE_BWNOTIF;
+	}
 
 	return services;
 }

From: David Heidelberg <[email protected]>

commit b30d0289de72c62516df03fdad8d53f552c69839 upstream.

The merge_fdt_bootargs() function by definition consumes more than 1024 bytes of stack because it has a 1024 byte command line on the stack, meaning that we always get a warning when building this file:

arch/arm/boot/compressed/atags_to_fdt.c: In function 'merge_fdt_bootargs':
arch/arm/boot/compressed/atags_to_fdt.c:98:1: warning: the frame size of 1032 bytes is larger than 1024 bytes [-Wframe-larger-than=]

However, as this is the decompressor and we know that it has a very shallow call chain, and we do not actually risk overflowing the kernel stack at runtime here.

This just shuts up the warning by disabling the warning flag for this file.

Tested on Nexus 7 2012 builds.

---
 arch/arm/boot/compressed/Makefile |    2 ++
 1 file changed, 2 insertions(+)

@@ -84,6 +84,8 @@ compress-$(CONFIG_KERNEL_LZ4)  = lz4
 libfdt_objs := fdt_rw.o fdt_ro.o fdt_wip.o fdt.o
 
 ifeq ($(CONFIG_ARM_ATAG_DTB_COMPAT),y)
+CFLAGS_REMOVE_atags_to_fdt.o += -Wframe-larger-than=${CONFIG_FRAME_WARN}
+CFLAGS_atags_to_fdt.o += -Wframe-larger-than=1280
 OBJS	+= $(libfdt_objs) atags_to_fdt.o
 endif
 

From: Chao Yu <[email protected]>

commit 65ddf6564843890a58ee3b18bb46ce67d96333fb upstream.

This patch fixes below problems of sb/cp sanity check:
- in sanity_check_raw_superi(), it missed to consider log header blocks while cp_payload check.
- in f2fs_sanity_check_ckpt(), it missed to check nat_bits_blocks.

---
 fs/f2fs/super.c |   22 ++++++++++++++++++----
 1 file changed, 18 insertions(+), 4 deletions(-)

@@ -2898,11 +2898,13 @@ static int sanity_check_raw_super(struct
 		return -EFSCORRUPTED;
 	}
 
-	if (le32_to_cpu(raw_super->cp_payload) >
-				(blocks_per_seg - F2FS_CP_PACKS)) {
-		f2fs_info(sbi, "Insane cp_payload (%u > %u)",
+	if (le32_to_cpu(raw_super->cp_payload) >=
+				(blocks_per_seg - F2FS_CP_PACKS -
+				NR_CURSEG_PERSIST_TYPE)) {
+		f2fs_info(sbi, "Insane cp_payload (%u >= %u)",
 			  le32_to_cpu(raw_super->cp_payload),
-			  blocks_per_seg - F2FS_CP_PACKS);
+			  blocks_per_seg - F2FS_CP_PACKS -
+			  NR_CURSEG_PERSIST_TYPE);
 		return -EFSCORRUPTED;
 	}
 

@@ -2938,6 +2940,7 @@ int f2fs_sanity_check_ckpt(struct f2fs_s
 	unsigned int cp_pack_start_sum, cp_payload;
 	block_t user_block_count, valid_user_blocks;
 	block_t avail_node_count, valid_node_count;
+	unsigned int nat_blocks, nat_bits_bytes, nat_bits_blocks;
 	int i, j;
 
 	total = le32_to_cpu(raw_super->segment_count);

@@ -3058,6 +3061,17 @@ int f2fs_sanity_check_ckpt(struct f2fs_s
 		return 1;
 	}
 
+	nat_blocks = nat_segs << log_blocks_per_seg;
+	nat_bits_bytes = nat_blocks / BITS_PER_BYTE;
+	nat_bits_blocks = F2FS_BLK_ALIGN((nat_bits_bytes << 1) + 8);
+	if (__is_set_ckpt_flags(ckpt, CP_NAT_BITS_FLAG) &&
+		(cp_payload + F2FS_CP_PACKS +
+		NR_CURSEG_PERSIST_TYPE + nat_bits_blocks >= blocks_per_seg)) {
+		f2fs_warn(sbi, "Insane cp_payload: %u, nat_bits_blocks: %u)",
+			  cp_payload, nat_bits_blocks);
+		return -EFSCORRUPTED;
+	}
+
 	if (unlikely(f2fs_cp_error(sbi))) {
 		f2fs_err(sbi, "A bug case: need to run fsck");
 		return 1;

From: Robin Gong <[email protected]>

commit e555a03b112838883fdd8185d613c35d043732f2 upstream.

Since sdma_transfer_init() will do sdma_load_context before any sdma transfer, no need once more in sdma_config_channel().

---
 drivers/dma/imx-sdma.c |    5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

@@ -1138,7 +1138,6 @@ static void sdma_set_watermarklevel_for_
 static int sdma_config_channel(struct dma_chan *chan)
 {
 	struct sdma_channel *sdmac = to_sdma_chan(chan);
-	int ret;
 
 	sdma_disable_channel(chan);
 

@@ -1178,9 +1177,7 @@ static int sdma_config_channel(struct dm
 		sdmac->watermark_level = 0; /* FIXME: M3_BASE_ADDRESS */
 	}
 
-	ret = sdma_load_context(sdmac);
-
-	return ret;
+	return 0;
 }
 
 static int sdma_set_channel_priority(struct sdma_channel *sdmac,

From: Hans de Goede <[email protected]>

commit 8a6430ab9c9c87cb64c512e505e8690bbaee190b upstream.

Commit ca6bfcb2f6d9 ("libata: Enable queued TRIM for Samsung SSD 860") limited the existing ATA_HORKAGE_NO_NCQ_TRIM quirk from "Samsung SSD 8*", covering all Samsung 800 series SSDs, to only apply to "Samsung SSD 840*" and "Samsung SSD 850*" series based on information from Samsung.

But there is a large number of users which is still reporting issues with the Samsung 860 and 870 SSDs combined with Intel, ASmedia or Marvell SATA controllers and all reporters also report these problems going away when disabling queued trims.

Note that with AMD SATA controllers users are reporting even worse issues and only completely disabling NCQ helps there, this will be addressed in a separate patch.

---
 drivers/ata/libata-core.c |    4 ++++
 1 file changed, 4 insertions(+)

@@ -3950,6 +3950,10 @@ static const struct ata_blacklist_entry
 						ATA_HORKAGE_ZERO_AFTER_TRIM, },
 	{ "Samsung SSD 850*",		NULL,	ATA_HORKAGE_NO_NCQ_TRIM |
 						ATA_HORKAGE_ZERO_AFTER_TRIM, },
+	{ "Samsung SSD 860*",		NULL,	ATA_HORKAGE_NO_NCQ_TRIM |
+						ATA_HORKAGE_ZERO_AFTER_TRIM, },
+	{ "Samsung SSD 870*",		NULL,	ATA_HORKAGE_NO_NCQ_TRIM |
+						ATA_HORKAGE_ZERO_AFTER_TRIM, },
 	{ "FCCT*M500*",			NULL,	ATA_HORKAGE_NO_NCQ_TRIM |
 						ATA_HORKAGE_ZERO_AFTER_TRIM, },
 

From: Hyun Kwon <[email protected]>

commit de0a01f5296651d3a539f2d23d0db8f359483696 upstream.

Enable PCIe reference clock. There is no remove function that's why this should be enough for simple operation.
Normally this clock is enabled by default by firmware but there are usecases where this clock should be enabled by driver itself. It is also good that PCIe clock is recorded in a clock framework.

---
 drivers/pci/controller/pcie-xilinx-nwl.c |   12 ++++++++++++
 1 file changed, 12 insertions(+)

@@ -6,6 +6,7 @@
  * (C) Copyright 2014 - 2015, Xilinx, Inc.
  */
 
+#include <linux/clk.h>
 #include <linux/delay.h>
 #include <linux/interrupt.h>
 #include <linux/irq.h>

@@ -168,6 +169,7 @@ struct nwl_pcie {
 	u8 last_busno;
 	struct nwl_msi msi;
 	struct irq_domain *legacy_irq_domain;
+	struct clk *clk;
 	raw_spinlock_t leg_mask_lock;
 };
 

@@ -825,6 +827,16 @@ static int nwl_pcie_probe(struct platfor
 		return err;
 	}
 
+	pcie->clk = devm_clk_get(dev, NULL);
+	if (IS_ERR(pcie->clk))
+		return PTR_ERR(pcie->clk);
+
+	err = clk_prepare_enable(pcie->clk);
+	if (err) {
+		dev_err(dev, "can't enable PCIe ref clock\n");
+		return err;
+	}
+
 	err = nwl_pcie_bridge_init(pcie);
 	if (err) {
 		dev_err(dev, "HW Initialization failed\n");

From: Pali Rohár <[email protected]>

commit d212dcee27c1f89517181047e5485fcbba4a25c2 upstream.

irq_mask and irq_unmask callbacks need to be properly guarded by raw spin locks as masking/unmasking procedure needs atomic read-modify-write operation on hardware register.

---
 drivers/pci/controller/pci-aardvark.c |    9 +++++++++
 1 file changed, 9 insertions(+)

@@ -237,6 +237,7 @@ struct advk_pcie {
 	u8 wins_count;
 	struct irq_domain *irq_domain;
 	struct irq_chip irq_chip;
+	raw_spinlock_t irq_lock;
 	struct irq_domain *msi_domain;
 	struct irq_domain *msi_inner_domain;
 	struct irq_chip msi_bottom_irq_chip;

@@ -1045,22 +1046,28 @@ static void advk_pcie_irq_mask(struct ir
 {
 	struct advk_pcie *pcie = d->domain->host_data;
 	irq_hw_number_t hwirq = irqd_to_hwirq(d);
+	unsigned long flags;
 	u32 mask;
 
+	raw_spin_lock_irqsave(&pcie->irq_lock, flags);
 	mask = advk_readl(pcie, PCIE_ISR1_MASK_REG);
 	mask |= PCIE_ISR1_INTX_ASSERT(hwirq);
 	advk_writel(pcie, mask, PCIE_ISR1_MASK_REG);
+	raw_spin_unlock_irqrestore(&pcie->irq_lock, flags);
 }
 
 static void advk_pcie_irq_unmask(struct irq_data *d)
 {
 	struct advk_pcie *pcie = d->domain->host_data;
 	irq_hw_number_t hwirq = irqd_to_hwirq(d);
+	unsigned long flags;
 	u32 mask;
 
+	raw_spin_lock_irqsave(&pcie->irq_lock, flags);
 	mask = advk_readl(pcie, PCIE_ISR1_MASK_REG);
 	mask &= ~PCIE_ISR1_INTX_ASSERT(hwirq);
 	advk_writel(pcie, mask, PCIE_ISR1_MASK_REG);
+	raw_spin_unlock_irqrestore(&pcie->irq_lock, flags);
 }
 
 static int advk_pcie_irq_map(struct irq_domain *h,

@@ -1144,6 +1151,8 @@ static int advk_pcie_init_irq_domain(str
 	struct irq_chip *irq_chip;
 	int ret = 0;
 
+	raw_spin_lock_init(&pcie->irq_lock);
+
 	pcie_intc_node =  of_get_next_child(node, NULL);
 	if (!pcie_intc_node) {
 		dev_err(dev, "No PCIe Intc node found\n");

From: Dmitry Torokhov <[email protected]>

[ Upstream commit f4abaa9eebde334045ed6ac4e564d050f1df3013 ]

The power supply states of discharging, charging, full, etc, represent state of charging, not the capacity level of the battery (for which we have a separate property). Current HID usage tables to not allow for expressing charging state of the batteries found in generic styli, so we should simply assume that the battery is discharging even if current capacity is at 100% when battery strength reporting is done via HID interface. In fact, we were doing just that before commit 581c4484769e.

This change helps UIs to not mis-represent fully charged batteries in styli as being charging/topping-off.

---
 drivers/hid/hid-input.c | 2 --
 1 file changed, 2 deletions(-)

index d1ab2dccf6fd..580d378342c4 100644
@@ -415,8 +415,6 @@ static int hidinput_get_battery_property(struct power_supply *psy,
 
 		if (dev->battery_status == HID_BATTERY_UNKNOWN)
 			val->intval = POWER_SUPPLY_STATUS_UNKNOWN;
-		else if (dev->battery_capacity == 100)
-			val->intval = POWER_SUPPLY_STATUS_FULL;
 		else
 			val->intval = POWER_SUPPLY_STATUS_DISCHARGING;
 		break;

2.30.2

From: Evan Wang <[email protected]>

commit fcb461e2bc8b83b7eaca20cb2221e8b940f2189c upstream.

There is an issue that when PCIe switch is connected to an Armada 3700 board, there will be lots of warnings about PIO errors when reading the config space. According to Aardvark PIO read and write sequence in HW specification, the current way to check PIO status has the following issues:

1) For PIO read operation, it reports the error message, which should be avoided according to HW specification.

2) For PIO read and write operations, it only checks PIO operation complete status, which is not enough, and error status should also be checked.

This patch aligns the code with Aardvark PIO read and write sequence in HW specification on PIO status check and fix the warnings when reading config space.

[pali: Fix CRS handling when CRSSVE is not enabled]

---
 drivers/pci/controller/pci-aardvark.c |   62 +++++++++++++++++++++++++++++-----
 1 file changed, 54 insertions(+), 8 deletions(-)

@@ -57,6 +57,7 @@
 #define   PIO_COMPLETION_STATUS_CRS		2
 #define   PIO_COMPLETION_STATUS_CA		4
 #define   PIO_NON_POSTED_REQ			BIT(10)
+#define   PIO_ERR_STATUS			BIT(11)
 #define PIO_ADDR_LS				(PIO_BASE_ADDR + 0x8)
 #define PIO_ADDR_MS				(PIO_BASE_ADDR + 0xc)
 #define PIO_WR_DATA				(PIO_BASE_ADDR + 0x10)

@@ -585,7 +586,7 @@ static void advk_pcie_setup_hw(struct ad
 	advk_writel(pcie, reg, PCIE_CORE_CMD_STATUS_REG);
 }
 
-static void advk_pcie_check_pio_status(struct advk_pcie *pcie)
+static int advk_pcie_check_pio_status(struct advk_pcie *pcie, u32 *val)
 {
 	struct device *dev = &pcie->pdev->dev;
 	u32 reg;

@@ -596,14 +597,49 @@ static void advk_pcie_check_pio_status(s
 	status = (reg & PIO_COMPLETION_STATUS_MASK) >>
 		PIO_COMPLETION_STATUS_SHIFT;
 
-	if (!status)
-		return;
-
+	/*
+	 * According to HW spec, the PIO status check sequence as below:
+	 * 1) even if COMPLETION_STATUS(bit9:7) indicates successful,
+	 *    it still needs to check Error Status(bit11), only when this bit
+	 *    indicates no error happen, the operation is successful.
+	 * 2) value Unsupported Request(1) of COMPLETION_STATUS(bit9:7) only
+	 *    means a PIO write error, and for PIO read it is successful with
+	 *    a read value of 0xFFFFFFFF.
+	 * 3) value Completion Retry Status(CRS) of COMPLETION_STATUS(bit9:7)
+	 *    only means a PIO write error, and for PIO read it is successful
+	 *    with a read value of 0xFFFF0001.
+	 * 4) value Completer Abort (CA) of COMPLETION_STATUS(bit9:7) means
+	 *    error for both PIO read and PIO write operation.
+	 * 5) other errors are indicated as 'unknown'.
+	 */
 	switch (status) {
+	case PIO_COMPLETION_STATUS_OK:
+		if (reg & PIO_ERR_STATUS) {
+			strcomp_status = "COMP_ERR";
+			break;
+		}
+		/* Get the read result */
+		if (val)
+			*val = advk_readl(pcie, PIO_RD_DATA);
+		/* No error */
+		strcomp_status = NULL;
+		break;
 	case PIO_COMPLETION_STATUS_UR:
 		strcomp_status = "UR";
 		break;
 	case PIO_COMPLETION_STATUS_CRS:
+		/* PCIe r4.0, sec 2.3.2, says:
+		 * If CRS Software Visibility is not enabled, the Root Complex
+		 * must re-issue the Configuration Request as a new Request.
+		 * A Root Complex implementation may choose to limit the number
+		 * of Configuration Request/CRS Completion Status loops before
+		 * determining that something is wrong with the target of the
+		 * Request and taking appropriate action, e.g., complete the
+		 * Request to the host as a failed transaction.
+		 *
+		 * To simplify implementation do not re-issue the Configuration
+		 * Request and complete the Request as a failed transaction.
+		 */
 		strcomp_status = "CRS";
 		break;
 	case PIO_COMPLETION_STATUS_CA:

@@ -614,6 +650,9 @@ static void advk_pcie_check_pio_status(s
 		break;
 	}
 
+	if (!strcomp_status)
+		return 0;
+
 	if (reg & PIO_NON_POSTED_REQ)
 		str_posted = "Non-posted";
 	else

@@ -621,6 +660,8 @@ static void advk_pcie_check_pio_status(s
 
 	dev_err(dev, "%s PIO Response Status: %s, %#x @ %#x\n",
 		str_posted, strcomp_status, reg, advk_readl(pcie, PIO_ADDR_LS));
+
+	return -EFAULT;
 }
 
 static int advk_pcie_wait_pio(struct advk_pcie *pcie)

@@ -858,10 +899,13 @@ static int advk_pcie_rd_conf(struct pci_
 		return PCIBIOS_SET_FAILED;
 	}
 
-	advk_pcie_check_pio_status(pcie);
+	/* Check PIO status and get the read result */
+	ret = advk_pcie_check_pio_status(pcie, val);
+	if (ret < 0) {
+		*val = 0xffffffff;
+		return PCIBIOS_SET_FAILED;
+	}
 
-	/* Get the read result */
-	*val = advk_readl(pcie, PIO_RD_DATA);
 	if (size == 1)
 		*val = (*val >> (8 * (where & 3))) & 0xff;
 	else if (size == 2)

@@ -925,7 +969,9 @@ static int advk_pcie_wr_conf(struct pci_
 	if (ret < 0)
 		return PCIBIOS_SET_FAILED;
 
-	advk_pcie_check_pio_status(pcie);
+	ret = advk_pcie_check_pio_status(pcie, NULL);
+	if (ret < 0)
+		return PCIBIOS_SET_FAILED;
 
 	return PCIBIOS_SUCCESSFUL;
 }

From: Arne Welzel <[email protected]>

commit 528b16bfc3ae5f11638e71b3b63a81f9999df727 upstream.

On systems with many cores using dm-crypt, heavy spinlock contention in percpu_counter_compare() can be observed when the page allocation limit for a given device is reached or close to be reached. This is due to percpu_counter_compare() taking a spinlock to compute an exact result on potentially many CPUs at the same time.

Switch to non-exact comparison of allocated and allowed pages by using the value returned by percpu_counter_read_positive() to avoid taking the percpu_counter spinlock.

This may over/under estimate the actual number of allocated pages by at most (batch-1) * num_online_cpus().

Currently, batch is bounded by 32. The system on which this issue was first observed has 256 CPUs and 512GB of RAM. With a 4k page size, this change may over/under estimate by 31MB. With ~10G (2%) allowed dm-crypt allocations, this seems an acceptable error. Certainly preferred over running into the spinlock contention.

This behavior was reproduced on an EC2 c5.24xlarge instance with 96 CPUs and 192GB RAM as follows, but can be provoked on systems with less CPUs as well.

* Disable swap
* Tune vm settings to promote regular writeback

     $ echo 50 > /proc/sys/vm/dirty_expire_centisecs
     $ echo 25 > /proc/sys/vm/dirty_writeback_centisecs
     $ echo $((128 * 1024 * 1024)) > /proc/sys/vm/dirty_background_bytes

* Create 8 dmcrypt devices based on files on a tmpfs
* Create and mount an ext4 filesystem on each crypt devices
* Run stress-ng --hdd 8 within one of above filesystems

Total %system usage collected from sysstat goes to ~35%. Write throughput on the underlying loop device is ~2GB/s. perf profiling an individual kworker kcryptd thread shows the following profile, indicating spinlock contention in percpu_counter_compare():

    99.98%     0.00%  kworker/u193:46  [kernel.kallsyms]  [k] ret_from_fork
      |
      --ret_from_fork
        kthread
        worker_thread
        |
         --99.92%--process_one_work
            |
            |--80.52%--kcryptd_crypt
            |    |
            |    |--62.58%--mempool_alloc
            |    |  |
            |    |   --62.24%--crypt_page_alloc
            |    |     |
            |    |      --61.51%--__percpu_counter_compare
            |    |        |
            |    |         --61.34%--__percpu_counter_sum
            |    |           |
            |    |           |--58.68%--_raw_spin_lock_irqsave
            |    |           |  |
            |    |           |   --58.30%--native_queued_spin_lock_slowpath
            |    |           |
            |    |            --0.69%--cpumask_next
            |    |                |
            |    |                 --0.51%--_find_next_bit
            |    |
            |    |--10.61%--crypt_convert
            |    |          |
            |    |          |--6.05%--xts_crypt
            ...

After applying this patch and running the same test, %system usage is lowered to ~7% and write throughput on the loop device increases to ~2.7GB/s. perf report shows mempool_alloc() as ~8% rather than ~62% in the profile and not hitting the percpu_counter() spinlock anymore.

    |--8.15%--mempool_alloc
    |    |
    |    |--3.93%--crypt_page_alloc
    |    |    |
    |    |     --3.75%--__alloc_pages
    |    |         |
    |    |          --3.62%--get_page_from_freelist
    |    |              |
    |    |               --3.22%--rmqueue_bulk
    |    |                   |
    |    |                    --2.59%--_raw_spin_lock
    |    |                      |
    |    |                       --2.57%--native_queued_spin_lock_slowpath
    |    |
    |     --3.05%--_raw_spin_lock_irqsave
    |               |
    |                --2.49%--native_queued_spin_lock_slowpath

---
 drivers/md/dm-crypt.c |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

@@ -2643,7 +2643,12 @@ static void *crypt_page_alloc(gfp_t gfp_
 	struct crypt_config *cc = pool_data;
 	struct page *page;
 
-	if (unlikely(percpu_counter_compare(&cc->n_allocated_pages, dm_crypt_pages_per_client) >= 0) &&
+	/*
+	 * Note, percpu_counter_read_positive() may over (and under) estimate
+	 * the current usage by at most (batch - 1) * num_online_cpus() pages,
+	 * but avoids potential spinlock contention of an exact result.
+	 */
+	if (unlikely(percpu_counter_read_positive(&cc->n_allocated_pages) >= dm_crypt_pages_per_client) &&
 	    likely(gfp_mask & __GFP_NORETRY))
 		return NULL;
 

From: Jianjun Wang <[email protected]>

commit 9cc742078c9a90cdd4cf131e9f760e6965df9048 upstream.

This interface will be used by PCI host drivers for PIO translation, export it to support compiling those drivers as kernel modules.

---
 drivers/pci/pci.c |    1 +
 1 file changed, 1 insertion(+)

@@ -4043,6 +4043,7 @@ phys_addr_t pci_pio_to_address(unsigned
 
 	return address;
 }
+EXPORT_SYMBOL_GPL(pci_pio_to_address);
 
 unsigned long __weak pci_address_to_pio(phys_addr_t address)
 {

From: Pali Rohár <[email protected]>

commit 64f160e19e9264a7f6d89c516baae1473b6f8359 upstream.

In commit 6df6ba974a55 ("PCI: aardvark: Remove PCIe outbound window configuration") was removed aardvark PCIe outbound window configuration and commit description said that was recommended solution by HW designers.

But that commit completely removed support for configuring PCIe IO resources without removing PCIe IO 'ranges' from DTS files. After that commit PCIe IO space started to be treated as PCIe MEM space and accessing it just caused kernel crash.

Moreover implementation of PCIe outbound windows prior that commit was incorrect. It completely ignored offset between CPU address and PCIe bus address and expected that in DTS is CPU address always same as PCIe bus address without doing any checks. Also it completely ignored size of every PCIe resource specified in 'ranges' DTS property and expected that every PCIe resource has size 128 MB (also for PCIe IO range). Again without any check. Apparently none of PCIe resource has in DTS specified size of 128 MB. So it was completely broken and thanks to how aardvark mask works, configuration was completely ignored.

This patch reverts back support for PCIe outbound window configuration but implementation is a new without issues mentioned above. PCIe outbound window is required when DTS specify in 'ranges' property non-zero offset between CPU and PCIe address space. To address recommendation by HW designers as specified in commit description of 6df6ba974a55, set default outbound parameters as PCIe MEM access without translation and therefore for this PCIe 'ranges' it is not needed to configure PCIe outbound window. For PCIe IO space is needed to configure aardvark PCIe outbound window.

This patch fixes kernel crash when trying to access PCIe IO space.

---
 drivers/pci/controller/pci-aardvark.c |  195 +++++++++++++++++++++++++++++++++-
 1 file changed, 194 insertions(+), 1 deletion(-)

@@ -117,6 +117,46 @@
 #define PCIE_MSI_MASK_REG			(CONTROL_BASE_ADDR + 0x5C)
 #define PCIE_MSI_PAYLOAD_REG			(CONTROL_BASE_ADDR + 0x9C)
 
+/* PCIe window configuration */
+#define OB_WIN_BASE_ADDR			0x4c00
+#define OB_WIN_BLOCK_SIZE			0x20
+#define OB_WIN_COUNT				8
+#define OB_WIN_REG_ADDR(win, offset)		(OB_WIN_BASE_ADDR + \
+						 OB_WIN_BLOCK_SIZE * (win) + \
+						 (offset))
+#define OB_WIN_MATCH_LS(win)			OB_WIN_REG_ADDR(win, 0x00)
+#define     OB_WIN_ENABLE			BIT(0)
+#define OB_WIN_MATCH_MS(win)			OB_WIN_REG_ADDR(win, 0x04)
+#define OB_WIN_REMAP_LS(win)			OB_WIN_REG_ADDR(win, 0x08)
+#define OB_WIN_REMAP_MS(win)			OB_WIN_REG_ADDR(win, 0x0c)
+#define OB_WIN_MASK_LS(win)			OB_WIN_REG_ADDR(win, 0x10)
+#define OB_WIN_MASK_MS(win)			OB_WIN_REG_ADDR(win, 0x14)
+#define OB_WIN_ACTIONS(win)			OB_WIN_REG_ADDR(win, 0x18)
+#define OB_WIN_DEFAULT_ACTIONS			(OB_WIN_ACTIONS(OB_WIN_COUNT-1) + 0x4)
+#define     OB_WIN_FUNC_NUM_MASK		GENMASK(31, 24)
+#define     OB_WIN_FUNC_NUM_SHIFT		24
+#define     OB_WIN_FUNC_NUM_ENABLE		BIT(23)
+#define     OB_WIN_BUS_NUM_BITS_MASK		GENMASK(22, 20)
+#define     OB_WIN_BUS_NUM_BITS_SHIFT		20
+#define     OB_WIN_MSG_CODE_ENABLE		BIT(22)
+#define     OB_WIN_MSG_CODE_MASK		GENMASK(21, 14)
+#define     OB_WIN_MSG_CODE_SHIFT		14
+#define     OB_WIN_MSG_PAYLOAD_LEN		BIT(12)
+#define     OB_WIN_ATTR_ENABLE			BIT(11)
+#define     OB_WIN_ATTR_TC_MASK			GENMASK(10, 8)
+#define     OB_WIN_ATTR_TC_SHIFT		8
+#define     OB_WIN_ATTR_RELAXED			BIT(7)
+#define     OB_WIN_ATTR_NOSNOOP			BIT(6)
+#define     OB_WIN_ATTR_POISON			BIT(5)
+#define     OB_WIN_ATTR_IDO			BIT(4)
+#define     OB_WIN_TYPE_MASK			GENMASK(3, 0)
+#define     OB_WIN_TYPE_SHIFT			0
+#define     OB_WIN_TYPE_MEM			0x0
+#define     OB_WIN_TYPE_IO			0x4
+#define     OB_WIN_TYPE_CONFIG_TYPE0		0x8
+#define     OB_WIN_TYPE_CONFIG_TYPE1		0x9
+#define     OB_WIN_TYPE_MSG			0xc
+
 /* LMI registers base address and register offsets */
 #define LMI_BASE_ADDR				0x6000
 #define CFG_REG					(LMI_BASE_ADDR + 0x0)

@@ -187,6 +227,13 @@
 struct advk_pcie {
 	struct platform_device *pdev;
 	void __iomem *base;
+	struct {
+		phys_addr_t match;
+		phys_addr_t remap;
+		phys_addr_t mask;
+		u32 actions;
+	} wins[OB_WIN_COUNT];
+	u8 wins_count;
 	struct irq_domain *irq_domain;
 	struct irq_chip irq_chip;
 	struct irq_domain *msi_domain;

@@ -366,9 +413,39 @@ err:
 	dev_err(dev, "link never came up\n");
 }
 
+/*
+ * Set PCIe address window register which could be used for memory
+ * mapping.
+ */
+static void advk_pcie_set_ob_win(struct advk_pcie *pcie, u8 win_num,
+				 phys_addr_t match, phys_addr_t remap,
+				 phys_addr_t mask, u32 actions)
+{
+	advk_writel(pcie, OB_WIN_ENABLE |
+			  lower_32_bits(match), OB_WIN_MATCH_LS(win_num));
+	advk_writel(pcie, upper_32_bits(match), OB_WIN_MATCH_MS(win_num));
+	advk_writel(pcie, lower_32_bits(remap), OB_WIN_REMAP_LS(win_num));
+	advk_writel(pcie, upper_32_bits(remap), OB_WIN_REMAP_MS(win_num));
+	advk_writel(pcie, lower_32_bits(mask), OB_WIN_MASK_LS(win_num));
+	advk_writel(pcie, upper_32_bits(mask), OB_WIN_MASK_MS(win_num));
+	advk_writel(pcie, actions, OB_WIN_ACTIONS(win_num));
+}
+
+static void advk_pcie_disable_ob_win(struct advk_pcie *pcie, u8 win_num)
+{
+	advk_writel(pcie, 0, OB_WIN_MATCH_LS(win_num));
+	advk_writel(pcie, 0, OB_WIN_MATCH_MS(win_num));
+	advk_writel(pcie, 0, OB_WIN_REMAP_LS(win_num));
+	advk_writel(pcie, 0, OB_WIN_REMAP_MS(win_num));
+	advk_writel(pcie, 0, OB_WIN_MASK_LS(win_num));
+	advk_writel(pcie, 0, OB_WIN_MASK_MS(win_num));
+	advk_writel(pcie, 0, OB_WIN_ACTIONS(win_num));
+}
+
 static void advk_pcie_setup_hw(struct advk_pcie *pcie)
 {
 	u32 reg;
+	int i;
 
 	/* Enable TX */
 	reg = advk_readl(pcie, PCIE_CORE_REF_CLK_REG);

@@ -447,15 +524,51 @@ static void advk_pcie_setup_hw(struct ad
 	reg = PCIE_IRQ_ALL_MASK & (~PCIE_IRQ_ENABLE_INTS_MASK);
 	advk_writel(pcie, reg, HOST_CTRL_INT_MASK_REG);
 
+	/*
+	 * Enable AXI address window location generation:
+	 * When it is enabled, the default outbound window
+	 * configurations (Default User Field: 0xD0074CFC)
+	 * are used to transparent address translation for
+	 * the outbound transactions. Thus, PCIe address
+	 * windows are not required for transparent memory
+	 * access when default outbound window configuration
+	 * is set for memory access.
+	 */
 	reg = advk_readl(pcie, PCIE_CORE_CTRL2_REG);
 	reg |= PCIE_CORE_CTRL2_OB_WIN_ENABLE;
 	advk_writel(pcie, reg, PCIE_CORE_CTRL2_REG);
 
-	/* Bypass the address window mapping for PIO */
+	/*
+	 * Set memory access in Default User Field so it
+	 * is not required to configure PCIe address for
+	 * transparent memory access.
+	 */
+	advk_writel(pcie, OB_WIN_TYPE_MEM, OB_WIN_DEFAULT_ACTIONS);
+
+	/*
+	 * Bypass the address window mapping for PIO:
+	 * Since PIO access already contains all required
+	 * info over AXI interface by PIO registers, the
+	 * address window is not required.
+	 */
 	reg = advk_readl(pcie, PIO_CTRL);
 	reg |= PIO_CTRL_ADDR_WIN_DISABLE;
 	advk_writel(pcie, reg, PIO_CTRL);
 
+	/*
+	 * Configure PCIe address windows for non-memory or
+	 * non-transparent access as by default PCIe uses
+	 * transparent memory access.
+	 */
+	for (i = 0; i < pcie->wins_count; i++)
+		advk_pcie_set_ob_win(pcie, i,
+				     pcie->wins[i].match, pcie->wins[i].remap,
+				     pcie->wins[i].mask, pcie->wins[i].actions);
+
+	/* Disable remaining PCIe outbound windows */
+	for (i = pcie->wins_count; i < OB_WIN_COUNT; i++)
+		advk_pcie_disable_ob_win(pcie, i);
+
 	advk_pcie_train_link(pcie);
 
 	/*

@@ -1162,6 +1275,7 @@ static int advk_pcie_probe(struct platfo
 	struct device *dev = &pdev->dev;
 	struct advk_pcie *pcie;
 	struct pci_host_bridge *bridge;
+	struct resource_entry *entry;
 	int ret, irq;
 
 	bridge = devm_pci_alloc_host_bridge(dev, sizeof(struct advk_pcie));

@@ -1172,6 +1286,80 @@ static int advk_pcie_probe(struct platfo
 	pcie->pdev = pdev;
 	platform_set_drvdata(pdev, pcie);
 
+	resource_list_for_each_entry(entry, &bridge->windows) {
+		resource_size_t start = entry->res->start;
+		resource_size_t size = resource_size(entry->res);
+		unsigned long type = resource_type(entry->res);
+		u64 win_size;
+
+		/*
+		 * Aardvark hardware allows to configure also PCIe window
+		 * for config type 0 and type 1 mapping, but driver uses
+		 * only PIO for issuing configuration transfers which does
+		 * not use PCIe window configuration.
+		 */
+		if (type != IORESOURCE_MEM && type != IORESOURCE_MEM_64 &&
+		    type != IORESOURCE_IO)
+			continue;
+
+		/*
+		 * Skip transparent memory resources. Default outbound access
+		 * configuration is set to transparent memory access so it
+		 * does not need window configuration.
+		 */
+		if ((type == IORESOURCE_MEM || type == IORESOURCE_MEM_64) &&
+		    entry->offset == 0)
+			continue;
+
+		/*
+		 * The n-th PCIe window is configured by tuple (match, remap, mask)
+		 * and an access to address A uses this window if A matches the
+		 * match with given mask.
+		 * So every PCIe window size must be a power of two and every start
+		 * address must be aligned to window size. Minimal size is 64 KiB
+		 * because lower 16 bits of mask must be zero. Remapped address
+		 * may have set only bits from the mask.
+		 */
+		while (pcie->wins_count < OB_WIN_COUNT && size > 0) {
+			/* Calculate the largest aligned window size */
+			win_size = (1ULL << (fls64(size)-1)) |
+				   (start ? (1ULL << __ffs64(start)) : 0);
+			win_size = 1ULL << __ffs64(win_size);
+			if (win_size < 0x10000)
+				break;
+
+			dev_dbg(dev,
+				"Configuring PCIe window %d: [0x%llx-0x%llx] as %lu\n",
+				pcie->wins_count, (unsigned long long)start,
+				(unsigned long long)start + win_size, type);
+
+			if (type == IORESOURCE_IO) {
+				pcie->wins[pcie->wins_count].actions = OB_WIN_TYPE_IO;
+				pcie->wins[pcie->wins_count].match = pci_pio_to_address(start);
+			} else {
+				pcie->wins[pcie->wins_count].actions = OB_WIN_TYPE_MEM;
+				pcie->wins[pcie->wins_count].match = start;
+			}
+			pcie->wins[pcie->wins_count].remap = start - entry->offset;
+			pcie->wins[pcie->wins_count].mask = ~(win_size - 1);
+
+			if (pcie->wins[pcie->wins_count].remap & (win_size - 1))
+				break;
+
+			start += win_size;
+			size -= win_size;
+			pcie->wins_count++;
+		}
+
+		if (size > 0) {
+			dev_err(&pcie->pdev->dev,
+				"Invalid PCIe region [0x%llx-0x%llx]\n",
+				(unsigned long long)entry->res->start,
+				(unsigned long long)entry->res->end + 1);
+			return -EINVAL;
+		}
+	}
+
 	pcie->base = devm_platform_ioremap_resource(pdev, 0);
 	if (IS_ERR(pcie->base))
 		return PTR_ERR(pcie->base);

@@ -1252,6 +1440,7 @@ static int advk_pcie_remove(struct platf
 {
 	struct advk_pcie *pcie = platform_get_drvdata(pdev);
 	struct pci_host_bridge *bridge = pci_host_bridge_from_priv(pcie);
+	int i;
 
 	pci_lock_rescan_remove();
 	pci_stop_root_bus(bridge->bus);

@@ -1261,6 +1450,10 @@ static int advk_pcie_remove(struct platf
 	advk_pcie_remove_msi_irq_domain(pcie);
 	advk_pcie_remove_irq_domain(pcie);
 
+	/* Disable outbound address windows mapping */
+	for (i = 0; i < OB_WIN_COUNT; i++)
+		advk_pcie_disable_ob_win(pcie, i);
+
 	return 0;
 }
 

From: Chao Yu <[email protected]>

[ Upstream commit 9de71ede81e6d1a111fdd868b2d78d459fa77f80 ]

xfstest generic/587 reports a deadlock issue as below:

======================================================
WARNING: possible circular locking dependency detected
5.14.0-rc1 #69 Not tainted
------------------------------------------------------
repquota/8606 is trying to acquire lock:
ffff888022ac9320 (&sb->s_type->i_mutex_key#18){+.+.}-{3:3}, at: f2fs_quota_sync+0x207/0x300 [f2fs]

but task is already holding lock:
ffff8880084bcde8 (&sbi->quota_sem){.+.+}-{3:3}, at: f2fs_quota_sync+0x59/0x300 [f2fs]

which lock already depends on the new lock.

the existing dependency chain (in reverse order) is:

-> #2 (&sbi->quota_sem){.+.+}-{3:3}:

       __lock_acquire+0x648/0x10b0
       lock_acquire+0x128/0x470
       down_read+0x3b/0x2a0
       f2fs_quota_sync+0x59/0x300 [f2fs]
       f2fs_quota_on+0x48/0x100 [f2fs]
       do_quotactl+0x5e3/0xb30
       __x64_sys_quotactl+0x23a/0x4e0
       do_syscall_64+0x3b/0x90
       entry_SYSCALL_64_after_hwframe+0x44/0xae

-> #1 (&sbi->cp_rwsem){++++}-{3:3}:

       __lock_acquire+0x648/0x10b0
       lock_acquire+0x128/0x470
       down_read+0x3b/0x2a0
       f2fs_unlink+0x353/0x670 [f2fs]
       vfs_unlink+0x1c7/0x380
       do_unlinkat+0x413/0x4b0
       __x64_sys_unlinkat+0x50/0xb0
       do_syscall_64+0x3b/0x90
       entry_SYSCALL_64_after_hwframe+0x44/0xae

-> #0 (&sb->s_type->i_mutex_key#18){+.+.}-{3:3}:

       check_prev_add+0xdc/0xb30
       validate_chain+0xa67/0xb20
       __lock_acquire+0x648/0x10b0
       lock_acquire+0x128/0x470
       down_write+0x39/0xc0
       f2fs_quota_sync+0x207/0x300 [f2fs]
       do_quotactl+0xaff/0xb30
       __x64_sys_quotactl+0x23a/0x4e0
       do_syscall_64+0x3b/0x90
       entry_SYSCALL_64_after_hwframe+0x44/0xae

other info that might help us debug this:

Chain exists of:
  &sb->s_type->i_mutex_key#18 --> &sbi->cp_rwsem --> &sbi->quota_sem

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&sbi->quota_sem);
                               lock(&sbi->cp_rwsem);
                               lock(&sbi->quota_sem);

lock(&sb->s_type->i_mutex_key#18);

*** DEADLOCK ***

3 locks held by repquota/8606:
#0: ffff88801efac0e0 (&type->s_umount_key#53){++++}-{3:3}, at: user_get_super+0xd9/0x190 #1: ffff8880084bc380 (&sbi->cp_rwsem){++++}-{3:3}, at: f2fs_quota_sync+0x3e/0x300 [f2fs] #2: ffff8880084bcde8 (&sbi->quota_sem){.+.+}-{3:3}, at: f2fs_quota_sync+0x59/0x300 [f2fs]

stack backtrace:
CPU: 6 PID: 8606 Comm: repquota Not tainted 5.14.0-rc1 #69
Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
Call Trace:
 dump_stack_lvl+0xce/0x134
 dump_stack+0x17/0x20
 print_circular_bug.isra.0.cold+0x239/0x253
 check_noncircular+0x1be/0x1f0
 check_prev_add+0xdc/0xb30
 validate_chain+0xa67/0xb20
 __lock_acquire+0x648/0x10b0
 lock_acquire+0x128/0x470
 down_write+0x39/0xc0
 f2fs_quota_sync+0x207/0x300 [f2fs]
 do_quotactl+0xaff/0xb30
 __x64_sys_quotactl+0x23a/0x4e0
 do_syscall_64+0x3b/0x90
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f883b0b4efe

The root cause is ABBA deadlock of inode lock and cp_rwsem, reorder locks in f2fs_quota_sync() as below to fix this issue:
- lock inode
- lock cp_rwsem
- lock quota_sem

---
 fs/f2fs/super.c | 84 ++++++++++++++++++++++++++++---------------------
 1 file changed, 48 insertions(+), 36 deletions(-)

index dad91b1f3849..de543168b370 100644
@@ -2206,6 +2206,33 @@ static int f2fs_enable_quotas(struct super_block *sb)
 	return 0;
 }
 
+static int f2fs_quota_sync_file(struct f2fs_sb_info *sbi, int type)
+{
+	struct quota_info *dqopt = sb_dqopt(sbi->sb);
+	struct address_space *mapping = dqopt->files[type]->i_mapping;
+	int ret = 0;
+
+	ret = dquot_writeback_dquots(sbi->sb, type);
+	if (ret)
+		goto out;
+
+	ret = filemap_fdatawrite(mapping);
+	if (ret)
+		goto out;
+
+	/* if we are using journalled quota */
+	if (is_journalled_quota(sbi))
+		goto out;
+
+	ret = filemap_fdatawait(mapping);
+
+	truncate_inode_pages(&dqopt->files[type]->i_data, 0);
+out:
+	if (ret)
+		set_sbi_flag(sbi, SBI_QUOTA_NEED_REPAIR);
+	return ret;
+}
+
 int f2fs_quota_sync(struct super_block *sb, int type)
 {
 	struct f2fs_sb_info *sbi = F2FS_SB(sb);

@@ -2213,57 +2240,42 @@ int f2fs_quota_sync(struct super_block *sb, int type)
 	int cnt;
 	int ret;
 
-	/*
-	 * do_quotactl
-	 *  f2fs_quota_sync
-	 *  down_read(quota_sem)
-	 *  dquot_writeback_dquots()
-	 *  f2fs_dquot_commit
-	 *                            block_operation
-	 *                            down_read(quota_sem)
-	 */
-	f2fs_lock_op(sbi);
-
-	down_read(&sbi->quota_sem);
-	ret = dquot_writeback_dquots(sb, type);
-	if (ret)
-		goto out;
-
 	/*
 	 * Now when everything is written we can discard the pagecache so
 	 * that userspace sees the changes.
 	 */
 	for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
-		struct address_space *mapping;
 
 		if (type != -1 && cnt != type)
 			continue;
-		if (!sb_has_quota_active(sb, cnt))
-			continue;
 
-		mapping = dqopt->files[cnt]->i_mapping;
+		if (!sb_has_quota_active(sb, type))
+			return 0;
 
-		ret = filemap_fdatawrite(mapping);
-		if (ret)
-			goto out;
+		inode_lock(dqopt->files[cnt]);
 
-		/* if we are using journalled quota */
-		if (is_journalled_quota(sbi))
-			continue;
+		/*
+		 * do_quotactl
+		 *  f2fs_quota_sync
+		 *  down_read(quota_sem)
+		 *  dquot_writeback_dquots()
+		 *  f2fs_dquot_commit
+		 *			      block_operation
+		 *			      down_read(quota_sem)
+		 */
+		f2fs_lock_op(sbi);
+		down_read(&sbi->quota_sem);
 
-		ret = filemap_fdatawait(mapping);
-		if (ret)
-			set_sbi_flag(F2FS_SB(sb), SBI_QUOTA_NEED_REPAIR);
+		ret = f2fs_quota_sync_file(sbi, cnt);
+
+		up_read(&sbi->quota_sem);
+		f2fs_unlock_op(sbi);
 
-		inode_lock(dqopt->files[cnt]);
-		truncate_inode_pages(&dqopt->files[cnt]->i_data, 0);
 		inode_unlock(dqopt->files[cnt]);
+
+		if (ret)
+			break;
 	}
-out:
-	if (ret)
-		set_sbi_flag(F2FS_SB(sb), SBI_QUOTA_NEED_REPAIR);
-	up_read(&sbi->quota_sem);
-	f2fs_unlock_op(sbi);
 	return ret;
 }
 

2.30.2

From: Zhaoyu Liu <[email protected]>

[ Upstream commit 43878eb7c83d3335af7737dcce1fa79071065dfe ]

Remove all empty lines at the end of functions in pinctrl subsystem, and make the code neat.

---
 drivers/pinctrl/actions/pinctrl-owl.c         | 1 -
 drivers/pinctrl/core.c                        | 1 -
 drivers/pinctrl/freescale/pinctrl-imx1-core.c | 1 -
 drivers/pinctrl/mvebu/pinctrl-armada-37xx.c   | 1 -
 drivers/pinctrl/pinctrl-at91.c                | 1 -
 drivers/pinctrl/pinctrl-st.c                  | 1 -
 drivers/pinctrl/pinctrl-sx150x.c              | 1 -
 drivers/pinctrl/qcom/pinctrl-sdm845.c         | 1 -
 drivers/pinctrl/qcom/pinctrl-ssbi-mpp.c       | 1 -
 drivers/pinctrl/renesas/pfc-r8a77950.c        | 1 -
 drivers/pinctrl/renesas/pfc-r8a77951.c        | 1 -
 drivers/pinctrl/renesas/pfc-r8a7796.c         | 1 -
 drivers/pinctrl/renesas/pfc-r8a77965.c        | 1 -
 13 files changed, 13 deletions(-)

index 903a4baf3846..c8b3e396ea27 100644
@@ -444,7 +444,6 @@ static int owl_group_config_get(struct pinctrl_dev *pctrldev,
 	*config = pinconf_to_config_packed(param, arg);
 
 	return ret;
-
 }
 
 static int owl_group_config_set(struct pinctrl_dev *pctrldev,

index 20b477cd5a30..6e6825d17a1d 100644
@@ -2119,7 +2119,6 @@ struct pinctrl_dev *pinctrl_register(struct pinctrl_desc *pctldesc,
 		return ERR_PTR(error);
 
 	return pctldev;
-
 }
 EXPORT_SYMBOL_GPL(pinctrl_register);
 

index 08d110078c43..70186448d2f4 100644
@@ -290,7 +290,6 @@ static const struct pinctrl_ops imx1_pctrl_ops = {
 	.pin_dbg_show = imx1_pin_dbg_show,
 	.dt_node_to_map = imx1_dt_node_to_map,
 	.dt_free_map = imx1_dt_free_map,
-
 };
 
 static int imx1_pmx_set(struct pinctrl_dev *pctldev, unsigned selector,

index 68894e9e05d2..5a68e242f6b3 100644
@@ -188,7 +188,6 @@ static struct armada_37xx_pin_group armada_37xx_nb_groups[] = {
 	PIN_GRP_GPIO_2("led1_od", 12, 1, BIT(21), BIT(21), 0, "led"),
 	PIN_GRP_GPIO_2("led2_od", 13, 1, BIT(22), BIT(22), 0, "led"),
 	PIN_GRP_GPIO_2("led3_od", 14, 1, BIT(23), BIT(23), 0, "led"),
-
 };
 
 static struct armada_37xx_pin_group armada_37xx_sb_groups[] = {