5.15.46-rc1 review

From: Marek Vasut <[email protected]>

[ Upstream commit 2dcec57b3734029cc1adc5cb872f61e21609eed4 ]

The chip register layout has nothing to do with MIPI DCS, the registers incorrectly marked as MIPI DCS in the driver are regular chip registers often with completely different function.

Fill in the actual register names and bits from [1] and [2] and add the entire register layout, since the documentation for this chip is hard to come by.

[1] https://github.com/rockchip-linux/kernel/blob/develop-4.19/drivers/gpu/drm/bridge/icn6211.c
[2] https://github.com/tdjastrzebski/ICN6211-Configurator

To: [email protected]

---
 drivers/gpu/drm/bridge/chipone-icn6211.c | 134 ++++++++++++++++++++---
 1 file changed, 117 insertions(+), 17 deletions(-)

index a6151db95586..eb26615b2993 100644
@@ -14,8 +14,19 @@
 #include <linux/of_device.h>
 #include <linux/regulator/consumer.h>
 
-#include <video/mipi_display.h>
-
+#define VENDOR_ID		0x00
+#define DEVICE_ID_H		0x01
+#define DEVICE_ID_L		0x02
+#define VERSION_ID		0x03
+#define FIRMWARE_VERSION	0x08
+#define CONFIG_FINISH		0x09
+#define PD_CTRL(n)		(0x0a + ((n) & 0x3)) /* 0..3 */
+#define RST_CTRL(n)		(0x0e + ((n) & 0x1)) /* 0..1 */
+#define SYS_CTRL(n)		(0x10 + ((n) & 0x7)) /* 0..4 */
+#define RGB_DRV(n)		(0x18 + ((n) & 0x3)) /* 0..3 */
+#define RGB_DLY(n)		(0x1c + ((n) & 0x1)) /* 0..1 */
+#define RGB_TEST_CTRL		0x1e
+#define ATE_PLL_EN		0x1f
 #define HACTIVE_LI		0x20
 #define VACTIVE_LI		0x21
 #define VACTIVE_HACTIVE_HI	0x22

@@ -26,6 +37,95 @@
 #define VFP			0x27
 #define VSYNC			0x28
 #define VBP			0x29
+#define BIST_POL		0x2a
+#define BIST_POL_BIST_MODE(n)		(((n) & 0xf) << 4)
+#define BIST_POL_BIST_GEN		BIT(3)
+#define BIST_POL_HSYNC_POL		BIT(2)
+#define BIST_POL_VSYNC_POL		BIT(1)
+#define BIST_POL_DE_POL			BIT(0)
+#define BIST_RED		0x2b
+#define BIST_GREEN		0x2c
+#define BIST_BLUE		0x2d
+#define BIST_CHESS_X		0x2e
+#define BIST_CHESS_Y		0x2f
+#define BIST_CHESS_XY_H		0x30
+#define BIST_FRAME_TIME_L	0x31
+#define BIST_FRAME_TIME_H	0x32
+#define FIFO_MAX_ADDR_LOW	0x33
+#define SYNC_EVENT_DLY		0x34
+#define HSW_MIN			0x35
+#define HFP_MIN			0x36
+#define LOGIC_RST_NUM		0x37
+#define OSC_CTRL(n)		(0x48 + ((n) & 0x7)) /* 0..5 */
+#define BG_CTRL			0x4e
+#define LDO_PLL			0x4f
+#define PLL_CTRL(n)		(0x50 + ((n) & 0xf)) /* 0..15 */
+#define PLL_CTRL_6_EXTERNAL		0x90
+#define PLL_CTRL_6_MIPI_CLK		0x92
+#define PLL_CTRL_6_INTERNAL		0x93
+#define PLL_REM(n)		(0x60 + ((n) & 0x3)) /* 0..2 */
+#define PLL_DIV(n)		(0x63 + ((n) & 0x3)) /* 0..2 */
+#define PLL_FRAC(n)		(0x66 + ((n) & 0x3)) /* 0..2 */
+#define PLL_INT(n)		(0x69 + ((n) & 0x1)) /* 0..1 */
+#define PLL_REF_DIV		0x6b
+#define PLL_REF_DIV_P(n)		((n) & 0xf)
+#define PLL_REF_DIV_Pe			BIT(4)
+#define PLL_REF_DIV_S(n)		(((n) & 0x7) << 5)
+#define PLL_SSC_P(n)		(0x6c + ((n) & 0x3)) /* 0..2 */
+#define PLL_SSC_STEP(n)		(0x6f + ((n) & 0x3)) /* 0..2 */
+#define PLL_SSC_OFFSET(n)	(0x72 + ((n) & 0x3)) /* 0..3 */
+#define GPIO_OEN		0x79
+#define MIPI_CFG_PW		0x7a
+#define MIPI_CFG_PW_CONFIG_DSI		0xc1
+#define MIPI_CFG_PW_CONFIG_I2C		0x3e
+#define GPIO_SEL(n)		(0x7b + ((n) & 0x1)) /* 0..1 */
+#define IRQ_SEL			0x7d
+#define DBG_SEL			0x7e
+#define DBG_SIGNAL		0x7f
+#define MIPI_ERR_VECTOR_L	0x80
+#define MIPI_ERR_VECTOR_H	0x81
+#define MIPI_ERR_VECTOR_EN_L	0x82
+#define MIPI_ERR_VECTOR_EN_H	0x83
+#define MIPI_MAX_SIZE_L		0x84
+#define MIPI_MAX_SIZE_H		0x85
+#define DSI_CTRL		0x86
+#define DSI_CTRL_UNKNOWN		0x28
+#define DSI_CTRL_DSI_LANES(n)		((n) & 0x3)
+#define MIPI_PN_SWAP		0x87
+#define MIPI_PN_SWAP_CLK		BIT(4)
+#define MIPI_PN_SWAP_D(n)		BIT((n) & 0x3)
+#define MIPI_SOT_SYNC_BIT_(n)	(0x88 + ((n) & 0x1)) /* 0..1 */
+#define MIPI_ULPS_CTRL		0x8a
+#define MIPI_CLK_CHK_VAR	0x8e
+#define MIPI_CLK_CHK_INI	0x8f
+#define MIPI_T_TERM_EN		0x90
+#define MIPI_T_HS_SETTLE	0x91
+#define MIPI_T_TA_SURE_PRE	0x92
+#define MIPI_T_LPX_SET		0x94
+#define MIPI_T_CLK_MISS		0x95
+#define MIPI_INIT_TIME_L	0x96
+#define MIPI_INIT_TIME_H	0x97
+#define MIPI_T_CLK_TERM_EN	0x99
+#define MIPI_T_CLK_SETTLE	0x9a
+#define MIPI_TO_HS_RX_L		0x9e
+#define MIPI_TO_HS_RX_H		0x9f
+#define MIPI_PHY_(n)		(0xa0 + ((n) & 0x7)) /* 0..5 */
+#define MIPI_PD_RX		0xb0
+#define MIPI_PD_TERM		0xb1
+#define MIPI_PD_HSRX		0xb2
+#define MIPI_PD_LPTX		0xb3
+#define MIPI_PD_LPRX		0xb4
+#define MIPI_PD_CK_LANE		0xb5
+#define MIPI_FORCE_0		0xb6
+#define MIPI_RST_CTRL		0xb7
+#define MIPI_RST_NUM		0xb8
+#define MIPI_DBG_SET_(n)	(0xc0 + ((n) & 0xf)) /* 0..9 */
+#define MIPI_DBG_SEL		0xe0
+#define MIPI_DBG_DATA		0xe1
+#define MIPI_ATE_TEST_SEL	0xe2
+#define MIPI_ATE_STATUS_(n)	(0xe3 + ((n) & 0x1)) /* 0..1 */
+#define MIPI_ATE_STATUS_1	0xe4
+#define ICN6211_MAX_REGISTER	MIPI_ATE_STATUS(1)
 
 struct chipone {
 	struct device *dev;

@@ -66,13 +166,13 @@ static void chipone_enable(struct drm_bridge *bridge)
 	struct chipone *icn = bridge_to_chipone(bridge);
 	struct drm_display_mode *mode = bridge_to_mode(bridge);
 
-	ICN6211_DSI(icn, 0x7a, 0xc1);
+	ICN6211_DSI(icn, MIPI_CFG_PW, MIPI_CFG_PW_CONFIG_DSI);
 
 	ICN6211_DSI(icn, HACTIVE_LI, mode->hdisplay & 0xff);
 
 	ICN6211_DSI(icn, VACTIVE_LI, mode->vdisplay & 0xff);
 
-	/**
+	/*
 	 * lsb nibble: 2nd nibble of hdisplay
 	 * msb nibble: 2nd nibble of vdisplay
 	 */

@@ -95,21 +195,21 @@ static void chipone_enable(struct drm_bridge *bridge)
 	ICN6211_DSI(icn, VBP, mode->vtotal - mode->vsync_end);
 
 	/* dsi specific sequence */
-	ICN6211_DSI(icn, MIPI_DCS_SET_TEAR_OFF, 0x80);
-	ICN6211_DSI(icn, MIPI_DCS_SET_ADDRESS_MODE, 0x28);
-	ICN6211_DSI(icn, 0xb5, 0xa0);
-	ICN6211_DSI(icn, 0x5c, 0xff);
-	ICN6211_DSI(icn, MIPI_DCS_SET_COLUMN_ADDRESS, 0x01);
-	ICN6211_DSI(icn, MIPI_DCS_GET_POWER_SAVE, 0x92);
-	ICN6211_DSI(icn, 0x6b, 0x71);
-	ICN6211_DSI(icn, 0x69, 0x2b);
-	ICN6211_DSI(icn, MIPI_DCS_ENTER_SLEEP_MODE, 0x40);
-	ICN6211_DSI(icn, MIPI_DCS_EXIT_SLEEP_MODE, 0x98);
+	ICN6211_DSI(icn, SYNC_EVENT_DLY, 0x80);
+	ICN6211_DSI(icn, HFP_MIN, 0x28);
+	ICN6211_DSI(icn, MIPI_PD_CK_LANE, 0xa0);
+	ICN6211_DSI(icn, PLL_CTRL(12), 0xff);
+	ICN6211_DSI(icn, BIST_POL, BIST_POL_DE_POL);
+	ICN6211_DSI(icn, PLL_CTRL(6), PLL_CTRL_6_MIPI_CLK);
+	ICN6211_DSI(icn, PLL_REF_DIV, 0x71);
+	ICN6211_DSI(icn, PLL_INT(0), 0x2b);
+	ICN6211_DSI(icn, SYS_CTRL(0), 0x40);
+	ICN6211_DSI(icn, SYS_CTRL(1), 0x98);
 
 	/* icn6211 specific sequence */
-	ICN6211_DSI(icn, 0xb6, 0x20);
-	ICN6211_DSI(icn, 0x51, 0x20);
-	ICN6211_DSI(icn, 0x09, 0x10);
+	ICN6211_DSI(icn, MIPI_FORCE_0, 0x20);
+	ICN6211_DSI(icn, PLL_CTRL(1), 0x20);
+	ICN6211_DSI(icn, CONFIG_FINISH, 0x10);
 
 	usleep_range(10000, 11000);
 }

2.35.1

From: Marek Vasut <[email protected]>

[ Upstream commit c0ff7a649d62105a9308cc3ac36e52a4669d9cb4 ]

The HFP_HSW_HBP_HI register must be programmed with 2 LSbits of each Horizontal Front Porch/Sync/Back Porch. Currently the driver programs this register to 0, which breaks displays with either value above 255.

The HFP_MIN register must be set to the same value as HFP_LI, otherwise there is visible image distortion, usually in the form of missing lines at the bottom of the panel.

Fix this by correctly programming the HFP_HSW_HBP_HI and HFP_MIN registers.

To: [email protected]

---
 drivers/gpu/drm/bridge/chipone-icn6211.c | 23 ++++++++++++++++-------
 1 file changed, 16 insertions(+), 7 deletions(-)

index eb26615b2993..d7eedf35e841 100644
@@ -34,6 +34,9 @@
 #define HSYNC_LI		0x24
 #define HBP_LI			0x25
 #define HFP_HSW_HBP_HI		0x26
+#define HFP_HSW_HBP_HI_HFP(n)		(((n) & 0x300) >> 4)
+#define HFP_HSW_HBP_HI_HS(n)		(((n) & 0x300) >> 6)
+#define HFP_HSW_HBP_HI_HBP(n)		(((n) & 0x300) >> 8)
 #define VFP			0x27
 #define VSYNC			0x28
 #define VBP			0x29

@@ -165,6 +168,7 @@ static void chipone_enable(struct drm_bridge *bridge)
 {
 	struct chipone *icn = bridge_to_chipone(bridge);
 	struct drm_display_mode *mode = bridge_to_mode(bridge);
+	u16 hfp, hbp, hsync;
 
 	ICN6211_DSI(icn, MIPI_CFG_PW, MIPI_CFG_PW_CONFIG_DSI);
 

@@ -180,13 +184,18 @@ static void chipone_enable(struct drm_bridge *bridge)
 		    ((mode->hdisplay >> 8) & 0xf) |
 		    (((mode->vdisplay >> 8) & 0xf) << 4));
 
-	ICN6211_DSI(icn, HFP_LI, mode->hsync_start - mode->hdisplay);
+	hfp = mode->hsync_start - mode->hdisplay;
+	hsync = mode->hsync_end - mode->hsync_start;
+	hbp = mode->htotal - mode->hsync_end;
 
-	ICN6211_DSI(icn, HSYNC_LI, mode->hsync_end - mode->hsync_start);
-
-	ICN6211_DSI(icn, HBP_LI, mode->htotal - mode->hsync_end);
-
-	ICN6211_DSI(icn, HFP_HSW_HBP_HI, 0x00);
+	ICN6211_DSI(icn, HFP_LI, hfp & 0xff);
+	ICN6211_DSI(icn, HSYNC_LI, hsync & 0xff);
+	ICN6211_DSI(icn, HBP_LI, hbp & 0xff);
+	/* Top two bits of Horizontal Front porch/Sync/Back porch */
+	ICN6211_DSI(icn, HFP_HSW_HBP_HI,
+		    HFP_HSW_HBP_HI_HFP(hfp) |
+		    HFP_HSW_HBP_HI_HS(hsync) |
+		    HFP_HSW_HBP_HI_HBP(hbp));
 
 	ICN6211_DSI(icn, VFP, mode->vsync_start - mode->vdisplay);
 

@@ -196,7 +205,7 @@ static void chipone_enable(struct drm_bridge *bridge)
 
 	/* dsi specific sequence */
 	ICN6211_DSI(icn, SYNC_EVENT_DLY, 0x80);
-	ICN6211_DSI(icn, HFP_MIN, 0x28);
+	ICN6211_DSI(icn, HFP_MIN, hfp & 0xff);
 	ICN6211_DSI(icn, MIPI_PD_CK_LANE, 0xa0);
 	ICN6211_DSI(icn, PLL_CTRL(12), 0xff);
 	ICN6211_DSI(icn, BIST_POL, BIST_POL_DE_POL);

2.35.1

From: Rik van der Kemp <[email protected]>

commit 15dad62f4bdb5dc0f0efde8181d680db9963544c upstream.

The 2022-model XPS 15 appears to use the same 4-speakers-on-ALC289 audio setup as the Dell XPS 15 9510, so requires the same quirk to enable woofer output. Tested on my own 9520.

[ Move the entry to the right position in the SSID order -- tiwai ]

---
 sound/pci/hda/patch_realtek.c |    1 +
 1 file changed, 1 insertion(+)

@@ -8713,6 +8713,7 @@ static const struct snd_pci_quirk alc269
 	SND_PCI_QUIRK(0x1028, 0x0a62, "Dell Precision 5560", ALC289_FIXUP_DUAL_SPK),
 	SND_PCI_QUIRK(0x1028, 0x0a9d, "Dell Latitude 5430", ALC269_FIXUP_DELL4_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1028, 0x0a9e, "Dell Latitude 5430", ALC269_FIXUP_DELL4_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1028, 0x0b19, "Dell XPS 15 9520", ALC289_FIXUP_DUAL_SPK),
 	SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2),

From: Takashi Iwai <[email protected]>

commit 0125de38122f0f66bf61336158d12a1aabfe6425 upstream.

At closing a USB MIDI output substream, there might be still a pending work, which would eventually access the rawmidi runtime object that is being released. For fixing the race, make sure to cancel the pending work at closing.

---
 sound/usb/midi.c |    3 +++
 1 file changed, 3 insertions(+)

@@ -1145,6 +1145,9 @@ static int snd_usbmidi_output_open(struc
 
 static int snd_usbmidi_output_close(struct snd_rawmidi_substream *substream)
 {
+	struct usbmidi_out_port *port = substream->runtime->private_data;
+
+	cancel_work_sync(&port->ep->work);
 	return substream_open(substream, 0, 0);
 }
 

From: Stephen Boyd <[email protected]>

commit 73e2d827a501d48dceeb5b9b267a4cd283d6b1ae upstream.

A static key warning splat appears during early boot on arm64 systems that credit randomness from devicetrees that contain an "rng-seed" property. This is because setup_machine_fdt() is called before jump_label_init() during setup_arch(). Let's swap the order of these two calls so that jump labels are initialized before the devicetree is unflattened and the rng seed is credited.

static_key_enable_cpuslocked(): static key '0xffffffe51c6fcfc0' used before call to jump_label_init()

 WARNING: CPU: 0 PID: 0 at kernel/jump_label.c:166 static_key_enable_cpuslocked+0xb0/0xb8
 Modules linked in:
 CPU: 0 PID: 0 Comm: swapper Not tainted 5.18.0+ #224 44b43e377bfc84bc99bb5ab885ff694984ee09ff
 pstate: 600001c9 (nZCv dAIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
 pc : static_key_enable_cpuslocked+0xb0/0xb8
 lr : static_key_enable_cpuslocked+0xb0/0xb8
 sp : ffffffe51c393cf0
 x29: ffffffe51c393cf0 x28: 000000008185054c x27: 00000000f1042f10
 x26: 0000000000000000 x25: 00000000f10302b2 x24: 0000002513200000
 x23: 0000002513200000 x22: ffffffe51c1c9000 x21: fffffffdfdc00000
 x20: ffffffe51c2f0831 x19: ffffffe51c6fcfc0 x18: 00000000ffff1020
 x17: 00000000e1e2ac90 x16: 00000000000000e0 x15: ffffffe51b710708
 x14: 0000000000000066 x13: 0000000000000018 x12: 0000000000000000
 x11: 0000000000000000 x10: 00000000ffffffff x9 : 0000000000000000
 x8 : 0000000000000000 x7 : 61632065726f6665 x6 : 6220646573752027
 x5 : ffffffe51c641d25 x4 : ffffffe51c13142c x3 : ffff0a00ffffff05
 x2 : 40000000ffffe003 x1 : 00000000000001c0 x0 : 0000000000000065
 Call trace:
  static_key_enable_cpuslocked+0xb0/0xb8
  static_key_enable+0x2c/0x40
  crng_set_ready+0x24/0x30
  execute_in_process_context+0x80/0x90
  _credit_init_bits+0x100/0x154
  add_bootloader_randomness+0x64/0x78
  early_init_dt_scan_chosen+0x140/0x184
  early_init_dt_scan_nodes+0x28/0x4c
  early_init_dt_scan+0x40/0x44
  setup_machine_fdt+0x7c/0x120
  setup_arch+0x74/0x1d8
  start_kernel+0x84/0x44c
  __primary_switched+0xc0/0xc8
 ---[ end trace 0000000000000000 ]---
 random: crng init done
 Machine model: Google Lazor (rev1 - 2) with LTE

---
 arch/arm64/kernel/setup.c |    7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

@@ -307,13 +307,14 @@ void __init __no_sanitize_address setup_
 	early_fixmap_init();
 	early_ioremap_init();
 
-	setup_machine_fdt(__fdt_pointer);
-
 	/*
 	 * Initialise the static keys early as they may be enabled by the
-	 * cpufeature code and early parameters.
+	 * cpufeature code, early parameters, and DT setup.
 	 */
 	jump_label_init();
+
+	setup_machine_fdt(__fdt_pointer);
+
 	parse_early_param();
 
 	/*

From: Kailang Yang <[email protected]>

commit 60571929d06b028800f27b51a7c81de1144944cf upstream.

Add new type for ALC245.

---
 sound/pci/hda/patch_realtek.c |   10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

@@ -3126,6 +3126,7 @@ enum {
 	ALC269_TYPE_ALC257,
 	ALC269_TYPE_ALC215,
 	ALC269_TYPE_ALC225,
+	ALC269_TYPE_ALC245,
 	ALC269_TYPE_ALC287,
 	ALC269_TYPE_ALC294,
 	ALC269_TYPE_ALC300,

@@ -3163,6 +3164,7 @@ static int alc269_parse_auto_config(stru
 	case ALC269_TYPE_ALC257:
 	case ALC269_TYPE_ALC215:
 	case ALC269_TYPE_ALC225:
+	case ALC269_TYPE_ALC245:
 	case ALC269_TYPE_ALC287:
 	case ALC269_TYPE_ALC294:
 	case ALC269_TYPE_ALC300:

@@ -3690,7 +3692,8 @@ static void alc225_init(struct hda_codec
 	hda_nid_t hp_pin = alc_get_hp_pin(spec);
 	bool hp1_pin_sense, hp2_pin_sense;
 
-	if (spec->codec_variant != ALC269_TYPE_ALC287)
+	if (spec->codec_variant != ALC269_TYPE_ALC287 &&
+		spec->codec_variant != ALC269_TYPE_ALC245)
 		/* required only at boot or S3 and S4 resume time */
 		if (!spec->done_hp_init ||
 			is_s3_resume(codec) ||

@@ -9879,7 +9882,10 @@ static int patch_alc269(struct hda_codec
 	case 0x10ec0245:
 	case 0x10ec0285:
 	case 0x10ec0289:
-		spec->codec_variant = ALC269_TYPE_ALC215;
+		if (alc_get_coef0(codec) & 0x0010)
+			spec->codec_variant = ALC269_TYPE_ALC245;
+		else
+			spec->codec_variant = ALC269_TYPE_ALC215;
 		spec->shutup = alc225_shutup;
 		spec->init_hook = alc225_init;
 		spec->gen.mixer_nid = 0;

From: Carl Yin(殷张成) <[email protected]>

commit 33b7af2f459df453feb0d44628d820c47fefe7a8 upstream.

The BG95 modem has 3 USB configurations that are configurable via the AT command AT+QCFGEXT="usbnet",["ecm"|"modem"|"rmnet"] which make the modem enumerate with the following interfaces, respectively:

"modem": Diag + GNSS + Modem + Modem
"ecm" : Diag + GNSS + Modem + ECM
"rmnet": Diag + GNSS + Modem + QMI
Don't support Full QMI messages (e.g WDS_START_NETWORK_INTERFACE)

A detailed description of the USB configuration for each mode follows:

+QCFGEXT: "usbnet","modem"
--------------------------

T:  Bus=01 Lev=02 Prnt=02 Port=01 Cnt=01 Dev#=  3 Spd=480  MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=2c7c ProdID=0700 Rev= 0.00
S:  Manufacturer=Quectel, Incorporated
S:  Product=Quectel LPWA Module
S:  SerialNumber=884328a2
C:* #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E:  Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E:  Ad=83(I) Atr=03(Int.) MxPS=  64 Ivl=2ms
E:  Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fe Prot=ff Driver=option
E:  Ad=85(I) Atr=03(Int.) MxPS=  64 Ivl=2ms
E:  Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms

+QCFGEXT: "usbnet","ecm"
------------------------

T:  Bus=01 Lev=02 Prnt=02 Port=01 Cnt=01 Dev#=  4 Spd=480  MxCh= 0
D:  Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=2c7c ProdID=0700 Rev= 0.00
S:  Manufacturer=Quectel, Incorporated
S:  Product=Quectel LPWA Module
S:  SerialNumber=884328a2
C:* #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA
A:  FirstIf#= 3 IfCount= 2 Cls=02(comm.) Sub=00 Prot=00
I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E:  Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E:  Ad=83(I) Atr=03(Int.) MxPS=  64 Ivl=2ms
E:  Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 3 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=06 Prot=00 Driver=cdc_ether
E:  Ad=85(I) Atr=03(Int.) MxPS=  64 Ivl=2ms
I:  If#= 4 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether
I:* If#= 4 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether
E:  Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms

+QCFGEXT: "usbnet","rmnet"
--------------------------

T:  Bus=01 Lev=02 Prnt=02 Port=01 Cnt=01 Dev#=  4 Spd=480  MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=2c7c ProdID=0700 Rev= 0.00
S:  Manufacturer=Quectel, Incorporated
S:  Product=Quectel LPWA Module
S:  SerialNumber=884328a2
C:* #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E:  Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E:  Ad=83(I) Atr=03(Int.) MxPS=  64 Ivl=2ms
E:  Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
E:  Ad=85(I) Atr=03(Int.) MxPS=  64 Ivl=2ms
E:  Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms

---
 drivers/usb/serial/option.c |    2 ++
 1 file changed, 2 insertions(+)

@@ -1137,6 +1137,8 @@ static const struct usb_device_id option
 	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM12, 0xff, 0, 0) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, 0x0620, 0xff, 0xff, 0x30) },	/* EM160R-GL */
 	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, 0x0620, 0xff, 0, 0) },
+	{ USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, 0x0700, 0xff), /* BG95 */
+	  .driver_info = RSVD(3) | ZLP },
 	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0xff, 0x30) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0, 0) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0xff, 0x10),

From: Albert Wang <[email protected]>

commit 3c5880745b4439ac64eccdb040e37fc1cc4c5406 upstream.

When dwc3_gadget_ep_cleanup_completed_requests() called to dwc3_gadget_giveback() where the dwc3 lock is released, other thread is able to execute. In this situation, usb_ep_disable() gets the chance to clear endpoint descriptor pointer which leds to the null pointer dereference problem. So needs to move the null pointer check to a proper place.

Example call stack:

Thread#1:
dwc3_thread_interrupt()
spin_lock
-> dwc3_process_event_buf()
-> dwc3_process_event_entry()

    -> dwc3_endpoint_interrupt()
     -> dwc3_gadget_endpoint_trbs_complete()
      -> dwc3_gadget_ep_cleanup_completed_requests()
       ...
       -> dwc3_giveback()
          spin_unlock
          Thread#2 executes

Thread#2:
configfs_composite_disconnect()
-> __composite_disconnect()
-> ffs_func_disable()

    -> ffs_func_set_alt()
     -> ffs_func_eps_disable()
      -> usb_ep_disable()
         wait for dwc3 spin_lock
         Thread#1 released lock
         clear endpoint.desc

---
 drivers/usb/dwc3/gadget.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

@@ -3305,14 +3305,14 @@ static bool dwc3_gadget_endpoint_trbs_co
 	struct dwc3		*dwc = dep->dwc;
 	bool			no_started_trb = true;
 
-	if (!dep->endpoint.desc)
-		return no_started_trb;
-
 	dwc3_gadget_ep_cleanup_completed_requests(dep, event, status);
 
 	if (dep->flags & DWC3_EP_END_TRANSFER_PENDING)
 		goto out;
 
+	if (!dep->endpoint.desc)
+		return no_started_trb;
+
 	if (usb_endpoint_xfer_isoc(dep->endpoint.desc) &&
 		list_empty(&dep->started_list) &&
 		(list_empty(&dep->pending_list) || status == -EXDEV))

From: Johan Hovold <[email protected]>

commit e82e7c6dde91acd6748d672a44dc1980ce239f86 upstream.

At least one pl2303 device has a bcdUSB of 1.0.1 which most likely was was intended as 1.1.

Allow bcdDevice 1.0.1 but interpret it as 1.1.

---
 drivers/usb/serial/pl2303.c |    3 +++
 1 file changed, 3 insertions(+)

@@ -421,6 +421,9 @@ static int pl2303_detect_type(struct usb
 	bcdUSB = le16_to_cpu(desc->bcdUSB);
 
 	switch (bcdUSB) {
+	case 0x101:
+		/* USB 1.0.1? Let's assume they meant 1.1... */
+		fallthrough;
 	case 0x110:
 		switch (bcdDevice) {
 		case 0x300:

From: Niklas Cassel <[email protected]>

commit 6045ab5fea4c849153ebeb0acb532da5f29d69c4 upstream.

bFLT binaries are usually created using elf2flt.

The linker script used by elf2flt has defined the .data section like the following for the last 19 years:

.data : {
	_sdata = . ;
	__data_start = . ;
	data_start = . ;
	*(.got.plt)
	*(.got)
	FILL(0) ;
	. = ALIGN(0x20) ;
	LONG(-1)
	. = ALIGN(0x20) ;
	...
}

It places the .got.plt input section before the .got input section. The same is true for the default linker script (ld --verbose) on most architectures except x86/x86-64.

The binfmt_flat loader should relocate all GOT entries until it encounters a -1 (the LONG(-1) in the linker script).

The problem is that the .got.plt input section starts with a GOTPLT header (which has size 16 bytes on elf64-riscv and 8 bytes on elf32-riscv), where the first word is set to -1. See the binutils implementation for riscv [1].

This causes the binfmt_flat loader to stop relocating GOT entries prematurely and thus causes the application to crash when running.

Fix this by skipping the whole GOTPLT header, since the whole GOTPLT header is reserved for the dynamic linker.

The GOTPLT header will only be skipped for bFLT binaries with flag FLAT_FLAG_GOTPIC set. This flag is unconditionally set by elf2flt if the supplied ELF binary has the symbol _GLOBAL_OFFSET_TABLE_ defined. ELF binaries without a .got input section should thus remain unaffected.

Tested on RISC-V Canaan Kendryte K210 and RISC-V QEMU nommu_virt_defconfig.

[1] https://sourceware.org/git/?p=binutils-gdb.git;a=blob;f=bfd/elfnn-riscv.c;hb=binutils-2_38#l3275

---
 fs/binfmt_flat.c |   27 ++++++++++++++++++++++++++-
 1 file changed, 26 insertions(+), 1 deletion(-)

@@ -433,6 +433,30 @@ static void old_reloc(unsigned long rl)
 
 /****************************************************************************/
 
+static inline u32 __user *skip_got_header(u32 __user *rp)
+{
+	if (IS_ENABLED(CONFIG_RISCV)) {
+		/*
+		 * RISC-V has a 16 byte GOT PLT header for elf64-riscv
+		 * and 8 byte GOT PLT header for elf32-riscv.
+		 * Skip the whole GOT PLT header, since it is reserved
+		 * for the dynamic linker (ld.so).
+		 */
+		u32 rp_val0, rp_val1;
+
+		if (get_user(rp_val0, rp))
+			return rp;
+		if (get_user(rp_val1, rp + 1))
+			return rp;
+
+		if (rp_val0 == 0xffffffff && rp_val1 == 0xffffffff)
+			rp += 4;
+		else if (rp_val0 == 0xffffffff)
+			rp += 2;
+	}
+	return rp;
+}
+
 static int load_flat_file(struct linux_binprm *bprm,
 		struct lib_info *libinfo, int id, unsigned long *extra_stack)
 {

@@ -782,7 +806,8 @@ static int load_flat_file(struct linux_b
 	 * image.
 	 */
 	if (flags & FLAT_FLAG_GOTPIC) {
-		for (rp = (u32 __user *)datapos; ; rp++) {
+		rp = skip_got_header((u32 __user *) datapos);
+		for (; ; rp++) {
 			u32 addr, rp_val;
 			if (get_user(rp_val, rp))
 				return -EFAULT;

From: Kishon Vijay Abraham I <[email protected]>

commit a44623d9279086c89f631201d993aa332f7c9e66 upstream.

It has been observed with certain PCIe USB cards (like Inateck connected to AM64 EVM or J7200 EVM) that as soon as the primary roothub is registered, port status change is handled even before xHC is running leading to cold plug USB devices not detected. For such cases, registering both the root hubs along with the second HCD is required. Add support for deferring roothub registration in usb_add_hcd(), so that both primary and secondary roothubs are registered along with the second HCD.

This patch has been added and reverted earier as it triggered a race in usb device enumeration.
That race is now fixed in 5.16-rc3, and in stable back to 5.4 commit 6cca13de26ee ("usb: hub: Fix locking issues with address0_mutex") commit 6ae6dc22d2d1 ("usb: hub: Fix usb enumeration issue due to address0 race")

---
 drivers/usb/core/hcd.c  |   29 +++++++++++++++++++++++------
 include/linux/usb/hcd.h |    2 ++
 2 files changed, 25 insertions(+), 6 deletions(-)

@@ -2816,6 +2816,7 @@ int usb_add_hcd(struct usb_hcd *hcd,
 {
 	int retval;
 	struct usb_device *rhdev;
+	struct usb_hcd *shared_hcd;
 
 	if (!hcd->skip_phy_initialization && usb_hcd_is_primary_hcd(hcd)) {
 		hcd->phy_roothub = usb_phy_roothub_alloc(hcd->self.sysdev);

@@ -2976,13 +2977,26 @@ int usb_add_hcd(struct usb_hcd *hcd,
 		goto err_hcd_driver_start;
 	}
 
+	/* starting here, usbcore will pay attention to the shared HCD roothub */
+	shared_hcd = hcd->shared_hcd;
+	if (!usb_hcd_is_primary_hcd(hcd) && shared_hcd && HCD_DEFER_RH_REGISTER(shared_hcd)) {
+		retval = register_root_hub(shared_hcd);
+		if (retval != 0)
+			goto err_register_root_hub;
+
+		if (shared_hcd->uses_new_polling && HCD_POLL_RH(shared_hcd))
+			usb_hcd_poll_rh_status(shared_hcd);
+	}
+
 	/* starting here, usbcore will pay attention to this root hub */
-	retval = register_root_hub(hcd);
-	if (retval != 0)
-		goto err_register_root_hub;
+	if (!HCD_DEFER_RH_REGISTER(hcd)) {
+		retval = register_root_hub(hcd);
+		if (retval != 0)
+			goto err_register_root_hub;
 
-	if (hcd->uses_new_polling && HCD_POLL_RH(hcd))
-		usb_hcd_poll_rh_status(hcd);
+		if (hcd->uses_new_polling && HCD_POLL_RH(hcd))
+			usb_hcd_poll_rh_status(hcd);
+	}
 
 	return retval;
 

@@ -3020,6 +3034,7 @@ EXPORT_SYMBOL_GPL(usb_add_hcd);
 void usb_remove_hcd(struct usb_hcd *hcd)
 {
 	struct usb_device *rhdev = hcd->self.root_hub;
+	bool rh_registered;
 
 	dev_info(hcd->self.controller, "remove, state %x\n", hcd->state);
 

@@ -3030,6 +3045,7 @@ void usb_remove_hcd(struct usb_hcd *hcd)
 
 	dev_dbg(hcd->self.controller, "roothub graceful disconnect\n");
 	spin_lock_irq (&hcd_root_hub_lock);
+	rh_registered = hcd->rh_registered;
 	hcd->rh_registered = 0;
 	spin_unlock_irq (&hcd_root_hub_lock);
 

@@ -3039,7 +3055,8 @@ void usb_remove_hcd(struct usb_hcd *hcd)
 	cancel_work_sync(&hcd->died_work);
 
 	mutex_lock(&usb_bus_idr_lock);
-	usb_disconnect(&rhdev);		/* Sets rhdev to NULL */
+	if (rh_registered)
+		usb_disconnect(&rhdev);		/* Sets rhdev to NULL */
 	mutex_unlock(&usb_bus_idr_lock);
 
 	/*

@@ -124,6 +124,7 @@ struct usb_hcd {
 #define HCD_FLAG_RH_RUNNING		5	/* root hub is running? */
 #define HCD_FLAG_DEAD			6	/* controller has died? */
 #define HCD_FLAG_INTF_AUTHORIZED	7	/* authorize interfaces? */
+#define HCD_FLAG_DEFER_RH_REGISTER	8	/* Defer roothub registration */
 
 	/* The flags can be tested using these macros; they are likely to
 	 * be slightly faster than test_bit().

@@ -134,6 +135,7 @@ struct usb_hcd {
 #define HCD_WAKEUP_PENDING(hcd)	((hcd)->flags & (1U << HCD_FLAG_WAKEUP_PENDING))
 #define HCD_RH_RUNNING(hcd)	((hcd)->flags & (1U << HCD_FLAG_RH_RUNNING))
 #define HCD_DEAD(hcd)		((hcd)->flags & (1U << HCD_FLAG_DEAD))
+#define HCD_DEFER_RH_REGISTER(hcd) ((hcd)->flags & (1U << HCD_FLAG_DEFER_RH_REGISTER))
 
 	/*
 	 * Specifies if interfaces are authorized by default

From: Monish Kumar R <[email protected]>

commit 97fa5887cf283bb75ffff5f6b2c0e71794c02400 upstream.

Add USB_QUIRK_NO_LPM and USB_QUIRK_RESET_RESUME quirks for Dell usb gen 2 device to not fail during enumeration.

Found this bug on own testing

---
 drivers/usb/core/quirks.c |    3 +++
 1 file changed, 3 insertions(+)

@@ -510,6 +510,9 @@ static const struct usb_device_id usb_qu
 	/* DJI CineSSD */
 	{ USB_DEVICE(0x2ca3, 0x0031), .driver_info = USB_QUIRK_NO_LPM },
 
+	/* DELL USB GEN2 */
+	{ USB_DEVICE(0x413c, 0xb062), .driver_info = USB_QUIRK_NO_LPM | USB_QUIRK_RESET_RESUME },
+
 	/* VCOM device */
 	{ USB_DEVICE(0x4296, 0x7570), .driver_info = USB_QUIRK_CONFIG_INTF_STRINGS },
 

From: Konstantin Komarov <[email protected]>

commit 3880f2b816a7e4ca889b7e8a42e6c62c5706ed36 upstream.

Two problems:
1. ntfs3_setattr can't truncate preallocated space;
2. if allocated fragment "cross" valid size, then fragment splits into two parts:
- normal part;
- unwritten part (here we must return FIEMAP_EXTENT_LAST).
Before this commit we returned FIEMAP_EXTENT_LAST for whole fragment. Fixes xfstest generic/092

---
 fs/ntfs3/file.c    |    2 +-
 fs/ntfs3/frecord.c |   10 +++++++---
 2 files changed, 8 insertions(+), 4 deletions(-)

@@ -761,7 +761,7 @@ int ntfs3_setattr(struct user_namespace
 		}
 		inode_dio_wait(inode);
 
-		if (attr->ia_size < oldsize)
+		if (attr->ia_size <= oldsize)
 			err = ntfs_truncate(inode, attr->ia_size);
 		else if (attr->ia_size > oldsize)
 			err = ntfs_extend(inode, attr->ia_size, 0, NULL);

@@ -1964,10 +1964,8 @@ int ni_fiemap(struct ntfs_inode *ni, str
 
 		vcn += clen;
 
-		if (vbo + bytes >= end) {
+		if (vbo + bytes >= end)
 			bytes = end - vbo;
-			flags |= FIEMAP_EXTENT_LAST;
-		}
 
 		if (vbo + bytes <= valid) {
 			;

@@ -1977,6 +1975,9 @@ int ni_fiemap(struct ntfs_inode *ni, str
 			/* vbo < valid && valid < vbo + bytes */
 			u64 dlen = valid - vbo;
 
+			if (vbo + dlen >= end)
+				flags |= FIEMAP_EXTENT_LAST;
+
 			err = fiemap_fill_next_extent(fieinfo, vbo, lbo, dlen,
 						      flags);
 			if (err < 0)

@@ -1995,6 +1996,9 @@ int ni_fiemap(struct ntfs_inode *ni, str
 			flags |= FIEMAP_EXTENT_UNWRITTEN;
 		}
 
+		if (vbo + bytes >= end)
+			flags |= FIEMAP_EXTENT_LAST;
+
 		err = fiemap_fill_next_extent(fieinfo, vbo, lbo, bytes, flags);
 		if (err < 0)
 			break;

From: Marios Levogiannis <[email protected]>

commit 9bfa7b36343c7d84370bc61c9ed774635b05e4eb upstream.

Set microphone pins 0x18 (rear) and 0x19 (front) to VREF_50 to fix the microphone noise on ASUS TUF B550M-PLUS which uses the ALCS1200A codec. The initial value was VREF_80.

The same issue is also present on Windows using both the default Windows driver and all tested Realtek drivers before version 6.0.9049.1. Comparing Realtek driver 6.0.9049.1 (the first one without the microphone noise) to Realtek driver 6.0.9047.1 (the last one with the microphone noise) revealed that the fix is the result of setting pins 0x18 and 0x19 to VREF_50.

This fix may also work for other boards that have been reported to have the same microphone issue and use the ALC1150 and ALCS1200A codecs, since these codecs are similar and the fix in the Realtek driver on Windows is common for both. However, it is currently enabled only for ASUS TUF B550M-PLUS as this is the only board that could be tested.

---
 sound/pci/hda/patch_realtek.c |   10 ++++++++++
 1 file changed, 10 insertions(+)

@@ -1976,6 +1976,7 @@ enum {
 	ALC1220_FIXUP_CLEVO_PB51ED_PINS,
 	ALC887_FIXUP_ASUS_AUDIO,
 	ALC887_FIXUP_ASUS_HMIC,
+	ALCS1200A_FIXUP_MIC_VREF,
 };
 
 static void alc889_fixup_coef(struct hda_codec *codec,

@@ -2521,6 +2522,14 @@ static const struct hda_fixup alc882_fix
 		.chained = true,
 		.chain_id = ALC887_FIXUP_ASUS_AUDIO,
 	},
+	[ALCS1200A_FIXUP_MIC_VREF] = {
+		.type = HDA_FIXUP_PINCTLS,
+		.v.pins = (const struct hda_pintbl[]) {
+			{ 0x18, PIN_VREF50 }, /* rear mic */
+			{ 0x19, PIN_VREF50 }, /* front mic */
+			{}
+		}
+	},
 };
 
 static const struct snd_pci_quirk alc882_fixup_tbl[] = {

@@ -2558,6 +2567,7 @@ static const struct snd_pci_quirk alc882
 	SND_PCI_QUIRK(0x1043, 0x835f, "Asus Eee 1601", ALC888_FIXUP_EEE1601),
 	SND_PCI_QUIRK(0x1043, 0x84bc, "ASUS ET2700", ALC887_FIXUP_ASUS_BASS),
 	SND_PCI_QUIRK(0x1043, 0x8691, "ASUS ROG Ranger VIII", ALC882_FIXUP_GPIO3),
+	SND_PCI_QUIRK(0x1043, 0x8797, "ASUS TUF B550M-PLUS", ALCS1200A_FIXUP_MIC_VREF),
 	SND_PCI_QUIRK(0x104d, 0x9043, "Sony Vaio VGC-LN51JGB", ALC882_FIXUP_NO_PRIMARY_HP),
 	SND_PCI_QUIRK(0x104d, 0x9044, "Sony VAIO AiO", ALC882_FIXUP_NO_PRIMARY_HP),
 	SND_PCI_QUIRK(0x104d, 0x9047, "Sony Vaio TT", ALC889_FIXUP_VAIO_TT),

From: Konstantin Komarov <[email protected]>

commit 114346978cf61de02832cc3cc68432a3de70fb38 upstream.

We must check size before trying to allocate.
Size can be set for example by "ulimit -f".
Fixes xfstest generic/228

---
 fs/ntfs3/file.c |    8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

@@ -661,7 +661,13 @@ static long ntfs_fallocate(struct file *
 		/*
 		 * Normal file: Allocate clusters, do not change 'valid' size.
 		 */
-		err = ntfs_set_size(inode, max(end, i_size));
+		loff_t new_size = max(end, i_size);
+
+		err = inode_newsize_ok(inode, new_size);
+		if (err)
+			goto out;
+
+		err = ntfs_set_size(inode, new_size);
 		if (err)
 			goto out;
 

From: Konstantin Komarov <[email protected]>

commit 52e00ea6b26e45fb8159e3b57cdde8d3f9bdd8e9 upstream.

Update valid size if write is still in I/O queue.
Fixes xfstest generic/240

---
 fs/ntfs3/inode.c |    8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

@@ -757,6 +757,7 @@ static ssize_t ntfs_direct_IO(struct kio
 	loff_t vbo = iocb->ki_pos;
 	loff_t end;
 	int wr = iov_iter_rw(iter) & WRITE;
+	size_t iter_count = iov_iter_count(iter);
 	loff_t valid;
 	ssize_t ret;
 

@@ -770,10 +771,13 @@ static ssize_t ntfs_direct_IO(struct kio
 				 wr ? ntfs_get_block_direct_IO_W
 				    : ntfs_get_block_direct_IO_R);
 
-	if (ret <= 0)
+	if (ret > 0)
+		end = vbo + ret;
+	else if (wr && ret == -EIOCBQUEUED)
+		end = vbo + iter_count;
+	else
 		goto out;
 
-	end = vbo + ret;
 	valid = ni->i_valid;
 	if (wr) {
 		if (end > valid && !S_ISBLK(inode->i_mode)) {

From: Konstantin Komarov <[email protected]>

commit 2d44667c306e7806848a3478820f87343feb5421 upstream.

Ctime wasn't updated after setfacl command.
This commit fixes xfstest generic/307

---
 fs/ntfs3/xattr.c |    3 +++
 1 file changed, 3 insertions(+)

@@ -902,6 +902,9 @@ set_new_fa:
 	err = ntfs_set_ea(inode, name, name_len, value, size, flags);
 
 out:
+	inode->i_ctime = current_time(inode);
+	mark_inode_dirty(inode);
+
 	return err;
 }
 

From: Konstantin Komarov <[email protected]>

commit e95113ed4d428219e3395044e29f5713fc446720 upstream.

If size of file was reduced, we still kept allocated blocks. This commit makes ntfs3 work as other fs like btrfs.

---
 fs/ntfs3/file.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -494,7 +494,7 @@ static int ntfs_truncate(struct inode *i
 
 	down_write(&ni->file.run_lock);
 	err = attr_set_size(ni, ATTR_DATA, NULL, 0, &ni->file.run, new_size,
-			    &new_valid, true, NULL);
+			    &new_valid, ni->mi.sbi->options->prealloc, NULL);
 	up_write(&ni->file.run_lock);
 
 	if (new_valid < ni->i_valid)

From: Konstantin Komarov <[email protected]>

commit 9186d472ee780fabf74424756c4c00545166157e upstream.

ntfs_init_acl sets mode. ntfs_init_acl calls ntfs_set_acl_ex. ntfs_set_acl_ex must not change this mode.
Fixes xfstest generic/444

---
 fs/ntfs3/xattr.c |   13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

@@ -541,7 +541,7 @@ struct posix_acl *ntfs_get_acl(struct in
 
 static noinline int ntfs_set_acl_ex(struct user_namespace *mnt_userns,
 				    struct inode *inode, struct posix_acl *acl,
-				    int type)
+				    int type, bool init_acl)
 {
 	const char *name;
 	size_t size, name_len;

@@ -554,8 +554,9 @@ static noinline int ntfs_set_acl_ex(stru
 
 	switch (type) {
 	case ACL_TYPE_ACCESS:
-		if (acl) {
-			umode_t mode = inode->i_mode;
+		/* Do not change i_mode if we are in init_acl */
+		if (acl && !init_acl) {
+			umode_t mode;
 
 			err = posix_acl_update_mode(mnt_userns, inode, &mode,
 						    &acl);

@@ -616,7 +617,7 @@ out:
 int ntfs_set_acl(struct user_namespace *mnt_userns, struct inode *inode,
 		 struct posix_acl *acl, int type)
 {
-	return ntfs_set_acl_ex(mnt_userns, inode, acl, type);
+	return ntfs_set_acl_ex(mnt_userns, inode, acl, type, false);
 }
 
 /*

@@ -636,7 +637,7 @@ int ntfs_init_acl(struct user_namespace
 
 	if (default_acl) {
 		err = ntfs_set_acl_ex(mnt_userns, inode, default_acl,
-				      ACL_TYPE_DEFAULT);
+				      ACL_TYPE_DEFAULT, true);
 		posix_acl_release(default_acl);
 	} else {
 		inode->i_default_acl = NULL;

@@ -647,7 +648,7 @@ int ntfs_init_acl(struct user_namespace
 	else {
 		if (!err)
 			err = ntfs_set_acl_ex(mnt_userns, inode, acl,
-					      ACL_TYPE_ACCESS);
+					      ACL_TYPE_ACCESS, true);
 		posix_acl_release(acl);
 	}
 

From: Linus Walleij <[email protected]>

commit 26ae2c942b5702f2e43d36b2a4389cfb7d616b6a upstream.

Running the driver through kasan gives an interesting splat:

  BUG: KASAN: global-out-of-bounds in isp1760_register+0x180/0x70c
  Read of size 20 at addr f1db2e64 by task swapper/0/1
  (...)
  isp1760_register from isp1760_plat_probe+0x1d8/0x220
  (...)

This happens because the loop reading the regmap fields for the different ISP1760 variants look like this:

for (i = 0; i < HC_FIELD_MAX; i++) { ... }

Meaning it expects the arrays to be at least HC_FIELD_MAX - 1 long.

However the arrays isp1760_hc_reg_fields[], isp1763_hc_reg_fields[], isp1763_hc_volatile_ranges[] and isp1763_dc_volatile_ranges[] are dynamically sized during compilation.

Fix this by putting an empty assignment to the [HC_FIELD_MAX] and [DC_FIELD_MAX] array member at the end of each array. This will make the array one member longer than it needs to be, but avoids the risk of overwriting whatever is inside [HC_FIELD_MAX - 1] and is simple and intuitive to read. Also add comments explaining what is going on.

---
 drivers/usb/isp1760/isp1760-core.c |    8 ++++++++
 1 file changed, 8 insertions(+)

@@ -251,6 +251,8 @@ static const struct reg_field isp1760_hc
 	[HW_DM_PULLDOWN]	= REG_FIELD(ISP176x_HC_OTG_CTRL, 2, 2),
 	[HW_DP_PULLDOWN]	= REG_FIELD(ISP176x_HC_OTG_CTRL, 1, 1),
 	[HW_DP_PULLUP]		= REG_FIELD(ISP176x_HC_OTG_CTRL, 0, 0),
+	/* Make sure the array is sized properly during compilation */
+	[HC_FIELD_MAX]		= {},
 };
 
 static const struct reg_field isp1763_hc_reg_fields[] = {

@@ -321,6 +323,8 @@ static const struct reg_field isp1763_hc
 	[HW_DM_PULLDOWN_CLEAR]	= REG_FIELD(ISP1763_HC_OTG_CTRL_CLEAR, 2, 2),
 	[HW_DP_PULLDOWN_CLEAR]	= REG_FIELD(ISP1763_HC_OTG_CTRL_CLEAR, 1, 1),
 	[HW_DP_PULLUP_CLEAR]	= REG_FIELD(ISP1763_HC_OTG_CTRL_CLEAR, 0, 0),
+	/* Make sure the array is sized properly during compilation */
+	[HC_FIELD_MAX]		= {},
 };
 
 static const struct regmap_range isp1763_hc_volatile_ranges[] = {

@@ -405,6 +409,8 @@ static const struct reg_field isp1761_dc
 	[DC_CHIP_ID_HIGH]	= REG_FIELD(ISP176x_DC_CHIPID, 16, 31),
 	[DC_CHIP_ID_LOW]	= REG_FIELD(ISP176x_DC_CHIPID, 0, 15),
 	[DC_SCRATCH]		= REG_FIELD(ISP176x_DC_SCRATCH, 0, 15),
+	/* Make sure the array is sized properly during compilation */
+	[DC_FIELD_MAX]		= {},
 };
 
 static const struct regmap_range isp1763_dc_volatile_ranges[] = {

@@ -458,6 +464,8 @@ static const struct reg_field isp1763_dc
 	[DC_CHIP_ID_HIGH]	= REG_FIELD(ISP1763_DC_CHIPID_HIGH, 0, 15),
 	[DC_CHIP_ID_LOW]	= REG_FIELD(ISP1763_DC_CHIPID_LOW, 0, 15),
 	[DC_SCRATCH]		= REG_FIELD(ISP1763_DC_SCRATCH, 0, 15),
+	/* Make sure the array is sized properly during compilation */
+	[DC_FIELD_MAX]		= {},
 };
 
 static const struct regmap_config isp1763_dc_regmap_conf = {

From: Christophe JAILLET <[email protected]>

commit e589f9b7078e1c0191613cd736f598e81d2390de upstream.

All error handling paths lead to 'out' where many resources are freed.

Do it as well here instead of a direct return, otherwise 'log', 'ra' and 'log->one_page_buf' (at least) will leak.

---
 fs/ntfs3/fslog.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

@@ -4085,8 +4085,10 @@ process_log:
 		if (client == LFS_NO_CLIENT_LE) {
 			/* Insert "NTFS" client LogFile. */
 			client = ra->client_idx[0];
-			if (client == LFS_NO_CLIENT_LE)
-				return -EINVAL;
+			if (client == LFS_NO_CLIENT_LE) {
+				err = -EINVAL;
+				goto out;
+			}
 
 			t16 = le16_to_cpu(client);
 			cr = ca + t16;

From: Ronnie Sahlberg <[email protected]>

commit f66f8b94e7f2f4ac9fffe710be231ca8f25c5057 upstream.

as this is the only way to make sure the region is allocated. Fix the conditional that was wrong and only tried to make already non-sparse files non-sparse.

---
 fs/cifs/smb2ops.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -3791,7 +3791,7 @@ static long smb3_simple_falloc(struct fi
 		if (rc)
 			goto out;
 
-		if ((cifsi->cifsAttrs & FILE_ATTRIBUTE_SPARSE_FILE) == 0)
+		if (cifsi->cifsAttrs & FILE_ATTRIBUTE_SPARSE_FILE)
 			smb2_set_sparse(xid, tcon, cfile, inode, false);
 
 		eof = cpu_to_le64(off + len);

From: Helge Deller <[email protected]>

commit cf936af790a3ef5f41ff687ec91bfbffee141278 upstream.

Implement fb_is_primary_device() function, so that fbcon detects if this framebuffer belongs to the default graphics card which was used to start the system.

---
 arch/parisc/include/asm/fb.h    |    4 ++++
 drivers/video/console/sticore.c |   17 +++++++++++++++++
 drivers/video/fbdev/stifb.c     |    4 ++--
 3 files changed, 23 insertions(+), 2 deletions(-)

@@ -12,9 +12,13 @@ static inline void fb_pgprotect(struct f
 	pgprot_val(vma->vm_page_prot) |= _PAGE_NO_CACHE;
 }
 
+#if defined(CONFIG_STI_CONSOLE) || defined(CONFIG_FB_STI)
+int fb_is_primary_device(struct fb_info *info);
+#else
 static inline int fb_is_primary_device(struct fb_info *info)
 {
 	return 0;
 }
+#endif
 
 #endif /* _ASM_FB_H_ */

@@ -30,6 +30,7 @@
 #include <asm/pdc.h>
 #include <asm/cacheflush.h>
 #include <asm/grfioctl.h>
+#include <asm/fb.h>
 
 #include "../fbdev/sticore.h"
 

@@ -1127,6 +1128,22 @@ int sti_call(const struct sti_struct *st
 	return ret;
 }
 
+/* check if given fb_info is the primary device */
+int fb_is_primary_device(struct fb_info *info)
+{
+	struct sti_struct *sti;
+
+	sti = sti_get_rom(0);
+
+	/* if no built-in graphics card found, allow any fb driver as default */
+	if (!sti)
+		return true;
+
+	/* return true if it's the default built-in framebuffer driver */
+	return (sti->info == info);
+}
+EXPORT_SYMBOL(fb_is_primary_device);
+
 MODULE_AUTHOR("Philipp Rumpf, Helge Deller, Thomas Bogendoerfer");
 MODULE_DESCRIPTION("Core STI driver for HP's NGLE series graphics cards in HP PARISC machines");
 MODULE_LICENSE("GPL v2");

@@ -1317,11 +1317,11 @@ static int __init stifb_init_fb(struct s
 		goto out_err3;
 	}
 
+	/* save for primary gfx device detection & unregister_framebuffer() */
+	sti->info = info;
 	if (register_framebuffer(&fb->info) < 0)
 		goto out_err4;
 
-	sti->info = info; /* save for unregister_framebuffer() */
-
 	fb_info(&fb->info, "%s %dx%d-%d frame buffer device, %s, id: %04x, mmio: 0x%04lx\n",
 		fix->id,
 		var->xres, 

From: Ronnie Sahlberg <[email protected]>

commit 8378a51e3f8140f60901fb27208cc7a6e47047b5 upstream.

RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=2088799

---
 fs/cifs/cifsfs.c |   10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

@@ -826,7 +826,7 @@ cifs_smb3_do_mount(struct file_system_ty
 	      int flags, struct smb3_fs_context *old_ctx)
 {
 	int rc;
-	struct super_block *sb;
+	struct super_block *sb = NULL;
 	struct cifs_sb_info *cifs_sb = NULL;
 	struct cifs_mnt_data mnt_data;
 	struct dentry *root;

@@ -922,9 +922,11 @@ out_super:
 	return root;
 out:
 	if (cifs_sb) {
-		kfree(cifs_sb->prepath);
-		smb3_cleanup_fs_context(cifs_sb->ctx);
-		kfree(cifs_sb);
+		if (!sb || IS_ERR(sb)) {  /* otherwise kill_sb will handle */
+			kfree(cifs_sb->prepath);
+			smb3_cleanup_fs_context(cifs_sb->ctx);
+			kfree(cifs_sb);
+		}
 	}
 	return root;
 }

From: Mathias Nyman <[email protected]>

commit 74f55a62c4c354f43a6d75f77dd184c4f57b9a26 upstream.

Alder Lake N TCSS xHCI needs to be runtime suspended whenever possible to allow the TCSS hardware block to enter D3 and thus save energy

---
 drivers/usb/host/xhci-pci.c |    2 ++
 1 file changed, 2 insertions(+)

@@ -59,6 +59,7 @@
 #define PCI_DEVICE_ID_INTEL_TIGER_LAKE_XHCI		0x9a13
 #define PCI_DEVICE_ID_INTEL_MAPLE_RIDGE_XHCI		0x1138
 #define PCI_DEVICE_ID_INTEL_ALDER_LAKE_XHCI		0x461e
+#define PCI_DEVICE_ID_INTEL_ALDER_LAKE_N_XHCI		0x464e
 #define PCI_DEVICE_ID_INTEL_ALDER_LAKE_PCH_XHCI	0x51ed
 
 #define PCI_DEVICE_ID_AMD_RENOIR_XHCI			0x1639

@@ -268,6 +269,7 @@ static void xhci_pci_quirks(struct devic
 	     pdev->device == PCI_DEVICE_ID_INTEL_TIGER_LAKE_XHCI ||
 	     pdev->device == PCI_DEVICE_ID_INTEL_MAPLE_RIDGE_XHCI ||
 	     pdev->device == PCI_DEVICE_ID_INTEL_ALDER_LAKE_XHCI ||
+	     pdev->device == PCI_DEVICE_ID_INTEL_ALDER_LAKE_N_XHCI ||
 	     pdev->device == PCI_DEVICE_ID_INTEL_ALDER_LAKE_PCH_XHCI))
 		xhci->quirks |= XHCI_DEFAULT_PM_RUNTIME_ALLOW;
 

From: Michael Niewöhner <[email protected]>

commit 1620c80bba53af8c547bab34a1d3bc58319fe608 upstream.

intel_hid_dsm_fn_mask is a bit mask containing one bit for each function index. Fix the function index check in intel_hid_evaluate_method accordingly, which was missed in commit 97ab4516205e ("platform/x86:
intel-hid: fix _DSM function index handling").

---
 drivers/platform/x86/intel/hid.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -245,7 +245,7 @@ static bool intel_hid_evaluate_method(ac
 
 	method_name = (char *)intel_hid_dsm_fn_to_method[fn_index];
 
-	if (!(intel_hid_dsm_fn_mask & fn_index))
+	if (!(intel_hid_dsm_fn_mask & BIT(fn_index)))
 		goto skip_dsm_eval;
 
 	obj = acpi_evaluate_dsm_typed(handle, &intel_dsm_guid,

From: Ammar Faizi <[email protected]>

commit e5f28623ceb103e13fc3d7bd45edf9818b227fd0 upstream.

In mce_threshold_create_device(), if threshold_create_bank() fails, the previously allocated threshold banks array @bp will be leaked because the call to mce_threshold_remove_device() will not free it.

This happens because mce_threshold_remove_device() fetches the pointer through the threshold_banks per-CPU variable but bp is written there only after the bank creation is successful, and not before, when threshold_create_bank() fails.

Add a helper which unwinds all the bank creation work previously done and pass into it the previously allocated threshold banks array for freeing.

[ bp: Massage. ]

---
 arch/x86/kernel/cpu/mce/amd.c |   32 +++++++++++++++++++-------------
 1 file changed, 19 insertions(+), 13 deletions(-)

@@ -1470,10 +1470,23 @@ out_free:
 	kfree(bank);
 }
 
+static void __threshold_remove_device(struct threshold_bank **bp)
+{
+	unsigned int bank, numbanks = this_cpu_read(mce_num_banks);
+
+	for (bank = 0; bank < numbanks; bank++) {
+		if (!bp[bank])
+			continue;
+
+		threshold_remove_bank(bp[bank]);
+		bp[bank] = NULL;
+	}
+	kfree(bp);
+}
+
 int mce_threshold_remove_device(unsigned int cpu)
 {
 	struct threshold_bank **bp = this_cpu_read(threshold_banks);
-	unsigned int bank, numbanks = this_cpu_read(mce_num_banks);
 
 	if (!bp)
 		return 0;

@@ -1484,13 +1497,7 @@ int mce_threshold_remove_device(unsigned
 	 */
 	this_cpu_write(threshold_banks, NULL);
 
-	for (bank = 0; bank < numbanks; bank++) {
-		if (bp[bank]) {
-			threshold_remove_bank(bp[bank]);
-			bp[bank] = NULL;
-		}
-	}
-	kfree(bp);
+	__threshold_remove_device(bp);
 	return 0;
 }
 

@@ -1527,15 +1534,14 @@ int mce_threshold_create_device(unsigned
 		if (!(this_cpu_read(bank_map) & (1 << bank)))
 			continue;
 		err = threshold_create_bank(bp, cpu, bank);
-		if (err)
-			goto out_err;
+		if (err) {
+			__threshold_remove_device(bp);
+			return err;
+		}
 	}
 	this_cpu_write(threshold_banks, bp);
 
 	if (thresholding_irq_en)
 		mce_threshold_vector = amd_threshold_interrupt;
 	return 0;
-out_err:
-	mce_threshold_remove_device(cpu);
-	return err;
 }

From: Kan Liang <[email protected]>

commit 86dca369075b3e310c3c0adb0f81e513c562b5e4 upstream.

According to the latest event list, the event encoding 0x55 INST_DECODED.DECODERS and 0x56 UOPS_DECODED.DEC0 are only available on the first 4 counters. Add them into the event constraints table.

---
 arch/x86/events/intel/core.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -255,7 +255,7 @@ static struct event_constraint intel_icl
 	INTEL_EVENT_CONSTRAINT_RANGE(0x03, 0x0a, 0xf),
 	INTEL_EVENT_CONSTRAINT_RANGE(0x1f, 0x28, 0xf),
 	INTEL_EVENT_CONSTRAINT(0x32, 0xf),	/* SW_PREFETCH_ACCESS.* */
-	INTEL_EVENT_CONSTRAINT_RANGE(0x48, 0x54, 0xf),
+	INTEL_EVENT_CONSTRAINT_RANGE(0x48, 0x56, 0xf),
 	INTEL_EVENT_CONSTRAINT_RANGE(0x60, 0x8b, 0xf),
 	INTEL_UEVENT_CONSTRAINT(0x04a3, 0xff),  /* CYCLE_ACTIVITY.STALLS_TOTAL */
 	INTEL_UEVENT_CONSTRAINT(0x10a3, 0xff),  /* CYCLE_ACTIVITY.CYCLES_MEM_ANY */

From: Baoquan He <[email protected]>

commit b3e34a47f98974d0844444c5121aaff123004e57 upstream.

This is reported by kmemleak detector:

unreferenced object 0xffffc900002a9000 (size 4096):
comm "kexec", pid 14950, jiffies 4295110793 (age 373.951s) hex dump (first 32 bytes):

    7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00  .ELF............
    04 00 3e 00 01 00 00 00 00 00 00 00 00 00 00 00  ..>.............
  backtrace:
    [<0000000016a8ef9f>] __vmalloc_node_range+0x101/0x170
    [<000000002b66b6c0>] __vmalloc_node+0xb4/0x160
    [<00000000ad40107d>] crash_prepare_elf64_headers+0x8e/0xcd0
    [<0000000019afff23>] crash_load_segments+0x260/0x470
    [<0000000019ebe95c>] bzImage64_load+0x814/0xad0
    [<0000000093e16b05>] arch_kexec_kernel_image_load+0x1be/0x2a0
    [<000000009ef2fc88>] kimage_file_alloc_init+0x2ec/0x5a0
    [<0000000038f5a97a>] __do_sys_kexec_file_load+0x28d/0x530
    [<0000000087c19992>] do_syscall_64+0x3b/0x90
    [<0000000066e063a4>] entry_SYSCALL_64_after_hwframe+0x44/0xae

In crash_prepare_elf64_headers(), a buffer is allocated via vmalloc() to store elf headers. While it's not freed back to system correctly when kdump kernel is reloaded or unloaded. Then memory leak is caused. Fix it by introducing x86 specific function arch_kimage_file_post_load_cleanup(), and freeing the buffer there.

And also remove the incorrect elf header buffer freeing code. Before calling arch specific kexec_file loading function, the image instance has been initialized. So 'image->elf_headers' must be NULL. It doesn't make sense to free the elf header buffer in the place.

Three different people have reported three bugs about the memory leak on x86_64 inside Redhat.

---
 arch/x86/kernel/machine_kexec_64.c |   12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

@@ -373,9 +373,6 @@ void machine_kexec(struct kimage *image)
 #ifdef CONFIG_KEXEC_FILE
 void *arch_kexec_kernel_image_load(struct kimage *image)
 {
-	vfree(image->elf_headers);
-	image->elf_headers = NULL;
-
 	if (!image->fops || !image->fops->load)
 		return ERR_PTR(-ENOEXEC);
 

@@ -511,6 +508,15 @@ overflow:
 	       (int)ELF64_R_TYPE(rel[i].r_info), value);
 	return -ENOEXEC;
 }
+
+int arch_kimage_file_post_load_cleanup(struct kimage *image)
+{
+	vfree(image->elf_headers);
+	image->elf_headers = NULL;
+	image->elf_headers_sz = 0;
+
+	return kexec_image_post_load_cleanup_default(image);
+}
 #endif /* CONFIG_KEXEC_FILE */
 
 static int

From: Eric W. Biederman <[email protected]>

commit 6a2d90ba027adba528509ffa27097cffd3879257 upstream.

The current implementation of PTRACE_KILL is buggy and has been for many years as it assumes it's target has stopped in ptrace_stop. At a quick skim it looks like this assumption has existed since ptrace support was added in linux v1.0.

While PTRACE_KILL has been deprecated we can not remove it as a quick search with google code search reveals many existing programs calling it.

When the ptracee is not stopped at ptrace_stop some fields would be set that are ignored except in ptrace_stop. Making the userspace visible behavior of PTRACE_KILL a noop in those case.

As the usual rules are not obeyed it is not clear what the consequences are of calling PTRACE_KILL on a running process. Presumably userspace does not do this as it achieves nothing.

Replace the implementation of PTRACE_KILL with a simple send_sig_info(SIGKILL) followed by a return 0. This changes the observable user space behavior only in that PTRACE_KILL on a process not stopped in ptrace_stop will also kill it. As that has always been the intent of the code this seems like a reasonable change.

---
 arch/x86/kernel/step.c |    3 +--
 kernel/ptrace.c        |    5 ++---
 2 files changed, 3 insertions(+), 5 deletions(-)

@@ -180,8 +180,7 @@ void set_task_blockstep(struct task_stru
 	 *
 	 * NOTE: this means that set/clear TIF_BLOCKSTEP is only safe if
 	 * task is current or it can't be running, otherwise we can race
-	 * with __switch_to_xtra(). We rely on ptrace_freeze_traced() but
-	 * PTRACE_KILL is not safe.
+	 * with __switch_to_xtra(). We rely on ptrace_freeze_traced().
 	 */
 	local_irq_disable();
 	debugctl = get_debugctlmsr();

@@ -1238,9 +1238,8 @@ int ptrace_request(struct task_struct *c
 		return ptrace_resume(child, request, data);
 
 	case PTRACE_KILL:
-		if (child->exit_state)	/* already dead */
-			return 0;
-		return ptrace_resume(child, request, SIGKILL);
+		send_sig_info(SIGKILL, SEND_SIG_NOINFO, child);
+		return 0;
 
 #ifdef CONFIG_HAVE_ARCH_TRACEHOOK
 	case PTRACE_GETREGSET:

From: Helge Deller <[email protected]>

commit b046f984814af7985f444150ec28716d42d00d9a upstream.

Keep the pa_path (hardware path) of the graphics card in sti_struct and use this info to give more useful info which card is currently being used.

---
 drivers/video/console/sticon.c  |    5 ++++-
 drivers/video/console/sticore.c |   15 +++++++--------
 drivers/video/fbdev/sticore.h   |    3 +++
 3 files changed, 14 insertions(+), 9 deletions(-)

@@ -46,6 +46,7 @@
 #include <linux/slab.h>
 #include <linux/font.h>
 #include <linux/crc32.h>
+#include <linux/fb.h>
 
 #include <asm/io.h>
 

@@ -392,7 +393,9 @@ static int __init sticonsole_init(void)
     for (i = 0; i < MAX_NR_CONSOLES; i++)
 	font_data[i] = STI_DEF_FONT;
 
-    pr_info("sticon: Initializing STI text console.\n");
+    pr_info("sticon: Initializing STI text console on %s at [%s]\n",
+	sticon_sti->sti_data->inq_outptr.dev_name,
+	sticon_sti->pa_path);
     console_lock();
     err = do_take_over_console(&sti_con, 0, MAX_NR_CONSOLES - 1,
 		PAGE0->mem_cons.cl_class != CL_DUPLEX);

@@ -34,7 +34,7 @@
 
 #include "../fbdev/sticore.h"
 
-#define STI_DRIVERVERSION "Version 0.9b"
+#define STI_DRIVERVERSION "Version 0.9c"
 
 static struct sti_struct *default_sti __read_mostly;
 

@@ -503,7 +503,7 @@ sti_select_fbfont(struct sti_cooked_rom
 	if (!fbfont)
 		return NULL;
 
-	pr_info("STI selected %ux%u framebuffer font %s for sticon\n",
+	pr_info("    using %ux%u framebuffer font %s\n",
 			fbfont->width, fbfont->height, fbfont->name);
 			
 	bpc = ((fbfont->width+7)/8) * fbfont->height; 

@@ -947,6 +947,7 @@ out_err:
 
 static void sticore_check_for_default_sti(struct sti_struct *sti, char *path)
 {
+	pr_info("    located at [%s]\n", sti->pa_path);
 	if (strcmp (path, default_sti_path) == 0)
 		default_sti = sti;
 }

@@ -958,7 +959,6 @@ static void sticore_check_for_default_st
  */
 static int __init sticore_pa_init(struct parisc_device *dev)
 {
-	char pa_path[21];
 	struct sti_struct *sti = NULL;
 	int hpa = dev->hpa.start;
 

@@ -971,8 +971,8 @@ static int __init sticore_pa_init(struct
 	if (!sti)
 		return 1;
 
-	print_pa_hwpath(dev, pa_path);
-	sticore_check_for_default_sti(sti, pa_path);
+	print_pa_hwpath(dev, sti->pa_path);
+	sticore_check_for_default_sti(sti, sti->pa_path);
 	return 0;
 }
 

@@ -1008,9 +1008,8 @@ static int sticore_pci_init(struct pci_d
 
 	sti = sti_try_rom_generic(rom_base, fb_base, pd);
 	if (sti) {
-		char pa_path[30];
-		print_pci_hwpath(pd, pa_path);
-		sticore_check_for_default_sti(sti, pa_path);
+		print_pci_hwpath(pd, sti->pa_path);
+		sticore_check_for_default_sti(sti, sti->pa_path);
 	}
 	
 	if (!sti) {

@@ -370,6 +370,9 @@ struct sti_struct {
 
 	/* pointer to all internal data */
 	struct sti_all_data *sti_data;
+
+	/* pa_path of this device */
+	char pa_path[24];
 };
 
 

From: Qu Wenruo <[email protected]>

commit d5321a0fa8bc49f11bea0b470800962c17d92d8f upstream.

The following error message lack the "0x" obviously:

cannot mount because of unsupported optional features (4000)

Add the prefix to make it less confusing. This can happen on older kernels that try to mount a filesystem with newer features so it makes sense to backport to older trees.

---
 fs/btrfs/disk-io.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

@@ -3370,7 +3370,7 @@ int __cold open_ctree(struct super_block
 		~BTRFS_FEATURE_INCOMPAT_SUPP;
 	if (features) {
 		btrfs_err(fs_info,
-		    "cannot mount because of unsupported optional features (%llx)",
+		    "cannot mount because of unsupported optional features (0x%llx)",
 		    features);
 		err = -EINVAL;
 		goto fail_alloc;

@@ -3408,7 +3408,7 @@ int __cold open_ctree(struct super_block
 		~BTRFS_FEATURE_COMPAT_RO_SUPP;
 	if (!sb_rdonly(sb) && features) {
 		btrfs_err(fs_info,
-	"cannot mount read-write because of unsupported optional features (%llx)",
+	"cannot mount read-write because of unsupported optional features (0x%llx)",
 		       features);
 		err = -EINVAL;
 		goto fail_alloc;

From: Kristen Carlson Accardi <[email protected]>

commit 0c9782e204d3cc5625b9e8bf4e8625d38dfe0139 upstream.

When the system runs out of enclave memory, SGX can reclaim EPC pages by swapping to normal RAM. These backing pages are allocated via a per-enclave shared memory area. Since SGX allows unlimited over commit on EPC memory, the reclaimer thread can allocate a large number of backing RAM pages in response to EPC memory pressure.

When the shared memory backing RAM allocation occurs during the reclaimer thread context, the shared memory is charged to the root memory control group, and the shmem usage of the enclave is not properly accounted for, making cgroups ineffective at limiting the amount of RAM an enclave can consume.

For example, when using a cgroup to launch a set of test enclaves, the kernel does not properly account for 50% - 75% of shmem page allocations on average. In the worst case, when nearly all allocations occur during the reclaimer thread, the kernel accounts less than a percent of the amount of shmem used by the enclave's cgroup to the correct cgroup.

SGX stores a list of mm_structs that are associated with an enclave. Pick one of them during reclaim and charge that mm's memcg with the shmem allocation. The one that gets picked is arbitrary, but this list almost always only has one mm. The cases where there is more than one mm with different memcg's are not worth considering.

Create a new function - sgx_encl_alloc_backing(). This function is used whenever a new backing storage page needs to be allocated. Previously the same function was used for page allocation as well as retrieving a previously allocated page. Prior to backing page allocation, if there is a mm_struct associated with the enclave that is requesting the allocation, it is set as the active memory control group.

[ dhansen: - fix merge conflict with ELDU fixes
- check against actual ksgxd_tsk, not ->mm ]

---
 arch/x86/kernel/cpu/sgx/encl.c |  105 ++++++++++++++++++++++++++++++++++++++++-
 arch/x86/kernel/cpu/sgx/encl.h |    7 +-
 arch/x86/kernel/cpu/sgx/main.c |    9 ++-
 3 files changed, 115 insertions(+), 6 deletions(-)

@@ -152,7 +152,7 @@ static int __sgx_encl_eldu(struct sgx_en
 
 	page_pcmd_off = sgx_encl_get_backing_page_pcmd_offset(encl, page_index);
 
-	ret = sgx_encl_get_backing(encl, page_index, &b);
+	ret = sgx_encl_lookup_backing(encl, page_index, &b);
 	if (ret)
 		return ret;
 

@@ -718,7 +718,7 @@ static struct page *sgx_encl_get_backing
  *   0 on success,
  *   -errno otherwise.
  */
-int sgx_encl_get_backing(struct sgx_encl *encl, unsigned long page_index,
+static int sgx_encl_get_backing(struct sgx_encl *encl, unsigned long page_index,
 			 struct sgx_backing *backing)
 {
 	pgoff_t page_pcmd_off = sgx_encl_get_backing_page_pcmd_offset(encl, page_index);

@@ -743,6 +743,107 @@ int sgx_encl_get_backing(struct sgx_encl
 	return 0;
 }
 
+/*
+ * When called from ksgxd, returns the mem_cgroup of a struct mm stored
+ * in the enclave's mm_list. When not called from ksgxd, just returns
+ * the mem_cgroup of the current task.
+ */
+static struct mem_cgroup *sgx_encl_get_mem_cgroup(struct sgx_encl *encl)
+{
+	struct mem_cgroup *memcg = NULL;
+	struct sgx_encl_mm *encl_mm;
+	int idx;
+
+	/*
+	 * If called from normal task context, return the mem_cgroup
+	 * of the current task's mm. The remainder of the handling is for
+	 * ksgxd.
+	 */
+	if (!current_is_ksgxd())
+		return get_mem_cgroup_from_mm(current->mm);
+
+	/*
+	 * Search the enclave's mm_list to find an mm associated with
+	 * this enclave to charge the allocation to.
+	 */
+	idx = srcu_read_lock(&encl->srcu);
+
+	list_for_each_entry_rcu(encl_mm, &encl->mm_list, list) {
+		if (!mmget_not_zero(encl_mm->mm))
+			continue;
+
+		memcg = get_mem_cgroup_from_mm(encl_mm->mm);
+
+		mmput_async(encl_mm->mm);
+
+		break;
+	}
+
+	srcu_read_unlock(&encl->srcu, idx);
+
+	/*
+	 * In the rare case that there isn't an mm associated with
+	 * the enclave, set memcg to the current active mem_cgroup.
+	 * This will be the root mem_cgroup if there is no active
+	 * mem_cgroup.
+	 */
+	if (!memcg)
+		return get_mem_cgroup_from_mm(NULL);
+
+	return memcg;
+}
+
+/**
+ * sgx_encl_alloc_backing() - allocate a new backing storage page
+ * @encl:	an enclave pointer
+ * @page_index:	enclave page index
+ * @backing:	data for accessing backing storage for the page
+ *
+ * When called from ksgxd, sets the active memcg from one of the
+ * mms in the enclave's mm_list prior to any backing page allocation,
+ * in order to ensure that shmem page allocations are charged to the
+ * enclave.
+ *
+ * Return:
+ *   0 on success,
+ *   -errno otherwise.
+ */
+int sgx_encl_alloc_backing(struct sgx_encl *encl, unsigned long page_index,
+			   struct sgx_backing *backing)
+{
+	struct mem_cgroup *encl_memcg = sgx_encl_get_mem_cgroup(encl);
+	struct mem_cgroup *memcg = set_active_memcg(encl_memcg);
+	int ret;
+
+	ret = sgx_encl_get_backing(encl, page_index, backing);
+
+	set_active_memcg(memcg);
+	mem_cgroup_put(encl_memcg);
+
+	return ret;
+}
+
+/**
+ * sgx_encl_lookup_backing() - retrieve an existing backing storage page
+ * @encl:	an enclave pointer
+ * @page_index:	enclave page index
+ * @backing:	data for accessing backing storage for the page
+ *
+ * Retrieve a backing page for loading data back into an EPC page with ELDU.
+ * It is the caller's responsibility to ensure that it is appropriate to use
+ * sgx_encl_lookup_backing() rather than sgx_encl_alloc_backing(). If lookup is
+ * not used correctly, this will cause an allocation which is not accounted for.
+ *
+ * Return:
+ *   0 on success,
+ *   -errno otherwise.
+ */
+int sgx_encl_lookup_backing(struct sgx_encl *encl, unsigned long page_index,
+			   struct sgx_backing *backing)
+{
+	return sgx_encl_get_backing(encl, page_index, backing);
+}
+
 /**
  * sgx_encl_put_backing() - Unpin the backing storage
  * @backing:	data for accessing backing storage for the page

@@ -103,10 +103,13 @@ static inline int sgx_encl_find(struct m
 int sgx_encl_may_map(struct sgx_encl *encl, unsigned long start,
 		     unsigned long end, unsigned long vm_flags);
 
+bool current_is_ksgxd(void);
 void sgx_encl_release(struct kref *ref);
 int sgx_encl_mm_add(struct sgx_encl *encl, struct mm_struct *mm);
-int sgx_encl_get_backing(struct sgx_encl *encl, unsigned long page_index,
-			 struct sgx_backing *backing);
+int sgx_encl_lookup_backing(struct sgx_encl *encl, unsigned long page_index,
+			    struct sgx_backing *backing);
+int sgx_encl_alloc_backing(struct sgx_encl *encl, unsigned long page_index,
+			   struct sgx_backing *backing);
 void sgx_encl_put_backing(struct sgx_backing *backing);
 int sgx_encl_test_and_clear_young(struct mm_struct *mm,
 				  struct sgx_encl_page *page);

@@ -292,7 +292,7 @@ static void sgx_reclaimer_write(struct s
 	sgx_encl_put_backing(backing);
 
 	if (!encl->secs_child_cnt && test_bit(SGX_ENCL_INITIALIZED, &encl->flags)) {
-		ret = sgx_encl_get_backing(encl, PFN_DOWN(encl->size),
+		ret = sgx_encl_alloc_backing(encl, PFN_DOWN(encl->size),
 					   &secs_backing);
 		if (ret)
 			goto out;

@@ -365,7 +365,7 @@ static void sgx_reclaim_pages(void)
 		page_index = PFN_DOWN(encl_page->desc - encl_page->encl->base);
 
 		mutex_lock(&encl_page->encl->lock);
-		ret = sgx_encl_get_backing(encl_page->encl, page_index, &backing[i]);
+		ret = sgx_encl_alloc_backing(encl_page->encl, page_index, &backing[i]);
 		if (ret) {
 			mutex_unlock(&encl_page->encl->lock);
 			goto skip;

@@ -462,6 +462,11 @@ static bool __init sgx_page_reclaimer_in
 	return true;
 }
 
+bool current_is_ksgxd(void)
+{
+	return current == ksgxd_tsk;
+}
+
 static struct sgx_epc_page *__sgx_alloc_epc_page_from_node(int nid)
 {
 	struct sgx_numa_node *node = &sgx_numa_nodes[nid];

From: Eric W. Biederman <[email protected]>

commit 4a3d2717d140401df7501a95e454180831a0c5af upstream.

xtensa is the last user of the PT_SINGLESTEP flag. Changing tsk->ptrace in user_enable_single_step and user_disable_single_step without locking could potentiallly cause problems.

So use a thread info flag instead of a flag in tsk->ptrace. Use TIF_SINGLESTEP that xtensa already had defined but unused.

Remove the definitions of PT_SINGLESTEP and PT_BLOCKSTEP as they have no more users.

---
 arch/xtensa/kernel/ptrace.c |    4 ++--
 arch/xtensa/kernel/signal.c |    4 ++--
 include/linux/ptrace.h      |    6 ------
 3 files changed, 4 insertions(+), 10 deletions(-)

@@ -226,12 +226,12 @@ const struct user_regset_view *task_user
 
 void user_enable_single_step(struct task_struct *child)
 {
-	child->ptrace |= PT_SINGLESTEP;
+	set_tsk_thread_flag(child, TIF_SINGLESTEP);
 }
 
 void user_disable_single_step(struct task_struct *child)
 {
-	child->ptrace &= ~PT_SINGLESTEP;
+	clear_tsk_thread_flag(child, TIF_SINGLESTEP);
 }
 
 /*

@@ -465,7 +465,7 @@ static void do_signal(struct pt_regs *re
 		/* Set up the stack frame */
 		ret = setup_frame(&ksig, sigmask_to_save(), regs);
 		signal_setup_done(ret, &ksig, 0);
-		if (current->ptrace & PT_SINGLESTEP)
+		if (test_thread_flag(TIF_SINGLESTEP))
 			task_pt_regs(current)->icountlevel = 1;
 
 		return;

@@ -491,7 +491,7 @@ static void do_signal(struct pt_regs *re
 	/* If there's no signal to deliver, we just restore the saved mask.  */
 	restore_saved_sigmask();
 
-	if (current->ptrace & PT_SINGLESTEP)
+	if (test_thread_flag(TIF_SINGLESTEP))
 		task_pt_regs(current)->icountlevel = 1;
 	return;
 }

@@ -46,12 +46,6 @@ extern int ptrace_access_vm(struct task_
 #define PT_EXITKILL		(PTRACE_O_EXITKILL << PT_OPT_FLAG_SHIFT)
 #define PT_SUSPEND_SECCOMP	(PTRACE_O_SUSPEND_SECCOMP << PT_OPT_FLAG_SHIFT)
 
-/* single stepping state bits (used on ARM and PA-RISC) */
-#define PT_SINGLESTEP_BIT	31
-#define PT_SINGLESTEP		(1<<PT_SINGLESTEP_BIT)
-#define PT_BLOCKSTEP_BIT	30
-#define PT_BLOCKSTEP		(1<<PT_BLOCKSTEP_BIT)
-
 extern long arch_ptrace(struct task_struct *child, long request,
 			unsigned long addr, unsigned long data);
 extern int ptrace_readdata(struct task_struct *tsk, unsigned long src, char __user *dst, int len);

From: Eric W. Biederman <[email protected]>

commit c200e4bb44e80b343c09841e7caaaca0aac5e5fa upstream.

User mode linux is the last user of the PT_DTRACE flag. Using the flag to indicate single stepping is a little confusing and worse changing tsk->ptrace without locking could potentionally cause problems.

So use a thread info flag with a better name instead of flag in tsk->ptrace.

Remove the definition PT_DTRACE as uml is the last user.

---
 arch/um/include/asm/thread_info.h |    2 ++
 arch/um/kernel/exec.c             |    2 +-
 arch/um/kernel/process.c          |    2 +-
 arch/um/kernel/ptrace.c           |    8 ++++----
 arch/um/kernel/signal.c           |    4 ++--
 include/linux/ptrace.h            |    1 -
 6 files changed, 10 insertions(+), 9 deletions(-)

@@ -64,6 +64,7 @@ static inline struct thread_info *curren
 #define TIF_RESTORE_SIGMASK	7
 #define TIF_NOTIFY_RESUME	8
 #define TIF_SECCOMP		9	/* secure computing */
+#define TIF_SINGLESTEP		10	/* single stepping userspace */
 
 #define _TIF_SYSCALL_TRACE	(1 << TIF_SYSCALL_TRACE)
 #define _TIF_SIGPENDING		(1 << TIF_SIGPENDING)

@@ -72,5 +73,6 @@ static inline struct thread_info *curren
 #define _TIF_MEMDIE		(1 << TIF_MEMDIE)
 #define _TIF_SYSCALL_AUDIT	(1 << TIF_SYSCALL_AUDIT)
 #define _TIF_SECCOMP		(1 << TIF_SECCOMP)
+#define _TIF_SINGLESTEP		(1 << TIF_SINGLESTEP)
 
 #endif

@@ -42,7 +42,7 @@ void start_thread(struct pt_regs *regs,
 {
 	PT_REGS_IP(regs) = eip;
 	PT_REGS_SP(regs) = esp;
-	current->ptrace &= ~PT_DTRACE;
+	clear_thread_flag(TIF_SINGLESTEP);
 #ifdef SUBARCH_EXECVE1
 	SUBARCH_EXECVE1(regs->regs);
 #endif

@@ -339,7 +339,7 @@ int singlestepping(void * t)
 {
 	struct task_struct *task = t ? t : current;
 
-	if (!(task->ptrace & PT_DTRACE))
+	if (!test_thread_flag(TIF_SINGLESTEP))
 		return 0;
 
 	if (task->thread.singlestep_syscall)

@@ -12,7 +12,7 @@
 
 void user_enable_single_step(struct task_struct *child)
 {
-	child->ptrace |= PT_DTRACE;
+	set_tsk_thread_flag(child, TIF_SINGLESTEP);
 	child->thread.singlestep_syscall = 0;
 
 #ifdef SUBARCH_SET_SINGLESTEPPING

@@ -22,7 +22,7 @@ void user_enable_single_step(struct task
 
 void user_disable_single_step(struct task_struct *child)
 {
-	child->ptrace &= ~PT_DTRACE;
+	clear_tsk_thread_flag(child, TIF_SINGLESTEP);
 	child->thread.singlestep_syscall = 0;
 
 #ifdef SUBARCH_SET_SINGLESTEPPING

@@ -121,7 +121,7 @@ static void send_sigtrap(struct uml_pt_r
 }
 
 /*
- * XXX Check PT_DTRACE vs TIF_SINGLESTEP for singlestepping check and
+ * XXX Check TIF_SINGLESTEP for singlestepping check and
  * PT_PTRACED vs TIF_SYSCALL_TRACE for syscall tracing check
  */
 int syscall_trace_enter(struct pt_regs *regs)

@@ -145,7 +145,7 @@ void syscall_trace_leave(struct pt_regs
 	audit_syscall_exit(regs);
 
 	/* Fake a debug trap */
-	if (ptraced & PT_DTRACE)
+	if (test_thread_flag(TIF_SINGLESTEP))
 		send_sigtrap(&regs->regs, 0);
 
 	if (!test_thread_flag(TIF_SYSCALL_TRACE))

@@ -53,7 +53,7 @@ static void handle_signal(struct ksignal
 	unsigned long sp;
 	int err;
 
-	if ((current->ptrace & PT_DTRACE) && (current->ptrace & PT_PTRACED))
+	if (test_thread_flag(TIF_SINGLESTEP) && (current->ptrace & PT_PTRACED))
 		singlestep = 1;
 
 	/* Did we come from a system call? */

@@ -128,7 +128,7 @@ void do_signal(struct pt_regs *regs)
 	 * on the host.  The tracing thread will check this flag and
 	 * PTRACE_SYSCALL if necessary.
 	 */
-	if (current->ptrace & PT_DTRACE)
+	if (test_thread_flag(TIF_SINGLESTEP))
 		current->thread.singlestep_syscall =
 			is_syscall(PT_REGS_IP(&current->thread.regs));
 

@@ -30,7 +30,6 @@ extern int ptrace_access_vm(struct task_
 
 #define PT_SEIZED	0x00010000	/* SEIZE used, enable new behavior */
 #define PT_PTRACED	0x00000001
-#define PT_DTRACE	0x00000002	/* delayed trace (used on m68k, i386) */
 
 #define PT_OPT_FLAG_SHIFT	3
 /* PT_TRACE_* event enable flags */

From: Xianting Tian <[email protected]>

commit e61bf5c071148c80d091f8e7220b3b9130780ae3 upstream.

Commit 00ab027a3b82 ("RISC-V: Add kernel image sections to the resource tree") marked IORESOURCE_BUSY for reserved memory, which caused resource map failed in subsequent operations of related driver, so remove the IORESOURCE_BUSY flag. In order to prohibit userland mapping reserved memory, mark IORESOURCE_EXCLUSIVE for it.

The code to reproduce the issue,
dts:

        mem0: memory@a0000000 {
                reg = <0x0 0xa0000000 0 0x1000000>;
                no-map;
        };

        &test {
                status = "okay";
                memory-region = <&mem0>;
        };

code:

        np = of_parse_phandle(pdev->dev.of_node, "memory-region", 0);
        ret = of_address_to_resource(np, 0, &r);
        base = devm_ioremap_resource(&pdev->dev, &r);
        // base = -EBUSY

---
 arch/riscv/kernel/setup.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

@@ -199,7 +199,7 @@ static void __init init_resources(void)
 		res = &mem_res[res_idx--];
 
 		res->name = "Reserved";
-		res->flags = IORESOURCE_MEM | IORESOURCE_BUSY;
+		res->flags = IORESOURCE_MEM | IORESOURCE_EXCLUSIVE;
 		res->start = __pfn_to_phys(memblock_region_reserved_base_pfn(region));
 		res->end = __pfn_to_phys(memblock_region_reserved_end_pfn(region)) - 1;
 

@@ -224,7 +224,7 @@ static void __init init_resources(void)
 
 		if (unlikely(memblock_is_nomap(region))) {
 			res->name = "Reserved";
-			res->flags = IORESOURCE_MEM | IORESOURCE_BUSY;
+			res->flags = IORESOURCE_MEM | IORESOURCE_EXCLUSIVE;
 		} else {
 			res->name = "System RAM";
 			res->flags = IORESOURCE_SYSTEM_RAM | IORESOURCE_BUSY;

From: Samuel Holland <[email protected]>

commit 2273272823db6f67d57761df8116ae32e7f05bed upstream.

irq_work is triggered via an IPI, but the IPI infrastructure is not included in uniprocessor kernels. As a result, irq_work never runs. Fall back to the tick-based irq_work implementation on uniprocessor configurations.

---
 arch/riscv/include/asm/irq_work.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -4,7 +4,7 @@
 
 static inline bool arch_irq_work_has_interrupt(void)
 {
-	return true;
+	return IS_ENABLED(CONFIG_SMP);
 }
 extern void arch_irq_work_raise(void);
 #endif /* _ASM_RISCV_IRQ_WORK_H */

From: Qu Wenruo <[email protected]>

commit d201238ccd2f30b9bfcfadaeae0972e3a486a176 upstream.

[BUG]
There is a report that a btrfs has a bad super block num devices.

This makes btrfs to reject the fs completely.

BTRFS error (device sdd3): super_num_devices 3 mismatch with num_devices 2 found here BTRFS error (device sdd3): failed to read chunk tree: -22
BTRFS error (device sdd3): open_ctree failed

[CAUSE]
During btrfs device removal, chunk tree and super block num devs are updated in two different transactions:

btrfs_rm_device()

  |- btrfs_rm_dev_item(device)
  |  |- trans = btrfs_start_transaction()
  |  |  Now we got transaction X
  |  |
  |  |- btrfs_del_item()
  |  |  Now device item is removed from chunk tree
  |  |
  |  |- btrfs_commit_transaction()
  |     Transaction X got committed, super num devs untouched,
  |     but device item removed from chunk tree.
  |     (AKA, super num devs is already incorrect)
  |
  |- cur_devices->num_devices--;
  |- cur_devices->total_devices--;
  |- btrfs_set_super_num_devices()

All those operations are not in transaction X, thus it will only be written back to disk in next transaction.

So after the transaction X in btrfs_rm_dev_item() committed, but before transaction X+1 (which can be minutes away), a power loss happen, then we got the super num mismatch.

This has been fixed by commit bbac58698a55 ("btrfs: remove device item and update super block in the same transaction").

[FIX]
Make the super_num_devices check less strict, converting it from a hard error to a warning, and reset the value to a correct one for the current or next transaction commit.

As the number of device items is the critical information where the super block num_devices is only a cached value (and also useful for cross checking), it's safe to automatically update it. Other device related problems like missing device are handled after that and may require other means to resolve, like degraded mount. With this fix, potentially affected filesystems won't fail mount and require the manual repair by btrfs check.

---
 fs/btrfs/volumes.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

@@ -7596,12 +7596,12 @@ int btrfs_read_chunk_tree(struct btrfs_f
 	 * do another round of validation checks.
 	 */
 	if (total_dev != fs_info->fs_devices->total_devices) {
-		btrfs_err(fs_info,
-	   "super_num_devices %llu mismatch with num_devices %llu found here",
+		btrfs_warn(fs_info,
+"super block num_devices %llu mismatch with DEV_ITEM count %llu, will be repaired on next transaction commit",
 			  btrfs_super_num_devices(fs_info->super_copy),
 			  total_dev);
-		ret = -EINVAL;
-		goto error;
+		fs_info->fs_devices->total_devices = total_dev;
+		btrfs_set_super_num_devices(fs_info->super_copy, total_dev);
 	}
 	if (btrfs_super_total_bytes(fs_info->super_copy) <
 	    fs_info->fs_devices->total_rw_bytes) {

From: Nathan Chancellor <[email protected]>

commit 61114e734ccb804bc12561ab4020745e02c468c2 upstream.

After commit 49b290e430d3 ("riscv: prevent compressed instructions in alternatives"), builds with LLVM's integrated assembler fail:

In file included from arch/riscv/mm/init.c:10:
In file included from ./include/linux/mm.h:29:
In file included from ./include/linux/pgtable.h:6:
In file included from ./arch/riscv/include/asm/pgtable.h:108:
./arch/riscv/include/asm/tlbflush.h:23:2: error: expected assembly-time absolute expression

          ALT_FLUSH_TLB_PAGE(__asm__ __volatile__ ("sfence.vma %0" : : "r" (addr) : "memory"));
          ^
  ./arch/riscv/include/asm/errata_list.h:33:5: note: expanded from macro 'ALT_FLUSH_TLB_PAGE'
  asm(ALTERNATIVE("sfence.vma %0", "sfence.vma", SIFIVE_VENDOR_ID,        \
      ^
  ./arch/riscv/include/asm/alternative-macros.h:187:2: note: expanded from macro 'ALTERNATIVE'
          _ALTERNATIVE_CFG(old_content, new_content, vendor_id, errata_id, CONFIG_k)
          ^
  ./arch/riscv/include/asm/alternative-macros.h:113:2: note: expanded from macro '_ALTERNATIVE_CFG'
          __ALTERNATIVE_CFG(old_c, new_c, vendor_id, errata_id, IS_ENABLED(CONFIG_k))
          ^
  ./arch/riscv/include/asm/alternative-macros.h:110:2: note: expanded from macro '__ALTERNATIVE_CFG'
          ALT_NEW_CONTENT(vendor_id, errata_id, enable, new_c)
          ^
  ./arch/riscv/include/asm/alternative-macros.h:99:3: note: expanded from macro 'ALT_NEW_CONTENT'
          ".org   . - (889b - 888b) + (887b - 886b)\n"                    \
           ^
  <inline asm>:26:6: note: instantiated into assembly here
  .org    . - (889b - 888b) + (887b - 886b)
          ^

This error happens because LLVM's integrated assembler has a one-pass design, which means it cannot figure out the instruction lengths when the .org directive is outside of the subsection that contains the instructions, which was changed by the .option directives added by the above change.

Move the .org directives before the .previous directive so that these directives are always within the same subsection, which resolves the failures and does not introduce any new issues with GNU as. This was done for arm64 in commit 966a0acce2fc ("arm64/alternatives: move length validation inside the subsection") and commit 22315a2296f4 ("arm64:
alternatives: Move length validation in alternative_{insn, endif}").

While there is no error from the assembly versions of the macro, they appear to have the same problem so just make the same change there as well so that there are no problems in the future.

---
 arch/riscv/include/asm/alternative-macros.h |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

@@ -23,9 +23,9 @@
 888 :
 	\new_c
 889 :
-	.previous
 	.org    . - (889b - 888b) + (887b - 886b)
 	.org    . - (887b - 886b) + (889b - 888b)
+	.previous
 	.endif
 .endm
 

@@ -60,9 +60,9 @@
 	"888 :\n"							\
 	new_c "\n"							\
 	"889 :\n"							\
-	".previous\n"							\
 	".org	. - (887b - 886b) + (889b - 888b)\n"			\
 	".org	. - (889b - 888b) + (887b - 886b)\n"			\
+	".previous\n"							\
 	".endif\n"
 
 #define __ALTERNATIVE_CFG(old_c, new_c, vendor_id, errata_id, enable) \

From: Tobias Klauser <[email protected]>

commit 02d88b40cb2e9614e0117c3385afdce878f0d377 upstream.

Move the __ARCH_WANT_MEMFD_SECRET define added in commit 7bb7f2ac24a0 ("arch, mm: wire up memfd_secret system call where relevant") to <uapi/asm/unistd.h> so __NR_memfd_secret is defined when including <unistd.h> in userspace.

This allows the memfd_secret selftest to pass on riscv.

---
 arch/riscv/include/asm/unistd.h      |    1 -
 arch/riscv/include/uapi/asm/unistd.h |    1 +
 2 files changed, 1 insertion(+), 1 deletion(-)

@@ -9,7 +9,6 @@
  */
 
 #define __ARCH_WANT_SYS_CLONE
-#define __ARCH_WANT_MEMFD_SECRET
 
 #include <uapi/asm/unistd.h>
 

@@ -21,6 +21,7 @@
 #endif /* __LP64__ */
 
 #define __ARCH_WANT_SYS_CLONE3
+#define __ARCH_WANT_MEMFD_SECRET
 
 #include <asm-generic/unistd.h>
 

From: Konstantin Komarov <[email protected]>

commit 87e21c99bad763524c953ff4d1a61ee19038ddc2 upstream.

Apparently we need to maintain these functions with ntfs_get_acl_ex and ntfs_set_acl_ex.
This commit fixes xfstest generic/099

---
 fs/ntfs3/xattr.c |   96 ++++++++++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 95 insertions(+), 1 deletion(-)

@@ -112,7 +112,7 @@ static int ntfs_read_ea(struct ntfs_inod
 		return -ENOMEM;
 
 	if (!size) {
-		;
+		/* EA info persists, but xattr is empty. Looks like EA problem. */
 	} else if (attr_ea->non_res) {
 		struct runs_tree run;
 

@@ -620,6 +620,67 @@ int ntfs_set_acl(struct user_namespace *
 	return ntfs_set_acl_ex(mnt_userns, inode, acl, type, false);
 }
 
+static int ntfs_xattr_get_acl(struct user_namespace *mnt_userns,
+			      struct inode *inode, int type, void *buffer,
+			      size_t size)
+{
+	struct posix_acl *acl;
+	int err;
+
+	if (!(inode->i_sb->s_flags & SB_POSIXACL)) {
+		ntfs_inode_warn(inode, "add mount option \"acl\" to use acl");
+		return -EOPNOTSUPP;
+	}
+
+	acl = ntfs_get_acl(inode, type, false);
+	if (IS_ERR(acl))
+		return PTR_ERR(acl);
+
+	if (!acl)
+		return -ENODATA;
+
+	err = posix_acl_to_xattr(mnt_userns, acl, buffer, size);
+	posix_acl_release(acl);
+
+	return err;
+}
+
+static int ntfs_xattr_set_acl(struct user_namespace *mnt_userns,
+			      struct inode *inode, int type, const void *value,
+			      size_t size)
+{
+	struct posix_acl *acl;
+	int err;
+
+	if (!(inode->i_sb->s_flags & SB_POSIXACL)) {
+		ntfs_inode_warn(inode, "add mount option \"acl\" to use acl");
+		return -EOPNOTSUPP;
+	}
+
+	if (!inode_owner_or_capable(mnt_userns, inode))
+		return -EPERM;
+
+	if (!value) {
+		acl = NULL;
+	} else {
+		acl = posix_acl_from_xattr(mnt_userns, value, size);
+		if (IS_ERR(acl))
+			return PTR_ERR(acl);
+
+		if (acl) {
+			err = posix_acl_valid(mnt_userns, acl);
+			if (err)
+				goto release_and_out;
+		}
+	}
+
+	err = ntfs_set_acl(mnt_userns, inode, acl, type);
+
+release_and_out:
+	posix_acl_release(acl);
+	return err;
+}
+
 /*
  * ntfs_init_acl - Initialize the ACLs of a new inode.
  *

@@ -786,6 +847,23 @@ static int ntfs_getxattr(const struct xa
 		goto out;
 	}
 
+#ifdef CONFIG_NTFS3_FS_POSIX_ACL
+	if ((name_len == sizeof(XATTR_NAME_POSIX_ACL_ACCESS) - 1 &&
+	     !memcmp(name, XATTR_NAME_POSIX_ACL_ACCESS,
+		     sizeof(XATTR_NAME_POSIX_ACL_ACCESS))) ||
+	    (name_len == sizeof(XATTR_NAME_POSIX_ACL_DEFAULT) - 1 &&
+	     !memcmp(name, XATTR_NAME_POSIX_ACL_DEFAULT,
+		     sizeof(XATTR_NAME_POSIX_ACL_DEFAULT)))) {
+		/* TODO: init_user_ns? */
+		err = ntfs_xattr_get_acl(
+			&init_user_ns, inode,
+			name_len == sizeof(XATTR_NAME_POSIX_ACL_ACCESS) - 1
+				? ACL_TYPE_ACCESS
+				: ACL_TYPE_DEFAULT,
+			buffer, size);
+		goto out;
+	}
+#endif
 	/* Deal with NTFS extended attribute. */
 	err = ntfs_get_ea(inode, name, name_len, buffer, size, NULL);
 

@@ -898,6 +976,22 @@ set_new_fa:
 		goto out;
 	}
 
+#ifdef CONFIG_NTFS3_FS_POSIX_ACL
+	if ((name_len == sizeof(XATTR_NAME_POSIX_ACL_ACCESS) - 1 &&
+	     !memcmp(name, XATTR_NAME_POSIX_ACL_ACCESS,
+		     sizeof(XATTR_NAME_POSIX_ACL_ACCESS))) ||
+	    (name_len == sizeof(XATTR_NAME_POSIX_ACL_DEFAULT) - 1 &&
+	     !memcmp(name, XATTR_NAME_POSIX_ACL_DEFAULT,
+		     sizeof(XATTR_NAME_POSIX_ACL_DEFAULT)))) {
+		err = ntfs_xattr_set_acl(
+			mnt_userns, inode,
+			name_len == sizeof(XATTR_NAME_POSIX_ACL_ACCESS) - 1
+				? ACL_TYPE_ACCESS
+				: ACL_TYPE_DEFAULT,
+			value, size);
+		goto out;
+	}
+#endif
 	/* Deal with NTFS extended attribute. */
 	err = ntfs_set_ea(inode, name, name_len, value, size, flags);
 

From: Haowen Bai <[email protected]>

[ Upstream commit 11800d893b38e0e12d636c170c1abc19c43c730c ]

fix warning reported by smatch:
drivers/net/wireless/broadcom/b43/phy_n.c:585 b43_nphy_adjust_lna_gain_table()
warn: assigning (-2) to unsigned variable '*(lna_gain[0])'

---
 drivers/net/wireless/broadcom/b43/phy_n.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index cf3ccf4ddfe7..aa5c99465674 100644
@@ -582,7 +582,7 @@ static void b43_nphy_adjust_lna_gain_table(struct b43_wldev *dev)
 	u16 data[4];
 	s16 gain[2];
 	u16 minmax[2];
-	static const u16 lna_gain[4] = { -2, 10, 19, 25 };
+	static const s16 lna_gain[4] = { -2, 10, 19, 25 };
 
 	if (nphy->hang_avoid)
 		b43_nphy_stay_in_carrier_search(dev, 1);

2.35.1

This is the start of the stable review cycle for the 5.15.46 release. There are 667 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Thu, 09 Jun 2022 16:48:02 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.46-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 5.15.46-rc1

Jia-Ju Bai <[email protected]>
md: bcache: check the return value of kzalloc() in detached_dev_do_request()

Xiao Ni <[email protected]>
md: fix double free of io_acct_set bioset

Xiao Ni <[email protected]>

    md: Don't set mddev private to NULL in raid0 pers->free

Namjae Jeon <[email protected]>
fs/ntfs3: Fix invalid free in log_replay

Christian Brauner <[email protected]>
exportfs: support idmapped mounts

Christian Brauner <[email protected]>
fs: add two trivial lookup helpers

Mike Tipton <[email protected]>
interconnect: qcom: icc-rpmh: Add BCMs to commit list in pre_aggregate

Stephen Boyd <[email protected]>
interconnect: qcom: sc7180: Drop IP0 interconnects

Eric Biggers <[email protected]>
ext4: only allow test_dummy_encryption when supported

Maciej W. Rozycki <[email protected]>
MIPS: IP30: Remove incorrect `cpu_has_fpu' override

Maciej W. Rozycki <[email protected]>
MIPS: IP27: Remove incorrect `cpu_has_fpu' override

Xiao Yang <[email protected]>
RDMA/rxe: Generate a completion for unsupported/invalid opcode

Yixing Liu <[email protected]>
RDMA/hns: Remove the num_cqc_timer variable

Dan Carpenter <[email protected]>

    staging: r8188eu: delete rtw_wx_read/write32()

Jason A. Donenfeld <[email protected]>
Revert "random: use static branch for crng_ready()"

David Gow <[email protected]>
list: test: Add a test for list_is_head()

Waiman Long <[email protected]>
kseltest/cgroup: Make test_stress.sh work if run interactively

Alex Elder <[email protected]>
net: ipa: fix page free in ipa_endpoint_replenish_one()

Alex Elder <[email protected]>
net: ipa: fix page free in ipa_endpoint_trans_release()

Johan Hovold <[email protected]>
phy: qcom-qmp: fix reset-controller leak on probe errors

Mao Jinlong <[email protected]>
coresight: core: Fix coresight device probe failure issue

Tejun Heo <[email protected]>
blk-iolatency: Fix inflight count imbalances and IO hangs on offline

Eugenio Pérez <[email protected]>
vdpasim: allow to enable a vq repeatedly

Dinh Nguyen <[email protected]>
dt-bindings: gpio: altera: correct interrupt-cells

Akira Yokosawa <[email protected]>
docs/conf.py: Cope with removal of language=None in Sphinx 5.0.0

Steve French <[email protected]>
SMB3: EBADF/EIO errors in rename/open caused by race condition in smb2_compound_op

Arnd Bergmann <[email protected]>
ARM: pxa: maybe fix gpio lookup tables

Jonathan Bakker <[email protected]>
ARM: dts: s5pv210: Remove spi-cs-high on panel in Aries

Johan Hovold <[email protected]>
phy: qcom-qmp: fix struct clk leak on probe errors

Diogo Ivo <[email protected]>
clk: tegra: Add missing reset deassertion

Diogo Ivo <[email protected]>
arm64: tegra: Add missing DFLL reset on Tegra210

Kathiravan T <[email protected]>
arm64: dts: qcom: ipq8074: fix the sleep clock frequency

Xiaomeng Tong <[email protected]>
gma500: fix an incorrect NULL check on list iterator

Xiaomeng Tong <[email protected]>
tilcdc: tilcdc_external: fix an incorrect NULL check on list iterator

Jiri Slaby <[email protected]>

    serial: pch: don't overwrite xmit->buf[0] by x_char

Coly Li <[email protected]>
bcache: avoid journal no-space deadlock by reserving 1 journal bucket

Coly Li <[email protected]>
bcache: remove incremental dirty sector counting for bch_sectors_dirty_init()

Coly Li <[email protected]>
bcache: improve multithreaded bch_sectors_dirty_init()

Coly Li <[email protected]>
bcache: improve multithreaded bch_btree_check()

Xiaomeng Tong <[email protected]>
stm: ltdc: fix two incorrect NULL checks on list iterator

Xiaomeng Tong <[email protected]>
carl9170: tx: fix an incorrect use of list iterator

Mark Brown <[email protected]>
ASoC: rt5514: Fix event generation for "DSP Voice Wake Up" control

Alexander Wetzel <[email protected]>
rtl818x: Prevent using not initialized queues

Yi Yang <[email protected]>
xtensa/simdisk: fix proc_read_simdisk()

Miaohe Lin <[email protected]>
mm/memremap: fix missing call to untrack_pfn() in pagemap_range()

Mike Kravetz <[email protected]>
hugetlb: fix huge_pmd_unshare address update

Christophe de Dinechin <[email protected]>
nodemask.h: fix compilation error with GCC12

Mel Gorman <[email protected]>
mm/page_alloc: always attempt to allocate at least one page during bulk allocation

Dong Aisheng <[email protected]>
Revert "mm/cma.c: remove redundant cma_mutex lock"

Yunfei Wang <[email protected]>
iommu/dma: Fix iova map result check bug

Xiaomeng Tong <[email protected]>
iommu/msm: Fix an incorrect NULL check on list iterator

Hyunchul Lee <[email protected]>
ksmbd: fix outstanding credits related bugs

Song Liu <[email protected]>
ftrace: Clean up hash direct_functions on register failures

Naveen N. Rao <[email protected]>
kexec_file: drop weak attribute from arch_kexec_apply_relocations[_add]

Vincent Whitchurch <[email protected]>
um: Fix out-of-bounds read in LDT setup

Johannes Berg <[email protected]>
um: chan_user: Fix winch_tramp() return value

Johannes Berg <[email protected]>
um: Use asm-generic/dma-mapping.h

Felix Fietkau <[email protected]>
mac80211: upgrade passive scan to active scan on DFS channels after beacon rx

Dimitri John Ledkov <[email protected]>
cfg80211: declare MODULE_FIRMWARE for regulatory.db

Kant Fan <[email protected]>
thermal: devfreq_cooling: use local ops instead of global ops

Max Filippov <[email protected]>
irqchip: irq-xtensa-mx: fix initial IRQ affinity

Pali Rohár <[email protected]>
irqchip/armada-370-xp: Do not touch Performance Counter Overflow on A375, A38x, A39x

Guo Ren <[email protected]>
csky: patch_text: Fixup last cpu should be master

Bean Huo <[email protected]>
mmc: core: Allows to override the timeout value for ioctl() path

Dennis Dalessandro <[email protected]>
RDMA/hfi1: Fix potential integer multiplication overflow errors

Sean Christopherson <[email protected]>
Kconfig: Add option for asm goto w/ tied outputs to workaround clang-13 bug

GUO Zihua <[email protected]>
ima: remove the IMA_TEMPLATE Kconfig option

Nicolas Dufresne <[email protected]>
media: coda: Add more H264 levels for CODA960

Nicolas Dufresne <[email protected]>
media: coda: Fix reported H264 profile

Tokunori Ikegami <[email protected]>

    mtd: cfi_cmdset_0002: Use chip_ready() for write on S29GL064N

Tokunori Ikegami <[email protected]>
mtd: cfi_cmdset_0002: Move and rename chip_check/chip_ready/chip_good_for_write

Xiaomeng Tong <[email protected]>
md: fix an incorrect NULL check in md_reload_sb

Xiaomeng Tong <[email protected]>
md: fix an incorrect NULL check in does_sb_need_changing

Jani Nikula <[email protected]>
drm/i915/dsi: fix VBT send packet port selection for ICL+

Brian Norris <[email protected]>
drm/bridge: analogix_dp: Grab runtime PM reference for DP-AUX

Xiaomeng Tong <[email protected]>
drm/nouveau/kms/nv50-: atom: fix an incorrect NULL check on list iterator

Xiaomeng Tong <[email protected]>
drm/nouveau/clk: Fix an incorrect NULL check on list iterator

Lucas Stach <[email protected]>
drm/etnaviv: check for reaped mapping in etnaviv_iommu_unmap_gem

Lyude Paul <[email protected]>
drm/nouveau/subdev/bus: Ratelimit logging for fault errors

Dave Airlie <[email protected]>
drm/amdgpu/cs: make commands with 0 chunks illegal behaviour.

Mickaël Salaün <[email protected]>
landlock: Fix same-layer rule unions

Mickaël Salaün <[email protected]>
landlock: Create find_rule() from unmask_layers()

Mickaël Salaün <[email protected]>
landlock: Reduce the maximum number of layers to 16

Mickaël Salaün <[email protected]>
landlock: Define access_mask_t to enforce a consistent access mask size

Mickaël Salaün <[email protected]>
selftests/landlock: Test landlock_create_ruleset(2) argument check ordering

Mickaël Salaün <[email protected]>
landlock: Change landlock_restrict_self(2) check ordering

Mickaël Salaün <[email protected]>
landlock: Change landlock_add_rule(2) argument check ordering

Mickaël Salaün <[email protected]>
selftests/landlock: Add tests for O_PATH

Mickaël Salaün <[email protected]>
selftests/landlock: Fully test file rename with "remove" access

Mickaël Salaün <[email protected]>
selftests/landlock: Extend access right tests to directories

Mickaël Salaün <[email protected]>
selftests/landlock: Add tests for unknown access rights

Mickaël Salaün <[email protected]>
selftests/landlock: Extend tests for minimal valid attribute size

Mickaël Salaün <[email protected]>
selftests/landlock: Make tests build with old libc

Mickaël Salaün <[email protected]>
landlock: Fix landlock_add_rule(2) documentation

Mickaël Salaün <[email protected]>
samples/landlock: Format with clang-format

Mickaël Salaün <[email protected]>
samples/landlock: Add clang-format exceptions

Mickaël Salaün <[email protected]>
selftests/landlock: Format with clang-format

Mickaël Salaün <[email protected]>
selftests/landlock: Normalize array assignment

Mickaël Salaün <[email protected]>
selftests/landlock: Add clang-format exceptions

Mickaël Salaün <[email protected]>
landlock: Format with clang-format

Mickaël Salaün <[email protected]>
landlock: Add clang-format exceptions

Manivannan Sadhasivam <[email protected]>
scsi: ufs: qcom: Add a readl() to make sure ref_clk gets enabled

Xiaomeng Tong <[email protected]>
scsi: dc395x: Fix a missing check on list iterator

Junxiao Bi via Ocfs2-devel <[email protected]>
ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock

Alexander Aring <[email protected]>
dlm: fix missing lkb refcount handling

Dan Carpenter <[email protected]>
dlm: uninitialized variable on error in dlm_listen_for_all()

Alexander Aring <[email protected]>
dlm: fix plock invalid read

Sven Schnelle <[email protected]>
s390/stp: clock_delta should be signed

Nico Boehr <[email protected]>
s390/perf: obtain sie_block from the right address

Rei Yamamoto <[email protected]>
mm, compaction: fast_find_migrateblock() should return pfn in the target zone

Denis Efremov <[email protected]>

    staging: r8188eu: prevent ->Ssid overflow in rtw_wx_set_scan()

Johan Hovold <[email protected]>
PCI: qcom: Fix unbalanced PHY init on probe errors

Johan Hovold <[email protected]>
PCI: qcom: Fix runtime PM imbalance on probe errors

Bjorn Helgaas <[email protected]>

    PCI/PM: Fix bridge_d3_blacklist[] Elo i2 overwrite of Gigabyte X299

Alex Deucher <[email protected]>
drm/amdgpu: add beige goby PCI ID

Gautam Menghani <[email protected]>
tracing: Initialize integer variable to prevent garbage return value

Keita Suzuki <[email protected]>
tracing: Fix potential double free in create_var_ref()

Laurent Vivier <[email protected]>
tty: goldfish: Introduce gf_ioread32()/gf_iowrite32()

Sakari Ailus <[email protected]>
ACPI: property: Release subnode properties with data nodes

Jan Kara <[email protected]>
ext4: avoid cycles in directory h-tree

Jan Kara <[email protected]>
ext4: verify dir block before splitting it

Baokun Li <[email protected]>
ext4: fix bug_on in __es_tree_search

Theodore Ts'o <[email protected]>
ext4: filter out EXT4_FC_REPLAY from on-disk superblock field s_state

Ye Bin <[email protected]>
ext4: fix bug_on in ext4_writepages

Ye Bin <[email protected]>
ext4: fix warning in ext4_handle_inode_extension

Baokun Li <[email protected]>
ext4: fix race condition between ext4_write and ext4_convert_inline_data

Ye Bin <[email protected]>
ext4: fix use-after-free in ext4_rename_dir_prepare

Dmitry Monakhov <[email protected]>
ext4: mark group as trimmed only if it was fully scanned

Jan Kara <[email protected]>
bfq: Make sure bfqg for which we are queueing requests is online

Jan Kara <[email protected]>
bfq: Get rid of __bio_blkcg() usage

Jan Kara <[email protected]>
bfq: Track whether bfq_group is still online

Jan Kara <[email protected]>
bfq: Remove pointless bfq_init_rq() calls

Jan Kara <[email protected]>
bfq: Drop pointless unlock-lock pair

Jan Kara <[email protected]>
bfq: Update cgroup information before merging bio

Jan Kara <[email protected]>
bfq: Split shared queues on move between cgroups

Jan Kara <[email protected]>
bfq: Avoid merging queues with different parents

Jan Kara <[email protected]>
bfq: Avoid false marking of bic as stably merged

Aditya Garg <[email protected]>
efi: Do not import certificates from UEFI Secure Boot for T2 Macs

Zhihao Cheng <[email protected]>
fs-writeback: writeback_sb_inodes：Recalculate 'wrote' according skipped pages

Emmanuel Grumbach <[email protected]>
iwlwifi: mvm: fix assert 1F04 upon reconfig

Johannes Berg <[email protected]>
wifi: mac80211: fix use-after-free in chanctx code

Peter Zijlstra <[email protected]>
objtool: Fix symbol creation

Mikulas Patocka <[email protected]>
objtool: Fix objtool regression on x32 systems

Chao Yu <[email protected]>
f2fs: fix to do sanity check for inline inode

Chao Yu <[email protected]>
f2fs: fix fallocate to use file_modified to update permissions consistently

Eric Biggers <[email protected]>
f2fs: don't use casefolded comparison for "." and ".."

Chao Yu <[email protected]>
f2fs: fix to do sanity check on total_data_blocks

Jaegeuk Kim <[email protected]>
f2fs: don't need inode lock for system hidden quota

Chao Yu <[email protected]>
f2fs: fix deadloop in foreground GC

Chao Yu <[email protected]>
f2fs: fix to clear dirty inode in f2fs_evict_inode()

Chao Yu <[email protected]>
f2fs: fix to do sanity check on block address in f2fs_do_zero_range()

Chao Yu <[email protected]>
f2fs: fix to avoid f2fs_bug_on() in dec_valid_node_count()

Olga Kornievskaia <[email protected]>
NFSv4.1 mark qualified async operations as MOVEABLE tasks

Trond Myklebust <[email protected]>
NFS: Convert GFP_NOFS to GFP_KERNEL

Anna Schumaker <[email protected]>
NFS: Create a new nfs_alloc_fattr_with_label() function

Trond Myklebust <[email protected]>

    NFS: Always initialise fattr->label in nfs_fattr_alloc()

Javier Martinez Canillas <[email protected]>
video: fbdev: vesafb: Fix a use-after-free due early fb_info cleanup

Zhengjun Xing <[email protected]>
perf jevents: Fix event syntax error caused by ExtSel

Leo Yan <[email protected]>
perf c2c: Use stdio interface if slang is not supported

Jiri Olsa <[email protected]>
perf build: Fix btf__load_from_kernel_by_id() feature check

Kuninori Morimoto <[email protected]>
i2c: rcar: fix PM ref counts in probe error paths

Tali Perry <[email protected]>
i2c: npcm: Handle spurious interrupts

Tyrone Ting <[email protected]>
i2c: npcm: Correct register access width

Tali Perry <[email protected]>
i2c: npcm: Fix timeout calculation

Joerg Roedel <[email protected]>
iommu/amd: Increase timeout waiting for GA log enablement

Amelie Delaunay <[email protected]>
dmaengine: stm32-mdma: fix chan initialization in stm32_mdma_irq_handler()

Amelie Delaunay <[email protected]>
dmaengine: stm32-mdma: remove GISR1 register

Miaoqian Lin <[email protected]>
video: fbdev: clcdfb: Fix refcount leak in clcdfb_of_vram_setup

Trond Myklebust <[email protected]>
NFS: Further fixes to the writeback error handling

Trond Myklebust <[email protected]>
NFSv4/pNFS: Do not fail I/O when we fail to allocate the pNFS layout

Trond Myklebust <[email protected]>
NFS: Don't report errors from nfs_pageio_complete() more than once

Trond Myklebust <[email protected]>
NFS: Do not report flush errors in nfs_write_end()

Trond Myklebust <[email protected]>
NFS: Don't report ENOSPC write errors twice

Trond Myklebust <[email protected]>
NFS: fsync() should report filesystem errors over EINTR/ERESTARTSYS

Trond Myklebust <[email protected]>
NFS: Do not report EINTR/ERESTARTSYS as mapping errors

Christophe JAILLET <[email protected]>
dmaengine: idxd: Fix the error handling path in idxd_cdev_register()

Nathan Chancellor <[email protected]>
i2c: at91: Initialize dma_buf in at91_twi_xfer()

Miles Chen <[email protected]>
iommu/mediatek: Fix NULL pointer dereference when printing dev_name

Guenter Roeck <[email protected]>
MIPS: Loongson: Use hwmon_device_register_with_groups() to register hwmon

Jean-Philippe Brucker <[email protected]>
iommu/arm-smmu-v3-sva: Fix mm use-after-free

Rex-BC Chen <[email protected]>
cpufreq: mediatek: Unregister platform device on exit

Jia-Wei Chang <[email protected]>
cpufreq: mediatek: Use module_init and add module_exit

Michael Walle <[email protected]>
i2c: at91: use dma safe buffers

Yong Wu <[email protected]>
iommu/mediatek: Add mutex for m4u_group and m4u_dom in data

Yong Wu <[email protected]>
iommu/mediatek: Remove clk_disable in mtk_iommu_remove

Yong Wu <[email protected]>
iommu/mediatek: Add list_del in mtk_iommu_remove

Yong Wu <[email protected]>
iommu/mediatek: Fix 2 HW sharing pgtable issue

Mario Limonciello <[email protected]>
iommu/amd: Enable swiotlb in all cases

Jakob Koschel <[email protected]>
f2fs: fix dereference of stale list iterator after loop body

Chao Yu <[email protected]>
f2fs: fix to do sanity check on inline_dots inode

Chao Yu <[email protected]>
f2fs: support fault injection for dquot_initialize()

Dan Carpenter <[email protected]>
OPP: call of_node_put() on error path in _bandwidth_supported()

Dmitry Torokhov <[email protected]>
Input: stmfts - do not leave device disabled in stmfts_input_open

Wanpeng Li <[email protected]>
KVM: LAPIC: Drop pending LAPIC timer injection when canceling the timer

Douglas Miller <[email protected]>
RDMA/hfi1: Prevent use of lock before it is initialized

Björn Ardö <[email protected]>
mailbox: forward the hrtimer if not queued and under a lock

Julian Schroeder <[email protected]>
nfsd: destroy percpu stats counters after reply cache shutdown

Yang Yingliang <[email protected]>
mfd: davinci_voicecodec: Fix possible null-ptr-deref davinci_vc_probe()

Miaoqian Lin <[email protected]>
powerpc/fsl_rio: Fix refcount leak in fsl_rio_setup

Miaoqian Lin <[email protected]>
powerpc/xive: Fix refcount leak in xive_spapr_init

Christophe JAILLET <[email protected]>
powerpc/xive: Add some error handling code to 'xive_spapr_init()'

Randy Dunlap <[email protected]>
macintosh: via-pmu and via-cuda need RTC_LIB

Kajol Jain <[email protected]>
powerpc/perf: Fix the threshold compare group constraint for power9

Kajol Jain <[email protected]>
powerpc/perf: Fix the threshold compare group constraint for power10

Michael Ellerman <[email protected]>
powerpc/64: Only WARN if __pa()/__va() called with bad addresses

Yang Yingliang <[email protected]>
hwrng: omap3-rom - fix using wrong clk_disable() in omap_rom_rng_runtime_resume()

Daire McNamara <[email protected]>
PCI: microchip: Fix potential race in interrupt handling

Kuppuswamy Sathyanarayanan <[email protected]>
PCI/AER: Clear MULTI_ERR_COR/UNCOR_RCV bits

Miaoqian Lin <[email protected]>
Input: sparcspkr - fix refcount leak in bbc_beep_probe

Mina Almasry <[email protected]>
hugetlbfs: fix hugetlbfs_statfs() locking

Eugen Hristev <[email protected]>
ARM: dts: at91: sama7g5: remove interrupt-parent from gic node

Sebastian Andrzej Siewior <[email protected]>
crypto: cryptd - Protect per-CPU resource by disabling BH.

Corentin Labbe <[email protected]>
crypto: sun8i-ss - handle zero sized sg

Corentin Labbe <[email protected]>
crypto: sun8i-ss - rework handling of IV

Qi Zheng <[email protected]>

    tty: fix deadlock caused by calling printk() under tty_port->lock

Francesco Dolcini <[email protected]>
PCI: imx6: Fix PERST# start-up sequence

Waiman Long <[email protected]>
ipc/mqueue: use get_tree_nodev() in mqueue_get_tree()

Alexey Dobriyan <[email protected]>

    proc: fix dentry/inode overinstantiating under /proc/${pid}/net

Charles Keepax <[email protected]>
ASoC: atmel-classd: Remove endianness flag on class d component

Charles Keepax <[email protected]>
ASoC: atmel-pdmic: Remove endianness flag on pdmic component

Robert Marko <[email protected]>
arm64: dts: marvell: espressobin-ultra: enable front USB3 port

Robert Marko <[email protected]>
arm64: dts: marvell: espressobin-ultra: fix SPI-NOR config

Yangyang Li <[email protected]>
RDMA/hns: Add the detection for CMDQ status in the device initialization process

Randy Dunlap <[email protected]>
powerpc/4xx/cpm: Fix return value of __setup() handler

Randy Dunlap <[email protected]>
powerpc/idle: Fix return value of __setup() handler

Yang Yingliang <[email protected]>
pinctrl: renesas: core: Fix possible null-ptr-deref in sh_pfc_map_resources()

Geert Uytterhoeven <[email protected]>
pinctrl: renesas: r8a779a0: Fix GPIO function on I2C-capable pins

Randy Dunlap <[email protected]>
powerpc/8xx: export 'cpm_setbrg' for modules

Lv Ruyi <[email protected]>
drm/msm/dpu: fix error check return value of irq_of_parse_and_map()

Kuniyuki Iwashima <[email protected]>

    list: fix a data-race around ep->rdllist

Andy Shevchenko <[email protected]>
list: introduce list_is_head() helper and re-use it in list.h

Sudeep Holla <[email protected]>
firmware: arm_ffa: Remove incorrect assignment of driver_data

Sudeep Holla <[email protected]>
firmware: arm_ffa: Fix uuid parameter to ffa_partition_probe

Christophe JAILLET <[email protected]>
drivers/base/memory: fix an unlikely reference counting issue in __add_memory_block()

Muchun Song <[email protected]>
dax: fix cache flush on PMD-mapped pages

Miaohe Lin <[email protected]>
drivers/base/node.c: fix compaction sysfs file leak

Krzysztof Kozlowski <[email protected]>
pinctrl: mvebu: Fix irq_of_parse_and_map() return value

Dan Williams <[email protected]>
nvdimm: Allow overwrite in the presence of disabled dimms

Dan Williams <[email protected]>
nvdimm: Fix firmware activation deadlock scenarios

Cristian Marussi <[email protected]>
firmware: arm_scmi: Fix list protocols enumeration in the base protocol

Lad Prabhakar <[email protected]>
ASoC: sh: rz-ssi: Release the DMA channels in rz_ssi_probe() error path

Lad Prabhakar <[email protected]>
ASoC: sh: rz-ssi: Propagate error codes returned from platform_get_irq_byname()

Heiner Kallweit <[email protected]>
ASoC: sh: rz-ssi: Check return value of pm_runtime_resume_and_get()

Matthias Schiffer <[email protected]>
arm64: dts: ti: k3-am64-mcu: remove incorrect UART base clock rates

QintaoShen <[email protected]>
soc: bcm: Check for NULL return of devm_kzalloc()

Gustavo A. R. Silva <[email protected]>
scsi: fcoe: Fix Wstringop-overflow warnings in fcoe_wwn_from_mac()

Lv Ruyi <[email protected]>
mfd: ipaq-micro: Fix error check return value of platform_get_irq()

Hari Bathini <[email protected]>
powerpc/fadump: fix PT_LOAD segment for boot memory area

Andrea Parri (Microsoft) <[email protected]>
Drivers: hv: vmbus: Fix handling of messages with transaction ID of zero

Vinod Koul <[email protected]>
arm64: dts: qcom: qrb5165-rb5: Fix can-clock node name

Fabien Parent <[email protected]>
pinctrl: mediatek: mt8195: enable driver on mtk platforms

Caleb Connolly <[email protected]>
pinctrl/rockchip: support deferring other gpio params

Chuanhong Guo <[email protected]>
arm: mediatek: select arch timer for mt7629

Stefan Wahren <[email protected]>
pinctrl: bcm2835: implement hook for missing gpio-ranges

Stefan Wahren <[email protected]>
gpiolib: of: Introduce hook for missing gpio-ranges

Corentin Labbe <[email protected]>
crypto: marvell/cesa - ECB does not IV

Hangyu Hua <[email protected]>
misc: ocxl: fix possible double free in ocxl_file_register_afu

Stefan Wahren <[email protected]>
ARM: dts: bcm2835-rpi-b: Fix GPIO line names

Phil Elwell <[email protected]>
ARM: dts: bcm2837-rpi-3-b-plus: Fix GPIO line name of power LED

Phil Elwell <[email protected]>
ARM: dts: bcm2837-rpi-cm3-io3: Fix GPIO line names for SMPS I2C

Phil Elwell <[email protected]>
ARM: dts: bcm2835-rpi-zero-w: Fix GPIO line name for Wifi/BT

Marek Vasut <[email protected]>
ARM: dts: stm32: Fix PHY post-reset delay on Avenger96

Marc Kleine-Budde <[email protected]>
can: xilinx_can: mark bit timing constants as const

Guenter Roeck <[email protected]>
platform/chrome: Re-introduce cros_ec_cmd_xfer and use it for ioctls

Max Krummenacher <[email protected]>
ARM: dts: imx6dl-colibri: Fix I2C pinmuxing

Tzung-Bi Shih <[email protected]>
platform/chrome: cros_ec: fix error handling in cros_ec_register()

Giovanni Cabiddu <[email protected]>
crypto: qat - set COMPRESSION capability for DH895XCC

Giovanni Cabiddu <[email protected]>
crypto: qat - set CIPHER capability for DH895XCC

Giovanni Cabiddu <[email protected]>
crypto: qat - set COMPRESSION capability for QAT GEN2

Giovanni Cabiddu <[email protected]>
crypto: qat - set CIPHER capability for QAT GEN2

Sean Christopherson <[email protected]>
KVM: nVMX: Clear IDT vectoring on nested VM-Exit for double/triple fault

Sean Christopherson <[email protected]>
KVM: nVMX: Leave most VM-Exit info fields unmodified on failed VM-Entry

Bjorn Andersson <[email protected]>
soc: qcom: llcc: Add MODULE_DEVICE_TABLE()

Thorsten Scherer <[email protected]>
ARM: dts: ci4x10: Adapt to changes in imx6qdl.dtsi regarding fec clocks

Jiantao Zhang <[email protected]>
PCI: dwc: Fix setting error return on MSI DMA mapping failure

Miaoqian Lin <[email protected]>
PCI: mediatek: Fix refcount leak in mtk_pcie_subsys_powerup()

Dan Carpenter <[email protected]>
PCI: rockchip: Fix find_first_zero_bit() limit

Dan Carpenter <[email protected]>
PCI: cadence: Fix find_first_zero_bit() limit

Miaoqian Lin <[email protected]>
soc: qcom: smsm: Fix missing of_node_put() in smsm_parse_ipc

Miaoqian Lin <[email protected]>
soc: qcom: smp2p: Fix missing of_node_put() in smp2p_parse_ipc

Andre Przywara <[email protected]>
ARM: dts: suniv: F1C100: fix watchdog compatible

Rafał Miłecki <[email protected]>
ARM: dts: BCM5301X: Update pin controller node name

Rafał Miłecki <[email protected]>
ARM: dts: BCM5301X: update CRU block description

Christophe JAILLET <[email protected]>
memory: samsung: exynos5422-dmc: Avoid some over memory allocation

Mario Limonciello <[email protected]>
PCI/ACPI: Allow D3 only if Root Port can signal and wake from D3

Allen-KH Cheng <[email protected]>
arm64: dts: mt8192: Fix nor_flash status disable typo

Shawn Lin <[email protected]>
arm64: dts: rockchip: Move drive-impedance-ohm to emmc phy on rk3399

Robin Murphy <[email protected]>
dma-direct: don't over-decrypt memory

Christoph Hellwig <[email protected]>
dma-direct: always leak memory that can't be re-encrypted

Christoph Hellwig <[email protected]>
dma-direct: don't call dma_set_decrypted for remapped allocations

Christoph Hellwig <[email protected]>
dma-direct: factor out dma_set_{de,en}crypted helpers

liuyacan <[email protected]>
net/smc: postpone sk_refcnt increment in connect()

Randy Dunlap <[email protected]>
net: dsa: restrict SMSC_LAN9303_I2C kconfig

Christophe JAILLET <[email protected]>
hinic: Avoid some over memory allocation

Gustavo A. R. Silva <[email protected]>
net: huawei: hinic: Use devm_kcalloc() instead of devm_kzalloc()

David Howells <[email protected]>
rxrpc: Fix decision on when to generate an IDLE ACK

David Howells <[email protected]>
rxrpc: Don't let ack.previousPacket regress

David Howells <[email protected]>
rxrpc: Fix overlapping ACK accounting

David Howells <[email protected]>
rxrpc: Don't try to resend the request if we're receiving the reply

David Howells <[email protected]>
rxrpc: Fix listen() setting the bar too high for the prealloc rings

Adam Wujek <[email protected]>
hwmon: (pmbus) Check PEC support before reading other registers

Yongzhi Liu <[email protected]>
hv_netvsc: Fix potential dereference of NULL pointer

Jakub Kicinski <[email protected]>
net: stmmac: fix out-of-bounds access in a selftest

Gustavo A. R. Silva <[email protected]>
net: stmmac: selftests: Use kcalloc() instead of kzalloc()

Alexey Khoroshilov <[email protected]>
ASoC: max98090: Move check for invalid values before casting in max98090_put_enab_tlv()

Duoming Zhou <[email protected]>
NFC: hci: fix sleep in atomic context bugs in nfc_hci_hcp_message_tx

Harini Katakam <[email protected]>
net: macb: Fix PTP one step sync support

Ulf Hansson <[email protected]>
PM: domains: Fix initialization of genpd's next_wakeup

Yang Yingliang <[email protected]>
ASoC: wm2000: fix missing clk_disable_unprepare() on error in wm2000_anc_transition()

Jan Kara <[email protected]>
bfq: Allow current waker to defend against a tentative one

Jan Kara <[email protected]>
bfq: Relax waker detection for shared queues

Miaoqian Lin <[email protected]>
thermal/drivers/imx_sc_thermal: Fix refcount leak in imx_sc_thermal_probe

Yang Yingliang <[email protected]>
thermal/core: Fix memory leak in __thermal_cooling_device_register()

Zheng Yongjun <[email protected]>
thermal/drivers/broadcom: Fix potential NULL dereference in sr_thermal_probe

Stefan Wahren <[email protected]>
thermal/drivers/bcm2711: Don't clamp temperature at zero

Nathan Chancellor <[email protected]>
drm/i915: Fix CFI violation with show_dynamic_id()

Abhinav Kumar <[email protected]>
drm/msm/dpu: handle pm_runtime_get_sync() errors in bind path

Hangbin Liu <[email protected]>
selftests/bpf: Add missed ima_setup.sh in Makefile

Dmitry Baryshkov <[email protected]>
drm/msm: don't free the IRQ if it was not requested

Lai Jiangshan <[email protected]>
x86/sev: Annotate stack change in the #VC handler

Hangyu Hua <[email protected]>
drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()

Miaoqian Lin <[email protected]>
drm/msm/a6xx: Fix refcount leak in a6xx_gpu_init

Eric Biggers <[email protected]>
ext4: reject the 'commit' option on ext2 filesystems

Miaoqian Lin <[email protected]>
regulator: scmi: Fix refcount leak in scmi_regulator_probe

Jonas Karlman <[email protected]>
media: rkvdec: h264: Fix bit depth wrap in pps packet

Nicolas Dufresne <[email protected]>
media: rkvdec: h264: Fix dpb_valid implementation

Nicolas Dufresne <[email protected]>
media: rkvdec: Stop overclocking the decoder

Cai Huoqing <[email protected]>
media: staging: media: rkvdec: Make use of the helper function devm_platform_ioremap_resource()

Yang Yingliang <[email protected]>
media: i2c: ov5648: fix wrong pointer passed to IS_ERR() and PTR_ERR()

Dongliang Mu <[email protected]>

    media: ov7670: remove ov7670_power_off from ov7670_remove

Andre Przywara <[email protected]>
kselftest/arm64: bti: force static linking

Miaoqian Lin <[email protected]>
ASoC: ti: j721e-evm: Fix refcount leak in j721e_soc_probe_*

Zheng Bin <[email protected]>
net: hinic: add missing destroy_workqueue in hinic_pf_to_mgmt_init

Eric Dumazet <[email protected]>

    sctp: read sk->sk_bound_dev_if once in sctp_rcv()

Geert Uytterhoeven <[email protected]>
m68k: math-emu: Fix dependencies of math emulation support

Keith Busch <[email protected]>
nvme: set dma alignment to dword

Niels Dossche <[email protected]>
Bluetooth: use hdev lock for accept_list and reject_list in conn req

Niels Dossche <[email protected]>
Bluetooth: use hdev lock in activate_scan for hci_is_adv_monitoring

Ying Hsu <[email protected]>
Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout

Benjamin Gaignard <[email protected]>
media: hantro: HEVC: Fix tile info buffer value computation

Eugen Hristev <[email protected]>
media: atmel: atmel-sama5d2-isc: fix wrong mask in YUYV format check

Michael Rodin <[email protected]>
media: vsp1: Fix offset calculation for plane cropping

Pavel Skripkin <[email protected]>
media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init

Miaoqian Lin <[email protected]>
media: exynos4-is: Change clk_disable to clk_disable_unprepare

Laurentiu Palcu <[email protected]>
media: i2c: rdacm2x: properly set subdev entity function

Miaoqian Lin <[email protected]>
media: atmel: atmel-isc: Fix PM disable depth imbalance in atmel_isc_probe

Miaoqian Lin <[email protected]>
media: st-delta: Fix PM disable depth imbalance in delta_probe

Felix Fietkau <[email protected]>
mt76: do not attempt to reorder received 802.3 packets without agg session

Christophe JAILLET <[email protected]>

    mt76: mt7921: Fix the error handling path of mt7921_pci_probe()

Miaoqian Lin <[email protected]>
media: exynos4-is: Fix PM disable depth imbalance in fimc_is_probe

Christophe JAILLET <[email protected]>
media: aspeed: Fix an error handling path in aspeed_video_probe()

Josh Poimboeuf <[email protected]>
scripts/faddr2line: Fix overlapping text section failures

Phil Auld <[email protected]>
kselftest/cgroup: fix test_stress.sh to use OUTPUT dir

Bart Van Assche <[email protected]>
block: Fix the bio.bi_opf comment

Miaoqian Lin <[email protected]>
ASoC: samsung: Fix refcount leak in aries_audio_probe

Kuninori Morimoto <[email protected]>
ASoC: samsung: Use dev_err_probe() helper

Christoph Hellwig <[email protected]>
dma-direct: don't fail on highmem CMA pages in dma_direct_alloc_pages

Christoph Hellwig <[email protected]>
dma-direct: factor out a helper for DMA_ATTR_NO_KERNEL_MAPPING allocations

Miaoqian Lin <[email protected]>
regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt

Miaoqian Lin <[email protected]>
ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe

Miaoqian Lin <[email protected]>
ASoC: imx-hdmi: Fix refcount leak in imx_hdmi_probe

Miaoqian Lin <[email protected]>
ASoC: fsl: Fix refcount leak in imx_sgtl5000_probe

Kuninori Morimoto <[email protected]>
ASoC: fsl: Use dev_err_probe() helper

Basavaraj Natikar <[email protected]>
HID: amd_sfh: Modify the hid name

Basavaraj Natikar <[email protected]>
HID: amd_sfh: Modify the bus name

Ajay Singh <[email protected]>
wilc1000: fix crash observed in AP mode with cfg80211_register_netdevice()

Baochen Qiang <[email protected]>

    ath11k: Don't check arvif->is_started before sending management frames

Ravi Bangoria <[email protected]>
perf/amd/ibs: Use interrupt regs ip for stack unwinding

Jerome Marchand <[email protected]>
samples: bpf: Don't fail for a missing VMLINUX_BTF when VMLINUX_H is provided

Konrad Dybcio <[email protected]>
regulator: qcom_smd: Fix up PM8950 regulator configuration

Viresh Kumar <[email protected]>
Revert "cpufreq: Fix possible race in cpufreq online error path"

Yang Yingliang <[email protected]>
spi: spi-fsl-qspi: check return value after calling platform_get_resource_byname()

Andreas Gruenbacher <[email protected]>
iomap: iomap_write_failed fix

Mark Rutland <[email protected]>
arm64: stackleak: fix current_top_of_stack()

Xiaomeng Tong <[email protected]>
media: uvcvideo: Fix missing check to determine if element is found in list