December 2022 - Linux-stable-mirror

[PATCH v2] KVM: x86: Do not return host topology information from KVM_GET_SUPPORTED_CPUID

by Paolo Bonzini

Passing the host topology to the guest is almost certainly wrong and will confuse the scheduler. In addition, several fields of these CPUID leaves vary on each processor; it is simply impossible to return the right values from KVM_GET_SUPPORTED_CPUID in such a way that they can be passed to KVM_SET_CPUID2. The values that will most likely prevent confusion are all zeroes. Userspace will have to override it anyway if it wishes to present a specific topology to the guest. Cc: stable(a)vger.kernel.org Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> --- Documentation/virt/kvm/api.rst | 14 ++++++++++++++ arch/x86/kvm/cpuid.c | 32 ++++++++++++++++---------------- 2 files changed, 30 insertions(+), 16 deletions(-) diff --git a/Documentation/virt/kvm/api.rst b/Documentation/virt/kvm/api.rst index eee9f857a986..20f4f6b302ff 100644 --- a/Documentation/virt/kvm/api.rst +++ b/Documentation/virt/kvm/api.rst @@ -8249,6 +8249,20 @@ CPU[EAX=1]:ECX[24] (TSC_DEADLINE) is not reported by ``KVM_GET_SUPPORTED_CPUID`` It can be enabled if ``KVM_CAP_TSC_DEADLINE_TIMER`` is present and the kernel has enabled in-kernel emulation of the local APIC. +CPU topology +~~~~~~~~~~~~ + +Several CPUID values include topology information for the host CPU: +0x0b and 0x1f for Intel systems, 0x8000001e for AMD systems. Different +versions of KVM return different values for this information and userspace +should not rely on it. Currently they return all zeroes. + +If userspace wishes to set up a guest topology, it should be careful that +the values of these three leaves differ for each CPU. In particular, +the APIC ID is found in EDX for all subleaves of 0x0b and 0x1f, and in EAX +for 0x8000001e; the latter also encodes the core id and node id in bits +7:0 of EBX and ECX respectively. + Obsolete ioctls and capabilities ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c index 0810e93cbedc..164bfb7e7a16 100644 --- a/arch/x86/kvm/cpuid.c +++ b/arch/x86/kvm/cpuid.c @@ -759,16 +759,22 @@ struct kvm_cpuid_array { int nent; }; +static struct kvm_cpuid_entry2 *get_next_cpuid(struct kvm_cpuid_array *array) +{ + if (array->nent >= array->maxnent) + return NULL; + + return &array->entries[array->nent++]; +} + static struct kvm_cpuid_entry2 *do_host_cpuid(struct kvm_cpuid_array *array, u32 function, u32 index) { - struct kvm_cpuid_entry2 *entry; + struct kvm_cpuid_entry2 *entry = get_next_cpuid(array); - if (array->nent >= array->maxnent) + if (!entry) return NULL; - entry = &array->entries[array->nent++]; - memset(entry, 0, sizeof(*entry)); entry->function = function; entry->index = index; @@ -945,22 +951,13 @@ static inline int __do_cpuid_func(struct kvm_cpuid_array *array, u32 function) entry->edx = edx.full; break; } - /* - * Per Intel's SDM, the 0x1f is a superset of 0xb, - * thus they can be handled by common code. - */ case 0x1f: case 0xb: /* - * Populate entries until the level type (ECX[15:8]) of the - * previous entry is zero. Note, CPUID EAX.{0x1f,0xb}.0 is - * the starting entry, filled by the primary do_host_cpuid(). + * No topology; a valid topology is indicated by the presence + * of subleaf 1. */ - for (i = 1; entry->ecx & 0xff00; ++i) { - entry = do_host_cpuid(array, function, i); - if (!entry) - goto out; - } + entry->eax = entry->ebx = entry->ecx = 0; break; case 0xd: { u64 permitted_xcr0 = kvm_caps.supported_xcr0 & xstate_get_guest_group_perm(); @@ -1193,6 +1190,9 @@ static inline int __do_cpuid_func(struct kvm_cpuid_array *array, u32 function) entry->ebx = entry->ecx = entry->edx = 0; break; case 0x8000001e: + /* Do not return host topology information. */ + entry->eax = entry->ebx = entry->ecx = 0; + entry->edx = 0; /* reserved */ break; case 0x8000001F: if (!kvm_cpu_cap_has(X86_FEATURE_SEV)) { -- 2.31.1

2 years, 7 months

3
12
0 0

[PATCH] clk: ingenic: jz4760: Update M/N/OD calculation algorithm

by Paul Cercueil

The previous algorithm was pretty broken. - The inner loop had a '(m > m_max)' condition, and the value of 'm' would increase in each iteration; - Each iteration would actually multiply 'm' by two, so it is not needed to re-compute the whole equation at each iteration; - It would loop until (m & 1) == 0, which means it would loop at most once. - The outer loop would divide the 'n' value by two at the end of each iteration. This meant that for a 12 MHz parent clock and a 1.2 GHz requested clock, it would first try n=12, then n=6, then n=3, then n=1, none of which would work; the only valid value is n=2 in this case. Simplify this algorithm with a single for loop, which decrements 'n' after each iteration, addressing all of the above problems. Fixes: bdbfc029374f ("clk: ingenic: Add support for the JZ4760") Cc: <stable(a)vger.kernel.org> Signed-off-by: Paul Cercueil <paul(a)crapouillou.net> --- drivers/clk/ingenic/jz4760-cgu.c | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-) diff --git a/drivers/clk/ingenic/jz4760-cgu.c b/drivers/clk/ingenic/jz4760-cgu.c index ecd395ac8a28..e407f00bd594 100644 --- a/drivers/clk/ingenic/jz4760-cgu.c +++ b/drivers/clk/ingenic/jz4760-cgu.c @@ -58,7 +58,7 @@ jz4760_cgu_calc_m_n_od(const struct ingenic_cgu_pll_info *pll_info, unsigned long rate, unsigned long parent_rate, unsigned int *pm, unsigned int *pn, unsigned int *pod) { - unsigned int m, n, od, m_max = (1 << pll_info->m_bits) - 2; + unsigned int m, n, od, m_max = (1 << pll_info->m_bits) - 1; /* The frequency after the N divider must be between 1 and 50 MHz. */ n = parent_rate / (1 * MHZ); @@ -66,19 +66,17 @@ jz4760_cgu_calc_m_n_od(const struct ingenic_cgu_pll_info *pll_info, /* The N divider must be >= 2. */ n = clamp_val(n, 2, 1 << pll_info->n_bits); - for (;; n >>= 1) { - od = (unsigned int)-1; + rate /= MHZ; + parent_rate /= MHZ; - do { - m = (rate / MHZ) * (1 << ++od) * n / (parent_rate / MHZ); - } while ((m > m_max || m & 1) && (od < 4)); - - if (od < 4 && m >= 4 && m <= m_max) - break; + for (m = m_max; m >= m_max && n >= 2; n--) { + m = rate * n / parent_rate; + od = m & 1; + m <<= od; } *pm = m; - *pn = n; + *pn = n + 1; *pod = 1 << od; } -- 2.35.1

2 years, 7 months

2
1
0 0

[PATCH v1] KVM: destruct kvm_io_device while unregistering it from kvm_io_bus

by Wei Wang

Current usage of kvm_io_device requires users to destruct it with an extra call of kvm_iodevice_destructor after the device gets unregistered from the kvm_io_bus. This is not necessary and can cause errors if a user forgot to make the extra call. Simplify the usage by combining kvm_iodevice_destructor into kvm_io_bus_unregister_dev. This reduces LOCs a bit for users and can avoid the leakage of destructing the device explicitly. The fix was originally provided by Sean Christopherson. Link: https://lore.kernel.org/lkml/DS0PR11MB6373F27D0EE6CD28C784478BDCEC9@DS0PR11… Fixes: 5d3c4c79384a ("KVM: Stop looking for coalesced MMIO zones if the bus is destroyed") Cc: stable(a)vger.kernel.org Reported-by: �� <liujingfeng(a)qianxin.com> Signed-off-by: Wei Wang <wei.w.wang(a)intel.com> --- include/kvm/iodev.h | 6 ------ virt/kvm/coalesced_mmio.c | 1 - virt/kvm/eventfd.c | 1 - virt/kvm/kvm_main.c | 24 +++++++++++++++--------- 4 files changed, 15 insertions(+), 17 deletions(-) diff --git a/include/kvm/iodev.h b/include/kvm/iodev.h index d75fc4365746..56619e33251e 100644 --- a/include/kvm/iodev.h +++ b/include/kvm/iodev.h @@ -55,10 +55,4 @@ static inline int kvm_iodevice_write(struct kvm_vcpu *vcpu, : -EOPNOTSUPP; } -static inline void kvm_iodevice_destructor(struct kvm_io_device *dev) -{ - if (dev->ops->destructor) - dev->ops->destructor(dev); -} - #endif /* __KVM_IODEV_H__ */ diff --git a/virt/kvm/coalesced_mmio.c b/virt/kvm/coalesced_mmio.c index 0be80c213f7f..d7135a5e76f8 100644 --- a/virt/kvm/coalesced_mmio.c +++ b/virt/kvm/coalesced_mmio.c @@ -195,7 +195,6 @@ int kvm_vm_ioctl_unregister_coalesced_mmio(struct kvm *kvm, */ if (r) break; - kvm_iodevice_destructor(&dev->dev); } } diff --git a/virt/kvm/eventfd.c b/virt/kvm/eventfd.c index 2a3ed401ce46..1b277afb545b 100644 --- a/virt/kvm/eventfd.c +++ b/virt/kvm/eventfd.c @@ -898,7 +898,6 @@ kvm_deassign_ioeventfd_idx(struct kvm *kvm, enum kvm_bus bus_idx, bus = kvm_get_bus(kvm, bus_idx); if (bus) bus->ioeventfd_count--; - ioeventfd_release(p); ret = 0; break; } diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c index 13e88297f999..582757ebdce6 100644 --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -5200,6 +5200,12 @@ static struct notifier_block kvm_reboot_notifier = { .priority = 0, }; +static void kvm_iodevice_destructor(struct kvm_io_device *dev) +{ + if (dev->ops->destructor) + dev->ops->destructor(dev); +} + static void kvm_io_bus_destroy(struct kvm_io_bus *bus) { int i; @@ -5423,7 +5429,7 @@ int kvm_io_bus_register_dev(struct kvm *kvm, enum kvm_bus bus_idx, gpa_t addr, int kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx, struct kvm_io_device *dev) { - int i, j; + int i; struct kvm_io_bus *new_bus, *bus; lockdep_assert_held(&kvm->slots_lock); @@ -5453,18 +5459,18 @@ int kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx, rcu_assign_pointer(kvm->buses[bus_idx], new_bus); synchronize_srcu_expedited(&kvm->srcu); - /* Destroy the old bus _after_ installing the (null) bus. */ + /* + * If (null) bus is installed, destroy the old bus, including all the + * attached devices. Otherwise, destroy the caller's device only. + */ if (!new_bus) { pr_err("kvm: failed to shrink bus, removing it completely\n"); - for (j = 0; j < bus->dev_count; j++) { - if (j == i) - continue; - kvm_iodevice_destructor(bus->range[j].dev); - } + kvm_io_bus_destroy(bus); + return -ENOMEM; } - kfree(bus); - return new_bus ? 0 : -ENOMEM; + kvm_iodevice_destructor(dev); + return 0; } struct kvm_io_device *kvm_io_bus_get_dev(struct kvm *kvm, enum kvm_bus bus_idx, -- 2.27.0

2 years, 7 months

4
5
0 0

[PATCH v2] security: Restore passing final prot to ima_file_mmap()

by Roberto Sassu

From: Roberto Sassu <roberto.sassu(a)huawei.com> Commit 98de59bfe4b2f ("take calculation of final prot in security_mmap_file() into a helper") moved the code to update prot with the actual protection flags to be granted to the requestor by the kernel to a helper called mmap_prot(). However, the patch didn't update the argument passed to ima_file_mmap(), making it receive the requested prot instead of the final computed prot. A possible consequence is that files mmapped as executable might not be measured/appraised if PROT_EXEC is not requested but subsequently added in the final prot. Replace prot with mmap_prot(file, prot) as the second argument of ima_file_mmap() to restore the original behavior. Cc: stable(a)vger.kernel.org Fixes: 98de59bfe4b2 ("take calculation of final prot in security_mmap_file() into a helper") Signed-off-by: Roberto Sassu <roberto.sassu(a)huawei.com> --- security/security.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/security/security.c b/security/security.c index d1571900a8c7..0d2359d588a1 100644 --- a/security/security.c +++ b/security/security.c @@ -1666,7 +1666,7 @@ int security_mmap_file(struct file *file, unsigned long prot, mmap_prot(file, prot), flags); if (ret) return ret; - return ima_file_mmap(file, prot); + return ima_file_mmap(file, mmap_prot(file, prot)); } int security_mmap_addr(unsigned long addr) -- 2.25.1

2 years, 7 months

3
10
0 0

[PATCH AUTOSEL 6.1 01/28] fs/ntfs3: Validate BOOT record_size

by Sasha Levin

From: edward lo <edward.lo(a)ambergroup.io> [ Upstream commit 0b66046266690454dc04e6307bcff4a5605b42a1 ] When the NTFS BOOT record_size field < 0, it represents a shift value. However, there is no sanity check on the shift result and the sbi->record_bits calculation through blksize_bits() assumes the size always > 256, which could lead to NPD while mounting a malformed NTFS image. [ 318.675159] BUG: kernel NULL pointer dereference, address: 0000000000000158 [ 318.675682] #PF: supervisor read access in kernel mode [ 318.675869] #PF: error_code(0x0000) - not-present page [ 318.676246] PGD 0 P4D 0 [ 318.676502] Oops: 0000 [#1] PREEMPT SMP NOPTI [ 318.676934] CPU: 0 PID: 259 Comm: mount Not tainted 5.19.0 #5 [ 318.677289] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 318.678136] RIP: 0010:ni_find_attr+0x2d/0x1c0 [ 318.678656] Code: 89 ca 4d 89 c7 41 56 41 55 41 54 41 89 cc 55 48 89 fd 53 48 89 d3 48 83 ec 20 65 48 8b 04 25 28 00 00 00 48 89 44 24 180 [ 318.679848] RSP: 0018:ffffa6c8c0297bd8 EFLAGS: 00000246 [ 318.680104] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000080 [ 318.680790] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 318.681679] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 318.682577] R10: 0000000000000000 R11: 0000000000000005 R12: 0000000000000080 [ 318.683015] R13: ffff8d5582e68400 R14: 0000000000000100 R15: 0000000000000000 [ 318.683618] FS: 00007fd9e1c81e40(0000) GS:ffff8d55fdc00000(0000) knlGS:0000000000000000 [ 318.684280] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 318.684651] CR2: 0000000000000158 CR3: 0000000002e1a000 CR4: 00000000000006f0 [ 318.685623] Call Trace: [ 318.686607] <TASK> [ 318.686872] ? ntfs_alloc_inode+0x1a/0x60 [ 318.687235] attr_load_runs_vcn+0x2b/0xa0 [ 318.687468] mi_read+0xbb/0x250 [ 318.687576] ntfs_iget5+0x114/0xd90 [ 318.687750] ntfs_fill_super+0x588/0x11b0 [ 318.687953] ? put_ntfs+0x130/0x130 [ 318.688065] ? snprintf+0x49/0x70 [ 318.688164] ? put_ntfs+0x130/0x130 [ 318.688256] get_tree_bdev+0x16a/0x260 [ 318.688407] vfs_get_tree+0x20/0xb0 [ 318.688519] path_mount+0x2dc/0x9b0 [ 318.688877] do_mount+0x74/0x90 [ 318.689142] __x64_sys_mount+0x89/0xd0 [ 318.689636] do_syscall_64+0x3b/0x90 [ 318.689998] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 318.690318] RIP: 0033:0x7fd9e133c48a [ 318.690687] Code: 48 8b 0d 11 fa 2a 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 008 [ 318.691357] RSP: 002b:00007ffd374406c8 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 [ 318.691632] RAX: ffffffffffffffda RBX: 0000564d0b051080 RCX: 00007fd9e133c48a [ 318.691920] RDX: 0000564d0b051280 RSI: 0000564d0b051300 RDI: 0000564d0b0596a0 [ 318.692123] RBP: 0000000000000000 R08: 0000564d0b0512a0 R09: 0000000000000020 [ 318.692349] R10: 00000000c0ed0000 R11: 0000000000000202 R12: 0000564d0b0596a0 [ 318.692673] R13: 0000564d0b051280 R14: 0000000000000000 R15: 00000000ffffffff [ 318.693007] </TASK> [ 318.693271] Modules linked in: [ 318.693614] CR2: 0000000000000158 [ 318.694446] ---[ end trace 0000000000000000 ]--- [ 318.694779] RIP: 0010:ni_find_attr+0x2d/0x1c0 [ 318.694952] Code: 89 ca 4d 89 c7 41 56 41 55 41 54 41 89 cc 55 48 89 fd 53 48 89 d3 48 83 ec 20 65 48 8b 04 25 28 00 00 00 48 89 44 24 180 [ 318.696042] RSP: 0018:ffffa6c8c0297bd8 EFLAGS: 00000246 [ 318.696531] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000080 [ 318.698114] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 318.699286] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 318.699795] R10: 0000000000000000 R11: 0000000000000005 R12: 0000000000000080 [ 318.700236] R13: ffff8d5582e68400 R14: 0000000000000100 R15: 0000000000000000 [ 318.700973] FS: 00007fd9e1c81e40(0000) GS:ffff8d55fdc00000(0000) knlGS:0000000000000000 [ 318.701688] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 318.702190] CR2: 0000000000000158 CR3: 0000000002e1a000 CR4: 00000000000006f0 [ 318.726510] mount (259) used greatest stack depth: 13320 bytes left This patch adds a sanity check. Signed-off-by: edward lo <edward.lo(a)ambergroup.io> Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- fs/ntfs3/super.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/ntfs3/super.c b/fs/ntfs3/super.c index 47012c9bf505..d998cb083d95 100644 --- a/fs/ntfs3/super.c +++ b/fs/ntfs3/super.c @@ -789,7 +789,7 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size, : (u32)boot->record_size << sbi->cluster_bits; - if (record_size > MAXIMUM_BYTES_PER_MFT) + if (record_size > MAXIMUM_BYTES_PER_MFT || record_size < SECTOR_SIZE) goto out; sbi->record_bits = blksize_bits(record_size); -- 2.35.1

2 years, 7 months

2
28
0 0

[PATCH 5.15 5.10 5.4 v2] kbuild: fix Build ID if CONFIG_MODVERSIONS

by Tom Saeger

Backport of: commit 0d362be5b142 ("Makefile: link with -z noexecstack --no-warn-rwx-segments") breaks arm64 Build ID when CONFIG_MODVERSIONS=y for all kernels from: commit e4484a495586 ("Merge tag 'kbuild-fixes-v5.0' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild") until: commit df202b452fe6 ("Merge tag 'kbuild-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild") Linus's tree doesn't have this issue since 0d362be5b142 was merged after df202b452fe6 which included: commit 7b4537199a4a ("kbuild: link symbol CRCs at final link, removing CONFIG_MODULE_REL_CRCS") This kernel's KBUILD CONFIG_MODVERSIONS tooling compiles and links .S targets with relocatable (-r) and now (-z noexecstack) which results in ld adding a .note.GNU-stack section to .o files. Final linking of vmlinux should add a .NOTES segment containing the Build ID, but does NOT (on some architectures like arm64) if a .note.GNU-stack section is found in .o's supplied during link of vmlinux. DISCARD .note.GNU-stack sections of .S targets. Final link of vmlinux then properly adds .NOTES segment containing Build ID that can be read using tools like 'readelf -n'. Fixes: 0d362be5b142 ("Makefile: link with -z noexecstack --no-warn-rwx-segments") Cc: <stable(a)vger.kernel.org> # 5.15, 5.10, 5.4 Cc: <linux-kbuild(a)vger.kernel.org> Cc: Nick Desaulniers <ndesaulniers(a)google.com> Cc: Masahiro Yamada <masahiroy(a)kernel.org> Cc: Nicholas Piggin <npiggin(a)gmail.com> Cc: Michal Marek <michal.lkml(a)markovi.net> Cc: Nathan Chancellor <nathan(a)kernel.org> Signed-off-by: Tom Saeger <tom.saeger(a)oracle.com> --- v2: - Changed approach to append DISCARD section to generated linker script. - ld no longer emits warning (which was intent of 0d362b35b142) this addresses Nick's v1 feedback. - this is applied to all arches, not just arm64 - added commit refs and notes why this doesn't occur in Linus's tree to address Greg's v1 feedback. - added Fixes: 0d362b35b142 requested by Nick - added note to changelog for 7b4537199a4a requested by Nick - build tested on arm64 and x86 version works(vmlinux contains Build ID) v4.14.302 x86, arm64 v4.14.302.patched x86, arm64 v4.19.269 x86, arm64 v4.19.269.patched x86, arm64 v5.4.227 x86 v5.4.227.patched x86, arm64 v5.10.159 x86 v5.10.159.patched x86, arm64 v5.15.83 x86 v5.15.83.patched x86, arm64 v1: https://lore.kernel.org/all/cover.1670358255.git.tom.saeger@oracle.com/ scripts/Makefile.build | 2 ++ 1 file changed, 2 insertions(+) diff --git a/scripts/Makefile.build b/scripts/Makefile.build index 17aa8ef2d52a..e3939676eeb5 100644 --- a/scripts/Makefile.build +++ b/scripts/Makefile.build @@ -379,6 +379,8 @@ cmd_modversions_S = \ if $(OBJDUMP) -h $@ | grep -q __ksymtab; then \ $(call cmd_gensymtypes_S,$(KBUILD_SYMTYPES),$(@:.o=.symtypes)) \ > $(@D)/.tmp_$(@F:.o=.ver); \ + echo "SECTIONS { /DISCARD/ : { *(.note.GNU-stack) } }" \ + >> $(@D)/.tmp_$(@F:.o=.ver); \ \ $(LD) $(KBUILD_LDFLAGS) -r -o $(@D)/.tmp_$(@F) $@ \ -T $(@D)/.tmp_$(@F:.o=.ver); \ base-commit: fd6d66840b4269da4e90e1ea807ae3197433bc66 -- 2.38.1

2 years, 7 months

4
22
0 0

[PATCH v6 1/6] locking/rwsem: Prevent non-first waiter from spinning in down_write() slowpath

by Waiman Long

A non-first waiter can potentially spin in the for loop of rwsem_down_write_slowpath() without sleeping but fail to acquire the lock even if the rwsem is free if the following sequence happens: Non-first RT waiter First waiter Lock holder ------------------- ------------ ----------- Acquire wait_lock rwsem_try_write_lock(): Set handoff bit if RT or wait too long Set waiter->handoff_set Release wait_lock Acquire wait_lock Inherit waiter->handoff_set Release wait_lock Clear owner Release lock if (waiter.handoff_set) { rwsem_spin_on_owner((); if (OWNER_NULL) goto trylock_again; } trylock_again: Acquire wait_lock rwsem_try_write_lock(): if (first->handoff_set && (waiter != first)) return false; Release wait_lock A non-first waiter cannot really acquire the rwsem even if it mistakenly believes that it can spin on OWNER_NULL value. If that waiter happens to be an RT task running on the same CPU as the first waiter, it can block the first waiter from acquiring the rwsem leading to live lock. Fix this problem by making sure that a non-first waiter cannot spin in the slowpath loop without sleeping. Fixes: d257cc8cb8d5 ("locking/rwsem: Make handoff bit handling more consistent") Reviewed-and-tested-by: Mukesh Ojha <quic_mojha(a)quicinc.com> Signed-off-by: Waiman Long <longman(a)redhat.com> Cc: stable(a)vger.kernel.org --- kernel/locking/rwsem.c | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) diff --git a/kernel/locking/rwsem.c b/kernel/locking/rwsem.c index 44873594de03..be2df9ea7c30 100644 --- a/kernel/locking/rwsem.c +++ b/kernel/locking/rwsem.c @@ -624,18 +624,16 @@ static inline bool rwsem_try_write_lock(struct rw_semaphore *sem, */ if (first->handoff_set && (waiter != first)) return false; - - /* - * First waiter can inherit a previously set handoff - * bit and spin on rwsem if lock acquisition fails. - */ - if (waiter == first) - waiter->handoff_set = true; } new = count; if (count & RWSEM_LOCK_MASK) { + /* + * A waiter (first or not) can set the handoff bit + * if it is an RT task or wait in the wait queue + * for too long. + */ if (has_handoff || (!rt_task(waiter->task) && !time_after(jiffies, waiter->timeout))) return false; @@ -651,11 +649,12 @@ static inline bool rwsem_try_write_lock(struct rw_semaphore *sem, } while (!atomic_long_try_cmpxchg_acquire(&sem->count, &count, new)); /* - * We have either acquired the lock with handoff bit cleared or - * set the handoff bit. + * We have either acquired the lock with handoff bit cleared or set + * the handoff bit. Only the first waiter can have its handoff_set + * set here to enable optimistic spinning in slowpath loop. */ if (new & RWSEM_FLAG_HANDOFF) { - waiter->handoff_set = true; + first->handoff_set = true; lockevent_inc(rwsem_wlock_handoff); return false; } -- 2.31.1

2 years, 7 months

2
2
0 0

[PATCH] HID: multitouch: enable trackstick of Asus ExpertBook B2502

by Benjamin Tissoires

This device has a trackstick that is sent through the same HID device than the touchpad. Unfortunately there are 2 mice attached to that device descriptor, with the first one for the touchpad when the second is for the trackstick. Force all devices to be exported. Cc: stable(a)vger.kernel.org # 5.8+ Link: https://bugzilla.redhat.com/show_bug.cgi?id=2154204 Signed-off-by: Benjamin Tissoires <benjamin.tissoires(a)redhat.com> --- drivers/hid/hid-multitouch.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c index 91a4d3fc30e0..91ac72b32d45 100644 --- a/drivers/hid/hid-multitouch.c +++ b/drivers/hid/hid-multitouch.c @@ -1860,6 +1860,12 @@ static const struct hid_device_id mt_devices[] = { USB_VENDOR_ID_ASUSTEK, USB_DEVICE_ID_ASUSTEK_T304_KEYBOARD) }, + /* Asus ExpertBook with trackstick */ + { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT, + HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8, + USB_VENDOR_ID_ELAN, + 0x3148) }, + /* Atmel panels */ { .driver_data = MT_CLS_SERIAL, MT_USB_DEVICE(USB_VENDOR_ID_ATMEL, -- 2.38.1

2 years, 7 months

1
1
0 0

[PATCH 1/5] pwm: jz4740: Fix pin level of disabled TCU2 channels, part 1

by Paul Cercueil

The "duty > cycle" trick to force the pin level of a disabled TCU2 channel would only work when the channel had been enabled previously. Address this issue by enabling the PWM mode in jz4740_pwm_disable (I know, right) so that the "duty > cycle" trick works before disabling the PWM channel right after. This issue went unnoticed, as the PWM pins on the majority of the boards tested would default to the inactive level once the corresponding TCU clock was enabled, so the first call to jz4740_pwm_disable() would not actually change the pin levels. On the GCW Zero however, the PWM pin for the backlight (PWM1, which is a TCU2 channel) goes active as soon as the timer1 clock is enabled. Since the jz4740_pwm_disable() function did not work on channels not previously enabled, the backlight would shine at full brightness from the moment the backlight driver would probe, until the backlight driver tried to *enable* the PWM output. With this fix, the PWM pins will be forced inactive as soon as jz4740_pwm_apply() is called (and might be reconfigured to active if dictated by the pwm_state). This means that there is still a tiny time frame between the .request() and .apply() callbacks where the PWM pin might be active. Sadly, there is no way to fix this issue: it is impossible to write a PWM channel's registers if the corresponding clock is not enabled, and enabling the clock is what causes the PWM pin to go active. There is a workaround, though, which complements this fix: simply starting the backlight driver (or any PWM client driver) with a "init" pinctrl state that sets the pin as an inactive GPIO. Once the driver is probed and the pinctrl state switches to "default", the regular PWM pin configuration can be used as it will be properly driven. Fixes: c2693514a0a1 ("pwm: jz4740: Obtain regmap from parent node") Signed-off-by: Paul Cercueil <paul(a)crapouillou.net> Cc: stable(a)vger.kernel.org --- drivers/pwm/pwm-jz4740.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/pwm/pwm-jz4740.c b/drivers/pwm/pwm-jz4740.c index a5fdf97c0d2e..228eb104bf1e 100644 --- a/drivers/pwm/pwm-jz4740.c +++ b/drivers/pwm/pwm-jz4740.c @@ -102,11 +102,14 @@ static void jz4740_pwm_disable(struct pwm_chip *chip, struct pwm_device *pwm) struct jz4740_pwm_chip *jz = to_jz4740(chip); /* - * Set duty > period. This trick allows the TCU channels in TCU2 mode to - * properly return to their init level. + * Set duty > period, then enable PWM mode and start the counter. + * This trick allows to force the inactive pin level for the TCU2 + * channels. */ regmap_write(jz->map, TCU_REG_TDHRc(pwm->hwpwm), 0xffff); regmap_write(jz->map, TCU_REG_TDFRc(pwm->hwpwm), 0x0); + regmap_set_bits(jz->map, TCU_REG_TCSRc(pwm->hwpwm), TCU_TCSR_PWM_EN); + regmap_write(jz->map, TCU_REG_TESR, BIT(pwm->hwpwm)); /* * Disable PWM output. -- 2.35.1

2 years, 7 months

2
7
0 0

[PATCH] scsi: ufs: core: fix devfreq deadlocks

by Johan Hovold

There is a lock inversion and rwsem read-lock recursion in the devfreq target callback which can lead to deadlocks. Specifically, ufshcd_devfreq_scale() already holds a clk_scaling_lock read lock when toggling the write booster, which involves taking the dev_cmd mutex before taking another clk_scaling_lock read lock. This can lead to a deadlock if another thread: 1) tries to acquire the dev_cmd and clk_scaling locks in the correct order, or 2) takes a clk_scaling write lock before the attempt to take the clk_scaling read lock a second time. Fix this by dropping the clk_scaling_lock before toggling the write booster as was done before commit 0e9d4ca43ba8 ("scsi: ufs: Protect some contexts from unexpected clock scaling"). While the devfreq callbacks are already serialised, add a second serialising mutex to handle the unlikely case where a callback triggered through the devfreq sysfs interface is racing with a request to disable clock scaling through the UFS controller 'clkscale_enable' sysfs attribute. This could otherwise lead to the write booster being left disabled after having disabled clock scaling. Also take the new mutex in ufshcd_clk_scaling_allow() to make sure that any pending write booster update has completed on return. Note that this currently only affects Qualcomm platforms since commit 87bd05016a64 ("scsi: ufs: core: Allow host driver to disable wb toggling during clock scaling"). The lock inversion (i.e. 1 above) was reported by lockdep as: ====================================================== WARNING: possible circular locking dependency detected 6.1.0-next-20221216 #211 Not tainted ------------------------------------------------------ kworker/u16:2/71 is trying to acquire lock: ffff076280ba98a0 (&hba->dev_cmd.lock){+.+.}-{3:3}, at: ufshcd_query_flag+0x50/0x1c0 but task is already holding lock: ffff076280ba9cf0 (&hba->clk_scaling_lock){++++}-{3:3}, at: ufshcd_devfreq_scale+0x2b8/0x380 which lock already depends on the new lock. [ +0.011606] the existing dependency chain (in reverse order) is: -> #1 (&hba->clk_scaling_lock){++++}-{3:3}: lock_acquire+0x68/0x90 down_read+0x58/0x80 ufshcd_exec_dev_cmd+0x70/0x2c0 ufshcd_verify_dev_init+0x68/0x170 ufshcd_probe_hba+0x398/0x1180 ufshcd_async_scan+0x30/0x320 async_run_entry_fn+0x34/0x150 process_one_work+0x288/0x6c0 worker_thread+0x74/0x450 kthread+0x118/0x120 ret_from_fork+0x10/0x20 -> #0 (&hba->dev_cmd.lock){+.+.}-{3:3}: __lock_acquire+0x12a0/0x2240 lock_acquire.part.0+0xcc/0x220 lock_acquire+0x68/0x90 __mutex_lock+0x98/0x430 mutex_lock_nested+0x2c/0x40 ufshcd_query_flag+0x50/0x1c0 ufshcd_query_flag_retry+0x64/0x100 ufshcd_wb_toggle+0x5c/0x120 ufshcd_devfreq_scale+0x2c4/0x380 ufshcd_devfreq_target+0xf4/0x230 devfreq_set_target+0x84/0x2f0 devfreq_update_target+0xc4/0xf0 devfreq_monitor+0x38/0x1f0 process_one_work+0x288/0x6c0 worker_thread+0x74/0x450 kthread+0x118/0x120 ret_from_fork+0x10/0x20 other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&hba->clk_scaling_lock); lock(&hba->dev_cmd.lock); lock(&hba->clk_scaling_lock); lock(&hba->dev_cmd.lock); *** DEADLOCK *** Fixes: 0e9d4ca43ba8 ("scsi: ufs: Protect some contexts from unexpected clock scaling") Cc: stable(a)vger.kernel.org # 5.12 Cc: Can Guo <quic_cang(a)quicinc.com> Signed-off-by: Johan Hovold <johan+linaro(a)kernel.org> --- This issue has apparently been known for over a year [1] without anyone bothering to fix it. Aside from the potential deadlocks, this also leads to developers using Qualcomm platforms not being able to use lockdep to prevent further issues like this from being introduced in other places. Johan [1] https://lore.kernel.org/lkml/1631843521-2863-1-git-send-email-cang@codeauro… drivers/ufs/core/ufshcd.c | 29 +++++++++++++++-------------- include/ufs/ufshcd.h | 2 ++ 2 files changed, 17 insertions(+), 14 deletions(-) diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c index bda61be5f035..5c3821b2fcf8 100644 --- a/drivers/ufs/core/ufshcd.c +++ b/drivers/ufs/core/ufshcd.c @@ -1234,12 +1234,14 @@ static int ufshcd_clock_scaling_prepare(struct ufs_hba *hba) * clock scaling is in progress */ ufshcd_scsi_block_requests(hba); + mutex_lock(&hba->wb_mutex); down_write(&hba->clk_scaling_lock); if (!hba->clk_scaling.is_allowed || ufshcd_wait_for_doorbell_clr(hba, DOORBELL_CLR_TOUT_US)) { ret = -EBUSY; up_write(&hba->clk_scaling_lock); + mutex_unlock(&hba->wb_mutex); ufshcd_scsi_unblock_requests(hba); goto out; } @@ -1251,12 +1253,16 @@ static int ufshcd_clock_scaling_prepare(struct ufs_hba *hba) return ret; } -static void ufshcd_clock_scaling_unprepare(struct ufs_hba *hba, bool writelock) +static void ufshcd_clock_scaling_unprepare(struct ufs_hba *hba, bool scale_up) { - if (writelock) - up_write(&hba->clk_scaling_lock); - else - up_read(&hba->clk_scaling_lock); + up_write(&hba->clk_scaling_lock); + + /* Enable Write Booster if we have scaled up else disable it */ + if (ufshcd_enable_wb_if_scaling_up(hba)) + ufshcd_wb_toggle(hba, scale_up); + + mutex_unlock(&hba->wb_mutex); + ufshcd_scsi_unblock_requests(hba); ufshcd_release(hba); } @@ -1273,7 +1279,6 @@ static void ufshcd_clock_scaling_unprepare(struct ufs_hba *hba, bool writelock) static int ufshcd_devfreq_scale(struct ufs_hba *hba, bool scale_up) { int ret = 0; - bool is_writelock = true; ret = ufshcd_clock_scaling_prepare(hba); if (ret) @@ -1302,15 +1307,8 @@ static int ufshcd_devfreq_scale(struct ufs_hba *hba, bool scale_up) } } - /* Enable Write Booster if we have scaled up else disable it */ - if (ufshcd_enable_wb_if_scaling_up(hba)) { - downgrade_write(&hba->clk_scaling_lock); - is_writelock = false; - ufshcd_wb_toggle(hba, scale_up); - } - out_unprepare: - ufshcd_clock_scaling_unprepare(hba, is_writelock); + ufshcd_clock_scaling_unprepare(hba, scale_up); return ret; } @@ -6066,9 +6064,11 @@ static void ufshcd_force_error_recovery(struct ufs_hba *hba) static void ufshcd_clk_scaling_allow(struct ufs_hba *hba, bool allow) { + mutex_lock(&hba->wb_mutex); down_write(&hba->clk_scaling_lock); hba->clk_scaling.is_allowed = allow; up_write(&hba->clk_scaling_lock); + mutex_unlock(&hba->wb_mutex); } static void ufshcd_clk_scaling_suspend(struct ufs_hba *hba, bool suspend) @@ -9793,6 +9793,7 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem *mmio_base, unsigned int irq) /* Initialize mutex for exception event control */ mutex_init(&hba->ee_ctrl_mutex); + mutex_init(&hba->wb_mutex); init_rwsem(&hba->clk_scaling_lock); ufshcd_init_clk_gating(hba); diff --git a/include/ufs/ufshcd.h b/include/ufs/ufshcd.h index 5cf81dff60aa..727084cd79be 100644 --- a/include/ufs/ufshcd.h +++ b/include/ufs/ufshcd.h @@ -808,6 +808,7 @@ struct ufs_hba_monitor { * @urgent_bkops_lvl: keeps track of urgent bkops level for device * @is_urgent_bkops_lvl_checked: keeps track if the urgent bkops level for * device is known or not. + * @wb_mutex: used to serialize devfreq and sysfs write booster toggling * @clk_scaling_lock: used to serialize device commands and clock scaling * @desc_size: descriptor sizes reported by device * @scsi_block_reqs_cnt: reference counting for scsi block requests @@ -951,6 +952,7 @@ struct ufs_hba { enum bkops_status urgent_bkops_lvl; bool is_urgent_bkops_lvl_checked; + struct mutex wb_mutex; struct rw_semaphore clk_scaling_lock; unsigned char desc_size[QUERY_DESC_IDN_MAX]; atomic_t scsi_block_reqs_cnt; -- 2.37.4

2 years, 7 months

7
11
0 0

[PATCH] usb: cdns3: remove fetched trb from cache before dequeuing

by Pawel Laszczak

After doorbell DMA fetches the TRB. If during dequeuing request driver changes NORMAL TRB to LINK TRB but doesn't delete it from controller cache then controller will handle cached TRB and packet can be lost. The example scenario for this issue looks like: 1. queue request - set doorbell 2. dequeue request 3. send OUT data packet from host 4. Device will accept this packet which is unexpected 5. queue new request - set doorbell 6. Device lost the expected packet. By setting DFLUSH controller clears DRDY bit and stop DMA transfer. Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") cc: <stable(a)vger.kernel.org> Signed-off-by: Pawel Laszczak <pawell(a)cadence.com> --- drivers/usb/cdns3/cdns3-gadget.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/drivers/usb/cdns3/cdns3-gadget.c b/drivers/usb/cdns3/cdns3-gadget.c index 5adcb349718c..ccfaebca6faa 100644 --- a/drivers/usb/cdns3/cdns3-gadget.c +++ b/drivers/usb/cdns3/cdns3-gadget.c @@ -2614,6 +2614,7 @@ int cdns3_gadget_ep_dequeue(struct usb_ep *ep, u8 req_on_hw_ring = 0; unsigned long flags; int ret = 0; + int val; if (!ep || !request || !ep->desc) return -EINVAL; @@ -2649,6 +2650,13 @@ int cdns3_gadget_ep_dequeue(struct usb_ep *ep, /* Update ring only if removed request is on pending_req_list list */ if (req_on_hw_ring && link_trb) { + /* Stop DMA */ + writel(EP_CMD_DFLUSH, &priv_dev->regs->ep_cmd); + + /* wait for DFLUSH cleared */ + readl_poll_timeout_atomic(&priv_dev->regs->ep_cmd, val, + !(val & EP_CMD_DFLUSH), 1, 1000); + link_trb->buffer = cpu_to_le32(TRB_BUFFER(priv_ep->trb_pool_dma + ((priv_req->end_trb + 1) * TRB_SIZE))); link_trb->control = cpu_to_le32((le32_to_cpu(link_trb->control) & TRB_CYCLE) | @@ -2660,6 +2668,10 @@ int cdns3_gadget_ep_dequeue(struct usb_ep *ep, cdns3_gadget_giveback(priv_ep, priv_req, -ECONNRESET); + req = cdns3_next_request(&priv_ep->pending_req_list); + if (req) + cdns3_rearm_transfer(priv_ep, 1); + not_found: spin_unlock_irqrestore(&priv_dev->lock, flags); return ret; -- 2.25.1

2 years, 7 months

3
7
0 0

[PATCH 5.15 000/230] 5.15.54-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.15.54 release. There are 230 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 13 Jul 2022 09:05:28 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.54-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.15.54-rc1 Hangbin Liu <liuhangbin(a)gmail.com> selftests/net: fix section name when using xdp_dummy.o Dave Jiang <dave.jiang(a)intel.com> dmaengine: idxd: force wq context cleanup on device disable path Miaoqian Lin <linmq006(a)gmail.com> dmaengine: ti: Add missing put_device in ti_dra7_xbar_route_allocate Caleb Connolly <caleb.connolly(a)linaro.org> dmaengine: qcom: bam_dma: fix runtime PM underflow Miaoqian Lin <linmq006(a)gmail.com> dmaengine: ti: Fix refcount leak in ti_dra7_xbar_route_allocate Michael Walle <michael(a)walle.cc> dmaengine: at_xdma: handle errors of at_xdmac_alloc_desc() correctly Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> dmaengine: lgm: Fix an error handling path in intel_ldma_probe() Dmitry Osipenko <dmitry.osipenko(a)collabora.com> dmaengine: pl330: Fix lockdep warning about non-static key Linus Torvalds <torvalds(a)linux-foundation.org> ida: don't use BUG_ON() for debugging Samuel Holland <samuel(a)sholland.org> dt-bindings: dma: allwinner,sun50i-a64-dma: Fix min/max typo AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> Revert "serial: 8250_mtk: Make sure to select the right FEATURE_SEL" Naoya Horiguchi <naoya.horiguchi(a)nec.com> Revert "mm/memory-failure.c: fix race with changing page compound again" Shuah Khan <skhan(a)linuxfoundation.org> misc: rtsx_usb: set return value in rsp_buf alloc err path Shuah Khan <skhan(a)linuxfoundation.org> misc: rtsx_usb: use separate command and response buffers Shuah Khan <skhan(a)linuxfoundation.org> misc: rtsx_usb: fix use of dma mapped buffer for usb bulk transfer Peter Robinson <pbrobinson(a)gmail.com> dmaengine: imx-sdma: Allow imx8m for imx7 FW revs Satish Nagireddy <satish.nagireddy(a)getcruise.com> i2c: cadence: Unregister the clk notifier in error path Heiner Kallweit <hkallweit1(a)gmail.com> r8169: fix accessing unset transport header Vladimir Oltean <vladimir.oltean(a)nxp.com> selftests: forwarding: fix error message in learning_test Vladimir Oltean <vladimir.oltean(a)nxp.com> selftests: forwarding: fix learning_test when h1 supports IFF_UNICAST_FLT Vladimir Oltean <vladimir.oltean(a)nxp.com> selftests: forwarding: fix flood_unicast_test when h2 supports IFF_UNICAST_FLT Rick Lindsley <ricklind(a)us.ibm.com> ibmvnic: Properly dispose of all skbs during a failover. Fabrice Gasnier <fabrice.gasnier(a)foss.st.com> ARM: dts: stm32: add missing usbh clock and fix clk order on stm32mp15 Amelie Delaunay <amelie.delaunay(a)foss.st.com> ARM: dts: stm32: use usbphyc ck_usbo_48m as USBH OHCI clock on stm32mp151 Norbert Zulinski <norbertx.zulinski(a)intel.com> i40e: Fix VF's MAC Address change on VM Lukasz Cieplicki <lukaszx.cieplicki(a)intel.com> i40e: Fix dropped jumbo frames statistics Jean Delvare <jdelvare(a)suse.de> i2c: piix4: Fix a memory leak in the EFCH MMIO support Ivan Malov <ivan.malov(a)oktetlabs.ru> xsk: Clear page contiguity bit when unmapping pool Mihai Sain <mihai.sain(a)microchip.com> ARM: at91: fix soc detection for SAM9X60 SiPs Eugen Hristev <eugen.hristev(a)microchip.com> ARM: dts: at91: sama5d2_icp: fix eeprom compatibles Eugen Hristev <eugen.hristev(a)microchip.com> ARM: dts: at91: sam9x60ek: fix eeprom compatible and size Claudiu Beznea <claudiu.beznea(a)microchip.com> ARM: at91: pm: use proper compatibles for sama7g5's rtc and rtt Claudiu Beznea <claudiu.beznea(a)microchip.com> ARM: at91: pm: use proper compatibles for sam9x60's rtc and rtt Claudiu Beznea <claudiu.beznea(a)microchip.com> ARM: at91: pm: use proper compatible for sama5d2's rtc Stephan Gerhold <stephan.gerhold(a)kernkonzept.com> arm64: dts: qcom: msm8992-*: Fix vdd_lvs1_2-supply typo Andrei Lalaev <andrey.lalaev(a)gmail.com> pinctrl: sunxi: sunxi_pconf_set: use correct offset Peng Fan <peng.fan(a)nxp.com> arm64: dts: imx8mp-phyboard-pollux-rdk: correct i2c2 & mmc settings Peng Fan <peng.fan(a)nxp.com> arm64: dts: imx8mp-phyboard-pollux-rdk: correct eqos pad settings Peng Fan <peng.fan(a)nxp.com> arm64: dts: imx8mp-phyboard-pollux-rdk: correct uart pad settings Peng Fan <peng.fan(a)nxp.com> arm64: dts: imx8mp-evk: correct I2C3 pad settings Peng Fan <peng.fan(a)nxp.com> arm64: dts: imx8mp-evk: correct I2C1 pad settings Peng Fan <peng.fan(a)nxp.com> arm64: dts: imx8mp-evk: correct eqos pad settings Peng Fan <peng.fan(a)nxp.com> arm64: dts: imx8mp-evk: correct vbus pad settings Peng Fan <peng.fan(a)nxp.com> arm64: dts: imx8mp-evk: correct gpio-led pad settings Sherry Sun <sherry.sun(a)nxp.com> arm64: dts: imx8mp-evk: correct the uart2 pinctl value Peng Fan <peng.fan(a)nxp.com> arm64: dts: imx8mp-evk: correct mmc pad settings Fabio Estevam <festevam(a)denx.de> ARM: mxs_defconfig: Enable the framebuffer Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> arm64: dts: qcom: sdm845: use dispcc AHB clock for mdss node Konrad Dybcio <konrad.dybcio(a)somainline.org> arm64: dts: qcom: msm8994: Fix CPU6/7 reg values Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com> ASoC: codecs: rt700/rt711/rt711-sdca: resume bus/codec in .set_jack_detect Charles Keepax <ckeepax(a)opensource.cirrus.com> ASoC: rt711-sdca: Add endianness flag in snd_soc_component_driver Charles Keepax <ckeepax(a)opensource.cirrus.com> ASoC: rt711: Add endianness flag in snd_soc_component_driver Samuel Holland <samuel(a)sholland.org> pinctrl: sunxi: a83t: Fix NAND function name for some pins Miaoqian Lin <linmq006(a)gmail.com> ARM: meson: Fix refcount leak in meson_smp_prepare_cpus daniel.starke(a)siemens.com <daniel.starke(a)siemens.com> tty: n_gsm: fix encoding of command/response bit Tom Rix <trix(a)redhat.com> btrfs: fix use of uninitialized variable at rm device ioctl Ye Guojin <ye.guojin(a)zte.com.cn> virtio-blk: modify the value type of num in virtio_queue_rq() Dan Carpenter <dan.carpenter(a)oracle.com> btrfs: fix error pointer dereference in btrfs_ioctl_rm_dev_v2() Hui Wang <hui.wang(a)canonical.com> Revert "serial: sc16is7xx: Clear RS485 bits in the shutdown" Eric Sandeen <sandeen(a)redhat.com> xfs: remove incorrect ASSERT in xfs_rename Jimmy Assarsson <extja(a)kvaser.com> can: kvaser_usb: kvaser_usb_leaf: fix bittiming limits Jimmy Assarsson <extja(a)kvaser.com> can: kvaser_usb: kvaser_usb_leaf: fix CAN clock frequency regression Jimmy Assarsson <extja(a)kvaser.com> can: kvaser_usb: replace run-time checks with struct kvaser_usb_driver_info Christian Marangi <ansuelsmth(a)gmail.com> net: dsa: qca8k: reset cpu port on MTU change Jason A. Donenfeld <Jason(a)zx2c4.com> powerpc/powernv: delay rng platform device creation until later in boot Hsin-Yi Wang <hsinyi(a)chromium.org> video: of_display_timing.h: include errno.h Dan Williams <dan.j.williams(a)intel.com> memregion: Fix memregion_free() fallback definition Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> PM: runtime: Redefine pm_runtime_release_supplier() Helge Deller <deller(a)gmx.de> fbcon: Prevent that screen size is smaller than font size Helge Deller <deller(a)gmx.de> fbcon: Disallow setting font bigger than screen size Helge Deller <deller(a)gmx.de> fbmem: Check virtual screen sizes in fb_set_var() Guiling Deng <greens9(a)163.com> fbdev: fbmem: Fix logo center image dx issue Yian Chen <yian.chen(a)intel.com> iommu/vt-d: Fix PCI bus rescan device hot add Alexey Dobriyan <adobriyan(a)gmail.com> module: fix [e_shstrndx].sh_size=0 OOB access Shuah Khan <skhan(a)linuxfoundation.org> module: change to print useful messages from elf_validity_check() Bryan O'Donoghue <bryan.odonoghue(a)linaro.org> dt-bindings: soc: qcom: smd-rpm: Fix missing MSM8936 compatible Vladimir Lypak <vladimir.lypak(a)gmail.com> dt-bindings: soc: qcom: smd-rpm: Add compatible for MSM8953 SoC David Howells <dhowells(a)redhat.com> rxrpc: Fix locking issue Mark Rutland <mark.rutland(a)arm.com> irqchip/gic-v3: Ensure pseudo-NMIs have an ISB between ack and handling Pavel Begunkov <asml.silence(a)gmail.com> io_uring: avoid io-wq -EAGAIN looping for !IOPOLL Sean Wang <sean.wang(a)mediatek.com> Bluetooth: btmtksdio: fix use-after-free at btmtksdio_recv_event Niels Dossche <dossche.niels(a)gmail.com> Bluetooth: protect le accept and resolv lists with hdev->lock Rex-BC Chen <rex-bc.chen(a)mediatek.com> drm/mediatek: Add vblank register/unregister callback functions Chun-Kuang Hu <chunkuang.hu(a)kernel.org> drm/mediatek: Add cmdq_handle in mtk_crtc Chun-Kuang Hu <chunkuang.hu(a)kernel.org> drm/mediatek: Detect CMDQ execution timeout Chun-Kuang Hu <chunkuang.hu(a)kernel.org> drm/mediatek: Remove the pointer of struct cmdq_client Chun-Kuang Hu <chunkuang.hu(a)kernel.org> drm/mediatek: Use mailbox rx_callback instead of cmdq_task_cb Thomas Hellström <thomas.hellstrom(a)linux.intel.com> drm/i915: Fix a race between vma / object destruction and unbinding Richard Gong <richard.gong(a)amd.com> drm/amdgpu: vi: disable ASPM on Intel Alder Lake based systems Mario Limonciello <mario.limonciello(a)amd.com> drm/amd: Refactor `amdgpu_aspm` to be evaluated per device Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu: drop flags check for CHIP_IP_DISCOVERY Lukas Fink <lukas.fink1(a)gmail.com> drm/amdgpu: Fix rejecting Tahiti GPUs Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu: bind to any 0x1002 PCI diplay class device Daniel Starke <daniel.starke(a)siemens.com> tty: n_gsm: fix invalid gsmtty_write_room() result AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> serial: 8250_mtk: Make sure to select the right FEATURE_SEL Michael Ellerman <mpe(a)ellerman.id.au> powerpc/vdso: Fix incorrect CFI in gettimeofday.S Christophe Leroy <christophe.leroy(a)csgroup.eu> powerpc/vdso: Move cvdso_call macro into gettimeofday.S Christophe Leroy <christophe.leroy(a)csgroup.eu> powerpc/vdso: Remove cvdso_call_time macro Daniel Starke <daniel.starke(a)siemens.com> tty: n_gsm: fix sometimes uninitialized warning in gsm_dlci_modem_output() Daniel Starke <daniel.starke(a)siemens.com> tty: n_gsm: fix invalid use of MSC in advanced option Naoya Horiguchi <naoya.horiguchi(a)nec.com> mm/hwpoison: fix race between hugetlb free/demotion and memory_failure_hugetlb() Miaohe Lin <linmiaohe(a)huawei.com> mm/memory-failure.c: fix race with changing page compound again luofei <luofei(a)unicloud.com> mm/hwpoison: avoid the impact of hwpoison_filter() return value on mce handler Naoya Horiguchi <naoya.horiguchi(a)nec.com> mm/hwpoison: mf_mutex for soft offline and unpoison Sean Christopherson <seanjc(a)google.com> KVM: Initialize debugfs_dentry when a VM is created to avoid NULL deref Naohiro Aota <naohiro.aota(a)wdc.com> btrfs: zoned: use dedicated lock for data relocation Johannes Thumshirn <johannes.thumshirn(a)wdc.com> btrfs: zoned: encapsulate inode locking for zoned relocation Daniel Starke <daniel.starke(a)siemens.com> tty: n_gsm: fix missing update of modem controls after DLCI open Maurizio Avogadro <mavoga(a)gmail.com> ALSA: usb-audio: add mapping for MSI MAG X570S Torpedo MAX. Johannes Schickel <lordhoto(a)gmail.com> ALSA: usb-audio: add mapping for MSI MPG X570S Carbon Max Wifi. Daniel Starke <daniel.starke(a)siemens.com> tty: n_gsm: fix frame reception handling Zhenguo Zhao <Zhenguo.Zhao1(a)unisoc.com> tty: n_gsm: Save dlci address open status when config requester Zhenguo Zhao <Zhenguo.Zhao1(a)unisoc.com> tty: n_gsm: Modify CR,PF bit when config requester Oliver Upton <oupton(a)google.com> KVM: Don't create VM debugfs files outside of the VM directory tiancyin <tianci.yin(a)amd.com> drm/amd/vcn: fix an error msg on vcn 3.0 Xiaomeng Tong <xiam0nd.tong(a)gmail.com> ASoC: rt5682: fix an incorrect NULL check on list iterator Jack Yu <jack.yu(a)realtek.com> ASoC: rt5682: move clk related code to rt5682_i2c_probe Tadeusz Struk <tadeusz.struk(a)linaro.org> uapi/linux/stddef.h: Add include guards Kees Cook <keescook(a)chromium.org> stddef: Introduce DECLARE_FLEX_ARRAY() helper Paul Davey <paul.davey(a)alliedtelesis.co.nz> bus: mhi: Fix pm_state conversion to string Kees Cook <keescook(a)chromium.org> bus: mhi: core: Use correctly sized arguments for bit field Hui Wang <hui.wang(a)canonical.com> serial: sc16is7xx: Clear RS485 bits in the shutdown Nicholas Piggin <npiggin(a)gmail.com> powerpc/tm: Fix more userspace r13 corruption Nicholas Piggin <npiggin(a)gmail.com> powerpc: flexible GPR range save/restore macros Christophe Leroy <christophe.leroy(a)csgroup.eu> powerpc/32: Don't use lmw/stmw for saving/restoring non volatile regs Arun Easi <aeasi(a)marvell.com> scsi: qla2xxx: Fix loss of NVMe namespaces after driver reload test Claudio Imbrenda <imbrenda(a)linux.ibm.com> KVM: s390x: fix SCK locking Dongliang Mu <mudongliangabcd(a)gmail.com> btrfs: don't access possibly stale fs_info data in device_list_add Paolo Bonzini <pbonzini(a)redhat.com> KVM: use __vcalloc for very large allocations Paolo Bonzini <pbonzini(a)redhat.com> mm: vmalloc: introduce array allocation functions Kees Cook <keescook(a)chromium.org> Compiler Attributes: add __alloc_size() for better bounds checking Tudor Ambarus <tudor.ambarus(a)microchip.com> mtd: spi-nor: Skip erase logic when SPI_NOR_NO_ERASE is set Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> batman-adv: Use netif_rx(). Haibo Chen <haibo.chen(a)nxp.com> iio: accel: mma8452: use the correct logic to get mma8452_data Palmer Dabbelt <palmer(a)rivosinc.com> riscv/mm: Add XIP_FIXUP for riscv_pfn_base Chuck Lever <chuck.lever(a)oracle.com> NFSD: COMMIT operations must not return NFS?ERR_INVAL Chuck Lever <chuck.lever(a)oracle.com> NFSD: De-duplicate net_generic(nf->nf_net, nfsd_net_id) CHANDAN VURDIGERE NATARAJ <chandan.vurdigerenataraj(a)amd.com> drm/amd/display: Fix by adding FPU protection for dcn30_internal_validate_bw Michael Strauss <michael.strauss(a)amd.com> drm/amd/display: Set min dcfclk if pipe count is 0 Xiaomeng Tong <xiam0nd.tong(a)gmail.com> drbd: fix an invalid memory access caused by incorrect use of list iterator Wu Bo <wubo40(a)huawei.com> drbd: Fix double free problem in drbd_create_device Luis Chamberlain <mcgrof(a)kernel.org> drbd: add error handling support for add_disk() Qu Wenruo <wqu(a)suse.com> btrfs: remove device item and update super block in the same transaction Josef Bacik <josef(a)toxicpanda.com> btrfs: use btrfs_get_dev_args_from_path in dev removal ioctls Josef Bacik <josef(a)toxicpanda.com> btrfs: add a btrfs_get_dev_args_from_path helper Josef Bacik <josef(a)toxicpanda.com> btrfs: handle device lookup with btrfs_dev_lookup_args Eli Cohen <elic(a)nvidia.com> vdpa/mlx5: Avoid processing works if workqueue was destroyed Andreas Gruenbacher <agruenba(a)redhat.com> gfs2: Fix gfs2_file_buffered_write endless loop workaround Arun Easi <aeasi(a)marvell.com> scsi: qla2xxx: Fix crash during module load unload test Quinn Tran <qutran(a)marvell.com> scsi: qla2xxx: edif: Replace list_for_each_safe with list_for_each_entry_safe Quinn Tran <qutran(a)marvell.com> scsi: qla2xxx: Fix laggy FC remote port session recovery Manish Rangankar <mrangankar(a)marvell.com> scsi: qla2xxx: Move heartbeat handling from DPC thread to workqueue Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Use common TDP MMU zap helper for MMU notifier unmap hook Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Use yield-safe TDP MMU root iter in MMU notifier unmapping Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> clk: renesas: r9a07g044: Update multiplier and divider values for PLL2/3 Dan Williams <dan.j.williams(a)intel.com> cxl/port: Hold port reference until decoder release Lorenzo Bianconi <lorenzo(a)kernel.org> mt76: mt7921: do not always disable fw runtime-pm Sean Wang <sean.wang(a)mediatek.com> mt76: mt76_connac: fix MCU_CE_CMD_SET_ROC definition error Johan Hovold <johan(a)kernel.org> media: davinci: vpif: fix use-after-free on driver unbind Kees Cook <keescook(a)chromium.org> media: omap3isp: Use struct_group() for memcpy() region Kees Cook <keescook(a)chromium.org> stddef: Introduce struct_group() helper macro Tejun Heo <tj(a)kernel.org> block: fix rq-qos breakage from skipping rq_qos_done_bio() Jens Axboe <axboe(a)kernel.dk> block: only mark bio as tracked if it really is tracked Pavel Begunkov <asml.silence(a)gmail.com> block: use bdev_get_queue() in bio.c Jens Axboe <axboe(a)kernel.dk> io_uring: ensure that fsnotify is always called Max Gurtovoy <mgurtovoy(a)nvidia.com> virtio-blk: avoid preallocating big SGL for data Sukadev Bhattiprolu <sukadev(a)linux.ibm.com> ibmvnic: Allow queueing resets during probe Sukadev Bhattiprolu <sukadev(a)linux.ibm.com> ibmvnic: clear fop when retrying probe Sukadev Bhattiprolu <sukadev(a)linux.ibm.com> ibmvnic: init init_done_rc earlier Alexander Egorenkov <egorenar(a)linux.ibm.com> s390/setup: preserve memory at OLDMEM_BASE and OLDMEM_SIZE Alexander Gordeev <agordeev(a)linux.ibm.com> s390/setup: use physical pointers for memblock_reserve() Alexander Gordeev <agordeev(a)linux.ibm.com> s390/boot: allocate amode31 section in decompressor Florian Westphal <fw(a)strlen.de> netfilter: nft_payload: don't allow th access for fragments Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nft_payload: support for inner header matching / mangling Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: convert pktinfo->tprot_set to flags field Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: rt5682: Fix deadlock on resume Derek Fang <derek.fang(a)realtek.com> ASoC: rt5682: Re-detect the combo jack after resuming Derek Fang <derek.fang(a)realtek.com> ASoC: rt5682: Avoid the unexpected IRQ event during going to suspend Roi Dayan <roid(a)nvidia.com> net/mlx5e: TC, Reject rules with forward and drop actions Roi Dayan <roid(a)nvidia.com> net/mlx5e: TC, Reject rules with drop and modify hdr action Roi Dayan <roid(a)nvidia.com> net/mlx5e: Split actions_match_supported() into a sub function Roi Dayan <roid(a)nvidia.com> net/mlx5e: Check action fwd/drop flag exists also for nic flows Palmer Dabbelt <palmer(a)rivosinc.com> RISC-V: defconfigs: Set CONFIG_FB=y, for FB console Heinrich Schuchardt <heinrich.schuchardt(a)canonical.com> riscv: defconfig: enable DRM_NOUVEAU Hou Tao <houtao1(a)huawei.com> bpf, arm64: Use emit_addr_mov_i64() for BPF_PSEUDO_FUNC Lorenzo Bianconi <lorenzo(a)kernel.org> mt76: mt7921: fix a possible race enabling/disabling runtime-pm Lorenzo Bianconi <lorenzo(a)kernel.org> mt76: mt7921: introduce mt7921_mcu_set_beacon_filter utility routine Lorenzo Bianconi <lorenzo(a)kernel.org> mt76: mt7921: get rid of mt7921_mac_set_beacon_filter Hans de Goede <hdegoede(a)redhat.com> platform/x86: wmi: Fix driver->notify() vs ->probe() race Hans de Goede <hdegoede(a)redhat.com> platform/x86: wmi: Replace read_takes_no_args with a flags field Barnabás Pőcze <pobrn(a)protonmail.com> platform/x86: wmi: introduce helper to convert driver to WMI driver Shai Malin <smalin(a)marvell.com> qed: Improve the stack space of filter_config() Seevalamuthu Mariappan <quic_seevalam(a)quicinc.com> ath11k: add hw_param for wakeup_mhi Andrew Gabbasov <andrew_gabbasov(a)mentor.com> memory: renesas-rpc-if: Avoid unaligned bus access for HyperFlash Sean Young <sean(a)mess.org> media: ir_toy: prevent device from hanging during transmit Lukas Wunner <lukas(a)wunner.de> PCI: pciehp: Ignore Link Down/Up caused by error-induced Hot Reset Lukas Wunner <lukas(a)wunner.de> PCI/portdrv: Rename pm_iter() to pcie_port_device_iter() Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915: Replace the unconditional clflush with drm_clflush_virt_range() Thomas Hellström <thomas.hellstrom(a)linux.intel.com> drm/i915/gt: Register the migrate contexts with their engines Matthew Brost <matthew.brost(a)intel.com> drm/i915: Disable bonding on gen12+ platforms Filipe Manana <fdmanana(a)suse.com> btrfs: fix deadlock between chunk allocation and chunk btree modifications Michel Dänzer <mdaenzer(a)redhat.com> dma-buf/poll: Get a file reference for outstanding fence callbacks Hans de Goede <hdegoede(a)redhat.com> Input: goodix - try not to touch the reset-pin on x86/ACPI devices Hans de Goede <hdegoede(a)redhat.com> Input: goodix - refactor reset handling Hans de Goede <hdegoede(a)redhat.com> Input: goodix - add a goodix.h header file Hans de Goede <hdegoede(a)redhat.com> Input: goodix - change goodix_i2c_write() len parameter type to int Tang Bin <tangbin(a)cmss.chinamobile.com> Input: cpcap-pwrbutton - handle errors from platform_get_irq() Filipe Manana <fdmanana(a)suse.com> btrfs: fix warning when freeing leaf after subvolume creation failure Filipe Manana <fdmanana(a)suse.com> btrfs: fix invalid delayed ref after subvolume creation failure Nikolay Borisov <nborisov(a)suse.com> btrfs: add additional parameters to btrfs_init_tree_ref/btrfs_init_data_ref Nikolay Borisov <nborisov(a)suse.com> btrfs: rename btrfs_alloc_chunk to btrfs_create_chunk Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: stricter validation of element data Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nft_set_pipapo: release elements in clone from abort path Duoming Zhou <duoming(a)zju.edu.cn> net: rose: fix UAF bug caused by rose_t0timer_expiry Oliver Neukum <oneukum(a)suse.com> usbnet: fix memory leak in error case Daniel Borkmann <daniel(a)iogearbox.net> bpf: Fix insufficient bounds propagation from adjust_scalar_min_max_vals Daniel Borkmann <daniel(a)iogearbox.net> bpf: Fix incorrect verifier simulation around jmp32's jeq/jne Thomas Kopp <thomas.kopp(a)microchip.com> can: mcp251xfd: mcp251xfd_regmap_crc_read(): update workaround broken CRC on TBC register Thomas Kopp <thomas.kopp(a)microchip.com> can: mcp251xfd: mcp251xfd_regmap_crc_read(): improve workaround handling for mcp2517fd Marc Kleine-Budde <mkl(a)pengutronix.de> can: m_can: m_can_{read_fifo,echo_tx_event}(): shift timestamp to full 32 bits Marc Kleine-Budde <mkl(a)pengutronix.de> can: m_can: m_can_chip_config(): actually enable internal timestamping Rhett Aultman <rhett.aultman(a)samsara.com> can: gs_usb: gs_usb_open/close(): fix memory leak Liang He <windhl(a)126.com> can: grcan: grcan_probe(): remove extra of_node_get() Oliver Hartkopp <socketcan(a)hartkopp.net> can: bcm: use call_rcu() instead of costly synchronize_rcu() Takashi Iwai <tiwai(a)suse.de> ALSA: cs46xx: Fix missing snd_card_free() call at probe error Tim Crawford <tcrawford(a)system76.com> ALSA: hda/realtek: Add quirk for Clevo L140PU Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Workarounds for Behringer UMC 204/404 HD Po-Hsu Lin <po-hsu.lin(a)canonical.com> Revert "selftests/bpf: Add test for bpf_timer overwriting crash" Liu Shixin <liushixin2(a)huawei.com> mm/filemap: fix UAF in find_lock_entries Jann Horn <jannh(a)google.com> mm/slub: add missing TID updates on slab deactivation ------------- Diffstat: .../bindings/dma/allwinner,sun50i-a64-dma.yaml | 2 +- .../devicetree/bindings/soc/qcom/qcom,smd-rpm.yaml | 3 + MAINTAINERS | 3 +- Makefile | 19 +- arch/arm/boot/dts/at91-sam9x60ek.dts | 3 +- arch/arm/boot/dts/at91-sama5d2_icp.dts | 6 +- arch/arm/boot/dts/stm32mp151.dtsi | 4 +- arch/arm/configs/mxs_defconfig | 1 + arch/arm/mach-at91/pm.c | 10 +- arch/arm/mach-meson/platsmp.c | 2 + arch/arm64/boot/dts/freescale/imx8mp-evk.dts | 54 ++-- .../dts/freescale/imx8mp-phyboard-pollux-rdk.dts | 48 ++-- .../boot/dts/qcom/msm8992-bullhead-rev-101.dts | 2 +- arch/arm64/boot/dts/qcom/msm8992-xiaomi-libra.dts | 2 +- arch/arm64/boot/dts/qcom/msm8994.dtsi | 4 +- arch/arm64/boot/dts/qcom/sdm845.dtsi | 2 +- arch/arm64/net/bpf_jit_comp.c | 5 +- arch/powerpc/boot/crt0.S | 31 +-- arch/powerpc/crypto/md5-asm.S | 10 +- arch/powerpc/crypto/sha1-powerpc-asm.S | 6 +- arch/powerpc/include/asm/ppc_asm.h | 43 +-- arch/powerpc/include/asm/vdso/gettimeofday.h | 69 +---- arch/powerpc/kernel/entry_32.S | 23 +- arch/powerpc/kernel/exceptions-64e.S | 14 +- arch/powerpc/kernel/exceptions-64s.S | 6 +- arch/powerpc/kernel/head_32.h | 3 +- arch/powerpc/kernel/head_booke.h | 3 +- arch/powerpc/kernel/interrupt_64.S | 34 +-- arch/powerpc/kernel/optprobes_head.S | 4 +- arch/powerpc/kernel/tm.S | 38 +-- arch/powerpc/kernel/trace/ftrace_64_mprofile.S | 15 +- arch/powerpc/kernel/vdso32/gettimeofday.S | 51 +++- arch/powerpc/kvm/book3s_hv_rmhandlers.S | 5 +- arch/powerpc/kvm/book3s_hv_uvmem.c | 2 +- arch/powerpc/lib/test_emulate_step_exec_instr.S | 8 +- arch/powerpc/platforms/powernv/rng.c | 16 +- arch/riscv/configs/defconfig | 8 +- arch/riscv/configs/rv32_defconfig | 1 + arch/riscv/mm/init.c | 1 + arch/s390/boot/compressed/decompressor.h | 1 + arch/s390/boot/startup.c | 8 + arch/s390/kernel/entry.h | 1 + arch/s390/kernel/setup.c | 31 +-- arch/s390/kernel/vmlinux.lds.S | 1 + arch/s390/kvm/kvm-s390.c | 19 +- arch/s390/kvm/kvm-s390.h | 4 +- arch/s390/kvm/priv.c | 15 +- arch/x86/kernel/cpu/mce/core.c | 8 +- arch/x86/kvm/mmu/page_track.c | 4 +- arch/x86/kvm/mmu/tdp_mmu.c | 9 +- arch/x86/kvm/x86.c | 4 +- block/bio.c | 11 +- block/blk-iolatency.c | 2 +- block/blk-rq-qos.h | 23 +- drivers/base/core.c | 3 +- drivers/base/memory.c | 2 + drivers/base/power/runtime.c | 20 +- drivers/block/Kconfig | 1 + drivers/block/drbd/drbd_main.c | 8 +- drivers/block/virtio_blk.c | 158 +++++++---- drivers/bluetooth/btmtksdio.c | 3 +- drivers/bus/mhi/core/init.c | 9 +- drivers/bus/mhi/core/internal.h | 2 +- drivers/clk/renesas/r9a07g044-cpg.c | 4 +- drivers/cxl/core/bus.c | 4 + drivers/dma-buf/dma-buf.c | 19 +- drivers/dma/at_xdmac.c | 5 + drivers/dma/idxd/device.c | 5 +- drivers/dma/imx-sdma.c | 2 +- drivers/dma/lgm/lgm-dma.c | 3 +- drivers/dma/pl330.c | 2 +- drivers/dma/qcom/bam_dma.c | 39 +-- drivers/dma/ti/dma-crossbar.c | 5 + drivers/gpu/drm/amd/amdgpu/amdgpu.h | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 25 ++ drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 10 + drivers/gpu/drm/amd/amdgpu/cik.c | 2 +- drivers/gpu/drm/amd/amdgpu/nv.c | 2 +- drivers/gpu/drm/amd/amdgpu/si.c | 2 +- drivers/gpu/drm/amd/amdgpu/soc15.c | 2 +- drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/vi.c | 17 +- .../gpu/drm/amd/display/dc/dcn30/dcn30_resource.c | 2 +- .../gpu/drm/amd/display/dc/dcn30/dcn30_resource.h | 7 + .../gpu/drm/amd/display/dc/dcn31/dcn31_resource.c | 65 ++++- .../drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c | 2 +- drivers/gpu/drm/i915/gem/i915_gem_context.c | 7 + drivers/gpu/drm/i915/gem/i915_gem_object.c | 6 + drivers/gpu/drm/i915/gt/intel_context_types.h | 8 + drivers/gpu/drm/i915/gt/intel_engine_cs.c | 4 + drivers/gpu/drm/i915/gt/intel_engine_pm.c | 23 ++ drivers/gpu/drm/i915/gt/intel_engine_pm.h | 2 + drivers/gpu/drm/i915/gt/intel_engine_types.h | 7 + .../gpu/drm/i915/gt/intel_execlists_submission.c | 2 + drivers/gpu/drm/i915/gt/intel_ring_submission.c | 5 +- drivers/gpu/drm/i915/gt/mock_engine.c | 2 + drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c | 12 +- drivers/gpu/drm/mediatek/mtk_disp_drv.h | 16 +- drivers/gpu/drm/mediatek/mtk_disp_ovl.c | 22 +- drivers/gpu/drm/mediatek/mtk_disp_rdma.c | 20 +- drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 133 +++++++-- drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c | 4 + drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.h | 29 +- drivers/i2c/busses/i2c-cadence.c | 1 + drivers/i2c/busses/i2c-piix4.c | 16 +- drivers/iio/accel/mma8452.c | 4 +- drivers/input/misc/cpcap-pwrbutton.c | 6 +- drivers/input/touchscreen/goodix.c | 150 +++++----- drivers/input/touchscreen/goodix.h | 75 +++++ drivers/iommu/intel/dmar.c | 2 +- drivers/irqchip/irq-gic-v3.c | 3 + drivers/media/platform/davinci/vpif.c | 97 +++++-- drivers/media/platform/omap3isp/ispstat.c | 5 +- drivers/media/rc/ir_toy.c | 2 +- drivers/memory/renesas-rpc-if.c | 48 +++- drivers/misc/cardreader/rtsx_usb.c | 27 +- drivers/mtd/spi-nor/core.c | 3 +- drivers/net/can/grcan.c | 1 - drivers/net/can/m_can/m_can.c | 8 +- drivers/net/can/spi/mcp251xfd/mcp251xfd-regmap.c | 22 +- drivers/net/can/usb/gs_usb.c | 23 +- drivers/net/can/usb/kvaser_usb/kvaser_usb.h | 25 +- drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c | 286 ++++++++++--------- drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 4 +- drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 119 ++++---- drivers/net/dsa/qca8k.c | 23 +- drivers/net/ethernet/ibm/ibmvnic.c | 147 +++++++++- drivers/net/ethernet/ibm/ibmvnic.h | 1 + drivers/net/ethernet/intel/i40e/i40e.h | 16 ++ drivers/net/ethernet/intel/i40e/i40e_main.c | 73 +++++ drivers/net/ethernet/intel/i40e/i40e_register.h | 13 + drivers/net/ethernet/intel/i40e/i40e_type.h | 1 + drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 4 + drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 88 +++--- drivers/net/ethernet/qlogic/qed/qed_l2.c | 23 +- drivers/net/ethernet/qlogic/qede/qede_filter.c | 47 ++-- drivers/net/ethernet/realtek/r8169_main.c | 10 +- drivers/net/usb/usbnet.c | 17 +- drivers/net/wireless/ath/ath11k/core.c | 5 + drivers/net/wireless/ath/ath11k/hw.h | 1 + drivers/net/wireless/ath/ath11k/pci.c | 12 +- .../net/wireless/mediatek/mt76/mt76_connac_mac.c | 3 - .../net/wireless/mediatek/mt76/mt76_connac_mcu.h | 2 +- .../net/wireless/mediatek/mt76/mt7921/debugfs.c | 31 ++- drivers/net/wireless/mediatek/mt76/mt7921/mac.c | 28 -- drivers/net/wireless/mediatek/mt76/mt7921/main.c | 33 +-- drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 47 ++-- drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h | 11 +- drivers/pci/hotplug/pciehp.h | 2 + drivers/pci/hotplug/pciehp_core.c | 2 + drivers/pci/hotplug/pciehp_hpc.c | 26 ++ drivers/pci/pcie/portdrv.h | 3 + drivers/pci/pcie/portdrv_core.c | 20 +- drivers/pci/pcie/portdrv_pci.c | 3 + drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c | 10 +- drivers/pinctrl/sunxi/pinctrl-sunxi.c | 2 + drivers/platform/x86/wmi.c | 39 +-- drivers/scsi/qla2xxx/qla_def.h | 5 +- drivers/scsi/qla2xxx/qla_edif.c | 39 +-- drivers/scsi/qla2xxx/qla_edif.h | 1 - drivers/scsi/qla2xxx/qla_init.c | 2 + drivers/scsi/qla2xxx/qla_nvme.c | 27 +- drivers/scsi/qla2xxx/qla_os.c | 102 ++++--- drivers/soc/atmel/soc.c | 12 +- drivers/tty/n_gsm.c | 263 ++++++++++++++--- drivers/vdpa/mlx5/net/mlx5_vnet.c | 7 +- drivers/video/fbdev/core/fbcon.c | 33 +++ drivers/video/fbdev/core/fbmem.c | 16 +- fs/btrfs/block-group.c | 152 ++++++---- fs/btrfs/block-group.h | 2 + fs/btrfs/ctree.c | 17 +- fs/btrfs/ctree.h | 8 +- fs/btrfs/delayed-ref.h | 5 +- fs/btrfs/dev-replace.c | 16 +- fs/btrfs/disk-io.c | 1 + fs/btrfs/extent-tree.c | 28 +- fs/btrfs/extent_io.c | 8 +- fs/btrfs/file.c | 13 +- fs/btrfs/free-space-tree.c | 4 +- fs/btrfs/inode.c | 3 +- fs/btrfs/ioctl.c | 96 ++++--- fs/btrfs/qgroup.c | 3 +- fs/btrfs/relocation.c | 25 +- fs/btrfs/scrub.c | 6 +- fs/btrfs/tree-log.c | 2 +- fs/btrfs/volumes.c | 310 +++++++++++++-------- fs/btrfs/volumes.h | 28 +- fs/btrfs/zoned.c | 2 +- fs/btrfs/zoned.h | 17 ++ fs/gfs2/file.c | 1 + fs/io_uring.c | 10 +- fs/nfsd/nfs3proc.c | 6 - fs/nfsd/vfs.c | 64 +++-- fs/nfsd/vfs.h | 4 +- fs/seq_file.c | 32 +++ fs/xfs/xfs_inode.c | 1 - include/linux/blk_types.h | 3 +- include/linux/compiler-gcc.h | 8 + include/linux/compiler_attributes.h | 10 + include/linux/compiler_types.h | 12 + include/linux/fbcon.h | 4 + include/linux/hugetlb.h | 6 + include/linux/list.h | 10 + include/linux/memregion.h | 2 +- include/linux/mm.h | 8 + include/linux/pm_runtime.h | 5 +- include/linux/qed/qed_eth_if.h | 21 +- include/linux/rtsx_usb.h | 2 - include/linux/seq_file.h | 4 + include/linux/stddef.h | 61 ++++ include/linux/vmalloc.h | 5 + include/net/netfilter/nf_tables.h | 10 +- include/net/netfilter/nf_tables_ipv4.h | 7 +- include/net/netfilter/nf_tables_ipv6.h | 6 +- include/uapi/linux/netfilter/nf_tables.h | 2 + include/uapi/linux/omap3isp.h | 21 +- include/uapi/linux/stddef.h | 41 +++ include/video/of_display_timing.h | 2 + kernel/bpf/verifier.c | 113 ++++---- kernel/module.c | 79 ++++-- lib/idr.c | 3 +- mm/filemap.c | 12 +- mm/hugetlb.c | 10 + mm/hwpoison-inject.c | 3 +- mm/madvise.c | 2 + mm/memory-failure.c | 205 ++++++++------ mm/slub.c | 2 + mm/util.c | 50 ++++ net/batman-adv/bridge_loop_avoidance.c | 2 +- net/bluetooth/hci_event.c | 12 + net/can/bcm.c | 18 +- net/netfilter/nf_tables_api.c | 9 +- net/netfilter/nf_tables_core.c | 2 +- net/netfilter/nf_tables_trace.c | 4 +- net/netfilter/nft_exthdr.c | 2 +- net/netfilter/nft_meta.c | 2 +- net/netfilter/nft_payload.c | 63 ++++- net/netfilter/nft_set_pipapo.c | 48 +++- net/rose/rose_route.c | 4 +- net/rxrpc/ar-internal.h | 2 +- net/rxrpc/call_accept.c | 6 +- net/rxrpc/call_object.c | 18 +- net/rxrpc/net_ns.c | 2 +- net/rxrpc/proc.c | 10 +- net/xdp/xsk_buff_pool.c | 1 + scripts/checkpatch.pl | 3 +- scripts/kernel-doc | 9 + sound/pci/cs46xx/cs46xx.c | 22 +- sound/pci/hda/patch_realtek.c | 1 + sound/soc/codecs/rt5682-i2c.c | 36 ++- sound/soc/codecs/rt5682.c | 125 ++++----- sound/soc/codecs/rt5682.h | 4 +- sound/soc/codecs/rt700.c | 16 +- sound/soc/codecs/rt711-sdca.c | 27 +- sound/soc/codecs/rt711.c | 25 +- sound/usb/mixer_maps.c | 16 ++ sound/usb/quirks.c | 4 + .../testing/selftests/bpf/prog_tests/timer_crash.c | 32 --- tools/testing/selftests/bpf/progs/timer_crash.c | 54 ---- tools/testing/selftests/net/forwarding/lib.sh | 6 +- tools/testing/selftests/net/udpgro.sh | 2 +- tools/testing/selftests/net/udpgro_bench.sh | 2 +- tools/testing/selftests/net/udpgro_fwd.sh | 2 +- tools/testing/selftests/net/veth.sh | 6 +- virt/kvm/kvm_main.c | 14 +- 265 files changed, 3774 insertions(+), 2044 deletions(-)

2 years, 7 months

8
243
0 0

[PATCH] aio: fix mremap after fork null-deref

by Seth Jenkins

Commit e4a0d3e720e7 ("aio: Make it possible to remap aio ring") introduced a null-deref if mremap is called on an old aio mapping after fork as mm->ioctx_table will be set to NULL. Fixes: e4a0d3e720e7 ("aio: Make it possible to remap aio ring") Cc: stable(a)vger.kernel.org Signed-off-by: Seth Jenkins <sethjenkins(a)google.com> --- fs/aio.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/fs/aio.c b/fs/aio.c index 5b2ff20ad322..74eae7de7323 100644 --- a/fs/aio.c +++ b/fs/aio.c @@ -361,16 +361,18 @@ static int aio_ring_mremap(struct vm_area_struct *vma) spin_lock(&mm->ioctx_lock); rcu_read_lock(); table = rcu_dereference(mm->ioctx_table); - for (i = 0; i < table->nr; i++) { - struct kioctx *ctx; - - ctx = rcu_dereference(table->table[i]); - if (ctx && ctx->aio_ring_file == file) { - if (!atomic_read(&ctx->dead)) { - ctx->user_id = ctx->mmap_base = vma->vm_start; - res = 0; + if (table) { + for (i = 0; i < table->nr; i++) { + struct kioctx *ctx; + + ctx = rcu_dereference(table->table[i]); + if (ctx && ctx->aio_ring_file == file) { + if (!atomic_read(&ctx->dead)) { + ctx->user_id = ctx->mmap_base = vma->vm_start; + res = 0; + } + break; } - break; } } -- 2.38.1.431.g37b22c650d-goog

2 years, 7 months

4
7
0 0

[PATCH AUTOSEL 6.1 1/7] ASoC: SOF: Revert: "core: unregister clients and machine drivers in .shutdown"

by Sasha Levin

From: Kai Vehmanen <kai.vehmanen(a)linux.intel.com> [ Upstream commit 44fda61d2bcfb74a942df93959e083a4e8eff75f ] The unregister machine drivers call is not safe to do when kexec is used. Kexec-lite gets blocked with following backtrace: [ 84.943749] Freezing user space processes ... (elapsed 0.111 seconds) done. [ 246.784446] INFO: task kexec-lite:5123 blocked for more than 122 seconds. [ 246.819035] Call Trace: [ 246.821782] <TASK> [ 246.824186] __schedule+0x5f9/0x1263 [ 246.828231] schedule+0x87/0xc5 [ 246.831779] snd_card_disconnect_sync+0xb5/0x127 ... [ 246.889249] snd_sof_device_shutdown+0xb4/0x150 [ 246.899317] pci_device_shutdown+0x37/0x61 [ 246.903990] device_shutdown+0x14c/0x1d6 [ 246.908391] kernel_kexec+0x45/0xb9 This reverts commit 83bfc7e793b555291785136c3ae86abcdc046887. Reported-by: Ricardo Ribalda <ribalda(a)chromium.org> Cc: Ricardo Ribalda <ribalda(a)chromium.org> Signed-off-by: Kai Vehmanen <kai.vehmanen(a)linux.intel.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com> Reviewed-by: Péter Ujfalusi <peter.ujfalusi(a)linux.intel.com> Reviewed-by: Ranjani Sridharan <ranjani.sridharan(a)linux.intel.com> Link: https://lore.kernel.org/r/20221209114529.3909192-3-kai.vehmanen@linux.intel… Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- sound/soc/sof/core.c | 9 --------- 1 file changed, 9 deletions(-) diff --git a/sound/soc/sof/core.c b/sound/soc/sof/core.c index 3e6141d03770..625977a29d8a 100644 --- a/sound/soc/sof/core.c +++ b/sound/soc/sof/core.c @@ -475,19 +475,10 @@ EXPORT_SYMBOL(snd_sof_device_remove); int snd_sof_device_shutdown(struct device *dev) { struct snd_sof_dev *sdev = dev_get_drvdata(dev); - struct snd_sof_pdata *pdata = sdev->pdata; if (IS_ENABLED(CONFIG_SND_SOC_SOF_PROBE_WORK_QUEUE)) cancel_work_sync(&sdev->probe_work); - /* - * make sure clients and machine driver(s) are unregistered to force - * all userspace devices to be closed prior to the DSP shutdown sequence - */ - sof_unregister_clients(sdev); - - snd_sof_machine_unregister(sdev, pdata); - if (sdev->fw_state == SOF_FW_BOOT_COMPLETE) return snd_sof_shutdown(sdev); -- 2.35.1

2 years, 7 months

3
9
0 0

[PATCH v2] Bluetooth: hci_qca: Fix driver shutdown on closed serdev

by Krzysztof Kozlowski

The driver shutdown callback (which sends EDL_SOC_RESET to the device over serdev) should not be invoked when HCI device is not open (e.g. if hci_dev_open_sync() failed), because the serdev and its TTY are not open either. Also skip this step if device is powered off (qca_power_shutdown()). The shutdown callback causes use-after-free during system reboot with Qualcomm Atheros Bluetooth: Unable to handle kernel paging request at virtual address 0072662f67726fd7 ... CPU: 6 PID: 1 Comm: systemd-shutdow Tainted: G W 6.1.0-rt5-00325-g8a5f56bcfcca #8 Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT) Call trace: tty_driver_flush_buffer+0x4/0x30 serdev_device_write_flush+0x24/0x34 qca_serdev_shutdown+0x80/0x130 [hci_uart] device_shutdown+0x15c/0x260 kernel_restart+0x48/0xac KASAN report: BUG: KASAN: use-after-free in tty_driver_flush_buffer+0x1c/0x50 Read of size 8 at addr ffff16270c2e0018 by task systemd-shutdow/1 CPU: 7 PID: 1 Comm: systemd-shutdow Not tainted 6.1.0-next-20221220-00014-gb85aaf97fb01-dirty #28 Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT) Call trace: dump_backtrace.part.0+0xdc/0xf0 show_stack+0x18/0x30 dump_stack_lvl+0x68/0x84 print_report+0x188/0x488 kasan_report+0xa4/0xf0 __asan_load8+0x80/0xac tty_driver_flush_buffer+0x1c/0x50 ttyport_write_flush+0x34/0x44 serdev_device_write_flush+0x48/0x60 qca_serdev_shutdown+0x124/0x274 device_shutdown+0x1e8/0x350 kernel_restart+0x48/0xb0 __do_sys_reboot+0x244/0x2d0 __arm64_sys_reboot+0x54/0x70 invoke_syscall+0x60/0x190 el0_svc_common.constprop.0+0x7c/0x160 do_el0_svc+0x44/0xf0 el0_svc+0x2c/0x6c el0t_64_sync_handler+0xbc/0x140 el0t_64_sync+0x190/0x194 Fixes: 7e7bbddd029b ("Bluetooth: hci_qca: Fix qca6390 enable failure after warm reboot") Cc: <stable(a)vger.kernel.org> Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> --- Changes since v1: 1. Drop serdev patch and fix it only on BT side. 2. Update commit msg. --- drivers/bluetooth/hci_qca.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c index bb7623fe53a8..157fc4d024c1 100644 --- a/drivers/bluetooth/hci_qca.c +++ b/drivers/bluetooth/hci_qca.c @@ -2166,10 +2166,16 @@ static void qca_serdev_shutdown(struct device *dev) int timeout = msecs_to_jiffies(CMD_TRANS_TIMEOUT_MS); struct serdev_device *serdev = to_serdev_device(dev); struct qca_serdev *qcadev = serdev_device_get_drvdata(serdev); + struct hci_uart *hu = &qcadev->serdev_hu; + struct hci_dev *hdev = hu->hdev; + struct qca_data *qca = hu->priv; const u8 ibs_wake_cmd[] = { 0xFD }; const u8 edl_reset_soc_cmd[] = { 0x01, 0x00, 0xFC, 0x01, 0x05 }; if (qcadev->btsoc_type == QCA_QCA6390) { + if (test_bit(QCA_BT_OFF, &qca->flags) || !test_bit(HCI_RUNNING, &hdev->flags)) + return; + serdev_device_write_flush(serdev); ret = serdev_device_write_buf(serdev, ibs_wake_cmd, sizeof(ibs_wake_cmd)); -- 2.34.1

2 years, 7 months

2
3
0 0

[PATCH 5.10 1/2] fsl_lpuart: Don't enable interrupts too early

by Dominique Martinet

From: Indan Zupancic <Indan.Zupancic(a)mep-info.com> [ Upstream commit 401fb66a355eb0f22096cf26864324f8e63c7d78 ] If an irq is pending when devm_request_irq() is called, the irq handler will cause a NULL pointer access because initialisation is not done yet. Fixes: 9d7ee0e28da59 ("tty: serial: lpuart: avoid report NULL interrupt") Cc: stable <stable(a)vger.kernel.org> Signed-off-by: Indan Zupancic <Indan.Zupancic(a)mep-info.com> Link: https://lore.kernel.org/r/20220505114750.45423-1-Indan.Zupancic@mep-info.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> [5.10 did not have lpuart_global_reset or anything after uart_add_one_port(), so add the remove call in cleanup manually] Signed-off-by: Dominique Martinet <dominique.martinet(a)atmark-techno.com> --- This was originally intended as a prerequirement to backport the patch submitted in [1] for 5.10, but even with that part of the patch gone it makes sense as a fix on its own. [1] https://lkml.kernel.org/r/20221222114414.1886632-1-linux@rasmusvillemoes.dk drivers/tty/serial/fsl_lpuart.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c index 43aca5a2ef0f..223695947b65 100644 --- a/drivers/tty/serial/fsl_lpuart.c +++ b/drivers/tty/serial/fsl_lpuart.c @@ -2586,6 +2586,7 @@ static int lpuart_probe(struct platform_device *pdev) struct device_node *np = pdev->dev.of_node; struct lpuart_port *sport; struct resource *res; + irq_handler_t handler; int ret; sport = devm_kzalloc(&pdev->dev, sizeof(*sport), GFP_KERNEL); @@ -2658,17 +2659,12 @@ static int lpuart_probe(struct platform_device *pdev) if (lpuart_is_32(sport)) { lpuart_reg.cons = LPUART32_CONSOLE; - ret = devm_request_irq(&pdev->dev, sport->port.irq, lpuart32_int, 0, - DRIVER_NAME, sport); + handler = lpuart32_int; } else { lpuart_reg.cons = LPUART_CONSOLE; - ret = devm_request_irq(&pdev->dev, sport->port.irq, lpuart_int, 0, - DRIVER_NAME, sport); + handler = lpuart_int; } - if (ret) - goto failed_irq_request; - ret = uart_get_rs485_mode(&sport->port); if (ret) goto failed_get_rs485; @@ -2684,11 +2680,17 @@ static int lpuart_probe(struct platform_device *pdev) if (ret) goto failed_attach_port; + ret = devm_request_irq(&pdev->dev, sport->port.irq, handler, 0, + DRIVER_NAME, sport); + if (ret) + goto failed_irq_request; + return 0; +failed_irq_request: + uart_remove_one_port(&lpuart_reg, &sport->port); failed_get_rs485: failed_attach_port: -failed_irq_request: lpuart_disable_clks(sport); return ret; } -- 2.35.1

2 years, 7 months

2
2
0 0

[PATCH 5.15.y] tty: serial: fsl_lpuart: fixup error path in lpuart_probe()

by Rasmus Villemoes

When 7c7f9bc986e6 ("serial: Deassert Transmit Enable on probe in driver-specific way") got backported to 5.15.y, there known as b079d3775237, this hunk was accidentally left out. So if the "goto failed_get_rs485;" is hit, the cleanup will do uart_remove_one_port() despite uart_add_one_port() not having been called. Add the missing hunk. Fixes: b079d3775237 ("serial: Deassert Transmit Enable on probe in driver-specific way") Signed-off-by: Rasmus Villemoes <linux(a)rasmusvillemoes.dk> --- Not quite sure how to submit patches for a specific -stable series only, or if the Fixes tag is appropriate and correct. Please let me know if you'd have preferred anything different. drivers/tty/serial/fsl_lpuart.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c index 595430aedc0d..fc311df9f1c9 100644 --- a/drivers/tty/serial/fsl_lpuart.c +++ b/drivers/tty/serial/fsl_lpuart.c @@ -2784,9 +2784,9 @@ static int lpuart_probe(struct platform_device *pdev) return 0; failed_irq_request: -failed_get_rs485: uart_remove_one_port(&lpuart_reg, &sport->port); failed_attach_port: +failed_get_rs485: failed_reset: lpuart_disable_clks(sport); return ret; base-commit: fd6d66840b4269da4e90e1ea807ae3197433bc66 -- 2.37.2

2 years, 7 months

3
3
0 0

[PATCH v5 2/2] ceph: blocklist the kclient when receiving corrupted snap trace

by xiubli＠redhat.com

From: Xiubo Li <xiubli(a)redhat.com> When received corrupted snap trace we don't know what exactly has happened in MDS side. And we shouldn't continue IOs and metadatas access to MDS, which may corrupt or get incorrect contents. This patch will just block all the further IO/MDS requests immediately and then evict the kclient itself. The reason why we still need to evict the kclient just after blocking all the further IOs is that the MDS could revoke the caps faster. Cc: stable(a)vger.kernel.org URL: https://tracker.ceph.com/issues/57686 Signed-off-by: Xiubo Li <xiubli(a)redhat.com> --- fs/ceph/addr.c | 22 ++++++++++++++++++++-- fs/ceph/caps.c | 17 ++++++++++++++--- fs/ceph/file.c | 9 +++++++++ fs/ceph/mds_client.c | 28 +++++++++++++++++++++++++--- fs/ceph/snap.c | 37 +++++++++++++++++++++++++++++++++++-- fs/ceph/super.h | 1 + 6 files changed, 104 insertions(+), 10 deletions(-) diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c index da2fb2c97531..092f8d40abdc 100644 --- a/fs/ceph/addr.c +++ b/fs/ceph/addr.c @@ -305,13 +305,18 @@ static void ceph_netfs_issue_read(struct netfs_io_subrequest *subreq) struct inode *inode = rreq->inode; struct ceph_inode_info *ci = ceph_inode(inode); struct ceph_fs_client *fsc = ceph_inode_to_client(inode); - struct ceph_osd_request *req; + struct ceph_osd_request *req = NULL; struct ceph_vino vino = ceph_vino(inode); struct iov_iter iter; int err = 0; u64 len = subreq->len; bool sparse = ceph_test_mount_opt(fsc, SPARSEREAD); + if (READ_ONCE(fsc->mount_state) == CEPH_MOUNT_FENCE_IO) { + err = -EIO; + goto out; + } + if (ceph_has_inline_data(ci) && ceph_netfs_issue_op_inline(subreq)) return; @@ -559,6 +564,9 @@ static int writepage_nounlock(struct page *page, struct writeback_control *wbc) dout("writepage %p idx %lu\n", page, page->index); + if (READ_ONCE(fsc->mount_state) == CEPH_MOUNT_FENCE_IO) + return -EIO; + /* verify this is a writeable snap context */ snapc = page_snap_context(page); if (!snapc) { @@ -797,6 +805,11 @@ static int ceph_writepages_start(struct address_space *mapping, bool done = false; bool caching = ceph_is_cache_enabled(inode); + if (READ_ONCE(fsc->mount_state) == CEPH_MOUNT_FENCE_IO) { + mapping_set_error(mapping, -EIO); + return -EIO; + } + if (wbc->sync_mode == WB_SYNC_NONE && fsc->write_congested) return 0; @@ -1639,7 +1652,7 @@ int ceph_uninline_data(struct file *file) struct ceph_inode_info *ci = ceph_inode(inode); struct ceph_fs_client *fsc = ceph_inode_to_client(inode); struct ceph_osd_request *req = NULL; - struct ceph_cap_flush *prealloc_cf; + struct ceph_cap_flush *prealloc_cf = NULL; struct folio *folio = NULL; u64 inline_version = CEPH_INLINE_NONE; struct page *pages[1]; @@ -1653,6 +1666,11 @@ int ceph_uninline_data(struct file *file) dout("uninline_data %p %llx.%llx inline_version %llu\n", inode, ceph_vinop(inode), inline_version); + if (READ_ONCE(fsc->mount_state) == CEPH_MOUNT_FENCE_IO) { + err = -EIO; + goto out; + } + if (inline_version == CEPH_INLINE_NONE) return 0; diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c index 948136f81fc8..5230ab64fff0 100644 --- a/fs/ceph/caps.c +++ b/fs/ceph/caps.c @@ -4134,6 +4134,7 @@ void ceph_handle_caps(struct ceph_mds_session *session, void *p, *end; struct cap_extra_info extra_info = {}; bool queue_trunc; + bool close_sessions = false; dout("handle_caps from mds%d\n", session->s_mds); @@ -4275,9 +4276,13 @@ void ceph_handle_caps(struct ceph_mds_session *session, realm = NULL; if (snaptrace_len) { down_write(&mdsc->snap_rwsem); - ceph_update_snap_trace(mdsc, snaptrace, - snaptrace + snaptrace_len, - false, &realm); + if (ceph_update_snap_trace(mdsc, snaptrace, + snaptrace + snaptrace_len, + false, &realm)) { + up_write(&mdsc->snap_rwsem); + close_sessions = true; + goto done; + } downgrade_write(&mdsc->snap_rwsem); } else { down_read(&mdsc->snap_rwsem); @@ -4341,6 +4346,11 @@ void ceph_handle_caps(struct ceph_mds_session *session, iput(inode); out: ceph_put_string(extra_info.pool_ns); + + /* Defer closing the sessions after s_mutex lock being released */ + if (close_sessions) + ceph_mdsc_close_sessions(mdsc); + return; flush_cap_releases: @@ -4350,6 +4360,7 @@ void ceph_handle_caps(struct ceph_mds_session *session, * cap). */ ceph_flush_cap_releases(mdsc, session); + goto done; bad: diff --git a/fs/ceph/file.c b/fs/ceph/file.c index 85afcbbb5648..76a5633b3f35 100644 --- a/fs/ceph/file.c +++ b/fs/ceph/file.c @@ -976,6 +976,9 @@ static ssize_t ceph_sync_read(struct kiocb *iocb, struct iov_iter *to, dout("sync_read on file %p %llu~%u %s\n", file, off, (unsigned)len, (file->f_flags & O_DIRECT) ? "O_DIRECT" : ""); + if (READ_ONCE(fsc->mount_state) == CEPH_MOUNT_FENCE_IO) + return -EIO; + if (!len) return 0; /* @@ -1342,6 +1345,9 @@ ceph_direct_read_write(struct kiocb *iocb, struct iov_iter *iter, bool should_dirty = !write && user_backed_iter(iter); bool sparse = ceph_test_mount_opt(fsc, SPARSEREAD); + if (READ_ONCE(fsc->mount_state) == CEPH_MOUNT_FENCE_IO) + return -EIO; + if (write && ceph_snap(file_inode(file)) != CEPH_NOSNAP) return -EROFS; @@ -2078,6 +2084,9 @@ static int ceph_zero_partial_object(struct inode *inode, loff_t zero = 0; int op; + if (READ_ONCE(fsc->mount_state) == CEPH_MOUNT_FENCE_IO) + return -EIO; + if (!length) { op = offset ? CEPH_OSD_OP_DELETE : CEPH_OSD_OP_TRUNCATE; length = &zero; diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c index cbbaf334b6b8..b60812707fce 100644 --- a/fs/ceph/mds_client.c +++ b/fs/ceph/mds_client.c @@ -957,6 +957,9 @@ static struct ceph_mds_session *register_session(struct ceph_mds_client *mdsc, { struct ceph_mds_session *s; + if (READ_ONCE(mdsc->fsc->mount_state) == CEPH_MOUNT_FENCE_IO) + return ERR_PTR(-EIO); + if (mds >= mdsc->mdsmap->possible_max_rank) return ERR_PTR(-EINVAL); @@ -1632,6 +1635,9 @@ static int __open_session(struct ceph_mds_client *mdsc, int mstate; int mds = session->s_mds; + if (READ_ONCE(mdsc->fsc->mount_state) == CEPH_MOUNT_FENCE_IO) + return -EIO; + /* wait for mds to go active? */ mstate = ceph_mdsmap_get_state(mdsc->mdsmap, mds); dout("open_session to mds%d (%s)\n", mds, @@ -3205,6 +3211,11 @@ static void __do_request(struct ceph_mds_client *mdsc, err = -ETIMEDOUT; goto finish; } + if (READ_ONCE(mdsc->fsc->mount_state) == CEPH_MOUNT_FENCE_IO) { + dout("do_request metadata corrupted\n"); + err = -EIO; + goto finish; + } if (READ_ONCE(mdsc->fsc->mount_state) == CEPH_MOUNT_SHUTDOWN) { dout("do_request forced umount\n"); err = -EIO; @@ -3584,6 +3595,7 @@ static void handle_reply(struct ceph_mds_session *session, struct ceph_msg *msg) u64 tid; int err, result; int mds = session->s_mds; + bool close_sessions = false; if (msg->front.iov_len < sizeof(*head)) { pr_err("mdsc_handle_reply got corrupt (short) reply\n"); @@ -3698,10 +3710,15 @@ static void handle_reply(struct ceph_mds_session *session, struct ceph_msg *msg) realm = NULL; if (rinfo->snapblob_len) { down_write(&mdsc->snap_rwsem); - ceph_update_snap_trace(mdsc, rinfo->snapblob, + err = ceph_update_snap_trace(mdsc, rinfo->snapblob, rinfo->snapblob + rinfo->snapblob_len, le32_to_cpu(head->op) == CEPH_MDS_OP_RMSNAP, &realm); + if (err) { + up_write(&mdsc->snap_rwsem); + close_sessions = true; + goto out_err; + } downgrade_write(&mdsc->snap_rwsem); } else { down_read(&mdsc->snap_rwsem); @@ -3759,6 +3776,10 @@ static void handle_reply(struct ceph_mds_session *session, struct ceph_msg *msg) req->r_end_latency, err); out: ceph_mdsc_put_request(req); + + /* Defer closing the sessions after s_mutex lock being released */ + if (close_sessions) + ceph_mdsc_close_sessions(mdsc); return; } @@ -5358,7 +5379,7 @@ static bool done_closing_sessions(struct ceph_mds_client *mdsc, int skipped) } /* - * called after sb is ro. + * called after sb is ro or when metadata corrupted. */ void ceph_mdsc_close_sessions(struct ceph_mds_client *mdsc) { @@ -5648,7 +5669,8 @@ static void mds_peer_reset(struct ceph_connection *con) struct ceph_mds_client *mdsc = s->s_mdsc; pr_warn("mds%d closed our session\n", s->s_mds); - send_mds_reconnect(mdsc, s); + if (READ_ONCE(mdsc->fsc->mount_state) != CEPH_MOUNT_FENCE_IO) + send_mds_reconnect(mdsc, s); } static void mds_dispatch(struct ceph_connection *con, struct ceph_msg *msg) diff --git a/fs/ceph/snap.c b/fs/ceph/snap.c index c1c452afa84d..a73943e51a77 100644 --- a/fs/ceph/snap.c +++ b/fs/ceph/snap.c @@ -767,8 +767,10 @@ int ceph_update_snap_trace(struct ceph_mds_client *mdsc, struct ceph_snap_realm *realm; struct ceph_snap_realm *first_realm = NULL; struct ceph_snap_realm *realm_to_rebuild = NULL; + struct ceph_client *client = mdsc->fsc->client; int rebuild_snapcs; int err = -ENOMEM; + int ret; LIST_HEAD(dirty_realms); lockdep_assert_held_write(&mdsc->snap_rwsem); @@ -885,6 +887,27 @@ int ceph_update_snap_trace(struct ceph_mds_client *mdsc, if (first_realm) ceph_put_snap_realm(mdsc, first_realm); pr_err("%s error %d\n", __func__, err); + + /* + * When receiving a corrupted snap trace we don't know what + * exactly has happened in MDS side. And we shouldn't continue + * writing to OSD, which may corrupt the snapshot contents. + * + * Just try to blocklist this kclient and then this kclient + * must be remounted to continue after the corrupted metadata + * fixed in the MDS side. + */ + mdsc->fsc->mount_state = CEPH_MOUNT_FENCE_IO; + ret = ceph_monc_blocklist_add(&client->monc, &client->msgr.inst.addr); + if (ret) + pr_err("%s blocklist of %s failed: %d", __func__, + ceph_pr_addr(&client->msgr.inst.addr), ret); + + WARN(1, "%s:%s%s do remount to continue%s", + __func__, ret ? "" : ceph_pr_addr(&client->msgr.inst.addr), + ret ? "" : " was blocklisted,", + err == -EIO ? " after corrupted snaptrace fixed" : ""); + return err; } @@ -985,6 +1008,7 @@ void ceph_handle_snap(struct ceph_mds_client *mdsc, __le64 *split_inos = NULL, *split_realms = NULL; int i; int locked_rwsem = 0; + bool close_sessions = false; /* decode */ if (msg->front.iov_len < sizeof(*h)) @@ -1093,8 +1117,12 @@ void ceph_handle_snap(struct ceph_mds_client *mdsc, * update using the provided snap trace. if we are deleting a * snap, we can avoid queueing cap_snaps. */ - ceph_update_snap_trace(mdsc, p, e, - op == CEPH_SNAP_OP_DESTROY, NULL); + if (ceph_update_snap_trace(mdsc, p, e, + op == CEPH_SNAP_OP_DESTROY, + NULL)) { + close_sessions = true; + goto bad; + } if (op == CEPH_SNAP_OP_SPLIT) /* we took a reference when we created the realm, above */ @@ -1113,6 +1141,11 @@ void ceph_handle_snap(struct ceph_mds_client *mdsc, out: if (locked_rwsem) up_write(&mdsc->snap_rwsem); + + /* Defer closing the sessions after s_mutex lock being released */ + if (close_sessions) + ceph_mdsc_close_sessions(mdsc); + return; } diff --git a/fs/ceph/super.h b/fs/ceph/super.h index 0d5cb0983831..f59fd4b4755b 100644 --- a/fs/ceph/super.h +++ b/fs/ceph/super.h @@ -111,6 +111,7 @@ enum { CEPH_MOUNT_UNMOUNTED, CEPH_MOUNT_SHUTDOWN, CEPH_MOUNT_RECOVER, + CEPH_MOUNT_FENCE_IO, }; #define CEPH_ASYNC_CREATE_CONFLICT_BITS 8 -- 2.31.1

2 years, 7 months

4
3
0 0

[PATCH v3 1/2] x86/resctrl: Fix event counts regression in reused RMIDs

by Peter Newman

When creating a new monitoring group, the RMID allocated for it may have been used by a group which was previously removed. In this case, the hardware counters will have non-zero values which should be deducted from what is reported in the new group's counts. resctrl_arch_reset_rmid() initializes the prev_msr value for counters to 0, causing the initial count to be charged to the new group. Resurrect __rmid_read() and use it to initialize prev_msr correctly. Unlike before, __rmid_read() checks for error bits in the MSR read so that callers don't need to. Fixes: 1d81d15db39c ("x86/resctrl: Move mbm_overflow_count() into resctrl_arch_rmid_read()") Signed-off-by: Peter Newman <peternewman(a)google.com> Reviewed-by: Reinette Chatre <reinette.chatre(a)intel.com> Cc: stable(a)vger.kernel.org --- v3: - add changelog - CC stable v2: - move error bit processing into __rmid_read() v1: https://lore.kernel.org/lkml/20221207112924.3602960-1-peternewman@google.co… v2: https://lore.kernel.org/lkml/20221214160856.2164207-1-peternewman@google.co… --- arch/x86/kernel/cpu/resctrl/monitor.c | 49 ++++++++++++++++++--------- 1 file changed, 33 insertions(+), 16 deletions(-) diff --git a/arch/x86/kernel/cpu/resctrl/monitor.c b/arch/x86/kernel/cpu/resctrl/monitor.c index efe0c30d3a12..77538abeb72a 100644 --- a/arch/x86/kernel/cpu/resctrl/monitor.c +++ b/arch/x86/kernel/cpu/resctrl/monitor.c @@ -146,6 +146,30 @@ static inline struct rmid_entry *__rmid_entry(u32 rmid) return entry; } +static int __rmid_read(u32 rmid, enum resctrl_event_id eventid, u64 *val) +{ + u64 msr_val; + + /* + * As per the SDM, when IA32_QM_EVTSEL.EvtID (bits 7:0) is configured + * with a valid event code for supported resource type and the bits + * IA32_QM_EVTSEL.RMID (bits 41:32) are configured with valid RMID, + * IA32_QM_CTR.data (bits 61:0) reports the monitored data. + * IA32_QM_CTR.Error (bit 63) and IA32_QM_CTR.Unavailable (bit 62) + * are error bits. + */ + wrmsr(MSR_IA32_QM_EVTSEL, eventid, rmid); + rdmsrl(MSR_IA32_QM_CTR, msr_val); + + if (msr_val & RMID_VAL_ERROR) + return -EIO; + if (msr_val & RMID_VAL_UNAVAIL) + return -EINVAL; + + *val = msr_val; + return 0; +} + static struct arch_mbm_state *get_arch_mbm_state(struct rdt_hw_domain *hw_dom, u32 rmid, enum resctrl_event_id eventid) @@ -172,8 +196,12 @@ void resctrl_arch_reset_rmid(struct rdt_resource *r, struct rdt_domain *d, struct arch_mbm_state *am; am = get_arch_mbm_state(hw_dom, rmid, eventid); - if (am) + if (am) { memset(am, 0, sizeof(*am)); + + /* Record any initial, non-zero count value. */ + __rmid_read(rmid, eventid, &am->prev_msr); + } } static u64 mbm_overflow_count(u64 prev_msr, u64 cur_msr, unsigned int width) @@ -191,25 +219,14 @@ int resctrl_arch_rmid_read(struct rdt_resource *r, struct rdt_domain *d, struct rdt_hw_domain *hw_dom = resctrl_to_arch_dom(d); struct arch_mbm_state *am; u64 msr_val, chunks; + int ret; if (!cpumask_test_cpu(smp_processor_id(), &d->cpu_mask)) return -EINVAL; - /* - * As per the SDM, when IA32_QM_EVTSEL.EvtID (bits 7:0) is configured - * with a valid event code for supported resource type and the bits - * IA32_QM_EVTSEL.RMID (bits 41:32) are configured with valid RMID, - * IA32_QM_CTR.data (bits 61:0) reports the monitored data. - * IA32_QM_CTR.Error (bit 63) and IA32_QM_CTR.Unavailable (bit 62) - * are error bits. - */ - wrmsr(MSR_IA32_QM_EVTSEL, eventid, rmid); - rdmsrl(MSR_IA32_QM_CTR, msr_val); - - if (msr_val & RMID_VAL_ERROR) - return -EIO; - if (msr_val & RMID_VAL_UNAVAIL) - return -EINVAL; + ret = __rmid_read(rmid, eventid, &msr_val); + if (ret) + return ret; am = get_arch_mbm_state(hw_dom, rmid, eventid); if (am) { base-commit: 830b3c68c1fb1e9176028d02ef86f3cf76aa2476 -- 2.39.0.314.g84b9a713c41-goog

2 years, 7 months

3
2
0 0

[PATCH v9 02/10] rockchip-mailbox: Fix typo

by Allen Webb

A one character difference in the name supplied to MODULE_DEVICE_TABLE breaks a future patch set, so fix the typo. Cc: stable(a)vger.kernel.org Fixes: f70ed3b5dc8b ("mailbox: rockchip: Add Rockchip mailbox driver") Reported-by: kernel test robot <lkp(a)intel.com> Signed-off-by: Allen Webb <allenwebb(a)google.com> --- drivers/mailbox/rockchip-mailbox.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/mailbox/rockchip-mailbox.c b/drivers/mailbox/rockchip-mailbox.c index 979acc810f30..ca50f7f176f6 100644 --- a/drivers/mailbox/rockchip-mailbox.c +++ b/drivers/mailbox/rockchip-mailbox.c @@ -159,7 +159,7 @@ static const struct of_device_id rockchip_mbox_of_match[] = { { .compatible = "rockchip,rk3368-mailbox", .data = &rk3368_drv_data}, { }, }; -MODULE_DEVICE_TABLE(of, rockchp_mbox_of_match); +MODULE_DEVICE_TABLE(of, rockchip_mbox_of_match); static int rockchip_mbox_probe(struct platform_device *pdev) { -- 2.37.3

2 years, 7 months

4
13
0 0

[PATCH] clk: rockchip: rk3399: allow clk_cifout to force clk_cifout_src to reparent

by Quentin Schulz

From: Quentin Schulz <quentin.schulz(a)theobroma-systems.com> clk_cifout is derived from clk_cifout_src through an integer divider limited to 32. clk_cifout_src is a child of either cpll, gpll or npll without any possibility of a divider of any sort. The default clock parent is cpll. Let's allow clk_cifout to ask its parent clk_cifout_src to reparent in order to find the real closest possible rate for clk_cifout and not one derived from cpll only. Cc: stable(a)vger.kernel.org # 4.10+ Fixes: fd8bc829336a ("clk: rockchip: fix the rk3399 cifout clock") Signed-off-by: Quentin Schulz <quentin.schulz(a)theobroma-systems.com> --- clk: rockchip: rk3399: allow clk_cifout to force clk_cifout_src to reparent This used to be correct before v4.10 but commit fd8bc829336a ("clk: rockchip: fix the rk3399 cifout clock") incorrectly removed this ability while reworking it. Note: this has been tested on top of v6.0.2 only but no changes were made to this driver since. As for older stable releases, the git context seems identical and there does not seem to have been any logical change introduced since v4.10 so it should be pretty safe to apply. To: Michael Turquette <mturquette(a)baylibre.com> To: Stephen Boyd <sboyd(a)kernel.org> To: Heiko Stuebner <heiko(a)sntech.de> To: Xing Zheng <zhengxing(a)rock-chips.com> Cc: linux-clk(a)vger.kernel.org Cc: linux-arm-kernel(a)lists.infradead.org Cc: linux-rockchip(a)lists.infradead.org Cc: linux-kernel(a)vger.kernel.org --- drivers/clk/rockchip/clk-rk3399.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/clk/rockchip/clk-rk3399.c b/drivers/clk/rockchip/clk-rk3399.c index 306910a3a0d38..9ebd6c451b3db 100644 --- a/drivers/clk/rockchip/clk-rk3399.c +++ b/drivers/clk/rockchip/clk-rk3399.c @@ -1263,7 +1263,7 @@ static struct rockchip_clk_branch rk3399_clk_branches[] __initdata = { RK3399_CLKSEL_CON(56), 6, 2, MFLAGS, RK3399_CLKGATE_CON(10), 7, GFLAGS), - COMPOSITE_NOGATE(SCLK_CIF_OUT, "clk_cifout", mux_clk_cif_p, 0, + COMPOSITE_NOGATE(SCLK_CIF_OUT, "clk_cifout", mux_clk_cif_p, CLK_SET_RATE_PARENT, RK3399_CLKSEL_CON(56), 5, 1, MFLAGS, 0, 5, DFLAGS), /* gic */ --- base-commit: cc675d22e422442f6d230654a55a5fc5682ea018 change-id: 20221117-rk3399-cifout-set-rate-parent-1fbf0173ef2d Best regards, -- Quentin Schulz <quentin.schulz(a)theobroma-systems.com>

2 years, 7 months

3
2
0 0

[PATCH 5.15 000/530] 5.15.75-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.15.75 release. There are 530 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 26 Oct 2022 11:29:24 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.75-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.15.75-rc1 Rafael Mendonca <rafaelmendsr(a)gmail.com> io-wq: Fix memory leak in worker creation Martin Liska <mliska(a)suse.cz> gcov: support GCC 12.1 and newer compilers Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: intel_powerclamp: Use first online CPU as control_cpu Jerry Lee 李修賢 <jerrylee(a)qnap.com> ext4: continue to expand file system when the target size doesn't reach Nathan Chancellor <nathan(a)kernel.org> lib/Kconfig.debug: Add check for non-constant .{s,u}leb128 support to DWARF5 Masahiro Yamada <masahiroy(a)kernel.org> Kconfig.debug: add toolchain checks for DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT Masahiro Yamada <masahiroy(a)kernel.org> Kconfig.debug: simplify the dependency of DEBUG_INFO_DWARF4/5 Nathan Chancellor <nathan(a)kernel.org> drm/amd/display: Fix build breakage with CONFIG_DEBUG_FS=n Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> net/ieee802154: don't warn zero-sized raw_sendmsg() Alexander Aring <aahringo(a)redhat.com> Revert "net/ieee802154: reject zero-sized raw_sendmsg()" Randy Dunlap <rdunlap(a)infradead.org> net: ethernet: ti: davinci_mdio: fix build for mdio bitbang uses Yu Kuai <yukuai3(a)huawei.com> blk-wbt: fix that 'rwb->wc' is always set to 1 in wbt_init() Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Fix last interface check for registration Alexander Aring <aahringo(a)redhat.com> net: ieee802154: return -EINVAL for unknown addr type Liu Shixin <liushixin2(a)huawei.com> mm: hugetlb: fix UAF in hugetlb_handle_userfault Pavel Begunkov <asml.silence(a)gmail.com> io_uring/rw: fix unexpected link breakage Pavel Begunkov <asml.silence(a)gmail.com> io_uring/rw: fix error'ed retry return values Pavel Begunkov <asml.silence(a)gmail.com> io_uring/rw: fix short rw error handling Pavel Begunkov <asml.silence(a)gmail.com> io_uring: correct pinned_vm accounting Pavel Begunkov <asml.silence(a)gmail.com> io_uring/af_unix: defer registered files gc to io_uring release Adrian Hunter <adrian.hunter(a)intel.com> perf intel-pt: Fix segfault in intel_pt_print_info() with uClibc Ivan T. Ivanov <iivanov(a)suse.de> clk: bcm2835: Round UART input clock up Maxime Ripard <maxime(a)cerno.tech> clk: bcm2835: Make peripheral PLLC critical Dongliang Mu <mudongliangabcd(a)gmail.com> usb: idmouse: fix an uninit-value in idmouse_open Varun Prakash <varun(a)chelsio.com> nvmet-tcp: add bounds check on Transfer Tag Keith Busch <kbusch(a)kernel.org> nvme: copy firmware_rev on each init Jan Kara <jack(a)suse.cz> ext2: Use kvmalloc() for group descriptor array Arun Easi <aeasi(a)marvell.com> scsi: tracing: Fix compile error in trace_array calls when TRACING is disabled Xiaoke Wang <xkernel.wang(a)foxmail.com> staging: rtl8723bs: fix a potential memory leak in rtw_init_cmd_priv() Xiaoke Wang <xkernel.wang(a)foxmail.com> staging: rtl8723bs: fix potential memory leak in rtw_init_drv_sw() sunghwan jung <onenowy(a)gmail.com> Revert "usb: storage: Add quirk for Samsung Fit flash" Piyush Mehta <piyush.mehta(a)amd.com> usb: dwc3: core: Enable GUCTL1 bit 10 for fixing termination error after resume bug Alexander Stein <alexander.stein(a)ew.tq-group.com> arm64: dts: imx8mp: Add snps,gfladj-refclk-lpm-sel quirk to USB nodes Robin Guo <guoweibin(a)inspur.com> usb: musb: Fix musb_gadget.c rxstate overflow bug Jianglei Nie <niejianglei2021(a)163.com> usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info() Logan Gunthorpe <logang(a)deltatee.com> md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d Dylan Yudaken <dylany(a)fb.com> eventfd: guard wake_up in eventfd fs calls as well Hyunwoo Kim <imv4bel(a)gmail.com> HID: roccat: Fix use-after-free in roccat_read() Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com> soundwire: intel: fix error handling on dai registration issues Richard Fitzgerald <rf(a)opensource.cirrus.com> soundwire: cadence: Don't overwrite msg->buf during write commands Coly Li <colyli(a)suse.de> bcache: fix set_at_max_writeback_rate() for multiple attached devices Serge Semin <Sergey.Semin(a)baikalelectronics.ru> ata: libahci_platform: Sanity check the DT child nodes number Yu Kuai <yukuai3(a)huawei.com> blk-throttle: prevent overflow while calculating wait time Nam Cao <namcaov(a)gmail.com> staging: vt6655: fix potential memory leak Wei Yongjun <weiyongjun1(a)huawei.com> power: supply: adp5061: fix out-of-bounds read in adp5061_get_chg_type() Yicong Yang <yangyicong(a)hisilicon.com> iommu/arm-smmu-v3: Make default domain type of HiSilicon PTT device to identity Shigeru Yoshida <syoshida(a)redhat.com> nbd: Fix hung when signal interrupts nbd_start_device_ioctl() Letu Ren <fantasquex(a)gmail.com> scsi: 3w-9xxx: Avoid disabling device if failing to enable it Vaishnav Achath <vaishnav.a(a)ti.com> dmaengine: ti: k3-udma: Reset UDMA_CHAN_RT byte counters to prevent overflow Justin Chen <justinpopo6(a)gmail.com> usb: host: xhci-plat: suspend/resume clks for brcm Justin Chen <justinpopo6(a)gmail.com> usb: host: xhci-plat: suspend and resume clocks Quanyang Wang <quanyang.wang(a)windriver.com> clk: zynqmp: pll: rectify rate rounding in zynqmp_pll_round_rate Hangyu Hua <hbh25y(a)gmail.com> media: platform: fix some double free in meson-ge2d and mtk-jpeg and s5p-mfc Zheyu Ma <zheyuma97(a)gmail.com> media: cx88: Fix a null-ptr-deref bug in buffer_prepare() Ian Nam <young.kwan.nam(a)xilinx.com> clk: zynqmp: Fix stack-out-of-bounds in strncpy` Alex Sverdlin <alexander.sverdlin(a)nokia.com> ARM: 9242/1: kasan: Only map modules if CONFIG_KASAN_VMALLOC=n Maciej S. Szmigiero <maciej.szmigiero(a)oracle.com> btrfs: don't print information about space cache or tree every remount Qu Wenruo <wqu(a)suse.com> btrfs: scrub: try to fix super block errors Qu Wenruo <wqu(a)suse.com> btrfs: dump extra info if one free space cache has more bitmaps than it should Sebastian Krzyszkowiak <sebastian.krzyszkowiak(a)puri.sm> arm64: dts: imx8mq-librem5: Add bq25895 as max17055's power supply Mark Brown <broonie(a)kernel.org> kselftest/arm64: Fix validatation termination record after EXTRA_CONTEXT Alexander Stein <alexander.stein(a)ew.tq-group.com> ARM: dts: imx6sx: add missing properties for sram Alexander Stein <alexander.stein(a)ew.tq-group.com> ARM: dts: imx6sll: add missing properties for sram Alexander Stein <alexander.stein(a)ew.tq-group.com> ARM: dts: imx6sl: add missing properties for sram Alexander Stein <alexander.stein(a)ew.tq-group.com> ARM: dts: imx6qp: add missing properties for sram Alexander Stein <alexander.stein(a)ew.tq-group.com> ARM: dts: imx6dl: add missing properties for sram Alexander Stein <alexander.stein(a)ew.tq-group.com> ARM: dts: imx6q: add missing properties for sram Haibo Chen <haibo.chen(a)nxp.com> ARM: dts: imx7d-sdb: config the max pressure for tsc2046 Aric Cyr <aric.cyr(a)amd.com> drm/amd/display: Remove interface for periodic interrupt 1 Khaled Almahallawy <khaled.almahallawy(a)intel.com> drm/dp: Don't rewrite link config when setting phy test pattern Richard Acayan <mailingradian(a)gmail.com> mmc: sdhci-msm: add compatible string check for sdm670 Adrián Larumbe <adrian.larumbe(a)collabora.com> drm/meson: explicitly remove aggregate driver at module unload time Adrián Larumbe <adrian.larumbe(a)collabora.com> drm/meson: reorder driver deinit sequence to fix use-after-free bug hongao <hongao(a)uniontech.com> drm/amdgpu: fix initial connector audio value Jairaj Arava <jairaj.arava(a)intel.com> ASoC: SOF: pci: Change DMI match info to support all Chrome platforms Hans de Goede <hdegoede(a)redhat.com> platform/x86: msi-laptop: Change DMI match / alias strings to fix module autoloading Jameson Thies <jthies(a)google.com> platform/chrome: cros_ec: Notify the PM of wake events during resume Maya Matuszczyk <maccraft123mc(a)gmail.com> drm: panel-orientation-quirks: Add quirk for Anbernic Win600 Mateusz Kwiatkowski <kfyatek+publicgit(a)gmail.com> drm/vc4: vec: Fix timings for VEC modes Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Register card at the last interface Lucas Stach <l.stach(a)pengutronix.de> drm: bridge: dw_hdmi: only trigger hotplug event on link change Vivek Kasireddy <vivek.kasireddy(a)intel.com> udmabuf: Set ubuf->sg = NULL if the creation of sg table fails David Gow <davidgow(a)google.com> drm/amd/display: fix overflow on MIN_I64 definition Zeng Jingxiang <linuszeng(a)tencent.com> gpu: lontium-lt9611: Fix NULL pointer dereference in lt9611_connector_init() Liviu Dudau <liviu.dudau(a)arm.com> drm/komeda: Fix handling of atomic commits in the atomic_commit_tail hook Javier Martinez Canillas <javierm(a)redhat.com> drm: Prevent drm_copy_field() to attempt copying a NULL pointer Javier Martinez Canillas <javierm(a)redhat.com> drm: Use size_t type for len variable in drm_copy_field() Jianglei Nie <niejianglei2021(a)163.com> drm/nouveau/nouveau_bo: fix potential memory leak in nouveau_bo_alloc() Andrew Gaul <gaul(a)gaul.org> r8152: Rate limit overflow messages Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: L2CAP: Fix user-after-free Liu Jian <liujian56(a)huawei.com> net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory Jason A. Donenfeld <Jason(a)zx2c4.com> hwmon: (sht4x) do not overflow clamping operation on 32-bit platforms Daniel Golle <daniel(a)makrotopia.org> wifi: rt2x00: correctly set BBP register 86 for MT7620 Daniel Golle <daniel(a)makrotopia.org> wifi: rt2x00: set SoC wmac clock register Daniel Golle <daniel(a)makrotopia.org> wifi: rt2x00: set VGC gain for both chains of MT7620 Daniel Golle <daniel(a)makrotopia.org> wifi: rt2x00: set correct TX_SW_CFG1 MAC register for MT7620 Daniel Golle <daniel(a)makrotopia.org> wifi: rt2x00: don't run Rt5592 IQ calibration on MT7620 Ziyang Xuan <william.xuanziyang(a)huawei.com> can: bcm: check the result of can_send() in bcm_can_tx() Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Bluetooth: L2CAP: initialize delayed works at l2cap_chan_create() Sean Wang <sean.wang(a)mediatek.com> wifi: mt76: mt7921: reset msta->airtime_ac while clearing up hw value Patrick Rudolph <patrick.rudolph(a)9elements.com> regulator: core: Prevent integer underflow Kiran K <kiran.k(a)intel.com> Bluetooth: btintel: Mark Intel controller to support LE_STATES quirk Alexander Coffin <alex.coffin(a)matician.com> wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() Michal Jaron <michalx.jaron(a)intel.com> iavf: Fix race between iavf_close and iavf_reset_task Khalid Masum <khalid.masum.92(a)gmail.com> xfrm: Update ipcomp_scratches with NULL when freed Mika Westerberg <mika.westerberg(a)linux.intel.com> thunderbolt: Add back Intel Falcon Ridge end-to-end flow control workaround Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg() Jane Chu <jane.chu(a)oracle.com> x86/mce: Retrieve poison range from hardware Eric Dumazet <edumazet(a)google.com> tcp: annotate data-race around tcp_md5sig_pool_populated Mike Pattrick <mkp(a)redhat.com> openvswitch: Fix overreporting of drops in dropwatch Mike Pattrick <mkp(a)redhat.com> openvswitch: Fix double reporting of drops in dropwatch Ravi Gunasekaran <r-gunasekaran(a)ti.com> net: ethernet: ti: davinci_mdio: Add workaround for errata i2329 Jacob Keller <jacob.e.keller(a)intel.com> ice: set tx_tstamps when creating new Tx rings via ethtool Quentin Monnet <quentin(a)isovalent.com> bpftool: Clear errno after libcap's checks Wright Feng <wright.feng(a)cypress.com> wifi: brcmfmac: fix invalid address access when enabling SCAN log level Dai Ngo <dai.ngo(a)oracle.com> NFSD: fix use-after-free on source server when doing inter-server copy Anna Schumaker <Anna.Schumaker(a)Netapp.com> NFSD: Return nfserr_serverfault if splice_ok but buf->pages have data Kees Cook <keescook(a)chromium.org> x86/entry: Work around Clang __bdos() bug Mario Limonciello <mario.limonciello(a)amd.com> ACPI: x86: Add a quirk for Dell Inspiron 14 2-in-1 for StorageD3Enable Kees Cook <keescook(a)chromium.org> ARM: decompressor: Include .data.rel.ro.local Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash Chao Qin <chao.qin(a)intel.com> powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue Kees Cook <keescook(a)chromium.org> MIPS: BCM47XX: Cast memcmp() of function to (void *) Doug Smythies <dsmythies(a)telus.net> cpufreq: intel_pstate: Add Tigerlake support in no-HWP mode Hans de Goede <hdegoede(a)redhat.com> ACPI: tables: FPDT: Don't call acpi_os_map_memory() on invalid phys address Arvid Norlander <lkml(a)vorpal.se> ACPI: video: Add Toshiba Satellite/Portege Z830 quirk Zqiang <qiang1.zhang(a)intel.com> rcu-tasks: Convert RCU_LOCKDEP_WARN() to WARN_ONCE() Michal Hocko <mhocko(a)suse.com> rcu: Back off upon fill_page_cache_func() allocation failure Zqiang <qiang1.zhang(a)intel.com> rcu: Avoid triggering strict-GP irq-work when RCU is idle Alexander Aring <aahringo(a)redhat.com> fs: dlm: fix race in lowcomms Stefan Berger <stefanb(a)linux.ibm.com> selftest: tpm2: Add Client.__del__() to close /dev/tpm* handle Chao Yu <chao(a)kernel.org> f2fs: fix to account FS_CP_DATA_IO correctly Zhang Qilong <zhangqilong3(a)huawei.com> f2fs: fix race condition on setting FI_NO_EXTENT flag Shuai Xue <xueshuai(a)linux.alibaba.com> ACPI: APEI: do not add task_work to kernel thread to avoid memory leak Vincent Knecht <vincent.knecht(a)mailoo.org> thermal/drivers/qcom/tsens-v0_1: Fix MSM8939 fourth sensor hw_id Dan Carpenter <dan.carpenter(a)oracle.com> crypto: cavium - prevent integer overflow loading firmware Dan Carpenter <dan.carpenter(a)oracle.com> crypto: marvell/octeontx - prevent integer overflows Janis Schoetterl-Glausch <scgl(a)linux.ibm.com> kbuild: rpm-pkg: fix breakage when V=1 is used Masahiro Yamada <masahiroy(a)kernel.org> kbuild: remove the target in signal traps when interrupted Nico Pache <npache(a)redhat.com> tracing/osnoise: Fix possible recursive locking in stop_per_cpu_kthreads Yipeng Zou <zouyipeng(a)huawei.com> tracing: kprobe: Make gen test module work in arm and riscv Yipeng Zou <zouyipeng(a)huawei.com> tracing: kprobe: Fix kprobe event gen test module on exit Robin Murphy <robin.murphy(a)arm.com> iommu/iova: Fix module config properly Enzo Matsumiya <ematsumiya(a)suse.de> cifs: return correct error in ->calc_signature() Damian Muszynski <damian.muszynski(a)intel.com> crypto: qat - fix DMA transfer direction Peter Harliman Liem <pliem(a)maxlinear.com> crypto: inside-secure - Change swab to swab32 Koba Ko <koba.ko(a)canonical.com> crypto: ccp - Release dma channels before dmaengine unrgister Ignat Korchagin <ignat(a)cloudflare.com> crypto: akcipher - default implementation for setting a private key Dan Carpenter <dan.carpenter(a)oracle.com> iommu/omap: Fix buffer overflow in debugfs Waiman Long <longman(a)redhat.com> cgroup/cpuset: Enable update_tasks_cpumask() on top_cpuset Weili Qian <qianweili(a)huawei.com> crypto: hisilicon/qm - fix missing put dfx access Lucas Segarra Fernandez <lucas.segarra.fernandez(a)intel.com> crypto: qat - fix default value of WDT timer Kshitiz Varshney <kshitiz.varshney(a)nxp.com> hwrng: imx-rngc - Moving IRQ handler registering after imx_rngc_irq_mask_clear() Michal Koutný <mkoutny(a)suse.com> cgroup: Honor caller's cgroup NS when resolving path James Cowgill <james.cowgill(a)blaize.com> hwrng: arm-smccc-trng - fix NO_ENTROPY handling Ye Weihua <yeweihua4(a)huawei.com> crypto: hisilicon/zip - fix mismatch in get/set sgl_sge_nr Zhengchao Shao <shaozhengchao(a)huawei.com> crypto: sahara - don't sleep when in softirq Haren Myneni <haren(a)linux.ibm.com> powerpc/pseries/vas: Pass hw_cpu_id to node associativity HCALL Li Huafei <lihuafei1(a)huawei.com> powerpc/kprobes: Fix null pointer reference in arch_prepare_kprobe() Pali Rohár <pali(a)kernel.org> powerpc: Fix SPE Power ISA properties for e500v1 platforms Nicholas Piggin <npiggin(a)gmail.com> powerpc/64s: Fix GENERIC_CPU build flags for PPC970 / G5 Vitaly Kuznetsov <vkuznets(a)redhat.com> x86/hyperv: Fix 'struct hv_enlightened_vmcs' definition Rohan McLure <rmclure(a)linux.ibm.com> powerpc: Fix fallocate and fadvise64_64 compat parameter combination Zheng Yongjun <zhengyongjun3(a)huawei.com> powerpc/powernv: add missing of_node_put() in opal_export_attrs() Liang He <windhl(a)126.com> powerpc/pci_dn: Add missing of_node_put() Liang He <windhl(a)126.com> powerpc/sysdev/fsl_msi: Add missing of_node_put() Nathan Chancellor <nathan(a)kernel.org> powerpc/math_emu/efp: Include module.h Michael Ellerman <mpe(a)ellerman.id.au> powerpc/configs: Properly enable PAPR_SCM in pseries_defconfig Jack Wang <jinpu.wang(a)ionos.com> mailbox: bcm-ferxrm-mailbox: Fix error check for dma_map_sg Conor Dooley <conor.dooley(a)microchip.com> mailbox: mpfs: account for mbox offsets while sending Conor Dooley <conor.dooley(a)microchip.com> mailbox: mpfs: fix handling of the reg property Joel Stanley <joel(a)jms.id.au> clk: ast2600: BCLK comes from EPLL Miaoqian Lin <linmq006(a)gmail.com> clk: ti: dra7-atl: Fix reference leak in of_dra7_atl_clk_probe Lin Yujun <linyujun809(a)huawei.com> clk: imx: scu: fix memleak on platform_device_add() fails Stefan Wahren <stefan.wahren(a)i2se.com> clk: bcm2835: fix bcm2835_clock_rate_from_divisor declaration Serge Semin <Sergey.Semin(a)baikalelectronics.ru> clk: baikal-t1: Add SATA internal ref clock buffer Serge Semin <Sergey.Semin(a)baikalelectronics.ru> clk: baikal-t1: Add shared xGMAC ref/ptp clocks internal parent Serge Semin <Sergey.Semin(a)baikalelectronics.ru> clk: baikal-t1: Fix invalid xGMAC PTP clock divider Serge Semin <Sergey.Semin(a)baikalelectronics.ru> clk: vc5: Fix 5P49V6901 outputs disabling when enabling FOD David Collins <collinsd(a)codeaurora.org> spmi: pmic-arb: correct duplicate APID to PPID mapping logic Chunfeng Yun <chunfeng.yun(a)mediatek.com> usb: mtu3: fix failed runtime suspend in host only mode Dave Jiang <dave.jiang(a)intel.com> dmaengine: ioat: stop mod_timer from resurrecting deleted timer in __cleanup() Chen-Yu Tsai <wenst(a)chromium.org> clk: mediatek: mt8183: mfgcfg: Propagate rate changes to parent Jiasheng Jiang <jiasheng(a)iscas.ac.cn> mfd: sm501: Add check for platform_driver_register() Dan Carpenter <dan.carpenter(a)oracle.com> mfd: fsl-imx25: Fix check for platform_get_irq() errors Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> mfd: lp8788: Fix an error handling path in lp8788_irq_init() and lp8788_irq_init() Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> mfd: lp8788: Fix an error handling path in lp8788_probe() Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> mfd: fsl-imx25: Fix an error handling path in mx25_tsadc_setup_irq() Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> mfd: intel_soc_pmic: Fix an error handling path in intel_soc_pmic_i2c_probe() Jiasheng Jiang <jiasheng(a)iscas.ac.cn> fsi: core: Check error number after calling ida_simple_get Bob Pearson <rpearsonhpe(a)gmail.com> RDMA/rxe: Fix resize_finish() in rxe_queue.c Adam Skladowski <a_skl39(a)protonmail.com> clk: qcom: gcc-sm6115: Override default Alpha PLL regs Robert Marko <robimarko(a)gmail.com> clk: qcom: apss-ipq6018: mark apcs_alias0_core_clk as critical Mike Christie <michael.christie(a)oracle.com> scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername() Mike Christie <michael.christie(a)oracle.com> scsi: iscsi: Run recv path from workqueue Mike Christie <michael.christie(a)oracle.com> scsi: iscsi: Add recv workqueue helpers Mike Christie <michael.christie(a)oracle.com> scsi: iscsi: Rename iscsi_conn_queue_work() Duoming Zhou <duoming(a)zju.edu.cn> scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() Pali Rohár <pali(a)kernel.org> serial: 8250: Fix restoring termios speed after suspend Guilherme G. Piccoli <gpiccoli(a)igalia.com> firmware: google: Test spinlock on panic path to avoid lockups Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> slimbus: qcom-ngd-ctrl: allow compile testing without QCOM_RPROC_COMMON Nam Cao <namcaov(a)gmail.com> staging: vt6655: fix some erroneous memory clean-up loops Dongliang Mu <mudongliangabcd(a)gmail.com> phy: qualcomm: call clk_disable_unprepare in the error handling Sherry Sun <sherry.sun(a)nxp.com> tty: serial: fsl_lpuart: disable dma rx/tx use flags in lpuart_dma_shutdown Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> serial: 8250: Toggle IER bits on only after irq has been set up Dan Carpenter <dan.carpenter(a)oracle.com> drivers: serial: jsm: fix some leaks in probe Albert Briscoe <albertsbriscoe(a)gmail.com> usb: gadget: function: fix dangling pnp_string in f_printer.c Mario Limonciello <mario.limonciello(a)amd.com> xhci: Don't show warning for reinit on known broken suspend Daisuke Matsuda <matsuda-daisuke(a)fujitsu.com> IB: Set IOVA/LENGTH on IB_MR in core/uverbs layers Mark Zhang <markzhang(a)nvidia.com> RDMA/cm: Use SLID in the work completion as the DLID in responder side David Sloan <david.sloan(a)eideticom.com> md/raid5: Remove unnecessary bio_put() in raid5_read_one_chunk() Logan Gunthorpe <logang(a)deltatee.com> md/raid5: Ensure stripe_fill happens on non-read IO with journal Saurabh Sengar <ssengar(a)linux.microsoft.com> md: Replace snprintf with scnprintf Dan Carpenter <dan.carpenter(a)oracle.com> mtd: rawnand: meson: fix bit map use in meson_nfc_ecc_correct() Niklas Cassel <niklas.cassel(a)wdc.com> ata: fix ata_id_has_dipm() Niklas Cassel <niklas.cassel(a)wdc.com> ata: fix ata_id_has_ncq_autosense() Niklas Cassel <niklas.cassel(a)wdc.com> ata: fix ata_id_has_devslp() Niklas Cassel <niklas.cassel(a)wdc.com> ata: fix ata_id_sense_reporting_enabled() and ata_id_has_sense_reporting() Bernard Metzler <bmt(a)zurich.ibm.com> RDMA/siw: Fix QP destroy to wait for all references dropped. Bernard Metzler <bmt(a)zurich.ibm.com> RDMA/siw: Always consume all skbuf data in sk_data_ready() upcall. Bart Van Assche <bvanassche(a)acm.org> RDMA/srp: Fix srp_abort() Sindhu-Devale <sindhu.devale(a)intel.com> RDMA/irdma: Align AE id codes to correct flush code and event Pali Rohár <pali(a)kernel.org> mtd: rawnand: fsl_elbc: Fix none ECC mode Martin Blumenstingl <martin.blumenstingl(a)googlemail.com> mtd: rawnand: intel: Remove undocumented compatible string Martin Blumenstingl <martin.blumenstingl(a)googlemail.com> mtd: rawnand: intel: Read the chip-select line from the correct OF node Chunfeng Yun <chunfeng.yun(a)mediatek.com> phy: phy-mtk-tphy: fix the phy type setting issue Liang He <windhl(a)126.com> phy: amlogic: phy-meson-axg-mipi-pcie-analog: Hold reference returned by of_get_parent() William Dean <williamsukatube(a)gmail.com> mtd: devices: docg3: check the return value of devm_ioremap() in the probe Dang Huynh <danct12(a)riseup.net> clk: qcom: sm6115: Select QCOM_GDSC Jim Cromie <jim.cromie(a)gmail.com> dyndbg: drop EXPORTed dynamic_debug_exec_queries Jim Cromie <jim.cromie(a)gmail.com> dyndbg: let query-modname override actual module name Jim Cromie <jim.cromie(a)gmail.com> dyndbg: fix module.dyndbg handling Jim Cromie <jim.cromie(a)gmail.com> dyndbg: fix static_branch manipulation Jie Hai <haijie1(a)huawei.com> dmaengine: hisilicon: Add multi-thread support for a DMA channel Jie Hai <haijie1(a)huawei.com> dmaengine: hisilicon: Fix CQ head update Jie Hai <haijie1(a)huawei.com> dmaengine: hisilicon: Disable channels when unregister hisi_dma Dan Carpenter <dan.carpenter(a)oracle.com> fpga: prevent integer overflow in dfl_feature_ioctl_set_irq() Hangyu Hua <hbh25y(a)gmail.com> misc: ocxl: fix possible refcount leak in afu_ioctl() Zhu Yanjun <yanjun.zhu(a)linux.dev> RDMA/rxe: Fix the error caused by qp->sk Zhu Yanjun <yanjun.zhu(a)linux.dev> RDMA/rxe: Fix "kernel NULL pointer dereference" error Miaoqian Lin <linmq006(a)gmail.com> media: xilinx: vipp: Fix refcount leak in xvip_graph_dma_init Yunke Cao <yunkec(a)google.com> media: uvcvideo: Use entity get_cur in uvc_ctrl_set José Expósito <jose.exposito89(a)gmail.com> media: uvcvideo: Fix memory leak in uvc_gpio_parse Xu Qiang <xuqiang36(a)huawei.com> media: meson: vdec: add missing clk_disable_unprepare on error in vdec_hevc_start() Shubhrajyoti Datta <shubhrajyoti.datta(a)xilinx.com> tty: xilinx_uartps: Fix the ignore_status Liang He <windhl(a)126.com> media: exynos4-is: fimc-is: Add of_node_put() when breaking out of loop Jack Wang <jinpu.wang(a)ionos.com> HSI: omap_ssi_port: Fix dma_map_sg error check Miaoqian Lin <linmq006(a)gmail.com> HSI: omap_ssi: Fix refcount leak in ssi_probe Miaoqian Lin <linmq006(a)gmail.com> clk: tegra20: Fix refcount leak in tegra20_clock_init Miaoqian Lin <linmq006(a)gmail.com> clk: tegra: Fix refcount leak in tegra114_clock_init Miaoqian Lin <linmq006(a)gmail.com> clk: tegra: Fix refcount leak in tegra210_clock_init Liang He <windhl(a)126.com> clk: sprd: Hold reference returned by of_get_parent() Liang He <windhl(a)126.com> clk: berlin: Add of_node_put() for of_get_parent() Liang He <windhl(a)126.com> clk: qoriq: Hold reference returned by of_get_parent() Liang He <windhl(a)126.com> clk: oxnas: Hold reference returned by of_get_parent() Liang He <windhl(a)126.com> clk: meson: Hold reference returned by of_get_parent() Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> usb: common: debug: Check non-standard control requests Aharon Landau <aharonl(a)nvidia.com> RDMA/mlx5: Don't compare mkey tags in DEVX indirect mkey Jakob Hauser <jahau(a)rocketmail.com> iio: magnetometer: yas530: Change data type of hard_offsets to signed Jonathan Cameron <Jonathan.Cameron(a)huawei.com> iio: ABI: Fix wrong format of differential capacitance channel ABI. Nuno Sá <nuno.sa(a)analog.com> iio: inkern: fix return value in devm_of_iio_channel_get_by_name() Nuno Sá <nuno.sa(a)analog.com> iio: inkern: only release the device node when done with it Claudiu Beznea <claudiu.beznea(a)microchip.com> iio: adc: at91-sama5d2_adc: disable/prepare buffer on suspend/resume Claudiu Beznea <claudiu.beznea(a)microchip.com> iio: adc: at91-sama5d2_adc: lock around oversampling and sample freq Claudiu Beznea <claudiu.beznea(a)microchip.com> iio: adc: at91-sama5d2_adc: check return status for pressure and touch Claudiu Beznea <claudiu.beznea(a)microchip.com> iio: adc: at91-sama5d2_adc: fix AT91_SAMA5D2_MR_TRACKTIM_MAX Dmitry Torokhov <dmitry.torokhov(a)gmail.com> ARM: dts: exynos: fix polarity of VBUS GPIO of Origen Mark Rutland <mark.rutland(a)arm.com> arm64: ftrace: fix module PLTs with mcount Josh Triplett <josh(a)joshtriplett.org> ext4: don't run ext4lazyinit for read-only filesystems Geert Uytterhoeven <geert+renesas(a)glider.be> ARM: Drop CMDLINE_* dependency on ATAGS Dmitry Torokhov <dmitry.torokhov(a)gmail.com> ARM: dts: exynos: correct s5k6a3 reset polarity on Midas family Matt Ranostay <mranostay(a)ti.com> arm64: dts: ti: k3-j7200: fix main pinmux range Dmitry Osipenko <digetx(a)gmail.com> soc/tegra: fuse: Drop Kconfig dependency on TEGRA20_APB_DMA Randy Dunlap <rdunlap(a)infradead.org> ia64: export memory_add_physaddr_to_nid to fix cxl build error Michael Walle <michael(a)walle.cc> ARM: dts: kirkwood: lsxl: remove first ethernet port Michael Walle <michael(a)walle.cc> ARM: dts: kirkwood: lsxl: fix serial line Marek Behún <kabel(a)kernel.org> ARM: dts: turris-omnia: Fix mpp26 pin name and comment Lucas Stach <l.stach(a)pengutronix.de> ARM: dts: imx6qdl-kontron-samx6i: hook up DDC i2c bus Liang He <windhl(a)126.com> soc: qcom: smem_state: Add refcounting for the 'state->of_node' Liang He <windhl(a)126.com> soc: qcom: smsm: Fix refcount leak bugs in qcom_smsm_probe() Amir Goldstein <amir73il(a)gmail.com> locks: fix TOCTOU race when granting write lease Liang He <windhl(a)126.com> memory: of: Fix refcount leak bug in of_lpddr3_get_ddr_timings() Liang He <windhl(a)126.com> memory: of: Fix refcount leak bug in of_get_ddr_timings() Liang He <windhl(a)126.com> memory: pl353-smc: Fix refcount leak bug in pl353_smc_probe() Takashi Iwai <tiwai(a)suse.de> ALSA: hda/hdmi: Don't skip notification handling during PM operation Zhang Qilong <zhangqilong3(a)huawei.com> ASoC: mt6660: Fix PM disable depth imbalance in mt6660_i2c_probe Zhang Qilong <zhangqilong3(a)huawei.com> ASoC: wm5102: Fix PM disable depth imbalance in wm5102_probe Zhang Qilong <zhangqilong3(a)huawei.com> ASoC: wm5110: Fix PM disable depth imbalance in wm5110_probe Zhang Qilong <zhangqilong3(a)huawei.com> ASoC: wm8997: Fix PM disable depth imbalance in wm8997_probe Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> mmc: wmt-sdmmc: Fix an error handling path in wmt_mci_probe() Andreas Pape <apape(a)de.adit-jv.com> ALSA: dmaengine: increment buffer pointer atomically Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> ASoC: da7219: Fix an error handling path in da7219_register_dai_clks() Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org> ASoC: codecs: tx-macro: fix kcontrol put Rafael Mendonca <rafaelmendsr(a)gmail.com> drm/vmwgfx: Fix memory leak in vmw_mksstat_add_ioctl() Kuogee Hsieh <quic_khsieh(a)quicinc.com> drm/msm/dp: correct 1.62G link rate at dp_catalog_ctrl_config_msa() Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> drm/msm/dpu: index dpu_kms->hw_vbif using vbif_idx Liang He <windhl(a)126.com> ASoC: eureka-tlv320: Hold reference returned from of_find_xxx API Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> mmc: au1xmmc: Fix an error handling path in au1xmmc_probe() Rafael Mendonca <rafaelmendsr(a)gmail.com> drm/amdgpu: Fix memory leak in hpd_rx_irq_create_workqueue() Liang He <windhl(a)126.com> drm/omap: dss: Fix refcount leak bugs Gerd Hoffmann <kraxel(a)redhat.com> drm/bochs: fix blanking Takashi Iwai <tiwai(a)suse.de> ALSA: hda: beep: Simplify keep-power-at-enable behavior Jiasheng Jiang <jiasheng(a)iscas.ac.cn> ASoC: rsnd: Add check for rsnd_mod_power_on Zheyu Ma <zheyuma97(a)gmail.com> drm/bridge: megachips: Fix a null pointer dereference bug Yang Yingliang <yangyingliang(a)huawei.com> drm/amdgpu: add missing pci_disable_device() in amdgpu_pmops_runtime_resume() Prashant Malani <pmalani(a)chromium.org> platform/chrome: cros_ec_typec: Correct alt mode index Hans de Goede <hdegoede(a)redhat.com> platform/x86: msi-laptop: Fix resource cleanup Hans de Goede <hdegoede(a)redhat.com> platform/x86: msi-laptop: Fix old-ec check for backlight registering Martin Povišer <povik+lin(a)cutebit.org> ASoC: tas2764: Fix mute/unmute Martin Povišer <povik+lin(a)cutebit.org> ASoC: tas2764: Drop conflicting set_bias_level power setting Martin Povišer <povik+lin(a)cutebit.org> ASoC: tas2764: Allow mono streams Dan Carpenter <dan.carpenter(a)oracle.com> platform/chrome: fix memory corruption in ioctl Rustam Subkhankulov <subkhankulov(a)ispras.ru> platform/chrome: fix double-free in chromeos_laptop_prepare() Dan Carpenter <dan.carpenter(a)oracle.com> ASoC: mt6359: fix tests for platform_get_irq() failure Liang He <windhl(a)126.com> drm:pl111: Add of_node_put() when breaking out of for_each_available_child_of_node() Simon Ser <contact(a)emersion.fr> drm/dp_mst: fix drm_dp_dpcd_read return value checks Chen-Yu Tsai <wenst(a)chromium.org> drm/bridge: parade-ps8640: Fix regulator supply order Dmitry Osipenko <dmitry.osipenko(a)collabora.com> drm/virtio: Correct drm_gem_shmem_get_sg_table() error handling Maxime Ripard <maxime(a)cerno.tech> drm/mipi-dsi: Detach devices when removing the host Dan Carpenter <dan.carpenter(a)oracle.com> drm/bridge: Avoid uninitialized variable warning Alvin Šipraga <alsi(a)bang-olufsen.dk> drm: bridge: adv7511: unregister cec i2c device after cec adapter Alvin Šipraga <alsi(a)bang-olufsen.dk> drm: bridge: adv7511: fix CEC power down control register offset Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: mvpp2: fix mvpp2 debugfs leak Eric Dumazet <edumazet(a)google.com> once: add DO_ONCE_SLOW() for sleepable contexts Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> net/ieee802154: reject zero-sized raw_sendmsg() Maxim Mikityanskiy <maxtram95(a)gmail.com> net: wwan: iosm: Call mutex_init before locking it Jianglei Nie <niejianglei2021(a)163.com> bnx2x: fix potential memory leak in bnx2x_tpa_stop() Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks() Oleksandr Shamray <oleksandrs(a)nvidia.com> hwmon: (pmbus/mp2888) Fix sensors readouts for MPS Multi-phase mp2888 controller Marek Szyprowski <m.szyprowski(a)samsung.com> spi: Ensure that sg_table won't be used after being freed Neal Cardwell <ncardwell(a)google.com> tcp: fix tcp_cwnd_validate() to not forget is_cwnd_limited Xin Long <lucien.xin(a)gmail.com> sctp: handle the error returned from sctp_auth_asoc_init_active_key Duoming Zhou <duoming(a)zju.edu.cn> mISDN: fix use-after-free bugs in l1oip timer handlers Jakub Kicinski <kuba(a)kernel.org> eth: alx: take rtnl_lock on resume Junichi Uekawa <uekawa(a)chromium.org> vhost/vsock: Use kvmalloc/kvfree for larger packets. Bitterblue Smith <rtl8821cerfe2(a)gmail.com> wifi: rtl8xxxu: Fix AIFS written to REG_EDCA_*_PARAM Vincent Whitchurch <vincent.whitchurch(a)axis.com> spi: s3c64xx: Fix large transfers with DMA Phil Sutter <phil(a)nwl.cc> netfilter: nft_fib: Fix for rpath check with VRF devices Liu Jian <liujian56(a)huawei.com> xfrm: Reinject transport-mode packets through workqueue Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_core: Fix not handling link timeouts propertly Asmaa Mnebhi <asmaa(a)nvidia.com> i2c: mlxbf: support lock mechanism Liu Jian <liujian56(a)huawei.com> skmsg: Schedule psock work if the cached skb exists on the psock Zhang Qilong <zhangqilong3(a)huawei.com> spi/omap100k:Fix PM disable depth imbalance in omap1_spi100k_probe Zhang Qilong <zhangqilong3(a)huawei.com> spi: dw: Fix PM disable depth imbalance in dw_spi_bt1_probe Luciano Leão <lucianorsleao(a)gmail.com> x86/cpu: Include the header of init_ia32_feat_ctl()'s prototype Kees Cook <keescook(a)chromium.org> x86/microcode/AMD: Track patch allocation size explicitly Jesus Fernandez Manzano <jesus.manzano(a)galgus.net> wifi: ath11k: fix number of VHT beamformee spatial streams Antoine Tenart <atenart(a)kernel.org> netfilter: conntrack: revisit the gc initial rescheduling bias Antoine Tenart <atenart(a)kernel.org> netfilter: conntrack: fix the gc rescheduling delay Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Bluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failure Lee Jones <lee(a)kernel.org> bpf: Ensure correct locking around vulnerable function find_vpid() Zheng Yongjun <zhengyongjun3(a)huawei.com> net: fs_enet: Fix wrong check in do_pd_setup Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: RFCOMM: Fix possible deadlock on socket shutdown/release Howard Hsu <howard-yh.hsu(a)mediatek.com> wifi: mt76: mt7915: do not check state before configuring implicit beamform Lorenzo Bianconi <lorenzo(a)kernel.org> wifi: mt76: mt7615: add mt7615_mutex_acquire/release in mt7615_sta_set_decap_offload YN Chen <yn.chen(a)mediatek.com> wifi: mt76: sdio: fix transmitting packet hangs Bitterblue Smith <rtl8821cerfe2(a)gmail.com> wifi: rtl8xxxu: Remove copy-paste leftover in gen2_update_rate_mask Bitterblue Smith <rtl8821cerfe2(a)gmail.com> wifi: rtl8xxxu: gen2: Fix mistake in path B IQ calibration Lorenz Bauer <oss(a)lmb.io> bpf: btf: fix truncated last_member_type_id in btf_struct_resolve Neil Armstrong <narmstrong(a)baylibre.com> spi: meson-spicc: do not rely on busy flag in pow2 clk ops Bitterblue Smith <rtl8821cerfe2(a)gmail.com> wifi: rtl8xxxu: Fix skb misuse in TX queue selection Xu Qiang <xuqiang36(a)huawei.com> spi: qup: add missing clk_disable_unprepare on error in spi_qup_pm_resume_runtime() Xu Qiang <xuqiang36(a)huawei.com> spi: qup: add missing clk_disable_unprepare on error in spi_qup_resume() Ian Rogers <irogers(a)google.com> selftests/xsk: Avoid use-after-free on ctx Yang Yingliang <yangyingliang(a)huawei.com> wifi: rtw88: add missing destroy_workqueue() on error path in rtw_core_init() Dan Carpenter <dan.carpenter(a)oracle.com> wifi: rtl8xxxu: tighten bounds checking in rtl8xxxu_read_efuse() Sean Wang <sean.wang(a)mediatek.com> Bluetooth: btusb: mediatek: fix WMT failure during runtime suspend Hou Tao <houtao1(a)huawei.com> bpf: Use this_cpu_{inc|dec|inc_return} for bpf_task_storage_busy Hou Tao <houtao1(a)huawei.com> bpf: Propagate error from htab_lock_bucket() to userspace Hou Tao <houtao1(a)huawei.com> bpf: Disable preemption when increasing per-cpu map_locked Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> xsk: Fix backpressure mechanism on Tx Kohei Tarumizu <tarumizu.kohei(a)fujitsu.com> x86/resctrl: Fix to restore to original value when re-enabling hardware prefetch register Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> spi: mt7621: Fix an error message in mt7621_spi_probe() Lam Thai <lamthai(a)arista.com> bpftool: Fix a wrong type cast in btf_dumper_int Hari Chandrakanthan <quic_haric(a)quicinc.com> wifi: mac80211: allow bw change during channel switch in mesh Kumar Kartikeya Dwivedi <memxor(a)gmail.com> bpf: Fix reference state management for synchronous callbacks Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> leds: lm3601x: Don't use mutex after it was destroyed Wen Gong <quic_wgong(a)quicinc.com> wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state() Ping-Ke Shih <pkshih(a)realtek.com> wifi: rtlwifi: 8192de: correct checking of IQK reload Chuck Lever <chuck.lever(a)oracle.com> NFSD: Fix handling of oversized NFSv4 COMPOUND requests Chuck Lever <chuck.lever(a)oracle.com> NFSD: Protect against send buffer overflow in NFSv2 READDIR Chuck Lever <chuck.lever(a)oracle.com> SUNRPC: Fix svcxdr_init_encode's buflen calculation Chuck Lever <chuck.lever(a)oracle.com> SUNRPC: Fix svcxdr_init_decode's end-of-buffer calculation Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> nfsd: Fix a memory leak in an error handling path Sami Tolvanen <samitolvanen(a)google.com> objtool: Preserve special st_shndx indexes in elf_update_symbol Wang Kefeng <wangkefeng.wang(a)huawei.com> ARM: 9247/1: mm: set readonly for MT_MEMORY_RO with ARM_LPAE Wang Kefeng <wangkefeng.wang(a)huawei.com> ARM: 9244/1: dump: Fix wrong pg_level in walk_pmd() Lin Yujun <linyujun809(a)huawei.com> MIPS: SGI-IP27: Fix platform-device leak in bridge_platform_create() Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> MIPS: SGI-IP27: Free some unused memory Kees Cook <keescook(a)chromium.org> sh: machvec: Use char[] for section boundaries Xuewen Yan <xuewen.yan(a)unisoc.com> thermal: cpufreq_cooling: Check the policy first in cpufreq_cooling_register() Christian Brauner <brauner(a)kernel.org> ntfs3: rework xattr handlers and switch to POSIX ACL VFS helpers Ondrej Mosnacek <omosnace(a)redhat.com> userfaultfd: open userfaultfds with O_RDONLY Mimi Zohar <zohar(a)linux.ibm.com> ima: fix blocking of security.ima xattrs of unsupported algorithms Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> selinux: use "grep -E" instead of "egrep" Steve French <stfrench(a)microsoft.com> smb3: must initialize two ACL struct fields to zero Yunxiang Li <Yunxiang.Li(a)amd.com> drm/amd/display: Fix vblank refcount in vrr transition Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915: Fix watermark calculations for gen12+ CCS+CC modifier Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915: Fix watermark calculations for gen12+ MC CCS modifier Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915: Fix watermark calculations for gen12+ RC CCS modifier Jianglei Nie <niejianglei2021(a)163.com> drm/nouveau: fix a use-after-free in nouveau_gem_prime_import_sg_table() Lyude Paul <lyude(a)redhat.com> drm/nouveau/kms/nv140-: Disable interlacing Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> staging: greybus: audio_helper: remove unused and wrong debugfs usage Sean Christopherson <seanjc(a)google.com> KVM: VMX: Drop bits 31:16 when shoving exception error code into VMCS Sean Christopherson <seanjc(a)google.com> KVM: nVMX: Don't propagate vmcs12's PERF_GLOBAL_CTRL settings to vmcs02 Sean Christopherson <seanjc(a)google.com> KVM: nVMX: Unconditionally purge queued/injected events on nested "exit" Michal Luczaj <mhal(a)rbox.co> KVM: x86/emulator: Fix handing of POP SS to correctly set interruptibility Yu Kuai <yukuai3(a)huawei.com> blk-wbt: call rq_qos_add() after wb_normal is initialized Dmitry Osipenko <dmitry.osipenko(a)collabora.com> media: cedrus: Fix endless loop in cedrus_h265_skip_bits() Dmitry Osipenko <dmitry.osipenko(a)collabora.com> media: cedrus: Set the platform driver data earlier Ard Biesheuvel <ardb(a)kernel.org> efi: libstub: drop pointless get_memory_map() call Mario Limonciello <mario.limonciello(a)amd.com> thunderbolt: Explicitly enable lane adapter hotplug events at startup Steven Rostedt (Google) <rostedt(a)goodmis.org> tracing: Fix reading strings from synthetic events Steven Rostedt (Google) <rostedt(a)goodmis.org> tracing: Add "(fault)" name injection to kernel probes Steven Rostedt (Google) <rostedt(a)goodmis.org> tracing: Move duplicate code of trace_kprobe/eprobe.c into header Steven Rostedt (Google) <rostedt(a)goodmis.org> tracing: Add ioctl() to force ring buffer waiters to wake up Steven Rostedt (Google) <rostedt(a)goodmis.org> tracing: Wake up waiters when tracing is disabled Steven Rostedt (Google) <rostedt(a)goodmis.org> tracing: Wake up ring buffer waiters on closing of the file Waiman Long <longman(a)redhat.com> tracing: Disable interrupt or preemption before acquiring arch_spinlock_t Steven Rostedt (Google) <rostedt(a)goodmis.org> ring-buffer: Fix race between reset page and reading page Steven Rostedt (Google) <rostedt(a)goodmis.org> ring-buffer: Add ring_buffer_wake_waiters() Steven Rostedt (Google) <rostedt(a)goodmis.org> ring-buffer: Check pending waiters when doing wake ups as well Steven Rostedt (Google) <rostedt(a)goodmis.org> ring-buffer: Have the shortest_full queue be the shortest not longest Steven Rostedt (Google) <rostedt(a)goodmis.org> ring-buffer: Allow splice to read previous partially read pages Zheng Yejian <zhengyejian1(a)huawei.com> ftrace: Properly unset FTRACE_HASH_FL_MOD Rik van Riel <riel(a)surriel.com> livepatch: fix race between fork and KLP transition Ye Bin <yebin10(a)huawei.com> ext4: update 'state->fc_regions_size' after successful memory allocation Ye Bin <yebin10(a)huawei.com> ext4: fix potential memory leak in ext4_fc_record_regions() Ye Bin <yebin10(a)huawei.com> ext4: fix potential memory leak in ext4_fc_record_modified_inode() Ye Bin <yebin10(a)huawei.com> ext4: fix miss release buffer head in ext4_fc_write_inode Zhihao Cheng <chengzhihao1(a)huawei.com> ext4: fix dir corruption when ext4_dx_add_entry() fails Jinke Han <hanjinke.666(a)bytedance.com> ext4: place buffer head allocation before handle start Zhang Yi <yi.zhang(a)huawei.com> ext4: ext4_read_bh_lock() should submit IO if the buffer isn't uptodate Lukas Czerner <lczerner(a)redhat.com> ext4: don't increase iversion counter for ea_inodes Jan Kara <jack(a)suse.cz> ext4: fix check for block being out of directory size Lalith Rajendran <lalithkraj(a)google.com> ext4: make ext4_lazyinit_thread freezable Baokun Li <libaokun1(a)huawei.com> ext4: fix null-ptr-deref in ext4_write_info Jan Kara <jack(a)suse.cz> ext4: avoid crash when inline data creation follows DIO write Ye Bin <yebin10(a)huawei.com> jbd2: add miss release buffer head in fc_do_one_pass() Ye Bin <yebin10(a)huawei.com> jbd2: fix potential use-after-free in jbd2_fc_wait_bufs Ye Bin <yebin10(a)huawei.com> jbd2: fix potential buffer head reference count leak Andrew Perepechko <anserper(a)ya.ru> jbd2: wake up journal waiters in FIFO order, not LIFO Kees Cook <keescook(a)chromium.org> hardening: Remove Clang's enable flag for -ftrivial-auto-var-init=zero Kees Cook <keescook(a)chromium.org> hardening: Avoid harmless Clang option under CONFIG_INIT_STACK_ALL_ZERO Chao Yu <chao(a)kernel.org> f2fs: fix to do sanity check on summary info Chao Yu <chao(a)kernel.org> f2fs: fix to do sanity check on destination blkaddr during recovery Jaegeuk Kim <jaegeuk(a)kernel.org> f2fs: increase the limit for reserve_root Jaegeuk Kim <jaegeuk(a)kernel.org> f2fs: flush pending checkpoints when freezing super Jaegeuk Kim <jaegeuk(a)kernel.org> f2fs: complete checkpoints during remount Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> btrfs: set generation before calling btrfs_clean_tree_block in btrfs_init_new_buffer Filipe Manana <fdmanana(a)suse.com> btrfs: fix race between quota enable and quota rescan ioctl Lukas Czerner <lczerner(a)redhat.com> fs: record I_DIRTY_TIME even if inode already has I_DIRTY_INODE Mickaël Salaün <mic(a)digikod.net> ksmbd: Fix user namespace mapping Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> ksmbd: Fix wrong return value and message length check in smb2_ioctl() Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: fix endless loop when encryption for response fails Hyunwoo Kim <imv4bel(a)gmail.com> fbdev: smscufx: Fix use-after-free in ufx_ops_open() Quentin Schulz <quentin.schulz(a)theobroma-systems.com> pinctrl: rockchip: add pinmux_ops.gpio_set_direction callback Quentin Schulz <quentin.schulz(a)theobroma-systems.com> gpio: rockchip: request GPIO mux to pinctrl when setting direction Saurav Kashyap <skashyap(a)marvell.com> scsi: qedf: Populate sysfs attributes for vport Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> slimbus: qcom-ngd: cleanup in probe error path Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> slimbus: qcom-ngd: use correct error in message of pdr_add_lookup() failure Pali Rohár <pali(a)kernel.org> powerpc/boot: Explicitly disable usage of SPE instructions Zhang Rui <rui.zhang(a)intel.com> powercap: intel_rapl: Use standard Energy Unit for SPR Dram RAPL domain Chuck Lever <chuck.lever(a)oracle.com> NFSD: Protect against send buffer overflow in NFSv3 READ Chuck Lever <chuck.lever(a)oracle.com> NFSD: Protect against send buffer overflow in NFSv2 READ Chuck Lever <chuck.lever(a)oracle.com> NFSD: Protect against send buffer overflow in NFSv3 READDIR Maciej W. Rozycki <macro(a)orcam.me.uk> serial: 8250: Request full 16550A feature probing for OxSemi PCIe devices Maciej W. Rozycki <macro(a)orcam.me.uk> serial: 8250: Let drivers request full 16550A feature probing Maciej W. Rozycki <macro(a)orcam.me.uk> PCI: Sanitise firmware BAR assignments behind a PCI-PCI bridge M. Vefa Bicakci <m.v.b(a)runbox.com> xen/gntdev: Accommodate VMA splitting M. Vefa Bicakci <m.v.b(a)runbox.com> xen/gntdev: Prevent leaking grants Carlos Llamas <cmllamas(a)google.com> mm/mmap: undo ->mmap() when arch_validate_flags() fails Baolin Wang <baolin.wang(a)linux.alibaba.com> mm/damon: validate if the pmd entry is present before accessing James Morse <james.morse(a)arm.com> arm64: errata: Add Cortex-A55 to the repeat tlbi list Takashi Iwai <tiwai(a)suse.de> drm/udl: Restore display mode on resume Dmitry Osipenko <dmitry.osipenko(a)collabora.com> drm/virtio: Use appropriate atomic state in virtio_gpu_plane_cleanup_fb() Dmitry Osipenko <dmitry.osipenko(a)collabora.com> drm/virtio: Unlock reservations on virtio_gpu_object_shmem_init() error Dmitry Osipenko <dmitry.osipenko(a)collabora.com> drm/virtio: Check whether transferred 2D BO is shmem Dario Binacchi <dario.binacchi(a)amarulasolutions.com> dmaengine: mxs: use platform_driver_register Hamza Mahfooz <hamza.mahfooz(a)amd.com> Revert "drm/amdgpu: use dirty framebuffer helper" Rishabh Bhatnagar <risbhat(a)amazon.com> nvme-pci: set min_align_mask before calculating max_hw_sectors Sagi Grimberg <sagi(a)grimberg.me> nvme-multipath: fix possible hang in live ns resize with ANA access Gaosheng Cui <cuigaosheng1(a)huawei.com> nvmem: core: Fix memleak in nvmem_register() Huacai Chen <chenhuacai(a)kernel.org> UM: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK Fangrui Song <maskray(a)google.com> riscv: Pass -mno-relax only on lld < 15.0.0 Wenting Zhang <zephray(a)outlook.com> riscv: always honor the CONFIG_CMDLINE_FORCE when parsing dtb Andrew Bresticker <abrestic(a)rivosinc.com> riscv: Make VM_WRITE imply VM_READ Andrew Bresticker <abrestic(a)rivosinc.com> riscv: Allow PROT_WRITE-only mmap() Helge Deller <deller(a)gmx.de> parisc: fbdev/stifb: Align graphics memory size to 4MB Maciej W. Rozycki <macro(a)orcam.me.uk> RISC-V: Make port I/O string accessors actually work Conor Dooley <conor.dooley(a)microchip.com> riscv: topology: fix default topology reporting Conor Dooley <conor.dooley(a)microchip.com> arm64: topology: move store_cpu_topology() to shared code Linus Walleij <linus.walleij(a)linaro.org> regulator: qcom_rpm: Fix circular deferral regression Mika Westerberg <mika.westerberg(a)linux.intel.com> net: thunderbolt: Enable DMA paths only after rings are enabled Liang He <windhl(a)126.com> hwmon: (gsc-hwmon) Call of_node_get() before of_find_xxx API Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> ASoC: wcd934x: fix order of Slimbus unprepare/disable Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> ASoC: wcd9335: fix order of Slimbus unprepare/disable Patryk Duda <pdk(a)semihalf.com> platform/chrome: cros_ec_proto: Update version on GET_NEXT_EVENT failure Zhihao Cheng <chengzhihao1(a)huawei.com> quota: Check next/prev free block number after reading from quota file Andri Yngvason <andri(a)yngvason.is> HID: multitouch: Add memory barriers Alexander Aring <aahringo(a)redhat.com> fs: dlm: handle -EBUSY first in lock arg validation Alexander Aring <aahringo(a)redhat.com> fs: dlm: fix race between test_bit() and queue_work() Jarkko Nikula <jarkko.nikula(a)linux.intel.com> i2c: designware: Fix handling of real but unexpected device interrupts Wenchao Chen <wenchao.chen(a)unisoc.com> mmc: sdhci-sprd: Fix minimum clock limit Anssi Hannula <anssi.hannula(a)bitwise.fi> can: kvaser_usb_leaf: Fix CAN state after restart Anssi Hannula <anssi.hannula(a)bitwise.fi> can: kvaser_usb_leaf: Fix TX queue out of sync after restart Anssi Hannula <anssi.hannula(a)bitwise.fi> can: kvaser_usb_leaf: Fix overread with an invalid command Anssi Hannula <anssi.hannula(a)bitwise.fi> can: kvaser_usb: Fix use of uninitialized completion Jean-Francois Le Fillatre <jflf_kernel(a)gmx.com> usb: add quirks for Lenovo OneLink+ Dock Rafael Mendonca <rafaelmendsr(a)gmail.com> xhci: dbc: Fix memory leak in xhci_alloc_dbc() Eddie James <eajames(a)linux.ibm.com> iio: pressure: dps310: Reset chip after timeout Eddie James <eajames(a)linux.ibm.com> iio: pressure: dps310: Refactor startup procedure Nuno Sá <nuno.sa(a)analog.com> iio: adc: ad7923: fix channel readings for some variants Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> iio: ltc2497: Fix reading conversion results Michael Hennerich <michael.hennerich(a)analog.com> iio: dac: ad5593r: Fix i2c read protocol requirements Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> cifs: Fix the error length of VALIDATE_NEGOTIATE_INFO message Ronnie Sahlberg <lsahlber(a)redhat.com> cifs: destage dirty pages before re-reading them for cache=none Gaurav Kohli <gauravkohli(a)linux.microsoft.com> hv_netvsc: Fix race between VF offering and VF association message from host Pavel Begunkov <asml.silence(a)gmail.com> io_uring/net: don't update msg_name if not provided Tudor Ambarus <tudor.ambarus(a)microchip.com> mtd: rawnand: atmel: Unmap streaming DMA mappings Saranya Gopal <saranya.gopal(a)intel.com> ALSA: hda/realtek: Add Intel Reference SSID to support headset keys Luke D. Jones <luke(a)ljones.dev> ALSA: hda/realtek: Add quirk for ASUS GV601R laptop Luke D. Jones <luke(a)ljones.dev> ALSA: hda/realtek: Correct pin configs for ASUS G533Z Callum Osmotherly <callum.osmotherly(a)gmail.com> ALSA: hda/realtek: remove ALC289_FIXUP_DUAL_SPK for Dell 5530 Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Fix NULL dererence at error path Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Fix potential memory leaks Takashi Iwai <tiwai(a)suse.de> ALSA: rawmidi: Drop register_mutex in snd_rawmidi_free() Takashi Iwai <tiwai(a)suse.de> ALSA: oss: Fix potential deadlock at unregistration Sasha Levin <sashal(a)kernel.org> Revert "fs: check FMODE_LSEEK to control internal pipe splicing" ------------- Diffstat: Documentation/ABI/testing/sysfs-bus-iio | 2 +- Documentation/arm64/silicon-errata.rst | 2 + Documentation/filesystems/vfs.rst | 3 + Makefile | 10 +- arch/arm/Kconfig | 1 - arch/arm/boot/compressed/vmlinux.lds.S | 2 + arch/arm/boot/dts/armada-385-turris-omnia.dts | 4 +- arch/arm/boot/dts/exynos4412-midas.dtsi | 2 +- arch/arm/boot/dts/exynos4412-origen.dts | 2 +- arch/arm/boot/dts/imx6dl.dtsi | 3 + arch/arm/boot/dts/imx6q.dtsi | 3 + arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi | 6 +- arch/arm/boot/dts/imx6qp.dtsi | 6 + arch/arm/boot/dts/imx6sl.dtsi | 3 + arch/arm/boot/dts/imx6sll.dtsi | 3 + arch/arm/boot/dts/imx6sx.dtsi | 6 + arch/arm/boot/dts/imx7d-sdb.dts | 7 +- arch/arm/boot/dts/kirkwood-lsxl.dtsi | 16 +- arch/arm/mm/dump.c | 2 +- arch/arm/mm/kasan_init.c | 9 +- arch/arm/mm/mmu.c | 4 + arch/arm64/Kconfig | 17 ++ arch/arm64/boot/dts/freescale/imx8mp.dtsi | 4 +- arch/arm64/boot/dts/freescale/imx8mq-librem5.dtsi | 1 + .../boot/dts/ti/k3-j7200-common-proc-board.dts | 10 +- arch/arm64/boot/dts/ti/k3-j7200-main.dtsi | 11 +- arch/arm64/kernel/cpu_errata.c | 5 + arch/arm64/kernel/ftrace.c | 17 +- arch/arm64/kernel/topology.c | 40 ---- arch/ia64/mm/numa.c | 1 + arch/mips/bcm47xx/prom.c | 4 +- arch/mips/sgi-ip27/ip27-xtalk.c | 74 ++++-- arch/powerpc/Makefile | 2 +- arch/powerpc/boot/Makefile | 1 + arch/powerpc/boot/dts/fsl/e500v1_power_isa.dtsi | 51 ++++ arch/powerpc/boot/dts/fsl/mpc8540ads.dts | 2 +- arch/powerpc/boot/dts/fsl/mpc8541cds.dts | 2 +- arch/powerpc/boot/dts/fsl/mpc8555cds.dts | 2 +- arch/powerpc/boot/dts/fsl/mpc8560ads.dts | 2 +- arch/powerpc/configs/pseries_defconfig | 1 + arch/powerpc/include/asm/syscalls.h | 12 + arch/powerpc/kernel/kprobes.c | 8 +- arch/powerpc/kernel/pci_dn.c | 1 + arch/powerpc/kernel/sys_ppc32.c | 14 +- arch/powerpc/kernel/syscalls.c | 4 +- arch/powerpc/math-emu/math_efp.c | 1 + arch/powerpc/platforms/powernv/opal.c | 1 + arch/powerpc/platforms/pseries/vas.c | 2 +- arch/powerpc/sysdev/fsl_msi.c | 2 + arch/riscv/Kconfig | 2 +- arch/riscv/Makefile | 2 + arch/riscv/include/asm/io.h | 16 +- arch/riscv/kernel/setup.c | 4 +- arch/riscv/kernel/smpboot.c | 3 +- arch/riscv/kernel/sys_riscv.c | 3 - arch/riscv/mm/fault.c | 3 +- arch/sh/include/asm/sections.h | 2 +- arch/sh/kernel/machvec.c | 10 +- arch/um/kernel/um_arch.c | 2 +- arch/x86/include/asm/hyperv-tlfs.h | 4 +- arch/x86/include/asm/microcode.h | 1 + arch/x86/kernel/cpu/feat_ctl.c | 2 +- arch/x86/kernel/cpu/mce/apei.c | 13 +- arch/x86/kernel/cpu/microcode/amd.c | 3 +- arch/x86/kernel/cpu/resctrl/pseudo_lock.c | 12 +- arch/x86/kvm/emulate.c | 2 +- arch/x86/kvm/vmx/nested.c | 37 ++- arch/x86/kvm/vmx/vmx.c | 12 +- arch/x86/xen/enlighten_pv.c | 3 +- block/blk-throttle.c | 8 +- block/blk-wbt.c | 10 +- crypto/akcipher.c | 8 + drivers/acpi/acpi_fpdt.c | 22 ++ drivers/acpi/acpi_video.c | 16 ++ drivers/acpi/apei/ghes.c | 2 +- drivers/acpi/x86/utils.c | 19 +- drivers/ata/libahci_platform.c | 14 +- drivers/base/arch_topology.c | 19 ++ drivers/block/nbd.c | 6 +- drivers/bluetooth/btintel.c | 17 +- drivers/bluetooth/btusb.c | 14 ++ drivers/bluetooth/hci_ldisc.c | 7 +- drivers/bluetooth/hci_serdev.c | 10 +- drivers/char/hw_random/arm_smccc_trng.c | 4 +- drivers/char/hw_random/imx-rngc.c | 14 +- drivers/clk/baikal-t1/ccu-div.c | 65 +++++ drivers/clk/baikal-t1/ccu-div.h | 10 + drivers/clk/baikal-t1/clk-ccu-div.c | 26 +- drivers/clk/bcm/clk-bcm2835.c | 43 +++- drivers/clk/berlin/bg2.c | 5 +- drivers/clk/berlin/bg2q.c | 6 +- drivers/clk/clk-ast2600.c | 2 +- drivers/clk/clk-oxnas.c | 6 +- drivers/clk/clk-qoriq.c | 10 +- drivers/clk/clk-versaclock5.c | 2 +- drivers/clk/imx/clk-scu.c | 6 +- drivers/clk/mediatek/clk-mt8183-mfgcfg.c | 6 +- drivers/clk/meson/meson-aoclk.c | 5 +- drivers/clk/meson/meson-eeclk.c | 5 +- drivers/clk/meson/meson8b.c | 5 +- drivers/clk/qcom/Kconfig | 1 + drivers/clk/qcom/apss-ipq6018.c | 2 +- drivers/clk/qcom/gcc-sm6115.c | 46 ++-- drivers/clk/sprd/common.c | 9 +- drivers/clk/tegra/clk-tegra114.c | 1 + drivers/clk/tegra/clk-tegra20.c | 1 + drivers/clk/tegra/clk-tegra210.c | 1 + drivers/clk/ti/clk-dra7-atl.c | 9 +- drivers/clk/zynqmp/clkc.c | 7 + drivers/clk/zynqmp/pll.c | 31 ++- drivers/cpufreq/intel_pstate.c | 1 + drivers/crypto/cavium/cpt/cptpf_main.c | 6 +- drivers/crypto/ccp/ccp-dmaengine.c | 6 +- drivers/crypto/hisilicon/qm.c | 6 +- drivers/crypto/hisilicon/zip/zip_crypto.c | 4 +- drivers/crypto/inside-secure/safexcel_hash.c | 8 +- drivers/crypto/marvell/octeontx/otx_cptpf_ucode.c | 18 +- drivers/crypto/qat/qat_common/adf_gen4_hw_data.h | 2 +- drivers/crypto/qat/qat_common/qat_algs.c | 18 +- drivers/crypto/sahara.c | 18 +- drivers/dma-buf/udmabuf.c | 9 +- drivers/dma/hisi_dma.c | 28 +-- drivers/dma/ioat/dma.c | 6 +- drivers/dma/mxs-dma.c | 11 +- drivers/dma/ti/k3-udma.c | 25 +- drivers/firmware/efi/libstub/fdt.c | 8 - drivers/firmware/google/gsmi.c | 9 + drivers/fpga/dfl.c | 2 +- drivers/fsi/fsi-core.c | 3 + drivers/gpio/gpio-rockchip.c | 7 + drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | 7 +- drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 14 +- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 5 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 67 +++--- drivers/gpu/drm/amd/display/dc/calcs/bw_fixed.c | 6 +- drivers/gpu/drm/amd/display/dc/core/dc.c | 16 +- drivers/gpu/drm/amd/display/dc/dc_stream.h | 6 +- .../drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c | 35 +-- .../drm/amd/display/dc/dcn10/dcn10_hw_sequencer.h | 3 +- drivers/gpu/drm/amd/display/dc/inc/hw_sequencer.h | 8 +- drivers/gpu/drm/arm/display/komeda/komeda_crtc.c | 4 +- drivers/gpu/drm/arm/display/komeda/komeda_kms.c | 21 +- drivers/gpu/drm/arm/display/komeda/komeda_kms.h | 2 + drivers/gpu/drm/bridge/adv7511/adv7511.h | 5 +- drivers/gpu/drm/bridge/adv7511/adv7511_cec.c | 4 +- drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 4 +- drivers/gpu/drm/bridge/lontium-lt9611.c | 3 +- .../drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c | 4 +- drivers/gpu/drm/bridge/parade-ps8640.c | 4 +- drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 13 +- drivers/gpu/drm/drm_bridge.c | 4 +- drivers/gpu/drm/drm_dp_helper.c | 9 - drivers/gpu/drm/drm_dp_mst_topology.c | 6 +- drivers/gpu/drm/drm_ioctl.c | 8 +- drivers/gpu/drm/drm_mipi_dsi.c | 1 + drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 + drivers/gpu/drm/i915/intel_pm.c | 10 +- drivers/gpu/drm/meson/meson_drv.c | 10 +- drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 12 +- drivers/gpu/drm/msm/disp/dpu1/dpu_vbif.c | 29 +-- drivers/gpu/drm/msm/dp/dp_catalog.c | 2 +- drivers/gpu/drm/nouveau/nouveau_bo.c | 4 +- drivers/gpu/drm/nouveau/nouveau_connector.c | 3 +- drivers/gpu/drm/nouveau/nouveau_prime.c | 1 - drivers/gpu/drm/omapdrm/dss/dss.c | 3 + drivers/gpu/drm/pl111/pl111_versatile.c | 1 + drivers/gpu/drm/tiny/bochs.c | 2 + drivers/gpu/drm/udl/udl_modeset.c | 3 - drivers/gpu/drm/vc4/vc4_vec.c | 4 +- drivers/gpu/drm/virtio/virtgpu_object.c | 3 + drivers/gpu/drm/virtio/virtgpu_plane.c | 6 +- drivers/gpu/drm/virtio/virtgpu_vq.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_msg.c | 1 + drivers/hid/hid-multitouch.c | 8 +- drivers/hid/hid-roccat.c | 4 + drivers/hsi/controllers/omap_ssi_core.c | 1 + drivers/hsi/controllers/omap_ssi_port.c | 8 +- drivers/hwmon/gsc-hwmon.c | 1 + drivers/hwmon/pmbus/mp2888.c | 13 +- drivers/hwmon/sht4x.c | 2 +- drivers/i2c/busses/i2c-designware-core.h | 7 +- drivers/i2c/busses/i2c-designware-master.c | 13 + drivers/i2c/busses/i2c-mlxbf.c | 44 +++- drivers/iio/adc/ad7923.c | 4 +- drivers/iio/adc/at91-sama5d2_adc.c | 28 ++- drivers/iio/adc/ltc2497.c | 13 + drivers/iio/dac/ad5593r.c | 46 ++-- drivers/iio/inkern.c | 8 +- drivers/iio/magnetometer/yamaha-yas530.c | 2 +- drivers/iio/pressure/dps310.c | 262 +++++++++++++-------- drivers/infiniband/core/cm.c | 14 +- drivers/infiniband/core/uverbs_cmd.c | 5 +- drivers/infiniband/core/verbs.c | 2 + drivers/infiniband/hw/hns/hns_roce_mr.c | 1 - drivers/infiniband/hw/irdma/defs.h | 1 + drivers/infiniband/hw/irdma/hw.c | 51 ++-- drivers/infiniband/hw/irdma/type.h | 1 + drivers/infiniband/hw/irdma/user.h | 1 + drivers/infiniband/hw/irdma/utils.c | 3 + drivers/infiniband/hw/irdma/verbs.c | 2 + drivers/infiniband/hw/mlx4/mr.c | 1 - drivers/infiniband/hw/mlx5/main.c | 3 + drivers/infiniband/hw/mlx5/odp.c | 3 +- drivers/infiniband/sw/rxe/rxe_qp.c | 10 +- drivers/infiniband/sw/rxe/rxe_queue.c | 12 +- drivers/infiniband/sw/siw/siw.h | 1 + drivers/infiniband/sw/siw/siw_qp.c | 2 +- drivers/infiniband/sw/siw/siw_qp_rx.c | 27 ++- drivers/infiniband/sw/siw/siw_verbs.c | 3 + drivers/infiniband/ulp/srp/ib_srp.c | 4 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 21 ++ drivers/iommu/omap-iommu-debug.c | 6 +- drivers/isdn/mISDN/l1oip.h | 1 + drivers/isdn/mISDN/l1oip_core.c | 13 +- drivers/leds/flash/leds-lm3601x.c | 2 - drivers/mailbox/bcm-flexrm-mailbox.c | 8 +- drivers/mailbox/mailbox-mpfs.c | 25 +- drivers/md/bcache/writeback.c | 73 ++++-- drivers/md/raid0.c | 2 +- drivers/md/raid5.c | 15 +- drivers/media/pci/cx88/cx88-vbi.c | 9 +- drivers/media/pci/cx88/cx88-video.c | 43 ++-- drivers/media/platform/exynos4-is/fimc-is.c | 1 + drivers/media/platform/meson/ge2d/ge2d.c | 1 - drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c | 1 - drivers/media/platform/s5p-mfc/s5p_mfc.c | 3 +- drivers/media/platform/xilinx/xilinx-vipp.c | 9 +- drivers/media/usb/uvc/uvc_ctrl.c | 83 ++++--- drivers/media/usb/uvc/uvc_driver.c | 8 +- drivers/memory/of_memory.c | 2 + drivers/memory/pl353-smc.c | 1 + drivers/mfd/fsl-imx25-tsadc.c | 34 ++- drivers/mfd/intel_soc_pmic_core.c | 1 + drivers/mfd/lp8788-irq.c | 3 + drivers/mfd/lp8788.c | 12 +- drivers/mfd/sm501.c | 7 +- drivers/misc/ocxl/file.c | 2 + drivers/mmc/host/au1xmmc.c | 3 +- drivers/mmc/host/sdhci-msm.c | 1 + drivers/mmc/host/sdhci-sprd.c | 2 +- drivers/mmc/host/wmt-sdmmc.c | 5 +- drivers/mtd/devices/docg3.c | 7 +- drivers/mtd/nand/raw/atmel/nand-controller.c | 1 + drivers/mtd/nand/raw/fsl_elbc_nand.c | 28 ++- drivers/mtd/nand/raw/intel-nand-controller.c | 12 +- drivers/mtd/nand/raw/meson_nand.c | 4 +- drivers/net/can/usb/kvaser_usb/kvaser_usb.h | 2 + drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c | 3 +- drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 2 +- drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 79 +++++++ drivers/net/ethernet/atheros/alx/main.c | 5 + drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 1 + drivers/net/ethernet/freescale/fs_enet/mac-fec.c | 2 +- drivers/net/ethernet/intel/iavf/iavf_main.c | 177 +++++++++++--- drivers/net/ethernet/intel/ice/ice_ethtool.c | 1 + drivers/net/ethernet/marvell/mvpp2/mvpp2.h | 1 + drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c | 10 +- drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 13 +- drivers/net/ethernet/ti/Kconfig | 1 + drivers/net/ethernet/ti/davinci_mdio.c | 242 ++++++++++++++++++- drivers/net/hyperv/hyperv_net.h | 3 +- drivers/net/hyperv/netvsc.c | 4 + drivers/net/hyperv/netvsc_drv.c | 19 ++ drivers/net/thunderbolt.c | 28 ++- drivers/net/usb/r8152.c | 4 +- drivers/net/wireless/ath/ath10k/mac.c | 54 +++-- drivers/net/wireless/ath/ath11k/mac.c | 25 +- drivers/net/wireless/ath/ath9k/htc_hst.c | 43 ++-- .../wireless/broadcom/brcm80211/brcmfmac/core.c | 3 +- .../net/wireless/broadcom/brcm80211/brcmfmac/pno.c | 12 +- drivers/net/wireless/mediatek/mt76/mt7615/main.c | 4 + .../net/wireless/mediatek/mt76/mt7915/debugfs.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7921/main.c | 1 + drivers/net/wireless/mediatek/mt76/sdio.c | 2 +- drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 34 ++- .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 75 +++++- .../net/wireless/realtek/rtlwifi/rtl8192de/phy.c | 9 +- drivers/net/wireless/realtek/rtw88/main.c | 8 +- drivers/net/wwan/iosm/iosm_ipc_wwan.c | 5 +- drivers/nvme/host/core.c | 3 +- drivers/nvme/host/multipath.c | 1 + drivers/nvme/host/pci.c | 3 +- drivers/nvme/target/tcp.c | 11 +- drivers/nvmem/core.c | 15 +- drivers/pci/setup-res.c | 11 + .../phy/amlogic/phy-meson-axg-mipi-pcie-analog.c | 6 +- drivers/phy/mediatek/phy-mtk-tphy.c | 7 +- drivers/phy/qualcomm/phy-qcom-usb-hsic.c | 6 +- drivers/pinctrl/pinctrl-rockchip.c | 13 + drivers/platform/chrome/chromeos_laptop.c | 24 +- drivers/platform/chrome/cros_ec.c | 8 +- drivers/platform/chrome/cros_ec_chardev.c | 3 + drivers/platform/chrome/cros_ec_proto.c | 32 +++ drivers/platform/chrome/cros_ec_typec.c | 2 +- drivers/platform/x86/msi-laptop.c | 14 +- drivers/power/supply/adp5061.c | 6 +- drivers/powercap/intel_rapl_common.c | 4 +- drivers/regulator/core.c | 2 +- drivers/regulator/qcom_rpm-regulator.c | 24 +- drivers/scsi/3w-9xxx.c | 2 +- drivers/scsi/cxgbi/libcxgbi.c | 2 +- drivers/scsi/iscsi_tcp.c | 140 ++++++++--- drivers/scsi/iscsi_tcp.h | 5 + drivers/scsi/libiscsi.c | 41 +++- drivers/scsi/libsas/sas_expander.c | 2 +- drivers/scsi/qedf/qedf_main.c | 21 ++ drivers/slimbus/Kconfig | 3 +- drivers/slimbus/qcom-ngd-ctrl.c | 14 +- drivers/soc/qcom/smem_state.c | 3 +- drivers/soc/qcom/smsm.c | 20 +- drivers/soc/tegra/Kconfig | 1 - drivers/soundwire/cadence_master.c | 9 +- drivers/soundwire/intel.c | 1 - drivers/spi/spi-dw-bt1.c | 4 +- drivers/spi/spi-meson-spicc.c | 6 +- drivers/spi/spi-mt7621.c | 8 +- drivers/spi/spi-omap-100k.c | 1 + drivers/spi/spi-qup.c | 21 +- drivers/spi/spi-s3c64xx.c | 9 + drivers/spi/spi.c | 2 + drivers/spmi/spmi-pmic-arb.c | 13 +- drivers/staging/greybus/audio_helper.c | 11 - drivers/staging/media/meson/vdec/vdec_hevc.c | 6 +- drivers/staging/media/sunxi/cedrus/cedrus.c | 4 +- drivers/staging/media/sunxi/cedrus/cedrus_h265.c | 5 +- drivers/staging/rtl8723bs/core/rtw_cmd.c | 16 +- drivers/staging/rtl8723bs/os_dep/os_intfs.c | 60 ++--- drivers/staging/vt6655/device_main.c | 8 +- drivers/thermal/cpufreq_cooling.c | 10 +- drivers/thermal/intel/intel_powerclamp.c | 4 +- drivers/thermal/qcom/tsens-v0_1.c | 2 +- drivers/thunderbolt/nhi.c | 49 +++- drivers/thunderbolt/switch.c | 24 ++ drivers/thunderbolt/tb.h | 1 + drivers/thunderbolt/tb_regs.h | 1 + drivers/thunderbolt/usb4.c | 20 ++ drivers/tty/serial/8250/8250_core.c | 16 +- drivers/tty/serial/8250/8250_pci.c | 5 + drivers/tty/serial/8250/8250_port.c | 18 +- drivers/tty/serial/fsl_lpuart.c | 2 + drivers/tty/serial/jsm/jsm_driver.c | 3 +- drivers/tty/serial/xilinx_uartps.c | 2 + drivers/usb/common/debug.c | 96 +++++--- drivers/usb/core/quirks.c | 4 + drivers/usb/dwc3/core.c | 17 ++ drivers/usb/dwc3/core.h | 4 + drivers/usb/gadget/function/f_printer.c | 12 +- drivers/usb/host/xhci-dbgcap.c | 2 +- drivers/usb/host/xhci-mem.c | 7 +- drivers/usb/host/xhci-plat.c | 18 +- drivers/usb/host/xhci.c | 3 +- drivers/usb/host/xhci.h | 1 + drivers/usb/misc/idmouse.c | 8 +- drivers/usb/mtu3/mtu3_core.c | 2 - drivers/usb/mtu3/mtu3_plat.c | 2 + drivers/usb/musb/musb_gadget.c | 3 + drivers/usb/storage/unusual_devs.h | 6 - drivers/vhost/vsock.c | 2 +- drivers/video/fbdev/smscufx.c | 14 +- drivers/video/fbdev/stifb.c | 2 +- drivers/xen/gntdev-common.h | 3 +- drivers/xen/gntdev.c | 80 ++++--- fs/btrfs/extent-tree.c | 3 + fs/btrfs/free-space-cache.c | 6 + fs/btrfs/qgroup.c | 15 ++ fs/btrfs/scrub.c | 36 +++ fs/btrfs/super.c | 11 +- fs/cifs/file.c | 9 + fs/cifs/smb2pdu.c | 7 +- fs/cifs/smb2transport.c | 10 +- fs/dlm/ast.c | 6 +- fs/dlm/lock.c | 16 +- fs/dlm/lowcomms.c | 4 + fs/eventfd.c | 10 +- fs/ext2/super.c | 6 +- fs/ext4/fast_commit.c | 40 ++-- fs/ext4/file.c | 6 + fs/ext4/inode.c | 14 +- fs/ext4/namei.c | 17 +- fs/ext4/resize.c | 2 +- fs/ext4/super.c | 25 +- fs/f2fs/checkpoint.c | 47 +++- fs/f2fs/data.c | 4 +- fs/f2fs/extent_cache.c | 3 +- fs/f2fs/f2fs.h | 9 +- fs/f2fs/gc.c | 10 +- fs/f2fs/recovery.c | 23 +- fs/f2fs/segment.c | 2 +- fs/f2fs/super.c | 15 +- fs/file_table.c | 7 +- fs/fs-writeback.c | 37 ++- fs/internal.h | 10 + fs/io-wq.c | 2 +- fs/io_uring.c | 43 ++-- fs/jbd2/commit.c | 2 +- fs/jbd2/journal.c | 10 +- fs/jbd2/recovery.c | 1 + fs/jbd2/transaction.c | 6 +- fs/ksmbd/server.c | 4 +- fs/ksmbd/smb2pdu.c | 13 +- fs/ksmbd/smb_common.c | 6 +- fs/nfsd/nfs3proc.c | 11 +- fs/nfsd/nfs4proc.c | 19 +- fs/nfsd/nfs4recover.c | 4 +- fs/nfsd/nfs4state.c | 5 + fs/nfsd/nfs4xdr.c | 13 +- fs/nfsd/nfsproc.c | 6 +- fs/nfsd/xdr4.h | 3 +- fs/ntfs3/inode.c | 2 - fs/ntfs3/xattr.c | 102 +------- fs/open.c | 11 +- fs/quota/quota_tree.c | 38 +++ fs/splice.c | 10 +- fs/userfaultfd.c | 4 +- fs/xfs/xfs_super.c | 10 +- include/linux/ata.h | 39 +-- include/linux/bpf_verifier.h | 11 + include/linux/dynamic_debug.h | 11 +- include/linux/eventfd.h | 2 +- include/linux/fs.h | 9 +- include/linux/iova.h | 2 +- include/linux/once.h | 28 +++ include/linux/ring_buffer.h | 2 +- include/linux/sched.h | 2 +- include/linux/serial_8250.h | 1 + include/linux/serial_core.h | 3 +- include/linux/skbuff.h | 2 + include/linux/sunrpc/svc.h | 19 +- include/linux/tcp.h | 2 +- include/linux/trace.h | 36 ++- include/linux/trace_events.h | 1 + include/net/ieee802154_netdev.h | 12 +- include/net/tcp.h | 5 +- include/scsi/libiscsi.h | 6 +- include/uapi/rdma/mlx5-abi.h | 1 + kernel/bpf/bpf_local_storage.c | 4 +- kernel/bpf/bpf_task_storage.c | 8 +- kernel/bpf/btf.c | 2 +- kernel/bpf/hashtab.c | 30 ++- kernel/bpf/syscall.c | 2 + kernel/bpf/verifier.c | 42 +++- kernel/cgroup/cgroup.c | 6 +- kernel/cgroup/cpuset.c | 18 +- kernel/gcov/gcc_4_7.c | 18 +- kernel/livepatch/transition.c | 18 +- kernel/rcu/tasks.h | 2 +- kernel/rcu/tree.c | 17 +- kernel/rcu/tree_plugin.h | 3 +- kernel/trace/ftrace.c | 8 +- kernel/trace/kprobe_event_gen_test.c | 49 +++- kernel/trace/ring_buffer.c | 87 ++++++- kernel/trace/trace.c | 66 ++++++ kernel/trace/trace_eprobe.c | 60 +---- kernel/trace/trace_events_synth.c | 23 +- kernel/trace/trace_kprobe.c | 60 +---- kernel/trace/trace_osnoise.c | 3 +- kernel/trace/trace_probe_kernel.h | 115 +++++++++ lib/Kconfig.debug | 8 +- lib/dynamic_debug.c | 45 +--- lib/once.c | 30 +++ mm/damon/vaddr.c | 10 + mm/hugetlb.c | 37 ++- mm/mmap.c | 5 +- net/bluetooth/hci_core.c | 34 ++- net/bluetooth/hci_sysfs.c | 3 + net/bluetooth/l2cap_core.c | 17 +- net/bluetooth/rfcomm/sock.c | 3 + net/can/bcm.c | 7 +- net/core/skmsg.c | 12 +- net/core/stream.c | 3 +- net/ieee802154/socket.c | 4 + net/ipv4/inet_hashtables.c | 4 +- net/ipv4/netfilter/nft_fib_ipv4.c | 3 + net/ipv4/tcp.c | 16 +- net/ipv4/tcp_output.c | 19 +- net/ipv6/netfilter/nft_fib_ipv6.c | 6 +- net/mac80211/cfg.c | 3 - net/netfilter/nf_conntrack_core.c | 18 +- net/openvswitch/datapath.c | 18 +- net/rds/tcp.c | 2 +- net/sctp/auth.c | 18 +- net/unix/garbage.c | 20 ++ net/vmw_vsock/virtio_transport_common.c | 2 +- net/xdp/xsk.c | 22 +- net/xdp/xsk_queue.h | 22 +- net/xfrm/xfrm_input.c | 18 +- net/xfrm/xfrm_ipcomp.c | 1 + scripts/Kbuild.include | 23 +- scripts/package/mkspec | 4 +- scripts/selinux/install_policy.sh | 2 +- security/Kconfig.hardening | 13 +- security/integrity/ima/ima_appraise.c | 12 +- sound/core/pcm_dmaengine.c | 8 +- sound/core/rawmidi.c | 2 - sound/core/sound_oss.c | 13 +- sound/pci/hda/hda_beep.c | 15 +- sound/pci/hda/hda_beep.h | 1 + sound/pci/hda/patch_hdmi.c | 6 - sound/pci/hda/patch_realtek.c | 11 +- sound/pci/hda/patch_sigmatel.c | 25 +- sound/soc/codecs/da7219.c | 5 +- sound/soc/codecs/lpass-tx-macro.c | 13 +- sound/soc/codecs/mt6359-accdet.c | 6 +- sound/soc/codecs/mt6660.c | 8 +- sound/soc/codecs/tas2764.c | 78 ++---- sound/soc/codecs/wcd9335.c | 2 +- sound/soc/codecs/wcd934x.c | 2 +- sound/soc/codecs/wm5102.c | 6 +- sound/soc/codecs/wm5110.c | 6 +- sound/soc/codecs/wm8997.c | 6 +- sound/soc/fsl/eukrea-tlv320.c | 8 +- sound/soc/sh/rcar/ctu.c | 6 +- sound/soc/sh/rcar/dvc.c | 6 +- sound/soc/sh/rcar/mix.c | 6 +- sound/soc/sh/rcar/src.c | 5 +- sound/soc/sh/rcar/ssi.c | 4 +- sound/soc/sof/sof-pci-dev.c | 2 +- sound/usb/card.c | 32 ++- sound/usb/endpoint.c | 6 +- sound/usb/quirks.c | 42 ---- sound/usb/quirks.h | 2 - sound/usb/usbaudio.h | 1 + tools/bpf/bpftool/btf_dumper.c | 2 +- tools/bpf/bpftool/main.c | 10 + tools/lib/bpf/xsk.c | 6 +- tools/objtool/elf.c | 7 +- tools/perf/util/intel-pt.c | 9 +- .../selftests/arm64/signal/testcases/testcases.c | 2 +- tools/testing/selftests/tpm2/tpm2.py | 4 + 529 files changed, 4805 insertions(+), 2196 deletions(-)

2 years, 7 months

12
542
0 0

[PATCH v6 1/2] sched: Fix use-after-free bug in dup_user_cpus_ptr()

by Waiman Long

Since commit 07ec77a1d4e8 ("sched: Allow task CPU affinity to be restricted on asymmetric systems"), the setting and clearing of user_cpus_ptr are done under pi_lock for arm64 architecture. However, dup_user_cpus_ptr() accesses user_cpus_ptr without any lock protection. Since sched_setaffinity() can be invoked from another process, the process being modified may be undergoing fork() at the same time. When racing with the clearing of user_cpus_ptr in __set_cpus_allowed_ptr_locked(), it can lead to user-after-free and possibly double-free in arm64 kernel. Commit 8f9ea86fdf99 ("sched: Always preserve the user requested cpumask") fixes this problem as user_cpus_ptr, once set, will never be cleared in a task's lifetime. However, this bug was re-introduced in commit 851a723e45d1 ("sched: Always clear user_cpus_ptr in do_set_cpus_allowed()") which allows the clearing of user_cpus_ptr in do_set_cpus_allowed(). This time, it will affect all arches. Fix this bug by always clearing the user_cpus_ptr of the newly cloned/forked task before the copying process starts and check the user_cpus_ptr state of the source task under pi_lock. Note to stable, this patch won't be applicable to stable releases. Just copy the new dup_user_cpus_ptr() function over. Fixes: 07ec77a1d4e8 ("sched: Allow task CPU affinity to be restricted on asymmetric systems") Fixes: 851a723e45d1 ("sched: Always clear user_cpus_ptr in do_set_cpus_allowed()") CC: stable(a)vger.kernel.org Reported-by: David Wang 王标 <wangbiao3(a)xiaomi.com> Signed-off-by: Waiman Long <longman(a)redhat.com> --- kernel/sched/core.c | 34 +++++++++++++++++++++++++++++----- 1 file changed, 29 insertions(+), 5 deletions(-) diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 25b582b6ee5f..b93d030b9fd5 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -2612,19 +2612,43 @@ void do_set_cpus_allowed(struct task_struct *p, const struct cpumask *new_mask) int dup_user_cpus_ptr(struct task_struct *dst, struct task_struct *src, int node) { + cpumask_t *user_mask; unsigned long flags; - if (!src->user_cpus_ptr) + /* + * Always clear dst->user_cpus_ptr first as their user_cpus_ptr's + * may differ by now due to racing. + */ + dst->user_cpus_ptr = NULL; + + /* + * This check is racy and losing the race is a valid situation. + * It is not worth the extra overhead of taking the pi_lock on + * every fork/clone. + */ + if (data_race(!src->user_cpus_ptr)) return 0; - dst->user_cpus_ptr = kmalloc_node(cpumask_size(), GFP_KERNEL, node); - if (!dst->user_cpus_ptr) + user_mask = kmalloc_node(cpumask_size(), GFP_KERNEL, node); + if (!user_mask) return -ENOMEM; - /* Use pi_lock to protect content of user_cpus_ptr */ + /* + * Use pi_lock to protect content of user_cpus_ptr + * + * Though unlikely, user_cpus_ptr can be reset to NULL by a concurrent + * do_set_cpus_allowed(). + */ raw_spin_lock_irqsave(&src->pi_lock, flags); - cpumask_copy(dst->user_cpus_ptr, src->user_cpus_ptr); + if (src->user_cpus_ptr) { + swap(dst->user_cpus_ptr, user_mask); + cpumask_copy(dst->user_cpus_ptr, src->user_cpus_ptr); + } raw_spin_unlock_irqrestore(&src->pi_lock, flags); + + if (unlikely(user_mask)) + kfree(user_mask); + return 0; } -- 2.31.1

2 years, 7 months

3
2
0 0

[PATCH v5.10.y] ALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC

by Zubin Mithra

From: Takashi Iwai <tiwai(a)suse.de> commit 8423f0b6d513b259fdab9c9bf4aaa6188d054c2d upstream. There is a small race window at snd_pcm_oss_sync() that is called from OSS PCM SNDCTL_DSP_SYNC ioctl; namely the function calls snd_pcm_oss_make_ready() at first, then takes the params_lock mutex for the rest. When the stream is set up again by another thread between them, it leads to inconsistency, and may result in unexpected results such as NULL dereference of OSS buffer as a fuzzer spotted recently. The fix is simply to cover snd_pcm_oss_make_ready() call into the same params_lock mutex with snd_pcm_oss_make_ready_locked() variant. Reported-and-tested-by: butt3rflyh4ck <butterflyhuangxx(a)gmail.com> Reviewed-by: Jaroslav Kysela <perex(a)perex.cz> Cc: <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/CAFcO6XN7JDM4xSXGhtusQfS2mSBcx50VJKwQpCq=WeLt57aa… Link: https://lore.kernel.org/r/20220905060714.22549-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Zubin Mithra <zsm(a)google.com> --- Note: * 8423f0b6d513 is present in linux-5.15.y and linux-5.4.y; missing in linux-5.10.y. * Backport addresses conflict due to surrounding context. * Tests run: build and boot. sound/core/oss/pcm_oss.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c index f88de74da1eb..de6f94bee50b 100644 --- a/sound/core/oss/pcm_oss.c +++ b/sound/core/oss/pcm_oss.c @@ -1662,13 +1662,14 @@ static int snd_pcm_oss_sync(struct snd_pcm_oss_file *pcm_oss_file) runtime = substream->runtime; if (atomic_read(&substream->mmap_count)) goto __direct; - if ((err = snd_pcm_oss_make_ready(substream)) < 0) - return err; atomic_inc(&runtime->oss.rw_ref); if (mutex_lock_interruptible(&runtime->oss.params_lock)) { atomic_dec(&runtime->oss.rw_ref); return -ERESTARTSYS; } + err = snd_pcm_oss_make_ready_locked(substream); + if (err < 0) + goto unlock; format = snd_pcm_oss_format_from(runtime->oss.format); width = snd_pcm_format_physical_width(format); if (runtime->oss.buffer_used > 0) { -- 2.38.0.rc1.362.ged0d419d3c-goog

2 years, 7 months

3
3
0 0

[PATCH] usb: cdnsp: : add scatter gather support for ISOC endpoint

by Pawel Laszczak

Patch implements scatter gather support for isochronous endpoint. This fix is forced by 'commit e81e7f9a0eb9 ("usb: gadget: uvc: add scatter gather support")'. After this fix CDNSP driver stop working with UVC class. cc: <stable(a)vger.kernel.org> Fixes: 3d82904559f4 ("usb: cdnsp: cdns3 Add main part of Cadence USBSSP DRD Driver") Signed-off-by: Pawel Laszczak <pawell(a)cadence.com> --- drivers/usb/cdns3/cdnsp-gadget.c | 2 +- drivers/usb/cdns3/cdnsp-gadget.h | 4 +- drivers/usb/cdns3/cdnsp-ring.c | 110 +++++++++++++++++-------------- 3 files changed, 63 insertions(+), 53 deletions(-) diff --git a/drivers/usb/cdns3/cdnsp-gadget.c b/drivers/usb/cdns3/cdnsp-gadget.c index a8640516c895..e81dca0e62a8 100644 --- a/drivers/usb/cdns3/cdnsp-gadget.c +++ b/drivers/usb/cdns3/cdnsp-gadget.c @@ -382,7 +382,7 @@ int cdnsp_ep_enqueue(struct cdnsp_ep *pep, struct cdnsp_request *preq) ret = cdnsp_queue_bulk_tx(pdev, preq); break; case USB_ENDPOINT_XFER_ISOC: - ret = cdnsp_queue_isoc_tx_prepare(pdev, preq); + ret = cdnsp_queue_isoc_tx(pdev, preq); } if (ret) diff --git a/drivers/usb/cdns3/cdnsp-gadget.h b/drivers/usb/cdns3/cdnsp-gadget.h index f740fa6089d8..e1b5801fdddf 100644 --- a/drivers/usb/cdns3/cdnsp-gadget.h +++ b/drivers/usb/cdns3/cdnsp-gadget.h @@ -1532,8 +1532,8 @@ void cdnsp_queue_stop_endpoint(struct cdnsp_device *pdev, unsigned int ep_index); int cdnsp_queue_ctrl_tx(struct cdnsp_device *pdev, struct cdnsp_request *preq); int cdnsp_queue_bulk_tx(struct cdnsp_device *pdev, struct cdnsp_request *preq); -int cdnsp_queue_isoc_tx_prepare(struct cdnsp_device *pdev, - struct cdnsp_request *preq); +int cdnsp_queue_isoc_tx(struct cdnsp_device *pdev, + struct cdnsp_request *preq); void cdnsp_queue_configure_endpoint(struct cdnsp_device *pdev, dma_addr_t in_ctx_ptr); void cdnsp_queue_reset_ep(struct cdnsp_device *pdev, unsigned int ep_index); diff --git a/drivers/usb/cdns3/cdnsp-ring.c b/drivers/usb/cdns3/cdnsp-ring.c index b23e543b3a3d..07f6068342d4 100644 --- a/drivers/usb/cdns3/cdnsp-ring.c +++ b/drivers/usb/cdns3/cdnsp-ring.c @@ -1333,6 +1333,20 @@ static int cdnsp_handle_tx_event(struct cdnsp_device *pdev, ep_ring->dequeue, td->last_trb, ep_trb_dma); + desc = td->preq->pep->endpoint.desc; + + if (ep_seg) { + ep_trb = &ep_seg->trbs[(ep_trb_dma - ep_seg->dma) + / sizeof(*ep_trb)]; + + trace_cdnsp_handle_transfer(ep_ring, + (struct cdnsp_generic_trb *)ep_trb); + + if (pep->skip && usb_endpoint_xfer_isoc(desc) && + td->last_trb != ep_trb) + return -EAGAIN; + } + /* * Skip the Force Stopped Event. The event_trb(ep_trb_dma) * of FSE is not in the current TD pointed by ep_ring->dequeue @@ -1347,7 +1361,6 @@ static int cdnsp_handle_tx_event(struct cdnsp_device *pdev, goto cleanup; } - desc = td->preq->pep->endpoint.desc; if (!ep_seg) { if (!pep->skip || !usb_endpoint_xfer_isoc(desc)) { /* Something is busted, give up! */ @@ -1374,12 +1387,6 @@ static int cdnsp_handle_tx_event(struct cdnsp_device *pdev, goto cleanup; } - ep_trb = &ep_seg->trbs[(ep_trb_dma - ep_seg->dma) - / sizeof(*ep_trb)]; - - trace_cdnsp_handle_transfer(ep_ring, - (struct cdnsp_generic_trb *)ep_trb); - if (cdnsp_trb_is_noop(ep_trb)) goto cleanup; @@ -1726,11 +1733,6 @@ static unsigned int count_sg_trbs_needed(struct cdnsp_request *preq) return num_trbs; } -static unsigned int count_isoc_trbs_needed(struct cdnsp_request *preq) -{ - return cdnsp_count_trbs(preq->request.dma, preq->request.length); -} - static void cdnsp_check_trb_math(struct cdnsp_request *preq, int running_total) { if (running_total != preq->request.length) @@ -2192,28 +2194,48 @@ static unsigned int } /* Queue function isoc transfer */ -static int cdnsp_queue_isoc_tx(struct cdnsp_device *pdev, - struct cdnsp_request *preq) +int cdnsp_queue_isoc_tx(struct cdnsp_device *pdev, + struct cdnsp_request *preq) { - int trb_buff_len, td_len, td_remain_len, ret; + unsigned int trb_buff_len, td_len, td_remain_len, block_len; unsigned int burst_count, last_burst_pkt; unsigned int total_pkt_count, max_pkt; struct cdnsp_generic_trb *start_trb; + struct scatterlist *sg = NULL; bool more_trbs_coming = true; struct cdnsp_ring *ep_ring; + unsigned int num_sgs = 0; int running_total = 0; u32 field, length_field; + u64 addr, send_addr; int start_cycle; int trbs_per_td; - u64 addr; - int i; + int i, sent_len, ret; ep_ring = preq->pep->ring; + + td_len = preq->request.length; + + if (preq->request.num_sgs) { + num_sgs = preq->request.num_sgs; + sg = preq->request.sg; + addr = (u64)sg_dma_address(sg); + block_len = sg_dma_len(sg); + trbs_per_td = count_sg_trbs_needed(preq); + } else { + addr = (u64)preq->request.dma; + block_len = td_len; + trbs_per_td = count_trbs_needed(preq); + } + + ret = cdnsp_prepare_transfer(pdev, preq, trbs_per_td); + if (ret) + return ret; + start_trb = &ep_ring->enqueue->generic; start_cycle = ep_ring->cycle_state; - td_len = preq->request.length; - addr = (u64)preq->request.dma; td_remain_len = td_len; + send_addr = addr; max_pkt = usb_endpoint_maxp(preq->pep->endpoint.desc); total_pkt_count = DIV_ROUND_UP(td_len, max_pkt); @@ -2225,11 +2247,6 @@ static int cdnsp_queue_isoc_tx(struct cdnsp_device *pdev, burst_count = cdnsp_get_burst_count(pdev, preq, total_pkt_count); last_burst_pkt = cdnsp_get_last_burst_packet_count(pdev, preq, total_pkt_count); - trbs_per_td = count_isoc_trbs_needed(preq); - - ret = cdnsp_prepare_transfer(pdev, preq, trbs_per_td); - if (ret) - goto cleanup; /* * Set isoc specific data for the first TRB in a TD. @@ -2248,6 +2265,7 @@ static int cdnsp_queue_isoc_tx(struct cdnsp_device *pdev, /* Calculate TRB length. */ trb_buff_len = TRB_BUFF_LEN_UP_TO_BOUNDARY(addr); + trb_buff_len = min(trb_buff_len, block_len); if (trb_buff_len > td_remain_len) trb_buff_len = td_remain_len; @@ -2256,7 +2274,8 @@ static int cdnsp_queue_isoc_tx(struct cdnsp_device *pdev, trb_buff_len, td_len, preq, more_trbs_coming, 0); - length_field = TRB_LEN(trb_buff_len) | TRB_INTR_TARGET(0); + length_field = TRB_LEN(trb_buff_len) | TRB_TD_SIZE(remainder) | + TRB_INTR_TARGET(0); /* Only first TRB is isoc, overwrite otherwise. */ if (i) { @@ -2281,12 +2300,27 @@ static int cdnsp_queue_isoc_tx(struct cdnsp_device *pdev, } cdnsp_queue_trb(pdev, ep_ring, more_trbs_coming, - lower_32_bits(addr), upper_32_bits(addr), + lower_32_bits(send_addr), upper_32_bits(send_addr), length_field, field); running_total += trb_buff_len; addr += trb_buff_len; td_remain_len -= trb_buff_len; + + sent_len = trb_buff_len; + while (sg && sent_len >= block_len) { + /* New sg entry */ + --num_sgs; + sent_len -= block_len; + if (num_sgs != 0) { + sg = sg_next(sg); + block_len = sg_dma_len(sg); + addr = (u64)sg_dma_address(sg); + addr += sent_len; + } + } + block_len -= sent_len; + send_addr = addr; } /* Check TD length */ @@ -2324,30 +2358,6 @@ static int cdnsp_queue_isoc_tx(struct cdnsp_device *pdev, return ret; } -int cdnsp_queue_isoc_tx_prepare(struct cdnsp_device *pdev, - struct cdnsp_request *preq) -{ - struct cdnsp_ring *ep_ring; - u32 ep_state; - int num_trbs; - int ret; - - ep_ring = preq->pep->ring; - ep_state = GET_EP_CTX_STATE(preq->pep->out_ctx); - num_trbs = count_isoc_trbs_needed(preq); - - /* - * Check the ring to guarantee there is enough room for the whole - * request. Do not insert any td of the USB Request to the ring if the - * check failed. - */ - ret = cdnsp_prepare_ring(pdev, ep_ring, ep_state, num_trbs, GFP_ATOMIC); - if (ret) - return ret; - - return cdnsp_queue_isoc_tx(pdev, preq); -} - /**** Command Ring Operations ****/ /* * Generic function for queuing a command TRB on the command ring. -- 2.25.1

2 years, 7 months

2
3
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror December 2022