December 2022 - Linux-stable-mirror

[PATCH 07/12] arm64: dts: qcom: sm8150: Fix the base addresses of LLCC banks

by Manivannan Sadhasivam

The LLCC block has several banks each with a different base address and holes in between. So it is not a correct approach to cover these banks with a single offset/size. Instead, the individual bank's base address needs to be specified in devicetree with the exact size. Cc: <stable(a)vger.kernel.org> # 5.11 Fixes: bb1f7cf68a2d ("arm64: dts: qcom: sm8150: Add LLC support for sm8150") Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> --- arch/arm64/boot/dts/qcom/sm8150.dtsi | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/arch/arm64/boot/dts/qcom/sm8150.dtsi b/arch/arm64/boot/dts/qcom/sm8150.dtsi index a0c57fb798d3..7fd2291b2638 100644 --- a/arch/arm64/boot/dts/qcom/sm8150.dtsi +++ b/arch/arm64/boot/dts/qcom/sm8150.dtsi @@ -1762,8 +1762,11 @@ mmss_noc: interconnect@1740000 { system-cache-controller@9200000 { compatible = "qcom,sm8150-llcc"; - reg = <0 0x09200000 0 0x200000>, <0 0x09600000 0 0x50000>; - reg-names = "llcc_base", "llcc_broadcast_base"; + reg = <0 0x09200000 0 0x50000>, <0 0x09280000 0 0x50000>, + <0 0x09300000 0 0x50000>, <0 0x09380000 0 0x50000>, + <0 0x09600000 0 0x50000>; + reg-names = "llcc0_base", "llcc1_base", "llcc2_base", + "llcc3_base", "llcc_broadcast_base"; interrupts = <GIC_SPI 582 IRQ_TYPE_LEVEL_HIGH>; }; -- 2.25.1

2 years, 1 month

1
0
0 0

[PATCH 06/12] arm64: dts: qcom: sc8280xp: Fix the base addresses of LLCC banks

by Manivannan Sadhasivam

The LLCC block has several banks each with a different base address and holes in between. So it is not a correct approach to cover these banks with a single offset/size. Instead, the individual bank's base address needs to be specified in devicetree with the exact size. Cc: <stable(a)vger.kernel.org> # 6.0 Fixes: 152d1faf1e2f ("arm64: dts: qcom: add SC8280XP platform") Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> --- arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi index 109c9d2b684d..0510a5d510e7 100644 --- a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi +++ b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi @@ -1856,8 +1856,14 @@ opp-6 { system-cache-controller@9200000 { compatible = "qcom,sc8280xp-llcc"; - reg = <0 0x09200000 0 0x58000>, <0 0x09600000 0 0x58000>; - reg-names = "llcc_base", "llcc_broadcast_base"; + reg = <0 0x09200000 0 0x58000>, <0 0x09280000 0 0x58000>, + <0 0x09300000 0 0x58000>, <0 0x09380000 0 0x58000>, + <0 0x09400000 0 0x58000>, <0 0x09480000 0 0x58000>, + <0 0x09500000 0 0x58000>, <0 0x09580000 0 0x58000>, + <0 0x09600000 0 0x58000>; + reg-names = "llcc0_base", "llcc1_base", "llcc2_base", + "llcc3_base", "llcc4_base", "llcc5_base", + "llcc6_base", "llcc7_base", "llcc_broadcast_base"; interrupts = <GIC_SPI 582 IRQ_TYPE_LEVEL_HIGH>; }; -- 2.25.1

2 years, 1 month

1
0
0 0

[PATCH 05/12] arm64: dts: qcom: sc7280: Fix the base addresses of LLCC banks

by Manivannan Sadhasivam

The LLCC block has several banks each with a different base address and holes in between. So it is not a correct approach to cover these banks with a single offset/size. Instead, the individual bank's base address needs to be specified in devicetree with the exact size. While at it, let's also fix the size of the llcc_broadcast_base to cover the whole region. Cc: <stable(a)vger.kernel.org> # 5.13 Fixes: 0392968dbe09 ("arm64: dts: qcom: sc7280: Add device tree node for LLCC") Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> --- arch/arm64/boot/dts/qcom/sc7280.dtsi | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi index 0adf13399e64..6c6eb6f4f650 100644 --- a/arch/arm64/boot/dts/qcom/sc7280.dtsi +++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi @@ -3579,8 +3579,9 @@ gem_noc: interconnect@9100000 { system-cache-controller@9200000 { compatible = "qcom,sc7280-llcc"; - reg = <0 0x09200000 0 0xd0000>, <0 0x09600000 0 0x50000>; - reg-names = "llcc_base", "llcc_broadcast_base"; + reg = <0 0x09200000 0 0x58000>, <0 0x09280000 0 0x58000>, + <0 0x09600000 0 0x58000>; + reg-names = "llcc0_base", "llcc1_base", "llcc_broadcast_base"; interrupts = <GIC_SPI 582 IRQ_TYPE_LEVEL_HIGH>; }; -- 2.25.1

2 years, 1 month

1
0
0 0

[PATCH 04/12] arm64: dts: qcom: sc7180: Fix the base addresses of LLCC banks

by Manivannan Sadhasivam

The LLCC block has several banks each with a different base address and holes in between. So it is not a correct approach to cover these banks with a single offset/size. Instead, the individual bank's base address needs to be specified in devicetree with the exact size. On SC7180, there is only one LLCC bank available. So let's just pass that as "llcc0_base". Cc: <stable(a)vger.kernel.org> # 5.6 Fixes: c831fa299996 ("arm64: dts: qcom: sc7180: Add Last level cache controller node") Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> --- arch/arm64/boot/dts/qcom/sc7180.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm64/boot/dts/qcom/sc7180.dtsi b/arch/arm64/boot/dts/qcom/sc7180.dtsi index f71cf21a8dd8..f861f692c9b1 100644 --- a/arch/arm64/boot/dts/qcom/sc7180.dtsi +++ b/arch/arm64/boot/dts/qcom/sc7180.dtsi @@ -2759,7 +2759,7 @@ dc_noc: interconnect@9160000 { system-cache-controller@9200000 { compatible = "qcom,sc7180-llcc"; reg = <0 0x09200000 0 0x50000>, <0 0x09600000 0 0x50000>; - reg-names = "llcc_base", "llcc_broadcast_base"; + reg-names = "llcc0_base", "llcc_broadcast_base"; interrupts = <GIC_SPI 582 IRQ_TYPE_LEVEL_HIGH>; }; -- 2.25.1

2 years, 1 month

1
0
0 0

[PATCH 03/12] arm64: dts: qcom: sdm845: Fix the base addresses of LLCC banks

by Manivannan Sadhasivam

The LLCC block has several banks each with a different base address and holes in between. So it is not a correct approach to cover these banks with a single offset/size. Instead, the individual bank's base address needs to be specified in devicetree with the exact size. Cc: <stable(a)vger.kernel.org> # 5.4 Fixes: ba0411ddd133 ("arm64: dts: sdm845: Add device node for Last level cache controller") Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> --- arch/arm64/boot/dts/qcom/sdm845.dtsi | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi index 65032b94b46d..e1c0d9faf46e 100644 --- a/arch/arm64/boot/dts/qcom/sdm845.dtsi +++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi @@ -2132,8 +2132,11 @@ uart15: serial@a9c000 { llcc: system-cache-controller@1100000 { compatible = "qcom,sdm845-llcc"; - reg = <0 0x01100000 0 0x31000>, <0 0x01300000 0 0x50000>; - reg-names = "llcc_base", "llcc_broadcast_base"; + reg = <0 0x01100000 0 0x50000>, <0 0x01180000 0 0x50000>, + <0 0x01200000 0 0x50000>, <0 0x01280000 0 0x50000>, + <0 0x01300000 0 0x50000>; + reg-names = "llcc0_base", "llcc1_base", "llcc2_base", + "llcc3_base", "llcc_broadcast_base"; interrupts = <GIC_SPI 582 IRQ_TYPE_LEVEL_HIGH>; }; -- 2.25.1

2 years, 1 month

1
0
0 0

[PATCH v2] net: dsa: sja1105: avoid out of bounds access in sja1105_init_l2_policing()

by Radu Nicolae Pirea (OSS)

The SJA1105 family has 45 L2 policing table entries (SJA1105_MAX_L2_POLICING_COUNT) and SJA1110 has 110 (SJA1110_MAX_L2_POLICING_COUNT). Keeping the table structure but accounting for the difference in port count (5 in SJA1105 vs 10 in SJA1110) does not fully explain the difference. Rather, the SJA1110 also has L2 ingress policers for multicast traffic. If a packet is classified as multicast, it will be processed by the policer index 99 + SRCPORT. The sja1105_init_l2_policing() function initializes all L2 policers such that they don't interfere with normal packet reception by default. To have a common code between SJA1105 and SJA1110, the index of the multicast policer for the port is calculated because it's an index that is out of bounds for SJA1105 but in bounds for SJA1110, and a bounds check is performed. The code fails to do the proper thing when determining what to do with the multicast policer of port 0 on SJA1105 (ds->num_ports = 5). The "mcast" index will be equal to 45, which is also equal to table->ops->max_entry_count (SJA1105_MAX_L2_POLICING_COUNT). So it passes through the check. But at the same time, SJA1105 doesn't have multicast policers. So the code programs the SHARINDX field of an out-of-bounds element in the L2 Policing table of the static config. The comparison between index 45 and 45 entries should have determined the code to not access this policer index on SJA1105, since its memory wasn't even allocated. With enough bad luck, the out-of-bounds write could even overwrite other valid kernel data, but in this case, the issue was detected using KASAN. Kernel log: sja1105 spi5.0: Probed switch chip: SJA1105Q ================================================================== BUG: KASAN: slab-out-of-bounds in sja1105_setup+0x1cbc/0x2340 Write of size 8 at addr ffffff880bd57708 by task kworker/u8:0/8 ... Workqueue: events_unbound deferred_probe_work_func Call trace: ... sja1105_setup+0x1cbc/0x2340 dsa_register_switch+0x1284/0x18d0 sja1105_probe+0x748/0x840 ... Allocated by task 8: ... sja1105_setup+0x1bcc/0x2340 dsa_register_switch+0x1284/0x18d0 sja1105_probe+0x748/0x840 ... Fixes: 38fbe91f2287 ("net: dsa: sja1105: configure the multicast policers, if present") CC: stable(a)vger.kernel.org # 5.15+ Signed-off-by: Radu Nicolae Pirea (OSS) <radu-nicolae.pirea(a)oss.nxp.com> --- drivers/net/dsa/sja1105/sja1105_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/dsa/sja1105/sja1105_main.c b/drivers/net/dsa/sja1105/sja1105_main.c index 412666111b0c..b70dcf32a26d 100644 --- a/drivers/net/dsa/sja1105/sja1105_main.c +++ b/drivers/net/dsa/sja1105/sja1105_main.c @@ -1038,7 +1038,7 @@ static int sja1105_init_l2_policing(struct sja1105_private *priv) policing[bcast].sharindx = port; /* Only SJA1110 has multicast policers */ - if (mcast <= table->ops->max_entry_count) + if (mcast < table->ops->max_entry_count) policing[mcast].sharindx = port; } -- 2.34.1

2 years, 1 month

1
0
0 0

[PATCH net 4/4] can: esd_usb: Allow REC and TEC to return to zero

by Marc Kleine-Budde

From: Frank Jungclaus <frank.jungclaus(a)esd.eu> We don't get any further EVENT from an esd CAN USB device for changes on REC or TEC while those counters converge to 0 (with ecc == 0). So when handling the "Back to Error Active"-event force txerr = rxerr = 0, otherwise the berr-counters might stay on values like 95 forever. Also, to make life easier during the ongoing development a netdev_dbg() has been introduced to allow dumping error events send by an esd CAN USB device. Fixes: 96d8e90382dc ("can: Add driver for esd CAN-USB/2 device") Signed-off-by: Frank Jungclaus <frank.jungclaus(a)esd.eu> Link: https://lore.kernel.org/all/20221130202242.3998219-2-frank.jungclaus@esd.eu Cc: stable(a)vger.kernel.org Signed-off-by: Marc Kleine-Budde <mkl(a)pengutronix.de> --- drivers/net/can/usb/esd_usb.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/net/can/usb/esd_usb.c b/drivers/net/can/usb/esd_usb.c index 81b88e9e5bdc..42323f5e6f3a 100644 --- a/drivers/net/can/usb/esd_usb.c +++ b/drivers/net/can/usb/esd_usb.c @@ -234,6 +234,10 @@ static void esd_usb_rx_event(struct esd_usb_net_priv *priv, u8 rxerr = msg->msg.rx.data[2]; u8 txerr = msg->msg.rx.data[3]; + netdev_dbg(priv->netdev, + "CAN_ERR_EV_EXT: dlc=%#02x state=%02x ecc=%02x rec=%02x tec=%02x\n", + msg->msg.rx.dlc, state, ecc, rxerr, txerr); + skb = alloc_can_err_skb(priv->netdev, &cf); if (skb == NULL) { stats->rx_dropped++; @@ -260,6 +264,8 @@ static void esd_usb_rx_event(struct esd_usb_net_priv *priv, break; default: priv->can.state = CAN_STATE_ERROR_ACTIVE; + txerr = 0; + rxerr = 0; break; } } else { -- 2.35.1

2 years, 1 month

1
0
0 0

[PATCH net 3/4] can: can327: flush TX_work on ldisc .close()

by Marc Kleine-Budde

From: Max Staudt <max(a)enpas.org> Additionally, remove it from .ndo_stop(). This ensures that the worker is not called after being freed, and that the UART TX queue remains active to send final commands when the netdev is stopped. Thanks to Jiri Slaby for finding this in slcan: https://lore.kernel.org/linux-can/20221201073426.17328-1-jirislaby@kernel.o… A variant of this patch for slcan, with the flush in .ndo_stop() still present, has been tested successfully on physical hardware: https://bugzilla.suse.com/show_bug.cgi?id=1205597 Fixes: 43da2f07622f ("can: can327: CAN/ldisc driver for ELM327 based OBD-II adapters") Cc: "Jiri Slaby (SUSE)" <jirislaby(a)kernel.org> Cc: Max Staudt <max(a)enpas.org> Cc: Wolfgang Grandegger <wg(a)grandegger.com> Cc: Marc Kleine-Budde <mkl(a)pengutronix.de> Cc: "David S. Miller" <davem(a)davemloft.net> Cc: Eric Dumazet <edumazet(a)google.com> Cc: Jakub Kicinski <kuba(a)kernel.org> Cc: Paolo Abeni <pabeni(a)redhat.com> Cc: linux-can(a)vger.kernel.org Cc: netdev(a)vger.kernel.org Cc: stable(a)vger.kernel.org Signed-off-by: Max Staudt <max(a)enpas.org> Link: https://lore.kernel.org/all/20221202160148.282564-1-max@enpas.org Cc: stable(a)vger.kernel.org Signed-off-by: Marc Kleine-Budde <mkl(a)pengutronix.de> --- drivers/net/can/can327.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/drivers/net/can/can327.c b/drivers/net/can/can327.c index ed3d0b8989a0..dc7192ecb001 100644 --- a/drivers/net/can/can327.c +++ b/drivers/net/can/can327.c @@ -796,9 +796,9 @@ static int can327_netdev_close(struct net_device *dev) netif_stop_queue(dev); - /* Give UART one final chance to flush. */ - clear_bit(TTY_DO_WRITE_WAKEUP, &elm->tty->flags); - flush_work(&elm->tx_work); + /* We don't flush the UART TX queue here, as we want final stop + * commands (like the above dummy char) to be flushed out. + */ can_rx_offload_disable(&elm->offload); elm->can.state = CAN_STATE_STOPPED; @@ -1069,12 +1069,15 @@ static void can327_ldisc_close(struct tty_struct *tty) { struct can327 *elm = (struct can327 *)tty->disc_data; - /* unregister_netdev() calls .ndo_stop() so we don't have to. - * Our .ndo_stop() also flushes the TTY write wakeup handler, - * so we can safely set elm->tty = NULL after this. - */ + /* unregister_netdev() calls .ndo_stop() so we don't have to. */ unregister_candev(elm->dev); + /* Give UART one final chance to flush. + * No need to clear TTY_DO_WRITE_WAKEUP since .write_wakeup() is + * serialised against .close() and will not be called once we return. + */ + flush_work(&elm->tx_work); + /* Mark channel as dead */ spin_lock_bh(&elm->lock); tty->disc_data = NULL; -- 2.35.1

2 years, 1 month

1
0
0 0

[PATCH net 2/4] can: slcan: fix freed work crash

by Marc Kleine-Budde

From: "Jiri Slaby (SUSE)" <jirislaby(a)kernel.org> The LTP test pty03 is causing a crash in slcan: BUG: kernel NULL pointer dereference, address: 0000000000000008 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 0 PID: 348 Comm: kworker/0:3 Not tainted 6.0.8-1-default #1 openSUSE Tumbleweed 9d20364b934f5aab0a9bdf84e8f45cfdfae39dab Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b-rebuilt.opensuse.org 04/01/2014 Workqueue: 0x0 (events) RIP: 0010:process_one_work (/home/rich/kernel/linux/kernel/workqueue.c:706 /home/rich/kernel/linux/kernel/workqueue.c:2185) Code: 49 89 ff 41 56 41 55 41 54 55 53 48 89 f3 48 83 ec 10 48 8b 06 48 8b 6f 48 49 89 c4 45 30 e4 a8 04 b8 00 00 00 00 4c 0f 44 e0 <49> 8b 44 24 08 44 8b a8 00 01 00 00 41 83 e5 20 f6 45 10 04 75 0e RSP: 0018:ffffaf7b40f47e98 EFLAGS: 00010046 RAX: 0000000000000000 RBX: ffff9d644e1b8b48 RCX: ffff9d649e439968 RDX: 00000000ffff8455 RSI: ffff9d644e1b8b48 RDI: ffff9d64764aa6c0 RBP: ffff9d649e4335c0 R08: 0000000000000c00 R09: ffff9d64764aa734 R10: 0000000000000007 R11: 0000000000000001 R12: 0000000000000000 R13: ffff9d649e4335e8 R14: ffff9d64490da780 R15: ffff9d64764aa6c0 FS: 0000000000000000(0000) GS:ffff9d649e400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000008 CR3: 0000000036424000 CR4: 00000000000006f0 Call Trace: <TASK> worker_thread (/home/rich/kernel/linux/kernel/workqueue.c:2436) kthread (/home/rich/kernel/linux/kernel/kthread.c:376) ret_from_fork (/home/rich/kernel/linux/arch/x86/entry/entry_64.S:312) Apparently, the slcan's tx_work is freed while being scheduled. While slcan_netdev_close() (netdev side) calls flush_work(&sl->tx_work), slcan_close() (tty side) does not. So when the netdev is never set UP, but the tty is stuffed with bytes and forced to wakeup write, the work is scheduled, but never flushed. So add an additional flush_work() to slcan_close() to be sure the work is flushed under all circumstances. The Fixes commit below moved flush_work() from slcan_close() to slcan_netdev_close(). What was the rationale behind it? Maybe we can drop the one in slcan_netdev_close()? I see the same pattern in can327. So it perhaps needs the very same fix. Fixes: cfcb4465e992 ("can: slcan: remove legacy infrastructure") Link: https://bugzilla.suse.com/show_bug.cgi?id=1205597 Reported-by: Richard Palethorpe <richard.palethorpe(a)suse.com> Tested-by: Petr Vorel <petr.vorel(a)suse.com> Cc: Dario Binacchi <dario.binacchi(a)amarulasolutions.com> Cc: Wolfgang Grandegger <wg(a)grandegger.com> Cc: Marc Kleine-Budde <mkl(a)pengutronix.de> Cc: "David S. Miller" <davem(a)davemloft.net> Cc: Eric Dumazet <edumazet(a)google.com> Cc: Jakub Kicinski <kuba(a)kernel.org> Cc: Paolo Abeni <pabeni(a)redhat.com> Cc: linux-can(a)vger.kernel.org Cc: netdev(a)vger.kernel.org Cc: stable(a)vger.kernel.org Cc: Max Staudt <max(a)enpas.org> Signed-off-by: Jiri Slaby (SUSE) <jirislaby(a)kernel.org> Reviewed-by: Max Staudt <max(a)enpas.org> Link: https://lore.kernel.org/all/20221201073426.17328-1-jirislaby@kernel.org Signed-off-by: Marc Kleine-Budde <mkl(a)pengutronix.de> --- drivers/net/can/slcan/slcan-core.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/drivers/net/can/slcan/slcan-core.c b/drivers/net/can/slcan/slcan-core.c index fbb34139daa1..f4db77007c13 100644 --- a/drivers/net/can/slcan/slcan-core.c +++ b/drivers/net/can/slcan/slcan-core.c @@ -864,12 +864,14 @@ static void slcan_close(struct tty_struct *tty) { struct slcan *sl = (struct slcan *)tty->disc_data; - /* unregister_netdev() calls .ndo_stop() so we don't have to. - * Our .ndo_stop() also flushes the TTY write wakeup handler, - * so we can safely set sl->tty = NULL after this. - */ unregister_candev(sl->dev); + /* + * The netdev needn't be UP (so .ndo_stop() is not called). Hence make + * sure this is not running before freeing it up. + */ + flush_work(&sl->tx_work); + /* Mark channel as dead */ spin_lock_bh(&sl->lock); tty->disc_data = NULL; -- 2.35.1

2 years, 1 month

1
0
0 0

[PATCH 5.10 00/92] 5.10.158-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.10.158 release. There are 92 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 07 Dec 2022 19:07:46 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.158-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.10.158-rc1 Ming Lei <ming.lei(a)redhat.com> block: unhash blkdev part inode when the part is deleted Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Input: raydium_ts_i2c - fix memory leak in raydium_i2c_send() Jan Dabros <jsd(a)semihalf.com> char: tpm: Protect tpm_pm_suspend with locks Conor Dooley <conor.dooley(a)microchip.com> Revert "clocksource/drivers/riscv: Events are stopped during CPU suspend" Vishal Verma <vishal.l.verma(a)intel.com> ACPI: HMAT: Fix initiator registration for single-initiator systems Vishal Verma <vishal.l.verma(a)intel.com> ACPI: HMAT: remove unnecessary variable initialization Andrew Lunn <andrew(a)lunn.ch> i2c: imx: Only DMA messages with I2C_M_DMA_SAFE flag set Yuan Can <yuancan(a)huawei.com> i2c: npcm7xx: Fix error handling in npcm_i2c_init() Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> x86/pm: Add enumeration check before spec MSRs save/restore setup Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> x86/tsx: Add a feature bit for TSX control MSR support Fedor Pchelkin <pchelkin(a)ispras.ru> Revert "tty: n_gsm: avoid call of sleeping functions from atomic context" Ido Schimmel <idosch(a)nvidia.com> ipv4: Fix route deletion when nexthop info is not specified David Ahern <dsahern(a)kernel.org> ipv4: Handle attempt to delete multipath route when fib_info contains an nh reference Nikolay Aleksandrov <razor(a)blackwall.org> selftests: net: fix nexthop warning cleanup double ip typo Nikolay Aleksandrov <razor(a)blackwall.org> selftests: net: add delete nexthop route warning test Lee Jones <lee(a)kernel.org> Kconfig.debug: provide a little extra FRAME_WARN leeway when KASAN is enabled Helge Deller <deller(a)gmx.de> parisc: Increase FRAME_WARN to 2048 bytes on parisc Guenter Roeck <linux(a)roeck-us.net> xtensa: increase size of gcc stack frame check Helge Deller <deller(a)gmx.de> parisc: Increase size of gcc stack frame check Xiongfeng Wang <wangxiongfeng2(a)huawei.com> iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init() Xiongfeng Wang <wangxiongfeng2(a)huawei.com> iommu/vt-d: Fix PCI device refcount leak in has_external_pci() Maxim Korotkov <korotkov.maxim.s(a)gmail.com> pinctrl: single: Fix potential division by zero Mark Brown <broonie(a)kernel.org> ASoC: ops: Fix bounds check for _sx controls Hao Xu <haoxu(a)linux.alibaba.com> io_uring: don't hold uring_lock when calling io_run_task_work* Steven Rostedt (Google) <rostedt(a)goodmis.org> tracing: Free buffers when a used dynamic event is removed Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com> drm/i915: Never return 0 if not all requests retired Lee Jones <lee(a)kernel.org> drm/amdgpu: temporarily disable broken Clang builds due to blown stack-frame Adrian Hunter <adrian.hunter(a)intel.com> mmc: sdhci: Fix voltage switch delay Wenchao Chen <wenchao.chen(a)unisoc.com> mmc: sdhci-sprd: Fix no reset data and command after voltage switch Sebastian Falbesoner <sebastian.falbesoner(a)gmail.com> mmc: sdhci-esdhc-imx: correct CQHCI exit halt state check Christian Löhle <CLoehle(a)hyperstone.com> mmc: core: Fix ambiguous TRIM and DISCARD arg Ye Bin <yebin10(a)huawei.com> mmc: mmc_test: Fix removal of debugfs file Goh, Wei Sheng <wei.sheng.goh(a)intel.com> net: stmmac: Set MAC's flow control register to reflect current settings Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> pinctrl: intel: Save and restore pins in "direct IRQ" mode Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> x86/bugs: Make sure MSR_SPEC_CTRL is updated properly upon resume from S3 ZhangPeng <zhangpeng362(a)huawei.com> nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry() Tiezhu Yang <yangtiezhu(a)loongson.cn> tools/vm/slabinfo-gnuplot: use "grep -E" instead of "egrep" Steven Rostedt (Google) <rostedt(a)goodmis.org> error-injection: Add prompt for function error injection Jisheng Zhang <jszhang(a)kernel.org> riscv: vdso: fix section overlapping under some conditions YueHaibing <yuehaibing(a)huawei.com> net/mlx5: DR, Fix uninitialized var warning Yang Yingliang <yangyingliang(a)huawei.com> hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() Phil Auld <pauld(a)redhat.com> hwmon: (coretemp) Check for null before removing sysfs attrs Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com> net: ethernet: renesas: ravb: Fix promiscuous mode after system resumed Zhengchao Shao <shaozhengchao(a)huawei.com> sctp: fix memory leak in sctp_stream_outq_migrate() Willem de Bruijn <willemb(a)google.com> packet: do not set TP_STATUS_CSUM_VALID on CHECKSUM_COMPLETE Shigeru Yoshida <syoshida(a)redhat.com> net: tun: Fix use-after-free in tun_detach() David Howells <dhowells(a)redhat.com> afs: Fix fileserver probe RTT handling YueHaibing <yuehaibing(a)huawei.com> net: hsr: Fix potential use-after-free Xin Long <lucien.xin(a)gmail.com> tipc: re-fetch skb cb after tipc_msg_validate Jerry Ray <jerry.ray(a)microchip.com> dsa: lan9303: Correct stat name Yuri Karpov <YKarpov(a)ispras.ru> net: ethernet: nixge: fix NULL dereference Wang Hai <wanghai38(a)huawei.com> net/9p: Fix a potential socket leak in p9_socket_open Yuan Can <yuancan(a)huawei.com> net: net_netdev: Fix error handling in ntb_netdev_init_module() Yang Yingliang <yangyingliang(a)huawei.com> net: phy: fix null-ptr-deref while probe() failed Lorenzo Bianconi <lorenzo(a)kernel.org> wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration Johannes Berg <johannes.berg(a)intel.com> wifi: cfg80211: don't allow multi-BSSID in S1G Johannes Berg <johannes.berg(a)intel.com> wifi: cfg80211: fix buffer overflow in elem comparison Izabela Bakollari <ibakolla(a)redhat.com> aquantia: Do not purge addresses when setting the number of rings Duoming Zhou <duoming(a)zju.edu.cn> qlcnic: fix sleep-in-atomic-context bugs caused by msleep Zhang Changzhong <zhangchangzhong(a)huawei.com> can: cc770: cc770_isa_probe(): add missing free_cc770dev() Zhang Changzhong <zhangchangzhong(a)huawei.com> can: sja1000_isa: sja1000_isa_probe(): add missing free_sja1000dev() Roi Dayan <roid(a)nvidia.com> net/mlx5e: Fix use-after-free when reverting termination table YueHaibing <yuehaibing(a)huawei.com> net/mlx5: Fix uninitialized variable bug in outlen_write() Wang Hai <wanghai38(a)huawei.com> e100: Fix possible use after free in e100_xmit_prepare Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> e100: switch from 'pci_' to 'dma_' API Yuan Can <yuancan(a)huawei.com> iavf: Fix error handling in iavf_init_module() Minghao Chi <chi.minghao(a)zte.com.cn> iavf: remove redundant ret variable Yuan Can <yuancan(a)huawei.com> fm10k: Fix error handling in fm10k_init_module() Shang XiaoJing <shangxiaojing(a)huawei.com> i40e: Fix error handling in i40e_init_module() Shang XiaoJing <shangxiaojing(a)huawei.com> ixgbevf: Fix resource leak in ixgbevf_init_module() Yang Yingliang <yangyingliang(a)huawei.com> of: property: decrement node refcount in of_fwnode_get_reference_args() Xu Kuohai <xukuohai(a)huawei.com> bpf: Do not copy spin lock field from user in bpf_selem_alloc Gaosheng Cui <cuigaosheng1(a)huawei.com> hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails Yang Yingliang <yangyingliang(a)huawei.com> hwmon: (i5500_temp) fix missing pci_disable_device() Ninad Malwade <nmalwade(a)nvidia.com> hwmon: (ina3221) Fix shunt sum critical calculation Derek Nguyen <derek.nguyen(a)collins.com> hwmon: (ltc2947) fix temperature scaling Hou Tao <houtao1(a)huawei.com> libbpf: Handle size overflow for ringbuf mmap Michael Grzeschik <m.grzeschik(a)pengutronix.de> ARM: at91: rm9200: fix usb device clock id Srikar Dronamraju <srikar(a)linux.vnet.ibm.com> scripts/faddr2line: Fix regression in name resolution on ppc64le Hou Tao <houtao1(a)huawei.com> bpf, perf: Use subprog name when reporting subprog ksymbol Paul Gazzillo <paul(a)pgazz.com> iio: light: rpr0521: add missing Kconfig dependencies Wei Yongjun <weiyongjun1(a)huawei.com> iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw Wei Yongjun <weiyongjun1(a)huawei.com> iio: health: afe4403: Fix oob read in afe4403_read_raw ChenXiaoSong <chenxiaosong2(a)huawei.com> btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu: Partially revert "drm/amdgpu: update drm_display_info correctly when the edid is read" Claudio Suarez <cssk(a)net-c.es> drm/amdgpu: update drm_display_info correctly when the edid is read Sam James <sam(a)gentoo.org> kbuild: fix -Wimplicit-function-declaration in license_is_gpl_compatible Lyude Paul <lyude(a)redhat.com> drm/display/dp_mst: Fix drm_dp_mst_add_affected_dsc_crtcs() return code Nikolay Borisov <nborisov(a)suse.com> btrfs: move QUOTA_ENABLED check to rescan_should_stop from btrfs_qgroup_rescan_worker Frieder Schrempf <frieder.schrempf(a)kontron.de> spi: spi-imx: Fix spi_bus_clk if requested clock is higher than input clock Anand Jain <anand.jain(a)oracle.com> btrfs: free btrfs_path before copying inodes to userspace David Sterba <dsterba(a)suse.com> btrfs: sink iterator parameter to btrfs_ioctl_logical_to_ino ------------- Diffstat: Makefile | 4 +- arch/arm/boot/dts/at91rm9200.dtsi | 2 +- arch/riscv/kernel/vdso/Makefile | 1 + arch/x86/include/asm/cpufeatures.h | 1 + arch/x86/include/asm/nospec-branch.h | 2 +- arch/x86/kernel/cpu/bugs.c | 21 +++-- arch/x86/kernel/cpu/tsx.c | 33 ++++---- arch/x86/kernel/process.c | 2 +- arch/x86/power/cpu.c | 23 ++++-- block/partitions/core.c | 7 ++ drivers/acpi/numa/hmat.c | 27 ++++-- drivers/char/tpm/tpm-interface.c | 5 +- drivers/clk/at91/at91rm9200.c | 2 +- drivers/clocksource/timer-riscv.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | 4 +- drivers/gpu/drm/amd/display/Kconfig | 7 ++ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 +- drivers/gpu/drm/drm_dp_mst_topology.c | 2 +- drivers/gpu/drm/i915/gt/intel_gt_requests.c | 2 +- drivers/hwmon/coretemp.c | 9 +- drivers/hwmon/i5500_temp.c | 2 +- drivers/hwmon/ibmpex.c | 1 + drivers/hwmon/ina3221.c | 4 +- drivers/hwmon/ltc2947-core.c | 2 +- drivers/i2c/busses/i2c-imx.c | 6 +- drivers/i2c/busses/i2c-npcm7xx.c | 11 ++- drivers/iio/health/afe4403.c | 5 +- drivers/iio/health/afe4404.c | 12 +-- drivers/iio/light/Kconfig | 2 + drivers/input/touchscreen/raydium_i2c_ts.c | 4 +- drivers/iommu/intel/dmar.c | 1 + drivers/iommu/intel/iommu.c | 4 +- drivers/mmc/core/core.c | 9 +- drivers/mmc/core/mmc_test.c | 3 +- drivers/mmc/host/sdhci-esdhc-imx.c | 2 +- drivers/mmc/host/sdhci-sprd.c | 4 +- drivers/mmc/host/sdhci.c | 61 ++++++++++++-- drivers/mmc/host/sdhci.h | 2 + drivers/net/can/cc770/cc770_isa.c | 10 ++- drivers/net/can/sja1000/sja1000_isa.c | 10 ++- drivers/net/dsa/lan9303-core.c | 2 +- .../net/ethernet/aquantia/atlantic/aq_ethtool.c | 5 +- drivers/net/ethernet/aquantia/atlantic/aq_main.c | 4 +- drivers/net/ethernet/aquantia/atlantic/aq_main.h | 2 + drivers/net/ethernet/intel/e100.c | 95 +++++++++++----------- drivers/net/ethernet/intel/fm10k/fm10k_main.c | 10 ++- drivers/net/ethernet/intel/i40e/i40e_main.c | 11 ++- drivers/net/ethernet/intel/iavf/iavf_main.c | 8 +- drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c | 10 ++- drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 4 +- .../mellanox/mlx5/core/eswitch_offloads_termtbl.c | 2 + .../mellanox/mlx5/core/steering/dr_table.c | 5 +- drivers/net/ethernet/ni/nixge.c | 29 +++---- .../net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c | 4 +- drivers/net/ethernet/renesas/ravb_main.c | 1 + drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c | 2 + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 12 ++- drivers/net/ntb_netdev.c | 9 +- drivers/net/phy/phy_device.c | 1 + drivers/net/tun.c | 4 +- drivers/of/property.c | 4 +- drivers/pinctrl/intel/pinctrl-intel.c | 27 +++++- drivers/pinctrl/pinctrl-single.c | 2 +- drivers/spi/spi-imx.c | 3 +- drivers/tty/n_gsm.c | 39 +++++---- fs/afs/fs_probe.c | 4 +- fs/btrfs/backref.c | 25 +++++- fs/btrfs/backref.h | 3 +- fs/btrfs/ioctl.c | 38 ++------- fs/btrfs/qgroup.c | 22 ++--- fs/io_uring.c | 82 ++++++++++++++----- fs/nilfs2/dat.c | 7 ++ include/linux/license.h | 2 + include/linux/mmc/mmc.h | 2 +- include/net/sctp/stream_sched.h | 2 + kernel/bpf/bpf_local_storage.c | 2 +- kernel/events/core.c | 2 +- kernel/trace/trace_dynevent.c | 2 + kernel/trace/trace_events.c | 11 ++- lib/Kconfig.debug | 14 +++- net/9p/trans_fd.c | 4 +- net/hsr/hsr_forward.c | 5 +- net/ipv4/fib_semantics.c | 10 ++- net/mac80211/airtime.c | 3 + net/packet/af_packet.c | 6 +- net/sctp/stream.c | 25 ++++-- net/sctp/stream_sched.c | 5 ++ net/sctp/stream_sched_prio.c | 19 +++++ net/sctp/stream_sched_rr.c | 5 ++ net/tipc/crypto.c | 3 + net/wireless/scan.c | 10 ++- scripts/faddr2line | 7 +- sound/soc/soc-ops.c | 2 +- tools/lib/bpf/ringbuf.c | 12 ++- tools/testing/selftests/net/fib_nexthops.sh | 30 +++++++ tools/vm/slabinfo-gnuplot.sh | 4 +- 96 files changed, 672 insertions(+), 305 deletions(-)

2 years, 1 month

6
97
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror December 2022