August 2023 - Linux-stable-mirror

[PATCH v0 3/9] media: qcom: camss: Fix vfe_get() error jump

by Bryan O'Donoghue

Right now it is possible to do a vfe_get() with the internal reference count at 1. If vfe_check_clock_rates() returns non-zero then we will leave the reference count as-is and run: - pm_runtime_put_sync() - vfe->ops->pm_domain_off() skip: - camss_disable_clocks() Subsequent vfe_put() calls will when the ref-count is non-zero unconditionally run: - pm_runtime_put_sync() - vfe->ops->pm_domain_off() - camss_disable_clocks() vfe_get() should not attempt to roll-back on error when the ref-count is non-zero as the upper layers will still do their own vfe_put() operations. vfe_put() will drop the reference count and do the necessary power domain release, the cleanup jumps in vfe_get() should only be run when the ref-count is zero. [ 50.095796] CPU: 7 PID: 3075 Comm: cam Not tainted 6.3.2+ #80 [ 50.095798] Hardware name: LENOVO 21BXCTO1WW/21BXCTO1WW, BIOS N3HET82W (1.54 ) 05/26/2023 [ 50.095799] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 50.095802] pc : refcount_warn_saturate+0xf4/0x148 [ 50.095804] lr : refcount_warn_saturate+0xf4/0x148 [ 50.095805] sp : ffff80000c7cb8b0 [ 50.095806] x29: ffff80000c7cb8b0 x28: ffff16ecc0e3fc10 x27: 0000000000000000 [ 50.095810] x26: 0000000000000000 x25: 0000000000020802 x24: 0000000000000000 [ 50.095813] x23: ffff16ecc7360640 x22: 00000000ffffffff x21: 0000000000000005 [ 50.095815] x20: ffff16ed175f4400 x19: ffffb4d9852942a8 x18: ffffffffffffffff [ 50.095818] x17: ffffb4d9852d4a48 x16: ffffb4d983da5db8 x15: ffff80000c7cb320 [ 50.095821] x14: 0000000000000001 x13: 2e656572662d7265 x12: 7466612d65737520 [ 50.095823] x11: 00000000ffffefff x10: ffffb4d9850cebf0 x9 : ffffb4d9835cf954 [ 50.095826] x8 : 0000000000017fe8 x7 : c0000000ffffefff x6 : 0000000000057fa8 [ 50.095829] x5 : ffff16f813fe3d08 x4 : 0000000000000000 x3 : ffff621e8f4d2000 [ 50.095832] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff16ed32119040 [ 50.095835] Call trace: [ 50.095836] refcount_warn_saturate+0xf4/0x148 [ 50.095838] device_link_put_kref+0x84/0xc8 [ 50.095843] device_link_del+0x38/0x58 [ 50.095846] vfe_pm_domain_off+0x3c/0x50 [qcom_camss] [ 50.095860] vfe_put+0x114/0x140 [qcom_camss] [ 50.095869] csid_set_power+0x2c8/0x408 [qcom_camss] [ 50.095878] pipeline_pm_power_one+0x164/0x170 [videodev] [ 50.095896] pipeline_pm_power+0xc4/0x110 [videodev] [ 50.095909] v4l2_pipeline_pm_use+0x5c/0xa0 [videodev] [ 50.095923] v4l2_pipeline_pm_get+0x1c/0x30 [videodev] [ 50.095937] video_open+0x7c/0x100 [qcom_camss] [ 50.095945] v4l2_open+0x84/0x130 [videodev] [ 50.095960] chrdev_open+0xc8/0x250 [ 50.095964] do_dentry_open+0x1bc/0x498 [ 50.095966] vfs_open+0x34/0x40 [ 50.095968] path_openat+0xb44/0xf20 [ 50.095971] do_filp_open+0xa4/0x160 [ 50.095974] do_sys_openat2+0xc8/0x188 [ 50.095975] __arm64_sys_openat+0x6c/0xb8 [ 50.095977] invoke_syscall+0x50/0x128 [ 50.095982] el0_svc_common.constprop.0+0x4c/0x100 [ 50.095985] do_el0_svc+0x40/0xa8 [ 50.095988] el0_svc+0x2c/0x88 [ 50.095991] el0t_64_sync_handler+0xf4/0x120 [ 50.095994] el0t_64_sync+0x190/0x198 [ 50.095996] ---[ end trace 0000000000000000 ]--- Fixes: 779096916dae ("media: camss: vfe: Fix runtime PM imbalance on error") Cc: stable(a)vger.kernel.org Signed-off-by: Bryan O'Donoghue <bryan.odonoghue(a)linaro.org> --- drivers/media/platform/qcom/camss/camss-vfe.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/platform/qcom/camss/camss-vfe.c b/drivers/media/platform/qcom/camss/camss-vfe.c index dabfd613b2f94..938f373bcd1fd 100644 --- a/drivers/media/platform/qcom/camss/camss-vfe.c +++ b/drivers/media/platform/qcom/camss/camss-vfe.c @@ -611,7 +611,7 @@ int vfe_get(struct vfe_device *vfe) } else { ret = vfe_check_clock_rates(vfe); if (ret < 0) - goto error_pm_runtime_get; + goto error_pm_domain; } vfe->power_count++; -- 2.41.0

1 year, 4 months

1
0
0 0

[PATCH v0 1/9] media: qcom: camss: Fix pm_domain_on sequence in probe

by Bryan O'Donoghue

We need to make sure camss_configure_pd() happens before camss_register_entities() as the vfe_get() path relies on the pointer provided by camss_configure_pd(). Fix the ordering sequence in probe to ensure the pointers vfe_get() demands are present by the time camss_register_entities() runs. In order to facilitate backporting to stable kernels I've moved the configure_pd() call pretty early on the probe() function so that irrespective of the existence of the old error handling jump labels this patch should still apply to -next circa Aug 2023 to v5.13 inclusive. Fixes: 2f6f8af67203 ("media: camss: Refactor VFE power domain toggling") Cc: stable(a)vger.kernel.org Signed-off-by: Bryan O'Donoghue <bryan.odonoghue(a)linaro.org> --- drivers/media/platform/qcom/camss/camss.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/media/platform/qcom/camss/camss.c b/drivers/media/platform/qcom/camss/camss.c index f11dc59135a5a..75991d849b571 100644 --- a/drivers/media/platform/qcom/camss/camss.c +++ b/drivers/media/platform/qcom/camss/camss.c @@ -1619,6 +1619,12 @@ static int camss_probe(struct platform_device *pdev) if (ret < 0) goto err_cleanup; + ret = camss_configure_pd(camss); + if (ret < 0) { + dev_err(dev, "Failed to configure power domains: %d\n", ret); + goto err_cleanup; + } + ret = camss_init_subdevices(camss); if (ret < 0) goto err_cleanup; @@ -1678,12 +1684,6 @@ static int camss_probe(struct platform_device *pdev) } } - ret = camss_configure_pd(camss); - if (ret < 0) { - dev_err(dev, "Failed to configure power domains: %d\n", ret); - return ret; - } - pm_runtime_enable(dev); return 0; -- 2.41.0

1 year, 4 months

1
0
0 0

[PATCH] printk: ringbuffer: Fix truncating buffer size min_t cast

by Kees Cook

If an output buffer size exceeded U16_MAX, the min_t(u16, ...) cast in copy_data() was causing writes to truncate. This manifested as output bytes being skipped, seen as %NUL bytes in pstore dumps when the available record size was larger than 65536. Fix the cast to no longer truncate the calculation. Cc: Petr Mladek <pmladek(a)suse.com> Cc: Sergey Senozhatsky <senozhatsky(a)chromium.org> Cc: Steven Rostedt <rostedt(a)goodmis.org> Cc: John Ogness <john.ogness(a)linutronix.de> Reported-by: Vijay Balakrishna <vijayb(a)linux.microsoft.com> Closes: https://lore.kernel.org/lkml/d8bb1ec7-a4c5-43a2-9de0-9643a70b899f@linux.mic… Fixes: b6cf8b3f3312 ("printk: add lockless ringbuffer") Cc: stable(a)vger.kernel.org Signed-off-by: Kees Cook <keescook(a)chromium.org> --- kernel/printk/printk_ringbuffer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/printk/printk_ringbuffer.c b/kernel/printk/printk_ringbuffer.c index 2dc4d5a1f1ff..fde338606ce8 100644 --- a/kernel/printk/printk_ringbuffer.c +++ b/kernel/printk/printk_ringbuffer.c @@ -1735,7 +1735,7 @@ static bool copy_data(struct prb_data_ring *data_ring, if (!buf || !buf_size) return true; - data_size = min_t(u16, buf_size, len); + data_size = min_t(unsigned int, buf_size, len); memcpy(&buf[0], data, data_size); /* LMM(copy_data:A) */ return true; -- 2.34.1

1 year, 4 months

8
9
0 0

[PATCH v2 2/2] i2c: designware: Handle invalid SMBus block data response length value

by Tam Nguyen

In the I2C_FUNC_SMBUS_BLOCK_DATA case, the invalid length byte value (outside of 1-32) of the SMBus block data response from the Slave device is not correctly handled by the I2C Designware driver. In case IC_EMPTYFIFO_HOLD_MASTER_EN==1, which cannot be detected from the registers, the Master can be disabled only if the STOP bit is set. Without STOP bit set, the Master remains active, holding the bus until receiving a block data response length. This hangs the bus and is unrecoverable. Avoid this by issuing another dump read to reach the stop condition when an invalid length byte is received. Cc: stable(a)vger.kernel.org Signed-off-by: Tam Nguyen <tamnguyenchi(a)os.amperecomputing.com> --- drivers/i2c/busses/i2c-designware-master.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/drivers/i2c/busses/i2c-designware-master.c b/drivers/i2c/busses/i2c-designware-master.c index e96276d1b002..c51fc1f4b97e 100644 --- a/drivers/i2c/busses/i2c-designware-master.c +++ b/drivers/i2c/busses/i2c-designware-master.c @@ -528,8 +528,19 @@ i2c_dw_read(struct dw_i2c_dev *dev) regmap_read(dev->map, DW_IC_DATA_CMD, &tmp); tmp &= DW_IC_DATA_CMD_DAT; /* Ensure length byte is a valid value */ - if (flags & I2C_M_RECV_LEN && - tmp <= I2C_SMBUS_BLOCK_MAX && tmp > 0) { + if (flags & I2C_M_RECV_LEN) { + /* + * if IC_EMPTYFIFO_HOLD_MASTER_EN is set, which cannot be + * detected from the registers, the controller can be + * disabled if the STOP bit is set. But it is only set + * after receiving block data response length in + * I2C_FUNC_SMBUS_BLOCK_DATA case. That needs to read + * another byte with STOP bit set when the block data + * response length is invalid to complete the transaction. + */ + if (!tmp || tmp > I2C_SMBUS_BLOCK_MAX) + tmp = 1; + len = i2c_dw_recv_len(dev, tmp); } *buf++ = tmp; -- 2.25.1

1 year, 4 months

3
2
0 0

[PATCH v2 1/2] i2c: designware: Correct length byte validation logic

by Tam Nguyen

From: Quan Nguyen <quan(a)os.amperecomputing.com> Commit 0daede80f870 ("i2c: designware: Convert driver to using regmap API") changes the logic to validate the whole 32-bit return value of DW_IC_DATA_CMD register instead of 8-bit LSB without reason. Later, commit f53f15ba5a85 ("i2c: designware: Get right data length"), introduced partial fix but not enough because the "tmp > 0" still test tmp as 32-bit value and is wrong in case the IC_DATA_CMD[11] is set. Revert the logic to just before commit 0daede80f870 ("i2c: designware: Convert driver to using regmap API"). Fixes: f53f15ba5a85 ("i2c: designware: Get right data length") Fixes: 0daede80f870 ("i2c: designware: Convert driver to using regmap API") Cc: stable(a)vger.kernel.org Signed-off-by: Tam Nguyen <tamnguyenchi(a)os.amperecomputing.com> Signed-off-by: Quan Nguyen <quan(a)os.amperecomputing.com> --- drivers/i2c/busses/i2c-designware-master.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/i2c/busses/i2c-designware-master.c b/drivers/i2c/busses/i2c-designware-master.c index 55ea91a63382..e96276d1b002 100644 --- a/drivers/i2c/busses/i2c-designware-master.c +++ b/drivers/i2c/busses/i2c-designware-master.c @@ -526,9 +526,10 @@ i2c_dw_read(struct dw_i2c_dev *dev) u32 flags = msgs[dev->msg_read_idx].flags; regmap_read(dev->map, DW_IC_DATA_CMD, &tmp); + tmp &= DW_IC_DATA_CMD_DAT; /* Ensure length byte is a valid value */ if (flags & I2C_M_RECV_LEN && - (tmp & DW_IC_DATA_CMD_DAT) <= I2C_SMBUS_BLOCK_MAX && tmp > 0) { + tmp <= I2C_SMBUS_BLOCK_MAX && tmp > 0) { len = i2c_dw_recv_len(dev, tmp); } *buf++ = tmp; -- 2.25.1

1 year, 4 months

3
2
0 0

[PATCH AUTOSEL 5.10 01/25] phy: qcom-snps-femto-v2: keep cfg_ahb_clk enabled during runtime suspend

by Sasha Levin

From: Adrien Thierry <athierry(a)redhat.com> [ Upstream commit 45d89a344eb46db9dce851c28e14f5e3c635c251 ] In the dwc3 core, both system and runtime suspend end up calling dwc3_suspend_common(). From there, what happens for the PHYs depends on the USB mode and whether the controller is entering system or runtime suspend. HOST mode: (1) system suspend on a non-wakeup-capable controller The [1] if branch is taken. dwc3_core_exit() is called, which ends up calling phy_power_off() and phy_exit(). Those two functions decrease the PM runtime count at some point, so they will trigger the PHY runtime sleep (assuming the count is right). (2) runtime suspend / system suspend on a wakeup-capable controller The [1] branch is not taken. dwc3_suspend_common() calls phy_pm_runtime_put_sync(). Assuming the ref count is right, the PHY runtime suspend op is called. DEVICE mode: dwc3_core_exit() is called on both runtime and system sleep unless the controller is already runtime suspended. OTG mode: (1) system suspend : dwc3_core_exit() is called (2) runtime suspend : do nothing In host mode, the code seems to make a distinction between 1) runtime sleep / system sleep for wakeup-capable controller, and 2) system sleep for non-wakeup-capable controller, where phy_power_off() and phy_exit() are only called for the latter. This suggests the PHY is not supposed to be in a fully powered-off state for runtime sleep and system sleep for wakeup-capable controller. Moreover, downstream, cfg_ahb_clk only gets disabled for system suspend. The clocks are disabled by phy->set_suspend() [2] which is only called in the system sleep path through dwc3_core_exit() [3]. With that in mind, don't disable the clocks during the femto PHY runtime suspend callback. The clocks will only be disabled during system suspend for non-wakeup-capable controllers, through dwc3_core_exit(). [1] https://elixir.bootlin.com/linux/v6.4/source/drivers/usb/dwc3/core.c#L1988 [2] https://git.codelinaro.org/clo/la/kernel/msm-5.4/-/blob/LV.AU.1.2.1.r2-0530… [3] https://git.codelinaro.org/clo/la/kernel/msm-5.4/-/blob/LV.AU.1.2.1.r2-0530… Signed-off-by: Adrien Thierry <athierry(a)redhat.com> Link: https://lore.kernel.org/r/20230629144542.14906-2-athierry@redhat.com Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c | 9 --------- 1 file changed, 9 deletions(-) diff --git a/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c b/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c index 7e61202aa234e..a107f98c662d5 100644 --- a/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c +++ b/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c @@ -122,22 +122,13 @@ static int qcom_snps_hsphy_suspend(struct qcom_snps_hsphy *hsphy) 0, USB2_AUTO_RESUME); } - clk_disable_unprepare(hsphy->cfg_ahb_clk); return 0; } static int qcom_snps_hsphy_resume(struct qcom_snps_hsphy *hsphy) { - int ret; - dev_dbg(&hsphy->phy->dev, "Resume QCOM SNPS PHY, mode\n"); - ret = clk_prepare_enable(hsphy->cfg_ahb_clk); - if (ret) { - dev_err(&hsphy->phy->dev, "failed to enable cfg ahb clock\n"); - return ret; - } - return 0; } -- 2.40.1

1 year, 4 months

2
25
0 0

[PATCH AUTOSEL 5.15 01/31] phy: qcom-snps-femto-v2: keep cfg_ahb_clk enabled during runtime suspend

by Sasha Levin

From: Adrien Thierry <athierry(a)redhat.com> [ Upstream commit 45d89a344eb46db9dce851c28e14f5e3c635c251 ] In the dwc3 core, both system and runtime suspend end up calling dwc3_suspend_common(). From there, what happens for the PHYs depends on the USB mode and whether the controller is entering system or runtime suspend. HOST mode: (1) system suspend on a non-wakeup-capable controller The [1] if branch is taken. dwc3_core_exit() is called, which ends up calling phy_power_off() and phy_exit(). Those two functions decrease the PM runtime count at some point, so they will trigger the PHY runtime sleep (assuming the count is right). (2) runtime suspend / system suspend on a wakeup-capable controller The [1] branch is not taken. dwc3_suspend_common() calls phy_pm_runtime_put_sync(). Assuming the ref count is right, the PHY runtime suspend op is called. DEVICE mode: dwc3_core_exit() is called on both runtime and system sleep unless the controller is already runtime suspended. OTG mode: (1) system suspend : dwc3_core_exit() is called (2) runtime suspend : do nothing In host mode, the code seems to make a distinction between 1) runtime sleep / system sleep for wakeup-capable controller, and 2) system sleep for non-wakeup-capable controller, where phy_power_off() and phy_exit() are only called for the latter. This suggests the PHY is not supposed to be in a fully powered-off state for runtime sleep and system sleep for wakeup-capable controller. Moreover, downstream, cfg_ahb_clk only gets disabled for system suspend. The clocks are disabled by phy->set_suspend() [2] which is only called in the system sleep path through dwc3_core_exit() [3]. With that in mind, don't disable the clocks during the femto PHY runtime suspend callback. The clocks will only be disabled during system suspend for non-wakeup-capable controllers, through dwc3_core_exit(). [1] https://elixir.bootlin.com/linux/v6.4/source/drivers/usb/dwc3/core.c#L1988 [2] https://git.codelinaro.org/clo/la/kernel/msm-5.4/-/blob/LV.AU.1.2.1.r2-0530… [3] https://git.codelinaro.org/clo/la/kernel/msm-5.4/-/blob/LV.AU.1.2.1.r2-0530… Signed-off-by: Adrien Thierry <athierry(a)redhat.com> Link: https://lore.kernel.org/r/20230629144542.14906-2-athierry@redhat.com Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c | 9 --------- 1 file changed, 9 deletions(-) diff --git a/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c b/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c index 7e61202aa234e..a107f98c662d5 100644 --- a/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c +++ b/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c @@ -122,22 +122,13 @@ static int qcom_snps_hsphy_suspend(struct qcom_snps_hsphy *hsphy) 0, USB2_AUTO_RESUME); } - clk_disable_unprepare(hsphy->cfg_ahb_clk); return 0; } static int qcom_snps_hsphy_resume(struct qcom_snps_hsphy *hsphy) { - int ret; - dev_dbg(&hsphy->phy->dev, "Resume QCOM SNPS PHY, mode\n"); - ret = clk_prepare_enable(hsphy->cfg_ahb_clk); - if (ret) { - dev_err(&hsphy->phy->dev, "failed to enable cfg ahb clock\n"); - return ret; - } - return 0; } -- 2.40.1

1 year, 4 months

2
31
0 0

[PATCH 5.4 000/154] 5.4.253-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.4.253 release. There are 154 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Fri, 11 Aug 2023 10:36:10 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.253-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.4.253-rc1 Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Revert "driver core: Annotate dev_err_probe() with __must_check" Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> drivers: core: fix kernel-doc markup for dev_err_probe() Michał Mirosław <mirq-linux(a)rere.qmqm.pl> driver code: print symbolic error code Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> driver core: Annotate dev_err_probe() with __must_check Xu Yang <xu.yang_2(a)nxp.com> ARM: dts: nxp/imx6sll: fix wrong property name in usbphy node Andreas Kemnade <andreas(a)kemnade.info> ARM: dts: imx6sll: fixup of operating points Peng Fan <peng.fan(a)nxp.com> ARM: dts: imx: add usb alias Krzysztof Kozlowski <krzk(a)kernel.org> ARM: dts: imx: Align L2 cache-controller nodename with dtschema Shengjiu Wang <shengjiu.wang(a)nxp.com> ARM: dts: imx6sll: Make ssi node name same as other platforms Dinh Nguyen <dinguyen(a)kernel.org> arm64: dts: stratix10: fix incorrect I2C property for SCL signal Xiubo Li <xiubli(a)redhat.com> ceph: defer stopping mdsc delayed_work Jeff Layton <jlayton(a)kernel.org> ceph: use kill_anon_super helper Jeff Layton <jlayton(a)kernel.org> ceph: show tasks waiting on caps in debugfs caps file Johan Hovold <johan+linaro(a)kernel.org> PM: sleep: wakeirq: fix wake irq arming Chunfeng Yun <chunfeng.yun(a)mediatek.com> PM / wakeirq: support enabling wake-up irq after runtime_suspend called Sean Christopherson <seanjc(a)google.com> selftests/rseq: Play nice with binaries statically linked against glibc 2.35+ Michael Jeanson <mjeanson(a)efficios.com> selftests/rseq: check if libc rseq support is registered Aneesh Kumar K.V <aneesh.kumar(a)linux.ibm.com> powerpc/mm/altmap: Fix altmap boundary check Roger Quadros <rogerq(a)kernel.org> mtd: rawnand: omap_elm: Fix incorrect type in assignment Mirsad Goran Todorovac <mirsad.todorovac(a)alu.unizg.hr> test_firmware: return ENOMEM instead of ENOSPC on failed memory allocation Mirsad Goran Todorovac <mirsad.todorovac(a)alu.unizg.hr> test_firmware: prevent race conditions by a correct implementation of locking Jan Kara <jack(a)suse.cz> ext2: Drop fragment support Jan Kara <jack(a)suse.cz> fs: Protect reconfiguration of sb read-write from racing writes Alan Stern <stern(a)rowland.harvard.edu> net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb Sungwoo Kim <iam(a)sung-woo.kim> Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb Prince Kumar Maurya <princekumarmaurya06(a)gmail.com> fs/sysv: Null check to prevent null-ptr-deref bug Laszlo Ersek <lersek(a)redhat.com> net: tap_open(): set sk_uid from current_fsuid() Laszlo Ersek <lersek(a)redhat.com> net: tun_chr_open(): set sk_uid from current_fsuid() Arseniy Krasnov <AVKrasnov(a)sberdevices.ru> mtd: rawnand: meson: fix OOB available bytes for ECC Olivier Maignial <olivier.maignial(a)hotmail.fr> mtd: spinand: toshiba: Fix ecc_get_status Ross Maynard <bids.7405(a)bigpond.com> USB: zaurus: Add ID for A-300/B-500/C-700 Ilya Dryomov <idryomov(a)gmail.com> libceph: fix potential hang in ceph_osdc_notify() Steffen Maier <maier(a)linux.ibm.com> scsi: zfcp: Defer fc_rport blocking until after ADISC response Eric Dumazet <edumazet(a)google.com> tcp_metrics: fix data-race in tcpm_suck_dst() vs fastopen Eric Dumazet <edumazet(a)google.com> tcp_metrics: annotate data-races around tm->tcpm_net Eric Dumazet <edumazet(a)google.com> tcp_metrics: annotate data-races around tm->tcpm_vals[] Eric Dumazet <edumazet(a)google.com> tcp_metrics: annotate data-races around tm->tcpm_lock Eric Dumazet <edumazet(a)google.com> tcp_metrics: annotate data-races around tm->tcpm_stamp Eric Dumazet <edumazet(a)google.com> tcp_metrics: fix addr_same() helper Yue Haibing <yuehaibing(a)huawei.com> ip6mr: Fix skb_under_panic in ip6mr_cache_report() Lin Ma <linma(a)zju.edu.cn> net: dcb: choose correct policy to parse DCB_ATTR_BCN Dan Carpenter <dan.carpenter(a)linaro.org> net: ll_temac: fix error checking of irq_of_parse_and_map() Yang Yingliang <yangyingliang(a)huawei.com> net: ll_temac: Switch to use dev_err_probe() helper Andrzej Hajda <a.hajda(a)samsung.com> driver core: add device probe log helper Tomas Glozar <tglozar(a)redhat.com> bpf: sockmap: Remove preempt_disable in sock_map_sk_acquire valis <sec(a)valis.email> net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free valis <sec(a)valis.email> net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free valis <sec(a)valis.email> net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free Eric Dumazet <edumazet(a)google.com> net: add missing data-race annotation for sk_ll_usec Eric Dumazet <edumazet(a)google.com> net: add missing data-race annotations around sk->sk_peek_off Eric Dumazet <edumazet(a)google.com> net: add missing READ_ONCE(sk->sk_rcvbuf) annotation Eric Dumazet <edumazet(a)google.com> net: add missing READ_ONCE(sk->sk_sndbuf) annotation Eric Dumazet <edumazet(a)google.com> net: add missing READ_ONCE(sk->sk_rcvlowat) annotation Eric Dumazet <edumazet(a)google.com> net: annotate data-races around sk->sk_max_pacing_rate Chengfeng Ye <dg573847474(a)gmail.com> mISDN: hfcpci: Fix potential deadlock on &hc->lock Jamal Hadi Salim <jhs(a)mojatatu.com> net: sched: cls_u32: Fix match key mis-addressing Georg Müller <georgmueller(a)gmx.net> perf test uprobe_from_different_cu: Skip if there is no gcc Lin Ma <linma(a)zju.edu.cn> rtnetlink: let rtnl_bridge_setlink checks IFLA_BRIDGE_MODE length Yuanjun Gong <ruc_gongyuanjun(a)163.com> net/mlx5e: fix return value check in mlx5e_ipsec_remove_trailer() Zhengchao Shao <shaozhengchao(a)huawei.com> net/mlx5: DR, fix memory leak in mlx5dr_cmd_create_reformat_ctx Heiko Carstens <hca(a)linux.ibm.com> KVM: s390: fix sthyi error handling ndesaulniers(a)google.com <ndesaulniers(a)google.com> word-at-a-time: use the same return type for has_zero regardless of endianness Bart Van Assche <bvanassche(a)acm.org> loop: Select I/O scheduler 'none' from inside add_disk() Peter Zijlstra <peterz(a)infradead.org> perf: Fix function pointer case D Scott Phillips <scott(a)os.amperecomputing.com> arm64: Fix bit-shifting UB in the MIDR_CPU_MODEL() macro D Scott Phillips <scott(a)os.amperecomputing.com> arm64: Add AMPERE1 to the Spectre-BHB affected list Thomas Petazzoni <thomas.petazzoni(a)bootlin.com> ASoC: cs42l51: fix driver to properly autoload with automatic module loading Pedro Tammela <pctammela(a)mojatatu.com> net/sched: sch_qfq: account for stab overhead in qfq_enqueue Filipe Manana <fdmanana(a)suse.com> btrfs: fix race between quota disable and quota assign ioctls Marcos Paulo de Souza <mpdesouza(a)suse.com> btrfs: qgroup: return ENOTCONN instead of EINVAL when quotas are not enabled Marcos Paulo de Souza <mpdesouza(a)suse.com> btrfs: qgroup: remove one-time use variables for quota_root checks Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> cpufreq: intel_pstate: Drop ACPI _PSS states table patching Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> ACPI: processor: perflib: Avoid updating frequency QoS unnecessarily Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> ACPI: processor: perflib: Use the "no limit" frequency QoS Joe Thornber <ejt(a)redhat.com> dm cache policy smq: ensure IO doesn't prevent cleaner policy progress Mark Brown <broonie(a)kernel.org> ASoC: wm8904: Fill the cache for WM8904_ADC_TEST_0 register Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: fix hanging device after quiesce/resume Jason Wang <jasowang(a)redhat.com> virtio-net: fix race between set queues and probe Filipe Manana <fdmanana(a)suse.com> btrfs: check if the transaction was aborted at btrfs_wait_for_commit() Jonas Gorski <jonas.gorski(a)gmail.com> irq-bcm6345-l1: Do not assume a fixed block to cpu mapping Alexander Steffen <Alexander.Steffen(a)infineon.com> tpm_tis: Explicitly check for error code Filipe Manana <fdmanana(a)suse.com> btrfs: check for commit error at btrfs_attach_transaction_barrier() Gilles Buloz <Gilles.Buloz(a)kontron.com> hwmon: (nct7802) Fix for temp6 (PECI1) processed even if PECI1 disabled Zhang Shurong <zhang_shurong(a)foxmail.com> staging: ks7010: potential buffer overflow in ks_wlan_set_encode_ext() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Documentation: security-bugs.rst: clarify CVE handling Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Documentation: security-bugs.rst: update preferences when dealing with the linux-distros group Dan Carpenter <dan.carpenter(a)linaro.org> Revert "usb: xhci: tegra: Fix error check" Ricardo Ribalda <ribalda(a)chromium.org> usb: xhci-mtk: set the dma max_seg_size Łukasz Bartosik <lb(a)semihalf.com> USB: quirks: add quirk for Focusrite Scarlett Guiting Shen <aarongt.shen(a)gmail.com> usb: ohci-at91: Fix the unhandle interrupt when resume Jisheng Zhang <jszhang(a)kernel.org> usb: dwc3: don't reset device side if dwc3 was configured as host-only Gratian Crisan <gratian.crisan(a)ni.com> usb: dwc3: pci: skip BYT GPIO lookup table for hardwired phy Jakub Vanek <linuxtardis(a)gmail.com> Revert "usb: dwc3: core: Enable AutoRetry feature in the controller" Marc Kleine-Budde <mkl(a)pengutronix.de> can: gs_usb: gs_can_close(): add missing set of CAN state to CAN_STATE_STOPPED Johan Hovold <johan(a)kernel.org> USB: serial: simple: sort driver entries Oliver Neukum <oneukum(a)suse.com> USB: serial: simple: add Kaufmann RKS+CAN VCP Mohsen Tahmasebi <moh53n(a)moh53n.ir> USB: serial: option: add Quectel EC200A module support Jerry Meng <jerry-meng(a)foxmail.com> USB: serial: option: support Quectel EM060K_128 Samuel Holland <samuel.holland(a)sifive.com> serial: sifive: Fix sifive_serial_console_setup() section Ruihong Luo <colorsu1922(a)gmail.com> serial: 8250_dw: Preserve original value of DLF register Zheng Yejian <zhengyejian1(a)huawei.com> tracing: Fix warning in trace_buffered_event_disable() Zheng Yejian <zhengyejian1(a)huawei.com> ring-buffer: Fix wrong stat of cpu_buffer->read Arnd Bergmann <arnd(a)arndb.de> ata: pata_ns87415: mark ns87560_tf_read static Yu Kuai <yukuai3(a)huawei.com> dm raid: fix missing reconfig_mutex unlock in raid_ctr() error paths Bart Van Assche <bvanassche(a)acm.org> block: Fix a source code comment in include/uapi/linux/blkzoned.h Matus Gajdos <matuszpd(a)gmail.com> ASoC: fsl_spdif: Silence output on stop Gaosheng Cui <cuigaosheng1(a)huawei.com> drm/msm: Fix IS_ERR_OR_NULL() vs NULL check in a5xx_submit_in_rb() Rob Clark <robdclark(a)chromium.org> drm/msm/adreno: Fix snapshot BINDLESS_DATA size Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> drm/msm/dpu: drop enum dpu_core_perf_data_bus_id Dan Carpenter <dan.carpenter(a)linaro.org> RDMA/mlx4: Make check for invalid flags stricter Yuanjun Gong <ruc_gongyuanjun(a)163.com> benet: fix return value check in be_lancer_xmit_workarounds() Lin Ma <linma(a)zju.edu.cn> net/sched: mqprio: Add length check for TCA_MQPRIO_{MAX/MIN}_RATE64 Vladimir Oltean <vladimir.oltean(a)nxp.com> net/sched: mqprio: add extack to mqprio_parse_nlattr() Vladimir Oltean <vladimir.oltean(a)nxp.com> net/sched: mqprio: refactor nlattr parsing to a separate function Maxim Mikityanskiy <maxtram95(a)gmail.com> platform/x86: msi-laptop: Fix rfkill out-of-sync on MSI Wind U100 Hangbin Liu <liuhangbin(a)gmail.com> team: reset team's flags when down link is P2P device Hangbin Liu <liuhangbin(a)gmail.com> bonding: reset bond's flags when down link is P2P device Stewart Smith <trawets(a)amazon.com> tcp: Reduce chance of collisions in inet6_hashfn(). Maciej Żenczykowski <maze(a)google.com> ipv6 addrconf: fix bug where deleting a mngtmpaddr can create a new temporary address Yuanjun Gong <ruc_gongyuanjun(a)163.com> ethernet: atheros: fix return value check in atl1e_tso_csum() Harshit Mogalapalli <harshit.m.mogalapalli(a)oracle.com> phy: hisilicon: Fix an out of bounds check in hisi_inno_phy_probe() Jiri Benc <jbenc(a)redhat.com> vxlan: calculate correct header length for GPE Wang Ming <machel(a)vivo.com> i40e: Fix an NULL vs IS_ERR() bug for debugfs_create_dir() Chao Yu <chao(a)kernel.org> ext4: fix to check return value of freeze_bdev() in ext4_shutdown() Petr Pavlu <petr.pavlu(a)suse.com> keys: Fix linking a duplicate key to a keyring's assoc_array David Howells <dhowells(a)redhat.com> uapi: General notification queue definitions Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Array index may go out of bound Ye Bin <yebin10(a)huawei.com> scsi: qla2xxx: Fix inconsistent format argument type in qla_os.c Heiner Kallweit <hkallweit1(a)gmail.com> pwm: meson: fix handling of period/duty if greater than UINT_MAX Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> pwm: meson: Simplify duplicated per-channel tracking Colin Ian King <colin.king(a)canonical.com> pwm: meson: Remove redundant assignment to variable fin_freq Zheng Yejian <zhengyejian1(a)huawei.com> ftrace: Fix possible warning on checking all pages used in ftrace_process_locs() Linus Torvalds <torvalds(a)linux-foundation.org> ftrace: Store the order of pages allocated in ftrace_page Steven Rostedt (VMware) <rostedt(a)goodmis.org> ftrace: Check if pages were allocated before calling free_pages() Steven Rostedt (VMware) <rostedt(a)goodmis.org> ftrace: Add information on number of page groups allocated Alexander Aring <aahringo(a)redhat.com> fs: dlm: interrupt posix locks only when process is killed Alexander Aring <aahringo(a)redhat.com> dlm: rearrange async condition return Alexander Aring <aahringo(a)redhat.com> dlm: cleanup plock_op vs plock_xop Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> PCI/ASPM: Avoid link retraining race Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> PCI/ASPM: Factor out pcie_wait_for_retrain() Bjorn Helgaas <bhelgaas(a)google.com> PCI/ASPM: Return 0 or -ETIMEDOUT from pcie_retrain_link() Zhihao Cheng <chengzhihao1(a)huawei.com> ext4: Fix reusing stale buffer heads from last failed mounting Chunguang Xu <brookxu(a)tencent.com> ext4: rename journal_dev to s_journal_dev inside ext4_sb_info Filipe Manana <fdmanana(a)suse.com> btrfs: fix extent buffer leak after tree mod log failure at split_node() Filipe Manana <fdmanana(a)suse.com> btrfs: fix race between quota disable and relocation Qu Wenruo <wqu(a)suse.com> btrfs: qgroup: catch reserved space leaks at unmount time Zheng Wang <zyytlz.wz(a)163.com> bcache: Fix __bch_btree_node_alloc to make the failure behavior consistent Coly Li <colyli(a)suse.de> bcache: remove 'int n' from parameter list of bch_bucket_alloc_set() Hans de Goede <hdegoede(a)redhat.com> gpio: tps68470: Make tps68470_gpio_output() always set the initial value Zhihao Cheng <chengzhihao1(a)huawei.com> jbd2: Fix wrongly judgement for buffer head removing while doing checkpoint Zhang Yi <yi.zhang(a)huawei.com> jbd2: recheck chechpointing non-dirty buffer Zhang Yi <yi.zhang(a)huawei.com> jbd2: remove redundant buffer io error checks Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> jbd2: fix kernel-doc markups Xianting Tian <xianting_tian(a)126.com> jbd2: fix incorrect code style ------------- Diffstat: Documentation/admin-guide/security-bugs.rst | 37 +++--- Makefile | 4 +- arch/arm/boot/dts/imx35.dtsi | 2 +- arch/arm/boot/dts/imx6qdl.dtsi | 6 +- arch/arm/boot/dts/imx6sl.dtsi | 5 +- arch/arm/boot/dts/imx6sll.dtsi | 34 ++--- arch/arm/boot/dts/imx6sx.dtsi | 5 +- arch/arm/boot/dts/imx6ul.dtsi | 2 + arch/arm/boot/dts/imx7d.dtsi | 6 + arch/arm/boot/dts/imx7s.dtsi | 2 + .../boot/dts/altera/socfpga_stratix10_socdk.dts | 2 +- arch/arm64/include/asm/cputype.h | 6 +- arch/arm64/kernel/cpu_errata.c | 6 + arch/powerpc/include/asm/word-at-a-time.h | 2 +- arch/powerpc/mm/init_64.c | 3 +- arch/s390/kernel/sthyi.c | 6 +- arch/s390/kvm/intercept.c | 9 +- drivers/acpi/processor_perflib.c | 42 ++++-- drivers/ata/pata_ns87415.c | 2 +- drivers/base/core.c | 44 +++++++ drivers/base/power/power.h | 8 +- drivers/base/power/runtime.c | 6 +- drivers/base/power/wakeirq.c | 111 ++++++++++++---- drivers/block/loop.c | 2 +- drivers/char/tpm/tpm_tis_core.c | 10 +- drivers/cpufreq/intel_pstate.c | 14 -- drivers/gpio/gpio-tps68470.c | 6 +- drivers/gpu/drm/msm/adreno/a5xx_gpu.c | 2 +- drivers/gpu/drm/msm/adreno/a6xx_gpu_state.h | 2 +- drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.h | 13 -- drivers/hwmon/nct7802.c | 2 +- drivers/infiniband/hw/mlx4/qp.c | 18 +-- drivers/irqchip/irq-bcm6345-l1.c | 14 +- drivers/isdn/hardware/mISDN/hfcpci.c | 10 +- drivers/md/bcache/alloc.c | 35 +++-- drivers/md/bcache/bcache.h | 4 +- drivers/md/bcache/btree.c | 6 +- drivers/md/bcache/super.c | 2 +- drivers/md/dm-cache-policy-smq.c | 28 ++-- drivers/md/dm-raid.c | 9 +- drivers/mtd/nand/raw/meson_nand.c | 3 +- drivers/mtd/nand/raw/omap_elm.c | 24 ++-- drivers/mtd/nand/spi/toshiba.c | 4 +- drivers/net/bonding/bond_main.c | 5 + drivers/net/can/usb/gs_usb.c | 2 + drivers/net/ethernet/atheros/atl1e/atl1e_main.c | 7 +- drivers/net/ethernet/emulex/benet/be_main.c | 3 +- drivers/net/ethernet/intel/i40e/i40e_debugfs.c | 2 +- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 2 +- .../mellanox/mlx5/core/en_accel/ipsec_rxtx.c | 4 +- .../ethernet/mellanox/mlx5/core/steering/dr_cmd.c | 5 +- drivers/net/ethernet/xilinx/ll_temac_main.c | 16 +-- drivers/net/tap.c | 2 +- drivers/net/team/team.c | 9 ++ drivers/net/tun.c | 2 +- drivers/net/usb/cdc_ether.c | 21 +++ drivers/net/usb/usbnet.c | 6 + drivers/net/usb/zaurus.c | 21 +++ drivers/net/virtio_net.c | 4 +- drivers/net/vxlan.c | 22 ++-- drivers/pci/pcie/aspm.c | 55 +++++--- drivers/phy/hisilicon/phy-hisi-inno-usb2.c | 2 +- drivers/platform/x86/msi-laptop.c | 8 +- drivers/pwm/pwm-meson.c | 27 ++-- drivers/s390/block/dasd_ioctl.c | 1 + drivers/s390/scsi/zfcp_fc.c | 6 +- drivers/scsi/qla2xxx/qla_os.c | 5 +- drivers/staging/ks7010/ks_wlan_net.c | 6 +- drivers/tty/serial/8250/8250_dwlib.c | 6 +- drivers/tty/serial/sifive.c | 2 +- drivers/usb/core/quirks.c | 4 + drivers/usb/dwc3/core.c | 20 +-- drivers/usb/dwc3/core.h | 3 - drivers/usb/dwc3/dwc3-pci.c | 6 +- drivers/usb/host/ohci-at91.c | 8 +- drivers/usb/host/xhci-mtk.c | 1 + drivers/usb/host/xhci-tegra.c | 8 +- drivers/usb/serial/option.c | 6 + drivers/usb/serial/usb-serial-simple.c | 73 ++++++----- fs/btrfs/ctree.c | 2 + fs/btrfs/disk-io.c | 5 + fs/btrfs/ioctl.c | 2 + fs/btrfs/qgroup.c | 116 ++++++++++++----- fs/btrfs/qgroup.h | 1 + fs/btrfs/transaction.c | 10 +- fs/ceph/caps.c | 17 +++ fs/ceph/debugfs.c | 13 ++ fs/ceph/mds_client.c | 5 +- fs/ceph/mds_client.h | 14 ++ fs/ceph/super.c | 14 +- fs/dlm/plock.c | 100 ++++++++------ fs/ext2/ext2.h | 12 -- fs/ext2/super.c | 23 +--- fs/ext4/ext4.h | 2 +- fs/ext4/fsmap.c | 8 +- fs/ext4/ioctl.c | 5 +- fs/ext4/super.c | 25 ++-- fs/jbd2/checkpoint.c | 137 ++++++-------------- fs/jbd2/journal.c | 42 +++--- fs/jbd2/transaction.c | 31 ++--- fs/super.c | 11 +- fs/sysv/itree.c | 4 + include/asm-generic/word-at-a-time.h | 2 +- include/linux/device.h | 3 + include/linux/jbd2.h | 2 +- include/linux/pm_wakeirq.h | 9 +- include/net/ipv6.h | 8 +- include/net/vxlan.h | 13 +- include/uapi/linux/blkzoned.h | 10 +- include/uapi/linux/watch_queue.h | 55 ++++++++ kernel/events/core.c | 8 +- kernel/trace/ftrace.c | 75 ++++++++--- kernel/trace/ring_buffer.c | 22 ++-- kernel/trace/trace.c | 21 ++- kernel/trace/trace.h | 2 + kernel/trace/trace_events.c | 14 +- lib/test_firmware.c | 49 ++++--- net/bluetooth/l2cap_sock.c | 2 + net/ceph/osd_client.c | 20 ++- net/core/rtnetlink.c | 8 +- net/core/sock.c | 21 +-- net/core/sock_map.c | 2 - net/dcb/dcbnl.c | 2 +- net/ipv4/tcp_metrics.c | 70 ++++++---- net/ipv6/addrconf.c | 14 +- net/ipv6/ip6mr.c | 2 +- net/sched/cls_fw.c | 1 - net/sched/cls_route.c | 1 - net/sched/cls_u32.c | 57 +++++++- net/sched/sch_mqprio.c | 144 +++++++++++++-------- net/sched/sch_qfq.c | 7 +- net/unix/af_unix.c | 2 +- security/keys/request_key.c | 35 +++-- sound/soc/codecs/cs42l51-i2c.c | 6 + sound/soc/codecs/cs42l51.c | 7 - sound/soc/codecs/cs42l51.h | 1 - sound/soc/codecs/wm8904.c | 3 + sound/soc/fsl/fsl_spdif.c | 2 + .../tests/shell/test_uprobe_from_different_cu.sh | 8 +- tools/testing/selftests/rseq/rseq.c | 31 ++++- 140 files changed, 1444 insertions(+), 832 deletions(-)

1 year, 4 months

6
159
0 0

Re: [PATCH 6.4 000/206] 6.4.11-rc1 review

by Ronald Warsow

Hi Greg 6.4.11-rc1 compiles, boots and runs here on x86_64 (Intel Rocket Lake, i5-11400) Thanks Tested-by: Ronald Warsow <rwarsow(a)gmx.de>

1 year, 4 months

1
0
0 0

[PATCH Wacom EKR Battery Fixes 0/3]

by Aaron Armstrong Skomra

Currently the ExpressKey Remote battery will persist indefinitely in /sys/class/power_supply. Remove the battery when we stop getting reports from the device. Also remove some unneccessary code and make an EKR struct name more descriptive. Only the bugfix in the first patch will be sent to stable. Aaron Armstrong Skomra (3): HID: wacom: remove the battery when the EKR is off HID: wacom: remove unnecessary 'connected' variable from EKR HID: wacom: struct name cleanup drivers/hid/wacom.h | 1 + drivers/hid/wacom_sys.c | 44 +++++++++++++++++++++++++++++------------ drivers/hid/wacom_wac.c | 7 +++---- drivers/hid/wacom_wac.h | 4 ++-- 4 files changed, 37 insertions(+), 19 deletions(-) -- 2.34.1

1 year, 4 months

2
1
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror August 2023