The patch below does not apply to the 5.15-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 64620e0a1e712a778095bd35cbb277dc2259281f Mon Sep 17 00:00:00 2001
From: Daniel Borkmann <daniel(a)iogearbox.net>
Date: Tue, 11 Jan 2022 14:43:41 +0000
Subject: [PATCH] bpf: Fix out of bounds access for ringbuf helpers
Both bpf_ringbuf_submit() and bpf_ringbuf_discard() have ARG_PTR_TO_ALLOC_MEM
in their bpf_func_proto definition as their first argument. They both expect
the result from a prior bpf_ringbuf_reserve() call which has a return type of
RET_PTR_TO_ALLOC_MEM_OR_NULL.
Meaning, after a NULL check in the code, the verifier will promote the register
type in the non-NULL branch to a PTR_TO_MEM and in the NULL branch to a known
zero scalar. Generally, pointer arithmetic on PTR_TO_MEM is allowed, so the
latter could have an offset.
The ARG_PTR_TO_ALLOC_MEM expects a PTR_TO_MEM register type. However, the non-
zero result from bpf_ringbuf_reserve() must be fed into either bpf_ringbuf_submit()
or bpf_ringbuf_discard() but with the original offset given it will then read
out the struct bpf_ringbuf_hdr mapping.
The verifier missed to enforce a zero offset, so that out of bounds access
can be triggered which could be used to escalate privileges if unprivileged
BPF was enabled (disabled by default in kernel).
Fixes: 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support for it")
Reported-by: <tr3e.wang(a)gmail.com> (SecCoder Security Lab)
Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net>
Acked-by: John Fastabend <john.fastabend(a)gmail.com>
Acked-by: Alexei Starovoitov <ast(a)kernel.org>
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index e0b3f4d683eb..c72c57a6684f 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -5318,9 +5318,15 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
case PTR_TO_BUF:
case PTR_TO_BUF | MEM_RDONLY:
case PTR_TO_STACK:
+ /* Some of the argument types nevertheless require a
+ * zero register offset.
+ */
+ if (arg_type == ARG_PTR_TO_ALLOC_MEM)
+ goto force_off_check;
break;
/* All the rest must be rejected: */
default:
+force_off_check:
err = __check_ptr_off_reg(env, reg, regno,
type == PTR_TO_BTF_ID);
if (err < 0)
This is the start of the stable review cycle for the 6.6.28 release.
There are 122 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 17 Apr 2024 14:19:30 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.28-rc1…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 6.6.28-rc1
Fudongwang <fudong.wang(a)amd.com>
drm/amd/display: fix disable otg wa logic in DCN316
Harry Wentland <harry.wentland(a)amd.com>
drm/amd/display: Set VSC SDP Colorimetry same way for MST and SST
Harry Wentland <harry.wentland(a)amd.com>
drm/amd/display: Program VSC SDP colorimetry for all DP sinks >= 1.4
Tim Huang <Tim.Huang(a)amd.com>
drm/amdgpu: fix incorrect number of active RBs for gfx11
Alex Deucher <alexander.deucher(a)amd.com>
drm/amdgpu: always force full reset for SOC21
Lijo Lazar <lijo.lazar(a)amd.com>
drm/amdgpu: Reset dGPU if suspend got aborted
Ville Syrjälä <ville.syrjala(a)linux.intel.com>
drm/i915: Disable port sync when bigjoiner is used
Ville Syrjälä <ville.syrjala(a)linux.intel.com>
drm/i915/cdclk: Fix CDCLK programming order when pipes are active
Josh Poimboeuf <jpoimboe(a)kernel.org>
x86/bugs: Replace CONFIG_SPECTRE_BHI_{ON,OFF} with CONFIG_MITIGATION_SPECTRE_BHI
Josh Poimboeuf <jpoimboe(a)kernel.org>
x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto
Josh Poimboeuf <jpoimboe(a)kernel.org>
x86/bugs: Clarify that syscall hardening isn't a BHI mitigation
Josh Poimboeuf <jpoimboe(a)kernel.org>
x86/bugs: Fix BHI handling of RRSBA
Ingo Molnar <mingo(a)kernel.org>
x86/bugs: Rename various 'ia32_cap' variables to 'x86_arch_cap_msr'
Josh Poimboeuf <jpoimboe(a)kernel.org>
x86/bugs: Cache the value of MSR_IA32_ARCH_CAPABILITIES
Josh Poimboeuf <jpoimboe(a)kernel.org>
x86/bugs: Fix BHI documentation
Daniel Sneddon <daniel.sneddon(a)linux.intel.com>
x86/bugs: Fix return type of spectre_bhi_state()
Arnd Bergmann <arnd(a)arndb.de>
irqflags: Explicitly ignore lockdep_hrtimer_exit() argument
Adam Dunlap <acdunlap(a)google.com>
x86/apic: Force native_apic_mem_read() to use the MOV instruction
John Stultz <jstultz(a)google.com>
selftests: timers: Fix abs() warning in posix_timers test
Sean Christopherson <seanjc(a)google.com>
x86/cpu: Actually turn off mitigations by default for SPECULATION_MITIGATIONS=n
Namhyung Kim <namhyung(a)kernel.org>
perf/x86: Fix out of range data
Gavin Shan <gshan(a)redhat.com>
vhost: Add smp_rmb() in vhost_enable_notify()
Gavin Shan <gshan(a)redhat.com>
vhost: Add smp_rmb() in vhost_vq_avail_empty()
Frank Li <Frank.Li(a)nxp.com>
arm64: dts: imx8-ss-dma: fix spi lpcg indices
Frank Li <Frank.Li(a)nxp.com>
arm64: dts: imx8-ss-lsio: fix pwm lpcg indices
Frank Li <Frank.Li(a)nxp.com>
arm64: dts: imx8-ss-conn: fix usb lpcg indices
Frank Li <Frank.Li(a)nxp.com>
arm64: dts: imx8-ss-dma: fix adc lpcg indices
Frank Li <Frank.Li(a)nxp.com>
arm64: dts: imx8-ss-dma: fix can lpcg indices
Frank Li <Frank.Li(a)nxp.com>
arm64: dts: imx8qm-ss-dma: fix can lpcg indices
Ville Syrjälä <ville.syrjala(a)linux.intel.com>
drm/client: Fully protect modes[] with dev->mode_config.mutex
Boris Brezillon <boris.brezillon(a)collabora.com>
drm/panfrost: Fix the error path in panfrost_mmu_map_fault_addr()
Jammy Huang <jammy_huang(a)aspeedtech.com>
drm/ast: Fix soft lockup
Harish Kasiviswanathan <Harish.Kasiviswanathan(a)amd.com>
drm/amdkfd: Reset GPU on queue preemption failure
Ville Syrjälä <ville.syrjala(a)linux.intel.com>
drm/i915/vrr: Disable VRR when using bigjoiner
Zack Rusin <zack.rusin(a)broadcom.com>
drm/vmwgfx: Enable DMA mappings with SEV
Jacek Lawrynowicz <jacek.lawrynowicz(a)linux.intel.com>
accel/ivpu: Fix deadlock in context_xa
Alexander Wetzel <Alexander(a)wetzel-home.de>
scsi: sg: Avoid race in error handling & drop bogus warn
Alexander Wetzel <Alexander(a)wetzel-home.de>
scsi: sg: Avoid sg device teardown race
Zheng Yejian <zhengyejian1(a)huawei.com>
kprobes: Fix possible use-after-free issue on kprobe registration
Pavel Begunkov <asml.silence(a)gmail.com>
io_uring/net: restore msg_control on sendzc retry
Boris Burkov <boris(a)bur.io>
btrfs: qgroup: convert PREALLOC to PERTRANS after record_root_in_trans
Boris Burkov <boris(a)bur.io>
btrfs: record delayed inode root in transaction
Boris Burkov <boris(a)bur.io>
btrfs: qgroup: fix qgroup prealloc rsv leak in subvolume operations
Boris Burkov <boris(a)bur.io>
btrfs: qgroup: correctly model root qgroup rsv in convert
Geliang Tang <tanggeliang(a)kylinos.cn>
selftests: mptcp: use += operator to append strings
Jacob Pan <jacob.jun.pan(a)linux.intel.com>
iommu/vt-d: Allocate local memory for page request queue
Xuchun Shang <xuchun.shang(a)linux.alibaba.com>
iommu/vt-d: Fix wrong use of pasid config
Arnd Bergmann <arnd(a)arndb.de>
tracing: hide unused ftrace_event_id_fops
David Arinzon <darinzon(a)amazon.com>
net: ena: Set tx_info->xdpf value to NULL
David Arinzon <darinzon(a)amazon.com>
net: ena: Use tx_ring instead of xdp_ring for XDP channel TX
David Arinzon <darinzon(a)amazon.com>
net: ena: Pass ena_adapter instead of net_device to ena_xmit_common()
David Arinzon <darinzon(a)amazon.com>
net: ena: Move XDP code to its new files
David Arinzon <darinzon(a)amazon.com>
net: ena: Fix incorrect descriptor free behavior
David Arinzon <darinzon(a)amazon.com>
net: ena: Wrong missing IO completions check order
David Arinzon <darinzon(a)amazon.com>
net: ena: Fix potential sign extension issue
Michal Luczaj <mhal(a)rbox.co>
af_unix: Fix garbage collector racing against connect()
Kuniyuki Iwashima <kuniyu(a)amazon.com>
af_unix: Do not use atomic ops for unix_sk(sk)->inflight.
Arınç ÜNAL <arinc.unal(a)arinc9.com>
net: dsa: mt7530: trap link-local frames regardless of ST Port State
Gerd Bayer <gbayer(a)linux.ibm.com>
Revert "s390/ism: fix receive message buffer allocation"
Daniel Machon <daniel.machon(a)microchip.com>
net: sparx5: fix wrong config being used when reconfiguring PCS
Rahul Rameshbabu <rrameshbabu(a)nvidia.com>
net/mlx5e: Do not produce metadata freelist entries in Tx port ts WQE xmit
Carolina Jubran <cjubran(a)nvidia.com>
net/mlx5e: HTB, Fix inconsistencies with QoS SQs number
Carolina Jubran <cjubran(a)nvidia.com>
net/mlx5e: Fix mlx5e_priv_init() cleanup flow
Cosmin Ratiu <cratiu(a)nvidia.com>
net/mlx5: Correctly compare pkt reformat ids
Cosmin Ratiu <cratiu(a)nvidia.com>
net/mlx5: Properly link new fs rules into the tree
Michael Liang <mliang(a)purestorage.com>
net/mlx5: offset comp irq index in name by one
Shay Drory <shayd(a)nvidia.com>
net/mlx5: Register devlink first under devlink lock
Moshe Shemesh <moshe(a)nvidia.com>
net/mlx5: SF, Stop waiting for FW as teardown was called
Eric Dumazet <edumazet(a)google.com>
netfilter: complete validation of user input
Archie Pusaka <apusaka(a)chromium.org>
Bluetooth: l2cap: Don't double set the HCI_CONN_MGMT_CONNECTED bit
Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com>
Bluetooth: SCO: Fix not validating setsockopt user input
Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com>
Bluetooth: hci_sync: Fix using the same interval and window for Coded PHY
Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com>
Bluetooth: hci_sync: Use QoS to determine which PHY to scan
Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com>
Bluetooth: ISO: Don't reject BT_ISO_QOS if parameters are unset
Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com>
Bluetooth: ISO: Align broadcast sync_timeout with connection timeout
Jiri Benc <jbenc(a)redhat.com>
ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr
Arnd Bergmann <arnd(a)arndb.de>
ipv4/route: avoid unused-but-set-variable warning
Arnd Bergmann <arnd(a)arndb.de>
ipv6: fib: hide unused 'pn' variable
Geetha sowjanya <gakula(a)marvell.com>
octeontx2-af: Fix NIX SQ mode and BP config
Kuniyuki Iwashima <kuniyu(a)amazon.com>
af_unix: Clear stale u->oob_skb.
Marek Vasut <marex(a)denx.de>
net: ks8851: Handle softirqs at the end of IRQ thread to fix hang
Marek Vasut <marex(a)denx.de>
net: ks8851: Inline ks8851_rx_skb()
Pavan Chebbi <pavan.chebbi(a)broadcom.com>
bnxt_en: Reset PTP tx_avail after possible firmware reset
Vikas Gupta <vikas.gupta(a)broadcom.com>
bnxt_en: Fix error recovery for RoCE ulp client
Vikas Gupta <vikas.gupta(a)broadcom.com>
bnxt_en: Fix possible memory leak in bnxt_rdma_aux_device_init()
Gerd Bayer <gbayer(a)linux.ibm.com>
s390/ism: fix receive message buffer allocation
Eric Dumazet <edumazet(a)google.com>
geneve: fix header validation in geneve[6]_xmit_skb
Ming Lei <ming.lei(a)redhat.com>
block: fix q->blkg_list corruption during disk rebind
Hariprasad Kelam <hkelam(a)marvell.com>
octeontx2-pf: Fix transmit scheduler resource leak
Eric Dumazet <edumazet(a)google.com>
xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING
Petr Tesarik <petr(a)tesarici.cz>
u64_stats: fix u64_stats_init() for lockdep when used repeatedly in one file
Ilya Maximets <i.maximets(a)ovn.org>
net: openvswitch: fix unwanted error log on timeout policy probing
Dan Carpenter <dan.carpenter(a)linaro.org>
scsi: qla2xxx: Fix off by one in qla_edif_app_getstats()
Xiang Chen <chenxiang66(a)hisilicon.com>
scsi: hisi_sas: Modify the deadline for ata_wait_after_reset()
Arnd Bergmann <arnd(a)arndb.de>
nouveau: fix function cast warning
Alex Constantino <dreaming.about.electric.sheep(a)gmail.com>
Revert "drm/qxl: simplify qxl_fence_wait"
Kwangjin Ko <kwangjin.ko(a)sk.com>
cxl/core: Fix initialization of mbox_cmd.size_out in get event
Frank Li <Frank.Li(a)nxp.com>
arm64: dts: imx8-ss-conn: fix usdhc wrong lpcg clock order
Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org>
drm/msm/dpu: don't allow overriding data from catalog
Dave Jiang <dave.jiang(a)intel.com>
cxl/core/regs: Fix usage of map->reg_type in cxl_decode_regblock() before assigned
Yuquan Wang <wangyuquan1236(a)phytium.com.cn>
cxl/mem: Fix for the index of Clear Event Record Handle
Cristian Marussi <cristian.marussi(a)arm.com>
firmware: arm_scmi: Make raw debugfs entries non-seekable
Aaro Koskinen <aaro.koskinen(a)iki.fi>
ARM: OMAP2+: fix USB regression on Nokia N8x0
Aaro Koskinen <aaro.koskinen(a)iki.fi>
mmc: omap: restore original power up/down steps
Aaro Koskinen <aaro.koskinen(a)iki.fi>
mmc: omap: fix deferred probe
Aaro Koskinen <aaro.koskinen(a)iki.fi>
mmc: omap: fix broken slot switch lookup
Aaro Koskinen <aaro.koskinen(a)iki.fi>
ARM: OMAP2+: fix N810 MMC gpiod table
Aaro Koskinen <aaro.koskinen(a)iki.fi>
ARM: OMAP2+: fix bogus MMC GPIO labels on Nokia N8x0
Nini Song <nini.song(a)mediatek.com>
media: cec: core: remove length check of Timer Status
Anna-Maria Behnsen <anna-maria(a)linutronix.de>
PM: s2idle: Make sure CPUs will wakeup directly on resume
Hans de Goede <hdegoede(a)redhat.com>
ACPI: scan: Do not increase dep_unmet for already met dependencies
Noah Loomans <noah(a)noahloomans.com>
platform/chrome: cros_ec_uart: properly fix race condition
Tim Huang <Tim.Huang(a)amd.com>
drm/amd/pm: fixes a random hang in S4 for SMU v13.0.4/11
Dmitry Antipov <dmantipov(a)yandex.ru>
Bluetooth: Fix memory leak in hci_req_sync_complete()
Steven Rostedt (Google) <rostedt(a)goodmis.org>
ring-buffer: Only update pages_touched when a new page is touched
Yu Kuai <yukuai3(a)huawei.com>
raid1: fix use-after-free for original bio in raid1_write_request()
Fabio Estevam <festevam(a)denx.de>
ARM: dts: imx7s-warp: Pass OV2680 link-frequencies
Gavin Shan <gshan(a)redhat.com>
arm64: tlb: Fix TLBI RANGE operand
Sven Eckelmann <sven(a)narfation.org>
batman-adv: Avoid infinite loop trying to resize local TT
Damien Le Moal <dlemoal(a)kernel.org>
ata: libata-scsi: Fix ata_scsi_dev_rescan() error path
Igor Pylypiv <ipylypiv(a)google.com>
ata: libata-core: Allow command duration limits detection for ACS-4 drives
Steve French <stfrench(a)microsoft.com>
smb3: fix Open files on server counter going negative
-------------
Diffstat:
Documentation/admin-guide/hw-vuln/spectre.rst | 22 +-
Documentation/admin-guide/kernel-parameters.txt | 12 +-
.../device_drivers/ethernet/amazon/ena.rst | 1 +
Makefile | 4 +-
arch/arm/boot/dts/nxp/imx/imx7s-warp.dts | 1 +
arch/arm/mach-omap2/board-n8x0.c | 23 +-
arch/arm64/boot/dts/freescale/imx8-ss-conn.dtsi | 16 +-
arch/arm64/boot/dts/freescale/imx8-ss-dma.dtsi | 36 +-
arch/arm64/boot/dts/freescale/imx8-ss-lsio.dtsi | 16 +-
arch/arm64/boot/dts/freescale/imx8qm-ss-dma.dtsi | 8 +-
arch/arm64/include/asm/tlbflush.h | 20 +-
arch/x86/Kconfig | 21 +-
arch/x86/events/core.c | 1 +
arch/x86/include/asm/apic.h | 3 +-
arch/x86/kernel/apic/apic.c | 6 +-
arch/x86/kernel/cpu/bugs.c | 82 ++-
arch/x86/kernel/cpu/common.c | 48 +-
block/blk-cgroup.c | 9 +-
block/blk-cgroup.h | 2 +
block/blk-core.c | 2 +
drivers/accel/ivpu/ivpu_drv.c | 2 +-
drivers/acpi/scan.c | 3 +-
drivers/ata/libata-core.c | 2 +-
drivers/ata/libata-scsi.c | 9 +-
drivers/cxl/core/mbox.c | 5 +-
drivers/cxl/core/regs.c | 5 +-
drivers/firmware/arm_scmi/raw_mode.c | 7 +-
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 2 +-
drivers/gpu/drm/amd/amdgpu/soc21.c | 27 +-
.../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 1 +
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 15 +-
.../amd/display/dc/clk_mgr/dcn316/dcn316_clk_mgr.c | 19 +-
.../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_4_ppt.c | 12 +-
drivers/gpu/drm/ast/ast_dp.c | 3 +
drivers/gpu/drm/drm_client_modeset.c | 3 +-
drivers/gpu/drm/i915/display/intel_cdclk.c | 7 +-
drivers/gpu/drm/i915/display/intel_cdclk.h | 3 +
drivers/gpu/drm/i915/display/intel_ddi.c | 5 +
drivers/gpu/drm/i915/display/intel_vrr.c | 7 +
drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c | 10 +-
.../gpu/drm/nouveau/nvkm/subdev/bios/shadowof.c | 7 +-
drivers/gpu/drm/panfrost/panfrost_mmu.c | 13 +-
drivers/gpu/drm/qxl/qxl_release.c | 50 +-
drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 11 +-
drivers/iommu/intel/perfmon.c | 2 +-
drivers/iommu/intel/svm.c | 2 +-
drivers/md/raid1.c | 2 +-
drivers/media/cec/core/cec-adap.c | 14 -
drivers/mmc/host/omap.c | 48 +-
drivers/net/dsa/mt7530.c | 229 ++++++-
drivers/net/dsa/mt7530.h | 5 +
drivers/net/ethernet/amazon/ena/Makefile | 2 +-
drivers/net/ethernet/amazon/ena/ena_com.c | 2 +-
drivers/net/ethernet/amazon/ena/ena_ethtool.c | 1 +
drivers/net/ethernet/amazon/ena/ena_netdev.c | 688 ++-------------------
drivers/net/ethernet/amazon/ena/ena_netdev.h | 83 +--
drivers/net/ethernet/amazon/ena/ena_xdp.c | 466 ++++++++++++++
drivers/net/ethernet/amazon/ena/ena_xdp.h | 152 +++++
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +
drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c | 6 +-
.../net/ethernet/marvell/octeontx2/af/rvu_nix.c | 22 +-
drivers/net/ethernet/marvell/octeontx2/nic/qos.c | 1 +
drivers/net/ethernet/mellanox/mlx5/core/en/ptp.h | 8 +-
drivers/net/ethernet/mellanox/mlx5/core/en/qos.c | 33 +-
drivers/net/ethernet/mellanox/mlx5/core/en/selq.c | 2 +
drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 2 -
drivers/net/ethernet/mellanox/mlx5/core/en_tx.c | 7 +-
drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 17 +-
drivers/net/ethernet/mellanox/mlx5/core/main.c | 37 +-
drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c | 4 +-
.../ethernet/mellanox/mlx5/core/sf/dev/driver.c | 22 +-
drivers/net/ethernet/micrel/ks8851.h | 3 -
drivers/net/ethernet/micrel/ks8851_common.c | 16 +-
drivers/net/ethernet/micrel/ks8851_par.c | 11 -
drivers/net/ethernet/micrel/ks8851_spi.c | 11 -
.../net/ethernet/microchip/sparx5/sparx5_port.c | 4 +-
drivers/net/geneve.c | 4 +-
drivers/platform/chrome/cros_ec_uart.c | 28 +-
drivers/scsi/hisi_sas/hisi_sas_main.c | 2 +-
drivers/scsi/qla2xxx/qla_edif.c | 2 +-
drivers/scsi/sg.c | 20 +-
drivers/vhost/vhost.c | 28 +-
fs/btrfs/delayed-inode.c | 3 +
fs/btrfs/inode.c | 13 +-
fs/btrfs/ioctl.c | 37 +-
fs/btrfs/qgroup.c | 2 +
fs/btrfs/root-tree.c | 10 -
fs/btrfs/root-tree.h | 2 -
fs/btrfs/transaction.c | 17 +-
fs/smb/client/cached_dir.c | 4 +-
include/linux/dma-fence.h | 7 +
include/linux/irqflags.h | 2 +-
include/linux/u64_stats_sync.h | 9 +-
include/net/addrconf.h | 4 +
include/net/af_unix.h | 2 +-
include/net/bluetooth/bluetooth.h | 11 +
include/net/ip_tunnels.h | 33 +
io_uring/net.c | 1 +
kernel/cpu.c | 3 +-
kernel/kprobes.c | 18 +-
kernel/power/suspend.c | 6 +
kernel/trace/ring_buffer.c | 6 +-
kernel/trace/trace_events.c | 4 +
net/batman-adv/translation-table.c | 2 +-
net/bluetooth/hci_request.c | 4 +-
net/bluetooth/hci_sync.c | 66 +-
net/bluetooth/iso.c | 14 +-
net/bluetooth/l2cap_core.c | 3 +-
net/bluetooth/sco.c | 23 +-
net/ipv4/netfilter/arp_tables.c | 4 +
net/ipv4/netfilter/ip_tables.c | 4 +
net/ipv4/route.c | 4 +-
net/ipv6/addrconf.c | 7 +-
net/ipv6/ip6_fib.c | 7 +-
net/ipv6/netfilter/ip6_tables.c | 4 +
net/openvswitch/conntrack.c | 5 +-
net/unix/af_unix.c | 8 +-
net/unix/garbage.c | 35 +-
net/unix/scm.c | 8 +-
net/xdp/xsk.c | 2 +
tools/testing/selftests/net/mptcp/mptcp_connect.sh | 53 +-
tools/testing/selftests/net/mptcp/mptcp_join.sh | 30 +-
tools/testing/selftests/timers/posix_timers.c | 2 +-
123 files changed, 1765 insertions(+), 1263 deletions(-)
The patch below does not apply to the 5.10-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y
git checkout FETCH_HEAD
git cherry-pick -x a4833e3abae132d613ce7da0e0c9a9465d1681fa
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024041925-walnut-flammable-adf1@gregkh' --subject-prefix 'PATCH 5.10.y' HEAD^..
Possible dependencies:
a4833e3abae1 ("SUNRPC: Fix rpcgss_context trace event acceptor field")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From a4833e3abae132d613ce7da0e0c9a9465d1681fa Mon Sep 17 00:00:00 2001
From: "Steven Rostedt (Google)" <rostedt(a)goodmis.org>
Date: Wed, 10 Apr 2024 12:38:13 -0400
Subject: [PATCH] SUNRPC: Fix rpcgss_context trace event acceptor field
The rpcgss_context trace event acceptor field is a dynamically sized
string that records the "data" parameter. But this parameter is also
dependent on the "len" field to determine the size of the data.
It needs to use __string_len() helper macro where the length can be passed
in. It also incorrectly uses strncpy() to save it instead of
__assign_str(). As these macros can change, it is not wise to open code
them in trace events.
As of commit c759e609030c ("tracing: Remove __assign_str_len()"),
__assign_str() can be used for both __string() and __string_len() fields.
Before that commit, __assign_str_len() is required to be used. This needs
to be noted for backporting. (In actuality, commit c1fa617caeb0 ("tracing:
Rework __assign_str() and __string() to not duplicate getting the string")
is the commit that makes __string_str_len() obsolete).
Cc: stable(a)vger.kernel.org
Fixes: 0c77668ddb4e ("SUNRPC: Introduce trace points in rpc_auth_gss.ko")
Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org>
Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com>
diff --git a/include/trace/events/rpcgss.h b/include/trace/events/rpcgss.h
index ba2d96a1bc2f..f50fcafc69de 100644
--- a/include/trace/events/rpcgss.h
+++ b/include/trace/events/rpcgss.h
@@ -609,7 +609,7 @@ TRACE_EVENT(rpcgss_context,
__field(unsigned int, timeout)
__field(u32, window_size)
__field(int, len)
- __string(acceptor, data)
+ __string_len(acceptor, data, len)
),
TP_fast_assign(
@@ -618,7 +618,7 @@ TRACE_EVENT(rpcgss_context,
__entry->timeout = timeout;
__entry->window_size = window_size;
__entry->len = len;
- strncpy(__get_str(acceptor), data, len);
+ __assign_str(acceptor, data);
),
TP_printk("win_size=%u expiry=%lu now=%lu timeout=%u acceptor=%.*s",
The patch below does not apply to the 5.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.4.y
git checkout FETCH_HEAD
git cherry-pick -x a4833e3abae132d613ce7da0e0c9a9465d1681fa
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024041953-duration-fructose-0bc1@gregkh' --subject-prefix 'PATCH 5.4.y' HEAD^..
Possible dependencies:
a4833e3abae1 ("SUNRPC: Fix rpcgss_context trace event acceptor field")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From a4833e3abae132d613ce7da0e0c9a9465d1681fa Mon Sep 17 00:00:00 2001
From: "Steven Rostedt (Google)" <rostedt(a)goodmis.org>
Date: Wed, 10 Apr 2024 12:38:13 -0400
Subject: [PATCH] SUNRPC: Fix rpcgss_context trace event acceptor field
The rpcgss_context trace event acceptor field is a dynamically sized
string that records the "data" parameter. But this parameter is also
dependent on the "len" field to determine the size of the data.
It needs to use __string_len() helper macro where the length can be passed
in. It also incorrectly uses strncpy() to save it instead of
__assign_str(). As these macros can change, it is not wise to open code
them in trace events.
As of commit c759e609030c ("tracing: Remove __assign_str_len()"),
__assign_str() can be used for both __string() and __string_len() fields.
Before that commit, __assign_str_len() is required to be used. This needs
to be noted for backporting. (In actuality, commit c1fa617caeb0 ("tracing:
Rework __assign_str() and __string() to not duplicate getting the string")
is the commit that makes __string_str_len() obsolete).
Cc: stable(a)vger.kernel.org
Fixes: 0c77668ddb4e ("SUNRPC: Introduce trace points in rpc_auth_gss.ko")
Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org>
Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com>
diff --git a/include/trace/events/rpcgss.h b/include/trace/events/rpcgss.h
index ba2d96a1bc2f..f50fcafc69de 100644
--- a/include/trace/events/rpcgss.h
+++ b/include/trace/events/rpcgss.h
@@ -609,7 +609,7 @@ TRACE_EVENT(rpcgss_context,
__field(unsigned int, timeout)
__field(u32, window_size)
__field(int, len)
- __string(acceptor, data)
+ __string_len(acceptor, data, len)
),
TP_fast_assign(
@@ -618,7 +618,7 @@ TRACE_EVENT(rpcgss_context,
__entry->timeout = timeout;
__entry->window_size = window_size;
__entry->len = len;
- strncpy(__get_str(acceptor), data, len);
+ __assign_str(acceptor, data);
),
TP_printk("win_size=%u expiry=%lu now=%lu timeout=%u acceptor=%.*s",
From: Ard Biesheuvel <ardb(a)kernel.org>
This is the final batch of changes to bring linux-6.1.y in sync with
6.6 and later in terms of compatibility with tightened boot security
requirements imposed by MicroSoft, compliance with which is a
prerequisite for them to be willing to resume signing distro shim images
with the MS 3rd party secure boot certificate.
Without this, distros can only boot on off-the-shelf x86 PCs after
disabling secure boot explicitly.
Most of these changes appeared in v6.8 and have been backported to v6.6
already.
Ard Biesheuvel (20):
x86/efi: Drop EFI stub .bss from .data section
x86/efi: Disregard setup header of loaded image
x86/efistub: Reinstate soft limit for initrd loading
x86/efi: Drop alignment flags from PE section headers
x86/boot: Remove the 'bugger off' message
x86/boot: Omit compression buffer from PE/COFF image memory footprint
x86/boot: Drop redundant code setting the root device
x86/boot: Drop references to startup_64
x86/boot: Grab kernel_info offset from zoffset header directly
x86/boot: Set EFI handover offset directly in header asm
x86/boot: Define setup size in linker script
x86/boot: Derive file size from _edata symbol
x86/boot: Construct PE/COFF .text section from assembler
x86/boot: Drop PE/COFF .reloc section
x86/boot: Split off PE/COFF .data section
x86/boot: Increase section and file alignment to 4k/512
x86/efistub: Use 1:1 file:memory mapping for PE/COFF .compat section
x86/sme: Move early SME kernel encryption handling into .head.text
x86/sev: Move early startup code into .head.text section
x86/efistub: Remap kernel text read-only before dropping NX attribute
Hou Wenlong (2):
x86/head/64: Add missing __head annotation to startup_64_load_idt()
x86/head/64: Move the __head definition to <asm/init.h>
Pasha Tatashin (1):
x86/mm: Remove P*D_PAGE_MASK and P*D_PAGE_SIZE macros
arch/x86/boot/Makefile | 2 +-
arch/x86/boot/compressed/Makefile | 2 +-
arch/x86/boot/compressed/misc.c | 1 +
arch/x86/boot/compressed/sev.c | 3 +
arch/x86/boot/compressed/vmlinux.lds.S | 6 +-
arch/x86/boot/header.S | 211 ++++++---------
arch/x86/boot/setup.ld | 14 +-
arch/x86/boot/tools/build.c | 273 +-------------------
arch/x86/include/asm/boot.h | 1 +
arch/x86/include/asm/init.h | 2 +
arch/x86/include/asm/mem_encrypt.h | 8 +-
arch/x86/include/asm/page_types.h | 12 +-
arch/x86/include/asm/sev.h | 10 +-
arch/x86/kernel/amd_gart_64.c | 2 +-
arch/x86/kernel/head64.c | 7 +-
arch/x86/kernel/sev-shared.c | 23 +-
arch/x86/kernel/sev.c | 11 +-
arch/x86/mm/mem_encrypt_boot.S | 4 +-
arch/x86/mm/mem_encrypt_identity.c | 58 ++---
arch/x86/mm/pat/set_memory.c | 6 +-
arch/x86/mm/pti.c | 2 +-
drivers/firmware/efi/libstub/Makefile | 7 -
drivers/firmware/efi/libstub/x86-stub.c | 58 ++---
23 files changed, 194 insertions(+), 529 deletions(-)
--
2.44.0.769.g3c40516874-goog
The patch below does not apply to the 6.1-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y
git checkout FETCH_HEAD
git cherry-pick -x 1db7959aacd905e6487d0478ac01d89f86eb1e51
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024041954-bullish-slingshot-109f@gregkh' --subject-prefix 'PATCH 6.1.y' HEAD^..
Possible dependencies:
1db7959aacd9 ("btrfs: do not wait for short bulk allocation")
09e6cef19c9f ("btrfs: refactor alloc_extent_buffer() to allocate-then-attach method")
397239ed6a6c ("btrfs: allow extent buffer helpers to skip cross-page handling")
94dbf7c0871f ("btrfs: free the allocated memory if btrfs_alloc_page_array() fails")
096d23016543 ("btrfs: refactor main loop in memmove_extent_buffer()")
13840f3f2837 ("btrfs: refactor main loop in memcpy_extent_buffer()")
730c374e5b2c ("btrfs: use write_extent_buffer() to implement write_extent_buffer_*id()")
cb22964f1dad ("btrfs: refactor extent buffer bitmaps operations")
52ea5bfbfa6d ("btrfs: move eb subpage preallocation out of the loop")
5a96341927b0 ("btrfs: subpage: make alloc_extent_buffer() handle previously uptodate range efficiently")
2af2aaf98205 ("btrfs: scrub: introduce structure for new BTRFS_STRIPE_LEN based interface")
5eb30ee26fa4 ("btrfs: raid56: introduce the main entrance for RMW path")
6486d21c99cb ("btrfs: raid56: extract rwm write bios assembly into a helper")
509c27aa2fb6 ("btrfs: raid56: extract the rmw bio list build code into a helper")
30e3c897f4a8 ("btrfs: raid56: extract the pq generation code into a helper")
2fc6822c99d7 ("btrfs: move scrub prototypes into scrub.h")
677074792a1d ("btrfs: move relocation prototypes into relocation.h")
33cf97a7b658 ("btrfs: move acl prototypes into acl.h")
af142b6f44d3 ("btrfs: move file prototypes to file.h")
7572dec8f522 ("btrfs: move ioctl prototypes into ioctl.h")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 1db7959aacd905e6487d0478ac01d89f86eb1e51 Mon Sep 17 00:00:00 2001
From: Qu Wenruo <wqu(a)suse.com>
Date: Tue, 26 Mar 2024 09:16:46 +1030
Subject: [PATCH] btrfs: do not wait for short bulk allocation
[BUG]
There is a recent report that when memory pressure is high (including
cached pages), btrfs can spend most of its time on memory allocation in
btrfs_alloc_page_array() for compressed read/write.
[CAUSE]
For btrfs_alloc_page_array() we always go alloc_pages_bulk_array(), and
even if the bulk allocation failed (fell back to single page
allocation) we still retry but with extra memalloc_retry_wait().
If the bulk alloc only returned one page a time, we would spend a lot of
time on the retry wait.
The behavior was introduced in commit 395cb57e8560 ("btrfs: wait between
incomplete batch memory allocations").
[FIX]
Although the commit mentioned that other filesystems do the wait, it's
not the case at least nowadays.
All the mainlined filesystems only call memalloc_retry_wait() if they
failed to allocate any page (not only for bulk allocation).
If there is any progress, they won't call memalloc_retry_wait() at all.
For example, xfs_buf_alloc_pages() would only call memalloc_retry_wait()
if there is no allocation progress at all, and the call is not for
metadata readahead.
So I don't believe we should call memalloc_retry_wait() unconditionally
for short allocation.
Call memalloc_retry_wait() if it fails to allocate any page for tree
block allocation (which goes with __GFP_NOFAIL and may not need the
special handling anyway), and reduce the latency for
btrfs_alloc_page_array().
Reported-by: Julian Taylor <julian.taylor(a)1und1.de>
Tested-by: Julian Taylor <julian.taylor(a)1und1.de>
Link: https://lore.kernel.org/all/8966c095-cbe7-4d22-9784-a647d1bf27c3@1und1.de/
Fixes: 395cb57e8560 ("btrfs: wait between incomplete batch memory allocations")
CC: stable(a)vger.kernel.org # 6.1+
Reviewed-by: Sweet Tea Dorminy <sweettea-kernel(a)dorminy.me>
Reviewed-by: Filipe Manana <fdmanana(a)suse.com>
Signed-off-by: Qu Wenruo <wqu(a)suse.com>
Reviewed-by: David Sterba <dsterba(a)suse.com>
Signed-off-by: David Sterba <dsterba(a)suse.com>
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index b18034f2ab80..2776112dbdf8 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -681,31 +681,21 @@ static void end_bbio_data_read(struct btrfs_bio *bbio)
int btrfs_alloc_page_array(unsigned int nr_pages, struct page **page_array,
gfp_t extra_gfp)
{
+ const gfp_t gfp = GFP_NOFS | extra_gfp;
unsigned int allocated;
for (allocated = 0; allocated < nr_pages;) {
unsigned int last = allocated;
- allocated = alloc_pages_bulk_array(GFP_NOFS | extra_gfp,
- nr_pages, page_array);
-
- if (allocated == nr_pages)
- return 0;
-
- /*
- * During this iteration, no page could be allocated, even
- * though alloc_pages_bulk_array() falls back to alloc_page()
- * if it could not bulk-allocate. So we must be out of memory.
- */
- if (allocated == last) {
+ allocated = alloc_pages_bulk_array(gfp, nr_pages, page_array);
+ if (unlikely(allocated == last)) {
+ /* No progress, fail and do cleanup. */
for (int i = 0; i < allocated; i++) {
__free_page(page_array[i]);
page_array[i] = NULL;
}
return -ENOMEM;
}
-
- memalloc_retry_wait(GFP_NOFS);
}
return 0;
}
The patch below does not apply to the 6.6-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.6.y
git checkout FETCH_HEAD
git cherry-pick -x 1db7959aacd905e6487d0478ac01d89f86eb1e51
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024041951-sports-hula-f2a5@gregkh' --subject-prefix 'PATCH 6.6.y' HEAD^..
Possible dependencies:
1db7959aacd9 ("btrfs: do not wait for short bulk allocation")
09e6cef19c9f ("btrfs: refactor alloc_extent_buffer() to allocate-then-attach method")
397239ed6a6c ("btrfs: allow extent buffer helpers to skip cross-page handling")
94dbf7c0871f ("btrfs: free the allocated memory if btrfs_alloc_page_array() fails")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 1db7959aacd905e6487d0478ac01d89f86eb1e51 Mon Sep 17 00:00:00 2001
From: Qu Wenruo <wqu(a)suse.com>
Date: Tue, 26 Mar 2024 09:16:46 +1030
Subject: [PATCH] btrfs: do not wait for short bulk allocation
[BUG]
There is a recent report that when memory pressure is high (including
cached pages), btrfs can spend most of its time on memory allocation in
btrfs_alloc_page_array() for compressed read/write.
[CAUSE]
For btrfs_alloc_page_array() we always go alloc_pages_bulk_array(), and
even if the bulk allocation failed (fell back to single page
allocation) we still retry but with extra memalloc_retry_wait().
If the bulk alloc only returned one page a time, we would spend a lot of
time on the retry wait.
The behavior was introduced in commit 395cb57e8560 ("btrfs: wait between
incomplete batch memory allocations").
[FIX]
Although the commit mentioned that other filesystems do the wait, it's
not the case at least nowadays.
All the mainlined filesystems only call memalloc_retry_wait() if they
failed to allocate any page (not only for bulk allocation).
If there is any progress, they won't call memalloc_retry_wait() at all.
For example, xfs_buf_alloc_pages() would only call memalloc_retry_wait()
if there is no allocation progress at all, and the call is not for
metadata readahead.
So I don't believe we should call memalloc_retry_wait() unconditionally
for short allocation.
Call memalloc_retry_wait() if it fails to allocate any page for tree
block allocation (which goes with __GFP_NOFAIL and may not need the
special handling anyway), and reduce the latency for
btrfs_alloc_page_array().
Reported-by: Julian Taylor <julian.taylor(a)1und1.de>
Tested-by: Julian Taylor <julian.taylor(a)1und1.de>
Link: https://lore.kernel.org/all/8966c095-cbe7-4d22-9784-a647d1bf27c3@1und1.de/
Fixes: 395cb57e8560 ("btrfs: wait between incomplete batch memory allocations")
CC: stable(a)vger.kernel.org # 6.1+
Reviewed-by: Sweet Tea Dorminy <sweettea-kernel(a)dorminy.me>
Reviewed-by: Filipe Manana <fdmanana(a)suse.com>
Signed-off-by: Qu Wenruo <wqu(a)suse.com>
Reviewed-by: David Sterba <dsterba(a)suse.com>
Signed-off-by: David Sterba <dsterba(a)suse.com>
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index b18034f2ab80..2776112dbdf8 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -681,31 +681,21 @@ static void end_bbio_data_read(struct btrfs_bio *bbio)
int btrfs_alloc_page_array(unsigned int nr_pages, struct page **page_array,
gfp_t extra_gfp)
{
+ const gfp_t gfp = GFP_NOFS | extra_gfp;
unsigned int allocated;
for (allocated = 0; allocated < nr_pages;) {
unsigned int last = allocated;
- allocated = alloc_pages_bulk_array(GFP_NOFS | extra_gfp,
- nr_pages, page_array);
-
- if (allocated == nr_pages)
- return 0;
-
- /*
- * During this iteration, no page could be allocated, even
- * though alloc_pages_bulk_array() falls back to alloc_page()
- * if it could not bulk-allocate. So we must be out of memory.
- */
- if (allocated == last) {
+ allocated = alloc_pages_bulk_array(gfp, nr_pages, page_array);
+ if (unlikely(allocated == last)) {
+ /* No progress, fail and do cleanup. */
for (int i = 0; i < allocated; i++) {
__free_page(page_array[i]);
page_array[i] = NULL;
}
return -ENOMEM;
}
-
- memalloc_retry_wait(GFP_NOFS);
}
return 0;
}
From: Joao Paulo Goncalves <joao.goncalves(a)toradex.com>
When using davinci-mcasp as CPU DAI with simple-card, there are some
conditions that cause simple-card to finish registering a sound card before
davinci-mcasp finishes registering all sound components. This creates a
non-working sound card from userspace with no problem indication apart
from not being able to play/record audio on a PCM stream. The issue
arises during simultaneous probe execution of both drivers. Specifically,
the simple-card driver, awaiting a CPU DAI, proceeds as soon as
davinci-mcasp registers its DAI. However, this process can lead to the
client mutex lock (client_mutex in soc-core.c) being held or davinci-mcasp
being preempted before PCM DMA registration on davinci-mcasp finishes.
This situation occurs when the probes of both drivers run concurrently.
Below is the code path for this condition. To solve the issue, defer
davinci-mcasp CPU DAI registration to the last step in the audio part of
it. This way, simple-card CPU DAI parsing will be deferred until all
audio components are registered.
Fail Code Path:
simple-card.c: probe starts
simple-card.c: simple_dai_link_of: simple_parse_node(..,cpu,..) returns EPROBE_DEFER, no CPU DAI yet
davinci-mcasp.c: probe starts
davinci-mcasp.c: devm_snd_soc_register_component() register CPU DAI
simple-card.c: probes again, finish CPU DAI parsing and call devm_snd_soc_register_card()
simple-card.c: finish probe
davinci-mcasp.c: *dma_pcm_platform_register() register PCM DMA
davinci-mcasp.c: probe finish
Cc: stable(a)vger.kernel.org
Fixes: 9fbd58cf4ab0 ("ASoC: davinci-mcasp: Choose PCM driver based on configured DMA controller")
Signed-off-by: Joao Paulo Goncalves <joao.goncalves(a)toradex.com>
---
sound/soc/ti/davinci-mcasp.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/sound/soc/ti/davinci-mcasp.c b/sound/soc/ti/davinci-mcasp.c
index b892d66f78470..1e760c3155213 100644
--- a/sound/soc/ti/davinci-mcasp.c
+++ b/sound/soc/ti/davinci-mcasp.c
@@ -2417,12 +2417,6 @@ static int davinci_mcasp_probe(struct platform_device *pdev)
mcasp_reparent_fck(pdev);
- ret = devm_snd_soc_register_component(&pdev->dev, &davinci_mcasp_component,
- &davinci_mcasp_dai[mcasp->op_mode], 1);
-
- if (ret != 0)
- goto err;
-
ret = davinci_mcasp_get_dma_type(mcasp);
switch (ret) {
case PCM_EDMA:
@@ -2449,6 +2443,12 @@ static int davinci_mcasp_probe(struct platform_device *pdev)
goto err;
}
+ ret = devm_snd_soc_register_component(&pdev->dev, &davinci_mcasp_component,
+ &davinci_mcasp_dai[mcasp->op_mode], 1);
+
+ if (ret != 0)
+ goto err;
+
no_audio:
ret = davinci_mcasp_init_gpiochip(mcasp);
if (ret) {
--
2.34.1
Framebuffer memory is allocated via vzalloc() from non-contiguous
physical pages. The physical framebuffer start address is therefore
meaningless. Do not set it.
The value is not used within the kernel and only exported to userspace
on dedicated ARM configs. No functional change is expected.
v2:
- refer to vzalloc() in commit message (Javier)
Signed-off-by: Thomas Zimmermann <tzimmermann(a)suse.de>
Fixes: a5b44c4adb16 ("drm/fbdev-generic: Always use shadow buffering")
Cc: Thomas Zimmermann <tzimmermann(a)suse.de>
Cc: Javier Martinez Canillas <javierm(a)redhat.com>
Cc: Zack Rusin <zackr(a)vmware.com>
Cc: Maarten Lankhorst <maarten.lankhorst(a)linux.intel.com>
Cc: Maxime Ripard <mripard(a)kernel.org>
Cc: <stable(a)vger.kernel.org> # v6.4+
Reviewed-by: Javier Martinez Canillas <javierm(a)redhat.com>
Reviewed-by: Zack Rusin <zack.rusin(a)broadcom.com>
Reviewed-by: Sui Jingfeng <sui.jingfeng(a)linux.dev>
Tested-by: Sui Jingfeng <sui.jingfeng(a)linux.dev>
Acked-by: Maxime Ripard <mripard(a)kernel.org>
---
drivers/gpu/drm/drm_fbdev_generic.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/gpu/drm/drm_fbdev_generic.c b/drivers/gpu/drm/drm_fbdev_generic.c
index be357f926faec..97e579c33d84a 100644
--- a/drivers/gpu/drm/drm_fbdev_generic.c
+++ b/drivers/gpu/drm/drm_fbdev_generic.c
@@ -113,7 +113,6 @@ static int drm_fbdev_generic_helper_fb_probe(struct drm_fb_helper *fb_helper,
/* screen */
info->flags |= FBINFO_VIRTFB | FBINFO_READS_FAST;
info->screen_buffer = screen_buffer;
- info->fix.smem_start = page_to_phys(vmalloc_to_page(info->screen_buffer));
info->fix.smem_len = screen_size;
/* deferred I/O */
--
2.44.0