April 2024 - Linux-stable-mirror

[v2] drm/xe: Fix bo leak in intel_fb_bo_framebuffer_init

by Maarten Lankhorst

Add a unreference bo in the error path, to prevent leaking a bo ref. Return 0 on success to clarify the success path. Signed-off-by: Maarten Lankhorst <maarten.lankhorst(a)linux.intel.com> Fixes: 44e694958b95 ("drm/xe/display: Implement display support") Cc: <stable(a)vger.kernel.org> # v6.8+ --- drivers/gpu/drm/xe/display/intel_fb_bo.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/xe/display/intel_fb_bo.c b/drivers/gpu/drm/xe/display/intel_fb_bo.c index b21da7b745a5..a9c1f9885c6b 100644 --- a/drivers/gpu/drm/xe/display/intel_fb_bo.c +++ b/drivers/gpu/drm/xe/display/intel_fb_bo.c @@ -31,7 +31,7 @@ int intel_fb_bo_framebuffer_init(struct intel_framebuffer *intel_fb, ret = ttm_bo_reserve(&bo->ttm, true, false, NULL); if (ret) - return ret; + goto err; if (!(bo->flags & XE_BO_SCANOUT_BIT)) { /* @@ -42,12 +42,16 @@ int intel_fb_bo_framebuffer_init(struct intel_framebuffer *intel_fb, */ if (XE_IOCTL_DBG(i915, !list_empty(&bo->ttm.base.gpuva.list))) { ttm_bo_unreserve(&bo->ttm); - return -EINVAL; + ret = -EINVAL; + goto err; } bo->flags |= XE_BO_SCANOUT_BIT; } ttm_bo_unreserve(&bo->ttm); + return 0; +err: + xe_bo_put(bo); return ret; } -- 2.43.0

1 year, 2 months

1
0
0 0

Linux 6.7.12

by Greg Kroah-Hartman

Note, this is the LAST 6.7.y kernel to be released. This branch is now end-of-life. Please move to the 6.8.y branch at this point in time. ------------------------------- I'm announcing the release of the 6.7.12 kernel. All users of the 6.7 kernel series must upgrade. The updated 6.7.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.7.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Documentation/admin-guide/kernel-parameters.txt | 4 Documentation/arch/x86/amd-memory-encryption.rst | 16 Documentation/conf.py | 6 Documentation/userspace-api/media/mediactl/media-types.rst | 11 Makefile | 2 arch/arm/Kconfig | 4 arch/arm/boot/dts/marvell/mmp2-brownstone.dts | 2 arch/arm/configs/imx_v6_v7_defconfig | 1 arch/arm/include/asm/mman.h | 14 arch/arm/kernel/Makefile | 2 arch/arm/kernel/iwmmxt.S | 51 - arch/arm/kernel/pj4-cp0.c | 135 ----- arch/arm/mm/flush.c | 3 arch/arm64/boot/dts/qcom/sc7280.dtsi | 12 arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts | 2 arch/arm64/boot/dts/qcom/sm8450-hdk.dts | 4 arch/arm64/boot/dts/qcom/sm8550-mtp.dts | 2 arch/arm64/boot/dts/qcom/sm8550-qrd.dts | 2 arch/hexagon/kernel/vmlinux.lds.S | 1 arch/loongarch/crypto/crc32-loongarch.c | 2 arch/loongarch/include/asm/Kbuild | 1 arch/loongarch/include/asm/io.h | 2 arch/loongarch/include/asm/percpu.h | 7 arch/loongarch/include/asm/qspinlock.h | 18 arch/parisc/include/asm/assembly.h | 18 arch/parisc/include/asm/checksum.h | 10 arch/parisc/include/asm/mman.h | 14 arch/parisc/kernel/unaligned.c | 27 - arch/powerpc/include/asm/reg_fsl_emb.h | 11 arch/powerpc/kernel/prom.c | 12 arch/powerpc/lib/Makefile | 2 arch/sparc/include/asm/parport.h | 259 ---------- arch/sparc/include/asm/parport_64.h | 256 +++++++++ arch/sparc/kernel/nmi.c | 2 arch/sparc/vdso/vma.c | 7 arch/x86/Kconfig | 13 arch/x86/boot/compressed/efi_mixed.S | 29 - arch/x86/coco/core.c | 7 arch/x86/include/asm/asm-prototypes.h | 1 arch/x86/include/asm/asm.h | 14 arch/x86/include/asm/coco.h | 8 arch/x86/include/asm/crash_core.h | 2 arch/x86/include/asm/mem_encrypt.h | 15 arch/x86/include/asm/nospec-branch.h | 21 arch/x86/include/asm/sev.h | 4 arch/x86/include/asm/suspend_32.h | 10 arch/x86/include/asm/x86_init.h | 3 arch/x86/kernel/cpu/amd.c | 10 arch/x86/kernel/eisa.c | 3 arch/x86/kernel/fpu/xstate.c | 5 arch/x86/kernel/fpu/xstate.h | 14 arch/x86/kernel/kprobes/core.c | 11 arch/x86/kernel/mpparse.c | 10 arch/x86/kernel/nmi.c | 2 arch/x86/kernel/probe_roms.c | 10 arch/x86/kernel/setup.c | 3 arch/x86/kernel/sev-shared.c | 12 arch/x86/kernel/sev.c | 31 - arch/x86/kernel/x86_init.c | 2 arch/x86/kvm/cpuid.c | 21 arch/x86/kvm/hyperv.c | 2 arch/x86/kvm/lapic.c | 5 arch/x86/kvm/reverse_cpuid.h | 35 - arch/x86/kvm/svm/sev.c | 23 arch/x86/kvm/x86.c | 10 arch/x86/kvm/xen.c | 4 arch/x86/kvm/xen.h | 18 arch/x86/lib/retpoline.S | 11 arch/x86/mm/mem_encrypt_amd.c | 18 arch/x86/mm/mem_encrypt_identity.c | 38 - block/bio.c | 7 block/blk-mq.c | 9 block/blk-settings.c | 4 block/mq-deadline.c | 3 crypto/asymmetric_keys/mscode_parser.c | 3 crypto/asymmetric_keys/pkcs7_parser.c | 4 crypto/asymmetric_keys/public_key.c | 3 crypto/asymmetric_keys/signature.c | 2 crypto/asymmetric_keys/x509_cert_parser.c | 8 crypto/testmgr.h | 80 +++ drivers/accel/habanalabs/common/device.c | 2 drivers/accessibility/speakup/synth.c | 4 drivers/ata/ahci.c | 5 drivers/ata/libata-eh.c | 5 drivers/ata/libata-scsi.c | 9 drivers/base/power/wakeirq.c | 4 drivers/bluetooth/btnxpuart.c | 3 drivers/char/tpm/tpm_tis_core.c | 3 drivers/clk/qcom/gcc-ipq5018.c | 3 drivers/clk/qcom/gcc-ipq6018.c | 2 drivers/clk/qcom/gcc-ipq8074.c | 2 drivers/clk/qcom/gcc-ipq9574.c | 1 drivers/clk/qcom/gcc-sdm845.c | 1 drivers/clk/qcom/mmcc-apq8084.c | 2 drivers/clk/qcom/mmcc-msm8974.c | 2 drivers/clocksource/arm_global_timer.c | 2 drivers/clocksource/timer-riscv.c | 3 drivers/cpufreq/amd-pstate.c | 2 drivers/cpufreq/cpufreq-dt.c | 2 drivers/crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c | 34 - drivers/crypto/intel/qat/qat_common/adf_aer.c | 22 drivers/crypto/intel/qat/qat_common/adf_rl.c | 20 drivers/crypto/rockchip/rk3288_crypto_ahash.c | 4 drivers/cxl/core/trace.h | 14 drivers/firewire/ohci.c | 2 drivers/firmware/efi/efi.c | 2 drivers/firmware/efi/libstub/randomalloc.c | 2 drivers/firmware/efi/libstub/x86-stub.c | 1 drivers/fpga/dfl.c | 2 drivers/gpu/drm/amd/amdgpu/amdgpu.h | 1 drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 13 drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c | 20 drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | 46 + drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 1 drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 2 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 60 +- drivers/gpu/drm/amd/display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c | 14 drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c | 2 drivers/gpu/drm/amd/display/dc/core/dc.c | 30 - drivers/gpu/drm/amd/display/dc/dcn30/dcn30_mpc.c | 54 +- drivers/gpu/drm/amd/display/dc/dcn30/dcn30_mpc.h | 14 drivers/gpu/drm/amd/display/dc/dcn32/dcn32_mpc.c | 5 drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c | 19 drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.h | 5 drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource_helpers.c | 32 + drivers/gpu/drm/amd/display/dc/dcn321/dcn321_resource.c | 2 drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c | 16 drivers/gpu/drm/amd/display/dc/dml2/dml2_translation_helper.c | 24 drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c | 53 +- drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.h | 7 drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c | 3 drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c | 41 - drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c | 12 drivers/gpu/drm/amd/display/dc/hwss/dcn314/dcn314_hwseq.c | 41 - drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c | 48 - drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c | 41 - drivers/gpu/drm/amd/display/dc/inc/resource.h | 20 drivers/gpu/drm/amd/display/modules/hdcp/hdcp_psp.c | 3 drivers/gpu/drm/amd/display/modules/info_packet/info_packet.c | 13 drivers/gpu/drm/amd/pm/amdgpu_pm.c | 12 drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c | 19 drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c | 19 drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c | 31 - drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 18 drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 18 drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c | 2 drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_0_ppt.c | 5 drivers/gpu/drm/bridge/lontium-lt8912b.c | 24 drivers/gpu/drm/drm_bridge.c | 46 + drivers/gpu/drm/drm_panel.c | 17 drivers/gpu/drm/drm_probe_helper.c | 7 drivers/gpu/drm/drm_syncobj.c | 6 drivers/gpu/drm/etnaviv/etnaviv_drv.c | 2 drivers/gpu/drm/etnaviv/etnaviv_hwdb.c | 9 drivers/gpu/drm/exynos/exynos_drm_vidi.c | 4 drivers/gpu/drm/exynos/exynos_hdmi.c | 4 drivers/gpu/drm/i915/display/icl_dsi.c | 3 drivers/gpu/drm/i915/display/intel_bios.c | 46 + drivers/gpu/drm/i915/display/intel_display_power_well.c | 17 drivers/gpu/drm/i915/display/intel_display_trace.h | 6 drivers/gpu/drm/i915/display/intel_dpll_mgr.c | 200 ++++--- drivers/gpu/drm/i915/display/intel_dpll_mgr.h | 4 drivers/gpu/drm/i915/display/intel_dsb.c | 14 drivers/gpu/drm/i915/display/intel_vrr.c | 7 drivers/gpu/drm/i915/gem/i915_gem_userptr.c | 3 drivers/gpu/drm/i915/gt/intel_engine_pm.c | 3 drivers/gpu/drm/i915/gt/intel_execlists_submission.c | 3 drivers/gpu/drm/i915/gvt/interrupt.c | 13 drivers/gpu/drm/i915/i915_hwmon.c | 37 - drivers/gpu/drm/i915/i915_reg.h | 2 drivers/gpu/drm/imx/ipuv3/parallel-display.c | 4 drivers/gpu/drm/nouveau/include/nvkm/core/client.h | 1 drivers/gpu/drm/nouveau/nouveau_dmem.c | 12 drivers/gpu/drm/nouveau/nouveau_gem.c | 2 drivers/gpu/drm/nouveau/nvkm/core/client.c | 1 drivers/gpu/drm/nouveau/nvkm/core/object.c | 26 - drivers/gpu/drm/scheduler/sched_entity.c | 12 drivers/gpu/drm/ttm/ttm_bo_util.c | 13 drivers/gpu/drm/ttm/ttm_tt.c | 13 drivers/gpu/drm/vc4/vc4_hdmi.c | 2 drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 15 drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 14 drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 17 drivers/hwmon/amc6821.c | 11 drivers/i2c/busses/i2c-i801.c | 6 drivers/iio/accel/adxl367.c | 8 drivers/iio/accel/adxl367_i2c.c | 2 drivers/iio/adc/rockchip_saradc.c | 6 drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c | 2 drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c | 5 drivers/infiniband/hw/mlx5/devx.c | 2 drivers/input/joystick/xpad.c | 6 drivers/iommu/dma-iommu.c | 9 drivers/irqchip/irq-renesas-rzg2l.c | 93 ++- drivers/leds/trigger/ledtrig-netdev.c | 4 drivers/md/dm-raid.c | 93 ++- drivers/md/dm-snap.c | 4 drivers/md/md-bitmap.c | 9 drivers/md/md.c | 82 ++- drivers/md/md.h | 38 + drivers/md/raid5.c | 46 + drivers/media/mc/mc-entity.c | 93 ++- drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c | 4 drivers/media/tuners/xc4000.c | 4 drivers/mfd/Kconfig | 1 drivers/mfd/intel-lpss-pci.c | 28 - drivers/mfd/intel-lpss.c | 9 drivers/mfd/intel-lpss.h | 14 drivers/misc/fastrpc.c | 10 drivers/misc/lis3lv02d/lis3lv02d_i2c.c | 21 drivers/misc/mei/hw-me-regs.h | 2 drivers/misc/mei/pci-me.c | 2 drivers/misc/ocxl/file.c | 2 drivers/mmc/core/block.c | 14 drivers/mmc/host/sdhci-of-dwcmshc.c | 28 - drivers/mmc/host/sdhci-omap.c | 3 drivers/mmc/host/tmio_mmc_core.c | 2 drivers/mtd/nand/raw/meson_nand.c | 2 drivers/mtd/nand/raw/nand_base.c | 85 ++- drivers/mtd/ubi/fastmap.c | 7 drivers/mtd/ubi/vtbl.c | 6 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_trace.h | 8 drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_trace.h | 8 drivers/net/ethernet/xilinx/ll_temac_main.c | 2 drivers/net/wireguard/netlink.c | 10 drivers/net/wireless/broadcom/brcm80211/brcmfmac/bca/core.c | 15 drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 60 -- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h | 2 drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c | 33 - drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c | 3 drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c | 1 drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h | 2 drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwvid.c | 14 drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwvid.h | 33 - drivers/net/wireless/broadcom/brcm80211/brcmfmac/wcc/core.c | 16 drivers/net/wireless/intel/iwlwifi/fw/dbg.c | 15 drivers/net/wireless/intel/iwlwifi/mvm/debugfs-vif.c | 11 drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 2 drivers/net/wireless/realtek/rtw88/mac.c | 7 drivers/net/wireless/realtek/rtw88/rtw8821cu.c | 40 + drivers/nvmem/meson-efuse.c | 25 drivers/pci/controller/dwc/pcie-designware-ep.c | 7 drivers/pci/controller/dwc/pcie-qcom.c | 41 + drivers/pci/controller/pci-hyperv.c | 3 drivers/pci/pci-driver.c | 7 drivers/pci/pcie/err.c | 20 drivers/pci/quirks.c | 2 drivers/phy/tegra/xusb.c | 13 drivers/platform/x86/intel/tpmi.c | 9 drivers/powercap/intel_rapl_common.c | 34 + drivers/powercap/intel_rapl_msr.c | 8 drivers/powercap/intel_rapl_tpmi.c | 15 drivers/pwm/pwm-img.c | 4 drivers/remoteproc/remoteproc_virtio.c | 6 drivers/s390/cio/vfio_ccw_chp.c | 2 drivers/s390/cio/vfio_ccw_drv.c | 4 drivers/s390/cio/vfio_ccw_ops.c | 6 drivers/s390/crypto/vfio_ap_ops.c | 2 drivers/s390/crypto/zcrypt_api.c | 2 drivers/scsi/hosts.c | 7 drivers/scsi/libsas/sas_expander.c | 51 + drivers/scsi/lpfc/lpfc_bsg.c | 4 drivers/scsi/lpfc/lpfc_nvmet.c | 2 drivers/scsi/qla2xxx/qla_attr.c | 14 drivers/scsi/qla2xxx/qla_def.h | 2 drivers/scsi/qla2xxx/qla_gbl.h | 2 drivers/scsi/qla2xxx/qla_init.c | 128 ++-- drivers/scsi/qla2xxx/qla_iocb.c | 68 +- drivers/scsi/qla2xxx/qla_mbx.c | 2 drivers/scsi/qla2xxx/qla_os.c | 3 drivers/scsi/qla2xxx/qla_target.c | 10 drivers/scsi/scsi_scan.c | 34 + drivers/scsi/sd.c | 23 drivers/slimbus/core.c | 4 drivers/soc/fsl/qbman/qman.c | 25 drivers/staging/media/ipu3/ipu3-v4l2.c | 16 drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c | 5 drivers/tee/optee/device.c | 3 drivers/thermal/devfreq_cooling.c | 2 drivers/thermal/intel/int340x_thermal/processor_thermal_device.c | 8 drivers/thermal/intel/int340x_thermal/processor_thermal_rapl.c | 8 drivers/thermal/intel/intel_tcc.c | 12 drivers/thermal/intel/x86_pkg_temp_thermal.c | 8 drivers/thermal/mediatek/auxadc_thermal.c | 3 drivers/thunderbolt/switch.c | 3 drivers/tty/serial/8250/8250_port.c | 6 drivers/tty/serial/fsl_lpuart.c | 7 drivers/tty/serial/imx.c | 22 drivers/tty/serial/max310x.c | 7 drivers/tty/serial/qcom_geni_serial.c | 10 drivers/tty/serial/serial_core.c | 12 drivers/tty/serial/serial_port.c | 25 drivers/tty/vt/vt.c | 2 drivers/ufs/host/ufs-qcom.c | 6 drivers/usb/class/cdc-wdm.c | 6 drivers/usb/core/hub.c | 23 drivers/usb/core/hub.h | 2 drivers/usb/core/port.c | 43 + drivers/usb/core/sysfs.c | 16 drivers/usb/dwc2/core.h | 14 drivers/usb/dwc2/core_intr.c | 72 +- drivers/usb/dwc2/gadget.c | 10 drivers/usb/dwc2/hcd.c | 49 + drivers/usb/dwc2/hcd_ddma.c | 17 drivers/usb/dwc2/hw.h | 2 drivers/usb/dwc2/platform.c | 2 drivers/usb/dwc3/core.c | 2 drivers/usb/dwc3/core.h | 2 drivers/usb/dwc3/dwc3-am62.c | 13 drivers/usb/dwc3/dwc3-pci.c | 2 drivers/usb/dwc3/gadget.c | 10 drivers/usb/dwc3/host.c | 11 drivers/usb/gadget/function/f_fs.c | 4 drivers/usb/gadget/function/f_ncm.c | 2 drivers/usb/gadget/udc/core.c | 4 drivers/usb/gadget/udc/tegra-xudc.c | 39 - drivers/usb/host/xhci-ring.c | 8 drivers/usb/host/xhci.c | 2 drivers/usb/misc/usb-ljca.c | 22 drivers/usb/phy/phy-generic.c | 7 drivers/usb/serial/cp210x.c | 4 drivers/usb/serial/ftdi_sio.c | 2 drivers/usb/serial/ftdi_sio_ids.h | 6 drivers/usb/serial/option.c | 6 drivers/usb/storage/isd200.c | 23 drivers/usb/storage/uas.c | 28 - drivers/usb/typec/altmodes/displayport.c | 18 drivers/usb/typec/class.c | 7 drivers/usb/typec/tcpm/tcpm.c | 7 drivers/usb/typec/ucsi/ucsi.c | 46 + drivers/usb/typec/ucsi/ucsi.h | 4 drivers/usb/typec/ucsi/ucsi_acpi.c | 75 +- drivers/usb/typec/ucsi/ucsi_glink.c | 14 drivers/vdpa/vdpa_user/vduse_dev.c | 6 drivers/vfio/fsl-mc/vfio_fsl_mc_intr.c | 9 drivers/vfio/pci/pds/lm.c | 13 drivers/vfio/pci/pds/lm.h | 1 drivers/vfio/pci/pds/vfio_dev.c | 4 drivers/vfio/pci/vfio_pci_core.c | 6 drivers/vfio/pci/vfio_pci_intrs.c | 186 ++++--- drivers/vfio/platform/vfio_platform_irq.c | 105 ++-- drivers/vfio/virqfd.c | 21 drivers/vhost/vdpa.c | 4 drivers/vhost/vhost.c | 10 drivers/vhost/vhost.h | 2 drivers/virt/acrn/ioeventfd.c | 2 drivers/virtio/virtio.c | 10 drivers/xen/privcmd.c | 2 fs/aio.c | 10 fs/btrfs/block-group.c | 3 fs/btrfs/extent_io.c | 75 ++ fs/btrfs/qgroup.c | 10 fs/btrfs/scrub.c | 12 fs/btrfs/volumes.c | 69 ++ fs/debugfs/inode.c | 25 fs/dlm/user.c | 10 fs/eventfd.c | 11 fs/exec.c | 1 fs/ext4/mballoc.c | 17 fs/ext4/resize.c | 3 fs/f2fs/f2fs.h | 1 fs/f2fs/segment.c | 4 fs/fat/nfs.c | 6 fs/fuse/dir.c | 6 fs/fuse/file.c | 8 fs/fuse/fuse_i.h | 1 fs/fuse/inode.c | 7 fs/nfs/direct.c | 11 fs/nfs/read.c | 2 fs/nfs/write.c | 2 fs/nfsd/trace.h | 2 fs/nilfs2/btree.c | 9 fs/nilfs2/direct.c | 9 fs/nilfs2/inode.c | 2 fs/smb/client/cached_dir.c | 3 fs/smb/client/cifs_debug.c | 2 fs/smb/client/cifsglob.h | 5 fs/smb/client/cifsproto.h | 8 fs/smb/client/connect.c | 6 fs/smb/client/file.c | 8 fs/smb/client/fs_context.c | 27 - fs/smb/client/inode.c | 17 fs/smb/client/readdir.c | 133 ++--- fs/smb/client/sess.c | 45 - fs/smb/client/smb2ops.c | 2 fs/smb/client/smb2pdu.c | 10 fs/smb/server/smb2misc.c | 26 - fs/smb/server/smb2pdu.c | 228 +++++--- fs/smb/server/smb_common.c | 11 fs/smb/server/vfs.c | 12 fs/ubifs/file.c | 13 include/drm/drm_bridge.h | 33 + include/drm/drm_modeset_helper_vtables.h | 3 include/drm/ttm/ttm_tt.h | 9 include/linux/cpufreq.h | 15 include/linux/eventfd.h | 4 include/linux/gfp.h | 9 include/linux/hyperv.h | 22 include/linux/intel_rapl.h | 6 include/linux/intel_tcc.h | 2 include/linux/libata.h | 1 include/linux/mman.h | 8 include/linux/mtd/spinand.h | 2 include/linux/nfs_fs.h | 1 include/linux/oid_registry.h | 4 include/linux/phy/tegra/xusb.h | 1 include/linux/ring_buffer.h | 1 include/linux/serial_core.h | 3 include/linux/skbuff.h | 10 include/linux/vfio.h | 2 include/media/media-entity.h | 2 include/net/cfg80211.h | 2 include/net/cfg802154.h | 1 include/scsi/scsi_driver.h | 1 include/scsi/scsi_host.h | 1 include/uapi/linux/virtio_config.h | 8 init/Kconfig | 6 init/initramfs.c | 2 io_uring/futex.c | 1 io_uring/io_uring.c | 5 io_uring/net.c | 5 io_uring/poll.c | 19 io_uring/rw.c | 4 io_uring/waitid.c | 7 kernel/bounds.c | 2 kernel/cgroup/cpuset.c | 8 kernel/crash_core.c | 8 kernel/dma/swiotlb.c | 35 - kernel/entry/common.c | 8 kernel/module/Kconfig | 5 kernel/power/suspend.c | 1 kernel/printk/printk.c | 27 - kernel/sys.c | 7 kernel/time/posix-clock.c | 16 kernel/trace/ring_buffer.c | 233 +++++--- kernel/trace/trace.c | 21 kernel/workqueue.c | 2 lib/pci_iomap.c | 2 mm/compaction.c | 7 mm/filemap.c | 16 mm/kasan/kasan_test.c | 3 mm/memcontrol.c | 10 mm/memtest.c | 4 mm/mmap.c | 10 mm/page_alloc.c | 10 mm/shmem_quota.c | 10 mm/swapfile.c | 13 mm/vmpressure.c | 2 mm/vmscan.c | 5 net/bluetooth/hci_core.c | 6 net/bluetooth/hci_sync.c | 5 net/ipv4/esp4.c | 8 net/ipv6/esp6.c | 8 net/mac80211/cfg.c | 7 net/mac80211/ieee80211_i.h | 2 net/mac80211/rate.c | 2 net/mac80211/sta_info.h | 6 net/mac80211/vht.c | 46 - net/mac802154/llsec.c | 18 net/netfilter/nf_tables_api.c | 7 net/wireless/wext-core.c | 7 net/xfrm/xfrm_user.c | 3 samples/vfio-mdev/mtty.c | 4 scripts/Makefile.extrawarn | 2 security/landlock/syscalls.c | 18 security/smack/smack_lsm.c | 12 sound/pci/hda/patch_realtek.c | 13 sound/pci/hda/tas2781_hda_i2c.c | 83 +-- sound/sh/aica.c | 17 sound/soc/amd/yc/acp6x-mach.c | 7 tools/include/linux/btf_ids.h | 2 tools/perf/builtin-top.c | 4 tools/testing/selftests/mm/gup_test.c | 67 +- tools/testing/selftests/mm/soft-dirty.c | 2 tools/testing/selftests/mm/split_huge_page_test.c | 2 tools/testing/selftests/mm/uffd-common.c | 3 tools/testing/selftests/mm/uffd-common.h | 2 tools/testing/selftests/mm/uffd-unit-tests.c | 13 tools/testing/selftests/mqueue/setting | 1 tools/testing/selftests/net/mptcp/diag.sh | 6 tools/testing/selftests/wireguard/qemu/arch/riscv32.config | 1 tools/testing/selftests/wireguard/qemu/arch/riscv64.config | 1 virt/kvm/async_pf.c | 31 + virt/kvm/eventfd.c | 4 484 files changed, 4983 insertions(+), 2783 deletions(-) Adamos Ttofari (1): x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD Akira Yokosawa (1): docs: Restore "smart quotes" for quotes Alan Stern (4): USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command USB: core: Fix deadlock in usb_deauthorize_interface() USB: core: Add hub_get() and hub_put() routines USB: core: Fix deadlock in port "disable" sysfs attribute Aleksandrs Vinarskis (2): mfd: intel-lpss: Switch to generalized quirk table mfd: intel-lpss: Introduce QUIRK_CLOCK_DIVIDER_UNITY for XPS 9530 Alex Deucher (1): drm/amd/display: handle range offsets in VRR ranges Alex Williamson (7): vfio/pci: Disable auto-enable of exclusive INTx IRQ vfio/pci: Lock external INTx masking ops vfio/platform: Disable virqfds on cleanup vfio/platform: Create persistent IRQ handlers vfio/fsl-mc: Block calling interrupt handler without trigger vfio: Introduce interface to flush virqfd inject workqueue vfio/pci: Create persistent INTx handler Alexander Aring (1): dlm: fix user space lkb refcounting Alexander Stein (1): Revert "usb: phy: generic: Get the vbus supply" Alexander Sverdlin (1): mfd: twl: Select MFD_CORE Alexander Usyskin (2): mei: me: add arrow lake point S DID mei: me: add arrow lake point H DID Alison Schofield (1): cxl/trace: Properly initialize cxl_poison region name Amit Pundir (1): clk: qcom: gcc-sdm845: Add soft dependency on rpmhpd Anand Jain (2): btrfs: do not skip re-registration for the mounted device btrfs: validate device maj:min during open Andrey Jr. Melnikov (1): ahci: asm1064: correct count of reported ports Andrey Skvortsov (1): crypto: sun8i-ce - Fix use after free in unprepare André Rösti (1): entry: Respect changes to system call number by trace_sys_enter() Andy Chi (1): ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook Anton Altaparmakov (1): x86/pm: Work around false positive kmemleak report in msr_build_context() Ard Biesheuvel (6): x86/efistub: Call mixed mode boot services on the firmware's stack x86/sev: Fix position dependent variable references in startup code ARM: 9352/1: iwmmxt: Remove support for PJ4/PJ4B cores x86/efistub: Add missing boot_params for mixed mode compat entry efi/libstub: Cast away type warning in use of max() x86/efistub: Reinstate soft limit for initrd loading Arend van Spriel (2): wifi: brcmfmac: avoid invalid list operation when vendor attach fails wifi: brcmfmac: add per-vendor feature detection callback Arnd Bergmann (2): kasan/test: avoid gcc warning for intentional overflow staging: vc04_services: changen strncpy() to strscpy_pad() Arseniy Krasnov (1): mtd: rawnand: meson: fix scrambling mode value in command macro Audra Mitchell (1): workqueue: Shorten events_freezable_power_efficient name Aurélien Jacobs (1): USB: serial: option: add MeiG Smart SLM320 product Badhri Jagan Sridharan (1): usb: typec: tpcm: Fix PORT_RESET behavior for self powered devices Baokun Li (1): ext4: correct best extent lstart adjustment logic Baoquan He (1): crash: use macro to add crashk_res into iomem early for specific arch Bart Van Assche (2): Revert "block/mq-deadline: use correct way to throttling write requests" fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion Benjamin Coddington (1): NFS: Read unlock folio on nfs_page_create_from_folio() error Bernd Schubert (1): fuse: fix VM_MAYSHARE and direct_io_allow_mmap Bharath SM (1): cifs: prevent updating file size from server if we have a read/write lease Biju Das (4): irqchip/renesas-rzg2l: Flush posted write in irq_eoi() irqchip/renesas-rzg2l: Rename rzg2l_tint_eoi() irqchip/renesas-rzg2l: Rename rzg2l_irq_eoi() irqchip/renesas-rzg2l: Prevent spurious interrupts when setting trigger type Bikash Hazarika (1): scsi: qla2xxx: Update manufacturer detail Bitterblue Smith (1): wifi: rtw88: 8821cu: Fix connection failure Borislav Petkov (AMD) (3): x86/CPU/AMD: Update the Zenbleed microcode revisions x86/Kconfig: Remove CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT x86/bugs: Fix the SRSO mitigation on Zen3/4 Breno Leitao (1): x86/nmi: Fix the inverse "in NMI handler" check Brett Creeley (2): vfio/pds: Always clear the save/restore FDs on reset vfio/pds: Make sure migration file isn't accessed after reset Cameron Williams (1): USB: serial: add device ID for VeriFone adapter Carlos Maiolino (1): tmpfs: fix race on handling dquot rbtree Chris Park (1): drm/amd/display: Prevent crash when disable stream Chris Wilson (1): drm/i915/gt: Reset queue_priority_hint on parking Christian A. Ehrhardt (4): usb: typec: ucsi: Clear EVENT_PENDING under PPM lock usb: typec: ucsi: Ack unsupported commands usb: typec: ucsi_acpi: Refactor and fix DELL quirk usb: typec: ucsi: Clear UCSI_CCI_RESET_COMPLETE before reset Christian Brauner (2): i915: make inject_virtual_interrupt() void eventfd: simplify eventfd_signal() Christian Gmeiner (1): drm/etnaviv: Restore some id values Christian Häggström (1): USB: serial: cp210x: add ID for MGP Instruments PDS100 Christian Marangi (1): leds: trigger: netdev: Fix kernel panic on interface rename trig notify Christophe JAILLET (1): slimbus: core: Remove usage of the deprecated ida_simple_xx() API Claudiu Beznea (2): irqchip/renesas-rzg2l: Implement restriction when writing ISCR register irqchip/renesas-rzg2l: Add macro to retrieve TITSR register offset based on register's index Claus Hansen Ries (1): net: ll_temac: platform_get_resource replaced by wrong function Conrad Kostecki (1): ahci: asm1064: asm1166: don't limit reported ports Cosmin Tanislav (2): iio: accel: adxl367: fix DEVID read after reset iio: accel: adxl367: fix I2C FIFO data register Damian Muszynski (2): crypto: qat - change SLAs cleanup flow at shutdown crypto: qat - resolve race condition during AER recovery Damien Le Moal (3): block: Clear zone limits for a non-zoned stacked queue block: Do not force full zone append completion in req_bio_endio() scsi: sd: Fix TCG OPAL unlock on system resume Dan Carpenter (3): cifs: delete unnecessary NULL checks in cifs_chan_update_iface() cifs: make cifs_chan_update_iface() a void function staging: vc04_services: fix information leak in create_component() Daniel Vogelbacher (1): USB: serial: ftdi_sio: add support for GMC Z216C Adapter IR-USB Dave Airlie (1): nouveau: lock the client object tree. Dave Hansen (1): Revert "x86/bugs: Use fixed addressing for VERW operand" David Hildenbrand (1): virtio: reenable config if freezing device failed David Woodhouse (1): KVM: x86/xen: inject vCPU upcall vector when local APIC is enabled Dillon Varone (2): drm/amd/display: Add dml2 copy functions drm/amd/display: Init DPPCLK from SMU on dcn32 Dmitry Baryshkov (1): scsi: ufs: qcom: Provide default cycles_in_1us value Dominique Martinet (1): mmc: core: Fix switch on gp3 partition Douglas Anderson (1): Revert "tty: serial: simplify qcom_geni_serial_send_chunk_fifo()" Dragos Tatulea (1): net: esp: fix bad handling of pages from page_pool Duje Mihanović (1): arm: dts: marvell: Fix maxium->maxim typo in brownstone dts Duoming Zhou (2): nouveau/dmem: handle kcalloc() allocation failure ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs Edmund Raile (1): firewire: ohci: prevent leak of left-over IRQ on unbind Edward Liaw (2): selftests/mm: sigbus-wp test requires UFFD_FEATURE_WP_HUGETLBFS_SHMEM selftests/mm: fix ARM related issue with fork after pthread_create Ekansh Gupta (1): misc: fastrpc: Pass proper arguments to scm call Eric Biggers (1): Revert "crypto: pkcs7 - remove sha1 support" Eric Huang (1): drm/amdkfd: fix TLB flush after unmap for GFX9.4.2 Eugene Korenevsky (1): cifs: open_cached_dir(): add FILE_READ_EA to desired access Ezra Buehler (1): mtd: spinand: Add support for 5-byte IDs Fabio Estevam (1): ARM: imx_v6_v7_defconfig: Restore CONFIG_BACKLIGHT_CLASS_DEVICE Fedor Pchelkin (1): mac802154: fix llsec key resources release in mac802154_llsec_key_del Felix Fietkau (1): wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes Feng Liu (1): virtio: Define feature bit for administration virtqueue Filipe Manana (1): btrfs: fix off-by-one chunk length calculation at contains_pending_extent() Frank Wunderlich (1): thermal/drivers/mediatek: Fix control buffer enablement on MT7896 Gabor Juhos (6): clk: qcom: gcc-ipq5018: fix terminating of frequency table arrays clk: qcom: gcc-ipq6018: fix terminating of frequency table arrays clk: qcom: gcc-ipq8074: fix terminating of frequency table arrays clk: qcom: gcc-ipq9574: fix terminating of frequency table arrays clk: qcom: mmcc-apq8084: fix terminating of frequency table arrays clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays Geliang Tang (1): selftests: mptcp: diag: return KSFT_FAIL not test_cnt George Shen (1): drm/amd/display: Remove MPC rate control logic from DCN30 and above Gergo Koteles (2): ALSA: hda/tas2781: remove digital gain kcontrol ALSA: hda/tas2781: add locks to kcontrols Greg Kroah-Hartman (1): Linux 6.7.12 Guenter Roeck (5): parisc/unaligned: Rewrite 64-bit inline assembly of emulate_ldd() parisc: Fix ip_fast_csum parisc: Fix csum_ipv6_magic on 32-bit systems parisc: Fix csum_ipv6_magic on 64-bit systems parisc: Strip upper 32 bit of sum in csum_ipv6_magic for 64-bit builds Gui-Dong Han (2): media: xc4000: Fix atomicity violation in xc4000_get_frequency md/raid5: fix atomicity violation in raid5_cache_count Guilherme G. Piccoli (1): scsi: core: Fix unremoved procfs host directory regression Hamza Mahfooz (1): drm/amdgpu: make damage clips support configurable Hans de Goede (1): misc: lis3lv02d_i2c: Fix regulators getting en-/dis-abled twice on suspend/resume Harald Freudenberger (1): s390/zcrypt: fix reference counting on zcrypt card objects Harry Wentland (1): Revert "drm/amd/display: Fix sending VSC (+ colorimetry) packets for DP/eDP displays without PSR" Hector Martin (2): wifi: brcmfmac: cfg80211: Use WSEC to set SAE password wifi: brcmfmac: Demote vendor-specific attach/detach messages to info Heikki Krogerus (1): usb: dwc3: pci: Drop duplicate ID Heiner Kallweit (2): i2c: i801: Fix using mux_pdev before it's set i2c: i801: Avoid potential double call to gpiod_remove_lookup_table Heming Zhao (1): md/md-bitmap: fix incorrect usage for sb_index Herbert Xu (1): crypto: rk3288 - Fix use after free in unprepare Hidenori Kobayashi (1): media: staging: ipu3-imgu: Set fields before media_entity_pads_init() Huacai Chen (2): LoongArch: Change __my_cpu_offset definition to avoid mis-optimization LoongArch: Define the __io_aw() hook as mmiowb() Hugo Villeneuve (1): serial: max310x: fix NULL pointer dereference in I2C instantiation Jameson Thies (1): usb: typec: ucsi: Clean up UCSI_CABLE_PROP macros Jan Kara (1): fat: fix uninitialized field in nostale filehandles Jani Nikula (9): drm/probe-helper: warn about negative .get_modes() drm/panel: do not return negative error codes from drm_panel_get_modes() drm/exynos: do not return negative values from .get_modes() drm/imx/ipuv3: do not return negative values from .get_modes() drm/vc4: hdmi: do not return negative values from .get_modes() drm/bridge: add ->edid_read hook and drm_bridge_edid_read() drm/bridge: lt8912b: use drm_bridge_edid_read() drm/bridge: lt8912b: clear the EDID property on failures drm/bridge: lt8912b: do not return negative values from .get_modes() Janusz Krzysztofik (1): drm/i915/hwmon: Fix locking inversion in sysfs getter Jason A. Donenfeld (3): wireguard: netlink: check for dangling peer via is_dead instead of empty list wireguard: netlink: access device through ctx instead of peer wireguard: selftests: set RISCV_ISA_FALLBACK on riscv{32,64} Jean-Baptiste Maneyrol (2): iio: imu: inv_mpu6050: fix frequency setting when chip is off iio: imu: inv_mpu6050: fix FIFO parsing when empty Jens Axboe (4): io_uring/net: correctly handle multishot recvmsg retry setup io_uring/rw: return IOU_ISSUE_SKIP_COMPLETE for multishot retry io_uring/futex: always remove futex entry for cancel all io_uring/waitid: always remove waitid entry for cancel all Jerome Brunet (1): nvmem: meson-efuse: fix function pointer type mismatch Jiawei Wang (1): ASoC: amd: yc: Revert "Fix non-functional mic on Lenovo 21J2" Jim Mattson (2): KVM: x86: Advertise CPUID.(EAX=7,ECX=2):EDX[5:0] to userspace KVM: x86: Use a switch statement and macros in __feature_translate() Joakim Zhang (1): remoteproc: virtio: Fix wdg cannot recovery remote processor Jocelyn Falempe (1): drm/vmwgfx: Create debugfs ttm_resource_manager entry only if needed Johan Hovold (2): PCI: qcom: Disable ASPM L0s for sc8280xp, sa8540p and sa8295p arm64: dts: qcom: sc8280xp-x13s: limit pcie4 link speed Johannes Berg (6): wifi: mac80211: track capability/opmode NSS separately debugfs: fix wait/cancellation handling during remove wifi: cfg80211: add a flag to disable wireless extensions wifi: iwlwifi: mvm: disable MLO for the time being wifi: iwlwifi: fw: don't always use FW dump trig wifi: iwlwifi: mvm: handle debugfs names more carefully Johannes Thumshirn (2): btrfs: zoned: don't skip block groups with 100% zone unusable btrfs: zoned: use zone aware sb location for scrub Johannes Weiner (2): mm: cachestat: fix two shmem bugs drm/amdgpu: fix deadlock while reading mqd from debugfs John David Anglin (1): parisc: Avoid clobbering the C/B bits in the PSW with tophys and tovirt macros John Ogness (1): printk: Update @console_may_schedule in console_trylock_spinning() John Sperbeck (1): init: open /initrd.image with O_LARGEFILE Jonas Gorski (1): serial: core: only stop transmit when HW fifo is empty Jonathon Hall (1): drm/i915: Do not match JSL in ehl_combo_pll_div_frac_wa_needed() Josef Bacik (2): nfs: fix UAF in direct writes btrfs: fix deadlock with fiemap and extent locking Josip Pavic (1): drm/amd/display: Allow dirty rects to be sent to dmub when abm is active Josua Mayer (1): hwmon: (amc6821) add of_match table KONDO KAZUMA(近藤　和真) (1): efi/libstub: fix efi_random_alloc() to allocate memory at alloc_min or higher address Kailang Yang (2): ALSA: hda/realtek - Fix headset Mic no show at resume back for Lenovo ALC897 platform ALSA: hda/realtek - Add Headset Mic supported Acer NB platform Kamalesh Babulal (1): cgroup/cpuset: Fix retval in update_cpumask() Kan Liang (1): perf top: Use evsel's cpus to replace user_requested_cpus Karol Herbst (1): drm/nouveau: fix stale locked mutex in nouveau_gem_ioctl_pushbuf Kees Cook (1): init/Kconfig: lower GCC version check for -Warray-bounds Kevin Loughlin (1): x86/sev: Skip ROM range scans and validation for SEV-SNP guests Krishna Kurapati (2): usb: gadget: ncm: Fix handling of zero block length packets usb: typec: ucsi: Fix race between typec_switch and role_switch Krishna chaitanya chundru (1): arm64: dts: qcom: sc7280: Add additional MSI interrupts Krzysztof Kozlowski (3): arm64: dts: qcom: sm8450-hdk: correct AMIC4 and AMIC5 microphones arm64: dts: qcom: sm8550-qrd: correct WCD9385 TX port mapping arm64: dts: qcom: sm8550-mtp: correct WCD9385 TX port mapping Kyle Tso (1): usb: typec: Return size of buffer if pd_set operation succeeds Laurent Pinchart (6): media: mc: Add local pad to pipeline regardless of the link state media: mc: Fix flags handling when creating pad links media: mc: Add num_links flag to media_pad media: mc: Rename pad variable to clarify intent media: mc: Expand MUST_CONNECT flag to always require an enabled link media: nxp: imx8-isi: Mark all crossbar sink pads as MUST_CONNECT Leo Ma (1): drm/amd/display: Fix noise issue on HDMI AV mute Ley Foon Tan (1): clocksource/drivers/timer-riscv: Clear timer interrupt on timer initialization Li Lingfeng (1): md: use RCU lock to protect traversal in md_spares_need_change() Li Ma (1): drm/amd/swsmu: modify the gfx activity scaling Liming Sun (1): sdhci-of-dwcmshc: disable PM runtime in dwcmshc_remove() Lino Sanfilippo (1): tpm,tpm_tis: Avoid warning splat at shutdown Linus Torvalds (1): Fix memory leak in posix_clock_open() Luiz Augusto von Dentz (1): Bluetooth: hci_sync: Fix not checking error on hci_cmd_sync_cancel_sync Ma Jun (3): drm/amdgpu/pm: Fix NULL pointer dereference when get power limit drm/amdgpu/pm: Check the validity of overdiver power limit drm/amdgpu/pm: Fix the error of pwm1_enable setting Manivannan Sadhasivam (1): PCI: qcom: Enable BDF to SID translation properly Marcel Ziswiler (1): Bluetooth: btnxpuart: Fix btnxpuart_close Marek Szyprowski (1): cpufreq: dt: always allocate zeroed cpumask Marek Vasut (1): media: nxp: imx8-isi: Check whether crossbar pad is non-NULL before access Mario Limonciello (1): drm/amd/display: Use freesync when `DRM_EDID_FEATURE_CONTINUOUS_FREQ` found Marios Makassikis (2): ksmbd: replace generic_fillattr with vfs_getattr ksmbd: retrieve number of blocks using vfs_getattr in set_file_allocation_info Martin Blumenstingl (1): clocksource/drivers/arm_global_timer: Fix maximum prescaler value Masami Hiramatsu (Google) (1): kprobes/x86: Use copy_from_kernel_nofault() to read from unsafe address Mathias Nyman (2): usb: port: Don't try to peer unused USB ports based on location xhci: Fix failure to detect ring expansion need. Matthew Wilcox (Oracle) (2): bounds: support non-power-of-two CONFIG_NR_CPUS ubifs: Set page uptodate in the correct place Maulik Shah (1): PM: suspend: Set mem_sleep_current during kernel command line setup Max Filippov (1): exec: Fix NOMMU linux_binprm::exec in transfer_args_to_stack() Max Nguyen (1): Input: xpad - add additional HyperX Controller Identifiers Maximilian Heyne (1): ext4: fix corruption during on-line resize Michael Ellerman (3): powerpc/smp: Adjust nr_cpu_ids to cover all threads of a core powerpc/smp: Increase nr_cpu_ids to include the boot CPU powerpc/fsl: Fix mfpmr build errors with newer binutils Michael Kelley (2): PCI: hv: Fix ring buffer size calculation Drivers: hv: vmbus: Calculate ring buffer size for more efficient use of memory Mickaël Salaün (1): landlock: Warn once if a Landlock action is requested while disabled Mika Westerberg (1): thunderbolt: Fix NULL pointer dereference in tb_port_update_credits() Mikko Rapeli (2): mmc: core: Initialize mmc_blk_ioc_data mmc: core: Avoid negative index with array access Miklos Szeredi (3): fuse: replace remaining make_bad_inode() with fuse_make_bad() fuse: fix root lookup with nonzero generation fuse: don't unhash root Mikulas Patocka (1): dm snapshot: fix lockup in dm_exception_table_exit Minas Harutyunyan (5): usb: dwc2: host: Fix remote wakeup from hibernation usb: dwc2: host: Fix hibernation flow usb: dwc2: host: Fix ISOC flow in DDMA mode usb: dwc2: gadget: Fix exiting from clock gating usb: dwc2: gadget: LPM flow fix Miquel Raynal (4): mtd: rawnand: Fix and simplify again the continuous read derivations mtd: rawnand: Add a helper for calculating a page index mtd: rawnand: Ensure all continuous terms are always in sync mtd: rawnand: Constrain even more when continuous reads are enabled Muhammad Usama Anjum (3): selftests/mm: gup_test: conform test to TAP format output scsi: lpfc: Correct size for cmdwqe/rspwqe for memset() scsi: lpfc: Correct size for wqe for memset() Namjae Jeon (2): ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16() ksmbd: fix potencial out-of-bounds when buffer offset is invalid Natanael Copa (1): tools/resolve_btfids: fix build with musl libc Nathan Chancellor (4): powerpc: xor_vmx: Add '-mhard-float' to CFLAGS kbuild: Move -Wenum-{compare-conditional,enum-conversion} into W=1 xfrm: Avoid clang fortify warning in copy_to_user_tmpl() hexagon: vmlinux.lds.S: handle attributes section Nicholas Kazlauskas (1): drm/amd/display: Fix idle check for shared firmware state Nick Morrow (1): wifi: rtw88: Add missing VID/PIDs for 8811CU and 8821CU Nicolas Pitre (1): vt: fix unicode buffer corruption when deleting characters Nicolin Chen (1): iommu/dma: Force swiotlb_max_mapping_size on an untrusted device Niklas Cassel (1): PCI: dwc: endpoint: Fix advertised resizable BAR size Nirmoy Das (1): drm/i915: Check before removing mm notifier Oleksandr Tymoshenko (1): efi: fix panic in kdump kernel Oliver Neukum (1): usb: cdc-wdm: close race between read and workqueue Pablo Neira Ayuso (3): netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout netfilter: nf_tables: disallow anonymous set with timeout flag netfilter: nf_tables: reject constant set with timeout Paolo Bonzini (1): SEV: disable SEV-ES DebugSwap by default Paul Menzel (1): PCI/DPC: Quirk PIO log size for Intel Raptor Lake Root Ports Paulo Alcantara (1): smb: client: stop revalidating reparse points unnecessarily Pavel Begunkov (4): io_uring: fix mshot read defer taskrun cqe posting io_uring: fix io_queue_proc modifying req->flags io_uring: fix mshot io-wq checks io_uring: clean rings on NO_MMAP alloc fail Pawan Gupta (1): x86/bugs: Use fixed addressing for VERW operand Peter Collingbourne (1): serial: Lock console when calling into driver before registration Philip Yang (1): drm/amdgpu: amdgpu_ttm_gart_bind set gtt bound flag Philipp Stanner (1): pci_iounmap(): Fix MMIO mapping leak Prashanth K (1): usb: xhci: Add error handling in xhci_map_urb_for_dma Qiang Zhang (1): memtest: use {READ,WRITE}_ONCE in memory scanning Qingliang Li (1): PM: sleep: wakeirq: fix wake irq warning in system suspend Qu Wenruo (1): btrfs: qgroup: always free reserved space for extent records Quentin Schulz (2): iio: adc: rockchip_saradc: fix bitmask for channels on SARADCv2 iio: adc: rockchip_saradc: use mask for write_enable bitfield Quinn Tran (6): scsi: qla2xxx: Prevent command send on chip reset scsi: qla2xxx: Fix N2N stuck connection scsi: qla2xxx: Split FCE|EFT trace control scsi: qla2xxx: NVME|FCP prefer flag not being honored scsi: qla2xxx: Fix command flush on cable pull scsi: qla2xxx: Delay I/O Abort on PCI error RD Babiera (1): usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group Rafael J. Wysocki (1): PCI/PM: Drain runtime-idle callbacks before driver removal Randy Dunlap (2): sparc64: NMI watchdog: fix return value of __setup handler sparc: vDSO: fix return value of __setup handler Relja Vojvodic (1): drm/amd/display: Add ODM check during pipe split/merge validation Richard Weinberger (1): ubi: Check for too small LEB size in VTBL code Rickard x Andersson (1): tty: serial: imx: Fix broken RS485 Roberto Sassu (2): smack: Set SMACK64TRANSMUTE only for dirs in smack_inode_setxattr() smack: Handle SMACK64TRANSMUTE in smack_inode_setsecurity() Rodrigo Siqueira (1): drm/amd/display: Return the correct HDCP error code Roger Quadros (2): usb: dwc3-am62: fix module unload/reload behavior usb: dwc3-am62: Disable wakeup at remove Romain Naour (1): mmc: sdhci-omap: re-tuning is needed after a pm transition to support emmc HS200 mode Roman Li (1): drm/amd/display: Fix bounds check for dcn35 DcfClocks Ryan Roberts (1): mm: swap: fix race between free_swap_and_cache() and swapoff() Ryusuke Konishi (2): nilfs2: fix failure to detect DAT corruption in btree and direct mappings nilfs2: prevent kernel bug at submit_bh_wbc() Sam Ravnborg (1): sparc32: Fix parport build with sparc32 Samuel Thibault (1): speakup: Fix 8bit characters from direct synth Saurav Kashyap (3): scsi: qla2xxx: Fix double free of the ha->vp_map pointer scsi: qla2xxx: Fix double free of fcport scsi: qla2xxx: Change debug message during driver unload Sean Anderson (2): soc: fsl: qbman: Always disable interrupts when taking cgr_lock soc: fsl: qbman: Use raw spinlock for cgr_lock Sean Christopherson (3): KVM: Always flush async #PF workqueue when vCPU is being destroyed KVM: x86: Mark target gfn of emulated atomic instruction as dirty KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region() SeongJae Park (1): selftests/mqueue: Set timeout to 180 seconds Sherry Sun (1): tty: serial: fsl_lpuart: avoid idle preamble pending if CTS is enabled Shivnandan Kumar (1): cpufreq: Limit resolving a frequency to policy min/max Shyam Prasad N (2): cifs: make sure server interfaces are requested only for SMB3+ cifs: reduce warning log level for server not advertising interfaces Sohaib Nadeem (1): drm/amd/display: Override min required DCFCLK in dml1_validate Srinivas Pandruvada (1): platform/x86/intel/tpmi: Change vsec offset to u64 Srinivasan Shanmugam (1): drm/amdgpu/display: Address kdoc for 'is_psr_su' in 'fill_dc_dirty_rects' Stanislaw Gruszka (1): PCI/AER: Block runtime suspend when handling errors Steve French (1): cifs: allow changing password during remount Steven Rostedt (Google) (9): ring-buffer: Fix waking up ring buffer readers ring-buffer: Do not set shortest_full when full target is hit ring-buffer: Fix resetting of shortest_full ring-buffer: Fix full_waiters_pending in poll ring-buffer: Use wait_event_interruptible() in ring_buffer_wait() NFSD: Fix nfsd_clid_class use of __string_len() macro drm/i915: Add missing ; to __assign_str() macros in tracepoint code net: hns3: tracing: fix hclgevf trace event strings tracing: Use .flush() call to wake up readers Sumit Garg (1): tee: optee: Fix kernel panic caused by incorrect error handling Sunmin Jeong (2): f2fs: mark inode dirty for FI_ATOMIC_COMMITTED flag f2fs: truncate page cache before clearing flags when aborting atomic write Swapnil Patel (1): drm/amd/display: Change default size for dummy plane in DML2 Tavian Barnes (1): btrfs: fix race in read_extent_buffer_pages() Thinh Nguyen (1): usb: dwc3: Properly set system wakeup Thomas Gleixner (1): x86/mpparse: Register APIC address only once Tony Battersby (1): block: Fix page refcounts for unaligned buffers in __bio_release_pages() Tor Vic (1): cpufreq: amd-pstate: Fix min_perf assignment in amd_pstate_adjust_perf() Toru Katagiri (1): USB: serial: cp210x: add pid/vid for TDK NC0110013M and MM0110113M Ville Syrjälä (11): drm/i915: Don't explode when the dig port we don't have an AUX CH drm/i915: Stop printing pipe name as hex drm/i915: Use named initializers for DPLL info drm/i915: Replace a memset() with zero initialization drm/i915: Try to preserve the current shared_dpll for fastset on type-c ports drm/i915: Include the PLL name in the debug messages drm/i915: Suppress old PLL pipe_mask checks for MG/TC/TBT PLLs drm/i915/bios: Tolerate devdata==NULL in intel_bios_encoder_supports_dp_dual_mode() drm/i915/vrr: Generate VRR "safe window" for DSB drm/i915/dsi: Go back to the previous INIT_OTP/DISPLAY_ON order, mostly drm/i915/dsb: Fix DSB vblank waits when using VRR Vitaly Chikunov (1): selftests/mm: Fix build with _FORTIFY_SOURCE Vitaly Prosyak (2): drm/amdgpu: fix use-after-free bug drm/sched: fix null-ptr-deref in init entity Vlastimil Babka (2): mm, mmap: fix vma_merge() case 7 with vma_ops->close mm, vmscan: prevent infinite loop for costly GFP_NOIO | __GFP_RETRY_MAYFAIL allocations Waiman Long (1): cgroup/cpuset: Fix a memory leak in update_exclusive_cpumask() Wayne Chang (2): phy: tegra: xusb: Add API to retrieve the port number of phy usb: gadget: tegra-xudc: Fix USB3 PHY retrieval logic Weitao Wang (1): USB: UAS: return ENODEV when submit urbs fail with device not attached Wenjing Liu (2): drm/amd/display: Update odm when ODM combine is changed on an otg master pipe with no plane drm/amd/display: set odm_combine_policy based on context in dcn32 resource Will Deacon (3): swiotlb: Fix double-allocation of slots due to broken alignment handling swiotlb: Honour dma_alloc_coherent() alignment in swiotlb_alloc() swiotlb: Fix alignment checks when both allocation and DMA masks are present Wolfram Sang (1): mmc: tmio: avoid concurrent runs of mmc_request_done() Xi Liu (1): drm/amd/display: Set DCN351 BB and IP the same as DCN35 Xingui Yang (2): scsi: libsas: Add a helper sas_get_sas_addr_and_dev_type() scsi: libsas: Fix disk not being scanned in after being removed Ye Zhang (1): thermal: devfreq_cooling: Fix perf state when calculate dfc res_util Yicong Yang (1): serial: port: Don't suspend if the port is still busy Yongqiang Liu (1): ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses Yongzhi Liu (1): usb: misc: ljca: Fix double free in error handling path Yu Kuai (9): md: don't clear MD_RECOVERY_FROZEN for new dm-raid until resume md: export helpers to stop sync_thread md: export helper md_is_rdwr() md: add a new helper reshape_interrupted() dm-raid: really frozen sync_thread during suspend md/dm-raid: don't call md_reap_sync_thread() directly dm-raid: add a new helper prepare_suspend() in md_personality dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent with reshape dm-raid: fix lockdep waring in "pers->hot_add_disk" Yuli Wang (1): LoongArch/crypto: Clean up useless assignment operations Zack Rusin (4): drm/vmwgfx: Unmap the surface before resetting it on a plane state drm/vmwgfx: Fix possible null pointer derefence with invalid contexts drm/vmwgfx: Fix the lifetime of the bo cursor memory drm/ttm: Make sure the mapped tt pages are decrypted when needed Zev Weiss (2): prctl: generalize PR_SET_MDWE support check to be per-arch ARM: prctl: reject PR_SET_MDWE on pre-ARMv6 Zhang Rui (5): thermal/intel: Fix intel_tcc_get_temp() to support negative CPU temperature powercap: intel_rapl: Fix a NULL pointer dereference powercap: intel_rapl: Fix locking in TPMI RAPL powercap: intel_rapl_tpmi: Fix a register bug powercap: intel_rapl_tpmi: Fix System Domain probing Zhang Yi (1): ubi: correct the calculation of fastmap size Zheng Wang (1): wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach Zoltan HERPAI (1): pwm: img: fix pwm clock lookup yuan linyu (1): usb: udc: remove warning when queue disabled ep

1 year, 2 months

1
1
0 0

[PATCH 2/2] gpio: cdev: check for NULL labels when sanitizing them for irqs

by Kent Gibson

From: Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> We need to take into account that a line's consumer label may be NULL and not try to kstrdup() it in that case but rather pass the NULL pointer up the stack to the interrupt request function. To that end: let make_irq_label() return NULL as a valid return value and use ERR_PTR() instead to signal an allocation failure to callers. Cc: stable(a)vger.kernel.org Fixes: b34490879baa ("gpio: cdev: sanitize the label before requesting the interrupt") Reported-by: Linux Kernel Functional Testing <lkft(a)linaro.org> Closes: https://lore.kernel.org/lkml/20240402093534.212283-1-naresh.kamboju@linaro.… Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> Signed-off-by: Kent Gibson <warthog618(a)gmail.com> (rebased) --- drivers/gpio/gpiolib-cdev.c | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-) diff --git a/drivers/gpio/gpiolib-cdev.c b/drivers/gpio/gpiolib-cdev.c index f4c2da2041e5..8112ec36e55f 100644 --- a/drivers/gpio/gpiolib-cdev.c +++ b/drivers/gpio/gpiolib-cdev.c @@ -730,7 +730,16 @@ static u32 line_event_id(int level) static inline char *make_irq_label(const char *orig) { - return kstrdup_and_replace(orig, '/', ':', GFP_KERNEL); + char *new; + + if (!orig) + return NULL; + + new = kstrdup_and_replace(orig, '/', ':', GFP_KERNEL); + if (!new) + return ERR_PTR(-ENOMEM); + + return new; } static inline void free_irq_label(const char *label) @@ -1049,8 +1058,8 @@ static int debounce_setup(struct line *line, unsigned int debounce_period_us) return -ENXIO; label = make_irq_label(line->req->label); - if (!label) - return -ENOMEM; + if (IS_ERR(label)) + return PTR_ERR(label); irqflags = IRQF_TRIGGER_FALLING | IRQF_TRIGGER_RISING; ret = request_irq(irq, debounce_irq_handler, irqflags, @@ -1165,8 +1174,8 @@ static int edge_detector_setup(struct line *line, irqflags |= IRQF_ONESHOT; label = make_irq_label(line->req->label); - if (!label) - return -ENOMEM; + if (IS_ERR(label)) + return PTR_ERR(label); /* Request a thread to read the events */ ret = request_threaded_irq(irq, edge_irq_handler, edge_irq_thread, @@ -2224,8 +2233,8 @@ static int lineevent_create(struct gpio_device *gdev, void __user *ip) goto out_free_le; label = make_irq_label(le->label); - if (!label) { - ret = -ENOMEM; + if (IS_ERR(label)) { + ret = PTR_ERR(label); goto out_free_le; } -- 2.39.2

1 year, 2 months

1
0
0 0

[PATCH net v3] virtio_net: Do not send RSS key if it is not supported

by Breno Leitao

There is a bug when setting the RSS options in virtio_net that can break the whole machine, getting the kernel into an infinite loop. Running the following command in any QEMU virtual machine with virtionet will reproduce this problem: # ethtool -X eth0 hfunc toeplitz This is how the problem happens: 1) ethtool_set_rxfh() calls virtnet_set_rxfh() 2) virtnet_set_rxfh() calls virtnet_commit_rss_command() 3) virtnet_commit_rss_command() populates 4 entries for the rss scatter-gather 4) Since the command above does not have a key, then the last scatter-gatter entry will be zeroed, since rss_key_size == 0. sg_buf_size = vi->rss_key_size; 5) This buffer is passed to qemu, but qemu is not happy with a buffer with zero length, and do the following in virtqueue_map_desc() (QEMU function): if (!sz) { virtio_error(vdev, "virtio: zero sized buffers are not allowed"); 6) virtio_error() (also QEMU function) set the device as broken vdev->broken = true; 7) Qemu bails out, and do not repond this crazy kernel. 8) The kernel is waiting for the response to come back (function virtnet_send_command()) 9) The kernel is waiting doing the following : while (!virtqueue_get_buf(vi->cvq, &tmp) && !virtqueue_is_broken(vi->cvq)) cpu_relax(); 10) None of the following functions above is true, thus, the kernel loops here forever. Keeping in mind that virtqueue_is_broken() does not look at the qemu `vdev->broken`, so, it never realizes that the vitio is broken at QEMU side. Fix it by not sending RSS commands if the feature is not available in the device. Fixes: c7114b1249fa ("drivers/net/virtio_net: Added basic RSS support.") Cc: stable(a)vger.kernel.org Cc: qemu-devel(a)nongnu.org Signed-off-by: Breno Leitao <leitao(a)debian.org> --- Changelog: V2: * Moved from creating a valid packet, by rejecting the request completely V3: * Got some good feedback from and Xuan Zhuo and Heng Qi, and reworked the rejection path. --- drivers/net/virtio_net.c | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-) diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c index c22d1118a133..c4a21ec51adf 100644 --- a/drivers/net/virtio_net.c +++ b/drivers/net/virtio_net.c @@ -3807,6 +3807,7 @@ static int virtnet_set_rxfh(struct net_device *dev, struct netlink_ext_ack *extack) { struct virtnet_info *vi = netdev_priv(dev); + bool update = false; int i; if (rxfh->hfunc != ETH_RSS_HASH_NO_CHANGE && @@ -3814,13 +3815,24 @@ static int virtnet_set_rxfh(struct net_device *dev, return -EOPNOTSUPP; if (rxfh->indir) { + if (!vi->has_rss) + return -EOPNOTSUPP; + for (i = 0; i < vi->rss_indir_table_size; ++i) vi->ctrl->rss.indirection_table[i] = rxfh->indir[i]; + update = true; } - if (rxfh->key) + + if (rxfh->key) { + if (!vi->has_rss && !vi->has_rss_hash_report) + return -EOPNOTSUPP; + memcpy(vi->ctrl->rss.key, rxfh->key, vi->rss_key_size); + update = true; + } - virtnet_commit_rss_command(vi); + if (update) + virtnet_commit_rss_command(vi); return 0; } @@ -4729,13 +4741,15 @@ static int virtnet_probe(struct virtio_device *vdev) if (virtio_has_feature(vdev, VIRTIO_NET_F_HASH_REPORT)) vi->has_rss_hash_report = true; - if (virtio_has_feature(vdev, VIRTIO_NET_F_RSS)) + if (virtio_has_feature(vdev, VIRTIO_NET_F_RSS)) { vi->has_rss = true; - if (vi->has_rss || vi->has_rss_hash_report) { vi->rss_indir_table_size = virtio_cread16(vdev, offsetof(struct virtio_net_config, rss_max_indirection_table_length)); + } + + if (vi->has_rss || vi->has_rss_hash_report) { vi->rss_key_size = virtio_cread8(vdev, offsetof(struct virtio_net_config, rss_max_key_size)); -- 2.43.0

1 year, 2 months

4
5
0 0

[PATCH v3] HID: i2c-hid: Revert to await reset ACK before reading report descriptor

by Hans de Goede

From: Kenny Levinsen <kl(a)kl.wtf> In af93a167eda9, i2c_hid_parse was changed to continue with reading the report descriptor before waiting for reset to be acknowledged. This has lead to two regressions: 1. We fail to handle reset acknowledgment if it happens while reading the report descriptor. The transfer sets I2C_HID_READ_PENDING, which causes the IRQ handler to return without doing anything. This affects both a Wacom touchscreen and a Sensel touchpad. 2. On a Sensel touchpad, reading the report descriptor this quickly after reset results in all zeroes or partial zeroes. The issues were observed on the Lenovo Thinkpad Z16 Gen 2. The change in question was made based on a Microsoft article[0] stating that Windows 8 *may* read the report descriptor in parallel with awaiting reset acknowledgment, intended as a slight reset performance optimization. Perhaps they only do this if reset is not completing quickly enough for their tastes? As the code is not currently ready to read registers in parallel with a pending reset acknowledgment, and as reading quickly breaks the report descriptor on the Sensel touchpad, revert to waiting for reset acknowledgment before proceeding to read the report descriptor. [0]: https://learn.microsoft.com/en-us/windows-hardware/drivers/hid/plug-and-pla… Fixes: af93a167eda9 ("HID: i2c-hid: Move i2c_hid_finish_hwreset() to after reading the report-descriptor") Closes: https://bugzilla.redhat.com/show_bug.cgi?id=2271136 Cc: stable(a)vger.kernel.org Signed-off-by: Kenny Levinsen <kl(a)kl.wtf> Link: https://lore.kernel.org/r/20240331182440.14477-1-kl@kl.wtf [hdegoede(a)redhat.com Drop no longer necessary abort_reset error exit path] Signed-off-by: Hans de Goede <hdegoede(a)redhat.com> --- drivers/hid/i2c-hid/i2c-hid-core.c | 29 ++++++++--------------------- 1 file changed, 8 insertions(+), 21 deletions(-) diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c index 2df1ab3c31cc..13d67d7c67b4 100644 --- a/drivers/hid/i2c-hid/i2c-hid-core.c +++ b/drivers/hid/i2c-hid/i2c-hid-core.c @@ -735,12 +735,15 @@ static int i2c_hid_parse(struct hid_device *hid) mutex_lock(&ihid->reset_lock); do { ret = i2c_hid_start_hwreset(ihid); - if (ret) + if (ret == 0) + ret = i2c_hid_finish_hwreset(ihid); + else msleep(1000); } while (tries-- > 0 && ret); + mutex_unlock(&ihid->reset_lock); if (ret) - goto abort_reset; + return ret; use_override = i2c_hid_get_dmi_hid_report_desc_override(client->name, &rsize); @@ -750,11 +753,8 @@ static int i2c_hid_parse(struct hid_device *hid) i2c_hid_dbg(ihid, "Using a HID report descriptor override\n"); } else { rdesc = kzalloc(rsize, GFP_KERNEL); - - if (!rdesc) { - ret = -ENOMEM; - goto abort_reset; - } + if (!rdesc) + return -ENOMEM; i2c_hid_dbg(ihid, "asking HID report descriptor\n"); @@ -763,23 +763,10 @@ static int i2c_hid_parse(struct hid_device *hid) rdesc, rsize); if (ret) { hid_err(hid, "reading report descriptor failed\n"); - goto abort_reset; + goto out; } } - /* - * Windows directly reads the report-descriptor after sending reset - * and then waits for resets completion afterwards. Some touchpads - * actually wait for the report-descriptor to be read before signalling - * reset completion. - */ - ret = i2c_hid_finish_hwreset(ihid); -abort_reset: - clear_bit(I2C_HID_RESET_PENDING, &ihid->flags); - mutex_unlock(&ihid->reset_lock); - if (ret) - goto out; - i2c_hid_dbg(ihid, "Report Descriptor: %*ph\n", rsize, rdesc); ret = hid_parse_report(hid, rdesc, rsize); -- 2.44.0

1 year, 2 months

3
2
0 0

[PATCH v2 1/2] Revert "mei: vsc: Call wake_up() in the threaded IRQ handler"

by Wentong Wu

From: Sakari Ailus <sakari.ailus(a)linux.intel.com> This reverts commit 058a38acba15fd8e7b262ec6e17c4204cb15f984. It's not necessary to avoid a spinlock, a sleeping lock on PREEMPT_RT, in an interrupt handler as the interrupt handler itself would be called in a process context if PREEMPT_RT is enabled. So revert the patch. Cc: stable(a)vger.kernel.org # for 6.8 Signed-off-by: Sakari Ailus <sakari.ailus(a)linux.intel.com> --- drivers/misc/mei/vsc-tp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/misc/mei/vsc-tp.c b/drivers/misc/mei/vsc-tp.c index ecfb70cd057c..968a92a7425d 100644 --- a/drivers/misc/mei/vsc-tp.c +++ b/drivers/misc/mei/vsc-tp.c @@ -419,6 +419,8 @@ static irqreturn_t vsc_tp_isr(int irq, void *data) atomic_inc(&tp->assert_cnt); + wake_up(&tp->xfer_wait); + return IRQ_WAKE_THREAD; } @@ -426,8 +428,6 @@ static irqreturn_t vsc_tp_thread_isr(int irq, void *data) { struct vsc_tp *tp = data; - wake_up(&tp->xfer_wait); - if (tp->event_notify) tp->event_notify(tp->event_notify_context); -- 2.34.1

1 year, 2 months

2
3
0 0

[PATCH] gpio: cdev: check for NULL labels when sanitizing them for irqs

by Bartosz Golaszewski

From: Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> We need to take into account that a line's consumer label may be NULL and not try to kstrdup() it in that case but rather pass the NULL pointer up the stack to the interrupt request function. To that end: let make_irq_label() return NULL as a valid return value and use ERR_PTR() instead to signal an allocation failure to callers. Cc: stable(a)vger.kernel.org Fixes: b34490879baa ("gpio: cdev: sanitize the label before requesting the interrupt") Reported-by: Linux Kernel Functional Testing <lkft(a)linaro.org> Closes: https://lore.kernel.org/lkml/20240402093534.212283-1-naresh.kamboju@linaro.… Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> --- drivers/gpio/gpiolib-cdev.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/drivers/gpio/gpiolib-cdev.c b/drivers/gpio/gpiolib-cdev.c index fa9635610251..1426cc1c4a28 100644 --- a/drivers/gpio/gpiolib-cdev.c +++ b/drivers/gpio/gpiolib-cdev.c @@ -1085,7 +1085,16 @@ static u32 gpio_v2_line_config_debounce_period(struct gpio_v2_line_config *lc, static inline char *make_irq_label(const char *orig) { - return kstrdup_and_replace(orig, '/', ':', GFP_KERNEL); + char *new; + + if (!orig) + return NULL; + + new = kstrdup_and_replace(orig, '/', ':', GFP_KERNEL); + if (!new) + return ERR_PTR(-ENOMEM); + + return new; } static inline void free_irq_label(const char *label) @@ -1158,8 +1167,8 @@ static int edge_detector_setup(struct line *line, irqflags |= IRQF_ONESHOT; label = make_irq_label(line->req->label); - if (!label) - return -ENOMEM; + if (IS_ERR(label)) + return PTR_ERR(label); /* Request a thread to read the events */ ret = request_threaded_irq(irq, edge_irq_handler, edge_irq_thread, @@ -2217,8 +2226,8 @@ static int lineevent_create(struct gpio_device *gdev, void __user *ip) goto out_free_le; label = make_irq_label(le->label); - if (!label) { - ret = -ENOMEM; + if (IS_ERR(label)) { + ret = PTR_ERR(label); goto out_free_le; } -- 2.40.1

1 year, 2 months

3
4
0 0

[PATCH] drm/vkms: call drm_atomic_helper_shutdown before drm_dev_put()

by Guo Mengqi

commit 73a82b22963d ("drm/atomic: Fix potential use-after-free in nonblocking commits") introduced drm_dev_get/put() to drm_atomic_helper_shutdown(). And this cause problem in vkms driver exit process. vkms_exit() drm_dev_put() vkms_release() drm_atomic_helper_shutdown() drm_dev_get() drm_dev_put() vkms_release() ------ null pointer access Using 4.19 stable x86 image on qemu, below stacktrace can be triggered by load and unload vkms.ko. root:~ # insmod vkms.ko [ 142.135449] [drm] Supports vblank timestamp caching Rev 2 (21.10.2013). [ 142.138713] [drm] Driver supports precise vblank timestamp query. [ 142.142390] [drm] Initialized vkms 1.0.0 20180514 for virtual device on minor 0 root:~ # rmmod vkms.ko [ 144.093710] BUG: unable to handle kernel NULL pointer dereference at 00000000000000a0 [ 144.097491] PGD 800000023624e067 P4D 800000023624e067 PUD 22ab59067 PMD 0 [ 144.100802] Oops: 0000 [#1] SMP PTI [ 144.102502] CPU: 0 PID: 3615 Comm: rmmod Not tainted 4.19.310 #1 [ 144.104452] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [ 144.107238] RIP: 0010:device_del+0x34/0x3a0 ... [ 144.131323] Call Trace: [ 144.131962] ? __die+0x7d/0xc0 [ 144.132711] ? no_context+0x152/0x3b0 [ 144.133605] ? wake_up_q+0x70/0x70 [ 144.134436] ? __do_page_fault+0x342/0x4b0 [ 144.135445] ? __switch_to_asm+0x41/0x70 [ 144.136416] ? __switch_to_asm+0x35/0x70 [ 144.137366] ? page_fault+0x1e/0x30 [ 144.138214] ? __drm_atomic_state_free+0x51/0x60 [ 144.139331] ? device_del+0x34/0x3a0 [ 144.140197] platform_device_del.part.14+0x19/0x70 [ 144.141348] platform_device_unregister+0xe/0x20 [ 144.142458] vkms_release+0x10/0x30 [vkms] [ 144.143449] __drm_atomic_helper_disable_all.constprop.31+0x13b/0x150 [ 144.144980] drm_atomic_helper_shutdown+0x4b/0x90 [ 144.146102] vkms_release+0x18/0x30 [vkms] [ 144.147107] vkms_exit+0x29/0x8ec [vkms] [ 144.148053] __x64_sys_delete_module+0x155/0x220 [ 144.149168] do_syscall_64+0x43/0x100 [ 144.150056] entry_SYSCALL_64_after_hwframe+0x5c/0xc1 It seems that the proper unload sequence is: drm_atomic_helper_shutdown(); drm_dev_put(); Just put drm_atomic_helper_shutdown() before drm_dev_put() should solve the problem. Fixes: 73a82b22963d ("drm/atomic: Fix potential use-after-free in nonblocking commits") Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- drivers/gpu/drm/vkms/vkms_drv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/vkms/vkms_drv.c b/drivers/gpu/drm/vkms/vkms_drv.c index b1201c18d3eb..d32e08f17427 100644 --- a/drivers/gpu/drm/vkms/vkms_drv.c +++ b/drivers/gpu/drm/vkms/vkms_drv.c @@ -39,7 +39,6 @@ static void vkms_release(struct drm_device *dev) struct vkms_device *vkms = container_of(dev, struct vkms_device, drm); platform_device_unregister(vkms->platform); - drm_atomic_helper_shutdown(&vkms->drm); drm_mode_config_cleanup(&vkms->drm); drm_dev_fini(&vkms->drm); } @@ -137,6 +136,7 @@ static void __exit vkms_exit(void) } drm_dev_unregister(&vkms_device->drm); + drm_atomic_helper_shutdown(&vkms_device->drm); drm_dev_put(&vkms_device->drm); kfree(vkms_device); -- 2.17.1

1 year, 2 months

4
5
0 0

[PATCH 02/11] drm/mgag200: Bind I2C lifetime to DRM device

by Thomas Zimmermann

Managed cleanup with devm_add_action_or_reset() will release the I2C adapter when the underlying Linux device goes away. But the connector still refers to it, so this cleanup leaves behind a stale pointer in struct drm_connector.ddc. Bind the lifetime of the I2C adapter to the connector's lifetime by using DRM's managed release. When the DRM device goes away (after the Linux device) DRM will first clean up the connector and then clean up the I2C adapter. Signed-off-by: Thomas Zimmermann <tzimmermann(a)suse.de> Fixes: b279df242972 ("drm/mgag200: Switch I2C code to managed cleanup") Cc: Thomas Zimmermann <tzimmermann(a)suse.de> Cc: Jocelyn Falempe <jfalempe(a)redhat.com> Cc: Dave Airlie <airlied(a)redhat.com> Cc: dri-devel(a)lists.freedesktop.org Cc: <stable(a)vger.kernel.org> # v6.0+ --- drivers/gpu/drm/mgag200/mgag200_i2c.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/mgag200/mgag200_i2c.c b/drivers/gpu/drm/mgag200/mgag200_i2c.c index 1029fef590f9b..4caeb68f3010c 100644 --- a/drivers/gpu/drm/mgag200/mgag200_i2c.c +++ b/drivers/gpu/drm/mgag200/mgag200_i2c.c @@ -31,6 +31,8 @@ #include <linux/i2c.h> #include <linux/pci.h> +#include <drm/drm_managed.h> + #include "mgag200_drv.h" static int mga_i2c_read_gpio(struct mga_device *mdev) @@ -86,7 +88,7 @@ static int mga_gpio_getscl(void *data) return (mga_i2c_read_gpio(mdev) & i2c->clock) ? 1 : 0; } -static void mgag200_i2c_release(void *res) +static void mgag200_i2c_release(struct drm_device *dev, void *res) { struct mga_i2c_chan *i2c = res; @@ -125,5 +127,5 @@ int mgag200_i2c_init(struct mga_device *mdev, struct mga_i2c_chan *i2c) if (ret) return ret; - return devm_add_action_or_reset(dev->dev, mgag200_i2c_release, i2c); + return drmm_add_action_or_reset(dev, mgag200_i2c_release, i2c); } -- 2.44.0

1 year, 2 months

1
0
0 0

[PATCH 01/11] drm/mgag200: Set DDC timeout in milliseconds

by Thomas Zimmermann

Compute the i2c timeout in jiffies from a value in milliseconds. The original values of 2 jiffies equals 2 milliseconds if HZ has been configured to a value of 1000. This corresponds to 2.2 milliseconds used by most other DRM drivers. Update mgag200 accordingly. Signed-off-by: Thomas Zimmermann <tzimmermann(a)suse.de> Fixes: 414c45310625 ("mgag200: initial g200se driver (v2)") Cc: Dave Airlie <airlied(a)redhat.com> Cc: Maarten Lankhorst <maarten.lankhorst(a)linux.intel.com> Cc: Maxime Ripard <mripard(a)kernel.org> Cc: Thomas Zimmermann <tzimmermann(a)suse.de> Cc: Jocelyn Falempe <jfalempe(a)redhat.com> Cc: dri-devel(a)lists.freedesktop.org Cc: <stable(a)vger.kernel.org> # v3.5+ --- drivers/gpu/drm/mgag200/mgag200_i2c.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/mgag200/mgag200_i2c.c b/drivers/gpu/drm/mgag200/mgag200_i2c.c index 423eb302be7eb..1029fef590f9b 100644 --- a/drivers/gpu/drm/mgag200/mgag200_i2c.c +++ b/drivers/gpu/drm/mgag200/mgag200_i2c.c @@ -114,7 +114,7 @@ int mgag200_i2c_init(struct mga_device *mdev, struct mga_i2c_chan *i2c) i2c->adapter.algo_data = &i2c->bit; i2c->bit.udelay = 10; - i2c->bit.timeout = 2; + i2c->bit.timeout = usecs_to_jiffies(2200); i2c->bit.data = i2c; i2c->bit.setsda = mga_gpio_setsda; i2c->bit.setscl = mga_gpio_setscl; -- 2.44.0

1 year, 2 months

1
0
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror April 2024