August 2024 - Linux-stable-mirror

[PATCH v5] scsi: sd: Ignore command SYNC CACHE error if format in progress

by Yihang Li

If formatting a suspended disk (such as formatting with different DIF type), the disk will be resuming first, and then the format command will submit to the disk through SG_IO ioctl. When the disk is processing the format command, the system does not submit other commands to the disk. Therefore, the system attempts to suspend the disk again and sends the SYNC CACHE command. However, the SYNC CACHE command will fail because the disk is in the formatting process, which will cause the runtime_status of the disk to error and it is difficult for user to recover it. Error info like: [ 669.925325] sd 6:0:6:0: [sdg] Synchronizing SCSI cache [ 670.202371] sd 6:0:6:0: [sdg] Synchronize Cache(10) failed: Result: hostbyte=0x00 driverbyte=DRIVER_OK [ 670.216300] sd 6:0:6:0: [sdg] Sense Key : 0x2 [current] [ 670.221860] sd 6:0:6:0: [sdg] ASC=0x4 ASCQ=0x4 To solve the issue, ignore the error and return success/0 when formatting in progress. Cc: stable(a)vger.kernel.org Signed-off-by: Yihang Li <liyihang9(a)huawei.com> Reviewed-by: Bart Van Assche <bvanassche(a)acm.org> --- Changes since v4: - Rename the commit title. - Ignore the SYNC command error during formatting as suggested by Damien. Changes since v3: - Add Cc tag for kernel stable. Changes since v2: - Add Reviewed-by for Bart. Changes since v1: - Updated and added error information to the patch description. --- drivers/scsi/sd.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c index adeaa8ab9951..2d7240a24b52 100644 --- a/drivers/scsi/sd.c +++ b/drivers/scsi/sd.c @@ -1823,13 +1823,15 @@ static int sd_sync_cache(struct scsi_disk *sdkp) (sshdr.asc == 0x74 && sshdr.ascq == 0x71)) /* drive is password locked */ /* this is no error here */ return 0; + /* - * This drive doesn't support sync and there's not much - * we can do because this is called during shutdown - * or suspend so just return success so those operations - * can proceed. + * If a format is in progress or if the drive does not + * support sync, there is not much we can do because + * this is called during shutdown or suspend so just + * return success so those operations can proceed. */ - if (sshdr.sense_key == ILLEGAL_REQUEST) + if ((sshdr.asc == 0x04 && sshdr.ascq == 0x04) || + sshdr.sense_key == ILLEGAL_REQUEST) return 0; } -- 2.33.0

5 months, 1 week

3
7
0 0

[PATCH] phy: qualcomm: Check NULL ptr on lvts_data in qcom_ipq806x_usb_phy_probe()

by Ma Ke

of_device_get_match_data() can return NULL if of_match_device failed, and the pointer 'data' was dereferenced without checking against NULL. Add checking of pointer 'data' in qcom_ipq806x_usb_phy_probe(). Cc: stable(a)vger.kernel.org Fixes: ef19b117b834 ("phy: qualcomm: add qcom ipq806x dwc usb phy driver") Signed-off-by: Ma Ke <make24(a)iscas.ac.cn> --- drivers/phy/qualcomm/phy-qcom-ipq806x-usb.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/phy/qualcomm/phy-qcom-ipq806x-usb.c b/drivers/phy/qualcomm/phy-qcom-ipq806x-usb.c index 06392ed7c91b..9b9fd9c1b1f7 100644 --- a/drivers/phy/qualcomm/phy-qcom-ipq806x-usb.c +++ b/drivers/phy/qualcomm/phy-qcom-ipq806x-usb.c @@ -492,6 +492,8 @@ static int qcom_ipq806x_usb_phy_probe(struct platform_device *pdev) return -ENOMEM; data = of_device_get_match_data(&pdev->dev); + if (!data) + return -ENODEV; phy_dwc3->dev = &pdev->dev; -- 2.25.1

5 months, 1 week

3
2
0 0

[PATCH 6.10 000/263] 6.10.5-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.10.5 release. There are 263 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 14 Aug 2024 16:00:26 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.10.5-rc1… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.10.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.10.5-rc1 Filipe Manana <fdmanana(a)suse.com> btrfs: fix double inode unlock for direct IO sync writes Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: join: test both signal & subflow Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: join: ability to invert ADD_ADDR check Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: do not ignore 'subflow' if 'signal' flag is also set Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: don't try to create sf if alloc failed Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: reduce indentation blocks Wayne Lin <wayne.lin(a)amd.com> drm/amd/display: Defer handling mst up request in resume Swapnil Patel <swapnil.patel(a)amd.com> drm/amd/display: Change ASSR disable sequence Natanel Roizenman <natanel.roizenman(a)amd.com> drm/amd/display: Add null check in resource_log_pipe_topology_update Michal Kubiak <michal.kubiak(a)intel.com> idpf: fix memleak in vport interrupt configuration Filipe Manana <fdmanana(a)suse.com> btrfs: fix corruption after buffer fault in during direct IO append write Ivan Lipski <ivlipski(a)amd.com> Revert "drm/amd/display: Add NULL check for 'afb' before dereferencing in amdgpu_dm_plane_handle_cursor_update" Sung-huai Wang <danny.wang(a)amd.com> Revert "drm/amd/display: Handle HPD_IRQ for internal link" Jens Axboe <axboe(a)kernel.dk> block: use the right type for stub rq_integrity_vec() Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: deny endp with signal + subflow + port Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: fully established after ADD_ADDR echo on MPJ Bill Wendling <morbo(a)google.com> drm/radeon: Remove __counted_by from StateArray.states[] Thomas Zimmermann <tzimmermann(a)suse.de> drm/mgag200: Bind I2C lifetime to DRM device Thomas Zimmermann <tzimmermann(a)suse.de> drm/mgag200: Set DDC timeout in milliseconds Dragan Simic <dsimic(a)manjaro.org> drm/lima: Mark simple_ondemand governor as softdep Wayne Lin <Wayne.Lin(a)amd.com> drm/dp_mst: Skip CSN if topology probing is not done yet Lucas Stach <l.stach(a)pengutronix.de> drm/bridge: analogix_dp: properly handle zero sized AUX transactions Yang Yingliang <yangyingliang(a)huawei.com> sched/core: Fix unbalance set_rq_online/offline() in sched_cpu_deactivate() Yang Yingliang <yangyingliang(a)huawei.com> sched/core: Introduce sched_set_rq_on/offline() helper Yang Yingliang <yangyingliang(a)huawei.com> sched/smt: Fix unbalance sched_smt_present dec/inc Yang Yingliang <yangyingliang(a)huawei.com> sched/smt: Introduce sched_smt_present_inc/dec() helper Andi Kleen <ak(a)linux.intel.com> x86/mtrr: Check if fixed MTRRs exist before saving them Chen Yu <yu.c.chen(a)intel.com> x86/paravirt: Fix incorrect virt spinlock setting on bare metal Qu Wenruo <wqu(a)suse.com> btrfs: avoid using fixed char array size for tree names Dmitry Safonov <0x7f454c46(a)gmail.com> net/tcp: Disable TCP-AO static key after RCU grace period Muchun Song <muchun.song(a)linux.dev> mm: list_lru: fix UAF for memory cgroup Nico Pache <npache(a)redhat.com> selftests: mm: add s390 to ARCH check Mathias Krause <minipli(a)grsecurity.net> eventfs: Use SRCU for freeing eventfs_inodes Mathias Krause <minipli(a)grsecurity.net> eventfs: Don't return NULL in eventfs_create_dir() Steve French <stfrench(a)microsoft.com> smb3: fix setting SecurityFlags when encryption is required Waiman Long <longman(a)redhat.com> padata: Fix possible divide-by-0 panic in padata_mt_helper() Tze-nan Wu <Tze-nan.Wu(a)mediatek.com> tracing: Fix overflow in get_free_elt() Steven Rostedt <rostedt(a)goodmis.org> tracing: Have format file honor EVENT_FILE_FL_FREED Hans de Goede <hdegoede(a)redhat.com> power: supply: axp288_charger: Round constant_charge_voltage writes down Hans de Goede <hdegoede(a)redhat.com> power: supply: axp288_charger: Fix constant_charge_voltage writes Neil Armstrong <neil.armstrong(a)linaro.org> power: supply: qcom_battmgr: return EAGAIN when firmware service is not up Miao Wang <shankerwangmiao(a)gmail.com> LoongArch: Enable general EFI poweroff method Shay Drory <shayd(a)nvidia.com> genirq/irqdesc: Honor caller provided affinity in alloc_desc() Yong-Xuan Wang <yongxuan.wang(a)sifive.com> irqchip/riscv-aplic: Retrigger MSI interrupt on source configuration Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> irqchip/xilinx: Fix shift out of bounds Andrey Konovalov <andreyknvl(a)gmail.com> kcov: properly check for softirq context Konrad Dybcio <konrad.dybcio(a)linaro.org> spmi: pmic-arb: Pass the correct of_node to irq_domain_add_tree Takashi Iwai <tiwai(a)suse.de> ASoC: amd: yc: Add quirk entry for OMEN by HP Gaming Laptop 16-n0xxx Mikulas Patocka <mpatocka(a)redhat.com> parisc: fix a possible DMA corruption Mikulas Patocka <mpatocka(a)redhat.com> parisc: fix unaligned accesses in BPF Shakeel Butt <shakeel.butt(a)linux.dev> memcg: protect concurrent access to mem_cgroup_idr Max Krummenacher <max.krummenacher(a)toradex.com> tty: vt: conmakehash: cope with abs_srctree no longer in env Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: sc16is7xx: fix invalid FIFO access with special register set Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: sc16is7xx: fix TX fifo corruption George Kennedy <george.kennedy(a)oracle.com> serial: core: check uartclk for zero to avoid divide by zero Thomas Gleixner <tglx(a)linutronix.de> timekeeping: Fix bogus clock_was_set() invocation in do_adjtimex() Justin Stitt <justinstitt(a)google.com> ntp: Safeguard against time_constant overflow Steven Rostedt <rostedt(a)goodmis.org> tracefs: Use generic inode RCU for synchronizing freeing Mathias Krause <minipli(a)grsecurity.net> tracefs: Fix inode allocation Francesco Dolcini <francesco.dolcini(a)toradex.com> arm64: dts: ti: k3-am62-verdin-dahlia: Keep CTRL_SLEEP_MOCI# regulator on Dan Williams <dan.j.williams(a)intel.com> driver core: Fix uevent_show() vs driver detach race Justin Stitt <justinstitt(a)google.com> ntp: Clamp maxerror and esterror to operating range David Collins <quic_collinsd(a)quicinc.com> spmi: pmic-arb: add missing newline in dev_err format strings Jason Wang <jasowang(a)redhat.com> vhost-vdpa: switch to use vmf_insert_pfn() in the fault handler Jean-Michel Hautbois <jeanmichel.hautbois(a)yoseli.org> media: v4l: Fix missing tabular column hint for Y14P format Thomas Gleixner <tglx(a)linutronix.de> tick/broadcast: Move per CPU pointer access into the atomic section Vamshi Gajjela <vamshigajjela(a)google.com> scsi: ufs: core: Fix hba->last_dme_cmd_tstamp timestamp updating logic Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> scsi: ufs: core: Do not set link to OFF state while waking up from hibernation Peter Wang <peter.wang(a)mediatek.com> scsi: ufs: core: Fix deadlock during RTC update Damien Le Moal <dlemoal(a)kernel.org> scsi: mpi3mr: Avoid IOMMU page faults on REPORT ZONES Chris Wulff <crwulff(a)gmail.com> usb: gadget: u_audio: Check return codes from usb_ep_enable and config_ep_by_speed. Tudor Ambarus <tudor.ambarus(a)linaro.org> usb: gadget: f_fs: restore ffs_func_disable() functionality Prashanth K <quic_prashk(a)quicinc.com> usb: gadget: u_serial: Set start_delayed during suspend Takashi Iwai <tiwai(a)suse.de> usb: gadget: midi2: Fix the response for FB info with block 0xff Chris Wulff <crwulff(a)gmail.com> usb: gadget: core: Check for unset descriptor Konrad Dybcio <konrad.dybcio(a)linaro.org> usb: typec: fsa4480: Check if the chip is really there Marek Marczykowski-Górecki <marmarek(a)invisiblethingslab.com> USB: serial: debug: do not echo input by default Oliver Neukum <oneukum(a)suse.com> usb: vhci-hcd: Do not drop references before new references are gained Takashi Iwai <tiwai(a)suse.de> ALSA: hda/hdmi: Yet more pin fix for HP EliteDesk 800 G4 Dustin L. Howett <dustin(a)howett.net> ALSA: hda/realtek: Add Framework Laptop 13 (Intel Core Ultra) to quirks Steven 'Steve' Kendall <skend(a)chromium.org> ALSA: hda: Add HP MP9 G4 Retail System AMS to force connect list Takashi Iwai <tiwai(a)suse.de> ALSA: line6: Fix racy access to midibuf Jens Axboe <axboe(a)kernel.dk> io_uring/net: don't pick multiple buffers for non-bundle send Jens Axboe <axboe(a)kernel.dk> io_uring/net: ensure expanded bundle send gets marked for cleanup Jens Axboe <axboe(a)kernel.dk> io_uring/net: ensure expanded bundle recv gets marked for cleanup Dave Airlie <airlied(a)redhat.com> drm/test: fix the gem shmem test to map the sg table. Dnyaneshwar Bhadane <dnyaneshwar.bhadane(a)intel.com> drm/i915/display: correct dual pps handling for MTL_PCH+ Ma Ke <make24(a)iscas.ac.cn> drm/client: fix null pointer dereference in drm_client_modeset_probe Andi Shyti <andi.shyti(a)linux.intel.com> drm/i915/gem: Adjust vma offset for framebuffer mmap offset Joshua Ashton <joshua(a)froggi.es> drm/amdgpu: Forward soft recovery errors to userspace Fangzhi Zuo <Jerry.Zuo(a)amd.com> drm/amd/display: Skip Recompute DSC Params if no Stream on Link Andi Shyti <andi.shyti(a)linux.intel.com> drm/i915/gem: Fix Virtual Memory mapping boundaries calculation Linus Torvalds <torvalds(a)linux-foundation.org> module: make waiting for a concurrent module loader interruptible Linus Torvalds <torvalds(a)linux-foundation.org> module: warn about excessively long module waits Gleb Korobeynikov <gkorobeynikov(a)astralinux.ru> cifs: cifs_inval_name_dfs_link_error: correct the check for fullpath Jerome Brunet <jbrunet(a)baylibre.com> ASoC: meson: axg-fifo: fix irq scheduling issue with PREEMPT_RT Matthew Brost <matthew.brost(a)intel.com> drm/xe: Take ref to VM in delayed snapshot Niranjana Vishwanathapura <niranjana.vishwanathapura(a)intel.com> drm/xe: Minor cleanup in LRC handling Karthik Poosa <karthik.poosa(a)intel.com> drm/xe/hwmon: Fix PL1 disable flow in xe_hwmon_power_max_write Matthew Brost <matthew.brost(a)intel.com> drm/xe: Use dma_fence_chain_free in chain fence unused as a sync Lucas De Marchi <lucas.demarchi(a)intel.com> drm/xe/rtp: Fix off-by-one when processing rules Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Re-add ScratchAmp quirk entries Stefan Wahren <wahrenst(a)gmx.net> spi: spi-fsl-lpspi: Fix scldiv calculation Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com> drm/amd/display: Replace dm_execute_dmub_cmd with dc_wake_and_execute_dmub_cmd David Gow <david(a)davidgow.net> drm/i915: Attempt to get pages without eviction first David Gow <david(a)davidgow.net> drm/i915: Allow evicting to use the requested placement Gaosheng Cui <cuigaosheng1(a)huawei.com> i2c: qcom-geni: Add missing geni_icc_disable in geni_i2c_runtime_resume Simon Ser <contact(a)emersion.fr> drm/atomic: allow no-op FB_ID updates for async flips Richard Fitzgerald <rf(a)opensource.cirrus.com> ASoC: cs35l56: Handle OTP read latency over SoundWire Richard Fitzgerald <rf(a)opensource.cirrus.com> ASoC: cs35l56: Revert support for dual-ownership of ASP registers Gaosheng Cui <cuigaosheng1(a)huawei.com> i2c: qcom-geni: Add missing clk_disable_unprepare in geni_i2c_runtime_resume Richard Fitzgerald <rf(a)opensource.cirrus.com> ASoC: cs-amp-lib: Fix NULL pointer crash if efi.get_variable is NULL Masami Hiramatsu (Google) <mhiramat(a)kernel.org> kprobes: Fix to check symbol prefixes correctly Menglong Dong <menglong8.dong(a)gmail.com> bpf: kprobe: remove unused declaring of bpf_kprobe_override Guenter Roeck <linux(a)roeck-us.net> i2c: smbus: Send alert notifications to all devices if source not found Curtis Malainey <cujomalainey(a)chromium.org> ASoC: SOF: Remove libraries from topology lookups Geert Uytterhoeven <geert+renesas(a)glider.be> spi: spidev: Add missing spi_device_id for bh2228fv Jerome Audu <jau(a)free.fr> ASoC: sti: add missing probe entry for player and reader Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> ASoC: codecs: wsa884x: Correct Soundwire ports mask Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org> ASoC: codecs: wsa884x: parse port-mapping information Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> ASoC: codecs: wsa883x: Correct Soundwire ports mask Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org> ASoC: codecs: wsa883x: parse port-mapping information Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> ASoC: codecs: wsa881x: Correct Soundwire ports mask Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> ASoC: codecs: wcd939x-sdw: Correct Soundwire ports mask Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> ASoC: codecs: wcd938x-sdw: Correct Soundwire ports mask Guenter Roeck <linux(a)roeck-us.net> i2c: smbus: Improve handling of stuck alerts Jeff Layton <jlayton(a)kernel.org> nfsd: don't set SVC_SOCK_ANONYMOUS when creating nfsd sockets Mark Rutland <mark.rutland(a)arm.com> arm64: errata: Expand speculative SSBS workaround (again) Mark Rutland <mark.rutland(a)arm.com> arm64: cputype: Add Cortex-A725 definitions Mark Rutland <mark.rutland(a)arm.com> arm64: cputype: Add Cortex-X1C definitions Mark Rutland <mark.rutland(a)arm.com> arm64: errata: Expand speculative SSBS workaround Mark Rutland <mark.rutland(a)arm.com> arm64: errata: Unify speculative SSBS errata logic Mark Rutland <mark.rutland(a)arm.com> arm64: cputype: Add Cortex-X925 definitions Mark Rutland <mark.rutland(a)arm.com> arm64: cputype: Add Cortex-A720 definitions Mark Rutland <mark.rutland(a)arm.com> arm64: cputype: Add Cortex-X3 definitions Willem de Bruijn <willemb(a)google.com> net: drop bad gso csum_start and offset in virtio_net_hdr Zheng Zucheng <zhengzucheng(a)huawei.com> sched/cputime: Fix mul_u64_u64_div_u64() precision for cputime Huacai Chen <chenhuacai(a)kernel.org> irqchip/loongarch-cpu: Fix return value of lpic_gsi_to_irq() Arseniy Krasnov <avkrasnov(a)salutedevices.com> irqchip/meson-gpio: Convert meson_gpio_irq_controller::lock to 'raw_spinlock_t' Bingbu Cao <bingbu.cao(a)intel.com> media: intel/ipu6: select AUXILIARY_BUS in Kconfig Arnd Bergmann <arnd(a)arndb.de> media: ipu-bridge: fix ipu6 Kconfig dependencies Damien Le Moal <dlemoal(a)kernel.org> scsi: mpt3sas: Avoid IOMMU page faults on REPORT ZONES Johan Hovold <johan+linaro(a)kernel.org> scsi: Revert "scsi: sd: Do not repeat the starting disk message" Paul E. McKenney <paulmck(a)kernel.org> clocksource: Fix brown-bag boolean thinko in cs_watchdog_read() Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> profiling: remove profile=sleep support Rik van Riel <riel(a)surriel.com> mm, slub: do not call do_slab_free for kfence object Benjamin Coddington <bcodding(a)redhat.com> SUNRPC: Fix a race to wake a sync task Wojciech Gładysz <wojciech.gladysz(a)infogain.com> ext4: sanity check for NULL pointer after ext4_force_shutdown Peter Oberparleiter <oberpar(a)linux.ibm.com> s390/sclp: Prevent release of buffer in I/O Aurabindo Pillai <aurabindo.pillai(a)amd.com> drm/amd/display: Fix null pointer deref in dcn20_resource.c Kemeng Shi <shikemeng(a)huaweicloud.com> jbd2: avoid memleak in jbd2_journal_write_metadata_buffer Xiaxi Shen <shenxiaxi26(a)gmail.com> ext4: fix uninitialized variable in ext4_inlinedir_to_tree Chi Zhiling <chizhiling(a)kylinos.cn> media: xc2028: avoid use-after-free in load_firmware_cb() Rodrigo Siqueira <rodrigo.siqueira(a)amd.com> drm/amd/display: Fix NULL pointer dereference for DTN log in DCN401 Michal Pecio <michal.pecio(a)gmail.com> media: uvcvideo: Fix the bandwdith quirk on USB 3.x Ricardo Ribalda <ribalda(a)chromium.org> media: uvcvideo: Ignore empty TS packets Abdulrasaq Lawani <abdulrasaqolawani(a)gmail.com> media: i2c: ov5647: replacing of_node_put with __free(device_node) Alex Hung <alex.hung(a)amd.com> drm/amd/display: Add null checker before passing variables Wenjing Liu <wenjing.liu(a)amd.com> drm/amd/display: remove dpp pipes on failure to update pipe params Wayne Lin <wayne.lin(a)amd.com> drm/amd/display: Don't refer to dc_sink in is_dsc_need_re_compute Wenjing Liu <wenjing.liu(a)amd.com> drm/amd/display: reduce ODM slice count to initial new dc state only when needed Nicholas Kazlauskas <nicholas.kazlauskas(a)amd.com> drm/amd/display: Wake DMCUB before sending a command for replay feature Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> drm/amd/display: Add NULL check for 'afb' before dereferencing in amdgpu_dm_plane_handle_cursor_update Ming Qian <ming.qian(a)nxp.com> media: amphion: Remove lock in s_ctrl callback Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> drm/amd/display: Add null checks for 'stream' and 'plane' before dereferencing Bob Zhou <bob.zhou(a)amd.com> drm/amd/pm: Fix the null pointer dereference for vega10_hwmgr Victor Skvortsov <victor.skvortsov(a)amd.com> drm/amdgpu: Add lock around VF RLCG interface Jesse Zhang <jesse.zhang(a)amd.com> drm/admgpu: fix dereferencing null pointer context Ma Jun <Jun.Ma2(a)amd.com> drm/amdgpu/pm: Fix the null pointer dereference in apply_state_adjust_rules Ma Jun <Jun.Ma2(a)amd.com> drm/amdgpu: Fix the null pointer dereference to ras_manager Ma Jun <Jun.Ma2(a)amd.com> drm/amdgpu/pm: Fix the null pointer dereference for smu7 Jonathan Cavitt <jonathan.cavitt(a)intel.com> drm/xe/xe_guc_submit: Fix exec queue stop race condition Ramesh Errabolu <Ramesh.Errabolu(a)amd.com> drm/amd/amdkfd: Fix a resource leak in svm_range_validate_and_map() Ma Jun <Jun.Ma2(a)amd.com> drm/amdgpu/pm: Fix the param type of set_power_profile_mode Tim Huang <Tim.Huang(a)amd.com> drm/amdgpu: fix potential resource leak warning Michael Strauss <michael.strauss(a)amd.com> drm/amd/display: Add delay to improve LTTPR UHBR interop Sung-huai Wang <danny.wang(a)amd.com> drm/amd/display: Handle HPD_IRQ for internal link Matthew Auld <matthew.auld(a)intel.com> drm/xe/preempt_fence: enlarge the fence critical section Luke Wang <ziniu.wang_1(a)nxp.com> Bluetooth: btnxpuart: Shutdown timer and prevent rearming when driver unloading Filipe Manana <fdmanana(a)suse.com> btrfs: fix bitmap leak when loading free space cache on duplicate entry Filipe Manana <fdmanana(a)suse.com> btrfs: fix data race when accessing the last_trans field of a root Filipe Manana <fdmanana(a)suse.com> btrfs: reduce nesting for extent processing at btrfs_lookup_extent_info() Filipe Manana <fdmanana(a)suse.com> btrfs: do not BUG_ON() when freeing tree block after error Qu Wenruo <wqu(a)suse.com> btrfs: do not clear page dirty inside extent_write_locked_range() Ido Schimmel <idosch(a)nvidia.com> mlxsw: pci: Lock configuration space of upstream bridge during reset Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> net: stmmac: qcom-ethqos: enable SGMII loopback during DMA reset on sa8775p-ride-r3 Marc Kleine-Budde <mkl(a)pengutronix.de> can: mcp251xfd: tef: update workaround for erratum DS80000789E 6 of mcp2518fd Marc Kleine-Budde <mkl(a)pengutronix.de> can: mcp251xfd: tef: prepare to workaround broken TEF FIFO tail index erratum Johannes Berg <johannes.berg(a)intel.com> wifi: nl80211: don't give key data to userspace Matt Bobrowski <mattbobrowski(a)google.com> bpf: add missing check_func_arg_reg_off() to prevent out-of-bounds memory accesses Roman Smirnov <r.smirnov(a)omp.ru> udf: prevent integer overflow in udf_bitmap_free_blocks() Zong-Zhe Yang <kevin_yang(a)realtek.com> wifi: mac80211: fix NULL dereference at band check in starting tx ba session FUJITA Tomonori <fujita.tomonori(a)gmail.com> PCI: Add Edimax Vendor ID to pci_ids.h Kuniyuki Iwashima <kuniyu(a)amazon.com> af_unix: Don't retry after unix_state_lock_nested() in unix_stream_connect(). Ping-Ke Shih <pkshih(a)realtek.com> wifi: rtw89: pci: fix RX tag race condition resulting in wrong RX length Yonghong Song <yonghong.song(a)linux.dev> selftests/bpf: Fix send_signal test with nested CONFIG_PARAVIRT Dragos Tatulea <dtatulea(a)nvidia.com> net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink Baochen Qiang <quic_bqiang(a)quicinc.com> wifi: ath12k: fix memory leak in ath12k_dp_rx_peer_frag_setup() Ping-Ke Shih <pkshih(a)realtek.com> wifi: rtlwifi: handle return value of usb init TX/RX Baochen Qiang <quic_bqiang(a)quicinc.com> wifi: ath12k: fix race due to setting ATH12K_FLAG_EXT_IRQ_ENABLED too early Johannes Berg <johannes.berg(a)intel.com> wifi: nl80211: disallow setting special AP channel widths Zhang Rui <rui.zhang(a)intel.com> thermal: intel: hfi: Give HFI instances package scope Tamim Khan <tamim(a)fusetak.com> ACPI: resource: Skip IRQ override on Asus Vivobook Pro N6506MJ Tamim Khan <tamim(a)fusetak.com> ACPI: resource: Skip IRQ override on Asus Vivobook Pro N6506MU Viresh Kumar <viresh.kumar(a)linaro.org> xen: privcmd: Switch from mutex to spinlock for irqfds Sibi Sankar <quic_sibis(a)quicinc.com> soc: qcom: icc-bwmon: Allow for interrupts to be shared across instances Perry Yuan <perry.yuan(a)amd.com> cpufreq: amd-pstate: auto-load pstate driver by default Mario Limonciello <mario.limonciello(a)amd.com> cpufreq: amd-pstate: Allow users to write 'default' EPP string Thomas Weißschuh <linux(a)weissschuh.net> ACPI: SBS: manage alarm sysfs attribute through psy core Thomas Weißschuh <linux(a)weissschuh.net> ACPI: battery: create alarm sysfs attribute atomically Niklas Söderlund <niklas.soderlund+renesas(a)ragnatech.se> clocksource/drivers/sh_cmt: Address race condition for clock events Frederic Weisbecker <frederic(a)kernel.org> rcu: Fix rcu_barrier() VS post CPUHP_TEARDOWN_CPU invocation Mikulas Patocka <mpatocka(a)redhat.com> block: change rq_integrity_vec to respect the iterator Keith Busch <kbusch(a)kernel.org> nvme: apple: fix device reference counting Breno Leitao <leitao(a)debian.org> debugobjects: Annotate racy debug variables Yu Kuai <yukuai3(a)huawei.com> md/raid5: avoid BUG_ON() while continue reshape after reassembling Li Nan <linan122(a)huawei.com> md: change the return value type of md_write_start to void Li Nan <linan122(a)huawei.com> md: do not delete safemode_timer in mddev_suspend Paul E. McKenney <paulmck(a)kernel.org> rcutorture: Fix rcu_torture_fwd_cb_cr() data race Ben Walsh <ben(a)jubnut.com> platform/chrome: cros_ec_lpc: Add a new quirk for ACPI id Frederic Weisbecker <frederic(a)kernel.org> Revert "rcu-tasks: Fix synchronize_rcu_tasks() VS zap_pid_ns_processes()" Wilken Gottwalt <wilken.gottwalt(a)posteo.net> hwmon: corsair-psu: add USB id of HX1200i Series 2023 psu Hagar Hemdan <hagarhem(a)amazon.com> gpio: prevent potential speculation leaks in gpio_device_get_desc() Richard Fitzgerald <rf(a)opensource.cirrus.com> regmap: kunit: Fix memory leaks in gen_regmap() and gen_raw_regmap() Martin Whitaker <foss(a)martin-whitaker.me.uk> net: dsa: microchip: disable EEE for KSZ8567/KSZ9567/KSZ9896/KSZ9897. Arnd Bergmann <arnd(a)arndb.de> net: pse-pd: tps23881: include missing bitfield.h header Csókás, Bence <csokas.bence(a)prolan.hu> net: fec: Stop PPS on driver remove Florian Fainelli <florian.fainelli(a)broadcom.com> net: bcmgenet: Properly overlay PHY and MAC Wake-on-LAN capabilities James Chapman <jchapman(a)katalix.com> l2tp: fix lockdep splat Alexander Lobakin <aleksander.lobakin(a)intel.com> idpf: fix UAFs when destroying the queues Alexander Lobakin <aleksander.lobakin(a)intel.com> idpf: fix memory leaks and crashes while performing a soft reset Michael Chan <michael.chan(a)broadcom.com> bnxt_en : Fix memory out-of-bounds in bnxt_fill_hw_rss_tbl() Joe Hattori <joe(a)pf.is.s.u-tokyo.ac.jp> net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register() Zhengchao Shao <shaozhengchao(a)huawei.com> net/smc: add the max value of fallback reason count Anton Khirnov <anton(a)khirnov.net> Bluetooth: hci_sync: avoid dup filtering when passive scanning with adv monitor Dmitry Antipov <dmantipov(a)yandex.ru> Bluetooth: l2cap: always unlock channel in l2cap_conless_channel() Grzegorz Nitka <grzegorz.nitka(a)intel.com> ice: Fix reset handler Tristram Ha <tristram.ha(a)microchip.com> net: dsa: microchip: Fix Wake-on-LAN check to not return an error Eric Dumazet <edumazet(a)google.com> net: linkwatch: use system_unbound_wq Nikolay Aleksandrov <razor(a)blackwall.org> net: bridge: mcast: wait for previous gc cycles when removing port Daniele Palmas <dnlplm(a)gmail.com> net: usb: qmi_wwan: fix memory leak for not ip packets Heng Qi <hengqi(a)linux.alibaba.com> virtio-net: unbreak vq resizing when coalescing is not negotiated Praveen Kaligineedi <pkaligineedi(a)google.com> gve: Fix use of netif_carrier_ok() Kyle Swenson <kyle.swenson(a)est.tech> net: pse-pd: tps23881: Fix the device ID check Kuniyuki Iwashima <kuniyu(a)amazon.com> sctp: Fix null-ptr-deref in reuseport_add_sock(). Nikita Travkin <nikita(a)trvn.ru> power: supply: rt5033: Bring back i2c_set_clientdata Paulo Alcantara <pc(a)manguebit.com> smb: client: handle lack of FSCTL_GET_REPARSE_POINT support Peter Zijlstra <peterz(a)infradead.org> x86/mm: Fix pti_clone_entry_text() for i386 Peter Zijlstra <peterz(a)infradead.org> x86/mm: Fix pti_clone_pgtable() alignment assumption Laura Nao <laura.nao(a)collabora.com> selftests: ksft: Fix finished() helper exit code on skipped tests Li Huafei <lihuafei1(a)huawei.com> perf/x86: Fix smp_processor_id()-in-preemptible warnings Kan Liang <kan.liang(a)linux.intel.com> perf/x86: Support counter mask Kan Liang <kan.liang(a)linux.intel.com> perf/x86/intel: Support the PEBS event mask Uros Bizjak <ubizjak(a)gmail.com> perf/x86/amd: Use try_cmpxchg() in events/amd/{un,}core.c Peter Zijlstra <peterz(a)infradead.org> jump_label: Fix the fix, brown paper bags galore Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy(a)linux.intel.com> platform/x86/intel/ifs: Initialize union ifs_status to zero Yipeng Zou <zouyipeng(a)huawei.com> irqchip/mbigen: Fix mbigen node address layout Hans de Goede <hdegoede(a)redhat.com> platform/x86: intel-vbtn: Protect ACPI notify handler against recursion Zhenyu Wang <zhenyuw(a)linux.intel.com> perf/x86/intel/cstate: Add pkg C2 residency counter for Sierra Forest Zhang Rui <rui.zhang(a)intel.com> perf/x86/intel/cstate: Add Lunarlake support Zhang Rui <rui.zhang(a)intel.com> perf/x86/intel/cstate: Add Arrowlake support Uros Bizjak <ubizjak(a)gmail.com> locking/pvqspinlock: Correct the type of "old" variable in pv_kick_node() Wayne Lin <wayne.lin(a)amd.com> drm/amd/display: Refactor function dm_dp_mst_is_port_support_mode() ------------- Diffstat: Documentation/admin-guide/cifs/usage.rst | 2 +- Documentation/admin-guide/kernel-parameters.txt | 4 +- Documentation/arch/arm64/silicon-errata.rst | 34 ++- Documentation/hwmon/corsair-psu.rst | 6 +- .../userspace-api/media/v4l/pixfmt-yuv-luma.rst | 4 +- Makefile | 4 +- arch/arm64/Kconfig | 58 +++-- arch/arm64/boot/dts/ti/k3-am62-verdin-dahlia.dtsi | 22 -- arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi | 6 - arch/arm64/include/asm/cpucaps.h | 2 +- arch/arm64/include/asm/cputype.h | 10 + arch/arm64/kernel/cpu_errata.c | 26 ++- arch/arm64/kernel/proton-pack.c | 2 +- arch/loongarch/kernel/efi.c | 6 + arch/parisc/Kconfig | 1 + arch/parisc/include/asm/cache.h | 11 +- arch/parisc/net/bpf_jit_core.c | 2 +- arch/x86/events/amd/core.c | 28 +-- arch/x86/events/amd/uncore.c | 8 +- arch/x86/events/core.c | 116 +++++----- arch/x86/events/intel/core.c | 164 +++++++------ arch/x86/events/intel/cstate.c | 35 ++- arch/x86/events/intel/ds.c | 34 ++- arch/x86/events/intel/knc.c | 2 +- arch/x86/events/intel/p4.c | 10 +- arch/x86/events/intel/p6.c | 2 +- arch/x86/events/perf_event.h | 62 ++++- arch/x86/events/zhaoxin/core.c | 12 +- arch/x86/include/asm/intel_ds.h | 1 + arch/x86/include/asm/qspinlock.h | 12 +- arch/x86/kernel/cpu/mtrr/mtrr.c | 2 +- arch/x86/kernel/paravirt.c | 7 +- arch/x86/mm/pti.c | 8 +- drivers/acpi/battery.c | 16 +- drivers/acpi/resource.c | 14 ++ drivers/acpi/sbs.c | 23 +- drivers/base/core.c | 13 +- drivers/base/module.c | 4 + drivers/base/regmap/regmap-kunit.c | 72 +++--- drivers/bluetooth/btnxpuart.c | 2 +- drivers/clocksource/sh_cmt.c | 13 +- drivers/cpufreq/amd-pstate.c | 32 ++- drivers/cpufreq/amd-pstate.h | 1 + drivers/gpio/gpiolib.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_job.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 7 +- drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 6 + drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h | 2 + drivers/gpu/drm/amd/amdgpu/amdgpu_vm_sdma.c | 5 + drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 9 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 10 +- .../amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 255 +++++++++++++-------- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 58 +++-- drivers/gpu/drm/amd/display/dc/core/dc_state.c | 67 ++++-- drivers/gpu/drm/amd/display/dc/dce/dmub_replay.c | 9 +- .../drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c | 49 ++-- .../drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c | 3 + .../hwss/link_hwss_hpo_fixed_vs_pe_retimer_dp.c | 5 + drivers/gpu/drm/amd/display/dc/link/link_dpms.c | 3 +- .../dc/link/protocols/link_dp_irq_handler.c | 3 +- .../amd/display/dc/resource/dcn20/dcn20_resource.c | 9 +- drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c | 8 +- drivers/gpu/drm/amd/pm/powerplay/hwmgr/pp_psm.c | 8 +- .../gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 55 ++--- .../gpu/drm/amd/pm/powerplay/hwmgr/smu8_hwmgr.c | 14 +- .../gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c | 36 ++- drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 16 +- drivers/gpu/drm/bridge/analogix/analogix_dp_reg.c | 5 +- drivers/gpu/drm/display/drm_dp_mst_topology.c | 11 + drivers/gpu/drm/drm_atomic_uapi.c | 15 +- drivers/gpu/drm/drm_client_modeset.c | 5 + drivers/gpu/drm/i915/display/intel_backlight.c | 3 + drivers/gpu/drm/i915/display/intel_pps.c | 3 + drivers/gpu/drm/i915/gem/i915_gem_mman.c | 55 ++++- drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 13 +- drivers/gpu/drm/lima/lima_drv.c | 1 + drivers/gpu/drm/mgag200/mgag200_i2c.c | 8 +- drivers/gpu/drm/radeon/pptable.h | 2 +- drivers/gpu/drm/tests/drm_gem_shmem_test.c | 11 + drivers/gpu/drm/xe/regs/xe_engine_regs.h | 4 +- drivers/gpu/drm/xe/xe_guc_submit.c | 2 +- drivers/gpu/drm/xe/xe_hwmon.c | 3 +- drivers/gpu/drm/xe/xe_lrc.c | 17 +- drivers/gpu/drm/xe/xe_preempt_fence.c | 14 +- drivers/gpu/drm/xe/xe_rtp.c | 2 +- drivers/gpu/drm/xe/xe_sync.c | 2 +- drivers/hwmon/corsair-psu.c | 7 +- drivers/i2c/busses/i2c-qcom-geni.c | 5 +- drivers/i2c/i2c-smbus.c | 64 +++++- drivers/irqchip/irq-loongarch-cpu.c | 6 +- drivers/irqchip/irq-mbigen.c | 20 +- drivers/irqchip/irq-meson-gpio.c | 14 +- drivers/irqchip/irq-riscv-aplic-msi.c | 32 ++- drivers/irqchip/irq-xilinx-intc.c | 2 +- drivers/md/md.c | 15 +- drivers/md/md.h | 2 +- drivers/md/raid1.c | 3 +- drivers/md/raid10.c | 3 +- drivers/md/raid5.c | 23 +- drivers/media/i2c/ov5647.c | 11 +- drivers/media/pci/intel/ipu6/Kconfig | 3 +- drivers/media/platform/amphion/vdec.c | 2 - drivers/media/platform/amphion/venc.c | 2 - drivers/media/tuners/xc2028.c | 9 +- drivers/media/usb/uvc/uvc_video.c | 37 ++- drivers/net/can/spi/mcp251xfd/mcp251xfd-ring.c | 2 + drivers/net/can/spi/mcp251xfd/mcp251xfd-tef.c | 125 +++++----- drivers/net/can/spi/mcp251xfd/mcp251xfd.h | 13 +- drivers/net/dsa/bcm_sf2.c | 4 +- drivers/net/dsa/microchip/ksz_common.c | 16 ++ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 13 +- drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c | 14 +- drivers/net/ethernet/freescale/fec_ptp.c | 3 + drivers/net/ethernet/google/gve/gve_ethtool.c | 2 +- drivers/net/ethernet/google/gve/gve_main.c | 12 +- drivers/net/ethernet/intel/ice/ice_main.c | 2 + drivers/net/ethernet/intel/idpf/idpf_lib.c | 48 ++-- drivers/net/ethernet/intel/idpf/idpf_txrx.c | 43 +--- drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 3 + drivers/net/ethernet/mellanox/mlxsw/pci.c | 6 + .../ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c | 23 ++ drivers/net/pse-pd/tps23881.c | 5 +- drivers/net/usb/qmi_wwan.c | 1 + drivers/net/virtio_net.c | 8 +- drivers/net/wireless/ath/ath12k/dp_rx.c | 1 + drivers/net/wireless/ath/ath12k/pci.c | 4 +- drivers/net/wireless/realtek/rtlwifi/usb.c | 34 ++- drivers/net/wireless/realtek/rtw89/pci.c | 13 +- drivers/nvme/host/apple.c | 27 ++- drivers/nvme/host/pci.c | 6 +- drivers/platform/chrome/cros_ec_lpc.c | 50 +++- drivers/platform/x86/intel/ifs/runtest.c | 2 +- drivers/platform/x86/intel/vbtn.c | 9 + drivers/power/supply/axp288_charger.c | 24 +- drivers/power/supply/qcom_battmgr.c | 8 +- drivers/power/supply/rt5033_battery.c | 1 + drivers/s390/char/sclp_sd.c | 10 +- drivers/scsi/mpi3mr/mpi3mr_os.c | 11 + drivers/scsi/mpt3sas/mpt3sas_base.c | 20 +- drivers/scsi/sd.c | 5 +- drivers/soc/qcom/icc-bwmon.c | 12 +- drivers/spi/spi-fsl-lpspi.c | 6 +- drivers/spi/spidev.c | 1 + drivers/spmi/spmi-pmic-arb.c | 11 +- drivers/thermal/intel/intel_hfi.c | 30 +-- drivers/tty/serial/sc16is7xx.c | 25 +- drivers/tty/serial/serial_core.c | 8 + drivers/tty/vt/conmakehash.c | 20 +- drivers/ufs/core/ufshcd-priv.h | 5 + drivers/ufs/core/ufshcd.c | 19 +- drivers/usb/gadget/function/f_fs.c | 6 +- drivers/usb/gadget/function/f_midi2.c | 21 +- drivers/usb/gadget/function/u_audio.c | 42 +++- drivers/usb/gadget/function/u_serial.c | 1 + drivers/usb/gadget/udc/core.c | 10 +- drivers/usb/serial/usb_debug.c | 7 + drivers/usb/typec/mux/fsa4480.c | 14 ++ drivers/usb/usbip/vhci_hcd.c | 9 +- drivers/vhost/vdpa.c | 8 +- drivers/xen/privcmd.c | 25 +- fs/btrfs/ctree.c | 57 +++-- fs/btrfs/ctree.h | 11 + fs/btrfs/defrag.c | 2 +- fs/btrfs/disk-io.c | 4 +- fs/btrfs/extent-tree.c | 46 ++-- fs/btrfs/extent-tree.h | 8 +- fs/btrfs/extent_io.c | 4 +- fs/btrfs/file.c | 60 +++-- fs/btrfs/free-space-cache.c | 1 + fs/btrfs/free-space-tree.c | 10 +- fs/btrfs/ioctl.c | 6 +- fs/btrfs/print-tree.c | 2 +- fs/btrfs/qgroup.c | 6 +- fs/btrfs/relocation.c | 8 +- fs/btrfs/transaction.c | 8 +- fs/buffer.c | 2 + fs/ext4/inline.c | 6 +- fs/ext4/inode.c | 5 + fs/jbd2/journal.c | 1 + fs/nfsd/nfsctl.c | 3 +- fs/smb/client/cifs_debug.c | 2 +- fs/smb/client/cifsglob.h | 8 +- fs/smb/client/inode.c | 17 +- fs/smb/client/misc.c | 9 +- fs/smb/client/reparse.c | 4 + fs/smb/client/reparse.h | 19 +- fs/smb/client/smb2inode.c | 2 + fs/smb/client/smb2pdu.c | 3 + fs/tracefs/event_inode.c | 4 +- fs/tracefs/inode.c | 12 +- fs/tracefs/internal.h | 5 +- fs/udf/balloc.c | 36 ++- include/linux/blk-integrity.h | 16 +- include/linux/fs.h | 2 +- include/linux/pci_ids.h | 2 + include/linux/profile.h | 1 - include/linux/rcupdate.h | 2 - include/linux/trace_events.h | 1 - include/linux/virtio_net.h | 16 +- include/sound/cs35l56.h | 14 +- io_uring/net.c | 7 +- kernel/bpf/verifier.c | 17 +- kernel/irq/irqdesc.c | 1 + kernel/jump_label.c | 4 +- kernel/kcov.c | 15 +- kernel/kprobes.c | 4 +- kernel/locking/qspinlock_paravirt.h | 2 +- kernel/module/main.c | 41 +++- kernel/padata.c | 7 + kernel/pid_namespace.c | 17 -- kernel/profile.c | 11 +- kernel/rcu/rcutorture.c | 2 +- kernel/rcu/tasks.h | 16 +- kernel/rcu/tree.c | 10 +- kernel/sched/core.c | 68 ++++-- kernel/sched/cputime.c | 6 + kernel/sched/stats.c | 10 - kernel/time/clocksource.c | 2 +- kernel/time/ntp.c | 9 +- kernel/time/tick-broadcast.c | 3 +- kernel/time/timekeeping.c | 2 +- kernel/trace/trace.h | 23 ++ kernel/trace/trace_events.c | 33 +-- kernel/trace/trace_events_hist.c | 4 +- kernel/trace/trace_events_inject.c | 2 +- kernel/trace/trace_events_trigger.c | 6 +- kernel/trace/tracing_map.c | 6 +- lib/debugobjects.c | 21 +- mm/list_lru.c | 28 ++- mm/memcontrol.c | 22 +- mm/slub.c | 3 + net/bluetooth/hci_sync.c | 14 ++ net/bluetooth/l2cap_core.c | 1 + net/bridge/br_multicast.c | 4 +- net/core/link_watch.c | 4 +- net/ipv4/tcp_ao.c | 43 ++-- net/ipv4/tcp_offload.c | 3 + net/ipv4/udp_offload.c | 4 + net/l2tp/l2tp_core.c | 15 +- net/mac80211/agg-tx.c | 4 +- net/mptcp/options.c | 3 +- net/mptcp/pm_netlink.c | 47 ++-- net/sctp/input.c | 19 +- net/smc/smc_stats.h | 2 +- net/sunrpc/sched.c | 4 +- net/unix/af_unix.c | 34 +-- net/wireless/nl80211.c | 37 ++- sound/pci/hda/patch_hdmi.c | 2 + sound/pci/hda/patch_realtek.c | 1 + sound/soc/amd/yc/acp6x-mach.c | 7 + sound/soc/codecs/cs-amp-lib.c | 2 +- sound/soc/codecs/cs35l56-sdw.c | 77 +++++++ sound/soc/codecs/cs35l56-shared.c | 101 ++------ sound/soc/codecs/cs35l56.c | 205 ++--------------- sound/soc/codecs/cs35l56.h | 1 - sound/soc/codecs/wcd938x-sdw.c | 4 +- sound/soc/codecs/wcd939x-sdw.c | 4 +- sound/soc/codecs/wsa881x.c | 2 +- sound/soc/codecs/wsa883x.c | 10 +- sound/soc/codecs/wsa884x.c | 10 +- sound/soc/meson/axg-fifo.c | 26 +-- sound/soc/sof/mediatek/mt8195/mt8195.c | 2 +- sound/soc/sti/sti_uniperif.c | 2 +- sound/soc/sti/uniperif.h | 1 + sound/soc/sti/uniperif_player.c | 1 + sound/soc/sti/uniperif_reader.c | 1 + sound/usb/line6/driver.c | 5 + sound/usb/quirks-table.h | 4 + .../testing/selftests/bpf/prog_tests/send_signal.c | 3 +- tools/testing/selftests/devices/ksft.py | 2 +- tools/testing/selftests/mm/Makefile | 2 +- tools/testing/selftests/net/mptcp/mptcp_join.sh | 55 +++-- 274 files changed, 2691 insertions(+), 1727 deletions(-)

5 months, 1 week

15
290
0 0

[PATCH v4 1/2] locking/lockdep: Forcing subclasses to have same name pointer as their parent class

by botta633

From: Ahmed Ehab <bottaawesome633(a)gmail.com> Preventing lockdep_set_subclass from creating a new instance of the string literal. Hence, we will always have the same class->name among parent and subclasses. This prevents kernel panics when looking up a lock class while comparing class locks and class names. Reported-by: <syzbot+7f4a6f7f7051474e40ad(a)syzkaller.appspotmail.com> Fixes: de8f5e4f2dc1f ("lockdep: Introduce wait-type checks") Cc: <stable(a)vger.kernel.org> Signed-off-by: Ahmed Ehab <bottaawesome633(a)gmail.com> --- v3->v4: - Fixed subject line truncation. include/linux/lockdep.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/linux/lockdep.h b/include/linux/lockdep.h index 08b0d1d9d78b..df8fa5929de7 100644 --- a/include/linux/lockdep.h +++ b/include/linux/lockdep.h @@ -173,7 +173,7 @@ static inline void lockdep_init_map(struct lockdep_map *lock, const char *name, (lock)->dep_map.lock_type) #define lockdep_set_subclass(lock, sub) \ - lockdep_init_map_type(&(lock)->dep_map, #lock, (lock)->dep_map.key, sub,\ + lockdep_init_map_type(&(lock)->dep_map, (lock)->dep_map.name, (lock)->dep_map.key, sub,\ (lock)->dep_map.wait_type_inner, \ (lock)->dep_map.wait_type_outer, \ (lock)->dep_map.lock_type) -- 2.45.2

5 months, 1 week

2
4
0 0

[tip: x86/urgent] x86/kaslr: Expose and use the end of the physical memory address space

by tip-bot2 for Thomas Gleixner

The following commit has been merged into the x86/urgent branch of tip: Commit-ID: ea72ce5da22806d5713f3ffb39a6d5ae73841f93 Gitweb: https://git.kernel.org/tip/ea72ce5da22806d5713f3ffb39a6d5ae73841f93 Author: Thomas Gleixner <tglx(a)linutronix.de> AuthorDate: Wed, 14 Aug 2024 00:29:36 +02:00 Committer: Thomas Gleixner <tglx(a)linutronix.de> CommitterDate: Tue, 20 Aug 2024 13:44:57 +02:00 x86/kaslr: Expose and use the end of the physical memory address space iounmap() on x86 occasionally fails to unmap because the provided valid ioremap address is not below high_memory. It turned out that this happens due to KASLR. KASLR uses the full address space between PAGE_OFFSET and vaddr_end to randomize the starting points of the direct map, vmalloc and vmemmap regions. It thereby limits the size of the direct map by using the installed memory size plus an extra configurable margin for hot-plug memory. This limitation is done to gain more randomization space because otherwise only the holes between the direct map, vmalloc, vmemmap and vaddr_end would be usable for randomizing. The limited direct map size is not exposed to the rest of the kernel, so the memory hot-plug and resource management related code paths still operate under the assumption that the available address space can be determined with MAX_PHYSMEM_BITS. request_free_mem_region() allocates from (1 << MAX_PHYSMEM_BITS) - 1 downwards. That means the first allocation happens past the end of the direct map and if unlucky this address is in the vmalloc space, which causes high_memory to become greater than VMALLOC_START and consequently causes iounmap() to fail for valid ioremap addresses. MAX_PHYSMEM_BITS cannot be changed for that because the randomization does not align with address bit boundaries and there are other places which actually require to know the maximum number of address bits. All remaining usage sites of MAX_PHYSMEM_BITS have been analyzed and found to be correct. Cure this by exposing the end of the direct map via PHYSMEM_END and use that for the memory hot-plug and resource management related places instead of relying on MAX_PHYSMEM_BITS. In the KASLR case PHYSMEM_END maps to a variable which is initialized by the KASLR initialization and otherwise it is based on MAX_PHYSMEM_BITS as before. To prevent future hickups add a check into add_pages() to catch callers trying to add memory above PHYSMEM_END. Fixes: 0483e1fa6e09 ("x86/mm: Implement ASLR for kernel memory regions") Reported-by: Max Ramanouski <max8rr8(a)gmail.com> Reported-by: Alistair Popple <apopple(a)nvidia.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Tested-By: Max Ramanouski <max8rr8(a)gmail.com> Tested-by: Alistair Popple <apopple(a)nvidia.com> Reviewed-by: Dan Williams <dan.j.williams(a)intel.com> Reviewed-by: Alistair Popple <apopple(a)nvidia.com> Reviewed-by: Kees Cook <kees(a)kernel.org> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/all/87ed6soy3z.ffs@tglx --- arch/x86/include/asm/page_64.h | 1 +- arch/x86/include/asm/pgtable_64_types.h | 4 +++- arch/x86/mm/init_64.c | 4 +++- arch/x86/mm/kaslr.c | 32 +++++++++++++++++++----- include/linux/mm.h | 4 +++- kernel/resource.c | 6 +---- mm/memory_hotplug.c | 2 +- mm/sparse.c | 2 +- 8 files changed, 43 insertions(+), 12 deletions(-) diff --git a/arch/x86/include/asm/page_64.h b/arch/x86/include/asm/page_64.h index af4302d..f3d257c 100644 --- a/arch/x86/include/asm/page_64.h +++ b/arch/x86/include/asm/page_64.h @@ -17,6 +17,7 @@ extern unsigned long phys_base; extern unsigned long page_offset_base; extern unsigned long vmalloc_base; extern unsigned long vmemmap_base; +extern unsigned long physmem_end; static __always_inline unsigned long __phys_addr_nodebug(unsigned long x) { diff --git a/arch/x86/include/asm/pgtable_64_types.h b/arch/x86/include/asm/pgtable_64_types.h index 9053dfe..a98e534 100644 --- a/arch/x86/include/asm/pgtable_64_types.h +++ b/arch/x86/include/asm/pgtable_64_types.h @@ -140,6 +140,10 @@ extern unsigned int ptrs_per_p4d; # define VMEMMAP_START __VMEMMAP_BASE_L4 #endif /* CONFIG_DYNAMIC_MEMORY_LAYOUT */ +#ifdef CONFIG_RANDOMIZE_MEMORY +# define PHYSMEM_END physmem_end +#endif + /* * End of the region for which vmalloc page tables are pre-allocated. * For non-KMSAN builds, this is the same as VMALLOC_END. diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c index d8dbeac..ff25364 100644 --- a/arch/x86/mm/init_64.c +++ b/arch/x86/mm/init_64.c @@ -958,8 +958,12 @@ static void update_end_of_memory_vars(u64 start, u64 size) int add_pages(int nid, unsigned long start_pfn, unsigned long nr_pages, struct mhp_params *params) { + unsigned long end = ((start_pfn + nr_pages) << PAGE_SHIFT) - 1; int ret; + if (WARN_ON_ONCE(end > PHYSMEM_END)) + return -ERANGE; + ret = __add_pages(nid, start_pfn, nr_pages, params); WARN_ON_ONCE(ret); diff --git a/arch/x86/mm/kaslr.c b/arch/x86/mm/kaslr.c index 37db264..230f1de 100644 --- a/arch/x86/mm/kaslr.c +++ b/arch/x86/mm/kaslr.c @@ -47,13 +47,24 @@ static const unsigned long vaddr_end = CPU_ENTRY_AREA_BASE; */ static __initdata struct kaslr_memory_region { unsigned long *base; + unsigned long *end; unsigned long size_tb; } kaslr_regions[] = { - { &page_offset_base, 0 }, - { &vmalloc_base, 0 }, - { &vmemmap_base, 0 }, + { + .base = &page_offset_base, + .end = &physmem_end, + }, + { + .base = &vmalloc_base, + }, + { + .base = &vmemmap_base, + }, }; +/* The end of the possible address space for physical memory */ +unsigned long physmem_end __ro_after_init; + /* Get size in bytes used by the memory region */ static inline unsigned long get_padding(struct kaslr_memory_region *region) { @@ -82,6 +93,8 @@ void __init kernel_randomize_memory(void) BUILD_BUG_ON(vaddr_end != CPU_ENTRY_AREA_BASE); BUILD_BUG_ON(vaddr_end > __START_KERNEL_map); + /* Preset the end of the possible address space for physical memory */ + physmem_end = ((1ULL << MAX_PHYSMEM_BITS) - 1); if (!kaslr_memory_enabled()) return; @@ -128,11 +141,18 @@ void __init kernel_randomize_memory(void) vaddr += entropy; *kaslr_regions[i].base = vaddr; + /* Calculate the end of the region */ + vaddr += get_padding(&kaslr_regions[i]); /* - * Jump the region and add a minimum padding based on - * randomization alignment. + * KASLR trims the maximum possible size of the + * direct-map. Update the physmem_end boundary. + * No rounding required as the region starts + * PUD aligned and size is in units of TB. */ - vaddr += get_padding(&kaslr_regions[i]); + if (kaslr_regions[i].end) + *kaslr_regions[i].end = __pa_nodebug(vaddr - 1); + + /* Add a minimum padding based on randomization alignment. */ vaddr = round_up(vaddr + 1, PUD_SIZE); remain_entropy -= entropy; } diff --git a/include/linux/mm.h b/include/linux/mm.h index c4b238a..b386415 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -97,6 +97,10 @@ extern const int mmap_rnd_compat_bits_max; extern int mmap_rnd_compat_bits __read_mostly; #endif +#ifndef PHYSMEM_END +# define PHYSMEM_END ((1ULL << MAX_PHYSMEM_BITS) - 1) +#endif + #include <asm/page.h> #include <asm/processor.h> diff --git a/kernel/resource.c b/kernel/resource.c index 14777af..a83040f 100644 --- a/kernel/resource.c +++ b/kernel/resource.c @@ -1826,8 +1826,7 @@ static resource_size_t gfr_start(struct resource *base, resource_size_t size, if (flags & GFR_DESCENDING) { resource_size_t end; - end = min_t(resource_size_t, base->end, - (1ULL << MAX_PHYSMEM_BITS) - 1); + end = min_t(resource_size_t, base->end, PHYSMEM_END); return end - size + 1; } @@ -1844,8 +1843,7 @@ static bool gfr_continue(struct resource *base, resource_size_t addr, * @size did not wrap 0. */ return addr > addr - size && - addr <= min_t(resource_size_t, base->end, - (1ULL << MAX_PHYSMEM_BITS) - 1); + addr <= min_t(resource_size_t, base->end, PHYSMEM_END); } static resource_size_t gfr_next(resource_size_t addr, resource_size_t size, diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c index 66267c2..951878a 100644 --- a/mm/memory_hotplug.c +++ b/mm/memory_hotplug.c @@ -1681,7 +1681,7 @@ struct range __weak arch_get_mappable_range(void) struct range mhp_get_pluggable_range(bool need_mapping) { - const u64 max_phys = (1ULL << MAX_PHYSMEM_BITS) - 1; + const u64 max_phys = PHYSMEM_END; struct range mhp_range; if (need_mapping) { diff --git a/mm/sparse.c b/mm/sparse.c index e4b8300..0c3bff8 100644 --- a/mm/sparse.c +++ b/mm/sparse.c @@ -129,7 +129,7 @@ static inline int sparse_early_nid(struct mem_section *section) static void __meminit mminit_validate_memmodel_limits(unsigned long *start_pfn, unsigned long *end_pfn) { - unsigned long max_sparsemem_pfn = 1UL << (MAX_PHYSMEM_BITS-PAGE_SHIFT); + unsigned long max_sparsemem_pfn = (PHYSMEM_END + 1) >> PAGE_SHIFT; /* * Sanity checks - do not allow an architecture to pass

5 months, 1 week

1
0
0 0

[PATCH v2 1/2] cpuidle: riscv-sbi: Use scoped device node handling to fix missing of_node_put

by Krzysztof Kozlowski

Two return statements in sbi_cpuidle_dt_init_states() did not drop the OF node reference count. Solve the issue and simplify entire error handling with scoped/cleanup.h. Fixes: 6abf32f1d9c5 ("cpuidle: Add RISC-V SBI CPU idle driver") Cc: <stable(a)vger.kernel.org> Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> --- Changes in v2: 1. Re-write commit msg, because this is actually a fix. --- drivers/cpuidle/cpuidle-riscv-sbi.c | 21 +++++++-------------- 1 file changed, 7 insertions(+), 14 deletions(-) diff --git a/drivers/cpuidle/cpuidle-riscv-sbi.c b/drivers/cpuidle/cpuidle-riscv-sbi.c index a6e123dfe394..5bb3401220d2 100644 --- a/drivers/cpuidle/cpuidle-riscv-sbi.c +++ b/drivers/cpuidle/cpuidle-riscv-sbi.c @@ -8,6 +8,7 @@ #define pr_fmt(fmt) "cpuidle-riscv-sbi: " fmt +#include <linux/cleanup.h> #include <linux/cpuhotplug.h> #include <linux/cpuidle.h> #include <linux/cpumask.h> @@ -236,19 +237,16 @@ static int sbi_cpuidle_dt_init_states(struct device *dev, { struct sbi_cpuidle_data *data = per_cpu_ptr(&sbi_cpuidle_data, cpu); struct device_node *state_node; - struct device_node *cpu_node; u32 *states; int i, ret; - cpu_node = of_cpu_device_node_get(cpu); + struct device_node *cpu_node __free(device_node) = of_cpu_device_node_get(cpu); if (!cpu_node) return -ENODEV; states = devm_kcalloc(dev, state_count, sizeof(*states), GFP_KERNEL); - if (!states) { - ret = -ENOMEM; - goto fail; - } + if (!states) + return -ENOMEM; /* Parse SBI specific details from state DT nodes */ for (i = 1; i < state_count; i++) { @@ -264,10 +262,8 @@ static int sbi_cpuidle_dt_init_states(struct device *dev, pr_debug("sbi-state %#x index %d\n", states[i], i); } - if (i != state_count) { - ret = -ENODEV; - goto fail; - } + if (i != state_count) + return -ENODEV; /* Initialize optional data, used for the hierarchical topology. */ ret = sbi_dt_cpu_init_topology(drv, data, state_count, cpu); @@ -277,10 +273,7 @@ static int sbi_cpuidle_dt_init_states(struct device *dev, /* Store states in the per-cpu struct. */ data->states = states; -fail: - of_node_put(cpu_node); - - return ret; + return 0; } static void sbi_cpuidle_deinit_cpu(int cpu) -- 2.43.0

5 months, 1 week

3
2
0 0

It is correct to introduce new sys calls to stable versions?

by Miao Wang

Hi, Greg I saw you have included commit 7697a0fe0154 ("LoongArch: Define __ARCH_WANT_NEW_STAT in unistd.h") in your stable trees, which actually introduced new sys calls newfstatat and fstat to Loongarch. I wonder if it is correct to add new syscalls, which actually changes the kernel features, in stable releases, as it might confuse downstream developers because they may assume the existence of a certain feature after a certain version. Cheers, Miao Wang

5 months, 1 week

5
9
0 0

[PATCH RESEND] erofs: fix out-of-bound access when z_erofs_gbuf_growsize() partially fails

by Gao Xiang

If z_erofs_gbuf_growsize() partially fails on a global buffer due to memory allocation failure or fault injection (as reported by syzbot [1]), new pages need to be freed by comparing to the existing pages to avoid memory leaks. However, the old gbuf->pages[] array may not be large enough, which can lead to null-ptr-deref or out-of-bound access. Fix this by checking against gbuf->nrpages in advance. [1] https://lore.kernel.org/r/000000000000f7b96e062018c6e3@google.com Reported-by: syzbot+242ee56aaa9585553766(a)syzkaller.appspotmail.com Fixes: d6db47e571dc ("erofs: do not use pagepool in z_erofs_gbuf_growsize()") Cc: <stable(a)vger.kernel.org> # 6.10+ Cc: Chunhai Guo <guochunhai(a)vivo.com> Signed-off-by: Gao Xiang <hsiangkao(a)linux.alibaba.com> --- RESEND: Add missing link and reported-by. fs/erofs/zutil.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/erofs/zutil.c b/fs/erofs/zutil.c index 9b53883e5caf..37afe2024840 100644 --- a/fs/erofs/zutil.c +++ b/fs/erofs/zutil.c @@ -111,7 +111,8 @@ int z_erofs_gbuf_growsize(unsigned int nrpages) out: if (i < z_erofs_gbuf_count && tmp_pages) { for (j = 0; j < nrpages; ++j) - if (tmp_pages[j] && tmp_pages[j] != gbuf->pages[j]) + if (tmp_pages[j] && (j >= gbuf->nrpages || + tmp_pages[j] != gbuf->pages[j])) __free_page(tmp_pages[j]); kfree(tmp_pages); } -- 2.43.5

5 months, 1 week

2
1
0 0

[PATCH 6.10 00/25] 6.10.6-rc3 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.10.6 release. There are 25 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Mon, 19 Aug 2024 08:53:52 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.10.6-rc3… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.10.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.10.6-rc3 Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Revert "drm/amd/display: Refactor function dm_dp_mst_is_port_support_mode()" Niklas Cassel <cassel(a)kernel.org> Revert "ata: libata-scsi: Honor the D_SENSE bit for CK_COND=1 and no error" Sean Young <sean(a)mess.org> media: Revert "media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()" Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> drm/amdgpu/display: Fix null pointer dereference in dc_stream_program_cursor_position Wayne Lin <Wayne.Lin(a)amd.com> drm/amd/display: Solve mst monitors blank out problem after resume Kees Cook <kees(a)kernel.org> binfmt_flat: Fix corruption when not offsetting data start Gergo Koteles <soyer(a)irl.hu> platform/x86: ideapad-laptop: add a mutex to synchronize VPC commands Gergo Koteles <soyer(a)irl.hu> platform/x86: ideapad-laptop: move ymc_trigger_ec from lenovo-ymc Gergo Koteles <soyer(a)irl.hu> platform/x86: ideapad-laptop: introduce a generic notification chain Shyam Sundar S K <Shyam-sundar.S-k(a)amd.com> platform/x86/amd/pmf: Fix to Update HPD Data When ALS is Disabled Takashi Iwai <tiwai(a)suse.de> ALSA: usb: Fix UBSAN warning in parse_audio_unit() Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> fs/ntfs3: Do copy_to_user out of run_lock Pei Li <peili.dev(a)gmail.com> jfs: Fix shift-out-of-bounds in dbDiscardAG Edward Adam Davis <eadavis(a)qq.com> jfs: fix null ptr deref in dtInsertEntry Willem de Bruijn <willemb(a)google.com> fou: remove warn in gue_gro_receive on unsupported protocol Chao Yu <chao(a)kernel.org> f2fs: fix to cover read extent cache access with lock Chao Yu <chao(a)kernel.org> f2fs: fix to do sanity check on F2FS_INLINE_DATA flag in inode during GC yunshui <jiangyunshui(a)kylinos.cn> bpf, net: Use DEV_STAT_INC() Simon Trimmer <simont(a)opensource.cirrus.com> ASoC: cs35l56: Patch CS35L56_IRQ1_MASK_18 to the default value WangYuli <wangyuli(a)uniontech.com> nvme/pci: Add APST quirk for Lenovo N60z laptop Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Define __ARCH_WANT_NEW_STAT in unistd.h Fangzhi Zuo <jerry.zuo(a)amd.com> drm/amd/display: Prevent IPX From Link Detect and Set Mode Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Separate setting and programming of cursor Wayne Lin <wayne.lin(a)amd.com> drm/amd/display: Defer handling mst up request in resume Kees Cook <kees(a)kernel.org> exec: Fix ToCToU between perm check and set-uid/gid usage ------------- Diffstat: Makefile | 4 +- arch/loongarch/include/uapi/asm/unistd.h | 1 + drivers/ata/libata-scsi.c | 15 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 14 +- .../amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 236 ++++++++------------- .../drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c | 6 +- drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 94 +++++--- drivers/gpu/drm/amd/display/dc/dc_stream.h | 8 + .../drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c | 2 +- drivers/media/usb/dvb-usb/dvb-usb-init.c | 35 +-- drivers/nvme/host/pci.c | 7 + drivers/platform/x86/Kconfig | 1 + drivers/platform/x86/amd/pmf/spc.c | 32 +-- drivers/platform/x86/ideapad-laptop.c | 148 +++++++++++-- drivers/platform/x86/ideapad-laptop.h | 9 + drivers/platform/x86/lenovo-ymc.c | 60 +----- fs/binfmt_flat.c | 4 +- fs/exec.c | 8 +- fs/f2fs/extent_cache.c | 50 ++--- fs/f2fs/f2fs.h | 2 +- fs/f2fs/gc.c | 10 + fs/f2fs/inode.c | 10 +- fs/jfs/jfs_dmap.c | 2 + fs/jfs/jfs_dtree.c | 2 + fs/ntfs3/frecord.c | 75 ++++++- net/core/filter.c | 8 +- net/ipv4/fou_core.c | 2 +- sound/soc/codecs/cs35l56-shared.c | 1 + sound/usb/mixer.c | 7 + 29 files changed, 492 insertions(+), 361 deletions(-)

5 months, 1 week

8
8
0 0

[PATCH] ACPI: platform-profile: Fix CFI violation when accessing sysfs files

by Nathan Chancellor

When an attribute group is created with sysfs_create_group(), the ->sysfs_ops() callback is set to kobj_sysfs_ops, which sets the ->show() and ->store() callbacks to kobj_attr_show() and kobj_attr_store() respectively. These functions use container_of() to get the respective callback from the passed attribute, meaning that these callbacks need to be the same type as the callbacks in 'struct kobj_attribute'. However, the platform_profile sysfs functions have the type of the ->show() and ->store() callbacks in 'struct device_attribute', which results a CFI violation when accessing platform_profile or platform_profile_choices under /sys/firmware/acpi because the types do not match: CFI failure at kobj_attr_show+0x19/0x30 (target: platform_profile_choices_show+0x0/0x140; expected type: 0x7a69590c) This happens to work because the layout of 'struct kobj_attribute' and 'struct device_attribute' are the same, so the container_of() cast happens to allow the callbacks to still work. Change the type of platform_profile_choices_show() and platform_profile_{show,store}() to match the callbacks in 'struct kobj_attribute' and update the attribute variables to match, which resolves the CFI violation. Cc: stable(a)vger.kernel.org Fixes: a2ff95e018f1 ("ACPI: platform: Add platform profile support") Reported-by: John Rowley <lkml(a)johnrowley.me> Closes: https://github.com/ClangBuiltLinux/linux/issues/2047 Tested-by: John Rowley <lkml(a)johnrowley.me> Signed-off-by: Nathan Chancellor <nathan(a)kernel.org> --- drivers/acpi/platform_profile.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/drivers/acpi/platform_profile.c b/drivers/acpi/platform_profile.c index d2f7fd7743a1..11278f785526 100644 --- a/drivers/acpi/platform_profile.c +++ b/drivers/acpi/platform_profile.c @@ -22,8 +22,8 @@ static const char * const profile_names[] = { }; static_assert(ARRAY_SIZE(profile_names) == PLATFORM_PROFILE_LAST); -static ssize_t platform_profile_choices_show(struct device *dev, - struct device_attribute *attr, +static ssize_t platform_profile_choices_show(struct kobject *kobj, + struct kobj_attribute *attr, char *buf) { int len = 0; @@ -49,8 +49,8 @@ static ssize_t platform_profile_choices_show(struct device *dev, return len; } -static ssize_t platform_profile_show(struct device *dev, - struct device_attribute *attr, +static ssize_t platform_profile_show(struct kobject *kobj, + struct kobj_attribute *attr, char *buf) { enum platform_profile_option profile = PLATFORM_PROFILE_BALANCED; @@ -77,8 +77,8 @@ static ssize_t platform_profile_show(struct device *dev, return sysfs_emit(buf, "%s\n", profile_names[profile]); } -static ssize_t platform_profile_store(struct device *dev, - struct device_attribute *attr, +static ssize_t platform_profile_store(struct kobject *kobj, + struct kobj_attribute *attr, const char *buf, size_t count) { int err, i; @@ -115,12 +115,12 @@ static ssize_t platform_profile_store(struct device *dev, return count; } -static DEVICE_ATTR_RO(platform_profile_choices); -static DEVICE_ATTR_RW(platform_profile); +static struct kobj_attribute attr_platform_profile_choices = __ATTR_RO(platform_profile_choices); +static struct kobj_attribute attr_platform_profile = __ATTR_RW(platform_profile); static struct attribute *platform_profile_attrs[] = { - &dev_attr_platform_profile_choices.attr, - &dev_attr_platform_profile.attr, + &attr_platform_profile_choices.attr, + &attr_platform_profile.attr, NULL }; --- base-commit: 47ac09b91befbb6a235ab620c32af719f8208399 change-id: 20240819-acpi-platform_profile-fix-cfi-violation-de278753bd5f Best regards, -- Nathan Chancellor <nathan(a)kernel.org>

5 months, 1 week

3
3
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror August 2024