- Linux-stable-mirror - lists.linaro.org

by Greg Kroah-Hartman

I'm announcing the release of the 6.10.8 kernel. All users of the 6.10 kernel series must upgrade. The updated 6.10.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.10.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Documentation/devicetree/bindings/usb/microchip,usb2514.yaml | 9 Makefile | 2 arch/arm/boot/dts/nxp/imx/imx6dl-yapp43-common.dtsi | 12 arch/arm/boot/dts/ti/omap/omap3-n900.dts | 2 arch/arm64/boot/dts/freescale/imx8mp-beacon-kit.dts | 12 arch/arm64/boot/dts/freescale/imx93-tqma9352-mba93xxla.dts | 2 arch/arm64/boot/dts/freescale/imx93-tqma9352.dtsi | 2 arch/arm64/boot/dts/freescale/imx93.dtsi | 2 arch/arm64/boot/dts/qcom/ipq5332.dtsi | 4 arch/arm64/boot/dts/qcom/x1e80100-crd.dts | 2 arch/arm64/boot/dts/qcom/x1e80100-qcp.dts | 2 arch/arm64/boot/dts/qcom/x1e80100.dtsi | 6 arch/loongarch/include/asm/dma-direct.h | 11 arch/loongarch/kernel/fpu.S | 4 arch/loongarch/kvm/switch.S | 4 drivers/bluetooth/btnxpuart.c | 65 +++- drivers/char/tpm/tpm_ibmvtpm.c | 4 drivers/cpufreq/amd-pstate-ut.c | 13 drivers/cpufreq/amd-pstate.c | 2 drivers/dma/dw-edma/dw-hdma-v0-core.c | 26 - drivers/dma/dw/core.c | 89 +++++- drivers/dma/ti/omap-dma.c | 6 drivers/firmware/microchip/mpfs-auto-update.c | 2 drivers/firmware/qcom/qcom_scm-smc.c | 2 drivers/firmware/sysfb.c | 19 - drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 26 - drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | 2 drivers/gpu/drm/amd/amdgpu/mes_v11_0.c | 18 - drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c | 9 drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 21 - drivers/gpu/drm/i915/display/intel_dp.c | 12 drivers/gpu/drm/i915/display/intel_dp_mst.c | 40 ++ drivers/gpu/drm/i915/display/intel_dp_mst.h | 1 drivers/gpu/drm/i915/display/vlv_dsi.c | 1 drivers/gpu/drm/v3d/v3d_sched.c | 6 drivers/gpu/drm/vmwgfx/vmwgfx_blit.c | 114 +++++++ drivers/gpu/drm/vmwgfx/vmwgfx_bo.c | 13 drivers/gpu/drm/vmwgfx/vmwgfx_bo.h | 3 drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 4 drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c | 12 drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 6 drivers/gpu/drm/xe/display/xe_display.c | 33 ++ drivers/gpu/drm/xe/display/xe_display.h | 8 drivers/gpu/drm/xe/xe_exec_queue.c | 5 drivers/gpu/drm/xe/xe_exec_queue_types.h | 14 drivers/gpu/drm/xe/xe_hwmon.c | 2 drivers/gpu/drm/xe/xe_pm.c | 20 + drivers/gpu/drm/xe/xe_preempt_fence.c | 3 drivers/gpu/drm/xe/xe_preempt_fence_types.h | 2 drivers/gpu/drm/xe/xe_vm.c | 60 ++-- drivers/hwmon/pt5161l.c | 4 drivers/iommu/io-pgtable-arm-v7s.c | 3 drivers/iommu/io-pgtable-arm.c | 3 drivers/iommu/io-pgtable-dart.c | 3 drivers/iommu/iommufd/ioas.c | 8 drivers/net/bonding/bond_main.c | 159 +++++++---- drivers/net/ethernet/microsoft/mana/hw_channel.c | 62 ++-- drivers/net/gtp.c | 2 drivers/net/wireless/intel/iwlwifi/fw/acpi.c | 13 drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 2 drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 11 drivers/net/wireless/marvell/mwifiex/cfg80211.c | 32 +- drivers/net/wireless/silabs/wfx/sta.c | 5 drivers/nfc/pn533/pn533.c | 5 drivers/of/platform.c | 2 drivers/phy/freescale/phy-fsl-imx8mq-usb.c | 2 drivers/phy/qualcomm/phy-qcom-qmp-pcie.c | 23 + drivers/phy/xilinx/phy-zynqmp.c | 56 +++ drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c | 55 ++- drivers/pinctrl/pinctrl-rockchip.c | 2 drivers/pinctrl/pinctrl-single.c | 2 drivers/pinctrl/qcom/pinctrl-x1e80100.c | 35 +- drivers/pinctrl/starfive/pinctrl-starfive-jh7110.c | 4 drivers/power/supply/qcom_battmgr.c | 16 - drivers/scsi/aacraid/comminit.c | 2 drivers/scsi/sd.c | 12 drivers/soc/qcom/cmd-db.c | 2 drivers/soc/qcom/pmic_glink.c | 40 +- drivers/soc/qcom/pmic_glink_altmode.c | 17 - drivers/soundwire/stream.c | 8 drivers/usb/cdns3/cdnsp-gadget.h | 3 drivers/usb/cdns3/cdnsp-ring.c | 30 ++ drivers/usb/class/cdc-acm.c | 3 drivers/usb/core/sysfs.c | 1 drivers/usb/dwc3/core.c | 8 drivers/usb/dwc3/dwc3-omap.c | 4 drivers/usb/dwc3/dwc3-st.c | 16 - drivers/usb/dwc3/dwc3-xilinx.c | 7 drivers/usb/dwc3/ep0.c | 3 drivers/usb/gadget/function/uvc_video.c | 1 drivers/usb/serial/option.c | 5 drivers/usb/typec/mux/fsa4480.c | 2 drivers/usb/typec/ucsi/ucsi_glink.c | 43 ++ drivers/video/aperture.c | 11 fs/afs/inode.c | 11 fs/attr.c | 14 fs/backing-file.c | 5 fs/binfmt_elf_fdpic.c | 3 fs/btrfs/bio.c | 26 + fs/btrfs/qgroup.c | 2 fs/ceph/inode.c | 1 fs/erofs/zutil.c | 3 fs/netfs/io.c | 1 fs/netfs/misc.c | 60 +++- fs/netfs/write_collect.c | 7 fs/nfsd/nfs4state.c | 62 ++-- fs/nfsd/nfs4xdr.c | 6 fs/nfsd/state.h | 2 fs/smb/client/cifsglob.h | 1 fs/smb/client/cifssmb.c | 1 fs/smb/client/smb2ops.c | 24 + fs/smb/client/smb2pdu.c | 4 include/linux/fs.h | 1 include/linux/soc/qcom/pmic_glink.h | 11 include/linux/sysfb.h | 4 include/net/bonding.h | 2 include/net/busy_poll.h | 2 include/net/netfilter/nf_tables_ipv4.h | 10 include/net/netfilter/nf_tables_ipv6.h | 5 io_uring/kbuf.c | 2 mm/truncate.c | 4 net/bluetooth/hci_core.c | 10 net/core/net-sysfs.c | 2 net/core/pktgen.c | 4 net/ethtool/ioctl.c | 3 net/ipv4/tcp.c | 18 - net/mptcp/fastopen.c | 4 net/mptcp/options.c | 50 +-- net/mptcp/pm.c | 32 +- net/mptcp/pm_netlink.c | 107 +++++-- net/mptcp/protocol.c | 65 ++-- net/mptcp/protocol.h | 9 net/mptcp/sched.c | 4 net/mptcp/sockopt.c | 4 net/mptcp/subflow.c | 56 ++- net/sched/sch_fq.c | 4 net/sctp/sm_statefuns.c | 22 + security/apparmor/policy_unpack_test.c | 6 security/selinux/hooks.c | 4 security/smack/smack_lsm.c | 4 sound/core/seq/seq_clientmgr.c | 3 sound/pci/hda/cs35l56_hda.c | 2 sound/pci/hda/patch_realtek.c | 2 sound/soc/amd/acp/acp-legacy-mach.c | 2 sound/soc/codecs/cs-amp-lib-test.c | 9 sound/soc/codecs/cs-amp-lib.c | 7 sound/soc/sof/amd/acp-dsp-offset.h | 6 sound/soc/sof/amd/acp.c | 52 ++- sound/soc/sof/amd/acp.h | 9 sound/soc/sof/amd/pci-acp63.c | 2 sound/soc/sof/amd/pci-rmb.c | 2 sound/soc/sof/amd/pci-rn.c | 2 tools/testing/selftests/iommu/iommufd.c | 6 tools/testing/selftests/net/forwarding/local_termination.sh | 4 tools/testing/selftests/net/forwarding/no_forwarding.sh | 3 tools/testing/selftests/net/mptcp/mptcp_join.sh | 57 ++- 156 files changed, 1609 insertions(+), 707 deletions(-) Abel Vesa (1): phy: qcom: qmp-pcie: Fix X1E80100 PCIe Gen4 PHY initialisation Adam Ford (1): arm64: dts: imx8mp-beacon-kit: Fix Stereo Audio on WM8962 Aleksandr Mishin (1): nfc: pn533: Add poll mod list filling check Alex Deucher (4): drm/amdgpu: align pp_power_profile_mode with kernel docs drm/amdgpu/swsmu: always force a state reprogram on init video/aperture: optionally match the device in sysfb_disable() drm/amdgpu: fix eGPU hotplug regression Alexander Stein (1): dt-bindings: usb: microchip,usb2514: Fix reference USB device schema Alexander Sverdlin (1): wifi: wfx: repair open network AP mode Anjaneyulu (1): wifi: iwlwifi: fw: fix wgds rev 3 exact size Avraham Stern (1): wifi: iwlwifi: mvm: allow 6 GHz channels in MLO scan Ben Hutchings (1): scsi: aacraid: Fix double-free on probe failure Bjorn Andersson (3): soc: qcom: pmic_glink: Actually communicate when remote goes down soc: qcom: pmic_glink: Fix race during initialization usb: typec: ucsi: Move unregister out of atomic section Cong Wang (1): gtp: fix a potential NULL pointer dereference Cosmo Chou (1): hwmon: (pt5161l) Fix invalid temperature reading David Howells (8): netfs, ceph: Partially revert "netfs: Replace PG_fscache by setting folio->private and marking dirty" mm: Fix missing folio invalidation calls during truncation afs: Fix post-setattr file edit to do truncation correctly netfs: Fix netfs_release_folio() to say no if folio dirty netfs: Fix trimming of streaming-write folios in netfs_inval_folio() netfs: Fix missing iterator reset on retry of short read netfs: Fix interaction of streaming writes with zero-point tracker cifs: Fix FALLOC_FL_PUNCH_HOLE support Ed Tsai (1): backing-file: convert to using fops->splice_write Emmanuel Grumbach (1): wifi: iwlwifi: mvm: take the mutex before running link selection Eric Dumazet (3): pktgen: use cpus_read_lock() in pg_net_init() net_sched: sch_fq: fix incorrect behavior for small weights net: busy-poll: use ktime_get_ns() instead of local_clock() Francois Dugast (1): drm/xe/exec_queue: Rename xe_exec_queue::compute to xe_exec_queue::lr Gao Xiang (1): erofs: fix out-of-bound access when z_erofs_gbuf_growsize() partially fails Gautham R. Shenoy (1): cpufreq/amd-pstate: Use topology_logical_package_id() instead of logical_die_id() Greg Kroah-Hartman (1): Linux 6.10.8 Guenter Roeck (1): apparmor: fix policy_unpack_test on big endian systems Haiyang Zhang (1): net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response Hal Feng (1): pinctrl: starfive: jh7110: Correct the level trigger configuration of iev register Hans de Goede (1): drm/i915/dsi: Make Lenovo Yoga Tab 3 X90F DMI match less strict Hendrik Borghorst (1): ALSA: hda/realtek: support HP Pavilion Aero 13-bg0xxx Mute LED Huang-Huang Bao (1): pinctrl: rockchip: correct RK3328 iomux width flag for GPIO2-B pins Ian Ray (1): cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller Imre Deak (1): drm/i915/dp_mst: Fix MST state after a sink reset Jack Xiao (1): drm/amdgpu/mes: fix mes ring buffer overflow Jamie Bainbridge (1): ethtool: check device is present when getting link settings Jason Gunthorpe (2): iommufd: Do not allow creating areas without READ or WRITE iommu: Do not return 0 from map_pages if it doesn't do anything Jeff Layton (4): nfsd: ensure that nfsd4_fattr_args.context is zeroed out nfsd: hold reference to delegation when updating it for cb_getattr nfsd: fix potential UAF in nfsd4_cb_getattr_release fs/nfsd: fix update of inode attrs in CB_GETATTR Jens Axboe (1): io_uring/kbuf: return correct iovec count from classic buffer peek Jianbo Liu (3): bonding: implement xdo_dev_state_free and call it after deletion bonding: extract the use of real_device into local variable bonding: change ipsec_lock from spin lock to mutex Johan Hovold (4): arm64: dts: qcom: x1e80100-crd: fix PCIe4 PHY supply arm64: dts: qcom: x1e80100-qcp: fix PCIe4 PHY supply arm64: dts: qcom: x1e80100: add missing PCIe minimum OPP arm64: dts: qcom: x1e80100: fix PCIe domain numbers John Sweeney (1): ALSA: hda/realtek: Enable mute/micmute LEDs on HP Laptop 14-ey0xxx Josef Bacik (1): btrfs: run delayed iputs when flushing delalloc Karthik Poosa (1): drm/xe/hwmon: Fix WRITE_I1 param from u32 to u16 Kees Cook (1): dmaengine: ti: omap-dma: Initialize sglen after allocation Konrad Dybcio (2): pinctrl: qcom: x1e80100: Update PDC hwirq map pinctrl: qcom: x1e80100: Fix special pin offsets Krzysztof Kozlowski (5): soundwire: stream: fix programming slave ports for non-continous port maps usb: dwc3: xilinx: add missing depopulate in probe error path usb: dwc3: omap: add missing depopulate in probe error path usb: dwc3: st: fix probed platform device ref count on probe error path usb: dwc3: st: add missing depopulate in probe error path Luca Weiss (1): usb: typec: fsa4480: Relax CHIP_ID check Luiz Augusto von Dentz (1): Bluetooth: hci_core: Fix not handling hibernation actions Ma Ke (2): pinctrl: single: fix potential NULL dereference in pcs_get_function() drm/amd/display: avoid using null object of framebuffer Maarten Lankhorst (1): drm/xe/display: Make display suspend/resume work on discrete Mario Limonciello (1): cpufreq/amd-pstate-ut: Don't check for highest perf matching on prefcore Markus Niebel (2): arm64: dts: freescale: imx93-tqma9352: fix CMA alloc-ranges arm64: dts: freescale: imx93-tqma9352-mba93xxla: fix typo Matthew Auld (1): drm/xe: prevent UAF around preempt fence Matthieu Baerts (NGI0) (16): mptcp: close subflow when receiving TCP+FIN mptcp: sched: check both backup in retrans mptcp: pr_debug: add missing \n at the end mptcp: pm: reuse ID 0 after delete and re-add mptcp: pm: skip connecting to already established sf mptcp: pm: reset MPC endp ID when re-added mptcp: pm: send ACK on an active subflow mptcp: pm: fix RM_ADDR ID for the initial subflow mptcp: pm: do not remove already closed subflows mptcp: pm: fix ID 0 endp usage after multiple re-creations mptcp: avoid duplicated SUB_CLOSED events mptcp: pm: ADD_ADDR 0 is not a new address selftests: mptcp: join: cannot rm sf if closed selftests: mptcp: join: check removing ID 0 endpoint selftests: mptcp: join: no extra msg if no counter selftests: mptcp: join: check re-re-adding ID 0 endp Max Filippov (1): binfmt_elf_fdpic: fix AUXV size calculation when ELF_HWCAP2 is defined Miao Wang (1): LoongArch: Remove the unused dma-direct.h Michael Grzeschik (1): usb: dwc3: ep0: Don't reset resource alloc flag (including ep0) Michal Vokáč (1): ARM: dts: imx6dl-yapp43: Increase LED current to match the yapp4 HW design Mrinmay Sarkar (2): dmaengine: dw-edma: Fix unmasking STOP and ABORT interrupts for HDMA dmaengine: dw-edma: Do not enable watermark interrupts for HDMA Murali Nalajala (1): firmware: qcom: scm: Mark get_wq_ctx() as atomic call Neeraj Sanjay Kale (2): Bluetooth: btnxpuart: Handle FW Download Abort scenario Bluetooth: btnxpuart: Fix random crash seen while removing driver NeilBrown (1): nfsd: fix nfsd4_deleg_getattr_conflict in presence of third party lease Nícolas F. R. A. Prado (1): pinctrl: mediatek: common-v2: Fix broken bias-disable for PULL_PU_PD_RSEL_TYPE Olga Kornievskaia (1): nfsd: prevent panic for nfsv4.0 closed files in nfs4_show_open Ondrej Mosnacek (1): sctp: fix association labeling in the duplicate COOKIE-ECHO case Pablo Neira Ayuso (2): netfilter: nf_tables: restore IP sanity checks for netdev/egress netfilter: nf_tables_ipv6: consider network offset in netdev/egress validation Pawel Laszczak (2): usb: cdnsp: fix incorrect index in cdnsp_get_hw_deq function usb: cdnsp: fix for Link TRB with TC Petr Machata (2): selftests: forwarding: no_forwarding: Down ports on cleanup selftests: forwarding: local_termination: Down ports on cleanup Piyush Mehta (1): phy: xilinx: phy-zynqmp: Fix SGMII linkup failure on resume Qu Wenruo (1): btrfs: fix a use-after-free when hitting errors inside btrfs_submit_chunk() Richard Fitzgerald (2): ASoC: cs-amp-lib-test: Force test calibration blob entries to be valid ASoC: cs-amp-lib: Ignore empty UEFI calibration entries Rodrigo Vivi (1): drm/xe: Prepare display for D3Cold Sascha Hauer (1): wifi: mwifiex: duplicate static structs used in driver instances Scott Mayhew (1): selinux,smack: don't bypass permissions check in inode_setsecctx hook Selvarasu Ganesan (1): usb: dwc3: core: Prevent USB core invalid event buffer address access Serge Semin (2): dmaengine: dw: Add peripheral bus width verification dmaengine: dw: Add memory bus width verification Shenwei Wang (1): arm64: dts: imx93: update default value for snps,clk-csr Sicelo A. Mhlongo (1): ARM: dts: omap3-n900: correct the accelerometer orientation Simon Trimmer (1): ALSA: hda: cs35l56: Don't use the device index as a calibration index Stefan Berger (1): tpm: ibmvtpm: Call tpm2_sessions_init() to initialize session support Stefan Metzmacher (2): smb/client: avoid dereferencing rdata=NULL in smb2_new_read_req() smb/client: remove unused rq_iter_size from struct smb_rqst Steve Wilkins (1): firmware: microchip: fix incorrect error report of programming:timeout on success Takashi Iwai (1): ALSA: seq: Skip event type filtering for UMP events Thorsten Blum (1): drm/xe/vm: Simplify if condition Tiezhu Yang (1): LoongArch: Add ifdefs to fix LSX and LASX related warnings Tvrtko Ursulin (1): drm/v3d: Disable preemption while updating GPU stats Varadarajan Narayanan (1): arm64: dts: qcom: ipq5332: Fix interrupt trigger type for usb Victor Lu (1): drm/amdgpu: Do not wait for MP0_C2PMSG_33 IFWI init in SRIOV Vijendar Mukunda (3): ASoC: SOF: amd: move iram-dram fence register programming sequence ASoC: SOF: amd: Fix for incorrect acp error register offsets ASoC: SOF: amd: Fix for acp init sequence Volodymyr Babchuk (1): soc: qcom: cmd-db: Map shared memory as WC, not WB Xu Yang (2): phy: fsl-imx8mq-usb: fix tuning parameter name usb: gadget: uvc: queue pump work in uvcg_video_enable() Xueming Feng (1): tcp: fix forever orphan socket caused by tcp_abort Yihang Li (1): scsi: sd: Ignore command SYNCHRONIZE CACHE error if format in progress Yuntao Liu (1): ASoC: amd: acp: fix module autoloading ZHANG Yuntian (1): USB: serial: option: add MeiG Smart SRM825L Zack Rusin (3): drm/vmwgfx: Prevent unmapping active read buffers drm/vmwgfx: Fix prime with external buffers drm/vmwgfx: Disable coherent dumb buffers without 3d Zijun Hu (1): usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in remove_power_attributes()

1 year

1
1
0 0

Linux 6.6.49

by Greg Kroah-Hartman

I'm announcing the release of the 6.6.49 kernel. All users of the 6.6 kernel series must upgrade. The updated 6.6.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.6.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Makefile | 2 arch/alpha/kernel/pci_iommu.c | 2 arch/arm/boot/dts/nxp/imx/imx6dl-yapp43-common.dtsi | 12 arch/arm/boot/dts/ti/omap/omap3-n900.dts | 2 arch/arm64/boot/dts/freescale/imx8mp-beacon-kit.dts | 12 arch/arm64/boot/dts/freescale/imx93-tqma9352-mba93xxla.dts | 2 arch/arm64/boot/dts/freescale/imx93-tqma9352.dtsi | 2 arch/arm64/boot/dts/freescale/imx93.dtsi | 15 + arch/loongarch/include/asm/dma-direct.h | 11 arch/mips/jazz/jazzdma.c | 2 arch/powerpc/kernel/dma-iommu.c | 2 arch/powerpc/platforms/ps3/system-bus.c | 4 arch/powerpc/platforms/pseries/vio.c | 2 arch/x86/kernel/amd_gart_64.c | 2 drivers/bluetooth/btnxpuart.c | 89 +++++- drivers/dma/dw-edma/dw-hdma-v0-core.c | 26 - drivers/dma/dw/core.c | 89 ++++++ drivers/firmware/qcom_scm-smc.c | 2 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c | 9 drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 21 - drivers/gpu/drm/vmwgfx/vmwgfx_blit.c | 114 ++++++++ drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 4 drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c | 12 drivers/iommu/dma-iommu.c | 2 drivers/iommu/io-pgtable-arm-v7s.c | 3 drivers/iommu/io-pgtable-arm.c | 3 drivers/iommu/io-pgtable-dart.c | 3 drivers/iommu/iommufd/ioas.c | 8 drivers/net/bonding/bond_main.c | 159 +++++++----- drivers/net/ethernet/microsoft/mana/hw_channel.c | 62 ++-- drivers/net/gtp.c | 2 drivers/net/wireless/intel/iwlwifi/fw/acpi.c | 13 drivers/net/wireless/marvell/mwifiex/cfg80211.c | 32 +- drivers/net/wireless/silabs/wfx/sta.c | 5 drivers/nfc/pn533/pn533.c | 5 drivers/parisc/ccio-dma.c | 2 drivers/parisc/sba_iommu.c | 2 drivers/phy/freescale/phy-fsl-imx8mq-usb.c | 2 drivers/phy/xilinx/phy-zynqmp.c | 56 ++++ drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c | 55 ++-- drivers/pinctrl/pinctrl-rockchip.c | 2 drivers/pinctrl/pinctrl-single.c | 2 drivers/pinctrl/starfive/pinctrl-starfive-jh7110.c | 4 drivers/power/supply/qcom_battmgr.c | 16 - drivers/scsi/aacraid/comminit.c | 2 drivers/scsi/sd.c | 12 drivers/soc/qcom/cmd-db.c | 2 drivers/soc/qcom/pmic_glink.c | 30 +- drivers/soc/qcom/pmic_glink_altmode.c | 17 - drivers/soundwire/stream.c | 8 drivers/thermal/thermal_of.c | 17 - drivers/usb/cdns3/cdnsp-gadget.h | 3 drivers/usb/cdns3/cdnsp-ring.c | 30 ++ drivers/usb/class/cdc-acm.c | 3 drivers/usb/core/sysfs.c | 1 drivers/usb/dwc3/core.c | 8 drivers/usb/dwc3/dwc3-omap.c | 4 drivers/usb/dwc3/dwc3-st.c | 16 - drivers/usb/serial/option.c | 5 drivers/usb/typec/tcpm/tcpm.c | 14 - drivers/usb/typec/ucsi/ucsi_glink.c | 16 - drivers/xen/grant-dma-ops.c | 2 drivers/xen/swiotlb-xen.c | 2 fs/btrfs/bio.c | 26 + fs/btrfs/qgroup.c | 2 fs/overlayfs/params.c | 51 --- fs/smb/client/smb2ops.c | 22 + fs/smb/client/smb2pdu.c | 2 include/linux/dma-map-ops.h | 2 include/linux/of.h | 15 + include/linux/soc/qcom/pmic_glink.h | 11 include/net/bonding.h | 2 include/net/busy_poll.h | 2 include/net/netfilter/nf_tables_ipv4.h | 10 include/net/netfilter/nf_tables_ipv6.h | 5 kernel/dma/mapping.c | 4 kernel/trace/trace.h | 23 + kernel/trace/trace_events.c | 33 +- kernel/trace/trace_events_hist.c | 4 kernel/trace/trace_events_inject.c | 2 kernel/trace/trace_events_trigger.c | 6 mm/truncate.c | 4 net/bluetooth/hci_core.c | 10 net/core/net-sysfs.c | 2 net/ethtool/ioctl.c | 3 net/mptcp/pm.c | 4 net/mptcp/pm_netlink.c | 59 +++- net/mptcp/protocol.c | 7 net/mptcp/protocol.h | 2 net/mptcp/subflow.c | 8 net/sctp/sm_statefuns.c | 22 + security/apparmor/policy_unpack_test.c | 6 security/selinux/hooks.c | 4 security/smack/smack_lsm.c | 4 sound/core/seq/seq_clientmgr.c | 3 sound/soc/amd/acp/acp-legacy-mach.c | 2 sound/soc/sof/amd/acp.c | 19 + sound/soc/sof/amd/acp.h | 7 tools/testing/selftests/iommu/iommufd.c | 6 tools/testing/selftests/net/forwarding/local_termination.sh | 4 tools/testing/selftests/net/forwarding/no_forwarding.sh | 3 tools/testing/selftests/net/mptcp/mptcp_join.sh | 46 ++- 102 files changed, 1071 insertions(+), 444 deletions(-) Adam Ford (1): arm64: dts: imx8mp-beacon-kit: Fix Stereo Audio on WM8962 Aleksandr Mishin (1): nfc: pn533: Add poll mod list filling check Alex Deucher (2): drm/amdgpu: align pp_power_profile_mode with kernel docs drm/amdgpu/swsmu: always force a state reprogram on init Alexander Sverdlin (1): wifi: wfx: repair open network AP mode Anjaneyulu (1): wifi: iwlwifi: fw: fix wgds rev 3 exact size Ben Hutchings (1): scsi: aacraid: Fix double-free on probe failure Bjorn Andersson (2): soc: qcom: pmic_glink: Actually communicate when remote goes down soc: qcom: pmic_glink: Fix race during initialization Christian Brauner (1): ovl: pass string to ovl_parse_layer() Cong Wang (1): gtp: fix a potential NULL pointer dereference David Howells (2): mm: Fix missing folio invalidation calls during truncation cifs: Fix FALLOC_FL_PUNCH_HOLE support Eric Dumazet (1): net: busy-poll: use ktime_get_ns() instead of local_clock() Greg Kroah-Hartman (3): usb: typec: fix up incorrectly backported "usb: typec: tcpm: unregister existing source caps before re-registration" Revert "change alloc_pages name in dma_map_ops to avoid name conflicts" Linux 6.6.49 Guenter Roeck (1): apparmor: fix policy_unpack_test on big endian systems Haiyang Zhang (1): net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response Hal Feng (1): pinctrl: starfive: jh7110: Correct the level trigger configuration of iev register Huang-Huang Bao (1): pinctrl: rockchip: correct RK3328 iomux width flag for GPIO2-B pins Ian Ray (1): cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller Jamie Bainbridge (1): ethtool: check device is present when getting link settings Jason Gunthorpe (2): iommufd: Do not allow creating areas without READ or WRITE iommu: Do not return 0 from map_pages if it doesn't do anything Jianbo Liu (3): bonding: implement xdo_dev_state_free and call it after deletion bonding: extract the use of real_device into local variable bonding: change ipsec_lock from spin lock to mutex Jonathan Cameron (2): of: Add cleanup.h based auto release via __free(device_node) markings of: Introduce for_each_*_child_of_node_scoped() to automate of_node_put() handling Josef Bacik (1): btrfs: run delayed iputs when flushing delalloc Krzysztof Kozlowski (6): thermal: of: Fix OF node leak in thermal_of_trips_init() error path thermal: of: Fix OF node leak in of_thermal_zone_find() error paths soundwire: stream: fix programming slave ports for non-continous port maps usb: dwc3: omap: add missing depopulate in probe error path usb: dwc3: st: fix probed platform device ref count on probe error path usb: dwc3: st: add missing depopulate in probe error path Luiz Augusto von Dentz (1): Bluetooth: hci_core: Fix not handling hibernation actions Ma Ke (2): pinctrl: single: fix potential NULL dereference in pcs_get_function() drm/amd/display: avoid using null object of framebuffer Markus Niebel (2): arm64: dts: freescale: imx93-tqma9352: fix CMA alloc-ranges arm64: dts: freescale: imx93-tqma9352-mba93xxla: fix typo Matthieu Baerts (NGI0) (12): mptcp: close subflow when receiving TCP+FIN mptcp: sched: check both backup in retrans mptcp: pm: reuse ID 0 after delete and re-add mptcp: pm: skip connecting to already established sf mptcp: pm: reset MPC endp ID when re-added mptcp: pm: send ACK on an active subflow mptcp: pm: do not remove already closed subflows mptcp: pm: fix ID 0 endp usage after multiple re-creations mptcp: pm: ADD_ADDR 0 is not a new address selftests: mptcp: join: check removing ID 0 endpoint selftests: mptcp: join: no extra msg if no counter selftests: mptcp: join: check re-re-adding ID 0 endp Miao Wang (1): LoongArch: Remove the unused dma-direct.h Michal Vokáč (1): ARM: dts: imx6dl-yapp43: Increase LED current to match the yapp4 HW design Mrinmay Sarkar (2): dmaengine: dw-edma: Fix unmasking STOP and ABORT interrupts for HDMA dmaengine: dw-edma: Do not enable watermark interrupts for HDMA Murali Nalajala (1): firmware: qcom: scm: Mark get_wq_ctx() as atomic call Neeraj Sanjay Kale (3): Bluetooth: btnxpuart: Resolve TX timeout error in power save stress test Bluetooth: btnxpuart: Handle FW Download Abort scenario Bluetooth: btnxpuart: Fix random crash seen while removing driver Nícolas F. R. A. Prado (1): pinctrl: mediatek: common-v2: Fix broken bias-disable for PULL_PU_PD_RSEL_TYPE Ondrej Mosnacek (1): sctp: fix association labeling in the duplicate COOKIE-ECHO case Pablo Neira Ayuso (2): netfilter: nf_tables: restore IP sanity checks for netdev/egress netfilter: nf_tables_ipv6: consider network offset in netdev/egress validation Pawel Laszczak (2): usb: cdnsp: fix incorrect index in cdnsp_get_hw_deq function usb: cdnsp: fix for Link TRB with TC Peng Fan (2): arm64: dts: imx93: add nvmem property for fec1 arm64: dts: imx93: add nvmem property for eqos Petr Machata (2): selftests: forwarding: no_forwarding: Down ports on cleanup selftests: forwarding: local_termination: Down ports on cleanup Piyush Mehta (1): phy: xilinx: phy-zynqmp: Fix SGMII linkup failure on resume Qu Wenruo (1): btrfs: fix a use-after-free when hitting errors inside btrfs_submit_chunk() Sascha Hauer (1): wifi: mwifiex: duplicate static structs used in driver instances Scott Mayhew (1): selinux,smack: don't bypass permissions check in inode_setsecctx hook Selvarasu Ganesan (1): usb: dwc3: core: Prevent USB core invalid event buffer address access Serge Semin (2): dmaengine: dw: Add peripheral bus width verification dmaengine: dw: Add memory bus width verification Shenwei Wang (1): arm64: dts: imx93: update default value for snps,clk-csr Sicelo A. Mhlongo (1): ARM: dts: omap3-n900: correct the accelerometer orientation Stefan Metzmacher (1): smb/client: avoid dereferencing rdata=NULL in smb2_new_read_req() Steven Rostedt (1): tracing: Have format file honor EVENT_FILE_FL_FREED Takashi Iwai (1): ALSA: seq: Skip event type filtering for UMP events Vijendar Mukunda (1): ASoC: SOF: amd: Fix for acp init sequence Volodymyr Babchuk (1): soc: qcom: cmd-db: Map shared memory as WC, not WB Xu Yang (1): phy: fsl-imx8mq-usb: fix tuning parameter name Yihang Li (1): scsi: sd: Ignore command SYNCHRONIZE CACHE error if format in progress Yuntao Liu (1): ASoC: amd: acp: fix module autoloading ZHANG Yuntian (1): USB: serial: option: add MeiG Smart SRM825L Zack Rusin (1): drm/vmwgfx: Fix prime with external buffers Zhihao Cheng (2): ovl: fix wrong lowerdir number check for parameter Opt_lowerdir ovl: ovl_parse_param_lowerdir: Add missed '\n' for pr_err Zijun Hu (1): usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in remove_power_attributes()

1 year

1
1
0 0

Linux 6.1.108

by Greg Kroah-Hartman

I'm announcing the release of the 6.1.108 kernel. All users of the 6.1 kernel series must upgrade. The updated 6.1.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.1.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Makefile | 2 arch/loongarch/include/asm/dma-direct.h | 11 drivers/ata/libata-core.c | 3 drivers/dma/dw/core.c | 89 ++++++- drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 3 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c | 9 drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 21 - drivers/iommu/io-pgtable-arm-v7s.c | 3 drivers/iommu/io-pgtable-arm.c | 3 drivers/iommu/io-pgtable-dart.c | 3 drivers/mmc/core/core.c | 3 drivers/mmc/host/dw_mmc.c | 3 drivers/mmc/host/mtk-sd.c | 14 - drivers/mmc/host/sdhci-msm.c | 3 drivers/mmc/host/sdhci-pci-o2micro.c | 3 drivers/mmc/host/sdhci-tegra.c | 8 drivers/mmc/host/sdhci.c | 9 drivers/net/bonding/bond_main.c | 36 ++ drivers/net/ethernet/intel/igc/igc_tsn.c | 9 drivers/net/ethernet/microsoft/mana/hw_channel.c | 62 ++-- drivers/net/gtp.c | 2 drivers/net/wireless/intel/iwlwifi/fw/acpi.c | 13 - drivers/net/wireless/marvell/mwifiex/cfg80211.c | 32 ++ drivers/net/wireless/silabs/wfx/sta.c | 5 drivers/nfc/pn533/pn533.c | 5 drivers/phy/xilinx/phy-zynqmp.c | 152 +++++++----- drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c | 55 ++-- drivers/pinctrl/pinctrl-rockchip.c | 2 drivers/pinctrl/pinctrl-single.c | 2 drivers/scsi/aacraid/comminit.c | 2 drivers/soc/qcom/cmd-db.c | 2 drivers/soundwire/stream.c | 8 drivers/thermal/thermal_of.c | 17 - drivers/usb/cdns3/cdnsp-gadget.h | 3 drivers/usb/cdns3/cdnsp-ring.c | 30 ++ drivers/usb/class/cdc-acm.c | 3 drivers/usb/core/sysfs.c | 1 drivers/usb/dwc3/core.c | 8 drivers/usb/dwc3/dwc3-omap.c | 4 drivers/usb/dwc3/dwc3-st.c | 16 - drivers/usb/serial/option.c | 5 drivers/usb/typec/tcpm/tcpm.c | 14 - drivers/video/fbdev/offb.c | 1 fs/btrfs/compression.c | 2 fs/btrfs/qgroup.c | 2 fs/smb/client/smb2pdu.c | 2 include/linux/of.h | 15 + include/net/busy_poll.h | 2 include/net/netfilter/nf_tables_ipv4.h | 10 include/net/netfilter/nf_tables_ipv6.h | 5 mm/truncate.c | 4 net/bluetooth/hci_core.c | 10 net/core/net-sysfs.c | 2 net/ethtool/ioctl.c | 3 net/mptcp/pm.c | 32 +- net/mptcp/pm_netlink.c | 110 ++++---- net/mptcp/protocol.c | 7 net/mptcp/protocol.h | 7 net/mptcp/subflow.c | 8 net/sctp/sm_statefuns.c | 22 + security/apparmor/policy_unpack_test.c | 6 sound/soc/amd/acp/acp-legacy-mach.c | 2 sound/soc/sof/amd/acp.c | 19 + sound/soc/sof/amd/acp.h | 7 tools/testing/selftests/net/forwarding/local_termination.sh | 4 tools/testing/selftests/net/forwarding/no_forwarding.sh | 3 66 files changed, 649 insertions(+), 314 deletions(-) Aleksandr Mishin (1): nfc: pn533: Add poll mod list filling check Alex Deucher (2): drm/amdgpu: align pp_power_profile_mode with kernel docs drm/amdgpu/swsmu: always force a state reprogram on init Alexander Sverdlin (1): wifi: wfx: repair open network AP mode Anjaneyulu (1): wifi: iwlwifi: fw: fix wgds rev 3 exact size Ben Hutchings (1): scsi: aacraid: Fix double-free on probe failure ChanWoo Lee (1): mmc: Avoid open coding by using mmc_op_tuning() Cong Wang (1): gtp: fix a potential NULL pointer dereference David Howells (1): mm: Fix missing folio invalidation calls during truncation Eric Dumazet (1): net: busy-poll: use ktime_get_ns() instead of local_clock() Faizal Rahim (2): igc: Fix reset adapter logics when tx mode change igc: Fix qbv tx latency by setting gtxoffset Filipe Manana (1): btrfs: fix extent map use-after-free when adding pages to compressed bio Geliang Tang (1): mptcp: unify pm get_local_id interfaces Greg Kroah-Hartman (3): usb: typec: fix up incorrectly backported "usb: typec: tcpm: unregister existing source caps before re-registration" fbdev: offb: fix up missing cleanup.h Linux 6.1.108 Guenter Roeck (1): apparmor: fix policy_unpack_test on big endian systems Haiyang Zhang (1): net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response Huang-Huang Bao (1): pinctrl: rockchip: correct RK3328 iomux width flag for GPIO2-B pins Ian Ray (1): cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller Jamie Bainbridge (1): ethtool: check device is present when getting link settings Jason Gunthorpe (1): iommu: Do not return 0 from map_pages if it doesn't do anything Jesse Zhang (1): drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc Jianbo Liu (1): bonding: implement xdo_dev_state_free and call it after deletion Jonathan Cameron (2): of: Add cleanup.h based auto release via __free(device_node) markings of: Introduce for_each_*_child_of_node_scoped() to automate of_node_put() handling Josef Bacik (1): btrfs: run delayed iputs when flushing delalloc Krzysztof Kozlowski (6): thermal: of: Fix OF node leak in thermal_of_trips_init() error path thermal: of: Fix OF node leak in of_thermal_zone_find() error paths soundwire: stream: fix programming slave ports for non-continous port maps usb: dwc3: omap: add missing depopulate in probe error path usb: dwc3: st: fix probed platform device ref count on probe error path usb: dwc3: st: add missing depopulate in probe error path Luiz Augusto von Dentz (1): Bluetooth: hci_core: Fix not handling hibernation actions Ma Ke (2): pinctrl: single: fix potential NULL dereference in pcs_get_function() drm/amd/display: avoid using null object of framebuffer Matthieu Baerts (NGI0) (10): mptcp: close subflow when receiving TCP+FIN mptcp: sched: check both backup in retrans mptcp: pm: skip connecting to already established sf mptcp: pm: reset MPC endp ID when re-added mptcp: pm: send ACK on an active subflow mptcp: pm: do not remove already closed subflows mptcp: pm: ADD_ADDR 0 is not a new address mptcp: pm: remove mptcp_pm_remove_subflow() mptcp: pm: only mark 'subflow' endp as available mptcp: pm: check add_addr_accept_max before accepting new ADD_ADDR Mengqi Zhang (1): mmc: mtk-sd: receive cmd8 data when hs400 tuning fail Miao Wang (1): LoongArch: Remove the unused dma-direct.h Niklas Cassel (1): ata: libata-core: Fix null pointer dereference on error Nícolas F. R. A. Prado (1): pinctrl: mediatek: common-v2: Fix broken bias-disable for PULL_PU_PD_RSEL_TYPE Ondrej Mosnacek (1): sctp: fix association labeling in the duplicate COOKIE-ECHO case Pablo Neira Ayuso (2): netfilter: nf_tables: restore IP sanity checks for netdev/egress netfilter: nf_tables_ipv6: consider network offset in netdev/egress validation Pawel Laszczak (2): usb: cdnsp: fix incorrect index in cdnsp_get_hw_deq function usb: cdnsp: fix for Link TRB with TC Petr Machata (2): selftests: forwarding: no_forwarding: Down ports on cleanup selftests: forwarding: local_termination: Down ports on cleanup Piyush Mehta (3): phy: xilinx: add runtime PM support phy: xilinx: phy-zynqmp: dynamic clock support for power-save phy: xilinx: phy-zynqmp: Fix SGMII linkup failure on resume Sascha Hauer (1): wifi: mwifiex: duplicate static structs used in driver instances Sean Anderson (1): phy: zynqmp: Enable reference clock correctly Selvarasu Ganesan (1): usb: dwc3: core: Prevent USB core invalid event buffer address access Serge Semin (2): dmaengine: dw: Add peripheral bus width verification dmaengine: dw: Add memory bus width verification Stefan Metzmacher (1): smb/client: avoid dereferencing rdata=NULL in smb2_new_read_req() Vijendar Mukunda (1): ASoC: SOF: amd: Fix for acp init sequence Volodymyr Babchuk (1): soc: qcom: cmd-db: Map shared memory as WC, not WB Yuntao Liu (1): ASoC: amd: acp: fix module autoloading ZHANG Yuntian (1): USB: serial: option: add MeiG Smart SRM825L Zijun Hu (1): usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in remove_power_attributes()

1 year

1
1
0 0

Linux 5.15.166

by Greg Kroah-Hartman

I'm announcing the release of the 5.15.166 kernel. All users of the 5.15 kernel series must upgrade. The updated 5.15.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.15.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Makefile | 2 arch/arm64/kernel/acpi_numa.c | 2 arch/arm64/kernel/setup.c | 3 arch/arm64/kernel/smp.c | 2 arch/arm64/kvm/sys_regs.c | 6 arch/arm64/kvm/vgic/vgic.h | 7 arch/mips/kernel/cpu-probe.c | 4 arch/mips/loongson64/reset.c | 38 +- arch/openrisc/kernel/setup.c | 6 arch/parisc/kernel/irq.c | 4 arch/powerpc/boot/simple_alloc.c | 7 arch/powerpc/sysdev/xics/icp-native.c | 2 arch/s390/include/asm/uv.h | 5 arch/s390/kernel/early.c | 12 arch/s390/kernel/smp.c | 4 arch/x86/kernel/process.c | 5 drivers/ata/libata-core.c | 3 drivers/atm/idt77252.c | 9 drivers/bluetooth/hci_ldisc.c | 3 drivers/char/xillybus/xillyusb.c | 42 ++ drivers/clocksource/arm_global_timer.c | 11 drivers/dma/dw/core.c | 89 ++++- drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c | 8 drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 3 drivers/gpu/drm/amd/amdgpu/jpeg_v2_0.c | 4 drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 5 drivers/gpu/drm/lima/lima_gp.c | 12 drivers/gpu/drm/msm/disp/dpu1/dpu_kms.h | 14 drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c | 3 drivers/gpu/drm/msm/dp/dp_ctrl.c | 2 drivers/hid/hid-ids.h | 10 drivers/hid/hid-microsoft.c | 11 drivers/hid/wacom_wac.c | 4 drivers/hwmon/ltc2992.c | 8 drivers/i2c/busses/i2c-riic.c | 2 drivers/i3c/master/mipi-i3c-hci/dma.c | 5 drivers/infiniband/hw/hfi1/chip.c | 5 drivers/infiniband/ulp/rtrs/rtrs.c | 2 drivers/input/input-mt.c | 3 drivers/irqchip/irq-gic-v3-its.c | 2 drivers/md/dm-clone-metadata.c | 5 drivers/md/dm-ioctl.c | 22 + drivers/md/dm.c | 4 drivers/md/md.c | 5 drivers/md/persistent-data/dm-space-map-metadata.c | 4 drivers/media/dvb-core/dvb_frontend.c | 12 drivers/media/pci/cx23885/cx23885-video.c | 8 drivers/media/pci/solo6x10/solo6x10-offsets.h | 10 drivers/media/platform/qcom/venus/pm_helpers.c | 2 drivers/media/radio/radio-isa.c | 2 drivers/memory/stm32-fmc2-ebi.c | 122 +++++-- drivers/memory/tegra/tegra186.c | 3 drivers/mmc/core/mmc_test.c | 9 drivers/mmc/host/dw_mmc.c | 8 drivers/net/bonding/bond_main.c | 21 - drivers/net/bonding/bond_options.c | 2 drivers/net/dsa/mv88e6xxx/Makefile | 4 drivers/net/dsa/mv88e6xxx/global1_atu.c | 82 ++++ drivers/net/dsa/mv88e6xxx/trace.c | 6 drivers/net/dsa/mv88e6xxx/trace.h | 66 +++ drivers/net/dsa/vitesse-vsc73xx-core.c | 69 +++- drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c | 3 drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c | 7 drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 3 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 4 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c | 7 drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 4 drivers/net/ethernet/i825xx/sun3_82586.c | 2 drivers/net/ethernet/intel/ice/ice_txrx.c | 2 drivers/net/ethernet/intel/igc/igc_base.c | 29 + drivers/net/ethernet/intel/igc/igc_base.h | 2 drivers/net/ethernet/intel/igc/igc_defines.h | 16 drivers/net/ethernet/intel/igc/igc_main.c | 12 drivers/net/ethernet/intel/igc/igc_regs.h | 1 drivers/net/ethernet/intel/igc/igc_tsn.c | 113 +++++- drivers/net/ethernet/intel/igc/igc_tsn.h | 1 drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c | 2 drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige.h | 9 drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c | 10 drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_regs.h | 2 drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c | 50 ++- drivers/net/ethernet/microsoft/mana/hw_channel.c | 62 ++- drivers/net/ethernet/microsoft/mana/mana.h | 1 drivers/net/ethernet/microsoft/mana/mana_en.c | 24 - drivers/net/ethernet/xilinx/xilinx_axienet.h | 17 - drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 25 - drivers/net/gtp.c | 5 drivers/net/wireless/intel/iwlwifi/fw/debugfs.c | 6 drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 2 drivers/net/wireless/marvell/mwifiex/cfg80211.c | 32 + drivers/net/wireless/st/cw1200/txrx.c | 2 drivers/nfc/pn533/pn533.c | 5 drivers/nvme/target/rdma.c | 16 drivers/nvme/target/tcp.c | 1 drivers/nvme/target/trace.c | 6 drivers/nvme/target/trace.h | 28 + drivers/phy/xilinx/phy-zynqmp.c | 152 ++++++--- drivers/pinctrl/pinctrl-rockchip.c | 2 drivers/pinctrl/pinctrl-single.c | 2 drivers/platform/surface/aggregator/controller.c | 3 drivers/platform/x86/lg-laptop.c | 2 drivers/s390/block/dasd.c | 36 +- drivers/s390/block/dasd_3990_erp.c | 10 drivers/s390/block/dasd_eckd.c | 55 +-- drivers/s390/block/dasd_int.h | 2 drivers/s390/cio/idset.c | 12 drivers/scsi/aacraid/comminit.c | 2 drivers/scsi/lpfc/lpfc_sli.c | 2 drivers/scsi/scsi_transport_spi.c | 4 drivers/soc/qcom/cmd-db.c | 2 drivers/soundwire/stream.c | 8 drivers/ssb/main.c | 2 drivers/staging/iio/resolver/ad2s1210.c | 7 drivers/staging/ks7010/ks7010_sdio.c | 4 drivers/thunderbolt/switch.c | 1 drivers/usb/cdns3/cdnsp-gadget.h | 3 drivers/usb/cdns3/cdnsp-ring.c | 30 + drivers/usb/class/cdc-acm.c | 3 drivers/usb/core/sysfs.c | 1 drivers/usb/dwc3/core.c | 21 + drivers/usb/dwc3/dwc3-omap.c | 4 drivers/usb/dwc3/dwc3-st.c | 16 drivers/usb/gadget/udc/fsl_udc_core.c | 2 drivers/usb/host/xhci.c | 8 drivers/usb/serial/option.c | 5 fs/afs/file.c | 8 fs/binfmt_elf_fdpic.c | 2 fs/binfmt_misc.c | 216 ++++++++++--- fs/btrfs/delayed-inode.c | 2 fs/btrfs/free-space-cache.c | 8 fs/btrfs/inode.c | 9 fs/btrfs/qgroup.c | 4 fs/btrfs/send.c | 9 fs/btrfs/tree-checker.c | 69 ++++ fs/ext4/extents.c | 3 fs/ext4/mballoc.c | 3 fs/f2fs/segment.c | 5 fs/file.c | 30 - fs/fuse/cuse.c | 3 fs/fuse/dev.c | 6 fs/fuse/fuse_i.h | 1 fs/fuse/inode.c | 15 fs/fuse/virtio_fs.c | 10 fs/gfs2/inode.c | 2 fs/inode.c | 39 ++ fs/lockd/svc.c | 3 fs/nfs/callback.c | 3 fs/nfs/pnfs.c | 8 fs/nfsd/export.c | 32 + fs/nfsd/export.h | 4 fs/nfsd/netns.h | 25 + fs/nfsd/nfs4proc.c | 6 fs/nfsd/nfscache.c | 200 +++++++----- fs/nfsd/nfsctl.c | 24 - fs/nfsd/nfsd.h | 1 fs/nfsd/nfsfh.c | 3 fs/nfsd/nfssvc.c | 24 - fs/nfsd/stats.c | 52 +-- fs/nfsd/stats.h | 85 +---- fs/nfsd/trace.h | 22 + fs/nfsd/vfs.c | 6 fs/ntfs3/bitmap.c | 4 fs/ntfs3/fsntfs.c | 2 fs/ntfs3/index.c | 11 fs/ntfs3/ntfs_fs.h | 4 fs/ntfs3/super.c | 2 fs/quota/dquot.c | 5 include/linux/bitmap.h | 20 + include/linux/blkdev.h | 2 include/linux/cpumask.h | 2 include/linux/fs.h | 5 include/linux/pm.h | 55 ++- include/linux/pm_runtime.h | 14 include/linux/sunrpc/svc.h | 5 include/net/busy_poll.h | 2 include/net/kcm.h | 1 include/scsi/scsi_cmnd.h | 2 kernel/cgroup/cpuset.c | 13 kernel/time/clocksource.c | 42 +- kernel/time/hrtimer.c | 2 lib/math/prime_numbers.c | 2 mm/huge_memory.c | 30 - mm/memcontrol.c | 7 mm/memory.c | 29 - net/bluetooth/bnep/core.c | 3 net/bluetooth/hci_core.c | 19 - net/bluetooth/mgmt.c | 4 net/bluetooth/smp.c | 144 ++++---- net/bridge/br_netfilter_hooks.c | 6 net/core/net-sysfs.c | 2 net/ethtool/ioctl.c | 3 net/ipv6/ip6_output.c | 10 net/ipv6/ip6_tunnel.c | 12 net/ipv6/netfilter/nf_conntrack_reasm.c | 4 net/iucv/iucv.c | 3 net/kcm/kcmsock.c | 4 net/mac80211/agg-tx.c | 6 net/mac80211/driver-ops.c | 3 net/mac80211/sta_info.c | 14 net/mptcp/diag.c | 2 net/mptcp/protocol.c | 2 net/netfilter/nf_flow_table_inet.c | 3 net/netfilter/nf_flow_table_ip.c | 3 net/netfilter/nf_flow_table_offload.c | 2 net/netfilter/nfnetlink_queue.c | 35 +- net/netfilter/nft_counter.c | 9 net/netlink/af_netlink.c | 13 net/rds/recv.c | 13 net/sched/sch_netem.c | 47 +- net/sunrpc/stats.c | 2 net/sunrpc/svc.c | 36 +- net/wireless/core.h | 8 security/apparmor/policy_unpack_test.c | 6 security/selinux/avc.c | 2 sound/core/timer.c | 2 sound/pci/hda/patch_realtek.c | 1 sound/usb/quirks-table.h | 1 sound/usb/quirks.c | 2 tools/include/linux/align.h | 12 tools/include/linux/bitmap.h | 9 tools/testing/selftests/core/close_range_test.c | 35 ++ tools/testing/selftests/tc-testing/tdc.py | 1 222 files changed, 2387 insertions(+), 1046 deletions(-) Abhinav Kumar (1): drm/msm/dp: reset the link phy params before link training Adrian Hunter (1): clocksource: Make watchdog and suspend-timing multiplication overflow safe Al Viro (4): fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE memcg_write_event_control(): fix a user-triggerable oops afs: fix __afs_break_callback() / afs_drop_open_mmap() race fuse: fix UAF in rcu pathwalks Aleksandr Mishin (1): nfc: pn533: Add poll mod list filling check Alex Deucher (2): drm/amdgpu/jpeg2: properly set atomics vmid field drm/amdkfd: don't allow mapping the MMIO HDP page with large pages Alex Hung (2): drm/amd/display: Validate hw_points_num before using it Revert "drm/amd/display: Validate hw_points_num before using it" Alexander Gordeev (1): s390/iucv: fix receive buffer virtual vs physical address confusion Alexander Lobakin (5): fs/ntfs3: add prefix to bitmap_size() and use BITS_TO_U64() s390/cio: rename bitmap_size() -> idset_bitmap_size() btrfs: rename bitmap_set_bits() -> btrfs_bitmap_set_bits() bitmap: introduce generic optimized bitmap_size() tools: move alignment-related macros to new <linux/align.h> Allison Henderson (1): net:rds: Fix possible deadlock in rds_message_put Andreas Gruenbacher (1): gfs2: setattr_chown: Add missing initialization Antoniu Miclaus (1): hwmon: (ltc2992) Avoid division by zero Ashish Mhetre (1): memory: tegra: Skip SID programming if SID registers aren't set Aurelien Jarno (1): media: solo6x10: replace max(a, min(b, c)) by clamp(b, a, c) Baokun Li (2): ext4: do not trim the group with corrupted block bitmap ext4: set the type of max_zeroout to unsigned int to avoid overflow Bas Nieuwenhuizen (1): drm/amdgpu: Actually check flags for all context ops. Ben Hutchings (1): scsi: aacraid: Fix double-free on probe failure Ben Whitten (1): mmc: dw_mmc: allow biu and ciu clocks to defer Chaotian Jing (1): scsi: core: Fix the return value of scsi_logical_block_count() Chen Ridong (1): cgroup/cpuset: Prevent UAF in proc_cpuset_show() Chengfeng Ye (2): staging: ks7010: disable bh on tx_dev_lock IB/hfi1: Fix potential deadlock on &irq_src_lock and &dd->uctxt_lock Christian Brauner (1): binfmt_misc: cleanup on filesystem umount Christophe Kerello (1): memory: stm32-fmc2-ebi: check regmap_read return value Chuck Lever (6): NFSD: Refactor nfsd_reply_cache_free_locked() NFSD: Rename nfsd_reply_cache_alloc() NFSD: Replace nfsd_prune_bucket() NFSD: Refactor the duplicate reply cache shrinker NFSD: Rewrite synopsis of nfsd_percpu_counters_init() NFSD: Fix frame size warning in svc_export_parse() Claudio Imbrenda (1): s390/uv: Panic for set and remove shared access UVC errors Cong Wang (1): gtp: fix a potential NULL pointer dereference Cosmin Ratiu (1): net/mlx5e: Correctly report errors for ethtool rx flows Dan Carpenter (3): atm: idt77252: prevent use after free in dequeue_rx() dpaa2-switch: Fix error checking in dpaa2_switch_seed_bp() mmc: mmc_test: Fix NULL dereference on allocation failure Daniel Wagner (1): nvmet-trace: avoid dereferencing pointer too early David Lechner (1): staging: iio: resolver: ad2s1210: fix use before initialization David Sterba (5): btrfs: change BUG_ON to assertion when checking for delayed_node root btrfs: handle invalid root reference found in may_destroy_subvol() btrfs: send: handle unexpected data in header buffer in begin_cmd() btrfs: change BUG_ON to assertion in tree_move_down() btrfs: delete pointless BUG_ON check on quota root in btrfs_qgroup_account_extent() David Thompson (1): mlxbf_gige: disable RX filters until RX path initialized Dmitry Baryshkov (2): drm/msm/dpu: don't play tricks with debug macros drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails Donald Hunter (1): netfilter: flowtable: initialise extack before use Eli Billauer (3): char: xillybus: Don't destroy workqueue from work item running on it char: xillybus: Refine workqueue handling char: xillybus: Check USB endpoints when probing device Eric Dumazet (6): netlink: hold nlk->cb_mutex longer in __netlink_dump_start() gtp: pull network headers in gtp_dev_xmit() ipv6: prevent UAF in ip6_send_skb() ipv6: fix possible UAF in ip6_finish_output2() ipv6: prevent possible UAF in ip6_xmit() net: busy-poll: use ktime_get_ns() instead of local_clock() Erico Nunes (1): drm/lima: set gp bus_stop bit before hard reset Eugene Syromiatnikov (1): mptcp: correct MPTCP_SUBFLOW_ATTR_SSN_OFFSET reserved size Faizal Rahim (3): igc: Fix packet still tx after gate close by reducing i226 MAC retry buffer igc: Fix reset adapter logics when tx mode change igc: Fix qbv tx latency by setting gtxoffset Florian Westphal (1): netfilter: nf_queue: drop packets with cloned unconfirmed conntracks Gergo Koteles (1): platform/x86: lg-laptop: fix %s null argument warning Greg Kroah-Hartman (2): Revert "MIPS: Loongson64: reset: Prioritise firmware service" Linux 5.15.166 Griffin Kroah-Hartman (1): Bluetooth: MGMT: Add error handling to pair_device() Guanrui Huang (1): irqchip/gic-v3-its: Remove BUG_ON in its_vpe_irq_domain_alloc Guenter Roeck (1): apparmor: fix policy_unpack_test on big endian systems Haibo Xu (1): arm64: ACPI: NUMA: initialize all values of acpi_early_node_map to NUMA_NO_NODE Haiyang Zhang (1): net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response Hannes Reinecke (1): nvmet-tcp: do not continue for invalid icreq Hans J. Schultz (1): net: dsa: mv88e6xxx: read FID when handling ATU violations Hans Verkuil (3): media: radio-isa: use dev_name to fill in bus_info media: qcom: venus: fix incorrect return value media: pci: cx23885: check cx23885_vdev_init() return Heiko Carstens (1): s390/smp,mcck: fix early IPI handling Helge Deller (1): parisc: Use irq_enter_rcu() to fix warning at kernel/context_tracking.c:367 Huang-Huang Bao (1): pinctrl: rockchip: correct RK3328 iomux width flag for GPIO2-B pins Ian Ray (1): cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller Jamie Bainbridge (1): ethtool: check device is present when getting link settings Jan Kara (1): quota: Remove BUG_ON from dqget() Jann Horn (1): fuse: Initialize beyond-EOF page contents before setting uptodate Jarkko Nikula (2): i3c: mipi-i3c-hci: Remove BUG() when Ring Abort request times out i3c: mipi-i3c-hci: Do not unmap region not mapped for transfer Jason Gerecke (1): HID: wacom: Defer calculation of resolution until resolution_code is known Javier Carrasco (1): hwmon: (ltc2992) Fix memory leak in ltc2992_parse_dt() Jeff Johnson (1): wifi: cw1200: Avoid processing an invalid TIM IE Jeff Layton (2): nfsd: move reply cache initialization into nfsd startup nfsd: move init of percpu reply_cache_stats counters back to nfsd_init_net Jesse Zhang (1): drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc Jian Shen (1): net: hns3: add checking for vf id of mailbox Jiaxun Yang (1): MIPS: Loongson64: Set timer mode in cpu-probe Jie Wang (2): net: hns3: fix wrong use of semaphore up net: hns3: fix a deadlock problem when config TC during resetting Johannes Berg (2): wifi: cfg80211: check wiphy mutex is held for wdev mutex wifi: mac80211: fix BA session teardown race Josef Bacik (11): sunrpc: don't change ->sv_stats if it doesn't exist nfsd: stop setting ->pg_stats for unused stats sunrpc: pass in the sv_stats struct through svc_create_pooled sunrpc: remove ->pg_stats from svc_program sunrpc: use the struct net as the svc proc private nfsd: rename NFSD_NET_* to NFSD_STATS_* nfsd: expose /proc/net/sunrpc/nfsd in net namespaces nfsd: make all of the nfsd stats per-network namespace nfsd: remove nfsd_stats, make th_cnt a global counter nfsd: make svc_stat per-network namespace instead of global btrfs: run delayed iputs when flushing delalloc Joseph Huang (1): net: dsa: mv88e6xxx: Fix out-of-bound access Juan José Arboleda (1): ALSA: usb-audio: Support Yamaha P-125 quirk entry Justin Tee (1): scsi: lpfc: Initialize status local variable in lpfc_sli4_repost_sgl_list() Kees Cook (2): net/sun3_82586: Avoid reading past buffer in debug output x86: Increase brk randomness entropy for 64-bit systems Khazhismel Kumykov (1): dm resume: don't return EINVAL when signalled Krishna Kurapati (1): usb: dwc3: core: Skip setting event buffers for host only controllers Krzysztof Kozlowski (4): soundwire: stream: fix programming slave ports for non-continous port maps usb: dwc3: omap: add missing depopulate in probe error path usb: dwc3: st: fix probed platform device ref count on probe error path usb: dwc3: st: add missing depopulate in probe error path Kuniyuki Iwashima (1): kcm: Serialise kcm_sendmsg() for the same socket. Kunwu Chan (1): powerpc/xics: Check return value of kasprintf in icp_native_map_one_cpu Lee, Chun-Yi (1): Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO Li Nan (1): md: clean up invalid BUG_ON in md_ioctl Li zeming (1): powerpc/boot: Handle allocation failure in simple_realloc() Lianqin Hu (1): ALSA: usb-audio: Add delay quirk for VIVO USB-C-XE710 HEADSET Long Li (1): net: mana: Fix doorbell out of order violation and avoid unnecessary doorbell rings Luiz Augusto von Dentz (3): Bluetooth: bnep: Fix out-of-bound access Bluetooth: hci_core: Fix LE quote calculation Bluetooth: SMP: Fix assumption of Central always being Initiator Ma Ke (1): pinctrl: single: fix potential NULL dereference in pcs_get_function() Maciej Fijalkowski (1): ice: fix ICE_LAST_OFFSET formula Marc Zyngier (1): KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3 Martin Blumenstingl (1): clocksource/drivers/arm_global_timer: Guard against division by zero Mathias Nyman (1): xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration Matthieu Baerts (NGI0) (1): mptcp: sched: check both backup in retrans Max Filippov (1): fs: binfmt_elf_efpic: don't use missing interpreter's properties Maximilian Luz (1): platform/surface: aggregator: Fix warning when controller is destroyed in probe Michael Ellerman (1): powerpc/boot: Only free if realloc() succeeds Mika Westerberg (1): thunderbolt: Mark XDomain as unplugged when router is removed Mike Christie (1): scsi: spi: Fix sshdr use Mikulas Patocka (2): dm persistent data: fix memory allocation failure dm suspend: return -ERESTARTSYS instead of -EINTR Miri Korenblit (1): wifi: iwlwifi: abort scan when rfkill on but device enabled Muhammad Husaini Zulkifli (2): igc: Correct the launchtime offset igc: remove I226 Qbv BaseTime restriction Mukesh Sisodiya (1): wifi: iwlwifi: fw: Fix debugfs command sending NeilBrown (1): NFS: avoid infinite loop in pnfs_update_layout. Niklas Cassel (1): ata: libata-core: Fix null pointer dereference on error Nikolay Aleksandrov (4): bonding: fix bond_ipsec_offload_ok return type bonding: fix null pointer deref in bond_ipsec_offload_ok bonding: fix xfrm real_dev null pointer dereference bonding: fix xfrm state handling when clearing active slave Nikolay Kuratov (1): cxgb4: add forgotten u64 ivlan cast before shift Oreoluwa Babatunde (1): openrisc: Call setup_memory() earlier in the init sequence Pablo Neira Ayuso (1): netfilter: flowtable: validate vlan header Parsa Poorshikhian (1): ALSA: hda/realtek: Fix noise from speakers on Lenovo IdeaPad 3 15IAU7 Paul Cercueil (3): PM: core: Remove DEFINE_UNIVERSAL_DEV_PM_OPS() macro PM: core: Add EXPORT[_GPL]_SIMPLE_DEV_PM_OPS macros PM: runtime: Add DEFINE_RUNTIME_DEV_PM_OPS() macro Pawel Dembicki (3): net: dsa: vsc73xx: pass value in phy_write operation net: dsa: vsc73xx: use read_poll_timeout instead delay loop net: dsa: vsc73xx: check busy flag in MDIO operations Pawel Laszczak (2): usb: cdnsp: fix incorrect index in cdnsp_get_hw_deq function usb: cdnsp: fix for Link TRB with TC Phil Chang (1): hrtimer: Prevent queuing of hrtimer without a function callback Philipp Stanner (1): media: drivers/media/dvb-core: copy user arrays safely Piyush Mehta (3): phy: xilinx: add runtime PM support phy: xilinx: phy-zynqmp: dynamic clock support for power-save phy: xilinx: phy-zynqmp: Fix SGMII linkup failure on resume Qu Wenruo (1): btrfs: tree-checker: add dev extent item checks Radhey Shyam Pandey (1): net: axienet: Fix register defines comment description Rand Deeb (1): ssb: Fix division by zero issue in ssb_calc_clock_rate Sagi Grimberg (1): nvmet-rdma: fix possible bad dereference when freeing rsps Samuel Holland (1): arm64: Fix KASAN random tag seed initialization Sascha Hauer (1): wifi: mwifiex: duplicate static structs used in driver instances Sean Anderson (3): net: xilinx: axienet: Always disable promiscuous mode net: xilinx: axienet: Fix dangling multicast addresses phy: zynqmp: Enable reference clock correctly Sebastian Andrzej Siewior (2): netfilter: nft_counter: Disable BH in nft_counter_offload_stats(). netfilter: nft_counter: Synchronize nft_counter_reset() against reader. Selvarasu Ganesan (1): usb: dwc3: core: Prevent USB core invalid event buffer address access Serge Semin (2): dmaengine: dw: Add peripheral bus width verification dmaengine: dw: Add memory bus width verification Siarhei Vishniakou (1): HID: microsoft: Add rumble support to latest xbox controllers Simon Horman (1): tc-testing: don't access non-existent variable on exception Stefan Haberland (1): s390/dasd: fix error recovery leading to data corruption on ESE devices Stefan Hajnoczi (1): virtiofs: forbid newlines in tags Stephen Hemminger (1): netem: fix return value if duplicate enqueue fails Takashi Iwai (1): ALSA: timer: Relax start tick time check for slave timer elements Tetsuo Handa (2): block: use "unsigned long" for blk_validate_block_size(). Input: MT - limit max slots Thomas Bogendoerfer (1): ip6_tunnel: Fix broken GRO Tom Hughes (1): netfilter: allow ipv6 fragments to arrive on different devices Uwe Kleine-König (1): usb: gadget: fsl: Increase size of name buffer for endpoints Vladimir Oltean (1): net: dsa: mv88e6xxx: replace ATU violation prints with trace points Volodymyr Babchuk (1): soc: qcom: cmd-db: Map shared memory as WC, not WB Wolfram Sang (1): i2c: riic: avoid potential division by zero Yue Haibing (1): mlxbf_gige: Remove two unused function declarations ZHANG Yuntian (1): USB: serial: option: add MeiG Smart SRM825L Zhen Lei (1): selinux: fix potential counting error in avc_add_xperms_decision() Zhiguo Niu (1): f2fs: fix to do sanity check in update_sit_entry Zhihao Cheng (1): vfs: Don't evict inode under the inode lru traversing context Zhu Yanjun (1): RDMA/rtrs: Fix the problem of variable not initialized fully Zi Yan (2): mm/numa: no task_numa_fault() call if PMD is changed mm/numa: no task_numa_fault() call if PTE is changed Zijun Hu (1): usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in remove_power_attributes()

1 year

1
1
0 0

Linux 5.10.225

by Greg Kroah-Hartman

I'm announcing the release of the 5.10.225 kernel. All users of the 5.10 kernel series must upgrade. The updated 5.10.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Makefile | 2 arch/arm64/kernel/acpi_numa.c | 2 arch/arm64/kvm/hyp/entry.S | 6 arch/arm64/kvm/sys_regs.c | 6 arch/arm64/kvm/vgic/vgic.h | 7 arch/mips/kernel/cpu-probe.c | 4 arch/openrisc/kernel/setup.c | 6 arch/parisc/kernel/irq.c | 4 arch/powerpc/boot/simple_alloc.c | 7 arch/powerpc/sysdev/xics/icp-native.c | 2 arch/s390/include/asm/uv.h | 5 arch/s390/kernel/early.c | 12 arch/s390/kernel/smp.c | 4 arch/x86/kernel/process.c | 5 drivers/ata/libata-core.c | 3 drivers/atm/idt77252.c | 9 drivers/bluetooth/hci_ldisc.c | 3 drivers/dma/dw/core.c | 89 +++++ drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c | 8 drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 3 drivers/gpu/drm/amd/amdgpu/jpeg_v2_0.c | 4 drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 5 drivers/gpu/drm/lima/lima_gp.c | 12 drivers/gpu/drm/msm/disp/dpu1/dpu_kms.h | 14 drivers/gpu/drm/msm/dp/dp_ctrl.c | 2 drivers/hid/hid-ids.h | 10 drivers/hid/hid-microsoft.c | 11 drivers/hid/wacom_wac.c | 4 drivers/i2c/busses/i2c-riic.c | 2 drivers/infiniband/hw/hfi1/chip.c | 5 drivers/infiniband/ulp/rtrs/rtrs.c | 2 drivers/input/input-mt.c | 3 drivers/input/serio/ioc3kbd.c | 6 drivers/irqchip/irq-gic-v3-its.c | 2 drivers/md/dm-clone-metadata.c | 5 drivers/md/dm-ioctl.c | 22 + drivers/md/dm.c | 4 drivers/md/md.c | 5 drivers/md/persistent-data/dm-space-map-metadata.c | 4 drivers/media/pci/cx23885/cx23885-video.c | 8 drivers/media/pci/solo6x10/solo6x10-offsets.h | 10 drivers/media/platform/qcom/venus/pm_helpers.c | 2 drivers/media/radio/radio-isa.c | 2 drivers/media/usb/uvc/uvc_video.c | 10 drivers/memory/stm32-fmc2-ebi.c | 122 +++++-- drivers/mmc/core/mmc_test.c | 9 drivers/mmc/host/dw_mmc.c | 8 drivers/net/bonding/bond_main.c | 21 - drivers/net/bonding/bond_options.c | 2 drivers/net/dsa/mv88e6xxx/Makefile | 4 drivers/net/dsa/mv88e6xxx/global1_atu.c | 82 ++++- drivers/net/dsa/mv88e6xxx/trace.c | 6 drivers/net/dsa/mv88e6xxx/trace.h | 66 ++++ drivers/net/dsa/vitesse-vsc73xx-core.c | 69 +++- drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c | 3 drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 3 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 4 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c | 7 drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 4 drivers/net/ethernet/i825xx/sun3_82586.c | 2 drivers/net/ethernet/intel/ice/ice_txrx.c | 2 drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c | 2 drivers/net/ethernet/xilinx/xilinx_axienet.h | 17 - drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 25 - drivers/net/gtp.c | 5 drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 2 drivers/net/wireless/marvell/mwifiex/cfg80211.c | 32 +- drivers/net/wireless/st/cw1200/txrx.c | 2 drivers/nfc/pn533/pn533.c | 5 drivers/nvme/target/rdma.c | 16 - drivers/nvme/target/tcp.c | 1 drivers/nvme/target/trace.c | 6 drivers/nvme/target/trace.h | 28 + drivers/pinctrl/pinctrl-rockchip.c | 2 drivers/pinctrl/pinctrl-single.c | 2 drivers/s390/block/dasd.c | 36 +- drivers/s390/block/dasd_3990_erp.c | 10 drivers/s390/block/dasd_eckd.c | 55 +-- drivers/s390/block/dasd_int.h | 2 drivers/s390/cio/idset.c | 12 drivers/scsi/aacraid/comminit.c | 2 drivers/scsi/lpfc/lpfc_sli.c | 2 drivers/scsi/scsi_transport_spi.c | 4 drivers/soc/qcom/cmd-db.c | 2 drivers/soundwire/stream.c | 8 drivers/ssb/main.c | 2 drivers/staging/iio/resolver/ad2s1210.c | 7 drivers/staging/ks7010/ks7010_sdio.c | 4 drivers/thunderbolt/switch.c | 1 drivers/usb/class/cdc-acm.c | 3 drivers/usb/core/sysfs.c | 1 drivers/usb/dwc3/core.c | 21 + drivers/usb/dwc3/dwc3-omap.c | 4 drivers/usb/dwc3/dwc3-st.c | 16 - drivers/usb/gadget/udc/fsl_udc_core.c | 2 drivers/usb/host/xhci.c | 8 drivers/usb/serial/option.c | 5 fs/binfmt_elf.c | 5 fs/binfmt_elf_fdpic.c | 7 fs/binfmt_misc.c | 220 ++++++++++---- fs/btrfs/delayed-inode.c | 2 fs/btrfs/free-space-cache.c | 8 fs/btrfs/inode.c | 9 fs/btrfs/qgroup.c | 2 fs/btrfs/send.c | 7 fs/btrfs/tree-checker.c | 69 ++++ fs/ext4/extents.c | 3 fs/ext4/mballoc.c | 3 fs/f2fs/segment.c | 5 fs/file.c | 30 - fs/fuse/dev.c | 6 fs/fuse/virtio_fs.c | 10 fs/gfs2/inode.c | 2 fs/inode.c | 39 ++ fs/nfs/pnfs.c | 8 fs/overlayfs/file.c | 11 fs/quota/dquot.c | 5 include/linux/binfmts.h | 4 include/linux/bitmap.h | 20 + include/linux/blkdev.h | 2 include/linux/cpumask.h | 2 include/linux/fs.h | 5 include/net/busy_poll.h | 2 include/net/kcm.h | 1 include/uapi/linux/binfmts.h | 4 ipc/util.c | 16 - kernel/cgroup/cpuset.c | 13 kernel/time/hrtimer.c | 2 lib/math/prime_numbers.c | 2 mm/memcontrol.c | 7 net/bluetooth/bnep/core.c | 3 net/bluetooth/hci_core.c | 19 - net/bluetooth/mgmt.c | 4 net/bluetooth/smp.c | 144 ++++----- net/core/net-sysfs.c | 2 net/ethtool/ioctl.c | 3 net/ipv6/ip6_output.c | 2 net/ipv6/ip6_tunnel.c | 12 net/iucv/iucv.c | 3 net/kcm/kcmsock.c | 4 net/mac80211/agg-tx.c | 6 net/mac80211/driver-ops.c | 3 net/mac80211/sta_info.c | 14 net/mptcp/diag.c | 2 net/mptcp/protocol.c | 2 net/netfilter/nf_flow_table_offload.c | 2 net/netfilter/nft_counter.c | 5 net/netlink/af_netlink.c | 13 net/rds/recv.c | 13 net/sched/sch_netem.c | 47 +- net/sunrpc/svc_xprt.c | 2 security/apparmor/policy_unpack_test.c | 6 security/selinux/avc.c | 2 sound/core/timer.c | 2 sound/pci/hda/patch_realtek.c | 1 sound/usb/quirks-table.h | 1 tools/include/linux/align.h | 12 tools/include/linux/bitmap.h | 9 tools/testing/selftests/core/close_range_test.c | 35 ++ tools/testing/selftests/tc-testing/tdc.py | 1 160 files changed, 1419 insertions(+), 593 deletions(-) Abhinav Kumar (1): drm/msm/dp: reset the link phy params before link training Al Viro (2): fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE memcg_write_event_control(): fix a user-triggerable oops Aleksandr Mishin (1): nfc: pn533: Add poll mod list filling check Alex Deucher (2): drm/amdgpu/jpeg2: properly set atomics vmid field drm/amdkfd: don't allow mapping the MMIO HDP page with large pages Alex Hung (2): drm/amd/display: Validate hw_points_num before using it Revert "drm/amd/display: Validate hw_points_num before using it" Alexander Gordeev (1): s390/iucv: fix receive buffer virtual vs physical address confusion Alexander Lobakin (4): bitmap: introduce generic optimized bitmap_size() s390/cio: rename bitmap_size() -> idset_bitmap_size() btrfs: rename bitmap_set_bits() -> btrfs_bitmap_set_bits() tools: move alignment-related macros to new <linux/align.h> Allison Henderson (1): net:rds: Fix possible deadlock in rds_message_put Andreas Gruenbacher (1): gfs2: setattr_chown: Add missing initialization Aurelien Jarno (1): media: solo6x10: replace max(a, min(b, c)) by clamp(b, a, c) Baokun Li (2): ext4: do not trim the group with corrupted block bitmap ext4: set the type of max_zeroout to unsigned int to avoid overflow Bas Nieuwenhuizen (1): drm/amdgpu: Actually check flags for all context ops. Ben Hutchings (1): scsi: aacraid: Fix double-free on probe failure Ben Whitten (1): mmc: dw_mmc: allow biu and ciu clocks to defer Chen Ridong (1): cgroup/cpuset: Prevent UAF in proc_cpuset_show() Chengfeng Ye (2): staging: ks7010: disable bh on tx_dev_lock IB/hfi1: Fix potential deadlock on &irq_src_lock and &dd->uctxt_lock Christian Brauner (1): binfmt_misc: cleanup on filesystem umount Christophe Kerello (1): memory: stm32-fmc2-ebi: check regmap_read return value Claudio Imbrenda (1): s390/uv: Panic for set and remove shared access UVC errors Cong Wang (1): gtp: fix a potential NULL pointer dereference Cosmin Ratiu (1): net/mlx5e: Correctly report errors for ethtool rx flows Dan Carpenter (2): atm: idt77252: prevent use after free in dequeue_rx() mmc: mmc_test: Fix NULL dereference on allocation failure Daniel Wagner (1): nvmet-trace: avoid dereferencing pointer too early David Lechner (1): staging: iio: resolver: ad2s1210: fix use before initialization David Sterba (4): btrfs: change BUG_ON to assertion when checking for delayed_node root btrfs: handle invalid root reference found in may_destroy_subvol() btrfs: send: handle unexpected data in header buffer in begin_cmd() btrfs: delete pointless BUG_ON check on quota root in btrfs_qgroup_account_extent() Dmitry Baryshkov (1): drm/msm/dpu: don't play tricks with debug macros Donald Hunter (1): netfilter: flowtable: initialise extack before use Eric Dumazet (4): netlink: hold nlk->cb_mutex longer in __netlink_dump_start() gtp: pull network headers in gtp_dev_xmit() ipv6: prevent UAF in ip6_send_skb() net: busy-poll: use ktime_get_ns() instead of local_clock() Erico Nunes (1): drm/lima: set gp bus_stop bit before hard reset Eugene Syromiatnikov (1): mptcp: correct MPTCP_SUBFLOW_ATTR_SSN_OFFSET reserved size Greg Kroah-Hartman (2): Revert "Input: ioc3kbd - convert to platform remove callback returning void" Linux 5.10.225 Griffin Kroah-Hartman (1): Bluetooth: MGMT: Add error handling to pair_device() Guanrui Huang (1): irqchip/gic-v3-its: Remove BUG_ON in its_vpe_irq_domain_alloc Guenter Roeck (1): apparmor: fix policy_unpack_test on big endian systems Haibo Xu (1): arm64: ACPI: NUMA: initialize all values of acpi_early_node_map to NUMA_NO_NODE Hannes Reinecke (1): nvmet-tcp: do not continue for invalid icreq Hans J. Schultz (1): net: dsa: mv88e6xxx: read FID when handling ATU violations Hans Verkuil (3): media: radio-isa: use dev_name to fill in bus_info media: qcom: venus: fix incorrect return value media: pci: cx23885: check cx23885_vdev_init() return Heiko Carstens (1): s390/smp,mcck: fix early IPI handling Helge Deller (1): parisc: Use irq_enter_rcu() to fix warning at kernel/context_tracking.c:367 Huang-Huang Bao (1): pinctrl: rockchip: correct RK3328 iomux width flag for GPIO2-B pins Ian Ray (1): cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller Jamie Bainbridge (1): ethtool: check device is present when getting link settings Jan Kara (1): quota: Remove BUG_ON from dqget() Jann Horn (1): fuse: Initialize beyond-EOF page contents before setting uptodate Jason Gerecke (1): HID: wacom: Defer calculation of resolution until resolution_code is known Jeff Johnson (1): wifi: cw1200: Avoid processing an invalid TIM IE Jesse Zhang (1): drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc Jian Shen (1): net: hns3: add checking for vf id of mailbox Jiaxun Yang (1): MIPS: Loongson64: Set timer mode in cpu-probe Jie Wang (2): net: hns3: fix wrong use of semaphore up net: hns3: fix a deadlock problem when config TC during resetting Johannes Berg (1): wifi: mac80211: fix BA session teardown race Joseph Huang (1): net: dsa: mv88e6xxx: Fix out-of-bound access Juan José Arboleda (1): ALSA: usb-audio: Support Yamaha P-125 quirk entry Justin Tee (1): scsi: lpfc: Initialize status local variable in lpfc_sli4_repost_sgl_list() Kees Cook (2): net/sun3_82586: Avoid reading past buffer in debug output x86: Increase brk randomness entropy for 64-bit systems Khazhismel Kumykov (1): dm resume: don't return EINVAL when signalled Krishna Kurapati (1): usb: dwc3: core: Skip setting event buffers for host only controllers Krzysztof Kozlowski (4): soundwire: stream: fix programming slave ports for non-continous port maps usb: dwc3: omap: add missing depopulate in probe error path usb: dwc3: st: fix probed platform device ref count on probe error path usb: dwc3: st: add missing depopulate in probe error path Kuniyuki Iwashima (2): kcm: Serialise kcm_sendmsg() for the same socket. nfsd: Don't call freezable_schedule_timeout() after each successful page allocation in svc_alloc_arg(). Kunwu Chan (1): powerpc/xics: Check return value of kasprintf in icp_native_map_one_cpu Laurent Vivier (1): binfmt_misc: pass binfmt_misc flags to the interpreter Lee, Chun-Yi (1): Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO Li Nan (1): md: clean up invalid BUG_ON in md_ioctl Li zeming (1): powerpc/boot: Handle allocation failure in simple_realloc() Luiz Augusto von Dentz (3): Bluetooth: bnep: Fix out-of-bound access Bluetooth: hci_core: Fix LE quote calculation Bluetooth: SMP: Fix assumption of Central always being Initiator Ma Ke (1): pinctrl: single: fix potential NULL dereference in pcs_get_function() Maciej Fijalkowski (1): ice: fix ICE_LAST_OFFSET formula Marc Zyngier (1): KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3 Mathias Nyman (1): xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration Matthieu Baerts (NGI0) (1): mptcp: sched: check both backup in retrans Max Filippov (1): fs: binfmt_elf_efpic: don't use missing interpreter's properties Michael Ellerman (1): powerpc/boot: Only free if realloc() succeeds Mika Westerberg (1): thunderbolt: Mark XDomain as unplugged when router is removed Mike Christie (1): scsi: spi: Fix sshdr use Miklos Szeredi (1): ovl: do not fail because of O_NOATIME Mikulas Patocka (2): dm persistent data: fix memory allocation failure dm suspend: return -ERESTARTSYS instead of -EINTR Miri Korenblit (1): wifi: iwlwifi: abort scan when rfkill on but device enabled NeilBrown (1): NFS: avoid infinite loop in pnfs_update_layout. Niklas Cassel (1): ata: libata-core: Fix null pointer dereference on error Nikolay Aleksandrov (4): bonding: fix bond_ipsec_offload_ok return type bonding: fix null pointer deref in bond_ipsec_offload_ok bonding: fix xfrm real_dev null pointer dereference bonding: fix xfrm state handling when clearing active slave Nikolay Kuratov (1): cxgb4: add forgotten u64 ivlan cast before shift Oreoluwa Babatunde (1): openrisc: Call setup_memory() earlier in the init sequence Parsa Poorshikhian (1): ALSA: hda/realtek: Fix noise from speakers on Lenovo IdeaPad 3 15IAU7 Pawel Dembicki (3): net: dsa: vsc73xx: pass value in phy_write operation net: dsa: vsc73xx: use read_poll_timeout instead delay loop net: dsa: vsc73xx: check busy flag in MDIO operations Phil Chang (1): hrtimer: Prevent queuing of hrtimer without a function callback Qu Wenruo (1): btrfs: tree-checker: add dev extent item checks Radhey Shyam Pandey (1): net: axienet: Fix register defines comment description Rafael Aquini (1): ipc: replace costly bailout check in sysvipc_find_ipc() Rand Deeb (1): ssb: Fix division by zero issue in ssb_calc_clock_rate Ricardo Ribalda (1): media: uvcvideo: Fix integer overflow calculating timestamp Sagi Grimberg (1): nvmet-rdma: fix possible bad dereference when freeing rsps Sami Tolvanen (1): KVM: arm64: Don't use cbz/adr with external symbols Sascha Hauer (1): wifi: mwifiex: duplicate static structs used in driver instances Sean Anderson (2): net: xilinx: axienet: Always disable promiscuous mode net: xilinx: axienet: Fix dangling multicast addresses Sebastian Andrzej Siewior (1): netfilter: nft_counter: Synchronize nft_counter_reset() against reader. Selvarasu Ganesan (1): usb: dwc3: core: Prevent USB core invalid event buffer address access Serge Semin (2): dmaengine: dw: Add peripheral bus width verification dmaengine: dw: Add memory bus width verification Siarhei Vishniakou (1): HID: microsoft: Add rumble support to latest xbox controllers Simon Horman (1): tc-testing: don't access non-existent variable on exception Stefan Haberland (1): s390/dasd: fix error recovery leading to data corruption on ESE devices Stefan Hajnoczi (1): virtiofs: forbid newlines in tags Stephen Hemminger (1): netem: fix return value if duplicate enqueue fails Takashi Iwai (1): ALSA: timer: Relax start tick time check for slave timer elements Tetsuo Handa (2): block: use "unsigned long" for blk_validate_block_size(). Input: MT - limit max slots Thomas Bogendoerfer (1): ip6_tunnel: Fix broken GRO Uwe Kleine-König (1): usb: gadget: fsl: Increase size of name buffer for endpoints Vladimir Oltean (1): net: dsa: mv88e6xxx: replace ATU violation prints with trace points Volodymyr Babchuk (1): soc: qcom: cmd-db: Map shared memory as WC, not WB Wolfram Sang (1): i2c: riic: avoid potential division by zero ZHANG Yuntian (1): USB: serial: option: add MeiG Smart SRM825L Zhen Lei (1): selinux: fix potential counting error in avc_add_xperms_decision() Zhiguo Niu (1): f2fs: fix to do sanity check in update_sit_entry Zhihao Cheng (1): vfs: Don't evict inode under the inode lru traversing context Zhu Yanjun (1): RDMA/rtrs: Fix the problem of variable not initialized fully Zijun Hu (1): usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in remove_power_attributes()

1 year

1
1
0 0

Linux 5.4.283

by Greg Kroah-Hartman

I'm announcing the release of the 5.4.283 kernel. All users of the 5.4 kernel series must upgrade. The updated 5.4.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.4.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Documentation/process/deprecated.rst | 20 Makefile | 2 arch/arm64/kernel/acpi_numa.c | 2 arch/openrisc/kernel/setup.c | 6 arch/parisc/kernel/irq.c | 4 arch/powerpc/boot/simple_alloc.c | 7 arch/powerpc/sysdev/xics/icp-native.c | 2 arch/s390/include/asm/uv.h | 5 arch/x86/kernel/process.c | 5 drivers/ata/libata-core.c | 3 drivers/atm/idt77252.c | 9 drivers/bluetooth/hci_ldisc.c | 3 drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c | 8 drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 3 drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 5 drivers/gpu/drm/lima/lima_gp.c | 12 drivers/gpu/drm/msm/disp/dpu1/dpu_kms.h | 14 drivers/hid/hid-ids.h | 10 drivers/hid/hid-microsoft.c | 11 drivers/hid/wacom_wac.c | 4 drivers/i2c/busses/i2c-riic.c | 2 drivers/infiniband/hw/hfi1/chip.c | 5 drivers/input/input-mt.c | 3 drivers/irqchip/irq-gic-v3-its.c | 2 drivers/md/dm-clone-metadata.c | 5 drivers/md/dm-ioctl.c | 22 - drivers/md/dm-mpath.c | 9 drivers/md/dm-path-selector.h | 2 drivers/md/dm-queue-length.c | 2 drivers/md/dm-rq.c | 4 drivers/md/dm-service-time.c | 2 drivers/md/dm.c | 67 ++- drivers/md/md.c | 5 drivers/md/persistent-data/dm-space-map-metadata.c | 4 drivers/media/pci/cx23885/cx23885-video.c | 8 drivers/media/pci/solo6x10/solo6x10-offsets.h | 10 drivers/media/radio/radio-isa.c | 2 drivers/media/usb/uvc/uvc_video.c | 10 drivers/mmc/core/mmc_test.c | 9 drivers/mmc/host/dw_mmc.c | 8 drivers/net/dsa/mv88e6xxx/Makefile | 4 drivers/net/dsa/mv88e6xxx/global1.h | 1 drivers/net/dsa/mv88e6xxx/global1_atu.c | 87 +++- drivers/net/dsa/mv88e6xxx/global2.c | 13 drivers/net/dsa/mv88e6xxx/global2.h | 25 + drivers/net/dsa/mv88e6xxx/trace.c | 6 drivers/net/dsa/mv88e6xxx/trace.h | 66 +++ drivers/net/dsa/vitesse-vsc73xx-core.c | 2 drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c | 3 drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 3 drivers/net/ethernet/i825xx/sun3_82586.c | 2 drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c | 2 drivers/net/ethernet/xilinx/xilinx_axienet.h | 34 - drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 337 +++++++++++----- drivers/net/gtp.c | 5 drivers/net/usb/r8152.c | 73 --- drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 2 drivers/net/wireless/marvell/mwifiex/cfg80211.c | 32 + drivers/net/wireless/st/cw1200/txrx.c | 2 drivers/nfc/pn533/pn533.c | 210 +++++++++ drivers/nfc/pn533/pn533.h | 19 drivers/nvme/host/core.c | 5 drivers/nvme/target/rdma.c | 16 drivers/nvme/target/tcp.c | 1 drivers/nvme/target/trace.c | 6 drivers/nvme/target/trace.h | 28 - drivers/pinctrl/pinctrl-single.c | 2 drivers/s390/block/dasd.c | 36 + drivers/s390/block/dasd_3990_erp.c | 10 drivers/s390/block/dasd_eckd.c | 55 +- drivers/s390/block/dasd_int.h | 2 drivers/s390/cio/idset.c | 12 drivers/scsi/aacraid/comminit.c | 2 drivers/scsi/lpfc/lpfc_sli.c | 2 drivers/scsi/scsi_transport_spi.c | 4 drivers/soc/qcom/cmd-db.c | 2 drivers/soundwire/stream.c | 8 drivers/ssb/main.c | 2 drivers/staging/ks7010/ks7010_sdio.c | 4 drivers/usb/class/cdc-acm.c | 3 drivers/usb/core/sysfs.c | 1 drivers/usb/dwc3/core.c | 21 drivers/usb/dwc3/dwc3-omap.c | 4 drivers/usb/dwc3/dwc3-st.c | 16 drivers/usb/gadget/udc/fsl_udc_core.c | 2 drivers/usb/host/xhci.c | 8 drivers/usb/serial/option.c | 5 fs/binfmt_elf_fdpic.c | 2 fs/binfmt_misc.c | 216 +++++++--- fs/btrfs/delayed-inode.c | 2 fs/btrfs/free-space-cache.c | 8 fs/btrfs/inode.c | 9 fs/btrfs/qgroup.c | 2 fs/btrfs/send.c | 7 fs/ext4/extents.c | 3 fs/ext4/mballoc.c | 3 fs/f2fs/segment.c | 5 fs/file.c | 30 - fs/fuse/dev.c | 6 fs/fuse/virtio_fs.c | 10 fs/gfs2/inode.c | 2 fs/inode.c | 39 + fs/locks.c | 4 fs/nfs/pnfs.c | 8 fs/quota/dquot.c | 5 include/linux/bitmap.h | 20 include/linux/blkdev.h | 2 include/linux/cpumask.h | 2 include/linux/device-mapper.h | 2 include/linux/fs.h | 5 include/linux/overflow.h | 115 +++-- include/net/busy_poll.h | 2 include/net/kcm.h | 1 ipc/util.c | 16 kernel/cgroup/cpuset.c | 13 kernel/time/hrtimer.c | 2 lib/math/prime_numbers.c | 2 lib/test_overflow.c | 98 ++++ mm/memcontrol.c | 7 net/bluetooth/bnep/core.c | 3 net/bluetooth/hci_core.c | 58 +- net/bluetooth/mgmt.c | 4 net/core/ethtool.c | 3 net/core/net-sysfs.c | 2 net/ipv6/ip6_output.c | 2 net/iucv/iucv.c | 3 net/kcm/kcmsock.c | 4 net/netfilter/nft_counter.c | 5 net/rds/recv.c | 13 net/sched/sch_netem.c | 47 +- security/selinux/avc.c | 2 sound/core/timer.c | 2 sound/pci/hda/patch_realtek.c | 1 sound/usb/quirks-table.h | 1 tools/include/linux/align.h | 12 tools/include/linux/bitmap.h | 8 tools/testing/selftests/tc-testing/tdc.py | 1 137 files changed, 1699 insertions(+), 621 deletions(-) Al Viro (2): fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE memcg_write_event_control(): fix a user-triggerable oops Aleksandr Mishin (1): nfc: pn533: Add poll mod list filling check Alex Deucher (1): drm/amdkfd: don't allow mapping the MMIO HDP page with large pages Alexander Gordeev (1): s390/iucv: fix receive buffer virtual vs physical address confusion Alexander Lobakin (4): bitmap: introduce generic optimized bitmap_size() s390/cio: rename bitmap_size() -> idset_bitmap_size() btrfs: rename bitmap_set_bits() -> btrfs_bitmap_set_bits() tools: move alignment-related macros to new <linux/align.h> Allison Henderson (1): net:rds: Fix possible deadlock in rds_message_put Andre Przywara (8): net: axienet: Fix DMA descriptor cleanup path net: axienet: Improve DMA error handling net: axienet: Factor out TX descriptor chain cleanup net: axienet: Check for DMA mapping errors net: axienet: Drop MDIO interrupt registers from ethtools dump net: axienet: Wrap DMA pointer writes to prepare for 64 bit net: axienet: Upgrade descriptors to hold 64-bit addresses net: axienet: Autodetect 64-bit DMA capability Andreas Gruenbacher (1): gfs2: setattr_chown: Add missing initialization Andrew Lunn (3): net: dsa: mv88e6xxx: global2: Expose ATU stats register net: dsa: mv88e6xxx: global1_atu: Add helper for get next net: dsa: mv8e6xxx: Fix stub function parameters Aurelien Jarno (1): media: solo6x10: replace max(a, min(b, c)) by clamp(b, a, c) Baokun Li (2): ext4: do not trim the group with corrupted block bitmap ext4: set the type of max_zeroout to unsigned int to avoid overflow Bas Nieuwenhuizen (1): drm/amdgpu: Actually check flags for all context ops. Ben Hutchings (1): scsi: aacraid: Fix double-free on probe failure Ben Whitten (1): mmc: dw_mmc: allow biu and ciu clocks to defer Chen Ridong (1): cgroup/cpuset: Prevent UAF in proc_cpuset_show() Chengfeng Ye (2): staging: ks7010: disable bh on tx_dev_lock IB/hfi1: Fix potential deadlock on &irq_src_lock and &dd->uctxt_lock Christian Brauner (1): binfmt_misc: cleanup on filesystem umount Claudio Imbrenda (1): s390/uv: Panic for set and remove shared access UVC errors Cong Wang (1): gtp: fix a potential NULL pointer dereference Cosmin Ratiu (1): net/mlx5e: Correctly report errors for ethtool rx flows Dan Carpenter (2): atm: idt77252: prevent use after free in dequeue_rx() mmc: mmc_test: Fix NULL dereference on allocation failure Daniel Wagner (1): nvmet-trace: avoid dereferencing pointer too early David Sterba (4): btrfs: change BUG_ON to assertion when checking for delayed_node root btrfs: handle invalid root reference found in may_destroy_subvol() btrfs: send: handle unexpected data in header buffer in begin_cmd() btrfs: delete pointless BUG_ON check on quota root in btrfs_qgroup_account_extent() Dmitry Baryshkov (1): drm/msm/dpu: don't play tricks with debug macros Eric Dumazet (3): gtp: pull network headers in gtp_dev_xmit() ipv6: prevent UAF in ip6_send_skb() net: busy-poll: use ktime_get_ns() instead of local_clock() Erico Nunes (1): drm/lima: set gp bus_stop bit before hard reset Gabriel Krisman Bertazi (1): dm mpath: pass IO start time to path selector Greg Kroah-Hartman (1): Linux 5.4.283 Griffin Kroah-Hartman (1): Bluetooth: MGMT: Add error handling to pair_device() Guanrui Huang (1): irqchip/gic-v3-its: Remove BUG_ON in its_vpe_irq_domain_alloc Gustavo A. R. Silva (1): overflow.h: Add flex_array_size() helper Haibo Xu (1): arm64: ACPI: NUMA: initialize all values of acpi_early_node_map to NUMA_NO_NODE Hannes Reinecke (1): nvmet-tcp: do not continue for invalid icreq Hans J. Schultz (1): net: dsa: mv88e6xxx: read FID when handling ATU violations Hans Verkuil (2): media: radio-isa: use dev_name to fill in bus_info media: pci: cx23885: check cx23885_vdev_init() return Helge Deller (1): parisc: Use irq_enter_rcu() to fix warning at kernel/context_tracking.c:367 Ian Ray (1): cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller Jamie Bainbridge (1): ethtool: check device is present when getting link settings Jan Kara (1): quota: Remove BUG_ON from dqget() Jani Nikula (1): drm/msm: use drm_debug_enabled() to check for debug categories Jann Horn (1): fuse: Initialize beyond-EOF page contents before setting uptodate Jason Gerecke (1): HID: wacom: Defer calculation of resolution until resolution_code is known Jeff Johnson (1): wifi: cw1200: Avoid processing an invalid TIM IE Jesse Zhang (1): drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc Jie Wang (1): net: hns3: fix a deadlock problem when config TC during resetting Joseph Huang (1): net: dsa: mv88e6xxx: Fix out-of-bound access Juan José Arboleda (1): ALSA: usb-audio: Support Yamaha P-125 quirk entry Justin Tee (1): scsi: lpfc: Initialize status local variable in lpfc_sli4_repost_sgl_list() Kees Cook (3): overflow: Implement size_t saturating arithmetic helpers net/sun3_82586: Avoid reading past buffer in debug output x86: Increase brk randomness entropy for 64-bit systems Keith Busch (1): nvme: clear caller pointer on identify failure Khazhismel Kumykov (1): dm resume: don't return EINVAL when signalled Krishna Kurapati (1): usb: dwc3: core: Skip setting event buffers for host only controllers Krzysztof Kozlowski (4): soundwire: stream: fix programming slave ports for non-continous port maps usb: dwc3: omap: add missing depopulate in probe error path usb: dwc3: st: fix probed platform device ref count on probe error path usb: dwc3: st: add missing depopulate in probe error path Kuniyuki Iwashima (1): kcm: Serialise kcm_sendmsg() for the same socket. Kunwu Chan (1): powerpc/xics: Check return value of kasprintf in icp_native_map_one_cpu Lars Poeschel (2): nfc: pn533: Add dev_up/dev_down hooks to phy_ops nfc: pn533: Add autopoll capability Lee, Chun-Yi (1): Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO Li Nan (1): md: clean up invalid BUG_ON in md_ioctl Li zeming (1): powerpc/boot: Handle allocation failure in simple_realloc() Long Li (1): filelock: Correct the filelock owner in fcntl_setlk/fcntl_setlk64 Luiz Augusto von Dentz (4): Bluetooth: bnep: Fix out-of-bound access Bluetooth: Make use of __check_timeout on hci_sched_le Bluetooth: hci_core: Fix not handling link timeouts propertly Bluetooth: hci_core: Fix LE quote calculation Ma Ke (1): pinctrl: single: fix potential NULL dereference in pcs_get_function() Mathias Nyman (1): xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration Max Filippov (1): fs: binfmt_elf_efpic: don't use missing interpreter's properties Michael Ellerman (1): powerpc/boot: Only free if realloc() succeeds Mike Christie (1): scsi: spi: Fix sshdr use Mikulas Patocka (2): dm persistent data: fix memory allocation failure dm suspend: return -ERESTARTSYS instead of -EINTR Ming Lei (1): dm: do not use waitqueue for request-based DM Miri Korenblit (1): wifi: iwlwifi: abort scan when rfkill on but device enabled NeilBrown (1): NFS: avoid infinite loop in pnfs_update_layout. Niklas Cassel (1): ata: libata-core: Fix null pointer dereference on error Nikolay Kuratov (1): cxgb4: add forgotten u64 ivlan cast before shift Oreoluwa Babatunde (1): openrisc: Call setup_memory() earlier in the init sequence Parsa Poorshikhian (1): ALSA: hda/realtek: Fix noise from speakers on Lenovo IdeaPad 3 15IAU7 Pawel Dembicki (1): net: dsa: vsc73xx: pass value in phy_write operation Phil Chang (1): hrtimer: Prevent queuing of hrtimer without a function callback Prashant Malani (1): r8152: Factor out OOB link list waits Radhey Shyam Pandey (1): net: axienet: Fix register defines comment description Rafael Aquini (1): ipc: replace costly bailout check in sysvipc_find_ipc() Rand Deeb (1): ssb: Fix division by zero issue in ssb_calc_clock_rate Ricardo Ribalda (1): media: uvcvideo: Fix integer overflow calculating timestamp Sagi Grimberg (1): nvmet-rdma: fix possible bad dereference when freeing rsps Sascha Hauer (1): wifi: mwifiex: duplicate static structs used in driver instances Sean Anderson (2): net: xilinx: axienet: Always disable promiscuous mode net: xilinx: axienet: Fix dangling multicast addresses Sebastian Andrzej Siewior (1): netfilter: nft_counter: Synchronize nft_counter_reset() against reader. Selvarasu Ganesan (1): usb: dwc3: core: Prevent USB core invalid event buffer address access Siarhei Vishniakou (1): HID: microsoft: Add rumble support to latest xbox controllers Simon Horman (1): tc-testing: don't access non-existent variable on exception Stefan Haberland (1): s390/dasd: fix error recovery leading to data corruption on ESE devices Stefan Hajnoczi (1): virtiofs: forbid newlines in tags Stephen Hemminger (1): netem: fix return value if duplicate enqueue fails Takashi Iwai (1): ALSA: timer: Relax start tick time check for slave timer elements Tetsuo Handa (2): block: use "unsigned long" for blk_validate_block_size(). Input: MT - limit max slots Uwe Kleine-König (1): usb: gadget: fsl: Increase size of name buffer for endpoints Vladimir Oltean (1): net: dsa: mv88e6xxx: replace ATU violation prints with trace points Volodymyr Babchuk (1): soc: qcom: cmd-db: Map shared memory as WC, not WB Wolfram Sang (1): i2c: riic: avoid potential division by zero ZHANG Yuntian (1): USB: serial: option: add MeiG Smart SRM825L Zhen Lei (1): selinux: fix potential counting error in avc_add_xperms_decision() Zhiguo Niu (1): f2fs: fix to do sanity check in update_sit_entry Zhihao Cheng (1): vfs: Don't evict inode under the inode lru traversing context Zijun Hu (1): usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in remove_power_attributes()

1 year

1
1
0 0

Linux 4.19.321

by Greg Kroah-Hartman

I'm announcing the release of the 4.19.321 kernel. All users of the 4.19 kernel series must upgrade. The updated 4.19.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.19.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Makefile | 2 arch/arm64/kernel/acpi_numa.c | 2 arch/openrisc/kernel/setup.c | 6 arch/parisc/kernel/irq.c | 4 arch/powerpc/boot/simple_alloc.c | 7 arch/powerpc/sysdev/xics/icp-native.c | 2 drivers/ata/libata-core.c | 3 drivers/atm/idt77252.c | 9 drivers/bluetooth/hci_ldisc.c | 3 drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c | 8 drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 3 drivers/gpu/drm/drm_fb_helper.c | 3 drivers/gpu/drm/msm/disp/dpu1/dpu_kms.h | 14 - drivers/hid/wacom_wac.c | 4 drivers/i2c/busses/i2c-riic.c | 2 drivers/input/input-mt.c | 3 drivers/irqchip/irq-gic-v3-its.c | 2 drivers/md/dm-ioctl.c | 22 + drivers/md/dm.c | 2 drivers/md/md.c | 5 drivers/md/persistent-data/dm-space-map-metadata.c | 4 drivers/media/pci/cx23885/cx23885-video.c | 8 drivers/media/usb/uvc/uvc_video.c | 10 drivers/mmc/core/mmc_test.c | 9 drivers/mmc/host/dw_mmc.c | 8 drivers/net/dsa/vitesse-vsc73xx.c | 2 drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c | 3 drivers/net/ethernet/i825xx/sun3_82586.c | 2 drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c | 2 drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 4 drivers/net/gtp.c | 5 drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 2 drivers/net/wireless/marvell/mwifiex/cfg80211.c | 32 +- drivers/net/wireless/st/cw1200/txrx.c | 2 drivers/nvme/target/rdma.c | 16 - drivers/pinctrl/pinctrl-single.c | 2 drivers/s390/cio/idset.c | 12 drivers/scsi/aacraid/comminit.c | 2 drivers/scsi/lpfc/lpfc_sli.c | 2 drivers/scsi/mpt3sas/mpt3sas_base.c | 20 + drivers/scsi/scsi_transport_spi.c | 4 drivers/soundwire/stream.c | 8 drivers/ssb/main.c | 2 drivers/staging/ks7010/ks7010_sdio.c | 4 drivers/usb/class/cdc-acm.c | 3 drivers/usb/core/sysfs.c | 1 drivers/usb/dwc3/core.c | 21 + drivers/usb/dwc3/dwc3-omap.c | 4 drivers/usb/dwc3/dwc3-st.c | 11 drivers/usb/gadget/udc/fsl_udc_core.c | 2 drivers/usb/host/xhci.c | 8 drivers/usb/serial/option.c | 5 drivers/video/fbdev/core/fbcon.c | 28 ++ drivers/video/fbdev/core/fbmem.c | 20 + fs/binfmt_elf_fdpic.c | 2 fs/binfmt_misc.c | 216 ++++++++++++---- fs/btrfs/delayed-inode.c | 2 fs/btrfs/free-space-cache.c | 8 fs/btrfs/inode.c | 9 fs/btrfs/qgroup.c | 2 fs/btrfs/send.c | 7 fs/ext4/extents.c | 3 fs/ext4/mballoc.c | 3 fs/f2fs/segment.c | 5 fs/file.c | 30 -- fs/fuse/dev.c | 6 fs/gfs2/inode.c | 2 fs/locks.c | 4 fs/nfs/pnfs.c | 8 fs/quota/dquot.c | 5 include/linux/bitmap.h | 20 + include/linux/blkdev.h | 2 include/linux/cpumask.h | 2 include/linux/fbcon.h | 4 include/linux/overflow.h | 113 ++++++-- include/net/busy_poll.h | 2 include/net/kcm.h | 1 ipc/msg.c | 2 ipc/sem.c | 7 ipc/shm.c | 2 kernel/cgroup/cpuset.c | 13 kernel/time/hrtimer.c | 2 lib/idr.c | 2 lib/test_ida.c | 40 ++ lib/test_overflow.c | 98 +++++++ mm/memcontrol.c | 7 net/bluetooth/bnep/core.c | 3 net/bluetooth/hci_core.c | 58 ++-- net/bluetooth/mgmt.c | 4 net/core/skbuff.c | 3 net/ipv6/ip6_output.c | 2 net/iucv/iucv.c | 3 net/kcm/kcmsock.c | 4 net/netfilter/nft_counter.c | 5 net/rds/recv.c | 13 security/selinux/avc.c | 2 sound/core/timer.c | 2 sound/usb/quirks-table.h | 1 tools/include/linux/align.h | 12 tools/include/linux/bitmap.h | 8 100 files changed, 840 insertions(+), 283 deletions(-) Al Viro (2): fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE memcg_write_event_control(): fix a user-triggerable oops Alexander Gordeev (1): s390/iucv: fix receive buffer virtual vs physical address confusion Alexander Lobakin (4): bitmap: introduce generic optimized bitmap_size() s390/cio: rename bitmap_size() -> idset_bitmap_size() btrfs: rename bitmap_set_bits() -> btrfs_bitmap_set_bits() tools: move alignment-related macros to new <linux/align.h> Allison Henderson (1): net:rds: Fix possible deadlock in rds_message_put Andreas Gruenbacher (1): gfs2: setattr_chown: Add missing initialization Baokun Li (2): ext4: do not trim the group with corrupted block bitmap ext4: set the type of max_zeroout to unsigned int to avoid overflow Bas Nieuwenhuizen (1): drm/amdgpu: Actually check flags for all context ops. Ben Hutchings (1): scsi: aacraid: Fix double-free on probe failure Ben Whitten (1): mmc: dw_mmc: allow biu and ciu clocks to defer Chen Ridong (1): cgroup/cpuset: Prevent UAF in proc_cpuset_show() Chengfeng Ye (1): staging: ks7010: disable bh on tx_dev_lock Christian Brauner (1): binfmt_misc: cleanup on filesystem umount Cong Wang (1): gtp: fix a potential NULL pointer dereference Cosmin Ratiu (1): net/mlx5e: Correctly report errors for ethtool rx flows Damien Le Moal (1): scsi: mpt3sas: Avoid IOMMU page faults on REPORT ZONES Dan Carpenter (2): atm: idt77252: prevent use after free in dequeue_rx() mmc: mmc_test: Fix NULL dereference on allocation failure Daniel Vetter (1): drm/fb-helper: set x/yres_virtual in drm_fb_helper_check_var David Sterba (4): btrfs: change BUG_ON to assertion when checking for delayed_node root btrfs: handle invalid root reference found in may_destroy_subvol() btrfs: send: handle unexpected data in header buffer in begin_cmd() btrfs: delete pointless BUG_ON check on quota root in btrfs_qgroup_account_extent() Dmitry Baryshkov (1): drm/msm/dpu: don't play tricks with debug macros Eric Dumazet (4): gtp: pull network headers in gtp_dev_xmit() ipv6: prevent UAF in ip6_send_skb() net: prevent mss overflow in skb_segment() net: busy-poll: use ktime_get_ns() instead of local_clock() Greg Kroah-Hartman (1): Linux 4.19.321 Griffin Kroah-Hartman (1): Bluetooth: MGMT: Add error handling to pair_device() Guanrui Huang (1): irqchip/gic-v3-its: Remove BUG_ON in its_vpe_irq_domain_alloc Gustavo A. R. Silva (1): overflow.h: Add flex_array_size() helper Haibo Xu (1): arm64: ACPI: NUMA: initialize all values of acpi_early_node_map to NUMA_NO_NODE Hans Verkuil (1): media: pci: cx23885: check cx23885_vdev_init() return Helge Deller (3): parisc: Use irq_enter_rcu() to fix warning at kernel/context_tracking.c:367 fbcon: Prevent that screen size is smaller than font size fbmem: Check virtual screen sizes in fb_set_var() Ian Ray (1): cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller Jan Kara (1): quota: Remove BUG_ON from dqget() Jani Nikula (1): drm/msm: use drm_debug_enabled() to check for debug categories Jann Horn (1): fuse: Initialize beyond-EOF page contents before setting uptodate Jason Gerecke (1): HID: wacom: Defer calculation of resolution until resolution_code is known Jeff Johnson (1): wifi: cw1200: Avoid processing an invalid TIM IE Jesse Zhang (1): drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc Juan José Arboleda (1): ALSA: usb-audio: Support Yamaha P-125 quirk entry Justin Tee (1): scsi: lpfc: Initialize status local variable in lpfc_sli4_repost_sgl_list() Kees Cook (2): overflow: Implement size_t saturating arithmetic helpers net/sun3_82586: Avoid reading past buffer in debug output Khazhismel Kumykov (1): dm resume: don't return EINVAL when signalled Krishna Kurapati (1): usb: dwc3: core: Skip setting event buffers for host only controllers Krzysztof Kozlowski (3): soundwire: stream: fix programming slave ports for non-continous port maps usb: dwc3: omap: add missing depopulate in probe error path usb: dwc3: st: fix probed platform device ref count on probe error path Kuniyuki Iwashima (1): kcm: Serialise kcm_sendmsg() for the same socket. Kunwu Chan (1): powerpc/xics: Check return value of kasprintf in icp_native_map_one_cpu Lee, Chun-Yi (1): Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO Li Nan (1): md: clean up invalid BUG_ON in md_ioctl Li zeming (1): powerpc/boot: Handle allocation failure in simple_realloc() Long Li (1): filelock: Correct the filelock owner in fcntl_setlk/fcntl_setlk64 Luiz Augusto von Dentz (4): Bluetooth: bnep: Fix out-of-bound access Bluetooth: Make use of __check_timeout on hci_sched_le Bluetooth: hci_core: Fix not handling link timeouts propertly Bluetooth: hci_core: Fix LE quote calculation Ma Ke (1): pinctrl: single: fix potential NULL dereference in pcs_get_function() Mathias Nyman (1): xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration Matthew Wilcox (Oracle) (1): ida: Fix crash in ida_free when the bitmap is empty Max Filippov (1): fs: binfmt_elf_efpic: don't use missing interpreter's properties Michael Ellerman (1): powerpc/boot: Only free if realloc() succeeds Mike Christie (1): scsi: spi: Fix sshdr use Mikulas Patocka (2): dm persistent data: fix memory allocation failure dm suspend: return -ERESTARTSYS instead of -EINTR Miri Korenblit (1): wifi: iwlwifi: abort scan when rfkill on but device enabled NeilBrown (1): NFS: avoid infinite loop in pnfs_update_layout. Niklas Cassel (1): ata: libata-core: Fix null pointer dereference on error Nikolay Kuratov (1): cxgb4: add forgotten u64 ivlan cast before shift Oreoluwa Babatunde (1): openrisc: Call setup_memory() earlier in the init sequence Pawel Dembicki (1): net: dsa: vsc73xx: pass value in phy_write operation Phil Chang (1): hrtimer: Prevent queuing of hrtimer without a function callback Rand Deeb (1): ssb: Fix division by zero issue in ssb_calc_clock_rate Ricardo Ribalda (1): media: uvcvideo: Fix integer overflow calculating timestamp Sagi Grimberg (1): nvmet-rdma: fix possible bad dereference when freeing rsps Sascha Hauer (1): wifi: mwifiex: duplicate static structs used in driver instances Sean Anderson (1): net: xilinx: axienet: Always disable promiscuous mode Sebastian Andrzej Siewior (1): netfilter: nft_counter: Synchronize nft_counter_reset() against reader. Selvarasu Ganesan (1): usb: dwc3: core: Prevent USB core invalid event buffer address access Takashi Iwai (1): ALSA: timer: Relax start tick time check for slave timer elements Tetsuo Handa (2): block: use "unsigned long" for blk_validate_block_size(). Input: MT - limit max slots Uwe Kleine-König (1): usb: gadget: fsl: Increase size of name buffer for endpoints Vasily Averin (2): memcg: enable accounting of ipc resources ipc: remove memcg accounting for sops objects in do_semtimedop() Wolfram Sang (1): i2c: riic: avoid potential division by zero ZHANG Yuntian (1): USB: serial: option: add MeiG Smart SRM825L Zhen Lei (1): selinux: fix potential counting error in avc_add_xperms_decision() Zhiguo Niu (1): f2fs: fix to do sanity check in update_sit_entry Zijun Hu (1): usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in remove_power_attributes()

1 year

1
1
0 0

[PATCH RFC] driver core: bus: Correct return value for storing bus attribute drivers_probe

by Zijun Hu

From: Zijun Hu <quic_zijuhu(a)quicinc.com> drivers_probe_store() regards bus_rescan_devices_helper()'s returned value 0 as success when find driver for a single device user specify that is wrong since the following 3 failed cases also return 0: (1) the device is dead (2) bus fails to match() the device with any its driver (3) bus fails to probe() the device with any its driver Fixed by only regarding successfully attaching the device to a driver as success. Fixes: b8c5cec23d5c ("Driver core: udev triggered device-<>driver binding") Cc: stable(a)vger.kernel.org Signed-off-by: Zijun Hu <quic_zijuhu(a)quicinc.com> --- drivers/base/bus.c | 23 ++++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) diff --git a/drivers/base/bus.c b/drivers/base/bus.c index abf090ace833..0a994e63785c 100644 --- a/drivers/base/bus.c +++ b/drivers/base/bus.c @@ -40,6 +40,20 @@ static struct kset *bus_kset; struct driver_attribute driver_attr_##_name = \ __ATTR_IGNORE_LOCKDEP(_name, _mode, _show, _store) +/* Bus rescans drivers for a single device */ +static int __must_check bus_rescan_single_device(struct device *dev) +{ + int ret; + + if (dev->parent && dev->bus->need_parent_lock) + device_lock(dev->parent); + ret = device_attach(dev); + if (dev->parent && dev->bus->need_parent_lock) + device_unlock(dev->parent); + + return ret; +} + static int __must_check bus_rescan_devices_helper(struct device *dev, void *data); @@ -311,12 +325,19 @@ static ssize_t drivers_probe_store(const struct bus_type *bus, { struct device *dev; int err = -EINVAL; + int res; dev = bus_find_device_by_name(bus, NULL, buf); if (!dev) return -ENODEV; - if (bus_rescan_devices_helper(dev, NULL) == 0) + + res = bus_rescan_single_device(dev); + /* Propagate error code upwards as far as possible */ + if (res < 0) + err = res; + else if (res == 1) err = count; + put_device(dev); return err; } --- base-commit: 888f67e621dda5c2804a696524e28d0ca4cf0a80 change-id: 20240826-fix_drivers_probe-88c6a2cc1899 Best regards, -- Zijun Hu <quic_zijuhu(a)quicinc.com>

1 year

1
1
0 0

[PATCH V4 net] net: mana: Fix error handling in mana_create_txq/rxq's NAPI cleanup

by Souradeep Chakrabarti

Currently napi_disable() gets called during rxq and txq cleanup, even before napi is enabled and hrtimer is initialized. It causes kernel panic. ? page_fault_oops+0x136/0x2b0 ? page_counter_cancel+0x2e/0x80 ? do_user_addr_fault+0x2f2/0x640 ? refill_obj_stock+0xc4/0x110 ? exc_page_fault+0x71/0x160 ? asm_exc_page_fault+0x27/0x30 ? __mmdrop+0x10/0x180 ? __mmdrop+0xec/0x180 ? hrtimer_active+0xd/0x50 hrtimer_try_to_cancel+0x2c/0xf0 hrtimer_cancel+0x15/0x30 napi_disable+0x65/0x90 mana_destroy_rxq+0x4c/0x2f0 mana_create_rxq.isra.0+0x56c/0x6d0 ? mana_uncfg_vport+0x50/0x50 mana_alloc_queues+0x21b/0x320 ? skb_dequeue+0x5f/0x80 Cc: stable(a)vger.kernel.org Fixes: e1b5683ff62e ("net: mana: Move NAPI from EQ to CQ") Signed-off-by: Souradeep Chakrabarti <schakrabarti(a)linux.microsoft.com> Reviewed-by: Haiyang Zhang <haiyangz(a)microsoft.com> Reviewed-by: Shradha Gupta <shradhagupta(a)linux.microsoft.com> --- V4 -> V3: Made napi_initialized from atomic_t to bool in txq, as per review comment. Also used validate_state for rxq as a check. V3 -> V2: Instead of using napi internal attribute, using an atomic attribute to verify napi is initialized for a particular txq / rxq. V2 -> V1: Addressed the comment on cleaning up napi for the queues, where queue creation was successful. --- drivers/net/ethernet/microsoft/mana/mana_en.c | 22 +++++++++++-------- include/net/mana/mana.h | 2 ++ 2 files changed, 15 insertions(+), 9 deletions(-) diff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c b/drivers/net/ethernet/microsoft/mana/mana_en.c index 39f56973746d..3d151700f658 100644 --- a/drivers/net/ethernet/microsoft/mana/mana_en.c +++ b/drivers/net/ethernet/microsoft/mana/mana_en.c @@ -1872,10 +1872,12 @@ static void mana_destroy_txq(struct mana_port_context *apc) for (i = 0; i < apc->num_queues; i++) { napi = &apc->tx_qp[i].tx_cq.napi; - napi_synchronize(napi); - napi_disable(napi); - netif_napi_del(napi); - + if (apc->tx_qp[i].txq.napi_initialized) { + napi_synchronize(napi); + napi_disable(napi); + netif_napi_del(napi); + apc->tx_qp[i].txq.napi_initialized = false; + } mana_destroy_wq_obj(apc, GDMA_SQ, apc->tx_qp[i].tx_object); mana_deinit_cq(apc, &apc->tx_qp[i].tx_cq); @@ -1931,6 +1933,7 @@ static int mana_create_txq(struct mana_port_context *apc, txq->ndev = net; txq->net_txq = netdev_get_tx_queue(net, i); txq->vp_offset = apc->tx_vp_offset; + txq->napi_initialized = false; skb_queue_head_init(&txq->pending_skbs); memset(&spec, 0, sizeof(spec)); @@ -1997,6 +2000,7 @@ static int mana_create_txq(struct mana_port_context *apc, netif_napi_add_tx(net, &cq->napi, mana_poll); napi_enable(&cq->napi); + txq->napi_initialized = true; mana_gd_ring_cq(cq->gdma_cq, SET_ARM_BIT); } @@ -2008,7 +2012,7 @@ static int mana_create_txq(struct mana_port_context *apc, } static void mana_destroy_rxq(struct mana_port_context *apc, - struct mana_rxq *rxq, bool validate_state) + struct mana_rxq *rxq, bool napi_initialized) { struct gdma_context *gc = apc->ac->gdma_dev->gdma_context; @@ -2023,15 +2027,15 @@ static void mana_destroy_rxq(struct mana_port_context *apc, napi = &rxq->rx_cq.napi; - if (validate_state) + if (napi_initialized) { napi_synchronize(napi); - napi_disable(napi); + napi_disable(napi); + netif_napi_del(napi); + } xdp_rxq_info_unreg(&rxq->xdp_rxq); - netif_napi_del(napi); - mana_destroy_wq_obj(apc, GDMA_RQ, rxq->rxobj); mana_deinit_cq(apc, &rxq->rx_cq); diff --git a/include/net/mana/mana.h b/include/net/mana/mana.h index 7caa334f4888..b8a6c7504ee1 100644 --- a/include/net/mana/mana.h +++ b/include/net/mana/mana.h @@ -98,6 +98,8 @@ struct mana_txq { atomic_t pending_sends; + bool napi_initialized; + struct mana_stats_tx stats; }; -- 2.34.1

1 year

2
1
0 0

Linux 4.19.320

by Greg Kroah-Hartman

I'm announcing the release of the 4.19.320 kernel. All users of the 4.19 kernel series must upgrade. The updated 4.19.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.19.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Documentation/arm64/silicon-errata.txt | 18 Documentation/hwmon/hwmon-kernel-api.txt | 24 Makefile | 2 arch/arm64/Kconfig | 38 + arch/arm64/boot/dts/rockchip/rk3328.dtsi | 4 arch/arm64/include/asm/assembler.h | 13 arch/arm64/include/asm/barrier.h | 4 arch/arm64/include/asm/cpucaps.h | 4 arch/arm64/include/asm/cputype.h | 16 arch/arm64/include/asm/sysreg.h | 6 arch/arm64/include/asm/uaccess.h | 3 arch/arm64/include/uapi/asm/hwcap.h | 1 arch/arm64/kernel/cpu_errata.c | 43 + arch/arm64/kernel/cpufeature.c | 103 +++ arch/arm64/kernel/cpuinfo.c | 1 arch/m68k/amiga/config.c | 9 arch/m68k/atari/ataints.c | 6 arch/m68k/include/asm/cmpxchg.h | 2 arch/mips/include/asm/mips-cm.h | 4 arch/mips/kernel/smp-cps.c | 5 arch/powerpc/xmon/ppc-dis.c | 33 - arch/sparc/include/asm/oplib_64.h | 1 arch/sparc/prom/init_64.c | 3 arch/sparc/prom/p1275.c | 2 arch/x86/events/intel/pt.c | 157 +++-- arch/x86/events/intel/pt.h | 25 arch/x86/include/asm/intel_pt.h | 23 arch/x86/kernel/cpu/mtrr/mtrr.c | 2 arch/x86/kernel/devicetree.c | 2 arch/x86/mm/pti.c | 6 arch/x86/pci/intel_mid_pci.c | 4 arch/x86/pci/xen.c | 4 arch/x86/platform/intel/iosf_mbi.c | 4 arch/x86/xen/p2m.c | 4 drivers/android/binder.c | 4 drivers/base/core.c | 13 drivers/base/devres.c | 8 drivers/base/module.c | 4 drivers/char/hw_random/amd-rng.c | 4 drivers/char/tpm/eventlog/common.c | 2 drivers/clk/davinci/da8xx-cfgchip.c | 4 drivers/clocksource/sh_cmt.c | 13 drivers/gpu/drm/bridge/analogix/analogix_dp_reg.c | 5 drivers/gpu/drm/etnaviv/etnaviv_gem.c | 6 drivers/gpu/drm/gma500/cdv_intel_lvds.c | 3 drivers/gpu/drm/gma500/psb_intel_lvds.c | 3 drivers/gpu/drm/i915/i915_gem.c | 47 + drivers/gpu/drm/mgag200/mgag200_i2c.c | 2 drivers/gpu/drm/vmwgfx/vmwgfx_overlay.c | 2 drivers/hwmon/adt7475.c | 2 drivers/hwmon/max6697.c | 145 ++--- drivers/i2c/i2c-smbus.c | 69 +- drivers/infiniband/core/iwcm.c | 11 drivers/infiniband/hw/bnxt_re/ib_verbs.c | 8 drivers/infiniband/hw/bnxt_re/qplib_fp.h | 6 drivers/infiniband/hw/mlx4/alias_GUID.c | 2 drivers/infiniband/hw/mlx4/mad.c | 2 drivers/infiniband/sw/rxe/rxe_req.c | 7 drivers/input/mouse/elan_i2c_core.c | 2 drivers/irqchip/irq-mbigen.c | 20 drivers/isdn/hardware/mISDN/hfcmulti.c | 7 drivers/leds/led-triggers.c | 2 drivers/leds/leds-ss4200.c | 7 drivers/macintosh/therm_windtunnel.c | 2 drivers/md/raid5.c | 20 drivers/media/pci/saa7134/saa7134-dvb.c | 8 drivers/media/platform/qcom/venus/vdec.c | 1 drivers/media/platform/vsp1/vsp1_histo.c | 20 drivers/media/platform/vsp1/vsp1_pipe.h | 2 drivers/media/platform/vsp1/vsp1_rpf.c | 8 drivers/media/rc/imon.c | 5 drivers/media/usb/uvc/uvc_ctrl.c | 90 ++- drivers/media/usb/uvc/uvc_video.c | 37 + drivers/media/usb/uvc/uvcvideo.h | 5 drivers/mfd/omap-usb-tll.c | 3 drivers/mtd/tests/Makefile | 34 - drivers/mtd/tests/mtd_test.c | 9 drivers/mtd/ubi/eba.c | 3 drivers/net/bonding/bond_main.c | 7 drivers/net/ethernet/brocade/bna/bna_types.h | 2 drivers/net/ethernet/brocade/bna/bnad.c | 11 drivers/net/ethernet/freescale/fec_main.c | 52 + drivers/net/ethernet/freescale/fec_ptp.c | 3 drivers/net/ethernet/intel/ice/ice_common.c | 102 ++- drivers/net/ethernet/intel/ice/ice_lan_tx_rx.h | 24 drivers/net/netconsole.c | 2 drivers/net/usb/qmi_wwan.c | 1 drivers/net/usb/sr9700.c | 11 drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c | 18 drivers/net/wireless/marvell/mwifiex/cfg80211.c | 2 drivers/nvme/host/pci.c | 7 drivers/parport/daisy.c | 6 drivers/parport/ieee1284.c | 4 drivers/parport/ieee1284_ops.c | 3 drivers/parport/parport_amiga.c | 2 drivers/parport/parport_atari.c | 2 drivers/parport/parport_cs.c | 6 drivers/parport/parport_gsc.c | 15 drivers/parport/parport_ip32.c | 25 drivers/parport/parport_mfc3.c | 2 drivers/parport/parport_pc.c | 180 ++---- drivers/parport/parport_sunbpp.c | 2 drivers/parport/probe.c | 7 drivers/parport/procfs.c | 28 drivers/parport/share.c | 24 drivers/pci/controller/pci-hyperv.c | 4 drivers/pci/controller/pcie-rockchip.c | 12 drivers/pci/setup-bus.c | 32 - drivers/pinctrl/core.c | 12 drivers/pinctrl/freescale/pinctrl-mxs.c | 4 drivers/pinctrl/pinctrl-single.c | 7 drivers/pinctrl/ti/pinctrl-ti-iodelay.c | 14 drivers/platform/chrome/cros_ec_debugfs.c | 1 drivers/platform/mips/cpu_hwmon.c | 3 drivers/power/supply/axp288_charger.c | 22 drivers/pwm/pwm-stm32.c | 5 drivers/remoteproc/imx_rproc.c | 5 drivers/rtc/rtc-cmos.c | 10 drivers/s390/char/sclp_sd.c | 10 drivers/scsi/qla2xxx/qla_bsg.c | 2 drivers/scsi/qla2xxx/qla_mid.c | 2 drivers/scsi/qla2xxx/qla_nvme.c | 5 drivers/scsi/ufs/ufshcd.c | 11 drivers/spi/spi-fsl-lpspi.c | 281 ++++++---- drivers/tty/serial/serial_core.c | 8 drivers/usb/gadget/udc/core.c | 10 drivers/usb/serial/usb_debug.c | 7 drivers/usb/usbip/vhci_hcd.c | 9 fs/btrfs/free-space-cache.c | 1 fs/exec.c | 8 fs/ext4/mballoc.c | 3 fs/ext4/namei.c | 73 ++ fs/ext4/xattr.c | 6 fs/f2fs/inode.c | 3 fs/file.c | 1 fs/hfs/inode.c | 3 fs/hfsplus/bfind.c | 15 fs/hfsplus/extents.c | 9 fs/hfsplus/hfsplus_fs.h | 21 fs/jbd2/journal.c | 1 fs/jfs/jfs_imap.c | 5 fs/nilfs2/btnode.c | 25 fs/nilfs2/btree.c | 4 fs/nilfs2/segment.c | 7 fs/udf/balloc.c | 36 - include/linux/hwmon-sysfs.h | 39 + include/linux/pci_ids.h | 2 include/linux/trace_events.h | 1 include/net/netfilter/nf_tables.h | 21 include/uapi/linux/zorro_ids.h | 3 kernel/debug/kdb/kdb_io.c | 8 kernel/dma/mapping.c | 2 kernel/events/core.c | 2 kernel/events/internal.h | 2 kernel/time/ntp.c | 9 kernel/time/tick-broadcast.c | 24 kernel/trace/tracing_map.c | 6 kernel/watchdog_hld.c | 11 lib/decompress_bunzip2.c | 3 lib/kobject_uevent.c | 17 mm/page-writeback.c | 30 - net/bluetooth/l2cap_core.c | 1 net/core/link_watch.c | 4 net/ipv4/route.c | 21 net/ipv6/addrconf.c | 3 net/ipv6/ndisc.c | 34 - net/iucv/af_iucv.c | 4 net/netfilter/ipvs/ip_vs_proto_sctp.c | 4 net/netfilter/nf_conntrack_netlink.c | 3 net/netfilter/nf_tables_api.c | 128 ---- net/netfilter/nft_set_hash.c | 8 net/netfilter/nft_set_rbtree.c | 6 net/packet/af_packet.c | 86 ++- net/smc/smc_core.c | 32 - net/sunrpc/sched.c | 4 net/tipc/udp_media.c | 5 net/wireless/nl80211.c | 10 net/wireless/util.c | 8 scripts/gcc-x86_32-has-stack-protector.sh | 2 scripts/gcc-x86_64-has-stack-protector.sh | 2 sound/usb/line6/driver.c | 5 sound/usb/stream.c | 4 tools/memory-model/lock.cat | 20 tools/perf/util/sort.c | 2 tools/testing/selftests/bpf/test_sockmap.c | 3 tools/testing/selftests/net/forwarding/devlink_lib.sh | 2 tools/testing/selftests/sigaltstack/current_stack_pointer.h | 2 187 files changed, 1974 insertions(+), 1087 deletions(-) Adrian Hunter (3): perf: Fix perf_aux_size() for greater-than 32-bit size perf: Prevent passing zero nr_pages to rb_alloc_aux() perf/x86/intel/pt: Fix a topa_entry base address calculation Al Viro (1): protect the fetch of ->fd[fd] in do_dup2() from mispredictions Alan Stern (1): tools/memory-model: Fix bug in lock.cat Aleksandr Burakov (1): saa7134: Unchecked i2c_transfer function result fixed Aleksandr Mishin (1): remoteproc: imx_rproc: Skip over memory region when node value is NULL Alex Shi (1): fs/nilfs2: remove some unused macros to tame gcc Alexander Shishkin (3): perf/x86/intel/pt: Use helpers to obtain ToPA entry size perf/x86/intel/pt: Use pointer arithmetics instead in ToPA entry calculation perf/x86/intel/pt: Split ToPA metadata and page layout Alexandra Winter (1): net/iucv: fix use after free in iucv_sock_close() Alexey Kodanev (1): bna: adjust 'name' buf size of bna_tcb and bna_ccb structures Amit Cohen (1): selftests: forwarding: devlink_lib: Wait for udev events after reloading Amit Daniel Kachhap (1): arm64: cpufeature: Fix the visibility of compat hwcaps Andi Kleen (1): x86/mtrr: Check if fixed MTRRs exist before saving them Andi Shyti (1): drm/i915/gem: Fix Virtual Memory mapping boundaries calculation Andreas Larsson (1): sparc64: Fix incorrect function signature and add prototype for prom_cif_init Andy Shevchenko (1): driver core: Cast to (void *) with __force for __percpu pointer Anirudh Venkataramanan (1): ice: Rework flex descriptor programming Arnd Bergmann (2): mtd: make mtd_test.c a separate module kdb: address -Wformat-security warnings Baochen Qiang (2): wifi: cfg80211: fix typo in cfg80211_calculate_bitrate_he() wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he() Baokun Li (2): ext4: check dot and dotdot of dx_root before making dir indexed ext4: make sure the first directory block is not a hole Bart Van Assche (1): RDMA/iwcm: Fix a use-after-free related to destroying CM IDs Bastien Curutchet (1): clk: davinci: da8xx-cfgchip: Initialize clk_init_data before use Benjamin Coddington (1): SUNRPC: Fix a race to wake a sync task Besar Wicaksono (1): arm64: Add Neoverse-V2 part Breno Leitao (1): net: netconsole: Disable target before netpoll cleanup Carlos Llamas (1): binder: fix hang of unregistered readers Chao Peng (1): perf/x86/intel/pt: Export pt_cap_get() Chao Yu (3): hfsplus: fix to avoid false alarm of circular locking hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode() f2fs: fix to don't dirty inode for readonly filesystem Chen Ni (1): x86/xen: Convert comma to semicolon Chen-Yu Tsai (1): PCI: rockchip: Make 'ep-gpios' DT property optional Chengen Du (1): af_packet: Handle outgoing VLAN packets without hardware offloading Chris Wulff (1): usb: gadget: core: Check for unset descriptor Clark Wang (5): spi: lpspi: Replace all "master" with "controller" spi: lpspi: Add slave mode support spi: lpspi: Let watermark change with send data length spi: lpspi: Add i.MX8 boards support for lpspi spi: lpspi: add the error info of transfer speed setting Corey Minyard (1): i2c: smbus: Don't filter out duplicate alerts Csókás Bence (1): net: fec: Refactor: #define magic constants Csókás, Bence (2): net: fec: Fix FEC_ECR_EN1588 being cleared on link-down net: fec: Stop PPS on driver remove Dan Carpenter (1): mISDN: Fix a use after free in hfcmulti_tx() Dan Williams (1): driver core: Fix uevent_show() vs driver detach race Daniel Schaefer (1): media: uvcvideo: Override default flags Daniele Palmas (1): net: usb: qmi_wwan: fix memory leak for not ip packets Dikshita Agarwal (1): media: venus: fix use after free in vdec_close Dmitry Antipov (1): Bluetooth: l2cap: always unlock channel in l2cap_conless_channel() Dmitry Torokhov (1): Input: elan_i2c - do not leave interrupt disabled on suspend failure Dominique Martinet (1): MIPS: Octeron: remove source file executable bit Dong Aisheng (1): remoteproc: imx_rproc: Fix ignoring mapping vdev regions Douglas Anderson (1): kdb: Use the passed prompt in kdb_position_cursor() Eero Tamminen (1): m68k: atari: Fix TT bootup freeze / unexpected (SCU) interrupt messages Eric Dumazet (1): net: linkwatch: use system_unbound_wq FUJITA Tomonori (1): PCI: Add Edimax Vendor ID to pci_ids.h Fedor Pchelkin (1): ubi: eba: properly rollback inside self_check_eba Filipe Manana (1): btrfs: fix bitmap leak when loading free space cache on duplicate entry Florian Westphal (1): netfilter: nf_tables: prefer nft_chain_validate Geliang Tang (1): selftests/bpf: Check length of recv in test_sockmap George Kennedy (1): serial: core: check uartclk for zero to avoid divide by zero Greg Kroah-Hartman (1): Linux 4.19.320 Gregory CLEMENT (1): MIPS: SMP-CPS: Fix address for GCR_ACCESS register for CM3 and later Guangguan Wang (1): net/smc: set rmb's SG_MAX_SINGLE_ALLOC limitation only when CONFIG_ARCH_NO_SG_CHAIN is defined Guenter Roeck (6): hwmon: (max6697) Fix underflow when writing limit attributes hwmon: Introduce SENSOR_DEVICE_ATTR_{RO, RW, WO} and variants hwmon: (max6697) Auto-convert to use SENSOR_DEVICE_ATTR_{RO, RW, WO} hwmon: (max6697) Fix swapped temp{1,8} critical alarms i2c: smbus: Improve handling of stuck alerts i2c: smbus: Send alert notifications to all devices if source not found Gustavo A. R. Silva (1): parport: parport_pc: Mark expected switch fall-through Hans de Goede (3): leds: trigger: Unregister sysfs attributes before calling deactivate() power: supply: axp288_charger: Fix constant_charge_voltage writes power: supply: axp288_charger: Round constant_charge_voltage writes down Honggang LI (1): RDMA/rxe: Don't set BTH_ACK_MASK for UC or UD QPs Ian Forbes (1): drm/vmwgfx: Fix overlay when using Screen Targets Ido Schimmel (1): ipv4: Fix incorrect source address in Record Route option Ilpo Järvinen (7): x86/of: Return consistent error type from x86_of_pci_irq_enable() x86/pci/intel_mid_pci: Fix PCIBIOS_* return code handling x86/pci/xen: Fix PCIBIOS_* return code handling x86/platform/iosf_mbi: Convert PCIBIOS_* return codes to errnos PCI: Fix resource double counting on remove & rescan leds: ss4200: Convert PCIBIOS_* return codes to errnos hwrng: amd - Convert PCIBIOS_* return codes to errnos Ismael Luceno (1): ipvs: Avoid unnecessary calls to skb_is_gso_sctp Jack Wang (1): bnxt_re: Fix imm_data endianness James Morse (1): arm64: cpufeature: Force HWCAP to be based on the sysreg visible to user-space Jan Kara (2): ext4: avoid writing unitialized memory to disk in EA inodes mm: avoid overflows in dirty throttling logic Javier Carrasco (1): mfd: omap-usb-tll: Use struct_size to allocate tll Jeongjun Park (1): jfs: Fix array-index-out-of-bounds in diFree Jiaxun Yang (1): platform: mips: cpu_hwmon: Disable driver on unsupported hardware Joe Hattori (1): char: tpm: Fix possible memory leak in tpm_bios_measurements_open() Joe Perches (2): parport: Convert printk(KERN_<LEVEL> to pr_<level>( parport: Standardize use of printmode Johannes Berg (2): net: bonding: correctly annotate RCU in bond_should_notify_peers() wifi: nl80211: don't give key data to userspace Jon Derrick (1): PCI: Equalize hotplug memory and io for occupied and empty slots Jonas Karlman (1): arm64: dts: rockchip: Increase VOP clk rate on RK3328 Joy Chakraborty (1): rtc: cmos: Fix return value of nvmem callbacks Justin Stitt (2): ntp: Clamp maxerror and esterror to operating range ntp: Safeguard against time_constant overflow Kees Cook (1): exec: Fix ToCToU between perm check and set-uid/gid usage Kemeng Shi (2): jbd2: avoid memleak in jbd2_journal_write_metadata_buffer ext4: fix wrong unit use in ext4_mb_find_by_goal Lance Richardson (1): dma: fix call order in dmam_free_coherent Laurent Pinchart (2): media: renesas: vsp1: Fix _irqsave and _irq mix media: renesas: vsp1: Store RPF partition configuration per RPF instance Leon Romanovsky (2): RDMA/mlx4: Fix truncated output warning in mad.c RDMA/mlx4: Fix truncated output warning in alias_GUID.c Lucas Stach (2): drm/etnaviv: fix DMA direction handling for cached RW buffers drm/bridge: analogix_dp: properly handle zero sized AUX transactions Ma Ke (3): drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes drm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes net: usb: sr9700: fix uninitialized variable use in sr_mdio_read Maciej Żenczykowski (2): net: ip_rt_get_source() - use new style struct initializer instead of memset ipv6: fix ndisc_is_useropt() handling for PIO Manish Rangankar (1): scsi: qla2xxx: During vport delete send async logout explicitly Manivannan Sadhasivam (1): PCI: rockchip: Use GPIOD_OUT_LOW flag while requesting ep_gpio Marco Cavenati (1): perf/x86/intel/pt: Fix topa_entry base length Marek Marczykowski-Górecki (1): USB: serial: debug: do not echo input by default Mark Rutland (11): arm64: cputype: Add Cortex-X4 definitions arm64: cputype: Add Neoverse-V3 definitions arm64: errata: Add workaround for Arm errata 3194386 and 3312417 arm64: cputype: Add Cortex-X3 definitions arm64: cputype: Add Cortex-A720 definitions arm64: cputype: Add Cortex-X925 definitions arm64: errata: Unify speculative SSBS errata logic arm64: errata: Expand speculative SSBS workaround arm64: cputype: Add Cortex-X1C definitions arm64: cputype: Add Cortex-A725 definitions arm64: errata: Expand speculative SSBS workaround (again) Menglong Dong (1): bpf: kprobe: remove unused declaring of bpf_kprobe_override Michael Ellerman (2): powerpc/xmon: Fix disassembly CPU feature checks selftests/sigaltstack: Fix ppc64 GCC build Michal Pecio (1): media: uvcvideo: Fix the bandwdith quirk on USB 3.x Namhyung Kim (1): perf report: Fix condition in sort__sym_cmp() Nathan Chancellor (1): kbuild: Fix '-S -c' in x86 stack protector scripts Nick Bowler (1): macintosh/therm_windtunnel: fix module unload. Nicolas Dichtel (1): ipv6: take care of scope when choosing the src addr Niklas Söderlund (1): clocksource/drivers/sh_cmt: Address race condition for clock events Nilesh Javali (1): scsi: qla2xxx: validate nvme_local_port correctly Oleksandr Suvorov (1): spi: fsl-lpspi: remove unneeded array Oliver Neukum (1): usb: vhci-hcd: Do not drop references before new references are gained Pablo Neira Ayuso (3): netfilter: ctnetlink: use helper function to calculate expect ID netfilter: nf_tables: set element extended ACK reporting support netfilter: nf_tables: use timestamp to check for set element timeout Paolo Pisati (1): m68k: amiga: Turn off Warp1260 interrupts during boot Peng Fan (2): pinctrl: freescale: mxs: Fix refcount of child remoteproc: imx_rproc: ignore mapping vdev regions Peter Oberparleiter (1): s390/sclp: Prevent release of buffer in I/O Peter Zijlstra (1): x86/mm: Fix pti_clone_pgtable() alignment assumption Rafael Beims (1): wifi: mwifiex: Fix interface type change Ricardo Ribalda (3): media: imon: Fix race getting ictx->lock media: uvcvideo: Allow entity-defined get_info and get_cur media: uvcvideo: Ignore empty TS packets Roman Smirnov (1): udf: prevent integer overflow in udf_bitmap_free_blocks() Ross Lagerwall (1): decompress_bunzip2: fix rare decompression failure Ryusuke Konishi (2): nilfs2: avoid undefined behavior in nilfs_cnt32_ge macro nilfs2: handle inconsistent state in nilfs_btnode_create_block() Samasth Norway Ananda (1): wifi: brcmsmac: LCN PHY code is used for BCM4313 2G-only device Saurav Kashyap (1): scsi: qla2xxx: Return ENOBUFS if sg_cnt is more than one for ELS cmds Shigeru Yoshida (1): tipc: Return non-zero value from tipc_udp_addr2str() on error Stefan Raspl (1): net/smc: Allow SMC-D 1MB DMB allocations Stefan Wahren (1): spi: spi-fsl-lpspi: Fix scldiv calculation Takashi Iwai (2): ALSA: usb-audio: Correct surround channels in UAC1 channel map ALSA: line6: Fix racy access to midibuf Thomas Gleixner (2): watchdog/perf: properly initialize the turbo mode timestamp and rearm counter tick/broadcast: Move per CPU pointer access into the atomic section Thomas Zimmermann (1): drm/mgag200: Set DDC timeout in milliseconds Thorsten Blum (1): m68k: cmpxchg: Fix return value for default case in __arch_xchg() Tze-nan Wu (1): tracing: Fix overflow in get_free_elt() Tzung-Bi Shih (1): platform/chrome: cros_ec_debugfs: fix wrong EC message version Uwe Kleine-König (2): pwm: stm32: Always do lazy disabling pinctrl: ti: ti-iodelay: Drop if block with always false condition Vamshi Gajjela (1): scsi: ufs: core: Fix hba->last_dme_cmd_tstamp timestamp updating logic WangYuli (1): nvme/pci: Add APST quirk for Lenovo N60z laptop Wayne Tung (1): hwmon: (adt7475) Fix default duty on fan is disabled Wei Liu (1): PCI: hv: Return zero, not garbage, when reading PCI_INTERRUPT_PIN Wenlin Kang (1): kdb: Fix bound check compiler warning Will Deacon (1): arm64: Add support for SB barrier and patch in over DSB; ISB sequences Yang Yingliang (3): pinctrl: core: fix possible memory leak when pinctrl_enable() fails pinctrl: single: fix possible memory leak when pinctrl_enable() fails pinctrl: ti: ti-iodelay: fix possible memory leak when pinctrl_enable() fails Yipeng Zou (1): irqchip/mbigen: Fix mbigen node address layout Yu Kuai (1): md/raid5: avoid BUG_ON() while continue reshape after reassembling Yu Liao (1): tick/broadcast: Make takeover of broadcast hrtimer reliable Yunke Cao (1): media: uvcvideo: Use entity get_cur in uvc_ctrl_set Zijun Hu (2): kobject_uevent: Fix OOB access within zap_modalias_env() devres: Fix memory leakage caused by driver API devm_free_percpu() tuhaowen (1): dev/parport: fix the array out-of-bounds risk

1 year

2
4
0 0

[PATCH 4.19 00/98] 4.19.321-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.19.321 release. There are 98 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Tue, 03 Sep 2024 16:07:34 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.321-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.19.321-rc1 Daniel Vetter <daniel.vetter(a)ffwll.ch> drm/fb-helper: set x/yres_virtual in drm_fb_helper_check_var Vasily Averin <vvs(a)virtuozzo.com> ipc: remove memcg accounting for sops objects in do_semtimedop() Ben Hutchings <benh(a)debian.org> scsi: aacraid: Fix double-free on probe failure Zijun Hu <quic_zijuhu(a)quicinc.com> usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in remove_power_attributes() Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> usb: dwc3: st: fix probed platform device ref count on probe error path Selvarasu Ganesan <selvarasu.g(a)samsung.com> usb: dwc3: core: Prevent USB core invalid event buffer address access Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> usb: dwc3: omap: add missing depopulate in probe error path ZHANG Yuntian <yt(a)radxa.com> USB: serial: option: add MeiG Smart SRM825L Ian Ray <ian.ray(a)gehealthcare.com> cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller Eric Dumazet <edumazet(a)google.com> net: busy-poll: use ktime_get_ns() instead of local_clock() Cong Wang <cong.wang(a)bytedance.com> gtp: fix a potential NULL pointer dereference Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> soundwire: stream: fix programming slave ports for non-continous port maps Eric Dumazet <edumazet(a)google.com> net: prevent mss overflow in skb_segment() Matthew Wilcox (Oracle) <willy(a)infradead.org> ida: Fix crash in ida_free when the bitmap is empty Allison Henderson <allison.henderson(a)oracle.com> net:rds: Fix possible deadlock in rds_message_put Helge Deller <deller(a)gmx.de> fbmem: Check virtual screen sizes in fb_set_var() Helge Deller <deller(a)gmx.de> fbcon: Prevent that screen size is smaller than font size Vasily Averin <vvs(a)virtuozzo.com> memcg: enable accounting of ipc resources Chen Ridong <chenridong(a)huawei.com> cgroup/cpuset: Prevent UAF in proc_cpuset_show() Niklas Cassel <cassel(a)kernel.org> ata: libata-core: Fix null pointer dereference on error Ricardo Ribalda <ribalda(a)chromium.org> media: uvcvideo: Fix integer overflow calculating timestamp Long Li <leo.lilong(a)huawei.com> filelock: Correct the filelock owner in fcntl_setlk/fcntl_setlk64 Damien Le Moal <dlemoal(a)kernel.org> scsi: mpt3sas: Avoid IOMMU page faults on REPORT ZONES Mikulas Patocka <mpatocka(a)redhat.com> dm suspend: return -ERESTARTSYS instead of -EINTR Sascha Hauer <s.hauer(a)pengutronix.de> wifi: mwifiex: duplicate static structs used in driver instances Ma Ke <make24(a)iscas.ac.cn> pinctrl: single: fix potential NULL dereference in pcs_get_function() Jesse Zhang <jesse.zhang(a)amd.com> drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc Alexander Lobakin <aleksander.lobakin(a)intel.com> tools: move alignment-related macros to new <linux/align.h> Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Input: MT - limit max slots Lee, Chun-Yi <joeyli.kernel(a)gmail.com> Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO Takashi Iwai <tiwai(a)suse.de> ALSA: timer: Relax start tick time check for slave timer elements Ben Whitten <ben.whitten(a)gmail.com> mmc: dw_mmc: allow biu and ciu clocks to defer Nikolay Kuratov <kniv(a)yandex-team.ru> cxgb4: add forgotten u64 ivlan cast before shift Jason Gerecke <jason.gerecke(a)wacom.com> HID: wacom: Defer calculation of resolution until resolution_code is known Griffin Kroah-Hartman <griffin(a)kroah.com> Bluetooth: MGMT: Add error handling to pair_device() Dan Carpenter <dan.carpenter(a)linaro.org> mmc: mmc_test: Fix NULL dereference on allocation failure Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> drm/msm/dpu: don't play tricks with debug macros Jani Nikula <jani.nikula(a)intel.com> drm/msm: use drm_debug_enabled() to check for debug categories Sean Anderson <sean.anderson(a)linux.dev> net: xilinx: axienet: Always disable promiscuous mode Eric Dumazet <edumazet(a)google.com> ipv6: prevent UAF in ip6_send_skb() Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> netfilter: nft_counter: Synchronize nft_counter_reset() against reader. Kuniyuki Iwashima <kuniyu(a)amazon.com> kcm: Serialise kcm_sendmsg() for the same socket. Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_core: Fix LE quote calculation Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_core: Fix not handling link timeouts propertly Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: Make use of __check_timeout on hci_sched_le Tetsuo Handa <penguin-kernel(a)i-love.sakura.ne.jp> block: use "unsigned long" for blk_validate_block_size(). Eric Dumazet <edumazet(a)google.com> gtp: pull network headers in gtp_dev_xmit() Phil Chang <phil.chang(a)mediatek.com> hrtimer: Prevent queuing of hrtimer without a function callback Sagi Grimberg <sagi(a)grimberg.me> nvmet-rdma: fix possible bad dereference when freeing rsps Baokun Li <libaokun1(a)huawei.com> ext4: set the type of max_zeroout to unsigned int to avoid overflow Guanrui Huang <guanrui.huang(a)linux.alibaba.com> irqchip/gic-v3-its: Remove BUG_ON in its_vpe_irq_domain_alloc Abdulrasaq Lawani <abdulrasaqolawani(a)gmail.com> fbdev: offb: replace of_node_put with __free(device_node) Krishna Kurapati <quic_kriskura(a)quicinc.com> usb: dwc3: core: Skip setting event buffers for host only controllers Alexander Gordeev <agordeev(a)linux.ibm.com> s390/iucv: fix receive buffer virtual vs physical address confusion Oreoluwa Babatunde <quic_obabatun(a)quicinc.com> openrisc: Call setup_memory() earlier in the init sequence NeilBrown <neilb(a)suse.de> NFS: avoid infinite loop in pnfs_update_layout. Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: bnep: Fix out-of-bound access Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> usb: gadget: fsl: Increase size of name buffer for endpoints Zhiguo Niu <zhiguo.niu(a)unisoc.com> f2fs: fix to do sanity check in update_sit_entry David Sterba <dsterba(a)suse.com> btrfs: delete pointless BUG_ON check on quota root in btrfs_qgroup_account_extent() David Sterba <dsterba(a)suse.com> btrfs: send: handle unexpected data in header buffer in begin_cmd() David Sterba <dsterba(a)suse.com> btrfs: handle invalid root reference found in may_destroy_subvol() David Sterba <dsterba(a)suse.com> btrfs: change BUG_ON to assertion when checking for delayed_node root Michael Ellerman <mpe(a)ellerman.id.au> powerpc/boot: Only free if realloc() succeeds Li zeming <zeming(a)nfschina.com> powerpc/boot: Handle allocation failure in simple_realloc() Helge Deller <deller(a)gmx.de> parisc: Use irq_enter_rcu() to fix warning at kernel/context_tracking.c:367 Li Nan <linan122(a)huawei.com> md: clean up invalid BUG_ON in md_ioctl Kees Cook <keescook(a)chromium.org> net/sun3_82586: Avoid reading past buffer in debug output Justin Tee <justin.tee(a)broadcom.com> scsi: lpfc: Initialize status local variable in lpfc_sli4_repost_sgl_list() Max Filippov <jcmvbkbc(a)gmail.com> fs: binfmt_elf_efpic: don't use missing interpreter's properties Hans Verkuil <hverkuil-cisco(a)xs4all.nl> media: pci: cx23885: check cx23885_vdev_init() return Jan Kara <jack(a)suse.cz> quota: Remove BUG_ON from dqget() Baokun Li <libaokun1(a)huawei.com> ext4: do not trim the group with corrupted block bitmap Kunwu Chan <chentao(a)kylinos.cn> powerpc/xics: Check return value of kasprintf in icp_native_map_one_cpu Miri Korenblit <miriam.rachel.korenblit(a)intel.com> wifi: iwlwifi: abort scan when rfkill on but device enabled Andreas Gruenbacher <agruenba(a)redhat.com> gfs2: setattr_chown: Add missing initialization Mike Christie <michael.christie(a)oracle.com> scsi: spi: Fix sshdr use Christian Brauner <christian.brauner(a)ubuntu.com> binfmt_misc: cleanup on filesystem umount Chengfeng Ye <dg573847474(a)gmail.com> staging: ks7010: disable bh on tx_dev_lock Wolfram Sang <wsa+renesas(a)sang-engineering.com> i2c: riic: avoid potential division by zero Jeff Johnson <quic_jjohnson(a)quicinc.com> wifi: cw1200: Avoid processing an invalid TIM IE Rand Deeb <rand.sec96(a)gmail.com> ssb: Fix division by zero issue in ssb_calc_clock_rate Pawel Dembicki <paweldembicki(a)gmail.com> net: dsa: vsc73xx: pass value in phy_write operation Dan Carpenter <dan.carpenter(a)linaro.org> atm: idt77252: prevent use after free in dequeue_rx() Cosmin Ratiu <cratiu(a)nvidia.com> net/mlx5e: Correctly report errors for ethtool rx flows Alexander Lobakin <aleksander.lobakin(a)intel.com> btrfs: rename bitmap_set_bits() -> btrfs_bitmap_set_bits() Alexander Lobakin <aleksander.lobakin(a)intel.com> s390/cio: rename bitmap_size() -> idset_bitmap_size() Al Viro <viro(a)zeniv.linux.org.uk> memcg_write_event_control(): fix a user-triggerable oops Bas Nieuwenhuizen <bas(a)basnieuwenhuizen.nl> drm/amdgpu: Actually check flags for all context ops. Zhen Lei <thunder.leizhen(a)huawei.com> selinux: fix potential counting error in avc_add_xperms_decision() Al Viro <viro(a)zeniv.linux.org.uk> fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE Alexander Lobakin <aleksander.lobakin(a)intel.com> bitmap: introduce generic optimized bitmap_size() Mikulas Patocka <mpatocka(a)redhat.com> dm persistent data: fix memory allocation failure Khazhismel Kumykov <khazhy(a)google.com> dm resume: don't return EINVAL when signalled Haibo Xu <haibo1.xu(a)intel.com> arm64: ACPI: NUMA: initialize all values of acpi_early_node_map to NUMA_NO_NODE Mathias Nyman <mathias.nyman(a)linux.intel.com> xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration Juan José Arboleda <soyjuanarbol(a)gmail.com> ALSA: usb-audio: Support Yamaha P-125 quirk entry Jann Horn <jannh(a)google.com> fuse: Initialize beyond-EOF page contents before setting uptodate ------------- Diffstat: Makefile | 4 +- arch/arm64/kernel/acpi_numa.c | 2 +- arch/openrisc/kernel/setup.c | 6 +- arch/parisc/kernel/irq.c | 4 +- arch/powerpc/boot/simple_alloc.c | 7 +- arch/powerpc/sysdev/xics/icp-native.c | 2 + drivers/ata/libata-core.c | 3 + drivers/atm/idt77252.c | 9 +- drivers/bluetooth/hci_ldisc.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c | 8 + drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 3 +- drivers/gpu/drm/drm_fb_helper.c | 3 + drivers/gpu/drm/msm/disp/dpu1/dpu_kms.h | 14 +- drivers/hid/wacom_wac.c | 4 +- drivers/i2c/busses/i2c-riic.c | 2 +- drivers/input/input-mt.c | 3 + drivers/irqchip/irq-gic-v3-its.c | 2 - drivers/md/dm-ioctl.c | 22 ++- drivers/md/dm.c | 2 +- drivers/md/md.c | 5 - drivers/md/persistent-data/dm-space-map-metadata.c | 4 +- drivers/media/pci/cx23885/cx23885-video.c | 8 + drivers/media/usb/uvc/uvc_video.c | 10 +- drivers/mmc/core/mmc_test.c | 9 +- drivers/mmc/host/dw_mmc.c | 8 + drivers/net/dsa/vitesse-vsc73xx.c | 2 +- drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c | 3 +- drivers/net/ethernet/i825xx/sun3_82586.c | 2 +- .../ethernet/mellanox/mlx5/core/en_fs_ethtool.c | 2 +- drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 4 + drivers/net/gtp.c | 5 +- drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 2 +- drivers/net/wireless/marvell/mwifiex/cfg80211.c | 32 ++- drivers/net/wireless/st/cw1200/txrx.c | 2 +- drivers/nvme/target/rdma.c | 16 +- drivers/pinctrl/pinctrl-single.c | 2 + drivers/s390/cio/idset.c | 12 +- drivers/scsi/aacraid/comminit.c | 2 + drivers/scsi/lpfc/lpfc_sli.c | 2 +- drivers/scsi/mpt3sas/mpt3sas_base.c | 20 +- drivers/scsi/scsi_transport_spi.c | 4 +- drivers/soundwire/stream.c | 8 +- drivers/ssb/main.c | 2 +- drivers/staging/ks7010/ks7010_sdio.c | 4 +- drivers/usb/class/cdc-acm.c | 3 + drivers/usb/core/sysfs.c | 1 + drivers/usb/dwc3/core.c | 21 ++ drivers/usb/dwc3/dwc3-omap.c | 4 +- drivers/usb/dwc3/dwc3-st.c | 11 +- drivers/usb/gadget/udc/fsl_udc_core.c | 2 +- drivers/usb/host/xhci.c | 8 +- drivers/usb/serial/option.c | 5 + drivers/video/fbdev/core/fbcon.c | 28 +++ drivers/video/fbdev/core/fbmem.c | 20 +- drivers/video/fbdev/offb.c | 3 +- fs/binfmt_elf_fdpic.c | 2 +- fs/binfmt_misc.c | 216 ++++++++++++++++----- fs/btrfs/delayed-inode.c | 2 +- fs/btrfs/free-space-cache.c | 8 +- fs/btrfs/inode.c | 9 +- fs/btrfs/qgroup.c | 2 - fs/btrfs/send.c | 7 +- fs/ext4/extents.c | 3 +- fs/ext4/mballoc.c | 3 + fs/f2fs/segment.c | 5 +- fs/file.c | 28 ++- fs/fuse/dev.c | 6 +- fs/gfs2/inode.c | 2 +- fs/locks.c | 4 +- fs/nfs/pnfs.c | 8 + fs/quota/dquot.c | 5 +- include/linux/bitmap.h | 20 +- include/linux/blkdev.h | 2 +- include/linux/cpumask.h | 2 +- include/linux/fbcon.h | 4 + include/net/busy_poll.h | 2 +- include/net/kcm.h | 1 + ipc/msg.c | 2 +- ipc/sem.c | 7 +- ipc/shm.c | 2 +- kernel/cgroup/cpuset.c | 13 +- kernel/time/hrtimer.c | 2 + lib/idr.c | 2 +- lib/test_ida.c | 40 ++++ mm/memcontrol.c | 7 +- net/bluetooth/bnep/core.c | 3 +- net/bluetooth/hci_core.c | 58 +++--- net/bluetooth/mgmt.c | 4 + net/core/skbuff.c | 3 +- net/ipv6/ip6_output.c | 2 + net/iucv/iucv.c | 3 +- net/kcm/kcmsock.c | 4 + net/netfilter/nft_counter.c | 5 + net/rds/recv.c | 13 +- security/selinux/avc.c | 2 +- sound/core/timer.c | 2 +- sound/usb/quirks-table.h | 1 + tools/include/linux/align.h | 12 ++ tools/include/linux/bitmap.h | 8 +- 99 files changed, 662 insertions(+), 253 deletions(-)

1 year

5
107
0 0

[PATCH 5.15 000/215] 5.15.166-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.15.166 release. There are 215 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Tue, 03 Sep 2024 16:07:34 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.166-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.15.166-rc1 Guenter Roeck <linux(a)roeck-us.net> apparmor: fix policy_unpack_test on big endian systems Ben Hutchings <benh(a)debian.org> scsi: aacraid: Fix double-free on probe failure Faizal Rahim <faizal.abdul.rahim(a)linux.intel.com> igc: Fix qbv tx latency by setting gtxoffset Faizal Rahim <faizal.abdul.rahim(a)linux.intel.com> igc: Fix reset adapter logics when tx mode change Sean Anderson <sean.anderson(a)linux.dev> phy: zynqmp: Enable reference clock correctly Pawel Laszczak <pawell(a)cadence.com> usb: cdnsp: fix for Link TRB with TC Pawel Laszczak <pawell(a)cadence.com> usb: cdnsp: fix incorrect index in cdnsp_get_hw_deq function Zijun Hu <quic_zijuhu(a)quicinc.com> usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in remove_power_attributes() Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> usb: dwc3: st: add missing depopulate in probe error path Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> usb: dwc3: st: fix probed platform device ref count on probe error path Selvarasu Ganesan <selvarasu.g(a)samsung.com> usb: dwc3: core: Prevent USB core invalid event buffer address access Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> usb: dwc3: omap: add missing depopulate in probe error path ZHANG Yuntian <yt(a)radxa.com> USB: serial: option: add MeiG Smart SRM825L Ian Ray <ian.ray(a)gehealthcare.com> cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller Volodymyr Babchuk <Volodymyr_Babchuk(a)epam.com> soc: qcom: cmd-db: Map shared memory as WC, not WB Aleksandr Mishin <amishin(a)t-argos.ru> nfc: pn533: Add poll mod list filling check Eric Dumazet <edumazet(a)google.com> net: busy-poll: use ktime_get_ns() instead of local_clock() Cong Wang <cong.wang(a)bytedance.com> gtp: fix a potential NULL pointer dereference Jamie Bainbridge <jamie.bainbridge(a)gmail.com> ethtool: check device is present when getting link settings Serge Semin <fancer.lancer(a)gmail.com> dmaengine: dw: Add memory bus width verification Serge Semin <fancer.lancer(a)gmail.com> dmaengine: dw: Add peripheral bus width verification Piyush Mehta <piyush.mehta(a)amd.com> phy: xilinx: phy-zynqmp: Fix SGMII linkup failure on resume Piyush Mehta <piyush.mehta(a)amd.com> phy: xilinx: phy-zynqmp: dynamic clock support for power-save Piyush Mehta <piyush.mehta(a)amd.com> phy: xilinx: add runtime PM support Paul Cercueil <paul(a)crapouillou.net> PM: runtime: Add DEFINE_RUNTIME_DEV_PM_OPS() macro Paul Cercueil <paul(a)crapouillou.net> PM: core: Add EXPORT[_GPL]_SIMPLE_DEV_PM_OPS macros Paul Cercueil <paul(a)crapouillou.net> PM: core: Remove DEFINE_UNIVERSAL_DEV_PM_OPS() macro Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> soundwire: stream: fix programming slave ports for non-continous port maps Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: the buffer of smb2 query dir response has at least 1 byte Allison Henderson <allison.henderson(a)oracle.com> net:rds: Fix possible deadlock in rds_message_put Chen Ridong <chenridong(a)huawei.com> cgroup/cpuset: Prevent UAF in proc_cpuset_show() Niklas Cassel <cassel(a)kernel.org> ata: libata-core: Fix null pointer dereference on error Alex Deucher <alexander.deucher(a)amd.com> drm/amdkfd: don't allow mapping the MMIO HDP page with large pages Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Revert "MIPS: Loongson64: reset: Prioritise firmware service" Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: sched: check both backup in retrans Haiyang Zhang <haiyangz(a)microsoft.com> net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response Sascha Hauer <s.hauer(a)pengutronix.de> wifi: mwifiex: duplicate static structs used in driver instances Ma Ke <make24(a)iscas.ac.cn> pinctrl: single: fix potential NULL dereference in pcs_get_function() Huang-Huang Bao <i(a)eh5.me> pinctrl: rockchip: correct RK3328 iomux width flag for GPIO2-B pins Josef Bacik <josef(a)toxicpanda.com> btrfs: run delayed iputs when flushing delalloc Jesse Zhang <jesse.zhang(a)amd.com> drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc Alexander Lobakin <aleksander.lobakin(a)intel.com> tools: move alignment-related macros to new <linux/align.h> Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Input: MT - limit max slots Lee, Chun-Yi <joeyli.kernel(a)gmail.com> Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO Zi Yan <ziy(a)nvidia.com> mm/numa: no task_numa_fault() call if PTE is changed Zi Yan <ziy(a)nvidia.com> mm/numa: no task_numa_fault() call if PMD is changed Takashi Iwai <tiwai(a)suse.de> ALSA: timer: Relax start tick time check for slave timer elements Javier Carrasco <javier.carrasco.cruz(a)gmail.com> hwmon: (ltc2992) Fix memory leak in ltc2992_parse_dt() Alex Hung <alex.hung(a)amd.com> Revert "drm/amd/display: Validate hw_points_num before using it" Ben Whitten <ben.whitten(a)gmail.com> mmc: dw_mmc: allow biu and ciu clocks to defer Marc Zyngier <maz(a)kernel.org> KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3 Nikolay Kuratov <kniv(a)yandex-team.ru> cxgb4: add forgotten u64 ivlan cast before shift Siarhei Vishniakou <svv(a)google.com> HID: microsoft: Add rumble support to latest xbox controllers Jason Gerecke <jason.gerecke(a)wacom.com> HID: wacom: Defer calculation of resolution until resolution_code is known Jiaxun Yang <jiaxun.yang(a)flygoat.com> MIPS: Loongson64: Set timer mode in cpu-probe Chaotian Jing <chaotian.jing(a)mediatek.com> scsi: core: Fix the return value of scsi_logical_block_count() Griffin Kroah-Hartman <griffin(a)kroah.com> Bluetooth: MGMT: Add error handling to pair_device() Dan Carpenter <dan.carpenter(a)linaro.org> mmc: mmc_test: Fix NULL dereference on allocation failure Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails Abhinav Kumar <quic_abhinavk(a)quicinc.com> drm/msm/dp: reset the link phy params before link training Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> drm/msm/dpu: don't play tricks with debug macros Sean Anderson <sean.anderson(a)linux.dev> net: xilinx: axienet: Fix dangling multicast addresses Sean Anderson <sean.anderson(a)linux.dev> net: xilinx: axienet: Always disable promiscuous mode Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: flowtable: validate vlan header Eric Dumazet <edumazet(a)google.com> ipv6: prevent possible UAF in ip6_xmit() Eric Dumazet <edumazet(a)google.com> ipv6: fix possible UAF in ip6_finish_output2() Eric Dumazet <edumazet(a)google.com> ipv6: prevent UAF in ip6_send_skb() Stephen Hemminger <stephen(a)networkplumber.org> netem: fix return value if duplicate enqueue fails Joseph Huang <Joseph.Huang(a)garmin.com> net: dsa: mv88e6xxx: Fix out-of-bound access Vladimir Oltean <vladimir.oltean(a)nxp.com> net: dsa: mv88e6xxx: replace ATU violation prints with trace points Hans J. Schultz <netdev(a)kapio-technology.com> net: dsa: mv88e6xxx: read FID when handling ATU violations Dan Carpenter <dan.carpenter(a)linaro.org> dpaa2-switch: Fix error checking in dpaa2_switch_seed_bp() Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> ice: fix ICE_LAST_OFFSET formula Nikolay Aleksandrov <razor(a)blackwall.org> bonding: fix xfrm state handling when clearing active slave Nikolay Aleksandrov <razor(a)blackwall.org> bonding: fix xfrm real_dev null pointer dereference Nikolay Aleksandrov <razor(a)blackwall.org> bonding: fix null pointer deref in bond_ipsec_offload_ok Nikolay Aleksandrov <razor(a)blackwall.org> bonding: fix bond_ipsec_offload_ok return type Thomas Bogendoerfer <tbogendoerfer(a)suse.de> ip6_tunnel: Fix broken GRO Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> netfilter: nft_counter: Synchronize nft_counter_reset() against reader. Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> netfilter: nft_counter: Disable BH in nft_counter_offload_stats(). Kuniyuki Iwashima <kuniyu(a)amazon.com> kcm: Serialise kcm_sendmsg() for the same socket. Simon Horman <horms(a)kernel.org> tc-testing: don't access non-existent variable on exception Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: SMP: Fix assumption of Central always being Initiator Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_core: Fix LE quote calculation Maximilian Luz <luzmaximilian(a)gmail.com> platform/surface: aggregator: Fix warning when controller is destroyed in probe Long Li <longli(a)microsoft.com> net: mana: Fix doorbell out of order violation and avoid unnecessary doorbell rings Mikulas Patocka <mpatocka(a)redhat.com> dm suspend: return -ERESTARTSYS instead of -EINTR Aurelien Jarno <aurelien(a)aurel32.net> media: solo6x10: replace max(a, min(b, c)) by clamp(b, a, c) Josef Bacik <josef(a)toxicpanda.com> nfsd: make svc_stat per-network namespace instead of global Josef Bacik <josef(a)toxicpanda.com> nfsd: remove nfsd_stats, make th_cnt a global counter Josef Bacik <josef(a)toxicpanda.com> nfsd: make all of the nfsd stats per-network namespace Josef Bacik <josef(a)toxicpanda.com> nfsd: expose /proc/net/sunrpc/nfsd in net namespaces Josef Bacik <josef(a)toxicpanda.com> nfsd: rename NFSD_NET_* to NFSD_STATS_* Josef Bacik <josef(a)toxicpanda.com> sunrpc: use the struct net as the svc proc private Josef Bacik <josef(a)toxicpanda.com> sunrpc: remove ->pg_stats from svc_program Josef Bacik <josef(a)toxicpanda.com> sunrpc: pass in the sv_stats struct through svc_create_pooled Josef Bacik <josef(a)toxicpanda.com> nfsd: stop setting ->pg_stats for unused stats Josef Bacik <josef(a)toxicpanda.com> sunrpc: don't change ->sv_stats if it doesn't exist Chuck Lever <chuck.lever(a)oracle.com> NFSD: Fix frame size warning in svc_export_parse() Chuck Lever <chuck.lever(a)oracle.com> NFSD: Rewrite synopsis of nfsd_percpu_counters_init() Chuck Lever <chuck.lever(a)oracle.com> NFSD: Refactor the duplicate reply cache shrinker Chuck Lever <chuck.lever(a)oracle.com> NFSD: Replace nfsd_prune_bucket() Chuck Lever <chuck.lever(a)oracle.com> NFSD: Rename nfsd_reply_cache_alloc() Chuck Lever <chuck.lever(a)oracle.com> NFSD: Refactor nfsd_reply_cache_free_locked() Jeff Layton <jlayton(a)kernel.org> nfsd: move init of percpu reply_cache_stats counters back to nfsd_init_net Jeff Layton <jlayton(a)kernel.org> nfsd: move reply cache initialization into nfsd startup Tetsuo Handa <penguin-kernel(a)i-love.sakura.ne.jp> block: use "unsigned long" for blk_validate_block_size(). Eric Dumazet <edumazet(a)google.com> gtp: pull network headers in gtp_dev_xmit() Phil Chang <phil.chang(a)mediatek.com> hrtimer: Prevent queuing of hrtimer without a function callback Sagi Grimberg <sagi(a)grimberg.me> nvmet-rdma: fix possible bad dereference when freeing rsps Baokun Li <libaokun1(a)huawei.com> ext4: set the type of max_zeroout to unsigned int to avoid overflow Guanrui Huang <guanrui.huang(a)linux.alibaba.com> irqchip/gic-v3-its: Remove BUG_ON in its_vpe_irq_domain_alloc Abdulrasaq Lawani <abdulrasaqolawani(a)gmail.com> fbdev: offb: replace of_node_put with __free(device_node) Krishna Kurapati <quic_kriskura(a)quicinc.com> usb: dwc3: core: Skip setting event buffers for host only controllers Gergo Koteles <soyer(a)irl.hu> platform/x86: lg-laptop: fix %s null argument warning Adrian Hunter <adrian.hunter(a)intel.com> clocksource: Make watchdog and suspend-timing multiplication overflow safe Alexander Gordeev <agordeev(a)linux.ibm.com> s390/iucv: fix receive buffer virtual vs physical address confusion Oreoluwa Babatunde <quic_obabatun(a)quicinc.com> openrisc: Call setup_memory() earlier in the init sequence NeilBrown <neilb(a)suse.de> NFS: avoid infinite loop in pnfs_update_layout. Hannes Reinecke <hare(a)suse.de> nvmet-tcp: do not continue for invalid icreq Jian Shen <shenjian15(a)huawei.com> net: hns3: add checking for vf id of mailbox Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: bnep: Fix out-of-bound access Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> usb: gadget: fsl: Increase size of name buffer for endpoints Zhiguo Niu <zhiguo.niu(a)unisoc.com> f2fs: fix to do sanity check in update_sit_entry David Sterba <dsterba(a)suse.com> btrfs: delete pointless BUG_ON check on quota root in btrfs_qgroup_account_extent() David Sterba <dsterba(a)suse.com> btrfs: change BUG_ON to assertion in tree_move_down() David Sterba <dsterba(a)suse.com> btrfs: send: handle unexpected data in header buffer in begin_cmd() David Sterba <dsterba(a)suse.com> btrfs: handle invalid root reference found in may_destroy_subvol() David Sterba <dsterba(a)suse.com> btrfs: change BUG_ON to assertion when checking for delayed_node root Michael Ellerman <mpe(a)ellerman.id.au> powerpc/boot: Only free if realloc() succeeds Li zeming <zeming(a)nfschina.com> powerpc/boot: Handle allocation failure in simple_realloc() Helge Deller <deller(a)gmx.de> parisc: Use irq_enter_rcu() to fix warning at kernel/context_tracking.c:367 Christophe Kerello <christophe.kerello(a)foss.st.com> memory: stm32-fmc2-ebi: check regmap_read return value Kees Cook <keescook(a)chromium.org> x86: Increase brk randomness entropy for 64-bit systems Li Nan <linan122(a)huawei.com> md: clean up invalid BUG_ON in md_ioctl Eric Dumazet <edumazet(a)google.com> netlink: hold nlk->cb_mutex longer in __netlink_dump_start() Martin Blumenstingl <martin.blumenstingl(a)googlemail.com> clocksource/drivers/arm_global_timer: Guard against division by zero Stefan Hajnoczi <stefanha(a)redhat.com> virtiofs: forbid newlines in tags Erico Nunes <nunes.erico(a)gmail.com> drm/lima: set gp bus_stop bit before hard reset Kees Cook <keescook(a)chromium.org> net/sun3_82586: Avoid reading past buffer in debug output Philipp Stanner <pstanner(a)redhat.com> media: drivers/media/dvb-core: copy user arrays safely Justin Tee <justin.tee(a)broadcom.com> scsi: lpfc: Initialize status local variable in lpfc_sli4_repost_sgl_list() Max Filippov <jcmvbkbc(a)gmail.com> fs: binfmt_elf_efpic: don't use missing interpreter's properties Hans Verkuil <hverkuil-cisco(a)xs4all.nl> media: pci: cx23885: check cx23885_vdev_init() return Jan Kara <jack(a)suse.cz> quota: Remove BUG_ON from dqget() Al Viro <viro(a)zeniv.linux.org.uk> fuse: fix UAF in rcu pathwalks Al Viro <viro(a)zeniv.linux.org.uk> afs: fix __afs_break_callback() / afs_drop_open_mmap() race Baokun Li <libaokun1(a)huawei.com> ext4: do not trim the group with corrupted block bitmap Daniel Wagner <dwagner(a)suse.de> nvmet-trace: avoid dereferencing pointer too early Kunwu Chan <chentao(a)kylinos.cn> powerpc/xics: Check return value of kasprintf in icp_native_map_one_cpu Ashish Mhetre <amhetre(a)nvidia.com> memory: tegra: Skip SID programming if SID registers aren't set Samuel Holland <samuel.holland(a)sifive.com> arm64: Fix KASAN random tag seed initialization Antoniu Miclaus <antoniu.miclaus(a)analog.com> hwmon: (ltc2992) Avoid division by zero Chengfeng Ye <dg573847474(a)gmail.com> IB/hfi1: Fix potential deadlock on &irq_src_lock and &dd->uctxt_lock Mukesh Sisodiya <mukesh.sisodiya(a)intel.com> wifi: iwlwifi: fw: Fix debugfs command sending Miri Korenblit <miriam.rachel.korenblit(a)intel.com> wifi: iwlwifi: abort scan when rfkill on but device enabled Andreas Gruenbacher <agruenba(a)redhat.com> gfs2: setattr_chown: Add missing initialization Mike Christie <michael.christie(a)oracle.com> scsi: spi: Fix sshdr use Hans Verkuil <hverkuil-cisco(a)xs4all.nl> media: qcom: venus: fix incorrect return value Christian Brauner <christian.brauner(a)ubuntu.com> binfmt_misc: cleanup on filesystem umount Chengfeng Ye <dg573847474(a)gmail.com> staging: ks7010: disable bh on tx_dev_lock Alex Hung <alex.hung(a)amd.com> drm/amd/display: Validate hw_points_num before using it David Lechner <dlechner(a)baylibre.com> staging: iio: resolver: ad2s1210: fix use before initialization Hans Verkuil <hverkuil-cisco(a)xs4all.nl> media: radio-isa: use dev_name to fill in bus_info Jarkko Nikula <jarkko.nikula(a)linux.intel.com> i3c: mipi-i3c-hci: Do not unmap region not mapped for transfer Jarkko Nikula <jarkko.nikula(a)linux.intel.com> i3c: mipi-i3c-hci: Remove BUG() when Ring Abort request times out Heiko Carstens <hca(a)linux.ibm.com> s390/smp,mcck: fix early IPI handling Zhu Yanjun <yanjun.zhu(a)linux.dev> RDMA/rtrs: Fix the problem of variable not initialized fully Wolfram Sang <wsa+renesas(a)sang-engineering.com> i2c: riic: avoid potential division by zero Jeff Johnson <quic_jjohnson(a)quicinc.com> wifi: cw1200: Avoid processing an invalid TIM IE Johannes Berg <johannes.berg(a)intel.com> wifi: mac80211: fix BA session teardown race Johannes Berg <johannes.berg(a)intel.com> wifi: cfg80211: check wiphy mutex is held for wdev mutex Rand Deeb <rand.sec96(a)gmail.com> ssb: Fix division by zero issue in ssb_calc_clock_rate Parsa Poorshikhian <parsa.poorsh(a)gmail.com> ALSA: hda/realtek: Fix noise from speakers on Lenovo IdeaPad 3 15IAU7 Jie Wang <wangjie125(a)huawei.com> net: hns3: fix a deadlock problem when config TC during resetting Jie Wang <wangjie125(a)huawei.com> net: hns3: fix wrong use of semaphore up Florian Westphal <fw(a)strlen.de> netfilter: nf_queue: drop packets with cloned unconfirmed conntracks Donald Hunter <donald.hunter(a)gmail.com> netfilter: flowtable: initialise extack before use Tom Hughes <tom(a)compton.nu> netfilter: allow ipv6 fragments to arrive on different devices Eugene Syromiatnikov <esyr(a)redhat.com> mptcp: correct MPTCP_SUBFLOW_ATTR_SSN_OFFSET reserved size David Thompson <davthompson(a)nvidia.com> mlxbf_gige: disable RX filters until RX path initialized Yue Haibing <yuehaibing(a)huawei.com> mlxbf_gige: Remove two unused function declarations Pawel Dembicki <paweldembicki(a)gmail.com> net: dsa: vsc73xx: check busy flag in MDIO operations Pawel Dembicki <paweldembicki(a)gmail.com> net: dsa: vsc73xx: use read_poll_timeout instead delay loop Pawel Dembicki <paweldembicki(a)gmail.com> net: dsa: vsc73xx: pass value in phy_write operation Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> net: axienet: Fix register defines comment description Dan Carpenter <dan.carpenter(a)linaro.org> atm: idt77252: prevent use after free in dequeue_rx() Cosmin Ratiu <cratiu(a)nvidia.com> net/mlx5e: Correctly report errors for ethtool rx flows Faizal Rahim <faizal.abdul.rahim(a)linux.intel.com> igc: Fix packet still tx after gate close by reducing i226 MAC retry buffer Muhammad Husaini Zulkifli <muhammad.husaini.zulkifli(a)intel.com> igc: remove I226 Qbv BaseTime restriction Muhammad Husaini Zulkifli <muhammad.husaini.zulkifli(a)intel.com> igc: Correct the launchtime offset Claudio Imbrenda <imbrenda(a)linux.ibm.com> s390/uv: Panic for set and remove shared access UVC errors Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/jpeg2: properly set atomics vmid field Al Viro <viro(a)zeniv.linux.org.uk> memcg_write_event_control(): fix a user-triggerable oops Bas Nieuwenhuizen <bas(a)basnieuwenhuizen.nl> drm/amdgpu: Actually check flags for all context ops. Qu Wenruo <wqu(a)suse.com> btrfs: tree-checker: add dev extent item checks Zhen Lei <thunder.leizhen(a)huawei.com> selinux: fix potential counting error in avc_add_xperms_decision() Al Viro <viro(a)zeniv.linux.org.uk> fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE Alexander Lobakin <aleksander.lobakin(a)intel.com> bitmap: introduce generic optimized bitmap_size() Alexander Lobakin <aleksander.lobakin(a)intel.com> btrfs: rename bitmap_set_bits() -> btrfs_bitmap_set_bits() Alexander Lobakin <aleksander.lobakin(a)intel.com> s390/cio: rename bitmap_size() -> idset_bitmap_size() Alexander Lobakin <aleksander.lobakin(a)intel.com> fs/ntfs3: add prefix to bitmap_size() and use BITS_TO_U64() Zhihao Cheng <chengzhihao1(a)huawei.com> vfs: Don't evict inode under the inode lru traversing context Mikulas Patocka <mpatocka(a)redhat.com> dm persistent data: fix memory allocation failure Khazhismel Kumykov <khazhy(a)google.com> dm resume: don't return EINVAL when signalled Haibo Xu <haibo1.xu(a)intel.com> arm64: ACPI: NUMA: initialize all values of acpi_early_node_map to NUMA_NO_NODE Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: fix error recovery leading to data corruption on ESE devices Mika Westerberg <mika.westerberg(a)linux.intel.com> thunderbolt: Mark XDomain as unplugged when router is removed Mathias Nyman <mathias.nyman(a)linux.intel.com> xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration Juan José Arboleda <soyjuanarbol(a)gmail.com> ALSA: usb-audio: Support Yamaha P-125 quirk entry Lianqin Hu <hulianqin(a)vivo.com> ALSA: usb-audio: Add delay quirk for VIVO USB-C-XE710 HEADSET Eli Billauer <eli.billauer(a)gmail.com> char: xillybus: Check USB endpoints when probing device Eli Billauer <eli.billauer(a)gmail.com> char: xillybus: Refine workqueue handling Eli Billauer <eli.billauer(a)gmail.com> char: xillybus: Don't destroy workqueue from work item running on it Jann Horn <jannh(a)google.com> fuse: Initialize beyond-EOF page contents before setting uptodate ------------- Diffstat: Makefile | 4 +- arch/arm64/kernel/acpi_numa.c | 2 +- arch/arm64/kernel/setup.c | 3 - arch/arm64/kernel/smp.c | 2 + arch/arm64/kvm/sys_regs.c | 6 + arch/arm64/kvm/vgic/vgic.h | 7 + arch/mips/kernel/cpu-probe.c | 4 + arch/mips/loongson64/reset.c | 38 ++-- arch/openrisc/kernel/setup.c | 6 +- arch/parisc/kernel/irq.c | 4 +- arch/powerpc/boot/simple_alloc.c | 7 +- arch/powerpc/sysdev/xics/icp-native.c | 2 + arch/s390/include/asm/uv.h | 5 +- arch/s390/kernel/early.c | 12 +- arch/s390/kernel/smp.c | 4 +- arch/x86/kernel/process.c | 5 +- drivers/ata/libata-core.c | 3 + drivers/atm/idt77252.c | 9 +- drivers/bluetooth/hci_ldisc.c | 3 +- drivers/char/xillybus/xillyusb.c | 42 +++- drivers/clocksource/arm_global_timer.c | 11 +- drivers/dma/dw/core.c | 89 ++++++++- drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c | 8 + drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 3 +- drivers/gpu/drm/amd/amdgpu/jpeg_v2_0.c | 4 +- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 5 +- drivers/gpu/drm/lima/lima_gp.c | 12 ++ drivers/gpu/drm/msm/disp/dpu1/dpu_kms.h | 14 +- drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c | 3 + drivers/gpu/drm/msm/dp/dp_ctrl.c | 2 + drivers/hid/hid-ids.h | 10 +- drivers/hid/hid-microsoft.c | 11 +- drivers/hid/wacom_wac.c | 4 +- drivers/hwmon/ltc2992.c | 8 +- drivers/i2c/busses/i2c-riic.c | 2 +- drivers/i3c/master/mipi-i3c-hci/dma.c | 5 +- drivers/infiniband/hw/hfi1/chip.c | 5 +- drivers/infiniband/ulp/rtrs/rtrs.c | 2 +- drivers/input/input-mt.c | 3 + drivers/irqchip/irq-gic-v3-its.c | 2 - drivers/md/dm-clone-metadata.c | 5 - drivers/md/dm-ioctl.c | 22 ++- drivers/md/dm.c | 4 +- drivers/md/md.c | 5 - drivers/md/persistent-data/dm-space-map-metadata.c | 4 +- drivers/media/dvb-core/dvb_frontend.c | 12 +- drivers/media/pci/cx23885/cx23885-video.c | 8 + drivers/media/pci/solo6x10/solo6x10-offsets.h | 10 +- drivers/media/platform/qcom/venus/pm_helpers.c | 2 +- drivers/media/radio/radio-isa.c | 2 +- drivers/memory/stm32-fmc2-ebi.c | 122 ++++++++---- drivers/memory/tegra/tegra186.c | 3 + drivers/mmc/core/mmc_test.c | 9 +- drivers/mmc/host/dw_mmc.c | 8 + drivers/net/bonding/bond_main.c | 21 +- drivers/net/bonding/bond_options.c | 2 +- drivers/net/dsa/mv88e6xxx/Makefile | 4 + drivers/net/dsa/mv88e6xxx/global1_atu.c | 82 ++++++-- drivers/net/dsa/mv88e6xxx/trace.c | 6 + drivers/net/dsa/mv88e6xxx/trace.h | 66 +++++++ drivers/net/dsa/vitesse-vsc73xx-core.c | 69 +++++-- drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c | 3 +- .../net/ethernet/freescale/dpaa2/dpaa2-switch.c | 7 +- drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 3 + .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 4 +- .../net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c | 7 +- .../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 4 +- drivers/net/ethernet/i825xx/sun3_82586.c | 2 +- drivers/net/ethernet/intel/ice/ice_txrx.c | 2 +- drivers/net/ethernet/intel/igc/igc_base.c | 29 +++ drivers/net/ethernet/intel/igc/igc_base.h | 2 + drivers/net/ethernet/intel/igc/igc_defines.h | 16 ++ drivers/net/ethernet/intel/igc/igc_main.c | 12 +- drivers/net/ethernet/intel/igc/igc_regs.h | 1 + drivers/net/ethernet/intel/igc/igc_tsn.c | 113 +++++++++-- drivers/net/ethernet/intel/igc/igc_tsn.h | 1 + .../ethernet/mellanox/mlx5/core/en_fs_ethtool.c | 2 +- .../net/ethernet/mellanox/mlxbf_gige/mlxbf_gige.h | 9 +- .../ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c | 10 + .../ethernet/mellanox/mlxbf_gige/mlxbf_gige_regs.h | 2 + .../ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c | 50 ++++- drivers/net/ethernet/microsoft/mana/hw_channel.c | 68 ++++--- drivers/net/ethernet/microsoft/mana/mana.h | 1 + drivers/net/ethernet/microsoft/mana/mana_en.c | 22 ++- drivers/net/ethernet/xilinx/xilinx_axienet.h | 17 +- drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 25 +-- drivers/net/gtp.c | 5 +- drivers/net/wireless/intel/iwlwifi/fw/debugfs.c | 6 +- drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 2 +- drivers/net/wireless/marvell/mwifiex/cfg80211.c | 32 ++- drivers/net/wireless/st/cw1200/txrx.c | 2 +- drivers/nfc/pn533/pn533.c | 5 + drivers/nvme/target/rdma.c | 16 +- drivers/nvme/target/tcp.c | 1 + drivers/nvme/target/trace.c | 6 +- drivers/nvme/target/trace.h | 28 +-- drivers/phy/xilinx/phy-zynqmp.c | 152 ++++++++++----- drivers/pinctrl/pinctrl-rockchip.c | 2 +- drivers/pinctrl/pinctrl-single.c | 2 + drivers/platform/surface/aggregator/controller.c | 3 +- drivers/platform/x86/lg-laptop.c | 2 +- drivers/s390/block/dasd.c | 36 ++-- drivers/s390/block/dasd_3990_erp.c | 10 +- drivers/s390/block/dasd_eckd.c | 57 +++--- drivers/s390/block/dasd_int.h | 2 +- drivers/s390/cio/idset.c | 12 +- drivers/scsi/aacraid/comminit.c | 2 + drivers/scsi/lpfc/lpfc_sli.c | 2 +- drivers/scsi/scsi_transport_spi.c | 4 +- drivers/soc/qcom/cmd-db.c | 2 +- drivers/soundwire/stream.c | 8 +- drivers/ssb/main.c | 2 +- drivers/staging/iio/resolver/ad2s1210.c | 7 +- drivers/staging/ks7010/ks7010_sdio.c | 4 +- drivers/thunderbolt/switch.c | 1 + drivers/usb/cdns3/cdnsp-gadget.h | 3 + drivers/usb/cdns3/cdnsp-ring.c | 30 ++- drivers/usb/class/cdc-acm.c | 3 + drivers/usb/core/sysfs.c | 1 + drivers/usb/dwc3/core.c | 21 ++ drivers/usb/dwc3/dwc3-omap.c | 4 +- drivers/usb/dwc3/dwc3-st.c | 16 +- drivers/usb/gadget/udc/fsl_udc_core.c | 2 +- drivers/usb/host/xhci.c | 8 +- drivers/usb/serial/option.c | 5 + drivers/video/fbdev/offb.c | 3 +- fs/afs/file.c | 8 +- fs/binfmt_elf_fdpic.c | 2 +- fs/binfmt_misc.c | 216 ++++++++++++++++----- fs/btrfs/delayed-inode.c | 2 +- fs/btrfs/free-space-cache.c | 8 +- fs/btrfs/inode.c | 9 +- fs/btrfs/qgroup.c | 4 +- fs/btrfs/send.c | 9 +- fs/btrfs/tree-checker.c | 69 +++++++ fs/ext4/extents.c | 3 +- fs/ext4/mballoc.c | 3 + fs/f2fs/segment.c | 5 +- fs/file.c | 28 ++- fs/fuse/cuse.c | 3 +- fs/fuse/dev.c | 6 +- fs/fuse/fuse_i.h | 1 + fs/fuse/inode.c | 15 +- fs/fuse/virtio_fs.c | 10 + fs/gfs2/inode.c | 2 +- fs/inode.c | 39 +++- fs/ksmbd/smb2pdu.c | 3 +- fs/lockd/svc.c | 3 - fs/nfs/callback.c | 3 - fs/nfs/pnfs.c | 8 + fs/nfsd/export.c | 32 ++- fs/nfsd/export.h | 4 +- fs/nfsd/netns.h | 25 ++- fs/nfsd/nfs4proc.c | 6 +- fs/nfsd/nfscache.c | 202 +++++++++++-------- fs/nfsd/nfsctl.c | 24 ++- fs/nfsd/nfsd.h | 1 + fs/nfsd/nfsfh.c | 3 +- fs/nfsd/nfssvc.c | 24 ++- fs/nfsd/stats.c | 52 ++--- fs/nfsd/stats.h | 83 +++----- fs/nfsd/trace.h | 22 +++ fs/nfsd/vfs.c | 6 +- fs/ntfs3/bitmap.c | 4 +- fs/ntfs3/fsntfs.c | 2 +- fs/ntfs3/index.c | 11 +- fs/ntfs3/ntfs_fs.h | 4 +- fs/ntfs3/super.c | 2 +- fs/quota/dquot.c | 5 +- include/linux/bitmap.h | 20 +- include/linux/blkdev.h | 2 +- include/linux/cpumask.h | 2 +- include/linux/fs.h | 5 + include/linux/pm.h | 55 ++++-- include/linux/pm_runtime.h | 14 ++ include/linux/sunrpc/svc.h | 5 +- include/net/busy_poll.h | 2 +- include/net/kcm.h | 1 + include/scsi/scsi_cmnd.h | 2 +- kernel/cgroup/cpuset.c | 13 +- kernel/time/clocksource.c | 42 ++-- kernel/time/hrtimer.c | 2 + lib/math/prime_numbers.c | 2 - mm/huge_memory.c | 30 ++- mm/memcontrol.c | 7 +- mm/memory.c | 29 ++- net/bluetooth/bnep/core.c | 3 +- net/bluetooth/hci_core.c | 19 +- net/bluetooth/mgmt.c | 4 + net/bluetooth/smp.c | 146 +++++++------- net/bridge/br_netfilter_hooks.c | 6 +- net/core/net-sysfs.c | 2 +- net/ethtool/ioctl.c | 3 + net/ipv6/ip6_output.c | 10 + net/ipv6/ip6_tunnel.c | 12 +- net/ipv6/netfilter/nf_conntrack_reasm.c | 4 + net/iucv/iucv.c | 3 +- net/kcm/kcmsock.c | 4 + net/mac80211/agg-tx.c | 6 +- net/mac80211/driver-ops.c | 3 - net/mac80211/sta_info.c | 14 ++ net/mptcp/diag.c | 2 +- net/mptcp/protocol.c | 2 +- net/netfilter/nf_flow_table_inet.c | 3 + net/netfilter/nf_flow_table_ip.c | 3 + net/netfilter/nf_flow_table_offload.c | 2 +- net/netfilter/nfnetlink_queue.c | 35 +++- net/netfilter/nft_counter.c | 9 +- net/netlink/af_netlink.c | 13 +- net/rds/recv.c | 13 +- net/sched/sch_netem.c | 47 +++-- net/sunrpc/stats.c | 2 +- net/sunrpc/svc.c | 36 ++-- net/wireless/core.h | 8 +- security/apparmor/policy_unpack_test.c | 6 +- security/selinux/avc.c | 2 +- sound/core/timer.c | 2 +- sound/pci/hda/patch_realtek.c | 1 - sound/usb/quirks-table.h | 1 + sound/usb/quirks.c | 2 + tools/include/linux/align.h | 12 ++ tools/include/linux/bitmap.h | 9 +- tools/testing/selftests/core/close_range_test.c | 35 ++++ tools/testing/selftests/tc-testing/tdc.py | 1 - 224 files changed, 2394 insertions(+), 1053 deletions(-)

1 year

8
224
0 0

[PATCH] drm: imx: ipuv3-plane: fix HDMI cannot work for odd screen resolutions

by Paul Pu

This changes the judgement of if needing to round up the width or not, from using the `dp_flow` to the plane's type. The `dp_flow` can be -22(-EINVAL) even the plane is a PRIMARY one. See `client_reg[]` in `ipu-common.c`. [ 0.605141] [drm:ipu_plane_init] channel 28, dp flow -22, possible_crtcs=0x0 Per the commit message in commit: 71f9fd5bcf09, using the plane type for judging if rounding up is needed is correct. Fixes: 71f9fd5bcf09 ("drm/imx: ipuv3-plane: Fix overlay plane width") Cc: stable(a)vger.kernel.org Signed-off-by: Paul Pu <hui.pu(a)gehealthcare.com> --- drivers/gpu/drm/imx/ipuv3/ipuv3-plane.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/imx/ipuv3/ipuv3-plane.c b/drivers/gpu/drm/imx/ipuv3/ipuv3-plane.c index 704c549750f9..cee83ac70ada 100644 --- a/drivers/gpu/drm/imx/ipuv3/ipuv3-plane.c +++ b/drivers/gpu/drm/imx/ipuv3/ipuv3-plane.c @@ -614,7 +614,7 @@ static void ipu_plane_atomic_update(struct drm_plane *plane, break; } - if (ipu_plane->dp_flow == IPU_DP_FLOW_SYNC_BG) + if (ipu_plane->base.type == DRM_PLANE_TYPE_PRIMARY) width = ipu_src_rect_width(new_state); else width = drm_rect_width(&new_state->src) >> 16; base-commit: 431c1646e1f86b949fa3685efc50b660a364c2b6 -- 2.39.2

1 year

5
11
0 0

[PATCH v5.15] virtio_net: Fix napi_skb_cache_put warning

by Shivani Agarwal

From: Breno Leitao <leitao(a)debian.org> [ Upstream commit f8321fa75102246d7415a6af441872f6637c93ab ] After the commit bdacf3e34945 ("net: Use nested-BH locking for napi_alloc_cache.") was merged, the following warning began to appear: WARNING: CPU: 5 PID: 1 at net/core/skbuff.c:1451 napi_skb_cache_put+0x82/0x4b0 __warn+0x12f/0x340 napi_skb_cache_put+0x82/0x4b0 napi_skb_cache_put+0x82/0x4b0 report_bug+0x165/0x370 handle_bug+0x3d/0x80 exc_invalid_op+0x1a/0x50 asm_exc_invalid_op+0x1a/0x20 __free_old_xmit+0x1c8/0x510 napi_skb_cache_put+0x82/0x4b0 __free_old_xmit+0x1c8/0x510 __free_old_xmit+0x1c8/0x510 __pfx___free_old_xmit+0x10/0x10 The issue arises because virtio is assuming it's running in NAPI context even when it's not, such as in the netpoll case. To resolve this, modify virtnet_poll_tx() to only set NAPI when budget is available. Same for virtnet_poll_cleantx(), which always assumed that it was in a NAPI context. Fixes: df133f3f9625 ("virtio_net: bulk free tx skbs") Suggested-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Breno Leitao <leitao(a)debian.org> Reviewed-by: Jakub Kicinski <kuba(a)kernel.org> Acked-by: Michael S. Tsirkin <mst(a)redhat.com> Acked-by: Jason Wang <jasowang(a)redhat.com> Reviewed-by: Heng Qi <hengqi(a)linux.alibaba.com> Link: https://patch.msgid.link/20240712115325.54175-1-leitao@debian.org Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> [Shivani: Modified to apply on v5.15.y] Signed-off-by: Shivani Agarwal <shivani.agarwal(a)broadcom.com> --- drivers/net/virtio_net.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c index bd0cb3a03b7b..d8138ad4f865 100644 --- a/drivers/net/virtio_net.c +++ b/drivers/net/virtio_net.c @@ -1548,7 +1548,7 @@ static bool is_xdp_raw_buffer_queue(struct virtnet_info *vi, int q) return false; } -static void virtnet_poll_cleantx(struct receive_queue *rq) +static void virtnet_poll_cleantx(struct receive_queue *rq, int budget) { struct virtnet_info *vi = rq->vq->vdev->priv; unsigned int index = vq2rxq(rq->vq); @@ -1561,7 +1561,7 @@ static void virtnet_poll_cleantx(struct receive_queue *rq) if (__netif_tx_trylock(txq)) { do { virtqueue_disable_cb(sq->vq); - free_old_xmit_skbs(sq, true); + free_old_xmit_skbs(sq, !!budget); } while (unlikely(!virtqueue_enable_cb_delayed(sq->vq))); if (sq->vq->num_free >= 2 + MAX_SKB_FRAGS) @@ -1580,7 +1580,7 @@ static int virtnet_poll(struct napi_struct *napi, int budget) unsigned int received; unsigned int xdp_xmit = 0; - virtnet_poll_cleantx(rq); + virtnet_poll_cleantx(rq, budget); received = virtnet_receive(rq, budget, &xdp_xmit); @@ -1683,7 +1683,7 @@ static int virtnet_poll_tx(struct napi_struct *napi, int budget) txq = netdev_get_tx_queue(vi->dev, index); __netif_tx_lock(txq, raw_smp_processor_id()); virtqueue_disable_cb(sq->vq); - free_old_xmit_skbs(sq, true); + free_old_xmit_skbs(sq, !!budget); if (sq->vq->num_free >= 2 + MAX_SKB_FRAGS) netif_tx_wake_queue(txq); -- 2.39.4

1 year

1
0
0 0

[PATCH v6.1] virtio_net: Fix napi_skb_cache_put warning

by Shivani Agarwal

From: Breno Leitao <leitao(a)debian.org> [ Upstream commit f8321fa75102246d7415a6af441872f6637c93ab ] After the commit bdacf3e34945 ("net: Use nested-BH locking for napi_alloc_cache.") was merged, the following warning began to appear: WARNING: CPU: 5 PID: 1 at net/core/skbuff.c:1451 napi_skb_cache_put+0x82/0x4b0 __warn+0x12f/0x340 napi_skb_cache_put+0x82/0x4b0 napi_skb_cache_put+0x82/0x4b0 report_bug+0x165/0x370 handle_bug+0x3d/0x80 exc_invalid_op+0x1a/0x50 asm_exc_invalid_op+0x1a/0x20 __free_old_xmit+0x1c8/0x510 napi_skb_cache_put+0x82/0x4b0 __free_old_xmit+0x1c8/0x510 __free_old_xmit+0x1c8/0x510 __pfx___free_old_xmit+0x10/0x10 The issue arises because virtio is assuming it's running in NAPI context even when it's not, such as in the netpoll case. To resolve this, modify virtnet_poll_tx() to only set NAPI when budget is available. Same for virtnet_poll_cleantx(), which always assumed that it was in a NAPI context. Fixes: df133f3f9625 ("virtio_net: bulk free tx skbs") Suggested-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Breno Leitao <leitao(a)debian.org> Reviewed-by: Jakub Kicinski <kuba(a)kernel.org> Acked-by: Michael S. Tsirkin <mst(a)redhat.com> Acked-by: Jason Wang <jasowang(a)redhat.com> Reviewed-by: Heng Qi <hengqi(a)linux.alibaba.com> Link: https://patch.msgid.link/20240712115325.54175-1-leitao@debian.org Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> [Shivani: Modified to apply on v6.1.y] Signed-off-by: Shivani Agarwal <shivani.agarwal(a)broadcom.com> --- drivers/net/virtio_net.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c index 61cc0ed1ddc1..e3e5107adaca 100644 --- a/drivers/net/virtio_net.c +++ b/drivers/net/virtio_net.c @@ -1638,7 +1638,7 @@ static bool is_xdp_raw_buffer_queue(struct virtnet_info *vi, int q) return false; } -static void virtnet_poll_cleantx(struct receive_queue *rq) +static void virtnet_poll_cleantx(struct receive_queue *rq, int budget) { struct virtnet_info *vi = rq->vq->vdev->priv; unsigned int index = vq2rxq(rq->vq); @@ -1656,7 +1656,7 @@ static void virtnet_poll_cleantx(struct receive_queue *rq) do { virtqueue_disable_cb(sq->vq); - free_old_xmit_skbs(sq, true); + free_old_xmit_skbs(sq, !!budget); } while (unlikely(!virtqueue_enable_cb_delayed(sq->vq))); if (sq->vq->num_free >= 2 + MAX_SKB_FRAGS) @@ -1675,7 +1675,7 @@ static int virtnet_poll(struct napi_struct *napi, int budget) unsigned int received; unsigned int xdp_xmit = 0; - virtnet_poll_cleantx(rq); + virtnet_poll_cleantx(rq, budget); received = virtnet_receive(rq, budget, &xdp_xmit); @@ -1778,7 +1778,7 @@ static int virtnet_poll_tx(struct napi_struct *napi, int budget) txq = netdev_get_tx_queue(vi->dev, index); __netif_tx_lock(txq, raw_smp_processor_id()); virtqueue_disable_cb(sq->vq); - free_old_xmit_skbs(sq, true); + free_old_xmit_skbs(sq, !!budget); if (sq->vq->num_free >= 2 + MAX_SKB_FRAGS) netif_tx_wake_queue(txq); -- 2.39.4

1 year

1
0
0 0

[PATCH RESEND] wifi: mt76: mt7921: Check devm_kasprintf() returned value

by Ma Ke

devm_kasprintf() can return a NULL pointer on failure but this returned value is not checked. Fix this lack and check the returned value. Found by code review. Cc: stable(a)vger.kernel.org Fixes: 6ae39b7c7ed4 ("wifi: mt76: mt7921: Support temp sensor") Signed-off-by: Ma Ke <make24(a)iscas.ac.cn> --- drivers/net/wireless/mediatek/mt76/mt7921/init.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/init.c b/drivers/net/wireless/mediatek/mt76/mt7921/init.c index ef0c721d26e3..5ab395d9d93e 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7921/init.c +++ b/drivers/net/wireless/mediatek/mt76/mt7921/init.c @@ -52,6 +52,8 @@ static int mt7921_thermal_init(struct mt792x_phy *phy) name = devm_kasprintf(&wiphy->dev, GFP_KERNEL, "mt7921_%s", wiphy_name(wiphy)); + if (!name) + return -ENOMEM; hwmon = devm_hwmon_device_register_with_groups(&wiphy->dev, name, phy, mt7921_hwmon_groups); -- 2.25.1

1 year

3
2
0 0

[PATCH RESEND] mt76: mt7915: check devm_kasprintf() returned value

by Ma Ke

devm_kasprintf() can return a NULL pointer on failure but this returned value is not checked. Fix this lack and check the returned value. Found by code review. Cc: stable(a)vger.kernel.org Fixes: 6ae39b7c7ed4 ("wifi: mt76: mt7921: Support temp sensor") Signed-off-by: Ma Ke <make24(a)iscas.ac.cn> --- drivers/net/wireless/mediatek/mt76/mt7915/init.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/init.c b/drivers/net/wireless/mediatek/mt76/mt7915/init.c index a978f434dc5e..7bc3b4cd3592 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7915/init.c +++ b/drivers/net/wireless/mediatek/mt76/mt7915/init.c @@ -194,6 +194,8 @@ static int mt7915_thermal_init(struct mt7915_phy *phy) name = devm_kasprintf(&wiphy->dev, GFP_KERNEL, "mt7915_%s", wiphy_name(wiphy)); + if (!name) + return -ENOMEM; cdev = thermal_cooling_device_register(name, phy, &mt7915_thermal_ops); if (!IS_ERR(cdev)) { -- 2.25.1

1 year

2
1
0 0

[PATCH v6.6] virtio_net: Fix napi_skb_cache_put warning

by Shivani Agarwal

From: Breno Leitao <leitao(a)debian.org> [ Upstream commit f8321fa75102246d7415a6af441872f6637c93ab ] After the commit bdacf3e34945 ("net: Use nested-BH locking for napi_alloc_cache.") was merged, the following warning began to appear: WARNING: CPU: 5 PID: 1 at net/core/skbuff.c:1451 napi_skb_cache_put+0x82/0x4b0 __warn+0x12f/0x340 napi_skb_cache_put+0x82/0x4b0 napi_skb_cache_put+0x82/0x4b0 report_bug+0x165/0x370 handle_bug+0x3d/0x80 exc_invalid_op+0x1a/0x50 asm_exc_invalid_op+0x1a/0x20 __free_old_xmit+0x1c8/0x510 napi_skb_cache_put+0x82/0x4b0 __free_old_xmit+0x1c8/0x510 __free_old_xmit+0x1c8/0x510 __pfx___free_old_xmit+0x10/0x10 The issue arises because virtio is assuming it's running in NAPI context even when it's not, such as in the netpoll case. To resolve this, modify virtnet_poll_tx() to only set NAPI when budget is available. Same for virtnet_poll_cleantx(), which always assumed that it was in a NAPI context. Fixes: df133f3f9625 ("virtio_net: bulk free tx skbs") Suggested-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Breno Leitao <leitao(a)debian.org> Reviewed-by: Jakub Kicinski <kuba(a)kernel.org> Acked-by: Michael S. Tsirkin <mst(a)redhat.com> Acked-by: Jason Wang <jasowang(a)redhat.com> Reviewed-by: Heng Qi <hengqi(a)linux.alibaba.com> Link: https://patch.msgid.link/20240712115325.54175-1-leitao@debian.org Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> [Shivani: Modified to apply on v6.6.y] Signed-off-by: Shivani Agarwal <shivani.agarwal(a)broadcom.com> --- drivers/net/virtio_net.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c index 51ade909c84f..bc01f2dafa94 100644 --- a/drivers/net/virtio_net.c +++ b/drivers/net/virtio_net.c @@ -2140,7 +2140,7 @@ static int virtnet_receive(struct receive_queue *rq, int budget, return packets; } -static void virtnet_poll_cleantx(struct receive_queue *rq) +static void virtnet_poll_cleantx(struct receive_queue *rq, int budget) { struct virtnet_info *vi = rq->vq->vdev->priv; unsigned int index = vq2rxq(rq->vq); @@ -2158,7 +2158,7 @@ static void virtnet_poll_cleantx(struct receive_queue *rq) do { virtqueue_disable_cb(sq->vq); - free_old_xmit_skbs(sq, true); + free_old_xmit_skbs(sq, !!budget); } while (unlikely(!virtqueue_enable_cb_delayed(sq->vq))); if (sq->vq->num_free >= 2 + MAX_SKB_FRAGS) @@ -2177,7 +2177,7 @@ static int virtnet_poll(struct napi_struct *napi, int budget) unsigned int received; unsigned int xdp_xmit = 0; - virtnet_poll_cleantx(rq); + virtnet_poll_cleantx(rq, budget); received = virtnet_receive(rq, budget, &xdp_xmit); @@ -2280,7 +2280,7 @@ static int virtnet_poll_tx(struct napi_struct *napi, int budget) txq = netdev_get_tx_queue(vi->dev, index); __netif_tx_lock(txq, raw_smp_processor_id()); virtqueue_disable_cb(sq->vq); - free_old_xmit_skbs(sq, true); + free_old_xmit_skbs(sq, !!budget); if (sq->vq->num_free >= 2 + MAX_SKB_FRAGS) netif_tx_wake_queue(txq); -- 2.39.4

1 year

1
0
0 0

[PATCH] net: drop bad gso csum_start and offset in virtio_net_hdr

by Denis Arefev

From: Willem de Bruijn <willemb(a)google.com> Tighten csum_start and csum_offset checks in virtio_net_hdr_to_skb for GSO packets. The function already checks that a checksum requested with VIRTIO_NET_HDR_F_NEEDS_CSUM is in skb linear. But for GSO packets this might not hold for segs after segmentation. Syzkaller demonstrated to reach this warning in skb_checksum_help offset = skb_checksum_start_offset(skb); ret = -EINVAL; if (WARN_ON_ONCE(offset >= skb_headlen(skb))) By injecting a TSO packet: WARNING: CPU: 1 PID: 3539 at net/core/dev.c:3284 skb_checksum_help+0x3d0/0x5b0 ip_do_fragment+0x209/0x1b20 net/ipv4/ip_output.c:774 ip_finish_output_gso net/ipv4/ip_output.c:279 [inline] __ip_finish_output+0x2bd/0x4b0 net/ipv4/ip_output.c:301 iptunnel_xmit+0x50c/0x930 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x2296/0x2c70 net/ipv4/ip_tunnel.c:813 __gre_xmit net/ipv4/ip_gre.c:469 [inline] ipgre_xmit+0x759/0xa60 net/ipv4/ip_gre.c:661 __netdev_start_xmit include/linux/netdevice.h:4850 [inline] netdev_start_xmit include/linux/netdevice.h:4864 [inline] xmit_one net/core/dev.c:3595 [inline] dev_hard_start_xmit+0x261/0x8c0 net/core/dev.c:3611 __dev_queue_xmit+0x1b97/0x3c90 net/core/dev.c:4261 packet_snd net/packet/af_packet.c:3073 [inline] The geometry of the bad input packet at tcp_gso_segment: [ 52.003050][ T8403] skb len=12202 headroom=244 headlen=12093 tailroom=0 [ 52.003050][ T8403] mac=(168,24) mac_len=24 net=(192,52) trans=244 [ 52.003050][ T8403] shinfo(txflags=0 nr_frags=1 gso(size=1552 type=3 segs=0)) [ 52.003050][ T8403] csum(0x60000c7 start=199 offset=1536 ip_summed=3 complete_sw=0 valid=0 level=0) Mitigate with stricter input validation. csum_offset: for GSO packets, deduce the correct value from gso_type. This is already done for USO. Extend it to TSO. Let UFO be: udp[46]_ufo_fragment ignores these fields and always computes the checksum in software. csum_start: finding the real offset requires parsing to the transport header. Do not add a parser, use existing segmentation parsing. Thanks to SKB_GSO_DODGY, that also catches bad packets that are hw offloaded. Again test both TSO and USO. Do not test UFO for the above reason, and do not test UDP tunnel offload. GSO packet are almost always CHECKSUM_PARTIAL. USO packets may be CHECKSUM_NONE since commit 10154dbded6d6 ("udp: Allow GSO transmit from devices with no checksum offload"), but then still these fields are initialized correctly in udp4_hwcsum/udp6_hwcsum_outgoing. So no need to test for ip_summed == CHECKSUM_PARTIAL first. This revises an existing fix mentioned in the Fixes tag, which broke small packets with GSO offload, as detected by kselftests. Link: https://syzkaller.appspot.com/bug?extid=e1db31216c789f552871 Link: https://lore.kernel.org/netdev/20240723223109.2196886-1-kuba@kernel.org Fixes: e269d79c7d35 ("net: missing check virtio") Cc: stable(a)vger.kernel.org Signed-off-by: Willem de Bruijn <willemb(a)google.com> Link: https://patch.msgid.link/20240729201108.1615114-1-willemdebruijn.kernel@gma… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> (cherry picked from commit 89add40066f9ed9abe5f7f886fe5789ff7e0c50e) --- include/linux/virtio_net.h | 22 ++++++++++++++++++++-- net/ipv4/tcp_offload.c | 3 +++ net/ipv4/udp_offload.c | 18 +++++++++++++++--- 3 files changed, 38 insertions(+), 5 deletions(-) diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h index 6047058d6703..6fe99dd3ca39 100644 --- a/include/linux/virtio_net.h +++ b/include/linux/virtio_net.h @@ -144,9 +144,27 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb, unsigned int nh_off = p_off; struct skb_shared_info *shinfo = skb_shinfo(skb); - /* UFO may not include transport header in gso_size. */ - if (gso_type & SKB_GSO_UDP) + switch (gso_type & ~SKB_GSO_TCP_ECN) { + case SKB_GSO_UDP: + /* UFO may not include transport header in gso_size. */ nh_off -= thlen; + break; + case SKB_GSO_UDP_L4: + if (!(hdr->flags & VIRTIO_NET_HDR_F_NEEDS_CSUM)) + return -EINVAL; + if (skb->csum_offset != offsetof(struct udphdr, check)) + return -EINVAL; + if (skb->len - p_off > gso_size * UDP_MAX_SEGMENTS) + return -EINVAL; + if (gso_type != SKB_GSO_UDP_L4) + return -EINVAL; + break; + case SKB_GSO_TCPV4: + case SKB_GSO_TCPV6: + if (skb->csum_offset != offsetof(struct tcphdr, check)) + return -EINVAL; + break; + } /* Kernel has a special handling for GSO_BY_FRAGS. */ if (gso_size == GSO_BY_FRAGS) diff --git a/net/ipv4/tcp_offload.c b/net/ipv4/tcp_offload.c index fc61cd3fea65..357d3be04f84 100644 --- a/net/ipv4/tcp_offload.c +++ b/net/ipv4/tcp_offload.c @@ -71,6 +71,9 @@ struct sk_buff *tcp_gso_segment(struct sk_buff *skb, if (thlen < sizeof(*th)) goto out; + if (unlikely(skb_checksum_start(skb) != skb_transport_header(skb))) + goto out; + if (!pskb_may_pull(skb, thlen)) goto out; diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c index a0b569d0085b..0407b829e481 100644 --- a/net/ipv4/udp_offload.c +++ b/net/ipv4/udp_offload.c @@ -269,13 +269,25 @@ struct sk_buff *__udp_gso_segment(struct sk_buff *gso_skb, __sum16 check; __be16 newlen; - if (skb_shinfo(gso_skb)->gso_type & SKB_GSO_FRAGLIST) - return __udp_gso_segment_list(gso_skb, features, is_ipv6); - mss = skb_shinfo(gso_skb)->gso_size; if (gso_skb->len <= sizeof(*uh) + mss) return ERR_PTR(-EINVAL); + if (unlikely(skb_checksum_start(gso_skb) != + skb_transport_header(gso_skb) && + !(skb_shinfo(gso_skb)->gso_type & SKB_GSO_FRAGLIST))) + return ERR_PTR(-EINVAL); + + if (skb_gso_ok(gso_skb, features | NETIF_F_GSO_ROBUST)) { + /* Packet is from an untrusted source, reset gso_segs. */ + skb_shinfo(gso_skb)->gso_segs = DIV_ROUND_UP(gso_skb->len - sizeof(*uh), + mss); + return NULL; + } + + if (skb_shinfo(gso_skb)->gso_type & SKB_GSO_FRAGLIST) + return __udp_gso_segment_list(gso_skb, features, is_ipv6); + skb_pull(gso_skb, sizeof(*uh)); /* clear destructor to avoid skb_segment assigning it to tail */ -- 2.20.1

1 year

1
0
0 0

[PATCH 6.1 00/71] 6.1.108-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.1.108 release. There are 71 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Tue, 03 Sep 2024 16:07:34 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.108-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.1.108-rc1 Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> fbdev: offb: fix up missing cleanup.h Guenter Roeck <linux(a)roeck-us.net> apparmor: fix policy_unpack_test on big endian systems Ben Hutchings <benh(a)debian.org> scsi: aacraid: Fix double-free on probe failure Faizal Rahim <faizal.abdul.rahim(a)linux.intel.com> igc: Fix qbv tx latency by setting gtxoffset Faizal Rahim <faizal.abdul.rahim(a)linux.intel.com> igc: Fix reset adapter logics when tx mode change Sean Anderson <sean.anderson(a)linux.dev> phy: zynqmp: Enable reference clock correctly Pawel Laszczak <pawell(a)cadence.com> usb: cdnsp: fix for Link TRB with TC Pawel Laszczak <pawell(a)cadence.com> usb: cdnsp: fix incorrect index in cdnsp_get_hw_deq function Zijun Hu <quic_zijuhu(a)quicinc.com> usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in remove_power_attributes() Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> usb: dwc3: st: add missing depopulate in probe error path Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> usb: dwc3: st: fix probed platform device ref count on probe error path Selvarasu Ganesan <selvarasu.g(a)samsung.com> usb: dwc3: core: Prevent USB core invalid event buffer address access Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> usb: dwc3: omap: add missing depopulate in probe error path ZHANG Yuntian <yt(a)radxa.com> USB: serial: option: add MeiG Smart SRM825L Ian Ray <ian.ray(a)gehealthcare.com> cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller Volodymyr Babchuk <Volodymyr_Babchuk(a)epam.com> soc: qcom: cmd-db: Map shared memory as WC, not WB Aleksandr Mishin <amishin(a)t-argos.ru> nfc: pn533: Add poll mod list filling check Eric Dumazet <edumazet(a)google.com> net: busy-poll: use ktime_get_ns() instead of local_clock() Ma Ke <make24(a)iscas.ac.cn> drm/amd/display: avoid using null object of framebuffer Ondrej Mosnacek <omosnace(a)redhat.com> sctp: fix association labeling in the duplicate COOKIE-ECHO case Cong Wang <cong.wang(a)bytedance.com> gtp: fix a potential NULL pointer dereference Jianbo Liu <jianbol(a)nvidia.com> bonding: implement xdo_dev_state_free and call it after deletion Petr Machata <petrm(a)nvidia.com> selftests: forwarding: local_termination: Down ports on cleanup Petr Machata <petrm(a)nvidia.com> selftests: forwarding: no_forwarding: Down ports on cleanup Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables_ipv6: consider network offset in netdev/egress validation Jamie Bainbridge <jamie.bainbridge(a)gmail.com> ethtool: check device is present when getting link settings Anjaneyulu <pagadala.yesu.anjaneyulu(a)intel.com> wifi: iwlwifi: fw: fix wgds rev 3 exact size Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: restore IP sanity checks for netdev/egress Jason Gunthorpe <jgg(a)ziepe.ca> iommu: Do not return 0 from map_pages if it doesn't do anything Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_core: Fix not handling hibernation actions Serge Semin <fancer.lancer(a)gmail.com> dmaengine: dw: Add memory bus width verification Serge Semin <fancer.lancer(a)gmail.com> dmaengine: dw: Add peripheral bus width verification Piyush Mehta <piyush.mehta(a)amd.com> phy: xilinx: phy-zynqmp: Fix SGMII linkup failure on resume Piyush Mehta <piyush.mehta(a)amd.com> phy: xilinx: phy-zynqmp: dynamic clock support for power-save Piyush Mehta <piyush.mehta(a)amd.com> phy: xilinx: add runtime PM support Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> soundwire: stream: fix programming slave ports for non-continous port maps Filipe Manana <fdmanana(a)suse.com> btrfs: fix extent map use-after-free when adding pages to compressed bio David Howells <dhowells(a)redhat.com> mm: Fix missing folio invalidation calls during truncation Nícolas F. R. A. Prado <nfraprado(a)collabora.com> pinctrl: mediatek: common-v2: Fix broken bias-disable for PULL_PU_PD_RSEL_TYPE Vijendar Mukunda <Vijendar.Mukunda(a)amd.com> ASoC: SOF: amd: Fix for acp init sequence Yuntao Liu <liuyuntao12(a)huawei.com> ASoC: amd: acp: fix module autoloading Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> thermal: of: Fix OF node leak in of_thermal_zone_find() error paths Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> thermal: of: Fix OF node leak in thermal_of_trips_init() error path Jonathan Cameron <Jonathan.Cameron(a)huawei.com> of: Introduce for_each_*_child_of_node_scoped() to automate of_node_put() handling Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: check add_addr_accept_max before accepting new ADD_ADDR Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: only mark 'subflow' endp as available Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: remove mptcp_pm_remove_subflow() Geliang Tang <geliang.tang(a)suse.com> mptcp: unify pm get_local_id interfaces Mengqi Zhang <mengqi.zhang(a)mediatek.com> mmc: mtk-sd: receive cmd8 data when hs400 tuning fail ChanWoo Lee <cw9316.lee(a)samsung.com> mmc: Avoid open coding by using mmc_op_tuning() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: fix up incorrectly backported "usb: typec: tcpm: unregister existing source caps before re-registration" Niklas Cassel <cassel(a)kernel.org> ata: libata-core: Fix null pointer dereference on error Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/swsmu: always force a state reprogram on init Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu: align pp_power_profile_mode with kernel docs Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR 0 is not a new address Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: do not remove already closed subflows Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: send ACK on an active subflow Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: reset MPC endp ID when re-added Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: skip connecting to already established sf Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: sched: check both backup in retrans Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: close subflow when receiving TCP+FIN Haiyang Zhang <haiyangz(a)microsoft.com> net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response Sascha Hauer <s.hauer(a)pengutronix.de> wifi: mwifiex: duplicate static structs used in driver instances Alexander Sverdlin <alexander.sverdlin(a)siemens.com> wifi: wfx: repair open network AP mode Jonathan Cameron <Jonathan.Cameron(a)huawei.com> of: Add cleanup.h based auto release via __free(device_node) markings Ma Ke <make24(a)iscas.ac.cn> pinctrl: single: fix potential NULL dereference in pcs_get_function() Huang-Huang Bao <i(a)eh5.me> pinctrl: rockchip: correct RK3328 iomux width flag for GPIO2-B pins Stefan Metzmacher <metze(a)samba.org> smb/client: avoid dereferencing rdata=NULL in smb2_new_read_req() Josef Bacik <josef(a)toxicpanda.com> btrfs: run delayed iputs when flushing delalloc Miao Wang <shankerwangmiao(a)gmail.com> LoongArch: Remove the unused dma-direct.h Jesse Zhang <jesse.zhang(a)amd.com> drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc ------------- Diffstat: Makefile | 4 +- arch/loongarch/include/asm/dma-direct.h | 11 -- drivers/ata/libata-core.c | 3 + drivers/dma/dw/core.c | 89 +++++++++++- drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 3 +- .../drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c | 9 +- drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 21 +-- drivers/iommu/io-pgtable-arm-v7s.c | 3 +- drivers/iommu/io-pgtable-arm.c | 3 +- drivers/iommu/io-pgtable-dart.c | 3 +- drivers/mmc/core/core.c | 3 +- drivers/mmc/host/dw_mmc.c | 3 +- drivers/mmc/host/mtk-sd.c | 14 +- drivers/mmc/host/sdhci-msm.c | 3 +- drivers/mmc/host/sdhci-pci-o2micro.c | 3 +- drivers/mmc/host/sdhci-tegra.c | 8 +- drivers/mmc/host/sdhci.c | 9 +- drivers/net/bonding/bond_main.c | 36 +++++ drivers/net/ethernet/intel/igc/igc_tsn.c | 9 +- drivers/net/ethernet/microsoft/mana/hw_channel.c | 68 ++++----- drivers/net/gtp.c | 2 +- drivers/net/wireless/intel/iwlwifi/fw/acpi.c | 13 +- drivers/net/wireless/marvell/mwifiex/cfg80211.c | 32 ++++- drivers/net/wireless/silabs/wfx/sta.c | 5 +- drivers/nfc/pn533/pn533.c | 5 + drivers/phy/xilinx/phy-zynqmp.c | 152 ++++++++++++++------- drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c | 55 ++++---- drivers/pinctrl/pinctrl-rockchip.c | 2 +- drivers/pinctrl/pinctrl-single.c | 2 + drivers/scsi/aacraid/comminit.c | 2 + drivers/soc/qcom/cmd-db.c | 2 +- drivers/soundwire/stream.c | 8 +- drivers/thermal/thermal_of.c | 17 +-- drivers/usb/cdns3/cdnsp-gadget.h | 3 + drivers/usb/cdns3/cdnsp-ring.c | 30 +++- drivers/usb/class/cdc-acm.c | 3 + drivers/usb/core/sysfs.c | 1 + drivers/usb/dwc3/core.c | 8 ++ drivers/usb/dwc3/dwc3-omap.c | 4 +- drivers/usb/dwc3/dwc3-st.c | 16 +-- drivers/usb/serial/option.c | 5 + drivers/usb/typec/tcpm/tcpm.c | 14 +- drivers/video/fbdev/offb.c | 1 + fs/btrfs/compression.c | 2 +- fs/btrfs/qgroup.c | 2 + fs/smb/client/smb2pdu.c | 2 +- include/linux/of.h | 15 ++ include/net/busy_poll.h | 2 +- include/net/netfilter/nf_tables_ipv4.h | 10 +- include/net/netfilter/nf_tables_ipv6.h | 5 +- mm/truncate.c | 4 +- net/bluetooth/hci_core.c | 10 +- net/core/net-sysfs.c | 2 +- net/ethtool/ioctl.c | 3 + net/mptcp/pm.c | 32 +++-- net/mptcp/pm_netlink.c | 110 ++++++++------- net/mptcp/protocol.c | 7 +- net/mptcp/protocol.h | 7 +- net/mptcp/subflow.c | 8 +- net/sctp/sm_statefuns.c | 22 ++- security/apparmor/policy_unpack_test.c | 6 +- sound/soc/amd/acp/acp-legacy-mach.c | 2 + sound/soc/sof/amd/acp.c | 19 ++- sound/soc/sof/amd/acp.h | 7 +- .../selftests/net/forwarding/local_termination.sh | 4 + .../selftests/net/forwarding/no_forwarding.sh | 3 + 66 files changed, 653 insertions(+), 318 deletions(-)

1 year

8
78
0 0

[merged mm-stable] mm-krealloc-consider-spare-memory-for-__gfp_zero.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: mm: krealloc: consider spare memory for __GFP_ZERO has been removed from the -mm tree. Its filename was mm-krealloc-consider-spare-memory-for-__gfp_zero.patch This patch was dropped because it was merged into the mm-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Danilo Krummrich <dakr(a)kernel.org> Subject: mm: krealloc: consider spare memory for __GFP_ZERO Date: Tue, 13 Aug 2024 00:34:34 +0200 As long as krealloc() is called with __GFP_ZERO consistently, starting with the initial memory allocation, __GFP_ZERO should be fully honored. However, if for an existing allocation krealloc() is called with a decreased size, it is not ensured that the spare portion the allocation is zeroed. Thus, if krealloc() is subsequently called with a larger size again, __GFP_ZERO can't be fully honored, since we don't know the previous size, but only the bucket size. Example: buf = kzalloc(64, GFP_KERNEL); memset(buf, 0xff, 64); buf = krealloc(buf, 48, GFP_KERNEL | __GFP_ZERO); /* After this call the last 16 bytes are still 0xff. */ buf = krealloc(buf, 64, GFP_KERNEL | __GFP_ZERO); Fix this, by explicitly setting spare memory to zero, when shrinking an allocation with __GFP_ZERO flag set or init_on_alloc enabled. Link: https://lkml.kernel.org/r/20240812223707.32049-1-dakr@kernel.org Signed-off-by: Danilo Krummrich <dakr(a)kernel.org> Acked-by: Vlastimil Babka <vbabka(a)suse.cz> Acked-by: David Rientjes <rientjes(a)google.com> Cc: Christoph Lameter <cl(a)linux.com> Cc: Hyeonggon Yoo <42.hyeyoo(a)gmail.com> Cc: Joonsoo Kim <iamjoonsoo.kim(a)lge.com> Cc: Pekka Enberg <penberg(a)kernel.org> Cc: Roman Gushchin <roman.gushchin(a)linux.dev> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/slab_common.c | 7 +++++++ 1 file changed, 7 insertions(+) --- a/mm/slab_common.c~mm-krealloc-consider-spare-memory-for-__gfp_zero +++ a/mm/slab_common.c @@ -1273,6 +1273,13 @@ __do_krealloc(const void *p, size_t new_ /* If the object still fits, repoison it precisely. */ if (ks >= new_size) { + /* Zero out spare memory. */ + if (want_init_on_alloc(flags)) { + kasan_disable_current(); + memset((void *)p + new_size, 0, ks - new_size); + kasan_enable_current(); + } + p = kasan_krealloc((void *)p, new_size, flags); return (void *)p; } _ Patches currently in -mm which might be from dakr(a)kernel.org are

1 year

1
0
0 0

[PATCH] drm: imx: ipuv3-plane: fix HDMI cannot work for odd screen resolutions

by Paul Pu

This changes the judgement of if needing to round up the width or not, from using the `dp_flow` to the plane's type. The `dp_flow` can be -22(-EINVAL) even the plane is a PRIMARY one. See `client_reg[]` in `ipu-common.c`. [ 0.605141] [drm:ipu_plane_init] channel 28, dp flow -22, possible_crtcs=0x0 Per the commit message in commit: 71f9fd5bcf09, using the plane type for judging if rounding up is needed is correct. Fixes: 71f9fd5bcf09 ("drm/imx: ipuv3-plane: Fix overlay plane width") Cc: stable(a)vger.kernel.org Signed-off-by: Paul Pu <hui.pu(a)gehealthcare.com> --- drivers/gpu/drm/imx/ipuv3/ipuv3-plane.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/imx/ipuv3/ipuv3-plane.c b/drivers/gpu/drm/imx/ipuv3/ipuv3-plane.c index 704c549750f9..cee83ac70ada 100644 --- a/drivers/gpu/drm/imx/ipuv3/ipuv3-plane.c +++ b/drivers/gpu/drm/imx/ipuv3/ipuv3-plane.c @@ -614,7 +614,7 @@ static void ipu_plane_atomic_update(struct drm_plane *plane, break; } - if (ipu_plane->dp_flow == IPU_DP_FLOW_SYNC_BG) + if (ipu_plane->base.type == DRM_PLANE_TYPE_PRIMARY) width = ipu_src_rect_width(new_state); else width = drm_rect_width(&new_state->src) >> 16; base-commit: 431c1646e1f86b949fa3685efc50b660a364c2b6 -- 2.39.2

1 year

1
0
0 0

[PATCH] usb: gadget: dummy_hcd: execute hrtimer callback in softirq context

by andrey.konovalov＠linux.dev

From: Andrey Konovalov <andreyknvl(a)gmail.com> Commit a7f3813e589f ("usb: gadget: dummy_hcd: Switch to hrtimer transfer scheduler") switched dummy_hcd to use hrtimer and made the timer's callback be executed in the hardirq context. With that change, __usb_hcd_giveback_urb now gets executed in the hardirq context, which causes problems for KCOV and KMSAN. One problem is that KCOV now is unable to collect coverage from the USB code that gets executed from the dummy_hcd's timer callback, as KCOV cannot collect coverage in the hardirq context. Another problem is that the dummy_hcd hrtimer might get triggered in the middle of a softirq with KCOV remote coverage collection enabled, and that causes a WARNING in KCOV, as reported by syzbot. (I sent a separate patch to shut down this WARNING, but that doesn't fix the other two issues.) Finally, KMSAN appears to ignore tracking memory copying operations that happen in the hardirq context, which causes false positive kernel-infoleaks, as reported by syzbot. Change the hrtimer in dummy_hcd to execute the callback in the softirq context. Reported-by: syzbot+2388cdaeb6b10f0c13ac(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=2388cdaeb6b10f0c13ac Reported-by: syzbot+17ca2339e34a1d863aad(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=17ca2339e34a1d863aad Fixes: a7f3813e589f ("usb: gadget: dummy_hcd: Switch to hrtimer transfer scheduler") Cc: stable(a)vger.kernel.org Signed-off-by: Andrey Konovalov <andreyknvl(a)gmail.com> --- Marcello, would this change be acceptable for your use case? If we wanted to keep the hardirq hrtimer, we would need teach KCOV to collect coverage in the hardirq context (or disable it, which would be unfortunate) and also fix whatever is wrong with KMSAN, but all that requires some work. --- drivers/usb/gadget/udc/dummy_hcd.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c index f37b0d8386c1a..ff7bee78bcc49 100644 --- a/drivers/usb/gadget/udc/dummy_hcd.c +++ b/drivers/usb/gadget/udc/dummy_hcd.c @@ -1304,7 +1304,8 @@ static int dummy_urb_enqueue( /* kick the scheduler, it'll do the rest */ if (!hrtimer_active(&dum_hcd->timer)) - hrtimer_start(&dum_hcd->timer, ns_to_ktime(DUMMY_TIMER_INT_NSECS), HRTIMER_MODE_REL); + hrtimer_start(&dum_hcd->timer, ns_to_ktime(DUMMY_TIMER_INT_NSECS), + HRTIMER_MODE_REL_SOFT); done: spin_unlock_irqrestore(&dum_hcd->dum->lock, flags); @@ -1325,7 +1326,7 @@ static int dummy_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status) rc = usb_hcd_check_unlink_urb(hcd, urb, status); if (!rc && dum_hcd->rh_state != DUMMY_RH_RUNNING && !list_empty(&dum_hcd->urbp_list)) - hrtimer_start(&dum_hcd->timer, ns_to_ktime(0), HRTIMER_MODE_REL); + hrtimer_start(&dum_hcd->timer, ns_to_ktime(0), HRTIMER_MODE_REL_SOFT); spin_unlock_irqrestore(&dum_hcd->dum->lock, flags); return rc; @@ -1995,7 +1996,8 @@ static enum hrtimer_restart dummy_timer(struct hrtimer *t) dum_hcd->udev = NULL; } else if (dum_hcd->rh_state == DUMMY_RH_RUNNING) { /* want a 1 msec delay here */ - hrtimer_start(&dum_hcd->timer, ns_to_ktime(DUMMY_TIMER_INT_NSECS), HRTIMER_MODE_REL); + hrtimer_start(&dum_hcd->timer, ns_to_ktime(DUMMY_TIMER_INT_NSECS), + HRTIMER_MODE_REL_SOFT); } spin_unlock_irqrestore(&dum->lock, flags); @@ -2389,7 +2391,7 @@ static int dummy_bus_resume(struct usb_hcd *hcd) dum_hcd->rh_state = DUMMY_RH_RUNNING; set_link_state(dum_hcd); if (!list_empty(&dum_hcd->urbp_list)) - hrtimer_start(&dum_hcd->timer, ns_to_ktime(0), HRTIMER_MODE_REL); + hrtimer_start(&dum_hcd->timer, ns_to_ktime(0), HRTIMER_MODE_REL_SOFT); hcd->state = HC_STATE_RUNNING; } spin_unlock_irq(&dum_hcd->dum->lock); @@ -2467,7 +2469,7 @@ static DEVICE_ATTR_RO(urbs); static int dummy_start_ss(struct dummy_hcd *dum_hcd) { - hrtimer_init(&dum_hcd->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL); + hrtimer_init(&dum_hcd->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL_SOFT); dum_hcd->timer.function = dummy_timer; dum_hcd->rh_state = DUMMY_RH_RUNNING; dum_hcd->stream_en_ep = 0; @@ -2497,7 +2499,7 @@ static int dummy_start(struct usb_hcd *hcd) return dummy_start_ss(dum_hcd); spin_lock_init(&dum_hcd->dum->lock); - hrtimer_init(&dum_hcd->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL); + hrtimer_init(&dum_hcd->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL_SOFT); dum_hcd->timer.function = dummy_timer; dum_hcd->rh_state = DUMMY_RH_RUNNING; -- 2.25.1

1 year

6
8
0 0

[PATCH RESEND] usb: gadget: dummy_hcd: execute hrtimer callback in softirq context

by andrey.konovalov＠linux.dev

From: Andrey Konovalov <andreyknvl(a)gmail.com> Commit a7f3813e589f ("usb: gadget: dummy_hcd: Switch to hrtimer transfer scheduler") switched dummy_hcd to use hrtimer and made the timer's callback be executed in the hardirq context. With that change, __usb_hcd_giveback_urb now gets executed in the hardirq context, which causes problems for KCOV and KMSAN. One problem is that KCOV now is unable to collect coverage from the USB code that gets executed from the dummy_hcd's timer callback, as KCOV cannot collect coverage in the hardirq context. Another problem is that the dummy_hcd hrtimer might get triggered in the middle of a softirq with KCOV remote coverage collection enabled, and that causes a WARNING in KCOV, as reported by syzbot. (I sent a separate patch to shut down this WARNING, but that doesn't fix the other two issues.) Finally, KMSAN appears to ignore tracking memory copying operations that happen in the hardirq context, which causes false positive kernel-infoleaks, as reported by syzbot. Change the hrtimer in dummy_hcd to execute the callback in the softirq context. Reported-by: syzbot+2388cdaeb6b10f0c13ac(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=2388cdaeb6b10f0c13ac Reported-by: syzbot+17ca2339e34a1d863aad(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=17ca2339e34a1d863aad Reported-by: syzbot+c793a7eca38803212c61(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=c793a7eca38803212c61 Reported-by: syzbot+1e6e0b916b211bee1bd6(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=1e6e0b916b211bee1bd6 Reported-by: kernel test robot <oliver.sang(a)intel.com> Closes: https://lore.kernel.org/oe-lkp/202406141323.413a90d2-lkp@intel.com Fixes: a7f3813e589f ("usb: gadget: dummy_hcd: Switch to hrtimer transfer scheduler") Cc: stable(a)vger.kernel.org Acked-by: Marcello Sylvester Bauer <sylv(a)sylv.io> Signed-off-by: Andrey Konovalov <andreyknvl(a)gmail.com> --- No difference to v1 except a few more tags. --- drivers/usb/gadget/udc/dummy_hcd.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c index f37b0d8386c1a..ff7bee78bcc49 100644 --- a/drivers/usb/gadget/udc/dummy_hcd.c +++ b/drivers/usb/gadget/udc/dummy_hcd.c @@ -1304,7 +1304,8 @@ static int dummy_urb_enqueue( /* kick the scheduler, it'll do the rest */ if (!hrtimer_active(&dum_hcd->timer)) - hrtimer_start(&dum_hcd->timer, ns_to_ktime(DUMMY_TIMER_INT_NSECS), HRTIMER_MODE_REL); + hrtimer_start(&dum_hcd->timer, ns_to_ktime(DUMMY_TIMER_INT_NSECS), + HRTIMER_MODE_REL_SOFT); done: spin_unlock_irqrestore(&dum_hcd->dum->lock, flags); @@ -1325,7 +1326,7 @@ static int dummy_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status) rc = usb_hcd_check_unlink_urb(hcd, urb, status); if (!rc && dum_hcd->rh_state != DUMMY_RH_RUNNING && !list_empty(&dum_hcd->urbp_list)) - hrtimer_start(&dum_hcd->timer, ns_to_ktime(0), HRTIMER_MODE_REL); + hrtimer_start(&dum_hcd->timer, ns_to_ktime(0), HRTIMER_MODE_REL_SOFT); spin_unlock_irqrestore(&dum_hcd->dum->lock, flags); return rc; @@ -1995,7 +1996,8 @@ static enum hrtimer_restart dummy_timer(struct hrtimer *t) dum_hcd->udev = NULL; } else if (dum_hcd->rh_state == DUMMY_RH_RUNNING) { /* want a 1 msec delay here */ - hrtimer_start(&dum_hcd->timer, ns_to_ktime(DUMMY_TIMER_INT_NSECS), HRTIMER_MODE_REL); + hrtimer_start(&dum_hcd->timer, ns_to_ktime(DUMMY_TIMER_INT_NSECS), + HRTIMER_MODE_REL_SOFT); } spin_unlock_irqrestore(&dum->lock, flags); @@ -2389,7 +2391,7 @@ static int dummy_bus_resume(struct usb_hcd *hcd) dum_hcd->rh_state = DUMMY_RH_RUNNING; set_link_state(dum_hcd); if (!list_empty(&dum_hcd->urbp_list)) - hrtimer_start(&dum_hcd->timer, ns_to_ktime(0), HRTIMER_MODE_REL); + hrtimer_start(&dum_hcd->timer, ns_to_ktime(0), HRTIMER_MODE_REL_SOFT); hcd->state = HC_STATE_RUNNING; } spin_unlock_irq(&dum_hcd->dum->lock); @@ -2467,7 +2469,7 @@ static DEVICE_ATTR_RO(urbs); static int dummy_start_ss(struct dummy_hcd *dum_hcd) { - hrtimer_init(&dum_hcd->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL); + hrtimer_init(&dum_hcd->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL_SOFT); dum_hcd->timer.function = dummy_timer; dum_hcd->rh_state = DUMMY_RH_RUNNING; dum_hcd->stream_en_ep = 0; @@ -2497,7 +2499,7 @@ static int dummy_start(struct usb_hcd *hcd) return dummy_start_ss(dum_hcd); spin_lock_init(&dum_hcd->dum->lock); - hrtimer_init(&dum_hcd->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL); + hrtimer_init(&dum_hcd->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL_SOFT); dum_hcd->timer.function = dummy_timer; dum_hcd->rh_state = DUMMY_RH_RUNNING; -- 2.25.1

1 year

1
0
0 0

[PATCH] ASoC: rt5682: Return devm_of_clk_add_hw_provider to transfer the error

by Ma Ke

Return devm_of_clk_add_hw_provider() in order to transfer the error, if it fails due to resource allocation failure or device tree clock provider registration failure. Cc: stable(a)vger.kernel.org Fixes: ebbfabc16d23 ("ASoC: rt5682: Add CCF usage for providing I2S clks") Signed-off-by: Ma Ke <make24(a)iscas.ac.cn> --- sound/soc/codecs/rt5682.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/sound/soc/codecs/rt5682.c b/sound/soc/codecs/rt5682.c index e3aca9c785a0..aa163ec40862 100644 --- a/sound/soc/codecs/rt5682.c +++ b/sound/soc/codecs/rt5682.c @@ -2903,8 +2903,10 @@ int rt5682_register_dai_clks(struct rt5682_priv *rt5682) } if (dev->of_node) { - devm_of_clk_add_hw_provider(dev, of_clk_hw_simple_get, + ret = devm_of_clk_add_hw_provider(dev, of_clk_hw_simple_get, dai_clk_hw); + if (ret) + return ret; } else { ret = devm_clk_hw_register_clkdev(dev, dai_clk_hw, init.name, -- 2.25.1

1 year

2
1
0 0

[PATCH 6.6 000/166] 6.6.8-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.6.8 release. There are 166 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 20 Dec 2023 13:50:31 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.8-rc1.… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.6.8-rc1 Patrisious Haddad <phaddad(a)nvidia.com> RDMA/mlx5: Change the key being sent for MPV device affiliation Fangrui Song <maskray(a)google.com> x86/speculation, objtool: Use absolute relocations for annotations Steven Rostedt (Google) <rostedt(a)goodmis.org> ring-buffer: Have rb_time_cmpxchg() set the msb counter too Steven Rostedt (Google) <rostedt(a)goodmis.org> ring-buffer: Do not try to put back write_stamp Steven Rostedt (Google) <rostedt(a)goodmis.org> ring-buffer: Fix a race in rb_time_cmpxchg() for 32 bit archs Steven Rostedt (Google) <rostedt(a)goodmis.org> ring-buffer: Fix writing to the buffer with max_data_size Steven Rostedt (Google) <rostedt(a)goodmis.org> ring-buffer: Have saved event hold the entire event Steven Rostedt (Google) <rostedt(a)goodmis.org> ring-buffer: Do not update before stamp when switching sub-buffers Steven Rostedt (Google) <rostedt(a)goodmis.org> tracing: Update snapshot buffer on resize if it is allocated Steven Rostedt (Google) <rostedt(a)goodmis.org> ring-buffer: Fix memory leak of free page Paulo Alcantara <pc(a)manguebit.com> smb: client: fix OOB in smb2_query_reparse_point() Paulo Alcantara <pc(a)manguebit.com> smb: client: fix NULL deref in asn1_ber_decoder() Paulo Alcantara <pc(a)manguebit.com> smb: client: fix potential OOBs in smb2_parse_contexts() Paulo Alcantara <pc(a)manguebit.com> smb: client: fix OOB in receive_encrypted_standard() Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915: Fix remapped stride with CCS on ADL+ Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915: Fix intel_atomic_setup_scalers() plane_state handling Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915: Fix ADL+ tiled plane stride when the POT stride is smaller than the original Mario Limonciello <mario.limonciello(a)amd.com> drm/amd/display: Disable PSR-SU on Parade 0803 TCON again Mario Limonciello <mario.limonciello(a)amd.com> drm/amd/display: Restore guard against default backlight value < 1 nit Jani Nikula <jani.nikula(a)intel.com> drm/edid: also call add modes in EDID connector update fallback Christian König <christian.koenig(a)amd.com> drm/amdgpu: fix tear down order in amdgpu_vm_pt_free Boris Burkov <boris(a)bur.io> btrfs: don't clear qgroup reserved bit in release_folio Boris Burkov <boris(a)bur.io> btrfs: fix qgroup_free_reserved_data int overflow Boris Burkov <boris(a)bur.io> btrfs: free qgroup reserve when ORDERED_IOERR is set Ignat Korchagin <ignat(a)cloudflare.com> kexec: drop dependency on ARCH_SUPPORTS_KEXEC from CRASH_DUMP David Stevens <stevensd(a)chromium.org> mm/shmem: fix race in shmem_undo_range w/THP Yu Zhao <yuzhao(a)google.com> mm/mglru: reclaim offlined memcgs harder Yu Zhao <yuzhao(a)google.com> mm/mglru: respect min_ttl_ms with memcgs Yu Zhao <yuzhao(a)google.com> mm/mglru: try to stop at high watermarks Yu Zhao <yuzhao(a)google.com> mm/mglru: fix underprotected page cache Frank Li <Frank.Li(a)nxp.com> dmaengine: fsl-edma: fix DMA channel leak in eDMAv4 Amelie Delaunay <amelie.delaunay(a)foss.st.com> dmaengine: stm32-dma: avoid bitfield overflow assertion Stuart Lee <stuart.lee(a)mediatek.com> drm/mediatek: Fix access violation in mtk_drm_crtc_dma_dev_get Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/sdma5.2: add begin/end_use ring callbacks Florent Revest <revest(a)chromium.org> team: Fix use-after-free when an option instance allocation fails James Houghton <jthoughton(a)google.com> arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify John Hubbard <jhubbard(a)nvidia.com> Revert "selftests: error out if kernel header files are not yet built" Baokun Li <libaokun1(a)huawei.com> ext4: prevent the normalized size from exceeding EXT_MAX_BLOCKS Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> soundwire: stream: fix NULL pointer dereference for multi_link Dan Williams <dan.j.williams(a)intel.com> cxl/hdm: Fix dpa translation locking Josef Bacik <josef(a)toxicpanda.com> btrfs: do not allow non subvolume root targets for snapshot Mark Rutland <mark.rutland(a)arm.com> perf: Fix perf_event_validate_size() lockdep splat Denis Benato <benato.denis96(a)gmail.com> HID: hid-asus: add const to read-only outgoing usb buffer Masahiro Yamada <masahiroy(a)kernel.org> arm64: add dependency between vmlinuz.efi and Image Paulo Alcantara <pc(a)manguebit.com> smb: client: set correct file type from NFS reparse points Paulo Alcantara <pc(a)manguebit.com> smb: client: introduce ->parse_reparse_point() Paulo Alcantara <pc(a)manguebit.com> smb: client: implement ->query_reparse_point() for SMB1 Lech Perczak <lech.perczak(a)gmail.com> net: usb: qmi_wwan: claim interface 4 for ZTE MF290 Steven Rostedt (Google) <rostedt(a)goodmis.org> eventfs: Do not allow NULL parent to eventfs_start_creating() Linus Torvalds <torvalds(a)linux-foundation.org> asm-generic: qspinlock: fix queued_spin_value_unlocked() implementation Heiko Carstens <hca(a)linux.ibm.com> scripts/checkstack.pl: match all stack sizes for s390 Nguyen Dinh Phi <phind.uet(a)gmail.com> nfc: virtual_ncidev: Add variable to check if ndev is running Aoba K <nexp_0x17(a)outlook.com> HID: multitouch: Add quirk for HONOR GLO-GXXX touchpad Denis Benato <benato.denis96(a)gmail.com> HID: hid-asus: reset the backlight brightness level on resume Li Nan <linan122(a)huawei.com> nbd: pass nbd_sock to nbd_read_reply() instead of index Oliver Neukum <oneukum(a)suse.com> HID: add ALWAYS_POLL quirk for Apple kb Brett Raye <braye(a)fastmail.com> HID: glorious: fix Glorious Model I HID report Yihong Cao <caoyihong4(a)outlook.com> HID: apple: add Jamesdonkey and A3R to non-apple keyboards list Hamish Martin <hamish.martin(a)alliedtelesis.co.nz> HID: mcp2221: Allow IO to start during probe Hamish Martin <hamish.martin(a)alliedtelesis.co.nz> HID: mcp2221: Set driver data before I2C adapter add Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> platform/x86: intel_telemetry: Fix kernel doc descriptions Bibo Mao <maobibo(a)loongson.cn> LoongArch: Implement constant timer shutdown interface Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Mark {dmw,tlb}_virt_to_page() exports as non-GPL Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Silence the boot warning about 'nokaslr' WANG Rui <wangrui(a)loongson.cn> LoongArch: Record pc instead of offset in la_abs relocation Masahiro Yamada <masahiroy(a)kernel.org> LoongArch: Add dependency between vmlinuz.efi and vmlinux.efi Eduard Zingerman <eddyz87(a)gmail.com> selftests/bpf: fix bpf_loop_bench for new callback verification scheme Hannes Reinecke <hare(a)suse.de> nvme: catch errors from nvme_configure_metadata() Mark O'Donovan <shiftee(a)posteo.net> nvme-auth: set explanation code for failure2 msgs Li Nan <linan122(a)huawei.com> nbd: fix null-ptr-dereference while accessing 'nbd->config' Li Nan <linan122(a)huawei.com> nbd: factor out a helper to get nbd_config without holding 'config_lock' Li Nan <linan122(a)huawei.com> nbd: fold nbd config initialization into nbd_alloc_config() Coly Li <colyli(a)suse.de> bcache: avoid NULL checking to c->root in run_cache_set() Coly Li <colyli(a)suse.de> bcache: add code comments for bch_btree_node_get() and __bch_btree_node_alloc() Colin Ian King <colin.i.king(a)gmail.com> bcache: remove redundant assignment to variable cur_idx Coly Li <colyli(a)suse.de> bcache: avoid oversize memory allocation by small stripe_size Ming Lei <ming.lei(a)redhat.com> blk-cgroup: bypass blkcg_deactivate_policy after destroying Ming Lei <ming.lei(a)redhat.com> blk-throttle: fix lockdep warning of "cgroup_mutex or RCU read lock required!" David Howells <dhowells(a)redhat.com> rxrpc: Fix some minor issues with bundle tracing Jean Delvare <jdelvare(a)suse.de> stmmac: dwmac-loongson: Add architecture dependency Oliver Neukum <oneukum(a)suse.com> usb: aqc111: check packet for fixup for true limit Saurabh Sengar <ssengar(a)linux.microsoft.com> x86/hyperv: Fix the detection of E820_TYPE_PRAM in a Gen2 VM David Hildenbrand <david(a)redhat.com> selftests/mm: cow: print ksft header before printing anything else Tvrtko Ursulin <tvrtko.ursulin(a)intel.com> drm/i915: Use internal class when counting engine resets Tvrtko Ursulin <tvrtko.ursulin(a)intel.com> drm/i915/selftests: Fix engine reset count storage for multi-tile Andrzej Kacprowski <Andrzej.Kacprowski(a)intel.com> accel/ivpu/37xx: Fix interrupt_clear_with_0 WA initialization Stanislaw Gruszka <stanislaw.gruszka(a)linux.intel.com> accel/ivpu: Print information about used workarounds Jason-JH.Lin <jason-jh.lin(a)mediatek.com> drm/mediatek: Add spinlock for setting vblank event in atomic_begin Michael Walle <mwalle(a)kernel.org> drm/mediatek: fix kernel oops if no crtc is found Johan Hovold <johan+linaro(a)kernel.org> PCI: vmd: Fix potential deadlock when enabling ASPM Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: fix wrong name of SMB2_CREATE_ALLOCATION_SIZE Johan Hovold <johan+linaro(a)kernel.org> PCI/ASPM: Add pci_enable_link_state_locked() Jiaxun Yang <jiaxun.yang(a)flygoat.com> PCI: loongson: Limit MRRS to 256 Bjorn Helgaas <bhelgaas(a)google.com> Revert "PCI: acpiphp: Reassign resources on bridge if necessary" Gergo Koteles <soyer(a)irl.hu> ALSA: hda/tas2781: reset the amp before component_add Gergo Koteles <soyer(a)irl.hu> ALSA: hda/tas2781: call cleanup functions only once Gergo Koteles <soyer(a)irl.hu> ALSA: hda/tas2781: handle missing EFI calibration data Gergo Koteles <soyer(a)irl.hu> ALSA: hda/tas2781: leave hda_component in usable state Hartmut Knaack <knaack.h(a)gmx.de> ALSA: hda/realtek: Apply mute LED quirk for HP15-db Kai Vehmanen <kai.vehmanen(a)linux.intel.com> ALSA: hda/hdmi: add force-connect quirks for ASUSTeK Z170 variants Kai Vehmanen <kai.vehmanen(a)linux.intel.com> ALSA: hda/hdmi: add force-connect quirk for NUC5CPYB Al Viro <viro(a)zeniv.linux.org.uk> io_uring/cmd: fix breakage in SOCKET_URING_OP_SIOC* implementation Hangyu Hua <hbh25y(a)gmail.com> fuse: dax: set fc->dax to NULL in fuse_dax_conn_free() Amir Goldstein <amir73il(a)gmail.com> fuse: disable FOPEN_PARALLEL_DIRECT_WRITES with FUSE_DIRECT_IO_ALLOW_MMAP Krister Johansen <kjlx(a)templeofstupid.com> fuse: share lookup state between submount and its parent Tyler Fanelli <tfanelli(a)redhat.com> fuse: Rename DIRECT_IO_RELAX to DIRECT_IO_ALLOW_MMAP Sebastian Parschauer <s.parschauer(a)gmx.de> HID: Add quirk for Labtec/ODDOR/aikeec handbrake Mario Limonciello <mario.limonciello(a)amd.com> HID: i2c-hid: Add IDEA5002 to i2c_hid_acpi_blacklist[] Jens Axboe <axboe(a)kernel.dk> cred: get rid of CONFIG_DEBUG_CREDENTIALS Jens Axboe <axboe(a)kernel.dk> cred: switch to using atomic_long_t Igor Russkikh <irusskikh(a)marvell.com> net: atlantic: fix double free in ring reinit logic Hyunwoo Kim <v4bel(a)theori.io> appletalk: Fix Use-After-Free in atalk_ioctl Andrew Halaney <ahalaney(a)redhat.com> net: stmmac: Handle disabled MDIO busses from devicetree Sneh Shah <quic_snehshah(a)quicinc.com> net: stmmac: dwmac-qcom-ethqos: Fix drops in 10M SGMII RX Ioana Ciornei <ioana.ciornei(a)nxp.com> dpaa2-switch: do not ask for MDB, VLAN and FDB replay Ioana Ciornei <ioana.ciornei(a)nxp.com> dpaa2-switch: fix size of the dma_unmap Nikolay Kuratov <kniv(a)yandex-team.ru> vsock/virtio: Fix unsigned integer wrap around in virtio_transport_has_space() Yusong Gao <a869920004(a)gmail.com> sign-file: Fix incorrect return values check Yanteng Si <siyanteng(a)loongson.cn> stmmac: dwmac-loongson: Make sure MDIO is initialized before use David Arinzon <darinzon(a)amazon.com> net: ena: Fix XDP redirection error David Arinzon <darinzon(a)amazon.com> net: ena: Fix DMA syncing in XDP path when SWIOTLB is on David Arinzon <darinzon(a)amazon.com> net: ena: Fix xdp drops handling due to multibuf packets David Arinzon <darinzon(a)amazon.com> net: ena: Destroy correct number of xdp queues upon failure Dong Chenchen <dongchenchen2(a)huawei.com> net: Remove acked SYN flag from packet in the transmit queue correctly Dinghao Liu <dinghao.liu(a)zju.edu.cn> qed: Fix a potential use-after-free in qed_cxt_tables_alloc Slawomir Laba <slawomirx.laba(a)intel.com> iavf: Fix iavf_shutdown to call iavf_remove instead iavf_close Piotr Gardocki <piotrx.gardocki(a)intel.com> iavf: Handle ntuple on/off based on new state machines for flow director Piotr Gardocki <piotrx.gardocki(a)intel.com> iavf: Introduce new state machines for flow director Hyunwoo Kim <v4bel(a)theori.io> net/rose: Fix Use-After-Free in rose_ioctl Hyunwoo Kim <v4bel(a)theori.io> atm: Fix Use-After-Free in do_vcc_ioctl Hariprasad Kelam <hkelam(a)marvell.com> octeontx2-af: Fix pause frame configuration Hariprasad Kelam <hkelam(a)marvell.com> octeontx2-af: Update RSS algorithm index Hariprasad Kelam <hkelam(a)marvell.com> octeontx2-pf: Fix promisc mcam entry action Shinas Rasheed <srasheed(a)marvell.com> octeon_ep: explicitly test for firmware ready value Vlad Buslov <vladbu(a)nvidia.com> net/sched: act_ct: Take per-cb reference to tcf_ct_flow_table Zhipeng Lu <alexious(a)zju.edu.cn> octeontx2-af: fix a use-after-free in rvu_nix_register_reporters Radu Bulie <radu-andrei.bulie(a)nxp.com> net: fec: correct queue selection Chengfeng Ye <dg573847474(a)gmail.com> atm: solos-pci: Fix potential deadlock on &tx_queue_lock Chengfeng Ye <dg573847474(a)gmail.com> atm: solos-pci: Fix potential deadlock on &cli_queue_lock Michael Chan <michael.chan(a)broadcom.com> bnxt_en: Fix HWTSTAMP_FILTER_ALL packet timestamp logic Kalesh AP <kalesh-anakkur.purayil(a)broadcom.com> bnxt_en: Fix wrong return value check in bnxt_close_nic() Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> bnxt_en: Fix skb recycling logic in bnxt_deliver_skb() Somnath Kotur <somnath.kotur(a)broadcom.com> bnxt_en: Clear resource reservation during resume Stefan Wahren <wahrenst(a)gmx.net> qca_spi: Fix reset behavior Stefan Wahren <wahrenst(a)gmx.net> qca_debug: Fix ethtool -G iface tx behavior Stefan Wahren <wahrenst(a)gmx.net> qca_debug: Prevent crash on TX ring changes Maciej Żenczykowski <maze(a)google.com> net: ipv6: support reporting otherwise unknown prefix flags in RTM_NEWPREFIX Dan Carpenter <dan.carpenter(a)linaro.org> net/mlx5: Fix a NULL vs IS_ERR() check Gavin Li <gavinl(a)nvidia.com> net/mlx5e: Check netdev pointer before checking its net ns Moshe Shemesh <moshe(a)nvidia.com> net/mlx5: Nack sync reset request when HotPlug is enabled Chris Mi <cmi(a)nvidia.com> net/mlx5e: TC, Don't offload post action rule if not supported Moshe Shemesh <moshe(a)nvidia.com> net/mlx5e: Fix possible deadlock on mlx5e_tx_timeout_work Chris Mi <cmi(a)nvidia.com> net/mlx5e: Disable IPsec offload support if not FW steering Patrisious Haddad <phaddad(a)nvidia.com> RDMA/mlx5: Send events from IB driver about device affiliation state Jianbo Liu <jianbol(a)nvidia.com> net/mlx5e: Check the number of elements before walk TC rhashtable Jianbo Liu <jianbol(a)nvidia.com> net/mlx5e: Reduce eswitch mode_lock protection context Leon Romanovsky <leon(a)kernel.org> net/mlx5e: Tidy up IPsec NAT-T SA discovery Patrisious Haddad <phaddad(a)nvidia.com> net/mlx5e: Unify esw and normal IPsec status table creation/destruction Leon Romanovsky <leon(a)kernel.org> net/mlx5e: Ensure that IPsec sequence packet number starts from 1 Leon Romanovsky <leon(a)kernel.org> net/mlx5e: Honor user choice of IPsec replay window size Mikhail Khvainitski <me(a)khvoinitsky.org> HID: lenovo: Restrict detection of patched firmware only to USB cptkbd David Howells <dhowells(a)redhat.com> afs: Fix refcount underflow from error handling race Ard Biesheuvel <ardb(a)kernel.org> efi/x86: Avoid physical KASLR on older Dell systems Zizhi Wo <wozizhi(a)huawei.com> ksmbd: fix memory leak in smb2_lock() Jan Kara <jack(a)suse.cz> ext4: fix warning in ext4_dio_write_end_io() Kelly Kane <kelly(a)hawknetworks.com> r8152: add vendor/device ID pair for ASUS USB-C2500 ------------- Diffstat: Makefile | 4 +- arch/arm64/Makefile | 2 +- arch/arm64/include/asm/pgtable.h | 6 + arch/loongarch/Makefile | 2 + arch/loongarch/include/asm/asmmacro.h | 3 +- arch/loongarch/include/asm/setup.h | 2 +- arch/loongarch/kernel/relocate.c | 10 +- arch/loongarch/kernel/time.c | 27 +-- arch/loongarch/mm/pgtable.c | 4 +- arch/powerpc/configs/skiroot_defconfig | 1 - arch/riscv/Kconfig | 4 +- arch/riscv/kernel/crash_core.c | 4 +- arch/s390/configs/debug_defconfig | 1 - arch/x86/hyperv/hv_init.c | 25 ++- arch/x86/include/asm/alternative.h | 4 +- arch/x86/include/asm/nospec-branch.h | 4 +- block/blk-cgroup.c | 13 ++ block/blk-throttle.c | 2 + drivers/accel/ivpu/ivpu_drv.h | 5 + drivers/accel/ivpu/ivpu_hw_37xx.c | 17 +- drivers/accel/ivpu/ivpu_hw_40xx.c | 4 + drivers/atm/solos-pci.c | 8 +- drivers/block/nbd.c | 117 ++++++---- drivers/cxl/core/hdm.c | 3 +- drivers/cxl/core/port.c | 4 +- drivers/dma/fsl-edma-common.c | 1 + drivers/dma/stm32-dma.c | 8 +- drivers/firmware/efi/libstub/x86-stub.c | 31 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c | 3 +- drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c | 28 +++ .../dc/link/protocols/link_edp_panel_control.c | 4 +- .../drm/amd/display/modules/power/power_helpers.c | 2 + drivers/gpu/drm/drm_edid.c | 3 +- drivers/gpu/drm/i915/display/intel_fb.c | 19 +- drivers/gpu/drm/i915/display/skl_scaler.c | 2 +- drivers/gpu/drm/i915/gt/intel_reset.c | 2 +- drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c | 5 +- drivers/gpu/drm/i915/i915_gpu_error.h | 12 +- drivers/gpu/drm/i915/selftests/igt_live_test.c | 9 +- drivers/gpu/drm/i915/selftests/igt_live_test.h | 3 +- drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 14 +- drivers/gpu/drm/mediatek/mtk_drm_drv.c | 5 +- drivers/hid/hid-apple.c | 2 + drivers/hid/hid-asus.c | 27 ++- drivers/hid/hid-glorious.c | 16 +- drivers/hid/hid-ids.h | 12 +- drivers/hid/hid-lenovo.c | 3 +- drivers/hid/hid-mcp2221.c | 4 +- drivers/hid/hid-multitouch.c | 5 + drivers/hid/hid-quirks.c | 2 + drivers/hid/i2c-hid/i2c-hid-acpi.c | 5 + drivers/infiniband/hw/mlx5/main.c | 17 ++ drivers/md/bcache/bcache.h | 1 + drivers/md/bcache/btree.c | 7 + drivers/md/bcache/super.c | 4 +- drivers/md/bcache/writeback.c | 2 +- drivers/net/ethernet/amazon/ena/ena_eth_com.c | 3 - drivers/net/ethernet/amazon/ena/ena_netdev.c | 53 +++-- drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 5 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 38 +++- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 10 +- drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c | 11 +- drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 19 +- drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c | 5 +- .../ethernet/freescale/dpaa2/dpaa2-switch-flower.c | 7 +- .../net/ethernet/freescale/dpaa2/dpaa2-switch.c | 11 +- drivers/net/ethernet/freescale/fec_main.c | 27 +-- drivers/net/ethernet/intel/iavf/iavf.h | 1 + drivers/net/ethernet/intel/iavf/iavf_ethtool.c | 27 ++- drivers/net/ethernet/intel/iavf/iavf_fdir.h | 15 +- drivers/net/ethernet/intel/iavf/iavf_main.c | 179 ++++++++++----- drivers/net/ethernet/intel/iavf/iavf_virtchnl.c | 71 +++++- .../net/ethernet/marvell/octeon_ep/octep_main.c | 3 +- drivers/net/ethernet/marvell/octeontx2/af/rpm.c | 11 +- .../ethernet/marvell/octeontx2/af/rvu_devlink.c | 5 +- .../net/ethernet/marvell/octeontx2/af/rvu_npc.c | 55 ++++- .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 25 ++- drivers/net/ethernet/mellanox/mlx5/core/en.h | 1 + .../ethernet/mellanox/mlx5/core/en/tc/post_act.c | 6 + .../ethernet/mellanox/mlx5/core/en_accel/ipsec.c | 56 +++-- .../mellanox/mlx5/core/en_accel/ipsec_fs.c | 222 +++++++++++++----- .../mellanox/mlx5/core/en_accel/ipsec_offload.c | 10 +- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 27 ++- drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 25 ++- .../net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c | 154 +------------ .../net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.h | 15 -- drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 35 +-- drivers/net/ethernet/mellanox/mlx5/core/eswitch.h | 2 + .../ethernet/mellanox/mlx5/core/eswitch_offloads.c | 56 +++-- drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c | 29 +++ drivers/net/ethernet/mellanox/mlx5/core/main.c | 6 + drivers/net/ethernet/qlogic/qed/qed_cxt.c | 1 + drivers/net/ethernet/qualcomm/qca_debug.c | 17 +- drivers/net/ethernet/qualcomm/qca_spi.c | 20 +- drivers/net/ethernet/stmicro/stmmac/Kconfig | 2 +- .../net/ethernet/stmicro/stmmac/dwmac-loongson.c | 14 +- .../ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c | 10 + drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c | 6 +- drivers/net/team/team.c | 4 +- drivers/net/usb/aqc111.c | 8 +- drivers/net/usb/qmi_wwan.c | 1 + drivers/net/usb/r8152.c | 1 + drivers/nfc/virtual_ncidev.c | 7 +- drivers/nvme/host/auth.c | 2 + drivers/nvme/host/core.c | 19 +- drivers/pci/controller/pci-loongson.c | 46 +++- drivers/pci/controller/vmd.c | 2 +- drivers/pci/hotplug/acpiphp_glue.c | 9 +- drivers/pci/pcie/aspm.c | 53 +++-- drivers/platform/x86/intel/telemetry/core.c | 4 +- drivers/soundwire/stream.c | 7 +- fs/afs/rxrpc.c | 2 +- fs/btrfs/delalloc-space.c | 2 +- fs/btrfs/extent_io.c | 3 +- fs/btrfs/file.c | 2 +- fs/btrfs/inode.c | 16 +- fs/btrfs/ioctl.c | 9 + fs/btrfs/ordered-data.c | 11 +- fs/btrfs/qgroup.c | 25 ++- fs/btrfs/qgroup.h | 4 +- fs/ext4/file.c | 14 +- fs/ext4/mballoc.c | 4 + fs/fuse/dax.c | 1 + fs/fuse/file.c | 8 +- fs/fuse/fuse_i.h | 19 +- fs/fuse/inode.c | 81 ++++++- fs/nfsd/auth.c | 4 - fs/nfsd/nfssvc.c | 1 - fs/nfsd/vfs.c | 9 +- fs/open.c | 3 - fs/smb/client/cached_dir.c | 17 +- fs/smb/client/cifsglob.h | 14 +- fs/smb/client/cifspdu.h | 4 +- fs/smb/client/cifsproto.h | 11 +- fs/smb/client/cifssmb.c | 191 +++++++--------- fs/smb/client/inode.c | 74 ++++-- fs/smb/client/readdir.c | 6 +- fs/smb/client/smb1ops.c | 73 ++---- fs/smb/client/smb2inode.c | 2 +- fs/smb/client/smb2misc.c | 26 +-- fs/smb/client/smb2ops.c | 176 ++++++++------- fs/smb/client/smb2pdu.c | 95 ++++---- fs/smb/client/smb2proto.h | 12 +- fs/smb/common/smb2pdu.h | 2 +- fs/smb/server/smb2pdu.c | 1 + fs/tracefs/inode.c | 13 +- include/asm-generic/qspinlock.h | 2 +- include/linux/cred.h | 58 +---- include/linux/mlx5/device.h | 2 + include/linux/mlx5/driver.h | 2 + include/linux/mlx5/mlx5_ifc.h | 9 +- include/linux/mm_inline.h | 23 +- include/linux/mmzone.h | 34 +-- include/linux/objtool.h | 10 +- include/linux/pci.h | 3 + include/linux/usb/r8152.h | 1 + include/net/addrconf.h | 12 +- include/net/if_inet6.h | 4 - include/net/netfilter/nf_flow_table.h | 10 + include/uapi/linux/fuse.h | 10 +- io_uring/uring_cmd.c | 2 +- kernel/Kconfig.kexec | 1 - kernel/cred.c | 248 +++------------------ kernel/events/core.c | 10 + kernel/exit.c | 3 - kernel/trace/ring_buffer.c | 58 ++--- kernel/trace/trace.c | 4 +- lib/Kconfig.debug | 15 -- mm/shmem.c | 19 +- mm/vmscan.c | 92 +++++--- mm/workingset.c | 6 +- net/appletalk/ddp.c | 9 +- net/atm/ioctl.c | 7 +- net/ipv4/tcp_output.c | 6 + net/ipv6/addrconf.c | 6 +- net/rose/af_rose.c | 4 +- net/rxrpc/conn_client.c | 7 +- net/sched/act_ct.c | 34 ++- net/sunrpc/auth.c | 3 - net/vmw_vsock/virtio_transport_common.c | 2 +- scripts/checkstack.pl | 3 +- scripts/sign-file.c | 12 +- security/selinux/hooks.c | 6 - sound/pci/hda/patch_hdmi.c | 3 + sound/pci/hda/patch_realtek.c | 1 + sound/pci/hda/tas2781_hda_i2c.c | 21 +- tools/objtool/noreturns.h | 1 - tools/testing/selftests/Makefile | 21 +- tools/testing/selftests/bpf/config.x86_64 | 1 - tools/testing/selftests/bpf/progs/bpf_loop_bench.c | 13 +- tools/testing/selftests/hid/config.common | 1 - tools/testing/selftests/lib.mk | 40 +--- tools/testing/selftests/mm/cow.c | 3 +- 194 files changed, 2164 insertions(+), 1607 deletions(-)

1 year

13
179
0 0

[merged mm-hotfixes-stable] mm-memcontrol-respect-zswapwriteback-setting-from-parent-cg-too.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: mm/memcontrol: respect zswap.writeback setting from parent cg too has been removed from the -mm tree. Its filename was mm-memcontrol-respect-zswapwriteback-setting-from-parent-cg-too.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Mike Yuan <me(a)yhndnzj.com> Subject: mm/memcontrol: respect zswap.writeback setting from parent cg too Date: Fri, 23 Aug 2024 16:27:06 +0000 Currently, the behavior of zswap.writeback wrt. the cgroup hierarchy seems a bit odd. Unlike zswap.max, it doesn't honor the value from parent cgroups. This surfaced when people tried to globally disable zswap writeback, i.e. reserve physical swap space only for hibernation [1] - disabling zswap.writeback only for the root cgroup results in subcgroups with zswap.writeback=1 still performing writeback. The inconsistency became more noticeable after I introduced the MemoryZSwapWriteback= systemd unit setting [2] for controlling the knob. The patch assumed that the kernel would enforce the value of parent cgroups. It could probably be workarounded from systemd's side, by going up the slice unit tree and inheriting the value. Yet I think it's more sensible to make it behave consistently with zswap.max and friends. [1] https://wiki.archlinux.org/title/Power_management/Suspend_and_hibernate#Dis… [2] https://github.com/systemd/systemd/pull/31734 Link: https://lkml.kernel.org/r/20240823162506.12117-1-me@yhndnzj.com Fixes: 501a06fe8e4c ("zswap: memcontrol: implement zswap writeback disabling") Signed-off-by: Mike Yuan <me(a)yhndnzj.com> Reviewed-by: Nhat Pham <nphamcs(a)gmail.com> Acked-by: Yosry Ahmed <yosryahmed(a)google.com> Cc: Johannes Weiner <hannes(a)cmpxchg.org> Cc: Michal Hocko <mhocko(a)kernel.org> Cc: Michal Koutn�� <mkoutny(a)suse.com> Cc: Muchun Song <muchun.song(a)linux.dev> Cc: Roman Gushchin <roman.gushchin(a)linux.dev> Cc: Shakeel Butt <shakeel.butt(a)linux.dev> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- Documentation/admin-guide/cgroup-v2.rst | 7 ++++--- mm/memcontrol.c | 12 +++++++++--- 2 files changed, 13 insertions(+), 6 deletions(-) --- a/Documentation/admin-guide/cgroup-v2.rst~mm-memcontrol-respect-zswapwriteback-setting-from-parent-cg-too +++ a/Documentation/admin-guide/cgroup-v2.rst @@ -1717,9 +1717,10 @@ The following nested keys are defined. entries fault back in or are written out to disk. memory.zswap.writeback - A read-write single value file. The default value is "1". The - initial value of the root cgroup is 1, and when a new cgroup is - created, it inherits the current value of its parent. + A read-write single value file. The default value is "1". + Note that this setting is hierarchical, i.e. the writeback would be + implicitly disabled for child cgroups if the upper hierarchy + does so. When this is set to 0, all swapping attempts to swapping devices are disabled. This included both zswap writebacks, and swapping due --- a/mm/memcontrol.c~mm-memcontrol-respect-zswapwriteback-setting-from-parent-cg-too +++ a/mm/memcontrol.c @@ -3613,8 +3613,7 @@ mem_cgroup_css_alloc(struct cgroup_subsy memcg1_soft_limit_reset(memcg); #ifdef CONFIG_ZSWAP memcg->zswap_max = PAGE_COUNTER_MAX; - WRITE_ONCE(memcg->zswap_writeback, - !parent || READ_ONCE(parent->zswap_writeback)); + WRITE_ONCE(memcg->zswap_writeback, true); #endif page_counter_set_high(&memcg->swap, PAGE_COUNTER_MAX); if (parent) { @@ -5320,7 +5319,14 @@ void obj_cgroup_uncharge_zswap(struct ob bool mem_cgroup_zswap_writeback_enabled(struct mem_cgroup *memcg) { /* if zswap is disabled, do not block pages going to the swapping device */ - return !zswap_is_enabled() || !memcg || READ_ONCE(memcg->zswap_writeback); + if (!zswap_is_enabled()) + return true; + + for (; memcg; memcg = parent_mem_cgroup(memcg)) + if (!READ_ONCE(memcg->zswap_writeback)) + return false; + + return true; } static u64 zswap_current_read(struct cgroup_subsys_state *css, _ Patches currently in -mm which might be from me(a)yhndnzj.com are documentation-cgroup-v2-clarify-that-zswapwriteback-is-ignored-if-zswap-is-disabled.patch selftests-test_zswap-add-test-for-hierarchical-zswapwriteback.patch

1 year

2
3
0 0

[PATCH] x86/topology: Tolerate lack of APIC when booting as Xen domU

by Ariadne Conill

Xen domU instances do not boot on x86 with ACPI enabled, so the entire ACPI subsystem is ultimately disabled. This causes acpi_mps_check() to trigger a warning that the ACPI MPS table is not present, which then disables APIC support on domU, breaking the CPU topology detection for all vCPUs other than the boot vCPU. Fixes: 7c0edad3643f ("x86/cpu/topology: Rework possible CPU management") Signed-off-by: Ariadne Conill <ariadne(a)ariadne.space> Cc: x86(a)kernel.org Cc: Thomas Gleixner <tglx(a)linutronix.de> Cc: linux-kernel(a)vger.kernel.org Cc: stable(a)vger.kernel.org --- arch/x86/kernel/cpu/topology.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/kernel/cpu/topology.c b/arch/x86/kernel/cpu/topology.c index 621a151ccf7d..38fa5ed816d6 100644 --- a/arch/x86/kernel/cpu/topology.c +++ b/arch/x86/kernel/cpu/topology.c @@ -429,7 +429,7 @@ void __init topology_apply_cmdline_limits_early(void) unsigned int possible = nr_cpu_ids; /* 'maxcpus=0' 'nosmp' 'nolapic' 'disableapic' 'noapic' */ - if (!setup_max_cpus || ioapic_is_disabled || apic_is_disabled) + if (!setup_max_cpus || ioapic_is_disabled || (apic_is_disabled && !xen_pv_domain())) possible = 1; /* 'possible_cpus=N' */ -- 2.39.2

1 year

1
0
0 0

[PATCH AUTOSEL 4.19 1/6] ASoC: allow module autoloading for table db1200_pids

by Sasha Levin

From: Hongbo Li <lihongbo22(a)huawei.com> [ Upstream commit 0e9fdab1e8df490354562187cdbb8dec643eae2c ] Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded based on the alias from platform_device_id table. Signed-off-by: Hongbo Li <lihongbo22(a)huawei.com> Link: https://patch.msgid.link/20240821061955.2273782-2-lihongbo22@huawei.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- sound/soc/au1x/db1200.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sound/soc/au1x/db1200.c b/sound/soc/au1x/db1200.c index 301e1fc9a3773..24d16e6bf7501 100644 --- a/sound/soc/au1x/db1200.c +++ b/sound/soc/au1x/db1200.c @@ -43,6 +43,7 @@ static const struct platform_device_id db1200_pids[] = { }, {}, }; +MODULE_DEVICE_TABLE(platform, db1200_pids); /*------------------------- AC97 PART ---------------------------*/ -- 2.43.0

1 year

1
5
0 0

[PATCH AUTOSEL 5.4 1/8] ASoC: allow module autoloading for table db1200_pids

by Sasha Levin

From: Hongbo Li <lihongbo22(a)huawei.com> [ Upstream commit 0e9fdab1e8df490354562187cdbb8dec643eae2c ] Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded based on the alias from platform_device_id table. Signed-off-by: Hongbo Li <lihongbo22(a)huawei.com> Link: https://patch.msgid.link/20240821061955.2273782-2-lihongbo22@huawei.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- sound/soc/au1x/db1200.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sound/soc/au1x/db1200.c b/sound/soc/au1x/db1200.c index d6b692fff29a2..cdde5ba2ec351 100644 --- a/sound/soc/au1x/db1200.c +++ b/sound/soc/au1x/db1200.c @@ -44,6 +44,7 @@ static const struct platform_device_id db1200_pids[] = { }, {}, }; +MODULE_DEVICE_TABLE(platform, db1200_pids); /*------------------------- AC97 PART ---------------------------*/ -- 2.43.0

1 year

1
7
0 0

[PATCH AUTOSEL 5.10 1/8] ASoC: allow module autoloading for table db1200_pids

by Sasha Levin

From: Hongbo Li <lihongbo22(a)huawei.com> [ Upstream commit 0e9fdab1e8df490354562187cdbb8dec643eae2c ] Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded based on the alias from platform_device_id table. Signed-off-by: Hongbo Li <lihongbo22(a)huawei.com> Link: https://patch.msgid.link/20240821061955.2273782-2-lihongbo22@huawei.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- sound/soc/au1x/db1200.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sound/soc/au1x/db1200.c b/sound/soc/au1x/db1200.c index 5f8baad37a401..48243164b7ac8 100644 --- a/sound/soc/au1x/db1200.c +++ b/sound/soc/au1x/db1200.c @@ -44,6 +44,7 @@ static const struct platform_device_id db1200_pids[] = { }, {}, }; +MODULE_DEVICE_TABLE(platform, db1200_pids); /*------------------------- AC97 PART ---------------------------*/ -- 2.43.0

1 year

1
7
0 0

[PATCH AUTOSEL 5.15 01/12] ASoC: allow module autoloading for table db1200_pids

by Sasha Levin

From: Hongbo Li <lihongbo22(a)huawei.com> [ Upstream commit 0e9fdab1e8df490354562187cdbb8dec643eae2c ] Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded based on the alias from platform_device_id table. Signed-off-by: Hongbo Li <lihongbo22(a)huawei.com> Link: https://patch.msgid.link/20240821061955.2273782-2-lihongbo22@huawei.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- sound/soc/au1x/db1200.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sound/soc/au1x/db1200.c b/sound/soc/au1x/db1200.c index 5f8baad37a401..48243164b7ac8 100644 --- a/sound/soc/au1x/db1200.c +++ b/sound/soc/au1x/db1200.c @@ -44,6 +44,7 @@ static const struct platform_device_id db1200_pids[] = { }, {}, }; +MODULE_DEVICE_TABLE(platform, db1200_pids); /*------------------------- AC97 PART ---------------------------*/ -- 2.43.0

1 year

1
11
0 0

[PATCH AUTOSEL 6.1 01/17] ASoC: SOF: mediatek: Add missing board compatible

by Sasha Levin

From: Albert Jakieła <jakiela(a)google.com> [ Upstream commit c0196faaa927321a63e680427e075734ee656e42 ] Add Google Dojo compatible. Signed-off-by: Albert Jakieła <jakiela(a)google.com> Reviewed-by: Chen-Yu Tsai <wenst(a)chromium.org> Link: https://patch.msgid.link/20240809135627.544429-1-jakiela@google.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- sound/soc/sof/mediatek/mt8195/mt8195.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sound/soc/sof/mediatek/mt8195/mt8195.c b/sound/soc/sof/mediatek/mt8195/mt8195.c index 53cadbe8a05cc..ac96ea07e591b 100644 --- a/sound/soc/sof/mediatek/mt8195/mt8195.c +++ b/sound/soc/sof/mediatek/mt8195/mt8195.c @@ -663,6 +663,9 @@ static struct snd_sof_of_mach sof_mt8195_machs[] = { { .compatible = "google,tomato", .sof_tplg_filename = "sof-mt8195-mt6359-rt1019-rt5682.tplg" + }, { + .compatible = "google,dojo", + .sof_tplg_filename = "sof-mt8195-mt6359-max98390-rt5682.tplg" }, { .compatible = "mediatek,mt8195", .sof_tplg_filename = "sof-mt8195.tplg" -- 2.43.0

1 year

1
16
0 0

[PATCH AUTOSEL 6.6 01/20] ASoC: SOF: mediatek: Add missing board compatible

by Sasha Levin

From: Albert Jakieła <jakiela(a)google.com> [ Upstream commit c0196faaa927321a63e680427e075734ee656e42 ] Add Google Dojo compatible. Signed-off-by: Albert Jakieła <jakiela(a)google.com> Reviewed-by: Chen-Yu Tsai <wenst(a)chromium.org> Link: https://patch.msgid.link/20240809135627.544429-1-jakiela@google.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- sound/soc/sof/mediatek/mt8195/mt8195.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sound/soc/sof/mediatek/mt8195/mt8195.c b/sound/soc/sof/mediatek/mt8195/mt8195.c index b5b4ea854da4b..94db51d88dda0 100644 --- a/sound/soc/sof/mediatek/mt8195/mt8195.c +++ b/sound/soc/sof/mediatek/mt8195/mt8195.c @@ -625,6 +625,9 @@ static struct snd_sof_of_mach sof_mt8195_machs[] = { { .compatible = "google,tomato", .sof_tplg_filename = "sof-mt8195-mt6359-rt1019-rt5682.tplg" + }, { + .compatible = "google,dojo", + .sof_tplg_filename = "sof-mt8195-mt6359-max98390-rt5682.tplg" }, { .compatible = "mediatek,mt8195", .sof_tplg_filename = "sof-mt8195.tplg" -- 2.43.0

1 year

1
19
0 0

[PATCH AUTOSEL 6.10 01/22] ASoC: SOF: mediatek: Add missing board compatible

by Sasha Levin

From: Albert Jakieła <jakiela(a)google.com> [ Upstream commit c0196faaa927321a63e680427e075734ee656e42 ] Add Google Dojo compatible. Signed-off-by: Albert Jakieła <jakiela(a)google.com> Reviewed-by: Chen-Yu Tsai <wenst(a)chromium.org> Link: https://patch.msgid.link/20240809135627.544429-1-jakiela@google.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- sound/soc/sof/mediatek/mt8195/mt8195.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sound/soc/sof/mediatek/mt8195/mt8195.c b/sound/soc/sof/mediatek/mt8195/mt8195.c index 8d3fc167cd810..b9d4508bbb85d 100644 --- a/sound/soc/sof/mediatek/mt8195/mt8195.c +++ b/sound/soc/sof/mediatek/mt8195/mt8195.c @@ -574,6 +574,9 @@ static struct snd_sof_of_mach sof_mt8195_machs[] = { { .compatible = "google,tomato", .sof_tplg_filename = "sof-mt8195-mt6359-rt1019-rt5682.tplg" + }, { + .compatible = "google,dojo", + .sof_tplg_filename = "sof-mt8195-mt6359-max98390-rt5682.tplg" }, { .compatible = "mediatek,mt8195", .sof_tplg_filename = "sof-mt8195.tplg" -- 2.43.0

1 year

1
21
0 0

[PATCH 6.10 000/149] 6.10.8-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.10.8 release. There are 149 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Tue, 03 Sep 2024 16:07:34 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.10.8-rc1… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.10.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.10.8-rc1 NeilBrown <neilb(a)suse.de> nfsd: fix nfsd4_deleg_getattr_conflict in presence of third party lease Guenter Roeck <linux(a)roeck-us.net> apparmor: fix policy_unpack_test on big endian systems Ben Hutchings <benh(a)debian.org> scsi: aacraid: Fix double-free on probe failure Steve Wilkins <steve.wilkins(a)raymarine.com> firmware: microchip: fix incorrect error report of programming:timeout on success Markus Niebel <Markus.Niebel(a)ew.tq-group.com> arm64: dts: freescale: imx93-tqma9352-mba93xxla: fix typo Markus Niebel <Markus.Niebel(a)ew.tq-group.com> arm64: dts: freescale: imx93-tqma9352: fix CMA alloc-ranges Shenwei Wang <shenwei.wang(a)nxp.com> arm64: dts: imx93: update default value for snps,clk-csr Adam Ford <aford173(a)gmail.com> arm64: dts: imx8mp-beacon-kit: Fix Stereo Audio on WM8962 Sicelo A. Mhlongo <absicsz(a)gmail.com> ARM: dts: omap3-n900: correct the accelerometer orientation Varadarajan Narayanan <quic_varada(a)quicinc.com> arm64: dts: qcom: ipq5332: Fix interrupt trigger type for usb Bjorn Andersson <quic_bjorande(a)quicinc.com> usb: typec: ucsi: Move unregister out of atomic section Pawel Laszczak <pawell(a)cadence.com> usb: cdnsp: fix for Link TRB with TC Pawel Laszczak <pawell(a)cadence.com> usb: cdnsp: fix incorrect index in cdnsp_get_hw_deq function Zijun Hu <quic_zijuhu(a)quicinc.com> usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in remove_power_attributes() Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> usb: dwc3: st: add missing depopulate in probe error path Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> usb: dwc3: st: fix probed platform device ref count on probe error path Selvarasu Ganesan <selvarasu.g(a)samsung.com> usb: dwc3: core: Prevent USB core invalid event buffer address access Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> usb: dwc3: omap: add missing depopulate in probe error path Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> usb: dwc3: xilinx: add missing depopulate in probe error path Michael Grzeschik <m.grzeschik(a)pengutronix.de> usb: dwc3: ep0: Don't reset resource alloc flag (including ep0) Michal Vokáč <michal.vokac(a)ysoft.com> ARM: dts: imx6dl-yapp43: Increase LED current to match the yapp4 HW design Johan Hovold <johan+linaro(a)kernel.org> arm64: dts: qcom: x1e80100: fix PCIe domain numbers Johan Hovold <johan+linaro(a)kernel.org> arm64: dts: qcom: x1e80100: add missing PCIe minimum OPP Johan Hovold <johan+linaro(a)kernel.org> arm64: dts: qcom: x1e80100-qcp: fix PCIe4 PHY supply Johan Hovold <johan+linaro(a)kernel.org> arm64: dts: qcom: x1e80100-crd: fix PCIe4 PHY supply Xu Yang <xu.yang_2(a)nxp.com> usb: gadget: uvc: queue pump work in uvcg_video_enable() ZHANG Yuntian <yt(a)radxa.com> USB: serial: option: add MeiG Smart SRM825L Alexander Stein <alexander.stein(a)ew.tq-group.com> dt-bindings: usb: microchip,usb2514: Fix reference USB device schema Yihang Li <liyihang9(a)huawei.com> scsi: sd: Ignore command SYNCHRONIZE CACHE error if format in progress Murali Nalajala <quic_mnalajal(a)quicinc.com> firmware: qcom: scm: Mark get_wq_ctx() as atomic call Luca Weiss <luca.weiss(a)fairphone.com> usb: typec: fsa4480: Relax CHIP_ID check Ian Ray <ian.ray(a)gehealthcare.com> cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller Bjorn Andersson <quic_bjorande(a)quicinc.com> soc: qcom: pmic_glink: Fix race during initialization Bjorn Andersson <quic_bjorande(a)quicinc.com> soc: qcom: pmic_glink: Actually communicate when remote goes down Volodymyr Babchuk <Volodymyr_Babchuk(a)epam.com> soc: qcom: cmd-db: Map shared memory as WC, not WB Jens Axboe <axboe(a)kernel.dk> io_uring/kbuf: return correct iovec count from classic buffer peek Karthik Poosa <karthik.poosa(a)intel.com> drm/xe/hwmon: Fix WRITE_I1 param from u32 to u16 Aleksandr Mishin <amishin(a)t-argos.ru> nfc: pn533: Add poll mod list filling check Eric Dumazet <edumazet(a)google.com> net: busy-poll: use ktime_get_ns() instead of local_clock() Ma Ke <make24(a)iscas.ac.cn> drm/amd/display: avoid using null object of framebuffer Ondrej Mosnacek <omosnace(a)redhat.com> sctp: fix association labeling in the duplicate COOKIE-ECHO case Xueming Feng <kuro(a)kuroa.me> tcp: fix forever orphan socket caused by tcp_abort Cong Wang <cong.wang(a)bytedance.com> gtp: fix a potential NULL pointer dereference Jianbo Liu <jianbol(a)nvidia.com> bonding: change ipsec_lock from spin lock to mutex Jianbo Liu <jianbol(a)nvidia.com> bonding: extract the use of real_device into local variable Jianbo Liu <jianbol(a)nvidia.com> bonding: implement xdo_dev_state_free and call it after deletion Petr Machata <petrm(a)nvidia.com> selftests: forwarding: local_termination: Down ports on cleanup Petr Machata <petrm(a)nvidia.com> selftests: forwarding: no_forwarding: Down ports on cleanup Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables_ipv6: consider network offset in netdev/egress validation Eric Dumazet <edumazet(a)google.com> net_sched: sch_fq: fix incorrect behavior for small weights Cosmo Chou <chou.cosmo(a)gmail.com> hwmon: (pt5161l) Fix invalid temperature reading Jamie Bainbridge <jamie.bainbridge(a)gmail.com> ethtool: check device is present when getting link settings Avraham Stern <avraham.stern(a)intel.com> wifi: iwlwifi: mvm: allow 6 GHz channels in MLO scan Anjaneyulu <pagadala.yesu.anjaneyulu(a)intel.com> wifi: iwlwifi: fw: fix wgds rev 3 exact size Emmanuel Grumbach <emmanuel.grumbach(a)intel.com> wifi: iwlwifi: mvm: take the mutex before running link selection Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: restore IP sanity checks for netdev/egress Jason Gunthorpe <jgg(a)ziepe.ca> iommu: Do not return 0 from map_pages if it doesn't do anything Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_core: Fix not handling hibernation actions Neeraj Sanjay Kale <neeraj.sanjaykale(a)nxp.com> Bluetooth: btnxpuart: Fix random crash seen while removing driver Neeraj Sanjay Kale <neeraj.sanjaykale(a)nxp.com> Bluetooth: btnxpuart: Handle FW Download Abort scenario Mario Limonciello <mario.limonciello(a)amd.com> cpufreq/amd-pstate-ut: Don't check for highest perf matching on prefcore Eric Dumazet <edumazet(a)google.com> pktgen: use cpus_read_lock() in pg_net_init() Kees Cook <kees(a)kernel.org> dmaengine: ti: omap-dma: Initialize sglen after allocation Serge Semin <fancer.lancer(a)gmail.com> dmaengine: dw: Add memory bus width verification Serge Semin <fancer.lancer(a)gmail.com> dmaengine: dw: Add peripheral bus width verification Piyush Mehta <piyush.mehta(a)amd.com> phy: xilinx: phy-zynqmp: Fix SGMII linkup failure on resume Abel Vesa <abel.vesa(a)linaro.org> phy: qcom: qmp-pcie: Fix X1E80100 PCIe Gen4 PHY initialisation Mrinmay Sarkar <quic_msarkar(a)quicinc.com> dmaengine: dw-edma: Do not enable watermark interrupts for HDMA Mrinmay Sarkar <quic_msarkar(a)quicinc.com> dmaengine: dw-edma: Fix unmasking STOP and ABORT interrupts for HDMA Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> soundwire: stream: fix programming slave ports for non-continous port maps Xu Yang <xu.yang_2(a)nxp.com> phy: fsl-imx8mq-usb: fix tuning parameter name Jason Gunthorpe <jgg(a)ziepe.ca> iommufd: Do not allow creating areas without READ or WRITE Gautham R. Shenoy <gautham.shenoy(a)amd.com> cpufreq/amd-pstate: Use topology_logical_package_id() instead of logical_die_id() Scott Mayhew <smayhew(a)redhat.com> selinux,smack: don't bypass permissions check in inode_setsecctx hook Jeff Layton <jlayton(a)kernel.org> fs/nfsd: fix update of inode attrs in CB_GETATTR Jeff Layton <jlayton(a)kernel.org> nfsd: fix potential UAF in nfsd4_cb_getattr_release Jeff Layton <jlayton(a)kernel.org> nfsd: hold reference to delegation when updating it for cb_getattr David Howells <dhowells(a)redhat.com> cifs: Fix FALLOC_FL_PUNCH_HOLE support Stefan Metzmacher <metze(a)samba.org> smb/client: remove unused rq_iter_size from struct smb_rqst David Howells <dhowells(a)redhat.com> netfs: Fix interaction of streaming writes with zero-point tracker David Howells <dhowells(a)redhat.com> netfs: Fix missing iterator reset on retry of short read David Howells <dhowells(a)redhat.com> netfs: Fix trimming of streaming-write folios in netfs_inval_folio() David Howells <dhowells(a)redhat.com> netfs: Fix netfs_release_folio() to say no if folio dirty David Howells <dhowells(a)redhat.com> afs: Fix post-setattr file edit to do truncation correctly David Howells <dhowells(a)redhat.com> mm: Fix missing folio invalidation calls during truncation Olga Kornievskaia <okorniev(a)redhat.com> nfsd: prevent panic for nfsv4.0 closed files in nfs4_show_open Hal Feng <hal.feng(a)starfivetech.com> pinctrl: starfive: jh7110: Correct the level trigger configuration of iev register Konrad Dybcio <quic_kdybcio(a)quicinc.com> pinctrl: qcom: x1e80100: Fix special pin offsets Nícolas F. R. A. Prado <nfraprado(a)collabora.com> pinctrl: mediatek: common-v2: Fix broken bias-disable for PULL_PU_PD_RSEL_TYPE Ed Tsai <ed.tsai(a)mediatek.com> backing-file: convert to using fops->splice_write Jeff Layton <jlayton(a)kernel.org> nfsd: ensure that nfsd4_fattr_args.context is zeroed out Richard Fitzgerald <rf(a)opensource.cirrus.com> ASoC: cs-amp-lib: Ignore empty UEFI calibration entries Richard Fitzgerald <rf(a)opensource.cirrus.com> ASoC: cs-amp-lib-test: Force test calibration blob entries to be valid Simon Trimmer <simont(a)opensource.cirrus.com> ALSA: hda: cs35l56: Don't use the device index as a calibration index Vijendar Mukunda <Vijendar.Mukunda(a)amd.com> ASoC: SOF: amd: Fix for acp init sequence Yuntao Liu <liuyuntao12(a)huawei.com> ASoC: amd: acp: fix module autoloading Vijendar Mukunda <Vijendar.Mukunda(a)amd.com> ASoC: SOF: amd: Fix for incorrect acp error register offsets Vijendar Mukunda <Vijendar.Mukunda(a)amd.com> ASoC: SOF: amd: move iram-dram fence register programming sequence Konrad Dybcio <konrad.dybcio(a)linaro.org> pinctrl: qcom: x1e80100: Update PDC hwirq map Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu: fix eGPU hotplug regression Victor Lu <victorchengchi.lu(a)amd.com> drm/amdgpu: Do not wait for MP0_C2PMSG_33 IFWI init in SRIOV Matthew Auld <matthew.auld(a)intel.com> drm/xe: prevent UAF around preempt fence Francois Dugast <francois.dugast(a)intel.com> drm/xe/exec_queue: Rename xe_exec_queue::compute to xe_exec_queue::lr Thorsten Blum <thorsten.blum(a)toblux.com> drm/xe/vm: Simplify if condition Maarten Lankhorst <maarten.lankhorst(a)linux.intel.com> drm/xe/display: Make display suspend/resume work on discrete Rodrigo Vivi <rodrigo.vivi(a)intel.com> drm/xe: Prepare display for D3Cold Alex Deucher <alexander.deucher(a)amd.com> video/aperture: optionally match the device in sysfb_disable() Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: Disable coherent dumb buffers without 3d Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: Fix prime with external buffers Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: Prevent unmapping active read buffers Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/swsmu: always force a state reprogram on init Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu: align pp_power_profile_mode with kernel docs Imre Deak <imre.deak(a)intel.com> drm/i915/dp_mst: Fix MST state after a sink reset Hans de Goede <hdegoede(a)redhat.com> drm/i915/dsi: Make Lenovo Yoga Tab 3 X90F DMI match less strict Tvrtko Ursulin <tvrtko.ursulin(a)igalia.com> drm/v3d: Disable preemption while updating GPU stats Max Filippov <jcmvbkbc(a)gmail.com> binfmt_elf_fdpic: fix AUXV size calculation when ELF_HWCAP2 is defined Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: join: check re-re-adding ID 0 endp Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: join: no extra msg if no counter Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: join: check removing ID 0 endpoint Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: join: cannot rm sf if closed Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR 0 is not a new address Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: avoid duplicated SUB_CLOSED events Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: fix ID 0 endp usage after multiple re-creations Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: do not remove already closed subflows Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: fix RM_ADDR ID for the initial subflow Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: send ACK on an active subflow Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: reset MPC endp ID when re-added Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: skip connecting to already established sf Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: reuse ID 0 after delete and re-add Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pr_debug: add missing \n at the end Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: sched: check both backup in retrans Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: close subflow when receiving TCP+FIN Haiyang Zhang <haiyangz(a)microsoft.com> net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response Sascha Hauer <s.hauer(a)pengutronix.de> wifi: mwifiex: duplicate static structs used in driver instances Alexander Sverdlin <alexander.sverdlin(a)siemens.com> wifi: wfx: repair open network AP mode David Howells <dhowells(a)redhat.com> netfs, ceph: Partially revert "netfs: Replace PG_fscache by setting folio->private and marking dirty" Ma Ke <make24(a)iscas.ac.cn> pinctrl: single: fix potential NULL dereference in pcs_get_function() Huang-Huang Bao <i(a)eh5.me> pinctrl: rockchip: correct RK3328 iomux width flag for GPIO2-B pins Stefan Metzmacher <metze(a)samba.org> smb/client: avoid dereferencing rdata=NULL in smb2_new_read_req() Josef Bacik <josef(a)toxicpanda.com> btrfs: run delayed iputs when flushing delalloc Qu Wenruo <wqu(a)suse.com> btrfs: fix a use-after-free when hitting errors inside btrfs_submit_chunk() Stefan Berger <stefanb(a)linux.ibm.com> tpm: ibmvtpm: Call tpm2_sessions_init() to initialize session support Tiezhu Yang <yangtiezhu(a)loongson.cn> LoongArch: Add ifdefs to fix LSX and LASX related warnings Miao Wang <shankerwangmiao(a)gmail.com> LoongArch: Remove the unused dma-direct.h Hendrik Borghorst <hendrikborghorst(a)gmail.com> ALSA: hda/realtek: support HP Pavilion Aero 13-bg0xxx Mute LED John Sweeney <john.sweeney(a)runbox.com> ALSA: hda/realtek: Enable mute/micmute LEDs on HP Laptop 14-ey0xxx Takashi Iwai <tiwai(a)suse.de> ALSA: seq: Skip event type filtering for UMP events Gao Xiang <xiang(a)kernel.org> erofs: fix out-of-bound access when z_erofs_gbuf_growsize() partially fails Jack Xiao <Jack.Xiao(a)amd.com> drm/amdgpu/mes: fix mes ring buffer overflow ------------- Diffstat: .../devicetree/bindings/usb/microchip,usb2514.yaml | 9 +- Makefile | 4 +- .../arm/boot/dts/nxp/imx/imx6dl-yapp43-common.dtsi | 12 +- arch/arm/boot/dts/ti/omap/omap3-n900.dts | 2 +- .../arm64/boot/dts/freescale/imx8mp-beacon-kit.dts | 12 +- .../dts/freescale/imx93-tqma9352-mba93xxla.dts | 2 +- arch/arm64/boot/dts/freescale/imx93-tqma9352.dtsi | 2 +- arch/arm64/boot/dts/freescale/imx93.dtsi | 2 +- arch/arm64/boot/dts/qcom/ipq5332.dtsi | 4 +- arch/arm64/boot/dts/qcom/x1e80100-crd.dts | 2 +- arch/arm64/boot/dts/qcom/x1e80100-qcp.dts | 2 +- arch/arm64/boot/dts/qcom/x1e80100.dtsi | 6 +- arch/loongarch/include/asm/dma-direct.h | 11 -- arch/loongarch/kernel/fpu.S | 4 + arch/loongarch/kvm/switch.S | 4 + drivers/bluetooth/btnxpuart.c | 65 +++++++-- drivers/char/tpm/tpm_ibmvtpm.c | 4 + drivers/cpufreq/amd-pstate-ut.c | 13 +- drivers/cpufreq/amd-pstate.c | 2 +- drivers/dma/dw-edma/dw-hdma-v0-core.c | 26 ++-- drivers/dma/dw/core.c | 89 +++++++++++- drivers/dma/ti/omap-dma.c | 6 +- drivers/firmware/microchip/mpfs-auto-update.c | 2 +- drivers/firmware/qcom/qcom_scm-smc.c | 2 +- drivers/firmware/sysfb.c | 19 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 26 ++-- drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | 2 + drivers/gpu/drm/amd/amdgpu/mes_v11_0.c | 18 ++- .../drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c | 9 +- drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 21 +-- drivers/gpu/drm/i915/display/intel_dp.c | 12 ++ drivers/gpu/drm/i915/display/intel_dp_mst.c | 40 ++++++ drivers/gpu/drm/i915/display/intel_dp_mst.h | 1 + drivers/gpu/drm/i915/display/vlv_dsi.c | 1 - drivers/gpu/drm/v3d/v3d_sched.c | 6 + drivers/gpu/drm/vmwgfx/vmwgfx_blit.c | 114 ++++++++++++++- drivers/gpu/drm/vmwgfx/vmwgfx_bo.c | 13 +- drivers/gpu/drm/vmwgfx/vmwgfx_bo.h | 3 + drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c | 12 +- drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 6 +- drivers/gpu/drm/xe/display/xe_display.c | 33 ++++- drivers/gpu/drm/xe/display/xe_display.h | 8 +- drivers/gpu/drm/xe/xe_exec_queue.c | 5 +- drivers/gpu/drm/xe/xe_exec_queue_types.h | 14 +- drivers/gpu/drm/xe/xe_hwmon.c | 2 +- drivers/gpu/drm/xe/xe_pm.c | 20 ++- drivers/gpu/drm/xe/xe_preempt_fence.c | 3 +- drivers/gpu/drm/xe/xe_preempt_fence_types.h | 2 + drivers/gpu/drm/xe/xe_vm.c | 60 ++++---- drivers/hwmon/pt5161l.c | 4 +- drivers/iommu/io-pgtable-arm-v7s.c | 3 +- drivers/iommu/io-pgtable-arm.c | 3 +- drivers/iommu/io-pgtable-dart.c | 3 +- drivers/iommu/iommufd/ioas.c | 8 ++ drivers/net/bonding/bond_main.c | 159 ++++++++++++++------- drivers/net/ethernet/microsoft/mana/hw_channel.c | 68 +++++---- drivers/net/gtp.c | 2 +- drivers/net/wireless/intel/iwlwifi/fw/acpi.c | 13 +- drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 2 + drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 11 ++ drivers/net/wireless/marvell/mwifiex/cfg80211.c | 32 ++++- drivers/net/wireless/silabs/wfx/sta.c | 5 +- drivers/nfc/pn533/pn533.c | 5 + drivers/of/platform.c | 2 +- drivers/phy/freescale/phy-fsl-imx8mq-usb.c | 2 +- drivers/phy/qualcomm/phy-qcom-qmp-pcie.c | 23 ++- drivers/phy/xilinx/phy-zynqmp.c | 56 ++++++++ drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c | 55 +++---- drivers/pinctrl/pinctrl-rockchip.c | 2 +- drivers/pinctrl/pinctrl-single.c | 2 + drivers/pinctrl/qcom/pinctrl-x1e80100.c | 35 ++--- drivers/pinctrl/starfive/pinctrl-starfive-jh7110.c | 4 +- drivers/power/supply/qcom_battmgr.c | 16 ++- drivers/scsi/aacraid/comminit.c | 2 + drivers/scsi/sd.c | 12 +- drivers/soc/qcom/cmd-db.c | 2 +- drivers/soc/qcom/pmic_glink.c | 40 ++++-- drivers/soc/qcom/pmic_glink_altmode.c | 17 ++- drivers/soundwire/stream.c | 8 +- drivers/usb/cdns3/cdnsp-gadget.h | 3 + drivers/usb/cdns3/cdnsp-ring.c | 30 +++- drivers/usb/class/cdc-acm.c | 3 + drivers/usb/core/sysfs.c | 1 + drivers/usb/dwc3/core.c | 8 ++ drivers/usb/dwc3/dwc3-omap.c | 4 +- drivers/usb/dwc3/dwc3-st.c | 16 +-- drivers/usb/dwc3/dwc3-xilinx.c | 7 +- drivers/usb/dwc3/ep0.c | 3 +- drivers/usb/gadget/function/uvc_video.c | 1 + drivers/usb/serial/option.c | 5 + drivers/usb/typec/mux/fsa4480.c | 2 +- drivers/usb/typec/ucsi/ucsi_glink.c | 43 ++++-- drivers/video/aperture.c | 11 +- fs/afs/inode.c | 11 +- fs/attr.c | 14 +- fs/backing-file.c | 5 +- fs/binfmt_elf_fdpic.c | 3 + fs/btrfs/bio.c | 26 ++-- fs/btrfs/qgroup.c | 2 + fs/ceph/inode.c | 1 + fs/erofs/zutil.c | 3 +- fs/netfs/io.c | 1 + fs/netfs/misc.c | 60 ++++++-- fs/netfs/write_collect.c | 7 + fs/nfsd/nfs4state.c | 62 +++++--- fs/nfsd/nfs4xdr.c | 6 +- fs/nfsd/state.h | 2 +- fs/smb/client/cifsglob.h | 1 - fs/smb/client/cifssmb.c | 1 - fs/smb/client/smb2ops.c | 24 +++- fs/smb/client/smb2pdu.c | 4 +- include/linux/fs.h | 1 + include/linux/soc/qcom/pmic_glink.h | 11 +- include/linux/sysfb.h | 4 +- include/net/bonding.h | 2 +- include/net/busy_poll.h | 2 +- include/net/netfilter/nf_tables_ipv4.h | 10 +- include/net/netfilter/nf_tables_ipv6.h | 5 +- io_uring/kbuf.c | 2 +- mm/truncate.c | 4 +- net/bluetooth/hci_core.c | 10 +- net/core/net-sysfs.c | 2 +- net/core/pktgen.c | 4 +- net/ethtool/ioctl.c | 3 + net/ipv4/tcp.c | 18 ++- net/mptcp/fastopen.c | 4 +- net/mptcp/options.c | 50 +++---- net/mptcp/pm.c | 32 +++-- net/mptcp/pm_netlink.c | 107 +++++++++----- net/mptcp/protocol.c | 65 +++++---- net/mptcp/protocol.h | 9 +- net/mptcp/sched.c | 4 +- net/mptcp/sockopt.c | 4 +- net/mptcp/subflow.c | 56 ++++---- net/sched/sch_fq.c | 4 +- net/sctp/sm_statefuns.c | 22 ++- security/apparmor/policy_unpack_test.c | 6 +- security/selinux/hooks.c | 4 +- security/smack/smack_lsm.c | 4 +- sound/core/seq/seq_clientmgr.c | 3 + sound/pci/hda/cs35l56_hda.c | 2 +- sound/pci/hda/patch_realtek.c | 2 + sound/soc/amd/acp/acp-legacy-mach.c | 2 + sound/soc/codecs/cs-amp-lib-test.c | 9 ++ sound/soc/codecs/cs-amp-lib.c | 7 +- sound/soc/sof/amd/acp-dsp-offset.h | 6 +- sound/soc/sof/amd/acp.c | 52 ++++--- sound/soc/sof/amd/acp.h | 9 +- sound/soc/sof/amd/pci-acp63.c | 2 + sound/soc/sof/amd/pci-rmb.c | 2 + sound/soc/sof/amd/pci-rn.c | 2 + tools/testing/selftests/iommu/iommufd.c | 6 +- .../selftests/net/forwarding/local_termination.sh | 4 + .../selftests/net/forwarding/no_forwarding.sh | 3 + tools/testing/selftests/net/mptcp/mptcp_join.sh | 57 +++++--- 156 files changed, 1613 insertions(+), 711 deletions(-)

1 year

9
159
0 0

[PATCH] ALSA: hda/realtek: extend quirks for Clevo V5[46]0

by Marek Marczykowski-Górecki

The mic in those laptops suffers too high gain resulting in mostly (fan or else) noise being recorded. In addition to the existing fixup about mic detection, apply also limiting its boost. While at it, extend the quirk to also V5[46]0TNE models, which have the same issue. Signed-off-by: Marek Marczykowski-Górecki <marmarek(a)invisiblethingslab.com> Cc: <stable(a)vger.kernel.org> --- Cc: Michał Kopeć <michal.kopec(a)3mdeb.com> --- sound/pci/hda/patch_realtek.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c index 588738ce7380..01e2414b8839 100644 --- a/sound/pci/hda/patch_realtek.c +++ b/sound/pci/hda/patch_realtek.c @@ -7637,6 +7637,7 @@ enum { ALC287_FIXUP_LENOVO_14ARP8_LEGION_IAH7, ALC287_FIXUP_LENOVO_SSID_17AA3820, ALCXXX_FIXUP_CS35LXX, + ALC245_FIXUP_CLEVO_NOISY_MIC, }; /* A special fixup for Lenovo C940 and Yoga Duet 7; @@ -9970,6 +9971,12 @@ static const struct hda_fixup alc269_fixups[] = { .type = HDA_FIXUP_FUNC, .v.func = cs35lxx_autodet_fixup, }, + [ALC245_FIXUP_CLEVO_NOISY_MIC] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc269_fixup_limit_int_mic_boost, + .chained = true, + .chain_id = ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE, + }, }; static const struct snd_pci_quirk alc269_fixup_tbl[] = { @@ -10619,7 +10626,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { SND_PCI_QUIRK(0x1558, 0xa600, "Clevo NL50NU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), SND_PCI_QUIRK(0x1558, 0xa650, "Clevo NP[567]0SN[CD]", ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE), SND_PCI_QUIRK(0x1558, 0xa671, "Clevo NP70SN[CDE]", ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE), - SND_PCI_QUIRK(0x1558, 0xa763, "Clevo V54x_6x_TU", ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0xa741, "Clevo V54x_6x_TNE", ALC245_FIXUP_CLEVO_NOISY_MIC), + SND_PCI_QUIRK(0x1558, 0xa763, "Clevo V54x_6x_TU", ALC245_FIXUP_CLEVO_NOISY_MIC), SND_PCI_QUIRK(0x1558, 0xb018, "Clevo NP50D[BE]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), SND_PCI_QUIRK(0x1558, 0xb019, "Clevo NH77D[BE]Q", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), SND_PCI_QUIRK(0x1558, 0xb022, "Clevo NH77D[DC][QW]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), -- 2.46.0

1 year

2
1
0 0

[PATCH] riscv: misaligned: Restrict user access to kernel memory

by Samuel Holland

raw_copy_{to,from}_user() do not call access_ok(), so this code allowed userspace to access any virtual memory address. Cc: stable(a)vger.kernel.org Fixes: 7c83232161f6 ("riscv: add support for misaligned trap handling in S-mode") Fixes: 441381506ba7 ("riscv: misaligned: remove CONFIG_RISCV_M_MODE specific code") Signed-off-by: Samuel Holland <samuel.holland(a)sifive.com> --- arch/riscv/kernel/traps_misaligned.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/riscv/kernel/traps_misaligned.c b/arch/riscv/kernel/traps_misaligned.c index b62d5a2f4541..1a76f99ff185 100644 --- a/arch/riscv/kernel/traps_misaligned.c +++ b/arch/riscv/kernel/traps_misaligned.c @@ -417,7 +417,7 @@ int handle_misaligned_load(struct pt_regs *regs) val.data_u64 = 0; if (user_mode(regs)) { - if (raw_copy_from_user(&val, (u8 __user *)addr, len)) + if (copy_from_user(&val, (u8 __user *)addr, len)) return -1; } else { memcpy(&val, (u8 *)addr, len); @@ -515,7 +515,7 @@ int handle_misaligned_store(struct pt_regs *regs) return -EOPNOTSUPP; if (user_mode(regs)) { - if (raw_copy_to_user((u8 __user *)addr, &val, len)) + if (copy_to_user((u8 __user *)addr, &val, len)) return -1; } else { memcpy((u8 *)addr, &val, len); -- 2.45.1

1 year

3
2
0 0

linux-stable-rc.git: queue/6.1 is tracking v6.10 kernel

by Matthieu Baerts

Hi Sasha, I hope you are well! If I'm not mistaken, I think you are the person managing the script updating the 'queue/*' branches from the linux-stable-rc git tree, right? It looks like the branch for the v6.1 is in fact tracking the v6.10 kernel instead: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git/… Are you the person who is able to fix that? If not, do you know who can fix that? These branches are really useful, not to have to apply patches from the 'stable-queue' tree. Thank you! I also just noticed that they are used by CIs, e.g. the one from Linaro: https://qa-reports.linaro.org/lkft/linux-stable-rc-queues-queue_6.1/ Cheers, Matt -- Sponsored by the NGI0 Core fund.

1 year

1
0
0 0

[PATCH v2] usb: typec: ucsi: Fix cable registration

by Heikki Krogerus

The Cable PD Revision field in GET_CABLE_PROPERTY was introduced in UCSI v2.1, so adding check for that. The cable properties are also not used anywhere after the cable is registered, so removing the cable_prop member from struct ucsi_connector while at it. Fixes: 38ca416597b0 ("usb: typec: ucsi: Register cables based on GET_CABLE_PROPERTY") Cc: stable(a)vger.kernel.org Signed-off-by: Heikki Krogerus <heikki.krogerus(a)linux.intel.com> --- Hi Greg, This version is for your usb-linus branch. The original [1] should apply on top of your usb-next branch. thanks, [1] https://lore.kernel.org/linux-usb/20240830130217.2155774-1-heikki.krogerus@… --- drivers/usb/typec/ucsi/ucsi.c | 30 +++++++++++++++--------------- drivers/usb/typec/ucsi/ucsi.h | 1 - 2 files changed, 15 insertions(+), 16 deletions(-) diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c index 9a799637754c..17155ed17fdf 100644 --- a/drivers/usb/typec/ucsi/ucsi.c +++ b/drivers/usb/typec/ucsi/ucsi.c @@ -965,10 +965,20 @@ static void ucsi_unregister_plug(struct ucsi_connector *con) static int ucsi_register_cable(struct ucsi_connector *con) { + struct ucsi_cable_property cable_prop; struct typec_cable *cable; struct typec_cable_desc desc = {}; + u64 command; + int ret; + + command = UCSI_GET_CABLE_PROPERTY | UCSI_CONNECTOR_NUMBER(con->num); + ret = ucsi_send_command(con->ucsi, command, &cable_prop, sizeof(cable_prop)); + if (ret < 0) { + dev_err(con->ucsi->dev, "GET_CABLE_PROPERTY failed (%d)\n", ret); + return ret; + } - switch (UCSI_CABLE_PROP_FLAG_PLUG_TYPE(con->cable_prop.flags)) { + switch (UCSI_CABLE_PROP_FLAG_PLUG_TYPE(cable_prop.flags)) { case UCSI_CABLE_PROPERTY_PLUG_TYPE_A: desc.type = USB_PLUG_TYPE_A; break; @@ -984,10 +994,10 @@ static int ucsi_register_cable(struct ucsi_connector *con) } desc.identity = &con->cable_identity; - desc.active = !!(UCSI_CABLE_PROP_FLAG_ACTIVE_CABLE & - con->cable_prop.flags); - desc.pd_revision = UCSI_CABLE_PROP_FLAG_PD_MAJOR_REV_AS_BCD( - con->cable_prop.flags); + desc.active = !!(UCSI_CABLE_PROP_FLAG_ACTIVE_CABLE & cable_prop.flags); + + if (con->ucsi->version >= UCSI_VERSION_2_1) + desc.pd_revision = UCSI_CABLE_PROP_FLAG_PD_MAJOR_REV_AS_BCD(cable_prop.flags); cable = typec_register_cable(con->port, &desc); if (IS_ERR(cable)) { @@ -1193,21 +1203,11 @@ static int ucsi_check_connection(struct ucsi_connector *con) static int ucsi_check_cable(struct ucsi_connector *con) { - u64 command; int ret, num_plug_am; if (con->cable) return 0; - command = UCSI_GET_CABLE_PROPERTY | UCSI_CONNECTOR_NUMBER(con->num); - ret = ucsi_send_command(con->ucsi, command, &con->cable_prop, - sizeof(con->cable_prop)); - if (ret < 0) { - dev_err(con->ucsi->dev, "GET_CABLE_PROPERTY failed (%d)\n", - ret); - return ret; - } - ret = ucsi_register_cable(con); if (ret < 0) return ret; diff --git a/drivers/usb/typec/ucsi/ucsi.h b/drivers/usb/typec/ucsi/ucsi.h index 57129f3c0814..5a3481d36d7a 100644 --- a/drivers/usb/typec/ucsi/ucsi.h +++ b/drivers/usb/typec/ucsi/ucsi.h @@ -465,7 +465,6 @@ struct ucsi_connector { struct ucsi_connector_status status; struct ucsi_connector_capability cap; - struct ucsi_cable_property cable_prop; struct power_supply *psy; struct power_supply_desc psy_desc; u32 rdo; -- 2.45.2

1 year

1
0
0 0

[PATCH v2 1/2] mmc: cqhci: Fix checking of CQHCI_HALT state

by Seunghwan Baek

To check if mmc cqe is in halt state, need to check set/clear of CQHCI_HALT bit. At this time, we need to check with &, not &&. Fixes: a4080225f51d ("mmc: cqhci: support for command queue enabled host") Cc: stable(a)vger.kernel.org Signed-off-by: Seunghwan Baek <sh8267.baek(a)samsung.com> --- drivers/mmc/host/cqhci-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/mmc/host/cqhci-core.c b/drivers/mmc/host/cqhci-core.c index c14d7251d0bb..a02da26a1efd 100644 --- a/drivers/mmc/host/cqhci-core.c +++ b/drivers/mmc/host/cqhci-core.c @@ -617,7 +617,7 @@ static int cqhci_request(struct mmc_host *mmc, struct mmc_request *mrq) cqhci_writel(cq_host, 0, CQHCI_CTL); mmc->cqe_on = true; pr_debug("%s: cqhci: CQE on\n", mmc_hostname(mmc)); - if (cqhci_readl(cq_host, CQHCI_CTL) && CQHCI_HALT) { + if (cqhci_readl(cq_host, CQHCI_CTL) & CQHCI_HALT) { pr_err("%s: cqhci: CQE failed to exit halt state\n", mmc_hostname(mmc)); } -- 2.17.1

1 year

4
3
0 0

[PATCH] usb: typec: ucsi: Fix cable registration

by Heikki Krogerus

The Cable PD Revision field in GET_CABLE_PROPERTY was introduced in UCSI v2.1, so adding check for that. The cable properties are also not used anywhere after the cable is registered, so removing the cable_prop member from struct ucsi_connector while at it. Fixes: 38ca416597b0 ("usb: typec: ucsi: Register cables based on GET_CABLE_PROPERTY") Cc: stable(a)vger.kernel.org Signed-off-by: Heikki Krogerus <heikki.krogerus(a)linux.intel.com> --- drivers/usb/typec/ucsi/ucsi.c | 30 +++++++++++++++--------------- drivers/usb/typec/ucsi/ucsi.h | 1 - 2 files changed, 15 insertions(+), 16 deletions(-) diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c index fad43f292e7f..35dce4057c25 100644 --- a/drivers/usb/typec/ucsi/ucsi.c +++ b/drivers/usb/typec/ucsi/ucsi.c @@ -911,10 +911,20 @@ static void ucsi_unregister_plug(struct ucsi_connector *con) static int ucsi_register_cable(struct ucsi_connector *con) { + struct ucsi_cable_property cable_prop; struct typec_cable *cable; struct typec_cable_desc desc = {}; + u64 command; + int ret; + + command = UCSI_GET_CABLE_PROPERTY | UCSI_CONNECTOR_NUMBER(con->num); + ret = ucsi_send_command(con->ucsi, command, &cable_prop, sizeof(cable_prop)); + if (ret < 0) { + dev_err(con->ucsi->dev, "GET_CABLE_PROPERTY failed (%d)\n", ret); + return ret; + } - switch (UCSI_CABLE_PROP_FLAG_PLUG_TYPE(con->cable_prop.flags)) { + switch (UCSI_CABLE_PROP_FLAG_PLUG_TYPE(cable_prop.flags)) { case UCSI_CABLE_PROPERTY_PLUG_TYPE_A: desc.type = USB_PLUG_TYPE_A; break; @@ -931,10 +941,10 @@ static int ucsi_register_cable(struct ucsi_connector *con) if (con->ucsi->cap.features & UCSI_CAP_GET_PD_MESSAGE) desc.identity = &con->cable_identity; - desc.active = !!(UCSI_CABLE_PROP_FLAG_ACTIVE_CABLE & - con->cable_prop.flags); - desc.pd_revision = UCSI_CABLE_PROP_FLAG_PD_MAJOR_REV_AS_BCD( - con->cable_prop.flags); + desc.active = !!(UCSI_CABLE_PROP_FLAG_ACTIVE_CABLE & cable_prop.flags); + + if (con->ucsi->version >= UCSI_VERSION_2_1) + desc.pd_revision = UCSI_CABLE_PROP_FLAG_PD_MAJOR_REV_AS_BCD(cable_prop.flags); cable = typec_register_cable(con->port, &desc); if (IS_ERR(cable)) { @@ -1141,21 +1151,11 @@ static int ucsi_check_connection(struct ucsi_connector *con) static int ucsi_check_cable(struct ucsi_connector *con) { - u64 command; int ret, num_plug_am; if (con->cable) return 0; - command = UCSI_GET_CABLE_PROPERTY | UCSI_CONNECTOR_NUMBER(con->num); - ret = ucsi_send_command(con->ucsi, command, &con->cable_prop, - sizeof(con->cable_prop)); - if (ret < 0) { - dev_err(con->ucsi->dev, "GET_CABLE_PROPERTY failed (%d)\n", - ret); - return ret; - } - ret = ucsi_register_cable(con); if (ret < 0) return ret; diff --git a/drivers/usb/typec/ucsi/ucsi.h b/drivers/usb/typec/ucsi/ucsi.h index 63cc7f982663..4a017eb6a65b 100644 --- a/drivers/usb/typec/ucsi/ucsi.h +++ b/drivers/usb/typec/ucsi/ucsi.h @@ -435,7 +435,6 @@ struct ucsi_connector { struct ucsi_connector_status status; struct ucsi_connector_capability cap; - struct ucsi_cable_property cable_prop; struct power_supply *psy; struct power_supply_desc psy_desc; u32 rdo; -- 2.45.2

1 year

2
2
0 0

[PATCH 6.6 00/93] 6.6.49-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.6.49 release. There are 93 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Tue, 03 Sep 2024 16:07:34 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.49-rc1… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.6.49-rc1 Guenter Roeck <linux(a)roeck-us.net> apparmor: fix policy_unpack_test on big endian systems Ben Hutchings <benh(a)debian.org> scsi: aacraid: Fix double-free on probe failure Markus Niebel <Markus.Niebel(a)ew.tq-group.com> arm64: dts: freescale: imx93-tqma9352-mba93xxla: fix typo Markus Niebel <Markus.Niebel(a)ew.tq-group.com> arm64: dts: freescale: imx93-tqma9352: fix CMA alloc-ranges Shenwei Wang <shenwei.wang(a)nxp.com> arm64: dts: imx93: update default value for snps,clk-csr Peng Fan <peng.fan(a)nxp.com> arm64: dts: imx93: add nvmem property for eqos Peng Fan <peng.fan(a)nxp.com> arm64: dts: imx93: add nvmem property for fec1 Adam Ford <aford173(a)gmail.com> arm64: dts: imx8mp-beacon-kit: Fix Stereo Audio on WM8962 Sicelo A. Mhlongo <absicsz(a)gmail.com> ARM: dts: omap3-n900: correct the accelerometer orientation Pawel Laszczak <pawell(a)cadence.com> usb: cdnsp: fix for Link TRB with TC Pawel Laszczak <pawell(a)cadence.com> usb: cdnsp: fix incorrect index in cdnsp_get_hw_deq function Zijun Hu <quic_zijuhu(a)quicinc.com> usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in remove_power_attributes() Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> usb: dwc3: st: add missing depopulate in probe error path Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> usb: dwc3: st: fix probed platform device ref count on probe error path Selvarasu Ganesan <selvarasu.g(a)samsung.com> usb: dwc3: core: Prevent USB core invalid event buffer address access Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> usb: dwc3: omap: add missing depopulate in probe error path Michal Vokáč <michal.vokac(a)ysoft.com> ARM: dts: imx6dl-yapp43: Increase LED current to match the yapp4 HW design ZHANG Yuntian <yt(a)radxa.com> USB: serial: option: add MeiG Smart SRM825L Yihang Li <liyihang9(a)huawei.com> scsi: sd: Ignore command SYNCHRONIZE CACHE error if format in progress Murali Nalajala <quic_mnalajal(a)quicinc.com> firmware: qcom: scm: Mark get_wq_ctx() as atomic call Ian Ray <ian.ray(a)gehealthcare.com> cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller Bjorn Andersson <quic_bjorande(a)quicinc.com> soc: qcom: pmic_glink: Fix race during initialization Bjorn Andersson <quic_bjorande(a)quicinc.com> soc: qcom: pmic_glink: Actually communicate when remote goes down Volodymyr Babchuk <Volodymyr_Babchuk(a)epam.com> soc: qcom: cmd-db: Map shared memory as WC, not WB Aleksandr Mishin <amishin(a)t-argos.ru> nfc: pn533: Add poll mod list filling check Eric Dumazet <edumazet(a)google.com> net: busy-poll: use ktime_get_ns() instead of local_clock() Ma Ke <make24(a)iscas.ac.cn> drm/amd/display: avoid using null object of framebuffer Ondrej Mosnacek <omosnace(a)redhat.com> sctp: fix association labeling in the duplicate COOKIE-ECHO case Cong Wang <cong.wang(a)bytedance.com> gtp: fix a potential NULL pointer dereference Jianbo Liu <jianbol(a)nvidia.com> bonding: change ipsec_lock from spin lock to mutex Jianbo Liu <jianbol(a)nvidia.com> bonding: extract the use of real_device into local variable Jianbo Liu <jianbol(a)nvidia.com> bonding: implement xdo_dev_state_free and call it after deletion Petr Machata <petrm(a)nvidia.com> selftests: forwarding: local_termination: Down ports on cleanup Petr Machata <petrm(a)nvidia.com> selftests: forwarding: no_forwarding: Down ports on cleanup Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables_ipv6: consider network offset in netdev/egress validation Jamie Bainbridge <jamie.bainbridge(a)gmail.com> ethtool: check device is present when getting link settings Anjaneyulu <pagadala.yesu.anjaneyulu(a)intel.com> wifi: iwlwifi: fw: fix wgds rev 3 exact size Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: restore IP sanity checks for netdev/egress Jason Gunthorpe <jgg(a)ziepe.ca> iommu: Do not return 0 from map_pages if it doesn't do anything Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_core: Fix not handling hibernation actions Neeraj Sanjay Kale <neeraj.sanjaykale(a)nxp.com> Bluetooth: btnxpuart: Fix random crash seen while removing driver Neeraj Sanjay Kale <neeraj.sanjaykale(a)nxp.com> Bluetooth: btnxpuart: Handle FW Download Abort scenario Neeraj Sanjay Kale <neeraj.sanjaykale(a)nxp.com> Bluetooth: btnxpuart: Resolve TX timeout error in power save stress test Serge Semin <fancer.lancer(a)gmail.com> dmaengine: dw: Add memory bus width verification Serge Semin <fancer.lancer(a)gmail.com> dmaengine: dw: Add peripheral bus width verification Piyush Mehta <piyush.mehta(a)amd.com> phy: xilinx: phy-zynqmp: Fix SGMII linkup failure on resume Mrinmay Sarkar <quic_msarkar(a)quicinc.com> dmaengine: dw-edma: Do not enable watermark interrupts for HDMA Mrinmay Sarkar <quic_msarkar(a)quicinc.com> dmaengine: dw-edma: Fix unmasking STOP and ABORT interrupts for HDMA Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> soundwire: stream: fix programming slave ports for non-continous port maps Xu Yang <xu.yang_2(a)nxp.com> phy: fsl-imx8mq-usb: fix tuning parameter name Jason Gunthorpe <jgg(a)ziepe.ca> iommufd: Do not allow creating areas without READ or WRITE Scott Mayhew <smayhew(a)redhat.com> selinux,smack: don't bypass permissions check in inode_setsecctx hook Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Revert "change alloc_pages name in dma_map_ops to avoid name conflicts" David Howells <dhowells(a)redhat.com> cifs: Fix FALLOC_FL_PUNCH_HOLE support David Howells <dhowells(a)redhat.com> mm: Fix missing folio invalidation calls during truncation Zhihao Cheng <chengzhihao1(a)huawei.com> ovl: ovl_parse_param_lowerdir: Add missed '\n' for pr_err Zhihao Cheng <chengzhihao1(a)huawei.com> ovl: fix wrong lowerdir number check for parameter Opt_lowerdir Christian Brauner <brauner(a)kernel.org> ovl: pass string to ovl_parse_layer() Hal Feng <hal.feng(a)starfivetech.com> pinctrl: starfive: jh7110: Correct the level trigger configuration of iev register Nícolas F. R. A. Prado <nfraprado(a)collabora.com> pinctrl: mediatek: common-v2: Fix broken bias-disable for PULL_PU_PD_RSEL_TYPE Vijendar Mukunda <Vijendar.Mukunda(a)amd.com> ASoC: SOF: amd: Fix for acp init sequence Yuntao Liu <liuyuntao12(a)huawei.com> ASoC: amd: acp: fix module autoloading Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> thermal: of: Fix OF node leak in of_thermal_zone_find() error paths Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> thermal: of: Fix OF node leak in thermal_of_trips_init() error path Jonathan Cameron <Jonathan.Cameron(a)huawei.com> of: Introduce for_each_*_child_of_node_scoped() to automate of_node_put() handling Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: typec: fix up incorrectly backported "usb: typec: tcpm: unregister existing source caps before re-registration" Steven Rostedt <rostedt(a)goodmis.org> tracing: Have format file honor EVENT_FILE_FL_FREED Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: Fix prime with external buffers Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/swsmu: always force a state reprogram on init Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu: align pp_power_profile_mode with kernel docs Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: join: check re-re-adding ID 0 endp Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: join: no extra msg if no counter Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: join: check removing ID 0 endpoint Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR 0 is not a new address Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: fix ID 0 endp usage after multiple re-creations Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: do not remove already closed subflows Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: send ACK on an active subflow Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: reset MPC endp ID when re-added Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: skip connecting to already established sf Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: reuse ID 0 after delete and re-add Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: sched: check both backup in retrans Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: close subflow when receiving TCP+FIN Haiyang Zhang <haiyangz(a)microsoft.com> net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response Sascha Hauer <s.hauer(a)pengutronix.de> wifi: mwifiex: duplicate static structs used in driver instances Alexander Sverdlin <alexander.sverdlin(a)siemens.com> wifi: wfx: repair open network AP mode Jonathan Cameron <Jonathan.Cameron(a)huawei.com> of: Add cleanup.h based auto release via __free(device_node) markings Ma Ke <make24(a)iscas.ac.cn> pinctrl: single: fix potential NULL dereference in pcs_get_function() Huang-Huang Bao <i(a)eh5.me> pinctrl: rockchip: correct RK3328 iomux width flag for GPIO2-B pins Stefan Metzmacher <metze(a)samba.org> smb/client: avoid dereferencing rdata=NULL in smb2_new_read_req() Josef Bacik <josef(a)toxicpanda.com> btrfs: run delayed iputs when flushing delalloc Qu Wenruo <wqu(a)suse.com> btrfs: fix a use-after-free when hitting errors inside btrfs_submit_chunk() Miao Wang <shankerwangmiao(a)gmail.com> LoongArch: Remove the unused dma-direct.h Takashi Iwai <tiwai(a)suse.de> ALSA: seq: Skip event type filtering for UMP events ------------- Diffstat: Makefile | 4 +- arch/alpha/kernel/pci_iommu.c | 2 +- .../arm/boot/dts/nxp/imx/imx6dl-yapp43-common.dtsi | 12 +- arch/arm/boot/dts/ti/omap/omap3-n900.dts | 2 +- .../arm64/boot/dts/freescale/imx8mp-beacon-kit.dts | 12 +- .../dts/freescale/imx93-tqma9352-mba93xxla.dts | 2 +- arch/arm64/boot/dts/freescale/imx93-tqma9352.dtsi | 2 +- arch/arm64/boot/dts/freescale/imx93.dtsi | 15 +- arch/loongarch/include/asm/dma-direct.h | 11 -- arch/mips/jazz/jazzdma.c | 2 +- arch/powerpc/kernel/dma-iommu.c | 2 +- arch/powerpc/platforms/ps3/system-bus.c | 4 +- arch/powerpc/platforms/pseries/vio.c | 2 +- arch/x86/kernel/amd_gart_64.c | 2 +- drivers/bluetooth/btnxpuart.c | 89 +++++++++--- drivers/dma/dw-edma/dw-hdma-v0-core.c | 26 ++-- drivers/dma/dw/core.c | 89 +++++++++++- drivers/firmware/qcom_scm-smc.c | 2 +- .../drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c | 9 +- drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 21 +-- drivers/gpu/drm/vmwgfx/vmwgfx_blit.c | 114 ++++++++++++++- drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c | 12 +- drivers/iommu/dma-iommu.c | 2 +- drivers/iommu/io-pgtable-arm-v7s.c | 3 +- drivers/iommu/io-pgtable-arm.c | 3 +- drivers/iommu/io-pgtable-dart.c | 3 +- drivers/iommu/iommufd/ioas.c | 8 ++ drivers/net/bonding/bond_main.c | 159 ++++++++++++++------- drivers/net/ethernet/microsoft/mana/hw_channel.c | 68 +++++---- drivers/net/gtp.c | 2 +- drivers/net/wireless/intel/iwlwifi/fw/acpi.c | 13 +- drivers/net/wireless/marvell/mwifiex/cfg80211.c | 32 ++++- drivers/net/wireless/silabs/wfx/sta.c | 5 +- drivers/nfc/pn533/pn533.c | 5 + drivers/parisc/ccio-dma.c | 2 +- drivers/parisc/sba_iommu.c | 2 +- drivers/phy/freescale/phy-fsl-imx8mq-usb.c | 2 +- drivers/phy/xilinx/phy-zynqmp.c | 56 ++++++++ drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c | 55 +++---- drivers/pinctrl/pinctrl-rockchip.c | 2 +- drivers/pinctrl/pinctrl-single.c | 2 + drivers/pinctrl/starfive/pinctrl-starfive-jh7110.c | 4 +- drivers/power/supply/qcom_battmgr.c | 16 ++- drivers/scsi/aacraid/comminit.c | 2 + drivers/scsi/sd.c | 12 +- drivers/soc/qcom/cmd-db.c | 2 +- drivers/soc/qcom/pmic_glink.c | 30 ++-- drivers/soc/qcom/pmic_glink_altmode.c | 17 ++- drivers/soundwire/stream.c | 8 +- drivers/thermal/thermal_of.c | 17 +-- drivers/usb/cdns3/cdnsp-gadget.h | 3 + drivers/usb/cdns3/cdnsp-ring.c | 30 +++- drivers/usb/class/cdc-acm.c | 3 + drivers/usb/core/sysfs.c | 1 + drivers/usb/dwc3/core.c | 8 ++ drivers/usb/dwc3/dwc3-omap.c | 4 +- drivers/usb/dwc3/dwc3-st.c | 16 +-- drivers/usb/serial/option.c | 5 + drivers/usb/typec/tcpm/tcpm.c | 14 +- drivers/usb/typec/ucsi/ucsi_glink.c | 16 ++- drivers/xen/grant-dma-ops.c | 2 +- drivers/xen/swiotlb-xen.c | 2 +- fs/btrfs/bio.c | 26 ++-- fs/btrfs/qgroup.c | 2 + fs/overlayfs/params.c | 51 ++----- fs/smb/client/smb2ops.c | 22 +++ fs/smb/client/smb2pdu.c | 2 +- include/linux/dma-map-ops.h | 2 +- include/linux/of.h | 15 ++ include/linux/soc/qcom/pmic_glink.h | 11 +- include/net/bonding.h | 2 +- include/net/busy_poll.h | 2 +- include/net/netfilter/nf_tables_ipv4.h | 10 +- include/net/netfilter/nf_tables_ipv6.h | 5 +- kernel/dma/mapping.c | 4 +- kernel/trace/trace.h | 23 +++ kernel/trace/trace_events.c | 33 +++-- kernel/trace/trace_events_hist.c | 4 +- kernel/trace/trace_events_inject.c | 2 +- kernel/trace/trace_events_trigger.c | 6 +- mm/truncate.c | 4 +- net/bluetooth/hci_core.c | 10 +- net/core/net-sysfs.c | 2 +- net/ethtool/ioctl.c | 3 + net/mptcp/pm.c | 4 +- net/mptcp/pm_netlink.c | 59 ++++++-- net/mptcp/protocol.c | 7 +- net/mptcp/protocol.h | 2 + net/mptcp/subflow.c | 8 +- net/sctp/sm_statefuns.c | 22 ++- security/apparmor/policy_unpack_test.c | 6 +- security/selinux/hooks.c | 4 +- security/smack/smack_lsm.c | 4 +- sound/core/seq/seq_clientmgr.c | 3 + sound/soc/amd/acp/acp-legacy-mach.c | 2 + sound/soc/sof/amd/acp.c | 19 ++- sound/soc/sof/amd/acp.h | 7 +- tools/testing/selftests/iommu/iommufd.c | 6 +- .../selftests/net/forwarding/local_termination.sh | 4 + .../selftests/net/forwarding/no_forwarding.sh | 3 + tools/testing/selftests/net/mptcp/mptcp_join.sh | 46 +++--- 102 files changed, 1075 insertions(+), 448 deletions(-)

1 year

7
100
0 0

[PATCH 1/3] platform/x86: panasonic-laptop: Check minimum SQTY value

by Hans de Goede

The panasonic laptop code in various places uses the sinf array with index values of 0 - SINF_CUR_BRIGHT(0x0d) without checking that the sinf array is big enough. Check for a minimum SQTY value of SINF_CUR_BRIGHT to avoid out of bounds accesses of the sinf array. Note SQTY returning SINF_CUR_BRIGHT is ok because the driver adds one extra entry to the sinf array. Fixes: e424fb8cc4e6 ("panasonic-laptop: avoid overflow in acpi_pcc_hotkey_add()") Cc: stable(a)vger.kernel.org Tested-by: James Harmison <jharmison(a)redhat.com> Signed-off-by: Hans de Goede <hdegoede(a)redhat.com> --- drivers/platform/x86/panasonic-laptop.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/platform/x86/panasonic-laptop.c b/drivers/platform/x86/panasonic-laptop.c index cf845ee1c7b1..d7f9017a5a13 100644 --- a/drivers/platform/x86/panasonic-laptop.c +++ b/drivers/platform/x86/panasonic-laptop.c @@ -963,8 +963,8 @@ static int acpi_pcc_hotkey_add(struct acpi_device *device) num_sifr = acpi_pcc_get_sqty(device); - if (num_sifr < 0 || num_sifr > 255) { - pr_err("num_sifr out of range"); + if (num_sifr < SINF_CUR_BRIGHT || num_sifr > 255) { + pr_err("num_sifr %d out of range %d - 255\n", num_sifr, SINF_CUR_BRIGHT); return -ENODEV; } -- 2.46.0

1 year

3
4
0 0

patch "iio: adc: ad7173: fix GPIO device info" added to char-misc-linus

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled iio: adc: ad7173: fix GPIO device info to my char-misc git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git in the char-misc-linus branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will hopefully also be merged in Linus's tree for the next -rc kernel release. If you have any questions about this process, please let me know. From f242967f4d1c024ac42bb47ea50b6360b4cb4556 Mon Sep 17 00:00:00 2001 From: Dumitru Ceclan <mitrutzceclan(a)gmail.com> Date: Fri, 9 Aug 2024 16:49:08 +0300 Subject: iio: adc: ad7173: fix GPIO device info Models AD4114/5/6 have .higher_gpio_bits = true. This is not correct as the only models that have the GPIO bits to a higher position are AD4111/2. Fix by removing the higher_gpio_bits = true from the AD4114/5/6 models. Fixes: 13d12e3ad12d ("iio: adc: ad7173: Add support for AD411x devices") Signed-off-by: Dumitru Ceclan <dumitru.ceclan(a)analog.com> Link: https://patch.msgid.link/20240809134909.26829-1-dumitru.ceclan@analog.com Cc: <Stable(a)vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> --- drivers/iio/adc/ad7173.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/drivers/iio/adc/ad7173.c b/drivers/iio/adc/ad7173.c index a854f2d30174..0702ec71aa29 100644 --- a/drivers/iio/adc/ad7173.c +++ b/drivers/iio/adc/ad7173.c @@ -302,7 +302,6 @@ static const struct ad7173_device_info ad4114_device_info = { .num_configs = 8, .num_voltage_in = 16, .num_gpios = 4, - .higher_gpio_bits = true, .has_vincom_input = true, .has_temp = true, .has_input_buf = true, @@ -320,7 +319,6 @@ static const struct ad7173_device_info ad4115_device_info = { .num_configs = 8, .num_voltage_in = 16, .num_gpios = 4, - .higher_gpio_bits = true, .has_vincom_input = true, .has_temp = true, .has_input_buf = true, @@ -338,7 +336,6 @@ static const struct ad7173_device_info ad4116_device_info = { .num_configs = 8, .num_voltage_in = 16, .num_gpios = 4, - .higher_gpio_bits = true, .has_vincom_input = true, .has_temp = true, .has_input_buf = true, -- 2.46.0

1 year

1
0
0 0

patch "iio: adc: ad7124: fix DT configuration parsing" added to char-misc-linus

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled iio: adc: ad7124: fix DT configuration parsing to my char-misc git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git in the char-misc-linus branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will hopefully also be merged in Linus's tree for the next -rc kernel release. If you have any questions about this process, please let me know. From 61cbfb5368dd50ed0d65ce21d305aa923581db2b Mon Sep 17 00:00:00 2001 From: Dumitru Ceclan <mitrutzceclan(a)gmail.com> Date: Tue, 6 Aug 2024 11:51:33 +0300 Subject: iio: adc: ad7124: fix DT configuration parsing The cfg pointer is set before reading the channel number that the configuration should point to. This causes configurations to be shifted by one channel. For example setting bipolar to the first channel defined in the DT will cause bipolar mode to be active on the second defined channel. Fix by moving the cfg pointer setting after reading the channel number. Fixes: 7b8d045e497a ("iio: adc: ad7124: allow more than 8 channels") Signed-off-by: Dumitru Ceclan <dumitru.ceclan(a)analog.com> Reviewed-by: Nuno Sa <nuno.sa(a)analog.com> Link: https://patch.msgid.link/20240806085133.114547-1-dumitru.ceclan@analog.com Cc: <Stable(a)vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> --- drivers/iio/adc/ad7124.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/iio/adc/ad7124.c b/drivers/iio/adc/ad7124.c index afb5f4d741e6..108e9ccab1ef 100644 --- a/drivers/iio/adc/ad7124.c +++ b/drivers/iio/adc/ad7124.c @@ -844,8 +844,6 @@ static int ad7124_parse_channel_config(struct iio_dev *indio_dev, st->channels = channels; device_for_each_child_node_scoped(dev, child) { - cfg = &st->channels[channel].cfg; - ret = fwnode_property_read_u32(child, "reg", &channel); if (ret) return ret; @@ -863,6 +861,7 @@ static int ad7124_parse_channel_config(struct iio_dev *indio_dev, st->channels[channel].ain = AD7124_CHANNEL_AINP(ain[0]) | AD7124_CHANNEL_AINM(ain[1]); + cfg = &st->channels[channel].cfg; cfg->bipolar = fwnode_property_read_bool(child, "bipolar"); ret = fwnode_property_read_u32(child, "adi,reference-select", &tmp); -- 2.46.0

1 year

1
0
0 0

patch "iio: adc: ad_sigma_delta: fix irq_flags on irq request" added to char-misc-linus

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled iio: adc: ad_sigma_delta: fix irq_flags on irq request to my char-misc git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git in the char-misc-linus branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will hopefully also be merged in Linus's tree for the next -rc kernel release. If you have any questions about this process, please let me know. From e81bb580ec08d7503c14c92157d810d306290003 Mon Sep 17 00:00:00 2001 From: Nuno Sa <nuno.sa(a)analog.com> Date: Tue, 6 Aug 2024 17:40:49 +0200 Subject: iio: adc: ad_sigma_delta: fix irq_flags on irq request With commit 7b0c9f8fa3d2 ("iio: adc: ad_sigma_delta: Add optional irq selection"), we can get the irq line from struct ad_sigma_delta_info instead of the spi device. However, in devm_ad_sd_probe_trigger(), when getting the irq_flags with irq_get_trigger_type() we are still using the spi device irq instead of the one used for devm_request_irq(). Fixes: 7b0c9f8fa3d2 ("iio: adc: ad_sigma_delta: Add optional irq selection") Signed-off-by: Nuno Sa <nuno.sa(a)analog.com> Link: https://patch.msgid.link/20240806-dev-fix-ad-sigma-delta-v1-1-aa25b173c063@… Cc: <stable(a)vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> --- drivers/iio/adc/ad_sigma_delta.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iio/adc/ad_sigma_delta.c b/drivers/iio/adc/ad_sigma_delta.c index 8c062b0d26e3..dcd557e93586 100644 --- a/drivers/iio/adc/ad_sigma_delta.c +++ b/drivers/iio/adc/ad_sigma_delta.c @@ -569,7 +569,7 @@ EXPORT_SYMBOL_NS_GPL(ad_sd_validate_trigger, IIO_AD_SIGMA_DELTA); static int devm_ad_sd_probe_trigger(struct device *dev, struct iio_dev *indio_dev) { struct ad_sigma_delta *sigma_delta = iio_device_get_drvdata(indio_dev); - unsigned long irq_flags = irq_get_trigger_type(sigma_delta->spi->irq); + unsigned long irq_flags = irq_get_trigger_type(sigma_delta->irq_line); int ret; if (dev != &sigma_delta->spi->dev) { -- 2.46.0

1 year

1
0
0 0

patch "iio: fix scale application in iio_convert_raw_to_processed_unlocked" added to char-misc-linus

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled iio: fix scale application in iio_convert_raw_to_processed_unlocked to my char-misc git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git in the char-misc-linus branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will hopefully also be merged in Linus's tree for the next -rc kernel release. If you have any questions about this process, please let me know. From 8a3dcc970dc57b358c8db2702447bf0af4e0d83a Mon Sep 17 00:00:00 2001 From: Matteo Martelli <matteomartelli3(a)gmail.com> Date: Tue, 30 Jul 2024 10:11:53 +0200 Subject: iio: fix scale application in iio_convert_raw_to_processed_unlocked When the scale_type is IIO_VAL_INT_PLUS_MICRO or IIO_VAL_INT_PLUS_NANO the scale passed as argument is only applied to the fractional part of the value. Fix it by also multiplying the integer part by the scale provided. Fixes: 48e44ce0f881 ("iio:inkern: Add function to read the processed value") Signed-off-by: Matteo Martelli <matteomartelli3(a)gmail.com> Link: https://patch.msgid.link/20240730-iio-fix-scale-v1-1-6246638c8daa@gmail.com Cc: <Stable(a)vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> --- drivers/iio/inkern.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c index 9f484c94bc6e..151099be2863 100644 --- a/drivers/iio/inkern.c +++ b/drivers/iio/inkern.c @@ -647,17 +647,17 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan, break; case IIO_VAL_INT_PLUS_MICRO: if (scale_val2 < 0) - *processed = -raw64 * scale_val; + *processed = -raw64 * scale_val * scale; else - *processed = raw64 * scale_val; + *processed = raw64 * scale_val * scale; *processed += div_s64(raw64 * (s64)scale_val2 * scale, 1000000LL); break; case IIO_VAL_INT_PLUS_NANO: if (scale_val2 < 0) - *processed = -raw64 * scale_val; + *processed = -raw64 * scale_val * scale; else - *processed = raw64 * scale_val; + *processed = raw64 * scale_val * scale; *processed += div_s64(raw64 * (s64)scale_val2 * scale, 1000000000LL); break; -- 2.46.0

1 year

1
0
0 0

patch "iio: adc: ad7124: fix config comparison" added to char-misc-linus

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled iio: adc: ad7124: fix config comparison to my char-misc git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git in the char-misc-linus branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will hopefully also be merged in Linus's tree for the next -rc kernel release. If you have any questions about this process, please let me know. From 2f6b92d0f69f04d9e2ea0db1228ab7f82f3173af Mon Sep 17 00:00:00 2001 From: Dumitru Ceclan <mitrutzceclan(a)gmail.com> Date: Wed, 31 Jul 2024 15:37:23 +0300 Subject: iio: adc: ad7124: fix config comparison The ad7124_find_similar_live_cfg() computes the compare size by substracting the address of the cfg struct from the address of the live field. Because the live field is the first field in the struct, the result is 0. Also, the memcmp() call is made from the start of the cfg struct, which includes the live and cfg_slot fields, which are not relevant for the comparison. Fix by grouping the relevant fields with struct_group() and use the size of the group to compute the compare size; make the memcmp() call from the address of the group. Fixes: 7b8d045e497a ("iio: adc: ad7124: allow more than 8 channels") Signed-off-by: Dumitru Ceclan <dumitru.ceclan(a)analog.com> Reviewed-by: Nuno Sa <nuno.sa(a)analog.com> Link: https://patch.msgid.link/20240731-ad7124-fix-v1-2-46a76aa4b9be@analog.com Cc: <Stable(a)vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> --- drivers/iio/adc/ad7124.c | 26 +++++++++++++++----------- 1 file changed, 15 insertions(+), 11 deletions(-) diff --git a/drivers/iio/adc/ad7124.c b/drivers/iio/adc/ad7124.c index c0b82f64c976..afb5f4d741e6 100644 --- a/drivers/iio/adc/ad7124.c +++ b/drivers/iio/adc/ad7124.c @@ -147,15 +147,18 @@ struct ad7124_chip_info { struct ad7124_channel_config { bool live; unsigned int cfg_slot; - enum ad7124_ref_sel refsel; - bool bipolar; - bool buf_positive; - bool buf_negative; - unsigned int vref_mv; - unsigned int pga_bits; - unsigned int odr; - unsigned int odr_sel_bits; - unsigned int filter_type; + /* Following fields are used to compare equality. */ + struct_group(config_props, + enum ad7124_ref_sel refsel; + bool bipolar; + bool buf_positive; + bool buf_negative; + unsigned int vref_mv; + unsigned int pga_bits; + unsigned int odr; + unsigned int odr_sel_bits; + unsigned int filter_type; + ); }; struct ad7124_channel { @@ -334,11 +337,12 @@ static struct ad7124_channel_config *ad7124_find_similar_live_cfg(struct ad7124_ ptrdiff_t cmp_size; int i; - cmp_size = (u8 *)&cfg->live - (u8 *)cfg; + cmp_size = sizeof_field(struct ad7124_channel_config, config_props); for (i = 0; i < st->num_channels; i++) { cfg_aux = &st->channels[i].cfg; - if (cfg_aux->live && !memcmp(cfg, cfg_aux, cmp_size)) + if (cfg_aux->live && + !memcmp(&cfg->config_props, &cfg_aux->config_props, cmp_size)) return cfg_aux; } -- 2.46.0

1 year

1
0
0 0

patch "iio: adc: ad7124: fix chip ID mismatch" added to char-misc-linus

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled iio: adc: ad7124: fix chip ID mismatch to my char-misc git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git in the char-misc-linus branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will hopefully also be merged in Linus's tree for the next -rc kernel release. If you have any questions about this process, please let me know. From 96f9ab0d5933c1c00142dd052f259fce0bc3ced2 Mon Sep 17 00:00:00 2001 From: Dumitru Ceclan <mitrutzceclan(a)gmail.com> Date: Wed, 31 Jul 2024 15:37:22 +0300 Subject: iio: adc: ad7124: fix chip ID mismatch The ad7124_soft_reset() function has the assumption that the chip will assert the "power-on reset" bit in the STATUS register after a software reset without any delay. The POR bit =0 is used to check if the chip initialization is done. A chip ID mismatch probe error appears intermittently when the probe continues too soon and the ID register does not contain the expected value. Fix by adding a 200us delay after the software reset command is issued. Fixes: b3af341bbd96 ("iio: adc: Add ad7124 support") Signed-off-by: Dumitru Ceclan <dumitru.ceclan(a)analog.com> Reviewed-by: Nuno Sa <nuno.sa(a)analog.com> Link: https://patch.msgid.link/20240731-ad7124-fix-v1-1-46a76aa4b9be@analog.com Cc: <Stable(a)vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> --- drivers/iio/adc/ad7124.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/iio/adc/ad7124.c b/drivers/iio/adc/ad7124.c index 3beed78496c5..c0b82f64c976 100644 --- a/drivers/iio/adc/ad7124.c +++ b/drivers/iio/adc/ad7124.c @@ -764,6 +764,7 @@ static int ad7124_soft_reset(struct ad7124_state *st) if (ret < 0) return ret; + fsleep(200); timeout = 100; do { ret = ad_sd_read_reg(&st->sd, AD7124_STATUS, 1, &readval); -- 2.46.0

1 year

1
0
0 0

patch "iio: adc: ad7606: remove frstdata check for serial mode" added to char-misc-linus

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled iio: adc: ad7606: remove frstdata check for serial mode to my char-misc git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git in the char-misc-linus branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will hopefully also be merged in Linus's tree for the next -rc kernel release. If you have any questions about this process, please let me know. From 90826e08468ba7fb35d8b39645b22d9e80004afe Mon Sep 17 00:00:00 2001 From: Guillaume Stols <gstols(a)baylibre.com> Date: Tue, 2 Jul 2024 12:52:51 +0000 Subject: iio: adc: ad7606: remove frstdata check for serial mode The current implementation attempts to recover from an eventual glitch in the clock by checking frstdata state after reading the first channel's sample: If frstdata is low, it will reset the chip and return -EIO. This will only work in parallel mode, where frstdata pin is set low after the 2nd sample read starts. For the serial mode, according to the datasheet, "The FRSTDATA output returns to a logic low following the 16th SCLK falling edge.", thus after the Xth pulse, X being the number of bits in a sample, the check will always be true, and the driver will not work at all in serial mode if frstdata(optional) is defined in the devicetree as it will reset the chip, and return -EIO every time read_sample is called. Hence, this check must be removed for serial mode. Fixes: b9618c0cacd7 ("staging: IIO: ADC: New driver for AD7606/AD7606-6/AD7606-4") Signed-off-by: Guillaume Stols <gstols(a)baylibre.com> Reviewed-by: Nuno Sa <nuno.sa(a)analog.com> Link: https://patch.msgid.link/20240702-cleanup-ad7606-v3-1-18d5ea18770e@baylibre… Cc: <Stable(a)vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> --- drivers/iio/adc/ad7606.c | 28 ++-------------------- drivers/iio/adc/ad7606.h | 2 ++ drivers/iio/adc/ad7606_par.c | 46 ++++++++++++++++++++++++++++++++++-- 3 files changed, 48 insertions(+), 28 deletions(-) diff --git a/drivers/iio/adc/ad7606.c b/drivers/iio/adc/ad7606.c index 3a417595294f..c321c6ef48df 100644 --- a/drivers/iio/adc/ad7606.c +++ b/drivers/iio/adc/ad7606.c @@ -49,7 +49,7 @@ static const unsigned int ad7616_oversampling_avail[8] = { 1, 2, 4, 8, 16, 32, 64, 128, }; -static int ad7606_reset(struct ad7606_state *st) +int ad7606_reset(struct ad7606_state *st) { if (st->gpio_reset) { gpiod_set_value(st->gpio_reset, 1); @@ -60,6 +60,7 @@ static int ad7606_reset(struct ad7606_state *st) return -ENODEV; } +EXPORT_SYMBOL_NS_GPL(ad7606_reset, IIO_AD7606); static int ad7606_reg_access(struct iio_dev *indio_dev, unsigned int reg, @@ -88,31 +89,6 @@ static int ad7606_read_samples(struct ad7606_state *st) { unsigned int num = st->chip_info->num_channels - 1; u16 *data = st->data; - int ret; - - /* - * The frstdata signal is set to high while and after reading the sample - * of the first channel and low for all other channels. This can be used - * to check that the incoming data is correctly aligned. During normal - * operation the data should never become unaligned, but some glitch or - * electrostatic discharge might cause an extra read or clock cycle. - * Monitoring the frstdata signal allows to recover from such failure - * situations. - */ - - if (st->gpio_frstdata) { - ret = st->bops->read_block(st->dev, 1, data); - if (ret) - return ret; - - if (!gpiod_get_value(st->gpio_frstdata)) { - ad7606_reset(st); - return -EIO; - } - - data++; - num--; - } return st->bops->read_block(st->dev, num, data); } diff --git a/drivers/iio/adc/ad7606.h b/drivers/iio/adc/ad7606.h index 0c6a88cc4695..6649e84d25de 100644 --- a/drivers/iio/adc/ad7606.h +++ b/drivers/iio/adc/ad7606.h @@ -151,6 +151,8 @@ int ad7606_probe(struct device *dev, int irq, void __iomem *base_address, const char *name, unsigned int id, const struct ad7606_bus_ops *bops); +int ad7606_reset(struct ad7606_state *st); + enum ad7606_supported_device_ids { ID_AD7605_4, ID_AD7606_8, diff --git a/drivers/iio/adc/ad7606_par.c b/drivers/iio/adc/ad7606_par.c index d8408052262e..6bc587b20f05 100644 --- a/drivers/iio/adc/ad7606_par.c +++ b/drivers/iio/adc/ad7606_par.c @@ -7,6 +7,7 @@ #include <linux/mod_devicetable.h> #include <linux/module.h> +#include <linux/gpio/consumer.h> #include <linux/platform_device.h> #include <linux/types.h> #include <linux/err.h> @@ -21,8 +22,29 @@ static int ad7606_par16_read_block(struct device *dev, struct iio_dev *indio_dev = dev_get_drvdata(dev); struct ad7606_state *st = iio_priv(indio_dev); - insw((unsigned long)st->base_address, buf, count); + /* + * On the parallel interface, the frstdata signal is set to high while + * and after reading the sample of the first channel and low for all + * other channels. This can be used to check that the incoming data is + * correctly aligned. During normal operation the data should never + * become unaligned, but some glitch or electrostatic discharge might + * cause an extra read or clock cycle. Monitoring the frstdata signal + * allows to recover from such failure situations. + */ + int num = count; + u16 *_buf = buf; + + if (st->gpio_frstdata) { + insw((unsigned long)st->base_address, _buf, 1); + if (!gpiod_get_value(st->gpio_frstdata)) { + ad7606_reset(st); + return -EIO; + } + _buf++; + num--; + } + insw((unsigned long)st->base_address, _buf, num); return 0; } @@ -35,8 +57,28 @@ static int ad7606_par8_read_block(struct device *dev, { struct iio_dev *indio_dev = dev_get_drvdata(dev); struct ad7606_state *st = iio_priv(indio_dev); + /* + * On the parallel interface, the frstdata signal is set to high while + * and after reading the sample of the first channel and low for all + * other channels. This can be used to check that the incoming data is + * correctly aligned. During normal operation the data should never + * become unaligned, but some glitch or electrostatic discharge might + * cause an extra read or clock cycle. Monitoring the frstdata signal + * allows to recover from such failure situations. + */ + int num = count; + u16 *_buf = buf; - insb((unsigned long)st->base_address, buf, count * 2); + if (st->gpio_frstdata) { + insb((unsigned long)st->base_address, _buf, 2); + if (!gpiod_get_value(st->gpio_frstdata)) { + ad7606_reset(st); + return -EIO; + } + _buf++; + num--; + } + insb((unsigned long)st->base_address, _buf, num * 2); return 0; } -- 2.46.0

1 year

1
0
0 0

patch "iio: buffer-dmaengine: fix releasing dma channel on error" added to char-misc-linus

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled iio: buffer-dmaengine: fix releasing dma channel on error to my char-misc git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git in the char-misc-linus branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will hopefully also be merged in Linus's tree for the next -rc kernel release. If you have any questions about this process, please let me know. From 84c65d8008764a8fb4e627ff02de01ec4245f2c4 Mon Sep 17 00:00:00 2001 From: David Lechner <dlechner(a)baylibre.com> Date: Tue, 23 Jul 2024 11:32:21 -0500 Subject: iio: buffer-dmaengine: fix releasing dma channel on error If dma_get_slave_caps() fails, we need to release the dma channel before returning an error to avoid leaking the channel. Fixes: 2d6ca60f3284 ("iio: Add a DMAengine framework based buffer") Signed-off-by: David Lechner <dlechner(a)baylibre.com> Link: https://patch.msgid.link/20240723-iio-fix-dmaengine-free-on-error-v1-1-2c7c… Cc: <Stable(a)vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> --- drivers/iio/buffer/industrialio-buffer-dmaengine.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/iio/buffer/industrialio-buffer-dmaengine.c b/drivers/iio/buffer/industrialio-buffer-dmaengine.c index 12aa1412dfa0..426cc614587a 100644 --- a/drivers/iio/buffer/industrialio-buffer-dmaengine.c +++ b/drivers/iio/buffer/industrialio-buffer-dmaengine.c @@ -237,7 +237,7 @@ static struct iio_buffer *iio_dmaengine_buffer_alloc(struct device *dev, ret = dma_get_slave_caps(chan, &caps); if (ret < 0) - goto err_free; + goto err_release; /* Needs to be aligned to the maximum of the minimums */ if (caps.src_addr_widths) @@ -263,6 +263,8 @@ static struct iio_buffer *iio_dmaengine_buffer_alloc(struct device *dev, return &dmaengine_buffer->queue.buffer; +err_release: + dma_release_channel(chan); err_free: kfree(dmaengine_buffer); return ERR_PTR(ret); -- 2.46.0

1 year

1
0
0 0

patch "staging: iio: frequency: ad9834: Validate frequency parameter value" added to char-misc-linus

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled staging: iio: frequency: ad9834: Validate frequency parameter value to my char-misc git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git in the char-misc-linus branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will hopefully also be merged in Linus's tree for the next -rc kernel release. If you have any questions about this process, please let me know. From b48aa991758999d4e8f9296c5bbe388f293ef465 Mon Sep 17 00:00:00 2001 From: Aleksandr Mishin <amishin(a)t-argos.ru> Date: Wed, 3 Jul 2024 18:45:06 +0300 Subject: staging: iio: frequency: ad9834: Validate frequency parameter value In ad9834_write_frequency() clk_get_rate() can return 0. In such case ad9834_calc_freqreg() call will lead to division by zero. Checking 'if (fout > (clk_freq / 2))' doesn't protect in case of 'fout' is 0. ad9834_write_frequency() is called from ad9834_write(), where fout is taken from text buffer, which can contain any value. Modify parameters checking. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 12b9d5bf76bf ("Staging: IIO: DDS: AD9833 / AD9834 driver") Suggested-by: Dan Carpenter <dan.carpenter(a)linaro.org> Signed-off-by: Aleksandr Mishin <amishin(a)t-argos.ru> Reviewed-by: Dan Carpenter <dan.carpenter(a)linaro.org> Link: https://patch.msgid.link/20240703154506.25584-1-amishin@t-argos.ru Cc: <Stable(a)vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> --- drivers/staging/iio/frequency/ad9834.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/staging/iio/frequency/ad9834.c b/drivers/staging/iio/frequency/ad9834.c index a7a5cdcc6590..47e7d7e6d920 100644 --- a/drivers/staging/iio/frequency/ad9834.c +++ b/drivers/staging/iio/frequency/ad9834.c @@ -114,7 +114,7 @@ static int ad9834_write_frequency(struct ad9834_state *st, clk_freq = clk_get_rate(st->mclk); - if (fout > (clk_freq / 2)) + if (!clk_freq || fout > (clk_freq / 2)) return -EINVAL; regval = ad9834_calc_freqreg(clk_freq, fout); -- 2.46.0

1 year

1
0
0 0

patch "iio: pressure: bmp280: Fix waiting time for BMP3xx configuration" added to char-misc-next

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled iio: pressure: bmp280: Fix waiting time for BMP3xx configuration to my char-misc git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git in the char-misc-next branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will also be merged in the next major kernel release during the merge window. If you have any questions about this process, please let me know. From 262a6634bcc4f0c1c53d13aa89882909f281a6aa Mon Sep 17 00:00:00 2001 From: Vasileios Amoiridis <vassilisamir(a)gmail.com> Date: Thu, 11 Jul 2024 23:15:50 +0200 Subject: iio: pressure: bmp280: Fix waiting time for BMP3xx configuration According to the datasheet, both pressure and temperature can go up to oversampling x32. With this option, the maximum measurement time is not 80ms (this is for press x32 and temp x2), but it is 130ms nominal (calculated from table 3.9.2) and since most of the maximum values are around +15%, it is configured to 150ms. Fixes: 8d329309184d ("iio: pressure: bmp280: Add support for BMP380 sensor family") Signed-off-by: Vasileios Amoiridis <vassilisamir(a)gmail.com> Link: https://patch.msgid.link/20240711211558.106327-3-vassilisamir@gmail.com Cc: <Stable(a)vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> --- drivers/iio/pressure/bmp280-core.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/iio/pressure/bmp280-core.c b/drivers/iio/pressure/bmp280-core.c index cc8553177977..3deaa57bb3f5 100644 --- a/drivers/iio/pressure/bmp280-core.c +++ b/drivers/iio/pressure/bmp280-core.c @@ -1581,10 +1581,11 @@ static int bmp380_chip_config(struct bmp280_data *data) } /* * Waits for measurement before checking configuration error - * flag. Selected longest measure time indicated in - * section 3.9.1 in the datasheet. + * flag. Selected longest measurement time, calculated from + * formula in datasheet section 3.9.2 with an offset of ~+15% + * as it seen as well in table 3.9.1. */ - msleep(80); + msleep(150); /* Check config error flag */ ret = regmap_read(data->regmap, BMP380_REG_ERROR, &tmp); -- 2.46.0

1 year

1
0
0 0

patch "iio: pressure: bmp280: Fix regmap for BMP280 device" added to char-misc-next

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled iio: pressure: bmp280: Fix regmap for BMP280 device to my char-misc git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git in the char-misc-next branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will also be merged in the next major kernel release during the merge window. If you have any questions about this process, please let me know. From b9065b0250e1705935445ede0a18c1850afe7b75 Mon Sep 17 00:00:00 2001 From: Vasileios Amoiridis <vassilisamir(a)gmail.com> Date: Thu, 11 Jul 2024 23:15:49 +0200 Subject: iio: pressure: bmp280: Fix regmap for BMP280 device Up to now, the BMP280 device is using the regmap of the BME280 which has registers that exist only in the BME280 device. Fixes: 14e8015f8569 ("iio: pressure: bmp280: split driver in logical parts") Signed-off-by: Vasileios Amoiridis <vassilisamir(a)gmail.com> Link: https://patch.msgid.link/20240711211558.106327-2-vassilisamir@gmail.com Cc: <Stable(a)vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> --- drivers/iio/pressure/bmp280-core.c | 2 +- drivers/iio/pressure/bmp280-regmap.c | 45 ++++++++++++++++++++++++++-- drivers/iio/pressure/bmp280.h | 1 + 3 files changed, 44 insertions(+), 4 deletions(-) diff --git a/drivers/iio/pressure/bmp280-core.c b/drivers/iio/pressure/bmp280-core.c index 2fc5724196e3..cc8553177977 100644 --- a/drivers/iio/pressure/bmp280-core.c +++ b/drivers/iio/pressure/bmp280-core.c @@ -1186,7 +1186,7 @@ const struct bmp280_chip_info bme280_chip_info = { .id_reg = BMP280_REG_ID, .chip_id = bme280_chip_ids, .num_chip_id = ARRAY_SIZE(bme280_chip_ids), - .regmap_config = &bmp280_regmap_config, + .regmap_config = &bme280_regmap_config, .start_up_time = 2000, .channels = bme280_channels, .num_channels = ARRAY_SIZE(bme280_channels), diff --git a/drivers/iio/pressure/bmp280-regmap.c b/drivers/iio/pressure/bmp280-regmap.c index fa52839474b1..d27d68edd906 100644 --- a/drivers/iio/pressure/bmp280-regmap.c +++ b/drivers/iio/pressure/bmp280-regmap.c @@ -41,7 +41,7 @@ const struct regmap_config bmp180_regmap_config = { }; EXPORT_SYMBOL_NS(bmp180_regmap_config, IIO_BMP280); -static bool bmp280_is_writeable_reg(struct device *dev, unsigned int reg) +static bool bme280_is_writeable_reg(struct device *dev, unsigned int reg) { switch (reg) { case BMP280_REG_CONFIG: @@ -54,7 +54,35 @@ static bool bmp280_is_writeable_reg(struct device *dev, unsigned int reg) } } +static bool bmp280_is_writeable_reg(struct device *dev, unsigned int reg) +{ + switch (reg) { + case BMP280_REG_CONFIG: + case BMP280_REG_CTRL_MEAS: + case BMP280_REG_RESET: + return true; + default: + return false; + } +} + static bool bmp280_is_volatile_reg(struct device *dev, unsigned int reg) +{ + switch (reg) { + case BMP280_REG_TEMP_XLSB: + case BMP280_REG_TEMP_LSB: + case BMP280_REG_TEMP_MSB: + case BMP280_REG_PRESS_XLSB: + case BMP280_REG_PRESS_LSB: + case BMP280_REG_PRESS_MSB: + case BMP280_REG_STATUS: + return true; + default: + return false; + } +} + +static bool bme280_is_volatile_reg(struct device *dev, unsigned int reg) { switch (reg) { case BME280_REG_HUMIDITY_LSB: @@ -71,7 +99,6 @@ static bool bmp280_is_volatile_reg(struct device *dev, unsigned int reg) return false; } } - static bool bmp380_is_writeable_reg(struct device *dev, unsigned int reg) { switch (reg) { @@ -167,7 +194,7 @@ const struct regmap_config bmp280_regmap_config = { .reg_bits = 8, .val_bits = 8, - .max_register = BME280_REG_HUMIDITY_LSB, + .max_register = BMP280_REG_TEMP_XLSB, .cache_type = REGCACHE_RBTREE, .writeable_reg = bmp280_is_writeable_reg, @@ -175,6 +202,18 @@ const struct regmap_config bmp280_regmap_config = { }; EXPORT_SYMBOL_NS(bmp280_regmap_config, IIO_BMP280); +const struct regmap_config bme280_regmap_config = { + .reg_bits = 8, + .val_bits = 8, + + .max_register = BME280_REG_HUMIDITY_LSB, + .cache_type = REGCACHE_RBTREE, + + .writeable_reg = bme280_is_writeable_reg, + .volatile_reg = bme280_is_volatile_reg, +}; +EXPORT_SYMBOL_NS(bme280_regmap_config, IIO_BMP280); + const struct regmap_config bmp380_regmap_config = { .reg_bits = 8, .val_bits = 8, diff --git a/drivers/iio/pressure/bmp280.h b/drivers/iio/pressure/bmp280.h index 0933e411ae2c..4b0ebce001df 100644 --- a/drivers/iio/pressure/bmp280.h +++ b/drivers/iio/pressure/bmp280.h @@ -490,6 +490,7 @@ extern const struct bmp280_chip_info bmp580_chip_info; /* Regmap configurations */ extern const struct regmap_config bmp180_regmap_config; extern const struct regmap_config bmp280_regmap_config; +extern const struct regmap_config bme280_regmap_config; extern const struct regmap_config bmp380_regmap_config; extern const struct regmap_config bmp580_regmap_config; -- 2.46.0

1 year

1
0
0 0

patch "iio: pressure: bmp280: Fix waiting time for BMP3xx configuration" added to char-misc-testing

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled iio: pressure: bmp280: Fix waiting time for BMP3xx configuration to my char-misc git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git in the char-misc-testing branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will be merged to the char-misc-next branch sometime soon, after it passes testing, and the merge window is open. If you have any questions about this process, please let me know. From 262a6634bcc4f0c1c53d13aa89882909f281a6aa Mon Sep 17 00:00:00 2001 From: Vasileios Amoiridis <vassilisamir(a)gmail.com> Date: Thu, 11 Jul 2024 23:15:50 +0200 Subject: iio: pressure: bmp280: Fix waiting time for BMP3xx configuration According to the datasheet, both pressure and temperature can go up to oversampling x32. With this option, the maximum measurement time is not 80ms (this is for press x32 and temp x2), but it is 130ms nominal (calculated from table 3.9.2) and since most of the maximum values are around +15%, it is configured to 150ms. Fixes: 8d329309184d ("iio: pressure: bmp280: Add support for BMP380 sensor family") Signed-off-by: Vasileios Amoiridis <vassilisamir(a)gmail.com> Link: https://patch.msgid.link/20240711211558.106327-3-vassilisamir@gmail.com Cc: <Stable(a)vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> --- drivers/iio/pressure/bmp280-core.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/iio/pressure/bmp280-core.c b/drivers/iio/pressure/bmp280-core.c index cc8553177977..3deaa57bb3f5 100644 --- a/drivers/iio/pressure/bmp280-core.c +++ b/drivers/iio/pressure/bmp280-core.c @@ -1581,10 +1581,11 @@ static int bmp380_chip_config(struct bmp280_data *data) } /* * Waits for measurement before checking configuration error - * flag. Selected longest measure time indicated in - * section 3.9.1 in the datasheet. + * flag. Selected longest measurement time, calculated from + * formula in datasheet section 3.9.2 with an offset of ~+15% + * as it seen as well in table 3.9.1. */ - msleep(80); + msleep(150); /* Check config error flag */ ret = regmap_read(data->regmap, BMP380_REG_ERROR, &tmp); -- 2.46.0

1 year

1
0
0 0

patch "iio: pressure: bmp280: Fix regmap for BMP280 device" added to char-misc-testing

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled iio: pressure: bmp280: Fix regmap for BMP280 device to my char-misc git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git in the char-misc-testing branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will be merged to the char-misc-next branch sometime soon, after it passes testing, and the merge window is open. If you have any questions about this process, please let me know. From b9065b0250e1705935445ede0a18c1850afe7b75 Mon Sep 17 00:00:00 2001 From: Vasileios Amoiridis <vassilisamir(a)gmail.com> Date: Thu, 11 Jul 2024 23:15:49 +0200 Subject: iio: pressure: bmp280: Fix regmap for BMP280 device Up to now, the BMP280 device is using the regmap of the BME280 which has registers that exist only in the BME280 device. Fixes: 14e8015f8569 ("iio: pressure: bmp280: split driver in logical parts") Signed-off-by: Vasileios Amoiridis <vassilisamir(a)gmail.com> Link: https://patch.msgid.link/20240711211558.106327-2-vassilisamir@gmail.com Cc: <Stable(a)vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> --- drivers/iio/pressure/bmp280-core.c | 2 +- drivers/iio/pressure/bmp280-regmap.c | 45 ++++++++++++++++++++++++++-- drivers/iio/pressure/bmp280.h | 1 + 3 files changed, 44 insertions(+), 4 deletions(-) diff --git a/drivers/iio/pressure/bmp280-core.c b/drivers/iio/pressure/bmp280-core.c index 2fc5724196e3..cc8553177977 100644 --- a/drivers/iio/pressure/bmp280-core.c +++ b/drivers/iio/pressure/bmp280-core.c @@ -1186,7 +1186,7 @@ const struct bmp280_chip_info bme280_chip_info = { .id_reg = BMP280_REG_ID, .chip_id = bme280_chip_ids, .num_chip_id = ARRAY_SIZE(bme280_chip_ids), - .regmap_config = &bmp280_regmap_config, + .regmap_config = &bme280_regmap_config, .start_up_time = 2000, .channels = bme280_channels, .num_channels = ARRAY_SIZE(bme280_channels), diff --git a/drivers/iio/pressure/bmp280-regmap.c b/drivers/iio/pressure/bmp280-regmap.c index fa52839474b1..d27d68edd906 100644 --- a/drivers/iio/pressure/bmp280-regmap.c +++ b/drivers/iio/pressure/bmp280-regmap.c @@ -41,7 +41,7 @@ const struct regmap_config bmp180_regmap_config = { }; EXPORT_SYMBOL_NS(bmp180_regmap_config, IIO_BMP280); -static bool bmp280_is_writeable_reg(struct device *dev, unsigned int reg) +static bool bme280_is_writeable_reg(struct device *dev, unsigned int reg) { switch (reg) { case BMP280_REG_CONFIG: @@ -54,7 +54,35 @@ static bool bmp280_is_writeable_reg(struct device *dev, unsigned int reg) } } +static bool bmp280_is_writeable_reg(struct device *dev, unsigned int reg) +{ + switch (reg) { + case BMP280_REG_CONFIG: + case BMP280_REG_CTRL_MEAS: + case BMP280_REG_RESET: + return true; + default: + return false; + } +} + static bool bmp280_is_volatile_reg(struct device *dev, unsigned int reg) +{ + switch (reg) { + case BMP280_REG_TEMP_XLSB: + case BMP280_REG_TEMP_LSB: + case BMP280_REG_TEMP_MSB: + case BMP280_REG_PRESS_XLSB: + case BMP280_REG_PRESS_LSB: + case BMP280_REG_PRESS_MSB: + case BMP280_REG_STATUS: + return true; + default: + return false; + } +} + +static bool bme280_is_volatile_reg(struct device *dev, unsigned int reg) { switch (reg) { case BME280_REG_HUMIDITY_LSB: @@ -71,7 +99,6 @@ static bool bmp280_is_volatile_reg(struct device *dev, unsigned int reg) return false; } } - static bool bmp380_is_writeable_reg(struct device *dev, unsigned int reg) { switch (reg) { @@ -167,7 +194,7 @@ const struct regmap_config bmp280_regmap_config = { .reg_bits = 8, .val_bits = 8, - .max_register = BME280_REG_HUMIDITY_LSB, + .max_register = BMP280_REG_TEMP_XLSB, .cache_type = REGCACHE_RBTREE, .writeable_reg = bmp280_is_writeable_reg, @@ -175,6 +202,18 @@ const struct regmap_config bmp280_regmap_config = { }; EXPORT_SYMBOL_NS(bmp280_regmap_config, IIO_BMP280); +const struct regmap_config bme280_regmap_config = { + .reg_bits = 8, + .val_bits = 8, + + .max_register = BME280_REG_HUMIDITY_LSB, + .cache_type = REGCACHE_RBTREE, + + .writeable_reg = bme280_is_writeable_reg, + .volatile_reg = bme280_is_volatile_reg, +}; +EXPORT_SYMBOL_NS(bme280_regmap_config, IIO_BMP280); + const struct regmap_config bmp380_regmap_config = { .reg_bits = 8, .val_bits = 8, diff --git a/drivers/iio/pressure/bmp280.h b/drivers/iio/pressure/bmp280.h index 0933e411ae2c..4b0ebce001df 100644 --- a/drivers/iio/pressure/bmp280.h +++ b/drivers/iio/pressure/bmp280.h @@ -490,6 +490,7 @@ extern const struct bmp280_chip_info bmp580_chip_info; /* Regmap configurations */ extern const struct regmap_config bmp180_regmap_config; extern const struct regmap_config bmp280_regmap_config; +extern const struct regmap_config bme280_regmap_config; extern const struct regmap_config bmp380_regmap_config; extern const struct regmap_config bmp580_regmap_config; -- 2.46.0

1 year

1
0
0 0

[PATCH v2] usb: xhci: fixes lost of data for xHCI Cadence Controllers

by Pawel Laszczak

Stream endpoint can skip part of TD during next transfer initialization after beginning stopped during active stream data transfer. The Set TR Dequeue Pointer command does not clear all internal transfer-related variables that position stream endpoint on transfer ring. USB Controller stores all endpoint state information within RsvdO fields inside endpoint context structure. For stream endpoints, all relevant information regarding particular StreamID is stored within corresponding Stream Endpoint context. Whenever driver wants to stop stream endpoint traffic, it invokes Stop Endpoint command which forces the controller to dump all endpoint state-related variables into RsvdO spaces into endpoint context and stream endpoint context. Whenever driver wants to reinitialize endpoint starting point on Transfer Ring, it uses the Set TR Dequeue Pointer command to update dequeue pointer for particular stream in Stream Endpoint Context. When stream endpoint is forced to stop active transfer in the middle of TD, it dumps an information about TRB bytes left in RsvdO fields in Stream Endpoint Context which will be used in next transfer initialization to designate starting point for XDMA. This field is not cleared during Set TR Dequeue Pointer command which causes XDMA to skip over transfer ring and leads to data loss on stream pipe. Patch fixes this by clearing out all RsvdO fields before initializing new transfer via that StreamID. Field Rsvd0 is reserved field, so patch should not have impact for other xHCI controllers. Fixes: 3d82904559f4 ("usb: cdnsp: cdns3 Add main part of Cadence USBSSP DRD Driver") cc: <stable(a)vger.kernel.org> Signed-off-by: Pawel Laszczak <pawell(a)cadence.com> --- Changelog: v2: - removed restoring of EDTLA field drivers/usb/host/xhci-ring.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c index 1dde53f6eb31..e5e1d665adab 100644 --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -1386,6 +1386,16 @@ static void xhci_handle_cmd_set_deq(struct xhci_hcd *xhci, int slot_id, struct xhci_stream_ctx *ctx = &ep->stream_info->stream_ctx_array[stream_id]; deq = le64_to_cpu(ctx->stream_ring) & SCTX_DEQ_MASK; + + /* + * Existing Cadence xHCI controllers store some endpoint state information + * within Rsvd0 fields of Stream Endpoint context. This field is not + * cleared during Set TR Dequeue Pointer command which causes XDMA to skip + * over transfer ring and leads to data loss on stream pipe. + * To fix this issue driver must clear Rsvd0 field. + */ + ctx->reserved[0] = 0; + ctx->reserved[1] = 0; } else { deq = le64_to_cpu(ep_ctx->deq) & ~EP_CTX_CYCLE_MASK; } -- 2.43.0

1 year

3
4
0 0

[PATCH RFC] syscalls/fanotify09: Note backport of commit e730558adffb

by cel＠kernel.org

From: Chuck Lever <chuck.lever(a)oracle.com> I backported commit e730558adffb ("fsnotify: consistent behavior for parent not watching children") to v5.15.y and v5.10.y. Update fanotify09 to test older LTS kernels containing that commit. Suggested-by: Amir Goldstein <amir73il(a)gmail.com> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> --- testcases/kernel/syscalls/fanotify/fanotify09.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) Untested. diff --git a/testcases/kernel/syscalls/fanotify/fanotify09.c b/testcases/kernel/syscalls/fanotify/fanotify09.c index f61c4e45a88c..48b198b9415a 100644 --- a/testcases/kernel/syscalls/fanotify/fanotify09.c +++ b/testcases/kernel/syscalls/fanotify/fanotify09.c @@ -29,7 +29,6 @@ * 7372e79c9eb9 fanotify: fix logic of reporting name info with watched parent * * Test cases #6-#7 are regression tests for commit: - * (from v5.19, unlikely to be backported thus not in .tags): * * e730558adffb fanotify: consistent behavior for parent not watching children */ @@ -380,9 +379,9 @@ static void test_fanotify(unsigned int n) return; } - if (tc->ignore && tst_kvercmp(5, 19, 0) < 0) { + if (tc->ignore && tst_kvercmp(5, 10, 0) < 0) { tst_res(TCONF, "ignored mask on parent dir has undefined " - "behavior on kernel < 5.19"); + "behavior on kernel < 5.10"); return; } @@ -520,6 +519,7 @@ static struct tst_test test = { {"linux-git", "b469e7e47c8a"}, {"linux-git", "55bf882c7f13"}, {"linux-git", "7372e79c9eb9"}, + {"linux-git", "e730558adffb"}, {} } }; -- 2.46.0

1 year

2
2
0 0

[PATCH 6.6] usb: typec: fix up incorrectly backported "usb: typec: tcpm: unregister existing source caps before re-registration"

by Greg Kroah-Hartman

In commit b16abab1fb64 ("usb: typec: tcpm: unregister existing source caps before re-registration"), quilt, and git, applied the diff to the incorrect function, which would cause bad problems if exercised in a device with these capabilities. Fix this all up (including the follow-up fix in commit 04c05d50fa79 ("usb: typec: tcpm: fix use-after-free case in tcpm_register_source_caps") to be in the correct function. Fixes: 04c05d50fa79 ("usb: typec: tcpm: fix use-after-free case in tcpm_register_source_caps") Fixes: b16abab1fb64 ("usb: typec: tcpm: unregister existing source caps before re-registration") Reported-by: Charles Yo <charlesyo(a)google.com> Cc: Kyle Tso <kyletso(a)google.com> Cc: Amit Sunil Dhamne <amitsd(a)google.com> Cc: Ondrej Jirman <megi(a)xff.cz> Cc: Heikki Krogerus <heikki.krogerus(a)linux.intel.com> Cc: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- Note, this is also needed for 6.1, I'll fix up the git ids when committing it to the stable tree there as well. drivers/usb/typec/tcpm/tcpm.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/drivers/usb/typec/tcpm/tcpm.c b/drivers/usb/typec/tcpm/tcpm.c index 7db9c382c354..e053b6e99b9e 100644 --- a/drivers/usb/typec/tcpm/tcpm.c +++ b/drivers/usb/typec/tcpm/tcpm.c @@ -2403,7 +2403,7 @@ static int tcpm_register_source_caps(struct tcpm_port *port) { struct usb_power_delivery_desc desc = { port->negotiated_rev }; struct usb_power_delivery_capabilities_desc caps = { }; - struct usb_power_delivery_capabilities *cap; + struct usb_power_delivery_capabilities *cap = port->partner_source_caps; if (!port->partner_pd) port->partner_pd = usb_power_delivery_register(NULL, &desc); @@ -2413,6 +2413,11 @@ static int tcpm_register_source_caps(struct tcpm_port *port) memcpy(caps.pdo, port->source_caps, sizeof(u32) * port->nr_source_caps); caps.role = TYPEC_SOURCE; + if (cap) { + usb_power_delivery_unregister_capabilities(cap); + port->partner_source_caps = NULL; + } + cap = usb_power_delivery_register_capabilities(port->partner_pd, &caps); if (IS_ERR(cap)) return PTR_ERR(cap); @@ -2426,7 +2431,7 @@ static int tcpm_register_sink_caps(struct tcpm_port *port) { struct usb_power_delivery_desc desc = { port->negotiated_rev }; struct usb_power_delivery_capabilities_desc caps = { }; - struct usb_power_delivery_capabilities *cap = port->partner_source_caps; + struct usb_power_delivery_capabilities *cap; if (!port->partner_pd) port->partner_pd = usb_power_delivery_register(NULL, &desc); @@ -2436,11 +2441,6 @@ static int tcpm_register_sink_caps(struct tcpm_port *port) memcpy(caps.pdo, port->sink_caps, sizeof(u32) * port->nr_sink_caps); caps.role = TYPEC_SINK; - if (cap) { - usb_power_delivery_unregister_capabilities(cap); - port->partner_source_caps = NULL; - } - cap = usb_power_delivery_register_capabilities(port->partner_pd, &caps); if (IS_ERR(cap)) return PTR_ERR(cap); -- 2.46.0

1 year

2
2
0 0

[PATCH RESEND] wifi: mt76: mt7996: fix NULL pointer dereference in mt7996_mcu_sta_bfer_he

by Ma Ke

Fix the NULL pointer dereference in mt7996_mcu_sta_bfer_he routine adding an sta interface to the mt7996 driver. Found by code review. Cc: stable(a)vger.kernel.org Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") Signed-off-by: Ma Ke <make24(a)iscas.ac.cn> --- drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c index 2e4fa9f48dfb..cba28d8d5562 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c @@ -1544,6 +1544,9 @@ mt7996_mcu_sta_bfer_he(struct ieee80211_sta *sta, struct ieee80211_vif *vif, u8 nss_mcs = mt7996_mcu_get_sta_nss(mcs_map); u8 snd_dim, sts; + if (!vc) + return; + bf->tx_mode = MT_PHY_TYPE_HE_SU; mt7996_mcu_sta_sounding_rate(bf); -- 2.25.1

1 year

2
1
0 0

[PATCH RESEND] drm/nouveau: fix a possible null pointer dereference

by Ma Ke

In ch7006_encoder_get_modes(), the return value of drm_mode_duplicate() is used directly in drm_mode_probed_add(), which will lead to a NULL pointer dereference on failure of drm_mode_duplicate(). Add a check to avoid npd. Cc: stable(a)vger.kernel.org Fixes: 6ee738610f41 ("drm/nouveau: Add DRM driver for NVIDIA GPUs") Signed-off-by: Ma Ke <make24(a)iscas.ac.cn> --- drivers/gpu/drm/i2c/ch7006_drv.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/i2c/ch7006_drv.c b/drivers/gpu/drm/i2c/ch7006_drv.c index 131512a5f3bd..48bf6e4e8bdb 100644 --- a/drivers/gpu/drm/i2c/ch7006_drv.c +++ b/drivers/gpu/drm/i2c/ch7006_drv.c @@ -229,6 +229,7 @@ static int ch7006_encoder_get_modes(struct drm_encoder *encoder, { struct ch7006_priv *priv = to_ch7006_priv(encoder); const struct ch7006_mode *mode; + struct drm_display_mode *encoder_mode = NULL; int n = 0; for (mode = ch7006_modes; mode->mode.clock; mode++) { @@ -236,8 +237,11 @@ static int ch7006_encoder_get_modes(struct drm_encoder *encoder, ~mode->valid_norms & 1<<priv->norm) continue; - drm_mode_probed_add(connector, - drm_mode_duplicate(encoder->dev, &mode->mode)); + encoder_mode = drm_mode_duplicate(encoder->dev, &mode->mode); + if (!encoder_mode) + return 0; + + drm_mode_probed_add(connector, encoder_mode); n++; } -- 2.25.1

1 year

1
0
0 0

+ ocfs2-fix-possible-null-ptr-deref-in-ocfs2_set_buffer_uptodate.patch added to mm-hotfixes-unstable branch

by Andrew Morton

The patch titled Subject: ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate has been added to the -mm mm-hotfixes-unstable branch. Its filename is ocfs2-fix-possible-null-ptr-deref-in-ocfs2_set_buffer_uptodate.patch This patch will shortly appear at https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche… This patch will later appear in the mm-hotfixes-unstable branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next via the mm-everything branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm and is updated there every 2-3 working days ------------------------------------------------------ From: Lizhi Xu <lizhi.xu(a)windriver.com> Subject: ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate Date: Mon, 2 Sep 2024 10:36:36 +0800 When doing cleanup, if flags without OCFS2_BH_READAHEAD, it may trigger NULL pointer dereference in the following ocfs2_set_buffer_uptodate() if bh is NULL. Link: https://lkml.kernel.org/r/20240902023636.1843422-3-joseph.qi@linux.alibaba.… Fixes: cf76c78595ca ("ocfs2: don't put and assigning null to bh allocated outside") Signed-off-by: Lizhi Xu <lizhi.xu(a)windriver.com> Signed-off-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Reported-by: Heming Zhao <heming.zhao(a)suse.com> Suggested-by: Heming Zhao <heming.zhao(a)suse.com> Cc: <stable(a)vger.kernel.org> [4.20+] Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Gang He <ghe(a)suse.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Jun Piao <piaojun(a)huawei.com> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Mark Fasheh <mark(a)fasheh.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- fs/ocfs2/buffer_head_io.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/fs/ocfs2/buffer_head_io.c~ocfs2-fix-possible-null-ptr-deref-in-ocfs2_set_buffer_uptodate +++ a/fs/ocfs2/buffer_head_io.c @@ -388,7 +388,8 @@ read_failure: /* Always set the buffer in the cache, even if it was * a forced read, or read-ahead which hasn't yet * completed. */ - ocfs2_set_buffer_uptodate(ci, bh); + if (bh) + ocfs2_set_buffer_uptodate(ci, bh); } ocfs2_metadata_cache_io_unlock(ci); _ Patches currently in -mm which might be from lizhi.xu(a)windriver.com are ocfs2-remove-unreasonable-unlock-in-ocfs2_read_blocks.patch ocfs2-fix-possible-null-ptr-deref-in-ocfs2_set_buffer_uptodate.patch

1 year

1
0
0 0

+ ocfs2-remove-unreasonable-unlock-in-ocfs2_read_blocks.patch added to mm-hotfixes-unstable branch

by Andrew Morton

The patch titled Subject: ocfs2: remove unreasonable unlock in ocfs2_read_blocks has been added to the -mm mm-hotfixes-unstable branch. Its filename is ocfs2-remove-unreasonable-unlock-in-ocfs2_read_blocks.patch This patch will shortly appear at https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche… This patch will later appear in the mm-hotfixes-unstable branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next via the mm-everything branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm and is updated there every 2-3 working days ------------------------------------------------------ From: Lizhi Xu <lizhi.xu(a)windriver.com> Subject: ocfs2: remove unreasonable unlock in ocfs2_read_blocks Date: Mon, 2 Sep 2024 10:36:35 +0800 Patch series "Misc fixes for ocfs2_read_blocks", v5. This series contains 2 fixes for ocfs2_read_blocks(). The first patch fix the issue reported by syzbot, which detects bad unlock balance in ocfs2_read_blocks(). The second patch fixes an issue reported by Heming Zhao when reviewing above fix. This patch (of 2): There was a lock release before exiting, so remove the unreasonable unlock. Link: https://lkml.kernel.org/r/20240902023636.1843422-1-joseph.qi@linux.alibaba.… Link: https://lkml.kernel.org/r/20240902023636.1843422-2-joseph.qi@linux.alibaba.… Fixes: cf76c78595ca ("ocfs2: don't put and assigning null to bh allocated outside") Signed-off-by: Lizhi Xu <lizhi.xu(a)windriver.com> Signed-off-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Reviewed-by: Heming Zhao <heming.zhao(a)suse.com> Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Reported-by: syzbot+ab134185af9ef88dfed5(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=ab134185af9ef88dfed5 Tested-by: syzbot+ab134185af9ef88dfed5(a)syzkaller.appspotmail.com Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Gang He <ghe(a)suse.com> Cc: Jun Piao <piaojun(a)huawei.com> Cc: <stable(a)vger.kernel.org> [4.20+] Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- fs/ocfs2/buffer_head_io.c | 1 - 1 file changed, 1 deletion(-) --- a/fs/ocfs2/buffer_head_io.c~ocfs2-remove-unreasonable-unlock-in-ocfs2_read_blocks +++ a/fs/ocfs2/buffer_head_io.c @@ -235,7 +235,6 @@ int ocfs2_read_blocks(struct ocfs2_cachi if (bhs[i] == NULL) { bhs[i] = sb_getblk(sb, block++); if (bhs[i] == NULL) { - ocfs2_metadata_cache_io_unlock(ci); status = -ENOMEM; mlog_errno(status); /* Don't forget to put previous bh! */ _ Patches currently in -mm which might be from lizhi.xu(a)windriver.com are ocfs2-remove-unreasonable-unlock-in-ocfs2_read_blocks.patch ocfs2-fix-possible-null-ptr-deref-in-ocfs2_set_buffer_uptodate.patch

1 year

1
0
0 0

Re: [PATCH 5.15 000/215] 5.15.166-rc1 review

by Richard Narron

I get "out of memory" build error on Slackware 15.0 (x86) with kernels 5.15.164, 5.15.165, and 5.15.166-rc1. #uname -a Linux aragorn 5.15.166-rc1-smp #1 SMP PREEMPT Mon Sep 2 14:03:00 PDT 2024 i686 AMD Ryzen 9 5900X 12-Core Processor AuthenticAMD GNU/Linux The attached configuration I use is the standard Slackware 15.0: config-huge-smp-5.15.161-smp Here is some of the error log for the 5.15.166-rc1 build: ... LD [M] drivers/mtd/tests/mtd_stresstest.o LD [M] drivers/pcmcia/pcmcia_core.o LD [M] drivers/mtd/tests/mtd_subpagetest.o cc1: out of memory allocating 180705472 bytes after a total of 283914240 bytes LD [M] drivers/mtd/tests/mtd_torturetest.o CC [M] drivers/mtd/ubi/wl.o LD [M] drivers/pcmcia/pcmcia.o CC [M] drivers/gpu/drm/nouveau/nvkm/engine/disp/headgv100.o CC [M] drivers/gpu/drm/amd/amdgpu/../display/dc/dce/dmub_hw_lock_mgr.o LD [M] drivers/mtd/tests/mtd_nandbiterrs.o CC [M] drivers/mtd/ubi/attach.o LD [M] drivers/staging/qlge/qlge.o make[4]: *** [scripts/Makefile.build:289: drivers/staging/media/atomisp/pci/isp/kernels/ynr/ynr_1.0/ia_css_ynr.host.o] Er ror 1 make[3]: *** [scripts/Makefile.build:552: drivers/staging/media/atomisp] Error 2 make[2]: *** [scripts/Makefile.build:552: drivers/staging/media] Error 2 make[2]: *** Waiting for unfinished jobs.... LD [M] drivers/pcmcia/pcmcia_rsrc.o CC [M] drivers/gpu/drm/amd/amdgpu/../display/dc/dce/dmub_outbox.o make[1]: *** [scripts/Makefile.build:552: drivers/staging] Error 2 make[1]: *** Waiting for unfinished jobs.... ... I have a work around... When I unpatch these 6 minmax patches taken from kernel-5.15.164 then the errors are fixed! minmax: allow comparisons of 'int' against 'unsigned char/short' minmax: allow min()/max()/clamp() if the arguments have the same minmax: clamp more efficiently by avoiding extra comparison minmax: fix header inclusions minmax: relax check to allow comparison between unsigned arguments minmax: sanity check constant bounds when clamping Can the minmax patches be removed or fixed?

1 year

1
0
0 0

+ ocfs2-fix-null-ptr-deref-when-journal-load-failed.patch added to mm-hotfixes-unstable branch

by Andrew Morton

The patch titled Subject: ocfs2: fix null-ptr-deref when journal load failed. has been added to the -mm mm-hotfixes-unstable branch. Its filename is ocfs2-fix-null-ptr-deref-when-journal-load-failed.patch This patch will shortly appear at https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche… This patch will later appear in the mm-hotfixes-unstable branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next via the mm-everything branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm and is updated there every 2-3 working days ------------------------------------------------------ From: Julian Sun <sunjunchao2870(a)gmail.com> Subject: ocfs2: fix null-ptr-deref when journal load failed. Date: Mon, 2 Sep 2024 11:08:44 +0800 During the mounting process, if journal_reset() fails because of too short journal, then lead to jbd2_journal_load() fails with NULL j_sb_buffer. Subsequently, ocfs2_journal_shutdown() calls jbd2_journal_flush()->jbd2_cleanup_journal_tail()-> __jbd2_update_log_tail()->jbd2_journal_update_sb_log_tail() ->lock_buffer(journal->j_sb_buffer), resulting in a null-pointer dereference error. To resolve this issue, we should check the JBD2_LOADED flag to ensure the journal was properly loaded. Additionally, use journal instead of osb->journal directly to simplify the code. Link: https://syzkaller.appspot.com/bug?extid=05b9b39d8bdfe1a0861f Link: https://lkml.kernel.org/r/20240902030844.422725-1-sunjunchao2870@gmail.com Fixes: f6f50e28f0cb ("jbd2: Fail to load a journal if it is too short") Signed-off-by: Julian Sun <sunjunchao2870(a)gmail.com> Reported-by: syzbot+05b9b39d8bdfe1a0861f(a)syzkaller.appspotmail.com Suggested-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Gang He <ghe(a)suse.com> Cc: Jun Piao <piaojun(a)huawei.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- fs/ocfs2/journal.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) --- a/fs/ocfs2/journal.c~ocfs2-fix-null-ptr-deref-when-journal-load-failed +++ a/fs/ocfs2/journal.c @@ -1055,7 +1055,7 @@ void ocfs2_journal_shutdown(struct ocfs2 if (!igrab(inode)) BUG(); - num_running_trans = atomic_read(&(osb->journal->j_num_trans)); + num_running_trans = atomic_read(&(journal->j_num_trans)); trace_ocfs2_journal_shutdown(num_running_trans); /* Do a commit_cache here. It will flush our journal, *and* @@ -1074,9 +1074,10 @@ void ocfs2_journal_shutdown(struct ocfs2 osb->commit_task = NULL; } - BUG_ON(atomic_read(&(osb->journal->j_num_trans)) != 0); + BUG_ON(atomic_read(&(journal->j_num_trans)) != 0); - if (ocfs2_mount_local(osb)) { + if (ocfs2_mount_local(osb) && + (journal->j_journal->j_flags & JBD2_LOADED)) { jbd2_journal_lock_updates(journal->j_journal); status = jbd2_journal_flush(journal->j_journal, 0); jbd2_journal_unlock_updates(journal->j_journal); _ Patches currently in -mm which might be from sunjunchao2870(a)gmail.com are ocfs2-fix-null-ptr-deref-when-journal-load-failed.patch

1 year

1
0
0 0

[PATCH RFC 0/8] extensible syscalls: CHECK_FIELDS to allow for easier feature detection

by Aleksa Sarai

This is something that I've been thinking about for a while. We had a discussion at LPC 2020 about this[1] but the proposals suggested there never materialised. In short, it is quite difficult for userspace to detect the feature capability of syscalls at runtime. This is something a lot of programs want to do, but they are forced to create elaborate scenarios to try to figure out if a feature is supported without causing damage to the system. For the vast majority of cases, each individual feature also needs to be tested individually (because syscall results are all-or-nothing), so testing even a single syscall's feature set can easily inflate the startup time of programs. This patchset implements the fairly minimal design I proposed in this talk[2] and in some old LKML threads (though I can't find the exact references ATM). The general flow looks like: 1. Userspace will indicate to the kernel that a syscall should a be no-op by setting the top bit of the extensible struct size argument. We will almost certainly never support exabyte sized structs, so the top bits are free for us to use as makeshift flag bits. This is preferable to using the per-syscall flag field inside the structure because seccomp can easily detect the bit in the flag and allow the probe or forcefully return -EEXTSYS_NOOP. 2. The kernel will then fill the provided structure with every valid bit pattern that the current kernel understands. For flags or other bitflag-like fields, this is the set of valid flags or bits. For pointer fields or fields that take an arbitrary value, the field has every bit set (0xFF... to fill the field) to indicate that any value is valid in the field. 3. The syscall then returns -EEXTSYS_NOOP which is an errno that will only ever be used for this purpose (so userspace can be sure that the request succeeded). On older kernels, the syscall will return a different error (usually -E2BIG or -EFAULT) and userspace can do their old-fashioned checks. 4. Userspace can then check which flags and fields are supported by looking at the fields in the returned structure. Flags are checked by doing an AND with the flags field, and field support can checked by comparing to 0. In principle you could just AND the entire structure if you wanted to do this check generically without caring about the structure contents (this is what libraries might consider doing). Userspace can even find out the internal kernel structure size by passing a PAGE_SIZE buffer and seeing how many bytes are non-zero. As with copy_struct_from_user(), this is designed to be forward- and backwards- compatible. This allows programas to get a one-shot understanding of what features a syscall supports without having to do any elaborate setups or tricks to detect support for destructive features. Flags can simply be ANDed to check if they are in the supported set, and fields can just be checked to see if they are non-zero. This patchset is IMHO the simplest way we can add the ability to introspect the feature set of extensible struct (copy_struct_from_user) syscalls. It doesn't preclude the chance of a more generic mechanism being added later. The intended way of using this interface to get feature information looks something like the following (imagine that openat2 has gained a new field and a new flag in the future): static bool openat2_no_automount_supported; static bool openat2_cwd_fd_supported; int check_openat2_support(void) { int err; struct open_how how = {}; err = openat2(AT_FDCWD, ".", &how, CHECK_FIELDS | sizeof(how)); assert(err < 0); switch (errno) { case EFAULT: case E2BIG: /* Old kernel... */ check_support_the_old_way(); break; case EEXTSYS_NOOP: openat2_no_automount_supported = (how.flags & RESOLVE_NO_AUTOMOUNT); openat2_cwd_fd_supported = (how.cwd_fd != 0); break; } } [1]: https://lwn.net/Articles/830666/ [2]: https://youtu.be/ggD-eb3yPVs Signed-off-by: Aleksa Sarai <cyphar(a)cyphar.com> --- Aleksa Sarai (8): uaccess: add copy_struct_to_user helper sched_getattr: port to copy_struct_to_user openat2: explicitly return -E2BIG for (usize > PAGE_SIZE) openat2: add CHECK_FIELDS flag to usize argument clone3: add CHECK_FIELDS flag to usize argument selftests: openat2: add 0xFF poisoned data after misaligned struct selftests: openat2: add CHECK_FIELDS selftests selftests: clone3: add CHECK_FIELDS selftests fs/open.c | 17 ++ include/linux/uaccess.h | 98 +++++++++ include/uapi/asm-generic/errno.h | 3 + include/uapi/linux/openat2.h | 2 + kernel/fork.c | 33 ++- kernel/sched/syscalls.c | 42 +--- tools/testing/selftests/clone3/.gitignore | 1 + tools/testing/selftests/clone3/Makefile | 2 +- .../testing/selftests/clone3/clone3_check_fields.c | 229 +++++++++++++++++++++ tools/testing/selftests/openat2/openat2_test.c | 126 +++++++++++- 10 files changed, 504 insertions(+), 49 deletions(-) --- base-commit: 431c1646e1f86b949fa3685efc50b660a364c2b6 change-id: 20240803-extensible-structs-check_fields-a47e94cef691 Best regards, -- Aleksa Sarai <cyphar(a)cyphar.com>

1 year

2
4
0 0

[PATCH] arm64: dts: mediatek: mt8186-corsola: Disable DPI display interface

by Chen-Yu Tsai

The DPI display interface feeds the external display pipeline. However the pipeline representation is currently incomplete. Efforts are still under way to come up with a way to represent the "creative" repurposing of the DP bridge chip's internal output mux, which is meant to support USB type-C orientation changes, to output to one of two type-C ports. Until that is finalized, the external display can't be fully described, and thus won't work. Even worse, the half complete graph potentially confuses the OS, breaking the internal display as well. Disable the external display interface across the whole Corsola family until the DP / USB Type-C muxing graph binding is ready. Reported-by: Alper Nebi Yasak <alpernebiyasak(a)gmail.com> Closes: https://lore.kernel.org/linux-mediatek/38a703a9-6efb-456a-a248-1dd3687e526d… Fixes: 8855d01fb81f ("arm64: dts: mediatek: Add MT8186 Krabby platform based Tentacruel / Tentacool") Cc: <stable(a)vger.kernel.org> Signed-off-by: Chen-Yu Tsai <wenst(a)chromium.org> --- Stephen has recently posted the "platform/chrome: Add DT USB/DP muxing/topology support" patch series, which is now up to v3 [1]. More work based on this series is needed for the DP bridge drivers. [1] https://lore.kernel.org/dri-devel/20240819223834.2049862-1-swboyd@chromium.… --- arch/arm64/boot/dts/mediatek/mt8186-corsola.dtsi | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/arch/arm64/boot/dts/mediatek/mt8186-corsola.dtsi b/arch/arm64/boot/dts/mediatek/mt8186-corsola.dtsi index 0c4a26117428..682c6ad2574d 100644 --- a/arch/arm64/boot/dts/mediatek/mt8186-corsola.dtsi +++ b/arch/arm64/boot/dts/mediatek/mt8186-corsola.dtsi @@ -353,7 +353,8 @@ &dpi { pinctrl-names = "default", "sleep"; pinctrl-0 = <&dpi_pins_default>; pinctrl-1 = <&dpi_pins_sleep>; - status = "okay"; + /* TODO Re-enable after DP to Type-C port muxing can be described */ + status = "disabled"; }; &dpi_out { -- 2.46.0.184.g6999bdac58-goog

1 year

4
3
0 0

[PATCH V5] scsi: ufs: qcom: update MODE_MAX cfg_bw value

by Manish Pandey

Commit 8db8f6ce556a ("scsi: ufs: qcom: Add missing interconnect bandwidth values for Gear 5") updates the ufs_qcom_bw_table for Gear 5. However, it misses updating the cfg_bw value for the max mode. Hence update the cfg_bw value for the max mode for UFS 4.x devices. Fixes: 8db8f6ce556a ("scsi: ufs: qcom: Add missing interconnect bandwidth values for Gear 5") Cc: stable(a)vger.kernel.org Signed-off-by: Manish Pandey <quic_mapa(a)quicinc.com> --- Changes from v4: - Updated commit message. Changes from v3: - Cced stable(a)vger.kernel.org. Changes from v2: - Addressed Mani comment, added fixes tag. Changes from v1: - Updated commit message. --- drivers/ufs/host/ufs-qcom.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/ufs/host/ufs-qcom.c b/drivers/ufs/host/ufs-qcom.c index c87fdc849c62..ecdfff2456e3 100644 --- a/drivers/ufs/host/ufs-qcom.c +++ b/drivers/ufs/host/ufs-qcom.c @@ -93,7 +93,7 @@ static const struct __ufs_qcom_bw_table { [MODE_HS_RB][UFS_HS_G3][UFS_LANE_2] = { 1492582, 204800 }, [MODE_HS_RB][UFS_HS_G4][UFS_LANE_2] = { 2915200, 409600 }, [MODE_HS_RB][UFS_HS_G5][UFS_LANE_2] = { 5836800, 819200 }, - [MODE_MAX][0][0] = { 7643136, 307200 }, + [MODE_MAX][0][0] = { 7643136, 819200 }, }; static void ufs_qcom_get_default_testbus_cfg(struct ufs_qcom_host *host); -- 2.17.1

1 year

2
1
0 0

[PATCH 5.15 0/1] pm, restore async device resume optimization

by Yenchia Chen

From: "yenchia.chen" <yenchia.chen(a)mediatek.com> We have met a deadlock issue on our device when resuming. After applying this patch which is picked from mainline, issue solved. We'd like to backport to 5.15.y and could you help to review? thanks. [ Upstream commit 3e999770ac1c7c31a70685dd5b88e89473509e9c ] Rafael J. Wysocki (1): PM: sleep: Restore asynchronous device resume optimization drivers/base/power/main.c | 117 +++++++++++++++++++++----------------- include/linux/pm.h | 1 + 2 files changed, 65 insertions(+), 53 deletions(-) -- 2.18.0

1 year

3
6
0 0

[PATCH] usb: cdns2: Fix controller reset issue

by Pawel Laszczak

Patch fixes the procedure of resetting controller. The CPUCTRL register is write only and reading returns 0. Waiting for reset to complite is incorrect. Fixes: 3eb1f1efe204 ("usb: cdns2: Add main part of Cadence USBHS driver") cc: <stable(a)vger.kernel.org> Signed-off-by: Pawel Laszczak <pawell(a)cadence.com> --- drivers/usb/gadget/udc/cdns2/cdns2-gadget.c | 12 +++--------- drivers/usb/gadget/udc/cdns2/cdns2-gadget.h | 9 +++++++++ 2 files changed, 12 insertions(+), 9 deletions(-) diff --git a/drivers/usb/gadget/udc/cdns2/cdns2-gadget.c b/drivers/usb/gadget/udc/cdns2/cdns2-gadget.c index 0eed0e03842c..d394affb7072 100644 --- a/drivers/usb/gadget/udc/cdns2/cdns2-gadget.c +++ b/drivers/usb/gadget/udc/cdns2/cdns2-gadget.c @@ -2251,7 +2251,6 @@ static int cdns2_gadget_start(struct cdns2_device *pdev) { u32 max_speed; void *buf; - int val; int ret; pdev->usb_regs = pdev->regs; @@ -2261,14 +2260,9 @@ static int cdns2_gadget_start(struct cdns2_device *pdev) pdev->adma_regs = pdev->regs + CDNS2_ADMA_REGS_OFFSET; /* Reset controller. */ - set_reg_bit_8(&pdev->usb_regs->cpuctrl, CPUCTRL_SW_RST); - - ret = readl_poll_timeout_atomic(&pdev->usb_regs->cpuctrl, val, - !(val & CPUCTRL_SW_RST), 1, 10000); - if (ret) { - dev_err(pdev->dev, "Error: reset controller timeout\n"); - return -EINVAL; - } + writeb(CPUCTRL_SW_RST | CPUCTRL_UPCLK | CPUCTRL_WUEN, + &pdev->usb_regs->cpuctrl); + usleep_range(5, 10); usb_initialize_gadget(pdev->dev, &pdev->gadget, NULL); diff --git a/drivers/usb/gadget/udc/cdns2/cdns2-gadget.h b/drivers/usb/gadget/udc/cdns2/cdns2-gadget.h index 71e2f62d653a..b5d5ec12e986 100644 --- a/drivers/usb/gadget/udc/cdns2/cdns2-gadget.h +++ b/drivers/usb/gadget/udc/cdns2/cdns2-gadget.h @@ -292,8 +292,17 @@ struct cdns2_usb_regs { #define SPEEDCTRL_HSDISABLE BIT(7) /* CPUCTRL- bitmasks. */ +/* UP clock enable */ +#define CPUCTRL_UPCLK BIT(0) /* Controller reset bit. */ #define CPUCTRL_SW_RST BIT(1) +/** + * If the wuen bit is ‘1’, the upclken is automatically set to ‘1’ after + * detecting rising edge of wuintereq interrupt. If the wuen bit is ‘0’, + * the wuintereq interrupt is ignored. + */ +#define CPUCTRL_WUEN BIT(7) + /** * struct cdns2_adma_regs - ADMA controller registers. -- 2.43.0

1 year

1
0
0 0

[tip: timers/urgent] clocksource/drivers/imx-tpm: Fix next event not taking effect sometime

by tip-bot2 for Jacky Bai

The following commit has been merged into the timers/urgent branch of tip: Commit-ID: 3d5c2f8e75a55cfb11a85086c71996af0354a1fb Gitweb: https://git.kernel.org/tip/3d5c2f8e75a55cfb11a85086c71996af0354a1fb Author: Jacky Bai <ping.bai(a)nxp.com> AuthorDate: Thu, 25 Jul 2024 15:33:55 -04:00 Committer: Daniel Lezcano <daniel.lezcano(a)linaro.org> CommitterDate: Mon, 02 Sep 2024 10:04:15 +02:00 clocksource/drivers/imx-tpm: Fix next event not taking effect sometime The value written into the TPM CnV can only be updated into the hardware when the counter increases. Additional writes to the CnV write buffer are ignored until the register has been updated. Therefore, we need to check if the CnV has been updated before continuing. This may require waiting for 1 counter cycle in the worst case. Cc: stable(a)vger.kernel.org Fixes: 059ab7b82eec ("clocksource/drivers/imx-tpm: Add imx tpm timer support") Signed-off-by: Jacky Bai <ping.bai(a)nxp.com> Reviewed-by: Peng Fan <peng.fan(a)nxp.com> Reviewed-by: Ye Li <ye.li(a)nxp.com> Reviewed-by: Jason Liu <jason.hui.liu(a)nxp.com> Signed-off-by: Frank Li <Frank.Li(a)nxp.com> Link: https://lore.kernel.org/r/20240725193355.1436005-2-Frank.Li@nxp.com Signed-off-by: Daniel Lezcano <daniel.lezcano(a)linaro.org> --- drivers/clocksource/timer-imx-tpm.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/clocksource/timer-imx-tpm.c b/drivers/clocksource/timer-imx-tpm.c index cd23caf..92c025b 100644 --- a/drivers/clocksource/timer-imx-tpm.c +++ b/drivers/clocksource/timer-imx-tpm.c @@ -91,6 +91,14 @@ static int tpm_set_next_event(unsigned long delta, now = tpm_read_counter(); /* + * Need to wait CNT increase at least 1 cycle to make sure + * the C0V has been updated into HW. + */ + if ((next & 0xffffffff) != readl(timer_base + TPM_C0V)) + while (now == tpm_read_counter()) + ; + + /* * NOTE: We observed in a very small probability, the bus fabric * contention between GPU and A7 may results a few cycles delay * of writing CNT registers which may cause the min_delta event got

1 year

1
0
0 0

[tip: timers/urgent] clocksource/drivers/imx-tpm: Fix return -ETIME when delta exceeds INT_MAX

by tip-bot2 for Jacky Bai

The following commit has been merged into the timers/urgent branch of tip: Commit-ID: 5b8843fcd49827813da80c0f590a17ae4ce93c5d Gitweb: https://git.kernel.org/tip/5b8843fcd49827813da80c0f590a17ae4ce93c5d Author: Jacky Bai <ping.bai(a)nxp.com> AuthorDate: Thu, 25 Jul 2024 15:33:54 -04:00 Committer: Daniel Lezcano <daniel.lezcano(a)linaro.org> CommitterDate: Mon, 02 Sep 2024 10:04:15 +02:00 clocksource/drivers/imx-tpm: Fix return -ETIME when delta exceeds INT_MAX In tpm_set_next_event(delta), return -ETIME by wrong cast to int when delta is larger than INT_MAX. For example: tpm_set_next_event(delta = 0xffff_fffe) { ... next = tpm_read_counter(); // assume next is 0x10 next += delta; // next will 0xffff_fffe + 0x10 = 0x1_0000_000e now = tpm_read_counter(); // now is 0x10 ... return (int)(next - now) <= 0 ? -ETIME : 0; ^^^^^^^^^^ 0x1_0000_000e - 0x10 = 0xffff_fffe, which is -2 when cast to int. So return -ETIME. } To fix this, introduce a 'prev' variable and check if 'now - prev' is larger than delta. Cc: stable(a)vger.kernel.org Fixes: 059ab7b82eec ("clocksource/drivers/imx-tpm: Add imx tpm timer support") Signed-off-by: Jacky Bai <ping.bai(a)nxp.com> Reviewed-by: Peng Fan <peng.fan(a)nxp.com> Reviewed-by: Ye Li <ye.li(a)nxp.com> Reviewed-by: Jason Liu <jason.hui.liu(a)nxp.com> Signed-off-by: Frank Li <Frank.Li(a)nxp.com> Link: https://lore.kernel.org/r/20240725193355.1436005-1-Frank.Li@nxp.com Signed-off-by: Daniel Lezcano <daniel.lezcano(a)linaro.org> --- drivers/clocksource/timer-imx-tpm.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/clocksource/timer-imx-tpm.c b/drivers/clocksource/timer-imx-tpm.c index bd64a8a..cd23caf 100644 --- a/drivers/clocksource/timer-imx-tpm.c +++ b/drivers/clocksource/timer-imx-tpm.c @@ -83,10 +83,10 @@ static u64 notrace tpm_read_sched_clock(void) static int tpm_set_next_event(unsigned long delta, struct clock_event_device *evt) { - unsigned long next, now; + unsigned long next, prev, now; - next = tpm_read_counter(); - next += delta; + prev = tpm_read_counter(); + next = prev + delta; writel(next, timer_base + TPM_C0V); now = tpm_read_counter(); @@ -96,7 +96,7 @@ static int tpm_set_next_event(unsigned long delta, * of writing CNT registers which may cause the min_delta event got * missed, so we need add a ETIME check here in case it happened. */ - return (int)(next - now) <= 0 ? -ETIME : 0; + return (now - prev) >= delta ? -ETIME : 0; } static int tpm_set_state_oneshot(struct clock_event_device *evt)

1 year

1
0
0 0

[PATCH v6.1] f2fs: fix to truncate preallocated blocks in f2fs_file_open()

by Shivani Agarwal

From: Chao Yu <chao(a)kernel.org> [ Upstream commit 298b1e4182d657c3e388adcc29477904e9600ed5 ] chenyuwen reports a f2fs bug as below: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000011 fscrypt_set_bio_crypt_ctx+0x78/0x1e8 f2fs_grab_read_bio+0x78/0x208 f2fs_submit_page_read+0x44/0x154 f2fs_get_read_data_page+0x288/0x5f4 f2fs_get_lock_data_page+0x60/0x190 truncate_partial_data_page+0x108/0x4fc f2fs_do_truncate_blocks+0x344/0x5f0 f2fs_truncate_blocks+0x6c/0x134 f2fs_truncate+0xd8/0x200 f2fs_iget+0x20c/0x5ac do_garbage_collect+0x5d0/0xf6c f2fs_gc+0x22c/0x6a4 f2fs_disable_checkpoint+0xc8/0x310 f2fs_fill_super+0x14bc/0x1764 mount_bdev+0x1b4/0x21c f2fs_mount+0x20/0x30 legacy_get_tree+0x50/0xbc vfs_get_tree+0x5c/0x1b0 do_new_mount+0x298/0x4cc path_mount+0x33c/0x5fc __arm64_sys_mount+0xcc/0x15c invoke_syscall+0x60/0x150 el0_svc_common+0xb8/0xf8 do_el0_svc+0x28/0xa0 el0_svc+0x24/0x84 el0t_64_sync_handler+0x88/0xec It is because inode.i_crypt_info is not initialized during below path: - mount - f2fs_fill_super - f2fs_disable_checkpoint - f2fs_gc - f2fs_iget - f2fs_truncate So, let's relocate truncation of preallocated blocks to f2fs_file_open(), after fscrypt_file_open(). Fixes: d4dd19ec1ea0 ("f2fs: do not expose unwritten blocks to user by DIO") Reported-by: chenyuwen <yuwen.chen(a)xjmz.com> Closes: https://lore.kernel.org/linux-kernel/20240517085327.1188515-1-yuwen.chen@xj… Signed-off-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Shivani Agarwal <shivani.agarwal(a)broadcom.com> --- fs/f2fs/f2fs.h | 1 + fs/f2fs/file.c | 42 +++++++++++++++++++++++++++++++++++++++++- fs/f2fs/inode.c | 8 -------- 3 files changed, 42 insertions(+), 9 deletions(-) diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h index a02c74875..2b540d878 100644 --- a/fs/f2fs/f2fs.h +++ b/fs/f2fs/f2fs.h @@ -788,6 +788,7 @@ enum { FI_ALIGNED_WRITE, /* enable aligned write */ FI_COW_FILE, /* indicate COW file */ FI_ATOMIC_COMMITTED, /* indicate atomic commit completed except disk sync */ + FI_OPENED_FILE, /* indicate file has been opened */ FI_MAX, /* max flag, never be used */ }; diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c index c6fb179f9..62f2521cd 100644 --- a/fs/f2fs/file.c +++ b/fs/f2fs/file.c @@ -538,6 +538,42 @@ static int f2fs_file_mmap(struct file *file, struct vm_area_struct *vma) return 0; } +static int finish_preallocate_blocks(struct inode *inode) +{ + int ret; + + inode_lock(inode); + if (is_inode_flag_set(inode, FI_OPENED_FILE)) { + inode_unlock(inode); + return 0; + } + + if (!file_should_truncate(inode)) { + set_inode_flag(inode, FI_OPENED_FILE); + inode_unlock(inode); + return 0; + } + + f2fs_down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]); + filemap_invalidate_lock(inode->i_mapping); + + truncate_setsize(inode, i_size_read(inode)); + ret = f2fs_truncate(inode); + + filemap_invalidate_unlock(inode->i_mapping); + f2fs_up_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]); + + if (!ret) + set_inode_flag(inode, FI_OPENED_FILE); + + inode_unlock(inode); + if (ret) + return ret; + + file_dont_truncate(inode); + return 0; +} + static int f2fs_file_open(struct inode *inode, struct file *filp) { int err = fscrypt_file_open(inode, filp); @@ -554,7 +590,11 @@ static int f2fs_file_open(struct inode *inode, struct file *filp) filp->f_mode |= FMODE_NOWAIT; - return dquot_file_open(inode, filp); + err = dquot_file_open(inode, filp); + if (err) + return err; + + return finish_preallocate_blocks(inode); } void f2fs_truncate_data_blocks_range(struct dnode_of_data *dn, int count) diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c index ff4a4e92a..5b672df19 100644 --- a/fs/f2fs/inode.c +++ b/fs/f2fs/inode.c @@ -549,14 +549,6 @@ struct inode *f2fs_iget(struct super_block *sb, unsigned long ino) } f2fs_set_inode_flags(inode); - if (file_should_truncate(inode) && - !is_sbi_flag_set(sbi, SBI_POR_DOING)) { - ret = f2fs_truncate(inode); - if (ret) - goto bad_inode; - file_dont_truncate(inode); - } - unlock_new_inode(inode); trace_f2fs_iget(inode); return inode; -- 2.39.4

1 year

1
0
0 0

[PATCH 6.1 0/1] pm, restore async device resume optimization

by Yenchia Chen

We have met a deadlock issue on our device which use 5.15.y when resuming. After applying this patch which is picked from mainline, issue solved. Backport to 6.1.y also. Rafael J. Wysocki (1): PM: sleep: Restore asynchronous device resume optimization drivers/base/power/main.c | 117 +++++++++++++++++++++----------------- include/linux/pm.h | 1 + 2 files changed, 65 insertions(+), 53 deletions(-) -- 2.18.0

1 year

1
1
0 0

[PATCH] pinctrl: qcom: x1e80100: Bypass PDC wakeup parent for now

by Stephan Gerhold

On X1E80100, GPIO interrupts for wakeup-capable pins have been broken since the introduction of the pinctrl driver. This prevents keyboard and touchpad from working on most of the X1E laptops. So far we have worked around this by manually building a kernel with the "wakeup-parent" removed from the pinctrl node in the device tree, but we cannot expect all users to do that. Implement a similar workaround in the driver by clearing the wakeirq_map for X1E80100. This avoids using the PDC wakeup parent for all GPIOs and handles the interrupts directly in the pinctrl driver instead. The PDC driver needs additional changes to support X1E80100 properly. Adding a workaround separately first allows to land the necessary PDC changes through the normal release cycle, while still solving the more critical problem with keyboard and touchpad on the current stable kernel versions. Bypassing the PDC is enough for now, because we have not yet enabled the deep idle states where using the PDC becomes necessary. Cc: stable(a)vger.kernel.org Fixes: 05e4941d97ef ("pinctrl: qcom: Add X1E80100 pinctrl driver") Signed-off-by: Stephan Gerhold <stephan.gerhold(a)linaro.org> --- Commenting out .wakeirq_map as well would give an unused declaration warning for x1e80100_pdc_map. The map itself is correct, so I just "clear" it by setting .nwakeirq_map to 0 for now. It's just temporary - this patch will be reverted after we add X1E80100 support to the PDC driver. --- drivers/pinctrl/qcom/pinctrl-x1e80100.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/pinctrl/qcom/pinctrl-x1e80100.c b/drivers/pinctrl/qcom/pinctrl-x1e80100.c index 65ed933f05ce..abfcdd3da9e8 100644 --- a/drivers/pinctrl/qcom/pinctrl-x1e80100.c +++ b/drivers/pinctrl/qcom/pinctrl-x1e80100.c @@ -1839,7 +1839,9 @@ static const struct msm_pinctrl_soc_data x1e80100_pinctrl = { .ngroups = ARRAY_SIZE(x1e80100_groups), .ngpios = 239, .wakeirq_map = x1e80100_pdc_map, - .nwakeirq_map = ARRAY_SIZE(x1e80100_pdc_map), + /* TODO: Enabling PDC currently breaks GPIO interrupts */ + .nwakeirq_map = 0, + /* .nwakeirq_map = ARRAY_SIZE(x1e80100_pdc_map), */ .egpio_func = 9, }; --- base-commit: 128f71fe014fc91efa1407ce549f94a9a9f1072c change-id: 20240830-x1e80100-bypass-pdc-39a8c1ae594f Best regards, -- Stephan Gerhold <stephan.gerhold(a)linaro.org>

1 year

5
4
0 0

[PATCH] wifi: mt76: mt7925: fix a potential association failure upon resuming

by Mingyen Hsieh

From: Michael Lo <michael.lo(a)mediatek.com> In multi-channel scenarios, the granted channel must be aborted before suspending. Otherwise, the firmware will be put into a wrong state, resulting in an association failure after resuming. With this patch, the granted channel will be aborted before suspending if necessary. Cc: stable(a)vger.kernel.org Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips") Signed-off-by: Michael Lo <michael.lo(a)mediatek.com> Signed-off-by: Ming Yen Hsieh <mingyen.hsieh(a)mediatek.com> --- drivers/net/wireless/mediatek/mt76/mt7925/main.c | 15 +++++++++++++++ .../net/wireless/mediatek/mt76/mt7925/mt7925.h | 1 + drivers/net/wireless/mediatek/mt76/mt7925/pci.c | 2 ++ 3 files changed, 18 insertions(+) diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/main.c b/drivers/net/wireless/mediatek/mt76/mt7925/main.c index 8c0768bf9343..7c05aebd3c20 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7925/main.c +++ b/drivers/net/wireless/mediatek/mt76/mt7925/main.c @@ -439,6 +439,19 @@ static void mt7925_roc_iter(void *priv, u8 *mac, mt7925_mcu_abort_roc(phy, &mvif->bss_conf, phy->roc_token_id); } +void mt7925_roc_abort_sync(struct mt792x_dev *dev) +{ + struct mt792x_phy *phy = &dev->phy; + + del_timer_sync(&phy->roc_timer); + cancel_work_sync(&phy->roc_work); + if (test_and_clear_bit(MT76_STATE_ROC, &phy->mt76->state)) + ieee80211_iterate_interfaces(mt76_hw(dev), + IEEE80211_IFACE_ITER_RESUME_ALL, + mt7925_roc_iter, (void *)phy); +} +EXPORT_SYMBOL_GPL(mt7925_roc_abort_sync); + void mt7925_roc_work(struct work_struct *work) { struct mt792x_phy *phy; @@ -1109,6 +1122,8 @@ static void mt7925_mac_link_sta_remove(struct mt76_dev *mdev, msta = (struct mt792x_sta *)link_sta->sta->drv_priv; mlink = mt792x_sta_to_link(msta, link_id); + mt7925_roc_abort_sync(dev); + mt76_connac_free_pending_tx_skbs(&dev->pm, &mlink->wcid); mt76_connac_pm_wake(&dev->mphy, &dev->pm); diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mt7925.h b/drivers/net/wireless/mediatek/mt76/mt7925/mt7925.h index 669f3a079d04..c5ea431998e0 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7925/mt7925.h +++ b/drivers/net/wireless/mediatek/mt76/mt7925/mt7925.h @@ -307,6 +307,7 @@ int mt7925_mcu_set_roc(struct mt792x_phy *phy, struct mt792x_bss_conf *mconf, enum mt7925_roc_req type, u8 token_id); int mt7925_mcu_abort_roc(struct mt792x_phy *phy, struct mt792x_bss_conf *mconf, u8 token_id); +void mt7925_roc_abort_sync(struct mt792x_dev *dev); int mt7925_mcu_fill_message(struct mt76_dev *mdev, struct sk_buff *skb, int cmd, int *wait_seq); int mt7925_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif, diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/pci.c b/drivers/net/wireless/mediatek/mt76/mt7925/pci.c index 6e4f4e78c350..39305c39362f 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7925/pci.c +++ b/drivers/net/wireless/mediatek/mt76/mt7925/pci.c @@ -449,6 +449,8 @@ static int mt7925_pci_suspend(struct device *device) cancel_delayed_work_sync(&pm->ps_work); cancel_work_sync(&pm->wake_work); + mt7925_roc_abort_sync(dev); + err = mt792x_mcu_drv_pmctrl(dev); if (err < 0) goto restore_suspend; -- 2.45.2

1 year

1
0
0 0

[PATCH v5.10-v5.15] rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow

by Vamsi Krishna Brahmajosyula

From: Nikita Kiryushin <kiryushin(a)ancud.ru> [ Upstream commit cc5645fddb0ce28492b15520306d092730dffa48 ] There is a possibility of buffer overflow in show_rcu_tasks_trace_gp_kthread() if counters, passed to sprintf() are huge. Counter numbers, needed for this are unrealistically high, but buffer overflow is still possible. Use snprintf() with buffer size instead of sprintf(). Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: edf3775f0ad6 ("rcu-tasks: Add count for idle tasks on offline CPUs") Signed-off-by: Nikita Kiryushin <kiryushin(a)ancud.ru> Reviewed-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Paul E. McKenney <paulmck(a)kernel.org> Signed-off-by: Uladzislau Rezki (Sony) <urezki(a)gmail.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Vamsi Krishna Brahmajosyula <vamsi-krishna.brahmajosyula(a)broadcom.com> --- kernel/rcu/tasks.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/rcu/tasks.h b/kernel/rcu/tasks.h index 105fdc2bb004..bede3a4f108e 100644 --- a/kernel/rcu/tasks.h +++ b/kernel/rcu/tasks.h @@ -1240,7 +1240,7 @@ static void show_rcu_tasks_trace_gp_kthread(void) { char buf[64]; - sprintf(buf, "N%d h:%lu/%lu/%lu", atomic_read(&trc_n_readers_need_end), + snprintf(buf, sizeof(buf), "N%d h:%lu/%lu/%lu", atomic_read(&trc_n_readers_need_end), data_race(n_heavy_reader_ofl_updates), data_race(n_heavy_reader_updates), data_race(n_heavy_reader_attempts)); -- 2.45.2

1 year

1
0
0 0

[PATCH rdma-next v2 1/2] RDMA/mana_ib: use the correct page table index based on hardware page size

by longli＠linuxonhyperv.com

From: Long Li <longli(a)microsoft.com> MANA hardware uses 4k page size. When calculating the page table index, it should use the hardware page size, not the system page size. Cc: stable(a)vger.kernel.org Fixes: 0266a177631d ("RDMA/mana_ib: Add a driver for Microsoft Azure Network Adapter") Signed-off-by: Long Li <longli(a)microsoft.com> --- change log v2: replaced net with rdma-next tag in patch title and simplified the title drivers/infiniband/hw/mana/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/infiniband/hw/mana/main.c b/drivers/infiniband/hw/mana/main.c index d13abc954d2a..f68f54aea820 100644 --- a/drivers/infiniband/hw/mana/main.c +++ b/drivers/infiniband/hw/mana/main.c @@ -383,7 +383,7 @@ static int mana_ib_gd_create_dma_region(struct mana_ib_dev *dev, struct ib_umem create_req->length = umem->length; create_req->offset_in_page = ib_umem_dma_offset(umem, page_sz); - create_req->gdma_page_type = order_base_2(page_sz) - PAGE_SHIFT; + create_req->gdma_page_type = order_base_2(page_sz) - MANA_PAGE_SHIFT; create_req->page_count = num_pages_total; ibdev_dbg(&dev->ib_dev, "size_dma_region %lu num_pages_total %lu\n", -- 2.17.1

1 year

2
2
0 0

[PATCH v3 RESEND] pps: add an error check in parport_attach

by Ma Ke

In parport_attach, the return value of ida_alloc is unchecked, witch leads to the use of an invalid index value. To address this issue, index should be checked. When the index value is abnormal, the device should be freed. Found by code review, compile tested only. Cc: stable(a)vger.kernel.org Fixes: fb56d97df70e ("pps: client: use new parport device model") Signed-off-by: Ma Ke <make24(a)iscas.ac.cn> --- Changes in v3: - modified Fixes tag as suggestions. Changes in v2: - removed error output as suggestions. --- drivers/pps/clients/pps_parport.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/pps/clients/pps_parport.c b/drivers/pps/clients/pps_parport.c index 63d03a0df5cc..abaffb4e1c1c 100644 --- a/drivers/pps/clients/pps_parport.c +++ b/drivers/pps/clients/pps_parport.c @@ -149,6 +149,9 @@ static void parport_attach(struct parport *port) } index = ida_alloc(&pps_client_index, GFP_KERNEL); + if (index < 0) + goto err_free_device; + memset(&pps_client_cb, 0, sizeof(pps_client_cb)); pps_client_cb.private = device; pps_client_cb.irq_func = parport_irq; @@ -159,7 +162,7 @@ static void parport_attach(struct parport *port) index); if (!device->pardev) { pr_err("couldn't register with %s\n", port->name); - goto err_free; + goto err_free_ida; } if (parport_claim_or_block(device->pardev) < 0) { @@ -187,8 +190,9 @@ static void parport_attach(struct parport *port) parport_release(device->pardev); err_unregister_dev: parport_unregister_device(device->pardev); -err_free: +err_free_ida: ida_free(&pps_client_index, index); +err_free_device: kfree(device); } -- 2.25.1

1 year

2
1
0 0

Fwd: [PATCH 3/9] xfs: xfs_finobt_count_blocks() walks the wrong btree

by Anders Blomdell

Dave forgot to mark the original patch for stable, so after consulting with Dave, here it comes @Greg: you might want to add the patch to all versions that received 14dd46cf31f4 ("xfs: split xfs_inobt_init_cursor") (which I think is v6.9 and v6.10) /Anders -------- Forwarded Message -------- Subject: [PATCH 3/9] xfs: xfs_finobt_count_blocks() walks the wrong btree Date: Thu, 22 Aug 2024 16:59:33 -0700 From: Darrick J. Wong <djwong(a)kernel.org> To: djwong(a)kernel.org CC: Anders Blomdell <anders.blomdell(a)gmail.com>, Dave Chinner <dchinner(a)redhat.com>, Christoph Hellwig <hch(a)lst.de>, hch(a)lst.de, linux-xfs(a)vger.kernel.org From: Dave Chinner <dchinner(a)redhat.com> As a result of the factoring in commit 14dd46cf31f4 ("xfs: split xfs_inobt_init_cursor"), mount started taking a long time on a user's filesystem. For Anders, this made mount times regress from under a second to over 15 minutes for a filesystem with only 30 million inodes in it. Anders bisected it down to the above commit, but even then the bug was not obvious. In this commit, over 20 calls to xfs_inobt_init_cursor() were modified, and some we modified to call a new function named xfs_finobt_init_cursor(). If that takes you a moment to reread those function names to see what the rename was, then you have realised why this bug wasn't spotted during review. And it wasn't spotted on inspection even after the bisect pointed at this commit - a single missing "f" isn't the easiest thing for a human eye to notice.... The result is that xfs_finobt_count_blocks() now incorrectly calls xfs_inobt_init_cursor() so it is now walking the inobt instead of the finobt. Hence when there are lots of allocated inodes in a filesystem, mount takes a -long- time run because it now walks a massive allocated inode btrees instead of the small, nearly empty free inode btrees. It also means all the finobt space reservations are wrong, so mount could potentially given ENOSPC on kernel upgrade. In hindsight, commit 14dd46cf31f4 should have been two commits - the first to convert the finobt callers to the new API, the second to modify the xfs_inobt_init_cursor() API for the inobt callers. That would have made the bug very obvious during review. Fixes: 14dd46cf31f4 ("xfs: split xfs_inobt_init_cursor") Reported-by: Anders Blomdell <anders.blomdell(a)gmail.com> Signed-off-by: Dave Chinner <dchinner(a)redhat.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Reviewed-by: Darrick J. Wong <djwong(a)kernel.org> Signed-off-by: Darrick J. Wong <djwong(a)kernel.org> --- fs/xfs/libxfs/xfs_ialloc_btree.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/xfs/libxfs/xfs_ialloc_btree.c b/fs/xfs/libxfs/xfs_ialloc_btree.c index 496e2f72a85b9..797d5b5f7b725 100644 --- a/fs/xfs/libxfs/xfs_ialloc_btree.c +++ b/fs/xfs/libxfs/xfs_ialloc_btree.c @@ -749,7 +749,7 @@ xfs_finobt_count_blocks( if (error) return error; - cur = xfs_inobt_init_cursor(pag, tp, agbp); + cur = xfs_finobt_init_cursor(pag, tp, agbp); error = xfs_btree_count_blocks(cur, tree_blocks); xfs_btree_del_cursor(cur, error); xfs_trans_brelse(tp, agbp);

1 year

2
3
0 0

[merged mm-nonmm-stable] scripts-gdb-fix-lx-mounts-command-error.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: scripts/gdb: fix lx-mounts command error has been removed from the -mm tree. Its filename was scripts-gdb-fix-lx-mounts-command-error.patch This patch was dropped because it was merged into the mm-nonmm-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Kuan-Ying Lee <kuan-ying.lee(a)canonical.com> Subject: scripts/gdb: fix lx-mounts command error Date: Tue, 23 Jul 2024 14:48:59 +0800 (gdb) lx-mounts mount super_block devname pathname fstype options Python Exception <class 'gdb.error'>: There is no member named list. Error occurred in Python: There is no member named list. We encounter the above issue after commit 2eea9ce4310d ("mounts: keep list of mounts in an rbtree"). The commit move a mount from list into rbtree. So we can instead use rbtree to iterate all mounts information. Link: https://lkml.kernel.org/r/20240723064902.124154-4-kuan-ying.lee@canonical.c… Fixes: 2eea9ce4310d ("mounts: keep list of mounts in an rbtree") Signed-off-by: Kuan-Ying Lee <kuan-ying.lee(a)canonical.com> Cc: Jan Kiszka <jan.kiszka(a)siemens.com> Cc: Kieran Bingham <kbingham(a)kernel.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- scripts/gdb/linux/proc.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/scripts/gdb/linux/proc.py~scripts-gdb-fix-lx-mounts-command-error +++ a/scripts/gdb/linux/proc.py @@ -18,6 +18,7 @@ from linux import utils from linux import tasks from linux import lists from linux import vfs +from linux import rbtree from struct import * @@ -172,8 +173,7 @@ values of that process namespace""" gdb.write("{:^18} {:^15} {:>9} {} {} options\n".format( "mount", "super_block", "devname", "pathname", "fstype")) - for mnt in lists.list_for_each_entry(namespace['list'], - mount_ptr_type, "mnt_list"): + for mnt in rbtree.rb_inorder_for_each_entry(namespace['mounts'], mount_ptr_type, "mnt_node"): devname = mnt['mnt_devname'].string() devname = devname if devname else "none" _ Patches currently in -mm which might be from kuan-ying.lee(a)canonical.com are

1 year

1
0
0 0

[merged mm-nonmm-stable] scripts-gdb-add-iteration-function-for-rbtree.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: scripts/gdb: add iteration function for rbtree has been removed from the -mm tree. Its filename was scripts-gdb-add-iteration-function-for-rbtree.patch This patch was dropped because it was merged into the mm-nonmm-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Kuan-Ying Lee <kuan-ying.lee(a)canonical.com> Subject: scripts/gdb: add iteration function for rbtree Date: Tue, 23 Jul 2024 14:48:58 +0800 Add inorder iteration function for rbtree usage. This is a preparation patch for the next patch to fix the gdb mounts issue. Link: https://lkml.kernel.org/r/20240723064902.124154-3-kuan-ying.lee@canonical.c… Fixes: 2eea9ce4310d ("mounts: keep list of mounts in an rbtree") Signed-off-by: Kuan-Ying Lee <kuan-ying.lee(a)canonical.com> Cc: Jan Kiszka <jan.kiszka(a)siemens.com> Cc: Kieran Bingham <kbingham(a)kernel.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- scripts/gdb/linux/rbtree.py | 12 ++++++++++++ 1 file changed, 12 insertions(+) --- a/scripts/gdb/linux/rbtree.py~scripts-gdb-add-iteration-function-for-rbtree +++ a/scripts/gdb/linux/rbtree.py @@ -9,6 +9,18 @@ from linux import utils rb_root_type = utils.CachedType("struct rb_root") rb_node_type = utils.CachedType("struct rb_node") +def rb_inorder_for_each(root): + def inorder(node): + if node: + yield from inorder(node['rb_left']) + yield node + yield from inorder(node['rb_right']) + + yield from inorder(root['rb_node']) + +def rb_inorder_for_each_entry(root, gdbtype, member): + for node in rb_inorder_for_each(root): + yield utils.container_of(node, gdbtype, member) def rb_first(root): if root.type == rb_root_type.get_type(): _ Patches currently in -mm which might be from kuan-ying.lee(a)canonical.com are

1 year

1
0
0 0

[merged mm-nonmm-stable] scripts-gdb-fix-timerlist-parsing-issue.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: scripts/gdb: fix timerlist parsing issue has been removed from the -mm tree. Its filename was scripts-gdb-fix-timerlist-parsing-issue.patch This patch was dropped because it was merged into the mm-nonmm-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Kuan-Ying Lee <kuan-ying.lee(a)canonical.com> Subject: scripts/gdb: fix timerlist parsing issue Date: Tue, 23 Jul 2024 14:48:57 +0800 Patch series "Fix some GDB command error and add some GDB commands", v3. Fix some GDB command errors and add some useful GDB commands. This patch (of 5): Commit 7988e5ae2be7 ("tick: Split nohz and highres features from nohz_mode") and commit 7988e5ae2be7 ("tick: Split nohz and highres features from nohz_mode") move 'tick_stopped' and 'nohz_mode' to flags field which will break the gdb lx-mounts command: (gdb) lx-timerlist Python Exception <class 'gdb.error'>: There is no member named nohz_mode. Error occurred in Python: There is no member named nohz_mode. (gdb) lx-timerlist Python Exception <class 'gdb.error'>: There is no member named tick_stopped. Error occurred in Python: There is no member named tick_stopped. We move 'tick_stopped' and 'nohz_mode' to flags field instead. Link: https://lkml.kernel.org/r/20240723064902.124154-1-kuan-ying.lee@canonical.c… Link: https://lkml.kernel.org/r/20240723064902.124154-2-kuan-ying.lee@canonical.c… Fixes: a478ffb2ae23 ("tick: Move individual bit features to debuggable mask accesses") Fixes: 7988e5ae2be7 ("tick: Split nohz and highres features from nohz_mode") Signed-off-by: Kuan-Ying Lee <kuan-ying.lee(a)canonical.com> Cc: Jan Kiszka <jan.kiszka(a)siemens.com> Cc: Kieran Bingham <kbingham(a)kernel.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- scripts/gdb/linux/timerlist.py | 31 ++++++++++++++++--------------- 1 file changed, 16 insertions(+), 15 deletions(-) --- a/scripts/gdb/linux/timerlist.py~scripts-gdb-fix-timerlist-parsing-issue +++ a/scripts/gdb/linux/timerlist.py @@ -87,21 +87,22 @@ def print_cpu(hrtimer_bases, cpu, max_cl text += "\n" if constants.LX_CONFIG_TICK_ONESHOT: - fmts = [(" .{} : {}", 'nohz_mode'), - (" .{} : {} nsecs", 'last_tick'), - (" .{} : {}", 'tick_stopped'), - (" .{} : {}", 'idle_jiffies'), - (" .{} : {}", 'idle_calls'), - (" .{} : {}", 'idle_sleeps'), - (" .{} : {} nsecs", 'idle_entrytime'), - (" .{} : {} nsecs", 'idle_waketime'), - (" .{} : {} nsecs", 'idle_exittime'), - (" .{} : {} nsecs", 'idle_sleeptime'), - (" .{}: {} nsecs", 'iowait_sleeptime'), - (" .{} : {}", 'last_jiffies'), - (" .{} : {}", 'next_timer'), - (" .{} : {} nsecs", 'idle_expires')] - text += "\n".join([s.format(f, ts[f]) for s, f in fmts]) + TS_FLAG_STOPPED = 1 << 1 + TS_FLAG_NOHZ = 1 << 4 + text += f" .{'nohz':15s}: {int(bool(ts['flags'] & TS_FLAG_NOHZ))}\n" + text += f" .{'last_tick':15s}: {ts['last_tick']}\n" + text += f" .{'tick_stopped':15s}: {int(bool(ts['flags'] & TS_FLAG_STOPPED))}\n" + text += f" .{'idle_jiffies':15s}: {ts['idle_jiffies']}\n" + text += f" .{'idle_calls':15s}: {ts['idle_calls']}\n" + text += f" .{'idle_sleeps':15s}: {ts['idle_sleeps']}\n" + text += f" .{'idle_entrytime':15s}: {ts['idle_entrytime']} nsecs\n" + text += f" .{'idle_waketime':15s}: {ts['idle_waketime']} nsecs\n" + text += f" .{'idle_exittime':15s}: {ts['idle_exittime']} nsecs\n" + text += f" .{'idle_sleeptime':15s}: {ts['idle_sleeptime']} nsecs\n" + text += f" .{'iowait_sleeptime':15s}: {ts['iowait_sleeptime']} nsecs\n" + text += f" .{'last_jiffies':15s}: {ts['last_jiffies']}\n" + text += f" .{'next_timer':15s}: {ts['next_timer']}\n" + text += f" .{'idle_expires':15s}: {ts['idle_expires']} nsecs\n" text += "\njiffies: {}\n".format(jiffies) text += "\n" _ Patches currently in -mm which might be from kuan-ying.lee(a)canonical.com are

1 year

1
0
0 0

[merged mm-nonmm-stable] ocfs2-fix-the-la-space-leak-when-unmounting-an-ocfs2-volume.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: ocfs2: fix the la space leak when unmounting an ocfs2 volume has been removed from the -mm tree. Its filename was ocfs2-fix-the-la-space-leak-when-unmounting-an-ocfs2-volume.patch This patch was dropped because it was merged into the mm-nonmm-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Heming Zhao <heming.zhao(a)suse.com> Subject: ocfs2: fix the la space leak when unmounting an ocfs2 volume Date: Fri, 19 Jul 2024 19:43:10 +0800 This bug has existed since the initial OCFS2 code. The code logic in ocfs2_sync_local_to_main() is wrong, as it ignores the last contiguous free bits, which causes an OCFS2 volume to lose the last free clusters of LA window on each umount command. Link: https://lkml.kernel.org/r/20240719114310.14245-1-heming.zhao@suse.com Signed-off-by: Heming Zhao <heming.zhao(a)suse.com> Reviewed-by: Su Yue <glass.su(a)suse.com> Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Gang He <ghe(a)suse.com> Cc: Jun Piao <piaojun(a)huawei.com> Cc: Heming Zhao <heming.zhao(a)suse.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- fs/ocfs2/localalloc.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) --- a/fs/ocfs2/localalloc.c~ocfs2-fix-the-la-space-leak-when-unmounting-an-ocfs2-volume +++ a/fs/ocfs2/localalloc.c @@ -1002,6 +1002,25 @@ static int ocfs2_sync_local_to_main(stru start = bit_off + 1; } + /* clear the contiguous bits until the end boundary */ + if (count) { + blkno = la_start_blk + + ocfs2_clusters_to_blocks(osb->sb, + start - count); + + trace_ocfs2_sync_local_to_main_free( + count, start - count, + (unsigned long long)la_start_blk, + (unsigned long long)blkno); + + status = ocfs2_release_clusters(handle, + main_bm_inode, + main_bm_bh, blkno, + count); + if (status < 0) + mlog_errno(status); + } + bail: if (status) mlog_errno(status); _ Patches currently in -mm which might be from heming.zhao(a)suse.com are

1 year

1
0
0 0

[merged mm-stable] mm-hugetlb_vmemmap-batch-hvo-work-when-demoting.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: mm/hugetlb_vmemmap: batch HVO work when demoting has been removed from the -mm tree. Its filename was mm-hugetlb_vmemmap-batch-hvo-work-when-demoting.patch This patch was dropped because it was merged into the mm-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Yu Zhao <yuzhao(a)google.com> Subject: mm/hugetlb_vmemmap: batch HVO work when demoting Date: Mon, 12 Aug 2024 16:48:23 -0600 Batch the HVO work, including de-HVO of the source and HVO of the destination hugeTLB folios, to speed up demotion. After commit bd225530a4c7 ("mm/hugetlb_vmemmap: fix race with speculative PFN walkers"), each request of HVO or de-HVO, batched or not, invokes synchronize_rcu() once. For example, when not batched, demoting one 1GB hugeTLB folio to 512 2MB hugeTLB folios invokes synchronize_rcu() 513 times (1 de-HVO plus 512 HVO requests), whereas when batched, only twice (1 de-HVO plus 1 HVO request). And the performance difference between the two cases is significant, e.g., echo 2048kB >/sys/kernel/mm/hugepages/hugepages-1048576kB/demote_size time echo 100 >/sys/kernel/mm/hugepages/hugepages-1048576kB/demote Before this patch: real 8m58.158s user 0m0.009s sys 0m5.900s After this patch: real 0m0.900s user 0m0.000s sys 0m0.851s Note that this patch changes the behavior of the `demote` interface when de-HVO fails. Before, the interface aborts immediately upon failure; now, it tries to finish an entire batch, meaning it can make extra progress if the rest of the batch contains folios that do not need to de-HVO. Link: https://lkml.kernel.org/r/20240812224823.3914837-1-yuzhao@google.com Fixes: bd225530a4c7 ("mm/hugetlb_vmemmap: fix race with speculative PFN walkers") Signed-off-by: Yu Zhao <yuzhao(a)google.com> Reviewed-by: Muchun Song <muchun.song(a)linux.dev> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/hugetlb.c | 156 ++++++++++++++++++++++++++++--------------------- 1 file changed, 92 insertions(+), 64 deletions(-) --- a/mm/hugetlb.c~mm-hugetlb_vmemmap-batch-hvo-work-when-demoting +++ a/mm/hugetlb.c @@ -3921,101 +3921,125 @@ out: return 0; } -static int demote_free_hugetlb_folio(struct hstate *h, struct folio *folio) +static long demote_free_hugetlb_folios(struct hstate *src, struct hstate *dst, + struct list_head *src_list) { - int i, nid = folio_nid(folio); - struct hstate *target_hstate; - struct page *subpage; - struct folio *inner_folio; - int rc = 0; + long rc; + struct folio *folio, *next; + LIST_HEAD(dst_list); + LIST_HEAD(ret_list); - target_hstate = size_to_hstate(PAGE_SIZE << h->demote_order); - - remove_hugetlb_folio(h, folio, false); - spin_unlock_irq(&hugetlb_lock); - - /* - * If vmemmap already existed for folio, the remove routine above would - * have cleared the hugetlb folio flag. Hence the folio is technically - * no longer a hugetlb folio. hugetlb_vmemmap_restore_folio can only be - * passed hugetlb folios and will BUG otherwise. - */ - if (folio_test_hugetlb(folio)) { - rc = hugetlb_vmemmap_restore_folio(h, folio); - if (rc) { - /* Allocation of vmemmmap failed, we can not demote folio */ - spin_lock_irq(&hugetlb_lock); - add_hugetlb_folio(h, folio, false); - return rc; - } - } - - /* - * Use destroy_compound_hugetlb_folio_for_demote for all huge page - * sizes as it will not ref count folios. - */ - destroy_compound_hugetlb_folio_for_demote(folio, huge_page_order(h)); + rc = hugetlb_vmemmap_restore_folios(src, src_list, &ret_list); + list_splice_init(&ret_list, src_list); /* * Taking target hstate mutex synchronizes with set_max_huge_pages. * Without the mutex, pages added to target hstate could be marked * as surplus. * - * Note that we already hold h->resize_lock. To prevent deadlock, + * Note that we already hold src->resize_lock. To prevent deadlock, * use the convention of always taking larger size hstate mutex first. */ - mutex_lock(&target_hstate->resize_lock); - for (i = 0; i < pages_per_huge_page(h); - i += pages_per_huge_page(target_hstate)) { - subpage = folio_page(folio, i); - inner_folio = page_folio(subpage); - if (hstate_is_gigantic(target_hstate)) - prep_compound_gigantic_folio_for_demote(inner_folio, - target_hstate->order); - else - prep_compound_page(subpage, target_hstate->order); - folio_change_private(inner_folio, NULL); - prep_new_hugetlb_folio(target_hstate, inner_folio, nid); - free_huge_folio(inner_folio); + mutex_lock(&dst->resize_lock); + + list_for_each_entry_safe(folio, next, src_list, lru) { + int i; + + if (folio_test_hugetlb_vmemmap_optimized(folio)) + continue; + + list_del(&folio->lru); + /* + * Use destroy_compound_hugetlb_folio_for_demote for all huge page + * sizes as it will not ref count folios. + */ + destroy_compound_hugetlb_folio_for_demote(folio, huge_page_order(src)); + + for (i = 0; i < pages_per_huge_page(src); i += pages_per_huge_page(dst)) { + struct page *page = folio_page(folio, i); + + if (hstate_is_gigantic(dst)) + prep_compound_gigantic_folio_for_demote(page_folio(page), + dst->order); + else + prep_compound_page(page, dst->order); + set_page_private(page, 0); + + init_new_hugetlb_folio(dst, page_folio(page)); + list_add(&page->lru, &dst_list); + } } - mutex_unlock(&target_hstate->resize_lock); - spin_lock_irq(&hugetlb_lock); + prep_and_add_allocated_folios(dst, &dst_list); - /* - * Not absolutely necessary, but for consistency update max_huge_pages - * based on pool changes for the demoted page. - */ - h->max_huge_pages--; - target_hstate->max_huge_pages += - pages_per_huge_page(h) / pages_per_huge_page(target_hstate); + mutex_unlock(&dst->resize_lock); return rc; } -static int demote_pool_huge_page(struct hstate *h, nodemask_t *nodes_allowed) +static long demote_pool_huge_page(struct hstate *src, nodemask_t *nodes_allowed, + unsigned long nr_to_demote) __must_hold(&hugetlb_lock) { int nr_nodes, node; - struct folio *folio; + struct hstate *dst; + long rc = 0; + long nr_demoted = 0; lockdep_assert_held(&hugetlb_lock); /* We should never get here if no demote order */ - if (!h->demote_order) { + if (!src->demote_order) { pr_warn("HugeTLB: NULL demote order passed to demote_pool_huge_page.\n"); return -EINVAL; /* internal error */ } + dst = size_to_hstate(PAGE_SIZE << src->demote_order); - for_each_node_mask_to_free(h, nr_nodes, node, nodes_allowed) { - list_for_each_entry(folio, &h->hugepage_freelists[node], lru) { + for_each_node_mask_to_free(src, nr_nodes, node, nodes_allowed) { + LIST_HEAD(list); + struct folio *folio, *next; + + list_for_each_entry_safe(folio, next, &src->hugepage_freelists[node], lru) { if (folio_test_hwpoison(folio)) continue; - return demote_free_hugetlb_folio(h, folio); + + remove_hugetlb_folio(src, folio, false); + list_add(&folio->lru, &list); + + if (++nr_demoted == nr_to_demote) + break; + } + + spin_unlock_irq(&hugetlb_lock); + + rc = demote_free_hugetlb_folios(src, dst, &list); + + spin_lock_irq(&hugetlb_lock); + + list_for_each_entry_safe(folio, next, &list, lru) { + list_del(&folio->lru); + add_hugetlb_folio(src, folio, false); + + nr_demoted--; } + + if (rc < 0 || nr_demoted == nr_to_demote) + break; } /* + * Not absolutely necessary, but for consistency update max_huge_pages + * based on pool changes for the demoted page. + */ + src->max_huge_pages -= nr_demoted; + dst->max_huge_pages += nr_demoted << (huge_page_order(src) - huge_page_order(dst)); + + if (rc < 0) + return rc; + + if (nr_demoted) + return nr_demoted; + /* * Only way to get here is if all pages on free lists are poisoned. * Return -EBUSY so that caller will not retry. */ @@ -4249,6 +4273,8 @@ static ssize_t demote_store(struct kobje spin_lock_irq(&hugetlb_lock); while (nr_demote) { + long rc; + /* * Check for available pages to demote each time thorough the * loop as demote_pool_huge_page will drop hugetlb_lock. @@ -4261,11 +4287,13 @@ static ssize_t demote_store(struct kobje if (!nr_available) break; - err = demote_pool_huge_page(h, n_mask); - if (err) + rc = demote_pool_huge_page(h, n_mask, nr_demote); + if (rc < 0) { + err = rc; break; + } - nr_demote--; + nr_demote -= rc; } spin_unlock_irq(&hugetlb_lock); _ Patches currently in -mm which might be from yuzhao(a)google.com are mm-contig_alloc-support-__gfp_comp.patch mm-cma-add-cma_allocfree_folio.patch mm-cma-add-cma_allocfree_folio-fix.patch mm-hugetlb-use-__gfp_comp-for-gigantic-folios.patch mm-free-zapped-tail-pages-when-splitting-isolated-thp.patch mm-remap-unused-subpages-to-shared-zeropage-when-splitting-isolated-thp.patch

1 year

1
0
0 0

[merged mm-stable] selftest-mm-mseal-fix-test_seal_mremap_move_dontunmap_anyaddr.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: selftest mm/mseal: fix test_seal_mremap_move_dontunmap_anyaddr has been removed from the -mm tree. Its filename was selftest-mm-mseal-fix-test_seal_mremap_move_dontunmap_anyaddr.patch This patch was dropped because it was merged into the mm-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Jeff Xu <jeffxu(a)chromium.org> Subject: selftest mm/mseal: fix test_seal_mremap_move_dontunmap_anyaddr Date: Wed, 7 Aug 2024 21:23:20 +0000 the syscall remap accepts following: mremap(src, size, size, MREMAP_MAYMOVE | MREMAP_DONTUNMAP, dst) when the src is sealed, the call will fail with error code: EPERM Previously, the test uses hard-coded 0xdeaddead as dst, and it will fail on the system with newer glibc installed. This patch removes test's dependency on glibc for mremap(), also fix the test and remove the hardcoded address. Link: https://lkml.kernel.org/r/20240807212320.2831848-1-jeffxu@chromium.org Fixes: 4926c7a52de7 ("selftest mm/mseal memory sealing") Signed-off-by: Jeff Xu <jeffxu(a)chromium.org> Reported-by: Pedro Falcato <pedro.falcato(a)gmail.com> Cc: Dave Hansen <dave.hansen(a)intel.com> Cc: Liam R. Howlett <Liam.Howlett(a)oracle.com> Cc: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Cc: Matthew Wilcox (Oracle) <willy(a)infradead.org> Cc: Michael Ellerman <mpe(a)ellerman.id.au> Cc: Vlastimil Babka <vbabka(a)suse.cz> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- tools/testing/selftests/mm/mseal_test.c | 57 +++++++++++++--------- 1 file changed, 36 insertions(+), 21 deletions(-) --- a/tools/testing/selftests/mm/mseal_test.c~selftest-mm-mseal-fix-test_seal_mremap_move_dontunmap_anyaddr +++ a/tools/testing/selftests/mm/mseal_test.c @@ -110,6 +110,16 @@ static int sys_madvise(void *start, size return sret; } +static void *sys_mremap(void *addr, size_t old_len, size_t new_len, + unsigned long flags, void *new_addr) +{ + void *sret; + + errno = 0; + sret = (void *) syscall(__NR_mremap, addr, old_len, new_len, flags, new_addr); + return sret; +} + static int sys_pkey_alloc(unsigned long flags, unsigned long init_val) { int ret = syscall(__NR_pkey_alloc, flags, init_val); @@ -1115,12 +1125,12 @@ static void test_seal_mremap_shrink(bool } /* shrink from 4 pages to 2 pages. */ - ret2 = mremap(ptr, size, 2 * page_size, 0, 0); + ret2 = sys_mremap(ptr, size, 2 * page_size, 0, 0); if (seal) { - FAIL_TEST_IF_FALSE(ret2 == MAP_FAILED); + FAIL_TEST_IF_FALSE(ret2 == (void *) MAP_FAILED); FAIL_TEST_IF_FALSE(errno == EPERM); } else { - FAIL_TEST_IF_FALSE(ret2 != MAP_FAILED); + FAIL_TEST_IF_FALSE(ret2 != (void *) MAP_FAILED); } @@ -1147,7 +1157,7 @@ static void test_seal_mremap_expand(bool } /* expand from 2 page to 4 pages. */ - ret2 = mremap(ptr, 2 * page_size, 4 * page_size, 0, 0); + ret2 = sys_mremap(ptr, 2 * page_size, 4 * page_size, 0, 0); if (seal) { FAIL_TEST_IF_FALSE(ret2 == MAP_FAILED); FAIL_TEST_IF_FALSE(errno == EPERM); @@ -1180,7 +1190,7 @@ static void test_seal_mremap_move(bool s } /* move from ptr to fixed address. */ - ret2 = mremap(ptr, size, size, MREMAP_MAYMOVE | MREMAP_FIXED, newPtr); + ret2 = sys_mremap(ptr, size, size, MREMAP_MAYMOVE | MREMAP_FIXED, newPtr); if (seal) { FAIL_TEST_IF_FALSE(ret2 == MAP_FAILED); FAIL_TEST_IF_FALSE(errno == EPERM); @@ -1299,7 +1309,7 @@ static void test_seal_mremap_shrink_fixe } /* mremap to move and shrink to fixed address */ - ret2 = mremap(ptr, size, 2 * page_size, MREMAP_MAYMOVE | MREMAP_FIXED, + ret2 = sys_mremap(ptr, size, 2 * page_size, MREMAP_MAYMOVE | MREMAP_FIXED, newAddr); if (seal) { FAIL_TEST_IF_FALSE(ret2 == MAP_FAILED); @@ -1330,7 +1340,7 @@ static void test_seal_mremap_expand_fixe } /* mremap to move and expand to fixed address */ - ret2 = mremap(ptr, page_size, size, MREMAP_MAYMOVE | MREMAP_FIXED, + ret2 = sys_mremap(ptr, page_size, size, MREMAP_MAYMOVE | MREMAP_FIXED, newAddr); if (seal) { FAIL_TEST_IF_FALSE(ret2 == MAP_FAILED); @@ -1361,7 +1371,7 @@ static void test_seal_mremap_move_fixed( } /* mremap to move to fixed address */ - ret2 = mremap(ptr, size, size, MREMAP_MAYMOVE | MREMAP_FIXED, newAddr); + ret2 = sys_mremap(ptr, size, size, MREMAP_MAYMOVE | MREMAP_FIXED, newAddr); if (seal) { FAIL_TEST_IF_FALSE(ret2 == MAP_FAILED); FAIL_TEST_IF_FALSE(errno == EPERM); @@ -1390,14 +1400,13 @@ static void test_seal_mremap_move_fixed_ /* * MREMAP_FIXED can move the mapping to zero address */ - ret2 = mremap(ptr, size, 2 * page_size, MREMAP_MAYMOVE | MREMAP_FIXED, + ret2 = sys_mremap(ptr, size, 2 * page_size, MREMAP_MAYMOVE | MREMAP_FIXED, 0); if (seal) { FAIL_TEST_IF_FALSE(ret2 == MAP_FAILED); FAIL_TEST_IF_FALSE(errno == EPERM); } else { FAIL_TEST_IF_FALSE(ret2 == 0); - } REPORT_TEST_PASS(); @@ -1420,13 +1429,13 @@ static void test_seal_mremap_move_dontun } /* mremap to move, and don't unmap src addr. */ - ret2 = mremap(ptr, size, size, MREMAP_MAYMOVE | MREMAP_DONTUNMAP, 0); + ret2 = sys_mremap(ptr, size, size, MREMAP_MAYMOVE | MREMAP_DONTUNMAP, 0); if (seal) { FAIL_TEST_IF_FALSE(ret2 == MAP_FAILED); FAIL_TEST_IF_FALSE(errno == EPERM); } else { + /* kernel will allocate a new address */ FAIL_TEST_IF_FALSE(ret2 != MAP_FAILED); - } REPORT_TEST_PASS(); @@ -1434,7 +1443,7 @@ static void test_seal_mremap_move_dontun static void test_seal_mremap_move_dontunmap_anyaddr(bool seal) { - void *ptr; + void *ptr, *ptr2; unsigned long page_size = getpagesize(); unsigned long size = 4 * page_size; int ret; @@ -1449,24 +1458,30 @@ static void test_seal_mremap_move_dontun } /* - * The 0xdeaddead should not have effect on dest addr - * when MREMAP_DONTUNMAP is set. + * The new address is any address that not allocated. + * use allocate/free to similate that. + */ + setup_single_address(size, &ptr2); + FAIL_TEST_IF_FALSE(ptr2 != (void *)-1); + ret = sys_munmap(ptr2, size); + FAIL_TEST_IF_FALSE(!ret); + + /* + * remap to any address. */ - ret2 = mremap(ptr, size, size, MREMAP_MAYMOVE | MREMAP_DONTUNMAP, - 0xdeaddead); + ret2 = sys_mremap(ptr, size, size, MREMAP_MAYMOVE | MREMAP_DONTUNMAP, + (void *) ptr2); if (seal) { FAIL_TEST_IF_FALSE(ret2 == MAP_FAILED); FAIL_TEST_IF_FALSE(errno == EPERM); } else { - FAIL_TEST_IF_FALSE(ret2 != MAP_FAILED); - FAIL_TEST_IF_FALSE((long)ret2 != 0xdeaddead); - + /* remap success and return ptr2 */ + FAIL_TEST_IF_FALSE(ret2 == ptr2); } REPORT_TEST_PASS(); } - static void test_seal_merge_and_split(void) { void *ptr; _ Patches currently in -mm which might be from jeffxu(a)chromium.org are

1 year

1
0
0 0

[merged mm-stable] mm-only-enforce-minimum-stack-gap-size-if-its-sensible.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: mm: only enforce minimum stack gap size if it's sensible has been removed from the -mm tree. Its filename was mm-only-enforce-minimum-stack-gap-size-if-its-sensible.patch This patch was dropped because it was merged into the mm-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: David Gow <davidgow(a)google.com> Subject: mm: only enforce minimum stack gap size if it's sensible Date: Sat, 3 Aug 2024 15:46:41 +0800 The generic mmap_base code tries to leave a gap between the top of the stack and the mmap base address, but enforces a minimum gap size (MIN_GAP) of 128MB, which is too large on some setups. In particular, on arm tasks without ADDR_LIMIT_32BIT, the STACK_TOP value is less than 128MB, so it's impossible to fit such a gap in. Only enforce this minimum if MIN_GAP < MAX_GAP, as we'd prefer to honour MAX_GAP, which is defined proportionally, so scales better and always leaves us with both _some_ stack space and some room for mmap. This fixes the usercopy KUnit test suite on 32-bit arm, as it doesn't set any personality flags so gets the default (in this case 26-bit) task size. This test can be run with: ./tools/testing/kunit/kunit.py run --arch arm usercopy --make_options LLVM=1 Link: https://lkml.kernel.org/r/20240803074642.1849623-2-davidgow@google.com Fixes: dba79c3df4a2 ("arm: use generic mmap top-down layout and brk randomization") Signed-off-by: David Gow <davidgow(a)google.com> Reviewed-by: Kees Cook <kees(a)kernel.org> Cc: Alexandre Ghiti <alex(a)ghiti.fr> Cc: Linus Walleij <linus.walleij(a)linaro.org> Cc: Luis Chamberlain <mcgrof(a)kernel.org> Cc: Mark Rutland <mark.rutland(a)arm.com> Cc: Russell King <linux(a)armlinux.org.uk> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/util.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/mm/util.c~mm-only-enforce-minimum-stack-gap-size-if-its-sensible +++ a/mm/util.c @@ -463,7 +463,7 @@ static unsigned long mmap_base(unsigned if (gap + pad > gap) gap += pad; - if (gap < MIN_GAP) + if (gap < MIN_GAP && MIN_GAP < MAX_GAP) gap = MIN_GAP; else if (gap > MAX_GAP) gap = MAX_GAP; _ Patches currently in -mm which might be from davidgow(a)google.com are

1 year

1
0
0 0

[merged mm-hotfixes-stable] alloc_tag-fix-allocation-tag-reporting-when-config_modules=n.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: alloc_tag: fix allocation tag reporting when CONFIG_MODULES=n has been removed from the -mm tree. Its filename was alloc_tag-fix-allocation-tag-reporting-when-config_modules=n.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Suren Baghdasaryan <surenb(a)google.com> Subject: alloc_tag: fix allocation tag reporting when CONFIG_MODULES=n Date: Wed, 28 Aug 2024 16:15:36 -0700 codetag_module_init() is used to initialize sections containing allocation tags. This function is used to initialize module sections as well as core kernel sections, in which case the module parameter is set to NULL. This function has to be called even when CONFIG_MODULES=n to initialize core kernel allocation tag sections. When CONFIG_MODULES=n, this function is a NOP, which is wrong. This leads to /proc/allocinfo reported as empty. Fix this by making it independent of CONFIG_MODULES. Link: https://lkml.kernel.org/r/20240828231536.1770519-1-surenb@google.com Fixes: 916cc5167cc6 ("lib: code tagging framework") Signed-off-by: Suren Baghdasaryan <surenb(a)google.com> Cc: David Hildenbrand <david(a)redhat.com> Cc: Kees Cook <keescook(a)chromium.org> Cc: Kent Overstreet <kent.overstreet(a)linux.dev> Cc: Pasha Tatashin <pasha.tatashin(a)soleen.com> Cc: Sourav Panda <souravpanda(a)google.com> Cc: Vlastimil Babka <vbabka(a)suse.cz> Cc: <stable(a)vger.kernel.org> [6.10+] Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- lib/codetag.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) --- a/lib/codetag.c~alloc_tag-fix-allocation-tag-reporting-when-config_modules=n +++ a/lib/codetag.c @@ -125,7 +125,6 @@ static inline size_t range_size(const st cttype->desc.tag_size; } -#ifdef CONFIG_MODULES static void *get_symbol(struct module *mod, const char *prefix, const char *name) { DECLARE_SEQ_BUF(sb, KSYM_NAME_LEN); @@ -155,6 +154,15 @@ static struct codetag_range get_section_ }; } +static const char *get_mod_name(__maybe_unused struct module *mod) +{ +#ifdef CONFIG_MODULES + if (mod) + return mod->name; +#endif + return "(built-in)"; +} + static int codetag_module_init(struct codetag_type *cttype, struct module *mod) { struct codetag_range range; @@ -164,8 +172,7 @@ static int codetag_module_init(struct co range = get_section_range(mod, cttype->desc.section); if (!range.start || !range.stop) { pr_warn("Failed to load code tags of type %s from the module %s\n", - cttype->desc.section, - mod ? mod->name : "(built-in)"); + cttype->desc.section, get_mod_name(mod)); return -EINVAL; } @@ -199,6 +206,7 @@ static int codetag_module_init(struct co return 0; } +#ifdef CONFIG_MODULES void codetag_load_module(struct module *mod) { struct codetag_type *cttype; @@ -248,9 +256,6 @@ bool codetag_unload_module(struct module return unload_ok; } - -#else /* CONFIG_MODULES */ -static int codetag_module_init(struct codetag_type *cttype, struct module *mod) { return 0; } #endif /* CONFIG_MODULES */ struct codetag_type * _ Patches currently in -mm which might be from surenb(a)google.com are

1 year

1
0
0 0

[merged mm-hotfixes-stable] mm-vmalloc-optimize-vmap_lazy_nr-arithmetic-when-purging-each-vmap_area.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: mm: vmalloc: optimize vmap_lazy_nr arithmetic when purging each vmap_area has been removed from the -mm tree. Its filename was mm-vmalloc-optimize-vmap_lazy_nr-arithmetic-when-purging-each-vmap_area.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Adrian Huang <ahuang12(a)lenovo.com> Subject: mm: vmalloc: optimize vmap_lazy_nr arithmetic when purging each vmap_area Date: Thu, 29 Aug 2024 21:06:33 +0800 When running the vmalloc stress on a 448-core system, observe the average latency of purge_vmap_node() is about 2 seconds by using the eBPF/bcc 'funclatency.py' tool [1]. # /your-git-repo/bcc/tools/funclatency.py -u purge_vmap_node & pid1=$! && sleep 8 && modprobe test_vmalloc nr_threads=$(nproc) run_test_mask=0x7; kill -SIGINT $pid1 usecs : count distribution 0 -> 1 : 0 | | 2 -> 3 : 29 | | 4 -> 7 : 19 | | 8 -> 15 : 56 | | 16 -> 31 : 483 |**** | 32 -> 63 : 1548 |************ | 64 -> 127 : 2634 |********************* | 128 -> 255 : 2535 |********************* | 256 -> 511 : 1776 |************** | 512 -> 1023 : 1015 |******** | 1024 -> 2047 : 573 |**** | 2048 -> 4095 : 488 |**** | 4096 -> 8191 : 1091 |********* | 8192 -> 16383 : 3078 |************************* | 16384 -> 32767 : 4821 |****************************************| 32768 -> 65535 : 3318 |*************************** | 65536 -> 131071 : 1718 |************** | 131072 -> 262143 : 2220 |****************** | 262144 -> 524287 : 1147 |********* | 524288 -> 1048575 : 1179 |********* | 1048576 -> 2097151 : 822 |****** | 2097152 -> 4194303 : 906 |******* | 4194304 -> 8388607 : 2148 |***************** | 8388608 -> 16777215 : 4497 |************************************* | 16777216 -> 33554431 : 289 |** | avg = 2041714 usecs, total: 78381401772 usecs, count: 38390 The worst case is over 16-33 seconds, so soft lockup is triggered [2]. [Root Cause] 1) Each purge_list has the long list. The following shows the number of vmap_area is purged. crash> p vmap_nodes vmap_nodes = $27 = (struct vmap_node *) 0xff2de5a900100000 crash> vmap_node 0xff2de5a900100000 128 | grep nr_purged nr_purged = 663070 ... nr_purged = 821670 nr_purged = 692214 nr_purged = 726808 ... 2) atomic_long_sub() employs the 'lock' prefix to ensure the atomic operation when purging each vmap_area. However, the iteration is over 600000 vmap_area (See 'nr_purged' above). Here is objdump output: $ objdump -D vmlinux ffffffff813e8c80 <purge_vmap_node>: ... ffffffff813e8d70: f0 48 29 2d 68 0c bb lock sub %rbp,0x2bb0c68(%rip) ... Quote from "Instruction tables" pdf file [3]: Instructions with a LOCK prefix have a long latency that depends on cache organization and possibly RAM speed. If there are multiple processors or cores or direct memory access (DMA) devices, then all locked instructions will lock a cache line for exclusive access, which may involve RAM access. A LOCK prefix typically costs more than a hundred clock cycles, even on single-processor systems. That's why the latency of purge_vmap_node() dramatically increases on a many-core system: One core is busy on purging each vmap_area of the *long* purge_list and executing atomic_long_sub() for each vmap_area, while other cores free vmalloc allocations and execute atomic_long_add_return() in free_vmap_area_noflush(). [Solution] Employ a local variable to record the total purged pages, and execute atomic_long_sub() after the traversal of the purge_list is done. The experiment result shows the latency improvement is 99%. [Experiment Result] 1) System Configuration: Three servers (with HT-enabled) are tested. * 72-core server: 3rd Gen Intel Xeon Scalable Processor*1 * 192-core server: 5th Gen Intel Xeon Scalable Processor*2 * 448-core server: AMD Zen 4 Processor*2 2) Kernel Config * CONFIG_KASAN is disabled 3) The data in column "w/o patch" and "w/ patch" * Unit: micro seconds (us) * Each data is the average of 3-time measurements System w/o patch (us) w/ patch (us) Improvement (%) --------------- -------------- ------------- ------------- 72-core server 2194 14 99.36% 192-core server 143799 1139 99.21% 448-core server 1992122 6883 99.65% [1] https://github.com/iovisor/bcc/blob/master/tools/funclatency.py [2] https://gist.github.com/AdrianHuang/37c15f67b45407b83c2d32f918656c12 [3] https://www.agner.org/optimize/instruction_tables.pdf Link: https://lkml.kernel.org/r/20240829130633.2184-1-ahuang12@lenovo.com Signed-off-by: Adrian Huang <ahuang12(a)lenovo.com> Reviewed-by: Uladzislau Rezki (Sony) <urezki(a)gmail.com> Cc: Christoph Hellwig <hch(a)infradead.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/vmalloc.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) --- a/mm/vmalloc.c~mm-vmalloc-optimize-vmap_lazy_nr-arithmetic-when-purging-each-vmap_area +++ a/mm/vmalloc.c @@ -2191,6 +2191,7 @@ static void purge_vmap_node(struct work_ { struct vmap_node *vn = container_of(work, struct vmap_node, purge_work); + unsigned long nr_purged_pages = 0; struct vmap_area *va, *n_va; LIST_HEAD(local_list); @@ -2208,7 +2209,7 @@ static void purge_vmap_node(struct work_ kasan_release_vmalloc(orig_start, orig_end, va->va_start, va->va_end); - atomic_long_sub(nr, &vmap_lazy_nr); + nr_purged_pages += nr; vn->nr_purged++; if (is_vn_id_valid(vn_id) && !vn->skip_populate) @@ -2219,6 +2220,8 @@ static void purge_vmap_node(struct work_ list_add(&va->list, &local_list); } + atomic_long_sub(nr_purged_pages, &vmap_lazy_nr); + reclaim_list_global(&local_list); } _ Patches currently in -mm which might be from ahuang12(a)lenovo.com are mm-vmalloc-combine-all-tlb-flush-operations-of-kasan-shadow-virtual-address-into-one-operation.patch

1 year

1
0
0 0

[merged mm-hotfixes-stable] codetag-debug-mark-codetags-for-poisoned-page-as-empty.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: codetag: debug: mark codetags for poisoned page as empty has been removed from the -mm tree. Its filename was codetag-debug-mark-codetags-for-poisoned-page-as-empty.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Hao Ge <gehao(a)kylinos.cn> Subject: codetag: debug: mark codetags for poisoned page as empty Date: Mon, 26 Aug 2024 00:36:49 +0800 When PG_hwpoison pages are freed they are treated differently in free_pages_prepare() and instead of being released they are isolated. Page allocation tag counters are decremented at this point since the page is considered not in use. Later on when such pages are released by unpoison_memory(), the allocation tag counters will be decremented again and the following warning gets reported: [ 113.930443][ T3282] ------------[ cut here ]------------ [ 113.931105][ T3282] alloc_tag was not set [ 113.931576][ T3282] WARNING: CPU: 2 PID: 3282 at ./include/linux/alloc_tag.h:130 pgalloc_tag_sub.part.66+0x154/0x164 [ 113.932866][ T3282] Modules linked in: hwpoison_inject fuse ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 ipt_REJECT nf_reject_ipv4 xt_conntrack ebtable_nat ebtable_broute ip6table_nat ip6table_man4 [ 113.941638][ T3282] CPU: 2 UID: 0 PID: 3282 Comm: madvise11 Kdump: loaded Tainted: G W 6.11.0-rc4-dirty #18 [ 113.943003][ T3282] Tainted: [W]=WARN [ 113.943453][ T3282] Hardware name: QEMU KVM Virtual Machine, BIOS unknown 2/2/2022 [ 113.944378][ T3282] pstate: 40400005 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 113.945319][ T3282] pc : pgalloc_tag_sub.part.66+0x154/0x164 [ 113.946016][ T3282] lr : pgalloc_tag_sub.part.66+0x154/0x164 [ 113.946706][ T3282] sp : ffff800087093a10 [ 113.947197][ T3282] x29: ffff800087093a10 x28: ffff0000d7a9d400 x27: ffff80008249f0a0 [ 113.948165][ T3282] x26: 0000000000000000 x25: ffff80008249f2b0 x24: 0000000000000000 [ 113.949134][ T3282] x23: 0000000000000001 x22: 0000000000000001 x21: 0000000000000000 [ 113.950597][ T3282] x20: ffff0000c08fcad8 x19: ffff80008251e000 x18: ffffffffffffffff [ 113.952207][ T3282] x17: 0000000000000000 x16: 0000000000000000 x15: ffff800081746210 [ 113.953161][ T3282] x14: 0000000000000000 x13: 205d323832335420 x12: 5b5d353031313339 [ 113.954120][ T3282] x11: ffff800087093500 x10: 000000000000005d x9 : 00000000ffffffd0 [ 113.955078][ T3282] x8 : 7f7f7f7f7f7f7f7f x7 : ffff80008236ba90 x6 : c0000000ffff7fff [ 113.956036][ T3282] x5 : ffff000b34bf4dc8 x4 : ffff8000820aba90 x3 : 0000000000000001 [ 113.956994][ T3282] x2 : ffff800ab320f000 x1 : 841d1e35ac932e00 x0 : 0000000000000000 [ 113.957962][ T3282] Call trace: [ 113.958350][ T3282] pgalloc_tag_sub.part.66+0x154/0x164 [ 113.959000][ T3282] pgalloc_tag_sub+0x14/0x1c [ 113.959539][ T3282] free_unref_page+0xf4/0x4b8 [ 113.960096][ T3282] __folio_put+0xd4/0x120 [ 113.960614][ T3282] folio_put+0x24/0x50 [ 113.961103][ T3282] unpoison_memory+0x4f0/0x5b0 [ 113.961678][ T3282] hwpoison_unpoison+0x30/0x48 [hwpoison_inject] [ 113.962436][ T3282] simple_attr_write_xsigned.isra.34+0xec/0x1cc [ 113.963183][ T3282] simple_attr_write+0x38/0x48 [ 113.963750][ T3282] debugfs_attr_write+0x54/0x80 [ 113.964330][ T3282] full_proxy_write+0x68/0x98 [ 113.964880][ T3282] vfs_write+0xdc/0x4d0 [ 113.965372][ T3282] ksys_write+0x78/0x100 [ 113.965875][ T3282] __arm64_sys_write+0x24/0x30 [ 113.966440][ T3282] invoke_syscall+0x7c/0x104 [ 113.966984][ T3282] el0_svc_common.constprop.1+0x88/0x104 [ 113.967652][ T3282] do_el0_svc+0x2c/0x38 [ 113.968893][ T3282] el0_svc+0x3c/0x1b8 [ 113.969379][ T3282] el0t_64_sync_handler+0x98/0xbc [ 113.969980][ T3282] el0t_64_sync+0x19c/0x1a0 [ 113.970511][ T3282] ---[ end trace 0000000000000000 ]--- To fix this, clear the page tag reference after the page got isolated and accounted for. Link: https://lkml.kernel.org/r/20240825163649.33294-1-hao.ge@linux.dev Fixes: d224eb0287fb ("codetag: debug: mark codetags for reserved pages as empty") Signed-off-by: Hao Ge <gehao(a)kylinos.cn> Reviewed-by: Miaohe Lin <linmiaohe(a)huawei.com> Acked-by: Suren Baghdasaryan <surenb(a)google.com> Cc: David Hildenbrand <david(a)redhat.com> Cc: Hao Ge <gehao(a)kylinos.cn> Cc: Kent Overstreet <kent.overstreet(a)linux.dev> Cc: Naoya Horiguchi <nao.horiguchi(a)gmail.com> Cc: Pasha Tatashin <pasha.tatashin(a)soleen.com> Cc: <stable(a)vger.kernel.org> [6.10+] Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/page_alloc.c | 7 +++++++ 1 file changed, 7 insertions(+) --- a/mm/page_alloc.c~codetag-debug-mark-codetags-for-poisoned-page-as-empty +++ a/mm/page_alloc.c @@ -1054,6 +1054,13 @@ __always_inline bool free_pages_prepare( reset_page_owner(page, order); page_table_check_free(page, order); pgalloc_tag_sub(page, 1 << order); + + /* + * The page is isolated and accounted for. + * Mark the codetag as empty to avoid accounting error + * when the page is freed by unpoison_memory(). + */ + clear_page_tag_ref(page); return false; } _ Patches currently in -mm which might be from gehao(a)kylinos.cn are mm-cma-change-the-addition-of-totalcma_pages-in-the-cma_init_reserved_mem.patch

1 year

1
0
0 0

[merged mm-hotfixes-stable] revert-mm-skip-cma-pages-when-they-are-not-available.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: Revert "mm: skip CMA pages when they are not available" has been removed from the -mm tree. Its filename was revert-mm-skip-cma-pages-when-they-are-not-available.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Usama Arif <usamaarif642(a)gmail.com> Subject: Revert "mm: skip CMA pages when they are not available" Date: Wed, 21 Aug 2024 20:26:07 +0100 This reverts commit 5da226dbfce3 ("mm: skip CMA pages when they are not available") and b7108d66318a ("Multi-gen LRU: skip CMA pages when they are not eligible"). lruvec->lru_lock is highly contended and is held when calling isolate_lru_folios. If the lru has a large number of CMA folios consecutively, while the allocation type requested is not MIGRATE_MOVABLE, isolate_lru_folios can hold the lock for a very long time while it skips those. For FIO workload, ~150million order=0 folios were skipped to isolate a few ZONE_DMA folios [1]. This can cause lockups [1] and high memory pressure for extended periods of time [2]. Remove skipping CMA for MGLRU as well, as it was introduced in sort_folio for the same resaon as 5da226dbfce3a2f44978c2c7cf88166e69a6788b. [1] https://lore.kernel.org/all/CAOUHufbkhMZYz20aM_3rHZ3OcK4m2puji2FGpUpn_-DevG… [2] https://lore.kernel.org/all/ZrssOrcJIDy8hacI@gmail.com/ [usamaarif642(a)gmail.com: also revert b7108d66318a, per Johannes] Link: https://lkml.kernel.org/r/9060a32d-b2d7-48c0-8626-1db535653c54@gmail.com Link: https://lkml.kernel.org/r/357ac325-4c61-497a-92a3-bdbd230d5ec9@gmail.com Link: https://lkml.kernel.org/r/9060a32d-b2d7-48c0-8626-1db535653c54@gmail.com Fixes: 5da226dbfce3 ("mm: skip CMA pages when they are not available") Signed-off-by: Usama Arif <usamaarif642(a)gmail.com> Acked-by: Johannes Weiner <hannes(a)cmpxchg.org> Cc: Bharata B Rao <bharata(a)amd.com> Cc: Breno Leitao <leitao(a)debian.org> Cc: David Hildenbrand <david(a)redhat.com> Cc: Matthew Wilcox <willy(a)infradead.org> Cc: Rik van Riel <riel(a)surriel.com> Cc: Vlastimil Babka <vbabka(a)suse.cz> Cc: Yu Zhao <yuzhao(a)google.com> Cc: Zhaoyang Huang <huangzhaoyang(a)gmail.com> Cc: Zhaoyang Huang <zhaoyang.huang(a)unisoc.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/vmscan.c | 24 ++---------------------- 1 file changed, 2 insertions(+), 22 deletions(-) --- a/mm/vmscan.c~revert-mm-skip-cma-pages-when-they-are-not-available +++ a/mm/vmscan.c @@ -1604,25 +1604,6 @@ static __always_inline void update_lru_s } -#ifdef CONFIG_CMA -/* - * It is waste of effort to scan and reclaim CMA pages if it is not available - * for current allocation context. Kswapd can not be enrolled as it can not - * distinguish this scenario by using sc->gfp_mask = GFP_KERNEL - */ -static bool skip_cma(struct folio *folio, struct scan_control *sc) -{ - return !current_is_kswapd() && - gfp_migratetype(sc->gfp_mask) != MIGRATE_MOVABLE && - folio_migratetype(folio) == MIGRATE_CMA; -} -#else -static bool skip_cma(struct folio *folio, struct scan_control *sc) -{ - return false; -} -#endif - /* * Isolating page from the lruvec to fill in @dst list by nr_to_scan times. * @@ -1669,8 +1650,7 @@ static unsigned long isolate_lru_folios( nr_pages = folio_nr_pages(folio); total_scan += nr_pages; - if (folio_zonenum(folio) > sc->reclaim_idx || - skip_cma(folio, sc)) { + if (folio_zonenum(folio) > sc->reclaim_idx) { nr_skipped[folio_zonenum(folio)] += nr_pages; move_to = &folios_skipped; goto move; @@ -4320,7 +4300,7 @@ static bool sort_folio(struct lruvec *lr } /* ineligible */ - if (zone > sc->reclaim_idx || skip_cma(folio, sc)) { + if (zone > sc->reclaim_idx) { gen = folio_inc_gen(lruvec, folio, false); list_move_tail(&folio->lru, &lrugen->folios[gen][type][zone]); return true; _ Patches currently in -mm which might be from usamaarif642(a)gmail.com are mm-store-zero-pages-to-be-swapped-out-in-a-bitmap.patch mm-remove-code-to-handle-same-filled-pages.patch mm-introduce-a-pageflag-for-partially-mapped-folios.patch mm-split-underused-thps.patch mm-add-sysfs-entry-to-disable-splitting-underused-thps.patch

1 year

1
0
0 0

[merged mm-hotfixes-stable] maple_tree-remove-rcu_read_lock-from-mt_validate.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: maple_tree: remove rcu_read_lock() from mt_validate() has been removed from the -mm tree. Its filename was maple_tree-remove-rcu_read_lock-from-mt_validate.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: "Liam R. Howlett" <Liam.Howlett(a)Oracle.com> Subject: maple_tree: remove rcu_read_lock() from mt_validate() Date: Tue, 20 Aug 2024 13:54:17 -0400 The write lock should be held when validating the tree to avoid updates racing with checks. Holding the rcu read lock during a large tree validation may also cause a prolonged rcu read window and "rcu_preempt detected stalls" warnings. Link: https://lore.kernel.org/all/0000000000001d12d4062005aea1@google.com/ Link: https://lkml.kernel.org/r/20240820175417.2782532-1-Liam.Howlett@oracle.com Fixes: 54a611b60590 ("Maple Tree: add new data structure") Signed-off-by: Liam R. Howlett <Liam.Howlett(a)Oracle.com> Reported-by: syzbot+036af2f0c7338a33b0cd(a)syzkaller.appspotmail.com Cc: Hillf Danton <hdanton(a)sina.com> Cc: Matthew Wilcox <willy(a)infradead.org> Cc: "Paul E. McKenney" <paulmck(a)kernel.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- lib/maple_tree.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) --- a/lib/maple_tree.c~maple_tree-remove-rcu_read_lock-from-mt_validate +++ a/lib/maple_tree.c @@ -7566,14 +7566,14 @@ static void mt_validate_nulls(struct map * 2. The gap is correctly set in the parents */ void mt_validate(struct maple_tree *mt) + __must_hold(mas->tree->ma_lock) { unsigned char end; MA_STATE(mas, mt, 0, 0); - rcu_read_lock(); mas_start(&mas); if (!mas_is_active(&mas)) - goto done; + return; while (!mte_is_leaf(mas.node)) mas_descend(&mas); @@ -7594,9 +7594,6 @@ void mt_validate(struct maple_tree *mt) mas_dfs_postorder(&mas, ULONG_MAX); } mt_validate_nulls(mt); -done: - rcu_read_unlock(); - } EXPORT_SYMBOL_GPL(mt_validate); _ Patches currently in -mm which might be from Liam.Howlett(a)Oracle.com are mm-vma-correctly-position-vma_iterator-in-__split_vma.patch mm-vma-introduce-abort_munmap_vmas.patch mm-vma-introduce-vmi_complete_munmap_vmas.patch mm-vma-extract-the-gathering-of-vmas-from-do_vmi_align_munmap.patch mm-vma-introduce-vma_munmap_struct-for-use-in-munmap-operations.patch mm-vma-change-munmap-to-use-vma_munmap_struct-for-accounting-and-surrounding-vmas.patch mm-vma-extract-validate_mm-from-vma_complete.patch mm-vma-inline-munmap-operation-in-mmap_region.patch mm-vma-expand-mmap_region-munmap-call.patch mm-vma-support-vma-==-null-in-init_vma_munmap.patch mm-mmap-reposition-vma-iterator-in-mmap_region.patch mm-vma-track-start-and-end-for-munmap-in-vma_munmap_struct.patch mm-clean-up-unmap_region-argument-list.patch mm-mmap-avoid-zeroing-vma-tree-in-mmap_region.patch mm-change-failure-of-map_fixed-to-restoring-the-gap-on-failure.patch mm-mmap-use-phys_pfn-in-mmap_region.patch mm-mmap-use-vms-accounted-pages-in-mmap_region.patch ipc-shm-mm-drop-do_vma_munmap.patch mm-move-may_expand_vm-check-in-mmap_region.patch mm-vma-drop-incorrect-comment-from-vms_gather_munmap_vmas.patch mm-vmah-optimise-vma_munmap_struct.patch

1 year

1
0
0 0

[merged mm-hotfixes-stable] kexec_file-fix-elfcorehdr-digest-exclusion-when-config_crash_hotplug=y.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: kexec_file: fix elfcorehdr digest exclusion when CONFIG_CRASH_HOTPLUG=y has been removed from the -mm tree. Its filename was kexec_file-fix-elfcorehdr-digest-exclusion-when-config_crash_hotplug=y.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Petr Tesarik <ptesarik(a)suse.com> Subject: kexec_file: fix elfcorehdr digest exclusion when CONFIG_CRASH_HOTPLUG=y Date: Mon, 5 Aug 2024 17:07:50 +0200 Fix the condition to exclude the elfcorehdr segment from the SHA digest calculation. The j iterator is an index into the output sha_regions[] array, not into the input image->segment[] array. Once it reaches image->elfcorehdr_index, all subsequent segments are excluded. Besides, if the purgatory segment precedes the elfcorehdr segment, the elfcorehdr may be wrongly included in the calculation. Link: https://lkml.kernel.org/r/20240805150750.170739-1-petr.tesarik@suse.com Fixes: f7cc804a9fd4 ("kexec: exclude elfcorehdr from the segment digest") Signed-off-by: Petr Tesarik <ptesarik(a)suse.com> Acked-by: Baoquan He <bhe(a)redhat.com> Cc: Eric Biederman <ebiederm(a)xmission.com> Cc: Hari Bathini <hbathini(a)linux.ibm.com> Cc: Sourabh Jain <sourabhjain(a)linux.ibm.com> Cc: Eric DeVolder <eric_devolder(a)yahoo.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- kernel/kexec_file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/kernel/kexec_file.c~kexec_file-fix-elfcorehdr-digest-exclusion-when-config_crash_hotplug=y +++ a/kernel/kexec_file.c @@ -752,7 +752,7 @@ static int kexec_calculate_store_digests #ifdef CONFIG_CRASH_HOTPLUG /* Exclude elfcorehdr segment to allow future changes via hotplug */ - if (j == image->elfcorehdr_index) + if (i == image->elfcorehdr_index) continue; #endif _ Patches currently in -mm which might be from ptesarik(a)suse.com are

1 year

1
0
0 0

[merged mm-hotfixes-stable] mm-slub-add-check-for-s-flags-in-the-alloc_tagging_slab_free_hook.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: mm/slub: add check for s->flags in the alloc_tagging_slab_free_hook has been removed from the -mm tree. Its filename was mm-slub-add-check-for-s-flags-in-the-alloc_tagging_slab_free_hook.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Hao Ge <gehao(a)kylinos.cn> Subject: mm/slub: add check for s->flags in the alloc_tagging_slab_free_hook Date: Fri, 16 Aug 2024 09:33:36 +0800 When enable CONFIG_MEMCG & CONFIG_KFENCE & CONFIG_KMEMLEAK, the following warning always occurs,This is because the following call stack occurred: mem_pool_alloc kmem_cache_alloc_noprof slab_alloc_node kfence_alloc Once the kfence allocation is successful,slab->obj_exts will not be empty, because it has already been assigned a value in kfence_init_pool. Since in the prepare_slab_obj_exts_hook function,we perform a check for s->flags & (SLAB_NO_OBJ_EXT | SLAB_NOLEAKTRACE),the alloc_tag_add function will not be called as a result.Therefore,ref->ct remains NULL. However,when we call mem_pool_free,since obj_ext is not empty, it eventually leads to the alloc_tag_sub scenario being invoked. This is where the warning occurs. So we should add corresponding checks in the alloc_tagging_slab_free_hook. For __GFP_NO_OBJ_EXT case,I didn't see the specific case where it's using kfence,so I won't add the corresponding check in alloc_tagging_slab_free_hook for now. [ 3.734349] ------------[ cut here ]------------ [ 3.734807] alloc_tag was not set [ 3.735129] WARNING: CPU: 4 PID: 40 at ./include/linux/alloc_tag.h:130 kmem_cache_free+0x444/0x574 [ 3.735866] Modules linked in: autofs4 [ 3.736211] CPU: 4 UID: 0 PID: 40 Comm: ksoftirqd/4 Tainted: G W 6.11.0-rc3-dirty #1 [ 3.736969] Tainted: [W]=WARN [ 3.737258] Hardware name: QEMU KVM Virtual Machine, BIOS unknown 2/2/2022 [ 3.737875] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 3.738501] pc : kmem_cache_free+0x444/0x574 [ 3.738951] lr : kmem_cache_free+0x444/0x574 [ 3.739361] sp : ffff80008357bb60 [ 3.739693] x29: ffff80008357bb70 x28: 0000000000000000 x27: 0000000000000000 [ 3.740338] x26: ffff80008207f000 x25: ffff000b2eb2fd60 x24: ffff0000c0005700 [ 3.740982] x23: ffff8000804229e4 x22: ffff800082080000 x21: ffff800081756000 [ 3.741630] x20: fffffd7ff8253360 x19: 00000000000000a8 x18: ffffffffffffffff [ 3.742274] x17: ffff800ab327f000 x16: ffff800083398000 x15: ffff800081756df0 [ 3.742919] x14: 0000000000000000 x13: 205d344320202020 x12: 5b5d373038343337 [ 3.743560] x11: ffff80008357b650 x10: 000000000000005d x9 : 00000000ffffffd0 [ 3.744231] x8 : 7f7f7f7f7f7f7f7f x7 : ffff80008237bad0 x6 : c0000000ffff7fff [ 3.744907] x5 : ffff80008237ba78 x4 : ffff8000820bbad0 x3 : 0000000000000001 [ 3.745580] x2 : 68d66547c09f7800 x1 : 68d66547c09f7800 x0 : 0000000000000000 [ 3.746255] Call trace: [ 3.746530] kmem_cache_free+0x444/0x574 [ 3.746931] mem_pool_free+0x44/0xf4 [ 3.747306] free_object_rcu+0xc8/0xdc [ 3.747693] rcu_do_batch+0x234/0x8a4 [ 3.748075] rcu_core+0x230/0x3e4 [ 3.748424] rcu_core_si+0x14/0x1c [ 3.748780] handle_softirqs+0x134/0x378 [ 3.749189] run_ksoftirqd+0x70/0x9c [ 3.749560] smpboot_thread_fn+0x148/0x22c [ 3.749978] kthread+0x10c/0x118 [ 3.750323] ret_from_fork+0x10/0x20 [ 3.750696] ---[ end trace 0000000000000000 ]--- Link: https://lkml.kernel.org/r/20240816013336.17505-1-hao.ge@linux.dev Fixes: 4b8736964640 ("mm/slab: add allocation accounting into slab allocation and free paths") Signed-off-by: Hao Ge <gehao(a)kylinos.cn> Cc: Christoph Lameter <cl(a)linux.com> Cc: David Rientjes <rientjes(a)google.com> Cc: Hyeonggon Yoo <42.hyeyoo(a)gmail.com> Cc: Joonsoo Kim <iamjoonsoo.kim(a)lge.com> Cc: Kees Cook <kees(a)kernel.org> Cc: Kent Overstreet <kent.overstreet(a)linux.dev> Cc: Pekka Enberg <penberg(a)kernel.org> Cc: Roman Gushchin <roman.gushchin(a)linux.dev> Cc: Suren Baghdasaryan <surenb(a)google.com> Cc: Vlastimil Babka <vbabka(a)suse.cz> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/slub.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/mm/slub.c~mm-slub-add-check-for-s-flags-in-the-alloc_tagging_slab_free_hook +++ a/mm/slub.c @@ -2116,6 +2116,10 @@ alloc_tagging_slab_free_hook(struct kmem if (!mem_alloc_profiling_enabled()) return; + /* slab->obj_exts might not be NULL if it was created for MEMCG accounting. */ + if (s->flags & (SLAB_NO_OBJ_EXT | SLAB_NOLEAKTRACE)) + return; + obj_exts = slab_obj_exts(slab); if (!obj_exts) return; _ Patches currently in -mm which might be from gehao(a)kylinos.cn are mm-cma-change-the-addition-of-totalcma_pages-in-the-cma_init_reserved_mem.patch

1 year

1
0
0 0

[merged mm-hotfixes-stable] nilfs2-fix-state-management-in-error-path-of-log-writing-function.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: nilfs2: fix state management in error path of log writing function has been removed from the -mm tree. Its filename was nilfs2-fix-state-management-in-error-path-of-log-writing-function.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Subject: nilfs2: fix state management in error path of log writing function Date: Wed, 14 Aug 2024 19:11:19 +0900 After commit a694291a6211 ("nilfs2: separate wait function from nilfs_segctor_write") was applied, the log writing function nilfs_segctor_do_construct() was able to issue I/O requests continuously even if user data blocks were split into multiple logs across segments, but two potential flaws were introduced in its error handling. First, if nilfs_segctor_begin_construction() fails while creating the second or subsequent logs, the log writing function returns without calling nilfs_segctor_abort_construction(), so the writeback flag set on pages/folios will remain uncleared. This causes page cache operations to hang waiting for the writeback flag. For example, truncate_inode_pages_final(), which is called via nilfs_evict_inode() when an inode is evicted from memory, will hang. Second, the NILFS_I_COLLECTED flag set on normal inodes remain uncleared. As a result, if the next log write involves checkpoint creation, that's fine, but if a partial log write is performed that does not, inodes with NILFS_I_COLLECTED set are erroneously removed from the "sc_dirty_files" list, and their data and b-tree blocks may not be written to the device, corrupting the block mapping. Fix these issues by uniformly calling nilfs_segctor_abort_construction() on failure of each step in the loop in nilfs_segctor_do_construct(), having it clean up logs and segment usages according to progress, and correcting the conditions for calling nilfs_redirty_inodes() to ensure that the NILFS_I_COLLECTED flag is cleared. Link: https://lkml.kernel.org/r/20240814101119.4070-1-konishi.ryusuke@gmail.com Fixes: a694291a6211 ("nilfs2: separate wait function from nilfs_segctor_write") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- fs/nilfs2/segment.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) --- a/fs/nilfs2/segment.c~nilfs2-fix-state-management-in-error-path-of-log-writing-function +++ a/fs/nilfs2/segment.c @@ -1812,6 +1812,9 @@ static void nilfs_segctor_abort_construc nilfs_abort_logs(&logs, ret ? : err); list_splice_tail_init(&sci->sc_segbufs, &logs); + if (list_empty(&logs)) + return; /* if the first segment buffer preparation failed */ + nilfs_cancel_segusage(&logs, nilfs->ns_sufile); nilfs_free_incomplete_logs(&logs, nilfs); @@ -2056,7 +2059,7 @@ static int nilfs_segctor_do_construct(st err = nilfs_segctor_begin_construction(sci, nilfs); if (unlikely(err)) - goto out; + goto failed; /* Update time stamp */ sci->sc_seg_ctime = ktime_get_real_seconds(); @@ -2120,10 +2123,9 @@ static int nilfs_segctor_do_construct(st return err; failed_to_write: - if (sci->sc_stage.flags & NILFS_CF_IFILE_STARTED) - nilfs_redirty_inodes(&sci->sc_dirty_files); - failed: + if (mode == SC_LSEG_SR && nilfs_sc_cstage_get(sci) >= NILFS_ST_IFILE) + nilfs_redirty_inodes(&sci->sc_dirty_files); if (nilfs_doing_gc()) nilfs_redirty_inodes(&sci->sc_gc_inodes); nilfs_segctor_abort_construction(sci, nilfs, err); _ Patches currently in -mm which might be from konishi.ryusuke(a)gmail.com are nilfs2-add-support-for-fs_ioc_getuuid.patch nilfs2-add-support-for-fs_ioc_getfssysfspath.patch nilfs2-add-support-for-fs_ioc_getfslabel.patch nilfs2-add-support-for-fs_ioc_setfslabel.patch nilfs2-do-not-output-warnings-when-clearing-dirty-buffers.patch nilfs2-add-missing-argument-description-for-__nilfs_error.patch nilfs2-add-missing-argument-descriptions-for-ioctl-related-helpers.patch nilfs2-improve-kernel-doc-comments-for-b-tree-node-helpers.patch nilfs2-fix-incorrect-kernel-doc-declaration-of-nilfs_palloc_req-structure.patch nilfs2-add-missing-description-of-nilfs_btree_path-structure.patch nilfs2-describe-the-members-of-nilfs_bmap_operations-structure.patch nilfs2-fix-inconsistencies-in-kernel-doc-comments-in-segmenth.patch nilfs2-fix-missing-initial-short-descriptions-of-kernel-doc-comments.patch nilfs2-treat-missing-sufile-header-block-as-metadata-corruption.patch nilfs2-treat-missing-cpfile-header-block-as-metadata-corruption.patch nilfs2-do-not-propagate-enoent-error-from-sufile-during-recovery.patch nilfs2-do-not-propagate-enoent-error-from-sufile-during-gc.patch nilfs2-do-not-propagate-enoent-error-from-nilfs_sufile_mark_dirty.patch nilfs2-use-the-bits_per_long-macro.patch nilfs2-separate-inode-type-information-from-i_state-field.patch nilfs2-eliminate-the-shared-counter-and-spinlock-for-i_generation.patch nilfs2-do-not-repair-reserved-inode-bitmap-in-nilfs_new_inode.patch nilfs2-remove-sc_timer_task.patch nilfs2-use-kthread_create-and-kthread_stop-for-the-log-writer-thread.patch nilfs2-refactor-nilfs_segctor_thread.patch

1 year

1
0
0 0

[merged mm-hotfixes-stable] nilfs2-fix-missing-cleanup-on-rollforward-recovery-error.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: nilfs2: fix missing cleanup on rollforward recovery error has been removed from the -mm tree. Its filename was nilfs2-fix-missing-cleanup-on-rollforward-recovery-error.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Subject: nilfs2: fix missing cleanup on rollforward recovery error Date: Sat, 10 Aug 2024 15:52:42 +0900 In an error injection test of a routine for mount-time recovery, KASAN found a use-after-free bug. It turned out that if data recovery was performed using partial logs created by dsync writes, but an error occurred before starting the log writer to create a recovered checkpoint, the inodes whose data had been recovered were left in the ns_dirty_files list of the nilfs object and were not freed. Fix this issue by cleaning up inodes that have read the recovery data if the recovery routine fails midway before the log writer starts. Link: https://lkml.kernel.org/r/20240810065242.3701-1-konishi.ryusuke@gmail.com Fixes: 0f3e1c7f23f8 ("nilfs2: recovery functions") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- fs/nilfs2/recovery.c | 35 +++++++++++++++++++++++++++++++++-- 1 file changed, 33 insertions(+), 2 deletions(-) --- a/fs/nilfs2/recovery.c~nilfs2-fix-missing-cleanup-on-rollforward-recovery-error +++ a/fs/nilfs2/recovery.c @@ -716,6 +716,33 @@ static void nilfs_finish_roll_forward(st } /** + * nilfs_abort_roll_forward - cleaning up after a failed rollforward recovery + * @nilfs: nilfs object + */ +static void nilfs_abort_roll_forward(struct the_nilfs *nilfs) +{ + struct nilfs_inode_info *ii, *n; + LIST_HEAD(head); + + /* Abandon inodes that have read recovery data */ + spin_lock(&nilfs->ns_inode_lock); + list_splice_init(&nilfs->ns_dirty_files, &head); + spin_unlock(&nilfs->ns_inode_lock); + if (list_empty(&head)) + return; + + set_nilfs_purging(nilfs); + list_for_each_entry_safe(ii, n, &head, i_dirty) { + spin_lock(&nilfs->ns_inode_lock); + list_del_init(&ii->i_dirty); + spin_unlock(&nilfs->ns_inode_lock); + + iput(&ii->vfs_inode); + } + clear_nilfs_purging(nilfs); +} + +/** * nilfs_salvage_orphan_logs - salvage logs written after the latest checkpoint * @nilfs: nilfs object * @sb: super block instance @@ -773,15 +800,19 @@ int nilfs_salvage_orphan_logs(struct the if (unlikely(err)) { nilfs_err(sb, "error %d writing segment for recovery", err); - goto failed; + goto put_root; } nilfs_finish_roll_forward(nilfs, ri); } - failed: +put_root: nilfs_put_root(root); return err; + +failed: + nilfs_abort_roll_forward(nilfs); + goto put_root; } /** _ Patches currently in -mm which might be from konishi.ryusuke(a)gmail.com are nilfs2-add-support-for-fs_ioc_getuuid.patch nilfs2-add-support-for-fs_ioc_getfssysfspath.patch nilfs2-add-support-for-fs_ioc_getfslabel.patch nilfs2-add-support-for-fs_ioc_setfslabel.patch nilfs2-do-not-output-warnings-when-clearing-dirty-buffers.patch nilfs2-add-missing-argument-description-for-__nilfs_error.patch nilfs2-add-missing-argument-descriptions-for-ioctl-related-helpers.patch nilfs2-improve-kernel-doc-comments-for-b-tree-node-helpers.patch nilfs2-fix-incorrect-kernel-doc-declaration-of-nilfs_palloc_req-structure.patch nilfs2-add-missing-description-of-nilfs_btree_path-structure.patch nilfs2-describe-the-members-of-nilfs_bmap_operations-structure.patch nilfs2-fix-inconsistencies-in-kernel-doc-comments-in-segmenth.patch nilfs2-fix-missing-initial-short-descriptions-of-kernel-doc-comments.patch nilfs2-treat-missing-sufile-header-block-as-metadata-corruption.patch nilfs2-treat-missing-cpfile-header-block-as-metadata-corruption.patch nilfs2-do-not-propagate-enoent-error-from-sufile-during-recovery.patch nilfs2-do-not-propagate-enoent-error-from-sufile-during-gc.patch nilfs2-do-not-propagate-enoent-error-from-nilfs_sufile_mark_dirty.patch nilfs2-use-the-bits_per_long-macro.patch nilfs2-separate-inode-type-information-from-i_state-field.patch nilfs2-eliminate-the-shared-counter-and-spinlock-for-i_generation.patch nilfs2-do-not-repair-reserved-inode-bitmap-in-nilfs_new_inode.patch nilfs2-remove-sc_timer_task.patch nilfs2-use-kthread_create-and-kthread_stop-for-the-log-writer-thread.patch nilfs2-refactor-nilfs_segctor_thread.patch

1 year

1
0
0 0

[merged mm-hotfixes-stable] nilfs2-protect-references-to-superblock-parameters-exposed-in-sysfs.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: nilfs2: protect references to superblock parameters exposed in sysfs has been removed from the -mm tree. Its filename was nilfs2-protect-references-to-superblock-parameters-exposed-in-sysfs.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Subject: nilfs2: protect references to superblock parameters exposed in sysfs Date: Sun, 11 Aug 2024 19:03:20 +0900 The superblock buffers of nilfs2 can not only be overwritten at runtime for modifications/repairs, but they are also regularly swapped, replaced during resizing, and even abandoned when degrading to one side due to backing device issues. So, accessing them requires mutual exclusion using the reader/writer semaphore "nilfs->ns_sem". Some sysfs attribute show methods read this superblock buffer without the necessary mutual exclusion, which can cause problems with pointer dereferencing and memory access, so fix it. Link: https://lkml.kernel.org/r/20240811100320.9913-1-konishi.ryusuke@gmail.com Fixes: da7141fb78db ("nilfs2: add /sys/fs/nilfs2/<device> group") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- fs/nilfs2/sysfs.c | 43 +++++++++++++++++++++++++++++++++---------- 1 file changed, 33 insertions(+), 10 deletions(-) --- a/fs/nilfs2/sysfs.c~nilfs2-protect-references-to-superblock-parameters-exposed-in-sysfs +++ a/fs/nilfs2/sysfs.c @@ -836,9 +836,15 @@ ssize_t nilfs_dev_revision_show(struct n struct the_nilfs *nilfs, char *buf) { - struct nilfs_super_block **sbp = nilfs->ns_sbp; - u32 major = le32_to_cpu(sbp[0]->s_rev_level); - u16 minor = le16_to_cpu(sbp[0]->s_minor_rev_level); + struct nilfs_super_block *raw_sb; + u32 major; + u16 minor; + + down_read(&nilfs->ns_sem); + raw_sb = nilfs->ns_sbp[0]; + major = le32_to_cpu(raw_sb->s_rev_level); + minor = le16_to_cpu(raw_sb->s_minor_rev_level); + up_read(&nilfs->ns_sem); return sysfs_emit(buf, "%d.%d\n", major, minor); } @@ -856,8 +862,13 @@ ssize_t nilfs_dev_device_size_show(struc struct the_nilfs *nilfs, char *buf) { - struct nilfs_super_block **sbp = nilfs->ns_sbp; - u64 dev_size = le64_to_cpu(sbp[0]->s_dev_size); + struct nilfs_super_block *raw_sb; + u64 dev_size; + + down_read(&nilfs->ns_sem); + raw_sb = nilfs->ns_sbp[0]; + dev_size = le64_to_cpu(raw_sb->s_dev_size); + up_read(&nilfs->ns_sem); return sysfs_emit(buf, "%llu\n", dev_size); } @@ -879,9 +890,15 @@ ssize_t nilfs_dev_uuid_show(struct nilfs struct the_nilfs *nilfs, char *buf) { - struct nilfs_super_block **sbp = nilfs->ns_sbp; + struct nilfs_super_block *raw_sb; + ssize_t len; + + down_read(&nilfs->ns_sem); + raw_sb = nilfs->ns_sbp[0]; + len = sysfs_emit(buf, "%pUb\n", raw_sb->s_uuid); + up_read(&nilfs->ns_sem); - return sysfs_emit(buf, "%pUb\n", sbp[0]->s_uuid); + return len; } static @@ -889,10 +906,16 @@ ssize_t nilfs_dev_volume_name_show(struc struct the_nilfs *nilfs, char *buf) { - struct nilfs_super_block **sbp = nilfs->ns_sbp; + struct nilfs_super_block *raw_sb; + ssize_t len; + + down_read(&nilfs->ns_sem); + raw_sb = nilfs->ns_sbp[0]; + len = scnprintf(buf, sizeof(raw_sb->s_volume_name), "%s\n", + raw_sb->s_volume_name); + up_read(&nilfs->ns_sem); - return scnprintf(buf, sizeof(sbp[0]->s_volume_name), "%s\n", - sbp[0]->s_volume_name); + return len; } static const char dev_readme_str[] = _ Patches currently in -mm which might be from konishi.ryusuke(a)gmail.com are nilfs2-add-support-for-fs_ioc_getuuid.patch nilfs2-add-support-for-fs_ioc_getfssysfspath.patch nilfs2-add-support-for-fs_ioc_getfslabel.patch nilfs2-add-support-for-fs_ioc_setfslabel.patch nilfs2-do-not-output-warnings-when-clearing-dirty-buffers.patch nilfs2-add-missing-argument-description-for-__nilfs_error.patch nilfs2-add-missing-argument-descriptions-for-ioctl-related-helpers.patch nilfs2-improve-kernel-doc-comments-for-b-tree-node-helpers.patch nilfs2-fix-incorrect-kernel-doc-declaration-of-nilfs_palloc_req-structure.patch nilfs2-add-missing-description-of-nilfs_btree_path-structure.patch nilfs2-describe-the-members-of-nilfs_bmap_operations-structure.patch nilfs2-fix-inconsistencies-in-kernel-doc-comments-in-segmenth.patch nilfs2-fix-missing-initial-short-descriptions-of-kernel-doc-comments.patch nilfs2-treat-missing-sufile-header-block-as-metadata-corruption.patch nilfs2-treat-missing-cpfile-header-block-as-metadata-corruption.patch nilfs2-do-not-propagate-enoent-error-from-sufile-during-recovery.patch nilfs2-do-not-propagate-enoent-error-from-sufile-during-gc.patch nilfs2-do-not-propagate-enoent-error-from-nilfs_sufile_mark_dirty.patch nilfs2-use-the-bits_per_long-macro.patch nilfs2-separate-inode-type-information-from-i_state-field.patch nilfs2-eliminate-the-shared-counter-and-spinlock-for-i_generation.patch nilfs2-do-not-repair-reserved-inode-bitmap-in-nilfs_new_inode.patch nilfs2-remove-sc_timer_task.patch nilfs2-use-kthread_create-and-kthread_stop-for-the-log-writer-thread.patch nilfs2-refactor-nilfs_segctor_thread.patch

1 year

1
0
0 0

[merged mm-hotfixes-stable] userfaultfd-dont-bug_on-if-khugepaged-yanks-our-page-table.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: userfaultfd: don't BUG_ON() if khugepaged yanks our page table has been removed from the -mm tree. Its filename was userfaultfd-dont-bug_on-if-khugepaged-yanks-our-page-table.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Jann Horn <jannh(a)google.com> Subject: userfaultfd: don't BUG_ON() if khugepaged yanks our page table Date: Tue, 13 Aug 2024 22:25:22 +0200 Since khugepaged was changed to allow retracting page tables in file mappings without holding the mmap lock, these BUG_ON()s are wrong - get rid of them. We could also remove the preceding "if (unlikely(...))" block, but then we could reach pte_offset_map_lock() with transhuge pages not just for file mappings but also for anonymous mappings - which would probably be fine but I think is not necessarily expected. Link: https://lkml.kernel.org/r/20240813-uffd-thp-flip-fix-v2-2-5efa61078a41@goog… Fixes: 1d65b771bc08 ("mm/khugepaged: retract_page_tables() without mmap or vma lock") Signed-off-by: Jann Horn <jannh(a)google.com> Reviewed-by: Qi Zheng <zhengqi.arch(a)bytedance.com> Acked-by: David Hildenbrand <david(a)redhat.com> Cc: Andrea Arcangeli <aarcange(a)redhat.com> Cc: Hugh Dickins <hughd(a)google.com> Cc: Pavel Emelyanov <xemul(a)virtuozzo.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/userfaultfd.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) --- a/mm/userfaultfd.c~userfaultfd-dont-bug_on-if-khugepaged-yanks-our-page-table +++ a/mm/userfaultfd.c @@ -807,9 +807,10 @@ retry: err = -EFAULT; break; } - - BUG_ON(pmd_none(*dst_pmd)); - BUG_ON(pmd_trans_huge(*dst_pmd)); + /* + * For shmem mappings, khugepaged is allowed to remove page + * tables under us; pte_offset_map_lock() will deal with that. + */ err = mfill_atomic_pte(dst_pmd, dst_vma, dst_addr, src_addr, flags, &folio); _ Patches currently in -mm which might be from jannh(a)google.com are mm-fix-harmless-type-confusion-in-lock_vma_under_rcu.patch

1 year

1
0
0 0

[merged mm-hotfixes-stable] userfaultfd-fix-checks-for-huge-pmds.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: userfaultfd: fix checks for huge PMDs has been removed from the -mm tree. Its filename was userfaultfd-fix-checks-for-huge-pmds.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Jann Horn <jannh(a)google.com> Subject: userfaultfd: fix checks for huge PMDs Date: Tue, 13 Aug 2024 22:25:21 +0200 Patch series "userfaultfd: fix races around pmd_trans_huge() check", v2. The pmd_trans_huge() code in mfill_atomic() is wrong in three different ways depending on kernel version: 1. The pmd_trans_huge() check is racy and can lead to a BUG_ON() (if you hit the right two race windows) - I've tested this in a kernel build with some extra mdelay() calls. See the commit message for a description of the race scenario. On older kernels (before 6.5), I think the same bug can even theoretically lead to accessing transhuge page contents as a page table if you hit the right 5 narrow race windows (I haven't tested this case). 2. As pointed out by Qi Zheng, pmd_trans_huge() is not sufficient for detecting PMDs that don't point to page tables. On older kernels (before 6.5), you'd just have to win a single fairly wide race to hit this. I've tested this on 6.1 stable by racing migration (with a mdelay() patched into try_to_migrate()) against UFFDIO_ZEROPAGE - on my x86 VM, that causes a kernel oops in ptlock_ptr(). 3. On newer kernels (>=6.5), for shmem mappings, khugepaged is allowed to yank page tables out from under us (though I haven't tested that), so I think the BUG_ON() checks in mfill_atomic() are just wrong. I decided to write two separate fixes for these (one fix for bugs 1+2, one fix for bug 3), so that the first fix can be backported to kernels affected by bugs 1+2. This patch (of 2): This fixes two issues. I discovered that the following race can occur: mfill_atomic other thread ============ ============ <zap PMD> pmdp_get_lockless() [reads none pmd] <bail if trans_huge> <if none:> <pagefault creates transhuge zeropage> __pte_alloc [no-op] <zap PMD> <bail if pmd_trans_huge(*dst_pmd)> BUG_ON(pmd_none(*dst_pmd)) I have experimentally verified this in a kernel with extra mdelay() calls; the BUG_ON(pmd_none(*dst_pmd)) triggers. On kernels newer than commit 0d940a9b270b ("mm/pgtable: allow pte_offset_map[_lock]() to fail"), this can't lead to anything worse than a BUG_ON(), since the page table access helpers are actually designed to deal with page tables concurrently disappearing; but on older kernels (<=6.4), I think we could probably theoretically race past the two BUG_ON() checks and end up treating a hugepage as a page table. The second issue is that, as Qi Zheng pointed out, there are other types of huge PMDs that pmd_trans_huge() can't catch: devmap PMDs and swap PMDs (in particular, migration PMDs). On <=6.4, this is worse than the first issue: If mfill_atomic() runs on a PMD that contains a migration entry (which just requires winning a single, fairly wide race), it will pass the PMD to pte_offset_map_lock(), which assumes that the PMD points to a page table. Breakage follows: First, the kernel tries to take the PTE lock (which will crash or maybe worse if there is no "struct page" for the address bits in the migration entry PMD - I think at least on X86 there usually is no corresponding "struct page" thanks to the PTE inversion mitigation, amd64 looks different). If that didn't crash, the kernel would next try to write a PTE into what it wrongly thinks is a page table. As part of fixing these issues, get rid of the check for pmd_trans_huge() before __pte_alloc() - that's redundant, we're going to have to check for that after the __pte_alloc() anyway. Backport note: pmdp_get_lockless() is pmd_read_atomic() in older kernels. Link: https://lkml.kernel.org/r/20240813-uffd-thp-flip-fix-v2-0-5efa61078a41@goog… Link: https://lkml.kernel.org/r/20240813-uffd-thp-flip-fix-v2-1-5efa61078a41@goog… Fixes: c1a4de99fada ("userfaultfd: mcopy_atomic|mfill_zeropage: UFFDIO_COPY|UFFDIO_ZEROPAGE preparation") Signed-off-by: Jann Horn <jannh(a)google.com> Acked-by: David Hildenbrand <david(a)redhat.com> Cc: Andrea Arcangeli <aarcange(a)redhat.com> Cc: Hugh Dickins <hughd(a)google.com> Cc: Jann Horn <jannh(a)google.com> Cc: Pavel Emelyanov <xemul(a)virtuozzo.com> Cc: Qi Zheng <zhengqi.arch(a)bytedance.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/userfaultfd.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) --- a/mm/userfaultfd.c~userfaultfd-fix-checks-for-huge-pmds +++ a/mm/userfaultfd.c @@ -787,21 +787,23 @@ retry: } dst_pmdval = pmdp_get_lockless(dst_pmd); - /* - * If the dst_pmd is mapped as THP don't - * override it and just be strict. - */ - if (unlikely(pmd_trans_huge(dst_pmdval))) { - err = -EEXIST; - break; - } if (unlikely(pmd_none(dst_pmdval)) && unlikely(__pte_alloc(dst_mm, dst_pmd))) { err = -ENOMEM; break; } - /* If an huge pmd materialized from under us fail */ - if (unlikely(pmd_trans_huge(*dst_pmd))) { + dst_pmdval = pmdp_get_lockless(dst_pmd); + /* + * If the dst_pmd is THP don't override it and just be strict. + * (This includes the case where the PMD used to be THP and + * changed back to none after __pte_alloc().) + */ + if (unlikely(!pmd_present(dst_pmdval) || pmd_trans_huge(dst_pmdval) || + pmd_devmap(dst_pmdval))) { + err = -EEXIST; + break; + } + if (unlikely(pmd_bad(dst_pmdval))) { err = -EFAULT; break; } _ Patches currently in -mm which might be from jannh(a)google.com are mm-fix-harmless-type-confusion-in-lock_vma_under_rcu.patch

1 year

1
0
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror