- Linux-stable-mirror - lists.linaro.org

FAILED: patch "[PATCH] misc: fastrpc: Clean buffers on remote invocation failures" failed to apply to 5.4-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.4-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.4.y git checkout FETCH_HEAD git cherry-pick -x 1c8093591d1e372d700fe65423e7315a8ecf721b # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023102939-grit-elitism-fb36@gregkh' --subject-prefix 'PATCH 5.4.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 1c8093591d1e372d700fe65423e7315a8ecf721b Mon Sep 17 00:00:00 2001 From: Ekansh Gupta <quic_ekangupt(a)quicinc.com> Date: Fri, 13 Oct 2023 13:20:06 +0100 Subject: [PATCH] misc: fastrpc: Clean buffers on remote invocation failures With current design, buffers and dma handles are not freed in case of remote invocation failures returned from DSP. This could result in buffer leakings and dma handle pointing to wrong memory in the fastrpc kernel. Adding changes to clean buffers and dma handles even when remote invocation to DSP returns failures. Fixes: c68cfb718c8f ("misc: fastrpc: Add support for context Invoke method") Cc: stable <stable(a)kernel.org> Signed-off-by: Ekansh Gupta <quic_ekangupt(a)quicinc.com> Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org> Link: https://lore.kernel.org/r/20231013122007.174464-4-srinivas.kandagatla@linar… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c index a52701c1b018..3cdc58488db1 100644 --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -1176,11 +1176,6 @@ static int fastrpc_internal_invoke(struct fastrpc_user *fl, u32 kernel, err = wait_for_completion_interruptible(&ctx->work); } - if (err) - goto bail; - - /* Check the response from remote dsp */ - err = ctx->retval; if (err) goto bail; @@ -1191,6 +1186,11 @@ static int fastrpc_internal_invoke(struct fastrpc_user *fl, u32 kernel, if (err) goto bail; + /* Check the response from remote dsp */ + err = ctx->retval; + if (err) + goto bail; + bail: if (err != -ERESTARTSYS && err != -ETIMEDOUT) { /* We are done with this compute context */

2 years

1
0
0 0

FAILED: patch "[PATCH] iio: adc: xilinx-xadc: Don't clobber preset" failed to apply to 4.14-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.14-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-4.14.y git checkout FETCH_HEAD git cherry-pick -x 8d6b3ea4d9eaca80982442b68a292ce50ce0a135 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023102955-showcase-tidy-89ca@gregkh' --subject-prefix 'PATCH 4.14.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 8d6b3ea4d9eaca80982442b68a292ce50ce0a135 Mon Sep 17 00:00:00 2001 From: Robert Hancock <robert.hancock(a)calian.com> Date: Thu, 14 Sep 2023 18:10:18 -0600 Subject: [PATCH] iio: adc: xilinx-xadc: Don't clobber preset voltage/temperature thresholds In the probe function, the driver was reading out the thresholds already set in the core, which can be configured by the user in the Vivado tools when the FPGA image is built. However, it later clobbered those values with zero or maximum values. In particular, the overtemperature shutdown threshold register was overwritten with the max value, which effectively prevents the FPGA from shutting down when the desired threshold was eached, potentially risking hardware damage in that case. Remove this code to leave the preconfigured default threshold values intact. The code was also disabling all alarms regardless of what enable state they were left in by the FPGA image, including the overtemperature shutdown feature. Leave these bits in their original state so they are not unconditionally disabled. Fixes: bdc8cda1d010 ("iio:adc: Add Xilinx XADC driver") Signed-off-by: Robert Hancock <robert.hancock(a)calian.com> Acked-by: O'Griofa, Conall <conall.ogriofa(a)amd.com> Tested-by: O'Griofa, Conall <conall.ogriofa(a)amd.com> Link: https://lore.kernel.org/r/20230915001019.2862964-2-robert.hancock@calian.com Cc: <Stable(a)vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> diff --git a/drivers/iio/adc/xilinx-xadc-core.c b/drivers/iio/adc/xilinx-xadc-core.c index dba73300f894..d4d0d184a172 100644 --- a/drivers/iio/adc/xilinx-xadc-core.c +++ b/drivers/iio/adc/xilinx-xadc-core.c @@ -1423,28 +1423,6 @@ static int xadc_probe(struct platform_device *pdev) if (ret) return ret; - /* Disable all alarms */ - ret = xadc_update_adc_reg(xadc, XADC_REG_CONF1, XADC_CONF1_ALARM_MASK, - XADC_CONF1_ALARM_MASK); - if (ret) - return ret; - - /* Set thresholds to min/max */ - for (i = 0; i < 16; i++) { - /* - * Set max voltage threshold and both temperature thresholds to - * 0xffff, min voltage threshold to 0. - */ - if (i % 8 < 4 || i == 7) - xadc->threshold[i] = 0xffff; - else - xadc->threshold[i] = 0; - ret = xadc_write_adc_reg(xadc, XADC_REG_THRESHOLD(i), - xadc->threshold[i]); - if (ret) - return ret; - } - /* Go to non-buffered mode */ xadc_postdisable(indio_dev);

2 years

1
0
0 0

FAILED: patch "[PATCH] iio: adc: xilinx-xadc: Don't clobber preset" failed to apply to 4.19-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.19-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-4.19.y git checkout FETCH_HEAD git cherry-pick -x 8d6b3ea4d9eaca80982442b68a292ce50ce0a135 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023102953-ditto-overcook-adcf@gregkh' --subject-prefix 'PATCH 4.19.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 8d6b3ea4d9eaca80982442b68a292ce50ce0a135 Mon Sep 17 00:00:00 2001 From: Robert Hancock <robert.hancock(a)calian.com> Date: Thu, 14 Sep 2023 18:10:18 -0600 Subject: [PATCH] iio: adc: xilinx-xadc: Don't clobber preset voltage/temperature thresholds In the probe function, the driver was reading out the thresholds already set in the core, which can be configured by the user in the Vivado tools when the FPGA image is built. However, it later clobbered those values with zero or maximum values. In particular, the overtemperature shutdown threshold register was overwritten with the max value, which effectively prevents the FPGA from shutting down when the desired threshold was eached, potentially risking hardware damage in that case. Remove this code to leave the preconfigured default threshold values intact. The code was also disabling all alarms regardless of what enable state they were left in by the FPGA image, including the overtemperature shutdown feature. Leave these bits in their original state so they are not unconditionally disabled. Fixes: bdc8cda1d010 ("iio:adc: Add Xilinx XADC driver") Signed-off-by: Robert Hancock <robert.hancock(a)calian.com> Acked-by: O'Griofa, Conall <conall.ogriofa(a)amd.com> Tested-by: O'Griofa, Conall <conall.ogriofa(a)amd.com> Link: https://lore.kernel.org/r/20230915001019.2862964-2-robert.hancock@calian.com Cc: <Stable(a)vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> diff --git a/drivers/iio/adc/xilinx-xadc-core.c b/drivers/iio/adc/xilinx-xadc-core.c index dba73300f894..d4d0d184a172 100644 --- a/drivers/iio/adc/xilinx-xadc-core.c +++ b/drivers/iio/adc/xilinx-xadc-core.c @@ -1423,28 +1423,6 @@ static int xadc_probe(struct platform_device *pdev) if (ret) return ret; - /* Disable all alarms */ - ret = xadc_update_adc_reg(xadc, XADC_REG_CONF1, XADC_CONF1_ALARM_MASK, - XADC_CONF1_ALARM_MASK); - if (ret) - return ret; - - /* Set thresholds to min/max */ - for (i = 0; i < 16; i++) { - /* - * Set max voltage threshold and both temperature thresholds to - * 0xffff, min voltage threshold to 0. - */ - if (i % 8 < 4 || i == 7) - xadc->threshold[i] = 0xffff; - else - xadc->threshold[i] = 0; - ret = xadc_write_adc_reg(xadc, XADC_REG_THRESHOLD(i), - xadc->threshold[i]); - if (ret) - return ret; - } - /* Go to non-buffered mode */ xadc_postdisable(indio_dev);

2 years

1
0
0 0

FAILED: patch "[PATCH] iio: adc: xilinx-xadc: Don't clobber preset" failed to apply to 5.4-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.4-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.4.y git checkout FETCH_HEAD git cherry-pick -x 8d6b3ea4d9eaca80982442b68a292ce50ce0a135 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023102952-gave-matted-ec92@gregkh' --subject-prefix 'PATCH 5.4.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 8d6b3ea4d9eaca80982442b68a292ce50ce0a135 Mon Sep 17 00:00:00 2001 From: Robert Hancock <robert.hancock(a)calian.com> Date: Thu, 14 Sep 2023 18:10:18 -0600 Subject: [PATCH] iio: adc: xilinx-xadc: Don't clobber preset voltage/temperature thresholds In the probe function, the driver was reading out the thresholds already set in the core, which can be configured by the user in the Vivado tools when the FPGA image is built. However, it later clobbered those values with zero or maximum values. In particular, the overtemperature shutdown threshold register was overwritten with the max value, which effectively prevents the FPGA from shutting down when the desired threshold was eached, potentially risking hardware damage in that case. Remove this code to leave the preconfigured default threshold values intact. The code was also disabling all alarms regardless of what enable state they were left in by the FPGA image, including the overtemperature shutdown feature. Leave these bits in their original state so they are not unconditionally disabled. Fixes: bdc8cda1d010 ("iio:adc: Add Xilinx XADC driver") Signed-off-by: Robert Hancock <robert.hancock(a)calian.com> Acked-by: O'Griofa, Conall <conall.ogriofa(a)amd.com> Tested-by: O'Griofa, Conall <conall.ogriofa(a)amd.com> Link: https://lore.kernel.org/r/20230915001019.2862964-2-robert.hancock@calian.com Cc: <Stable(a)vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> diff --git a/drivers/iio/adc/xilinx-xadc-core.c b/drivers/iio/adc/xilinx-xadc-core.c index dba73300f894..d4d0d184a172 100644 --- a/drivers/iio/adc/xilinx-xadc-core.c +++ b/drivers/iio/adc/xilinx-xadc-core.c @@ -1423,28 +1423,6 @@ static int xadc_probe(struct platform_device *pdev) if (ret) return ret; - /* Disable all alarms */ - ret = xadc_update_adc_reg(xadc, XADC_REG_CONF1, XADC_CONF1_ALARM_MASK, - XADC_CONF1_ALARM_MASK); - if (ret) - return ret; - - /* Set thresholds to min/max */ - for (i = 0; i < 16; i++) { - /* - * Set max voltage threshold and both temperature thresholds to - * 0xffff, min voltage threshold to 0. - */ - if (i % 8 < 4 || i == 7) - xadc->threshold[i] = 0xffff; - else - xadc->threshold[i] = 0; - ret = xadc_write_adc_reg(xadc, XADC_REG_THRESHOLD(i), - xadc->threshold[i]); - if (ret) - return ret; - } - /* Go to non-buffered mode */ xadc_postdisable(indio_dev);

2 years

1
0
0 0

FAILED: patch "[PATCH] iio: adc: xilinx-xadc: Don't clobber preset" failed to apply to 5.10-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y git checkout FETCH_HEAD git cherry-pick -x 8d6b3ea4d9eaca80982442b68a292ce50ce0a135 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023102951-rubble-matriarch-f7e8@gregkh' --subject-prefix 'PATCH 5.10.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 8d6b3ea4d9eaca80982442b68a292ce50ce0a135 Mon Sep 17 00:00:00 2001 From: Robert Hancock <robert.hancock(a)calian.com> Date: Thu, 14 Sep 2023 18:10:18 -0600 Subject: [PATCH] iio: adc: xilinx-xadc: Don't clobber preset voltage/temperature thresholds In the probe function, the driver was reading out the thresholds already set in the core, which can be configured by the user in the Vivado tools when the FPGA image is built. However, it later clobbered those values with zero or maximum values. In particular, the overtemperature shutdown threshold register was overwritten with the max value, which effectively prevents the FPGA from shutting down when the desired threshold was eached, potentially risking hardware damage in that case. Remove this code to leave the preconfigured default threshold values intact. The code was also disabling all alarms regardless of what enable state they were left in by the FPGA image, including the overtemperature shutdown feature. Leave these bits in their original state so they are not unconditionally disabled. Fixes: bdc8cda1d010 ("iio:adc: Add Xilinx XADC driver") Signed-off-by: Robert Hancock <robert.hancock(a)calian.com> Acked-by: O'Griofa, Conall <conall.ogriofa(a)amd.com> Tested-by: O'Griofa, Conall <conall.ogriofa(a)amd.com> Link: https://lore.kernel.org/r/20230915001019.2862964-2-robert.hancock@calian.com Cc: <Stable(a)vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> diff --git a/drivers/iio/adc/xilinx-xadc-core.c b/drivers/iio/adc/xilinx-xadc-core.c index dba73300f894..d4d0d184a172 100644 --- a/drivers/iio/adc/xilinx-xadc-core.c +++ b/drivers/iio/adc/xilinx-xadc-core.c @@ -1423,28 +1423,6 @@ static int xadc_probe(struct platform_device *pdev) if (ret) return ret; - /* Disable all alarms */ - ret = xadc_update_adc_reg(xadc, XADC_REG_CONF1, XADC_CONF1_ALARM_MASK, - XADC_CONF1_ALARM_MASK); - if (ret) - return ret; - - /* Set thresholds to min/max */ - for (i = 0; i < 16; i++) { - /* - * Set max voltage threshold and both temperature thresholds to - * 0xffff, min voltage threshold to 0. - */ - if (i % 8 < 4 || i == 7) - xadc->threshold[i] = 0xffff; - else - xadc->threshold[i] = 0; - ret = xadc_write_adc_reg(xadc, XADC_REG_THRESHOLD(i), - xadc->threshold[i]); - if (ret) - return ret; - } - /* Go to non-buffered mode */ xadc_postdisable(indio_dev);

2 years

1
0
0 0

FAILED: patch "[PATCH] iio: exynos-adc: request second interupt only when" failed to apply to 4.14-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.14-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-4.14.y git checkout FETCH_HEAD git cherry-pick -x 865b080e3229102f160889328ce2e8e97aa65ea0 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023102932-enigmatic-starlet-4b1a@gregkh' --subject-prefix 'PATCH 4.14.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 865b080e3229102f160889328ce2e8e97aa65ea0 Mon Sep 17 00:00:00 2001 From: Marek Szyprowski <m.szyprowski(a)samsung.com> Date: Mon, 9 Oct 2023 12:14:12 +0200 Subject: [PATCH] iio: exynos-adc: request second interupt only when touchscreen mode is used Second interrupt is needed only when touchscreen mode is used, so don't request it unconditionally. This removes the following annoying warning during boot: exynos-adc 14d10000.adc: error -ENXIO: IRQ index 1 not found Fixes: 2bb8ad9b44c5 ("iio: exynos-adc: add experimental touchscreen support") Signed-off-by: Marek Szyprowski <m.szyprowski(a)samsung.com> Link: https://lore.kernel.org/r/20231009101412.916922-1-m.szyprowski@samsung.com Cc: <Stable(a)vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> diff --git a/drivers/iio/adc/exynos_adc.c b/drivers/iio/adc/exynos_adc.c index cff1ba57fb16..43c8af41b4a9 100644 --- a/drivers/iio/adc/exynos_adc.c +++ b/drivers/iio/adc/exynos_adc.c @@ -826,16 +826,26 @@ static int exynos_adc_probe(struct platform_device *pdev) } } + /* leave out any TS related code if unreachable */ + if (IS_REACHABLE(CONFIG_INPUT)) { + has_ts = of_property_read_bool(pdev->dev.of_node, + "has-touchscreen") || pdata; + } + irq = platform_get_irq(pdev, 0); if (irq < 0) return irq; info->irq = irq; - irq = platform_get_irq(pdev, 1); - if (irq == -EPROBE_DEFER) - return irq; + if (has_ts) { + irq = platform_get_irq(pdev, 1); + if (irq == -EPROBE_DEFER) + return irq; - info->tsirq = irq; + info->tsirq = irq; + } else { + info->tsirq = -1; + } info->dev = &pdev->dev; @@ -900,12 +910,6 @@ static int exynos_adc_probe(struct platform_device *pdev) if (info->data->init_hw) info->data->init_hw(info); - /* leave out any TS related code if unreachable */ - if (IS_REACHABLE(CONFIG_INPUT)) { - has_ts = of_property_read_bool(pdev->dev.of_node, - "has-touchscreen") || pdata; - } - if (pdata) info->delay = pdata->delay; else

2 years

1
0
0 0

FAILED: patch "[PATCH] iio: exynos-adc: request second interupt only when" failed to apply to 4.19-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.19-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-4.19.y git checkout FETCH_HEAD git cherry-pick -x 865b080e3229102f160889328ce2e8e97aa65ea0 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023102932-catatonic-decline-3ee9@gregkh' --subject-prefix 'PATCH 4.19.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 865b080e3229102f160889328ce2e8e97aa65ea0 Mon Sep 17 00:00:00 2001 From: Marek Szyprowski <m.szyprowski(a)samsung.com> Date: Mon, 9 Oct 2023 12:14:12 +0200 Subject: [PATCH] iio: exynos-adc: request second interupt only when touchscreen mode is used Second interrupt is needed only when touchscreen mode is used, so don't request it unconditionally. This removes the following annoying warning during boot: exynos-adc 14d10000.adc: error -ENXIO: IRQ index 1 not found Fixes: 2bb8ad9b44c5 ("iio: exynos-adc: add experimental touchscreen support") Signed-off-by: Marek Szyprowski <m.szyprowski(a)samsung.com> Link: https://lore.kernel.org/r/20231009101412.916922-1-m.szyprowski@samsung.com Cc: <Stable(a)vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> diff --git a/drivers/iio/adc/exynos_adc.c b/drivers/iio/adc/exynos_adc.c index cff1ba57fb16..43c8af41b4a9 100644 --- a/drivers/iio/adc/exynos_adc.c +++ b/drivers/iio/adc/exynos_adc.c @@ -826,16 +826,26 @@ static int exynos_adc_probe(struct platform_device *pdev) } } + /* leave out any TS related code if unreachable */ + if (IS_REACHABLE(CONFIG_INPUT)) { + has_ts = of_property_read_bool(pdev->dev.of_node, + "has-touchscreen") || pdata; + } + irq = platform_get_irq(pdev, 0); if (irq < 0) return irq; info->irq = irq; - irq = platform_get_irq(pdev, 1); - if (irq == -EPROBE_DEFER) - return irq; + if (has_ts) { + irq = platform_get_irq(pdev, 1); + if (irq == -EPROBE_DEFER) + return irq; - info->tsirq = irq; + info->tsirq = irq; + } else { + info->tsirq = -1; + } info->dev = &pdev->dev; @@ -900,12 +910,6 @@ static int exynos_adc_probe(struct platform_device *pdev) if (info->data->init_hw) info->data->init_hw(info); - /* leave out any TS related code if unreachable */ - if (IS_REACHABLE(CONFIG_INPUT)) { - has_ts = of_property_read_bool(pdev->dev.of_node, - "has-touchscreen") || pdata; - } - if (pdata) info->delay = pdata->delay; else

2 years

1
0
0 0

FAILED: patch "[PATCH] iio: afe: rescale: Accept only offset channels" failed to apply to 5.15-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.15-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y git checkout FETCH_HEAD git cherry-pick -x bee448390e5166d019e9e037194d487ee94399d9 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023102913-mutate-envelope-6e98@gregkh' --subject-prefix 'PATCH 5.15.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From bee448390e5166d019e9e037194d487ee94399d9 Mon Sep 17 00:00:00 2001 From: Linus Walleij <linus.walleij(a)linaro.org> Date: Sat, 2 Sep 2023 21:46:20 +0200 Subject: [PATCH] iio: afe: rescale: Accept only offset channels As noted by Jonathan Cameron: it is perfectly legal for a channel to have an offset but no scale in addition to the raw interface. The conversion will imply that scale is 1:1. Make rescale_configure_channel() accept just scale, or just offset to process a channel. When a user asks for IIO_CHAN_INFO_OFFSET in rescale_read_raw() we now have to deal with the fact that OFFSET could be present but SCALE missing. Add code to simply scale 1:1 in this case. Link: https://lore.kernel.org/linux-iio/CACRpkdZXBjHU4t-GVOCFxRO-AHGxKnxMeHD2s4Y4… Fixes: 53ebee949980 ("iio: afe: iio-rescale: Support processed channels") Fixes: 9decacd8b3a4 ("iio: afe: rescale: Fix boolean logic bug") Reported-by: Jonathan Cameron <jic23(a)kernel.org> Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> Reviewed-by: Peter Rosin <peda(a)axentia.se> Link: https://lore.kernel.org/r/20230902-iio-rescale-only-offset-v2-1-988b807754c… Cc: <Stable(a)vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> diff --git a/drivers/iio/afe/iio-rescale.c b/drivers/iio/afe/iio-rescale.c index 1f280c360701..56e5913ab82d 100644 --- a/drivers/iio/afe/iio-rescale.c +++ b/drivers/iio/afe/iio-rescale.c @@ -214,8 +214,18 @@ static int rescale_read_raw(struct iio_dev *indio_dev, return ret < 0 ? ret : -EOPNOTSUPP; } - ret = iio_read_channel_scale(rescale->source, &scale, &scale2); - return rescale_process_offset(rescale, ret, scale, scale2, + if (iio_channel_has_info(rescale->source->channel, + IIO_CHAN_INFO_SCALE)) { + ret = iio_read_channel_scale(rescale->source, &scale, &scale2); + return rescale_process_offset(rescale, ret, scale, scale2, + schan_off, val, val2); + } + + /* + * If we get here we have no scale so scale 1:1 but apply + * rescaler and offset, if any. + */ + return rescale_process_offset(rescale, IIO_VAL_FRACTIONAL, 1, 1, schan_off, val, val2); default: return -EINVAL; @@ -280,8 +290,9 @@ static int rescale_configure_channel(struct device *dev, chan->type = rescale->cfg->type; if (iio_channel_has_info(schan, IIO_CHAN_INFO_RAW) && - iio_channel_has_info(schan, IIO_CHAN_INFO_SCALE)) { - dev_info(dev, "using raw+scale source channel\n"); + (iio_channel_has_info(schan, IIO_CHAN_INFO_SCALE) || + iio_channel_has_info(schan, IIO_CHAN_INFO_OFFSET))) { + dev_info(dev, "using raw+scale/offset source channel\n"); } else if (iio_channel_has_info(schan, IIO_CHAN_INFO_PROCESSED)) { dev_info(dev, "using processed channel\n"); rescale->chan_processed = true;

2 years

1
0
0 0

[PATCH 1/2] mm/damon/sysfs: remove requested targets when online-commit inputs

by SeongJae Park

damon_sysfs_set_targets(), which updates the targets of the context for online commitment, do not remove targets that removed from the corresponding sysfs files. As a result, more than intended targets of the context can exist and hence consume memory and monitoring CPU resource more than expected. Fix it by removing all targets of the context and fill up again using the user input. This could cause unnecessary memory dealloc and realloc operations, but this is not a hot code path. Also, note that damon_target is stateless, and hence no data is lost. Fixes: da87878010e5 ("mm/damon/sysfs: support online inputs update") Cc: <stable(a)vger.kernel.org> # 5.19.x Signed-off-by: SeongJae Park <sj(a)kernel.org> --- mm/damon/sysfs.c | 50 +++++++++--------------------------------------- 1 file changed, 9 insertions(+), 41 deletions(-) diff --git a/mm/damon/sysfs.c b/mm/damon/sysfs.c index f73dc88d2d19..5268e8503722 100644 --- a/mm/damon/sysfs.c +++ b/mm/damon/sysfs.c @@ -1150,58 +1150,26 @@ static int damon_sysfs_add_target(struct damon_sysfs_target *sys_target, return err; } -/* - * Search a target in a context that corresponds to the sysfs target input. - * - * Return: pointer to the target if found, NULL if not found, or negative - * error code if the search failed. - */ -static struct damon_target *damon_sysfs_existing_target( - struct damon_sysfs_target *sys_target, struct damon_ctx *ctx) -{ - struct pid *pid; - struct damon_target *t; - - if (!damon_target_has_pid(ctx)) { - /* Up to only one target for paddr could exist */ - damon_for_each_target(t, ctx) - return t; - return NULL; - } - - /* ops.id should be DAMON_OPS_VADDR or DAMON_OPS_FVADDR */ - pid = find_get_pid(sys_target->pid); - if (!pid) - return ERR_PTR(-EINVAL); - damon_for_each_target(t, ctx) { - if (t->pid == pid) { - put_pid(pid); - return t; - } - } - put_pid(pid); - return NULL; -} - static int damon_sysfs_set_targets(struct damon_ctx *ctx, struct damon_sysfs_targets *sysfs_targets) { + struct damon_target *t, *next; int i, err; /* Multiple physical address space monitoring targets makes no sense */ if (ctx->ops.id == DAMON_OPS_PADDR && sysfs_targets->nr > 1) return -EINVAL; + damon_for_each_target_safe(t, next, ctx) { + if (damon_target_has_pid(ctx)) + put_pid(t->pid); + damon_destroy_target(t); + } + for (i = 0; i < sysfs_targets->nr; i++) { struct damon_sysfs_target *st = sysfs_targets->targets_arr[i]; - struct damon_target *t = damon_sysfs_existing_target(st, ctx); - - if (IS_ERR(t)) - return PTR_ERR(t); - if (!t) - err = damon_sysfs_add_target(st, ctx); - else - err = damon_sysfs_set_regions(t, st->regions); + + err = damon_sysfs_add_target(st, ctx); if (err) return err; } -- 2.34.1

2 years

1
1
0 0

[PATCH v2] objtool/x86: add missing embedded_insn check

by John Sperbeck

When dbf460087755 ("objtool/x86: Fixup frame-pointer vs rethunk") was backported to some stable branches, the check for dest->embedded_insn in is_special_call() was missed. The result is that the warning it was intended to suppress still appears. For example on 6.1 (on kernels before 6.1, the '-s' argument would instead be 'check'): $ tools/objtool/objtool -s arch/x86/lib/retpoline.o arch/x86/lib/retpoline.o: warning: objtool: srso_untrain_ret+0xd: call without frame pointer save/setup With this patch, the warning is correctly suppressed, and the kernel still passes the normal Google kernel developer tests. Signed-off-by: John Sperbeck <jsperbeck(a)google.com> --- I think 6.1.y, 5.15.y, and 5.10.y are the LTS branches missing the bit of code that this patch re-adds. Changes from v1 to v2: * include more context in the commit message. tools/objtool/check.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/objtool/check.c b/tools/objtool/check.c index f8008ab31eef..cb363b507a32 100644 --- a/tools/objtool/check.c +++ b/tools/objtool/check.c @@ -2478,7 +2478,7 @@ static bool is_special_call(struct instruction *insn) if (!dest) return false; - if (dest->fentry) + if (dest->fentry || dest->embedded_insn) return true; } -- 2.42.0.820.g83a721a137-goog

2 years

2
1
0 0

FAILED: patch "[PATCH] io_uring/fdinfo: lock SQ thread while retrieving thread" failed to apply to 6.1-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.1-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y git checkout FETCH_HEAD git cherry-pick -x 7644b1a1c9a7ae8ab99175989bfc8676055edb46 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023102835-margarine-credibly-e8ca@gregkh' --subject-prefix 'PATCH 6.1.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 7644b1a1c9a7ae8ab99175989bfc8676055edb46 Mon Sep 17 00:00:00 2001 From: Jens Axboe <axboe(a)kernel.dk> Date: Sat, 21 Oct 2023 12:30:29 -0600 Subject: [PATCH] io_uring/fdinfo: lock SQ thread while retrieving thread cpu/pid We could race with SQ thread exit, and if we do, we'll hit a NULL pointer dereference when the thread is cleared. Grab the SQPOLL data lock before attempting to get the task cpu and pid for fdinfo, this ensures we have a stable view of it. Cc: stable(a)vger.kernel.org Link: https://bugzilla.kernel.org/show_bug.cgi?id=218032 Reviewed-by: Gabriel Krisman Bertazi <krisman(a)suse.de> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> diff --git a/io_uring/fdinfo.c b/io_uring/fdinfo.c index c53678875416..f04a43044d91 100644 --- a/io_uring/fdinfo.c +++ b/io_uring/fdinfo.c @@ -53,7 +53,6 @@ static __cold int io_uring_show_cred(struct seq_file *m, unsigned int id, __cold void io_uring_show_fdinfo(struct seq_file *m, struct file *f) { struct io_ring_ctx *ctx = f->private_data; - struct io_sq_data *sq = NULL; struct io_overflow_cqe *ocqe; struct io_rings *r = ctx->rings; unsigned int sq_mask = ctx->sq_entries - 1, cq_mask = ctx->cq_entries - 1; @@ -64,6 +63,7 @@ __cold void io_uring_show_fdinfo(struct seq_file *m, struct file *f) unsigned int cq_shift = 0; unsigned int sq_shift = 0; unsigned int sq_entries, cq_entries; + int sq_pid = -1, sq_cpu = -1; bool has_lock; unsigned int i; @@ -143,13 +143,19 @@ __cold void io_uring_show_fdinfo(struct seq_file *m, struct file *f) has_lock = mutex_trylock(&ctx->uring_lock); if (has_lock && (ctx->flags & IORING_SETUP_SQPOLL)) { - sq = ctx->sq_data; - if (!sq->thread) - sq = NULL; + struct io_sq_data *sq = ctx->sq_data; + + if (mutex_trylock(&sq->lock)) { + if (sq->thread) { + sq_pid = task_pid_nr(sq->thread); + sq_cpu = task_cpu(sq->thread); + } + mutex_unlock(&sq->lock); + } } - seq_printf(m, "SqThread:\t%d\n", sq ? task_pid_nr(sq->thread) : -1); - seq_printf(m, "SqThreadCpu:\t%d\n", sq ? task_cpu(sq->thread) : -1); + seq_printf(m, "SqThread:\t%d\n", sq_pid); + seq_printf(m, "SqThreadCpu:\t%d\n", sq_cpu); seq_printf(m, "UserFiles:\t%u\n", ctx->nr_user_files); for (i = 0; has_lock && i < ctx->nr_user_files; i++) { struct file *f = io_file_from_index(&ctx->file_table, i);

2 years

3
2
0 0

[PATCH] x86/sgx: Return VM_FAULT_SIGBUS for EPC exhaustion

by Haitao Huang

In the EAUG on page fault path, VM_FAULT_OOM is returned when the Enclave Page Cache (EPC) runs out. This may trigger unneeded OOM kill that will not free any EPCs. Return VM_FAULT_SIGBUS instead. Fixes: 5a90d2c3f5ef ("x86/sgx: Support adding of pages to an initialized enclave") Cc: stable(a)vger.kernel.org # v6.0+ Signed-off-by: Haitao Huang <haitao.huang(a)linux.intel.com> --- arch/x86/kernel/cpu/sgx/encl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/x86/kernel/cpu/sgx/encl.c b/arch/x86/kernel/cpu/sgx/encl.c index 279148e72459..d13b7e4ad0f5 100644 --- a/arch/x86/kernel/cpu/sgx/encl.c +++ b/arch/x86/kernel/cpu/sgx/encl.c @@ -322,7 +322,7 @@ struct sgx_encl_page *sgx_encl_load_page(struct sgx_encl *encl, * ENCLS[EAUG] instruction. * * Returns: Appropriate vm_fault_t: VM_FAULT_NOPAGE when PTE was installed - * successfully, VM_FAULT_SIGBUS or VM_FAULT_OOM as error otherwise. + * successfully, VM_FAULT_SIGBUS as error otherwise. */ static vm_fault_t sgx_encl_eaug_page(struct vm_area_struct *vma, struct sgx_encl *encl, unsigned long addr) @@ -348,7 +348,7 @@ static vm_fault_t sgx_encl_eaug_page(struct vm_area_struct *vma, secinfo_flags = SGX_SECINFO_R | SGX_SECINFO_W | SGX_SECINFO_X; encl_page = sgx_encl_page_alloc(encl, addr - encl->base, secinfo_flags); if (IS_ERR(encl_page)) - return VM_FAULT_OOM; + return VM_FAULT_SIGBUS; mutex_lock(&encl->lock); -- 2.25.1

2 years

6
8
0 0

FAILED: patch "[PATCH] io_uring/fdinfo: lock SQ thread while retrieving thread" failed to apply to 6.5-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.5-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.5.y git checkout FETCH_HEAD git cherry-pick -x 7644b1a1c9a7ae8ab99175989bfc8676055edb46 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023102836-rebel-rigor-f5e9@gregkh' --subject-prefix 'PATCH 6.5.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 7644b1a1c9a7ae8ab99175989bfc8676055edb46 Mon Sep 17 00:00:00 2001 From: Jens Axboe <axboe(a)kernel.dk> Date: Sat, 21 Oct 2023 12:30:29 -0600 Subject: [PATCH] io_uring/fdinfo: lock SQ thread while retrieving thread cpu/pid We could race with SQ thread exit, and if we do, we'll hit a NULL pointer dereference when the thread is cleared. Grab the SQPOLL data lock before attempting to get the task cpu and pid for fdinfo, this ensures we have a stable view of it. Cc: stable(a)vger.kernel.org Link: https://bugzilla.kernel.org/show_bug.cgi?id=218032 Reviewed-by: Gabriel Krisman Bertazi <krisman(a)suse.de> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> diff --git a/io_uring/fdinfo.c b/io_uring/fdinfo.c index c53678875416..f04a43044d91 100644 --- a/io_uring/fdinfo.c +++ b/io_uring/fdinfo.c @@ -53,7 +53,6 @@ static __cold int io_uring_show_cred(struct seq_file *m, unsigned int id, __cold void io_uring_show_fdinfo(struct seq_file *m, struct file *f) { struct io_ring_ctx *ctx = f->private_data; - struct io_sq_data *sq = NULL; struct io_overflow_cqe *ocqe; struct io_rings *r = ctx->rings; unsigned int sq_mask = ctx->sq_entries - 1, cq_mask = ctx->cq_entries - 1; @@ -64,6 +63,7 @@ __cold void io_uring_show_fdinfo(struct seq_file *m, struct file *f) unsigned int cq_shift = 0; unsigned int sq_shift = 0; unsigned int sq_entries, cq_entries; + int sq_pid = -1, sq_cpu = -1; bool has_lock; unsigned int i; @@ -143,13 +143,19 @@ __cold void io_uring_show_fdinfo(struct seq_file *m, struct file *f) has_lock = mutex_trylock(&ctx->uring_lock); if (has_lock && (ctx->flags & IORING_SETUP_SQPOLL)) { - sq = ctx->sq_data; - if (!sq->thread) - sq = NULL; + struct io_sq_data *sq = ctx->sq_data; + + if (mutex_trylock(&sq->lock)) { + if (sq->thread) { + sq_pid = task_pid_nr(sq->thread); + sq_cpu = task_cpu(sq->thread); + } + mutex_unlock(&sq->lock); + } } - seq_printf(m, "SqThread:\t%d\n", sq ? task_pid_nr(sq->thread) : -1); - seq_printf(m, "SqThreadCpu:\t%d\n", sq ? task_cpu(sq->thread) : -1); + seq_printf(m, "SqThread:\t%d\n", sq_pid); + seq_printf(m, "SqThreadCpu:\t%d\n", sq_cpu); seq_printf(m, "UserFiles:\t%u\n", ctx->nr_user_files); for (i = 0; has_lock && i < ctx->nr_user_files; i++) { struct file *f = io_file_from_index(&ctx->file_table, i);

2 years

1
0
0 0

[PATCH 5.4 1/3] ext4: add two helper functions extent_logical_end() and pa_logical_end()

by Baokun Li

commit 43bbddc067883d94de7a43d5756a295439fbe37d upstream. When we use lstart + len to calculate the end of free extent or prealloc space, it may exceed the maximum value of 4294967295(0xffffffff) supported by ext4_lblk_t and cause overflow, which may lead to various problems. Therefore, we add two helper functions, extent_logical_end() and pa_logical_end(), to limit the type of end to loff_t, and also convert lstart to loff_t for calculation to avoid overflow. Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> Link: https://lore.kernel.org/r/20230724121059.11834-2-libaokun1@huawei.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Conflicts: fs/ext4/mballoc.c Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/ext4/mballoc.c | 7 +++---- fs/ext4/mballoc.h | 14 ++++++++++++++ 2 files changed, 17 insertions(+), 4 deletions(-) diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c index 9099e112fda5..e07420c6ddee 100644 --- a/fs/ext4/mballoc.c +++ b/fs/ext4/mballoc.c @@ -3124,7 +3124,7 @@ ext4_mb_normalize_request(struct ext4_allocation_context *ac, /* first, let's learn actual file size * given current request is allocated */ - size = ac->ac_o_ex.fe_logical + EXT4_C2B(sbi, ac->ac_o_ex.fe_len); + size = extent_logical_end(sbi, &ac->ac_o_ex); size = size << bsbits; if (size < i_size_read(ac->ac_inode)) size = i_size_read(ac->ac_inode); @@ -3462,8 +3462,7 @@ ext4_mb_use_preallocated(struct ext4_allocation_context *ac) /* all fields in this condition don't change, * so we can skip locking for them */ if (ac->ac_o_ex.fe_logical < pa->pa_lstart || - ac->ac_o_ex.fe_logical >= (pa->pa_lstart + - EXT4_C2B(sbi, pa->pa_len))) + ac->ac_o_ex.fe_logical >= pa_logical_end(sbi, pa)) continue; /* non-extent files can't have physical blocks past 2^32 */ @@ -4234,7 +4233,7 @@ static void ext4_mb_group_or_file(struct ext4_allocation_context *ac) if (unlikely(ac->ac_flags & EXT4_MB_HINT_GOAL_ONLY)) return; - size = ac->ac_o_ex.fe_logical + EXT4_C2B(sbi, ac->ac_o_ex.fe_len); + size = extent_logical_end(sbi, &ac->ac_o_ex); isize = (i_size_read(ac->ac_inode) + ac->ac_sb->s_blocksize - 1) >> bsbits; diff --git a/fs/ext4/mballoc.h b/fs/ext4/mballoc.h index 88c98f17e3d9..4e442bad6d73 100644 --- a/fs/ext4/mballoc.h +++ b/fs/ext4/mballoc.h @@ -199,6 +199,20 @@ static inline ext4_fsblk_t ext4_grp_offs_to_block(struct super_block *sb, (fex->fe_start << EXT4_SB(sb)->s_cluster_bits); } +static inline loff_t extent_logical_end(struct ext4_sb_info *sbi, + struct ext4_free_extent *fex) +{ + /* Use loff_t to avoid end exceeding ext4_lblk_t max. */ + return (loff_t)fex->fe_logical + EXT4_C2B(sbi, fex->fe_len); +} + +static inline loff_t pa_logical_end(struct ext4_sb_info *sbi, + struct ext4_prealloc_space *pa) +{ + /* Use loff_t to avoid end exceeding ext4_lblk_t max. */ + return (loff_t)pa->pa_lstart + EXT4_C2B(sbi, pa->pa_len); +} + typedef int (*ext4_mballoc_query_range_fn)( struct super_block *sb, ext4_group_t agno, -- 2.31.1

2 years

1
2
0 0

[PATCH 5.10 1/3] ext4: add two helper functions extent_logical_end() and pa_logical_end()

by Baokun Li

commit 43bbddc067883d94de7a43d5756a295439fbe37d upstream. When we use lstart + len to calculate the end of free extent or prealloc space, it may exceed the maximum value of 4294967295(0xffffffff) supported by ext4_lblk_t and cause overflow, which may lead to various problems. Therefore, we add two helper functions, extent_logical_end() and pa_logical_end(), to limit the type of end to loff_t, and also convert lstart to loff_t for calculation to avoid overflow. Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> Link: https://lore.kernel.org/r/20230724121059.11834-2-libaokun1@huawei.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Conflicts: fs/ext4/mballoc.c Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/ext4/mballoc.c | 7 +++---- fs/ext4/mballoc.h | 14 ++++++++++++++ 2 files changed, 17 insertions(+), 4 deletions(-) diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c index b35d59d41c89..b994561f3f28 100644 --- a/fs/ext4/mballoc.c +++ b/fs/ext4/mballoc.c @@ -3545,7 +3545,7 @@ ext4_mb_normalize_request(struct ext4_allocation_context *ac, /* first, let's learn actual file size * given current request is allocated */ - size = ac->ac_o_ex.fe_logical + EXT4_C2B(sbi, ac->ac_o_ex.fe_len); + size = extent_logical_end(sbi, &ac->ac_o_ex); size = size << bsbits; if (size < i_size_read(ac->ac_inode)) size = i_size_read(ac->ac_inode); @@ -3885,8 +3885,7 @@ ext4_mb_use_preallocated(struct ext4_allocation_context *ac) /* all fields in this condition don't change, * so we can skip locking for them */ if (ac->ac_o_ex.fe_logical < pa->pa_lstart || - ac->ac_o_ex.fe_logical >= (pa->pa_lstart + - EXT4_C2B(sbi, pa->pa_len))) + ac->ac_o_ex.fe_logical >= pa_logical_end(sbi, pa)) continue; /* non-extent files can't have physical blocks past 2^32 */ @@ -4704,7 +4703,7 @@ static void ext4_mb_group_or_file(struct ext4_allocation_context *ac) if (unlikely(ac->ac_flags & EXT4_MB_HINT_GOAL_ONLY)) return; - size = ac->ac_o_ex.fe_logical + EXT4_C2B(sbi, ac->ac_o_ex.fe_len); + size = extent_logical_end(sbi, &ac->ac_o_ex); isize = (i_size_read(ac->ac_inode) + ac->ac_sb->s_blocksize - 1) >> bsbits; diff --git a/fs/ext4/mballoc.h b/fs/ext4/mballoc.h index 7be6288e48ec..1e9c402189cb 100644 --- a/fs/ext4/mballoc.h +++ b/fs/ext4/mballoc.h @@ -199,6 +199,20 @@ static inline ext4_fsblk_t ext4_grp_offs_to_block(struct super_block *sb, (fex->fe_start << EXT4_SB(sb)->s_cluster_bits); } +static inline loff_t extent_logical_end(struct ext4_sb_info *sbi, + struct ext4_free_extent *fex) +{ + /* Use loff_t to avoid end exceeding ext4_lblk_t max. */ + return (loff_t)fex->fe_logical + EXT4_C2B(sbi, fex->fe_len); +} + +static inline loff_t pa_logical_end(struct ext4_sb_info *sbi, + struct ext4_prealloc_space *pa) +{ + /* Use loff_t to avoid end exceeding ext4_lblk_t max. */ + return (loff_t)pa->pa_lstart + EXT4_C2B(sbi, pa->pa_len); +} + typedef int (*ext4_mballoc_query_range_fn)( struct super_block *sb, ext4_group_t agno, -- 2.31.1

2 years

1
2
0 0

FAILED: patch "[PATCH] nfsd: lock_rename() needs both directories to live on the" failed to apply to 4.14-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.14-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-4.14.y git checkout FETCH_HEAD git cherry-pick -x 1aee9158bc978f91701c5992e395efbc6da2de3c # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023102703-naming-synthetic-7515@gregkh' --subject-prefix 'PATCH 4.14.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 1aee9158bc978f91701c5992e395efbc6da2de3c Mon Sep 17 00:00:00 2001 From: Al Viro <viro(a)zeniv.linux.org.uk> Date: Sat, 14 Oct 2023 21:34:40 -0400 Subject: [PATCH] nfsd: lock_rename() needs both directories to live on the same fs ... checking that after lock_rename() is too late. Incidentally, NFSv2 had no nfserr_xdev... Fixes: aa387d6ce153 "nfsd: fix EXDEV checking in rename" Cc: stable(a)vger.kernel.org # v3.9+ Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Acked-by: Chuck Lever <chuck.lever(a)oracle.com> Tested-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Al Viro <viro(a)zeniv.linux.org.uk> diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c index 48260cf68fde..02f5fcaad03f 100644 --- a/fs/nfsd/vfs.c +++ b/fs/nfsd/vfs.c @@ -1788,6 +1788,12 @@ nfsd_rename(struct svc_rqst *rqstp, struct svc_fh *ffhp, char *fname, int flen, if (!flen || isdotent(fname, flen) || !tlen || isdotent(tname, tlen)) goto out; + err = (rqstp->rq_vers == 2) ? nfserr_acces : nfserr_xdev; + if (ffhp->fh_export->ex_path.mnt != tfhp->fh_export->ex_path.mnt) + goto out; + if (ffhp->fh_export->ex_path.dentry != tfhp->fh_export->ex_path.dentry) + goto out; + retry: host_err = fh_want_write(ffhp); if (host_err) { @@ -1823,12 +1829,6 @@ nfsd_rename(struct svc_rqst *rqstp, struct svc_fh *ffhp, char *fname, int flen, if (ndentry == trap) goto out_dput_new; - host_err = -EXDEV; - if (ffhp->fh_export->ex_path.mnt != tfhp->fh_export->ex_path.mnt) - goto out_dput_new; - if (ffhp->fh_export->ex_path.dentry != tfhp->fh_export->ex_path.dentry) - goto out_dput_new; - if ((ndentry->d_sb->s_export_op->flags & EXPORT_OP_CLOSE_BEFORE_UNLINK) && nfsd_has_cached_files(ndentry)) { close_cached = true;

2 years

2
1
0 0

FAILED: patch "[PATCH] nfsd: lock_rename() needs both directories to live on the" failed to apply to 4.19-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.19-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-4.19.y git checkout FETCH_HEAD git cherry-pick -x 1aee9158bc978f91701c5992e395efbc6da2de3c # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023102702-equation-convene-7bce@gregkh' --subject-prefix 'PATCH 4.19.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 1aee9158bc978f91701c5992e395efbc6da2de3c Mon Sep 17 00:00:00 2001 From: Al Viro <viro(a)zeniv.linux.org.uk> Date: Sat, 14 Oct 2023 21:34:40 -0400 Subject: [PATCH] nfsd: lock_rename() needs both directories to live on the same fs ... checking that after lock_rename() is too late. Incidentally, NFSv2 had no nfserr_xdev... Fixes: aa387d6ce153 "nfsd: fix EXDEV checking in rename" Cc: stable(a)vger.kernel.org # v3.9+ Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Acked-by: Chuck Lever <chuck.lever(a)oracle.com> Tested-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Al Viro <viro(a)zeniv.linux.org.uk> diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c index 48260cf68fde..02f5fcaad03f 100644 --- a/fs/nfsd/vfs.c +++ b/fs/nfsd/vfs.c @@ -1788,6 +1788,12 @@ nfsd_rename(struct svc_rqst *rqstp, struct svc_fh *ffhp, char *fname, int flen, if (!flen || isdotent(fname, flen) || !tlen || isdotent(tname, tlen)) goto out; + err = (rqstp->rq_vers == 2) ? nfserr_acces : nfserr_xdev; + if (ffhp->fh_export->ex_path.mnt != tfhp->fh_export->ex_path.mnt) + goto out; + if (ffhp->fh_export->ex_path.dentry != tfhp->fh_export->ex_path.dentry) + goto out; + retry: host_err = fh_want_write(ffhp); if (host_err) { @@ -1823,12 +1829,6 @@ nfsd_rename(struct svc_rqst *rqstp, struct svc_fh *ffhp, char *fname, int flen, if (ndentry == trap) goto out_dput_new; - host_err = -EXDEV; - if (ffhp->fh_export->ex_path.mnt != tfhp->fh_export->ex_path.mnt) - goto out_dput_new; - if (ffhp->fh_export->ex_path.dentry != tfhp->fh_export->ex_path.dentry) - goto out_dput_new; - if ((ndentry->d_sb->s_export_op->flags & EXPORT_OP_CLOSE_BEFORE_UNLINK) && nfsd_has_cached_files(ndentry)) { close_cached = true;

2 years

2
1
0 0

[tip: x86/urgent] x86/tsc: Defer marking TSC unstable to a worker

by tip-bot2 for Thomas Gleixner

The following commit has been merged into the x86/urgent branch of tip: Commit-ID: bd94d86f490b70c58b3fc5739328a53ad4b18d86 Gitweb: https://git.kernel.org/tip/bd94d86f490b70c58b3fc5739328a53ad4b18d86 Author: Thomas Gleixner <tglx(a)linutronix.de> AuthorDate: Wed, 25 Oct 2023 23:31:35 +02:00 Committer: Thomas Gleixner <tglx(a)linutronix.de> CommitterDate: Fri, 27 Oct 2023 20:36:57 +02:00 x86/tsc: Defer marking TSC unstable to a worker Tetsuo reported the following lockdep splat when the TSC synchronization fails during CPU hotplug: tsc: Marking TSC unstable due to check_tsc_sync_source failed WARNING: inconsistent lock state inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage. ffffffff8cfa1c78 (watchdog_lock){?.-.}-{2:2}, at: clocksource_watchdog+0x23/0x5a0 {IN-HARDIRQ-W} state was registered at: _raw_spin_lock_irqsave+0x3f/0x60 clocksource_mark_unstable+0x1b/0x90 mark_tsc_unstable+0x41/0x50 check_tsc_sync_source+0x14f/0x180 sysvec_call_function_single+0x69/0x90 Possible unsafe locking scenario: lock(watchdog_lock); <Interrupt> lock(watchdog_lock); stack backtrace: _raw_spin_lock+0x30/0x40 clocksource_watchdog+0x23/0x5a0 run_timer_softirq+0x2a/0x50 sysvec_apic_timer_interrupt+0x6e/0x90 The reason is the recent conversion of the TSC synchronization function during CPU hotplug on the control CPU to a SMP function call. In case that the synchronization with the upcoming CPU fails, the TSC has to be marked unstable via clocksource_mark_unstable(). clocksource_mark_unstable() acquires 'watchdog_lock', but that lock is taken with interrupts enabled in the watchdog timer callback to minimize interrupt disabled time. That's obviously a possible deadlock scenario, Before that change the synchronization function was invoked in thread context so this could not happen. As it is not crucical whether the unstable marking happens slightly delayed, defer the call to a worker thread which avoids the lock context problem. Fixes: 9d349d47f0e3 ("x86/smpboot: Make TSC synchronization function call based") Reported-by: Tetsuo Handa <penguin-kernel(a)i-love.sakura.ne.jp> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Tested-by: Tetsuo Handa <penguin-kernel(a)i-love.sakura.ne.jp> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/87zg064ceg.ffs@tglx --- arch/x86/kernel/tsc_sync.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/arch/x86/kernel/tsc_sync.c b/arch/x86/kernel/tsc_sync.c index bbc440c..1123ef3 100644 --- a/arch/x86/kernel/tsc_sync.c +++ b/arch/x86/kernel/tsc_sync.c @@ -15,6 +15,7 @@ * ( The serial nature of the boot logic and the CPU hotplug lock * protects against more than 2 CPUs entering this code. ) */ +#include <linux/workqueue.h> #include <linux/topology.h> #include <linux/spinlock.h> #include <linux/kernel.h> @@ -342,6 +343,13 @@ static inline unsigned int loop_timeout(int cpu) return (cpumask_weight(topology_core_cpumask(cpu)) > 1) ? 2 : 20; } +static void tsc_sync_mark_tsc_unstable(struct work_struct *work) +{ + mark_tsc_unstable("check_tsc_sync_source failed"); +} + +static DECLARE_WORK(tsc_sync_work, tsc_sync_mark_tsc_unstable); + /* * The freshly booted CPU initiates this via an async SMP function call. */ @@ -395,7 +403,7 @@ retry: "turning off TSC clock.\n", max_warp); if (random_warps) pr_warn("TSC warped randomly between CPUs\n"); - mark_tsc_unstable("check_tsc_sync_source failed"); + schedule_work(&tsc_sync_work); } /*

2 years

1
0
0 0

[tip: x86/urgent] x86/i8259: Skip probing when ACPI/MADT advertises PCAT compatibility

by tip-bot2 for Thomas Gleixner

The following commit has been merged into the x86/urgent branch of tip: Commit-ID: 128b0c9781c9f2651bea163cb85e52a6c7be0f9e Gitweb: https://git.kernel.org/tip/128b0c9781c9f2651bea163cb85e52a6c7be0f9e Author: Thomas Gleixner <tglx(a)linutronix.de> AuthorDate: Wed, 25 Oct 2023 23:04:15 +02:00 Committer: Thomas Gleixner <tglx(a)linutronix.de> CommitterDate: Fri, 27 Oct 2023 20:36:49 +02:00 x86/i8259: Skip probing when ACPI/MADT advertises PCAT compatibility David and a few others reported that on certain newer systems some legacy interrupts fail to work correctly. Debugging revealed that the BIOS of these systems leaves the legacy PIC in uninitialized state which makes the PIC detection fail and the kernel switches to a dummy implementation. Unfortunately this fallback causes quite some code to fail as it depends on checks for the number of legacy PIC interrupts or the availability of the real PIC. In theory there is no reason to use the PIC on any modern system when IO/APIC is available, but the dependencies on the related checks cannot be resolved trivially and on short notice. This needs lots of analysis and rework. The PIC detection has been added to avoid quirky checks and force selection of the dummy implementation all over the place, especially in VM guest scenarios. So it's not an option to revert the relevant commit as that would break a lot of other scenarios. One solution would be to try to initialize the PIC on detection fail and retry the detection, but that puts the burden on everything which does not have a PIC. Fortunately the ACPI/MADT table header has a flag field, which advertises in bit 0 that the system is PCAT compatible, which means it has a legacy 8259 PIC. Evaluate that bit and if set avoid the detection routine and keep the real PIC installed, which then gets initialized (for nothing) and makes the rest of the code with all the dependencies work again. Fixes: e179f6914152 ("x86, irq, pic: Probe for legacy PIC and set legacy_pic appropriately") Reported-by: David Lazar <dlazar(a)gmail.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Tested-by: David Lazar <dlazar(a)gmail.com> Reviewed-by: Hans de Goede <hdegoede(a)redhat.com> Reviewed-by: Mario Limonciello <mario.limonciello(a)amd.com> Cc: stable(a)vger.kernel.org Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218003 Link: https://lore.kernel.org/r/875y2u5s8g.ffs@tglx --- arch/x86/include/asm/i8259.h | 2 ++- arch/x86/kernel/acpi/boot.c | 3 +++- arch/x86/kernel/i8259.c | 38 +++++++++++++++++++++++++++-------- 3 files changed, 35 insertions(+), 8 deletions(-) diff --git a/arch/x86/include/asm/i8259.h b/arch/x86/include/asm/i8259.h index 637fa1d..c715097 100644 --- a/arch/x86/include/asm/i8259.h +++ b/arch/x86/include/asm/i8259.h @@ -69,6 +69,8 @@ struct legacy_pic { void (*make_irq)(unsigned int irq); }; +void legacy_pic_pcat_compat(void); + extern struct legacy_pic *legacy_pic; extern struct legacy_pic null_legacy_pic; diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c index 2a0ea38..c55c0ef 100644 --- a/arch/x86/kernel/acpi/boot.c +++ b/arch/x86/kernel/acpi/boot.c @@ -148,6 +148,9 @@ static int __init acpi_parse_madt(struct acpi_table_header *table) pr_debug("Local APIC address 0x%08x\n", madt->address); } + if (madt->flags & ACPI_MADT_PCAT_COMPAT) + legacy_pic_pcat_compat(); + /* ACPI 6.3 and newer support the online capable bit. */ if (acpi_gbl_FADT.header.revision > 6 || (acpi_gbl_FADT.header.revision == 6 && diff --git a/arch/x86/kernel/i8259.c b/arch/x86/kernel/i8259.c index 30a5520..c20d183 100644 --- a/arch/x86/kernel/i8259.c +++ b/arch/x86/kernel/i8259.c @@ -32,6 +32,7 @@ */ static void init_8259A(int auto_eoi); +static bool pcat_compat __ro_after_init; static int i8259A_auto_eoi; DEFINE_RAW_SPINLOCK(i8259A_lock); @@ -299,15 +300,32 @@ static void unmask_8259A(void) static int probe_8259A(void) { + unsigned char new_val, probe_val = ~(1 << PIC_CASCADE_IR); unsigned long flags; - unsigned char probe_val = ~(1 << PIC_CASCADE_IR); - unsigned char new_val; + + /* + * If MADT has the PCAT_COMPAT flag set, then do not bother probing + * for the PIC. Some BIOSes leave the PIC uninitialized and probing + * fails. + * + * Right now this causes problems as quite some code depends on + * nr_legacy_irqs() > 0 or has_legacy_pic() == true. This is silly + * when the system has an IO/APIC because then PIC is not required + * at all, except for really old machines where the timer interrupt + * must be routed through the PIC. So just pretend that the PIC is + * there and let legacy_pic->init() initialize it for nothing. + * + * Alternatively this could just try to initialize the PIC and + * repeat the probe, but for cases where there is no PIC that's + * just pointless. + */ + if (pcat_compat) + return nr_legacy_irqs(); + /* - * Check to see if we have a PIC. - * Mask all except the cascade and read - * back the value we just wrote. If we don't - * have a PIC, we will read 0xff as opposed to the - * value we wrote. + * Check to see if we have a PIC. Mask all except the cascade and + * read back the value we just wrote. If we don't have a PIC, we + * will read 0xff as opposed to the value we wrote. */ raw_spin_lock_irqsave(&i8259A_lock, flags); @@ -429,5 +447,9 @@ static int __init i8259A_init_ops(void) return 0; } - device_initcall(i8259A_init_ops); + +void __init legacy_pic_pcat_compat(void) +{ + pcat_compat = true; +}

2 years

1
0
0 0

[PATCH v4] mtd: cfi_cmdset_0001: Byte swap OTP info

by Linus Walleij

Currently the offset into the device when looking for OTP bits can go outside of the address of the MTD NOR devices, and if that memory isn't readable, bad things happen on the IXP4xx (added prints that illustrate the problem before the crash): cfi_intelext_otp_walk walk OTP on chip 0 start at reg_prot_offset 0x00000100 ixp4xx_copy_from copy from 0x00000100 to 0xc880dd78 cfi_intelext_otp_walk walk OTP on chip 0 start at reg_prot_offset 0x12000000 ixp4xx_copy_from copy from 0x12000000 to 0xc880dd78 8<--- cut here --- Unable to handle kernel paging request at virtual address db000000 [db000000] *pgd=00000000 (...) This happens in this case because the IXP4xx is big endian and the 32- and 16-bit fields in the struct cfi_intelext_otpinfo are not properly byteswapped. Compare to how the code in read_pri_intelext() byteswaps the fields in struct cfi_pri_intelext. Adding a small byte swapping loop for the OTP in read_pri_intelext() and the crash goes away. The problem went unnoticed for many years until I enabled CONFIG_MTD_OTP on the IXP4xx as well, triggering the bug. Cc: stable(a)vger.kernel.org Reviewed-by: Nicolas Pitre <nico(a)fluxnic.net> Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> --- ChangeLog v3->v4: - Collected Nico's ACK. - Stalled since june! Has this been missed? ChangeLog v2->v3: - Link to v3: https://lore.kernel.org/linux-mtd/20230602204359.3493320-1-linus.walleij@li… - Move the byte swapping to a small loop in read_pri_intelext() so all bytes are swapped as we reach cfi_intelext_otp_walk(). ChangeLog v1->v2: - Drill deeper and discover a big endian compatibility issue. --- drivers/mtd/chips/cfi_cmdset_0001.c | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/drivers/mtd/chips/cfi_cmdset_0001.c b/drivers/mtd/chips/cfi_cmdset_0001.c index 11b06fefaa0e..c10693ba265b 100644 --- a/drivers/mtd/chips/cfi_cmdset_0001.c +++ b/drivers/mtd/chips/cfi_cmdset_0001.c @@ -422,9 +422,25 @@ read_pri_intelext(struct map_info *map, __u16 adr) extra_size = 0; /* Protection Register info */ - if (extp->NumProtectionFields) + if (extp->NumProtectionFields) { + struct cfi_intelext_otpinfo *otp = + (struct cfi_intelext_otpinfo *)&extp->extra[0]; + extra_size += (extp->NumProtectionFields - 1) * - sizeof(struct cfi_intelext_otpinfo); + sizeof(struct cfi_intelext_otpinfo); + + if (extp_size >= sizeof(*extp) + extra_size) { + int i; + + /* Do some byteswapping if necessary */ + for (i = 0; i < extp->NumProtectionFields - 1; i++) { + otp->ProtRegAddr = le32_to_cpu(otp->ProtRegAddr); + otp->FactGroups = le16_to_cpu(otp->FactGroups); + otp->UserGroups = le16_to_cpu(otp->UserGroups); + otp++; + } + } + } } if (extp->MinorVersion >= '1') { --- base-commit: 0bb80ecc33a8fb5a682236443c1e740d5c917d1d change-id: 20231020-mtd-otp-byteswap-7ba47316ed73 Best regards, -- Linus Walleij <linus.walleij(a)linaro.org>

2 years

2
4
0 0

[PATCH] mtd: block2mtd: Add a valid holder to blkdev_put()

by Richard Weinberger

Since commit 2736e8eeb0ccd ("block: use the holder as indication for exclusive opens") blkdev_put() requires a valid holder argument. So, do so also in block2mtd to unbreak bdev->bd_holder refcounting. Cc: Christoph Hellwig <hch(a)lst.de> Cc: stable(a)vger.kernel.org Fixes: 2736e8eeb0ccd ("block: use the holder as indication for exclusive opens") Signed-off-by: Richard Weinberger <richard(a)nod.at> --- drivers/mtd/devices/block2mtd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/mtd/devices/block2mtd.c b/drivers/mtd/devices/block2mtd.c index be106dc20ff3c..8c37650bbce45 100644 --- a/drivers/mtd/devices/block2mtd.c +++ b/drivers/mtd/devices/block2mtd.c @@ -209,7 +209,7 @@ static void block2mtd_free_device(struct block2mtd_dev *dev) if (dev->blkdev) { invalidate_mapping_pages(dev->blkdev->bd_inode->i_mapping, 0, -1); - blkdev_put(dev->blkdev, NULL); + blkdev_put(dev->blkdev, dev); } kfree(dev); -- 2.35.3

2 years

3
2
0 0

[tip: x86/urgent] x86/sgx: Return VM_FAULT_SIGBUS instead of VM_FAULT_OOM for EPC exhaustion

by tip-bot2 for Haitao Huang

The following commit has been merged into the x86/urgent branch of tip: Commit-ID: 6b7b71a70af6d75e0a9eddf4b01e4383a78b8a5e Gitweb: https://git.kernel.org/tip/6b7b71a70af6d75e0a9eddf4b01e4383a78b8a5e Author: Haitao Huang <haitao.huang(a)linux.intel.com> AuthorDate: Thu, 19 Oct 2023 19:53:53 -07:00 Committer: Ingo Molnar <mingo(a)kernel.org> CommitterDate: Fri, 20 Oct 2023 10:05:48 +02:00 x86/sgx: Return VM_FAULT_SIGBUS instead of VM_FAULT_OOM for EPC exhaustion In the EAUG on page fault path, VM_FAULT_OOM is returned when the Enclave Page Cache (EPC) runs out. This may trigger unneeded OOM kill that will not free any EPCs. Return VM_FAULT_SIGBUS instead. Fixes: 5a90d2c3f5ef ("x86/sgx: Support adding of pages to an initialized enclave") Signed-off-by: Haitao Huang <haitao.huang(a)linux.intel.com> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Cc: stable(a)vger.kernel.org # v6.0+ --- arch/x86/kernel/cpu/sgx/encl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/x86/kernel/cpu/sgx/encl.c b/arch/x86/kernel/cpu/sgx/encl.c index 279148e..d13b7e4 100644 --- a/arch/x86/kernel/cpu/sgx/encl.c +++ b/arch/x86/kernel/cpu/sgx/encl.c @@ -322,7 +322,7 @@ struct sgx_encl_page *sgx_encl_load_page(struct sgx_encl *encl, * ENCLS[EAUG] instruction. * * Returns: Appropriate vm_fault_t: VM_FAULT_NOPAGE when PTE was installed - * successfully, VM_FAULT_SIGBUS or VM_FAULT_OOM as error otherwise. + * successfully, VM_FAULT_SIGBUS as error otherwise. */ static vm_fault_t sgx_encl_eaug_page(struct vm_area_struct *vma, struct sgx_encl *encl, unsigned long addr) @@ -348,7 +348,7 @@ static vm_fault_t sgx_encl_eaug_page(struct vm_area_struct *vma, secinfo_flags = SGX_SECINFO_R | SGX_SECINFO_W | SGX_SECINFO_X; encl_page = sgx_encl_page_alloc(encl, addr - encl->base, secinfo_flags); if (IS_ERR(encl_page)) - return VM_FAULT_OOM; + return VM_FAULT_SIGBUS; mutex_lock(&encl->lock);

2 years

4
3
0 0

[PATCH net-next 00/10] mptcp: Fixes and cleanup for v6.7

by Mat Martineau

This series includes three initial patches that we had queued in our mptcp-net branch, but given the likely timing of net/net-next syncs this week, the need to avoid introducing branch conflicts, and another batch of net-next patches pending in the mptcp tree, the most practical route is to send everything for net-next. Patches 1 & 2 fix some intermittent selftest failures by adjusting timing. Patch 3 removes an unneccessary userspace path manager restriction on the removal of subflows with subflow ID 0. The remainder of the patches are all cleanup or selftest changes: Patches 4-8 clean up kernel code by removing unused parameters, making more consistent use of existing helper functions, and reducing extra casting of socket pointers. Patch 9 removes an unused variable in a selftest script. Patch 10 adds a little more detail to some mptcp_join test output. Signed-off-by: Mat Martineau <martineau(a)kernel.org> --- Geliang Tang (10): selftests: mptcp: run userspace pm tests slower selftests: mptcp: fix wait_rm_addr/sf parameters mptcp: userspace pm send RM_ADDR for ID 0 mptcp: drop useless ssk in pm_subflow_check_next mptcp: use mptcp_check_fallback helper mptcp: use mptcp_get_ext helper mptcp: move sk assignment statement ahead mptcp: define more local variables sk selftests: mptcp: sockopt: drop mptcp_connect var selftests: mptcp: display simult in extra_msg net/mptcp/pm.c | 2 +- net/mptcp/pm_userspace.c | 81 +++++++++++++++++----- net/mptcp/protocol.c | 6 +- net/mptcp/protocol.h | 4 +- net/mptcp/sockopt.c | 2 +- tools/testing/selftests/net/mptcp/mptcp_join.sh | 23 ++++-- tools/testing/selftests/net/mptcp/mptcp_sockopt.sh | 1 - 7 files changed, 88 insertions(+), 31 deletions(-) --- base-commit: 8846f9a04b10b7f61214425409838d764df7080d change-id: 20231025-send-net-next-20231025-6bd0ee2d8d7d Best regards, -- Mat Martineau <martineau(a)kernel.org>

2 years

2
4
0 0

+ mm-sparsemem-fix-race-in-accessing-memory_section-usage-v2.patch added to mm-hotfixes-unstable branch

by Andrew Morton

The patch titled Subject: mm/sparsemem: fix race in accessing memory_section->usage has been added to the -mm mm-hotfixes-unstable branch. Its filename is mm-sparsemem-fix-race-in-accessing-memory_section-usage-v2.patch This patch will shortly appear at https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche… This patch will later appear in the mm-hotfixes-unstable branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next via the mm-everything branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm and is updated there every 2-3 working days ------------------------------------------------------ From: Charan Teja Kalla <quic_charante(a)quicinc.com> Subject: mm/sparsemem: fix race in accessing memory_section->usage Date: Fri, 27 Oct 2023 16:19:38 +0530 use kfree_rcu() in place of synchronize_rcu(), per David Link: https://lkml.kernel.org/r/1698403778-20938-1-git-send-email-quic_charante@q… Fixes: f46edbd1b151 ("mm/sparsemem: add helpers track active portions of a section at boot") Signed-off-by: Charan Teja Kalla <quic_charante(a)quicinc.com> Cc: Aneesh Kumar K.V <aneesh.kumar(a)linux.ibm.com> Cc: Dan Williams <dan.j.williams(a)intel.com> Cc: David Hildenbrand <david(a)redhat.com> Cc: Mel Gorman <mgorman(a)techsingularity.net> Cc: Oscar Salvador <osalvador(a)suse.de> Cc: Vlastimil Babka <vbabka(a)suse.cz> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- include/linux/mmzone.h | 3 ++- mm/sparse.c | 5 ++--- 2 files changed, 4 insertions(+), 4 deletions(-) --- a/include/linux/mmzone.h~mm-sparsemem-fix-race-in-accessing-memory_section-usage-v2 +++ a/include/linux/mmzone.h @@ -1770,6 +1770,7 @@ static inline unsigned long section_nr_t #define SUBSECTION_ALIGN_DOWN(pfn) ((pfn) & PAGE_SUBSECTION_MASK) struct mem_section_usage { + struct rcu_head rcu; #ifdef CONFIG_SPARSEMEM_VMEMMAP DECLARE_BITMAP(subsection_map, SUBSECTIONS_PER_SECTION); #endif @@ -1963,7 +1964,7 @@ static inline int pfn_section_valid(stru { int idx = subsection_map_index(pfn); - return test_bit(idx, ms->usage->subsection_map); + return test_bit(idx, READ_ONCE(ms->usage)->subsection_map); } #else static inline int pfn_section_valid(struct mem_section *ms, unsigned long pfn) --- a/mm/sparse.c~mm-sparsemem-fix-race-in-accessing-memory_section-usage-v2 +++ a/mm/sparse.c @@ -806,9 +806,8 @@ static void section_deactivate(unsigned * was allocated during boot. */ if (!PageReserved(virt_to_page(ms->usage))) { - synchronize_rcu(); - kfree(ms->usage); - ms->usage = NULL; + kfree_rcu(ms->usage, rcu); + WRITE_ONCE(ms->usage, NULL); } memmap = sparse_decode_mem_map(ms->section_mem_map, section_nr); } _ Patches currently in -mm which might be from quic_charante(a)quicinc.com are mm-sparsemem-fix-race-in-accessing-memory_section-usage.patch mm-sparsemem-fix-race-in-accessing-memory_section-usage-v2.patch

2 years

1
0
0 0

FAILED: patch "[PATCH] drm/amd: Disable ASPM for VI w/ all Intel systems" failed to apply to 5.15-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.15-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y git checkout FETCH_HEAD git cherry-pick -x 64ffd2f1d00c6235dabe9704bbb0d9ce3e28147f # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023102753-hatless-serpent-a3a8@gregkh' --subject-prefix 'PATCH 5.15.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 64ffd2f1d00c6235dabe9704bbb0d9ce3e28147f Mon Sep 17 00:00:00 2001 From: Mario Limonciello <mario.limonciello(a)amd.com> Date: Fri, 20 Oct 2023 10:26:29 -0500 Subject: [PATCH] drm/amd: Disable ASPM for VI w/ all Intel systems Originally we were quirking ASPM disabled specifically for VI when used with Alder Lake, but it appears to have problems with Rocket Lake as well. Like we've done in the case of dpm for newer platforms, disable ASPM for all Intel systems. Cc: stable(a)vger.kernel.org # 5.15+ Fixes: 0064b0ce85bb ("drm/amd/pm: enable ASPM by default") Reported-and-tested-by: Paolo Gentili <paolo.gentili(a)canonical.com> Closes: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2036742 Signed-off-by: Mario Limonciello <mario.limonciello(a)amd.com> Reviewed-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> diff --git a/drivers/gpu/drm/amd/amdgpu/vi.c b/drivers/gpu/drm/amd/amdgpu/vi.c index 6a8494f98d3e..fe8ba9e9837b 100644 --- a/drivers/gpu/drm/amd/amdgpu/vi.c +++ b/drivers/gpu/drm/amd/amdgpu/vi.c @@ -1124,7 +1124,7 @@ static void vi_program_aspm(struct amdgpu_device *adev) bool bL1SS = false; bool bClkReqSupport = true; - if (!amdgpu_device_should_use_aspm(adev) || !amdgpu_device_aspm_support_quirk()) + if (!amdgpu_device_should_use_aspm(adev) || !amdgpu_device_pcie_dynamic_switching_supported()) return; if (adev->flags & AMD_IS_APU ||

2 years

1
0
0 0

[PATCH 5.10 000/199] 5.10.199-rc2 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.10.199 release. There are 199 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 26 Oct 2023 08:32:45 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.199-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.10.199-rc2 Zhang Changzhong <zhangchangzhong(a)huawei.com> xfrm6: fix inet6_dev refcount underflow problem Kees Cook <keescook(a)chromium.org> Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name Edward AD <twuufnxlz(a)gmail.com> Bluetooth: hci_sock: fix slab oob read in create_monitor_event Tony Lindgren <tony(a)atomide.com> phy: mapphone-mdm6600: Fix pinctrl_pm handling for sleep pins Tony Lindgren <tony(a)atomide.com> phy: mapphone-mdm6600: Fix runtime PM for remove Tony Lindgren <tony(a)atomide.com> phy: mapphone-mdm6600: Fix runtime disable on probe Dan Carpenter <dan.carpenter(a)linaro.org> ASoC: pxa: fix a memory leak in probe() Haibo Chen <haibo.chen(a)nxp.com> gpio: vf610: set value before the direction to avoid a glitch Hans de Goede <hdegoede(a)redhat.com> platform/x86: asus-wmi: Map 0x2a code, Ignore 0x2b and 0x2c events Hans de Goede <hdegoede(a)redhat.com> platform/x86: asus-wmi: Change ASUS_WMI_BRN_DOWN code from 0x20 to 0x2e Niklas Schnelle <schnelle(a)linux.ibm.com> s390/pci: fix iommu bitmap allocation Peter Zijlstra <peterz(a)infradead.org> perf: Disallow mis-matched inherited group reads Puliang Lu <puliang.lu(a)fibocom.com> USB: serial: option: add Fibocom to DELL custom modem FM101R-GL Benoît Monin <benoit.monin(a)gmx.fr> USB: serial: option: add entry for Sierra EM9191 with new firmware Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit LE910C4-WWX 0x1035 composition Maurizio Lombardi <mlombard(a)redhat.com> nvme-rdma: do not try to stop unallocated queues Keith Busch <kbusch(a)kernel.org> nvme-pci: add BOGUS_NID for Intel 0a54 device Sunil V L <sunilvl(a)ventanamicro.com> ACPI: irq: Fix incorrect return value in acpi_register_gsi() Trond Myklebust <trond.myklebust(a)hammerspace.com> pNFS: Fix a hang in nfs4_evict_inode() Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> Revert "pinctrl: avoid unsafe code pattern in find_pinctrl()" Avri Altman <avri.altman(a)wdc.com> mmc: core: Capture correct oemid-bits for eMMC cards Haibo Chen <haibo.chen(a)nxp.com> mmc: core: sdio: hold retuning if sdio in 1-bit mode Geert Uytterhoeven <geert+renesas(a)glider.be> mtd: physmap-core: Restore map_rom fallback Martin Kurbanov <mmkurbanov(a)sberdevices.ru> mtd: spinand: micron: correct bitmask for ecc status Miquel Raynal <miquel.raynal(a)bootlin.com> mtd: rawnand: arasan: Ensure program page operations are successful Miquel Raynal <miquel.raynal(a)bootlin.com> mtd: rawnand: marvell: Ensure program page operations are successful Bibek Kumar Patro <quic_bibekkum(a)quicinc.com> mtd: rawnand: qcom: Unmap the right resource upon probe failure Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_event: Fix using memcmp when comparing keys Maher Sanalla <msanalla(a)nvidia.com> net/mlx5: Handle fw tracer change ownership event based on MTRC Renan Guilherme Lebre Ramos <japareaggae(a)gmail.com> platform/x86: touchscreen_dmi: Add info for the Positivo C4128B Rahul Rameshbabu <sergeantsagara(a)protonmail.com> HID: multitouch: Add required quirk for Synaptics 0xcd7e device Josef Bacik <josef(a)toxicpanda.com> btrfs: fix some -Wmaybe-uninitialized warnings in ioctl.c Kai Uwe Broulik <foss-linux(a)broulik.de> drm: panel-orientation-quirks: Add quirk for One Mix 2S Hangbin Liu <liuhangbin(a)gmail.com> ipv4/fib: send notify when delete source address routes Kees Cook <keescook(a)chromium.org> sky2: Make sure there is at least one frag_addr available Michał Mirosław <mirq-linux(a)rere.qmqm.pl> regulator/core: Revert "fix kobject release warning and memory leak in regulator_register()" Benjamin Berg <benjamin.berg(a)intel.com> wifi: cfg80211: avoid leaking stack data into trace Wen Gong <quic_wgong(a)quicinc.com> wifi: mac80211: allow transmitting EAPOL frames with tainted key Ilan Peer <ilan.peer(a)intel.com> wifi: cfg80211: Fix 6GHz scan configuration Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_core: Fix build warnings Ying Hsu <yinghsu(a)chromium.org> Bluetooth: Avoid redundant authentication Ma Ke <make_ruc2021(a)163.com> HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event Clément Léger <cleger(a)rivosinc.com> tracing: relax trace_event_eval_update() execution with cond_resched() Damien Le Moal <dlemoal(a)kernel.org> ata: libata-eh: Fix compilation warning in ata_eh_link_report() Chengfeng Ye <dg573847474(a)gmail.com> gpio: timberdale: Fix potential deadlock on &tgpio->lock Jeff Layton <jlayton(a)kernel.org> overlayfs: set ctime when setting mtime and atime Heiner Kallweit <hkallweit1(a)gmail.com> i2c: mux: Avoid potential false error message in i2c_mux_add_adapter Josef Bacik <josef(a)toxicpanda.com> btrfs: initialize start_slot in btrfs_log_prealloc_extents Filipe Manana <fdmanana(a)suse.com> btrfs: return -EUCLEAN for delayed tree ref with a ref count not equals to 1 Tony Lindgren <tony(a)atomide.com> ARM: dts: ti: omap: Fix noisy serial with overrun-throttle-ms for mapphone RD Babiera <rdbabiera(a)google.com> usb: typec: altmodes/displayport: Signal hpd low when exiting mode Hans de Goede <hdegoede(a)redhat.com> usb: typec: altmodes/displayport: Notify drm subsys of hotplug events Hans de Goede <hdegoede(a)redhat.com> drm/connector: Add support for out-of-band hotplug notification (v3) Hans de Goede <hdegoede(a)redhat.com> drm/connector: Add drm_connector_find_by_fwnode() function (v3) Hans de Goede <hdegoede(a)redhat.com> drm/connector: Add a fwnode pointer to drm_connector and register with ACPI (v2) Hans de Goede <hdegoede(a)redhat.com> drm/connector: Give connector sysfs devices there own device_type Daniel Miess <daniel.miess(a)amd.com> drm/amd/display: Don't set dpms_off for seamless boot Yongqiang Sun <yongqiang.sun(a)amd.com> drm/amd/display: only check available pipe to disable vbios mode. Tony Lindgren <tony(a)atomide.com> serial: 8250_omap: Fix errors with no_console_suspend Tony Lindgren <tony(a)atomide.com> serial: 8250: omap: Fix imprecise external abort for omap_8250_pm() Mathias Nyman <mathias.nyman(a)linux.intel.com> xhci: track port suspend state correctly in unsuccessful resume cases Mathias Nyman <mathias.nyman(a)linux.intel.com> xhci: decouple usb2 port resume and get_port_status request handling Mathias Nyman <mathias.nyman(a)linux.intel.com> xhci: clear usb2 resume related variables in one place. Mathias Nyman <mathias.nyman(a)linux.intel.com> xhci: rename resume_done to resume_timestamp Mathias Nyman <mathias.nyman(a)linux.intel.com> xhci: move port specific items such as state completions to port structure Mathias Nyman <mathias.nyman(a)linux.intel.com> xhci: cleanup xhci_hub_control port references Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> usb: core: Track SuperSpeed Plus GenXxY Juntong Deng <juntong.deng(a)outlook.com> selftests/mm: fix awk usage in charge_reserved_hugetlb.sh and hugetlb_reparenting_test.sh that may cause error Waiman Long <longman(a)redhat.com> selftests/vm: make charge_reserved_hugetlb.sh work with existing cgroup setting Hans de Goede <hdegoede(a)redhat.com> ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA Paul Menzel <pmenzel(a)molgen.mpg.de> ACPI: resource: Skip IRQ override on ASUS ExpertBook B1502CBA Tamim Khan <tamim(a)fusetak.com> ACPI: resource: Skip IRQ override on Asus Expertbook B2402CBA Hans de Goede <hdegoede(a)redhat.com> ACPI: resource: Add Asus ExpertBook B2502 to Asus quirks Tamim Khan <tamim(a)fusetak.com> ACPI: resource: Skip IRQ override on Asus Vivobook S5602ZA Kellen Renshaw <kellen.renshaw(a)canonical.com> ACPI: resource: Add ASUS model S5402ZA to quirks Tamim Khan <tamim(a)fusetak.com> ACPI: resource: Skip IRQ override on Asus Vivobook K3402ZA/K3502ZA Hui Wang <hui.wang(a)canonical.com> ACPI: resources: Add DMI-based legacy IRQ override quirk John Garry <john.garry(a)huawei.com> ACPI: Drop acpi_dev_irqresource_disabled() John Garry <john.garry(a)huawei.com> resource: Add irqresource_disabled() Mika Westerberg <mika.westerberg(a)linux.intel.com> thunderbolt: Workaround an IOMMU fault on certain systems with Intel Maple Ridge Gavrilov Ilia <Ilia.Gavrilov(a)infotecs.ru> net: pktgen: Fix interface flags printing Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nft_set_rbtree: .deactivate fails if element has expired Geert Uytterhoeven <geert+renesas(a)glider.be> neighbor: tracing: Move pin6 inside CONFIG_IPV6=y section Pedro Tammela <pctammela(a)mojatatu.com> net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve Jinjie Ruan <ruanjinjie(a)huawei.com> net: dsa: bcm_sf2: Fix possible memory leak in bcm_sf2_mdio_register() Michal Schmidt <mschmidt(a)redhat.com> i40e: prevent crash on probe if hw registers have invalid values Dan Carpenter <dan.carpenter(a)linaro.org> net: usb: smsc95xx: Fix an error code in smsc95xx_reset() Eric Dumazet <edumazet(a)google.com> ipv4: fib: annotate races around nh->nh_saddr_genid and nh->nh_saddr Eric Dumazet <edumazet(a)google.com> tun: prevent negative ifindex Eric Dumazet <edumazet(a)google.com> tcp: tsq: relax tcp_small_queue_check() when rtx queue contains a single skb Neal Cardwell <ncardwell(a)google.com> tcp: fix excessive TLP and RACK timeouts from HZ rounding Josua Mayer <josua(a)solid-run.com> net: rfkill: gpio: prevent value glitch during probe Ma Ke <make_ruc2021(a)163.com> net: ipv6: fix return value check in esp_remove_trailer Ma Ke <make_ruc2021(a)163.com> net: ipv4: fix return value check in esp_remove_trailer Eric Dumazet <edumazet(a)google.com> xfrm: interface: use DEV_STATS_INC() Eric Dumazet <edumazet(a)google.com> xfrm: fix a data-race in xfrm_gen_index() Manish Chopra <manishc(a)marvell.com> qed: fix LL2 RX buffer allocation Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915: Retry gtt fault when out of fence registers Sagi Grimberg <sagi(a)grimberg.me> nvmet-tcp: Fix a possible UAF in queue intialization setup Florian Westphal <fw(a)strlen.de> netfilter: nft_payload: fix wrong mac header matching Paolo Abeni <pabeni(a)redhat.com> tcp: check mptcp-level constraints for backlog coalescing Joerg Roedel <jroedel(a)suse.de> x86/sev: Check for user-space IOIO pointing to kernel space Joerg Roedel <jroedel(a)suse.de> x86/sev: Check IOBM for IOIO exceptions from user-space Borislav Petkov (AMD) <bp(a)alien8.de> x86/sev: Disable MMIO emulation from user mode Jim Mattson <jmattson(a)google.com> KVM: x86: Mask LVTPC when handling a PMI Johan Hovold <johan+linaro(a)kernel.org> regmap: fix NULL deref on lookup Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> nfc: nci: fix possible NULL pointer dereference in send_acknowledge() Jesse Brandeburg <jesse.brandeburg(a)intel.com> ice: reset first in crash dump kernels Jesse Brandeburg <jesse.brandeburg(a)intel.com> ice: fix over-shifted variable Arnd Bergmann <arnd(a)arndb.de> Bluetooth: avoid memcmp() out of bounds warning Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_event: Fix coding style Arkadiusz Bokowy <arkadiusz.bokowy(a)gmail.com> Bluetooth: vhci: Fix race when opening vhci device Ziyang Xuan <william.xuanziyang(a)huawei.com> Bluetooth: Fix a refcnt underflow problem for hci_conn Lee, Chun-Yi <jlee(a)suse.com> Bluetooth: Reject connection with the device which has same BD_ADDR Lee, Chun-Yi <jlee(a)suse.com> Bluetooth: hci_event: Ignore NULL link key Ricardo Cañuelo <ricardo.canuelo(a)collabora.com> usb: hub: Guard against accesses to uninitialized BOS descriptors Bagas Sanjaya <bagasdotme(a)gmail.com> Documentation: sysctl: align cells in second content column Liam Mark <lmark(a)codeaurora.org> mm/memory_hotplug: rate limit page migration warnings Hyeonggon Yoo <42.hyeyoo(a)gmail.com> lib/Kconfig.debug: do not enable DEBUG_PREEMPT by default Nicolas Dichtel <nicolas.dichtel(a)6wind.com> dev_forward_skb: do not scrub skb mark within the same name space Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com> ravb: Fix use-after-free issue in ravb_tx_timeout_work() Bart Van Assche <bvanassche(a)acm.org> RDMA/srp: Fix srp_abort() yangx.jy(a)fujitsu.com <yangx.jy(a)fujitsu.com> RDMA/srp: Set scmnd->result only when scmnd is not NULL Ren Zhijie <renzhijie2(a)huawei.com> arm64: armv8_deprecated: fix unused-function error Mark Rutland <mark.rutland(a)arm.com> arm64: armv8_deprecated: rework deprected instruction handling Mark Rutland <mark.rutland(a)arm.com> arm64: armv8_deprecated: move aarch32 helper earlier Mark Rutland <mark.rutland(a)arm.com> arm64: armv8_deprecated move emulation functions Mark Rutland <mark.rutland(a)arm.com> arm64: armv8_deprecated: fold ops into insn_emulation Mark Rutland <mark.rutland(a)arm.com> arm64: rework EL0 MRS emulation Mark Rutland <mark.rutland(a)arm.com> arm64: factor insn read out of call_undef_hook() Mark Rutland <mark.rutland(a)arm.com> arm64: factor out EL1 SSBS emulation hook Mark Rutland <mark.rutland(a)arm.com> arm64: split EL0/EL1 UNDEF handlers Mark Rutland <mark.rutland(a)arm.com> arm64: allow kprobes on EL0 handlers Mark Rutland <mark.rutland(a)arm.com> arm64: rework BTI exception handling Mark Rutland <mark.rutland(a)arm.com> arm64: rework FPAC exception handling Mark Rutland <mark.rutland(a)arm.com> arm64: consistently pass ESR_ELx to die() Mark Rutland <mark.rutland(a)arm.com> arm64: die(): pass 'err' as long Mark Rutland <mark.rutland(a)arm.com> arm64: report EL1 UNDEFs better Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com> x86/alternatives: Disable KASAN in apply_alternatives() Christophe Leroy <christophe.leroy(a)csgroup.eu> powerpc/64e: Fix wrong test in __ptep_test_and_clear_young() Christophe Leroy <christophe.leroy(a)csgroup.eu> powerpc/8xx: Fix pte_access_permitted() for PAGE_NONE Duoming Zhou <duoming(a)zju.edu.cn> dmaengine: mediatek: Fix deadlock caused by synchronize_irq() Krishna Kurapati <quic_kriskura(a)quicinc.com> usb: gadget: ncm: Handle decoding of multiple NTB's in unwrap call Piyush Mehta <piyush.mehta(a)amd.com> usb: gadget: udc-xilinx: replace memcpy with memcpy_toio Dharma Balasubiramani <dharma.b(a)microchip.com> counter: microchip-tcb-capture: Fix the use of internal GCLK logic Dmitry Torokhov <dmitry.torokhov(a)gmail.com> pinctrl: avoid unsafe code pattern in find_pinctrl() Michal Koutný <mkoutny(a)suse.com> cgroup: Remove duplicates in cgroup v1 tasks file Rijo Thomas <Rijo-john.Thomas(a)amd.com> tee: amdtee: fix use-after-free vulnerability in amdtee_close_session Hans de Goede <hdegoede(a)redhat.com> Input: goodix - ensure int GPIO is in input for gpio_count == 1 && gpio_int_idx == 0 case Szilard Fabian <szfabian(a)bluemarch.art> Input: i8042 - add Fujitsu Lifebook E5411 to i8042 quirk table Matthias Berndt <matthias_berndt(a)gmx.de> Input: xpad - add PXN V900 support Jeffery Miller <jefferymiller(a)google.com> Input: psmouse - fix fast_reconnect function for PS/2 mode Javier Carrasco <javier.carrasco.cruz(a)gmail.com> Input: powermate - fix use-after-free in powermate_config_complete Dan Carpenter <dan.carpenter(a)linaro.org> ceph: fix type promotion bug on 32bit systems Xiubo Li <xiubli(a)redhat.com> ceph: fix incorrect revoked caps assert in ceph_fill_file_size() Jordan Rife <jrife(a)google.com> libceph: use kernel_connect() Mika Westerberg <mika.westerberg(a)linux.intel.com> thunderbolt: Check that lane 1 is in CL0 before enabling lane bonding Jorge Sanjuan Garcia <jorge.sanjuangarcia(a)duagon.com> mcb: remove is_added flag from mcb_device struct Borislav Petkov (AMD) <bp(a)alien8.de> x86/cpu: Fix AMD erratum #1485 on Zen4-based CPUs Alexander Zangerl <az(a)breathe-safe.com> iio: pressure: ms5611: ms5611_prom_is_valid false negative bug Lakshmi Yadlapati <lakshmiy(a)us.ibm.com> iio: pressure: dps310: Adjust Timeout Settings Phil Elwell <phil(a)raspberrypi.com> iio: pressure: bmp280: Fix NULL pointer exception Xingxing Luo <xingxing.luo(a)unisoc.com> usb: musb: Modify the "HWVers" register address Xingxing Luo <xingxing.luo(a)unisoc.com> usb: musb: Get the musb_qh poniter after musb_giveback Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> usb: dwc3: Soft reset phy on probe for host Javier Carrasco <javier.carrasco.cruz(a)gmail.com> net: usb: dm9601: fix uninitialized variable use in dm9601_mdio_read Wesley Cheng <quic_wcheng(a)quicinc.com> usb: xhci: xhci-ring: Use sysdev for mapping bounce buffer Amelie Delaunay <amelie.delaunay(a)foss.st.com> dmaengine: stm32-mdma: abort resume if no ongoing transfer Zheng Wang <zyytlz.wz(a)163.com> media: mtk-jpeg: Fix use after free bug due to uncanceled work Patrick Rohr <prohr(a)google.com> net: release reference to inet6_dev pointer Patrick Rohr <prohr(a)google.com> net: change accept_ra_min_rtr_lft to affect all RA lifetimes Patrick Rohr <prohr(a)google.com> net: add sysctl accept_ra_min_rtr_lft Sasha Levin <sashal(a)kernel.org> Revert "spi: spi-zynqmp-gqspi: Fix runtime PM imbalance in zynqmp_qspi_probe" Sasha Levin <sashal(a)kernel.org> Revert "spi: zynqmp-gqspi: fix clock imbalance on probe failure" Waiman Long <longman(a)redhat.com> workqueue: Override implicit ordered attribute in workqueue_apply_unbound_cpumask() Jeremy Cline <jeremy(a)jcline.org> nfc: nci: assert requested protocol is valid Ralph Siemsen <ralph.siemsen(a)linaro.org> pinctrl: renesas: rzn1: Enable missing PINMUX Eric Dumazet <edumazet(a)google.com> net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() Dan Carpenter <dan.carpenter(a)linaro.org> ixgbe: fix crash with empty VF macvlan list Radu Pirea (NXP OSS) <radu-nicolae.pirea(a)oss.nxp.com> net: phy: mscc: macsec: reject PN update requests Radu Pirea (NXP OSS) <radu-nicolae.pirea(a)oss.nxp.com> net: macsec: indicate next pn update when offloading Konstantin Meskhidze <konstantin.meskhidze(a)huawei.com> drm/vmwgfx: fix typo of sizeof argument Björn Töpel <bjorn(a)rivosinc.com> riscv, bpf: Sign-extend return values Pu Lehui <pulehui(a)huawei.com> riscv, bpf: Factor out emit_call for kernel and bpf context Roger Pau Monne <roger.pau(a)citrix.com> xen-netback: use default TX queue size for vifs Dan Carpenter <dan.carpenter(a)linaro.org> mlxsw: fix mlxsw_sp2_nve_vxlan_learning_set() return type Dinghao Liu <dinghao.liu(a)zju.edu.cn> ieee802154: ca8210: Fix a potential UAF in ca8210_probe Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com> ravb: Fix up dma_free_coherent() call in ravb_remove() Abhinav Kumar <quic_abhinavk(a)quicinc.com> drm/msm/dpu: change _dpu_plane_calc_bw() to use u64 to avoid overflow Abhinav Kumar <quic_abhinavk(a)quicinc.com> drm/msm/dsi: skip the wait for video mode done if not applicable Kuogee Hsieh <quic_khsieh(a)quicinc.com> drm/msm/dp: do not reinitialize phy unless retry during link training Jordan Rife <jrife(a)google.com> net: prevent address rewrite in kernel_bind() Jan Kara <jack(a)suse.cz> quota: Fix slow quotaoff Hans de Goede <hdegoede(a)redhat.com> HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> lib/test_meminit: fix off-by-one error in test_pages() Jing Zhang <renyu.zj(a)linux.alibaba.com> perf/arm-cmn: Fix the unhandled overflow status of counter 4 to 7 Artem Chernyshev <artem.chernyshev(a)red-soft.ru> RDMA/cxgb4: Check skb value for failure to allocate Bart Van Assche <bvanassche(a)acm.org> RDMA/srp: Do not call scsi_done() from srp_abort() Bart Van Assche <bvanassche(a)acm.org> RDMA/srp: Make struct scsi_cmnd and struct srp_request adjacent ------------- Diffstat: Documentation/admin-guide/sysctl/net.rst | 18 +- Documentation/networking/ip-sysctl.rst | 8 + Makefile | 4 +- arch/arm/boot/dts/motorola-mapphone-common.dtsi | 1 + arch/arm64/include/asm/cpufeature.h | 3 +- arch/arm64/include/asm/exception.h | 13 +- arch/arm64/include/asm/spectre.h | 2 + arch/arm64/include/asm/system_misc.h | 2 +- arch/arm64/include/asm/traps.h | 19 +- arch/arm64/kernel/armv8_deprecated.c | 572 ++++++++++----------- arch/arm64/kernel/cpufeature.c | 23 +- arch/arm64/kernel/entry-common.c | 36 +- arch/arm64/kernel/proton-pack.c | 26 +- arch/arm64/kernel/traps.c | 125 ++--- arch/powerpc/include/asm/nohash/32/pte-8xx.h | 7 + arch/powerpc/include/asm/nohash/64/pgtable.h | 2 +- arch/powerpc/include/asm/nohash/pgtable.h | 2 + arch/riscv/net/bpf_jit_comp64.c | 33 +- arch/s390/pci/pci_dma.c | 15 +- arch/x86/boot/compressed/sev-es.c | 10 + arch/x86/include/asm/msr-index.h | 9 +- arch/x86/kernel/alternative.c | 13 + arch/x86/kernel/cpu/amd.c | 8 + arch/x86/kernel/sev-es-shared.c | 53 +- arch/x86/kernel/sev-es.c | 30 ++ arch/x86/kvm/lapic.c | 8 +- drivers/acpi/irq.c | 7 +- drivers/acpi/resource.c | 121 ++++- drivers/ata/libata-eh.c | 2 +- drivers/base/regmap/regmap.c | 2 +- drivers/bluetooth/hci_vhci.c | 3 + drivers/counter/microchip-tcb-capture.c | 2 +- drivers/dma/mediatek/mtk-uart-apdma.c | 3 +- drivers/dma/stm32-mdma.c | 4 + drivers/gpio/gpio-timberdale.c | 5 +- drivers/gpio/gpio-vf610.c | 4 +- drivers/gpu/drm/amd/display/dc/core/dc.c | 9 +- drivers/gpu/drm/drm_connector.c | 79 +++ drivers/gpu/drm/drm_crtc_internal.h | 2 + drivers/gpu/drm/drm_panel_orientation_quirks.c | 16 + drivers/gpu/drm/drm_sysfs.c | 87 +++- drivers/gpu/drm/i915/gem/i915_gem_mman.c | 1 + drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c | 12 +- drivers/gpu/drm/msm/dp/dp_ctrl.c | 13 +- drivers/gpu/drm/msm/dsi/dsi_host.c | 12 + drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 2 +- drivers/hid/hid-holtek-kbd.c | 4 + drivers/hid/hid-logitech-hidpp.c | 3 +- drivers/hid/hid-multitouch.c | 4 + drivers/i2c/i2c-mux.c | 2 +- drivers/iio/pressure/bmp280-core.c | 2 +- drivers/iio/pressure/dps310.c | 8 +- drivers/iio/pressure/ms5611_core.c | 2 +- drivers/infiniband/hw/cxgb4/cm.c | 3 + drivers/infiniband/ulp/srp/ib_srp.c | 172 +++---- drivers/infiniband/ulp/srp/ib_srp.h | 2 - drivers/input/joystick/xpad.c | 2 + drivers/input/misc/powermate.c | 1 + drivers/input/mouse/elantech.c | 1 + drivers/input/mouse/synaptics.c | 1 + drivers/input/serio/i8042-acpipnpio.h | 8 + drivers/input/touchscreen/goodix.c | 19 + drivers/mcb/mcb-core.c | 10 +- drivers/mcb/mcb-parse.c | 2 - drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c | 1 + drivers/mmc/core/mmc.c | 2 +- drivers/mmc/core/sdio.c | 8 +- drivers/mtd/maps/physmap-core.c | 11 + drivers/mtd/nand/raw/arasan-nand-controller.c | 16 +- drivers/mtd/nand/raw/marvell_nand.c | 23 +- drivers/mtd/nand/raw/qcom_nandc.c | 2 +- drivers/mtd/nand/spi/micron.c | 2 +- drivers/net/dsa/bcm_sf2.c | 24 +- drivers/net/ethernet/intel/i40e/i40e_common.c | 4 +- drivers/net/ethernet/intel/ice/ice_lib.c | 3 +- drivers/net/ethernet/intel/ice/ice_main.c | 15 + drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c | 5 +- drivers/net/ethernet/marvell/sky2.h | 2 +- .../ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 2 +- .../ethernet/mellanox/mlxsw/spectrum_nve_vxlan.c | 4 +- drivers/net/ethernet/qlogic/qed/qed_ll2.c | 7 +- drivers/net/ethernet/renesas/ravb_main.c | 6 +- drivers/net/ieee802154/ca8210.c | 17 +- drivers/net/macsec.c | 2 + drivers/net/phy/mscc/mscc_macsec.c | 6 + drivers/net/tun.c | 7 +- drivers/net/usb/dm9601.c | 7 +- drivers/net/usb/smsc95xx.c | 2 +- drivers/net/xen-netback/interface.c | 3 - drivers/nvme/host/pci.c | 3 +- drivers/nvme/host/rdma.c | 3 + drivers/nvme/target/tcp.c | 7 +- drivers/perf/arm-cmn.c | 2 +- drivers/phy/motorola/phy-mapphone-mdm6600.c | 38 +- drivers/pinctrl/renesas/Kconfig | 1 + drivers/platform/x86/asus-nb-wmi.c | 3 + drivers/platform/x86/asus-wmi.h | 2 +- drivers/platform/x86/touchscreen_dmi.c | 23 + drivers/regulator/core.c | 6 +- drivers/spi/spi-zynqmp-gqspi.c | 24 +- drivers/tee/amdtee/core.c | 10 +- drivers/thunderbolt/icm.c | 38 +- drivers/thunderbolt/switch.c | 7 + drivers/tty/serial/8250/8250_omap.c | 93 ++-- drivers/usb/core/hcd.c | 6 +- drivers/usb/core/hub.c | 106 +++- drivers/usb/core/hub.h | 2 +- drivers/usb/dwc3/core.c | 39 +- drivers/usb/gadget/function/f_ncm.c | 26 +- drivers/usb/gadget/udc/udc-xilinx.c | 20 +- drivers/usb/host/xhci-hub.c | 228 ++++---- drivers/usb/host/xhci-mem.c | 10 +- drivers/usb/host/xhci-ring.c | 17 +- drivers/usb/host/xhci.h | 9 +- drivers/usb/musb/musb_debugfs.c | 2 +- drivers/usb/musb/musb_host.c | 9 +- drivers/usb/serial/option.c | 7 + drivers/usb/typec/altmodes/Kconfig | 1 + drivers/usb/typec/altmodes/displayport.c | 28 + fs/btrfs/extent-tree.c | 6 +- fs/btrfs/ioctl.c | 4 +- fs/btrfs/tree-log.c | 2 +- fs/ceph/file.c | 2 +- fs/ceph/inode.c | 4 +- fs/nfs/pnfs.c | 33 +- fs/overlayfs/copy_up.c | 2 +- fs/quota/dquot.c | 66 ++- include/drm/drm_connector.h | 25 + include/linux/ioport.h | 7 + include/linux/ipv6.h | 1 + include/linux/mcb.h | 1 - include/linux/netdevice.h | 2 +- include/linux/perf_event.h | 1 + include/linux/quota.h | 4 +- include/linux/quotaops.h | 2 +- include/linux/usb.h | 2 + include/net/bluetooth/hci_core.h | 2 +- include/net/bluetooth/hci_mon.h | 2 +- include/net/ip_fib.h | 1 + include/net/macsec.h | 1 + include/net/netns/xfrm.h | 1 + include/net/tcp.h | 3 + include/trace/events/neigh.h | 4 +- include/uapi/linux/ipv6.h | 7 + kernel/cgroup/cgroup-v1.c | 5 +- kernel/events/core.c | 39 +- kernel/trace/trace_events.c | 1 + kernel/workqueue.c | 8 +- lib/Kconfig.debug | 5 +- lib/test_meminit.c | 2 +- mm/memory_hotplug.c | 16 +- net/bluetooth/hci_conn.c | 72 ++- net/bluetooth/hci_core.c | 8 +- net/bluetooth/hci_event.c | 33 +- net/bluetooth/hci_sock.c | 3 +- net/ceph/messenger.c | 4 +- net/core/pktgen.c | 14 +- net/ipv4/esp4.c | 4 +- net/ipv4/fib_semantics.c | 15 +- net/ipv4/fib_trie.c | 4 + net/ipv4/tcp_ipv4.c | 1 + net/ipv4/tcp_output.c | 25 +- net/ipv4/tcp_recovery.c | 2 +- net/ipv6/addrconf.c | 13 + net/ipv6/esp6.c | 4 +- net/ipv6/ndisc.c | 13 +- net/ipv6/xfrm6_policy.c | 4 +- net/mac80211/tx.c | 3 +- net/netfilter/ipvs/ip_vs_sync.c | 4 +- net/netfilter/nft_payload.c | 2 +- net/netfilter/nft_set_rbtree.c | 2 + net/nfc/llcp_core.c | 30 +- net/nfc/nci/core.c | 5 + net/nfc/nci/spi.c | 2 + net/rds/tcp_connect.c | 2 +- net/rds/tcp_listen.c | 2 +- net/rfkill/rfkill-gpio.c | 4 +- net/sched/sch_hfsc.c | 18 +- net/socket.c | 6 +- net/wireless/nl80211.c | 2 +- net/wireless/scan.c | 4 + net/xfrm/xfrm_interface_core.c | 22 +- net/xfrm/xfrm_policy.c | 6 +- sound/soc/pxa/pxa-ssp.c | 2 +- .../selftests/vm/charge_reserved_hugetlb.sh | 34 +- .../selftests/vm/hugetlb_reparenting_test.sh | 21 +- tools/testing/selftests/vm/write_hugetlb_memory.sh | 2 +- 187 files changed, 2095 insertions(+), 1183 deletions(-)

2 years

8
9
0 0

Hola

by audu bello

Se le envió un correo electrónico sobre la recepción de fondos pendientes, pero estoy Me sorprende que nunca te hayas molestado en responder. Utilice URGENTEMENTE mi dirección de correo electrónico habitual: a00728298(a)yahoo.com Atentamente Gerente de Auditoría

2 years

1
0
0 0

FAILED: patch "[PATCH] drm/dp_mst: Fix NULL deref in" failed to apply to 5.10-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y git checkout FETCH_HEAD git cherry-pick -x 3d887d512494d678b17c57b835c32f4e48d34f26 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023102722-foyer-jawed-7d2f@gregkh' --subject-prefix 'PATCH 5.10.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 3d887d512494d678b17c57b835c32f4e48d34f26 Mon Sep 17 00:00:00 2001 From: Lukasz Majczak <lma(a)semihalf.com> Date: Fri, 22 Sep 2023 08:34:10 +0200 Subject: [PATCH] drm/dp_mst: Fix NULL deref in get_mst_branch_device_by_guid_helper() As drm_dp_get_mst_branch_device_by_guid() is called from drm_dp_get_mst_branch_device_by_guid(), mstb parameter has to be checked, otherwise NULL dereference may occur in the call to the memcpy() and cause following: [12579.365869] BUG: kernel NULL pointer dereference, address: 0000000000000049 [12579.365878] #PF: supervisor read access in kernel mode [12579.365880] #PF: error_code(0x0000) - not-present page [12579.365882] PGD 0 P4D 0 [12579.365887] Oops: 0000 [#1] PREEMPT SMP NOPTI ... [12579.365895] Workqueue: events_long drm_dp_mst_up_req_work [12579.365899] RIP: 0010:memcmp+0xb/0x29 [12579.365921] Call Trace: [12579.365927] get_mst_branch_device_by_guid_helper+0x22/0x64 [12579.365930] drm_dp_mst_up_req_work+0x137/0x416 [12579.365933] process_one_work+0x1d0/0x419 [12579.365935] worker_thread+0x11a/0x289 [12579.365938] kthread+0x13e/0x14f [12579.365941] ? process_one_work+0x419/0x419 [12579.365943] ? kthread_blkcg+0x31/0x31 [12579.365946] ret_from_fork+0x1f/0x30 As get_mst_branch_device_by_guid_helper() is recursive, moving condition to the first line allow to remove a similar one for step over of NULL elements inside a loop. Fixes: 5e93b8208d3c ("drm/dp/mst: move GUID storage from mgr, port to only mst branch") Cc: <stable(a)vger.kernel.org> # 4.14+ Signed-off-by: Lukasz Majczak <lma(a)semihalf.com> Reviewed-by: Radoslaw Biernacki <rad(a)chromium.org> Signed-off-by: Manasi Navare <navaremanasi(a)chromium.org> Link: https://patchwork.freedesktop.org/patch/msgid/20230922063410.23626-1-lma@se… diff --git a/drivers/gpu/drm/display/drm_dp_mst_topology.c b/drivers/gpu/drm/display/drm_dp_mst_topology.c index ed96cfcfa304..8c929ef72c72 100644 --- a/drivers/gpu/drm/display/drm_dp_mst_topology.c +++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c @@ -2574,14 +2574,14 @@ static struct drm_dp_mst_branch *get_mst_branch_device_by_guid_helper( struct drm_dp_mst_branch *found_mstb; struct drm_dp_mst_port *port; + if (!mstb) + return NULL; + if (memcmp(mstb->guid, guid, 16) == 0) return mstb; list_for_each_entry(port, &mstb->ports, next) { - if (!port->mstb) - continue; - found_mstb = get_mst_branch_device_by_guid_helper(port->mstb, guid); if (found_mstb)

2 years

1
0
0 0

FAILED: patch "[PATCH] drm/dp_mst: Fix NULL deref in" failed to apply to 5.15-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.15-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y git checkout FETCH_HEAD git cherry-pick -x 3d887d512494d678b17c57b835c32f4e48d34f26 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023102720-gatherer-voter-6a5b@gregkh' --subject-prefix 'PATCH 5.15.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 3d887d512494d678b17c57b835c32f4e48d34f26 Mon Sep 17 00:00:00 2001 From: Lukasz Majczak <lma(a)semihalf.com> Date: Fri, 22 Sep 2023 08:34:10 +0200 Subject: [PATCH] drm/dp_mst: Fix NULL deref in get_mst_branch_device_by_guid_helper() As drm_dp_get_mst_branch_device_by_guid() is called from drm_dp_get_mst_branch_device_by_guid(), mstb parameter has to be checked, otherwise NULL dereference may occur in the call to the memcpy() and cause following: [12579.365869] BUG: kernel NULL pointer dereference, address: 0000000000000049 [12579.365878] #PF: supervisor read access in kernel mode [12579.365880] #PF: error_code(0x0000) - not-present page [12579.365882] PGD 0 P4D 0 [12579.365887] Oops: 0000 [#1] PREEMPT SMP NOPTI ... [12579.365895] Workqueue: events_long drm_dp_mst_up_req_work [12579.365899] RIP: 0010:memcmp+0xb/0x29 [12579.365921] Call Trace: [12579.365927] get_mst_branch_device_by_guid_helper+0x22/0x64 [12579.365930] drm_dp_mst_up_req_work+0x137/0x416 [12579.365933] process_one_work+0x1d0/0x419 [12579.365935] worker_thread+0x11a/0x289 [12579.365938] kthread+0x13e/0x14f [12579.365941] ? process_one_work+0x419/0x419 [12579.365943] ? kthread_blkcg+0x31/0x31 [12579.365946] ret_from_fork+0x1f/0x30 As get_mst_branch_device_by_guid_helper() is recursive, moving condition to the first line allow to remove a similar one for step over of NULL elements inside a loop. Fixes: 5e93b8208d3c ("drm/dp/mst: move GUID storage from mgr, port to only mst branch") Cc: <stable(a)vger.kernel.org> # 4.14+ Signed-off-by: Lukasz Majczak <lma(a)semihalf.com> Reviewed-by: Radoslaw Biernacki <rad(a)chromium.org> Signed-off-by: Manasi Navare <navaremanasi(a)chromium.org> Link: https://patchwork.freedesktop.org/patch/msgid/20230922063410.23626-1-lma@se… diff --git a/drivers/gpu/drm/display/drm_dp_mst_topology.c b/drivers/gpu/drm/display/drm_dp_mst_topology.c index ed96cfcfa304..8c929ef72c72 100644 --- a/drivers/gpu/drm/display/drm_dp_mst_topology.c +++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c @@ -2574,14 +2574,14 @@ static struct drm_dp_mst_branch *get_mst_branch_device_by_guid_helper( struct drm_dp_mst_branch *found_mstb; struct drm_dp_mst_port *port; + if (!mstb) + return NULL; + if (memcmp(mstb->guid, guid, 16) == 0) return mstb; list_for_each_entry(port, &mstb->ports, next) { - if (!port->mstb) - continue; - found_mstb = get_mst_branch_device_by_guid_helper(port->mstb, guid); if (found_mstb)

2 years

1
0
0 0

[PATCH 6.5] accel/ivpu: Don't enter d0i3 during FLR

by Stanislaw Gruszka

commit 828d63042aeca132a93938b98dc7f1a6c97bbc51 upstream. Avoid HW bug on some platforms where we enter D0i3 state and CPU is in low power states (C8 or above). Fixes: 852be13f3bd3 ("accel/ivpu: Add PM support") Signed-off-by: Jacek Lawrynowicz <jacek.lawrynowicz(a)linux.intel.com> Reviewed-by: Stanislaw Gruszka <stanislaw.gruszka(a)linux.intel.com> Signed-off-by: Stanislaw Gruszka <stanislaw.gruszka(a)linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20231003064213.1527327-1-stan… - --- drivers/accel/ivpu/ivpu_drv.c | 11 ++++++++--- drivers/accel/ivpu/ivpu_drv.h | 1 + drivers/accel/ivpu/ivpu_hw.h | 8 ++++++++ drivers/accel/ivpu/ivpu_hw_mtl.c | 1 + drivers/accel/ivpu/ivpu_pm.c | 3 ++- 5 files changed, 20 insertions(+), 4 deletions(-) diff --git a/drivers/accel/ivpu/ivpu_drv.c b/drivers/accel/ivpu/ivpu_drv.c index 8396db2b5203..13e11437bee5 100644 --- a/drivers/accel/ivpu/ivpu_drv.c +++ b/drivers/accel/ivpu/ivpu_drv.c @@ -343,14 +343,19 @@ int ivpu_boot(struct ivpu_device *vdev) return 0; } -int ivpu_shutdown(struct ivpu_device *vdev) +void ivpu_prepare_for_reset(struct ivpu_device *vdev) { - int ret; - ivpu_hw_irq_disable(vdev); disable_irq(vdev->irq); ivpu_ipc_disable(vdev); ivpu_mmu_disable(vdev); +} + +int ivpu_shutdown(struct ivpu_device *vdev) +{ + int ret; + + ivpu_prepare_for_reset(vdev); ret = ivpu_hw_power_down(vdev); if (ret) diff --git a/drivers/accel/ivpu/ivpu_drv.h b/drivers/accel/ivpu/ivpu_drv.h index 399dc5dcefd7..343b15e56799 100644 --- a/drivers/accel/ivpu/ivpu_drv.h +++ b/drivers/accel/ivpu/ivpu_drv.h @@ -144,6 +144,7 @@ void ivpu_file_priv_put(struct ivpu_file_priv **link); int ivpu_boot(struct ivpu_device *vdev); int ivpu_shutdown(struct ivpu_device *vdev); +void ivpu_prepare_for_reset(struct ivpu_device *vdev); static inline bool ivpu_is_mtl(struct ivpu_device *vdev) { diff --git a/drivers/accel/ivpu/ivpu_hw.h b/drivers/accel/ivpu/ivpu_hw.h index 50a9304ab09c..dac59f1c1e05 100644 --- a/drivers/accel/ivpu/ivpu_hw.h +++ b/drivers/accel/ivpu/ivpu_hw.h @@ -13,6 +13,7 @@ struct ivpu_hw_ops { int (*power_up)(struct ivpu_device *vdev); int (*boot_fw)(struct ivpu_device *vdev); int (*power_down)(struct ivpu_device *vdev); + int (*reset)(struct ivpu_device *vdev); bool (*is_idle)(struct ivpu_device *vdev); void (*wdt_disable)(struct ivpu_device *vdev); void (*diagnose_failure)(struct ivpu_device *vdev); @@ -90,6 +91,13 @@ static inline int ivpu_hw_power_down(struct ivpu_device *vdev) return vdev->hw->ops->power_down(vdev); }; +static inline int ivpu_hw_reset(struct ivpu_device *vdev) +{ + ivpu_dbg(vdev, PM, "HW reset\n"); + + return vdev->hw->ops->reset(vdev); +}; + static inline void ivpu_hw_wdt_disable(struct ivpu_device *vdev) { vdev->hw->ops->wdt_disable(vdev); diff --git a/drivers/accel/ivpu/ivpu_hw_mtl.c b/drivers/accel/ivpu/ivpu_hw_mtl.c index 2a5dd3a5dc46..d21c16b5e6f8 100644 --- a/drivers/accel/ivpu/ivpu_hw_mtl.c +++ b/drivers/accel/ivpu/ivpu_hw_mtl.c @@ -1041,6 +1041,7 @@ const struct ivpu_hw_ops ivpu_hw_mtl_ops = { .power_up = ivpu_hw_mtl_power_up, .is_idle = ivpu_hw_mtl_is_idle, .power_down = ivpu_hw_mtl_power_down, + .reset = ivpu_hw_mtl_reset, .boot_fw = ivpu_hw_mtl_boot_fw, .wdt_disable = ivpu_hw_mtl_wdt_disable, .diagnose_failure = ivpu_hw_mtl_diagnose_failure, diff --git a/drivers/accel/ivpu/ivpu_pm.c b/drivers/accel/ivpu/ivpu_pm.c index aa4d56dc52b3..86ec828dd1df 100644 --- a/drivers/accel/ivpu/ivpu_pm.c +++ b/drivers/accel/ivpu/ivpu_pm.c @@ -260,7 +260,8 @@ void ivpu_pm_reset_prepare_cb(struct pci_dev *pdev) ivpu_dbg(vdev, PM, "Pre-reset..\n"); atomic_set(&vdev->pm->in_reset, 1); - ivpu_shutdown(vdev); + ivpu_prepare_for_reset(vdev); + ivpu_hw_reset(vdev); ivpu_pm_prepare_cold_boot(vdev); ivpu_jobs_abort_all(vdev); ivpu_dbg(vdev, PM, "Pre-reset done.\n"); -- 2.34.1

2 years

2
1
0 0

FAILED: patch "[PATCH] accel/ivpu/37xx: Fix missing VPUIP interrupts" failed to apply to 6.5-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.5-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.5.y git checkout FETCH_HEAD git cherry-pick -x b132ac51d7a50c37683be56c96ff64f8c887930f # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023102746-unengaged-cosponsor-948a@gregkh' --subject-prefix 'PATCH 6.5.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From b132ac51d7a50c37683be56c96ff64f8c887930f Mon Sep 17 00:00:00 2001 From: Karol Wachowski <karol.wachowski(a)linux.intel.com> Date: Tue, 24 Oct 2023 18:19:52 +0200 Subject: [PATCH] accel/ivpu/37xx: Fix missing VPUIP interrupts Move sequence of masking and unmasking global interrupts from buttress interrupt handler to generic one that handles both VPUIP and BTRS interrupts. Unmasking global interrupts will re-trigger MSI for any pending interrupts. Lack of this sequence will cause the driver to miss any VPUIP interrupt that comes after reading VPU_37XX_HOST_SS_ICB_STATUS_0 and before clearing all active interrupt sources. Fixes: 35b137630f08 ("accel/ivpu: Introduce a new DRM driver for Intel VPU") Cc: stable(a)vger.kernel.org Signed-off-by: Karol Wachowski <karol.wachowski(a)linux.intel.com> Reviewed-by: Stanislaw Gruszka <stanislaw.gruszka(a)linux.intel.com> Signed-off-by: Stanislaw Gruszka <stanislaw.gruszka(a)linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20231024161952.759914-1-stani… diff --git a/drivers/accel/ivpu/ivpu_hw_37xx.c b/drivers/accel/ivpu/ivpu_hw_37xx.c index 976019429164..18be8b98e9a8 100644 --- a/drivers/accel/ivpu/ivpu_hw_37xx.c +++ b/drivers/accel/ivpu/ivpu_hw_37xx.c @@ -940,9 +940,6 @@ static u32 ivpu_hw_37xx_irqb_handler(struct ivpu_device *vdev, int irq) if (status == 0) return 0; - /* Disable global interrupt before handling local buttress interrupts */ - REGB_WR32(VPU_37XX_BUTTRESS_GLOBAL_INT_MASK, 0x1); - if (REG_TEST_FLD(VPU_37XX_BUTTRESS_INTERRUPT_STAT, FREQ_CHANGE, status)) ivpu_dbg(vdev, IRQ, "FREQ_CHANGE irq: %08x", REGB_RD32(VPU_37XX_BUTTRESS_CURRENT_PLL)); @@ -974,9 +971,6 @@ static u32 ivpu_hw_37xx_irqb_handler(struct ivpu_device *vdev, int irq) else REGB_WR32(VPU_37XX_BUTTRESS_INTERRUPT_STAT, status); - /* Re-enable global interrupt */ - REGB_WR32(VPU_37XX_BUTTRESS_GLOBAL_INT_MASK, 0x0); - if (schedule_recovery) ivpu_pm_schedule_recovery(vdev); @@ -988,9 +982,14 @@ static irqreturn_t ivpu_hw_37xx_irq_handler(int irq, void *ptr) struct ivpu_device *vdev = ptr; u32 ret_irqv, ret_irqb; + REGB_WR32(VPU_37XX_BUTTRESS_GLOBAL_INT_MASK, 0x1); + ret_irqv = ivpu_hw_37xx_irqv_handler(vdev, irq); ret_irqb = ivpu_hw_37xx_irqb_handler(vdev, irq); + /* Re-enable global interrupts to re-trigger MSI for pending interrupts */ + REGB_WR32(VPU_37XX_BUTTRESS_GLOBAL_INT_MASK, 0x0); + return IRQ_RETVAL(ret_irqb | ret_irqv); }

2 years

1
0
0 0

FAILED: patch "[PATCH] vdpa/mlx5: Fix firmware error on creation of 1k VQs" failed to apply to 5.10-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y git checkout FETCH_HEAD git cherry-pick -x abb0dcf9938c93f765abf8cb45567cadef0af6b2 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023102751-unsealed-faction-dcd6@gregkh' --subject-prefix 'PATCH 5.10.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From abb0dcf9938c93f765abf8cb45567cadef0af6b2 Mon Sep 17 00:00:00 2001 From: Dragos Tatulea <dtatulea(a)nvidia.com> Date: Thu, 31 Aug 2023 18:50:56 +0300 Subject: [PATCH] vdpa/mlx5: Fix firmware error on creation of 1k VQs A firmware error is triggered when configuring a 9k MTU on the PF after switching to switchdev mode and then using a vdpa device with larger (1k) rings: mlx5_cmd_out_err: CREATE_GENERAL_OBJECT(0xa00) op_mod(0xd) failed, status bad resource(0x5), syndrome (0xf6db90), err(-22) This is due to the fact that the hw VQ size parameters are computed based on the umem_1/2/3_buffer_param_a/b capabilities and all device capabilities are read only when the driver is moved to switchdev mode. The problematic configuration flow looks like this: 1) Create VF 2) Unbind VF 3) Switch PF to switchdev mode. 4) Bind VF 5) Set PF MTU to 9k 6) create vDPA device 7) Start VM with vDPA device and 1K queue size Note that setting the MTU before step 3) doesn't trigger this issue. This patch reads the forementioned umem parameters at the latest point possible before the VQs of the device are created. v2: - Allocate output with kmalloc to reduce stack frame size. - Removed stable from cc. Fixes: 1a86b377aa21 ("vdpa/mlx5: Add VDPA driver for supported mlx5 devices") Signed-off-by: Dragos Tatulea <dtatulea(a)nvidia.com> Message-Id: <20230831155702.1080754-1-dtatulea(a)nvidia.com> Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Acked-by: Jason Wang <jasowang(a)redhat.com> diff --git a/drivers/vdpa/mlx5/net/mlx5_vnet.c b/drivers/vdpa/mlx5/net/mlx5_vnet.c index 2b7b9000f2d3..946488b8989f 100644 --- a/drivers/vdpa/mlx5/net/mlx5_vnet.c +++ b/drivers/vdpa/mlx5/net/mlx5_vnet.c @@ -625,30 +625,70 @@ static void cq_destroy(struct mlx5_vdpa_net *ndev, u16 idx) mlx5_db_free(ndev->mvdev.mdev, &vcq->db); } +static int read_umem_params(struct mlx5_vdpa_net *ndev) +{ + u32 in[MLX5_ST_SZ_DW(query_hca_cap_in)] = {}; + u16 opmod = (MLX5_CAP_VDPA_EMULATION << 1) | (HCA_CAP_OPMOD_GET_CUR & 0x01); + struct mlx5_core_dev *mdev = ndev->mvdev.mdev; + int out_size; + void *caps; + void *out; + int err; + + out_size = MLX5_ST_SZ_BYTES(query_hca_cap_out); + out = kzalloc(out_size, GFP_KERNEL); + if (!out) + return -ENOMEM; + + MLX5_SET(query_hca_cap_in, in, opcode, MLX5_CMD_OP_QUERY_HCA_CAP); + MLX5_SET(query_hca_cap_in, in, op_mod, opmod); + err = mlx5_cmd_exec_inout(mdev, query_hca_cap, in, out); + if (err) { + mlx5_vdpa_warn(&ndev->mvdev, + "Failed reading vdpa umem capabilities with err %d\n", err); + goto out; + } + + caps = MLX5_ADDR_OF(query_hca_cap_out, out, capability); + + ndev->umem_1_buffer_param_a = MLX5_GET(virtio_emulation_cap, caps, umem_1_buffer_param_a); + ndev->umem_1_buffer_param_b = MLX5_GET(virtio_emulation_cap, caps, umem_1_buffer_param_b); + + ndev->umem_2_buffer_param_a = MLX5_GET(virtio_emulation_cap, caps, umem_2_buffer_param_a); + ndev->umem_2_buffer_param_b = MLX5_GET(virtio_emulation_cap, caps, umem_2_buffer_param_b); + + ndev->umem_3_buffer_param_a = MLX5_GET(virtio_emulation_cap, caps, umem_3_buffer_param_a); + ndev->umem_3_buffer_param_b = MLX5_GET(virtio_emulation_cap, caps, umem_3_buffer_param_b); + +out: + kfree(out); + return 0; +} + static void set_umem_size(struct mlx5_vdpa_net *ndev, struct mlx5_vdpa_virtqueue *mvq, int num, struct mlx5_vdpa_umem **umemp) { - struct mlx5_core_dev *mdev = ndev->mvdev.mdev; - int p_a; - int p_b; + u32 p_a; + u32 p_b; switch (num) { case 1: - p_a = MLX5_CAP_DEV_VDPA_EMULATION(mdev, umem_1_buffer_param_a); - p_b = MLX5_CAP_DEV_VDPA_EMULATION(mdev, umem_1_buffer_param_b); + p_a = ndev->umem_1_buffer_param_a; + p_b = ndev->umem_1_buffer_param_b; *umemp = &mvq->umem1; break; case 2: - p_a = MLX5_CAP_DEV_VDPA_EMULATION(mdev, umem_2_buffer_param_a); - p_b = MLX5_CAP_DEV_VDPA_EMULATION(mdev, umem_2_buffer_param_b); + p_a = ndev->umem_2_buffer_param_a; + p_b = ndev->umem_2_buffer_param_b; *umemp = &mvq->umem2; break; case 3: - p_a = MLX5_CAP_DEV_VDPA_EMULATION(mdev, umem_3_buffer_param_a); - p_b = MLX5_CAP_DEV_VDPA_EMULATION(mdev, umem_3_buffer_param_b); + p_a = ndev->umem_3_buffer_param_a; + p_b = ndev->umem_3_buffer_param_b; *umemp = &mvq->umem3; break; } + (*umemp)->size = p_a * mvq->num_ent + p_b; } @@ -2679,6 +2719,11 @@ static int setup_driver(struct mlx5_vdpa_dev *mvdev) goto out; } mlx5_vdpa_add_debugfs(ndev); + + err = read_umem_params(ndev); + if (err) + goto err_setup; + err = setup_virtqueues(mvdev); if (err) { mlx5_vdpa_warn(mvdev, "setup_virtqueues\n"); diff --git a/drivers/vdpa/mlx5/net/mlx5_vnet.h b/drivers/vdpa/mlx5/net/mlx5_vnet.h index 60cdbc903037..90b556a57971 100644 --- a/drivers/vdpa/mlx5/net/mlx5_vnet.h +++ b/drivers/vdpa/mlx5/net/mlx5_vnet.h @@ -65,6 +65,15 @@ struct mlx5_vdpa_net { struct hlist_head macvlan_hash[MLX5V_MACVLAN_SIZE]; struct mlx5_vdpa_irq_pool irqp; struct dentry *debugfs; + + u32 umem_1_buffer_param_a; + u32 umem_1_buffer_param_b; + + u32 umem_2_buffer_param_a; + u32 umem_2_buffer_param_b; + + u32 umem_3_buffer_param_a; + u32 umem_3_buffer_param_b; }; struct mlx5_vdpa_counter {

2 years

1
0
0 0

FAILED: patch "[PATCH] vdpa/mlx5: Fix firmware error on creation of 1k VQs" failed to apply to 5.15-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.15-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y git checkout FETCH_HEAD git cherry-pick -x abb0dcf9938c93f765abf8cb45567cadef0af6b2 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023102749-vitalize-debtless-eaf8@gregkh' --subject-prefix 'PATCH 5.15.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From abb0dcf9938c93f765abf8cb45567cadef0af6b2 Mon Sep 17 00:00:00 2001 From: Dragos Tatulea <dtatulea(a)nvidia.com> Date: Thu, 31 Aug 2023 18:50:56 +0300 Subject: [PATCH] vdpa/mlx5: Fix firmware error on creation of 1k VQs A firmware error is triggered when configuring a 9k MTU on the PF after switching to switchdev mode and then using a vdpa device with larger (1k) rings: mlx5_cmd_out_err: CREATE_GENERAL_OBJECT(0xa00) op_mod(0xd) failed, status bad resource(0x5), syndrome (0xf6db90), err(-22) This is due to the fact that the hw VQ size parameters are computed based on the umem_1/2/3_buffer_param_a/b capabilities and all device capabilities are read only when the driver is moved to switchdev mode. The problematic configuration flow looks like this: 1) Create VF 2) Unbind VF 3) Switch PF to switchdev mode. 4) Bind VF 5) Set PF MTU to 9k 6) create vDPA device 7) Start VM with vDPA device and 1K queue size Note that setting the MTU before step 3) doesn't trigger this issue. This patch reads the forementioned umem parameters at the latest point possible before the VQs of the device are created. v2: - Allocate output with kmalloc to reduce stack frame size. - Removed stable from cc. Fixes: 1a86b377aa21 ("vdpa/mlx5: Add VDPA driver for supported mlx5 devices") Signed-off-by: Dragos Tatulea <dtatulea(a)nvidia.com> Message-Id: <20230831155702.1080754-1-dtatulea(a)nvidia.com> Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Acked-by: Jason Wang <jasowang(a)redhat.com> diff --git a/drivers/vdpa/mlx5/net/mlx5_vnet.c b/drivers/vdpa/mlx5/net/mlx5_vnet.c index 2b7b9000f2d3..946488b8989f 100644 --- a/drivers/vdpa/mlx5/net/mlx5_vnet.c +++ b/drivers/vdpa/mlx5/net/mlx5_vnet.c @@ -625,30 +625,70 @@ static void cq_destroy(struct mlx5_vdpa_net *ndev, u16 idx) mlx5_db_free(ndev->mvdev.mdev, &vcq->db); } +static int read_umem_params(struct mlx5_vdpa_net *ndev) +{ + u32 in[MLX5_ST_SZ_DW(query_hca_cap_in)] = {}; + u16 opmod = (MLX5_CAP_VDPA_EMULATION << 1) | (HCA_CAP_OPMOD_GET_CUR & 0x01); + struct mlx5_core_dev *mdev = ndev->mvdev.mdev; + int out_size; + void *caps; + void *out; + int err; + + out_size = MLX5_ST_SZ_BYTES(query_hca_cap_out); + out = kzalloc(out_size, GFP_KERNEL); + if (!out) + return -ENOMEM; + + MLX5_SET(query_hca_cap_in, in, opcode, MLX5_CMD_OP_QUERY_HCA_CAP); + MLX5_SET(query_hca_cap_in, in, op_mod, opmod); + err = mlx5_cmd_exec_inout(mdev, query_hca_cap, in, out); + if (err) { + mlx5_vdpa_warn(&ndev->mvdev, + "Failed reading vdpa umem capabilities with err %d\n", err); + goto out; + } + + caps = MLX5_ADDR_OF(query_hca_cap_out, out, capability); + + ndev->umem_1_buffer_param_a = MLX5_GET(virtio_emulation_cap, caps, umem_1_buffer_param_a); + ndev->umem_1_buffer_param_b = MLX5_GET(virtio_emulation_cap, caps, umem_1_buffer_param_b); + + ndev->umem_2_buffer_param_a = MLX5_GET(virtio_emulation_cap, caps, umem_2_buffer_param_a); + ndev->umem_2_buffer_param_b = MLX5_GET(virtio_emulation_cap, caps, umem_2_buffer_param_b); + + ndev->umem_3_buffer_param_a = MLX5_GET(virtio_emulation_cap, caps, umem_3_buffer_param_a); + ndev->umem_3_buffer_param_b = MLX5_GET(virtio_emulation_cap, caps, umem_3_buffer_param_b); + +out: + kfree(out); + return 0; +} + static void set_umem_size(struct mlx5_vdpa_net *ndev, struct mlx5_vdpa_virtqueue *mvq, int num, struct mlx5_vdpa_umem **umemp) { - struct mlx5_core_dev *mdev = ndev->mvdev.mdev; - int p_a; - int p_b; + u32 p_a; + u32 p_b; switch (num) { case 1: - p_a = MLX5_CAP_DEV_VDPA_EMULATION(mdev, umem_1_buffer_param_a); - p_b = MLX5_CAP_DEV_VDPA_EMULATION(mdev, umem_1_buffer_param_b); + p_a = ndev->umem_1_buffer_param_a; + p_b = ndev->umem_1_buffer_param_b; *umemp = &mvq->umem1; break; case 2: - p_a = MLX5_CAP_DEV_VDPA_EMULATION(mdev, umem_2_buffer_param_a); - p_b = MLX5_CAP_DEV_VDPA_EMULATION(mdev, umem_2_buffer_param_b); + p_a = ndev->umem_2_buffer_param_a; + p_b = ndev->umem_2_buffer_param_b; *umemp = &mvq->umem2; break; case 3: - p_a = MLX5_CAP_DEV_VDPA_EMULATION(mdev, umem_3_buffer_param_a); - p_b = MLX5_CAP_DEV_VDPA_EMULATION(mdev, umem_3_buffer_param_b); + p_a = ndev->umem_3_buffer_param_a; + p_b = ndev->umem_3_buffer_param_b; *umemp = &mvq->umem3; break; } + (*umemp)->size = p_a * mvq->num_ent + p_b; } @@ -2679,6 +2719,11 @@ static int setup_driver(struct mlx5_vdpa_dev *mvdev) goto out; } mlx5_vdpa_add_debugfs(ndev); + + err = read_umem_params(ndev); + if (err) + goto err_setup; + err = setup_virtqueues(mvdev); if (err) { mlx5_vdpa_warn(mvdev, "setup_virtqueues\n"); diff --git a/drivers/vdpa/mlx5/net/mlx5_vnet.h b/drivers/vdpa/mlx5/net/mlx5_vnet.h index 60cdbc903037..90b556a57971 100644 --- a/drivers/vdpa/mlx5/net/mlx5_vnet.h +++ b/drivers/vdpa/mlx5/net/mlx5_vnet.h @@ -65,6 +65,15 @@ struct mlx5_vdpa_net { struct hlist_head macvlan_hash[MLX5V_MACVLAN_SIZE]; struct mlx5_vdpa_irq_pool irqp; struct dentry *debugfs; + + u32 umem_1_buffer_param_a; + u32 umem_1_buffer_param_b; + + u32 umem_2_buffer_param_a; + u32 umem_2_buffer_param_b; + + u32 umem_3_buffer_param_a; + u32 umem_3_buffer_param_b; }; struct mlx5_vdpa_counter {

2 years

1
0
0 0

FAILED: patch "[PATCH] vdpa/mlx5: Fix firmware error on creation of 1k VQs" failed to apply to 6.1-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.1-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y git checkout FETCH_HEAD git cherry-pick -x abb0dcf9938c93f765abf8cb45567cadef0af6b2 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023102748-monetary-sworn-9a51@gregkh' --subject-prefix 'PATCH 6.1.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From abb0dcf9938c93f765abf8cb45567cadef0af6b2 Mon Sep 17 00:00:00 2001 From: Dragos Tatulea <dtatulea(a)nvidia.com> Date: Thu, 31 Aug 2023 18:50:56 +0300 Subject: [PATCH] vdpa/mlx5: Fix firmware error on creation of 1k VQs A firmware error is triggered when configuring a 9k MTU on the PF after switching to switchdev mode and then using a vdpa device with larger (1k) rings: mlx5_cmd_out_err: CREATE_GENERAL_OBJECT(0xa00) op_mod(0xd) failed, status bad resource(0x5), syndrome (0xf6db90), err(-22) This is due to the fact that the hw VQ size parameters are computed based on the umem_1/2/3_buffer_param_a/b capabilities and all device capabilities are read only when the driver is moved to switchdev mode. The problematic configuration flow looks like this: 1) Create VF 2) Unbind VF 3) Switch PF to switchdev mode. 4) Bind VF 5) Set PF MTU to 9k 6) create vDPA device 7) Start VM with vDPA device and 1K queue size Note that setting the MTU before step 3) doesn't trigger this issue. This patch reads the forementioned umem parameters at the latest point possible before the VQs of the device are created. v2: - Allocate output with kmalloc to reduce stack frame size. - Removed stable from cc. Fixes: 1a86b377aa21 ("vdpa/mlx5: Add VDPA driver for supported mlx5 devices") Signed-off-by: Dragos Tatulea <dtatulea(a)nvidia.com> Message-Id: <20230831155702.1080754-1-dtatulea(a)nvidia.com> Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Acked-by: Jason Wang <jasowang(a)redhat.com> diff --git a/drivers/vdpa/mlx5/net/mlx5_vnet.c b/drivers/vdpa/mlx5/net/mlx5_vnet.c index 2b7b9000f2d3..946488b8989f 100644 --- a/drivers/vdpa/mlx5/net/mlx5_vnet.c +++ b/drivers/vdpa/mlx5/net/mlx5_vnet.c @@ -625,30 +625,70 @@ static void cq_destroy(struct mlx5_vdpa_net *ndev, u16 idx) mlx5_db_free(ndev->mvdev.mdev, &vcq->db); } +static int read_umem_params(struct mlx5_vdpa_net *ndev) +{ + u32 in[MLX5_ST_SZ_DW(query_hca_cap_in)] = {}; + u16 opmod = (MLX5_CAP_VDPA_EMULATION << 1) | (HCA_CAP_OPMOD_GET_CUR & 0x01); + struct mlx5_core_dev *mdev = ndev->mvdev.mdev; + int out_size; + void *caps; + void *out; + int err; + + out_size = MLX5_ST_SZ_BYTES(query_hca_cap_out); + out = kzalloc(out_size, GFP_KERNEL); + if (!out) + return -ENOMEM; + + MLX5_SET(query_hca_cap_in, in, opcode, MLX5_CMD_OP_QUERY_HCA_CAP); + MLX5_SET(query_hca_cap_in, in, op_mod, opmod); + err = mlx5_cmd_exec_inout(mdev, query_hca_cap, in, out); + if (err) { + mlx5_vdpa_warn(&ndev->mvdev, + "Failed reading vdpa umem capabilities with err %d\n", err); + goto out; + } + + caps = MLX5_ADDR_OF(query_hca_cap_out, out, capability); + + ndev->umem_1_buffer_param_a = MLX5_GET(virtio_emulation_cap, caps, umem_1_buffer_param_a); + ndev->umem_1_buffer_param_b = MLX5_GET(virtio_emulation_cap, caps, umem_1_buffer_param_b); + + ndev->umem_2_buffer_param_a = MLX5_GET(virtio_emulation_cap, caps, umem_2_buffer_param_a); + ndev->umem_2_buffer_param_b = MLX5_GET(virtio_emulation_cap, caps, umem_2_buffer_param_b); + + ndev->umem_3_buffer_param_a = MLX5_GET(virtio_emulation_cap, caps, umem_3_buffer_param_a); + ndev->umem_3_buffer_param_b = MLX5_GET(virtio_emulation_cap, caps, umem_3_buffer_param_b); + +out: + kfree(out); + return 0; +} + static void set_umem_size(struct mlx5_vdpa_net *ndev, struct mlx5_vdpa_virtqueue *mvq, int num, struct mlx5_vdpa_umem **umemp) { - struct mlx5_core_dev *mdev = ndev->mvdev.mdev; - int p_a; - int p_b; + u32 p_a; + u32 p_b; switch (num) { case 1: - p_a = MLX5_CAP_DEV_VDPA_EMULATION(mdev, umem_1_buffer_param_a); - p_b = MLX5_CAP_DEV_VDPA_EMULATION(mdev, umem_1_buffer_param_b); + p_a = ndev->umem_1_buffer_param_a; + p_b = ndev->umem_1_buffer_param_b; *umemp = &mvq->umem1; break; case 2: - p_a = MLX5_CAP_DEV_VDPA_EMULATION(mdev, umem_2_buffer_param_a); - p_b = MLX5_CAP_DEV_VDPA_EMULATION(mdev, umem_2_buffer_param_b); + p_a = ndev->umem_2_buffer_param_a; + p_b = ndev->umem_2_buffer_param_b; *umemp = &mvq->umem2; break; case 3: - p_a = MLX5_CAP_DEV_VDPA_EMULATION(mdev, umem_3_buffer_param_a); - p_b = MLX5_CAP_DEV_VDPA_EMULATION(mdev, umem_3_buffer_param_b); + p_a = ndev->umem_3_buffer_param_a; + p_b = ndev->umem_3_buffer_param_b; *umemp = &mvq->umem3; break; } + (*umemp)->size = p_a * mvq->num_ent + p_b; } @@ -2679,6 +2719,11 @@ static int setup_driver(struct mlx5_vdpa_dev *mvdev) goto out; } mlx5_vdpa_add_debugfs(ndev); + + err = read_umem_params(ndev); + if (err) + goto err_setup; + err = setup_virtqueues(mvdev); if (err) { mlx5_vdpa_warn(mvdev, "setup_virtqueues\n"); diff --git a/drivers/vdpa/mlx5/net/mlx5_vnet.h b/drivers/vdpa/mlx5/net/mlx5_vnet.h index 60cdbc903037..90b556a57971 100644 --- a/drivers/vdpa/mlx5/net/mlx5_vnet.h +++ b/drivers/vdpa/mlx5/net/mlx5_vnet.h @@ -65,6 +65,15 @@ struct mlx5_vdpa_net { struct hlist_head macvlan_hash[MLX5V_MACVLAN_SIZE]; struct mlx5_vdpa_irq_pool irqp; struct dentry *debugfs; + + u32 umem_1_buffer_param_a; + u32 umem_1_buffer_param_b; + + u32 umem_2_buffer_param_a; + u32 umem_2_buffer_param_b; + + u32 umem_3_buffer_param_a; + u32 umem_3_buffer_param_b; }; struct mlx5_vdpa_counter {

2 years

1
0
0 0

FAILED: patch "[PATCH] nfsd: lock_rename() needs both directories to live on the" failed to apply to 5.10-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y git checkout FETCH_HEAD git cherry-pick -x 1aee9158bc978f91701c5992e395efbc6da2de3c # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023102700-fraying-dispersed-5c9f@gregkh' --subject-prefix 'PATCH 5.10.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 1aee9158bc978f91701c5992e395efbc6da2de3c Mon Sep 17 00:00:00 2001 From: Al Viro <viro(a)zeniv.linux.org.uk> Date: Sat, 14 Oct 2023 21:34:40 -0400 Subject: [PATCH] nfsd: lock_rename() needs both directories to live on the same fs ... checking that after lock_rename() is too late. Incidentally, NFSv2 had no nfserr_xdev... Fixes: aa387d6ce153 "nfsd: fix EXDEV checking in rename" Cc: stable(a)vger.kernel.org # v3.9+ Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Acked-by: Chuck Lever <chuck.lever(a)oracle.com> Tested-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Al Viro <viro(a)zeniv.linux.org.uk> diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c index 48260cf68fde..02f5fcaad03f 100644 --- a/fs/nfsd/vfs.c +++ b/fs/nfsd/vfs.c @@ -1788,6 +1788,12 @@ nfsd_rename(struct svc_rqst *rqstp, struct svc_fh *ffhp, char *fname, int flen, if (!flen || isdotent(fname, flen) || !tlen || isdotent(tname, tlen)) goto out; + err = (rqstp->rq_vers == 2) ? nfserr_acces : nfserr_xdev; + if (ffhp->fh_export->ex_path.mnt != tfhp->fh_export->ex_path.mnt) + goto out; + if (ffhp->fh_export->ex_path.dentry != tfhp->fh_export->ex_path.dentry) + goto out; + retry: host_err = fh_want_write(ffhp); if (host_err) { @@ -1823,12 +1829,6 @@ nfsd_rename(struct svc_rqst *rqstp, struct svc_fh *ffhp, char *fname, int flen, if (ndentry == trap) goto out_dput_new; - host_err = -EXDEV; - if (ffhp->fh_export->ex_path.mnt != tfhp->fh_export->ex_path.mnt) - goto out_dput_new; - if (ffhp->fh_export->ex_path.dentry != tfhp->fh_export->ex_path.dentry) - goto out_dput_new; - if ((ndentry->d_sb->s_export_op->flags & EXPORT_OP_CLOSE_BEFORE_UNLINK) && nfsd_has_cached_files(ndentry)) { close_cached = true;

2 years

1
0
0 0

FAILED: patch "[PATCH] hugetlbfs: close race between MADV_DONTNEED and page fault" failed to apply to 6.1-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.1-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y git checkout FETCH_HEAD git cherry-pick -x 2820b0f09be99f6406784b03a22dfc83e858449d # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023102723-washroom-engine-fdc1@gregkh' --subject-prefix 'PATCH 6.1.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 2820b0f09be99f6406784b03a22dfc83e858449d Mon Sep 17 00:00:00 2001 From: Rik van Riel <riel(a)surriel.com> Date: Thu, 5 Oct 2023 23:59:08 -0400 Subject: [PATCH] hugetlbfs: close race between MADV_DONTNEED and page fault Malloc libraries, like jemalloc and tcalloc, take decisions on when to call madvise independently from the code in the main application. This sometimes results in the application page faulting on an address, right after the malloc library has shot down the backing memory with MADV_DONTNEED. Usually this is harmless, because we always have some 4kB pages sitting around to satisfy a page fault. However, with hugetlbfs systems often allocate only the exact number of huge pages that the application wants. Due to TLB batching, hugetlbfs MADV_DONTNEED will free pages outside of any lock taken on the page fault path, which can open up the following race condition: CPU 1 CPU 2 MADV_DONTNEED unmap page shoot down TLB entry page fault fail to allocate a huge page killed with SIGBUS free page Fix that race by pulling the locking from __unmap_hugepage_final_range into helper functions called from zap_page_range_single. This ensures page faults stay locked out of the MADV_DONTNEED VMA until the huge pages have actually been freed. Link: https://lkml.kernel.org/r/20231006040020.3677377-4-riel@surriel.com Fixes: 04ada095dcfc ("hugetlb: don't delete vma_lock in hugetlb MADV_DONTNEED processing") Signed-off-by: Rik van Riel <riel(a)surriel.com> Reviewed-by: Mike Kravetz <mike.kravetz(a)oracle.com> Cc: Matthew Wilcox (Oracle) <willy(a)infradead.org> Cc: Muchun Song <muchun.song(a)linux.dev> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h index 065ec022cbb0..47d25a5e1933 100644 --- a/include/linux/hugetlb.h +++ b/include/linux/hugetlb.h @@ -139,7 +139,7 @@ struct page *hugetlb_follow_page_mask(struct vm_area_struct *vma, void unmap_hugepage_range(struct vm_area_struct *, unsigned long, unsigned long, struct page *, zap_flags_t); -void __unmap_hugepage_range_final(struct mmu_gather *tlb, +void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma, unsigned long start, unsigned long end, struct page *ref_page, zap_flags_t zap_flags); @@ -246,6 +246,25 @@ int huge_pmd_unshare(struct mm_struct *mm, struct vm_area_struct *vma, void adjust_range_if_pmd_sharing_possible(struct vm_area_struct *vma, unsigned long *start, unsigned long *end); +extern void __hugetlb_zap_begin(struct vm_area_struct *vma, + unsigned long *begin, unsigned long *end); +extern void __hugetlb_zap_end(struct vm_area_struct *vma, + struct zap_details *details); + +static inline void hugetlb_zap_begin(struct vm_area_struct *vma, + unsigned long *start, unsigned long *end) +{ + if (is_vm_hugetlb_page(vma)) + __hugetlb_zap_begin(vma, start, end); +} + +static inline void hugetlb_zap_end(struct vm_area_struct *vma, + struct zap_details *details) +{ + if (is_vm_hugetlb_page(vma)) + __hugetlb_zap_end(vma, details); +} + void hugetlb_vma_lock_read(struct vm_area_struct *vma); void hugetlb_vma_unlock_read(struct vm_area_struct *vma); void hugetlb_vma_lock_write(struct vm_area_struct *vma); @@ -297,6 +316,18 @@ static inline void adjust_range_if_pmd_sharing_possible( { } +static inline void hugetlb_zap_begin( + struct vm_area_struct *vma, + unsigned long *start, unsigned long *end) +{ +} + +static inline void hugetlb_zap_end( + struct vm_area_struct *vma, + struct zap_details *details) +{ +} + static inline struct page *hugetlb_follow_page_mask( struct vm_area_struct *vma, unsigned long address, unsigned int flags, unsigned int *page_mask) @@ -442,7 +473,7 @@ static inline long hugetlb_change_protection( return 0; } -static inline void __unmap_hugepage_range_final(struct mmu_gather *tlb, +static inline void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma, unsigned long start, unsigned long end, struct page *ref_page, zap_flags_t zap_flags) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index d218ee2b6a99..1301ba7b2c9a 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -5306,9 +5306,9 @@ int move_hugetlb_page_tables(struct vm_area_struct *vma, return len + old_addr - old_end; } -static void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma, - unsigned long start, unsigned long end, - struct page *ref_page, zap_flags_t zap_flags) +void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma, + unsigned long start, unsigned long end, + struct page *ref_page, zap_flags_t zap_flags) { struct mm_struct *mm = vma->vm_mm; unsigned long address; @@ -5437,16 +5437,25 @@ static void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct tlb_flush_mmu_tlbonly(tlb); } -void __unmap_hugepage_range_final(struct mmu_gather *tlb, - struct vm_area_struct *vma, unsigned long start, - unsigned long end, struct page *ref_page, - zap_flags_t zap_flags) +void __hugetlb_zap_begin(struct vm_area_struct *vma, + unsigned long *start, unsigned long *end) { + if (!vma->vm_file) /* hugetlbfs_file_mmap error */ + return; + + adjust_range_if_pmd_sharing_possible(vma, start, end); hugetlb_vma_lock_write(vma); - i_mmap_lock_write(vma->vm_file->f_mapping); + if (vma->vm_file) + i_mmap_lock_write(vma->vm_file->f_mapping); +} - /* mmu notification performed in caller */ - __unmap_hugepage_range(tlb, vma, start, end, ref_page, zap_flags); +void __hugetlb_zap_end(struct vm_area_struct *vma, + struct zap_details *details) +{ + zap_flags_t zap_flags = details ? details->zap_flags : 0; + + if (!vma->vm_file) /* hugetlbfs_file_mmap error */ + return; if (zap_flags & ZAP_FLAG_UNMAP) { /* final unmap */ /* @@ -5459,11 +5468,12 @@ void __unmap_hugepage_range_final(struct mmu_gather *tlb, * someone else. */ __hugetlb_vma_unlock_write_free(vma); - i_mmap_unlock_write(vma->vm_file->f_mapping); } else { - i_mmap_unlock_write(vma->vm_file->f_mapping); hugetlb_vma_unlock_write(vma); } + + if (vma->vm_file) + i_mmap_unlock_write(vma->vm_file->f_mapping); } void unmap_hugepage_range(struct vm_area_struct *vma, unsigned long start, diff --git a/mm/memory.c b/mm/memory.c index 6c264d2f969c..517221f01303 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -1683,7 +1683,7 @@ static void unmap_single_vma(struct mmu_gather *tlb, if (vma->vm_file) { zap_flags_t zap_flags = details ? details->zap_flags : 0; - __unmap_hugepage_range_final(tlb, vma, start, end, + __unmap_hugepage_range(tlb, vma, start, end, NULL, zap_flags); } } else @@ -1728,8 +1728,12 @@ void unmap_vmas(struct mmu_gather *tlb, struct ma_state *mas, start_addr, end_addr); mmu_notifier_invalidate_range_start(&range); do { - unmap_single_vma(tlb, vma, start_addr, end_addr, &details, + unsigned long start = start_addr; + unsigned long end = end_addr; + hugetlb_zap_begin(vma, &start, &end); + unmap_single_vma(tlb, vma, start, end, &details, mm_wr_locked); + hugetlb_zap_end(vma, &details); } while ((vma = mas_find(mas, tree_end - 1)) != NULL); mmu_notifier_invalidate_range_end(&range); } @@ -1753,9 +1757,7 @@ void zap_page_range_single(struct vm_area_struct *vma, unsigned long address, lru_add_drain(); mmu_notifier_range_init(&range, MMU_NOTIFY_CLEAR, 0, vma->vm_mm, address, end); - if (is_vm_hugetlb_page(vma)) - adjust_range_if_pmd_sharing_possible(vma, &range.start, - &range.end); + hugetlb_zap_begin(vma, &range.start, &range.end); tlb_gather_mmu(&tlb, vma->vm_mm); update_hiwater_rss(vma->vm_mm); mmu_notifier_invalidate_range_start(&range); @@ -1766,6 +1768,7 @@ void zap_page_range_single(struct vm_area_struct *vma, unsigned long address, unmap_single_vma(&tlb, vma, address, end, details, false); mmu_notifier_invalidate_range_end(&range); tlb_finish_mmu(&tlb); + hugetlb_zap_end(vma, details); } /**

2 years

1
0
0 0

FAILED: patch "[PATCH] hugetlbfs: close race between MADV_DONTNEED and page fault" failed to apply to 6.5-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.5-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.5.y git checkout FETCH_HEAD git cherry-pick -x 2820b0f09be99f6406784b03a22dfc83e858449d # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023102721-populate-culpable-52a4@gregkh' --subject-prefix 'PATCH 6.5.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 2820b0f09be99f6406784b03a22dfc83e858449d Mon Sep 17 00:00:00 2001 From: Rik van Riel <riel(a)surriel.com> Date: Thu, 5 Oct 2023 23:59:08 -0400 Subject: [PATCH] hugetlbfs: close race between MADV_DONTNEED and page fault Malloc libraries, like jemalloc and tcalloc, take decisions on when to call madvise independently from the code in the main application. This sometimes results in the application page faulting on an address, right after the malloc library has shot down the backing memory with MADV_DONTNEED. Usually this is harmless, because we always have some 4kB pages sitting around to satisfy a page fault. However, with hugetlbfs systems often allocate only the exact number of huge pages that the application wants. Due to TLB batching, hugetlbfs MADV_DONTNEED will free pages outside of any lock taken on the page fault path, which can open up the following race condition: CPU 1 CPU 2 MADV_DONTNEED unmap page shoot down TLB entry page fault fail to allocate a huge page killed with SIGBUS free page Fix that race by pulling the locking from __unmap_hugepage_final_range into helper functions called from zap_page_range_single. This ensures page faults stay locked out of the MADV_DONTNEED VMA until the huge pages have actually been freed. Link: https://lkml.kernel.org/r/20231006040020.3677377-4-riel@surriel.com Fixes: 04ada095dcfc ("hugetlb: don't delete vma_lock in hugetlb MADV_DONTNEED processing") Signed-off-by: Rik van Riel <riel(a)surriel.com> Reviewed-by: Mike Kravetz <mike.kravetz(a)oracle.com> Cc: Matthew Wilcox (Oracle) <willy(a)infradead.org> Cc: Muchun Song <muchun.song(a)linux.dev> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h index 065ec022cbb0..47d25a5e1933 100644 --- a/include/linux/hugetlb.h +++ b/include/linux/hugetlb.h @@ -139,7 +139,7 @@ struct page *hugetlb_follow_page_mask(struct vm_area_struct *vma, void unmap_hugepage_range(struct vm_area_struct *, unsigned long, unsigned long, struct page *, zap_flags_t); -void __unmap_hugepage_range_final(struct mmu_gather *tlb, +void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma, unsigned long start, unsigned long end, struct page *ref_page, zap_flags_t zap_flags); @@ -246,6 +246,25 @@ int huge_pmd_unshare(struct mm_struct *mm, struct vm_area_struct *vma, void adjust_range_if_pmd_sharing_possible(struct vm_area_struct *vma, unsigned long *start, unsigned long *end); +extern void __hugetlb_zap_begin(struct vm_area_struct *vma, + unsigned long *begin, unsigned long *end); +extern void __hugetlb_zap_end(struct vm_area_struct *vma, + struct zap_details *details); + +static inline void hugetlb_zap_begin(struct vm_area_struct *vma, + unsigned long *start, unsigned long *end) +{ + if (is_vm_hugetlb_page(vma)) + __hugetlb_zap_begin(vma, start, end); +} + +static inline void hugetlb_zap_end(struct vm_area_struct *vma, + struct zap_details *details) +{ + if (is_vm_hugetlb_page(vma)) + __hugetlb_zap_end(vma, details); +} + void hugetlb_vma_lock_read(struct vm_area_struct *vma); void hugetlb_vma_unlock_read(struct vm_area_struct *vma); void hugetlb_vma_lock_write(struct vm_area_struct *vma); @@ -297,6 +316,18 @@ static inline void adjust_range_if_pmd_sharing_possible( { } +static inline void hugetlb_zap_begin( + struct vm_area_struct *vma, + unsigned long *start, unsigned long *end) +{ +} + +static inline void hugetlb_zap_end( + struct vm_area_struct *vma, + struct zap_details *details) +{ +} + static inline struct page *hugetlb_follow_page_mask( struct vm_area_struct *vma, unsigned long address, unsigned int flags, unsigned int *page_mask) @@ -442,7 +473,7 @@ static inline long hugetlb_change_protection( return 0; } -static inline void __unmap_hugepage_range_final(struct mmu_gather *tlb, +static inline void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma, unsigned long start, unsigned long end, struct page *ref_page, zap_flags_t zap_flags) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index d218ee2b6a99..1301ba7b2c9a 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -5306,9 +5306,9 @@ int move_hugetlb_page_tables(struct vm_area_struct *vma, return len + old_addr - old_end; } -static void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma, - unsigned long start, unsigned long end, - struct page *ref_page, zap_flags_t zap_flags) +void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma, + unsigned long start, unsigned long end, + struct page *ref_page, zap_flags_t zap_flags) { struct mm_struct *mm = vma->vm_mm; unsigned long address; @@ -5437,16 +5437,25 @@ static void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct tlb_flush_mmu_tlbonly(tlb); } -void __unmap_hugepage_range_final(struct mmu_gather *tlb, - struct vm_area_struct *vma, unsigned long start, - unsigned long end, struct page *ref_page, - zap_flags_t zap_flags) +void __hugetlb_zap_begin(struct vm_area_struct *vma, + unsigned long *start, unsigned long *end) { + if (!vma->vm_file) /* hugetlbfs_file_mmap error */ + return; + + adjust_range_if_pmd_sharing_possible(vma, start, end); hugetlb_vma_lock_write(vma); - i_mmap_lock_write(vma->vm_file->f_mapping); + if (vma->vm_file) + i_mmap_lock_write(vma->vm_file->f_mapping); +} - /* mmu notification performed in caller */ - __unmap_hugepage_range(tlb, vma, start, end, ref_page, zap_flags); +void __hugetlb_zap_end(struct vm_area_struct *vma, + struct zap_details *details) +{ + zap_flags_t zap_flags = details ? details->zap_flags : 0; + + if (!vma->vm_file) /* hugetlbfs_file_mmap error */ + return; if (zap_flags & ZAP_FLAG_UNMAP) { /* final unmap */ /* @@ -5459,11 +5468,12 @@ void __unmap_hugepage_range_final(struct mmu_gather *tlb, * someone else. */ __hugetlb_vma_unlock_write_free(vma); - i_mmap_unlock_write(vma->vm_file->f_mapping); } else { - i_mmap_unlock_write(vma->vm_file->f_mapping); hugetlb_vma_unlock_write(vma); } + + if (vma->vm_file) + i_mmap_unlock_write(vma->vm_file->f_mapping); } void unmap_hugepage_range(struct vm_area_struct *vma, unsigned long start, diff --git a/mm/memory.c b/mm/memory.c index 6c264d2f969c..517221f01303 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -1683,7 +1683,7 @@ static void unmap_single_vma(struct mmu_gather *tlb, if (vma->vm_file) { zap_flags_t zap_flags = details ? details->zap_flags : 0; - __unmap_hugepage_range_final(tlb, vma, start, end, + __unmap_hugepage_range(tlb, vma, start, end, NULL, zap_flags); } } else @@ -1728,8 +1728,12 @@ void unmap_vmas(struct mmu_gather *tlb, struct ma_state *mas, start_addr, end_addr); mmu_notifier_invalidate_range_start(&range); do { - unmap_single_vma(tlb, vma, start_addr, end_addr, &details, + unsigned long start = start_addr; + unsigned long end = end_addr; + hugetlb_zap_begin(vma, &start, &end); + unmap_single_vma(tlb, vma, start, end, &details, mm_wr_locked); + hugetlb_zap_end(vma, &details); } while ((vma = mas_find(mas, tree_end - 1)) != NULL); mmu_notifier_invalidate_range_end(&range); } @@ -1753,9 +1757,7 @@ void zap_page_range_single(struct vm_area_struct *vma, unsigned long address, lru_add_drain(); mmu_notifier_range_init(&range, MMU_NOTIFY_CLEAR, 0, vma->vm_mm, address, end); - if (is_vm_hugetlb_page(vma)) - adjust_range_if_pmd_sharing_possible(vma, &range.start, - &range.end); + hugetlb_zap_begin(vma, &range.start, &range.end); tlb_gather_mmu(&tlb, vma->vm_mm); update_hiwater_rss(vma->vm_mm); mmu_notifier_invalidate_range_start(&range); @@ -1766,6 +1768,7 @@ void zap_page_range_single(struct vm_area_struct *vma, unsigned long address, unmap_single_vma(&tlb, vma, address, end, details, false); mmu_notifier_invalidate_range_end(&range); tlb_finish_mmu(&tlb); + hugetlb_zap_end(vma, details); } /**

2 years

1
0
0 0

[PATCH v5.10.199] mmc: renesas_sdhi: use custom mask for TMIO_MASK_ALL

by Geert Uytterhoeven

From: Wolfram Sang <wsa+renesas(a)sang-engineering.com> [ Upstream commit 9f12cac1bb88e3296990e760d867a98308d6b0ac ] Populate the new member for custom mask values to make sure this value is applied whenever needed. Also, rename the define holding the value because this is not only about initialization anymore. Signed-off-by: Wolfram Sang <wsa+renesas(a)sang-engineering.com> Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com> Tested-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com> Link: https://lore.kernel.org/r/20210304092903.8534-1-wsa+renesas@sang-engineerin… Signed-off-by: Ulf Hansson <ulf.hansson(a)linaro.org> [geert: Backport to v5.10.199] Signed-off-by: Geert Uytterhoeven <geert+renesas(a)glider.be> --- Fixes: 6d3745bbc3341d3b ("mmc: renesas_sdhi: register irqs before registering controller") drivers/mmc/host/renesas_sdhi_core.c | 3 ++- drivers/mmc/host/tmio_mmc.h | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/mmc/host/renesas_sdhi_core.c b/drivers/mmc/host/renesas_sdhi_core.c index be4c2a848b52051e..24e524a1b9274168 100644 --- a/drivers/mmc/host/renesas_sdhi_core.c +++ b/drivers/mmc/host/renesas_sdhi_core.c @@ -571,7 +571,7 @@ static void renesas_sdhi_reset(struct tmio_mmc_host *host) if (host->pdata->flags & TMIO_MMC_MIN_RCAR2) sd_ctrl_write32_as_16_and_16(host, CTL_IRQ_MASK, - TMIO_MASK_INIT_RCAR2); + TMIO_MASK_ALL_RCAR2); } #define SH_MOBILE_SDHI_MIN_TAP_ROW 3 @@ -1012,6 +1012,7 @@ int renesas_sdhi_probe(struct platform_device *pdev, host->ops.start_signal_voltage_switch = renesas_sdhi_start_signal_voltage_switch; host->sdcard_irq_setbit_mask = TMIO_STAT_ALWAYS_SET_27; + host->sdcard_irq_mask_all = TMIO_MASK_ALL_RCAR2; host->reset = renesas_sdhi_reset; } else { host->sdcard_irq_mask_all = TMIO_MASK_ALL; diff --git a/drivers/mmc/host/tmio_mmc.h b/drivers/mmc/host/tmio_mmc.h index d6ed5e1f8386e459..330a17267f7eddba 100644 --- a/drivers/mmc/host/tmio_mmc.h +++ b/drivers/mmc/host/tmio_mmc.h @@ -97,8 +97,8 @@ /* Define some IRQ masks */ /* This is the mask used at reset by the chip */ -#define TMIO_MASK_INIT_RCAR2 0x8b7f031d /* Initial value for R-Car Gen2+ */ #define TMIO_MASK_ALL 0x837f031d +#define TMIO_MASK_ALL_RCAR2 0x8b7f031d #define TMIO_MASK_READOP (TMIO_STAT_RXRDY | TMIO_STAT_DATAEND) #define TMIO_MASK_WRITEOP (TMIO_STAT_TXRQ | TMIO_STAT_DATAEND) #define TMIO_MASK_CMD (TMIO_STAT_CMDRESPEND | TMIO_STAT_CMDTIMEOUT | \ -- 2.34.1

2 years

2
1
0 0

FAILED: patch "[PATCH] mm: zswap: fix pool refcount bug around shrink_worker()" failed to apply to 5.10-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y git checkout FETCH_HEAD git cherry-pick -x 969d63e1af3b3abe35a49b08218f3125131ac32f # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023102756-untainted-stinging-5142@gregkh' --subject-prefix 'PATCH 5.10.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 969d63e1af3b3abe35a49b08218f3125131ac32f Mon Sep 17 00:00:00 2001 From: Johannes Weiner <hannes(a)cmpxchg.org> Date: Fri, 6 Oct 2023 12:00:24 -0400 Subject: [PATCH] mm: zswap: fix pool refcount bug around shrink_worker() When a zswap store fails due to the limit, it acquires a pool reference and queues the shrinker. When the shrinker runs, it drops the reference. However, there can be multiple store attempts before the shrinker wakes up and runs once. This results in reference leaks and eventual saturation warnings for the pool refcount. Fix this by dropping the reference again when the shrinker is already queued. This ensures one reference per shrinker run. Link: https://lkml.kernel.org/r/20231006160024.170748-1-hannes@cmpxchg.org Fixes: 45190f01dd40 ("mm/zswap.c: add allocation hysteresis if pool limit is hit") Signed-off-by: Johannes Weiner <hannes(a)cmpxchg.org> Reported-by: Chris Mason <clm(a)fb.com> Acked-by: Nhat Pham <nphamcs(a)gmail.com> Cc: Vitaly Wool <vitaly.wool(a)konsulko.com> Cc: Domenico Cerasuolo <cerasuolodomenico(a)gmail.com> Cc: <stable(a)vger.kernel.org> [5.6+] Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> diff --git a/mm/zswap.c b/mm/zswap.c index 083c693602b8..37d2b1cb2ecb 100644 --- a/mm/zswap.c +++ b/mm/zswap.c @@ -1383,8 +1383,8 @@ bool zswap_store(struct folio *folio) shrink: pool = zswap_pool_last_get(); - if (pool) - queue_work(shrink_wq, &pool->shrink_work); + if (pool && !queue_work(shrink_wq, &pool->shrink_work)) + zswap_pool_put(pool); goto reject; }

2 years

1
0
0 0

FAILED: patch "[PATCH] mm: zswap: fix pool refcount bug around shrink_worker()" failed to apply to 5.15-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.15-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y git checkout FETCH_HEAD git cherry-pick -x 969d63e1af3b3abe35a49b08218f3125131ac32f # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023102755-recess-lair-ef90@gregkh' --subject-prefix 'PATCH 5.15.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 969d63e1af3b3abe35a49b08218f3125131ac32f Mon Sep 17 00:00:00 2001 From: Johannes Weiner <hannes(a)cmpxchg.org> Date: Fri, 6 Oct 2023 12:00:24 -0400 Subject: [PATCH] mm: zswap: fix pool refcount bug around shrink_worker() When a zswap store fails due to the limit, it acquires a pool reference and queues the shrinker. When the shrinker runs, it drops the reference. However, there can be multiple store attempts before the shrinker wakes up and runs once. This results in reference leaks and eventual saturation warnings for the pool refcount. Fix this by dropping the reference again when the shrinker is already queued. This ensures one reference per shrinker run. Link: https://lkml.kernel.org/r/20231006160024.170748-1-hannes@cmpxchg.org Fixes: 45190f01dd40 ("mm/zswap.c: add allocation hysteresis if pool limit is hit") Signed-off-by: Johannes Weiner <hannes(a)cmpxchg.org> Reported-by: Chris Mason <clm(a)fb.com> Acked-by: Nhat Pham <nphamcs(a)gmail.com> Cc: Vitaly Wool <vitaly.wool(a)konsulko.com> Cc: Domenico Cerasuolo <cerasuolodomenico(a)gmail.com> Cc: <stable(a)vger.kernel.org> [5.6+] Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> diff --git a/mm/zswap.c b/mm/zswap.c index 083c693602b8..37d2b1cb2ecb 100644 --- a/mm/zswap.c +++ b/mm/zswap.c @@ -1383,8 +1383,8 @@ bool zswap_store(struct folio *folio) shrink: pool = zswap_pool_last_get(); - if (pool) - queue_work(shrink_wq, &pool->shrink_work); + if (pool && !queue_work(shrink_wq, &pool->shrink_work)) + zswap_pool_put(pool); goto reject; }

2 years

1
0
0 0

FAILED: patch "[PATCH] mm: zswap: fix pool refcount bug around shrink_worker()" failed to apply to 6.1-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.1-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y git checkout FETCH_HEAD git cherry-pick -x 969d63e1af3b3abe35a49b08218f3125131ac32f # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023102753-progress-creatable-e21d@gregkh' --subject-prefix 'PATCH 6.1.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 969d63e1af3b3abe35a49b08218f3125131ac32f Mon Sep 17 00:00:00 2001 From: Johannes Weiner <hannes(a)cmpxchg.org> Date: Fri, 6 Oct 2023 12:00:24 -0400 Subject: [PATCH] mm: zswap: fix pool refcount bug around shrink_worker() When a zswap store fails due to the limit, it acquires a pool reference and queues the shrinker. When the shrinker runs, it drops the reference. However, there can be multiple store attempts before the shrinker wakes up and runs once. This results in reference leaks and eventual saturation warnings for the pool refcount. Fix this by dropping the reference again when the shrinker is already queued. This ensures one reference per shrinker run. Link: https://lkml.kernel.org/r/20231006160024.170748-1-hannes@cmpxchg.org Fixes: 45190f01dd40 ("mm/zswap.c: add allocation hysteresis if pool limit is hit") Signed-off-by: Johannes Weiner <hannes(a)cmpxchg.org> Reported-by: Chris Mason <clm(a)fb.com> Acked-by: Nhat Pham <nphamcs(a)gmail.com> Cc: Vitaly Wool <vitaly.wool(a)konsulko.com> Cc: Domenico Cerasuolo <cerasuolodomenico(a)gmail.com> Cc: <stable(a)vger.kernel.org> [5.6+] Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> diff --git a/mm/zswap.c b/mm/zswap.c index 083c693602b8..37d2b1cb2ecb 100644 --- a/mm/zswap.c +++ b/mm/zswap.c @@ -1383,8 +1383,8 @@ bool zswap_store(struct folio *folio) shrink: pool = zswap_pool_last_get(); - if (pool) - queue_work(shrink_wq, &pool->shrink_work); + if (pool && !queue_work(shrink_wq, &pool->shrink_work)) + zswap_pool_put(pool); goto reject; }

2 years

1
0
0 0

FAILED: patch "[PATCH] mm: zswap: fix pool refcount bug around shrink_worker()" failed to apply to 6.5-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.5-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.5.y git checkout FETCH_HEAD git cherry-pick -x 969d63e1af3b3abe35a49b08218f3125131ac32f # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023102752-rift-applicant-8761@gregkh' --subject-prefix 'PATCH 6.5.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 969d63e1af3b3abe35a49b08218f3125131ac32f Mon Sep 17 00:00:00 2001 From: Johannes Weiner <hannes(a)cmpxchg.org> Date: Fri, 6 Oct 2023 12:00:24 -0400 Subject: [PATCH] mm: zswap: fix pool refcount bug around shrink_worker() When a zswap store fails due to the limit, it acquires a pool reference and queues the shrinker. When the shrinker runs, it drops the reference. However, there can be multiple store attempts before the shrinker wakes up and runs once. This results in reference leaks and eventual saturation warnings for the pool refcount. Fix this by dropping the reference again when the shrinker is already queued. This ensures one reference per shrinker run. Link: https://lkml.kernel.org/r/20231006160024.170748-1-hannes@cmpxchg.org Fixes: 45190f01dd40 ("mm/zswap.c: add allocation hysteresis if pool limit is hit") Signed-off-by: Johannes Weiner <hannes(a)cmpxchg.org> Reported-by: Chris Mason <clm(a)fb.com> Acked-by: Nhat Pham <nphamcs(a)gmail.com> Cc: Vitaly Wool <vitaly.wool(a)konsulko.com> Cc: Domenico Cerasuolo <cerasuolodomenico(a)gmail.com> Cc: <stable(a)vger.kernel.org> [5.6+] Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> diff --git a/mm/zswap.c b/mm/zswap.c index 083c693602b8..37d2b1cb2ecb 100644 --- a/mm/zswap.c +++ b/mm/zswap.c @@ -1383,8 +1383,8 @@ bool zswap_store(struct folio *folio) shrink: pool = zswap_pool_last_get(); - if (pool) - queue_work(shrink_wq, &pool->shrink_work); + if (pool && !queue_work(shrink_wq, &pool->shrink_work)) + zswap_pool_put(pool); goto reject; }

2 years

1
0
0 0

FAILED: patch "[PATCH] net: stmmac: update MAC capabilities when tx queues are" failed to apply to 5.10-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y git checkout FETCH_HEAD git cherry-pick -x 95201f36f395df34321fcddbce12103e8bbe4970 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023102754-tracing-flavored-8157@gregkh' --subject-prefix 'PATCH 5.10.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 95201f36f395df34321fcddbce12103e8bbe4970 Mon Sep 17 00:00:00 2001 From: Michael Sit Wei Hong <michael.wei.hong.sit(a)intel.com> Date: Fri, 20 Oct 2023 11:25:35 +0800 Subject: [PATCH] net: stmmac: update MAC capabilities when tx queues are updated Upon boot up, the driver will configure the MAC capabilities based on the maximum number of tx and rx queues. When the user changes the tx queues to single queue, the MAC should be capable of supporting Half Duplex, but the driver does not update the MAC capabilities when it is configured so. Using the stmmac_reinit_queues() to check the number of tx queues and set the MAC capabilities accordingly. Fixes: 0366f7e06a6b ("net: stmmac: add ethtool support for get/set channels") Cc: <stable(a)vger.kernel.org> # 5.17+ Signed-off-by: Michael Sit Wei Hong <michael.wei.hong.sit(a)intel.com> Signed-off-by: Gan, Yi Fang <yi.fang.gan(a)intel.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c index ed1a5a31a491..5801f4d50f95 100644 --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c @@ -1197,6 +1197,17 @@ static int stmmac_init_phy(struct net_device *dev) return ret; } +static void stmmac_set_half_duplex(struct stmmac_priv *priv) +{ + /* Half-Duplex can only work with single tx queue */ + if (priv->plat->tx_queues_to_use > 1) + priv->phylink_config.mac_capabilities &= + ~(MAC_10HD | MAC_100HD | MAC_1000HD); + else + priv->phylink_config.mac_capabilities |= + (MAC_10HD | MAC_100HD | MAC_1000HD); +} + static int stmmac_phy_setup(struct stmmac_priv *priv) { struct stmmac_mdio_bus_data *mdio_bus_data; @@ -1228,10 +1239,7 @@ static int stmmac_phy_setup(struct stmmac_priv *priv) MAC_10FD | MAC_100FD | MAC_1000FD; - /* Half-Duplex can only work with single queue */ - if (priv->plat->tx_queues_to_use <= 1) - priv->phylink_config.mac_capabilities |= MAC_10HD | MAC_100HD | - MAC_1000HD; + stmmac_set_half_duplex(priv); /* Get the MAC specific capabilities */ stmmac_mac_phylink_get_caps(priv); @@ -7172,6 +7180,7 @@ int stmmac_reinit_queues(struct net_device *dev, u32 rx_cnt, u32 tx_cnt) priv->rss.table[i] = ethtool_rxfh_indir_default(i, rx_cnt); + stmmac_set_half_duplex(priv); stmmac_napi_add(dev); if (netif_running(dev))

2 years

1
0
0 0

FAILED: patch "[PATCH] net: stmmac: update MAC capabilities when tx queues are" failed to apply to 5.15-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.15-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y git checkout FETCH_HEAD git cherry-pick -x 95201f36f395df34321fcddbce12103e8bbe4970 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023102753-jovial-shifting-c677@gregkh' --subject-prefix 'PATCH 5.15.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 95201f36f395df34321fcddbce12103e8bbe4970 Mon Sep 17 00:00:00 2001 From: Michael Sit Wei Hong <michael.wei.hong.sit(a)intel.com> Date: Fri, 20 Oct 2023 11:25:35 +0800 Subject: [PATCH] net: stmmac: update MAC capabilities when tx queues are updated Upon boot up, the driver will configure the MAC capabilities based on the maximum number of tx and rx queues. When the user changes the tx queues to single queue, the MAC should be capable of supporting Half Duplex, but the driver does not update the MAC capabilities when it is configured so. Using the stmmac_reinit_queues() to check the number of tx queues and set the MAC capabilities accordingly. Fixes: 0366f7e06a6b ("net: stmmac: add ethtool support for get/set channels") Cc: <stable(a)vger.kernel.org> # 5.17+ Signed-off-by: Michael Sit Wei Hong <michael.wei.hong.sit(a)intel.com> Signed-off-by: Gan, Yi Fang <yi.fang.gan(a)intel.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c index ed1a5a31a491..5801f4d50f95 100644 --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c @@ -1197,6 +1197,17 @@ static int stmmac_init_phy(struct net_device *dev) return ret; } +static void stmmac_set_half_duplex(struct stmmac_priv *priv) +{ + /* Half-Duplex can only work with single tx queue */ + if (priv->plat->tx_queues_to_use > 1) + priv->phylink_config.mac_capabilities &= + ~(MAC_10HD | MAC_100HD | MAC_1000HD); + else + priv->phylink_config.mac_capabilities |= + (MAC_10HD | MAC_100HD | MAC_1000HD); +} + static int stmmac_phy_setup(struct stmmac_priv *priv) { struct stmmac_mdio_bus_data *mdio_bus_data; @@ -1228,10 +1239,7 @@ static int stmmac_phy_setup(struct stmmac_priv *priv) MAC_10FD | MAC_100FD | MAC_1000FD; - /* Half-Duplex can only work with single queue */ - if (priv->plat->tx_queues_to_use <= 1) - priv->phylink_config.mac_capabilities |= MAC_10HD | MAC_100HD | - MAC_1000HD; + stmmac_set_half_duplex(priv); /* Get the MAC specific capabilities */ stmmac_mac_phylink_get_caps(priv); @@ -7172,6 +7180,7 @@ int stmmac_reinit_queues(struct net_device *dev, u32 rx_cnt, u32 tx_cnt) priv->rss.table[i] = ethtool_rxfh_indir_default(i, rx_cnt); + stmmac_set_half_duplex(priv); stmmac_napi_add(dev); if (netif_running(dev))

2 years

1
0
0 0

FAILED: patch "[PATCH] net: stmmac: update MAC capabilities when tx queues are" failed to apply to 6.1-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.1-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y git checkout FETCH_HEAD git cherry-pick -x 95201f36f395df34321fcddbce12103e8bbe4970 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023102752-maturely-stardom-066f@gregkh' --subject-prefix 'PATCH 6.1.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 95201f36f395df34321fcddbce12103e8bbe4970 Mon Sep 17 00:00:00 2001 From: Michael Sit Wei Hong <michael.wei.hong.sit(a)intel.com> Date: Fri, 20 Oct 2023 11:25:35 +0800 Subject: [PATCH] net: stmmac: update MAC capabilities when tx queues are updated Upon boot up, the driver will configure the MAC capabilities based on the maximum number of tx and rx queues. When the user changes the tx queues to single queue, the MAC should be capable of supporting Half Duplex, but the driver does not update the MAC capabilities when it is configured so. Using the stmmac_reinit_queues() to check the number of tx queues and set the MAC capabilities accordingly. Fixes: 0366f7e06a6b ("net: stmmac: add ethtool support for get/set channels") Cc: <stable(a)vger.kernel.org> # 5.17+ Signed-off-by: Michael Sit Wei Hong <michael.wei.hong.sit(a)intel.com> Signed-off-by: Gan, Yi Fang <yi.fang.gan(a)intel.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c index ed1a5a31a491..5801f4d50f95 100644 --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c @@ -1197,6 +1197,17 @@ static int stmmac_init_phy(struct net_device *dev) return ret; } +static void stmmac_set_half_duplex(struct stmmac_priv *priv) +{ + /* Half-Duplex can only work with single tx queue */ + if (priv->plat->tx_queues_to_use > 1) + priv->phylink_config.mac_capabilities &= + ~(MAC_10HD | MAC_100HD | MAC_1000HD); + else + priv->phylink_config.mac_capabilities |= + (MAC_10HD | MAC_100HD | MAC_1000HD); +} + static int stmmac_phy_setup(struct stmmac_priv *priv) { struct stmmac_mdio_bus_data *mdio_bus_data; @@ -1228,10 +1239,7 @@ static int stmmac_phy_setup(struct stmmac_priv *priv) MAC_10FD | MAC_100FD | MAC_1000FD; - /* Half-Duplex can only work with single queue */ - if (priv->plat->tx_queues_to_use <= 1) - priv->phylink_config.mac_capabilities |= MAC_10HD | MAC_100HD | - MAC_1000HD; + stmmac_set_half_duplex(priv); /* Get the MAC specific capabilities */ stmmac_mac_phylink_get_caps(priv); @@ -7172,6 +7180,7 @@ int stmmac_reinit_queues(struct net_device *dev, u32 rx_cnt, u32 tx_cnt) priv->rss.table[i] = ethtool_rxfh_indir_default(i, rx_cnt); + stmmac_set_half_duplex(priv); stmmac_napi_add(dev); if (netif_running(dev))

2 years

1
0
0 0

FAILED: patch "[PATCH] net: stmmac: update MAC capabilities when tx queues are" failed to apply to 6.5-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.5-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.5.y git checkout FETCH_HEAD git cherry-pick -x 95201f36f395df34321fcddbce12103e8bbe4970 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023102751-playful-marbled-4744@gregkh' --subject-prefix 'PATCH 6.5.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 95201f36f395df34321fcddbce12103e8bbe4970 Mon Sep 17 00:00:00 2001 From: Michael Sit Wei Hong <michael.wei.hong.sit(a)intel.com> Date: Fri, 20 Oct 2023 11:25:35 +0800 Subject: [PATCH] net: stmmac: update MAC capabilities when tx queues are updated Upon boot up, the driver will configure the MAC capabilities based on the maximum number of tx and rx queues. When the user changes the tx queues to single queue, the MAC should be capable of supporting Half Duplex, but the driver does not update the MAC capabilities when it is configured so. Using the stmmac_reinit_queues() to check the number of tx queues and set the MAC capabilities accordingly. Fixes: 0366f7e06a6b ("net: stmmac: add ethtool support for get/set channels") Cc: <stable(a)vger.kernel.org> # 5.17+ Signed-off-by: Michael Sit Wei Hong <michael.wei.hong.sit(a)intel.com> Signed-off-by: Gan, Yi Fang <yi.fang.gan(a)intel.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c index ed1a5a31a491..5801f4d50f95 100644 --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c @@ -1197,6 +1197,17 @@ static int stmmac_init_phy(struct net_device *dev) return ret; } +static void stmmac_set_half_duplex(struct stmmac_priv *priv) +{ + /* Half-Duplex can only work with single tx queue */ + if (priv->plat->tx_queues_to_use > 1) + priv->phylink_config.mac_capabilities &= + ~(MAC_10HD | MAC_100HD | MAC_1000HD); + else + priv->phylink_config.mac_capabilities |= + (MAC_10HD | MAC_100HD | MAC_1000HD); +} + static int stmmac_phy_setup(struct stmmac_priv *priv) { struct stmmac_mdio_bus_data *mdio_bus_data; @@ -1228,10 +1239,7 @@ static int stmmac_phy_setup(struct stmmac_priv *priv) MAC_10FD | MAC_100FD | MAC_1000FD; - /* Half-Duplex can only work with single queue */ - if (priv->plat->tx_queues_to_use <= 1) - priv->phylink_config.mac_capabilities |= MAC_10HD | MAC_100HD | - MAC_1000HD; + stmmac_set_half_duplex(priv); /* Get the MAC specific capabilities */ stmmac_mac_phylink_get_caps(priv); @@ -7172,6 +7180,7 @@ int stmmac_reinit_queues(struct net_device *dev, u32 rx_cnt, u32 tx_cnt) priv->rss.table[i] = ethtool_rxfh_indir_default(i, rx_cnt); + stmmac_set_half_duplex(priv); stmmac_napi_add(dev); if (netif_running(dev))

2 years

1
0
0 0

FAILED: patch "[PATCH] btrfs: fix unwritten extent buffer after snapshotting a new" failed to apply to 6.5-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.5-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.5.y git checkout FETCH_HEAD git cherry-pick -x eb96e221937af3c7bb8a63208dbab813ca5d3d7e # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023102711-dizziness-ethanol-ecdd@gregkh' --subject-prefix 'PATCH 6.5.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From eb96e221937af3c7bb8a63208dbab813ca5d3d7e Mon Sep 17 00:00:00 2001 From: Filipe Manana <fdmanana(a)suse.com> Date: Thu, 19 Oct 2023 13:19:28 +0100 Subject: [PATCH] btrfs: fix unwritten extent buffer after snapshotting a new subvolume When creating a snapshot of a subvolume that was created in the current transaction, we can end up not persisting a dirty extent buffer that is referenced by the snapshot, resulting in IO errors due to checksum failures when trying to read the extent buffer later from disk. A sequence of steps that leads to this is the following: 1) At ioctl.c:create_subvol() we allocate an extent buffer, with logical address 36007936, for the leaf/root of a new subvolume that has an ID of 291. We mark the extent buffer as dirty, and at this point the subvolume tree has a single node/leaf which is also its root (level 0); 2) We no longer commit the transaction used to create the subvolume at create_subvol(). We used to, but that was recently removed in commit 1b53e51a4a8f ("btrfs: don't commit transaction for every subvol create"); 3) The transaction used to create the subvolume has an ID of 33, so the extent buffer 36007936 has a generation of 33; 4) Several updates happen to subvolume 291 during transaction 33, several files created and its tree height changes from 0 to 1, so we end up with a new root at level 1 and the extent buffer 36007936 is now a leaf of that new root node, which is extent buffer 36048896. The commit root remains as 36007936, since we are still at transaction 33; 5) Creation of a snapshot of subvolume 291, with an ID of 292, starts at ioctl.c:create_snapshot(). This triggers a commit of transaction 33 and we end up at transaction.c:create_pending_snapshot(), in the critical section of a transaction commit. There we COW the root of subvolume 291, which is extent buffer 36048896. The COW operation returns extent buffer 36048896, since there's no need to COW because the extent buffer was created in this transaction and it was not written yet. The we call btrfs_copy_root() against the root node 36048896. During this operation we allocate a new extent buffer to turn into the root node of the snapshot, copy the contents of the root node 36048896 into this snapshot root extent buffer, set the owner to 292 (the ID of the snapshot), etc, and then we call btrfs_inc_ref(). This will create a delayed reference for each leaf pointed by the root node with a reference root of 292 - this includes a reference for the leaf 36007936. After that we set the bit BTRFS_ROOT_FORCE_COW in the root's state. Then we call btrfs_insert_dir_item(), to create the directory entry in in the tree of subvolume 291 that points to the snapshot. This ends up needing to modify leaf 36007936 to insert the respective directory items. Because the bit BTRFS_ROOT_FORCE_COW is set for the root's state, we need to COW the leaf. We end up at btrfs_force_cow_block() and then at update_ref_for_cow(). At update_ref_for_cow() we call btrfs_block_can_be_shared() which returns false, despite the fact the leaf 36007936 is shared - the subvolume's root and the snapshot's root point to that leaf. The reason that it incorrectly returns false is because the commit root of the subvolume is extent buffer 36007936 - it was the initial root of the subvolume when we created it. So btrfs_block_can_be_shared() which has the following logic: int btrfs_block_can_be_shared(struct btrfs_root *root, struct extent_buffer *buf) { if (test_bit(BTRFS_ROOT_SHAREABLE, &root->state) && buf != root->node && buf != root->commit_root && (btrfs_header_generation(buf) <= btrfs_root_last_snapshot(&root->root_item) || btrfs_header_flag(buf, BTRFS_HEADER_FLAG_RELOC))) return 1; return 0; } Returns false (0) since 'buf' (extent buffer 36007936) matches the root's commit root. As a result, at update_ref_for_cow(), we don't check for the number of references for extent buffer 36007936, we just assume it's not shared and therefore that it has only 1 reference, so we set the local variable 'refs' to 1. Later on, in the final if-else statement at update_ref_for_cow(): static noinline int update_ref_for_cow(struct btrfs_trans_handle *trans, struct btrfs_root *root, struct extent_buffer *buf, struct extent_buffer *cow, int *last_ref) { (...) if (refs > 1) { (...) } else { (...) btrfs_clear_buffer_dirty(trans, buf); *last_ref = 1; } } So we mark the extent buffer 36007936 as not dirty, and as a result we don't write it to disk later in the transaction commit, despite the fact that the snapshot's root points to it. Attempting to access the leaf or dumping the tree for example shows that the extent buffer was not written: $ btrfs inspect-internal dump-tree -t 292 /dev/sdb btrfs-progs v6.2.2 file tree key (292 ROOT_ITEM 33) node 36110336 level 1 items 2 free space 119 generation 33 owner 292 node 36110336 flags 0x1(WRITTEN) backref revision 1 checksum stored a8103e3e checksum calced a8103e3e fs uuid 90c9a46f-ae9f-4626-9aff-0cbf3e2e3a79 chunk uuid e8c9c885-78f4-4d31-85fe-89e5f5fd4a07 key (256 INODE_ITEM 0) block 36007936 gen 33 key (257 EXTENT_DATA 0) block 36052992 gen 33 checksum verify failed on 36007936 wanted 0x00000000 found 0x86005f29 checksum verify failed on 36007936 wanted 0x00000000 found 0x86005f29 total bytes 107374182400 bytes used 38572032 uuid 90c9a46f-ae9f-4626-9aff-0cbf3e2e3a79 The respective on disk region is full of zeroes as the device was trimmed at mkfs time. Obviously 'btrfs check' also detects and complains about this: $ btrfs check /dev/sdb Opening filesystem to check... Checking filesystem on /dev/sdb UUID: 90c9a46f-ae9f-4626-9aff-0cbf3e2e3a79 generation: 33 (33) [1/7] checking root items [2/7] checking extents checksum verify failed on 36007936 wanted 0x00000000 found 0x86005f29 checksum verify failed on 36007936 wanted 0x00000000 found 0x86005f29 checksum verify failed on 36007936 wanted 0x00000000 found 0x86005f29 bad tree block 36007936, bytenr mismatch, want=36007936, have=0 owner ref check failed [36007936 4096] ERROR: errors found in extent allocation tree or chunk allocation [3/7] checking free space tree [4/7] checking fs roots checksum verify failed on 36007936 wanted 0x00000000 found 0x86005f29 checksum verify failed on 36007936 wanted 0x00000000 found 0x86005f29 checksum verify failed on 36007936 wanted 0x00000000 found 0x86005f29 bad tree block 36007936, bytenr mismatch, want=36007936, have=0 The following tree block(s) is corrupted in tree 292: tree block bytenr: 36110336, level: 1, node key: (256, 1, 0) root 292 root dir 256 not found ERROR: errors found in fs roots found 38572032 bytes used, error(s) found total csum bytes: 16048 total tree bytes: 1265664 total fs tree bytes: 1118208 total extent tree bytes: 65536 btree space waste bytes: 562598 file data blocks allocated: 65978368 referenced 36569088 Fix this by updating btrfs_block_can_be_shared() to consider that an extent buffer may be shared if it matches the commit root and if its generation matches the current transaction's generation. This can be reproduced with the following script: $ cat test.sh #!/bin/bash MNT=/mnt/sdi DEV=/dev/sdi # Use a filesystem with a 64K node size so that we have the same node # size on every machine regardless of its page size (on x86_64 default # node size is 16K due to the 4K page size, while on PPC it's 64K by # default). This way we can make sure we are able to create a btree for # the subvolume with a height of 2. mkfs.btrfs -f -n 64K $DEV mount $DEV $MNT btrfs subvolume create $MNT/subvol # Create a few empty files on the subvolume, this bumps its btree # height to 2 (root node at level 1 and 2 leaves). for ((i = 1; i <= 300; i++)); do echo -n > $MNT/subvol/file_$i done btrfs subvolume snapshot -r $MNT/subvol $MNT/subvol/snap umount $DEV btrfs check $DEV Running it on a 6.5 kernel (or any 6.6-rc kernel at the moment): $ ./test.sh Create subvolume '/mnt/sdi/subvol' Create a readonly snapshot of '/mnt/sdi/subvol' in '/mnt/sdi/subvol/snap' Opening filesystem to check... Checking filesystem on /dev/sdi UUID: bbdde2ff-7d02-45ca-8a73-3c36f23755a1 [1/7] checking root items [2/7] checking extents parent transid verify failed on 30539776 wanted 7 found 5 parent transid verify failed on 30539776 wanted 7 found 5 parent transid verify failed on 30539776 wanted 7 found 5 Ignoring transid failure owner ref check failed [30539776 65536] ERROR: errors found in extent allocation tree or chunk allocation [3/7] checking free space tree [4/7] checking fs roots parent transid verify failed on 30539776 wanted 7 found 5 Ignoring transid failure Wrong key of child node/leaf, wanted: (256, 1, 0), have: (2, 132, 0) Wrong generation of child node/leaf, wanted: 5, have: 7 root 257 root dir 256 not found ERROR: errors found in fs roots found 917504 bytes used, error(s) found total csum bytes: 0 total tree bytes: 851968 total fs tree bytes: 393216 total extent tree bytes: 65536 btree space waste bytes: 736550 file data blocks allocated: 0 referenced 0 A test case for fstests will follow soon. Fixes: 1b53e51a4a8f ("btrfs: don't commit transaction for every subvol create") CC: stable(a)vger.kernel.org # 6.5+ Reviewed-by: Josef Bacik <josef(a)toxicpanda.com> Signed-off-by: Filipe Manana <fdmanana(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c index b7d54efb4728..a4a809efc92f 100644 --- a/fs/btrfs/backref.c +++ b/fs/btrfs/backref.c @@ -3196,12 +3196,14 @@ static int handle_direct_tree_backref(struct btrfs_backref_cache *cache, * We still need to do a tree search to find out the parents. This is for * TREE_BLOCK_REF backref (keyed or inlined). * + * @trans: Transaction handle. * @ref_key: The same as @ref_key in handle_direct_tree_backref() * @tree_key: The first key of this tree block. * @path: A clean (released) path, to avoid allocating path every time * the function get called. */ -static int handle_indirect_tree_backref(struct btrfs_backref_cache *cache, +static int handle_indirect_tree_backref(struct btrfs_trans_handle *trans, + struct btrfs_backref_cache *cache, struct btrfs_path *path, struct btrfs_key *ref_key, struct btrfs_key *tree_key, @@ -3315,7 +3317,7 @@ static int handle_indirect_tree_backref(struct btrfs_backref_cache *cache, * If we know the block isn't shared we can avoid * checking its backrefs. */ - if (btrfs_block_can_be_shared(root, eb)) + if (btrfs_block_can_be_shared(trans, root, eb)) upper->checked = 0; else upper->checked = 1; @@ -3363,11 +3365,13 @@ static int handle_indirect_tree_backref(struct btrfs_backref_cache *cache, * links aren't yet bi-directional. Needs to finish such links. * Use btrfs_backref_finish_upper_links() to finish such linkage. * + * @trans: Transaction handle. * @path: Released path for indirect tree backref lookup * @iter: Released backref iter for extent tree search * @node_key: The first key of the tree block */ -int btrfs_backref_add_tree_node(struct btrfs_backref_cache *cache, +int btrfs_backref_add_tree_node(struct btrfs_trans_handle *trans, + struct btrfs_backref_cache *cache, struct btrfs_path *path, struct btrfs_backref_iter *iter, struct btrfs_key *node_key, @@ -3467,8 +3471,8 @@ int btrfs_backref_add_tree_node(struct btrfs_backref_cache *cache, * offset means the root objectid. We need to search * the tree to get its parent bytenr. */ - ret = handle_indirect_tree_backref(cache, path, &key, node_key, - cur); + ret = handle_indirect_tree_backref(trans, cache, path, + &key, node_key, cur); if (ret < 0) goto out; } diff --git a/fs/btrfs/backref.h b/fs/btrfs/backref.h index 1616e3e3f1e4..71d535e03dca 100644 --- a/fs/btrfs/backref.h +++ b/fs/btrfs/backref.h @@ -540,7 +540,8 @@ static inline void btrfs_backref_panic(struct btrfs_fs_info *fs_info, bytenr); } -int btrfs_backref_add_tree_node(struct btrfs_backref_cache *cache, +int btrfs_backref_add_tree_node(struct btrfs_trans_handle *trans, + struct btrfs_backref_cache *cache, struct btrfs_path *path, struct btrfs_backref_iter *iter, struct btrfs_key *node_key, diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c index da519c1b6ad0..617d4827eec2 100644 --- a/fs/btrfs/ctree.c +++ b/fs/btrfs/ctree.c @@ -367,7 +367,8 @@ int btrfs_copy_root(struct btrfs_trans_handle *trans, /* * check if the tree block can be shared by multiple trees */ -int btrfs_block_can_be_shared(struct btrfs_root *root, +int btrfs_block_can_be_shared(struct btrfs_trans_handle *trans, + struct btrfs_root *root, struct extent_buffer *buf) { /* @@ -376,11 +377,21 @@ int btrfs_block_can_be_shared(struct btrfs_root *root, * not allocated by tree relocation, we know the block is not shared. */ if (test_bit(BTRFS_ROOT_SHAREABLE, &root->state) && - buf != root->node && buf != root->commit_root && + buf != root->node && (btrfs_header_generation(buf) <= btrfs_root_last_snapshot(&root->root_item) || - btrfs_header_flag(buf, BTRFS_HEADER_FLAG_RELOC))) - return 1; + btrfs_header_flag(buf, BTRFS_HEADER_FLAG_RELOC))) { + if (buf != root->commit_root) + return 1; + /* + * An extent buffer that used to be the commit root may still be + * shared because the tree height may have increased and it + * became a child of a higher level root. This can happen when + * snapshotting a subvolume created in the current transaction. + */ + if (btrfs_header_generation(buf) == trans->transid) + return 1; + } return 0; } @@ -415,7 +426,7 @@ static noinline int update_ref_for_cow(struct btrfs_trans_handle *trans, * are only allowed for blocks use full backrefs. */ - if (btrfs_block_can_be_shared(root, buf)) { + if (btrfs_block_can_be_shared(trans, root, buf)) { ret = btrfs_lookup_extent_info(trans, fs_info, buf->start, btrfs_header_level(buf), 1, &refs, &flags); diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h index 9419f4e37a58..ff40acd63a37 100644 --- a/fs/btrfs/ctree.h +++ b/fs/btrfs/ctree.h @@ -540,7 +540,8 @@ int btrfs_copy_root(struct btrfs_trans_handle *trans, struct btrfs_root *root, struct extent_buffer *buf, struct extent_buffer **cow_ret, u64 new_root_objectid); -int btrfs_block_can_be_shared(struct btrfs_root *root, +int btrfs_block_can_be_shared(struct btrfs_trans_handle *trans, + struct btrfs_root *root, struct extent_buffer *buf); int btrfs_del_ptr(struct btrfs_trans_handle *trans, struct btrfs_root *root, struct btrfs_path *path, int level, int slot); diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c index 9951a0caf5bb..c6d4bb8cbe29 100644 --- a/fs/btrfs/relocation.c +++ b/fs/btrfs/relocation.c @@ -466,6 +466,7 @@ static bool handle_useless_nodes(struct reloc_control *rc, * cached. */ static noinline_for_stack struct btrfs_backref_node *build_backref_tree( + struct btrfs_trans_handle *trans, struct reloc_control *rc, struct btrfs_key *node_key, int level, u64 bytenr) { @@ -499,8 +500,8 @@ static noinline_for_stack struct btrfs_backref_node *build_backref_tree( /* Breadth-first search to build backref cache */ do { - ret = btrfs_backref_add_tree_node(cache, path, iter, node_key, - cur); + ret = btrfs_backref_add_tree_node(trans, cache, path, iter, + node_key, cur); if (ret < 0) { err = ret; goto out; @@ -2803,7 +2804,7 @@ int relocate_tree_blocks(struct btrfs_trans_handle *trans, /* Do tree relocation */ rbtree_postorder_for_each_entry_safe(block, next, blocks, rb_node) { - node = build_backref_tree(rc, &block->key, + node = build_backref_tree(trans, rc, &block->key, block->level, block->bytenr); if (IS_ERR(node)) { err = PTR_ERR(node);

2 years

1
0
0 0

FAILED: patch "[PATCH] vsock/virtio: initialize the_virtio_vsock before using VQs" failed to apply to 5.4-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.4-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.4.y git checkout FETCH_HEAD git cherry-pick -x 53b08c4985158430fd6d035fb49443bada535210 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023102739-channel-upstream-7bca@gregkh' --subject-prefix 'PATCH 5.4.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 53b08c4985158430fd6d035fb49443bada535210 Mon Sep 17 00:00:00 2001 From: Alexandru Matei <alexandru.matei(a)uipath.com> Date: Tue, 24 Oct 2023 22:17:42 +0300 Subject: [PATCH] vsock/virtio: initialize the_virtio_vsock before using VQs Once VQs are filled with empty buffers and we kick the host, it can send connection requests. If the_virtio_vsock is not initialized before, replies are silently dropped and do not reach the host. virtio_transport_send_pkt() can queue packets once the_virtio_vsock is set, but they won't be processed until vsock->tx_run is set to true. We queue vsock->send_pkt_work when initialization finishes to send those packets queued earlier. Fixes: 0deab087b16a ("vsock/virtio: use RCU to avoid use-after-free on the_virtio_vsock") Signed-off-by: Alexandru Matei <alexandru.matei(a)uipath.com> Reviewed-by: Stefano Garzarella <sgarzare(a)redhat.com> Link: https://lore.kernel.org/r/20231024191742.14259-1-alexandru.matei@uipath.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> diff --git a/net/vmw_vsock/virtio_transport.c b/net/vmw_vsock/virtio_transport.c index e95df847176b..b80bf681327b 100644 --- a/net/vmw_vsock/virtio_transport.c +++ b/net/vmw_vsock/virtio_transport.c @@ -555,6 +555,11 @@ static int virtio_vsock_vqs_init(struct virtio_vsock *vsock) virtio_device_ready(vdev); + return 0; +} + +static void virtio_vsock_vqs_start(struct virtio_vsock *vsock) +{ mutex_lock(&vsock->tx_lock); vsock->tx_run = true; mutex_unlock(&vsock->tx_lock); @@ -569,7 +574,16 @@ static int virtio_vsock_vqs_init(struct virtio_vsock *vsock) vsock->event_run = true; mutex_unlock(&vsock->event_lock); - return 0; + /* virtio_transport_send_pkt() can queue packets once + * the_virtio_vsock is set, but they won't be processed until + * vsock->tx_run is set to true. We queue vsock->send_pkt_work + * when initialization finishes to send those packets queued + * earlier. + * We don't need to queue the other workers (rx, event) because + * as long as we don't fill the queues with empty buffers, the + * host can't send us any notification. + */ + queue_work(virtio_vsock_workqueue, &vsock->send_pkt_work); } static void virtio_vsock_vqs_del(struct virtio_vsock *vsock) @@ -664,6 +678,7 @@ static int virtio_vsock_probe(struct virtio_device *vdev) goto out; rcu_assign_pointer(the_virtio_vsock, vsock); + virtio_vsock_vqs_start(vsock); mutex_unlock(&the_virtio_vsock_mutex); @@ -736,6 +751,7 @@ static int virtio_vsock_restore(struct virtio_device *vdev) goto out; rcu_assign_pointer(the_virtio_vsock, vsock); + virtio_vsock_vqs_start(vsock); out: mutex_unlock(&the_virtio_vsock_mutex);

2 years

1
0
0 0

FAILED: patch "[PATCH] vsock/virtio: initialize the_virtio_vsock before using VQs" failed to apply to 5.10-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y git checkout FETCH_HEAD git cherry-pick -x 53b08c4985158430fd6d035fb49443bada535210 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023102738-scoring-accurate-da6f@gregkh' --subject-prefix 'PATCH 5.10.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 53b08c4985158430fd6d035fb49443bada535210 Mon Sep 17 00:00:00 2001 From: Alexandru Matei <alexandru.matei(a)uipath.com> Date: Tue, 24 Oct 2023 22:17:42 +0300 Subject: [PATCH] vsock/virtio: initialize the_virtio_vsock before using VQs Once VQs are filled with empty buffers and we kick the host, it can send connection requests. If the_virtio_vsock is not initialized before, replies are silently dropped and do not reach the host. virtio_transport_send_pkt() can queue packets once the_virtio_vsock is set, but they won't be processed until vsock->tx_run is set to true. We queue vsock->send_pkt_work when initialization finishes to send those packets queued earlier. Fixes: 0deab087b16a ("vsock/virtio: use RCU to avoid use-after-free on the_virtio_vsock") Signed-off-by: Alexandru Matei <alexandru.matei(a)uipath.com> Reviewed-by: Stefano Garzarella <sgarzare(a)redhat.com> Link: https://lore.kernel.org/r/20231024191742.14259-1-alexandru.matei@uipath.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> diff --git a/net/vmw_vsock/virtio_transport.c b/net/vmw_vsock/virtio_transport.c index e95df847176b..b80bf681327b 100644 --- a/net/vmw_vsock/virtio_transport.c +++ b/net/vmw_vsock/virtio_transport.c @@ -555,6 +555,11 @@ static int virtio_vsock_vqs_init(struct virtio_vsock *vsock) virtio_device_ready(vdev); + return 0; +} + +static void virtio_vsock_vqs_start(struct virtio_vsock *vsock) +{ mutex_lock(&vsock->tx_lock); vsock->tx_run = true; mutex_unlock(&vsock->tx_lock); @@ -569,7 +574,16 @@ static int virtio_vsock_vqs_init(struct virtio_vsock *vsock) vsock->event_run = true; mutex_unlock(&vsock->event_lock); - return 0; + /* virtio_transport_send_pkt() can queue packets once + * the_virtio_vsock is set, but they won't be processed until + * vsock->tx_run is set to true. We queue vsock->send_pkt_work + * when initialization finishes to send those packets queued + * earlier. + * We don't need to queue the other workers (rx, event) because + * as long as we don't fill the queues with empty buffers, the + * host can't send us any notification. + */ + queue_work(virtio_vsock_workqueue, &vsock->send_pkt_work); } static void virtio_vsock_vqs_del(struct virtio_vsock *vsock) @@ -664,6 +678,7 @@ static int virtio_vsock_probe(struct virtio_device *vdev) goto out; rcu_assign_pointer(the_virtio_vsock, vsock); + virtio_vsock_vqs_start(vsock); mutex_unlock(&the_virtio_vsock_mutex); @@ -736,6 +751,7 @@ static int virtio_vsock_restore(struct virtio_device *vdev) goto out; rcu_assign_pointer(the_virtio_vsock, vsock); + virtio_vsock_vqs_start(vsock); out: mutex_unlock(&the_virtio_vsock_mutex);

2 years

1
0
0 0

[PATCH] net: dsa: lan9303: consequently nested-lock physical MDIO

by A. Sverdlin

From: Alexander Sverdlin <alexander.sverdlin(a)siemens.com> When LAN9303 is MDIO-connected two callchains exist into mdio->bus->write(): 1. switch ports 1&2 ("physical" PHYs): virtual (switch-internal) MDIO bus (lan9303_switch_ops->phy_{read|write})-> lan9303_mdio_phy_{read|write} -> mdiobus_{read|write}_nested 2. LAN9303 virtual PHY: virtual MDIO bus (lan9303_phy_{read|write}) -> lan9303_virt_phy_reg_{read|write} -> regmap -> lan9303_mdio_{read|write} If the latter functions just take mutex_lock(&sw_dev->device->bus->mdio_lock) it triggers a LOCKDEP false-positive splat. It's false-positive because the first mdio_lock in the second callchain above belongs to virtual MDIO bus, the second mdio_lock belongs to physical MDIO bus. Consequent annotation in lan9303_mdio_{read|write} as nested lock (similar to lan9303_mdio_phy_{read|write}, it's the same physical MDIO bus) prevents the following splat: WARNING: possible circular locking dependency detected 5.15.71 #1 Not tainted ------------------------------------------------------ kworker/u4:3/609 is trying to acquire lock: ffff000011531c68 (lan9303_mdio:131:(&lan9303_mdio_regmap_config)->lock){+.+.}-{3:3}, at: regmap_lock_mutex but task is already holding lock: ffff0000114c44d8 (&bus->mdio_lock){+.+.}-{3:3}, at: mdiobus_read which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&bus->mdio_lock){+.+.}-{3:3}: lock_acquire __mutex_lock mutex_lock_nested lan9303_mdio_read _regmap_read regmap_read lan9303_probe lan9303_mdio_probe mdio_probe really_probe __driver_probe_device driver_probe_device __device_attach_driver bus_for_each_drv __device_attach device_initial_probe bus_probe_device deferred_probe_work_func process_one_work worker_thread kthread ret_from_fork -> #0 (lan9303_mdio:131:(&lan9303_mdio_regmap_config)->lock){+.+.}-{3:3}: __lock_acquire lock_acquire.part.0 lock_acquire __mutex_lock mutex_lock_nested regmap_lock_mutex regmap_read lan9303_phy_read dsa_slave_phy_read __mdiobus_read mdiobus_read get_phy_device mdiobus_scan __mdiobus_register dsa_register_switch lan9303_probe lan9303_mdio_probe mdio_probe really_probe __driver_probe_device driver_probe_device __device_attach_driver bus_for_each_drv __device_attach device_initial_probe bus_probe_device deferred_probe_work_func process_one_work worker_thread kthread ret_from_fork other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&bus->mdio_lock); lock(lan9303_mdio:131:(&lan9303_mdio_regmap_config)->lock); lock(&bus->mdio_lock); lock(lan9303_mdio:131:(&lan9303_mdio_regmap_config)->lock); *** DEADLOCK *** 5 locks held by kworker/u4:3/609: #0: ffff000002842938 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work #1: ffff80000bacbd60 (deferred_probe_work){+.+.}-{0:0}, at: process_one_work #2: ffff000007645178 (&dev->mutex){....}-{3:3}, at: __device_attach #3: ffff8000096e6e78 (dsa2_mutex){+.+.}-{3:3}, at: dsa_register_switch #4: ffff0000114c44d8 (&bus->mdio_lock){+.+.}-{3:3}, at: mdiobus_read stack backtrace: CPU: 1 PID: 609 Comm: kworker/u4:3 Not tainted 5.15.71 #1 Workqueue: events_unbound deferred_probe_work_func Call trace: dump_backtrace show_stack dump_stack_lvl dump_stack print_circular_bug check_noncircular __lock_acquire lock_acquire.part.0 lock_acquire __mutex_lock mutex_lock_nested regmap_lock_mutex regmap_read lan9303_phy_read dsa_slave_phy_read __mdiobus_read mdiobus_read get_phy_device mdiobus_scan __mdiobus_register dsa_register_switch lan9303_probe lan9303_mdio_probe ... Cc: stable(a)vger.kernel.org Fixes: dc7005831523 ("net: dsa: LAN9303: add MDIO managed mode support") Signed-off-by: Alexander Sverdlin <alexander.sverdlin(a)siemens.com> --- Tested with v5.15 vendor kernel, compiled against net-next/main (cc54d2e2c58a). Affected code is unchanged since original introduction in 2017. drivers/net/dsa/lan9303_mdio.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/dsa/lan9303_mdio.c b/drivers/net/dsa/lan9303_mdio.c index d8ab2b77d201..167a86f39f27 100644 --- a/drivers/net/dsa/lan9303_mdio.c +++ b/drivers/net/dsa/lan9303_mdio.c @@ -32,7 +32,7 @@ static int lan9303_mdio_write(void *ctx, uint32_t reg, uint32_t val) struct lan9303_mdio *sw_dev = (struct lan9303_mdio *)ctx; reg <<= 2; /* reg num to offset */ - mutex_lock(&sw_dev->device->bus->mdio_lock); + mutex_lock_nested(&sw_dev->device->bus->mdio_lock, MDIO_MUTEX_NESTED); lan9303_mdio_real_write(sw_dev->device, reg, val & 0xffff); lan9303_mdio_real_write(sw_dev->device, reg + 2, (val >> 16) & 0xffff); mutex_unlock(&sw_dev->device->bus->mdio_lock); @@ -50,7 +50,7 @@ static int lan9303_mdio_read(void *ctx, uint32_t reg, uint32_t *val) struct lan9303_mdio *sw_dev = (struct lan9303_mdio *)ctx; reg <<= 2; /* reg num to offset */ - mutex_lock(&sw_dev->device->bus->mdio_lock); + mutex_lock_nested(&sw_dev->device->bus->mdio_lock, MDIO_MUTEX_NESTED); *val = lan9303_mdio_real_read(sw_dev->device, reg); *val |= (lan9303_mdio_real_read(sw_dev->device, reg + 2) << 16); mutex_unlock(&sw_dev->device->bus->mdio_lock); -- 2.41.0

2 years

2
1
0 0

[PATCH V2] mm/sparsemem: fix race in accessing memory_section->usage

by Charan Teja Kalla

The below race is observed on a PFN which falls into the device memory region with the system memory configuration where PFN's are such that [ZONE_NORMAL ZONE_DEVICE ZONE_NORMAL]. Since normal zone start and end pfn contains the device memory PFN's as well, the compaction triggered will try on the device memory PFN's too though they end up in NOP(because pfn_to_online_page() returns NULL for ZONE_DEVICE memory sections). When from other core, the section mappings are being removed for the ZONE_DEVICE region, that the PFN in question belongs to, on which compaction is currently being operated is resulting into the kernel crash with CONFIG_SPASEMEM_VMEMAP enabled. The crash logs can be seen at [1]. compact_zone() memunmap_pages ------------- --------------- __pageblock_pfn_to_page ...... (a)pfn_valid(): valid_section()//return true (b)__remove_pages()-> sparse_remove_section()-> section_deactivate(): [Free the array ms->usage and set ms->usage = NULL] pfn_section_valid() [Access ms->usage which is NULL] NOTE: From the above it can be said that the race is reduced to between the pfn_valid()/pfn_section_valid() and the section deactivate with SPASEMEM_VMEMAP enabled. The commit b943f045a9af("mm/sparse: fix kernel crash with pfn_section_valid check") tried to address the same problem by clearing the SECTION_HAS_MEM_MAP with the expectation of valid_section() returns false thus ms->usage is not accessed. Fix this issue by the below steps: a) Clear SECTION_HAS_MEM_MAP before freeing the ->usage. b) RCU protected read side critical section will either return NULL when SECTION_HAS_MEM_MAP is cleared or can successfully access ->usage. c) Free the ->usage with kfree_rcu() and set ms->usage = NULL. No attempt will be made to access ->usage after this as the SECTION_HAS_MEM_MAP is cleared thus valid_section() return false. Thanks to David/Pavan for their inputs on this patch. [1] https://lore.kernel.org/linux-mm/994410bb-89aa-d987-1f50-f514903c55aa@quici… Fixes: f46edbd1b151 ("mm/sparsemem: add helpers track active portions of a section at boot") Cc: stable(a)vger.kernel.org Signed-off-by: Charan Teja Kalla <quic_charante(a)quicinc.com> --- V2: Use kfree_rcu() inplace of synchronize_rcu() - David V1: https://lore.kernel.org/linux-mm/1697202267-23600-1-git-send-email-quic_cha… include/linux/mmzone.h | 14 +++++++++++--- mm/sparse.c | 17 +++++++++-------- 2 files changed, 20 insertions(+), 11 deletions(-) diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h index 4106fbc..19a4b1d 100644 --- a/include/linux/mmzone.h +++ b/include/linux/mmzone.h @@ -1770,6 +1770,7 @@ static inline unsigned long section_nr_to_pfn(unsigned long sec) #define SUBSECTION_ALIGN_DOWN(pfn) ((pfn) & PAGE_SUBSECTION_MASK) struct mem_section_usage { + struct rcu_head rcu; #ifdef CONFIG_SPARSEMEM_VMEMMAP DECLARE_BITMAP(subsection_map, SUBSECTIONS_PER_SECTION); #endif @@ -1963,7 +1964,7 @@ static inline int pfn_section_valid(struct mem_section *ms, unsigned long pfn) { int idx = subsection_map_index(pfn); - return test_bit(idx, ms->usage->subsection_map); + return test_bit(idx, READ_ONCE(ms->usage)->subsection_map); } #else static inline int pfn_section_valid(struct mem_section *ms, unsigned long pfn) @@ -1987,6 +1988,7 @@ static inline int pfn_section_valid(struct mem_section *ms, unsigned long pfn) static inline int pfn_valid(unsigned long pfn) { struct mem_section *ms; + int ret; /* * Ensure the upper PAGE_SHIFT bits are clear in the @@ -2000,13 +2002,19 @@ static inline int pfn_valid(unsigned long pfn) if (pfn_to_section_nr(pfn) >= NR_MEM_SECTIONS) return 0; ms = __pfn_to_section(pfn); - if (!valid_section(ms)) + rcu_read_lock(); + if (!valid_section(ms)) { + rcu_read_unlock(); return 0; + } /* * Traditionally early sections always returned pfn_valid() for * the entire section-sized span. */ - return early_section(ms) || pfn_section_valid(ms, pfn); + ret = early_section(ms) || pfn_section_valid(ms, pfn); + rcu_read_unlock(); + + return ret; } #endif diff --git a/mm/sparse.c b/mm/sparse.c index 77d91e5..338cf94 100644 --- a/mm/sparse.c +++ b/mm/sparse.c @@ -792,6 +792,13 @@ static void section_deactivate(unsigned long pfn, unsigned long nr_pages, unsigned long section_nr = pfn_to_section_nr(pfn); /* + * Mark the section invalid so that valid_section() + * return false. This prevents code from dereferencing + * ms->usage array. + */ + ms->section_mem_map &= ~SECTION_HAS_MEM_MAP; + + /* * When removing an early section, the usage map is kept (as the * usage maps of other sections fall into the same page). It * will be re-used when re-adding the section - which is then no @@ -799,16 +806,10 @@ static void section_deactivate(unsigned long pfn, unsigned long nr_pages, * was allocated during boot. */ if (!PageReserved(virt_to_page(ms->usage))) { - kfree(ms->usage); - ms->usage = NULL; + kfree_rcu(ms->usage, rcu); + WRITE_ONCE(ms->usage, NULL); } memmap = sparse_decode_mem_map(ms->section_mem_map, section_nr); - /* - * Mark the section invalid so that valid_section() - * return false. This prevents code from dereferencing - * ms->usage array. - */ - ms->section_mem_map &= ~SECTION_HAS_MEM_MAP; } /* -- 2.7.4

2 years

1
0
0 0

[PATCH v2] powerpc/pseries/iommu: enable_ddw incorrectly returns direct mapping for SR-IOV device

by Gaurav Batra

When a device is initialized, the driver invokes dma_supported() twice - first for streaming mappings followed by coherent mappings. For an SR-IOV device, default window is deleted and DDW created. With vPMEM enabled, TCE mappings are dynamically created for both vPMEM and SR-IOV device. There are no direct mappings. First time when dma_supported() is called with 64 bit mask, DDW is created and marked as dynamic window. The second time dma_supported() is called, enable_ddw() finds existing window for the device and incorrectly returns it as "direct mapping". This only happens when size of DDW is big enough to map max LPAR memory. This results in streaming TCEs to not get dynamically mapped, since code incorrently assumes these are already pre-mapped. The adapter initially comes up but goes down due to EEH. Fixes: 381ceda88c4c ("powerpc/pseries/iommu: Make use of DDW for indirect mapping") Cc: stable(a)vger.kernel.org Signed-off-by: Gaurav Batra <gbatra(a)linux.vnet.ibm.com> --- arch/powerpc/platforms/pseries/iommu.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/arch/powerpc/platforms/pseries/iommu.c b/arch/powerpc/platforms/pseries/iommu.c index 16d93b580f61..496e16c588aa 100644 --- a/arch/powerpc/platforms/pseries/iommu.c +++ b/arch/powerpc/platforms/pseries/iommu.c @@ -914,7 +914,8 @@ static int remove_ddw(struct device_node *np, bool remove_prop, const char *win_ return 0; } -static bool find_existing_ddw(struct device_node *pdn, u64 *dma_addr, int *window_shift) +static bool find_existing_ddw(struct device_node *pdn, u64 *dma_addr, int *window_shift, + bool *direct_mapping) { struct dma_win *window; const struct dynamic_dma_window_prop *dma64; @@ -927,6 +928,7 @@ static bool find_existing_ddw(struct device_node *pdn, u64 *dma_addr, int *windo dma64 = window->prop; *dma_addr = be64_to_cpu(dma64->dma_base); *window_shift = be32_to_cpu(dma64->window_shift); + *direct_mapping = window->direct; found = true; break; } @@ -1270,10 +1272,8 @@ static bool enable_ddw(struct pci_dev *dev, struct device_node *pdn) mutex_lock(&dma_win_init_mutex); - if (find_existing_ddw(pdn, &dev->dev.archdata.dma_offset, &len)) { - direct_mapping = (len >= max_ram_len); + if (find_existing_ddw(pdn, &dev->dev.archdata.dma_offset, &len, &direct_mapping)) goto out_unlock; - } /* * If we already went through this for a previous function of -- 2.39.2 (Apple Git-143)

2 years

2
1
0 0

[PATCH 2/2] media: mtk-jpeg: Fix timeout schedule error in mtk_jpegdec_worker.

by Zheng Wang

In mtk_jpegdec_worker, if error occurs in mtk_jpeg_set_dec_dst, it will start the timeout worker and invoke v4l2_m2m_job_finish at the same time. This will break the logic of design for there should be only one function to call v4l2_m2m_job_finish. But now the timeout handler and mtk_jpegdec_worker will both invoke it. Fix it by start the worker only if mtk_jpeg_set_dec_dst successfully finished. Fixes: da4ede4b7fd6 ("media: mtk-jpeg: move data/code inside CONFIG_OF blocks") Signed-off-by: Zheng Wang <zyytlz.wz(a)163.com> Signed-off-by: Dmitry Osipenko <dmitry.osipenko(a)collabora.com> Cc: stable(a)vger.kernel.org --- drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c index 7194f88edc0f..d099a9b67930 100644 --- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c +++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c @@ -1750,9 +1750,6 @@ static void mtk_jpegdec_worker(struct work_struct *work) v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx); v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx); - schedule_delayed_work(&comp_jpeg[hw_id]->job_timeout_work, - msecs_to_jiffies(MTK_JPEG_HW_TIMEOUT_MSEC)); - mtk_jpeg_set_dec_src(ctx, &src_buf->vb2_buf, &bs); if (mtk_jpeg_set_dec_dst(ctx, &jpeg_src_buf->dec_param, @@ -1762,6 +1759,9 @@ static void mtk_jpegdec_worker(struct work_struct *work) goto setdst_end; } + schedule_delayed_work(&comp_jpeg[hw_id]->job_timeout_work, + msecs_to_jiffies(MTK_JPEG_HW_TIMEOUT_MSEC)); + spin_lock_irqsave(&comp_jpeg[hw_id]->hw_lock, flags); ctx->total_frame_num++; mtk_jpeg_dec_reset(comp_jpeg[hw_id]->reg_base); -- 2.25.1

2 years

1
0
0 0

[PATCH 1/2] media: mtk-jpeg: Fix use after free bug due to error path handling in mtk_jpeg_dec_device_run

by Zheng Wang

In mtk_jpeg_probe, &jpeg->job_timeout_work is bound with mtk_jpeg_job_timeout_work. In mtk_jpeg_dec_device_run, if error happens in mtk_jpeg_set_dec_dst, it will finally start the worker while mark the job as finished by invoking v4l2_m2m_job_finish. There are two methods to trigger the bug. If we remove the module, it which will call mtk_jpeg_remove to make cleanup. The possible sequence is as follows, which will cause a use-after-free bug. CPU0 CPU1 mtk_jpeg_dec_... | start worker | |mtk_jpeg_job_timeout_work mtk_jpeg_remove | v4l2_m2m_release | kfree(m2m_dev); | | | v4l2_m2m_get_curr_priv | m2m_dev->curr_ctx //use If we close the file descriptor, which will call mtk_jpeg_release, it will have a similar sequence. Fix this bug by starting timeout worker only if started jpegdec worker successfully. Then v4l2_m2m_job_finish will only be called in either mtk_jpeg_job_timeout_work or mtk_jpeg_dec_device_run. Fixes: b2f0d2724ba4 ("[media] vcodec: mediatek: Add Mediatek JPEG Decoder Driver") Signed-off-by: Zheng Wang <zyytlz.wz(a)163.com> Signed-off-by: Dmitry Osipenko <dmitry.osipenko(a)collabora.com> Cc: stable(a)vger.kernel.org --- drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c index 7194f88edc0f..252ba9b6857b 100644 --- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c +++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c @@ -1021,13 +1021,13 @@ static void mtk_jpeg_dec_device_run(void *priv) if (ret < 0) goto dec_end; - schedule_delayed_work(&jpeg->job_timeout_work, - msecs_to_jiffies(MTK_JPEG_HW_TIMEOUT_MSEC)); - mtk_jpeg_set_dec_src(ctx, &src_buf->vb2_buf, &bs); if (mtk_jpeg_set_dec_dst(ctx, &jpeg_src_buf->dec_param, &dst_buf->vb2_buf, &fb)) goto dec_end; + schedule_delayed_work(&jpeg->job_timeout_work, + msecs_to_jiffies(MTK_JPEG_HW_TIMEOUT_MSEC)); + spin_lock_irqsave(&jpeg->hw_lock, flags); mtk_jpeg_dec_reset(jpeg->reg_base); mtk_jpeg_dec_set_config(jpeg->reg_base, -- 2.25.1

2 years

1
0
0 0

[PATCH 6.5 000/285] 6.5.4-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.5.4 release. There are 285 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Tue, 19 Sep 2023 19:10:04 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.5.4-rc1.… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.5.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.5.4-rc1 Wesley Chalmers <wesley.chalmers(a)amd.com> drm/amd/display: Fix a bug when searching for insert_above_mpcc Linus Torvalds <torvalds(a)linux-foundation.org> vm: fix move_vma() memory accounting being off Kuniyuki Iwashima <kuniyu(a)amazon.com> kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg(). Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com> net: renesas: rswitch: Fix unmasking irq condition Corinna Vinschen <vinschen(a)redhat.com> igb: clean up in all error paths when enabling SR-IOV Vadim Fedorenko <vadim.fedorenko(a)linux.dev> ixgbe: fix timestamp configuration code Kuniyuki Iwashima <kuniyu(a)amazon.com> selftest: tcp: Fix address length in bind_wildcard.c. Kuniyuki Iwashima <kuniyu(a)amazon.com> tcp: Fix bind() regression for v4-mapped-v6 non-wildcard address. Kuniyuki Iwashima <kuniyu(a)amazon.com> tcp: Fix bind() regression for v4-mapped-v6 wildcard address. Kuniyuki Iwashima <kuniyu(a)amazon.com> tcp: Factorise sk_family-independent comparison in inet_bind2_bucket_match(_addr_any). Eric Dumazet <edumazet(a)google.com> ipv6: fix ip6_sock_set_addr_preferences() typo Toke Høiland-Jørgensen <toke(a)redhat.com> veth: Update XDP feature set when bringing up device Sascha Hauer <s.hauer(a)pengutronix.de> net: macb: fix sleep inside spinlock Liu Jian <liujian56(a)huawei.com> net/tls: do not free tls_rec on async operation in bpf_exec_tx_verdict() Geert Uytterhoeven <geert+renesas(a)glider.be> platform/mellanox: NVSW_SN2201 should depend on ACPI Shravan Kumar Ramani <shravankr(a)nvidia.com> platform/mellanox: mlxbf-pmc: Fix reading of unprogrammed events Shravan Kumar Ramani <shravankr(a)nvidia.com> platform/mellanox: mlxbf-pmc: Fix potential buffer overflows Liming Sun <limings(a)nvidia.com> platform/mellanox: mlxbf-tmfifo: Drop jumbo frames Liming Sun <limings(a)nvidia.com> platform/mellanox: mlxbf-tmfifo: Drop the Rx packet if no more descriptors Shigeru Yoshida <syoshida(a)redhat.com> kcm: Fix memory leak in error path of kcm_sendmsg() Hayes Wang <hayeswang(a)realtek.com> r8152: check budget for r8152_poll() Vladimir Oltean <vladimir.oltean(a)nxp.com> net: dsa: sja1105: block FDB accesses that are concurrent with a switch reset Vladimir Oltean <vladimir.oltean(a)nxp.com> net: dsa: sja1105: serialize sja1105_port_mcast_flood() with other FDB accesses Vladimir Oltean <vladimir.oltean(a)nxp.com> net: dsa: sja1105: fix multicast forwarding working only for last added mdb entry Vladimir Oltean <vladimir.oltean(a)nxp.com> net: dsa: sja1105: propagate exact error code from sja1105_dynamic_config_poll_valid() Vladimir Oltean <vladimir.oltean(a)nxp.com> net: dsa: sja1105: hide all multicast addresses from "bridge fdb show" Ciprian Regus <ciprian.regus(a)analog.com> net:ethernet:adi:adin1110: Fix forwarding offload Yang Yingliang <yangyingliang(a)huawei.com> net: ethernet: adi: adin1110: use eth_broadcast_addr() to assign broadcast address Ziyang Xuan <william.xuanziyang(a)huawei.com> hsr: Fix uninit-value access in fill_frame_info() Hangyu Hua <hbh25y(a)gmail.com> net: ethernet: mtk_eth_soc: fix possible NULL pointer dereference in mtk_hwlro_get_fdir_all() Hangyu Hua <hbh25y(a)gmail.com> net: ethernet: mvpp2_main: fix possible OOB write in mvpp2_ethtool_get_rxnfc() Vincent Whitchurch <vincent.whitchurch(a)axis.com> net: stmmac: fix handling of zero coalescing tx-usecs Guangguan Wang <guangguan.wang(a)linux.alibaba.com> net/smc: use smc_lgr_list.lock to protect smc_lgr_list.list iterate in smcr_port_add Ratheesh Kannoth <rkannoth(a)marvell.com> octeontx2-pf: Fix page pool cache index corruption. Jinjie Ruan <ruanjinjie(a)huawei.com> net: microchip: vcap api: Fix possible memory leak for vcap_dup_rule() Naveen N Rao <naveen(a)kernel.org> selftests/ftrace: Fix dependencies for some of the synthetic event tests Björn Töpel <bjorn(a)rivosinc.com> selftests: Keep symlinks, when possible Björn Töpel <bjorn(a)rivosinc.com> kselftest/runner.sh: Propagate SIGTERM to runner child Liu Jian <liujian56(a)huawei.com> net: ipv4: fix one memleak in __inet_del_ifa() Jinjie Ruan <ruanjinjie(a)huawei.com> kunit: Fix wild-memory-access bug in kunit_free_suite_set() Helge Deller <deller(a)gmx.de> parisc: sba_iommu: Fix build warning if procfs if disabled Biju Das <biju.das.jz(a)bp.renesas.com> regulator: raa215300: Fix resource leak in case of error Biju Das <biju.das.jz(a)bp.renesas.com> regulator: raa215300: Change the scope of the variables {clkin_name, xin_name} Arnd Bergmann <arnd(a)arndb.de> bpf: fix bpf_probe_read_kernel prototype mismatch Hamza Mahfooz <hamza.mahfooz(a)amd.com> drm/amdgpu: register a dirty framebuffer callback for fbcon Jay Cornwall <jay.cornwall(a)amd.com> drm/amdkfd: Add missing gfx11 MQD manager callbacks Gabe Teeger <gabe.teeger(a)amd.com> drm/amd/display: Remove wait while locked Wenjing Liu <wenjing.liu(a)amd.com> drm/amd/display: always switch off ODM before committing more streams Namhyung Kim <namhyung(a)kernel.org> perf hists browser: Fix the number of entries for 'e' key Namhyung Kim <namhyung(a)kernel.org> perf build: Include generated header files properly Namhyung Kim <namhyung(a)kernel.org> perf tools: Handle old data in PERF_RECORD_ATTR Namhyung Kim <namhyung(a)kernel.org> perf test shell stat_bpf_counters: Fix test on Intel Namhyung Kim <namhyung(a)kernel.org> perf build: Update build rule for generated files Namhyung Kim <namhyung(a)kernel.org> perf hists browser: Fix hierarchy mode header Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: Fix CONFIG_CPU_DADDI_WORKAROUNDS `modules_install' regression Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: Only fiddle with CHECKFLAGS if `need-compiler' Sean Christopherson <seanjc(a)google.com> KVM: SVM: Skip VMSA init in sev_es_init_vmcb() if pointer is NULL Sean Christopherson <seanjc(a)google.com> KVM: SVM: Set target pCPU during IRTE update if target vCPU is running Sean Christopherson <seanjc(a)google.com> KVM: nSVM: Load L1's TSC multiplier based on L1 state, not L2 state Sean Christopherson <seanjc(a)google.com> KVM: nSVM: Check instead of asserting on nested TSC scaling support Sean Christopherson <seanjc(a)google.com> KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration Sean Christopherson <seanjc(a)google.com> KVM: SVM: Don't inject #UD if KVM attempts to skip SEV guest insn Sean Christopherson <seanjc(a)google.com> KVM: SVM: Take and hold ir_list_lock when updating vCPU's Physical ID entry Sean Christopherson <seanjc(a)google.com> KVM: VMX: Refresh available regs and IDT vectoring info before NMI handling Hamza Mahfooz <hamza.mahfooz(a)amd.com> drm/amd/display: prevent potential division by zero errors Hamza Mahfooz <hamza.mahfooz(a)amd.com> drm/amd/display: limit the v_startup workaround to ASICs older than DCN3.1 Melissa Wen <mwen(a)igalia.com> drm/amd/display: enable cursor degamma for DCN3+ DRM legacy gamma Hamza Mahfooz <hamza.mahfooz(a)amd.com> Revert "drm/amd/display: Remove v_startup workaround for dcn3+" William Zhang <william.zhang(a)broadcom.com> mtd: rawnand: brcmnand: Fix ECC level field setting for v7.2 controller William Zhang <william.zhang(a)broadcom.com> mtd: rawnand: brcmnand: Fix potential false time out warning Linus Walleij <linus.walleij(a)linaro.org> mtd: spi-nor: Correct flags for Winbond w25q128 William Zhang <william.zhang(a)broadcom.com> mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write William Zhang <william.zhang(a)broadcom.com> mtd: rawnand: brcmnand: Fix crash during the panic_write Liu Ying <victor.liu(a)nxp.com> drm/mxsfb: Disable overlay plane in mxsfb_plane_overlay_atomic_disable() Qu Wenruo <wqu(a)suse.com> btrfs: scrub: fix grouping of read IO Qu Wenruo <wqu(a)suse.com> btrfs: scrub: avoid unnecessary csum tree search preparing stripes Qu Wenruo <wqu(a)suse.com> btrfs: scrub: avoid unnecessary extent tree search preparing stripes Anand Jain <anand.jain(a)oracle.com> btrfs: use the correct superblock to compare fsid in btrfs_validate_super Naohiro Aota <naohiro.aota(a)wdc.com> btrfs: zoned: re-enable metadata over-commit for zoned mode Josef Bacik <josef(a)toxicpanda.com> btrfs: set page extent mapped after read_folio in relocate_one_page Filipe Manana <fdmanana(a)suse.com> btrfs: don't start transaction when joining with TRANS_JOIN_NOSTART Boris Burkov <boris(a)bur.io> btrfs: free qgroup rsv on io failure Boris Burkov <boris(a)bur.io> btrfs: fix start transaction qgroup rsv double free Naohiro Aota <naohiro.aota(a)wdc.com> btrfs: zoned: do not zone finish data relocation block group ruanmeisi <ruan.meisi(a)zte.com.cn> fuse: nlookup missing decrement in fuse_direntplus_link Damien Le Moal <dlemoal(a)kernel.org> ata: pata_ftide010: Add missing MODULE_DESCRIPTION Damien Le Moal <dlemoal(a)kernel.org> ata: sata_gemini: Add missing MODULE_DESCRIPTION Michael Schmitz <schmitzmic(a)gmail.com> ata: pata_falcon: fix IO base selection for Q40 Werner Fischer <devlists(a)wefi.net> ata: ahci: Add Elkhart Lake AHCI controller Johannes Weiner <hannes(a)cmpxchg.org> memcontrol: ensure memcg acquired by id is properly set up Christian Marangi <ansuelsmth(a)gmail.com> hwspinlock: qcom: add missing regmap config for SFPB MMIO implementation Nathan Chancellor <nathan(a)kernel.org> lib: test_scanf: Add explicit type cast to result initialization in test_number_prefix() Jaegeuk Kim <jaegeuk(a)kernel.org> f2fs: avoid false alarm of circular locking Jaegeuk Kim <jaegeuk(a)kernel.org> f2fs: flush inode if atomic file is aborted Jaegeuk Kim <jaegeuk(a)kernel.org> f2fs: get out of a repeat loop when getting a locked data page Brian Foster <bfoster(a)redhat.com> ext4: drop dio overwrite only flag and associated warning Luís Henriques <lhenriques(a)suse.de> ext4: fix memory leaks in ext4_fname_{setup_filename,prepare_lookup} Wang Jianjian <wangjianjian0(a)foxmail.com> ext4: add correct group descriptors and reserved GDT blocks to system zone Baokun Li <libaokun1(a)huawei.com> ext4: fix slab-use-after-free in ext4_es_insert_extent() Zhang Yi <yi.zhang(a)huawei.com> jbd2: correct the end of the journal recovery scan range Zhihao Cheng <chengzhihao1(a)huawei.com> jbd2: check 'jh->b_transaction' before removing it from checkpoint Zhang Yi <yi.zhang(a)huawei.com> jbd2: fix checkpoint cleanup performance regression Ekansh Gupta <quic_ekangupt(a)quicinc.com> misc: fastrpc: Fix incorrect DMA mapping unmap request Ekansh Gupta <quic_ekangupt(a)quicinc.com> misc: fastrpc: Fix remote heap allocation request Hien Huynh <hien.huynh.px(a)renesas.com> dmaengine: sh: rz-dmac: Fix destination and source data size setting Walter Chang <walter.chang(a)mediatek.com> clocksource/drivers/arm_arch_timer: Disable timer before programming CVAL Pavel Kozlov <pavel.kozlov(a)synopsys.com> ARC: atomics: Add compiler barrier to atomic operations... Fangzhi Zuo <jerry.zuo(a)amd.com> drm/amd/display: Temporary Disable MST DP Colorspace Property Florent CARLI <fcarli(a)gmail.com> watchdog: advantech_ec_wdt: fix Kconfig dependencies Masahiro Yamada <masahiroy(a)kernel.org> linux/export: fix reference to exported functions for parisc64 Duoming Zhou <duoming(a)zju.edu.cn> sh: push-switch: Reorder cleanup operations to avoid use-after-free bug Petr Tesarik <petr.tesarik.ext(a)huawei.com> sh: boards: Fix CEU buffer size passed to dma_declare_coherent_memory() Vladimir Oltean <vladimir.oltean(a)nxp.com> net: enetc: distinguish error from valid pointers in enetc_fixup_clear_rss_rfs() Jie Wang <wangjie125(a)huawei.com> net: hns3: remove GSO partial feature bit Yisen Zhuang <yisen.zhuang(a)huawei.com> net: hns3: fix the port information display when sfp is absent Jijie Shao <shaojijie(a)huawei.com> net: hns3: fix invalid mutex between tc qdisc and dcb ets command issue Hao Chen <chenhao418(a)huawei.com> net: hns3: fix debugfs concurrency issue between kfree buffer and read Hao Chen <chenhao418(a)huawei.com> net: hns3: fix byte order conversion issue in hclge_dbg_fd_tcam_read() Jian Shen <shenjian15(a)huawei.com> net: hns3: fix tx timeout issue Lukasz Majewski <lukma(a)denx.de> net: phy: Provide Module 4 KSZ9477 errata (DS80000754C) Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: Unbreak audit log reset Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction Wander Lairson Costa <wander(a)redhat.com> netfilter: nfnetlink_osf: avoid OOB read Florian Westphal <fw(a)strlen.de> netfilter: nftables: exthdr: fix 4-byte stack OOB write Martin KaFai Lau <martin.lau(a)kernel.org> bpf: bpf_sk_storage: Fix the missing uncharge in sk_omem_alloc Martin KaFai Lau <martin.lau(a)kernel.org> bpf: bpf_sk_storage: Fix invalid wait context lockdep report Ilya Leoshkevich <iii(a)linux.ibm.com> s390/bpf: Pass through tail call counter in trampolines Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> bpf: Assign bpf_tramp_run_ctx::saved_run_ctx before recursion check. Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> bpf: Invoke __bpf_prog_exit_sleepable_recur() on recursion in kern_sys_bpf(). Jakub Kicinski <kuba(a)kernel.org> net: phylink: fix sphinx complaint about invalid literal Vladimir Oltean <vladimir.oltean(a)nxp.com> net: dsa: sja1105: complete tc-cbs offload support on SJA1110 Vladimir Oltean <vladimir.oltean(a)nxp.com> net: dsa: sja1105: fix -ENOSPC when replacing the same tc-cbs too many times Vladimir Oltean <vladimir.oltean(a)nxp.com> net: dsa: sja1105: fix bandwidth discrepancy between tc-cbs software and offload Bodong Wang <bodong(a)nvidia.com> mlx5/core: E-Switch, Create ACL FT for eswitch manager in switchdev mode Jiri Pirko <jiri(a)resnulli.us> net/mlx5: Push devlink port PF/VF init/cleanup calls out of devlink_port_register/unregister() Jiri Pirko <jiri(a)resnulli.us> net/mlx5: Rework devlink port alloc/free into init/cleanup Jiri Pirko <jiri(a)resnulli.us> net/mlx5: Give esw_offloads_load/unload_rep() "mlx5_" prefix Jianbo Liu <jianbol(a)nvidia.com> net/mlx5e: Clear mirred devices array if the rule is split Eric Dumazet <edumazet(a)google.com> ip_tunnels: use DEV_STATS_INC() Ariel Marcovitch <arielmarcovitch(a)gmail.com> idr: fix param name in idr_alloc_cyclic() doc Jerome Neanne <jneanne(a)baylibre.com> regulator: tps6594-regulator: Fix random kernel crash Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> s390/zcrypt: don't leak memory if dev_set_name() fails Olga Zaborska <olga.zaborska(a)intel.com> igb: Change IGB_MIN to allow set rx/tx value between 64 and 80 Olga Zaborska <olga.zaborska(a)intel.com> igbvf: Change IGBVF_MIN to allow set rx/tx value between 64 and 80 Olga Zaborska <olga.zaborska(a)intel.com> igc: Change IGC_MIN to allow set rx/tx value between 64 and 80 Geetha sowjanya <gakula(a)marvell.com> octeontx2-af: Fix truncation of smq in CN10K NIX AQ enqueue mbox handler Shigeru Yoshida <syoshida(a)redhat.com> kcm: Destroy mutex in kcm_exit_net() valis <sec(a)valis.email> net: sched: sch_qfq: Fix UAF in qfq_dequeue() Kuniyuki Iwashima <kuniyu(a)amazon.com> af_unix: Fix data race around sk->sk_err. Kuniyuki Iwashima <kuniyu(a)amazon.com> af_unix: Fix data-races around sk->sk_shutdown. Kuniyuki Iwashima <kuniyu(a)amazon.com> af_unix: Fix data-race around unix_tot_inflight. Kuniyuki Iwashima <kuniyu(a)amazon.com> af_unix: Fix data-races around user->unix_inflight. Kuniyuki Iwashima <kuniyu(a)amazon.com> af_unix: Fix msg_controllen test in scm_pidfd_recv() for MSG_CMSG_COMPAT. John Fastabend <john.fastabend(a)gmail.com> bpf, sockmap: Fix skb refcnt race after locking changes Oleksij Rempel <linux(a)rempel-privat.de> net: phy: micrel: Correct bit assignments for phy_device flags Alex Henrie <alexhenrie24(a)gmail.com> net: ipv6/addrconf: avoid integer underflow in ipv6_create_tempaddr Liang Chen <liangchen.linux(a)gmail.com> veth: Fixing transmit return status for dropped packets Eric Dumazet <edumazet(a)google.com> gve: fix frag_list chaining Corinna Vinschen <vinschen(a)redhat.com> igb: disable virtualization features on 82580 Xu Kuohai <xukuohai(a)huawei.com> selftests/bpf: Fix a CI failure caused by vsock write Sriram Yagnaraman <sriram.yagnaraman(a)est.tech> ipv6: ignore dst hint for multipath routes Sriram Yagnaraman <sriram.yagnaraman(a)est.tech> ipv4: ignore dst hint for multipath routes Eric Dumazet <edumazet(a)google.com> net: annotate data-races around sk->sk_bind_phc Eric Dumazet <edumazet(a)google.com> net: annotate data-races around sk->sk_tsflags Eric Dumazet <edumazet(a)google.com> mptcp: annotate data-races around msk->rmem_fwd_alloc Eric Dumazet <edumazet(a)google.com> net: annotate data-races around sk->sk_forward_alloc Eric Dumazet <edumazet(a)google.com> net: use sk_forward_alloc_get() in sk_get_meminfo() Eric Dumazet <edumazet(a)google.com> net/handshake: fix null-ptr-deref in handshake_nl_done_doit() Hamza Mahfooz <hamza.mahfooz(a)amd.com> drm/amd/display: fix mode scaling (RMX_.*) Sean Christopherson <seanjc(a)google.com> drm/i915/gvt: Drop unused helper intel_vgpu_reset_gtt() Sean Christopherson <seanjc(a)google.com> drm/i915/gvt: Put the page reference obtained by KVM's gfn_to_pfn() Sean Christopherson <seanjc(a)google.com> drm/i915/gvt: Verify pfn is "valid" before dereferencing "struct page" Xiubo Li <xiubli(a)redhat.com> ceph: make members in struct ceph_mds_request_args_ext a union Magnus Karlsson <magnus.karlsson(a)intel.com> xsk: Fix xsk_diag use-after-free error during socket cleanup Florian Westphal <fw(a)strlen.de> net: fib: avoid warn splat in flow dissector Eric Dumazet <edumazet(a)google.com> net: read sk->sk_family once in sk_mc_loop() Eric Dumazet <edumazet(a)google.com> ipv4: annotate data-races around fi->fib_dead Eric Dumazet <edumazet(a)google.com> sctp: annotate data-races around sk->sk_wmem_queued Eric Dumazet <edumazet(a)google.com> net/sched: fq_pie: avoid stalls in fq_pie_timer() Katya Orlova <e.orlova(a)ispras.ru> smb: propagate error code of extract_sharename() Phil Sutter <phil(a)nwl.cc> netfilter: nf_tables: Audit log rule reset Phil Sutter <phil(a)nwl.cc> netfilter: nf_tables: Audit log setelem reset Yu Kuai <yukuai3(a)huawei.com> blk-throttle: consider 'carryover_ios/bytes' in throtl_trim_slice() Yu Kuai <yukuai3(a)huawei.com> blk-throttle: use calculate_io/bytes_allowed() for throtl_trim_slice() Andrzej Hajda <andrzej.hajda(a)intel.com> drm/i915: mark requests for GuC virtual engines to avoid use-after-free Yonghong Song <yonghong.song(a)linux.dev> selftests/bpf: Fix flaky cgroup_iter_sleepable subtest Vincent Whitchurch <vincent.whitchurch(a)axis.com> regulator: tps6287x: Fix n_voltages Namhyung Kim <namhyung(a)kernel.org> perf test stat_bpf_counters_cgrp: Enhance perf stat cgroup BPF counter test Kajol Jain <kjain(a)linux.ibm.com> perf test stat_bpf_counters_cgrp: Fix shellcheck issue about logical operators Miquel Raynal <miquel.raynal(a)bootlin.com> i3c: master: svc: Describe member 'saved_regs' Ian Rogers <irogers(a)google.com> perf header: Fix missing PMU caps Justin Stitt <justinstitt(a)google.com> accel/ivpu: refactor deprecated strncpy Vladimir Zapolskiy <vz(a)mleia.com> pwm: lpc32xx: Remove handling of PWM channels Ilkka Koskinen <ilkka(a)os.amperecomputing.com> perf vendor events arm64: Remove L1D_CACHE_LMISS from AmpereOne list Raag Jadav <raag.jadav(a)intel.com> watchdog: intel-mid_wdt: add MODULE_ALIAS() to allow auto-load Arnaldo Carvalho de Melo <acme(a)redhat.com> perf lock: Don't pass an ERR_PTR() directly to perf_session__delete() Arnaldo Carvalho de Melo <acme(a)redhat.com> perf top: Don't pass an ERR_PTR() directly to perf_session__delete() Kajol Jain <kjain(a)linux.ibm.com> perf vendor events: Update metric event names for power10 platform Kajol Jain <kjain(a)linux.ibm.com> perf vendor events: Move JSON/events to appropriate files for power10 platform Kajol Jain <kjain(a)linux.ibm.com> perf vendor events: Drop STORES_PER_INST metric event for power10 platform Kajol Jain <kjain(a)linux.ibm.com> perf vendor events: Drop some of the JSON/events for power10 platform Kajol Jain <kjain(a)linux.ibm.com> perf vendor events: Update the JSON/events descriptions for power10 platform Adrian Hunter <adrian.hunter(a)intel.com> perf dlfilter: Add al_cleanup() Arnaldo Carvalho de Melo <acme(a)kernel.org> perf dlfilter: Initialize addr_location before passing it to thread__find_symbol_fb() Namhyung Kim <namhyung(a)kernel.org> perf bpf-filter: Fix sample flag check with || Ivan Babrou <ivan(a)cloudflare.com> perf script: Print "cgroup" field on the same line as "comm" Sean Christopherson <seanjc(a)google.com> x86/virt: Drop unnecessary check on extended CPUID level in cpu_has_svm() Arnaldo Carvalho de Melo <acme(a)redhat.com> perf annotate bpf: Don't enclose non-debug code with an assert() Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: tca6416-keypad - fix interrupt enable disbalance Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: tca6416-keypad - always expect proper IRQ number in i2c client Sean Christopherson <seanjc(a)google.com> KVM: SVM: Don't defer NMI unblocking until next exit for SEV-ES guests Ian Rogers <irogers(a)google.com> perf parse-events: Additional error reporting Ian Rogers <irogers(a)google.com> perf parse-events: Separate ENOMEM memory handling Ian Rogers <irogers(a)google.com> perf parse-events: Move instances of YYABORT to YYNOMEM Ian Rogers <irogers(a)google.com> perf parse-events: Separate YYABORT and YYNOMEM cases Ying Liu <victor.liu(a)nxp.com> backlight: gpio_backlight: Drop output GPIO direction check for initial power state Artur Weber <aweber.kernel(a)gmail.com> backlight: lp855x: Initialize PWM state on first brightness change Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> pwm: atmel-tcb: Fix resource freeing in error path and remove Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> pwm: atmel-tcb: Harmonize resource allocation order Arnaldo Carvalho de Melo <acme(a)redhat.com> perf trace: Really free the evsel->priv area Jeff LaBundy <jeff(a)labundy.com> Input: iqs7222 - configure power mode before triggering ATI Xie XiuQi <xiexiuqi(a)huawei.com> tools/mm: fix undefined reference to pthread_once Konstantin Meskhidze <konstantin.meskhidze(a)huawei.com> kconfig: fix possible buffer overflow Jonathan Marek <jonathan(a)marek.ca> mailbox: qcom-ipcc: fix incorrect num_chans counting Andreas Gruenbacher <agruenba(a)redhat.com> gfs2: low-memory forced flush fixes Andreas Gruenbacher <agruenba(a)redhat.com> gfs2: Switch to wait_event in gfs2_logd Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> tpm_crb: Fix an error handling path in crb_acpi_add() Jiri Slaby <jirislaby(a)kernel.org> kbuild: dummy-tools: make MPROFILE_KERNEL checks work on BE Masahiro Yamada <masahiroy(a)kernel.org> kbuild: do not run depmod for 'make modules_sign' Masahiro Yamada <masahiroy(a)kernel.org> kbuild: rpm-pkg: define _arch conditionally Qiang Yu <quic_qianyu(a)quicinc.com> bus: mhi: host: Skip MHI reset if device is in RDDM Fedor Pchelkin <pchelkin(a)ispras.ru> NFSv4/pnfs: minor fix for cleanup path in nfs4_get_device_info Trond Myklebust <trond.myklebust(a)hammerspace.com> NFS: Fix a potential data corruption Johan Hovold <johan+linaro(a)kernel.org> clk: qcom: mss-sc7180: fix missing resume during probe Johan Hovold <johan+linaro(a)kernel.org> clk: qcom: q6sstop-qcs404: fix missing resume during probe Johan Hovold <johan+linaro(a)kernel.org> clk: qcom: lpasscc-sc7280: fix missing resume during probe Johan Hovold <johan+linaro(a)kernel.org> clk: qcom: dispcc-sm8550: fix runtime PM imbalance on probe errors Johan Hovold <johan+linaro(a)kernel.org> clk: qcom: dispcc-sm8450: fix runtime PM imbalance on probe errors Chris Lew <quic_clew(a)quicinc.com> soc: qcom: qmi_encdec: Restrict string length in decode Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> clk: qcom: gcc-mdm9615: use proper parent for pll0_vote clock Marco Felsch <m.felsch(a)pengutronix.de> clk: imx: pll14xx: align pdiv with reference manual Ahmad Fatoum <a.fatoum(a)pengutronix.de> clk: imx: pll14xx: dynamically configure PLL for 393216000/361267200Hz Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> dt-bindings: clock: xlnx,versal-clk: drop select:false Raag Jadav <raag.jadav(a)intel.com> pinctrl: cherryview: fix address_space_handler() argument Bharath SM <bharathsm(a)microsoft.com> cifs: update desired access while requesting for directory lease Helge Deller <deller(a)gmx.de> parisc: led: Reduce CPU overhead for disk & lan LED computation Helge Deller <deller(a)gmx.de> parisc: led: Fix LAN receive and transmit LEDs Kalesh Singh <kaleshsingh(a)google.com> Multi-gen LRU: avoid race in inc_min_seq() Andrew Donnellan <ajd(a)linux.ibm.com> lib/test_meminit: allocate pages up to order MAX_ORDER Muchun Song <muchun.song(a)linux.dev> mm: hugetlb_vmemmap: fix a race between vmemmap pmd split Michal Hocko <mhocko(a)suse.com> memcg: drop kmem.limit_in_bytes Steve French <stfrench(a)microsoft.com> send channel sequence number in SMB3 requests after reconnects Aleksey Nasibulin <alealexpro100(a)ya.ru> ARM: dts: BCM5301X: Extend RAM to full 256MB for Linksys EA6500 V2 Chris Paterson <chris.paterson2(a)renesas.com> arm64: dts: renesas: rzg2l: Fix txdv-skew-psec typos Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> ARM: dts: qcom: msm8974pro-castor: correct touchscreen syna,nosleep-mode Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> ARM: dts: qcom: msm8974pro-castor: correct touchscreen function names Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> arm64: dts: qcom: msm8953-vince: drop duplicated touschreen parent interrupt Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> ARM: dts: qcom: msm8974pro-castor: correct inverted X of touchscreen Johan Hovold <johan+linaro(a)kernel.org> clk: qcom: turingcc-qcs404: fix missing resume during probe Sameer Pujar <spujar(a)nvidia.com> arm64: tegra: Update AHUB clock parent and rate Sheetal <sheetal(a)nvidia.com> arm64: tegra: Update AHUB clock parent and rate on Tegra234 Paul Cercueil <paul(a)crapouillou.net> ARM: dts: samsung: exynos4210-i9100: Fix LCD screen's physical size Sheetal <sheetal(a)nvidia.com> ASoC: tegra: Fix SFC conversion for few rates Thomas Zimmermann <tzimmermann(a)suse.de> drm/ast: Fix DRAM init on AST2200 Johan Hovold <johan+linaro(a)kernel.org> clk: qcom: camcc-sc7180: fix async resume during probe Thomas Zimmermann <tzimmermann(a)suse.de> fbdev/ep93xx-fb: Do not assign to struct fb_info.dev Ian Kent <raven(a)themaw.net> kernfs: fix missing kernfs_iattr_rwsem locking Chengming Zhou <zhouchengming(a)bytedance.com> null_blk: fix poll request timeout handling Quinn Tran <qutran(a)marvell.com> scsi: qla2xxx: Fix firmware resource tracking Quinn Tran <qutran(a)marvell.com> scsi: qla2xxx: Error code did not return to upper layer Nilesh Javali <njavali(a)marvell.com> scsi: qla2xxx: Fix smatch warn for qla_init_iocb_limit() Quinn Tran <qutran(a)marvell.com> scsi: qla2xxx: Flush mailbox commands on chip reset Manish Rangankar <mrangankar(a)marvell.com> scsi: qla2xxx: Remove unsupported ql2xenabledif option Quinn Tran <qutran(a)marvell.com> scsi: qla2xxx: Fix TMF leak through Quinn Tran <qutran(a)marvell.com> scsi: qla2xxx: Fix session hang in gnl Quinn Tran <qutran(a)marvell.com> scsi: qla2xxx: Turn off noisy message log Quinn Tran <qutran(a)marvell.com> scsi: qla2xxx: Fix erroneous link up failure Quinn Tran <qutran(a)marvell.com> scsi: qla2xxx: Fix command flush during TMF Quinn Tran <qutran(a)marvell.com> scsi: qla2xxx: fix inconsistent TMF timeout Quinn Tran <qutran(a)marvell.com> scsi: qla2xxx: Fix deletion race condition Quinn Tran <qutran(a)marvell.com> scsi: qla2xxx: Limit TMF to 8 per function Quinn Tran <qutran(a)marvell.com> scsi: qla2xxx: Adjust IOCB resource on qpair create Bean Huo <beanhuo(a)micron.com> scsi: ufs: core: Add advanced RPMB support where UFSHCI 4.0 does not support EHS length in UTRD Gurchetan Singh <gurchetansingh(a)chromium.org> drm/virtio: Conditionally allocate virtio_gpu_fence Quan Tian <qtian(a)vmware.com> net/ipv6: SKB symmetric hash should incorporate transport ports ------------- Diffstat: Documentation/admin-guide/cgroup-v1/memory.rst | 2 - .../devicetree/bindings/clock/xlnx,versal-clk.yaml | 2 - Makefile | 6 +- arch/arc/include/asm/atomic-llsc.h | 6 +- arch/arc/include/asm/atomic64-arcv2.h | 6 +- .../dts/broadcom/bcm4708-linksys-ea6500-v2.dts | 3 +- .../qcom-msm8974pro-sony-xperia-shinano-castor.dts | 8 +- arch/arm/boot/dts/samsung/exynos4210-i9100.dts | 4 +- arch/arm64/boot/dts/nvidia/tegra186.dtsi | 3 +- arch/arm64/boot/dts/nvidia/tegra194.dtsi | 3 +- arch/arm64/boot/dts/nvidia/tegra210.dtsi | 3 +- arch/arm64/boot/dts/nvidia/tegra234.dtsi | 3 +- arch/arm64/boot/dts/qcom/msm8953-xiaomi-vince.dts | 1 - arch/arm64/boot/dts/renesas/rzg2l-smarc-som.dtsi | 4 +- arch/arm64/boot/dts/renesas/rzg2lc-smarc-som.dtsi | 2 +- arch/arm64/boot/dts/renesas/rzg2ul-smarc-som.dtsi | 4 +- arch/mips/Makefile | 6 +- arch/parisc/include/asm/led.h | 4 +- arch/parisc/include/asm/mckinley.h | 8 - arch/s390/net/bpf_jit_comp.c | 10 + arch/sh/boards/mach-ap325rxa/setup.c | 2 +- arch/sh/boards/mach-ecovec24/setup.c | 6 +- arch/sh/boards/mach-kfr2r09/setup.c | 2 +- arch/sh/boards/mach-migor/setup.c | 2 +- arch/sh/boards/mach-se/7724/setup.c | 6 +- arch/sh/drivers/push-switch.c | 2 +- arch/x86/include/asm/virtext.h | 6 - arch/x86/kvm/svm/avic.c | 59 +++- arch/x86/kvm/svm/nested.c | 9 +- arch/x86/kvm/svm/sev.c | 14 +- arch/x86/kvm/svm/svm.c | 45 ++- arch/x86/kvm/vmx/vmx.c | 21 +- block/blk-throttle.c | 99 +++--- drivers/accel/ivpu/ivpu_jsm_msg.c | 3 +- drivers/ata/ahci.c | 2 + drivers/ata/pata_falcon.c | 50 +-- drivers/ata/pata_ftide010.c | 1 + drivers/ata/sata_gemini.c | 1 + drivers/block/null_blk/main.c | 12 +- drivers/bus/mhi/host/pm.c | 5 + drivers/char/tpm/tpm_crb.c | 5 +- drivers/clk/imx/clk-pll14xx.c | 13 +- drivers/clk/qcom/camcc-sc7180.c | 2 +- drivers/clk/qcom/dispcc-sm8450.c | 13 +- drivers/clk/qcom/dispcc-sm8550.c | 13 +- drivers/clk/qcom/gcc-mdm9615.c | 2 +- drivers/clk/qcom/lpasscc-sc7280.c | 16 +- drivers/clk/qcom/mss-sc7180.c | 13 +- drivers/clk/qcom/q6sstop-qcs404.c | 15 +- drivers/clk/qcom/turingcc-qcs404.c | 13 +- drivers/clocksource/arm_arch_timer.c | 7 + drivers/dma/sh/rz-dmac.c | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 26 +- drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c | 3 + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4 +- .../drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c | 7 + drivers/gpu/drm/amd/display/dc/Makefile | 1 + drivers/gpu/drm/amd/display/dc/core/dc.c | 68 ++-- drivers/gpu/drm/amd/display/dc/dcn10/dcn10_mpc.c | 5 +- drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c | 11 - .../gpu/drm/amd/display/dc/dml/dcn20/dcn20_fpu.c | 25 +- .../drm/amd/display/modules/freesync/freesync.c | 9 +- drivers/gpu/drm/ast/ast_post.c | 2 +- drivers/gpu/drm/i915/gt/intel_engine_types.h | 1 + drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c | 3 + drivers/gpu/drm/i915/gvt/gtt.c | 27 +- drivers/gpu/drm/i915/gvt/gtt.h | 1 - drivers/gpu/drm/i915/i915_request.c | 7 +- drivers/gpu/drm/mxsfb/mxsfb_kms.c | 9 + drivers/gpu/drm/virtio/virtgpu_submit.c | 32 +- drivers/hwspinlock/qcom_hwspinlock.c | 9 + drivers/i3c/master/svc-i3c-master.c | 1 + drivers/input/keyboard/tca6416-keypad.c | 31 +- drivers/input/misc/iqs7222.c | 8 +- drivers/mailbox/qcom-ipcc.c | 4 +- drivers/misc/fastrpc.c | 22 +- drivers/mtd/nand/raw/brcmnand/brcmnand.c | 112 ++++-- drivers/mtd/spi-nor/winbond.c | 5 +- drivers/net/dsa/microchip/ksz_common.c | 16 +- drivers/net/dsa/sja1105/sja1105.h | 4 + drivers/net/dsa/sja1105/sja1105_dynamic_config.c | 93 +++-- drivers/net/dsa/sja1105/sja1105_main.c | 120 +++++-- drivers/net/dsa/sja1105/sja1105_spi.c | 4 + drivers/net/ethernet/adi/adin1110.c | 10 +- drivers/net/ethernet/cadence/macb_main.c | 5 +- drivers/net/ethernet/freescale/enetc/enetc_pf.c | 2 +- drivers/net/ethernet/google/gve/gve_rx_dqo.c | 5 +- drivers/net/ethernet/hisilicon/hns3/hnae3.h | 1 + drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c | 7 +- drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 19 +- drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c | 4 +- .../net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c | 20 +- .../ethernet/hisilicon/hns3/hns3pf/hclge_debugfs.c | 14 +- .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 5 +- .../ethernet/hisilicon/hns3/hns3pf/hclge_main.h | 2 - drivers/net/ethernet/intel/igb/igb.h | 4 +- drivers/net/ethernet/intel/igb/igb_main.c | 10 +- drivers/net/ethernet/intel/igbvf/igbvf.h | 4 +- drivers/net/ethernet/intel/igc/igc.h | 4 +- drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c | 28 +- drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 5 + .../net/ethernet/marvell/octeontx2/af/rvu_nix.c | 21 +- drivers/net/ethernet/marvell/octeontx2/nic/cn10k.c | 6 +- drivers/net/ethernet/marvell/octeontx2/nic/cn10k.h | 2 +- .../ethernet/marvell/octeontx2/nic/otx2_common.c | 43 +-- .../ethernet/marvell/octeontx2/nic/otx2_common.h | 3 +- .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 7 +- .../net/ethernet/marvell/octeontx2/nic/otx2_txrx.c | 30 +- .../net/ethernet/marvell/octeontx2/nic/otx2_txrx.h | 4 +- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 3 + .../net/ethernet/mellanox/mlx5/core/en/tc/act/ct.c | 4 +- .../ethernet/mellanox/mlx5/core/en/tc/act/mirred.c | 1 + .../ethernet/mellanox/mlx5/core/en/tc/act/pedit.c | 4 +- .../mlx5/core/en/tc/act/redirect_ingress.c | 1 + .../ethernet/mellanox/mlx5/core/en/tc/act/vlan.c | 1 + .../mellanox/mlx5/core/en/tc/act/vlan_mangle.c | 4 +- drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 1 + .../ethernet/mellanox/mlx5/core/esw/devlink_port.c | 62 ++-- drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 64 +++- drivers/net/ethernet/mellanox/mlx5/core/eswitch.h | 8 +- .../ethernet/mellanox/mlx5/core/eswitch_offloads.c | 75 ++-- drivers/net/ethernet/microchip/vcap/vcap_api.c | 18 +- drivers/net/ethernet/renesas/rswitch.c | 8 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 10 +- drivers/net/phy/micrel.c | 9 +- drivers/net/usb/r8152.c | 3 + drivers/net/veth.c | 6 +- drivers/parisc/led.c | 4 +- drivers/parisc/sba_iommu.c | 10 +- drivers/pinctrl/intel/pinctrl-cherryview.c | 5 +- drivers/platform/mellanox/Kconfig | 4 +- drivers/platform/mellanox/mlxbf-pmc.c | 41 +-- drivers/platform/mellanox/mlxbf-tmfifo.c | 90 +++-- drivers/pwm/pwm-atmel-tcb.c | 64 ++-- drivers/pwm/pwm-lpc32xx.c | 16 +- drivers/regulator/raa215300.c | 32 +- drivers/regulator/tps6287x-regulator.c | 2 +- drivers/regulator/tps6594-regulator.c | 31 +- drivers/s390/crypto/zcrypt_api.c | 1 + drivers/scsi/qla2xxx/qla_attr.c | 2 - drivers/scsi/qla2xxx/qla_dbg.c | 2 +- drivers/scsi/qla2xxx/qla_def.h | 21 +- drivers/scsi/qla2xxx/qla_dfs.c | 10 + drivers/scsi/qla2xxx/qla_gbl.h | 1 + drivers/scsi/qla2xxx/qla_init.c | 234 ++++++++----- drivers/scsi/qla2xxx/qla_inline.h | 57 +++- drivers/scsi/qla2xxx/qla_iocb.c | 1 + drivers/scsi/qla2xxx/qla_isr.c | 7 +- drivers/scsi/qla2xxx/qla_mbx.c | 7 +- drivers/scsi/qla2xxx/qla_nvme.c | 3 +- drivers/scsi/qla2xxx/qla_os.c | 26 +- drivers/scsi/qla2xxx/qla_target.c | 14 +- drivers/soc/qcom/qmi_encdec.c | 4 +- drivers/ufs/core/ufs_bsg.c | 3 +- drivers/ufs/core/ufshcd.c | 10 +- drivers/video/backlight/gpio_backlight.c | 3 +- drivers/video/backlight/lp855x_bl.c | 20 +- drivers/video/fbdev/ep93xx-fb.c | 1 - drivers/watchdog/Kconfig | 2 + drivers/watchdog/intel-mid_wdt.c | 1 + fs/btrfs/disk-io.c | 5 +- fs/btrfs/extent-tree.c | 43 +-- fs/btrfs/file-item.c | 34 +- fs/btrfs/file-item.h | 6 +- fs/btrfs/inode.c | 7 + fs/btrfs/raid56.c | 4 +- fs/btrfs/relocation.c | 12 +- fs/btrfs/scrub.c | 152 ++++++--- fs/btrfs/space-info.c | 6 +- fs/btrfs/transaction.c | 26 +- fs/btrfs/zoned.c | 16 +- fs/ext4/balloc.c | 15 +- fs/ext4/block_validity.c | 8 +- fs/ext4/crypto.c | 4 + fs/ext4/ext4.h | 2 + fs/ext4/extents_status.c | 44 ++- fs/ext4/file.c | 25 +- fs/f2fs/data.c | 8 +- fs/f2fs/f2fs.h | 24 +- fs/f2fs/inline.c | 3 +- fs/f2fs/segment.c | 2 + fs/fuse/readdir.c | 10 +- fs/gfs2/aops.c | 4 +- fs/gfs2/log.c | 25 +- fs/jbd2/checkpoint.c | 22 +- fs/jbd2/recovery.c | 12 +- fs/kernfs/dir.c | 4 + fs/nfs/direct.c | 20 +- fs/nfs/pnfs_dev.c | 2 +- fs/smb/client/cached_dir.c | 2 +- fs/smb/client/cifsglob.h | 1 + fs/smb/client/connect.c | 1 + fs/smb/client/fscache.c | 2 +- fs/smb/client/smb2ops.c | 11 +- fs/smb/client/smb2pdu.c | 11 + fs/smb/common/smb2pdu.h | 22 ++ include/linux/audit.h | 2 + include/linux/bpf.h | 12 + include/linux/ceph/ceph_fs.h | 24 +- include/linux/export-internal.h | 2 + include/linux/ipv6.h | 1 + include/linux/micrel_phy.h | 7 +- include/linux/phylink.h | 4 +- include/linux/tca6416_keypad.h | 1 - include/net/ip.h | 3 +- include/net/ip6_fib.h | 5 +- include/net/ip_fib.h | 5 +- include/net/ip_tunnels.h | 15 +- include/net/ipv6.h | 7 +- include/net/scm.h | 14 +- include/net/sock.h | 29 +- kernel/auditsc.c | 2 + kernel/bpf/bpf_local_storage.c | 49 +-- kernel/bpf/core.c | 10 +- kernel/bpf/syscall.c | 2 +- kernel/bpf/trampoline.c | 5 +- kernel/trace/bpf_trace.c | 11 - lib/idr.c | 2 +- lib/kunit/test.c | 3 +- lib/test_meminit.c | 2 +- lib/test_scanf.c | 2 +- mm/hugetlb_vmemmap.c | 34 +- mm/memcontrol.c | 32 +- mm/mremap.c | 2 +- mm/vmscan.c | 13 +- net/can/j1939/socket.c | 10 +- net/core/flow_dissector.c | 3 +- net/core/skbuff.c | 10 +- net/core/skmsg.c | 12 +- net/core/sock.c | 27 +- net/handshake/netlink.c | 18 +- net/hsr/hsr_forward.c | 1 + net/ipv4/devinet.c | 10 +- net/ipv4/fib_semantics.c | 5 +- net/ipv4/fib_trie.c | 3 +- net/ipv4/inet_hashtables.c | 36 +- net/ipv4/ip_input.c | 3 +- net/ipv4/ip_output.c | 2 +- net/ipv4/ip_sockglue.c | 2 +- net/ipv4/route.c | 1 + net/ipv4/tcp.c | 4 +- net/ipv4/tcp_output.c | 2 +- net/ipv4/udp.c | 6 +- net/ipv6/addrconf.c | 2 +- net/ipv6/ip6_input.c | 3 +- net/ipv6/ip6_output.c | 2 +- net/ipv6/ping.c | 2 +- net/ipv6/raw.c | 2 +- net/ipv6/route.c | 3 + net/ipv6/udp.c | 2 +- net/kcm/kcmsock.c | 15 +- net/mptcp/protocol.c | 23 +- net/netfilter/nf_tables_api.c | 54 ++- net/netfilter/nfnetlink_osf.c | 8 + net/netfilter/nft_exthdr.c | 22 +- net/netfilter/nft_set_rbtree.c | 8 +- net/sched/sch_fq_pie.c | 27 +- net/sched/sch_plug.c | 2 +- net/sched/sch_qfq.c | 22 +- net/sctp/proc.c | 2 +- net/sctp/socket.c | 10 +- net/smc/smc_core.c | 2 + net/socket.c | 15 +- net/tls/tls_sw.c | 4 +- net/unix/af_unix.c | 2 +- net/unix/scm.c | 6 +- net/xdp/xsk_diag.c | 3 + scripts/dummy-tools/gcc | 3 +- scripts/kconfig/preprocess.c | 3 + scripts/mod/modpost.c | 9 + scripts/package/mkspec | 2 +- sound/soc/tegra/tegra210_sfc.c | 31 +- sound/soc/tegra/tegra210_sfc.h | 4 +- tools/build/Makefile.build | 10 + tools/mm/Makefile | 4 +- tools/perf/Documentation/perf-dlfilter.txt | 22 +- tools/perf/Makefile.perf | 2 +- tools/perf/builtin-lock.c | 1 + tools/perf/builtin-script.c | 22 +- tools/perf/builtin-top.c | 1 + tools/perf/builtin-trace.c | 9 +- tools/perf/dlfilters/dlfilter-test-api-v2.c | 377 +++++++++++++++++++++ tools/perf/include/perf/perf_dlfilter.h | 11 +- tools/perf/pmu-events/Build | 6 + .../arch/arm64/ampere/ampereone/cache.json | 3 - .../pmu-events/arch/powerpc/power10/cache.json | 47 +-- .../arch/powerpc/power10/floating_point.json | 66 +++- .../pmu-events/arch/powerpc/power10/frontend.json | 188 +--------- .../pmu-events/arch/powerpc/power10/marked.json | 194 ++++++++--- .../pmu-events/arch/powerpc/power10/memory.json | 91 +---- .../pmu-events/arch/powerpc/power10/metrics.json | 56 ++- .../pmu-events/arch/powerpc/power10/others.json | 209 ++---------- .../pmu-events/arch/powerpc/power10/pipeline.json | 269 +++++++++++---- .../perf/pmu-events/arch/powerpc/power10/pmc.json | 193 ++++++++++- .../arch/powerpc/power10/translation.json | 42 +-- tools/perf/pmu-events/jevents.py | 2 +- tools/perf/tests/dlfilter-test.c | 38 ++- tools/perf/tests/shell/stat_bpf_counters.sh | 4 +- tools/perf/tests/shell/stat_bpf_counters_cgrp.sh | 28 +- tools/perf/ui/browsers/hists.c | 60 ++-- tools/perf/util/annotate.c | 10 +- tools/perf/util/bpf-filter.c | 14 +- tools/perf/util/dlfilter.c | 30 ++ tools/perf/util/expr.c | 4 +- tools/perf/util/header.c | 42 +-- tools/perf/util/parse-events.c | 4 +- tools/perf/util/parse-events.y | 256 +++++++++----- tools/perf/util/pmu.c | 4 +- .../selftests/bpf/prog_tests/bpf_obj_pinning.c | 5 +- .../selftests/bpf/prog_tests/sockmap_helpers.h | 26 ++ .../selftests/bpf/prog_tests/sockmap_listen.c | 7 + .../trigger-synthetic-event-dynstring.tc | 2 +- .../trigger-synthetic_event_syntax_errors.tc | 2 +- tools/testing/selftests/kselftest/runner.sh | 3 +- tools/testing/selftests/lib.mk | 4 +- tools/testing/selftests/net/bind_wildcard.c | 2 +- 316 files changed, 3898 insertions(+), 2319 deletions(-)

2 years

18
318
0 0

[PATCH v2] nvme: remove unprivileged passthrough support

by Kanchan Joshi

Passthrough has got a hole that can be exploited to cause kernel memory corruption. This is about making the device do larger DMA into short meta/data buffer owned by kernel [1]. As a stopgap measure, disable the support of unprivileged passthrough. This patch brings back coarse-granular CAP_SYS_ADMIN checks by reverting following patches: - 7d9d7d59d44 ("nvme: replace the fmode_t argument to the nvme ioctl handlers with a simple bool") - 313c08c72ee ("nvme: don't allow unprivileged passthrough on partitions") - 6f99ac04c46 ("nvme: consult the CSE log page for unprivileged passthrough") - ea43fceea41 ("nvme: allow unprivileged passthrough of Identify Controller") - e4fbcf32c86 ("nvme: identify-namespace without CAP_SYS_ADMIN") - 855b7717f44 ("nvme: fine-granular CAP_SYS_ADMIN for nvme io commands") [1] https://lore.kernel.org/linux-nvme/20231013051458.39987-1-joshi.k@samsung.c… CC: stable(a)vger.kernel.org # 6.2 Fixes: 855b7717f44b1 ("nvme: fine-granular CAP_SYS_ADMIN for nvme io commands") Suggested-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Kanchan Joshi <joshi.k(a)samsung.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> --- Changes since v1: - Fix the way "Fixes:" was written before (Greg) drivers/nvme/host/ioctl.c | 159 ++++++++------------------------------ include/linux/nvme.h | 2 - 2 files changed, 34 insertions(+), 127 deletions(-) diff --git a/drivers/nvme/host/ioctl.c b/drivers/nvme/host/ioctl.c index d8ff796fd5f2..788b36e7915a 100644 --- a/drivers/nvme/host/ioctl.c +++ b/drivers/nvme/host/ioctl.c @@ -10,80 +10,8 @@ enum { NVME_IOCTL_VEC = (1 << 0), - NVME_IOCTL_PARTITION = (1 << 1), }; -static bool nvme_cmd_allowed(struct nvme_ns *ns, struct nvme_command *c, - unsigned int flags, bool open_for_write) -{ - u32 effects; - - if (capable(CAP_SYS_ADMIN)) - return true; - - /* - * Do not allow unprivileged passthrough on partitions, as that allows an - * escape from the containment of the partition. - */ - if (flags & NVME_IOCTL_PARTITION) - return false; - - /* - * Do not allow unprivileged processes to send vendor specific or fabrics - * commands as we can't be sure about their effects. - */ - if (c->common.opcode >= nvme_cmd_vendor_start || - c->common.opcode == nvme_fabrics_command) - return false; - - /* - * Do not allow unprivileged passthrough of admin commands except - * for a subset of identify commands that contain information required - * to form proper I/O commands in userspace and do not expose any - * potentially sensitive information. - */ - if (!ns) { - if (c->common.opcode == nvme_admin_identify) { - switch (c->identify.cns) { - case NVME_ID_CNS_NS: - case NVME_ID_CNS_CS_NS: - case NVME_ID_CNS_NS_CS_INDEP: - case NVME_ID_CNS_CS_CTRL: - case NVME_ID_CNS_CTRL: - return true; - } - } - return false; - } - - /* - * Check if the controller provides a Commands Supported and Effects log - * and marks this command as supported. If not reject unprivileged - * passthrough. - */ - effects = nvme_command_effects(ns->ctrl, ns, c->common.opcode); - if (!(effects & NVME_CMD_EFFECTS_CSUPP)) - return false; - - /* - * Don't allow passthrough for command that have intrusive (or unknown) - * effects. - */ - if (effects & ~(NVME_CMD_EFFECTS_CSUPP | NVME_CMD_EFFECTS_LBCC | - NVME_CMD_EFFECTS_UUID_SEL | - NVME_CMD_EFFECTS_SCOPE_MASK)) - return false; - - /* - * Only allow I/O commands that transfer data to the controller or that - * change the logical block contents if the file descriptor is open for - * writing. - */ - if (nvme_is_write(c) || (effects & NVME_CMD_EFFECTS_LBCC)) - return open_for_write; - return true; -} - /* * Convert integer values from ioctl structures to user pointers, silently * ignoring the upper bits in the compat case to match behaviour of 32-bit @@ -335,8 +263,7 @@ static bool nvme_validate_passthru_nsid(struct nvme_ctrl *ctrl, } static int nvme_user_cmd(struct nvme_ctrl *ctrl, struct nvme_ns *ns, - struct nvme_passthru_cmd __user *ucmd, unsigned int flags, - bool open_for_write) + struct nvme_passthru_cmd __user *ucmd) { struct nvme_passthru_cmd cmd; struct nvme_command c; @@ -344,6 +271,8 @@ static int nvme_user_cmd(struct nvme_ctrl *ctrl, struct nvme_ns *ns, u64 result; int status; + if (!capable(CAP_SYS_ADMIN)) + return -EACCES; if (copy_from_user(&cmd, ucmd, sizeof(cmd))) return -EFAULT; if (cmd.flags) @@ -364,9 +293,6 @@ static int nvme_user_cmd(struct nvme_ctrl *ctrl, struct nvme_ns *ns, c.common.cdw14 = cpu_to_le32(cmd.cdw14); c.common.cdw15 = cpu_to_le32(cmd.cdw15); - if (!nvme_cmd_allowed(ns, &c, 0, open_for_write)) - return -EACCES; - if (cmd.timeout_ms) timeout = msecs_to_jiffies(cmd.timeout_ms); @@ -383,14 +309,16 @@ static int nvme_user_cmd(struct nvme_ctrl *ctrl, struct nvme_ns *ns, } static int nvme_user_cmd64(struct nvme_ctrl *ctrl, struct nvme_ns *ns, - struct nvme_passthru_cmd64 __user *ucmd, unsigned int flags, - bool open_for_write) + struct nvme_passthru_cmd64 __user *ucmd, + unsigned int flags) { struct nvme_passthru_cmd64 cmd; struct nvme_command c; unsigned timeout = 0; int status; + if (!capable(CAP_SYS_ADMIN)) + return -EACCES; if (copy_from_user(&cmd, ucmd, sizeof(cmd))) return -EFAULT; if (cmd.flags) @@ -411,9 +339,6 @@ static int nvme_user_cmd64(struct nvme_ctrl *ctrl, struct nvme_ns *ns, c.common.cdw14 = cpu_to_le32(cmd.cdw14); c.common.cdw15 = cpu_to_le32(cmd.cdw15); - if (!nvme_cmd_allowed(ns, &c, flags, open_for_write)) - return -EACCES; - if (cmd.timeout_ms) timeout = msecs_to_jiffies(cmd.timeout_ms); @@ -563,6 +488,9 @@ static int nvme_uring_cmd_io(struct nvme_ctrl *ctrl, struct nvme_ns *ns, void *meta = NULL; int ret; + if (!capable(CAP_SYS_ADMIN)) + return -EACCES; + c.common.opcode = READ_ONCE(cmd->opcode); c.common.flags = READ_ONCE(cmd->flags); if (c.common.flags) @@ -584,9 +512,6 @@ static int nvme_uring_cmd_io(struct nvme_ctrl *ctrl, struct nvme_ns *ns, c.common.cdw14 = cpu_to_le32(READ_ONCE(cmd->cdw14)); c.common.cdw15 = cpu_to_le32(READ_ONCE(cmd->cdw15)); - if (!nvme_cmd_allowed(ns, &c, 0, ioucmd->file->f_mode & FMODE_WRITE)) - return -EACCES; - d.metadata = READ_ONCE(cmd->metadata); d.addr = READ_ONCE(cmd->addr); d.data_len = READ_ONCE(cmd->data_len); @@ -643,13 +568,13 @@ static bool is_ctrl_ioctl(unsigned int cmd) } static int nvme_ctrl_ioctl(struct nvme_ctrl *ctrl, unsigned int cmd, - void __user *argp, bool open_for_write) + void __user *argp) { switch (cmd) { case NVME_IOCTL_ADMIN_CMD: - return nvme_user_cmd(ctrl, NULL, argp, 0, open_for_write); + return nvme_user_cmd(ctrl, NULL, argp); case NVME_IOCTL_ADMIN64_CMD: - return nvme_user_cmd64(ctrl, NULL, argp, 0, open_for_write); + return nvme_user_cmd64(ctrl, NULL, argp, 0); default: return sed_ioctl(ctrl->opal_dev, cmd, argp); } @@ -674,14 +599,16 @@ struct nvme_user_io32 { #endif /* COMPAT_FOR_U64_ALIGNMENT */ static int nvme_ns_ioctl(struct nvme_ns *ns, unsigned int cmd, - void __user *argp, unsigned int flags, bool open_for_write) + void __user *argp) { + unsigned int flags = 0; + switch (cmd) { case NVME_IOCTL_ID: force_successful_syscall_return(); return ns->head->ns_id; case NVME_IOCTL_IO_CMD: - return nvme_user_cmd(ns->ctrl, ns, argp, flags, open_for_write); + return nvme_user_cmd(ns->ctrl, ns, argp); /* * struct nvme_user_io can have different padding on some 32-bit ABIs. * Just accept the compat version as all fields that are used are the @@ -696,39 +623,32 @@ static int nvme_ns_ioctl(struct nvme_ns *ns, unsigned int cmd, flags |= NVME_IOCTL_VEC; fallthrough; case NVME_IOCTL_IO64_CMD: - return nvme_user_cmd64(ns->ctrl, ns, argp, flags, - open_for_write); + return nvme_user_cmd64(ns->ctrl, ns, argp, flags); default: return -ENOTTY; } } -int nvme_ioctl(struct block_device *bdev, blk_mode_t mode, +int nvme_ioctl(struct block_device *bdev, fmode_t mode, unsigned int cmd, unsigned long arg) { struct nvme_ns *ns = bdev->bd_disk->private_data; - bool open_for_write = mode & BLK_OPEN_WRITE; void __user *argp = (void __user *)arg; - unsigned int flags = 0; - - if (bdev_is_partition(bdev)) - flags |= NVME_IOCTL_PARTITION; if (is_ctrl_ioctl(cmd)) - return nvme_ctrl_ioctl(ns->ctrl, cmd, argp, open_for_write); - return nvme_ns_ioctl(ns, cmd, argp, flags, open_for_write); + return nvme_ctrl_ioctl(ns->ctrl, cmd, argp); + return nvme_ns_ioctl(ns, cmd, argp); } long nvme_ns_chr_ioctl(struct file *file, unsigned int cmd, unsigned long arg) { struct nvme_ns *ns = container_of(file_inode(file)->i_cdev, struct nvme_ns, cdev); - bool open_for_write = file->f_mode & FMODE_WRITE; void __user *argp = (void __user *)arg; if (is_ctrl_ioctl(cmd)) - return nvme_ctrl_ioctl(ns->ctrl, cmd, argp, open_for_write); - return nvme_ns_ioctl(ns, cmd, argp, 0, open_for_write); + return nvme_ctrl_ioctl(ns->ctrl, cmd, argp); + return nvme_ns_ioctl(ns, cmd, argp); } static int nvme_uring_cmd_checks(unsigned int issue_flags) @@ -792,8 +712,7 @@ int nvme_ns_chr_uring_cmd_iopoll(struct io_uring_cmd *ioucmd, } #ifdef CONFIG_NVME_MULTIPATH static int nvme_ns_head_ctrl_ioctl(struct nvme_ns *ns, unsigned int cmd, - void __user *argp, struct nvme_ns_head *head, int srcu_idx, - bool open_for_write) + void __user *argp, struct nvme_ns_head *head, int srcu_idx) __releases(&head->srcu) { struct nvme_ctrl *ctrl = ns->ctrl; @@ -801,7 +720,7 @@ static int nvme_ns_head_ctrl_ioctl(struct nvme_ns *ns, unsigned int cmd, nvme_get_ctrl(ns->ctrl); srcu_read_unlock(&head->srcu, srcu_idx); - ret = nvme_ctrl_ioctl(ns->ctrl, cmd, argp, open_for_write); + ret = nvme_ctrl_ioctl(ns->ctrl, cmd, argp); nvme_put_ctrl(ctrl); return ret; @@ -811,14 +730,9 @@ int nvme_ns_head_ioctl(struct block_device *bdev, blk_mode_t mode, unsigned int cmd, unsigned long arg) { struct nvme_ns_head *head = bdev->bd_disk->private_data; - bool open_for_write = mode & BLK_OPEN_WRITE; void __user *argp = (void __user *)arg; struct nvme_ns *ns; int srcu_idx, ret = -EWOULDBLOCK; - unsigned int flags = 0; - - if (bdev_is_partition(bdev)) - flags |= NVME_IOCTL_PARTITION; srcu_idx = srcu_read_lock(&head->srcu); ns = nvme_find_path(head); @@ -831,10 +745,9 @@ int nvme_ns_head_ioctl(struct block_device *bdev, blk_mode_t mode, * deadlock when deleting namespaces using the passthrough interface. */ if (is_ctrl_ioctl(cmd)) - return nvme_ns_head_ctrl_ioctl(ns, cmd, argp, head, srcu_idx, - open_for_write); + return nvme_ns_head_ctrl_ioctl(ns, cmd, argp, head, srcu_idx); - ret = nvme_ns_ioctl(ns, cmd, argp, flags, open_for_write); + ret = nvme_ns_ioctl(ns, cmd, argp); out_unlock: srcu_read_unlock(&head->srcu, srcu_idx); return ret; @@ -843,7 +756,6 @@ int nvme_ns_head_ioctl(struct block_device *bdev, blk_mode_t mode, long nvme_ns_head_chr_ioctl(struct file *file, unsigned int cmd, unsigned long arg) { - bool open_for_write = file->f_mode & FMODE_WRITE; struct cdev *cdev = file_inode(file)->i_cdev; struct nvme_ns_head *head = container_of(cdev, struct nvme_ns_head, cdev); @@ -857,10 +769,9 @@ long nvme_ns_head_chr_ioctl(struct file *file, unsigned int cmd, goto out_unlock; if (is_ctrl_ioctl(cmd)) - return nvme_ns_head_ctrl_ioctl(ns, cmd, argp, head, srcu_idx, - open_for_write); + return nvme_ns_head_ctrl_ioctl(ns, cmd, argp, head, srcu_idx); - ret = nvme_ns_ioctl(ns, cmd, argp, 0, open_for_write); + ret = nvme_ns_ioctl(ns, cmd, argp); out_unlock: srcu_read_unlock(&head->srcu, srcu_idx); return ret; @@ -909,8 +820,7 @@ int nvme_dev_uring_cmd(struct io_uring_cmd *ioucmd, unsigned int issue_flags) return ret; } -static int nvme_dev_user_cmd(struct nvme_ctrl *ctrl, void __user *argp, - bool open_for_write) +static int nvme_dev_user_cmd(struct nvme_ctrl *ctrl, void __user *argp) { struct nvme_ns *ns; int ret; @@ -934,7 +844,7 @@ static int nvme_dev_user_cmd(struct nvme_ctrl *ctrl, void __user *argp, kref_get(&ns->kref); up_read(&ctrl->namespaces_rwsem); - ret = nvme_user_cmd(ctrl, ns, argp, 0, open_for_write); + ret = nvme_user_cmd(ctrl, ns, argp); nvme_put_ns(ns); return ret; @@ -946,17 +856,16 @@ static int nvme_dev_user_cmd(struct nvme_ctrl *ctrl, void __user *argp, long nvme_dev_ioctl(struct file *file, unsigned int cmd, unsigned long arg) { - bool open_for_write = file->f_mode & FMODE_WRITE; struct nvme_ctrl *ctrl = file->private_data; void __user *argp = (void __user *)arg; switch (cmd) { case NVME_IOCTL_ADMIN_CMD: - return nvme_user_cmd(ctrl, NULL, argp, 0, open_for_write); + return nvme_user_cmd(ctrl, NULL, argp); case NVME_IOCTL_ADMIN64_CMD: - return nvme_user_cmd64(ctrl, NULL, argp, 0, open_for_write); + return nvme_user_cmd64(ctrl, NULL, argp, 0); case NVME_IOCTL_IO_CMD: - return nvme_dev_user_cmd(ctrl, argp, open_for_write); + return nvme_dev_user_cmd(ctrl, argp); case NVME_IOCTL_RESET: if (!capable(CAP_SYS_ADMIN)) return -EACCES; diff --git a/include/linux/nvme.h b/include/linux/nvme.h index 26dd3f859d9d..df3e2c619448 100644 --- a/include/linux/nvme.h +++ b/include/linux/nvme.h @@ -642,7 +642,6 @@ enum { NVME_CMD_EFFECTS_CCC = 1 << 4, NVME_CMD_EFFECTS_CSE_MASK = GENMASK(18, 16), NVME_CMD_EFFECTS_UUID_SEL = 1 << 19, - NVME_CMD_EFFECTS_SCOPE_MASK = GENMASK(31, 20), }; struct nvme_effects_log { @@ -834,7 +833,6 @@ enum nvme_opcode { nvme_cmd_zone_mgmt_send = 0x79, nvme_cmd_zone_mgmt_recv = 0x7a, nvme_cmd_zone_append = 0x7d, - nvme_cmd_vendor_start = 0x80, }; #define nvme_opcode_name(opcode) { opcode, #opcode } -- 2.25.1

2 years

4
12
0 0

[PATCH 1/1] genirq/generic_chip: Fix irq_remove_generic_chip() when an irq domain is used

by Herve Codina

irq_remove_generic_chip() can call (depending on the msk parameter value) several operations on irqs based on gc->irq_base such as irq_set_handler(irq, NULL) to remove an handler. When the generic chip is present in an irq domain (created with a call to irq_alloc_domain_generic_chips()), gc->irq_base is the base hardware irq for this chip. It is set to 0 for the first chip in the domain, 0 + n for the next chip (with n the number of hardware irqs per chip) and so on. In that case, the operations done on irqs based on gc->irq_base touch some irqs not related to the chip nor the domain breaking some unrelated components in the system. In order to avoid touching these "outside" irqs, take care of the domain irq mapping and translate the chip hardware irq to an irq number suitable for the several operations done. Fixes: cfefd21e693d ("genirq: Add chip suspend and resume callbacks") Cc: stable(a)vger.kernel.org Signed-off-by: Herve Codina <herve.codina(a)bootlin.com> --- kernel/irq/generic-chip.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/kernel/irq/generic-chip.c b/kernel/irq/generic-chip.c index c653cd31548d..494584e25ef4 100644 --- a/kernel/irq/generic-chip.c +++ b/kernel/irq/generic-chip.c @@ -544,21 +544,28 @@ EXPORT_SYMBOL_GPL(irq_setup_alt_chip); void irq_remove_generic_chip(struct irq_chip_generic *gc, u32 msk, unsigned int clr, unsigned int set) { - unsigned int i = gc->irq_base; + unsigned int irq; + unsigned int i; raw_spin_lock(&gc_lock); list_del(&gc->list); raw_spin_unlock(&gc_lock); - for (; msk; msk >>= 1, i++) { + for (i = 0; msk; msk >>= 1, i++) { if (!(msk & 0x01)) continue; + irq = gc->domain ? + irq_find_mapping(gc->domain, gc->irq_base + i) : + gc->irq_base + i; + if (!irq) + continue; + /* Remove handler first. That will mask the irq line */ - irq_set_handler(i, NULL); - irq_set_chip(i, &no_irq_chip); - irq_set_chip_data(i, NULL); - irq_modify_status(i, clr, set); + irq_set_handler(irq, NULL); + irq_set_chip(irq, &no_irq_chip); + irq_set_chip_data(irq, NULL); + irq_modify_status(irq, clr, set); } } EXPORT_SYMBOL_GPL(irq_remove_generic_chip); -- 2.41.0

2 years

2
1
0 0

[PATCH v4] nvme: fix corruption for passthrough meta/data

by Kanchan Joshi

User can specify a smaller meta buffer than what the device is wired to update/access. Kernel makes a copy of the meta buffer into which the device does DMA. As a result, the device overwrites the unrelated kernel memory, causing random kernel crashes. Same issue is possible for extended-lba case also. When user specifies a short unaligned buffer, the kernel makes a copy and uses that for DMA. Detect these situations and prevent corruption for unprivileged user passthrough. No change to status-quo for privileged/root user. Fixes: 63263d60e0f9 ("nvme: Use metadata for passthrough commands") Cc: stable(a)vger.kernel.org Reported-by: Vincent Fu <vincent.fu(a)samsung.com> Signed-off-by: Kanchan Joshi <joshi.k(a)samsung.com> --- Changes since v3: - Block only unprivileged user - Harden the checks by disallowing everything for which data length (nlb) can not be determined - Separate the bounce buffer checks to a different function - Factor in CSIs beyond NVM and ZNS Changes since v2: - Handle extended-lba case: short unaligned buffer IO - Reduce the scope of check to only well-known commands - Do not check early. Move it deeper so that check gets executed less often - Combine two patches into one. Changes since v1: - Revise the check to exclude PRACT=1 case drivers/nvme/host/ioctl.c | 116 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 116 insertions(+) diff --git a/drivers/nvme/host/ioctl.c b/drivers/nvme/host/ioctl.c index d8ff796fd5f2..57160ca02e65 100644 --- a/drivers/nvme/host/ioctl.c +++ b/drivers/nvme/host/ioctl.c @@ -96,6 +96,76 @@ static void __user *nvme_to_user_ptr(uintptr_t ptrval) return (void __user *)ptrval; } +static inline bool nvme_nlb_in_cdw12(struct nvme_ns *ns, u8 opcode) +{ + u8 csi = ns->head->ids.csi; + + if (csi != NVME_CSI_NVM && csi != NVME_CSI_ZNS) + return false; + + switch (opcode) { + case nvme_cmd_read: + case nvme_cmd_write: + case nvme_cmd_compare: + case nvme_cmd_zone_append: + return true; + default: + return false; + } +} + +/* + * NVMe has no separate field to encode the metadata length expected + * (except when using SGLs). + * + * Because of that we can't allow to transfer arbitrary metadata, as + * a metadata buffer that is shorted than what the device expects for + * the command will lead to arbitrary kernel (if bounce buffering) or + * userspace (if not) memory corruption. + * + * Check that external metadata is only specified for the few commands + * where we know the length based of other fields, and that it fits + * the actual data transfer from/to the device. + */ +static bool nvme_validate_metadata_len(struct request *req, unsigned meta_len) +{ + struct nvme_ns *ns = req->q->queuedata; + struct nvme_command *c = nvme_req(req)->cmd; + u32 len_by_nlb; + + /* Do not guard admin */ + if (capable(CAP_SYS_ADMIN)) + return true; + + /* Block commands that do not have nlb in cdw12 */ + if (!nvme_nlb_in_cdw12(ns, c->common.opcode)) { + dev_err(ns->ctrl->device, + "unknown metadata command %c\n", c->common.opcode); + return false; + } + + /* Skip when PI is inserted or stripped and not transferred */ + if (ns->ms == ns->pi_size && + (c->rw.control & cpu_to_le16(NVME_RW_PRINFO_PRACT))) + return true; + + if (ns->features & NVME_NS_EXT_LBAS) { + dev_err(ns->ctrl->device, + "requires extended LBAs for metadata\n"); + return false; + } + + len_by_nlb = (le16_to_cpu(c->rw.length) + 1) * ns->ms; + if (meta_len < len_by_nlb) { + dev_err(ns->ctrl->device, + "metadata length (%u instad of %u) is too small.\n", + meta_len, len_by_nlb); + return false; + } + + return true; +} + static void *nvme_add_user_metadata(struct request *req, void __user *ubuf, unsigned len, u32 seed) { @@ -104,6 +174,9 @@ static void *nvme_add_user_metadata(struct request *req, void __user *ubuf, void *buf; struct bio *bio = req->bio; + if (!nvme_validate_metadata_len(req, len)) + return ERR_PTR(-EINVAL); + buf = kmalloc(len, GFP_KERNEL); if (!buf) goto out; @@ -134,6 +207,41 @@ static void *nvme_add_user_metadata(struct request *req, void __user *ubuf, return ERR_PTR(ret); } +static bool nvme_validate_buffer_len(struct nvme_ns *ns, struct nvme_command *c, + unsigned meta_len, unsigned data_len) +{ + u32 mlen_by_nlb, dlen_by_nlb; + + /* Do not guard admin */ + if (capable(CAP_SYS_ADMIN)) + return true; + + /* Block commands that do not have nlb in cdw12 */ + if (!nvme_nlb_in_cdw12(ns, c->common.opcode)) { + dev_err(ns->ctrl->device, + "unknown metadata command %c.\n", c->common.opcode); + return false; + } + + /* When PI is inserted or stripped and not transferred.*/ + if (ns->ms == ns->pi_size && + (c->rw.control & cpu_to_le16(NVME_RW_PRINFO_PRACT))) + mlen_by_nlb = 0; + else + mlen_by_nlb = (le16_to_cpu(c->rw.length) + 1) * ns->ms; + + dlen_by_nlb = (le16_to_cpu(c->rw.length) + 1) << ns->lba_shift; + + if (data_len < (dlen_by_nlb + mlen_by_nlb)) { + dev_err(ns->ctrl->device, + "buffer length (%u instad of %u) is too small.\n", + data_len, dlen_by_nlb + mlen_by_nlb); + return false; + } + + return true; +} + static int nvme_finish_user_metadata(struct request *req, void __user *ubuf, void *meta, unsigned len, int ret) { @@ -202,6 +310,14 @@ static int nvme_map_user_request(struct request *req, u64 ubuffer, } *metap = meta; } + /* Guard for a short bounce buffer */ + if (bio->bi_private) { + if (!nvme_validate_buffer_len(ns, nvme_req(req)->cmd, + meta_len, bufflen)) { + ret = -EINVAL; + goto out_unmap; + } + } return ret; -- 2.25.1

2 years

4
16
0 0

[PATCH] regmap: Ensure range selector registers are updated after cache sync

by Mark Brown

When we sync the register cache we do so with the cache bypassed in order to avoid overhead from writing the synced values back into the cache. If the regmap has ranges and the selector register for those ranges is in a register which is cached this has the unfortunate side effect of meaning that the physical and cached copies of the selector register can be out of sync after a cache sync. The cache will have whatever the selector was when the sync started and the hardware will have the selector for the register that was synced last. Fix this by rewriting all cached selector registers after every sync, ensuring that the hardware and cache have the same content. This will result in extra writes that wouldn't otherwise be needed but is simple so hopefully robust. We don't read from the hardware since not all devices have physical read support. Given that nobody noticed this until now it is likely that we are rarely if ever hitting this case. Reported-by: Hector Martin <marcan(a)marcan.st> Signed-off-by: Mark Brown <broonie(a)kernel.org> Cc: stable(a)vger.kernel.org --- drivers/base/regmap/regcache.c | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/drivers/base/regmap/regcache.c b/drivers/base/regmap/regcache.c index c5d151e9c481..92592f944a3d 100644 --- a/drivers/base/regmap/regcache.c +++ b/drivers/base/regmap/regcache.c @@ -334,6 +334,11 @@ static int regcache_default_sync(struct regmap *map, unsigned int min, return 0; } +static int rbtree_all(const void *key, const struct rb_node *node) +{ + return 0; +} + /** * regcache_sync - Sync the register cache with the hardware. * @@ -351,6 +356,7 @@ int regcache_sync(struct regmap *map) unsigned int i; const char *name; bool bypass; + struct rb_node *node; if (WARN_ON(map->cache_type == REGCACHE_NONE)) return -EINVAL; @@ -392,6 +398,30 @@ int regcache_sync(struct regmap *map) /* Restore the bypass state */ map->cache_bypass = bypass; map->no_sync_defaults = false; + + /* + * If we did any paging with cache bypassed and a cached + * paging register then the register and cache state might + * have gone out of sync, force writes of all the paging + * registers. + */ + rb_for_each(node, 0, &map->range_tree, rbtree_all) { + struct regmap_range_node *this = + rb_entry(node, struct regmap_range_node, node); + + /* If there's nothing in the cache there's nothing to sync */ + ret = regcache_read(map, this->selector_reg, &i); + if (ret != 0) + continue; + + ret = _regmap_write(map, this->selector_reg, i); + if (ret != 0) { + dev_err(map->dev, "Failed to write %x = %x: %d\n", + this->selector_reg, i, ret); + break; + } + } + map->unlock(map->lock_arg); regmap_async_complete(map); --- base-commit: 611da07b89fdd53f140d7b33013f255bf0ed8f34 change-id: 20231026-regmap-fix-selector-sync-ad1514fd15df Best regards, -- Mark Brown <broonie(a)kernel.org>

2 years

2
3
0 0

Linux kernel 6.1 - drivers/usb/storage/unusual_cypress.h "Super Top" minimum bcdDevice too high

by LihaSika

Hi, in kernel 6.1 (maybe 5.x - 6.x) there's an ATACB setting for "Super Top USB 2.0 SATA Bridge" -devices, where the minimum bcdDevice version to match has been set to 1.60. It's in the file drivers/usb/storage/unusual_cypress.h: """ UNUSUAL_DEV( 0x14cd, 0x6116, 0x0160, 0x0160, "Super Top", "USB 2.0 SATA BRIDGE", USB_SC_CYP_ATACB, USB_PR_DEVICE, NULL, 0), """ My old USB HDD with a "Super Top" bridge has bcdDevice version 1.50, thus the setting won't match and it will not mount. I'm not sure when this changed (after kernel 4.x?), but it used to work before. Reading some earlier bug reports, it seems that the max version used to be 0x9999, which then caused corruption in "Super Top" devices with version >=2.20. So that's a reason for lowering the maximum value, but I wonder why the minimum value has also been set to 0x0160. I created a patch, changing 0x0160 to 0x0150 (though I should've left the max version as it was...): """ UNUSUAL_DEV( 0x14cd, 0x6116, 0x0150, 0x0150, """ Built, installed and rebooted; now the USB HDD can be mounted and works perfectly again. I did some write & read tests, checked with diff, cmp and md5sum - no corruption, everything OK 👍 Best regards, LihaS

2 years

2
1
0 0

Re: [PATCH] sched: psi: fix unprivileged polling against cgroups

by Daniel Black

Thank you, Reported-by: Daniel Black <daniel(a)mariadb.org>

2 years

1
0
0 0

[PATCH v3 1/3] s390/vfio-ap: unpin pages on gisc registration failure

by Tony Krowiak

From: Anthony Krowiak <akrowiak(a)linux.ibm.com> In the vfio_ap_irq_enable function, after the page containing the notification indicator byte (NIB) is pinned, the function attempts to register the guest ISC. If registration fails, the function sets the status response code and returns without unpinning the page containing the NIB. In order to avoid a memory leak, the NIB should be unpinned before returning from the vfio_ap_irq_enable function. Co-developed-by: Janosch Frank <frankja(a)linux.ibm.com> Signed-off-by: Janosch Frank <frankja(a)linux.ibm.com> Signed-off-by: Anthony Krowiak <akrowiak(a)linux.ibm.com> Reviewed-by: Matthew Rosato <mjrosato(a)linux.ibm.com> Fixes: 783f0a3ccd79 ("s390/vfio-ap: add s390dbf logging to the vfio_ap_irq_enable function") Cc: <stable(a)vger.kernel.org> --- drivers/s390/crypto/vfio_ap_ops.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_ap_ops.c index 4db538a55192..9cb28978c186 100644 --- a/drivers/s390/crypto/vfio_ap_ops.c +++ b/drivers/s390/crypto/vfio_ap_ops.c @@ -457,6 +457,7 @@ static struct ap_queue_status vfio_ap_irq_enable(struct vfio_ap_queue *q, VFIO_AP_DBF_WARN("%s: gisc registration failed: nisc=%d, isc=%d, apqn=%#04x\n", __func__, nisc, isc, q->apqn); + vfio_unpin_pages(&q->matrix_mdev->vdev, nib, 1); status.response_code = AP_RESPONSE_INVALID_GISA; return status; } -- 2.41.0

2 years

1
0
0 0

[PATCH v2 1/1] PCI: qcom-ep: Implement write_dbi2() callback for writing DBI2 registers properly

by Manivannan Sadhasivam

DWC core driver exposes the write_dbi2() callback for writing to the DBI2 registers in a vendor specific way. On the Qcom EP plaforms, DBI_CS2 bit in the ELBI region needs to be asserted before writing to any DBI2 registers and deasserted once done. So let's implement the callback for the Qcom PCIe EP driver so that the DBI2 writes are handled properly in the hardware. Without this callback, DBI2 register writes like BAR size won't go through and as a result, the default BAR size is set for all BARs. Cc: stable(a)vger.kernel.org # 5.16+ Fixes: f55fee56a631 ("PCI: qcom-ep: Add Qualcomm PCIe Endpoint controller driver") Suggested-by: Serge Semin <fancer.lancer(a)gmail.com> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> --- drivers/pci/controller/dwc/pcie-qcom-ep.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/drivers/pci/controller/dwc/pcie-qcom-ep.c b/drivers/pci/controller/dwc/pcie-qcom-ep.c index 32c8d9e37876..7da0599f70e7 100644 --- a/drivers/pci/controller/dwc/pcie-qcom-ep.c +++ b/drivers/pci/controller/dwc/pcie-qcom-ep.c @@ -124,6 +124,7 @@ /* ELBI registers */ #define ELBI_SYS_STTS 0x08 +#define ELBI_CS2_ENABLE 0xa4 /* DBI registers */ #define DBI_CON_STATUS 0x44 @@ -262,6 +263,21 @@ static void qcom_pcie_dw_stop_link(struct dw_pcie *pci) disable_irq(pcie_ep->perst_irq); } +static void qcom_pcie_write_dbi2(struct dw_pcie *pci, void __iomem *base, + u32 reg, size_t size, u32 val) +{ + struct qcom_pcie_ep *pcie_ep = to_pcie_ep(pci); + int ret; + + writel(1, pcie_ep->elbi + ELBI_CS2_ENABLE); + + ret = dw_pcie_write(pci->dbi_base2 + reg, size, val); + if (ret) + dev_err(pci->dev, "Failed to write DBI2 register (0x%x): %d\n", reg, ret); + + writel(0, pcie_ep->elbi + ELBI_CS2_ENABLE); +} + static void qcom_pcie_ep_icc_update(struct qcom_pcie_ep *pcie_ep) { struct dw_pcie *pci = &pcie_ep->pci; @@ -500,6 +516,7 @@ static const struct dw_pcie_ops pci_ops = { .link_up = qcom_pcie_dw_link_up, .start_link = qcom_pcie_dw_start_link, .stop_link = qcom_pcie_dw_stop_link, + .write_dbi2 = qcom_pcie_write_dbi2, }; static int qcom_pcie_ep_get_io_resources(struct platform_device *pdev, -- 2.25.1

2 years

2
1
0 0

[PATCH net] hv_netvsc: fix race of netvsc and VF register_netdevice

by Haiyang Zhang

The rtnl lock also needs to be held before rndis_filter_device_add() which advertises nvsp_2_vsc_capability / sriov bit, and triggers VF NIC offering and registering. If VF NIC finished register_netdev() earlier it may cause name based config failure. To fix this issue, move the call to rtnl_lock() before rndis_filter_device_add(), so VF will be registered later than netvsc / synthetic NIC, and gets a name numbered (ethX) after netvsc. And, move register_netdevice_notifier() earlier, so the call back function is set before probing. Cc: stable(a)vger.kernel.org Fixes: e04e7a7bbd4b ("hv_netvsc: Fix a deadlock by getting rtnl lock earlier in netvsc_probe()") Signed-off-by: Haiyang Zhang <haiyangz(a)microsoft.com> --- drivers/net/hyperv/netvsc_drv.c | 30 +++++++++++++++++++----------- 1 file changed, 19 insertions(+), 11 deletions(-) diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c index 3ba3c8fb28a5..feca1391f756 100644 --- a/drivers/net/hyperv/netvsc_drv.c +++ b/drivers/net/hyperv/netvsc_drv.c @@ -2531,15 +2531,6 @@ static int netvsc_probe(struct hv_device *dev, goto devinfo_failed; } - nvdev = rndis_filter_device_add(dev, device_info); - if (IS_ERR(nvdev)) { - ret = PTR_ERR(nvdev); - netdev_err(net, "unable to add netvsc device (ret %d)\n", ret); - goto rndis_failed; - } - - eth_hw_addr_set(net, device_info->mac_adr); - /* We must get rtnl lock before scheduling nvdev->subchan_work, * otherwise netvsc_subchan_work() can get rtnl lock first and wait * all subchannels to show up, but that may not happen because @@ -2547,9 +2538,23 @@ static int netvsc_probe(struct hv_device *dev, * -> ... -> device_add() -> ... -> __device_attach() can't get * the device lock, so all the subchannels can't be processed -- * finally netvsc_subchan_work() hangs forever. + * + * The rtnl lock also needs to be held before rndis_filter_device_add() + * which advertises nvsp_2_vsc_capability / sriov bit, and triggers + * VF NIC offering and registering. If VF NIC finished register_netdev() + * earlier it may cause name based config failure. */ rtnl_lock(); + nvdev = rndis_filter_device_add(dev, device_info); + if (IS_ERR(nvdev)) { + ret = PTR_ERR(nvdev); + netdev_err(net, "unable to add netvsc device (ret %d)\n", ret); + goto rndis_failed; + } + + eth_hw_addr_set(net, device_info->mac_adr); + if (nvdev->num_chn > 1) schedule_work(&nvdev->subchan_work); @@ -2788,11 +2793,14 @@ static int __init netvsc_drv_init(void) } netvsc_ring_bytes = ring_size * PAGE_SIZE; + register_netdevice_notifier(&netvsc_netdev_notifier); + ret = vmbus_driver_register(&netvsc_drv); - if (ret) + if (ret) { + unregister_netdevice_notifier(&netvsc_netdev_notifier); return ret; + } - register_netdevice_notifier(&netvsc_netdev_notifier); return 0; } -- 2.25.1

2 years

2
2
0 0

[PATCH v2 1/3] s390/vfio-ap: unpin pages on gisc registration failure

by Tony Krowiak

From: Anthony Krowiak <akrowiak(a)linux.ibm.com> In the vfio_ap_irq_enable function, after the page containing the notification indicator byte (NIB) is pinned, the function attempts to register the guest ISC. If registration fails, the function sets the status response code and returns without unpinning the page containing the NIB. In order to avoid a memory leak, the NIB should be unpinned before returning from the vfio_ap_irq_enable function. Signed-off-by: Janosch Frank <frankja(a)linux.ibm.com> Signed-off-by: Anthony Krowiak <akrowiak(a)linux.ibm.com> Reviewed-by: Matthew Rosato <mjrosato(a)linux.ibm.com> Fixes: 783f0a3ccd79 ("s390/vfio-ap: add s390dbf logging to the vfio_ap_irq_enable function") Cc: <stable(a)vger.kernel.org> --- drivers/s390/crypto/vfio_ap_ops.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_ap_ops.c index 4db538a55192..9cb28978c186 100644 --- a/drivers/s390/crypto/vfio_ap_ops.c +++ b/drivers/s390/crypto/vfio_ap_ops.c @@ -457,6 +457,7 @@ static struct ap_queue_status vfio_ap_irq_enable(struct vfio_ap_queue *q, VFIO_AP_DBF_WARN("%s: gisc registration failed: nisc=%d, isc=%d, apqn=%#04x\n", __func__, nisc, isc, q->apqn); + vfio_unpin_pages(&q->matrix_mdev->vdev, nib, 1); status.response_code = AP_RESPONSE_INVALID_GISA; return status; } -- 2.41.0

2 years

2
4
0 0

Some additional cifs patches for 6.5 stable to address issue brought up by kernel regression tracker

by Steve French

There were a set of issues brought up in 6.5 by the introduction of the "laundromat" (which cleans up directory leases). After discussion and testing with Paulo, Bernd Feige and others, we request that the following set also be included to address these problems. They are all in mainline (added in 6.6) and the patches (from mainline since they apply cleanly) are also attached. 238b351d0935 ("smb3: allow controlling length of time directory entries are cached with dir leases") 6a50d71d0fff ("smb3: allow controlling maximum number of cached directories") 2da338ff752a ("smb3: do not start laundromat thread when dir leases disabled") 3b8bb3171571 ("smb: client: do not start laundromat thread on nohandlecache") e95f3f744650 ("smb: client: make laundromat a delayed worker") 81ba10959970 ("smb: client: prevent new fids from being removed by laundromat") -- Thanks, Steve,

2 years

2
1
0 0

[PATCH 5.10 000/226] 5.10.198-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.10.198 release. There are 226 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 11 Oct 2023 13:00:55 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.198-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.10.198-rc1 Florian Westphal <fw(a)strlen.de> netfilter: nftables: exthdr: fix 4-byte stack OOB write Florian Westphal <fw(a)strlen.de> netfilter: nf_tables: fix kdoc warnings after gc rework John David Anglin <dave(a)parisc-linux.org> parisc: Restore __ldcw_align for PA-RISC 2.0 processors Shay Drory <shayd(a)nvidia.com> RDMA/mlx5: Fix NULL string error Bernard Metzler <bmt(a)zurich.ibm.com> RDMA/siw: Fix connection failure handling Konstantin Meskhidze <konstantin.meskhidze(a)huawei.com> RDMA/uverbs: Fix typo of sizeof argument Leon Romanovsky <leon(a)kernel.org> RDMA/cma: Fix truncation compilation warning in make_cma_ports Mark Zhang <markzhang(a)nvidia.com> RDMA/cma: Initialize ib_sa_multicast structure to 0 when join Duje Mihanović <duje.mihanovic(a)skole.hr> gpio: pxa: disable pinctrl calls for MMP_GPIO Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> gpio: aspeed: fix the GPIO number passed to pinctrl_gpio_set_config() Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> IB/mlx4: Fix the size of a buffer in add_port_entries() Dan Carpenter <dan.carpenter(a)linaro.org> of: dynamic: Fix potential memory leak in of_changeset_action() Leon Romanovsky <leon(a)kernel.org> RDMA/core: Require admin capabilities to set system parameters Fedor Pchelkin <pchelkin(a)ispras.ru> dm zoned: free dmz->ddev array in dmz_put_zoned_devices Ivan Babrou <ivan(a)cloudflare.com> cpupower: add Makefile dependencies for install targets Xin Long <lucien.xin(a)gmail.com> sctp: update hb timer immediately after users change hb_interval Xin Long <lucien.xin(a)gmail.com> sctp: update transport state when processing a dupcook packet Neal Cardwell <ncardwell(a)google.com> tcp: fix delayed ACKs for MSS boundary condition Neal Cardwell <ncardwell(a)google.com> tcp: fix quick-ack counting to count actual ACKs of new data Chengfeng Ye <dg573847474(a)gmail.com> tipc: fix a potential deadlock on &tx->lock Ben Wolsieffer <ben.wolsieffer(a)hefring.com> net: stmmac: dwmac-stm32: fix resume on STM32 MCU Florian Westphal <fw(a)strlen.de> netfilter: nf_tables: nft_set_rbtree: fix spurious insertion failure Xin Long <lucien.xin(a)gmail.com> netfilter: handle the connecting collision properly in nf_conntrack_proto_sctp Dan Carpenter <dan.carpenter(a)linaro.org> net: ethernet: ti: am65-cpsw: Fix error code in am65_cpsw_nuss_init_tx_chns() Jeremy Cline <jeremy(a)jcline.org> net: nfc: llcp: Add lock when modifying device list Shigeru Yoshida <syoshida(a)redhat.com> net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg Fabio Estevam <festevam(a)denx.de> net: dsa: mv88e6xxx: Avoid EEPROM timeout when EEPROM is absent David Howells <dhowells(a)redhat.com> ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data() Eric Dumazet <edumazet(a)google.com> net: fix possible store tearing in neigh_periodic_work() Mauricio Faria de Oliveira <mfo(a)canonical.com> modpost: add missing else to the "of" check Trond Myklebust <trond.myklebust(a)hammerspace.com> NFSv4: Fix a nfs4_state_manager() race Arnd Bergmann <arnd(a)arndb.de> ima: rework CONFIG_IMA dependency block Junxiao Bi <junxiao.bi(a)oracle.com> scsi: target: core: Fix deadlock due to recursive locking Oleksandr Tymoshenko <ovt(a)google.com> ima: Finish deprecation of IMA_TRUSTED_KEYRING Kconfig Richard Fitzgerald <rf(a)opensource.cirrus.com> regmap: rbtree: Fix wrong register marked as in-cache when creating new node Felix Fietkau <nbd(a)nbd.name> wifi: mt76: mt76x02: fix MT76x0 external LNA gain handling Alexandra Diupina <adiupina(a)astralinux.ru> drivers/net: process the result of hdlc_open() and add call of hdlc_close() in uhdlc_close() Leon Hwang <hffilwlqm(a)gmail.com> bpf: Fix tr dereferencing Pin-yen Lin <treapking(a)chromium.org> wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet Arnd Bergmann <arnd(a)arndb.de> wifi: iwlwifi: dbg_ini: fix structure packing Zhihao Cheng <chengzhihao1(a)huawei.com> ubi: Refuse attaching if mtd's erasesize is 0 Rob Herring <robh(a)kernel.org> arm64: Add Cortex-A520 CPU part definition Jordan Rife <jrife(a)google.com> net: prevent rewrite of msg_name in sock_sendmsg() Qu Wenruo <wqu(a)suse.com> btrfs: reject unknown mount options early Jordan Rife <jrife(a)google.com> net: replace calls to sock->ops->connect() with kernel_connect() Gustavo A. R. Silva <gustavoars(a)kernel.org> wifi: mwifiex: Fix tlv_buf_left calculation Gustavo A. R. Silva <gustavoars(a)kernel.org> qed/red_ll2: Fix undefined behavior bug in struct qed_ll2_info Dinghao Liu <dinghao.liu(a)zju.edu.cn> scsi: zfcp: Fix a double put in zfcp_port_enqueue() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Revert "PCI: qcom: Disable write access to read only registers for IP v2.3.3" Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Revert "clk: imx: pll14xx: dynamically configure PLL for 393216000/361267200Hz" Ming Lei <ming.lei(a)redhat.com> block: fix use-after-free of q->q_usage_counter Ilya Dryomov <idryomov(a)gmail.com> rbd: take header_rwsem in rbd_dev_refresh() only when updating Ilya Dryomov <idryomov(a)gmail.com> rbd: decouple parent info read-in from updating rbd_dev Ilya Dryomov <idryomov(a)gmail.com> rbd: decouple header read-in from updating rbd_dev->header Ilya Dryomov <idryomov(a)gmail.com> rbd: move rbd_dev_refresh() definition Nathan Chancellor <nathan(a)kernel.org> drm/mediatek: Fix backport issue in mtk_drm_gem_prime_vmap() Zheng Yejian <zhengyejian1(a)huawei.com> ring-buffer: Fix bytes info in per_cpu buffer stats Vlastimil Babka <vbabka(a)suse.cz> ring-buffer: remove obsolete comment for free_buffer_page() Trond Myklebust <trond.myklebust(a)hammerspace.com> NFSv4: Fix a state manager thread deadlock regression Benjamin Coddington <bcodding(a)redhat.com> NFS: rename nfs_client_kset to nfs_kset Benjamin Coddington <bcodding(a)redhat.com> NFS: Cleanup unused rpc_clnt variable Johan Hovold <johan+linaro(a)kernel.org> spi: zynqmp-gqspi: fix clock imbalance on probe failure Dinghao Liu <dinghao.liu(a)zju.edu.cn> spi: spi-zynqmp-gqspi: Fix runtime PM imbalance in zynqmp_qspi_probe Greg Ungerer <gerg(a)kernel.org> fs: binfmt_elf_efpic: fix personality for ELF-FDPIC Matthias Schiffer <mschiffer(a)universe-factory.net> ata: libata-sata: increase PMP SRST timeout to 10s Damien Le Moal <dlemoal(a)kernel.org> ata: libata-core: Do not register PM operations for SAS ports Damien Le Moal <dlemoal(a)kernel.org> ata: libata-core: Fix port and device removal Damien Le Moal <dlemoal(a)kernel.org> ata: libata-core: Fix ata_port_request_pm() locking Mika Westerberg <mika.westerberg(a)linux.intel.com> net: thunderbolt: Fix TCPv6 GSO checksum calculation Nick Desaulniers <ndesaulniers(a)google.com> bpf: Fix BTF_ID symbol generation collision in tools/ Jiri Olsa <jolsa(a)kernel.org> bpf: Fix BTF_ID symbol generation collision Josef Bacik <josef(a)toxicpanda.com> btrfs: properly report 0 avail for very full file systems Steven Rostedt (Google) <rostedt(a)goodmis.org> ring-buffer: Update "shortest_full" in polling Ben Wolsieffer <Ben.Wolsieffer(a)hefring.com> proc: nommu: /proc/<pid>/maps: release mmap read lock Trond Myklebust <trond.myklebust(a)hammerspace.com> Revert "SUNRPC dont update timeout value on connection reset" Heiner Kallweit <hkallweit1(a)gmail.com> i2c: i801: unregister tco_pdev in i801_probe() error path Niklas Cassel <niklas.cassel(a)wdc.com> ata: libata-scsi: ignore reserved bits for REPORT SUPPORTED OPERATION CODES Kailang Yang <kailang(a)realtek.com> ALSA: hda: Disable power save for solving pop issue on Lenovo ThinkCentre M70q Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: disallow rule removal from chain binding Pan Bian <bianpan2016(a)163.com> nilfs2: fix potential use after free in nilfs_gccache_submit_read_data() Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> serial: 8250_port: Check IRQ data before use Daniel Starke <daniel.starke(a)siemens.com> Revert "tty: n_gsm: fix UAF in gsm_cleanup_mux" Vishal Goel <vishal.goel(a)samsung.com> Smack:- Use overlay inode label in smack_inode_copy_up() Roberto Sassu <roberto.sassu(a)huawei.com> smack: Retrieve transmuting information in smack_inode_getsecurity() Roberto Sassu <roberto.sassu(a)huawei.com> smack: Record transmuting in smk_transmuted Irvin Cote <irvin.cote(a)insa-lyon.fr> nvme-pci: always return an ERR_PTR from nvme_pci_alloc_dev Phil Sutter <phil(a)nwl.cc> netfilter: nft_exthdr: Fix for unsafe packet data read Phil Sutter <phil(a)nwl.cc> netfilter: nft_exthdr: Search chunks in SCTP packets only Mika Westerberg <mika.westerberg(a)linux.intel.com> watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running Mika Westerberg <mika.westerberg(a)linux.intel.com> watchdog: iTCO_wdt: No need to stop the timer in probe Pratyush Yadav <ptyadav(a)amazon.de> nvme-pci: do not set the NUMA node of device if it has none Christoph Hellwig <hch(a)lst.de> nvme-pci: factor out a nvme_pci_alloc_dev helper Christoph Hellwig <hch(a)lst.de> nvme-pci: factor the iod mempool creation into a helper Mario Limonciello <mario.limonciello(a)amd.com> ACPI: Check StorageD3Enable _DSD property in ACPI code Chengming Zhou <zhouchengming(a)bytedance.com> cgroup: Fix suspicious rcu_dereference_check() usage warning Chengming Zhou <zhouchengming(a)bytedance.com> sched/cpuacct: Optimize away RCU read lock Chengming Zhou <zhouchengming(a)bytedance.com> sched/cpuacct: Fix charge percpu cpuusage Andrey Ryabinin <arbn(a)yandex-team.com> sched/cpuacct: Fix user/system in shown cpuacct.usage* Arnaldo Carvalho de Melo <acme(a)redhat.com> perf build: Define YYNOMEM as YYNOABORT for bison < 3.81 Thomas Zimmermann <tzimmermann(a)suse.de> fbdev/sh7760fb: Depend on FB=y Johnathan Mantey <johnathanx.mantey(a)intel.com> ncsi: Propagate carrier gain/loss events to the NCSI controller Benjamin Gray <bgray(a)linux.ibm.com> powerpc/watchpoints: Disable preemption in thread_change_pc() Hans Verkuil <hverkuil-cisco(a)xs4all.nl> media: vb2: frame_vector.c: replace WARN_ONCE with a comment Stanislav Fomichev <sdf(a)google.com> bpf: Clarify error expectations from bpf_clone_redirect Han Xu <han.xu(a)nxp.com> spi: nxp-fspi: reset the FLSHxCR1 registers Niklas Cassel <niklas.cassel(a)wdc.com> ata: libata-eh: do not clear ATA_PFLAG_EH_PENDING in ata_eh_reset() Michal Grzedzicki <mge(a)meta.com> scsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command Michal Grzedzicki <mge(a)meta.com> scsi: pm80xx: Use phy-specific SAS address when sending PHY_START command David Thompson <davthompson(a)nvidia.com> platform/mellanox: mlxbf-bootctl: add NET dependency into Kconfig Steven Rostedt (Google) <rostedt(a)goodmis.org> ring-buffer: Do not attempt to read past "commit" Ricardo B. Marliere <rbmarliere(a)gmail.com> selftests: fix dependency checker script Zheng Yejian <zhengyejian1(a)huawei.com> ring-buffer: Avoid softlockup in ring_buffer_resize() Zheng Yejian <zhengyejian1(a)huawei.com> selftests/ftrace: Correctly enable event in instance-event.tc Javed Hasan <jhasan(a)marvell.com> scsi: qedf: Add synchronization between I/O completions and abort Helge Deller <deller(a)gmx.de> parisc: irq: Make irq_stack_union static to avoid sparse warning Helge Deller <deller(a)gmx.de> parisc: drivers: Fix sparse warning Helge Deller <deller(a)gmx.de> parisc: iosapic.c: Fix sparse warnings Helge Deller <deller(a)gmx.de> parisc: sba: Fix compile warning wrt list of SBA devices Sergey Senozhatsky <senozhatsky(a)chromium.org> dma-debug: don't call __dma_entry_alloc_check_leak() under free_entries_lock William A. Kennington III <william(a)wkennington.com> i2c: npcm7xx: Fix callback completion ordering Wenhua Lin <Wenhua.Lin(a)unisoc.com> gpio: pmic-eic-sprd: Add can_sleep flag for PMIC EIC chip Max Filippov <jcmvbkbc(a)gmail.com> xtensa: boot/lib: fix function prototypes Randy Dunlap <rdunlap(a)infradead.org> xtensa: boot: don't add include-dirs Randy Dunlap <rdunlap(a)infradead.org> xtensa: iss/network: make functions static Max Filippov <jcmvbkbc(a)gmail.com> xtensa: add default definition for XCHAL_HAVE_DIV32 Dan Carpenter <dan.carpenter(a)linaro.org> power: supply: ucs1002: fix error code in ucs1002_get_property() Tony Lindgren <tony(a)atomide.com> bus: ti-sysc: Fix SYSC_QUIRK_SWSUP_SIDLE_ACT handling for uart wake-up Tony Lindgren <tony(a)atomide.com> ARM: dts: ti: omap: motorola-mapphone: Fix abe_clkctrl warning on boot Tony Lindgren <tony(a)atomide.com> ARM: dts: Unify pwm-omap-dmtimer node names Gireesh Hiremath <Gireesh.Hiremath(a)in.bosch.com> ARM: dts: am335x: Guardian: Update beeper label Geert Uytterhoeven <geert+renesas(a)glider.be> ARM: dts: motorola-mapphone: Drop second ti,wlcore compatible value Carl Philipp Klemm <philipp(a)uvos.xyz> ARM: dts: motorola-mapphone: Add 1.2GHz OPP Tony Lindgren <tony(a)atomide.com> ARM: dts: motorola-mapphone: Configure lower temperature passive cooling Tony Lindgren <tony(a)atomide.com> ARM: dts: ti: omap: Fix bandgap thermal cells addressing for omap3/4 Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> ARM: dts: omap: correct indentation Timo Alho <talho(a)nvidia.com> clk: tegra: fix error return case for recalc_rate Adam Ford <aford173(a)gmail.com> bus: ti-sysc: Fix missing AM35xx SoC matching Julien Panis <jpanis(a)baylibre.com> bus: ti-sysc: Use fsleep() instead of usleep_range() in sysc_reset() Christoph Hellwig <hch(a)lst.de> MIPS: Alchemy: only build mmc support helpers if au1xmmc is enabled Qu Wenruo <wqu(a)suse.com> btrfs: reset destination buffer when read_extent_buffer() gets invalid range Werner Fischer <devlists(a)wefi.net> ata: ahci: Add Elkhart Lake AHCI controller Mario Limonciello <mario.limonciello(a)amd.com> ata: ahci: Rename board_ahci_mobile Paul Menzel <pmenzel(a)molgen.mpg.de> ata: ahci: Add support for AMD A85 FCH (Hudson D4) Paul Menzel <pmenzel(a)molgen.mpg.de> ata: libata: Rename link flag ATA_LFLAG_NO_DB_DELAY Xiao Liang <shaw.leon(a)gmail.com> netfilter: nft_exthdr: Fix non-linear header modification Florian Westphal <fw(a)strlen.de> netfilter: exthdr: add support for tcp option removal Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nft_exthdr: break evaluation if setting TCP option fails Florian Westphal <fw(a)strlen.de> netfilter: nf_tables: add and use nft_thoff helper Florian Westphal <fw(a)strlen.de> netfilter: nf_tables: add and use nft_sk helper Phil Sutter <phil(a)nwl.cc> netfilter: nft_exthdr: Support SCTP chunks Jan Engelhardt <jengelh(a)inai.de> netfilter: use actual socket sk for REJECT action Konrad Dybcio <konrad.dybcio(a)linaro.org> media: venus: hfi_venus: Write to VIDC_CTRL_INIT after unmasking interrupts Dikshita Agarwal <dikshita(a)codeaurora.org> media: venus: hfi: Add a 6xx boot logic Bryan O'Donoghue <bryan.odonoghue(a)linaro.org> media: venus: core: Add differentiator IS_V6(core) Dikshita Agarwal <dikshita(a)codeaurora.org> media: venus: hfi: Define additional 6xx registers Bryan O'Donoghue <bryan.odonoghue(a)linaro.org> media: venus: hfi,pm,firmware: Convert to block relative addressing Bryan O'Donoghue <bryan.odonoghue(a)linaro.org> media: venus: core: Add io base variables for each block Wolfram Sang <wsa+renesas(a)sang-engineering.com> mmc: renesas_sdhi: register irqs before registering controller Wolfram Sang <wsa+renesas(a)sang-engineering.com> mmc: tmio: support custom irq masks Wolfram Sang <wsa+renesas(a)sang-engineering.com> mmc: renesas_sdhi: populate SCC pointer at the proper place Wolfram Sang <wsa+renesas(a)sang-engineering.com> mmc: renesas_sdhi: probe into TMIO after SCC parameters have been setup Werner Sembach <wse(a)tuxedocomputers.com> Input: i8042 - add quirk for TUXEDO Gemini 17 Gen1/Clevo PD70PN Huacai Chen <chenhuacai(a)loongson.cn> Input: i8042 - rename i8042-x86ia64io.h to i8042-acpipnpio.h Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: double hook unregistration in netns path Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: unregister flowtable hooks on netns exit Xiaoke Wang <xkernel.wang(a)foxmail.com> i2c: mux: demux-pinctrl: check the return value of devm_kstrdup() Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> gpio: tb10x: Fix an error handling path in tb10x_gpio_probe() Artem Chernyshev <artem.chernyshev(a)red-soft.ru> net: rds: Fix possible NULL-pointer dereference Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> bnxt_en: Flush XDP for bnxt_poll_nitroa0()'s NAPI Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> locking/seqlock: Do the lockdep annotation before locking in do_write_seqcount_begin_nested() Ahmed S. Darwish <a.darwish(a)linutronix.de> seqlock: Prefix internal seqcount_t-only macros with a "do_" Peter Zijlstra <peterz(a)infradead.org> seqlock: Rename __seqprop() users Arnd Bergmann <arnd(a)arndb.de> seqlock: avoid -Wshadow warnings Jozsef Kadlecsik <kadlec(a)netfilter.org> netfilter: ipset: Fix race between IPSET_CMD_CREATE and IPSET_CMD_SWAP Ziyang Xuan <william.xuanziyang(a)huawei.com> team: fix null-ptr-deref when team device type is changed Eric Dumazet <edumazet(a)google.com> net: bridge: use DEV_STATS_INC() Jie Wang <wangjie125(a)huawei.com> net: hns3: add 5ms delay before clear firmware reset irq source Jian Shen <shenjian15(a)huawei.com> net: hns3: only enable unicast promisc when mac table full Josh Poimboeuf <jpoimboe(a)kernel.org> x86/srso: Fix SBPB enablement for spec_rstack_overflow=off Josh Poimboeuf <jpoimboe(a)kernel.org> x86/srso: Fix srso_show_state() side effect Stephen Boyd <swboyd(a)chromium.org> platform/x86: intel_scu_ipc: Fail IPC send if still busy Stephen Boyd <swboyd(a)chromium.org> platform/x86: intel_scu_ipc: Don't override scu in intel_scu_ipc_dev_simple_command() Stephen Boyd <swboyd(a)chromium.org> platform/x86: intel_scu_ipc: Check status upon timeout in ipc_wait_for_interrupt() Stephen Boyd <swboyd(a)chromium.org> platform/x86: intel_scu_ipc: Check status after timeout in busy_loop() Eric Dumazet <edumazet(a)google.com> dccp: fix dccp_v4_err()/dccp_v6_err() again Kajol Jain <kjain(a)linux.ibm.com> powerpc/perf/hv-24x7: Update domain value check Kyle Zeng <zengyhkyle(a)gmail.com> ipv4: fix null-deref in ipv4_link_failure Ivan Vecera <ivecera(a)redhat.com> i40e: Fix VF VLAN offloading when port VLAN is configured Shengjiu Wang <shengjiu.wang(a)nxp.com> ASoC: imx-audmix: Fix return error with devm_clk_get() Sabrina Dubroca <sd(a)queasysnail.net> selftests: tls: swap the TX and RX sockets in some tests Kees Cook <keescook(a)chromium.org> selftests/tls: Add {} to avoid static checker warning Toke Høiland-Jørgensen <toke(a)redhat.com> bpf: Avoid deadlock when using queue and stack maps from NMI Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: disallow element removal on anonymous sets Jerome Brunet <jbrunet(a)baylibre.com> ASoC: meson: spdifin: start hw on dai probe Florian Westphal <fw(a)strlen.de> netfilter: nf_tables: fix memleak when more than 255 elements expired Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nft_set_hash: try later when GC hits EAGAIN on iteration Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nft_set_pipapo: stop GC iteration if GC transaction allocation fails Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nft_set_rbtree: use read spinlock to avoid datapath contention Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction Florian Westphal <fw(a)strlen.de> netfilter: nf_tables: defer gc run if previous batch is still pending Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: use correct lock to protect gc_list Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: GC transaction race with abort path Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: GC transaction race with netns dismantle Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: fix GC transaction races with netns and netlink event exit path Florian Westphal <fw(a)strlen.de> netfilter: nf_tables: don't fail inserts if duplicate has expired Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: remove busy mark and gc batch API Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nft_set_hash: mark set element as dead when deleting from packet path Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: adapt set backend to use GC transaction API Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: GC transaction API to avoid race with control plane Florian Westphal <fw(a)strlen.de> netfilter: nf_tables: don't skip expired elements during walk Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: integrate pipapo into commit protocol Steven Rostedt (Google) <rostedt(a)goodmis.org> tracing: Have event inject files inc the trace array ref count Jan Kara <jack(a)suse.cz> ext4: do not let fstrim block system suspend Jan Kara <jack(a)suse.cz> ext4: move setting of trimmed bit into ext4_try_to_trim_range() Kemeng Shi <shikemeng(a)huaweicloud.com> ext4: replace the traditional ternary conditional operator with with max()/min() Dmitry Monakhov <dmtrmonakhov(a)yandex-team.ru> ext4: mark group as trimmed only if it was fully scanned Lukas Czerner <lczerner(a)redhat.com> ext4: change s_last_trim_minblks type to unsigned long Lukas Bulwahn <lukas.bulwahn(a)gmail.com> ext4: scope ret locally in ext4_try_to_trim_range() Wang Jianchao <wangjianchao(a)kuaishou.com> ext4: add new helper interface ext4_try_to_trim_range() Wang Jianchao <wangjianchao(a)kuaishou.com> ext4: remove the 'group' parameter of ext4_trim_extent Szuying Chen <chensiying21(a)gmail.com> ata: libahci: clear pending interrupt status Hannes Reinecke <hare(a)suse.de> ata: ahci: Drop pointless VPRINTK() calls and convert the remaining ones Steven Rostedt (Google) <rostedt(a)goodmis.org> tracing: Increase trace array ref count on enable and filter files Trond Myklebust <trond.myklebust(a)hammerspace.com> SUNRPC: Mark the cred for revalidation if the server rejects it Trond Myklebust <trond.myklebust(a)hammerspace.com> NFS/pNFS: Report EINVAL errors from connect() to the server Trond Myklebust <trond.myklebust(a)hammerspace.com> NFS: Use the correct commit info in nfs_join_page_group() ------------- Diffstat: Makefile | 4 +- arch/arm/boot/dts/am335x-guardian.dts | 9 +- arch/arm/boot/dts/am3517-evm.dts | 2 +- arch/arm/boot/dts/logicpd-torpedo-baseboard.dtsi | 2 +- arch/arm/boot/dts/motorola-mapphone-common.dtsi | 33 +- arch/arm/boot/dts/omap-gpmc-smsc911x.dtsi | 6 +- arch/arm/boot/dts/omap-gpmc-smsc9221.dtsi | 6 +- arch/arm/boot/dts/omap3-cm-t3517.dts | 12 +- arch/arm/boot/dts/omap3-cpu-thermal.dtsi | 3 +- arch/arm/boot/dts/omap3-gta04.dtsi | 8 +- arch/arm/boot/dts/omap3-ldp.dts | 2 +- arch/arm/boot/dts/omap3-n900.dts | 40 +- arch/arm/boot/dts/omap3-zoom3.dts | 44 +-- arch/arm/boot/dts/omap4-cpu-thermal.dtsi | 29 +- arch/arm/boot/dts/omap443x.dtsi | 1 + arch/arm/boot/dts/omap4460.dtsi | 1 + arch/arm/boot/dts/omap5-cm-t54.dts | 64 +-- arch/arm64/include/asm/cputype.h | 2 + arch/mips/alchemy/devboards/db1000.c | 4 + arch/mips/alchemy/devboards/db1200.c | 6 + arch/mips/alchemy/devboards/db1300.c | 4 + arch/parisc/include/asm/ldcw.h | 36 +- arch/parisc/include/asm/ropes.h | 3 + arch/parisc/include/asm/spinlock_types.h | 5 - arch/parisc/kernel/drivers.c | 2 +- arch/parisc/kernel/irq.c | 2 +- arch/powerpc/kernel/hw_breakpoint.c | 7 +- arch/powerpc/perf/hv-24x7.c | 2 +- arch/x86/kernel/cpu/bugs.c | 4 +- arch/xtensa/boot/Makefile | 3 +- arch/xtensa/boot/lib/zmem.c | 5 +- arch/xtensa/include/asm/core.h | 4 + arch/xtensa/platforms/iss/network.c | 4 +- block/blk-core.c | 2 - block/blk-sysfs.c | 2 + drivers/acpi/device_pm.c | 29 ++ drivers/ata/ahci.c | 111 +++--- drivers/ata/ahci_brcm.c | 2 +- drivers/ata/ahci_xgene.c | 4 - drivers/ata/libahci.c | 49 +-- drivers/ata/libata-core.c | 41 +- drivers/ata/libata-eh.c | 13 +- drivers/ata/libata-sata.c | 2 +- drivers/ata/libata-scsi.c | 2 +- drivers/ata/libata-transport.c | 9 +- drivers/ata/libata.h | 2 + drivers/base/regmap/regcache-rbtree.c | 3 +- drivers/block/rbd.c | 412 ++++++++++--------- drivers/bus/ti-sysc.c | 31 +- drivers/char/agp/parisc-agp.c | 2 - drivers/clk/imx/clk-pll14xx.c | 2 + drivers/clk/tegra/clk-bpmp.c | 2 +- drivers/gpio/gpio-aspeed.c | 2 +- drivers/gpio/gpio-pmic-eic-sprd.c | 1 + drivers/gpio/gpio-pxa.c | 1 + drivers/gpio/gpio-tb10x.c | 6 +- drivers/gpu/drm/mediatek/mtk_drm_gem.c | 2 +- drivers/i2c/busses/i2c-i801.c | 1 + drivers/i2c/busses/i2c-npcm7xx.c | 17 +- drivers/i2c/muxes/i2c-demux-pinctrl.c | 4 + drivers/infiniband/core/cma.c | 2 +- drivers/infiniband/core/cma_configfs.c | 2 +- drivers/infiniband/core/nldev.c | 1 + drivers/infiniband/core/uverbs_main.c | 2 +- drivers/infiniband/hw/mlx4/sysfs.c | 2 +- drivers/infiniband/hw/mlx5/main.c | 2 +- drivers/infiniband/sw/siw/siw_cm.c | 16 +- .../serio/{i8042-x86ia64io.h => i8042-acpipnpio.h} | 13 +- drivers/input/serio/i8042.h | 2 +- drivers/md/dm-zoned-target.c | 15 +- drivers/media/platform/qcom/venus/core.c | 12 + drivers/media/platform/qcom/venus/core.h | 11 + drivers/media/platform/qcom/venus/firmware.c | 28 +- drivers/media/platform/qcom/venus/hfi_venus.c | 94 +++-- drivers/media/platform/qcom/venus/hfi_venus_io.h | 114 ++++-- drivers/media/platform/qcom/venus/pm_helpers.c | 12 +- drivers/mmc/host/renesas_sdhi_core.c | 19 +- drivers/mmc/host/tmio_mmc.h | 1 + drivers/mmc/host/tmio_mmc_core.c | 8 +- drivers/mtd/ubi/build.c | 7 + drivers/net/dsa/mv88e6xxx/chip.c | 6 +- drivers/net/dsa/mv88e6xxx/global1.c | 31 -- drivers/net/dsa/mv88e6xxx/global1.h | 1 - drivers/net/dsa/mv88e6xxx/global2.c | 2 +- drivers/net/dsa/mv88e6xxx/global2.h | 1 + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 5 + .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 7 +- drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 7 +- drivers/net/ethernet/qlogic/qed/qed_ll2.h | 2 +- drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c | 7 +- drivers/net/ethernet/ti/am65-cpsw-nuss.c | 1 + drivers/net/team/team.c | 10 +- drivers/net/thunderbolt.c | 3 +- drivers/net/usb/smsc75xx.c | 4 +- drivers/net/wan/fsl_ucc_hdlc.c | 12 +- drivers/net/wireless/intel/iwlwifi/fw/error-dump.h | 6 +- .../net/wireless/marvell/mwifiex/11n_rxreorder.c | 4 +- drivers/net/wireless/marvell/mwifiex/sta_rx.c | 16 +- .../net/wireless/mediatek/mt76/mt76x02_eeprom.c | 7 - drivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c | 13 +- drivers/nvme/host/pci.c | 149 +++---- drivers/of/dynamic.c | 6 +- drivers/parisc/iosapic.c | 4 +- drivers/parisc/iosapic_private.h | 4 +- drivers/pci/controller/dwc/pcie-qcom.c | 2 - drivers/platform/mellanox/Kconfig | 1 + drivers/platform/x86/intel_scu_ipc.c | 66 ++-- drivers/power/supply/ucs1002_power.c | 3 +- drivers/s390/scsi/zfcp_aux.c | 9 +- drivers/scsi/pm8001/pm8001_hwi.c | 2 +- drivers/scsi/pm8001/pm80xx_hwi.c | 4 +- drivers/scsi/qedf/qedf_io.c | 10 +- drivers/scsi/qedf/qedf_main.c | 7 +- drivers/spi/spi-nxp-fspi.c | 7 + drivers/spi/spi-zynqmp-gqspi.c | 24 +- drivers/target/target_core_device.c | 11 +- drivers/tty/n_gsm.c | 4 +- drivers/tty/serial/8250/8250_port.c | 5 +- drivers/video/fbdev/Kconfig | 2 +- drivers/watchdog/iTCO_wdt.c | 26 +- fs/binfmt_elf_fdpic.c | 5 +- fs/btrfs/extent_io.c | 8 +- fs/btrfs/super.c | 6 +- fs/ext4/ext4.h | 2 +- fs/ext4/mballoc.c | 138 ++++--- fs/nfs/direct.c | 8 +- fs/nfs/flexfilelayout/flexfilelayout.c | 1 + fs/nfs/nfs4proc.c | 4 +- fs/nfs/nfs4state.c | 47 ++- fs/nfs/sysfs.c | 16 +- fs/nfs/write.c | 23 +- fs/nilfs2/gcinode.c | 6 +- fs/proc/task_nommu.c | 27 +- include/linux/acpi.h | 5 + include/linux/bpf.h | 2 +- include/linux/btf_ids.h | 2 +- include/linux/cgroup.h | 3 +- include/linux/if_team.h | 2 + include/linux/libata.h | 4 +- include/linux/netfilter/nf_conntrack_sctp.h | 1 + include/linux/nfs_page.h | 4 +- include/linux/seqlock.h | 104 ++--- include/net/netfilter/ipv4/nf_reject.h | 4 +- include/net/netfilter/ipv6/nf_reject.h | 5 +- include/net/netfilter/nf_tables.h | 136 +++---- include/net/tcp.h | 6 +- include/uapi/linux/bpf.h | 4 +- include/uapi/linux/netfilter/nf_tables.h | 2 + kernel/bpf/queue_stack_maps.c | 21 +- kernel/dma/debug.c | 20 +- kernel/sched/cpuacct.c | 84 ++-- kernel/trace/ring_buffer.c | 42 +- kernel/trace/trace.c | 27 ++ kernel/trace/trace.h | 2 + kernel/trace/trace_events.c | 6 +- kernel/trace/trace_events_inject.c | 3 +- mm/frame_vector.c | 6 +- net/bridge/br_forward.c | 4 +- net/bridge/br_input.c | 4 +- net/core/neighbour.c | 4 +- net/dccp/ipv4.c | 9 +- net/dccp/ipv6.c | 9 +- net/ipv4/netfilter/ipt_REJECT.c | 3 +- net/ipv4/netfilter/nf_reject_ipv4.c | 6 +- net/ipv4/netfilter/nft_reject_ipv4.c | 3 +- net/ipv4/route.c | 4 +- net/ipv4/tcp_input.c | 13 + net/ipv4/tcp_output.c | 7 +- net/ipv6/netfilter/ip6t_REJECT.c | 2 +- net/ipv6/netfilter/nf_reject_ipv6.c | 5 +- net/ipv6/netfilter/nft_reject_ipv6.c | 3 +- net/l2tp/l2tp_ip6.c | 2 +- net/ncsi/ncsi-aen.c | 5 + net/netfilter/ipset/ip_set_core.c | 12 +- net/netfilter/ipvs/ip_vs_sync.c | 4 +- net/netfilter/nf_conntrack_proto_sctp.c | 43 +- net/netfilter/nf_tables_api.c | 436 ++++++++++++++++++--- net/netfilter/nf_tables_core.c | 2 +- net/netfilter/nf_tables_trace.c | 6 +- net/netfilter/nft_exthdr.c | 193 ++++++++- net/netfilter/nft_flow_offload.c | 2 +- net/netfilter/nft_payload.c | 10 +- net/netfilter/nft_reject_inet.c | 6 +- net/netfilter/nft_set_hash.c | 87 ++-- net/netfilter/nft_set_pipapo.c | 115 ++++-- net/netfilter/nft_set_rbtree.c | 199 ++++++---- net/netfilter/nft_synproxy.c | 4 +- net/netfilter/nft_tproxy.c | 4 +- net/nfc/llcp_core.c | 2 + net/rds/rdma_transport.c | 8 +- net/rds/tcp_connect.c | 2 +- net/sctp/associola.c | 3 +- net/sctp/socket.c | 1 + net/socket.c | 29 +- net/sunrpc/clnt.c | 4 +- net/tipc/crypto.c | 4 +- scripts/mod/file2alias.c | 2 +- security/integrity/ima/Kconfig | 21 +- security/smack/smack.h | 1 + security/smack/smack_lsm.c | 65 ++- sound/pci/hda/hda_intel.c | 1 + sound/soc/fsl/imx-audmix.c | 2 +- sound/soc/meson/axg-spdifin.c | 49 +-- tools/include/linux/btf_ids.h | 2 +- tools/include/uapi/linux/bpf.h | 4 +- tools/perf/util/Build | 6 + tools/power/cpupower/Makefile | 8 +- tools/power/cpupower/bench/Makefile | 2 +- .../ftrace/test.d/instances/instance-event.tc | 2 +- tools/testing/selftests/kselftest_deps.sh | 77 +++- tools/testing/selftests/net/tls.c | 11 +- 211 files changed, 2713 insertions(+), 1552 deletions(-)

2 years

10
252
0 0

[tip: x86/apic] x86/apic/msi: Fix misconfigured non-maskable MSI quirk

by tip-bot2 for Koichiro Den

The following commit has been merged into the x86/apic branch of tip: Commit-ID: b56ebe7c896dc78b5865ec2c4b1dae3c93537517 Gitweb: https://git.kernel.org/tip/b56ebe7c896dc78b5865ec2c4b1dae3c93537517 Author: Koichiro Den <den(a)valinux.co.jp> AuthorDate: Thu, 26 Oct 2023 12:20:36 +09:00 Committer: Thomas Gleixner <tglx(a)linutronix.de> CommitterDate: Thu, 26 Oct 2023 13:53:06 +02:00 x86/apic/msi: Fix misconfigured non-maskable MSI quirk commit ef8dd01538ea ("genirq/msi: Make interrupt allocation less convoluted"), reworked the code so that the x86 specific quirk for affinity setting of non-maskable PCI/MSI interrupts is not longer activated if necessary. This could be solved by restoring the original logic in the core MSI code, but after a deeper analysis it turned out that the quirk flag is not required at all. The quirk is only required when the PCI/MSI device cannot mask the MSI interrupts, which in turn also prevents reservation mode from being enabled for the affected interrupt. This allows ot remove the NOMASK quirk bit completely as msi_set_affinity() can instead check whether reservation mode is enabled for the interrupt, which gives exactly the same answer. Even in the momentary non-existing case that the reservation mode would be not set for a maskable MSI interrupt this would not cause any harm as it just would cause msi_set_affinity() to go needlessly through the functionaly equivalent slow path, which works perfectly fine with maskable interrupts as well. Rework msi_set_affinity() to query the reservation mode and remove all NOMASK quirk logic from the core code. [ tglx: Massaged changelog ] Fixes: ef8dd01538ea ("genirq/msi: Make interrupt allocation less convoluted") Suggested-by: Thomas Gleixner <tglx(a)linutronix.de> Signed-off-by: Koichiro Den <den(a)valinux.co.jp> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20231026032036.2462428-1-den@valinux.co.jp --- arch/x86/kernel/apic/msi.c | 8 +++----- include/linux/irq.h | 26 ++++---------------------- include/linux/msi.h | 6 ------ kernel/irq/debugfs.c | 1 - kernel/irq/msi.c | 12 +----------- 5 files changed, 8 insertions(+), 45 deletions(-) diff --git a/arch/x86/kernel/apic/msi.c b/arch/x86/kernel/apic/msi.c index 6b6b711..d9651f1 100644 --- a/arch/x86/kernel/apic/msi.c +++ b/arch/x86/kernel/apic/msi.c @@ -55,14 +55,14 @@ msi_set_affinity(struct irq_data *irqd, const struct cpumask *mask, bool force) * caused by the non-atomic update of the address/data pair. * * Direct update is possible when: - * - The MSI is maskable (remapped MSI does not use this code path)). - * The quirk bit is not set in this case. + * - The MSI is maskable (remapped MSI does not use this code path). + * The reservation mode bit is set in this case. * - The new vector is the same as the old vector * - The old vector is MANAGED_IRQ_SHUTDOWN_VECTOR (interrupt starts up) * - The interrupt is not yet started up * - The new destination CPU is the same as the old destination CPU */ - if (!irqd_msi_nomask_quirk(irqd) || + if (!irqd_can_reserve(irqd) || cfg->vector == old_cfg.vector || old_cfg.vector == MANAGED_IRQ_SHUTDOWN_VECTOR || !irqd_is_started(irqd) || @@ -215,8 +215,6 @@ static bool x86_init_dev_msi_info(struct device *dev, struct irq_domain *domain, if (WARN_ON_ONCE(domain != real_parent)) return false; info->chip->irq_set_affinity = msi_set_affinity; - /* See msi_set_affinity() for the gory details */ - info->flags |= MSI_FLAG_NOMASK_QUIRK; break; case DOMAIN_BUS_DMAR: case DOMAIN_BUS_AMDVI: diff --git a/include/linux/irq.h b/include/linux/irq.h index d8a6fdc..90081af 100644 --- a/include/linux/irq.h +++ b/include/linux/irq.h @@ -215,8 +215,6 @@ struct irq_data { * IRQD_SINGLE_TARGET - IRQ allows only a single affinity target * IRQD_DEFAULT_TRIGGER_SET - Expected trigger already been set * IRQD_CAN_RESERVE - Can use reservation mode - * IRQD_MSI_NOMASK_QUIRK - Non-maskable MSI quirk for affinity change - * required * IRQD_HANDLE_ENFORCE_IRQCTX - Enforce that handle_irq_*() is only invoked * from actual interrupt context. * IRQD_AFFINITY_ON_ACTIVATE - Affinity is set on activation. Don't call @@ -247,11 +245,10 @@ enum { IRQD_SINGLE_TARGET = BIT(24), IRQD_DEFAULT_TRIGGER_SET = BIT(25), IRQD_CAN_RESERVE = BIT(26), - IRQD_MSI_NOMASK_QUIRK = BIT(27), - IRQD_HANDLE_ENFORCE_IRQCTX = BIT(28), - IRQD_AFFINITY_ON_ACTIVATE = BIT(29), - IRQD_IRQ_ENABLED_ON_SUSPEND = BIT(30), - IRQD_RESEND_WHEN_IN_PROGRESS = BIT(31), + IRQD_HANDLE_ENFORCE_IRQCTX = BIT(27), + IRQD_AFFINITY_ON_ACTIVATE = BIT(28), + IRQD_IRQ_ENABLED_ON_SUSPEND = BIT(29), + IRQD_RESEND_WHEN_IN_PROGRESS = BIT(30), }; #define __irqd_to_state(d) ACCESS_PRIVATE((d)->common, state_use_accessors) @@ -426,21 +423,6 @@ static inline bool irqd_can_reserve(struct irq_data *d) return __irqd_to_state(d) & IRQD_CAN_RESERVE; } -static inline void irqd_set_msi_nomask_quirk(struct irq_data *d) -{ - __irqd_to_state(d) |= IRQD_MSI_NOMASK_QUIRK; -} - -static inline void irqd_clr_msi_nomask_quirk(struct irq_data *d) -{ - __irqd_to_state(d) &= ~IRQD_MSI_NOMASK_QUIRK; -} - -static inline bool irqd_msi_nomask_quirk(struct irq_data *d) -{ - return __irqd_to_state(d) & IRQD_MSI_NOMASK_QUIRK; -} - static inline void irqd_set_affinity_on_activate(struct irq_data *d) { __irqd_to_state(d) |= IRQD_AFFINITY_ON_ACTIVATE; diff --git a/include/linux/msi.h b/include/linux/msi.h index a50ea79..ddace8c 100644 --- a/include/linux/msi.h +++ b/include/linux/msi.h @@ -547,12 +547,6 @@ enum { MSI_FLAG_ALLOC_SIMPLE_MSI_DESCS = (1 << 5), /* Free MSI descriptors */ MSI_FLAG_FREE_MSI_DESCS = (1 << 6), - /* - * Quirk to handle MSI implementations which do not provide - * masking. Currently known to affect x86, but has to be partially - * handled in the core MSI code. - */ - MSI_FLAG_NOMASK_QUIRK = (1 << 7), /* Mask for the generic functionality */ MSI_GENERIC_FLAGS_MASK = GENMASK(15, 0), diff --git a/kernel/irq/debugfs.c b/kernel/irq/debugfs.c index 5971a66..aae0402 100644 --- a/kernel/irq/debugfs.c +++ b/kernel/irq/debugfs.c @@ -121,7 +121,6 @@ static const struct irq_bit_descr irqdata_states[] = { BIT_MASK_DESCR(IRQD_AFFINITY_ON_ACTIVATE), BIT_MASK_DESCR(IRQD_MANAGED_SHUTDOWN), BIT_MASK_DESCR(IRQD_CAN_RESERVE), - BIT_MASK_DESCR(IRQD_MSI_NOMASK_QUIRK), BIT_MASK_DESCR(IRQD_FORWARDED_TO_VCPU), diff --git a/kernel/irq/msi.c b/kernel/irq/msi.c index b4c31a5..79b4a58 100644 --- a/kernel/irq/msi.c +++ b/kernel/irq/msi.c @@ -1204,7 +1204,6 @@ static int msi_handle_pci_fail(struct irq_domain *domain, struct msi_desc *desc, #define VIRQ_CAN_RESERVE 0x01 #define VIRQ_ACTIVATE 0x02 -#define VIRQ_NOMASK_QUIRK 0x04 static int msi_init_virq(struct irq_domain *domain, int virq, unsigned int vflags) { @@ -1213,8 +1212,6 @@ static int msi_init_virq(struct irq_domain *domain, int virq, unsigned int vflag if (!(vflags & VIRQ_CAN_RESERVE)) { irqd_clr_can_reserve(irqd); - if (vflags & VIRQ_NOMASK_QUIRK) - irqd_set_msi_nomask_quirk(irqd); /* * If the interrupt is managed but no CPU is available to @@ -1275,15 +1272,8 @@ static int __msi_domain_alloc_irqs(struct device *dev, struct irq_domain *domain * Interrupt can use a reserved vector and will not occupy * a real device vector until the interrupt is requested. */ - if (msi_check_reservation_mode(domain, info, dev)) { + if (msi_check_reservation_mode(domain, info, dev)) vflags |= VIRQ_CAN_RESERVE; - /* - * MSI affinity setting requires a special quirk (X86) when - * reservation mode is active. - */ - if (info->flags & MSI_FLAG_NOMASK_QUIRK) - vflags |= VIRQ_NOMASK_QUIRK; - } xa_for_each_range(xa, idx, desc, ctrl->first, ctrl->last) { if (!msi_desc_match(desc, MSI_DESC_NOTASSOCIATED))

2 years

1
0
0 0

[tip: x86/urgent] x86/i8259: Skip probing when ACPI/MADT advertises PCAT compatibility

by tip-bot2 for Thomas Gleixner

The following commit has been merged into the x86/urgent branch of tip: Commit-ID: 38d54ecfe293ed8bb26d05e6f0270a0aaa6656c6 Gitweb: https://git.kernel.org/tip/38d54ecfe293ed8bb26d05e6f0270a0aaa6656c6 Author: Thomas Gleixner <tglx(a)linutronix.de> AuthorDate: Wed, 25 Oct 2023 23:04:15 +02:00 Committer: Thomas Gleixner <tglx(a)linutronix.de> CommitterDate: Thu, 26 Oct 2023 11:31:45 +02:00 x86/i8259: Skip probing when ACPI/MADT advertises PCAT compatibility David and a few others reported that on certain newer systems some legacy interrupts fail to work correctly. Debugging revealed that the BIOS of these systems leaves the legacy PIC in uninitialized state which makes the PIC detection fail and the kernel switches to a dummy implementation. Unfortunately this fallback causes quite some code to fail as it depends on checks for the number of legacy PIC interrupts or the availability of the real PIC. In theory there is no reason to use the PIC on any modern system when IO/APIC is available, but the dependencies on the related checks cannot be resolved trivially and on short notice. This needs lots of analysis and rework. The PIC detection has been added to avoid quirky checks and force selection of the dummy implementation all over the place, especially in VM guest scenarios. So it's not an option to revert the relevant commit as that would break a lot of other scenarios. One solution would be to try to initialize the PIC on detection fail and retry the detection, but that puts the burden on everything which does not have a PIC. Fortunately the ACPI/MADT table header has a flag field, which advertises in bit 0 that the system is PCAT compatible, which means it has a legacy 8259 PIC. Evaluate that bit and if set avoid the detection routine and keep the real PIC installed, which then gets initialized (for nothing) and makes the rest of the code with all the dependencies work again. Fixes: e179f6914152 ("x86, irq, pic: Probe for legacy PIC and set legacy_pic appropriately") Reported-by: David Lazar <dlazar(a)gmail.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Tested-by: David Lazar <dlazar(a)gmail.com> Reviewed-by: Hans de Goede <hdegoede(a)redhat.com> Reviewed-by: Mario Limonciello <mario.limonciello(a)amd.com> Cc: stable(a)vger.kernel.org Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218003 Link: https://lore.kernel.org/r/875y2u5s8g.ffs@tglx --- arch/x86/include/asm/i8259.h | 2 ++- arch/x86/kernel/acpi/boot.c | 3 +++- arch/x86/kernel/i8259.c | 38 +++++++++++++++++++++++++++-------- 3 files changed, 35 insertions(+), 8 deletions(-) diff --git a/arch/x86/include/asm/i8259.h b/arch/x86/include/asm/i8259.h index 637fa1d..c715097 100644 --- a/arch/x86/include/asm/i8259.h +++ b/arch/x86/include/asm/i8259.h @@ -69,6 +69,8 @@ struct legacy_pic { void (*make_irq)(unsigned int irq); }; +void legacy_pic_pcat_compat(void); + extern struct legacy_pic *legacy_pic; extern struct legacy_pic null_legacy_pic; diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c index 2a0ea38..c55c0ef 100644 --- a/arch/x86/kernel/acpi/boot.c +++ b/arch/x86/kernel/acpi/boot.c @@ -148,6 +148,9 @@ static int __init acpi_parse_madt(struct acpi_table_header *table) pr_debug("Local APIC address 0x%08x\n", madt->address); } + if (madt->flags & ACPI_MADT_PCAT_COMPAT) + legacy_pic_pcat_compat(); + /* ACPI 6.3 and newer support the online capable bit. */ if (acpi_gbl_FADT.header.revision > 6 || (acpi_gbl_FADT.header.revision == 6 && diff --git a/arch/x86/kernel/i8259.c b/arch/x86/kernel/i8259.c index 30a5520..c20d183 100644 --- a/arch/x86/kernel/i8259.c +++ b/arch/x86/kernel/i8259.c @@ -32,6 +32,7 @@ */ static void init_8259A(int auto_eoi); +static bool pcat_compat __ro_after_init; static int i8259A_auto_eoi; DEFINE_RAW_SPINLOCK(i8259A_lock); @@ -299,15 +300,32 @@ static void unmask_8259A(void) static int probe_8259A(void) { + unsigned char new_val, probe_val = ~(1 << PIC_CASCADE_IR); unsigned long flags; - unsigned char probe_val = ~(1 << PIC_CASCADE_IR); - unsigned char new_val; + + /* + * If MADT has the PCAT_COMPAT flag set, then do not bother probing + * for the PIC. Some BIOSes leave the PIC uninitialized and probing + * fails. + * + * Right now this causes problems as quite some code depends on + * nr_legacy_irqs() > 0 or has_legacy_pic() == true. This is silly + * when the system has an IO/APIC because then PIC is not required + * at all, except for really old machines where the timer interrupt + * must be routed through the PIC. So just pretend that the PIC is + * there and let legacy_pic->init() initialize it for nothing. + * + * Alternatively this could just try to initialize the PIC and + * repeat the probe, but for cases where there is no PIC that's + * just pointless. + */ + if (pcat_compat) + return nr_legacy_irqs(); + /* - * Check to see if we have a PIC. - * Mask all except the cascade and read - * back the value we just wrote. If we don't - * have a PIC, we will read 0xff as opposed to the - * value we wrote. + * Check to see if we have a PIC. Mask all except the cascade and + * read back the value we just wrote. If we don't have a PIC, we + * will read 0xff as opposed to the value we wrote. */ raw_spin_lock_irqsave(&i8259A_lock, flags); @@ -429,5 +447,9 @@ static int __init i8259A_init_ops(void) return 0; } - device_initcall(i8259A_init_ops); + +void __init legacy_pic_pcat_compat(void) +{ + pcat_compat = true; +}

2 years

1
0
0 0

[tip: x86/urgent] x86/tsc: Defer marking TSC unstable to a worker

by tip-bot2 for Thomas Gleixner

The following commit has been merged into the x86/urgent branch of tip: Commit-ID: 4f0d5e708ef88b58c954581ca54161064beaaaf5 Gitweb: https://git.kernel.org/tip/4f0d5e708ef88b58c954581ca54161064beaaaf5 Author: Thomas Gleixner <tglx(a)linutronix.de> AuthorDate: Wed, 25 Oct 2023 23:31:35 +02:00 Committer: Thomas Gleixner <tglx(a)linutronix.de> CommitterDate: Thu, 26 Oct 2023 11:31:45 +02:00 x86/tsc: Defer marking TSC unstable to a worker Tetsuo reported the following lockdep splat when the TSC synchronization fails during CPU hotplug: tsc: Marking TSC unstable due to check_tsc_sync_source failed WARNING: inconsistent lock state inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage. ffffffff8cfa1c78 (watchdog_lock){?.-.}-{2:2}, at: clocksource_watchdog+0x23/0x5a0 {IN-HARDIRQ-W} state was registered at: _raw_spin_lock_irqsave+0x3f/0x60 clocksource_mark_unstable+0x1b/0x90 mark_tsc_unstable+0x41/0x50 check_tsc_sync_source+0x14f/0x180 sysvec_call_function_single+0x69/0x90 Possible unsafe locking scenario: lock(watchdog_lock); <Interrupt> lock(watchdog_lock); stack backtrace: _raw_spin_lock+0x30/0x40 clocksource_watchdog+0x23/0x5a0 run_timer_softirq+0x2a/0x50 sysvec_apic_timer_interrupt+0x6e/0x90 The reason is the recent conversion of the TSC synchronization function during CPU hotplug on the control CPU to a SMP function call. In case that the synchronization with the upcoming CPU fails, the TSC has to be marked unstable via clocksource_mark_unstable(). clocksource_mark_unstable() acquires 'watchdog_lock', but that lock is taken with interrupts enabled in the watchdog timer callback to minimize interrupt disabled time. That's obviously a possible deadlock scenario, Before that change the synchronization function was invoked in thread context so this could not happen. As it is not crucical whether the unstable marking happens slightly delayed, defer the call to a worker thread which avoids the lock context problem. Fixes: 9d349d47f0e3 ("x86/smpboot: Make TSC synchronization function call based") Reported-by: Tetsuo Handa <penguin-kernel(a)i-love.sakura.ne.jp> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Tested-by: Tetsuo Handa <penguin-kernel(a)i-love.sakura.ne.jp> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/87zg064ceg.ffs@tglx --- arch/x86/kernel/tsc_sync.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/arch/x86/kernel/tsc_sync.c b/arch/x86/kernel/tsc_sync.c index bbc440c..1123ef3 100644 --- a/arch/x86/kernel/tsc_sync.c +++ b/arch/x86/kernel/tsc_sync.c @@ -15,6 +15,7 @@ * ( The serial nature of the boot logic and the CPU hotplug lock * protects against more than 2 CPUs entering this code. ) */ +#include <linux/workqueue.h> #include <linux/topology.h> #include <linux/spinlock.h> #include <linux/kernel.h> @@ -342,6 +343,13 @@ static inline unsigned int loop_timeout(int cpu) return (cpumask_weight(topology_core_cpumask(cpu)) > 1) ? 2 : 20; } +static void tsc_sync_mark_tsc_unstable(struct work_struct *work) +{ + mark_tsc_unstable("check_tsc_sync_source failed"); +} + +static DECLARE_WORK(tsc_sync_work, tsc_sync_mark_tsc_unstable); + /* * The freshly booted CPU initiates this via an async SMP function call. */ @@ -395,7 +403,7 @@ retry: "turning off TSC clock.\n", max_warp); if (random_warps) pr_warn("TSC warped randomly between CPUs\n"); - mark_tsc_unstable("check_tsc_sync_source failed"); + schedule_work(&tsc_sync_work); } /*

2 years

1
0
0 0

[PATCH] objtool/x86: add missing embedded_insn check

by John Sperbeck

When dbf460087755 ("objtool/x86: Fixup frame-pointer vs rethunk") was backported to some stable branches, the check for dest->embedded_insn in is_special_call() was missed. Add it back in. Signed-off-by: John Sperbeck <jsperbeck(a)google.com> --- I think 6.1.y, 5.15.y, and 5.10.y are the LTS branches missing the bit of code that this patch re-adds. tools/objtool/check.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/objtool/check.c b/tools/objtool/check.c index f8008ab31eef..cb363b507a32 100644 --- a/tools/objtool/check.c +++ b/tools/objtool/check.c @@ -2478,7 +2478,7 @@ static bool is_special_call(struct instruction *insn) if (!dest) return false; - if (dest->fentry) + if (dest->fentry || dest->embedded_insn) return true; } base-commit: 7d24402875c75ca6e43aa27ae3ce2042bde259a4 -- 2.42.0.758.gaed0368e0e-goog

2 years

3
4
0 0

[PATCH v2] mmc: Capture correct oemid

by Avri Altman

The OEMID is an 8-bit binary number that identifies the Device OEM and/or the Device contents (when used as a distribution media either on ROM or FLASH Devices). It occupies bits [111:104] in the CID register: see the eMMC spec JESD84-B51 paragraph 7.2.3. So it is 8 bits, and has been so since ever - this bug is so ancients I couldn't even find its source. The furthest I could go is to commit 335eadf2ef6a (sd: initialize SD cards) but its already was wrong. Could be because in SD its indeed 16 bits (a 2-characters ASCII string). Another option as pointed out by Alex (offlist), it seems like this comes from the legacy MMC specs (v3.31 and before). It is important to fix it because we are using it as one of our quirk's token, as well as other tools, e.g. the LVFS (https://github.com/fwupd/fwupd/). Signed-off-by: Avri Altman <avri.altman(a)wdc.com> Cc: stable(a)vger.kernel.org --- Changelog: v1--v2: Add Alex's note of the possible origin of this bug. --- drivers/mmc/core/mmc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c index 89cd48fcec79..4a4bab9aa726 100644 --- a/drivers/mmc/core/mmc.c +++ b/drivers/mmc/core/mmc.c @@ -104,7 +104,7 @@ static int mmc_decode_cid(struct mmc_card *card) case 3: /* MMC v3.1 - v3.3 */ case 4: /* MMC v4 */ card->cid.manfid = UNSTUFF_BITS(resp, 120, 8); - card->cid.oemid = UNSTUFF_BITS(resp, 104, 16); + card->cid.oemid = UNSTUFF_BITS(resp, 104, 8); card->cid.prod_name[0] = UNSTUFF_BITS(resp, 96, 8); card->cid.prod_name[1] = UNSTUFF_BITS(resp, 88, 8); card->cid.prod_name[2] = UNSTUFF_BITS(resp, 80, 8); -- 2.42.0

2 years

3
2
0 0

[PATCH] media: mtk-jpeg: Fix use after free bug due to error path handling in mtk_jpeg_dec_device_run

by Zheng Wang

In mtk_jpeg_probe, &jpeg->job_timeout_work is bound with mtk_jpeg_job_timeout_work. In mtk_jpeg_dec_device_run, if error happens in mtk_jpeg_set_dec_dst, it will finally start the worker while mark the job as finished by invoking v4l2_m2m_job_finish. There are two methods to trigger the bug. If we remove the module, it which will call mtk_jpeg_remove to make cleanup. The possible sequence is as follows, which will cause a use-after-free bug. CPU0 CPU1 mtk_jpeg_dec_... | start worker | |mtk_jpeg_job_timeout_work mtk_jpeg_remove | v4l2_m2m_release | kfree(m2m_dev); | | | v4l2_m2m_get_curr_priv | m2m_dev->curr_ctx //use If we close the file descriptor, which will call mtk_jpeg_release, it will have a similar sequence. Fix this bug by start timeout worker only if started jpegdec worker successfully so the v4l2_m2m_job_finish will only be called on either mtk_jpeg_job_timeout_work or mtk_jpeg_dec_device_run. This patch also reverts commit c677d7ae8314 ("media: mtk-jpeg: Fix use after free bug due to uncanceled work") for this patch also fixed the use-after-free bug mentioned before. Before mtk_jpeg_remove is invoked, mtk_jpeg_release must be invoked to close opened files. And it will call v4l2_m2m_cancel_job to wait for the timeout worker finished so the canceling in mtk_jpeg_remove is unnecessary. Fixes: b2f0d2724ba4 ("[media] vcodec: mediatek: Add Mediatek JPEG Decoder Driver") Signed-off-by: Zheng Wang <zyytlz.wz(a)163.com> Signed-off-by: Dmitry Osipenko <dmitry.osipenko(a)collabora.com> Cc: stable(a)vger.kernel.org --- .../media/platform/mediatek/jpeg/mtk_jpeg_core.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c index 7194f88edc0f..c3456c700c07 100644 --- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c +++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c @@ -1021,13 +1021,13 @@ static void mtk_jpeg_dec_device_run(void *priv) if (ret < 0) goto dec_end; - schedule_delayed_work(&jpeg->job_timeout_work, - msecs_to_jiffies(MTK_JPEG_HW_TIMEOUT_MSEC)); - mtk_jpeg_set_dec_src(ctx, &src_buf->vb2_buf, &bs); if (mtk_jpeg_set_dec_dst(ctx, &jpeg_src_buf->dec_param, &dst_buf->vb2_buf, &fb)) goto dec_end; + schedule_delayed_work(&jpeg->job_timeout_work, + msecs_to_jiffies(MTK_JPEG_HW_TIMEOUT_MSEC)); + spin_lock_irqsave(&jpeg->hw_lock, flags); mtk_jpeg_dec_reset(jpeg->reg_base); mtk_jpeg_dec_set_config(jpeg->reg_base, @@ -1403,7 +1403,6 @@ static void mtk_jpeg_remove(struct platform_device *pdev) { struct mtk_jpeg_dev *jpeg = platform_get_drvdata(pdev); - cancel_delayed_work_sync(&jpeg->job_timeout_work); pm_runtime_disable(&pdev->dev); video_unregister_device(jpeg->vdev); v4l2_m2m_release(jpeg->m2m_dev); @@ -1750,9 +1749,6 @@ static void mtk_jpegdec_worker(struct work_struct *work) v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx); v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx); - schedule_delayed_work(&comp_jpeg[hw_id]->job_timeout_work, - msecs_to_jiffies(MTK_JPEG_HW_TIMEOUT_MSEC)); - mtk_jpeg_set_dec_src(ctx, &src_buf->vb2_buf, &bs); if (mtk_jpeg_set_dec_dst(ctx, &jpeg_src_buf->dec_param, @@ -1762,6 +1758,9 @@ static void mtk_jpegdec_worker(struct work_struct *work) goto setdst_end; } + schedule_delayed_work(&comp_jpeg[hw_id]->job_timeout_work, + msecs_to_jiffies(MTK_JPEG_HW_TIMEOUT_MSEC)); + spin_lock_irqsave(&comp_jpeg[hw_id]->hw_lock, flags); ctx->total_frame_num++; mtk_jpeg_dec_reset(comp_jpeg[hw_id]->reg_base); -- 2.25.1

2 years

5
4
0 0

[merged mm-stable] mm-damon-lru_sort-avoid-divide-by-zero-in-hot-threshold-calculation.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: mm/damon/lru_sort: avoid divide-by-zero in hot threshold calculation has been removed from the -mm tree. Its filename was mm-damon-lru_sort-avoid-divide-by-zero-in-hot-threshold-calculation.patch This patch was dropped because it was merged into the mm-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: SeongJae Park <sj(a)kernel.org> Subject: mm/damon/lru_sort: avoid divide-by-zero in hot threshold calculation Date: Thu, 19 Oct 2023 19:49:23 +0000 When calculating the hotness threshold for lru_prio scheme of DAMON_LRU_SORT, the module divides some values by the maximum nr_accesses. However, due to the type of the related variables, simple division-based calculation of the divisor can return zero. As a result, divide-by-zero is possible. Fix it by using damon_max_nr_accesses(), which handles the case. Link: https://lkml.kernel.org/r/20231019194924.100347-5-sj@kernel.org Fixes: 40e983cca927 ("mm/damon: introduce DAMON-based LRU-lists Sorting") Signed-off-by: SeongJae Park <sj(a)kernel.org> Reported-by: Jakub Acs <acsjakub(a)amazon.de> Cc: <stable(a)vger.kernel.org> [6.0+] Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/damon/lru_sort.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) --- a/mm/damon/lru_sort.c~mm-damon-lru_sort-avoid-divide-by-zero-in-hot-threshold-calculation +++ a/mm/damon/lru_sort.c @@ -195,9 +195,7 @@ static int damon_lru_sort_apply_paramete if (err) return err; - /* aggr_interval / sample_interval is the maximum nr_accesses */ - hot_thres = damon_lru_sort_mon_attrs.aggr_interval / - damon_lru_sort_mon_attrs.sample_interval * + hot_thres = damon_max_nr_accesses(&damon_lru_sort_mon_attrs) * hot_thres_access_freq / 1000; scheme = damon_lru_sort_new_hot_scheme(hot_thres); if (!scheme) _ Patches currently in -mm which might be from sj(a)kernel.org are mm-damon-sysfs-remove-requested-targets-when-online-commit-inputs.patch

2 years

1
0
0 0

[merged mm-stable] mm-damon-ops-common-avoid-divide-by-zero-during-region-hotness-calculation.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: mm/damon/ops-common: avoid divide-by-zero during region hotness calculation has been removed from the -mm tree. Its filename was mm-damon-ops-common-avoid-divide-by-zero-during-region-hotness-calculation.patch This patch was dropped because it was merged into the mm-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: SeongJae Park <sj(a)kernel.org> Subject: mm/damon/ops-common: avoid divide-by-zero during region hotness calculation Date: Thu, 19 Oct 2023 19:49:22 +0000 When calculating the hotness of each region for the under-quota regions prioritization, DAMON divides some values by the maximum nr_accesses. However, due to the type of the related variables, simple division-based calculation of the divisor can return zero. As a result, divide-by-zero is possible. Fix it by using damon_max_nr_accesses(), which handles the case. Link: https://lkml.kernel.org/r/20231019194924.100347-4-sj@kernel.org Fixes: 198f0f4c58b9 ("mm/damon/vaddr,paddr: support pageout prioritization") Signed-off-by: SeongJae Park <sj(a)kernel.org> Reported-by: Jakub Acs <acsjakub(a)amazon.de> Cc: <stable(a)vger.kernel.org> [5.16+] Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/damon/ops-common.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) --- a/mm/damon/ops-common.c~mm-damon-ops-common-avoid-divide-by-zero-during-region-hotness-calculation +++ a/mm/damon/ops-common.c @@ -73,7 +73,6 @@ void damon_pmdp_mkold(pmd_t *pmd, struct int damon_hot_score(struct damon_ctx *c, struct damon_region *r, struct damos *s) { - unsigned int max_nr_accesses; int freq_subscore; unsigned int age_in_sec; int age_in_log, age_subscore; @@ -81,8 +80,8 @@ int damon_hot_score(struct damon_ctx *c, unsigned int age_weight = s->quota.weight_age; int hotness; - max_nr_accesses = c->attrs.aggr_interval / c->attrs.sample_interval; - freq_subscore = r->nr_accesses * DAMON_MAX_SUBSCORE / max_nr_accesses; + freq_subscore = r->nr_accesses * DAMON_MAX_SUBSCORE / + damon_max_nr_accesses(&c->attrs); age_in_sec = (unsigned long)r->age * c->attrs.aggr_interval / 1000000; for (age_in_log = 0; age_in_log < DAMON_MAX_AGE_IN_LOG && age_in_sec; _ Patches currently in -mm which might be from sj(a)kernel.org are mm-damon-sysfs-remove-requested-targets-when-online-commit-inputs.patch

2 years

1
0
0 0

[merged mm-stable] mm-damon-core-avoid-divide-by-zero-during-monitoring-results-update.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: mm/damon/core: avoid divide-by-zero during monitoring results update has been removed from the -mm tree. Its filename was mm-damon-core-avoid-divide-by-zero-during-monitoring-results-update.patch This patch was dropped because it was merged into the mm-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: SeongJae Park <sj(a)kernel.org> Subject: mm/damon/core: avoid divide-by-zero during monitoring results update Date: Thu, 19 Oct 2023 19:49:21 +0000 When monitoring attributes are changed, DAMON updates access rate of the monitoring results accordingly. For that, it divides some values by the maximum nr_accesses. However, due to the type of the related variables, simple division-based calculation of the divisor can return zero. As a result, divide-by-zero is possible. Fix it by using damon_max_nr_accesses(), which handles the case. Link: https://lkml.kernel.org/r/20231019194924.100347-3-sj@kernel.org Fixes: 2f5bef5a590b ("mm/damon/core: update monitoring results for new monitoring attributes") Signed-off-by: SeongJae Park <sj(a)kernel.org> Reported-by: Jakub Acs <acsjakub(a)amazon.de> Cc: <stable(a)vger.kernel.org> [6.3+] Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/damon/core.c | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) --- a/mm/damon/core.c~mm-damon-core-avoid-divide-by-zero-during-monitoring-results-update +++ a/mm/damon/core.c @@ -500,20 +500,14 @@ static unsigned int damon_age_for_new_at static unsigned int damon_accesses_bp_to_nr_accesses( unsigned int accesses_bp, struct damon_attrs *attrs) { - unsigned int max_nr_accesses = - attrs->aggr_interval / attrs->sample_interval; - - return accesses_bp * max_nr_accesses / 10000; + return accesses_bp * damon_max_nr_accesses(attrs) / 10000; } /* convert nr_accesses to access ratio in bp (per 10,000) */ static unsigned int damon_nr_accesses_to_accesses_bp( unsigned int nr_accesses, struct damon_attrs *attrs) { - unsigned int max_nr_accesses = - attrs->aggr_interval / attrs->sample_interval; - - return nr_accesses * 10000 / max_nr_accesses; + return nr_accesses * 10000 / damon_max_nr_accesses(attrs); } static unsigned int damon_nr_accesses_for_new_attrs(unsigned int nr_accesses, _ Patches currently in -mm which might be from sj(a)kernel.org are mm-damon-sysfs-remove-requested-targets-when-online-commit-inputs.patch

2 years

1
0
0 0

[merged mm-stable] mm-damon-implement-a-function-for-max-nr_accesses-safe-calculation.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: mm/damon: implement a function for max nr_accesses safe calculation has been removed from the -mm tree. Its filename was mm-damon-implement-a-function-for-max-nr_accesses-safe-calculation.patch This patch was dropped because it was merged into the mm-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: SeongJae Park <sj(a)kernel.org> Subject: mm/damon: implement a function for max nr_accesses safe calculation Date: Thu, 19 Oct 2023 19:49:20 +0000 Patch series "avoid divide-by-zero due to max_nr_accesses overflow". The maximum nr_accesses of given DAMON context can be calculated by dividing the aggregation interval by the sampling interval. Some logics in DAMON uses the maximum nr_accesses as a divisor. Hence, the value shouldn't be zero. Such case is avoided since DAMON avoids setting the agregation interval as samller than the sampling interval. However, since nr_accesses is unsigned int while the intervals are unsigned long, the maximum nr_accesses could be zero while casting. Avoid the divide-by-zero by implementing a function that handles the corner case (first patch), and replaces the vulnerable direct max nr_accesses calculations (remaining patches). Note that the patches for the replacements are divided for broken commits, to make backporting on required tres easier. Especially, the last patch is for a patch that not yet merged into the mainline but in mm tree. This patch (of 4): The maximum nr_accesses of given DAMON context can be calculated by dividing the aggregation interval by the sampling interval. Some logics in DAMON uses the maximum nr_accesses as a divisor. Hence, the value shouldn't be zero. Such case is avoided since DAMON avoids setting the agregation interval as samller than the sampling interval. However, since nr_accesses is unsigned int while the intervals are unsigned long, the maximum nr_accesses could be zero while casting. Implement a function that handles the corner case. Note that this commit is not fixing the real issue since this is only introducing the safe function that will replaces the problematic divisions. The replacements will be made by followup commits, to make backporting on stable series easier. Link: https://lkml.kernel.org/r/20231019194924.100347-1-sj@kernel.org Link: https://lkml.kernel.org/r/20231019194924.100347-2-sj@kernel.org Fixes: 198f0f4c58b9 ("mm/damon/vaddr,paddr: support pageout prioritization") Signed-off-by: SeongJae Park <sj(a)kernel.org> Reported-by: Jakub Acs <acsjakub(a)amazon.de> Cc: <stable(a)vger.kernel.org> [5.16+] Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- include/linux/damon.h | 7 +++++++ 1 file changed, 7 insertions(+) --- a/include/linux/damon.h~mm-damon-implement-a-function-for-max-nr_accesses-safe-calculation +++ a/include/linux/damon.h @@ -681,6 +681,13 @@ static inline bool damon_target_has_pid( return ctx->ops.id == DAMON_OPS_VADDR || ctx->ops.id == DAMON_OPS_FVADDR; } +static inline unsigned int damon_max_nr_accesses(const struct damon_attrs *attrs) +{ + /* {aggr,sample}_interval are unsigned long, hence could overflow */ + return min(attrs->aggr_interval / attrs->sample_interval, + (unsigned long)UINT_MAX); +} + int damon_start(struct damon_ctx **ctxs, int nr_ctxs, bool exclusive); int damon_stop(struct damon_ctx **ctxs, int nr_ctxs); _ Patches currently in -mm which might be from sj(a)kernel.org are mm-damon-sysfs-remove-requested-targets-when-online-commit-inputs.patch

2 years

1
0
0 0

stable/linux-5.15.y baseline: 259 runs, 1 regressions (v5.15.137)

by kernelci.org bot

stable/linux-5.15.y baseline: 259 runs, 1 regressions (v5.15.137) Regressions Summary ------------------- platform | arch | lab | compiler | defconfig | regressions --------------+-------+------------+----------+-----------+------------ rk3399-roc-pc | arm64 | lab-clabbe | gcc-10 | defconfig | 1 Details: https://kernelci.org/test/job/stable/branch/linux-5.15.y/kernel/v5.15.137/p… Test: baseline Tree: stable Branch: linux-5.15.y Describe: v5.15.137 URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git SHA: 12952a23a5da6459aaaaa3ae4bc8ce8fef952ef5 Test Regressions ---------------- platform | arch | lab | compiler | defconfig | regressions --------------+-------+------------+----------+-----------+------------ rk3399-roc-pc | arm64 | lab-clabbe | gcc-10 | defconfig | 1 Details: https://kernelci.org/test/plan/id/65396a9d949627589eefcefa Results: 5 PASS, 1 FAIL, 1 SKIP Full config: defconfig Compiler: gcc-10 Plain log: https://storage.kernelci.org//stable/linux-5.15.y/v5.15.137/arm64/defconfig… HTML log: https://storage.kernelci.org//stable/linux-5.15.y/v5.15.137/arm64/defconfig… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.bootrr.deferred-probe-empty: https://kernelci.org/test/case/id/65396a9d949627589eefcf03 new failure (last pass: v5.15.136) 2023-10-25T19:20:38.114559 <8>[ 16.116512] <LAVA_SIGNAL_ENDRUN 0_dmesg 440396_1.5.2.4.1> 2023-10-25T19:20:38.219994 / # # 2023-10-25T19:20:38.321621 export SHELL=/bin/sh 2023-10-25T19:20:38.322193 # 2023-10-25T19:20:38.423242 / # export SHELL=/bin/sh. /lava-440396/environment 2023-10-25T19:20:38.423773 2023-10-25T19:20:38.524782 / # . /lava-440396/environment/lava-440396/bin/lava-test-runner /lava-440396/1 2023-10-25T19:20:38.525693 2023-10-25T19:20:38.530864 / # /lava-440396/bin/lava-test-runner /lava-440396/1 2023-10-25T19:20:38.576004 + export 'TESTRUN_ID=1_bootrr' ... (40 line(s) more)

2 years

1
0
0 0

stable-rc/linux-5.10.y baseline: 168 runs, 1 regressions (v5.10.199)

by kernelci.org bot

stable-rc/linux-5.10.y baseline: 168 runs, 1 regressions (v5.10.199) Regressions Summary ------------------- platform | arch | lab | compiler | defconfig | regressions ---------+------+--------------+----------+--------------------+------------ panda | arm | lab-baylibre | gcc-10 | multi_v7_defconfig | 1 Details: https://kernelci.org/test/job/stable-rc/branch/linux-5.10.y/kernel/v5.10.19… Test: baseline Tree: stable-rc Branch: linux-5.10.y Describe: v5.10.199 URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git SHA: cb49f0e441ce7db63ef67ccfa9d9562c22f5d6c3 Test Regressions ---------------- platform | arch | lab | compiler | defconfig | regressions ---------+------+--------------+----------+--------------------+------------ panda | arm | lab-baylibre | gcc-10 | multi_v7_defconfig | 1 Details: https://kernelci.org/test/plan/id/653966117a9004113aefcefe Results: 5 PASS, 1 FAIL, 1 SKIP Full config: multi_v7_defconfig Compiler: gcc-10 Plain log: https://storage.kernelci.org//stable-rc/linux-5.10.y/v5.10.199/arm/multi_v7… HTML log: https://storage.kernelci.org//stable-rc/linux-5.10.y/v5.10.199/arm/multi_v7… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.bootrr.deferred-probe-empty: https://kernelci.org/test/case/id/653966117a9004113aefcf07 failing since 0 day (last pass: v5.10.148-5-gac0fb49345ee, first fail: v5.10.198-200-ge31b6513c43d) 2023-10-25T19:01:21.459095 <8>[ 24.783966] <LAVA_SIGNAL_ENDRUN 0_dmesg 3814643_1.5.2.4.1> 2023-10-25T19:01:21.565768 / # # 2023-10-25T19:01:21.666861 export SHELL=/bin/sh 2023-10-25T19:01:21.667200 # 2023-10-25T19:01:21.767958 / # export SHELL=/bin/sh. /lava-3814643/environment 2023-10-25T19:01:21.768318 2023-10-25T19:01:21.869091 / # . /lava-3814643/environment/lava-3814643/bin/lava-test-runner /lava-3814643/1 2023-10-25T19:01:21.869654 2023-10-25T19:01:21.874614 / # /lava-3814643/bin/lava-test-runner /lava-3814643/1 2023-10-25T19:01:21.932745 + export 'TESTRUN_ID=1_bootrr' ... (11 line(s) more)

2 years

1
0
0 0

stable-rc/linux-5.4.y baseline: 154 runs, 2 regressions (v5.4.259)

by kernelci.org bot

stable-rc/linux-5.4.y baseline: 154 runs, 2 regressions (v5.4.259) Regressions Summary ------------------- platform | arch | lab | compiler | defconfig | regressions ----------------+-------+--------------+----------+--------------------+------------ meson-gxbb-p200 | arm64 | lab-baylibre | gcc-10 | defconfig | 1 panda | arm | lab-baylibre | gcc-10 | multi_v7_defconfig | 1 Details: https://kernelci.org/test/job/stable-rc/branch/linux-5.4.y/kernel/v5.4.259/… Test: baseline Tree: stable-rc Branch: linux-5.4.y Describe: v5.4.259 URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git SHA: 86ea40e6ad22d9d7daa54b9e8167ad1e4a8a48ee Test Regressions ---------------- platform | arch | lab | compiler | defconfig | regressions ----------------+-------+--------------+----------+--------------------+------------ meson-gxbb-p200 | arm64 | lab-baylibre | gcc-10 | defconfig | 1 Details: https://kernelci.org/test/plan/id/6539637d595e489851efcef5 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: defconfig Compiler: gcc-10 Plain log: https://storage.kernelci.org//stable-rc/linux-5.4.y/v5.4.259/arm64/defconfi… HTML log: https://storage.kernelci.org//stable-rc/linux-5.4.y/v5.4.259/arm64/defconfi… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.login: https://kernelci.org/test/case/id/6539637d595e489851efcef6 new failure (last pass: v5.4.258-121-g18f5a3e6c35c) platform | arch | lab | compiler | defconfig | regressions ----------------+-------+--------------+----------+--------------------+------------ panda | arm | lab-baylibre | gcc-10 | multi_v7_defconfig | 1 Details: https://kernelci.org/test/plan/id/653962de22637550e2efcef6 Results: 5 PASS, 1 FAIL, 1 SKIP Full config: multi_v7_defconfig Compiler: gcc-10 Plain log: https://storage.kernelci.org//stable-rc/linux-5.4.y/v5.4.259/arm/multi_v7_d… HTML log: https://storage.kernelci.org//stable-rc/linux-5.4.y/v5.4.259/arm/multi_v7_d… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.bootrr.deferred-probe-empty: https://kernelci.org/test/case/id/653962de22637550e2efceff failing since 0 day (last pass: v5.4.218-5-g5a1de46f7e74, first fail: v5.4.258-121-g18f5a3e6c35c) 2023-10-25T18:47:34.464333 <8>[ 21.144439] <LAVA_SIGNAL_ENDRUN 0_dmesg 3814585_1.5.2.4.1> 2023-10-25T18:47:34.572041 / # # 2023-10-25T18:47:34.673866 export SHELL=/bin/sh 2023-10-25T18:47:34.674354 # 2023-10-25T18:47:34.775250 / # export SHELL=/bin/sh. /lava-3814585/environment 2023-10-25T18:47:34.775939 2023-10-25T18:47:34.877089 / # . /lava-3814585/environment/lava-3814585/bin/lava-test-runner /lava-3814585/1 2023-10-25T18:47:34.878114 2023-10-25T18:47:34.883067 / # /lava-3814585/bin/lava-test-runner /lava-3814585/1 2023-10-25T18:47:34.937208 + export 'TESTRUN_ID=1_bootrr' ... (11 line(s) more)

2 years

1
0
0 0

stable/linux-5.4.y baseline: 153 runs, 2 regressions (v5.4.259)

by kernelci.org bot

stable/linux-5.4.y baseline: 153 runs, 2 regressions (v5.4.259) Regressions Summary ------------------- platform | arch | lab | compiler | defconfig | regressions ---------+------+--------------+----------+---------------------+------------ panda | arm | lab-baylibre | gcc-10 | multi_v7_defconfig | 1 panda | arm | lab-baylibre | gcc-10 | omap2plus_defconfig | 1 Details: https://kernelci.org/test/job/stable/branch/linux-5.4.y/kernel/v5.4.259/pla… Test: baseline Tree: stable Branch: linux-5.4.y Describe: v5.4.259 URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git SHA: 86ea40e6ad22d9d7daa54b9e8167ad1e4a8a48ee Test Regressions ---------------- platform | arch | lab | compiler | defconfig | regressions ---------+------+--------------+----------+---------------------+------------ panda | arm | lab-baylibre | gcc-10 | multi_v7_defconfig | 1 Details: https://kernelci.org/test/plan/id/65394d49c8ac80869cefcf15 Results: 5 PASS, 1 FAIL, 1 SKIP Full config: multi_v7_defconfig Compiler: gcc-10 Plain log: https://storage.kernelci.org//stable/linux-5.4.y/v5.4.259/arm/multi_v7_defc… HTML log: https://storage.kernelci.org//stable/linux-5.4.y/v5.4.259/arm/multi_v7_defc… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.bootrr.deferred-probe-empty: https://kernelci.org/test/case/id/65394d49c8ac80869cefcf1e new failure (last pass: v5.4.218) 2023-10-25T17:15:26.648063 + <8>[ 21.045318] <LAVA_SIGNAL_ENDRUN 0_dmesg 3814384_1.5.2.4.1> 2023-10-25T17:15:26.648278 set +x 2023-10-25T17:15:26.752570 / # # 2023-10-25T17:15:26.853605 export SHELL=/bin/sh 2023-10-25T17:15:26.853922 # 2023-10-25T17:15:26.954642 / # export SHELL=/bin/sh. /lava-3814384/environment 2023-10-25T17:15:26.954955 2023-10-25T17:15:27.055692 / # . /lava-3814384/environment/lava-3814384/bin/lava-test-runner /lava-3814384/1 2023-10-25T17:15:27.056224 2023-10-25T17:15:27.061227 / # /lava-3814384/bin/lava-test-runner /lava-3814384/1 ... (12 line(s) more) platform | arch | lab | compiler | defconfig | regressions ---------+------+--------------+----------+---------------------+------------ panda | arm | lab-baylibre | gcc-10 | omap2plus_defconfig | 1 Details: https://kernelci.org/test/plan/id/65394a8d7cd2f603b3efcf17 Results: 5 PASS, 1 FAIL, 1 SKIP Full config: omap2plus_defconfig Compiler: gcc-10 Plain log: https://storage.kernelci.org//stable/linux-5.4.y/v5.4.259/arm/omap2plus_def… HTML log: https://storage.kernelci.org//stable/linux-5.4.y/v5.4.259/arm/omap2plus_def… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.bootrr.deferred-probe-empty: https://kernelci.org/test/case/id/65394a8d7cd2f603b3efcf20 new failure (last pass: v5.4.218) 2023-10-25T17:03:54.091350 <8>[ 20.709594] <LAVA_SIGNAL_ENDRUN 0_dmesg 3814301_1.5.2.4.1> 2023-10-25T17:03:54.102886 <6>[ 20.713592] smsc95xx 3-1.1:1.0 eth0: register 'smsc95xx' at usb-4a064c00.ehci-1.1, smsc95xx USB 2.0 Ethernet, 02:03:01:8c:13:b0 2023-10-25T17:03:54.108407 <6>[ 20.728118] usbcore: registered new interface driver smsc95xx 2023-10-25T17:03:54.217627 <3>[ 20.735504] omap-abe-twl6040 sound: AS# 2023-10-25T17:03:54.218477 oC: failed to init link DMIC: -517 2023-10-25T17:03:54.218785 / # <3>[ 20.743469] omap-abe-twl6040 sound: devm_snd_soc_register_card() failed: -517 2023-10-25T17:03:54.320107 #export SHELL=/bin/sh 2023-10-25T17:03:54.320526 2023-10-25T17:03:54.320764 / # <6>[ 20.881469] [drm] Cannot find any crtc or sizes 2023-10-25T17:03:54.421686 export SHELL=/bin/sh. /lava-3814301/environment ... (17 line(s) more)

2 years

1
0
0 0

stable-rc/linux-5.15.y baseline: 147 runs, 1 regressions (v5.15.137)

by kernelci.org bot

stable-rc/linux-5.15.y baseline: 147 runs, 1 regressions (v5.15.137) Regressions Summary ------------------- platform | arch | lab | compiler | defconfig | regressions ---------+------+--------------+----------+--------------------+------------ panda | arm | lab-baylibre | gcc-10 | multi_v7_defconfig | 1 Details: https://kernelci.org/test/job/stable-rc/branch/linux-5.15.y/kernel/v5.15.13… Test: baseline Tree: stable-rc Branch: linux-5.15.y Describe: v5.15.137 URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git SHA: 12952a23a5da6459aaaaa3ae4bc8ce8fef952ef5 Test Regressions ---------------- platform | arch | lab | compiler | defconfig | regressions ---------+------+--------------+----------+--------------------+------------ panda | arm | lab-baylibre | gcc-10 | multi_v7_defconfig | 1 Details: https://kernelci.org/test/plan/id/6539425bc3c04fb105efcf0e Results: 5 PASS, 1 FAIL, 1 SKIP Full config: multi_v7_defconfig Compiler: gcc-10 Plain log: https://storage.kernelci.org//stable-rc/linux-5.15.y/v5.15.137/arm/multi_v7… HTML log: https://storage.kernelci.org//stable-rc/linux-5.15.y/v5.15.137/arm/multi_v7… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.bootrr.deferred-probe-empty: https://kernelci.org/test/case/id/6539425bc3c04fb105efcf16 failing since 0 day (last pass: v5.15.74-2-g741b5047a5f58, first fail: v5.15.135-237-gbc0ffd9b5ee2) 2023-10-25T16:28:59.288638 + <8>[ 11.654632] <LAVA_SIGNAL_ENDRUN 0_dmesg 3814138_1.5.2.4.1> 2023-10-25T16:28:59.288855 set +x 2023-10-25T16:28:59.393322 / # # 2023-10-25T16:28:59.494657 export SHELL=/bin/sh 2023-10-25T16:28:59.495157 # 2023-10-25T16:28:59.595991 / # export SHELL=/bin/sh. /lava-3814138/environment 2023-10-25T16:28:59.596491 2023-10-25T16:28:59.697336 / # . /lava-3814138/environment/lava-3814138/bin/lava-test-runner /lava-3814138/1 2023-10-25T16:28:59.698048 2023-10-25T16:28:59.703091 / # /lava-3814138/bin/lava-test-runner /lava-3814138/1 ... (12 line(s) more)

2 years

1
0
0 0

[PATCH] hwmon: nct6775: Fix incorrect variable reuse in fan_div calculation

by Zev Weiss

In the regmap conversion in commit 4ef2774511dc ("hwmon: (nct6775) Convert register access to regmap API") I reused the 'reg' variable for all three register reads in the fan speed calculation loop in nct6775_update_device(), but failed to notice that the value from the first one (data->REG_FAN[i]) is actually used in the call to nct6775_select_fan_div() at the end of the loop body. Since that patch the register value passed to nct6775_select_fan_div() has been (conditionally) incorrectly clobbered with the value of a different register than intended, which has in at least some cases resulted in fan speeds being adjusted down to zero. Fix this by using dedicated temporaries for the two intermediate register reads instead of 'reg'. Signed-off-by: Zev Weiss <zev(a)bewilderbeest.net> Fixes: 4ef2774511dc ("hwmon: (nct6775) Convert register access to regmap API") Reported-by: Thomas Zajic <zlatko(a)gmx.at> Tested-by: Thomas Zajic <zlatko(a)gmx.at> Cc: stable(a)vger.kernel.org # v5.19+ --- drivers/hwmon/nct6775-core.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/drivers/hwmon/nct6775-core.c b/drivers/hwmon/nct6775-core.c index b5b81bd83bb1..d928eb8ae5a3 100644 --- a/drivers/hwmon/nct6775-core.c +++ b/drivers/hwmon/nct6775-core.c @@ -1614,17 +1614,21 @@ struct nct6775_data *nct6775_update_device(struct device *dev) data->fan_div[i]); if (data->has_fan_min & BIT(i)) { - err = nct6775_read_value(data, data->REG_FAN_MIN[i], &reg); + u16 tmp; + + err = nct6775_read_value(data, data->REG_FAN_MIN[i], &tmp); if (err) goto out; - data->fan_min[i] = reg; + data->fan_min[i] = tmp; } if (data->REG_FAN_PULSES[i]) { - err = nct6775_read_value(data, data->REG_FAN_PULSES[i], &reg); + u16 tmp; + + err = nct6775_read_value(data, data->REG_FAN_PULSES[i], &tmp); if (err) goto out; - data->fan_pulses[i] = (reg >> data->FAN_PULSE_SHIFT[i]) & 0x03; + data->fan_pulses[i] = (tmp >> data->FAN_PULSE_SHIFT[i]) & 0x03; } err = nct6775_select_fan_div(dev, data, i, reg); -- 2.42.0

2 years

2
1
0 0

stable/linux-5.10.y baseline: 171 runs, 1 regressions (v5.10.199)

by kernelci.org bot

stable/linux-5.10.y baseline: 171 runs, 1 regressions (v5.10.199) Regressions Summary ------------------- platform | arch | lab | compiler | defconfig | regressions ---------+------+--------------+----------+--------------------+------------ panda | arm | lab-baylibre | gcc-10 | multi_v7_defconfig | 1 Details: https://kernelci.org/test/job/stable/branch/linux-5.10.y/kernel/v5.10.199/p… Test: baseline Tree: stable Branch: linux-5.10.y Describe: v5.10.199 URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git SHA: cb49f0e441ce7db63ef67ccfa9d9562c22f5d6c3 Test Regressions ---------------- platform | arch | lab | compiler | defconfig | regressions ---------+------+--------------+----------+--------------------+------------ panda | arm | lab-baylibre | gcc-10 | multi_v7_defconfig | 1 Details: https://kernelci.org/test/plan/id/65393d32c56c634badefcef3 Results: 5 PASS, 1 FAIL, 1 SKIP Full config: multi_v7_defconfig Compiler: gcc-10 Plain log: https://storage.kernelci.org//stable/linux-5.10.y/v5.10.199/arm/multi_v7_de… HTML log: https://storage.kernelci.org//stable/linux-5.10.y/v5.10.199/arm/multi_v7_de… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.bootrr.deferred-probe-empty: https://kernelci.org/test/case/id/65393d32c56c634badefcefc new failure (last pass: v5.10.148) 2023-10-25T16:06:55.028018 + <8>[ 24.847930] <LAVA_SIGNAL_ENDRUN 0_dmesg 3813999_1.5.2.4.1> 2023-10-25T16:06:55.028245 set +x 2023-10-25T16:06:55.133717 / # # 2023-10-25T16:06:55.234988 export SHELL=/bin/sh 2023-10-25T16:06:55.235350 # 2023-10-25T16:06:55.336128 / # export SHELL=/bin/sh. /lava-3813999/environment 2023-10-25T16:06:55.336497 2023-10-25T16:06:55.437331 / # . /lava-3813999/environment/lava-3813999/bin/lava-test-runner /lava-3813999/1 2023-10-25T16:06:55.438038 2023-10-25T16:06:55.443282 / # /lava-3813999/bin/lava-test-runner /lava-3813999/1 ... (12 line(s) more)

2 years

1
0
0 0

[PATCH] drm/i915/pmu: Check if pmu is closed before stopping event

by Umesh Nerlige Ramappa

When the driver unbinds, pmu is unregistered and i915->uabi_engines is set to RB_ROOT. Due to this, when i915 PMU tries to stop the engine events, it issues a warn_on because engine lookup fails. All perf hooks are taking care of this using a pmu->closed flag that is set when PMU unregisters. The stop event seems to have been left out. Check for pmu->closed in pmu_event_stop as well. Based on discussion here - https://patchwork.freedesktop.org/patch/492079/?series=105790&rev=2 v2: s/is/if/ in commit title v3: Add fixes tag and cc stable Cc: <stable(a)vger.kernel.org> # v5.11+ Fixes: b00bccb3f0bb ("drm/i915/pmu: Handle PCI unbind") Signed-off-by: Umesh Nerlige Ramappa <umesh.nerlige.ramappa(a)intel.com> Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin(a)intel.com> --- drivers/gpu/drm/i915/i915_pmu.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/gpu/drm/i915/i915_pmu.c b/drivers/gpu/drm/i915/i915_pmu.c index 108b675088ba..f861863eb7c1 100644 --- a/drivers/gpu/drm/i915/i915_pmu.c +++ b/drivers/gpu/drm/i915/i915_pmu.c @@ -831,9 +831,18 @@ static void i915_pmu_event_start(struct perf_event *event, int flags) static void i915_pmu_event_stop(struct perf_event *event, int flags) { + struct drm_i915_private *i915 = + container_of(event->pmu, typeof(*i915), pmu.base); + struct i915_pmu *pmu = &i915->pmu; + + if (pmu->closed) + goto out; + if (flags & PERF_EF_UPDATE) i915_pmu_event_read(event); i915_pmu_disable(event); + +out: event->hw.state = PERF_HES_STOPPED; } -- 2.38.1

2 years

2
3
0 0

stable/linux-6.1.y baseline: 169 runs, 2 regressions (v6.1.60)

by kernelci.org bot

stable/linux-6.1.y baseline: 169 runs, 2 regressions (v6.1.60) Regressions Summary ------------------- platform | arch | lab | compiler | defconfig | regressions -------------------+-------+-------------+----------+-----------+------------ kontron-pitx-imx8m | arm64 | lab-kontron | gcc-10 | defconfig | 2 Details: https://kernelci.org/test/job/stable/branch/linux-6.1.y/kernel/v6.1.60/plan… Test: baseline Tree: stable Branch: linux-6.1.y Describe: v6.1.60 URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git SHA: 32c9cdbe383c153af23cfa1df0a352b97ab3df7a Test Regressions ---------------- platform | arch | lab | compiler | defconfig | regressions -------------------+-------+-------------+----------+-----------+------------ kontron-pitx-imx8m | arm64 | lab-kontron | gcc-10 | defconfig | 2 Details: https://kernelci.org/test/plan/id/65393a8cc4bb93a73fefcf1f Results: 50 PASS, 2 FAIL, 1 SKIP Full config: defconfig Compiler: gcc-10 Plain log: https://storage.kernelci.org//stable/linux-6.1.y/v6.1.60/arm64/defconfig/gc… HTML log: https://storage.kernelci.org//stable/linux-6.1.y/v6.1.60/arm64/defconfig/gc… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.bootrr.deferred-probe-empty: https://kernelci.org/test/case/id/65393a8cc4bb93a73fefcf26 new failure (last pass: v6.1.59) 2023-10-25T15:55:42.539365 / # # 2023-10-25T15:55:42.641336 export SHELL=/bin/sh 2023-10-25T15:55:42.641668 # 2023-10-25T15:55:42.742405 / # export SHELL=/bin/sh. /lava-388657/environment 2023-10-25T15:55:42.743182 2023-10-25T15:55:42.844427 / # . /lava-388657/environment/lava-388657/bin/lava-test-runner /lava-388657/1 2023-10-25T15:55:42.845580 2023-10-25T15:55:42.851322 / # /lava-388657/bin/lava-test-runner /lava-388657/1 2023-10-25T15:55:42.916339 + export 'TESTRUN_ID=1_bootrr' 2023-10-25T15:55:42.916749 + cd /lava-388657/1/tests/1_bootrr ... (10 line(s) more) * baseline.bootrr.dwc3-usb1-probed: https://kernelci.org/test/case/id/65393a8cc4bb93a73fefcf36 new failure (last pass: v6.1.59) 2023-10-25T15:55:45.287082 /lava-388657/1/../bin/lava-test-case 2023-10-25T15:55:45.287443 <8>[ 17.006305] <LAVA_SIGNAL_TESTCASE TEST_CASE_ID=dwc3-usb1-probed RESULT=fail> 2023-10-25T15:55:45.287681 /lava-388657/1/../bin/lava-test-case

2 years

1
0
0 0

[PATCH 5.15 000/102] 5.15.136-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.15.136 release. There are 102 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 18 Oct 2023 08:39:38 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.136-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.15.136-rc1 Jakub Kicinski <kuba(a)kernel.org> eth: remove remaining copies of the NAPI_POLL_WEIGHT define Ricardo Cañuelo <ricardo.canuelo(a)collabora.com> usb: hub: Guard against accesses to uninitialized BOS descriptors Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Revert "kernel/sched: Modify initial boot task idle setup" Ren Zhijie <renzhijie2(a)huawei.com> arm64: armv8_deprecated: fix unused-function error Mark Rutland <mark.rutland(a)arm.com> arm64: armv8_deprecated: rework deprected instruction handling Mark Rutland <mark.rutland(a)arm.com> arm64: armv8_deprecated: move aarch32 helper earlier Mark Rutland <mark.rutland(a)arm.com> arm64: armv8_deprecated move emulation functions Mark Rutland <mark.rutland(a)arm.com> arm64: armv8_deprecated: fold ops into insn_emulation Mark Rutland <mark.rutland(a)arm.com> arm64: rework EL0 MRS emulation Mark Rutland <mark.rutland(a)arm.com> arm64: factor insn read out of call_undef_hook() Mark Rutland <mark.rutland(a)arm.com> arm64: factor out EL1 SSBS emulation hook Mark Rutland <mark.rutland(a)arm.com> arm64: split EL0/EL1 UNDEF handlers Mark Rutland <mark.rutland(a)arm.com> arm64: allow kprobes on EL0 handlers Mark Rutland <mark.rutland(a)arm.com> arm64: rework BTI exception handling Mark Rutland <mark.rutland(a)arm.com> arm64: rework FPAC exception handling Mark Rutland <mark.rutland(a)arm.com> arm64: consistently pass ESR_ELx to die() Mark Rutland <mark.rutland(a)arm.com> arm64: die(): pass 'err' as long Mark Rutland <mark.rutland(a)arm.com> arm64: report EL1 UNDEFs better Christophe Leroy <christophe.leroy(a)csgroup.eu> powerpc/64e: Fix wrong test in __ptep_test_and_clear_young() Christophe Leroy <christophe.leroy(a)csgroup.eu> powerpc/8xx: Fix pte_access_permitted() for PAGE_NONE Duoming Zhou <duoming(a)zju.edu.cn> dmaengine: mediatek: Fix deadlock caused by synchronize_irq() Rex Zhang <rex.zhang(a)intel.com> dmaengine: idxd: use spin_lock_irqsave before wait_event_lock_irq Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com> x86/alternatives: Disable KASAN in apply_alternatives() Pawel Laszczak <pawell(a)cadence.com> usb: cdnsp: Fixes issue with dequeuing not queued requests Krishna Kurapati <quic_kriskura(a)quicinc.com> usb: gadget: ncm: Handle decoding of multiple NTB's in unwrap call Piyush Mehta <piyush.mehta(a)amd.com> usb: gadget: udc-xilinx: replace memcpy with memcpy_toio Dharma Balasubiramani <dharma.b(a)microchip.com> counter: microchip-tcb-capture: Fix the use of internal GCLK logic Dmitry Torokhov <dmitry.torokhov(a)gmail.com> pinctrl: avoid unsafe code pattern in find_pinctrl() Michal Koutný <mkoutny(a)suse.com> cgroup: Remove duplicates in cgroup v1 tasks file Rijo Thomas <Rijo-john.Thomas(a)amd.com> tee: amdtee: fix use-after-free vulnerability in amdtee_close_session Hans de Goede <hdegoede(a)redhat.com> Input: goodix - ensure int GPIO is in input for gpio_count == 1 && gpio_int_idx == 0 case Szilard Fabian <szfabian(a)bluemarch.art> Input: i8042 - add Fujitsu Lifebook E5411 to i8042 quirk table Matthias Berndt <matthias_berndt(a)gmx.de> Input: xpad - add PXN V900 support Jeffery Miller <jefferymiller(a)google.com> Input: psmouse - fix fast_reconnect function for PS/2 mode Javier Carrasco <javier.carrasco.cruz(a)gmail.com> Input: powermate - fix use-after-free in powermate_config_complete Dan Carpenter <dan.carpenter(a)linaro.org> ceph: fix type promotion bug on 32bit systems Xiubo Li <xiubli(a)redhat.com> ceph: fix incorrect revoked caps assert in ceph_fill_file_size() Jordan Rife <jrife(a)google.com> libceph: use kernel_connect() Mika Westerberg <mika.westerberg(a)linux.intel.com> thunderbolt: Check that lane 1 is in CL0 before enabling lane bonding Mika Westerberg <mika.westerberg(a)linux.intel.com> thunderbolt: Workaround an IOMMU fault on certain systems with Intel Maple Ridge Jorge Sanjuan Garcia <jorge.sanjuangarcia(a)duagon.com> mcb: remove is_added flag from mcb_device struct Borislav Petkov (AMD) <bp(a)alien8.de> x86/cpu: Fix AMD erratum #1485 on Zen4-based CPUs Hans de Goede <hdegoede(a)redhat.com> ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA Daniel Miess <daniel.miess(a)amd.com> drm/amd/display: Don't set dpms_off for seamless boot Christian König <christian.koenig(a)amd.com> drm/amdgpu: add missing NULL check Alexander Zangerl <az(a)breathe-safe.com> iio: pressure: ms5611: ms5611_prom_is_valid false negative bug Lakshmi Yadlapati <lakshmiy(a)us.ibm.com> iio: pressure: dps310: Adjust Timeout Settings Phil Elwell <phil(a)raspberrypi.com> iio: pressure: bmp280: Fix NULL pointer exception Xingxing Luo <xingxing.luo(a)unisoc.com> usb: musb: Modify the "HWVers" register address Xingxing Luo <xingxing.luo(a)unisoc.com> usb: musb: Get the musb_qh poniter after musb_giveback Xiaolei Wang <xiaolei.wang(a)windriver.com> usb: cdns3: Modify the return value of cdns_set_active () to void when CONFIG_PM_SLEEP is disabled Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> usb: dwc3: Soft reset phy on probe for host Javier Carrasco <javier.carrasco.cruz(a)gmail.com> net: usb: dm9601: fix uninitialized variable use in dm9601_mdio_read Wesley Cheng <quic_wcheng(a)quicinc.com> usb: xhci: xhci-ring: Use sysdev for mapping bounce buffer Hongyu Xie <xy521521(a)gmail.com> xhci: Keep interrupt disabled in initialization until host is running. Amelie Delaunay <amelie.delaunay(a)foss.st.com> dmaengine: stm32-mdma: abort resume if no ongoing transfer Zheng Wang <zyytlz.wz(a)163.com> media: mtk-jpeg: Fix use after free bug due to uncanceled work Patrick Rohr <prohr(a)google.com> net: release reference to inet6_dev pointer Patrick Rohr <prohr(a)google.com> net: change accept_ra_min_rtr_lft to affect all RA lifetimes Patrick Rohr <prohr(a)google.com> net: add sysctl accept_ra_min_rtr_lft Adrian Hunter <adrian.hunter(a)intel.com> perf inject: Fix GEN_ELF_TEXT_OFFSET for jit Waiman Long <longman(a)redhat.com> workqueue: Override implicit ordered attribute in workqueue_apply_unbound_cpumask() Jeremy Cline <jeremy(a)jcline.org> nfc: nci: assert requested protocol is valid Ralph Siemsen <ralph.siemsen(a)linaro.org> pinctrl: renesas: rzn1: Enable missing PINMUX Nils Hoppmann <niho(a)linux.ibm.com> net/smc: Fix pos miscalculation in statistics Kory Maincent <kory.maincent(a)bootlin.com> ethtool: Fix mod state of verbose no_mask bitset Eric Dumazet <edumazet(a)google.com> net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() Will Mortensen <will(a)extrahop.com> net/mlx5e: Again mutually exclude RX-FCS and RX-port-timestamp Dan Carpenter <dan.carpenter(a)linaro.org> ixgbe: fix crash with empty VF macvlan list Radu Pirea (NXP OSS) <radu-nicolae.pirea(a)oss.nxp.com> net: phy: mscc: macsec: reject PN update requests Radu Pirea (NXP OSS) <radu-nicolae.pirea(a)oss.nxp.com> net: macsec: indicate next pn update when offloading David Vernet <void(a)manifault.com> bpf: Fix verifier log for async callback return values Konstantin Meskhidze <konstantin.meskhidze(a)huawei.com> drm/vmwgfx: fix typo of sizeof argument Björn Töpel <bjorn(a)rivosinc.com> riscv, bpf: Sign-extend return values Pu Lehui <pulehui(a)huawei.com> riscv, bpf: Factor out emit_call for kernel and bpf context Roger Pau Monne <roger.pau(a)citrix.com> xen-netback: use default TX queue size for vifs Jakub Kicinski <kuba(a)kernel.org> eth: remove copies of the NAPI_POLL_WEIGHT define Dan Carpenter <dan.carpenter(a)linaro.org> mlxsw: fix mlxsw_sp2_nve_vxlan_learning_set() return type Dinghao Liu <dinghao.liu(a)zju.edu.cn> ieee802154: ca8210: Fix a potential UAF in ca8210_probe Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com> ravb: Fix use-after-free issue in ravb_tx_timeout_work() Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com> ravb: Fix up dma_free_coherent() call in ravb_remove() Abhinav Kumar <quic_abhinavk(a)quicinc.com> drm/msm/dpu: change _dpu_plane_calc_bw() to use u64 to avoid overflow Dan Carpenter <dan.carpenter(a)linaro.org> drm/msm/dsi: fix irq_of_parse_and_map() error checking Abhinav Kumar <quic_abhinavk(a)quicinc.com> drm/msm/dsi: skip the wait for video mode done if not applicable Kuogee Hsieh <quic_khsieh(a)quicinc.com> drm/msm/dp: do not reinitialize phy unless retry during link training Sumit Garg <sumit.garg(a)linaro.org> KEYS: trusted: Remove redundant static calls usage Ahmad Fatoum <a.fatoum(a)pengutronix.de> KEYS: trusted: allow use of kernel RNG for key material WhaleChang <whalechang(a)google.com> ALSA: usb-audio: Fix microphone sound on Opencomm2 Headset Jordan Rife <jrife(a)google.com> net: prevent address rewrite in kernel_bind() Jan Kara <jack(a)suse.cz> quota: Fix slow quotaoff Hans de Goede <hdegoede(a)redhat.com> HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> lib/test_meminit: fix off-by-one error in test_pages() Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> platform/x86: hp-wmi:: Mark driver struct with __refdata to prevent section mismatch warning Armin Wolf <W_Armin(a)gmx.de> platform/x86: think-lmi: Fix reference leak Geert Uytterhoeven <geert+renesas(a)glider.be> of: overlay: Reorder struct fragment fields kerneldoc Jing Zhang <renyu.zj(a)linux.alibaba.com> perf/arm-cmn: Fix the unhandled overflow status of counter 4 to 7 Artem Chernyshev <artem.chernyshev(a)red-soft.ru> RDMA/cxgb4: Check skb value for failure to allocate Bart Van Assche <bvanassche(a)acm.org> RDMA/srp: Do not call scsi_done() from srp_abort() Bart Van Assche <bvanassche(a)acm.org> scsi: ib_srp: Call scsi_done() directly Bart Van Assche <bvanassche(a)acm.org> scsi: core: Rename scsi_mq_done() into scsi_done() and export it Bart Van Assche <bvanassche(a)acm.org> scsi: core: Use a structure member to track the SCSI command submitter Zhang Rui <rui.zhang(a)intel.com> iommu/vt-d: Avoid memory allocation in iommu_suspend() ------------- Diffstat: Documentation/admin-guide/kernel-parameters.txt | 10 + Documentation/networking/ip-sysctl.rst | 8 + Documentation/security/keys/trusted-encrypted.rst | 20 +- Makefile | 4 +- arch/arm64/include/asm/cpufeature.h | 3 +- arch/arm64/include/asm/exception.h | 13 +- arch/arm64/include/asm/spectre.h | 2 + arch/arm64/include/asm/system_misc.h | 2 +- arch/arm64/include/asm/traps.h | 19 +- arch/arm64/kernel/armv8_deprecated.c | 572 ++++++++++----------- arch/arm64/kernel/cpufeature.c | 23 +- arch/arm64/kernel/entry-common.c | 36 +- arch/arm64/kernel/proton-pack.c | 26 +- arch/arm64/kernel/traps.c | 125 ++--- arch/powerpc/include/asm/nohash/32/pte-8xx.h | 7 + arch/powerpc/include/asm/nohash/64/pgtable.h | 2 +- arch/powerpc/include/asm/nohash/pgtable.h | 2 + arch/riscv/net/bpf_jit_comp64.c | 33 +- arch/x86/include/asm/msr-index.h | 9 +- arch/x86/kernel/alternative.c | 13 + arch/x86/kernel/cpu/amd.c | 8 + drivers/acpi/resource.c | 7 + drivers/counter/microchip-tcb-capture.c | 2 +- drivers/dma/idxd/device.c | 5 +- drivers/dma/mediatek/mtk-uart-apdma.c | 3 +- drivers/dma/stm32-mdma.c | 4 + drivers/gpu/drm/amd/amdgpu/amdgpu_object.h | 2 +- drivers/gpu/drm/amd/display/dc/core/dc.c | 3 + drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c | 12 +- drivers/gpu/drm/msm/dp/dp_ctrl.c | 13 +- drivers/gpu/drm/msm/dsi/dsi_host.c | 19 +- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 2 +- drivers/hid/hid-logitech-hidpp.c | 3 +- drivers/iio/pressure/bmp280-core.c | 2 +- drivers/iio/pressure/dps310.c | 8 +- drivers/iio/pressure/ms5611_core.c | 2 +- drivers/infiniband/hw/cxgb4/cm.c | 3 + drivers/infiniband/ulp/srp/ib_srp.c | 22 +- drivers/input/joystick/xpad.c | 2 + drivers/input/misc/powermate.c | 1 + drivers/input/mouse/elantech.c | 1 + drivers/input/mouse/synaptics.c | 1 + drivers/input/serio/i8042-acpipnpio.h | 8 + drivers/input/touchscreen/goodix.c | 19 + drivers/iommu/intel/iommu.c | 16 - drivers/mcb/mcb-core.c | 10 +- drivers/mcb/mcb-parse.c | 2 - drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c | 1 + drivers/net/ethernet/amazon/ena/ena_netdev.c | 4 +- drivers/net/ethernet/brocade/bna/bnad.c | 3 +- drivers/net/ethernet/cortina/gemini.c | 4 +- drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c | 5 +- drivers/net/ethernet/marvell/skge.c | 3 +- drivers/net/ethernet/marvell/sky2.c | 3 +- drivers/net/ethernet/mediatek/mtk_star_emac.c | 3 +- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 3 +- .../ethernet/mellanox/mlxsw/spectrum_nve_vxlan.c | 4 +- drivers/net/ethernet/nvidia/forcedeth.c | 6 +- drivers/net/ethernet/renesas/ravb_main.c | 6 +- drivers/net/ethernet/ti/davinci_emac.c | 3 +- drivers/net/ethernet/ti/netcp_core.c | 5 +- drivers/net/ieee802154/ca8210.c | 17 +- drivers/net/macsec.c | 2 + drivers/net/phy/mscc/mscc_macsec.c | 6 + drivers/net/usb/dm9601.c | 7 +- drivers/net/xen-netback/interface.c | 7 +- drivers/of/overlay.c | 2 +- drivers/perf/arm-cmn.c | 2 +- drivers/pinctrl/core.c | 16 +- drivers/pinctrl/renesas/Kconfig | 1 + drivers/platform/x86/hp/hp-wmi.c | 8 +- drivers/platform/x86/think-lmi.c | 24 +- drivers/scsi/scsi_error.c | 17 +- drivers/scsi/scsi_lib.c | 15 +- drivers/scsi/scsi_priv.h | 1 + drivers/tee/amdtee/core.c | 10 +- drivers/thunderbolt/icm.c | 40 +- drivers/thunderbolt/switch.c | 7 + drivers/usb/cdns3/cdnsp-gadget.c | 3 + drivers/usb/cdns3/core.h | 3 +- drivers/usb/core/hub.c | 25 +- drivers/usb/core/hub.h | 2 +- drivers/usb/dwc3/core.c | 39 +- drivers/usb/gadget/function/f_ncm.c | 26 +- drivers/usb/gadget/udc/udc-xilinx.c | 20 +- drivers/usb/host/xhci-ring.c | 4 +- drivers/usb/host/xhci.c | 35 +- drivers/usb/musb/musb_debugfs.c | 2 +- drivers/usb/musb/musb_host.c | 9 +- fs/ceph/file.c | 2 +- fs/ceph/inode.c | 4 +- fs/quota/dquot.c | 66 ++- include/keys/trusted-type.h | 2 +- include/linux/intel-iommu.h | 2 +- include/linux/ipv6.h | 1 + include/linux/mcb.h | 1 - include/linux/quota.h | 4 +- include/linux/quotaops.h | 2 +- include/net/macsec.h | 1 + include/scsi/scsi_cmnd.h | 9 + include/uapi/linux/ipv6.h | 3 + kernel/bpf/verifier.c | 6 +- kernel/cgroup/cgroup-v1.c | 5 +- kernel/sched/core.c | 2 +- kernel/sched/idle.c | 1 - kernel/workqueue.c | 8 +- lib/test_meminit.c | 2 +- net/ceph/messenger.c | 4 +- net/ethtool/bitset.c | 32 +- net/ipv6/addrconf.c | 13 + net/ipv6/ndisc.c | 13 +- net/netfilter/ipvs/ip_vs_sync.c | 4 +- net/nfc/llcp_core.c | 30 +- net/nfc/nci/core.c | 5 + net/rds/tcp_connect.c | 2 +- net/rds/tcp_listen.c | 2 +- net/smc/smc_stats.h | 14 +- net/socket.c | 6 +- security/keys/trusted-keys/trusted_core.c | 48 +- sound/usb/quirks.c | 6 +- tools/perf/util/genelf.h | 4 +- 121 files changed, 1054 insertions(+), 762 deletions(-)

2 years

12
122
0 0

[PATCH] hid: lenovo: Resend all settings on reset_resume for compact keyboards

by Martin Kepplinger

From: Jamie Lentin <jm(a)lentin.co.uk> The USB Compact Keyboard variant requires a reset_resume function to restore keyboard configuration after a suspend in some situations. Move configuration normally done on probe to lenovo_features_set_cptkbd(), then recycle this for use on reset_resume. Without, the keyboard and driver would end up in an inconsistent state, breaking middle-button scrolling amongst other problems, and twiddling sysfs values wouldn't help as the middle-button mode won't be set until the driver is reloaded. Tested on a USB and Bluetooth Thinkpad Compact Keyboard. CC: stable(a)vger.kernel.org Fixes: 94eefa271323 ("HID: lenovo: Use native middle-button mode for compact keyboards") Signed-off-by: Jamie Lentin <jm(a)lentin.co.uk> Signed-off-by: Martin Kepplinger <martink(a)posteo.de> --- drivers/hid/hid-lenovo.c | 50 +++++++++++++++++++++++++++------------- 1 file changed, 34 insertions(+), 16 deletions(-) diff --git a/drivers/hid/hid-lenovo.c b/drivers/hid/hid-lenovo.c index 44763c0da444..614320bff39f 100644 --- a/drivers/hid/hid-lenovo.c +++ b/drivers/hid/hid-lenovo.c @@ -521,6 +521,19 @@ static void lenovo_features_set_cptkbd(struct hid_device *hdev) int ret; struct lenovo_drvdata *cptkbd_data = hid_get_drvdata(hdev); + /* + * Tell the keyboard a driver understands it, and turn F7, F9, F11 into + * regular keys + */ + ret = lenovo_send_cmd_cptkbd(hdev, 0x01, 0x03); + if (ret) + hid_warn(hdev, "Failed to switch F7/9/11 mode: %d\n", ret); + + /* Switch middle button to native mode */ + ret = lenovo_send_cmd_cptkbd(hdev, 0x09, 0x01); + if (ret) + hid_warn(hdev, "Failed to switch middle button: %d\n", ret); + ret = lenovo_send_cmd_cptkbd(hdev, 0x05, cptkbd_data->fn_lock); if (ret) hid_err(hdev, "Fn-lock setting failed: %d\n", ret); @@ -1126,22 +1139,6 @@ static int lenovo_probe_cptkbd(struct hid_device *hdev) } hid_set_drvdata(hdev, cptkbd_data); - /* - * Tell the keyboard a driver understands it, and turn F7, F9, F11 into - * regular keys (Compact only) - */ - if (hdev->product == USB_DEVICE_ID_LENOVO_CUSBKBD || - hdev->product == USB_DEVICE_ID_LENOVO_CBTKBD) { - ret = lenovo_send_cmd_cptkbd(hdev, 0x01, 0x03); - if (ret) - hid_warn(hdev, "Failed to switch F7/9/11 mode: %d\n", ret); - } - - /* Switch middle button to native mode */ - ret = lenovo_send_cmd_cptkbd(hdev, 0x09, 0x01); - if (ret) - hid_warn(hdev, "Failed to switch middle button: %d\n", ret); - /* Set keyboard settings to known state */ cptkbd_data->middlebutton_state = 0; cptkbd_data->fn_lock = true; @@ -1264,6 +1261,24 @@ static int lenovo_probe(struct hid_device *hdev, return ret; } +#ifdef CONFIG_PM +static int lenovo_reset_resume(struct hid_device *hdev) +{ + switch (hdev->product) { + case USB_DEVICE_ID_LENOVO_CUSBKBD: + case USB_DEVICE_ID_LENOVO_TPIIUSBKBD: + if (hdev->type == HID_TYPE_USBMOUSE) + lenovo_features_set_cptkbd(hdev); + + break; + default: + break; + } + + return 0; +} +#endif + static void lenovo_remove_tpkbd(struct hid_device *hdev) { struct lenovo_drvdata *data_pointer = hid_get_drvdata(hdev); @@ -1380,6 +1395,9 @@ static struct hid_driver lenovo_driver = { .raw_event = lenovo_raw_event, .event = lenovo_event, .report_fixup = lenovo_report_fixup, +#ifdef CONFIG_PM + .reset_resume = lenovo_reset_resume, +#endif }; module_hid_driver(lenovo_driver); -- 2.39.2

2 years

2
3
0 0

[PATCH 5.10 000/202] 5.10.199-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.10.199 release. There are 202 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 25 Oct 2023 10:47:57 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.199-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.10.199-rc1 Zhang Changzhong <zhangchangzhong(a)huawei.com> xfrm6: fix inet6_dev refcount underflow problem Kees Cook <keescook(a)chromium.org> Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name Edward AD <twuufnxlz(a)gmail.com> Bluetooth: hci_sock: fix slab oob read in create_monitor_event Tony Lindgren <tony(a)atomide.com> phy: mapphone-mdm6600: Fix pinctrl_pm handling for sleep pins Tony Lindgren <tony(a)atomide.com> phy: mapphone-mdm6600: Fix runtime PM for remove Tony Lindgren <tony(a)atomide.com> phy: mapphone-mdm6600: Fix runtime disable on probe Haibo Chen <haibo.chen(a)nxp.com> gpio: vf610: mask the gpio irq in system suspend and support wakeup Alexander Stein <alexander.stein(a)ew.tq-group.com> gpio: vf610: make irq_chip immutable Dan Carpenter <dan.carpenter(a)linaro.org> ASoC: pxa: fix a memory leak in probe() Haibo Chen <haibo.chen(a)nxp.com> gpio: vf610: set value before the direction to avoid a glitch Hans de Goede <hdegoede(a)redhat.com> platform/x86: asus-wmi: Map 0x2a code, Ignore 0x2b and 0x2c events Hans de Goede <hdegoede(a)redhat.com> platform/x86: asus-wmi: Change ASUS_WMI_BRN_DOWN code from 0x20 to 0x2e Niklas Schnelle <schnelle(a)linux.ibm.com> s390/pci: fix iommu bitmap allocation Peter Zijlstra <peterz(a)infradead.org> perf: Disallow mis-matched inherited group reads Puliang Lu <puliang.lu(a)fibocom.com> USB: serial: option: add Fibocom to DELL custom modem FM101R-GL Benoît Monin <benoit.monin(a)gmx.fr> USB: serial: option: add entry for Sierra EM9191 with new firmware Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit LE910C4-WWX 0x1035 composition Maurizio Lombardi <mlombard(a)redhat.com> nvme-rdma: do not try to stop unallocated queues Keith Busch <kbusch(a)kernel.org> nvme-pci: add BOGUS_NID for Intel 0a54 device Sunil V L <sunilvl(a)ventanamicro.com> ACPI: irq: Fix incorrect return value in acpi_register_gsi() Trond Myklebust <trond.myklebust(a)hammerspace.com> pNFS: Fix a hang in nfs4_evict_inode() Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> Revert "pinctrl: avoid unsafe code pattern in find_pinctrl()" Avri Altman <avri.altman(a)wdc.com> mmc: core: Capture correct oemid-bits for eMMC cards Haibo Chen <haibo.chen(a)nxp.com> mmc: core: sdio: hold retuning if sdio in 1-bit mode Geert Uytterhoeven <geert+renesas(a)glider.be> mtd: physmap-core: Restore map_rom fallback Martin Kurbanov <mmkurbanov(a)sberdevices.ru> mtd: spinand: micron: correct bitmask for ecc status Miquel Raynal <miquel.raynal(a)bootlin.com> mtd: rawnand: arasan: Ensure program page operations are successful Miquel Raynal <miquel.raynal(a)bootlin.com> mtd: rawnand: marvell: Ensure program page operations are successful Bibek Kumar Patro <quic_bibekkum(a)quicinc.com> mtd: rawnand: qcom: Unmap the right resource upon probe failure Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_event: Fix using memcmp when comparing keys Maher Sanalla <msanalla(a)nvidia.com> net/mlx5: Handle fw tracer change ownership event based on MTRC Renan Guilherme Lebre Ramos <japareaggae(a)gmail.com> platform/x86: touchscreen_dmi: Add info for the Positivo C4128B Rahul Rameshbabu <sergeantsagara(a)protonmail.com> HID: multitouch: Add required quirk for Synaptics 0xcd7e device Josef Bacik <josef(a)toxicpanda.com> btrfs: fix some -Wmaybe-uninitialized warnings in ioctl.c Kai Uwe Broulik <foss-linux(a)broulik.de> drm: panel-orientation-quirks: Add quirk for One Mix 2S Hangbin Liu <liuhangbin(a)gmail.com> ipv4/fib: send notify when delete source address routes Kees Cook <keescook(a)chromium.org> sky2: Make sure there is at least one frag_addr available Michał Mirosław <mirq-linux(a)rere.qmqm.pl> regulator/core: Revert "fix kobject release warning and memory leak in regulator_register()" Benjamin Berg <benjamin.berg(a)intel.com> wifi: cfg80211: avoid leaking stack data into trace Wen Gong <quic_wgong(a)quicinc.com> wifi: mac80211: allow transmitting EAPOL frames with tainted key Ilan Peer <ilan.peer(a)intel.com> wifi: cfg80211: Fix 6GHz scan configuration Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_core: Fix build warnings Ying Hsu <yinghsu(a)chromium.org> Bluetooth: Avoid redundant authentication Ma Ke <make_ruc2021(a)163.com> HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event Clément Léger <cleger(a)rivosinc.com> tracing: relax trace_event_eval_update() execution with cond_resched() Damien Le Moal <dlemoal(a)kernel.org> ata: libata-eh: Fix compilation warning in ata_eh_link_report() Chengfeng Ye <dg573847474(a)gmail.com> gpio: timberdale: Fix potential deadlock on &tgpio->lock Jeff Layton <jlayton(a)kernel.org> overlayfs: set ctime when setting mtime and atime Heiner Kallweit <hkallweit1(a)gmail.com> i2c: mux: Avoid potential false error message in i2c_mux_add_adapter Josef Bacik <josef(a)toxicpanda.com> btrfs: initialize start_slot in btrfs_log_prealloc_extents Filipe Manana <fdmanana(a)suse.com> btrfs: return -EUCLEAN for delayed tree ref with a ref count not equals to 1 Tony Lindgren <tony(a)atomide.com> ARM: dts: ti: omap: Fix noisy serial with overrun-throttle-ms for mapphone RD Babiera <rdbabiera(a)google.com> usb: typec: altmodes/displayport: Signal hpd low when exiting mode Hans de Goede <hdegoede(a)redhat.com> usb: typec: altmodes/displayport: Notify drm subsys of hotplug events Hans de Goede <hdegoede(a)redhat.com> drm/connector: Add support for out-of-band hotplug notification (v3) Hans de Goede <hdegoede(a)redhat.com> drm/connector: Add drm_connector_find_by_fwnode() function (v3) Hans de Goede <hdegoede(a)redhat.com> drm/connector: Add a fwnode pointer to drm_connector and register with ACPI (v2) Hans de Goede <hdegoede(a)redhat.com> drm/connector: Give connector sysfs devices there own device_type Daniel Miess <daniel.miess(a)amd.com> drm/amd/display: Don't set dpms_off for seamless boot Yongqiang Sun <yongqiang.sun(a)amd.com> drm/amd/display: only check available pipe to disable vbios mode. Tony Lindgren <tony(a)atomide.com> serial: 8250_omap: Fix errors with no_console_suspend Tony Lindgren <tony(a)atomide.com> serial: 8250: omap: Fix imprecise external abort for omap_8250_pm() Mathias Nyman <mathias.nyman(a)linux.intel.com> xhci: track port suspend state correctly in unsuccessful resume cases Mathias Nyman <mathias.nyman(a)linux.intel.com> xhci: decouple usb2 port resume and get_port_status request handling Mathias Nyman <mathias.nyman(a)linux.intel.com> xhci: clear usb2 resume related variables in one place. Mathias Nyman <mathias.nyman(a)linux.intel.com> xhci: rename resume_done to resume_timestamp Mathias Nyman <mathias.nyman(a)linux.intel.com> xhci: move port specific items such as state completions to port structure Mathias Nyman <mathias.nyman(a)linux.intel.com> xhci: cleanup xhci_hub_control port references Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> usb: core: Track SuperSpeed Plus GenXxY Juntong Deng <juntong.deng(a)outlook.com> selftests/mm: fix awk usage in charge_reserved_hugetlb.sh and hugetlb_reparenting_test.sh that may cause error Waiman Long <longman(a)redhat.com> selftests/vm: make charge_reserved_hugetlb.sh work with existing cgroup setting Hans de Goede <hdegoede(a)redhat.com> ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA Paul Menzel <pmenzel(a)molgen.mpg.de> ACPI: resource: Skip IRQ override on ASUS ExpertBook B1502CBA Tamim Khan <tamim(a)fusetak.com> ACPI: resource: Skip IRQ override on Asus Expertbook B2402CBA Hans de Goede <hdegoede(a)redhat.com> ACPI: resource: Add Asus ExpertBook B2502 to Asus quirks Tamim Khan <tamim(a)fusetak.com> ACPI: resource: Skip IRQ override on Asus Vivobook S5602ZA Kellen Renshaw <kellen.renshaw(a)canonical.com> ACPI: resource: Add ASUS model S5402ZA to quirks Tamim Khan <tamim(a)fusetak.com> ACPI: resource: Skip IRQ override on Asus Vivobook K3402ZA/K3502ZA Hui Wang <hui.wang(a)canonical.com> ACPI: resources: Add DMI-based legacy IRQ override quirk John Garry <john.garry(a)huawei.com> ACPI: Drop acpi_dev_irqresource_disabled() John Garry <john.garry(a)huawei.com> resource: Add irqresource_disabled() Mika Westerberg <mika.westerberg(a)linux.intel.com> thunderbolt: Workaround an IOMMU fault on certain systems with Intel Maple Ridge Gavrilov Ilia <Ilia.Gavrilov(a)infotecs.ru> net: pktgen: Fix interface flags printing Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nft_set_rbtree: .deactivate fails if element has expired Geert Uytterhoeven <geert+renesas(a)glider.be> neighbor: tracing: Move pin6 inside CONFIG_IPV6=y section Pedro Tammela <pctammela(a)mojatatu.com> net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve Jinjie Ruan <ruanjinjie(a)huawei.com> net: dsa: bcm_sf2: Fix possible memory leak in bcm_sf2_mdio_register() Michal Schmidt <mschmidt(a)redhat.com> i40e: prevent crash on probe if hw registers have invalid values Dan Carpenter <dan.carpenter(a)linaro.org> net: usb: smsc95xx: Fix an error code in smsc95xx_reset() Eric Dumazet <edumazet(a)google.com> ipv4: fib: annotate races around nh->nh_saddr_genid and nh->nh_saddr Eric Dumazet <edumazet(a)google.com> tun: prevent negative ifindex Eric Dumazet <edumazet(a)google.com> tcp: tsq: relax tcp_small_queue_check() when rtx queue contains a single skb Neal Cardwell <ncardwell(a)google.com> tcp: fix excessive TLP and RACK timeouts from HZ rounding Josua Mayer <josua(a)solid-run.com> net: rfkill: gpio: prevent value glitch during probe Ma Ke <make_ruc2021(a)163.com> net: ipv6: fix return value check in esp_remove_trailer Ma Ke <make_ruc2021(a)163.com> net: ipv4: fix return value check in esp_remove_trailer Eric Dumazet <edumazet(a)google.com> xfrm: interface: use DEV_STATS_INC() Eric Dumazet <edumazet(a)google.com> xfrm: fix a data-race in xfrm_gen_index() Manish Chopra <manishc(a)marvell.com> qed: fix LL2 RX buffer allocation Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915: Retry gtt fault when out of fence registers Sagi Grimberg <sagi(a)grimberg.me> nvmet-tcp: Fix a possible UAF in queue intialization setup Florian Westphal <fw(a)strlen.de> netfilter: nft_payload: fix wrong mac header matching Paolo Abeni <pabeni(a)redhat.com> tcp: check mptcp-level constraints for backlog coalescing Joerg Roedel <jroedel(a)suse.de> x86/sev: Check for user-space IOIO pointing to kernel space Joerg Roedel <jroedel(a)suse.de> x86/sev: Check IOBM for IOIO exceptions from user-space Borislav Petkov (AMD) <bp(a)alien8.de> x86/sev: Disable MMIO emulation from user mode Jim Mattson <jmattson(a)google.com> KVM: x86: Mask LVTPC when handling a PMI Johan Hovold <johan+linaro(a)kernel.org> regmap: fix NULL deref on lookup Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> nfc: nci: fix possible NULL pointer dereference in send_acknowledge() Jesse Brandeburg <jesse.brandeburg(a)intel.com> ice: reset first in crash dump kernels Jesse Brandeburg <jesse.brandeburg(a)intel.com> ice: fix over-shifted variable Arnd Bergmann <arnd(a)arndb.de> Bluetooth: avoid memcmp() out of bounds warning Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_event: Fix coding style Arkadiusz Bokowy <arkadiusz.bokowy(a)gmail.com> Bluetooth: vhci: Fix race when opening vhci device Ziyang Xuan <william.xuanziyang(a)huawei.com> Bluetooth: Fix a refcnt underflow problem for hci_conn Lee, Chun-Yi <jlee(a)suse.com> Bluetooth: Reject connection with the device which has same BD_ADDR Lee, Chun-Yi <jlee(a)suse.com> Bluetooth: hci_event: Ignore NULL link key Ricardo Cañuelo <ricardo.canuelo(a)collabora.com> usb: hub: Guard against accesses to uninitialized BOS descriptors Bagas Sanjaya <bagasdotme(a)gmail.com> Documentation: sysctl: align cells in second content column Liam Mark <lmark(a)codeaurora.org> mm/memory_hotplug: rate limit page migration warnings Hyeonggon Yoo <42.hyeyoo(a)gmail.com> lib/Kconfig.debug: do not enable DEBUG_PREEMPT by default Nicolas Dichtel <nicolas.dichtel(a)6wind.com> dev_forward_skb: do not scrub skb mark within the same name space Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com> ravb: Fix use-after-free issue in ravb_tx_timeout_work() Bart Van Assche <bvanassche(a)acm.org> RDMA/srp: Fix srp_abort() yangx.jy(a)fujitsu.com <yangx.jy(a)fujitsu.com> RDMA/srp: Set scmnd->result only when scmnd is not NULL Ren Zhijie <renzhijie2(a)huawei.com> arm64: armv8_deprecated: fix unused-function error Mark Rutland <mark.rutland(a)arm.com> arm64: armv8_deprecated: rework deprected instruction handling Mark Rutland <mark.rutland(a)arm.com> arm64: armv8_deprecated: move aarch32 helper earlier Mark Rutland <mark.rutland(a)arm.com> arm64: armv8_deprecated move emulation functions Mark Rutland <mark.rutland(a)arm.com> arm64: armv8_deprecated: fold ops into insn_emulation Mark Rutland <mark.rutland(a)arm.com> arm64: rework EL0 MRS emulation Mark Rutland <mark.rutland(a)arm.com> arm64: factor insn read out of call_undef_hook() Mark Rutland <mark.rutland(a)arm.com> arm64: factor out EL1 SSBS emulation hook Mark Rutland <mark.rutland(a)arm.com> arm64: split EL0/EL1 UNDEF handlers Mark Rutland <mark.rutland(a)arm.com> arm64: allow kprobes on EL0 handlers Mark Rutland <mark.rutland(a)arm.com> arm64: rework BTI exception handling Mark Rutland <mark.rutland(a)arm.com> arm64: rework FPAC exception handling Mark Rutland <mark.rutland(a)arm.com> arm64: consistently pass ESR_ELx to die() Mark Rutland <mark.rutland(a)arm.com> arm64: die(): pass 'err' as long Mark Rutland <mark.rutland(a)arm.com> arm64: report EL1 UNDEFs better Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com> x86/alternatives: Disable KASAN in apply_alternatives() Christophe Leroy <christophe.leroy(a)csgroup.eu> powerpc/64e: Fix wrong test in __ptep_test_and_clear_young() Christophe Leroy <christophe.leroy(a)csgroup.eu> powerpc/8xx: Fix pte_access_permitted() for PAGE_NONE Duoming Zhou <duoming(a)zju.edu.cn> dmaengine: mediatek: Fix deadlock caused by synchronize_irq() Krishna Kurapati <quic_kriskura(a)quicinc.com> usb: gadget: ncm: Handle decoding of multiple NTB's in unwrap call Piyush Mehta <piyush.mehta(a)amd.com> usb: gadget: udc-xilinx: replace memcpy with memcpy_toio Dharma Balasubiramani <dharma.b(a)microchip.com> counter: microchip-tcb-capture: Fix the use of internal GCLK logic Dmitry Torokhov <dmitry.torokhov(a)gmail.com> pinctrl: avoid unsafe code pattern in find_pinctrl() Michal Koutný <mkoutny(a)suse.com> cgroup: Remove duplicates in cgroup v1 tasks file Rijo Thomas <Rijo-john.Thomas(a)amd.com> tee: amdtee: fix use-after-free vulnerability in amdtee_close_session Hans de Goede <hdegoede(a)redhat.com> Input: goodix - ensure int GPIO is in input for gpio_count == 1 && gpio_int_idx == 0 case Szilard Fabian <szfabian(a)bluemarch.art> Input: i8042 - add Fujitsu Lifebook E5411 to i8042 quirk table Matthias Berndt <matthias_berndt(a)gmx.de> Input: xpad - add PXN V900 support Jeffery Miller <jefferymiller(a)google.com> Input: psmouse - fix fast_reconnect function for PS/2 mode Javier Carrasco <javier.carrasco.cruz(a)gmail.com> Input: powermate - fix use-after-free in powermate_config_complete Dan Carpenter <dan.carpenter(a)linaro.org> ceph: fix type promotion bug on 32bit systems Xiubo Li <xiubli(a)redhat.com> ceph: fix incorrect revoked caps assert in ceph_fill_file_size() Jordan Rife <jrife(a)google.com> libceph: use kernel_connect() Mika Westerberg <mika.westerberg(a)linux.intel.com> thunderbolt: Check that lane 1 is in CL0 before enabling lane bonding Jorge Sanjuan Garcia <jorge.sanjuangarcia(a)duagon.com> mcb: remove is_added flag from mcb_device struct Borislav Petkov (AMD) <bp(a)alien8.de> x86/cpu: Fix AMD erratum #1485 on Zen4-based CPUs Alexander Zangerl <az(a)breathe-safe.com> iio: pressure: ms5611: ms5611_prom_is_valid false negative bug Lakshmi Yadlapati <lakshmiy(a)us.ibm.com> iio: pressure: dps310: Adjust Timeout Settings Phil Elwell <phil(a)raspberrypi.com> iio: pressure: bmp280: Fix NULL pointer exception Xingxing Luo <xingxing.luo(a)unisoc.com> usb: musb: Modify the "HWVers" register address Xingxing Luo <xingxing.luo(a)unisoc.com> usb: musb: Get the musb_qh poniter after musb_giveback Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> usb: dwc3: Soft reset phy on probe for host Javier Carrasco <javier.carrasco.cruz(a)gmail.com> net: usb: dm9601: fix uninitialized variable use in dm9601_mdio_read Wesley Cheng <quic_wcheng(a)quicinc.com> usb: xhci: xhci-ring: Use sysdev for mapping bounce buffer Amelie Delaunay <amelie.delaunay(a)foss.st.com> dmaengine: stm32-mdma: abort resume if no ongoing transfer Zheng Wang <zyytlz.wz(a)163.com> media: mtk-jpeg: Fix use after free bug due to uncanceled work Patrick Rohr <prohr(a)google.com> net: release reference to inet6_dev pointer Patrick Rohr <prohr(a)google.com> net: change accept_ra_min_rtr_lft to affect all RA lifetimes Patrick Rohr <prohr(a)google.com> net: add sysctl accept_ra_min_rtr_lft Sasha Levin <sashal(a)kernel.org> Revert "spi: spi-zynqmp-gqspi: Fix runtime PM imbalance in zynqmp_qspi_probe" Sasha Levin <sashal(a)kernel.org> Revert "spi: zynqmp-gqspi: fix clock imbalance on probe failure" Waiman Long <longman(a)redhat.com> workqueue: Override implicit ordered attribute in workqueue_apply_unbound_cpumask() Jeremy Cline <jeremy(a)jcline.org> nfc: nci: assert requested protocol is valid Ralph Siemsen <ralph.siemsen(a)linaro.org> pinctrl: renesas: rzn1: Enable missing PINMUX Eric Dumazet <edumazet(a)google.com> net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() Dan Carpenter <dan.carpenter(a)linaro.org> ixgbe: fix crash with empty VF macvlan list Radu Pirea (NXP OSS) <radu-nicolae.pirea(a)oss.nxp.com> net: phy: mscc: macsec: reject PN update requests Radu Pirea (NXP OSS) <radu-nicolae.pirea(a)oss.nxp.com> net: macsec: indicate next pn update when offloading Konstantin Meskhidze <konstantin.meskhidze(a)huawei.com> drm/vmwgfx: fix typo of sizeof argument Björn Töpel <bjorn(a)rivosinc.com> riscv, bpf: Sign-extend return values Pu Lehui <pulehui(a)huawei.com> riscv, bpf: Factor out emit_call for kernel and bpf context Roger Pau Monne <roger.pau(a)citrix.com> xen-netback: use default TX queue size for vifs Dan Carpenter <dan.carpenter(a)linaro.org> mlxsw: fix mlxsw_sp2_nve_vxlan_learning_set() return type Dinghao Liu <dinghao.liu(a)zju.edu.cn> ieee802154: ca8210: Fix a potential UAF in ca8210_probe Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com> ravb: Fix up dma_free_coherent() call in ravb_remove() Abhinav Kumar <quic_abhinavk(a)quicinc.com> drm/msm/dpu: change _dpu_plane_calc_bw() to use u64 to avoid overflow Abhinav Kumar <quic_abhinavk(a)quicinc.com> drm/msm/dsi: skip the wait for video mode done if not applicable Kuogee Hsieh <quic_khsieh(a)quicinc.com> drm/msm/dp: do not reinitialize phy unless retry during link training Jordan Rife <jrife(a)google.com> net: prevent address rewrite in kernel_bind() Jan Kara <jack(a)suse.cz> quota: Fix slow quotaoff Hans de Goede <hdegoede(a)redhat.com> HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> lib/test_meminit: fix off-by-one error in test_pages() Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> platform/x86: hp-wmi:: Mark driver struct with __refdata to prevent section mismatch warning Jing Zhang <renyu.zj(a)linux.alibaba.com> perf/arm-cmn: Fix the unhandled overflow status of counter 4 to 7 Artem Chernyshev <artem.chernyshev(a)red-soft.ru> RDMA/cxgb4: Check skb value for failure to allocate Bart Van Assche <bvanassche(a)acm.org> RDMA/srp: Do not call scsi_done() from srp_abort() Bart Van Assche <bvanassche(a)acm.org> RDMA/srp: Make struct scsi_cmnd and struct srp_request adjacent ------------- Diffstat: Documentation/admin-guide/sysctl/net.rst | 18 +- Documentation/networking/ip-sysctl.rst | 8 + Makefile | 4 +- arch/arm/boot/dts/motorola-mapphone-common.dtsi | 1 + arch/arm64/include/asm/cpufeature.h | 3 +- arch/arm64/include/asm/exception.h | 13 +- arch/arm64/include/asm/spectre.h | 2 + arch/arm64/include/asm/system_misc.h | 2 +- arch/arm64/include/asm/traps.h | 19 +- arch/arm64/kernel/armv8_deprecated.c | 572 ++++++++++----------- arch/arm64/kernel/cpufeature.c | 23 +- arch/arm64/kernel/entry-common.c | 36 +- arch/arm64/kernel/proton-pack.c | 26 +- arch/arm64/kernel/traps.c | 125 ++--- arch/powerpc/include/asm/nohash/32/pte-8xx.h | 7 + arch/powerpc/include/asm/nohash/64/pgtable.h | 2 +- arch/powerpc/include/asm/nohash/pgtable.h | 2 + arch/riscv/net/bpf_jit_comp64.c | 33 +- arch/s390/pci/pci_dma.c | 15 +- arch/x86/boot/compressed/sev-es.c | 10 + arch/x86/include/asm/msr-index.h | 9 +- arch/x86/kernel/alternative.c | 13 + arch/x86/kernel/cpu/amd.c | 8 + arch/x86/kernel/sev-es-shared.c | 53 +- arch/x86/kernel/sev-es.c | 30 ++ arch/x86/kvm/lapic.c | 8 +- drivers/acpi/irq.c | 7 +- drivers/acpi/resource.c | 121 ++++- drivers/ata/libata-eh.c | 2 +- drivers/base/regmap/regmap.c | 2 +- drivers/bluetooth/hci_vhci.c | 3 + drivers/counter/microchip-tcb-capture.c | 2 +- drivers/dma/mediatek/mtk-uart-apdma.c | 3 +- drivers/dma/stm32-mdma.c | 4 + drivers/gpio/gpio-timberdale.c | 5 +- drivers/gpio/gpio-vf610.c | 46 +- drivers/gpu/drm/amd/display/dc/core/dc.c | 9 +- drivers/gpu/drm/drm_connector.c | 79 +++ drivers/gpu/drm/drm_crtc_internal.h | 2 + drivers/gpu/drm/drm_panel_orientation_quirks.c | 16 + drivers/gpu/drm/drm_sysfs.c | 87 +++- drivers/gpu/drm/i915/gem/i915_gem_mman.c | 1 + drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c | 12 +- drivers/gpu/drm/msm/dp/dp_ctrl.c | 13 +- drivers/gpu/drm/msm/dsi/dsi_host.c | 12 + drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 2 +- drivers/hid/hid-holtek-kbd.c | 4 + drivers/hid/hid-logitech-hidpp.c | 3 +- drivers/hid/hid-multitouch.c | 4 + drivers/i2c/i2c-mux.c | 2 +- drivers/iio/pressure/bmp280-core.c | 2 +- drivers/iio/pressure/dps310.c | 8 +- drivers/iio/pressure/ms5611_core.c | 2 +- drivers/infiniband/hw/cxgb4/cm.c | 3 + drivers/infiniband/ulp/srp/ib_srp.c | 172 +++---- drivers/infiniband/ulp/srp/ib_srp.h | 2 - drivers/input/joystick/xpad.c | 2 + drivers/input/misc/powermate.c | 1 + drivers/input/mouse/elantech.c | 1 + drivers/input/mouse/synaptics.c | 1 + drivers/input/serio/i8042-acpipnpio.h | 8 + drivers/input/touchscreen/goodix.c | 19 + drivers/mcb/mcb-core.c | 10 +- drivers/mcb/mcb-parse.c | 2 - drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c | 1 + drivers/mmc/core/mmc.c | 2 +- drivers/mmc/core/sdio.c | 8 +- drivers/mtd/maps/physmap-core.c | 11 + drivers/mtd/nand/raw/arasan-nand-controller.c | 16 +- drivers/mtd/nand/raw/marvell_nand.c | 23 +- drivers/mtd/nand/raw/qcom_nandc.c | 2 +- drivers/mtd/nand/spi/micron.c | 2 +- drivers/net/dsa/bcm_sf2.c | 24 +- drivers/net/ethernet/intel/i40e/i40e_common.c | 4 +- drivers/net/ethernet/intel/ice/ice_lib.c | 3 +- drivers/net/ethernet/intel/ice/ice_main.c | 15 + drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c | 5 +- drivers/net/ethernet/marvell/sky2.h | 2 +- .../ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 2 +- .../ethernet/mellanox/mlxsw/spectrum_nve_vxlan.c | 4 +- drivers/net/ethernet/qlogic/qed/qed_ll2.c | 7 +- drivers/net/ethernet/renesas/ravb_main.c | 6 +- drivers/net/ieee802154/ca8210.c | 17 +- drivers/net/macsec.c | 2 + drivers/net/phy/mscc/mscc_macsec.c | 6 + drivers/net/tun.c | 7 +- drivers/net/usb/dm9601.c | 7 +- drivers/net/usb/smsc95xx.c | 2 +- drivers/net/xen-netback/interface.c | 3 - drivers/nvme/host/pci.c | 3 +- drivers/nvme/host/rdma.c | 3 + drivers/nvme/target/tcp.c | 7 +- drivers/perf/arm-cmn.c | 2 +- drivers/phy/motorola/phy-mapphone-mdm6600.c | 38 +- drivers/pinctrl/renesas/Kconfig | 1 + drivers/platform/x86/asus-nb-wmi.c | 3 + drivers/platform/x86/asus-wmi.h | 2 +- drivers/platform/x86/hp-wmi.c | 8 +- drivers/platform/x86/touchscreen_dmi.c | 23 + drivers/regulator/core.c | 6 +- drivers/spi/spi-zynqmp-gqspi.c | 24 +- drivers/tee/amdtee/core.c | 10 +- drivers/thunderbolt/icm.c | 38 +- drivers/thunderbolt/switch.c | 7 + drivers/tty/serial/8250/8250_omap.c | 93 ++-- drivers/usb/core/hcd.c | 6 +- drivers/usb/core/hub.c | 106 +++- drivers/usb/core/hub.h | 2 +- drivers/usb/dwc3/core.c | 39 +- drivers/usb/gadget/function/f_ncm.c | 26 +- drivers/usb/gadget/udc/udc-xilinx.c | 20 +- drivers/usb/host/xhci-hub.c | 228 ++++---- drivers/usb/host/xhci-mem.c | 10 +- drivers/usb/host/xhci-ring.c | 17 +- drivers/usb/host/xhci.h | 9 +- drivers/usb/musb/musb_debugfs.c | 2 +- drivers/usb/musb/musb_host.c | 9 +- drivers/usb/serial/option.c | 7 + drivers/usb/typec/altmodes/Kconfig | 1 + drivers/usb/typec/altmodes/displayport.c | 28 + fs/btrfs/extent-tree.c | 6 +- fs/btrfs/ioctl.c | 4 +- fs/btrfs/tree-log.c | 2 +- fs/ceph/file.c | 2 +- fs/ceph/inode.c | 4 +- fs/nfs/pnfs.c | 33 +- fs/overlayfs/copy_up.c | 2 +- fs/quota/dquot.c | 66 ++- include/drm/drm_connector.h | 25 + include/linux/ioport.h | 7 + include/linux/ipv6.h | 1 + include/linux/mcb.h | 1 - include/linux/netdevice.h | 2 +- include/linux/perf_event.h | 1 + include/linux/quota.h | 4 +- include/linux/quotaops.h | 2 +- include/linux/usb.h | 2 + include/net/bluetooth/hci_core.h | 2 +- include/net/bluetooth/hci_mon.h | 2 +- include/net/ip_fib.h | 1 + include/net/macsec.h | 1 + include/net/netns/xfrm.h | 1 + include/net/tcp.h | 3 + include/trace/events/neigh.h | 4 +- include/uapi/linux/ipv6.h | 7 + kernel/cgroup/cgroup-v1.c | 5 +- kernel/events/core.c | 39 +- kernel/trace/trace_events.c | 1 + kernel/workqueue.c | 8 +- lib/Kconfig.debug | 5 +- lib/test_meminit.c | 2 +- mm/memory_hotplug.c | 16 +- net/bluetooth/hci_conn.c | 72 ++- net/bluetooth/hci_core.c | 8 +- net/bluetooth/hci_event.c | 33 +- net/bluetooth/hci_sock.c | 3 +- net/ceph/messenger.c | 4 +- net/core/pktgen.c | 14 +- net/ipv4/esp4.c | 4 +- net/ipv4/fib_semantics.c | 15 +- net/ipv4/fib_trie.c | 4 + net/ipv4/tcp_ipv4.c | 1 + net/ipv4/tcp_output.c | 25 +- net/ipv4/tcp_recovery.c | 2 +- net/ipv6/addrconf.c | 13 + net/ipv6/esp6.c | 4 +- net/ipv6/ndisc.c | 13 +- net/ipv6/xfrm6_policy.c | 4 +- net/mac80211/tx.c | 3 +- net/netfilter/ipvs/ip_vs_sync.c | 4 +- net/netfilter/nft_payload.c | 2 +- net/netfilter/nft_set_rbtree.c | 2 + net/nfc/llcp_core.c | 30 +- net/nfc/nci/core.c | 5 + net/nfc/nci/spi.c | 2 + net/rds/tcp_connect.c | 2 +- net/rds/tcp_listen.c | 2 +- net/rfkill/rfkill-gpio.c | 4 +- net/sched/sch_hfsc.c | 18 +- net/socket.c | 6 +- net/wireless/nl80211.c | 2 +- net/wireless/scan.c | 4 + net/xfrm/xfrm_interface_core.c | 22 +- net/xfrm/xfrm_policy.c | 6 +- sound/soc/pxa/pxa-ssp.c | 2 +- .../selftests/vm/charge_reserved_hugetlb.sh | 34 +- .../selftests/vm/hugetlb_reparenting_test.sh | 21 +- tools/testing/selftests/vm/write_hugetlb_memory.sh | 2 +- 188 files changed, 2126 insertions(+), 1202 deletions(-)

2 years

7
209
0 0

[PATCH 5.4 000/123] 5.4.259-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.4.259 release. There are 123 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 25 Oct 2023 10:47:57 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.259-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.4.259-rc1 Zhang Changzhong <zhangchangzhong(a)huawei.com> xfrm6: fix inet6_dev refcount underflow problem Kees Cook <keescook(a)chromium.org> Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name Edward AD <twuufnxlz(a)gmail.com> Bluetooth: hci_sock: fix slab oob read in create_monitor_event Tony Lindgren <tony(a)atomide.com> phy: mapphone-mdm6600: Fix pinctrl_pm handling for sleep pins Tony Lindgren <tony(a)atomide.com> phy: mapphone-mdm6600: Fix runtime PM for remove Tony Lindgren <tony(a)atomide.com> phy: mapphone-mdm6600: Fix runtime disable on probe Haibo Chen <haibo.chen(a)nxp.com> gpio: vf610: mask the gpio irq in system suspend and support wakeup Alexander Stein <alexander.stein(a)ew.tq-group.com> gpio: vf610: make irq_chip immutable Dan Carpenter <dan.carpenter(a)linaro.org> ASoC: pxa: fix a memory leak in probe() Haibo Chen <haibo.chen(a)nxp.com> gpio: vf610: set value before the direction to avoid a glitch Niklas Schnelle <schnelle(a)linux.ibm.com> s390/pci: fix iommu bitmap allocation Peter Zijlstra <peterz(a)infradead.org> perf: Disallow mis-matched inherited group reads Puliang Lu <puliang.lu(a)fibocom.com> USB: serial: option: add Fibocom to DELL custom modem FM101R-GL Benoît Monin <benoit.monin(a)gmx.fr> USB: serial: option: add entry for Sierra EM9191 with new firmware Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit LE910C4-WWX 0x1035 composition Sunil V L <sunilvl(a)ventanamicro.com> ACPI: irq: Fix incorrect return value in acpi_register_gsi() Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> Revert "pinctrl: avoid unsafe code pattern in find_pinctrl()" Avri Altman <avri.altman(a)wdc.com> mmc: core: Capture correct oemid-bits for eMMC cards Haibo Chen <haibo.chen(a)nxp.com> mmc: core: sdio: hold retuning if sdio in 1-bit mode Geert Uytterhoeven <geert+renesas(a)glider.be> mtd: physmap-core: Restore map_rom fallback Martin Kurbanov <mmkurbanov(a)sberdevices.ru> mtd: spinand: micron: correct bitmask for ecc status Bibek Kumar Patro <quic_bibekkum(a)quicinc.com> mtd: rawnand: qcom: Unmap the right resource upon probe failure Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_event: Fix using memcmp when comparing keys Rahul Rameshbabu <sergeantsagara(a)protonmail.com> HID: multitouch: Add required quirk for Synaptics 0xcd7e device Josef Bacik <josef(a)toxicpanda.com> btrfs: fix some -Wmaybe-uninitialized warnings in ioctl.c Kai Uwe Broulik <foss-linux(a)broulik.de> drm: panel-orientation-quirks: Add quirk for One Mix 2S Kees Cook <keescook(a)chromium.org> sky2: Make sure there is at least one frag_addr available Michał Mirosław <mirq-linux(a)rere.qmqm.pl> regulator/core: Revert "fix kobject release warning and memory leak in regulator_register()" Benjamin Berg <benjamin.berg(a)intel.com> wifi: cfg80211: avoid leaking stack data into trace Wen Gong <quic_wgong(a)quicinc.com> wifi: mac80211: allow transmitting EAPOL frames with tainted key Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_core: Fix build warnings Ying Hsu <yinghsu(a)chromium.org> Bluetooth: Avoid redundant authentication Ma Ke <make_ruc2021(a)163.com> HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event Clément Léger <cleger(a)rivosinc.com> tracing: relax trace_event_eval_update() execution with cond_resched() Damien Le Moal <dlemoal(a)kernel.org> ata: libata-eh: Fix compilation warning in ata_eh_link_report() Chengfeng Ye <dg573847474(a)gmail.com> gpio: timberdale: Fix potential deadlock on &tgpio->lock Jeff Layton <jlayton(a)kernel.org> overlayfs: set ctime when setting mtime and atime Heiner Kallweit <hkallweit1(a)gmail.com> i2c: mux: Avoid potential false error message in i2c_mux_add_adapter Josef Bacik <josef(a)toxicpanda.com> btrfs: initialize start_slot in btrfs_log_prealloc_extents Filipe Manana <fdmanana(a)suse.com> btrfs: return -EUCLEAN for delayed tree ref with a ref count not equals to 1 Tony Lindgren <tony(a)atomide.com> ARM: dts: ti: omap: Fix noisy serial with overrun-throttle-ms for mapphone Hans de Goede <hdegoede(a)redhat.com> ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA Paul Menzel <pmenzel(a)molgen.mpg.de> ACPI: resource: Skip IRQ override on ASUS ExpertBook B1502CBA Tamim Khan <tamim(a)fusetak.com> ACPI: resource: Skip IRQ override on Asus Expertbook B2402CBA Hans de Goede <hdegoede(a)redhat.com> ACPI: resource: Add Asus ExpertBook B2502 to Asus quirks Tamim Khan <tamim(a)fusetak.com> ACPI: resource: Skip IRQ override on Asus Vivobook S5602ZA Kellen Renshaw <kellen.renshaw(a)canonical.com> ACPI: resource: Add ASUS model S5402ZA to quirks Tamim Khan <tamim(a)fusetak.com> ACPI: resource: Skip IRQ override on Asus Vivobook K3402ZA/K3502ZA Hui Wang <hui.wang(a)canonical.com> ACPI: resources: Add DMI-based legacy IRQ override quirk John Garry <john.garry(a)huawei.com> ACPI: Drop acpi_dev_irqresource_disabled() John Garry <john.garry(a)huawei.com> resource: Add irqresource_disabled() Gavrilov Ilia <Ilia.Gavrilov(a)infotecs.ru> net: pktgen: Fix interface flags printing Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nft_set_rbtree: .deactivate fails if element has expired Geert Uytterhoeven <geert+renesas(a)glider.be> neighbor: tracing: Move pin6 inside CONFIG_IPV6=y section Pedro Tammela <pctammela(a)mojatatu.com> net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve Michal Schmidt <mschmidt(a)redhat.com> i40e: prevent crash on probe if hw registers have invalid values Dan Carpenter <dan.carpenter(a)linaro.org> net: usb: smsc95xx: Fix an error code in smsc95xx_reset() Eric Dumazet <edumazet(a)google.com> ipv4: fib: annotate races around nh->nh_saddr_genid and nh->nh_saddr Eric Dumazet <edumazet(a)google.com> tun: prevent negative ifindex Eric Dumazet <edumazet(a)google.com> tcp: tsq: relax tcp_small_queue_check() when rtx queue contains a single skb Neal Cardwell <ncardwell(a)google.com> tcp: fix excessive TLP and RACK timeouts from HZ rounding Josua Mayer <josua(a)solid-run.com> net: rfkill: gpio: prevent value glitch during probe Ma Ke <make_ruc2021(a)163.com> net: ipv6: fix return value check in esp_remove_trailer Ma Ke <make_ruc2021(a)163.com> net: ipv4: fix return value check in esp_remove_trailer Eric Dumazet <edumazet(a)google.com> xfrm: interface: use DEV_STATS_INC() Eric Dumazet <edumazet(a)google.com> xfrm: fix a data-race in xfrm_gen_index() Manish Chopra <manishc(a)marvell.com> qed: fix LL2 RX buffer allocation Florian Westphal <fw(a)strlen.de> netfilter: nft_payload: fix wrong mac header matching Jim Mattson <jmattson(a)google.com> KVM: x86: Mask LVTPC when handling a PMI Johan Hovold <johan+linaro(a)kernel.org> regmap: fix NULL deref on lookup Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> nfc: nci: fix possible NULL pointer dereference in send_acknowledge() Jesse Brandeburg <jesse.brandeburg(a)intel.com> ice: fix over-shifted variable Arnd Bergmann <arnd(a)arndb.de> Bluetooth: avoid memcmp() out of bounds warning Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_event: Fix coding style Arkadiusz Bokowy <arkadiusz.bokowy(a)gmail.com> Bluetooth: vhci: Fix race when opening vhci device Ziyang Xuan <william.xuanziyang(a)huawei.com> Bluetooth: Fix a refcnt underflow problem for hci_conn Lee, Chun-Yi <jlee(a)suse.com> Bluetooth: Reject connection with the device which has same BD_ADDR Lee, Chun-Yi <jlee(a)suse.com> Bluetooth: hci_event: Ignore NULL link key Ricardo Cañuelo <ricardo.canuelo(a)collabora.com> usb: hub: Guard against accesses to uninitialized BOS descriptors Bagas Sanjaya <bagasdotme(a)gmail.com> Documentation: sysctl: align cells in second content column Nicolas Dichtel <nicolas.dichtel(a)6wind.com> dev_forward_skb: do not scrub skb mark within the same name space Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com> ravb: Fix use-after-free issue in ravb_tx_timeout_work() Christophe Leroy <christophe.leroy(a)csgroup.eu> powerpc/64e: Fix wrong test in __ptep_test_and_clear_young() Christophe Leroy <christophe.leroy(a)csgroup.eu> powerpc/8xx: Fix pte_access_permitted() for PAGE_NONE Duoming Zhou <duoming(a)zju.edu.cn> dmaengine: mediatek: Fix deadlock caused by synchronize_irq() Borislav Petkov (AMD) <bp(a)alien8.de> x86/cpu: Fix AMD erratum #1485 on Zen4-based CPUs Krishna Kurapati <quic_kriskura(a)quicinc.com> usb: gadget: ncm: Handle decoding of multiple NTB's in unwrap call Piyush Mehta <piyush.mehta(a)amd.com> usb: gadget: udc-xilinx: replace memcpy with memcpy_toio Dmitry Torokhov <dmitry.torokhov(a)gmail.com> pinctrl: avoid unsafe code pattern in find_pinctrl() Michal Koutný <mkoutny(a)suse.com> cgroup: Remove duplicates in cgroup v1 tasks file Matthias Berndt <matthias_berndt(a)gmx.de> Input: xpad - add PXN V900 support Jeffery Miller <jefferymiller(a)google.com> Input: psmouse - fix fast_reconnect function for PS/2 mode Javier Carrasco <javier.carrasco.cruz(a)gmail.com> Input: powermate - fix use-after-free in powermate_config_complete Xiubo Li <xiubli(a)redhat.com> ceph: fix incorrect revoked caps assert in ceph_fill_file_size() Jordan Rife <jrife(a)google.com> libceph: use kernel_connect() Jorge Sanjuan Garcia <jorge.sanjuangarcia(a)duagon.com> mcb: remove is_added flag from mcb_device struct Alexander Zangerl <az(a)breathe-safe.com> iio: pressure: ms5611: ms5611_prom_is_valid false negative bug Lakshmi Yadlapati <lakshmiy(a)us.ibm.com> iio: pressure: dps310: Adjust Timeout Settings Phil Elwell <phil(a)raspberrypi.com> iio: pressure: bmp280: Fix NULL pointer exception Xingxing Luo <xingxing.luo(a)unisoc.com> usb: musb: Modify the "HWVers" register address Xingxing Luo <xingxing.luo(a)unisoc.com> usb: musb: Get the musb_qh poniter after musb_giveback Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> usb: dwc3: Soft reset phy on probe for host Javier Carrasco <javier.carrasco.cruz(a)gmail.com> net: usb: dm9601: fix uninitialized variable use in dm9601_mdio_read Wesley Cheng <quic_wcheng(a)quicinc.com> usb: xhci: xhci-ring: Use sysdev for mapping bounce buffer Amelie Delaunay <amelie.delaunay(a)foss.st.com> dmaengine: stm32-mdma: abort resume if no ongoing transfer Waiman Long <longman(a)redhat.com> workqueue: Override implicit ordered attribute in workqueue_apply_unbound_cpumask() Jeremy Cline <jeremy(a)jcline.org> nfc: nci: assert requested protocol is valid Eric Dumazet <edumazet(a)google.com> net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() Dan Carpenter <dan.carpenter(a)linaro.org> ixgbe: fix crash with empty VF macvlan list Konstantin Meskhidze <konstantin.meskhidze(a)huawei.com> drm/vmwgfx: fix typo of sizeof argument Roger Pau Monne <roger.pau(a)citrix.com> xen-netback: use default TX queue size for vifs Dan Carpenter <dan.carpenter(a)linaro.org> mlxsw: fix mlxsw_sp2_nve_vxlan_learning_set() return type Dinghao Liu <dinghao.liu(a)zju.edu.cn> ieee802154: ca8210: Fix a potential UAF in ca8210_probe Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com> ravb: Fix up dma_free_coherent() call in ravb_remove() Abhinav Kumar <quic_abhinavk(a)quicinc.com> drm/msm/dsi: skip the wait for video mode done if not applicable Martin Fuzzey <martin.fuzzey(a)flowbird.group> drm: etvnaviv: fix bad backport leading to warning Jordan Rife <jrife(a)google.com> net: prevent address rewrite in kernel_bind() Jan Kara <jack(a)suse.cz> quota: Fix slow quotaoff Hans de Goede <hdegoede(a)redhat.com> HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> pwm: hibvt: Explicitly set .polarity in .get_state() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> lib/test_meminit: fix off-by-one error in test_pages() Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> platform/x86: hp-wmi:: Mark driver struct with __refdata to prevent section mismatch warning Artem Chernyshev <artem.chernyshev(a)red-soft.ru> RDMA/cxgb4: Check skb value for failure to allocate ------------- Diffstat: Documentation/admin-guide/sysctl/net.rst | 18 +-- Makefile | 4 +- arch/arm/boot/dts/omap4-droid4-xt894.dts | 1 + arch/powerpc/include/asm/nohash/32/pte-8xx.h | 7 ++ arch/powerpc/include/asm/nohash/64/pgtable.h | 2 +- arch/powerpc/include/asm/nohash/pgtable.h | 2 + arch/s390/pci/pci_dma.c | 15 ++- arch/x86/include/asm/msr-index.h | 4 + arch/x86/kernel/cpu/amd.c | 8 ++ arch/x86/kvm/lapic.c | 8 +- drivers/acpi/irq.c | 7 +- drivers/acpi/resource.c | 121 +++++++++++++++++++-- drivers/ata/libata-eh.c | 2 +- drivers/base/regmap/regmap.c | 2 +- drivers/bluetooth/hci_vhci.c | 3 + drivers/dma/mediatek/mtk-uart-apdma.c | 3 +- drivers/dma/stm32-mdma.c | 4 + drivers/gpio/gpio-timberdale.c | 5 +- drivers/gpio/gpio-vf610.c | 46 ++++---- drivers/gpu/drm/drm_panel_orientation_quirks.c | 16 +++ drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c | 2 +- drivers/gpu/drm/msm/dsi/dsi_host.c | 12 ++ drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 2 +- drivers/hid/hid-holtek-kbd.c | 4 + drivers/hid/hid-logitech-hidpp.c | 3 +- drivers/hid/hid-multitouch.c | 4 + drivers/i2c/i2c-mux.c | 2 +- drivers/iio/pressure/bmp280-core.c | 2 +- drivers/iio/pressure/dps310.c | 8 +- drivers/iio/pressure/ms5611_core.c | 2 +- drivers/infiniband/hw/cxgb4/cm.c | 3 + drivers/input/joystick/xpad.c | 2 + drivers/input/misc/powermate.c | 1 + drivers/input/mouse/elantech.c | 1 + drivers/input/mouse/synaptics.c | 1 + drivers/mcb/mcb-core.c | 10 +- drivers/mcb/mcb-parse.c | 2 - drivers/mmc/core/mmc.c | 2 +- drivers/mmc/core/sdio.c | 8 +- drivers/mtd/maps/physmap-core.c | 11 ++ drivers/mtd/nand/raw/qcom_nandc.c | 2 +- drivers/mtd/nand/spi/micron.c | 2 +- drivers/net/ethernet/intel/i40e/i40e_common.c | 4 +- drivers/net/ethernet/intel/ice/ice_lib.c | 3 +- drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c | 5 +- drivers/net/ethernet/marvell/sky2.h | 2 +- .../ethernet/mellanox/mlxsw/spectrum_nve_vxlan.c | 4 +- drivers/net/ethernet/qlogic/qed/qed_ll2.c | 7 +- drivers/net/ethernet/renesas/ravb_main.c | 6 +- drivers/net/ieee802154/ca8210.c | 17 +-- drivers/net/tun.c | 7 +- drivers/net/usb/dm9601.c | 7 +- drivers/net/usb/smsc95xx.c | 2 +- drivers/net/xen-netback/interface.c | 3 - drivers/phy/motorola/phy-mapphone-mdm6600.c | 38 +++---- drivers/platform/x86/hp-wmi.c | 8 +- drivers/pwm/pwm-hibvt.c | 1 + drivers/regulator/core.c | 6 +- drivers/usb/core/hub.c | 28 ++++- drivers/usb/core/hub.h | 2 +- drivers/usb/dwc3/core.c | 39 ++++++- drivers/usb/gadget/function/f_ncm.c | 26 +++-- drivers/usb/gadget/udc/udc-xilinx.c | 20 ++-- drivers/usb/host/xhci-ring.c | 4 +- drivers/usb/musb/musb_debugfs.c | 2 +- drivers/usb/musb/musb_host.c | 9 +- drivers/usb/serial/option.c | 7 ++ fs/btrfs/extent-tree.c | 6 +- fs/btrfs/ioctl.c | 4 +- fs/btrfs/tree-log.c | 2 +- fs/ceph/inode.c | 4 +- fs/overlayfs/copy_up.c | 2 +- fs/quota/dquot.c | 66 ++++++----- include/linux/ioport.h | 7 ++ include/linux/mcb.h | 1 - include/linux/netdevice.h | 2 +- include/linux/perf_event.h | 1 + include/linux/quota.h | 4 +- include/linux/quotaops.h | 2 +- include/net/bluetooth/hci_core.h | 2 +- include/net/bluetooth/hci_mon.h | 2 +- include/net/netns/xfrm.h | 1 + include/net/tcp.h | 3 + include/trace/events/neigh.h | 4 +- kernel/cgroup/cgroup-v1.c | 5 +- kernel/events/core.c | 39 ++++++- kernel/trace/trace_events.c | 1 + kernel/workqueue.c | 8 +- lib/test_meminit.c | 2 +- net/bluetooth/hci_conn.c | 72 +++++++----- net/bluetooth/hci_core.c | 8 +- net/bluetooth/hci_event.c | 33 +++++- net/bluetooth/hci_sock.c | 3 +- net/ceph/messenger.c | 4 +- net/core/pktgen.c | 14 +-- net/ipv4/esp4.c | 4 +- net/ipv4/fib_semantics.c | 14 ++- net/ipv4/tcp_output.c | 25 ++++- net/ipv4/tcp_recovery.c | 2 +- net/ipv6/esp6.c | 4 +- net/ipv6/xfrm6_policy.c | 4 +- net/mac80211/tx.c | 3 +- net/netfilter/ipvs/ip_vs_sync.c | 4 +- net/netfilter/nft_payload.c | 2 +- net/netfilter/nft_set_rbtree.c | 2 + net/nfc/llcp_core.c | 30 ++--- net/nfc/nci/core.c | 5 + net/nfc/nci/spi.c | 2 + net/rds/tcp_connect.c | 2 +- net/rds/tcp_listen.c | 2 +- net/rfkill/rfkill-gpio.c | 4 +- net/sched/sch_hfsc.c | 18 ++- net/socket.c | 6 +- net/wireless/nl80211.c | 2 +- net/xfrm/xfrm_interface_core.c | 22 ++-- net/xfrm/xfrm_policy.c | 6 +- sound/soc/pxa/pxa-ssp.c | 2 +- 117 files changed, 757 insertions(+), 331 deletions(-)

2 years

6
130
0 0

[PATCH 4.19 00/98] 4.19.297-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.19.297 release. There are 98 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 25 Oct 2023 10:47:57 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.297-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.19.297-rc1 Zhang Changzhong <zhangchangzhong(a)huawei.com> xfrm6: fix inet6_dev refcount underflow problem Kees Cook <keescook(a)chromium.org> Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name Edward AD <twuufnxlz(a)gmail.com> Bluetooth: hci_sock: fix slab oob read in create_monitor_event Tony Lindgren <tony(a)atomide.com> phy: mapphone-mdm6600: Fix runtime PM for remove Dan Carpenter <dan.carpenter(a)linaro.org> ASoC: pxa: fix a memory leak in probe() Haibo Chen <haibo.chen(a)nxp.com> gpio: vf610: set value before the direction to avoid a glitch Niklas Schnelle <schnelle(a)linux.ibm.com> s390/pci: fix iommu bitmap allocation Peter Zijlstra <peterz(a)infradead.org> perf: Disallow mis-matched inherited group reads Puliang Lu <puliang.lu(a)fibocom.com> USB: serial: option: add Fibocom to DELL custom modem FM101R-GL Benoît Monin <benoit.monin(a)gmx.fr> USB: serial: option: add entry for Sierra EM9191 with new firmware Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit LE910C4-WWX 0x1035 composition Sunil V L <sunilvl(a)ventanamicro.com> ACPI: irq: Fix incorrect return value in acpi_register_gsi() Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> Revert "pinctrl: avoid unsafe code pattern in find_pinctrl()" Avri Altman <avri.altman(a)wdc.com> mmc: core: Capture correct oemid-bits for eMMC cards Martin Kurbanov <mmkurbanov(a)sberdevices.ru> mtd: spinand: micron: correct bitmask for ecc status Bibek Kumar Patro <quic_bibekkum(a)quicinc.com> mtd: rawnand: qcom: Unmap the right resource upon probe failure Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_event: Fix using memcmp when comparing keys Josef Bacik <josef(a)toxicpanda.com> btrfs: fix some -Wmaybe-uninitialized warnings in ioctl.c Kai Uwe Broulik <foss-linux(a)broulik.de> drm: panel-orientation-quirks: Add quirk for One Mix 2S Kees Cook <keescook(a)chromium.org> sky2: Make sure there is at least one frag_addr available Benjamin Berg <benjamin.berg(a)intel.com> wifi: cfg80211: avoid leaking stack data into trace Wen Gong <quic_wgong(a)quicinc.com> wifi: mac80211: allow transmitting EAPOL frames with tainted key Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_core: Fix build warnings Ying Hsu <yinghsu(a)chromium.org> Bluetooth: Avoid redundant authentication Ma Ke <make_ruc2021(a)163.com> HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event Clément Léger <cleger(a)rivosinc.com> tracing: relax trace_event_eval_update() execution with cond_resched() Damien Le Moal <dlemoal(a)kernel.org> ata: libata-eh: Fix compilation warning in ata_eh_link_report() Chengfeng Ye <dg573847474(a)gmail.com> gpio: timberdale: Fix potential deadlock on &tgpio->lock Jeff Layton <jlayton(a)kernel.org> overlayfs: set ctime when setting mtime and atime Heiner Kallweit <hkallweit1(a)gmail.com> i2c: mux: Avoid potential false error message in i2c_mux_add_adapter Josef Bacik <josef(a)toxicpanda.com> btrfs: initialize start_slot in btrfs_log_prealloc_extents Filipe Manana <fdmanana(a)suse.com> btrfs: return -EUCLEAN for delayed tree ref with a ref count not equals to 1 Tony Lindgren <tony(a)atomide.com> ARM: dts: ti: omap: Fix noisy serial with overrun-throttle-ms for mapphone Jordan Rife <jrife(a)google.com> libceph: use kernel_connect() Jeff Layton <jlayton(a)kernel.org> libceph: fix unaligned accesses in ceph_entity_addr handling Gavrilov Ilia <Ilia.Gavrilov(a)infotecs.ru> net: pktgen: Fix interface flags printing Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nft_set_rbtree: .deactivate fails if element has expired Pedro Tammela <pctammela(a)mojatatu.com> net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve Michal Schmidt <mschmidt(a)redhat.com> i40e: prevent crash on probe if hw registers have invalid values Dan Carpenter <dan.carpenter(a)linaro.org> net: usb: smsc95xx: Fix an error code in smsc95xx_reset() Eric Dumazet <edumazet(a)google.com> tcp: tsq: relax tcp_small_queue_check() when rtx queue contains a single skb Neal Cardwell <ncardwell(a)google.com> tcp: fix excessive TLP and RACK timeouts from HZ rounding Josua Mayer <josua(a)solid-run.com> net: rfkill: gpio: prevent value glitch during probe Ma Ke <make_ruc2021(a)163.com> net: ipv6: fix return value check in esp_remove_trailer Ma Ke <make_ruc2021(a)163.com> net: ipv4: fix return value check in esp_remove_trailer Eric Dumazet <edumazet(a)google.com> xfrm: interface: use DEV_STATS_INC() Eric Dumazet <edumazet(a)google.com> xfrm: fix a data-race in xfrm_gen_index() Florian Westphal <fw(a)strlen.de> netfilter: nft_payload: fix wrong mac header matching Jim Mattson <jmattson(a)google.com> KVM: x86: Mask LVTPC when handling a PMI Johan Hovold <johan+linaro(a)kernel.org> regmap: fix NULL deref on lookup Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> nfc: nci: fix possible NULL pointer dereference in send_acknowledge() Arnd Bergmann <arnd(a)arndb.de> Bluetooth: avoid memcmp() out of bounds warning Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_event: Fix coding style Arkadiusz Bokowy <arkadiusz.bokowy(a)gmail.com> Bluetooth: vhci: Fix race when opening vhci device Ziyang Xuan <william.xuanziyang(a)huawei.com> Bluetooth: Fix a refcnt underflow problem for hci_conn Lee, Chun-Yi <jlee(a)suse.com> Bluetooth: Reject connection with the device which has same BD_ADDR Lee, Chun-Yi <jlee(a)suse.com> Bluetooth: hci_event: Ignore NULL link key Ricardo Cañuelo <ricardo.canuelo(a)collabora.com> usb: hub: Guard against accesses to uninitialized BOS descriptors Nicolas Dichtel <nicolas.dichtel(a)6wind.com> dev_forward_skb: do not scrub skb mark within the same name space Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com> x86/alternatives: Disable KASAN in apply_alternatives() Christophe Leroy <christophe.leroy(a)csgroup.eu> powerpc/64e: Fix wrong test in __ptep_test_and_clear_young() Krishna Kurapati <quic_kriskura(a)quicinc.com> usb: gadget: ncm: Handle decoding of multiple NTB's in unwrap call Piyush Mehta <piyush.mehta(a)amd.com> usb: gadget: udc-xilinx: replace memcpy with memcpy_toio Borislav Petkov (AMD) <bp(a)alien8.de> x86/cpu: Fix AMD erratum #1485 on Zen4-based CPUs Dmitry Torokhov <dmitry.torokhov(a)gmail.com> pinctrl: avoid unsafe code pattern in find_pinctrl() Michal Koutný <mkoutny(a)suse.com> cgroup: Remove duplicates in cgroup v1 tasks file Matthias Berndt <matthias_berndt(a)gmx.de> Input: xpad - add PXN V900 support Jeffery Miller <jefferymiller(a)google.com> Input: psmouse - fix fast_reconnect function for PS/2 mode Javier Carrasco <javier.carrasco.cruz(a)gmail.com> Input: powermate - fix use-after-free in powermate_config_complete Xiubo Li <xiubli(a)redhat.com> ceph: fix incorrect revoked caps assert in ceph_fill_file_size() Jorge Sanjuan Garcia <jorge.sanjuangarcia(a)duagon.com> mcb: remove is_added flag from mcb_device struct Alexander Zangerl <az(a)breathe-safe.com> iio: pressure: ms5611: ms5611_prom_is_valid false negative bug Phil Elwell <phil(a)raspberrypi.com> iio: pressure: bmp280: Fix NULL pointer exception Xingxing Luo <xingxing.luo(a)unisoc.com> usb: musb: Modify the "HWVers" register address Xingxing Luo <xingxing.luo(a)unisoc.com> usb: musb: Get the musb_qh poniter after musb_giveback Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> usb: dwc3: Soft reset phy on probe for host Javier Carrasco <javier.carrasco.cruz(a)gmail.com> net: usb: dm9601: fix uninitialized variable use in dm9601_mdio_read Wesley Cheng <quic_wcheng(a)quicinc.com> usb: xhci: xhci-ring: Use sysdev for mapping bounce buffer Amelie Delaunay <amelie.delaunay(a)foss.st.com> dmaengine: stm32-mdma: abort resume if no ongoing transfer Peter Zijlstra <peterz(a)infradead.org> sched,idle,rcu: Push rcu_idle deeper into the idle path Waiman Long <longman(a)redhat.com> workqueue: Override implicit ordered attribute in workqueue_apply_unbound_cpumask() Jeremy Cline <jeremy(a)jcline.org> nfc: nci: assert requested protocol is valid Eric Dumazet <edumazet(a)google.com> net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() Dan Carpenter <dan.carpenter(a)linaro.org> ixgbe: fix crash with empty VF macvlan list Konstantin Meskhidze <konstantin.meskhidze(a)huawei.com> drm/vmwgfx: fix typo of sizeof argument Roger Pau Monne <roger.pau(a)citrix.com> xen-netback: use default TX queue size for vifs Dinghao Liu <dinghao.liu(a)zju.edu.cn> ieee802154: ca8210: Fix a potential UAF in ca8210_probe Abhinav Kumar <quic_abhinavk(a)quicinc.com> drm/msm/dsi: skip the wait for video mode done if not applicable Martin Fuzzey <martin.fuzzey(a)flowbird.group> drm: etvnaviv: fix bad backport leading to warning Jordan Rife <jrife(a)google.com> net: prevent address rewrite in kernel_bind() Jan Kara <jack(a)suse.cz> quota: Fix slow quotaoff Hans de Goede <hdegoede(a)redhat.com> HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> platform/x86: hp-wmi:: Mark driver struct with __refdata to prevent section mismatch warning Artem Chernyshev <artem.chernyshev(a)red-soft.ru> RDMA/cxgb4: Check skb value for failure to allocate Jordan Rife <jrife(a)google.com> net: prevent rewrite of msg_name in sock_sendmsg() Randy Dunlap <rdunlap(a)infradead.org> net: fix kernel-doc warnings for socket.c Paolo Abeni <pabeni(a)redhat.com> net: use indirect calls helpers at the socket layer Paolo Abeni <pabeni(a)redhat.com> indirect call wrappers: helpers to speed-up indirect calls of builtin ------------- Diffstat: Makefile | 4 +- arch/arm/boot/dts/omap4-droid4-xt894.dts | 1 + arch/powerpc/include/asm/nohash/64/pgtable.h | 2 +- arch/s390/pci/pci_dma.c | 15 ++++- arch/x86/include/asm/msr-index.h | 4 ++ arch/x86/kernel/alternative.c | 13 +++++ arch/x86/kernel/cpu/amd.c | 8 +++ arch/x86/kvm/lapic.c | 8 ++- drivers/acpi/irq.c | 7 ++- drivers/ata/libata-eh.c | 2 +- drivers/base/regmap/regmap.c | 2 +- drivers/bluetooth/hci_vhci.c | 3 + drivers/cpuidle/cpuidle.c | 12 ++-- drivers/dma/stm32-mdma.c | 4 ++ drivers/gpio/gpio-timberdale.c | 5 +- drivers/gpio/gpio-vf610.c | 4 +- drivers/gpu/drm/drm_panel_orientation_quirks.c | 16 ++++++ drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c | 2 +- drivers/gpu/drm/msm/dsi/dsi_host.c | 12 ++++ drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 2 +- drivers/hid/hid-holtek-kbd.c | 4 ++ drivers/hid/hid-logitech-hidpp.c | 3 +- drivers/i2c/i2c-mux.c | 2 +- drivers/iio/pressure/bmp280-core.c | 2 +- drivers/iio/pressure/ms5611_core.c | 2 +- drivers/infiniband/hw/cxgb4/cm.c | 3 + drivers/input/joystick/xpad.c | 2 + drivers/input/misc/powermate.c | 1 + drivers/input/mouse/elantech.c | 1 + drivers/input/mouse/synaptics.c | 1 + drivers/mcb/mcb-core.c | 10 +--- drivers/mcb/mcb-parse.c | 2 - drivers/mmc/core/mmc.c | 2 +- drivers/mtd/nand/raw/qcom_nandc.c | 2 +- drivers/mtd/nand/spi/micron.c | 2 +- drivers/net/ethernet/intel/i40e/i40e_common.c | 4 +- drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c | 5 +- drivers/net/ethernet/marvell/sky2.h | 2 +- drivers/net/ieee802154/ca8210.c | 17 +----- drivers/net/usb/dm9601.c | 7 ++- drivers/net/usb/smsc95xx.c | 2 +- drivers/net/xen-netback/interface.c | 3 - drivers/phy/motorola/phy-mapphone-mdm6600.c | 1 + drivers/platform/x86/hp-wmi.c | 8 ++- drivers/usb/core/hub.c | 28 +++++++-- drivers/usb/core/hub.h | 2 +- drivers/usb/dwc3/core.c | 39 ++++++++++++- drivers/usb/gadget/function/f_ncm.c | 26 ++++++--- drivers/usb/gadget/udc/udc-xilinx.c | 20 ++++--- drivers/usb/host/xhci-ring.c | 4 +- drivers/usb/musb/musb_debugfs.c | 2 +- drivers/usb/musb/musb_host.c | 9 ++- drivers/usb/serial/option.c | 7 +++ fs/btrfs/extent-tree.c | 6 +- fs/btrfs/ioctl.c | 4 +- fs/btrfs/tree-log.c | 2 +- fs/ceph/inode.c | 4 +- fs/overlayfs/copy_up.c | 2 +- fs/quota/dquot.c | 66 ++++++++++++--------- include/linux/indirect_call_wrapper.h | 51 +++++++++++++++++ include/linux/mcb.h | 1 - include/linux/netdevice.h | 2 +- include/linux/perf_event.h | 1 + include/linux/quota.h | 4 +- include/linux/quotaops.h | 2 +- include/net/bluetooth/hci_core.h | 2 +- include/net/netns/xfrm.h | 1 + include/net/tcp.h | 3 + kernel/cgroup/cgroup-v1.c | 5 +- kernel/events/core.c | 39 +++++++++++-- kernel/sched/idle.c | 22 +++---- kernel/trace/trace_events.c | 1 + kernel/workqueue.c | 8 ++- net/bluetooth/hci_conn.c | 72 ++++++++++++++--------- net/bluetooth/hci_core.c | 8 ++- net/bluetooth/hci_event.c | 33 +++++++++-- net/bluetooth/hci_sock.c | 3 +- net/ceph/messenger.c | 79 +++++++++++++------------- net/core/pktgen.c | 14 ++--- net/ipv4/esp4.c | 4 +- net/ipv4/tcp_output.c | 25 ++++++-- net/ipv4/tcp_recovery.c | 2 +- net/ipv6/esp6.c | 4 +- net/ipv6/xfrm6_policy.c | 4 +- net/mac80211/tx.c | 3 +- net/netfilter/ipvs/ip_vs_sync.c | 4 +- net/netfilter/nft_payload.c | 2 +- net/netfilter/nft_set_rbtree.c | 2 + net/nfc/llcp_core.c | 30 ++++------ net/nfc/nci/core.c | 5 ++ net/nfc/nci/spi.c | 2 + net/rds/tcp_connect.c | 2 +- net/rds/tcp_listen.c | 2 +- net/rfkill/rfkill-gpio.c | 4 +- net/sched/sch_hfsc.c | 18 ++++-- net/socket.c | 77 ++++++++++++++++++------- net/wireless/nl80211.c | 2 +- net/xfrm/xfrm_interface_core.c | 22 ++++--- net/xfrm/xfrm_policy.c | 6 +- sound/soc/pxa/pxa-ssp.c | 2 +- 100 files changed, 688 insertions(+), 320 deletions(-)

2 years

7
105
0 0

[PATCH 4.14 00/66] 4.14.328-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.14.328 release. There are 66 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 25 Oct 2023 10:47:57 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.328-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.14.328-rc1 Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_event: Fix using memcmp when comparing keys Kees Cook <keescook(a)chromium.org> Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name Edward AD <twuufnxlz(a)gmail.com> Bluetooth: hci_sock: fix slab oob read in create_monitor_event Haibo Chen <haibo.chen(a)nxp.com> gpio: vf610: set value before the direction to avoid a glitch Niklas Schnelle <schnelle(a)linux.ibm.com> s390/pci: fix iommu bitmap allocation Peter Zijlstra <peterz(a)infradead.org> perf: Disallow mis-matched inherited group reads Puliang Lu <puliang.lu(a)fibocom.com> USB: serial: option: add Fibocom to DELL custom modem FM101R-GL Benoît Monin <benoit.monin(a)gmx.fr> USB: serial: option: add entry for Sierra EM9191 with new firmware Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit LE910C4-WWX 0x1035 composition Sunil V L <sunilvl(a)ventanamicro.com> ACPI: irq: Fix incorrect return value in acpi_register_gsi() Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> Revert "pinctrl: avoid unsafe code pattern in find_pinctrl()" Avri Altman <avri.altman(a)wdc.com> mmc: core: Capture correct oemid-bits for eMMC cards Kees Cook <keescook(a)chromium.org> sky2: Make sure there is at least one frag_addr available Benjamin Berg <benjamin.berg(a)intel.com> wifi: cfg80211: avoid leaking stack data into trace Wen Gong <quic_wgong(a)quicinc.com> wifi: mac80211: allow transmitting EAPOL frames with tainted key Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_core: Fix build warnings Ying Hsu <yinghsu(a)chromium.org> Bluetooth: Avoid redundant authentication Ma Ke <make_ruc2021(a)163.com> HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event Clément Léger <cleger(a)rivosinc.com> tracing: relax trace_event_eval_update() execution with cond_resched() Damien Le Moal <dlemoal(a)kernel.org> ata: libata-eh: Fix compilation warning in ata_eh_link_report() Chengfeng Ye <dg573847474(a)gmail.com> gpio: timberdale: Fix potential deadlock on &tgpio->lock Jeff Layton <jlayton(a)kernel.org> overlayfs: set ctime when setting mtime and atime Heiner Kallweit <hkallweit1(a)gmail.com> i2c: mux: Avoid potential false error message in i2c_mux_add_adapter Josef Bacik <josef(a)toxicpanda.com> btrfs: initialize start_slot in btrfs_log_prealloc_extents Tony Lindgren <tony(a)atomide.com> ARM: dts: ti: omap: Fix noisy serial with overrun-throttle-ms for mapphone Michal Schmidt <mschmidt(a)redhat.com> i40e: prevent crash on probe if hw registers have invalid values Dan Carpenter <dan.carpenter(a)linaro.org> net: usb: smsc95xx: Fix an error code in smsc95xx_reset() Josua Mayer <josua(a)solid-run.com> net: rfkill: gpio: prevent value glitch during probe Ma Ke <make_ruc2021(a)163.com> net: ipv6: fix return value check in esp_remove_trailer Ma Ke <make_ruc2021(a)163.com> net: ipv4: fix return value check in esp_remove_trailer Eric Dumazet <edumazet(a)google.com> xfrm: fix a data-race in xfrm_gen_index() Florian Westphal <fw(a)strlen.de> netfilter: nft_payload: fix wrong mac header matching Jim Mattson <jmattson(a)google.com> KVM: x86: Mask LVTPC when handling a PMI Johan Hovold <johan+linaro(a)kernel.org> regmap: fix NULL deref on lookup Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> nfc: nci: fix possible NULL pointer dereference in send_acknowledge() Arnd Bergmann <arnd(a)arndb.de> Bluetooth: avoid memcmp() out of bounds warning Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_event: Fix coding style Arkadiusz Bokowy <arkadiusz.bokowy(a)gmail.com> Bluetooth: vhci: Fix race when opening vhci device Ziyang Xuan <william.xuanziyang(a)huawei.com> Bluetooth: Fix a refcnt underflow problem for hci_conn Lee, Chun-Yi <jlee(a)suse.com> Bluetooth: Reject connection with the device which has same BD_ADDR Lee, Chun-Yi <jlee(a)suse.com> Bluetooth: hci_event: Ignore NULL link key Ricardo Cañuelo <ricardo.canuelo(a)collabora.com> usb: hub: Guard against accesses to uninitialized BOS descriptors Borislav Petkov (AMD) <bp(a)alien8.de> x86/cpu: Fix AMD erratum #1485 on Zen4-based CPUs Krishna Kurapati <quic_kriskura(a)quicinc.com> usb: gadget: ncm: Handle decoding of multiple NTB's in unwrap call Piyush Mehta <piyush.mehta(a)amd.com> usb: gadget: udc-xilinx: replace memcpy with memcpy_toio Dmitry Torokhov <dmitry.torokhov(a)gmail.com> pinctrl: avoid unsafe code pattern in find_pinctrl() Michal Koutný <mkoutny(a)suse.com> cgroup: Remove duplicates in cgroup v1 tasks file Matthias Berndt <matthias_berndt(a)gmx.de> Input: xpad - add PXN V900 support Javier Carrasco <javier.carrasco.cruz(a)gmail.com> Input: powermate - fix use-after-free in powermate_config_complete Xiubo Li <xiubli(a)redhat.com> ceph: fix incorrect revoked caps assert in ceph_fill_file_size() Jorge Sanjuan Garcia <jorge.sanjuangarcia(a)duagon.com> mcb: remove is_added flag from mcb_device struct Alexander Zangerl <az(a)breathe-safe.com> iio: pressure: ms5611: ms5611_prom_is_valid false negative bug Phil Elwell <phil(a)raspberrypi.com> iio: pressure: bmp280: Fix NULL pointer exception Xingxing Luo <xingxing.luo(a)unisoc.com> usb: musb: Modify the "HWVers" register address Xingxing Luo <xingxing.luo(a)unisoc.com> usb: musb: Get the musb_qh poniter after musb_giveback Javier Carrasco <javier.carrasco.cruz(a)gmail.com> net: usb: dm9601: fix uninitialized variable use in dm9601_mdio_read Wesley Cheng <quic_wcheng(a)quicinc.com> usb: xhci: xhci-ring: Use sysdev for mapping bounce buffer Waiman Long <longman(a)redhat.com> workqueue: Override implicit ordered attribute in workqueue_apply_unbound_cpumask() Jeremy Cline <jeremy(a)jcline.org> nfc: nci: assert requested protocol is valid Dan Carpenter <dan.carpenter(a)linaro.org> ixgbe: fix crash with empty VF macvlan list Konstantin Meskhidze <konstantin.meskhidze(a)huawei.com> drm/vmwgfx: fix typo of sizeof argument Dinghao Liu <dinghao.liu(a)zju.edu.cn> ieee802154: ca8210: Fix a potential UAF in ca8210_probe Martin Fuzzey <martin.fuzzey(a)flowbird.group> drm: etvnaviv: fix bad backport leading to warning Hans de Goede <hdegoede(a)redhat.com> HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> platform/x86: hp-wmi:: Mark driver struct with __refdata to prevent section mismatch warning Artem Chernyshev <artem.chernyshev(a)red-soft.ru> RDMA/cxgb4: Check skb value for failure to allocate ------------- Diffstat: Makefile | 4 +- arch/arm/boot/dts/omap4-droid4-xt894.dts | 1 + arch/s390/pci/pci_dma.c | 15 +++++- arch/x86/include/asm/msr-index.h | 4 ++ arch/x86/kernel/cpu/amd.c | 9 ++++ arch/x86/kvm/lapic.c | 8 ++- drivers/acpi/irq.c | 7 ++- drivers/ata/libata-eh.c | 2 +- drivers/base/regmap/regmap.c | 2 +- drivers/bluetooth/hci_vhci.c | 3 ++ drivers/gpio/gpio-timberdale.c | 5 +- drivers/gpio/gpio-vf610.c | 4 +- drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 2 +- drivers/hid/hid-holtek-kbd.c | 4 ++ drivers/hid/hid-logitech-hidpp.c | 3 +- drivers/i2c/i2c-mux.c | 2 +- drivers/iio/pressure/bmp280-core.c | 2 +- drivers/iio/pressure/ms5611_core.c | 2 +- drivers/infiniband/hw/cxgb4/cm.c | 3 ++ drivers/input/joystick/xpad.c | 2 + drivers/input/misc/powermate.c | 1 + drivers/mcb/mcb-core.c | 10 ++-- drivers/mcb/mcb-parse.c | 2 - drivers/mmc/core/mmc.c | 2 +- drivers/net/ethernet/intel/i40e/i40e_common.c | 4 +- drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c | 5 +- drivers/net/ethernet/marvell/sky2.h | 2 +- drivers/net/ieee802154/ca8210.c | 17 ++---- drivers/net/usb/dm9601.c | 7 ++- drivers/net/usb/smsc95xx.c | 2 +- drivers/platform/x86/hp-wmi.c | 8 ++- drivers/usb/core/hub.c | 28 ++++++++-- drivers/usb/core/hub.h | 2 +- drivers/usb/gadget/function/f_ncm.c | 26 +++++++--- drivers/usb/gadget/udc/udc-xilinx.c | 20 ++++--- drivers/usb/host/xhci-ring.c | 4 +- drivers/usb/musb/musb_debugfs.c | 2 +- drivers/usb/musb/musb_host.c | 9 +++- drivers/usb/serial/option.c | 7 +++ fs/btrfs/tree-log.c | 2 +- fs/ceph/inode.c | 4 +- fs/overlayfs/copy_up.c | 2 +- include/linux/mcb.h | 1 - include/linux/perf_event.h | 1 + include/net/bluetooth/hci_core.h | 2 +- include/net/netns/xfrm.h | 1 + kernel/cgroup/cgroup-v1.c | 5 +- kernel/events/core.c | 39 +++++++++++--- kernel/trace/trace_events.c | 1 + kernel/workqueue.c | 8 ++- net/bluetooth/hci_conn.c | 72 ++++++++++++++++---------- net/bluetooth/hci_core.c | 8 +-- net/bluetooth/hci_event.c | 33 +++++++++--- net/bluetooth/hci_sock.c | 3 +- net/ipv4/esp4.c | 4 +- net/ipv6/esp6.c | 4 +- net/mac80211/tx.c | 3 +- net/netfilter/nft_payload.c | 2 +- net/nfc/nci/core.c | 5 ++ net/nfc/nci/spi.c | 2 + net/rfkill/rfkill-gpio.c | 4 +- net/wireless/nl80211.c | 2 +- net/xfrm/xfrm_policy.c | 6 +-- 64 files changed, 316 insertions(+), 142 deletions(-)

2 years

5
71
0 0

stable/linux-4.19.y baseline: 107 runs, 4 regressions (v4.19.297)

by kernelci.org bot

stable/linux-4.19.y baseline: 107 runs, 4 regressions (v4.19.297) Regressions Summary ------------------- platform | arch | lab | compiler | defconfig | regressions ----------------------+-------+--------------+----------+--------------------+------------ at91sam9g20ek | arm | lab-broonie | gcc-10 | multi_v5_defconfig | 1 meson-gxbb-p200 | arm64 | lab-baylibre | gcc-10 | defconfig | 1 meson-gxl-s905d-p230 | arm64 | lab-baylibre | gcc-10 | defconfig | 1 meson-gxm-khadas-vim2 | arm64 | lab-baylibre | gcc-10 | defconfig | 1 Details: https://kernelci.org/test/job/stable/branch/linux-4.19.y/kernel/v4.19.297/p… Test: baseline Tree: stable Branch: linux-4.19.y Describe: v4.19.297 URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git SHA: 4a82dfcb8b4d07331d1db05a36f7d87013787e9e Test Regressions ---------------- platform | arch | lab | compiler | defconfig | regressions ----------------------+-------+--------------+----------+--------------------+------------ at91sam9g20ek | arm | lab-broonie | gcc-10 | multi_v5_defconfig | 1 Details: https://kernelci.org/test/plan/id/65392b6092ed3ade4aefcf0e Results: 42 PASS, 9 FAIL, 1 SKIP Full config: multi_v5_defconfig Compiler: gcc-10 Plain log: https://storage.kernelci.org//stable/linux-4.19.y/v4.19.297/arm/multi_v5_de… HTML log: https://storage.kernelci.org//stable/linux-4.19.y/v4.19.297/arm/multi_v5_de… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.bootrr.deferred-probe-empty: https://kernelci.org/test/case/id/65392b6092ed3ade4aefcf44 new failure (last pass: v4.19.296) 2023-10-25T14:50:34.361506 + set +x 2023-10-25T14:50:34.362068 <8><LAVA_SIGNAL_ENDRUN 0_dmesg 194139_1.5.2.4.1> 2023-10-25T14:50:34.474562 / # # 2023-10-25T14:50:34.577585 export SHELL=/bin/sh 2023-10-25T14:50:34.578476 # 2023-10-25T14:50:34.680456 / # export SHELL=/bin/sh. /lava-194139/environment 2023-10-25T14:50:34.681263 2023-10-25T14:50:34.783281 / # . /lava-194139/environment/lava-194139/bin/lava-test-runner /lava-194139/1 2023-10-25T14:50:34.784624 2023-10-25T14:50:34.788251 / # /lava-194139/bin/lava-test-runner /lava-194139/1 ... (12 line(s) more) platform | arch | lab | compiler | defconfig | regressions ----------------------+-------+--------------+----------+--------------------+------------ meson-gxbb-p200 | arm64 | lab-baylibre | gcc-10 | defconfig | 1 Details: https://kernelci.org/test/plan/id/65392abdf3dc9bc74eefcf71 Results: 5 PASS, 1 FAIL, 1 SKIP Full config: defconfig Compiler: gcc-10 Plain log: https://storage.kernelci.org//stable/linux-4.19.y/v4.19.297/arm64/defconfig… HTML log: https://storage.kernelci.org//stable/linux-4.19.y/v4.19.297/arm64/defconfig… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.dmesg.emerg: https://kernelci.org/test/case/id/65392abdf3dc9bc74eefcf74 new failure (last pass: v4.19.288) 1 lines 2023-10-25T14:48:15.013885 kern :emerg : Disabling IRQ #19 2023-10-25T14:48:15.014370 <8>[ 49.168281] <LAVA_SIGNAL_TESTCASE TEST_CASE_ID=emerg RESULT=fail UNITS=lines MEASUREMENT=1> 2023-10-25T14:48:15.014572 + set +<8>[ 49.171984] <LAVA_SIGNAL_ENDRUN 0_dmesg 3813706_1.5.2.4.1> 2023-10-25T14:48:15.014758 x 2023-10-25T14:48:15.015109 / # <4>[ 49.195436] ------------[ cut here ]------------ 2023-10-25T14:48:15.015282 <4>[ 49.195505] WARNING: CPU: 0 PID: 0 at drivers/mmc/host/meson-gx-mmc.c:1040 meson_mmc_irq+0x1c8/0x1dc platform | arch | lab | compiler | defconfig | regressions ----------------------+-------+--------------+----------+--------------------+------------ meson-gxl-s905d-p230 | arm64 | lab-baylibre | gcc-10 | defconfig | 1 Details: https://kernelci.org/test/plan/id/65392b02db8ca7add7efcf0b Results: 5 PASS, 1 FAIL, 1 SKIP Full config: defconfig Compiler: gcc-10 Plain log: https://storage.kernelci.org//stable/linux-4.19.y/v4.19.297/arm64/defconfig… HTML log: https://storage.kernelci.org//stable/linux-4.19.y/v4.19.297/arm64/defconfig… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.dmesg.emerg: https://kernelci.org/test/case/id/65392b02db8ca7add7efcf0e new failure (last pass: v4.19.292) 3 lines 2023-10-25T14:49:19.146912 kern :emerg : Disabling IRQ #19 2023-10-25T14:49:19.152728 kern :emerg : Disabling IRQ #20 2023-10-25T14:49:19.166863 kern :emerg : Disabling IRQ <8>[ 49.404913] <LAVA_SIGNAL_TESTCASE TEST_CASE_ID=emerg RESULT=fail UNITS=lines MEASUREMENT=3> 2023-10-25T14:49:19.167591 #18 platform | arch | lab | compiler | defconfig | regressions ----------------------+-------+--------------+----------+--------------------+------------ meson-gxm-khadas-vim2 | arm64 | lab-baylibre | gcc-10 | defconfig | 1 Details: https://kernelci.org/test/plan/id/65392aa8f3dc9bc74eefcf02 Results: 5 PASS, 1 FAIL, 1 SKIP Full config: defconfig Compiler: gcc-10 Plain log: https://storage.kernelci.org//stable/linux-4.19.y/v4.19.297/arm64/defconfig… HTML log: https://storage.kernelci.org//stable/linux-4.19.y/v4.19.297/arm64/defconfig… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.dmesg.emerg: https://kernelci.org/test/case/id/65392aa8f3dc9bc74eefcf05 new failure (last pass: v4.19.284) 2 lines 2023-10-25T14:47:55.117144 kern :emerg : Disabling IRQ #24 2023-10-25T14:47:55.117341 kern :emerg : Disabling IRQ #22 2023-10-25T14:47:55.117728 <8>[ 48.322195] <LAVA_SIGNAL_TESTCASE TEST_CASE_ID=emerg RESULT=fail UNITS=lines MEASUREMENT=2> 2023-10-25T14:47:55.117917 + set +x 2023-10-25T14:47:55.118096 <8>[ 48.326390] <LAVA_SIGNAL_ENDRUN 0_dmesg 3813708_1.5.2.4.1>

2 years

1
0
0 0

Re: [PATCH] drm: panel: simple: specify bpc for powertip_ph800480t013_idf02

by Marco Felsch

+Cc: stable <stable(a)kernel.org> The commit misses the Fixes tag. On Mon, Jul 31, 2023 at 02:47:47PM +0200, Neil Armstrong wrote: > On 27/07/2023 19:24, Dmitry Baryshkov wrote: > > Specify bpc value for the powertip_ph800480t013_idf02 panel to stop drm > > code from complaining about unexpected bpc value (0). > > > > Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> > > --- > > drivers/gpu/drm/panel/panel-simple.c | 1 + > > 1 file changed, 1 insertion(+) > > > > diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c > > index a247a0e7c799..4c4c24ab4d12 100644 > > --- a/drivers/gpu/drm/panel/panel-simple.c > > +++ b/drivers/gpu/drm/panel/panel-simple.c > > @@ -3207,6 +3207,7 @@ static const struct drm_display_mode powertip_ph800480t013_idf02_mode = { > > static const struct panel_desc powertip_ph800480t013_idf02 = { > > .modes = &powertip_ph800480t013_idf02_mode, > > .num_modes = 1, > > + .bpc = 8, > > .size = { > > .width = 152, > > .height = 91, > > Reviewed-by: Neil Armstrong <neil.armstrong(a)linaro.org>

2 years

1
0
0 0

[PATCH 5.15 000/135] 5.15.137-rc2 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.15.137 release. There are 135 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 26 Oct 2023 08:32:55 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.137-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.15.137-rc2 Zhang Changzhong <zhangchangzhong(a)huawei.com> xfrm6: fix inet6_dev refcount underflow problem Kees Cook <keescook(a)chromium.org> Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name Edward AD <twuufnxlz(a)gmail.com> Bluetooth: hci_sock: fix slab oob read in create_monitor_event Tony Lindgren <tony(a)atomide.com> phy: mapphone-mdm6600: Fix pinctrl_pm handling for sleep pins Tony Lindgren <tony(a)atomide.com> phy: mapphone-mdm6600: Fix runtime PM for remove Tony Lindgren <tony(a)atomide.com> phy: mapphone-mdm6600: Fix runtime disable on probe Geert Uytterhoeven <geert(a)linux-m68k.org> serial: 8250: omap: Move uart_write() inside PM section Dan Carpenter <dan.carpenter(a)linaro.org> ASoC: pxa: fix a memory leak in probe() Haibo Chen <haibo.chen(a)nxp.com> gpio: vf610: set value before the direction to avoid a glitch Hans de Goede <hdegoede(a)redhat.com> platform/x86: asus-wmi: Map 0x2a code, Ignore 0x2b and 0x2c events Hans de Goede <hdegoede(a)redhat.com> platform/x86: asus-wmi: Change ASUS_WMI_BRN_DOWN code from 0x20 to 0x2e Armin Wolf <W_Armin(a)gmx.de> platform/surface: platform_profile: Propagate error if profile registration fails Dinghao Liu <dinghao.liu(a)zju.edu.cn> s390/cio: fix a memleak in css_alloc_subchannel Francis Laniel <flaniel(a)linux.microsoft.com> selftests/ftrace: Add new test case which checks non unique symbol Niklas Schnelle <schnelle(a)linux.ibm.com> s390/pci: fix iommu bitmap allocation Peter Zijlstra <peterz(a)infradead.org> perf: Disallow mis-matched inherited group reads Puliang Lu <puliang.lu(a)fibocom.com> USB: serial: option: add Fibocom to DELL custom modem FM101R-GL Benoît Monin <benoit.monin(a)gmx.fr> USB: serial: option: add entry for Sierra EM9191 with new firmware Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit LE910C4-WWX 0x1035 composition Maurizio Lombardi <mlombard(a)redhat.com> nvme-rdma: do not try to stop unallocated queues Keith Busch <kbusch(a)kernel.org> nvme-pci: add BOGUS_NID for Intel 0a54 device Sunil V L <sunilvl(a)ventanamicro.com> ACPI: irq: Fix incorrect return value in acpi_register_gsi() Olga Kornievskaia <kolga(a)netapp.com> NFSv4.1: fixup use EXCHGID4_FLAG_USE_PNFS_DS for DS server Trond Myklebust <trond.myklebust(a)hammerspace.com> pNFS: Fix a hang in nfs4_evict_inode() Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> Revert "pinctrl: avoid unsafe code pattern in find_pinctrl()" Avri Altman <avri.altman(a)wdc.com> mmc: core: Capture correct oemid-bits for eMMC cards Haibo Chen <haibo.chen(a)nxp.com> mmc: core: sdio: hold retuning if sdio in 1-bit mode Pablo Sun <pablo.sun(a)mediatek.com> mmc: mtk-sd: Use readl_poll_timeout_atomic in msdc_reset_hw Geert Uytterhoeven <geert+renesas(a)glider.be> mtd: physmap-core: Restore map_rom fallback Martin Kurbanov <mmkurbanov(a)sberdevices.ru> mtd: spinand: micron: correct bitmask for ecc status Miquel Raynal <miquel.raynal(a)bootlin.com> mtd: rawnand: arasan: Ensure program page operations are successful Miquel Raynal <miquel.raynal(a)bootlin.com> mtd: rawnand: marvell: Ensure program page operations are successful Miquel Raynal <miquel.raynal(a)bootlin.com> mtd: rawnand: pl353: Ensure program page operations are successful Bibek Kumar Patro <quic_bibekkum(a)quicinc.com> mtd: rawnand: qcom: Unmap the right resource upon probe failure Jakub Kicinski <kuba(a)kernel.org> net: fix ifname in netlink ntf during netns move Wolfram Sang <wsa+renesas(a)sang-engineering.com> net: move from strlcpy with unused retval to strscpy Antoine Tenart <atenart(a)kernel.org> net: introduce a function to check if a netdev name is in use Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_event: Fix using memcmp when comparing keys Maher Sanalla <msanalla(a)nvidia.com> net/mlx5: Handle fw tracer change ownership event based on MTRC Renan Guilherme Lebre Ramos <japareaggae(a)gmail.com> platform/x86: touchscreen_dmi: Add info for the Positivo C4128B Rahul Rameshbabu <sergeantsagara(a)protonmail.com> HID: multitouch: Add required quirk for Synaptics 0xcd7e device Filipe Manana <fdmanana(a)suse.com> btrfs: error out when reallocating block for defrag using a stale transaction Filipe Manana <fdmanana(a)suse.com> btrfs: error when COWing block from a root that is being deleted Filipe Manana <fdmanana(a)suse.com> btrfs: error out when COWing block using a stale transaction Josef Bacik <josef(a)toxicpanda.com> btrfs: fix some -Wmaybe-uninitialized warnings in ioctl.c Kai Uwe Broulik <foss-linux(a)broulik.de> drm: panel-orientation-quirks: Add quirk for One Mix 2S Hangbin Liu <liuhangbin(a)gmail.com> ipv4/fib: send notify when delete source address routes Kees Cook <keescook(a)chromium.org> sky2: Make sure there is at least one frag_addr available Michał Mirosław <mirq-linux(a)rere.qmqm.pl> regulator/core: Revert "fix kobject release warning and memory leak in regulator_register()" Benjamin Berg <benjamin.berg(a)intel.com> wifi: cfg80211: avoid leaking stack data into trace Wen Gong <quic_wgong(a)quicinc.com> wifi: mac80211: allow transmitting EAPOL frames with tainted key Ilan Peer <ilan.peer(a)intel.com> wifi: cfg80211: Fix 6GHz scan configuration Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_core: Fix build warnings Ying Hsu <yinghsu(a)chromium.org> Bluetooth: Avoid redundant authentication Rocky Liao <quic_rjliao(a)quicinc.com> Bluetooth: btusb: add shutdown function for QCA6174 Ma Ke <make_ruc2021(a)163.com> HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event Ben Greear <greearb(a)candelatech.com> wifi: iwlwifi: Ensure ack flag is properly cleared. Gustavo A. R. Silva <gustavoars(a)kernel.org> wifi: mwifiex: Sanity check tlv_len and tlv_bitmap_len Clément Léger <cleger(a)rivosinc.com> tracing: relax trace_event_eval_update() execution with cond_resched() Damien Le Moal <dlemoal(a)kernel.org> ata: libata-eh: Fix compilation warning in ata_eh_link_report() Damien Le Moal <dlemoal(a)kernel.org> ata: libata-core: Fix compilation warning in ata_dev_config_ncq() Chengfeng Ye <dg573847474(a)gmail.com> gpio: timberdale: Fix potential deadlock on &tgpio->lock Jeff Layton <jlayton(a)kernel.org> overlayfs: set ctime when setting mtime and atime Heiner Kallweit <hkallweit1(a)gmail.com> i2c: mux: Avoid potential false error message in i2c_mux_add_adapter Josef Bacik <josef(a)toxicpanda.com> btrfs: initialize start_slot in btrfs_log_prealloc_extents Filipe Manana <fdmanana(a)suse.com> btrfs: return -EUCLEAN for delayed tree ref with a ref count not equals to 1 Chunhai Guo <guochunhai(a)vivo.com> fs-writeback: do not requeue a clean inode having skipped pages Tony Lindgren <tony(a)atomide.com> ARM: dts: ti: omap: Fix noisy serial with overrun-throttle-ms for mapphone Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: not allow to open file if delelete on close bit is set Yanguo Li <yanguo.li(a)corigine.com> nfp: flower: avoid rmmod nfp crash issues Jeremy Kerr <jk(a)codeconstruct.com.au> mctp: perform route lookups under a RCU read-side lock Jeremy Kerr <jk(a)codeconstruct.com.au> mctp: Allow local delivery to the null EID Michael Ellerman <mpe(a)ellerman.id.au> powerpc/47x: Fix 47x syscall return crash Christophe Leroy <christophe.leroy(a)csgroup.eu> powerpc/32s: Do kuep_lock() and kuep_unlock() in assembly Christophe Leroy <christophe.leroy(a)csgroup.eu> powerpc/32s: Remove capability to disable KUEP at boottime Simon Ser <contact(a)emersion.fr> drm/atomic-helper: relax unregistered connector check JP Kobryn <inwardvessel(a)gmail.com> perf/x86/lbr: Filter vsyscall addresses Sandipan Das <sandipan.das(a)amd.com> perf/x86: Move branch classifier Anshuman Khandual <anshuman.khandual(a)arm.com> perf: Add irq and exception return branch types Alisa-Dariana Roman <alisa.roman(a)analog.com> iio: adc: ad7192: Correct reference voltage Tzung-Bi Shih <tzungbi(a)kernel.org> iio: cros_ec: fix an use-after-free in cros_ec_sensors_push_data() Nuno Sá <nuno.sa(a)analog.com> iio: core: introduce iio_device_{claim|release}_buffer_mode() APIs Miquel Raynal <miquel.raynal(a)bootlin.com> iio: core: Hide read accesses to iio_dev->currentmode Miquel Raynal <miquel.raynal(a)bootlin.com> iio: Un-inline iio_buffer_enabled() Tony Lindgren <tony(a)atomide.com> serial: 8250_omap: Fix errors with no_console_suspend Tony Lindgren <tony(a)atomide.com> serial: 8250: omap: Fix imprecise external abort for omap_8250_pm() Juntong Deng <juntong.deng(a)outlook.com> selftests/mm: fix awk usage in charge_reserved_hugetlb.sh and hugetlb_reparenting_test.sh that may cause error Gavrilov Ilia <Ilia.Gavrilov(a)infotecs.ru> net: pktgen: Fix interface flags printing Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: revert do not remove elements if set backend implements .abort Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: do not remove elements if set backend implements .abort Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nft_set_rbtree: .deactivate fails if element has expired Geert Uytterhoeven <geert+renesas(a)glider.be> neighbor: tracing: Move pin6 inside CONFIG_IPV6=y section Pedro Tammela <pctammela(a)mojatatu.com> net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve Jiri Wiesner <jwiesner(a)suse.de> bonding: Return pointer to data after pull on skb Jinjie Ruan <ruanjinjie(a)huawei.com> net: dsa: bcm_sf2: Fix possible memory leak in bcm_sf2_mdio_register() Michal Schmidt <mschmidt(a)redhat.com> i40e: prevent crash on probe if hw registers have invalid values Dan Carpenter <dan.carpenter(a)linaro.org> net: usb: smsc95xx: Fix an error code in smsc95xx_reset() Eric Dumazet <edumazet(a)google.com> ipv4: fib: annotate races around nh->nh_saddr_genid and nh->nh_saddr Eric Dumazet <edumazet(a)google.com> tun: prevent negative ifindex Eric Dumazet <edumazet(a)google.com> tcp: tsq: relax tcp_small_queue_check() when rtx queue contains a single skb Neal Cardwell <ncardwell(a)google.com> tcp: fix excessive TLP and RACK timeouts from HZ rounding Josua Mayer <josua(a)solid-run.com> net: rfkill: gpio: prevent value glitch during probe Ma Ke <make_ruc2021(a)163.com> net: ipv6: fix return value check in esp_remove_trailer Ma Ke <make_ruc2021(a)163.com> net: ipv4: fix return value check in esp_remove_trailer Eric Dumazet <edumazet(a)google.com> xfrm: interface: use DEV_STATS_INC() Eric Dumazet <edumazet(a)google.com> xfrm: fix a data-race in xfrm_gen_index() Manish Chopra <manishc(a)marvell.com> qed: fix LL2 RX buffer allocation Johan Hovold <johan+linaro(a)kernel.org> ASoC: codecs: wcd938x: fix unbind tear down order Johan Hovold <johan+linaro(a)kernel.org> ASoC: codecs: wcd938x: drop bogus bind error handling Johan Hovold <johan+linaro(a)kernel.org> ASoC: codecs: wcd938x-sdw: fix runtime PM imbalance on probe errors Johan Hovold <johan+linaro(a)kernel.org> ASoC: codecs: wcd938x-sdw: fix use after free on driver unbind Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915: Retry gtt fault when out of fence registers Sagi Grimberg <sagi(a)grimberg.me> nvmet-tcp: Fix a possible UAF in queue intialization setup Florian Westphal <fw(a)strlen.de> netfilter: nft_payload: fix wrong mac header matching Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> fs/ntfs3: fix deadlock in mark_as_free_ex Zeng Heng <zengheng4(a)huawei.com> fs/ntfs3: fix panic about slab-out-of-bounds caused by ntfs_list_ea() Ziqi Zhao <astrajoan(a)yahoo.com> fs/ntfs3: Fix possible null-pointer dereference in hdr_find_e() Paolo Abeni <pabeni(a)redhat.com> tcp: check mptcp-level constraints for backlog coalescing Joerg Roedel <jroedel(a)suse.de> x86/sev: Check for user-space IOIO pointing to kernel space Joerg Roedel <jroedel(a)suse.de> x86/sev: Check IOBM for IOIO exceptions from user-space Borislav Petkov (AMD) <bp(a)alien8.de> x86/sev: Disable MMIO emulation from user mode Jim Mattson <jmattson(a)google.com> KVM: x86: Mask LVTPC when handling a PMI Johan Hovold <johan+linaro(a)kernel.org> regmap: fix NULL deref on lookup Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> nfc: nci: fix possible NULL pointer dereference in send_acknowledge() Jesse Brandeburg <jesse.brandeburg(a)intel.com> ice: reset first in crash dump kernels Jesse Brandeburg <jesse.brandeburg(a)intel.com> ice: fix over-shifted variable Arnd Bergmann <arnd(a)arndb.de> Bluetooth: avoid memcmp() out of bounds warning Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_event: Fix coding style Arkadiusz Bokowy <arkadiusz.bokowy(a)gmail.com> Bluetooth: vhci: Fix race when opening vhci device Ziyang Xuan <william.xuanziyang(a)huawei.com> Bluetooth: Fix a refcnt underflow problem for hci_conn Lee, Chun-Yi <jlee(a)suse.com> Bluetooth: Reject connection with the device which has same BD_ADDR Lee, Chun-Yi <jlee(a)suse.com> Bluetooth: hci_event: Ignore NULL link key Darrick J. Wong <djwong(a)kernel.org> xfs: don't expose internal symlink metadata buffers to the vfs Bagas Sanjaya <bagasdotme(a)gmail.com> Documentation: sysctl: align cells in second content column Hyeonggon Yoo <42.hyeyoo(a)gmail.com> lib/Kconfig.debug: do not enable DEBUG_PREEMPT by default ------------- Diffstat: Documentation/admin-guide/sysctl/net.rst | 18 +- Makefile | 4 +- arch/arm/boot/dts/motorola-mapphone-common.dtsi | 1 + arch/powerpc/include/asm/book3s/32/kup.h | 37 +-- arch/powerpc/include/asm/book3s/32/mmu-hash.h | 77 +++++- arch/powerpc/include/asm/interrupt.h | 6 +- arch/powerpc/include/asm/kup.h | 5 - arch/powerpc/kernel/entry_32.S | 39 ++- arch/powerpc/kernel/head_32.h | 6 + arch/powerpc/kernel/head_book3s_32.S | 4 + arch/powerpc/kernel/interrupt.c | 3 - arch/powerpc/mm/book3s32/kuep.c | 10 +- arch/s390/pci/pci_dma.c | 15 +- arch/x86/boot/compressed/sev.c | 10 + arch/x86/events/Makefile | 2 +- arch/x86/events/intel/lbr.c | 273 --------------------- arch/x86/events/perf_event.h | 62 +++++ arch/x86/events/utils.c | 217 ++++++++++++++++ arch/x86/kernel/sev-shared.c | 53 +++- arch/x86/kernel/sev.c | 30 +++ arch/x86/kvm/lapic.c | 8 +- drivers/acpi/irq.c | 7 +- drivers/ata/libata-core.c | 2 +- drivers/ata/libata-eh.c | 2 +- drivers/base/regmap/regmap.c | 2 +- drivers/bluetooth/btusb.c | 1 + drivers/bluetooth/hci_vhci.c | 3 + drivers/gpio/gpio-timberdale.c | 5 +- drivers/gpio/gpio-vf610.c | 4 +- drivers/gpu/drm/drm_atomic_helper.c | 17 +- drivers/gpu/drm/drm_panel_orientation_quirks.c | 16 ++ drivers/gpu/drm/i915/gem/i915_gem_mman.c | 1 + drivers/hid/hid-holtek-kbd.c | 4 + drivers/hid/hid-multitouch.c | 4 + drivers/i2c/i2c-mux.c | 2 +- drivers/iio/accel/bmc150-accel-core.c | 4 +- drivers/iio/adc/ad7192.c | 29 ++- drivers/iio/adc/at91-sama5d2_adc.c | 4 +- .../common/cros_ec_sensors/cros_ec_sensors_core.c | 6 +- drivers/iio/industrialio-core.c | 61 +++++ drivers/mmc/core/mmc.c | 2 +- drivers/mmc/core/sdio.c | 8 +- drivers/mmc/host/mtk-sd.c | 6 +- drivers/mtd/maps/physmap-core.c | 11 + drivers/mtd/nand/raw/arasan-nand-controller.c | 16 +- drivers/mtd/nand/raw/marvell_nand.c | 23 +- drivers/mtd/nand/raw/pl35x-nand-controller.c | 9 + drivers/mtd/nand/raw/qcom_nandc.c | 2 +- drivers/mtd/nand/spi/micron.c | 2 +- drivers/net/bonding/bond_main.c | 2 +- drivers/net/dsa/bcm_sf2.c | 24 +- drivers/net/ethernet/intel/i40e/i40e_common.c | 4 +- drivers/net/ethernet/intel/ice/ice_lib.c | 3 +- drivers/net/ethernet/intel/ice/ice_main.c | 15 ++ drivers/net/ethernet/marvell/sky2.h | 2 +- .../ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 2 +- drivers/net/ethernet/netronome/nfp/flower/cmsg.c | 10 +- .../net/ethernet/netronome/nfp/flower/conntrack.c | 19 +- drivers/net/ethernet/netronome/nfp/flower/main.h | 2 + .../net/ethernet/netronome/nfp/flower/metadata.c | 2 + .../net/ethernet/netronome/nfp/flower/offload.c | 24 +- .../net/ethernet/netronome/nfp/flower/qos_conf.c | 20 +- drivers/net/ethernet/qlogic/qed/qed_ll2.c | 7 +- drivers/net/tun.c | 7 +- drivers/net/usb/smsc95xx.c | 2 +- drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 3 + .../net/wireless/marvell/mwifiex/11n_rxreorder.c | 16 ++ drivers/nvme/host/pci.c | 3 +- drivers/nvme/host/rdma.c | 3 + drivers/nvme/target/tcp.c | 7 +- drivers/phy/motorola/phy-mapphone-mdm6600.c | 38 ++- drivers/pinctrl/core.c | 16 +- .../platform/surface/surface_platform_profile.c | 3 +- drivers/platform/x86/asus-nb-wmi.c | 3 + drivers/platform/x86/asus-wmi.h | 2 +- drivers/platform/x86/touchscreen_dmi.c | 23 ++ drivers/regulator/core.c | 6 +- drivers/s390/cio/css.c | 6 +- drivers/tty/serial/8250/8250_omap.c | 93 +++---- drivers/usb/serial/option.c | 7 + fs/btrfs/ctree.c | 52 +++- fs/btrfs/extent-tree.c | 6 +- fs/btrfs/ioctl.c | 4 +- fs/btrfs/tree-log.c | 2 +- fs/fs-writeback.c | 11 +- fs/ksmbd/vfs_cache.c | 4 +- fs/nfs/nfs4proc.c | 2 - fs/nfs/pnfs.c | 33 ++- fs/ntfs3/fsntfs.c | 6 +- fs/ntfs3/index.c | 3 + fs/ntfs3/xattr.c | 7 +- fs/overlayfs/copy_up.c | 2 +- fs/xfs/xfs_iops.c | 34 +-- fs/xfs/xfs_symlink.c | 29 ++- include/linux/iio/iio.h | 14 +- include/linux/netdevice.h | 1 + include/linux/perf_event.h | 1 + include/net/bluetooth/hci_core.h | 2 +- include/net/bluetooth/hci_mon.h | 2 +- include/net/ip_fib.h | 1 + include/net/netns/xfrm.h | 1 + include/net/tcp.h | 3 + include/trace/events/neigh.h | 4 +- include/uapi/linux/perf_event.h | 2 + kernel/events/core.c | 39 ++- kernel/trace/trace_events.c | 1 + lib/Kconfig.debug | 5 +- net/bluetooth/hci_conn.c | 72 +++--- net/bluetooth/hci_core.c | 8 +- net/bluetooth/hci_event.c | 33 ++- net/bluetooth/hci_sock.c | 3 +- net/core/dev.c | 58 +++-- net/core/drop_monitor.c | 2 +- net/core/netpoll.c | 4 +- net/core/pktgen.c | 14 +- net/ipv4/esp4.c | 4 +- net/ipv4/fib_semantics.c | 15 +- net/ipv4/fib_trie.c | 4 + net/ipv4/tcp_ipv4.c | 1 + net/ipv4/tcp_output.c | 25 +- net/ipv4/tcp_recovery.c | 2 +- net/ipv6/esp6.c | 4 +- net/ipv6/xfrm6_policy.c | 4 +- net/mac80211/tx.c | 3 +- net/mctp/route.c | 33 +++ net/netfilter/nft_payload.c | 2 +- net/netfilter/nft_set_rbtree.c | 2 + net/nfc/nci/spi.c | 2 + net/rfkill/rfkill-gpio.c | 4 +- net/sched/sch_hfsc.c | 18 +- net/wireless/nl80211.c | 2 +- net/wireless/scan.c | 4 + net/xfrm/xfrm_interface_core.c | 22 +- net/xfrm/xfrm_policy.c | 6 +- sound/soc/codecs/wcd938x-sdw.c | 27 +- sound/soc/codecs/wcd938x.c | 6 +- sound/soc/pxa/pxa-ssp.c | 2 +- tools/include/uapi/linux/perf_event.h | 2 + tools/perf/util/branch.c | 4 +- .../ftrace/test.d/kprobe/kprobe_non_uniq_symbol.tc | 13 + .../selftests/vm/charge_reserved_hugetlb.sh | 4 +- .../selftests/vm/hugetlb_reparenting_test.sh | 4 +- 142 files changed, 1444 insertions(+), 747 deletions(-)

2 years

10
9
0 0

[PATCH 5.4 000/120] 5.4.259-rc2 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.4.259 release. There are 120 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 26 Oct 2023 08:32:40 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.259-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.4.259-rc2 Zhang Changzhong <zhangchangzhong(a)huawei.com> xfrm6: fix inet6_dev refcount underflow problem Kees Cook <keescook(a)chromium.org> Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name Edward AD <twuufnxlz(a)gmail.com> Bluetooth: hci_sock: fix slab oob read in create_monitor_event Tony Lindgren <tony(a)atomide.com> phy: mapphone-mdm6600: Fix pinctrl_pm handling for sleep pins Tony Lindgren <tony(a)atomide.com> phy: mapphone-mdm6600: Fix runtime PM for remove Tony Lindgren <tony(a)atomide.com> phy: mapphone-mdm6600: Fix runtime disable on probe Dan Carpenter <dan.carpenter(a)linaro.org> ASoC: pxa: fix a memory leak in probe() Haibo Chen <haibo.chen(a)nxp.com> gpio: vf610: set value before the direction to avoid a glitch Niklas Schnelle <schnelle(a)linux.ibm.com> s390/pci: fix iommu bitmap allocation Peter Zijlstra <peterz(a)infradead.org> perf: Disallow mis-matched inherited group reads Puliang Lu <puliang.lu(a)fibocom.com> USB: serial: option: add Fibocom to DELL custom modem FM101R-GL Benoît Monin <benoit.monin(a)gmx.fr> USB: serial: option: add entry for Sierra EM9191 with new firmware Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit LE910C4-WWX 0x1035 composition Sunil V L <sunilvl(a)ventanamicro.com> ACPI: irq: Fix incorrect return value in acpi_register_gsi() Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> Revert "pinctrl: avoid unsafe code pattern in find_pinctrl()" Avri Altman <avri.altman(a)wdc.com> mmc: core: Capture correct oemid-bits for eMMC cards Haibo Chen <haibo.chen(a)nxp.com> mmc: core: sdio: hold retuning if sdio in 1-bit mode Geert Uytterhoeven <geert+renesas(a)glider.be> mtd: physmap-core: Restore map_rom fallback Martin Kurbanov <mmkurbanov(a)sberdevices.ru> mtd: spinand: micron: correct bitmask for ecc status Bibek Kumar Patro <quic_bibekkum(a)quicinc.com> mtd: rawnand: qcom: Unmap the right resource upon probe failure Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_event: Fix using memcmp when comparing keys Rahul Rameshbabu <sergeantsagara(a)protonmail.com> HID: multitouch: Add required quirk for Synaptics 0xcd7e device Josef Bacik <josef(a)toxicpanda.com> btrfs: fix some -Wmaybe-uninitialized warnings in ioctl.c Kai Uwe Broulik <foss-linux(a)broulik.de> drm: panel-orientation-quirks: Add quirk for One Mix 2S Kees Cook <keescook(a)chromium.org> sky2: Make sure there is at least one frag_addr available Michał Mirosław <mirq-linux(a)rere.qmqm.pl> regulator/core: Revert "fix kobject release warning and memory leak in regulator_register()" Benjamin Berg <benjamin.berg(a)intel.com> wifi: cfg80211: avoid leaking stack data into trace Wen Gong <quic_wgong(a)quicinc.com> wifi: mac80211: allow transmitting EAPOL frames with tainted key Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_core: Fix build warnings Ying Hsu <yinghsu(a)chromium.org> Bluetooth: Avoid redundant authentication Ma Ke <make_ruc2021(a)163.com> HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event Clément Léger <cleger(a)rivosinc.com> tracing: relax trace_event_eval_update() execution with cond_resched() Damien Le Moal <dlemoal(a)kernel.org> ata: libata-eh: Fix compilation warning in ata_eh_link_report() Chengfeng Ye <dg573847474(a)gmail.com> gpio: timberdale: Fix potential deadlock on &tgpio->lock Jeff Layton <jlayton(a)kernel.org> overlayfs: set ctime when setting mtime and atime Heiner Kallweit <hkallweit1(a)gmail.com> i2c: mux: Avoid potential false error message in i2c_mux_add_adapter Josef Bacik <josef(a)toxicpanda.com> btrfs: initialize start_slot in btrfs_log_prealloc_extents Filipe Manana <fdmanana(a)suse.com> btrfs: return -EUCLEAN for delayed tree ref with a ref count not equals to 1 Tony Lindgren <tony(a)atomide.com> ARM: dts: ti: omap: Fix noisy serial with overrun-throttle-ms for mapphone Hans de Goede <hdegoede(a)redhat.com> ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA Paul Menzel <pmenzel(a)molgen.mpg.de> ACPI: resource: Skip IRQ override on ASUS ExpertBook B1502CBA Tamim Khan <tamim(a)fusetak.com> ACPI: resource: Skip IRQ override on Asus Expertbook B2402CBA Hans de Goede <hdegoede(a)redhat.com> ACPI: resource: Add Asus ExpertBook B2502 to Asus quirks Tamim Khan <tamim(a)fusetak.com> ACPI: resource: Skip IRQ override on Asus Vivobook S5602ZA Kellen Renshaw <kellen.renshaw(a)canonical.com> ACPI: resource: Add ASUS model S5402ZA to quirks Tamim Khan <tamim(a)fusetak.com> ACPI: resource: Skip IRQ override on Asus Vivobook K3402ZA/K3502ZA Hui Wang <hui.wang(a)canonical.com> ACPI: resources: Add DMI-based legacy IRQ override quirk John Garry <john.garry(a)huawei.com> ACPI: Drop acpi_dev_irqresource_disabled() John Garry <john.garry(a)huawei.com> resource: Add irqresource_disabled() Gavrilov Ilia <Ilia.Gavrilov(a)infotecs.ru> net: pktgen: Fix interface flags printing Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nft_set_rbtree: .deactivate fails if element has expired Geert Uytterhoeven <geert+renesas(a)glider.be> neighbor: tracing: Move pin6 inside CONFIG_IPV6=y section Pedro Tammela <pctammela(a)mojatatu.com> net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve Michal Schmidt <mschmidt(a)redhat.com> i40e: prevent crash on probe if hw registers have invalid values Dan Carpenter <dan.carpenter(a)linaro.org> net: usb: smsc95xx: Fix an error code in smsc95xx_reset() Eric Dumazet <edumazet(a)google.com> ipv4: fib: annotate races around nh->nh_saddr_genid and nh->nh_saddr Eric Dumazet <edumazet(a)google.com> tun: prevent negative ifindex Eric Dumazet <edumazet(a)google.com> tcp: tsq: relax tcp_small_queue_check() when rtx queue contains a single skb Neal Cardwell <ncardwell(a)google.com> tcp: fix excessive TLP and RACK timeouts from HZ rounding Josua Mayer <josua(a)solid-run.com> net: rfkill: gpio: prevent value glitch during probe Ma Ke <make_ruc2021(a)163.com> net: ipv6: fix return value check in esp_remove_trailer Ma Ke <make_ruc2021(a)163.com> net: ipv4: fix return value check in esp_remove_trailer Eric Dumazet <edumazet(a)google.com> xfrm: interface: use DEV_STATS_INC() Eric Dumazet <edumazet(a)google.com> xfrm: fix a data-race in xfrm_gen_index() Manish Chopra <manishc(a)marvell.com> qed: fix LL2 RX buffer allocation Florian Westphal <fw(a)strlen.de> netfilter: nft_payload: fix wrong mac header matching Jim Mattson <jmattson(a)google.com> KVM: x86: Mask LVTPC when handling a PMI Johan Hovold <johan+linaro(a)kernel.org> regmap: fix NULL deref on lookup Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> nfc: nci: fix possible NULL pointer dereference in send_acknowledge() Jesse Brandeburg <jesse.brandeburg(a)intel.com> ice: fix over-shifted variable Arnd Bergmann <arnd(a)arndb.de> Bluetooth: avoid memcmp() out of bounds warning Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_event: Fix coding style Arkadiusz Bokowy <arkadiusz.bokowy(a)gmail.com> Bluetooth: vhci: Fix race when opening vhci device Ziyang Xuan <william.xuanziyang(a)huawei.com> Bluetooth: Fix a refcnt underflow problem for hci_conn Lee, Chun-Yi <jlee(a)suse.com> Bluetooth: Reject connection with the device which has same BD_ADDR Lee, Chun-Yi <jlee(a)suse.com> Bluetooth: hci_event: Ignore NULL link key Ricardo Cañuelo <ricardo.canuelo(a)collabora.com> usb: hub: Guard against accesses to uninitialized BOS descriptors Bagas Sanjaya <bagasdotme(a)gmail.com> Documentation: sysctl: align cells in second content column Nicolas Dichtel <nicolas.dichtel(a)6wind.com> dev_forward_skb: do not scrub skb mark within the same name space Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com> ravb: Fix use-after-free issue in ravb_tx_timeout_work() Christophe Leroy <christophe.leroy(a)csgroup.eu> powerpc/64e: Fix wrong test in __ptep_test_and_clear_young() Christophe Leroy <christophe.leroy(a)csgroup.eu> powerpc/8xx: Fix pte_access_permitted() for PAGE_NONE Duoming Zhou <duoming(a)zju.edu.cn> dmaengine: mediatek: Fix deadlock caused by synchronize_irq() Borislav Petkov (AMD) <bp(a)alien8.de> x86/cpu: Fix AMD erratum #1485 on Zen4-based CPUs Krishna Kurapati <quic_kriskura(a)quicinc.com> usb: gadget: ncm: Handle decoding of multiple NTB's in unwrap call Piyush Mehta <piyush.mehta(a)amd.com> usb: gadget: udc-xilinx: replace memcpy with memcpy_toio Dmitry Torokhov <dmitry.torokhov(a)gmail.com> pinctrl: avoid unsafe code pattern in find_pinctrl() Michal Koutný <mkoutny(a)suse.com> cgroup: Remove duplicates in cgroup v1 tasks file Matthias Berndt <matthias_berndt(a)gmx.de> Input: xpad - add PXN V900 support Jeffery Miller <jefferymiller(a)google.com> Input: psmouse - fix fast_reconnect function for PS/2 mode Javier Carrasco <javier.carrasco.cruz(a)gmail.com> Input: powermate - fix use-after-free in powermate_config_complete Xiubo Li <xiubli(a)redhat.com> ceph: fix incorrect revoked caps assert in ceph_fill_file_size() Jordan Rife <jrife(a)google.com> libceph: use kernel_connect() Jorge Sanjuan Garcia <jorge.sanjuangarcia(a)duagon.com> mcb: remove is_added flag from mcb_device struct Alexander Zangerl <az(a)breathe-safe.com> iio: pressure: ms5611: ms5611_prom_is_valid false negative bug Lakshmi Yadlapati <lakshmiy(a)us.ibm.com> iio: pressure: dps310: Adjust Timeout Settings Phil Elwell <phil(a)raspberrypi.com> iio: pressure: bmp280: Fix NULL pointer exception Xingxing Luo <xingxing.luo(a)unisoc.com> usb: musb: Modify the "HWVers" register address Xingxing Luo <xingxing.luo(a)unisoc.com> usb: musb: Get the musb_qh poniter after musb_giveback Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> usb: dwc3: Soft reset phy on probe for host Javier Carrasco <javier.carrasco.cruz(a)gmail.com> net: usb: dm9601: fix uninitialized variable use in dm9601_mdio_read Wesley Cheng <quic_wcheng(a)quicinc.com> usb: xhci: xhci-ring: Use sysdev for mapping bounce buffer Amelie Delaunay <amelie.delaunay(a)foss.st.com> dmaengine: stm32-mdma: abort resume if no ongoing transfer Waiman Long <longman(a)redhat.com> workqueue: Override implicit ordered attribute in workqueue_apply_unbound_cpumask() Jeremy Cline <jeremy(a)jcline.org> nfc: nci: assert requested protocol is valid Eric Dumazet <edumazet(a)google.com> net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() Dan Carpenter <dan.carpenter(a)linaro.org> ixgbe: fix crash with empty VF macvlan list Konstantin Meskhidze <konstantin.meskhidze(a)huawei.com> drm/vmwgfx: fix typo of sizeof argument Roger Pau Monne <roger.pau(a)citrix.com> xen-netback: use default TX queue size for vifs Dan Carpenter <dan.carpenter(a)linaro.org> mlxsw: fix mlxsw_sp2_nve_vxlan_learning_set() return type Dinghao Liu <dinghao.liu(a)zju.edu.cn> ieee802154: ca8210: Fix a potential UAF in ca8210_probe Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com> ravb: Fix up dma_free_coherent() call in ravb_remove() Abhinav Kumar <quic_abhinavk(a)quicinc.com> drm/msm/dsi: skip the wait for video mode done if not applicable Martin Fuzzey <martin.fuzzey(a)flowbird.group> drm: etvnaviv: fix bad backport leading to warning Jordan Rife <jrife(a)google.com> net: prevent address rewrite in kernel_bind() Jan Kara <jack(a)suse.cz> quota: Fix slow quotaoff Hans de Goede <hdegoede(a)redhat.com> HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> pwm: hibvt: Explicitly set .polarity in .get_state() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> lib/test_meminit: fix off-by-one error in test_pages() Artem Chernyshev <artem.chernyshev(a)red-soft.ru> RDMA/cxgb4: Check skb value for failure to allocate ------------- Diffstat: Documentation/admin-guide/sysctl/net.rst | 18 +-- Makefile | 4 +- arch/arm/boot/dts/omap4-droid4-xt894.dts | 1 + arch/powerpc/include/asm/nohash/32/pte-8xx.h | 7 ++ arch/powerpc/include/asm/nohash/64/pgtable.h | 2 +- arch/powerpc/include/asm/nohash/pgtable.h | 2 + arch/s390/pci/pci_dma.c | 15 ++- arch/x86/include/asm/msr-index.h | 4 + arch/x86/kernel/cpu/amd.c | 8 ++ arch/x86/kvm/lapic.c | 8 +- drivers/acpi/irq.c | 7 +- drivers/acpi/resource.c | 121 +++++++++++++++++++-- drivers/ata/libata-eh.c | 2 +- drivers/base/regmap/regmap.c | 2 +- drivers/bluetooth/hci_vhci.c | 3 + drivers/dma/mediatek/mtk-uart-apdma.c | 3 +- drivers/dma/stm32-mdma.c | 4 + drivers/gpio/gpio-timberdale.c | 5 +- drivers/gpio/gpio-vf610.c | 4 +- drivers/gpu/drm/drm_panel_orientation_quirks.c | 16 +++ drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c | 2 +- drivers/gpu/drm/msm/dsi/dsi_host.c | 12 ++ drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 2 +- drivers/hid/hid-holtek-kbd.c | 4 + drivers/hid/hid-logitech-hidpp.c | 3 +- drivers/hid/hid-multitouch.c | 4 + drivers/i2c/i2c-mux.c | 2 +- drivers/iio/pressure/bmp280-core.c | 2 +- drivers/iio/pressure/dps310.c | 8 +- drivers/iio/pressure/ms5611_core.c | 2 +- drivers/infiniband/hw/cxgb4/cm.c | 3 + drivers/input/joystick/xpad.c | 2 + drivers/input/misc/powermate.c | 1 + drivers/input/mouse/elantech.c | 1 + drivers/input/mouse/synaptics.c | 1 + drivers/mcb/mcb-core.c | 10 +- drivers/mcb/mcb-parse.c | 2 - drivers/mmc/core/mmc.c | 2 +- drivers/mmc/core/sdio.c | 8 +- drivers/mtd/maps/physmap-core.c | 11 ++ drivers/mtd/nand/raw/qcom_nandc.c | 2 +- drivers/mtd/nand/spi/micron.c | 2 +- drivers/net/ethernet/intel/i40e/i40e_common.c | 4 +- drivers/net/ethernet/intel/ice/ice_lib.c | 3 +- drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c | 5 +- drivers/net/ethernet/marvell/sky2.h | 2 +- .../ethernet/mellanox/mlxsw/spectrum_nve_vxlan.c | 4 +- drivers/net/ethernet/qlogic/qed/qed_ll2.c | 7 +- drivers/net/ethernet/renesas/ravb_main.c | 6 +- drivers/net/ieee802154/ca8210.c | 17 +-- drivers/net/tun.c | 7 +- drivers/net/usb/dm9601.c | 7 +- drivers/net/usb/smsc95xx.c | 2 +- drivers/net/xen-netback/interface.c | 3 - drivers/phy/motorola/phy-mapphone-mdm6600.c | 38 +++---- drivers/pwm/pwm-hibvt.c | 1 + drivers/regulator/core.c | 6 +- drivers/usb/core/hub.c | 28 ++++- drivers/usb/core/hub.h | 2 +- drivers/usb/dwc3/core.c | 39 ++++++- drivers/usb/gadget/function/f_ncm.c | 26 +++-- drivers/usb/gadget/udc/udc-xilinx.c | 20 ++-- drivers/usb/host/xhci-ring.c | 4 +- drivers/usb/musb/musb_debugfs.c | 2 +- drivers/usb/musb/musb_host.c | 9 +- drivers/usb/serial/option.c | 7 ++ fs/btrfs/extent-tree.c | 6 +- fs/btrfs/ioctl.c | 4 +- fs/btrfs/tree-log.c | 2 +- fs/ceph/inode.c | 4 +- fs/overlayfs/copy_up.c | 2 +- fs/quota/dquot.c | 66 ++++++----- include/linux/ioport.h | 7 ++ include/linux/mcb.h | 1 - include/linux/netdevice.h | 2 +- include/linux/perf_event.h | 1 + include/linux/quota.h | 4 +- include/linux/quotaops.h | 2 +- include/net/bluetooth/hci_core.h | 2 +- include/net/bluetooth/hci_mon.h | 2 +- include/net/netns/xfrm.h | 1 + include/net/tcp.h | 3 + include/trace/events/neigh.h | 4 +- kernel/cgroup/cgroup-v1.c | 5 +- kernel/events/core.c | 39 ++++++- kernel/trace/trace_events.c | 1 + kernel/workqueue.c | 8 +- lib/test_meminit.c | 2 +- net/bluetooth/hci_conn.c | 72 +++++++----- net/bluetooth/hci_core.c | 8 +- net/bluetooth/hci_event.c | 33 +++++- net/bluetooth/hci_sock.c | 3 +- net/ceph/messenger.c | 4 +- net/core/pktgen.c | 14 +-- net/ipv4/esp4.c | 4 +- net/ipv4/fib_semantics.c | 14 ++- net/ipv4/tcp_output.c | 25 ++++- net/ipv4/tcp_recovery.c | 2 +- net/ipv6/esp6.c | 4 +- net/ipv6/xfrm6_policy.c | 4 +- net/mac80211/tx.c | 3 +- net/netfilter/ipvs/ip_vs_sync.c | 4 +- net/netfilter/nft_payload.c | 2 +- net/netfilter/nft_set_rbtree.c | 2 + net/nfc/llcp_core.c | 30 ++--- net/nfc/nci/core.c | 5 + net/nfc/nci/spi.c | 2 + net/rds/tcp_connect.c | 2 +- net/rds/tcp_listen.c | 2 +- net/rfkill/rfkill-gpio.c | 4 +- net/sched/sch_hfsc.c | 18 ++- net/socket.c | 6 +- net/wireless/nl80211.c | 2 +- net/xfrm/xfrm_interface_core.c | 22 ++-- net/xfrm/xfrm_policy.c | 6 +- sound/soc/pxa/pxa-ssp.c | 2 +- 116 files changed, 726 insertions(+), 312 deletions(-)

2 years

7
6
0 0

[PATCH 6.5 000/241] 6.5.9-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.5.9 release. There are 241 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 25 Oct 2023 10:47:57 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.5.9-rc1.… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.5.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.5.9-rc1 Matthieu Baerts <matttbe(a)kernel.org> selftests: mptcp: join: correctly check for no RST Geliang Tang <geliang.tang(a)suse.com> mptcp: avoid sending RST when closing the initial subflow Kees Cook <keescook(a)chromium.org> Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name Miguel Ojeda <ojeda(a)kernel.org> kbuild: remove old Rust docs output path Miguel Ojeda <ojeda(a)kernel.org> docs: rust: update Rust docs output path Johannes Berg <johannes.berg(a)intel.com> net: rfkill: reduce data->mtx scope in rfkill_fop_open Edward AD <twuufnxlz(a)gmail.com> Bluetooth: hci_sock: fix slab oob read in create_monitor_event Jakub Kicinski <kuba(a)kernel.org> net: move altnames together with the netdevice Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com> efi/unaccepted: Fix soft lockups caused by parallel memory acceptance Konrad Dybcio <konrad.dybcio(a)linaro.org> phy: qcom-qmp-combo: initialize PCS_USB registers Konrad Dybcio <konrad.dybcio(a)linaro.org> phy: qcom-qmp-combo: Square out 8550 POWER_STATE_CONFIG1 Adrien Thierry <athierry(a)redhat.com> phy: qcom-qmp-usb: split PCS_USB init table for sc8280xp and sa8775p Adrien Thierry <athierry(a)redhat.com> phy: qcom-qmp-usb: initialize PCS_USB registers Tony Lindgren <tony(a)atomide.com> phy: mapphone-mdm6600: Fix pinctrl_pm handling for sleep pins Tony Lindgren <tony(a)atomide.com> phy: mapphone-mdm6600: Fix runtime PM for remove Tony Lindgren <tony(a)atomide.com> phy: mapphone-mdm6600: Fix runtime disable on probe Miguel Ojeda <ojeda(a)kernel.org> rust: docs: fix logo replacement Carlos Bilbao <carlos.bilbao(a)amd.com> docs: Move rustdoc output, cross-reference it Nicholas Piggin <npiggin(a)gmail.com> powerpc/qspinlock: Fix stale propagated yield_cpu Michael Ellerman <mpe(a)ellerman.id.au> powerpc/mm: Allow ARCH_FORCE_MAX_ORDER up to 12 Felix Kuehling <Felix.Kuehling(a)amd.com> drm/amdgpu: Fix possible null pointer dereference Khaled Almahallawy <khaled.almahallawy(a)intel.com> drm/i915/cx0: Only clear/set the Pipe Reset bit of the PHY Lanes Owned Douglas Anderson <dianders(a)chromium.org> drm/panel: Move AUX B116XW03 out of panel-edp back to panel-simple Stephen Boyd <swboyd(a)chromium.org> drm/bridge: ti-sn65dsi86: Associate DSI device lifetime with auxiliary device Richard Fitzgerald <rf(a)opensource.cirrus.com> ASoC: cs42l42: Fix missing include of gpio/consumer.h Dan Carpenter <dan.carpenter(a)linaro.org> ASoC: pxa: fix a memory leak in probe() Richard Fitzgerald <rf(a)opensource.cirrus.com> ASoC: cs35l56: Fix illegal use of init_completion() Haibo Chen <haibo.chen(a)nxp.com> gpio: vf610: mask the gpio irq in system suspend and support wakeup Haibo Chen <haibo.chen(a)nxp.com> gpio: vf610: set value before the direction to avoid a glitch Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> gpiolib: acpi: Add missing memset(0) to acpi_get_gpiod_from_data() Wedson Almeida Filho <walmeida(a)microsoft.com> rust: error: fix the description for `ECHILD` Hans de Goede <hdegoede(a)redhat.com> platform/x86: asus-wmi: Map 0x2a code, Ignore 0x2b and 0x2c events Hans de Goede <hdegoede(a)redhat.com> platform/x86: asus-wmi: Only map brightness codes when using asus-wmi backlight control Hans de Goede <hdegoede(a)redhat.com> platform/x86: asus-wmi: Change ASUS_WMI_BRN_DOWN code from 0x20 to 0x2e Nikita Kravets <teackot(a)gmail.com> platform/x86: msi-ec: Fix the 3rd config Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> platform/x86: intel-uncore-freq: Conditionally create attribute for read frequency Armin Wolf <W_Armin(a)gmx.de> platform/surface: platform_profile: Propagate error if profile registration fails Dinghao Liu <dinghao.liu(a)zju.edu.cn> s390/cio: fix a memleak in css_alloc_subchannel Orlando Chamberlain <orlandoch.dev(a)gmail.com> apple-gmux: Hard Code max brightness for MMIO gmux Herbert Xu <herbert(a)gondor.apana.org.au> KEYS: asymmetric: Fix sign/verify on pkcs1pad without a hash Francis Laniel <flaniel(a)linux.microsoft.com> selftests/ftrace: Add new test case which checks non unique symbol Francis Laniel <flaniel(a)linux.microsoft.com> tracing/kprobes: Return EADDRNOTAVAIL when func matches several symbols Niklas Schnelle <schnelle(a)linux.ibm.com> s390/pci: fix iommu bitmap allocation Peter Zijlstra <peterz(a)infradead.org> perf: Disallow mis-matched inherited group reads Gil Fine <gil.fine(a)linux.intel.com> thunderbolt: Call tb_switch_put() once DisplayPort bandwidth request is finished Puliang Lu <puliang.lu(a)fibocom.com> USB: serial: option: add Fibocom to DELL custom modem FM101R-GL Benoît Monin <benoit.monin(a)gmx.fr> USB: serial: option: add entry for Sierra EM9191 with new firmware Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit LE910C4-WWX 0x1035 composition Maurizio Lombardi <mlombard(a)redhat.com> nvme-rdma: do not try to stop unallocated queues Maurizio Lombardi <mlombard(a)redhat.com> nvmet-auth: complete a request only after freeing the dhchap pointers Martin Wilck <mwilck(a)suse.com> nvme-auth: use chap->s2 to indicate bidirectional authentication Keith Busch <kbusch(a)kernel.org> nvme-pci: add BOGUS_NID for Intel 0a54 device Keith Busch <kbusch(a)kernel.org> nvme: sanitize metadata bounce buffer for reads Dai Ngo <dai.ngo(a)oracle.com> nfs42: client needs to strip file mode's suid/sgid bit after ALLOCATE op Scott Mayhew <smayhew(a)redhat.com> NFS: Fix potential oops in nfs_inode_remove_request() Amir Goldstein <amir73il(a)gmail.com> fanotify: limit reporting of event with non-decodeable file handles Stanislaw Gruszka <stanislaw.gruszka(a)linux.intel.com> Revert "accel/ivpu: Use cached buffers for FW loading" Adrian Hunter <adrian.hunter(a)intel.com> perf dlfilter: Fix use of addr_location__exit() in dlfilter__object_code() Hanjun Guo <guohanjun(a)huawei.com> ACPI: bus: Move acpi_arm_init() to the place of after acpi_ghes_init() Sunil V L <sunilvl(a)ventanamicro.com> ACPI: irq: Fix incorrect return value in acpi_register_gsi() Olga Kornievskaia <kolga(a)netapp.com> NFSv4.1: fixup use EXCHGID4_FLAG_USE_PNFS_DS for DS server Trond Myklebust <trond.myklebust(a)hammerspace.com> pNFS/flexfiles: Check the layout validity in ff_layout_mirror_prepare_stats Trond Myklebust <trond.myklebust(a)hammerspace.com> pNFS: Fix a hang in nfs4_evict_inode() Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> Revert "pinctrl: avoid unsafe code pattern in find_pinctrl()" Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> pinctrl: qcom: lpass-lpi: fix concurrent register updates Avri Altman <avri.altman(a)wdc.com> mmc: core: Capture correct oemid-bits for eMMC cards Haibo Chen <haibo.chen(a)nxp.com> mmc: core: sdio: hold retuning if sdio in 1-bit mode Ulf Hansson <ulf.hansson(a)linaro.org> mmc: core: Fix error propagation for some ioctl commands Pablo Sun <pablo.sun(a)mediatek.com> mmc: mtk-sd: Use readl_poll_timeout_atomic in msdc_reset_hw Sven van Ashbrook <svenva(a)chromium.org> mmc: sdhci-pci-gli: fix LPM negotiation so x86/S0ix SoCs can suspend Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> dt-bindings: mmc: sdhci-msm: correct minimum number of clocks Geert Uytterhoeven <geert+renesas(a)glider.be> mtd: physmap-core: Restore map_rom fallback Martin Kurbanov <mmkurbanov(a)sberdevices.ru> mtd: spinand: micron: correct bitmask for ecc status Rouven Czerwinski <r.czerwinski(a)pengutronix.de> mtd: rawnand: Ensure the nand chip supports cached reads Miquel Raynal <miquel.raynal(a)bootlin.com> mtd: rawnand: arasan: Ensure program page operations are successful Miquel Raynal <miquel.raynal(a)bootlin.com> mtd: rawnand: marvell: Ensure program page operations are successful Miquel Raynal <miquel.raynal(a)bootlin.com> mtd: rawnand: pl353: Ensure program page operations are successful Bibek Kumar Patro <quic_bibekkum(a)quicinc.com> mtd: rawnand: qcom: Unmap the right resource upon probe failure Paolo Abeni <pabeni(a)redhat.com> tcp_bpf: properly release resources on error paths Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_event: Fix using memcmp when comparing keys Albert Huang <huangjie.albert(a)bytedance.com> net/smc: fix smc clc failed issue when netdevice not in init_net Guangguan Wang <guangguan.wang(a)linux.alibaba.com> net/smc: support smc v2.x features validate Guangguan Wang <guangguan.wang(a)linux.alibaba.com> net/smc: support smc release version negotiation in clc handshake Paolo Abeni <pabeni(a)redhat.com> tcp: allow again tcp_disconnect() when threads are waiting Hannes Reinecke <hare(a)suse.de> net/tls: split tls_rx_reader_lock Amir Tzin <amirtz(a)nvidia.com> net/mlx5e: Fix VF representors reporting zero counters to "ip -s" command Jianbo Liu <jianbol(a)nvidia.com> net/mlx5e: Don't offload internal port if filter device is out device Lama Kayal <lkayal(a)nvidia.com> net/mlx5e: Take RTNL lock before triggering netdev notifiers Dragos Tatulea <dtatulea(a)nvidia.com> net/mlx5e: XDP, Fix XDP_REDIRECT mpwqe page fragment leaks on shutdown Dragos Tatulea <dtatulea(a)nvidia.com> net/mlx5e: RX, Fix page_pool allocation failure recovery for legacy rq Dragos Tatulea <dtatulea(a)nvidia.com> net/mlx5e: RX, Fix page_pool allocation failure recovery for striding rq Maher Sanalla <msanalla(a)nvidia.com> net/mlx5: Handle fw tracer change ownership event based on MTRC Shay Drory <shayd(a)nvidia.com> net/mlx5: E-switch, register event handler before arming the event Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: always check if connection is alive before deleting Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: delete CIS in BT_OPEN/CONNECT/BOUND when aborting Iulia Tanasescu <iulia.tanasescu(a)nxp.com> Bluetooth: ISO: Fix invalid context error Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_sync: Introduce PTR_UINT/UINT_PTR macros Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_sync: Fix not handling ISO_LINK in hci_abort_conn_sync Jeff Moyer <jmoyer(a)redhat.com> io-wq: fully initialize wqe before calling cpuhp_state_add_instance_nocalls() Xuewen Yan <xuewen.yan(a)unisoc.com> cpufreq: schedutil: Update next_freq when cpufreq_limits change Renan Guilherme Lebre Ramos <japareaggae(a)gmail.com> platform/x86: touchscreen_dmi: Add info for the Positivo C4128B Fabian Vogt <fabian(a)ritter-vogt.de> HID: Add quirk to ignore the touchscreen battery on HP ENVY 15-eu0556ng Martino Fontana <tinozzo123(a)gmail.com> HID: nintendo: reinitialize USB Pro Controller after resuming from suspend Rahul Rameshbabu <sergeantsagara(a)protonmail.com> HID: multitouch: Add required quirk for Synaptics 0xcd7e device Kenneth Feng <kenneth.feng(a)amd.com> drm/amd/pm: add unique_id for gc 11.0.3 Tomasz Swiatek <swiatektomasz99(a)gmail.com> platform/x86: touchscreen_dmi: Add info for the BUSH Bush Windows tablet Filipe Manana <fdmanana(a)suse.com> btrfs: error out when reallocating block for defrag using a stale transaction Filipe Manana <fdmanana(a)suse.com> btrfs: error when COWing block from a root that is being deleted Filipe Manana <fdmanana(a)suse.com> btrfs: error out when COWing block using a stale transaction Josef Bacik <josef(a)toxicpanda.com> btrfs: fix some -Wmaybe-uninitialized warnings in ioctl.c Kai Uwe Broulik <foss-linux(a)broulik.de> drm: panel-orientation-quirks: Add quirk for One Mix 2S Hangbin Liu <liuhangbin(a)gmail.com> ipv4/fib: send notify when delete source address routes Kees Cook <keescook(a)chromium.org> sky2: Make sure there is at least one frag_addr available Jeff Layton <jlayton(a)kernel.org> nfs: decrement nrequests counter before releasing the req Anna Schumaker <Anna.Schumaker(a)Netapp.com> SUNRPC/TLS: Lock the lower_xprt during the tls handshake Chuck Lever <chuck.lever(a)oracle.com> SUNRPC: Fail quickly when server does not recognize TLS Michał Mirosław <mirq-linux(a)rere.qmqm.pl> regulator/core: Revert "fix kobject release warning and memory leak in regulator_register()" Benjamin Berg <benjamin.berg(a)intel.com> wifi: cfg80211: avoid leaking stack data into trace Wen Gong <quic_wgong(a)quicinc.com> wifi: mac80211: allow transmitting EAPOL frames with tainted key Johannes Berg <johannes.berg(a)intel.com> wifi: mac80211: work around Cisco AP 9115 VHT MPDU length Ilan Peer <ilan.peer(a)intel.com> wifi: cfg80211: Fix 6GHz scan configuration Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_core: Fix build warnings Ying Hsu <yinghsu(a)chromium.org> Bluetooth: Avoid redundant authentication Rocky Liao <quic_rjliao(a)quicinc.com> Bluetooth: btusb: add shutdown function for QCA6174 Ma Ke <make_ruc2021(a)163.com> HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event Hans de Goede <hdegoede(a)redhat.com> HID: logitech-hidpp: Add Bluetooth ID for the Logitech M720 Triathlon mouse Johannes Berg <johannes.berg(a)intel.com> rfkill: sync before userspace visibility/changes Ben Greear <greearb(a)candelatech.com> wifi: iwlwifi: Ensure ack flag is properly cleared. Aditya Kumar Singh <quic_adisi(a)quicinc.com> wifi: cfg80211: validate AP phy operation before starting it Gustavo A. R. Silva <gustavoars(a)kernel.org> wifi: mwifiex: Sanity check tlv_len and tlv_bitmap_len Clément Léger <cleger(a)rivosinc.com> tracing: relax trace_event_eval_update() execution with cond_resched() Damien Le Moal <dlemoal(a)kernel.org> ata: libata-eh: Fix compilation warning in ata_eh_link_report() Damien Le Moal <dlemoal(a)kernel.org> ata: libata-core: Fix compilation warning in ata_dev_config_ncq() Chengfeng Ye <dg573847474(a)gmail.com> gpio: timberdale: Fix potential deadlock on &tgpio->lock Jacek Lawrynowicz <jacek.lawrynowicz(a)linux.intel.com> accel/ivpu: Don't flood dmesg with VPU ready message Jeff Layton <jlayton(a)kernel.org> overlayfs: set ctime when setting mtime and atime Heiner Kallweit <hkallweit1(a)gmail.com> i2c: mux: Avoid potential false error message in i2c_mux_add_adapter Josef Bacik <josef(a)toxicpanda.com> btrfs: initialize start_slot in btrfs_log_prealloc_extents Filipe Manana <fdmanana(a)suse.com> btrfs: return -EUCLEAN for delayed tree ref with a ref count not equals to 1 Filipe Manana <fdmanana(a)suse.com> btrfs: prevent transaction block reserve underflow when starting transaction Filipe Manana <fdmanana(a)suse.com> btrfs: fix race when refilling delayed refs block reserve Chunhai Guo <guochunhai(a)vivo.com> fs-writeback: do not requeue a clean inode having skipped pages Rob Herring <robh(a)kernel.org> arm64: dts: mediatek: Fix "mediatek,merge-mute" and "mediatek,merge-fifo-en" types Tony Lindgren <tony(a)atomide.com> ARM: dts: ti: omap: Fix noisy serial with overrun-throttle-ms for mapphone David Thompson <davthompson(a)nvidia.com> pwr-mlxbf: extend Kconfig to include gpio-mlxbf3 dependency Mårten Lindahl <marten.lindahl(a)axis.com> iio: light: vcnl4000: Don't power on/off chip in config Jakub Kicinski <kuba(a)kernel.org> net: check for altname conflicts when changing netdev's netns Jakub Kicinski <kuba(a)kernel.org> net: fix ifname in netlink ntf during netns move Jakub Kicinski <kuba(a)kernel.org> net: avoid UAF on deleted altname Vladimir Oltean <vladimir.oltean(a)nxp.com> net: mdio-mux: fix C45 access returning -EIO after API change Willem de Bruijn <willemb(a)google.com> net: more strict VIRTIO_NET_HDR_GSO_UDP_L4 validation Gavrilov Ilia <Ilia.Gavrilov(a)infotecs.ru> net: pktgen: Fix interface flags printing Florian Fainelli <florian.fainelli(a)broadcom.com> net: phy: bcm7xxx: Add missing 16nm EPHY statistics Aaron Conole <aconole(a)redhat.com> selftests: openvswitch: Add version check for pyroute2 Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: revert do not remove elements if set backend implements .abort Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: do not remove elements if set backend implements .abort Xingyuan Mo <hdthky0(a)gmail.com> nf_tables: fix NULL pointer dereference in nft_inner_init() Xingyuan Mo <hdthky0(a)gmail.com> nf_tables: fix NULL pointer dereference in nft_expr_inner_parse() Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: do not refresh timeout when resetting element Christoph Paasch <cpaasch(a)apple.com> netlink: Correct offload_xstats size Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nft_set_rbtree: .deactivate fails if element has expired Phil Sutter <phil(a)nwl.cc> selftests: netfilter: Run nft_audit.sh in its own netns Aaron Conole <aconole(a)redhat.com> selftests: openvswitch: Fix the ct_tuple for v4 Aaron Conole <aconole(a)redhat.com> selftests: openvswitch: Catch cases where the tests are killed Geert Uytterhoeven <geert+renesas(a)glider.be> neighbor: tracing: Move pin6 inside CONFIG_IPV6=y section Pedro Tammela <pctammela(a)mojatatu.com> net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve Jiri Wiesner <jwiesner(a)suse.de> bonding: Return pointer to data after pull on skb Jinjie Ruan <ruanjinjie(a)huawei.com> net: dsa: bcm_sf2: Fix possible memory leak in bcm_sf2_mdio_register() Michal Schmidt <mschmidt(a)redhat.com> i40e: prevent crash on probe if hw registers have invalid values Shinas Rasheed <srasheed(a)marvell.com> octeon_ep: update BQL sent bytes before ringing doorbell Dan Carpenter <dan.carpenter(a)linaro.org> net: usb: smsc95xx: Fix an error code in smsc95xx_reset() Eric Dumazet <edumazet(a)google.com> ipv4: fib: annotate races around nh->nh_saddr_genid and nh->nh_saddr Shailend Chand <shailend(a)google.com> gve: Do not fully free QPL pages on prefill errors Eric Dumazet <edumazet(a)google.com> tun: prevent negative ifindex Mateusz Polchlopek <mateusz.polchlopek(a)intel.com> docs: fix info about representor identification Kuniyuki Iwashima <kuniyu(a)amazon.com> tcp: Fix listen() warning with v4-mapped-v6 address. Eric Dumazet <edumazet(a)google.com> tcp: tsq: relax tcp_small_queue_check() when rtx queue contains a single skb Neal Cardwell <ncardwell(a)google.com> tcp: fix excessive TLP and RACK timeouts from HZ rounding Josua Mayer <josua(a)solid-run.com> net: rfkill: gpio: prevent value glitch during probe Ma Ke <make_ruc2021(a)163.com> net: ipv6: fix return value check in esp_remove_trailer Ma Ke <make_ruc2021(a)163.com> net: ipv4: fix return value check in esp_remove_trailer Johannes Berg <johannes.berg(a)intel.com> wifi: cfg80211: use system_unbound_wq for wiphy work Masami Hiramatsu (Google) <mhiramat(a)kernel.org> fprobe: Fix to ensure the number of active retprobes is not zero Dong Chenchen <dongchenchen2(a)huawei.com> net: xfrm: skip policies marked as dead while reinserting policies Eric Dumazet <edumazet(a)google.com> xfrm: interface: use DEV_STATS_INC() Eric Dumazet <edumazet(a)google.com> xfrm: fix a data-race in xfrm_gen_index() Zhang Changzhong <zhangchangzhong(a)huawei.com> xfrm6: fix inet6_dev refcount underflow problem Eric Dumazet <edumazet(a)google.com> xfrm: fix a data-race in xfrm_lookup_with_ifid() Manish Chopra <manishc(a)marvell.com> qed: fix LL2 RX buffer allocation Johan Hovold <johan+linaro(a)kernel.org> ASoC: codecs: wcd938x: fix runtime PM imbalance on remove Johan Hovold <johan+linaro(a)kernel.org> ASoC: codecs: wcd938x: fix regulator leaks on probe errors Johan Hovold <johan+linaro(a)kernel.org> ASoC: codecs: wcd938x: fix resource leaks on bind errors Johan Hovold <johan+linaro(a)kernel.org> ASoC: codecs: wcd938x: fix unbind tear down order Johan Hovold <johan+linaro(a)kernel.org> ASoC: codecs: wcd938x: drop bogus bind error handling Johan Hovold <johan+linaro(a)kernel.org> ASoC: codecs: wcd938x-sdw: fix runtime PM imbalance on probe errors Johan Hovold <johan+linaro(a)kernel.org> ASoC: codecs: wcd938x-sdw: fix use after free on driver unbind Luka Guzenko <l.guzenko(a)web.de> ALSA: hda/relatek: Enable Mute LED on HP Laptop 15s-fq5xxx Artem Borisov <dedsa2002(a)gmail.com> ALSA: hda/realtek: Add quirk for ASUS ROG GU603ZV Kailang Yang <kailang(a)realtek.com> ALSA: hda/realtek - Fixed ASUS platform headset Mic issue Hamza Mahfooz <hamza.mahfooz(a)amd.com> drm/edid: add 8 bpc quirk to the BenQ GW2765 Karol Herbst <kherbst(a)redhat.com> drm/nouveau/disp: fix DP capable DSM connectors Chen-Yu Tsai <wenst(a)chromium.org> drm/mediatek: Correctly free sg_table in gem prime vmap Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915: Retry gtt fault when out of fence registers Sagi Grimberg <sagi(a)grimberg.me> nvmet-tcp: Fix a possible UAF in queue intialization setup Jens Axboe <axboe(a)kernel.dk> io_uring: fix crash with IORING_SETUP_NO_MMAP and invalid SQ ring address Florian Westphal <fw(a)strlen.de> netfilter: nft_payload: fix wrong mac header matching Bagas Sanjaya <bagasdotme(a)gmail.com> Revert "net: wwan: iosm: enable runtime pm support for 7560" Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> fs/ntfs3: fix deadlock in mark_as_free_ex Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> fs/ntfs3: Fix shift-out-of-bounds in ntfs_fill_super Zeng Heng <zengheng4(a)huawei.com> fs/ntfs3: fix panic about slab-out-of-bounds caused by ntfs_list_ea() Ziqi Zhao <astrajoan(a)yahoo.com> fs/ntfs3: Fix possible null-pointer dereference in hdr_find_e() Pavel Skripkin <paskripkin(a)gmail.com> fs/ntfs3: Fix OOB read in ntfs_init_from_boot Catalin Marinas <catalin.marinas(a)arm.com> mm: slab: Do not create kmalloc caches smaller than arch_slab_minalign() Matthieu Baerts <matttbe(a)kernel.org> selftests: mptcp: join: no RST when rm subflow/addr Paolo Abeni <pabeni(a)redhat.com> mptcp: more conservative check for zero probes Paolo Abeni <pabeni(a)redhat.com> tcp: check mptcp-level constraints for backlog coalescing Dan Clash <daclash(a)linux.microsoft.com> audit,io_uring: io_uring openat triggers audit reference count underflow Maxim Levitsky <mlevitsk(a)redhat.com> x86: KVM: SVM: refresh AVIC inhibition in svm_leave_nested() Maxim Levitsky <mlevitsk(a)redhat.com> x86: KVM: SVM: add support for Invalid IPI Vector interception Maxim Levitsky <mlevitsk(a)redhat.com> x86: KVM: SVM: always update the x2avic msr interception Sean Christopherson <seanjc(a)google.com> KVM: x86: Constrain guest-supported xfeatures only at KVM_GET_XSAVE{2} Roman Kagan <rkagan(a)amazon.de> KVM: x86/pmu: Truncate counter value to allowed width on write Sean Christopherson <seanjc(a)google.com> x86/fpu: Allow caller to constrain xfeatures when copying to uabi buffer Joerg Roedel <jroedel(a)suse.de> x86/sev: Check for user-space IOIO pointing to kernel space Joerg Roedel <jroedel(a)suse.de> x86/sev: Check IOBM for IOIO exceptions from user-space Borislav Petkov (AMD) <bp(a)alien8.de> x86/sev: Disable MMIO emulation from user mode Jim Mattson <jmattson(a)google.com> KVM: x86: Mask LVTPC when handling a PMI Johan Hovold <johan+linaro(a)kernel.org> regmap: fix NULL deref on lookup Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> nfc: nci: fix possible NULL pointer dereference in send_acknowledge() Zygo Blaxell <ce3g8jdj(a)umail.furryterror.org> btrfs: fix stripe length calculation for non-zoned data chunk allocation Dust Li <dust.li(a)linux.alibaba.com> net/smc: return the right falback reason when prefix checks fail Jesse Brandeburg <jesse.brandeburg(a)intel.com> ice: reset first in crash dump kernels Mateusz Pacuszka <mateuszx.pacuszka(a)intel.com> ice: Fix safe mode when DDP is missing Jesse Brandeburg <jesse.brandeburg(a)intel.com> ice: fix over-shifted variable Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_conn: Fix modifying handle while aborting Arnd Bergmann <arnd(a)arndb.de> Bluetooth: avoid memcmp() out of bounds warning Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_event: Fix coding style Arkadiusz Bokowy <arkadiusz.bokowy(a)gmail.com> Bluetooth: vhci: Fix race when opening vhci device Ziyang Xuan <william.xuanziyang(a)huawei.com> Bluetooth: Fix a refcnt underflow problem for hci_conn Lee, Chun-Yi <jlee(a)suse.com> Bluetooth: Reject connection with the device which has same BD_ADDR Lee, Chun-Yi <jlee(a)suse.com> Bluetooth: hci_event: Ignore NULL link key ------------- Diffstat: .../devicetree/bindings/mmc/sdhci-msm.yaml | 2 +- Documentation/networking/representors.rst | 8 +- Documentation/rust/general-information.rst | 2 +- Documentation/rust/index.rst | 8 + Makefile | 6 +- .../boot/dts/ti/omap/motorola-mapphone-common.dtsi | 1 + arch/arm64/boot/dts/mediatek/mt8195.dtsi | 10 +- arch/powerpc/Kconfig | 2 +- arch/powerpc/lib/qspinlock.c | 3 + arch/s390/pci/pci_dma.c | 15 +- arch/x86/boot/compressed/sev.c | 10 ++ arch/x86/include/asm/fpu/api.h | 3 +- arch/x86/include/asm/svm.h | 1 + arch/x86/kernel/fpu/core.c | 5 +- arch/x86/kernel/fpu/xstate.c | 12 +- arch/x86/kernel/fpu/xstate.h | 3 +- arch/x86/kernel/sev-shared.c | 53 +++++-- arch/x86/kernel/sev.c | 30 ++++ arch/x86/kvm/cpuid.c | 8 - arch/x86/kvm/lapic.c | 8 +- arch/x86/kvm/pmu.h | 6 + arch/x86/kvm/svm/avic.c | 5 +- arch/x86/kvm/svm/nested.c | 3 + arch/x86/kvm/svm/pmu.c | 2 +- arch/x86/kvm/svm/svm.c | 3 +- arch/x86/kvm/vmx/pmu_intel.c | 4 +- arch/x86/kvm/x86.c | 37 +++-- crypto/asymmetric_keys/public_key.c | 5 +- drivers/accel/ivpu/ivpu_drv.c | 2 +- drivers/accel/ivpu/ivpu_fw.c | 9 +- drivers/accel/ivpu/ivpu_gem.h | 5 - drivers/acpi/bus.c | 2 +- drivers/acpi/irq.c | 7 +- drivers/ata/libata-core.c | 2 +- drivers/ata/libata-eh.c | 2 +- drivers/base/regmap/regmap.c | 2 +- drivers/bluetooth/btusb.c | 1 + drivers/bluetooth/hci_vhci.c | 3 + drivers/firmware/efi/unaccepted_memory.c | 64 +++++++- drivers/gpio/gpio-timberdale.c | 5 +- drivers/gpio/gpio-vf610.c | 7 +- drivers/gpio/gpiolib-acpi.c | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 3 +- drivers/gpu/drm/amd/pm/amdgpu_pm.c | 1 + drivers/gpu/drm/bridge/ti-sn65dsi86.c | 14 +- drivers/gpu/drm/drm_edid.c | 3 + drivers/gpu/drm/drm_panel_orientation_quirks.c | 16 ++ drivers/gpu/drm/i915/display/intel_cx0_phy.c | 3 +- drivers/gpu/drm/i915/gem/i915_gem_mman.c | 1 + drivers/gpu/drm/mediatek/mtk_drm_gem.c | 6 +- drivers/gpu/drm/nouveau/nvkm/engine/disp/uconn.c | 14 +- drivers/gpu/drm/panel/panel-edp.c | 29 ---- drivers/gpu/drm/panel/panel-simple.c | 35 +++++ drivers/hid/hid-holtek-kbd.c | 4 + drivers/hid/hid-ids.h | 1 + drivers/hid/hid-input.c | 2 + drivers/hid/hid-logitech-hidpp.c | 2 + drivers/hid/hid-multitouch.c | 4 + drivers/hid/hid-nintendo.c | 175 ++++++++++++--------- drivers/i2c/i2c-mux.c | 2 +- drivers/iio/light/vcnl4000.c | 1 - drivers/mmc/core/block.c | 31 ++-- drivers/mmc/core/mmc.c | 2 +- drivers/mmc/core/sdio.c | 8 +- drivers/mmc/host/mtk-sd.c | 6 +- drivers/mmc/host/sdhci-pci-gli.c | 104 +++++++----- drivers/mtd/maps/physmap-core.c | 11 ++ drivers/mtd/nand/raw/arasan-nand-controller.c | 16 +- drivers/mtd/nand/raw/marvell_nand.c | 23 ++- drivers/mtd/nand/raw/nand_base.c | 3 + drivers/mtd/nand/raw/nand_jedec.c | 3 + drivers/mtd/nand/raw/nand_onfi.c | 3 + drivers/mtd/nand/raw/pl35x-nand-controller.c | 9 ++ drivers/mtd/nand/raw/qcom_nandc.c | 2 +- drivers/mtd/nand/spi/micron.c | 2 +- drivers/net/bonding/bond_main.c | 2 +- drivers/net/dsa/bcm_sf2.c | 24 +-- .../chelsio/inline_crypto/chtls/chtls_io.c | 36 ++++- drivers/net/ethernet/google/gve/gve_rx.c | 18 ++- drivers/net/ethernet/intel/i40e/i40e_common.c | 4 +- drivers/net/ethernet/intel/ice/ice_lib.c | 3 +- drivers/net/ethernet/intel/ice/ice_main.c | 18 +++ .../net/ethernet/marvell/octeon_ep/octep_main.c | 13 +- drivers/net/ethernet/marvell/sky2.h | 2 +- .../ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 2 +- .../ethernet/mellanox/mlx5/core/en/tc_tun_encap.c | 3 +- drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c | 8 +- drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 10 +- drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 35 +++-- drivers/net/ethernet/mellanox/mlx5/core/en_stats.h | 11 +- drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 5 +- drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 17 +- drivers/net/ethernet/qlogic/qed/qed_ll2.c | 7 +- drivers/net/mdio/mdio-mux.c | 47 ++++++ drivers/net/phy/bcm7xxx.c | 3 + drivers/net/tun.c | 7 +- drivers/net/usb/smsc95xx.c | 2 +- drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 3 + .../net/wireless/marvell/mwifiex/11n_rxreorder.c | 16 ++ drivers/net/wwan/iosm/iosm_ipc_imem.c | 17 -- drivers/net/wwan/iosm/iosm_ipc_imem.h | 2 - drivers/net/wwan/iosm/iosm_ipc_pcie.c | 4 +- drivers/net/wwan/iosm/iosm_ipc_port.c | 17 +- drivers/net/wwan/iosm/iosm_ipc_trace.c | 8 - drivers/net/wwan/iosm/iosm_ipc_wwan.c | 21 +-- drivers/nvme/host/auth.c | 4 +- drivers/nvme/host/ioctl.c | 10 +- drivers/nvme/host/pci.c | 3 +- drivers/nvme/host/rdma.c | 3 + drivers/nvme/target/fabrics-cmd-auth.c | 9 +- drivers/nvme/target/tcp.c | 7 +- drivers/phy/motorola/phy-mapphone-mdm6600.c | 38 +++-- drivers/phy/qualcomm/phy-qcom-qmp-combo.c | 6 +- drivers/phy/qualcomm/phy-qcom-qmp-pcs-usb-v6.h | 3 +- drivers/phy/qualcomm/phy-qcom-qmp-usb.c | 24 ++- drivers/pinctrl/core.c | 16 +- drivers/pinctrl/qcom/pinctrl-lpass-lpi.c | 17 +- .../platform/surface/surface_platform_profile.c | 3 +- drivers/platform/x86/apple-gmux.c | 14 +- drivers/platform/x86/asus-nb-wmi.c | 3 + drivers/platform/x86/asus-wmi.c | 15 +- drivers/platform/x86/asus-wmi.h | 2 +- .../uncore-frequency/uncore-frequency-common.c | 8 +- drivers/platform/x86/msi-ec.c | 3 +- drivers/platform/x86/touchscreen_dmi.c | 45 ++++++ drivers/power/reset/Kconfig | 2 +- drivers/regulator/core.c | 6 +- drivers/s390/cio/css.c | 6 +- drivers/thunderbolt/tb.c | 10 +- drivers/usb/serial/option.c | 7 + fs/btrfs/ctree.c | 52 ++++-- fs/btrfs/delayed-ref.c | 46 ++++-- fs/btrfs/delayed-ref.h | 1 - fs/btrfs/extent-tree.c | 6 +- fs/btrfs/ioctl.c | 4 +- fs/btrfs/transaction.c | 6 +- fs/btrfs/tree-log.c | 2 +- fs/btrfs/volumes.c | 2 +- fs/fs-writeback.c | 11 +- fs/namei.c | 9 +- fs/nfs/flexfilelayout/flexfilelayout.c | 17 +- fs/nfs/nfs42proc.c | 3 +- fs/nfs/nfs4proc.c | 2 - fs/nfs/pnfs.c | 33 ++-- fs/nfs/write.c | 4 +- fs/notify/fanotify/fanotify_user.c | 25 ++- fs/ntfs3/fsntfs.c | 6 +- fs/ntfs3/index.c | 3 + fs/ntfs3/ntfs_fs.h | 2 + fs/ntfs3/super.c | 31 +++- fs/ntfs3/xattr.c | 7 +- fs/overlayfs/copy_up.c | 2 +- include/linux/fs.h | 2 +- include/linux/mtd/jedec.h | 3 + include/linux/mtd/onfi.h | 1 + include/linux/mtd/rawnand.h | 2 + include/linux/perf_event.h | 1 + include/linux/virtio_net.h | 19 ++- include/net/bluetooth/hci_core.h | 3 +- include/net/bluetooth/hci_mon.h | 2 +- include/net/bluetooth/hci_sync.h | 3 + include/net/ip_fib.h | 1 + include/net/netns/xfrm.h | 1 + include/net/sock.h | 10 +- include/net/tcp.h | 3 + include/trace/events/neigh.h | 4 +- io_uring/io-wq.c | 10 +- io_uring/io_uring.c | 6 + kernel/auditsc.c | 8 +- kernel/events/core.c | 39 ++++- kernel/sched/cpufreq_schedutil.c | 3 +- kernel/trace/fprobe.c | 6 +- kernel/trace/trace_events.c | 1 + kernel/trace/trace_kprobe.c | 63 ++++++++ kernel/trace/trace_probe.h | 1 + mm/slab_common.c | 6 +- net/bluetooth/hci_conn.c | 135 +++++++++++----- net/bluetooth/hci_core.c | 8 +- net/bluetooth/hci_event.c | 77 +++++---- net/bluetooth/hci_sock.c | 3 +- net/bluetooth/hci_sync.c | 70 ++++++--- net/bluetooth/iso.c | 14 -- net/core/dev.c | 65 ++++++-- net/core/dev.h | 3 + net/core/pktgen.c | 14 +- net/core/rtnetlink.c | 4 +- net/core/stream.c | 12 +- net/ipv4/af_inet.c | 10 +- net/ipv4/esp4.c | 4 +- net/ipv4/fib_semantics.c | 15 +- net/ipv4/fib_trie.c | 4 + net/ipv4/inet_connection_sock.c | 1 - net/ipv4/inet_hashtables.c | 24 ++- net/ipv4/tcp.c | 16 +- net/ipv4/tcp_bpf.c | 12 ++ net/ipv4/tcp_ipv4.c | 1 + net/ipv4/tcp_output.c | 25 ++- net/ipv4/tcp_recovery.c | 2 +- net/ipv6/esp6.c | 4 +- net/ipv6/xfrm6_policy.c | 4 +- net/mac80211/cfg.c | 3 +- net/mac80211/ibss.c | 2 +- net/mac80211/ieee80211_i.h | 1 + net/mac80211/mesh_plink.c | 2 +- net/mac80211/mlme.c | 27 +++- net/mac80211/tx.c | 3 +- net/mac80211/vht.c | 16 +- net/mptcp/protocol.c | 43 ++--- net/netfilter/nf_tables_api.c | 20 +-- net/netfilter/nft_inner.c | 1 + net/netfilter/nft_payload.c | 2 +- net/netfilter/nft_set_rbtree.c | 2 + net/nfc/nci/spi.c | 2 + net/rfkill/core.c | 37 +++-- net/rfkill/rfkill-gpio.c | 4 +- net/sched/sch_hfsc.c | 18 ++- net/smc/af_smc.c | 44 +++++- net/smc/smc.h | 5 +- net/smc/smc_clc.c | 60 ++++++- net/smc/smc_clc.h | 30 +++- net/smc/smc_core.h | 1 + net/smc/smc_ib.c | 7 +- net/smc/smc_ib.h | 2 +- net/sunrpc/auth.c | 11 +- net/sunrpc/auth_tls.c | 4 +- net/sunrpc/clnt.c | 10 +- net/sunrpc/xprtsock.c | 6 + net/tls/tls_main.c | 10 +- net/tls/tls_sw.c | 57 ++++--- net/wireless/core.c | 2 +- net/wireless/nl80211.c | 21 ++- net/wireless/scan.c | 4 + net/xfrm/xfrm_interface_core.c | 22 ++- net/xfrm/xfrm_policy.c | 27 ++-- rust/Makefile | 24 +-- rust/kernel/error.rs | 2 +- sound/pci/hda/patch_realtek.c | 27 ++++ sound/soc/codecs/cs35l56.c | 2 +- sound/soc/codecs/cs42l42-sdw.c | 1 + sound/soc/codecs/wcd938x-sdw.c | 27 +++- sound/soc/codecs/wcd938x.c | 76 ++++++--- sound/soc/pxa/pxa-ssp.c | 2 +- tools/perf/util/dlfilter.c | 32 ++-- .../ftrace/test.d/kprobe/kprobe_non_uniq_symbol.tc | 13 ++ tools/testing/selftests/net/mptcp/mptcp_join.sh | 21 ++- .../selftests/net/openvswitch/openvswitch.sh | 4 +- .../testing/selftests/net/openvswitch/ovs-dpctl.py | 14 +- tools/testing/selftests/netfilter/nft_audit.sh | 6 + 248 files changed, 2331 insertions(+), 960 deletions(-)

2 years

13
256
0 0

[PATCH v2 1/2] wifi: ath11k: fix temperature event locking

by Johan Hovold

The ath11k active pdevs are protected by RCU but the temperature event handling code calling ath11k_mac_get_ar_by_pdev_id() was not marked as a read-side critical section as reported by RCU lockdep: ============================= WARNING: suspicious RCU usage 6.6.0-rc6 #7 Not tainted ----------------------------- drivers/net/wireless/ath/ath11k/mac.c:638 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 no locks held by swapper/0/0. ... Call trace: ... lockdep_rcu_suspicious+0x16c/0x22c ath11k_mac_get_ar_by_pdev_id+0x194/0x1b0 [ath11k] ath11k_wmi_tlv_op_rx+0xa84/0x2c1c [ath11k] ath11k_htc_rx_completion_handler+0x388/0x510 [ath11k] Mark the code in question as an RCU read-side critical section to avoid any potential use-after-free issues. Fixes: a41d10348b01 ("ath11k: add thermal sensor device support") Cc: stable(a)vger.kernel.org # 5.7 Signed-off-by: Johan Hovold <johan+linaro(a)kernel.org> --- drivers/net/wireless/ath/ath11k/wmi.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/ath/ath11k/wmi.c b/drivers/net/wireless/ath/ath11k/wmi.c index 23ad6825e5be..da1582b8dc30 100644 --- a/drivers/net/wireless/ath/ath11k/wmi.c +++ b/drivers/net/wireless/ath/ath11k/wmi.c @@ -8383,14 +8383,17 @@ ath11k_wmi_pdev_temperature_event(struct ath11k_base *ab, ath11k_dbg(ab, ATH11K_DBG_WMI, "event pdev temperature ev temp %d pdev_id %d\n", ev->temp, ev->pdev_id); + rcu_read_lock(); + ar = ath11k_mac_get_ar_by_pdev_id(ab, ev->pdev_id); if (!ar) { ath11k_warn(ab, "invalid pdev id in pdev temperature ev %d", ev->pdev_id); - kfree(tb); - return; + goto exit; } ath11k_thermal_event_temperature(ar, ev->temp); +exit: + rcu_read_unlock(); kfree(tb); } -- 2.41.0

2 years

4
6
0 0

Linux 6.5.9

by Greg Kroah-Hartman

I'm announcing the release of the 6.5.9 kernel. All users of the 6.5 kernel series must upgrade. The updated 6.5.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.5.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Documentation/devicetree/bindings/mmc/sdhci-msm.yaml | 2 Documentation/networking/representors.rst | 8 Documentation/rust/general-information.rst | 2 Documentation/rust/index.rst | 8 Makefile | 4 arch/arm/boot/dts/ti/omap/motorola-mapphone-common.dtsi | 1 arch/arm64/boot/dts/mediatek/mt8195.dtsi | 10 arch/powerpc/Kconfig | 2 arch/powerpc/lib/qspinlock.c | 3 arch/s390/pci/pci_dma.c | 15 arch/x86/boot/compressed/sev.c | 10 arch/x86/include/asm/fpu/api.h | 3 arch/x86/include/asm/svm.h | 1 arch/x86/kernel/fpu/core.c | 5 arch/x86/kernel/fpu/xstate.c | 12 arch/x86/kernel/fpu/xstate.h | 3 arch/x86/kernel/sev-shared.c | 53 ++- arch/x86/kernel/sev.c | 30 + arch/x86/kvm/cpuid.c | 8 arch/x86/kvm/lapic.c | 8 arch/x86/kvm/pmu.h | 6 arch/x86/kvm/svm/avic.c | 5 arch/x86/kvm/svm/nested.c | 3 arch/x86/kvm/svm/pmu.c | 2 arch/x86/kvm/svm/svm.c | 3 arch/x86/kvm/vmx/pmu_intel.c | 4 arch/x86/kvm/x86.c | 37 +- crypto/asymmetric_keys/public_key.c | 5 drivers/accel/ivpu/ivpu_drv.c | 2 drivers/accel/ivpu/ivpu_fw.c | 9 drivers/accel/ivpu/ivpu_gem.h | 5 drivers/acpi/bus.c | 2 drivers/acpi/irq.c | 7 drivers/ata/libata-core.c | 2 drivers/ata/libata-eh.c | 2 drivers/base/regmap/regmap.c | 2 drivers/bluetooth/btusb.c | 1 drivers/bluetooth/hci_vhci.c | 3 drivers/firmware/efi/unaccepted_memory.c | 64 +++ drivers/gpio/gpio-timberdale.c | 5 drivers/gpio/gpio-vf610.c | 7 drivers/gpio/gpiolib-acpi.c | 1 drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 3 drivers/gpu/drm/amd/pm/amdgpu_pm.c | 1 drivers/gpu/drm/bridge/ti-sn65dsi86.c | 14 drivers/gpu/drm/drm_edid.c | 3 drivers/gpu/drm/drm_panel_orientation_quirks.c | 16 drivers/gpu/drm/i915/display/intel_cx0_phy.c | 3 drivers/gpu/drm/i915/gem/i915_gem_mman.c | 1 drivers/gpu/drm/mediatek/mtk_drm_gem.c | 6 drivers/gpu/drm/nouveau/nvkm/engine/disp/uconn.c | 14 drivers/hid/hid-holtek-kbd.c | 4 drivers/hid/hid-ids.h | 1 drivers/hid/hid-input.c | 2 drivers/hid/hid-logitech-hidpp.c | 2 drivers/hid/hid-multitouch.c | 4 drivers/hid/hid-nintendo.c | 175 +++++----- drivers/i2c/i2c-mux.c | 2 drivers/iio/light/vcnl4000.c | 1 drivers/mmc/core/block.c | 31 + drivers/mmc/core/mmc.c | 2 drivers/mmc/core/sdio.c | 8 drivers/mmc/host/mtk-sd.c | 6 drivers/mmc/host/sdhci-pci-gli.c | 104 +++-- drivers/mtd/maps/physmap-core.c | 11 drivers/mtd/nand/raw/arasan-nand-controller.c | 16 drivers/mtd/nand/raw/marvell_nand.c | 23 + drivers/mtd/nand/raw/nand_base.c | 3 drivers/mtd/nand/raw/nand_jedec.c | 3 drivers/mtd/nand/raw/nand_onfi.c | 3 drivers/mtd/nand/raw/pl35x-nand-controller.c | 9 drivers/mtd/nand/raw/qcom_nandc.c | 2 drivers/mtd/nand/spi/micron.c | 2 drivers/net/bonding/bond_main.c | 2 drivers/net/dsa/bcm_sf2.c | 24 - drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_io.c | 36 +- drivers/net/ethernet/google/gve/gve_rx.c | 18 - drivers/net/ethernet/intel/i40e/i40e_common.c | 4 drivers/net/ethernet/intel/ice/ice_lib.c | 3 drivers/net/ethernet/intel/ice/ice_main.c | 18 + drivers/net/ethernet/marvell/octeon_ep/octep_main.c | 13 drivers/net/ethernet/marvell/sky2.h | 2 drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 2 drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c | 3 drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c | 8 drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 10 drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 35 +- drivers/net/ethernet/mellanox/mlx5/core/en_stats.h | 11 drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 5 drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 17 drivers/net/ethernet/qlogic/qed/qed_ll2.c | 7 drivers/net/mdio/mdio-mux.c | 47 ++ drivers/net/phy/bcm7xxx.c | 3 drivers/net/tun.c | 7 drivers/net/usb/smsc95xx.c | 2 drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 3 drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c | 16 drivers/net/wwan/iosm/iosm_ipc_imem.c | 17 drivers/net/wwan/iosm/iosm_ipc_imem.h | 2 drivers/net/wwan/iosm/iosm_ipc_pcie.c | 4 drivers/net/wwan/iosm/iosm_ipc_port.c | 17 drivers/net/wwan/iosm/iosm_ipc_trace.c | 8 drivers/net/wwan/iosm/iosm_ipc_wwan.c | 21 - drivers/nvme/host/auth.c | 4 drivers/nvme/host/ioctl.c | 10 drivers/nvme/host/pci.c | 3 drivers/nvme/host/rdma.c | 3 drivers/nvme/target/fabrics-cmd-auth.c | 9 drivers/nvme/target/tcp.c | 7 drivers/phy/motorola/phy-mapphone-mdm6600.c | 38 +- drivers/phy/qualcomm/phy-qcom-qmp-combo.c | 6 drivers/phy/qualcomm/phy-qcom-qmp-pcs-usb-v6.h | 3 drivers/phy/qualcomm/phy-qcom-qmp-usb.c | 24 + drivers/pinctrl/core.c | 16 drivers/pinctrl/qcom/pinctrl-lpass-lpi.c | 17 drivers/platform/surface/surface_platform_profile.c | 3 drivers/platform/x86/apple-gmux.c | 14 drivers/platform/x86/asus-nb-wmi.c | 3 drivers/platform/x86/asus-wmi.c | 15 drivers/platform/x86/asus-wmi.h | 2 drivers/platform/x86/intel/uncore-frequency/uncore-frequency-common.c | 8 drivers/platform/x86/msi-ec.c | 3 drivers/platform/x86/touchscreen_dmi.c | 45 ++ drivers/power/reset/Kconfig | 2 drivers/regulator/core.c | 6 drivers/s390/cio/css.c | 6 drivers/thunderbolt/tb.c | 10 drivers/usb/serial/option.c | 7 fs/btrfs/ctree.c | 52 ++ fs/btrfs/delayed-ref.c | 46 ++ fs/btrfs/delayed-ref.h | 1 fs/btrfs/extent-tree.c | 6 fs/btrfs/ioctl.c | 4 fs/btrfs/transaction.c | 6 fs/btrfs/tree-log.c | 2 fs/btrfs/volumes.c | 2 fs/fs-writeback.c | 11 fs/namei.c | 9 fs/nfs/flexfilelayout/flexfilelayout.c | 17 fs/nfs/nfs42proc.c | 3 fs/nfs/nfs4proc.c | 2 fs/nfs/pnfs.c | 33 + fs/nfs/write.c | 4 fs/notify/fanotify/fanotify_user.c | 25 - fs/ntfs3/fsntfs.c | 6 fs/ntfs3/index.c | 3 fs/ntfs3/ntfs_fs.h | 2 fs/ntfs3/super.c | 31 + fs/ntfs3/xattr.c | 7 fs/overlayfs/copy_up.c | 2 include/linux/fs.h | 2 include/linux/mtd/jedec.h | 3 include/linux/mtd/onfi.h | 1 include/linux/mtd/rawnand.h | 2 include/linux/perf_event.h | 1 include/linux/virtio_net.h | 19 - include/net/bluetooth/hci_core.h | 3 include/net/bluetooth/hci_mon.h | 2 include/net/bluetooth/hci_sync.h | 3 include/net/ip_fib.h | 1 include/net/netns/xfrm.h | 1 include/net/sock.h | 10 include/net/tcp.h | 3 include/trace/events/neigh.h | 4 io_uring/io-wq.c | 10 io_uring/io_uring.c | 6 kernel/auditsc.c | 8 kernel/events/core.c | 39 +- kernel/sched/cpufreq_schedutil.c | 3 kernel/trace/fprobe.c | 6 kernel/trace/trace_events.c | 1 kernel/trace/trace_kprobe.c | 63 +++ kernel/trace/trace_probe.h | 1 mm/slab_common.c | 6 net/bluetooth/hci_conn.c | 135 +++++-- net/bluetooth/hci_core.c | 8 net/bluetooth/hci_event.c | 77 ++-- net/bluetooth/hci_sock.c | 3 net/bluetooth/hci_sync.c | 70 ++-- net/bluetooth/iso.c | 14 net/core/dev.c | 65 ++- net/core/dev.h | 3 net/core/pktgen.c | 14 net/core/rtnetlink.c | 4 net/core/stream.c | 12 net/ipv4/af_inet.c | 10 net/ipv4/esp4.c | 4 net/ipv4/fib_semantics.c | 15 net/ipv4/fib_trie.c | 4 net/ipv4/inet_connection_sock.c | 1 net/ipv4/inet_hashtables.c | 24 - net/ipv4/tcp.c | 16 net/ipv4/tcp_bpf.c | 12 net/ipv4/tcp_ipv4.c | 1 net/ipv4/tcp_output.c | 25 + net/ipv4/tcp_recovery.c | 2 net/ipv6/esp6.c | 4 net/ipv6/xfrm6_policy.c | 4 net/mac80211/cfg.c | 3 net/mac80211/ibss.c | 2 net/mac80211/ieee80211_i.h | 1 net/mac80211/mesh_plink.c | 2 net/mac80211/mlme.c | 27 + net/mac80211/tx.c | 3 net/mac80211/vht.c | 16 net/mptcp/protocol.c | 43 +- net/netfilter/nf_tables_api.c | 20 - net/netfilter/nft_inner.c | 1 net/netfilter/nft_payload.c | 2 net/netfilter/nft_set_rbtree.c | 2 net/nfc/nci/spi.c | 2 net/rfkill/core.c | 37 +- net/rfkill/rfkill-gpio.c | 4 net/sched/sch_hfsc.c | 18 - net/smc/af_smc.c | 2 net/sunrpc/auth.c | 11 net/sunrpc/auth_tls.c | 4 net/sunrpc/clnt.c | 10 net/sunrpc/xprtsock.c | 6 net/tls/tls_main.c | 10 net/tls/tls_sw.c | 57 ++- net/wireless/core.c | 2 net/wireless/nl80211.c | 21 + net/wireless/scan.c | 4 net/xfrm/xfrm_interface_core.c | 22 - net/xfrm/xfrm_policy.c | 27 - rust/Makefile | 24 - rust/kernel/error.rs | 2 sound/pci/hda/patch_realtek.c | 27 + sound/soc/codecs/cs35l56.c | 2 sound/soc/codecs/cs42l42-sdw.c | 1 sound/soc/codecs/wcd938x-sdw.c | 27 + sound/soc/codecs/wcd938x.c | 76 +++- sound/soc/pxa/pxa-ssp.c | 2 tools/perf/util/dlfilter.c | 32 - tools/testing/selftests/ftrace/test.d/kprobe/kprobe_non_uniq_symbol.tc | 13 tools/testing/selftests/net/mptcp/mptcp_join.sh | 21 + tools/testing/selftests/net/openvswitch/openvswitch.sh | 4 tools/testing/selftests/net/openvswitch/ovs-dpctl.py | 14 tools/testing/selftests/netfilter/nft_audit.sh | 6 240 files changed, 2166 insertions(+), 912 deletions(-) Aaron Conole (3): selftests: openvswitch: Catch cases where the tests are killed selftests: openvswitch: Fix the ct_tuple for v4 selftests: openvswitch: Add version check for pyroute2 Aditya Kumar Singh (1): wifi: cfg80211: validate AP phy operation before starting it Adrian Hunter (1): perf dlfilter: Fix use of addr_location__exit() in dlfilter__object_code() Adrien Thierry (2): phy: qcom-qmp-usb: initialize PCS_USB registers phy: qcom-qmp-usb: split PCS_USB init table for sc8280xp and sa8775p Amir Goldstein (1): fanotify: limit reporting of event with non-decodeable file handles Amir Tzin (1): net/mlx5e: Fix VF representors reporting zero counters to "ip -s" command Andy Shevchenko (2): Revert "pinctrl: avoid unsafe code pattern in find_pinctrl()" gpiolib: acpi: Add missing memset(0) to acpi_get_gpiod_from_data() Anna Schumaker (1): SUNRPC/TLS: Lock the lower_xprt during the tls handshake Arkadiusz Bokowy (1): Bluetooth: vhci: Fix race when opening vhci device Armin Wolf (1): platform/surface: platform_profile: Propagate error if profile registration fails Arnd Bergmann (1): Bluetooth: avoid memcmp() out of bounds warning Artem Borisov (1): ALSA: hda/realtek: Add quirk for ASUS ROG GU603ZV Avri Altman (1): mmc: core: Capture correct oemid-bits for eMMC cards Bagas Sanjaya (1): Revert "net: wwan: iosm: enable runtime pm support for 7560" Ben Greear (1): wifi: iwlwifi: Ensure ack flag is properly cleared. Benjamin Berg (1): wifi: cfg80211: avoid leaking stack data into trace Benoît Monin (1): USB: serial: option: add entry for Sierra EM9191 with new firmware Bibek Kumar Patro (1): mtd: rawnand: qcom: Unmap the right resource upon probe failure Borislav Petkov (AMD) (1): x86/sev: Disable MMIO emulation from user mode Carlos Bilbao (1): docs: Move rustdoc output, cross-reference it Catalin Marinas (1): mm: slab: Do not create kmalloc caches smaller than arch_slab_minalign() Chen-Yu Tsai (1): drm/mediatek: Correctly free sg_table in gem prime vmap Chengfeng Ye (1): gpio: timberdale: Fix potential deadlock on &tgpio->lock Christoph Paasch (1): netlink: Correct offload_xstats size Chuck Lever (1): SUNRPC: Fail quickly when server does not recognize TLS Chunhai Guo (1): fs-writeback: do not requeue a clean inode having skipped pages Clément Léger (1): tracing: relax trace_event_eval_update() execution with cond_resched() Dai Ngo (1): nfs42: client needs to strip file mode's suid/sgid bit after ALLOCATE op Damien Le Moal (2): ata: libata-core: Fix compilation warning in ata_dev_config_ncq() ata: libata-eh: Fix compilation warning in ata_eh_link_report() Dan Carpenter (2): net: usb: smsc95xx: Fix an error code in smsc95xx_reset() ASoC: pxa: fix a memory leak in probe() Dan Clash (1): audit,io_uring: io_uring openat triggers audit reference count underflow David Thompson (1): pwr-mlxbf: extend Kconfig to include gpio-mlxbf3 dependency Dinghao Liu (1): s390/cio: fix a memleak in css_alloc_subchannel Dong Chenchen (1): net: xfrm: skip policies marked as dead while reinserting policies Dragos Tatulea (3): net/mlx5e: RX, Fix page_pool allocation failure recovery for striding rq net/mlx5e: RX, Fix page_pool allocation failure recovery for legacy rq net/mlx5e: XDP, Fix XDP_REDIRECT mpwqe page fragment leaks on shutdown Dust Li (1): net/smc: return the right falback reason when prefix checks fail Edward AD (1): Bluetooth: hci_sock: fix slab oob read in create_monitor_event Eric Dumazet (6): xfrm: fix a data-race in xfrm_lookup_with_ifid() xfrm: fix a data-race in xfrm_gen_index() xfrm: interface: use DEV_STATS_INC() tcp: tsq: relax tcp_small_queue_check() when rtx queue contains a single skb tun: prevent negative ifindex ipv4: fib: annotate races around nh->nh_saddr_genid and nh->nh_saddr Fabian Vogt (1): HID: Add quirk to ignore the touchscreen battery on HP ENVY 15-eu0556ng Fabio Porcedda (1): USB: serial: option: add Telit LE910C4-WWX 0x1035 composition Felix Kuehling (1): drm/amdgpu: Fix possible null pointer dereference Filipe Manana (6): btrfs: fix race when refilling delayed refs block reserve btrfs: prevent transaction block reserve underflow when starting transaction btrfs: return -EUCLEAN for delayed tree ref with a ref count not equals to 1 btrfs: error out when COWing block using a stale transaction btrfs: error when COWing block from a root that is being deleted btrfs: error out when reallocating block for defrag using a stale transaction Florian Fainelli (1): net: phy: bcm7xxx: Add missing 16nm EPHY statistics Florian Westphal (1): netfilter: nft_payload: fix wrong mac header matching Francis Laniel (2): tracing/kprobes: Return EADDRNOTAVAIL when func matches several symbols selftests/ftrace: Add new test case which checks non unique symbol Gavrilov Ilia (1): net: pktgen: Fix interface flags printing Geert Uytterhoeven (2): neighbor: tracing: Move pin6 inside CONFIG_IPV6=y section mtd: physmap-core: Restore map_rom fallback Geliang Tang (1): mptcp: avoid sending RST when closing the initial subflow Gil Fine (1): thunderbolt: Call tb_switch_put() once DisplayPort bandwidth request is finished Greg Kroah-Hartman (1): Linux 6.5.9 Gustavo A. R. Silva (1): wifi: mwifiex: Sanity check tlv_len and tlv_bitmap_len Haibo Chen (3): mmc: core: sdio: hold retuning if sdio in 1-bit mode gpio: vf610: set value before the direction to avoid a glitch gpio: vf610: mask the gpio irq in system suspend and support wakeup Hamza Mahfooz (1): drm/edid: add 8 bpc quirk to the BenQ GW2765 Hangbin Liu (1): ipv4/fib: send notify when delete source address routes Hanjun Guo (1): ACPI: bus: Move acpi_arm_init() to the place of after acpi_ghes_init() Hannes Reinecke (1): net/tls: split tls_rx_reader_lock Hans de Goede (4): HID: logitech-hidpp: Add Bluetooth ID for the Logitech M720 Triathlon mouse platform/x86: asus-wmi: Change ASUS_WMI_BRN_DOWN code from 0x20 to 0x2e platform/x86: asus-wmi: Only map brightness codes when using asus-wmi backlight control platform/x86: asus-wmi: Map 0x2a code, Ignore 0x2b and 0x2c events Heiner Kallweit (1): i2c: mux: Avoid potential false error message in i2c_mux_add_adapter Herbert Xu (1): KEYS: asymmetric: Fix sign/verify on pkcs1pad without a hash Ilan Peer (1): wifi: cfg80211: Fix 6GHz scan configuration Iulia Tanasescu (1): Bluetooth: ISO: Fix invalid context error Jacek Lawrynowicz (1): accel/ivpu: Don't flood dmesg with VPU ready message Jakub Kicinski (4): net: avoid UAF on deleted altname net: fix ifname in netlink ntf during netns move net: check for altname conflicts when changing netdev's netns net: move altnames together with the netdevice Jeff Layton (2): overlayfs: set ctime when setting mtime and atime nfs: decrement nrequests counter before releasing the req Jeff Moyer (1): io-wq: fully initialize wqe before calling cpuhp_state_add_instance_nocalls() Jens Axboe (1): io_uring: fix crash with IORING_SETUP_NO_MMAP and invalid SQ ring address Jesse Brandeburg (2): ice: fix over-shifted variable ice: reset first in crash dump kernels Jianbo Liu (1): net/mlx5e: Don't offload internal port if filter device is out device Jim Mattson (1): KVM: x86: Mask LVTPC when handling a PMI Jinjie Ruan (1): net: dsa: bcm_sf2: Fix possible memory leak in bcm_sf2_mdio_register() Jiri Wiesner (1): bonding: Return pointer to data after pull on skb Joerg Roedel (2): x86/sev: Check IOBM for IOIO exceptions from user-space x86/sev: Check for user-space IOIO pointing to kernel space Johan Hovold (8): regmap: fix NULL deref on lookup ASoC: codecs: wcd938x-sdw: fix use after free on driver unbind ASoC: codecs: wcd938x-sdw: fix runtime PM imbalance on probe errors ASoC: codecs: wcd938x: drop bogus bind error handling ASoC: codecs: wcd938x: fix unbind tear down order ASoC: codecs: wcd938x: fix resource leaks on bind errors ASoC: codecs: wcd938x: fix regulator leaks on probe errors ASoC: codecs: wcd938x: fix runtime PM imbalance on remove Johannes Berg (4): wifi: cfg80211: use system_unbound_wq for wiphy work rfkill: sync before userspace visibility/changes wifi: mac80211: work around Cisco AP 9115 VHT MPDU length net: rfkill: reduce data->mtx scope in rfkill_fop_open Josef Bacik (2): btrfs: initialize start_slot in btrfs_log_prealloc_extents btrfs: fix some -Wmaybe-uninitialized warnings in ioctl.c Josua Mayer (1): net: rfkill: gpio: prevent value glitch during probe Kai Uwe Broulik (1): drm: panel-orientation-quirks: Add quirk for One Mix 2S Kailang Yang (1): ALSA: hda/realtek - Fixed ASUS platform headset Mic issue Karol Herbst (1): drm/nouveau/disp: fix DP capable DSM connectors Kees Cook (2): sky2: Make sure there is at least one frag_addr available Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name Keith Busch (2): nvme: sanitize metadata bounce buffer for reads nvme-pci: add BOGUS_NID for Intel 0a54 device Kenneth Feng (1): drm/amd/pm: add unique_id for gc 11.0.3 Khaled Almahallawy (1): drm/i915/cx0: Only clear/set the Pipe Reset bit of the PHY Lanes Owned Kirill A. Shutemov (1): efi/unaccepted: Fix soft lockups caused by parallel memory acceptance Konrad Dybcio (2): phy: qcom-qmp-combo: Square out 8550 POWER_STATE_CONFIG1 phy: qcom-qmp-combo: initialize PCS_USB registers Konstantin Komarov (2): fs/ntfs3: Fix shift-out-of-bounds in ntfs_fill_super fs/ntfs3: fix deadlock in mark_as_free_ex Krzysztof Kozlowski (3): nfc: nci: fix possible NULL pointer dereference in send_acknowledge() dt-bindings: mmc: sdhci-msm: correct minimum number of clocks pinctrl: qcom: lpass-lpi: fix concurrent register updates Kuniyuki Iwashima (1): tcp: Fix listen() warning with v4-mapped-v6 address. Lama Kayal (1): net/mlx5e: Take RTNL lock before triggering netdev notifiers Lee, Chun-Yi (2): Bluetooth: hci_event: Ignore NULL link key Bluetooth: Reject connection with the device which has same BD_ADDR Luiz Augusto von Dentz (6): Bluetooth: hci_event: Fix coding style Bluetooth: hci_conn: Fix modifying handle while aborting Bluetooth: hci_core: Fix build warnings Bluetooth: hci_sync: Fix not handling ISO_LINK in hci_abort_conn_sync Bluetooth: hci_sync: Introduce PTR_UINT/UINT_PTR macros Bluetooth: hci_event: Fix using memcmp when comparing keys Luka Guzenko (1): ALSA: hda/relatek: Enable Mute LED on HP Laptop 15s-fq5xxx Ma Ke (3): net: ipv4: fix return value check in esp_remove_trailer net: ipv6: fix return value check in esp_remove_trailer HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event Maher Sanalla (1): net/mlx5: Handle fw tracer change ownership event based on MTRC Manish Chopra (1): qed: fix LL2 RX buffer allocation Martin Kurbanov (1): mtd: spinand: micron: correct bitmask for ecc status Martin Wilck (1): nvme-auth: use chap->s2 to indicate bidirectional authentication Martino Fontana (1): HID: nintendo: reinitialize USB Pro Controller after resuming from suspend Masami Hiramatsu (Google) (1): fprobe: Fix to ensure the number of active retprobes is not zero Mateusz Pacuszka (1): ice: Fix safe mode when DDP is missing Mateusz Polchlopek (1): docs: fix info about representor identification Matthieu Baerts (2): selftests: mptcp: join: no RST when rm subflow/addr selftests: mptcp: join: correctly check for no RST Maurizio Lombardi (2): nvmet-auth: complete a request only after freeing the dhchap pointers nvme-rdma: do not try to stop unallocated queues Maxim Levitsky (3): x86: KVM: SVM: always update the x2avic msr interception x86: KVM: SVM: add support for Invalid IPI Vector interception x86: KVM: SVM: refresh AVIC inhibition in svm_leave_nested() Michael Ellerman (1): powerpc/mm: Allow ARCH_FORCE_MAX_ORDER up to 12 Michal Schmidt (1): i40e: prevent crash on probe if hw registers have invalid values Michał Mirosław (1): regulator/core: Revert "fix kobject release warning and memory leak in regulator_register()" Miguel Ojeda (3): rust: docs: fix logo replacement docs: rust: update Rust docs output path kbuild: remove old Rust docs output path Miquel Raynal (3): mtd: rawnand: pl353: Ensure program page operations are successful mtd: rawnand: marvell: Ensure program page operations are successful mtd: rawnand: arasan: Ensure program page operations are successful Mårten Lindahl (1): iio: light: vcnl4000: Don't power on/off chip in config Neal Cardwell (1): tcp: fix excessive TLP and RACK timeouts from HZ rounding Nicholas Piggin (1): powerpc/qspinlock: Fix stale propagated yield_cpu Nikita Kravets (1): platform/x86: msi-ec: Fix the 3rd config Niklas Schnelle (1): s390/pci: fix iommu bitmap allocation Olga Kornievskaia (1): NFSv4.1: fixup use EXCHGID4_FLAG_USE_PNFS_DS for DS server Orlando Chamberlain (1): apple-gmux: Hard Code max brightness for MMIO gmux Pablo Neira Ayuso (4): netfilter: nft_set_rbtree: .deactivate fails if element has expired netfilter: nf_tables: do not refresh timeout when resetting element netfilter: nf_tables: do not remove elements if set backend implements .abort netfilter: nf_tables: revert do not remove elements if set backend implements .abort Pablo Sun (1): mmc: mtk-sd: Use readl_poll_timeout_atomic in msdc_reset_hw Paolo Abeni (4): tcp: check mptcp-level constraints for backlog coalescing mptcp: more conservative check for zero probes tcp: allow again tcp_disconnect() when threads are waiting tcp_bpf: properly release resources on error paths Pauli Virtanen (2): Bluetooth: hci_sync: delete CIS in BT_OPEN/CONNECT/BOUND when aborting Bluetooth: hci_sync: always check if connection is alive before deleting Pavel Skripkin (1): fs/ntfs3: Fix OOB read in ntfs_init_from_boot Pedro Tammela (1): net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve Peter Zijlstra (1): perf: Disallow mis-matched inherited group reads Phil Sutter (1): selftests: netfilter: Run nft_audit.sh in its own netns Puliang Lu (1): USB: serial: option: add Fibocom to DELL custom modem FM101R-GL Rahul Rameshbabu (1): HID: multitouch: Add required quirk for Synaptics 0xcd7e device Renan Guilherme Lebre Ramos (1): platform/x86: touchscreen_dmi: Add info for the Positivo C4128B Richard Fitzgerald (2): ASoC: cs35l56: Fix illegal use of init_completion() ASoC: cs42l42: Fix missing include of gpio/consumer.h Rob Herring (1): arm64: dts: mediatek: Fix "mediatek,merge-mute" and "mediatek,merge-fifo-en" types Rocky Liao (1): Bluetooth: btusb: add shutdown function for QCA6174 Roman Kagan (1): KVM: x86/pmu: Truncate counter value to allowed width on write Rouven Czerwinski (1): mtd: rawnand: Ensure the nand chip supports cached reads Sagi Grimberg (1): nvmet-tcp: Fix a possible UAF in queue intialization setup Scott Mayhew (1): NFS: Fix potential oops in nfs_inode_remove_request() Sean Christopherson (2): x86/fpu: Allow caller to constrain xfeatures when copying to uabi buffer KVM: x86: Constrain guest-supported xfeatures only at KVM_GET_XSAVE{2} Shailend Chand (1): gve: Do not fully free QPL pages on prefill errors Shay Drory (1): net/mlx5: E-switch, register event handler before arming the event Shinas Rasheed (1): octeon_ep: update BQL sent bytes before ringing doorbell Srinivas Pandruvada (1): platform/x86: intel-uncore-freq: Conditionally create attribute for read frequency Stanislaw Gruszka (1): Revert "accel/ivpu: Use cached buffers for FW loading" Stephen Boyd (1): drm/bridge: ti-sn65dsi86: Associate DSI device lifetime with auxiliary device Sunil V L (1): ACPI: irq: Fix incorrect return value in acpi_register_gsi() Sven van Ashbrook (1): mmc: sdhci-pci-gli: fix LPM negotiation so x86/S0ix SoCs can suspend Tomasz Swiatek (1): platform/x86: touchscreen_dmi: Add info for the BUSH Bush Windows tablet Tony Lindgren (4): ARM: dts: ti: omap: Fix noisy serial with overrun-throttle-ms for mapphone phy: mapphone-mdm6600: Fix runtime disable on probe phy: mapphone-mdm6600: Fix runtime PM for remove phy: mapphone-mdm6600: Fix pinctrl_pm handling for sleep pins Trond Myklebust (2): pNFS: Fix a hang in nfs4_evict_inode() pNFS/flexfiles: Check the layout validity in ff_layout_mirror_prepare_stats Ulf Hansson (1): mmc: core: Fix error propagation for some ioctl commands Ville Syrjälä (1): drm/i915: Retry gtt fault when out of fence registers Vladimir Oltean (1): net: mdio-mux: fix C45 access returning -EIO after API change Wedson Almeida Filho (1): rust: error: fix the description for `ECHILD` Wen Gong (1): wifi: mac80211: allow transmitting EAPOL frames with tainted key Willem de Bruijn (1): net: more strict VIRTIO_NET_HDR_GSO_UDP_L4 validation Xingyuan Mo (2): nf_tables: fix NULL pointer dereference in nft_expr_inner_parse() nf_tables: fix NULL pointer dereference in nft_inner_init() Xuewen Yan (1): cpufreq: schedutil: Update next_freq when cpufreq_limits change Ying Hsu (1): Bluetooth: Avoid redundant authentication Zeng Heng (1): fs/ntfs3: fix panic about slab-out-of-bounds caused by ntfs_list_ea() Zhang Changzhong (1): xfrm6: fix inet6_dev refcount underflow problem Ziqi Zhao (1): fs/ntfs3: Fix possible null-pointer dereference in hdr_find_e() Ziyang Xuan (1): Bluetooth: Fix a refcnt underflow problem for hci_conn Zygo Blaxell (1): btrfs: fix stripe length calculation for non-zoned data chunk allocation

2 years

1
1
0 0

Linux 6.1.60

by Greg Kroah-Hartman

I'm announcing the release of the 6.1.60 kernel. All users of the 6.1 kernel series must upgrade. The updated 6.1.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.1.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Documentation/devicetree/bindings/mmc/sdhci-msm.yaml | 2 Makefile | 2 arch/arm/boot/dts/motorola-mapphone-common.dtsi | 1 arch/s390/pci/pci_dma.c | 15 arch/x86/boot/compressed/sev.c | 10 arch/x86/include/asm/fpu/api.h | 3 arch/x86/include/asm/kvm_host.h | 3 arch/x86/include/asm/svm.h | 1 arch/x86/kernel/fpu/core.c | 5 arch/x86/kernel/fpu/xstate.c | 12 arch/x86/kernel/fpu/xstate.h | 3 arch/x86/kernel/sev-shared.c | 53 ++- arch/x86/kernel/sev.c | 30 + arch/x86/kvm/cpuid.c | 8 arch/x86/kvm/lapic.c | 8 arch/x86/kvm/mmu/mmu.c | 9 arch/x86/kvm/mmu/mmu_internal.h | 15 arch/x86/kvm/mmu/tdp_mmu.c | 135 +++---- arch/x86/kvm/mmu/tdp_mmu.h | 4 arch/x86/kvm/svm/avic.c | 5 arch/x86/kvm/svm/nested.c | 3 arch/x86/kvm/x86.c | 42 +- drivers/acpi/irq.c | 7 drivers/ata/libata-core.c | 2 drivers/ata/libata-eh.c | 2 drivers/base/regmap/regmap.c | 2 drivers/bluetooth/btusb.c | 1 drivers/bluetooth/hci_vhci.c | 3 drivers/gpio/gpio-timberdale.c | 5 drivers/gpio/gpio-vf610.c | 46 +- drivers/gpu/drm/amd/pm/amdgpu_pm.c | 1 drivers/gpu/drm/bridge/ti-sn65dsi86.c | 14 drivers/gpu/drm/drm_panel_orientation_quirks.c | 16 drivers/gpu/drm/i915/gem/i915_gem_mman.c | 1 drivers/gpu/drm/mediatek/mtk_drm_gem.c | 6 drivers/hid/.kunitconfig | 1 drivers/hid/Kconfig | 1 drivers/hid/hid-holtek-kbd.c | 4 drivers/hid/hid-input-test.c | 80 ++++ drivers/hid/hid-input.c | 36 +- drivers/hid/hid-logitech-hidpp.c | 2 drivers/hid/hid-multitouch.c | 4 drivers/hid/hid-nintendo.c | 175 +++++----- drivers/i2c/i2c-mux.c | 2 drivers/iio/adc/ad7192.c | 42 +- drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c | 6 drivers/iio/industrialio-core.c | 38 ++ drivers/mmc/core/mmc.c | 2 drivers/mmc/core/sdio.c | 8 drivers/mmc/host/mtk-sd.c | 6 drivers/mmc/host/sdhci-pci-gli.c | 104 +++-- drivers/mtd/maps/physmap-core.c | 11 drivers/mtd/nand/raw/arasan-nand-controller.c | 16 drivers/mtd/nand/raw/marvell_nand.c | 23 + drivers/mtd/nand/raw/pl35x-nand-controller.c | 9 drivers/mtd/nand/raw/qcom_nandc.c | 2 drivers/mtd/nand/spi/micron.c | 2 drivers/net/bonding/bond_main.c | 2 drivers/net/dsa/bcm_sf2.c | 24 - drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_io.c | 36 +- drivers/net/ethernet/intel/i40e/i40e_common.c | 4 drivers/net/ethernet/intel/ice/ice_lib.c | 3 drivers/net/ethernet/intel/ice/ice_main.c | 18 - drivers/net/ethernet/intel/igc/igc.h | 7 drivers/net/ethernet/intel/igc/igc_base.c | 29 + drivers/net/ethernet/intel/igc/igc_base.h | 2 drivers/net/ethernet/intel/igc/igc_defines.h | 1 drivers/net/ethernet/intel/igc/igc_ethtool.c | 1 drivers/net/ethernet/intel/igc/igc_main.c | 20 - drivers/net/ethernet/intel/igc/igc_ptp.c | 57 +-- drivers/net/ethernet/intel/igc/igc_tsn.c | 69 ++- drivers/net/ethernet/marvell/octeon_ep/octep_main.c | 13 drivers/net/ethernet/marvell/sky2.h | 2 drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 2 drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c | 3 drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 17 drivers/net/ethernet/qlogic/qed/qed_ll2.c | 7 drivers/net/phy/bcm7xxx.c | 3 drivers/net/tun.c | 7 drivers/net/usb/smsc95xx.c | 2 drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 3 drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c | 16 drivers/nvme/host/ioctl.c | 10 drivers/nvme/host/pci.c | 3 drivers/nvme/host/rdma.c | 3 drivers/nvme/target/fabrics-cmd-auth.c | 9 drivers/nvme/target/tcp.c | 7 drivers/phy/motorola/phy-mapphone-mdm6600.c | 38 +- drivers/pinctrl/core.c | 16 drivers/platform/surface/surface_platform_profile.c | 3 drivers/platform/x86/asus-nb-wmi.c | 3 drivers/platform/x86/asus-wmi.c | 15 drivers/platform/x86/asus-wmi.h | 2 drivers/platform/x86/intel/uncore-frequency/uncore-frequency-common.c | 8 drivers/platform/x86/touchscreen_dmi.c | 23 + drivers/power/reset/Kconfig | 2 drivers/regulator/core.c | 6 drivers/s390/cio/css.c | 6 drivers/tty/serial/8250/8250_omap.c | 110 ++---- drivers/tty/serial/serial_core.c | 115 +++--- drivers/usb/misc/onboard_usb_hub.c | 5 drivers/usb/misc/onboard_usb_hub.h | 12 drivers/usb/serial/option.c | 7 fs/btrfs/ctree.c | 52 ++ fs/btrfs/delayed-ref.c | 9 fs/btrfs/delayed-ref.h | 1 fs/btrfs/extent-tree.c | 6 fs/btrfs/ioctl.c | 4 fs/btrfs/transaction.c | 6 fs/btrfs/tree-log.c | 2 fs/btrfs/volumes.c | 2 fs/fs-writeback.c | 11 fs/namei.c | 9 fs/nfs/flexfilelayout/flexfilelayout.c | 17 fs/nfs/nfs42proc.c | 3 fs/nfs/nfs4proc.c | 2 fs/nfs/pnfs.c | 33 + fs/ntfs3/fsntfs.c | 6 fs/ntfs3/index.c | 3 fs/ntfs3/xattr.c | 7 fs/overlayfs/copy_up.c | 2 include/linux/fprobe.h | 10 include/linux/fs.h | 2 include/linux/hid.h | 2 include/linux/iio/iio.h | 2 include/linux/kallsyms.h | 8 include/linux/perf_event.h | 1 include/net/bluetooth/hci_core.h | 2 include/net/bluetooth/hci_mon.h | 2 include/net/ip_fib.h | 1 include/net/netns/xfrm.h | 1 include/net/sock.h | 10 include/net/tcp.h | 3 include/trace/events/neigh.h | 4 kernel/auditsc.c | 8 kernel/events/core.c | 39 +- kernel/kallsyms.c | 36 +- kernel/kallsyms_internal.h | 2 kernel/sched/cpufreq_schedutil.c | 3 kernel/trace/bpf_trace.c | 2 kernel/trace/fprobe.c | 32 + kernel/trace/trace_events.c | 1 kernel/trace/trace_kprobe.c | 63 +++ kernel/trace/trace_probe.h | 1 lib/Kconfig.debug | 5 lib/test_fprobe.c | 6 net/bluetooth/hci_conn.c | 72 ++-- net/bluetooth/hci_core.c | 8 net/bluetooth/hci_event.c | 33 + net/bluetooth/hci_sock.c | 3 net/core/dev.c | 65 ++- net/core/dev.h | 3 net/core/pktgen.c | 14 net/core/rtnetlink.c | 4 net/core/stream.c | 12 net/ipv4/af_inet.c | 10 net/ipv4/esp4.c | 4 net/ipv4/fib_semantics.c | 15 net/ipv4/fib_trie.c | 4 net/ipv4/inet_connection_sock.c | 1 net/ipv4/inet_hashtables.c | 24 - net/ipv4/tcp.c | 16 net/ipv4/tcp_bpf.c | 12 net/ipv4/tcp_ipv4.c | 1 net/ipv4/tcp_output.c | 25 + net/ipv4/tcp_recovery.c | 2 net/ipv6/esp6.c | 4 net/ipv6/xfrm6_policy.c | 4 net/mac80211/cfg.c | 3 net/mac80211/ibss.c | 2 net/mac80211/ieee80211_i.h | 1 net/mac80211/mesh_plink.c | 2 net/mac80211/mlme.c | 27 + net/mac80211/tx.c | 3 net/mac80211/vht.c | 16 net/mptcp/protocol.c | 43 +- net/netfilter/nft_payload.c | 2 net/netfilter/nft_set_rbtree.c | 2 net/nfc/nci/spi.c | 2 net/rfkill/rfkill-gpio.c | 4 net/sched/sch_hfsc.c | 18 - net/smc/af_smc.c | 5 net/smc/smc_ib.c | 7 net/smc/smc_ib.h | 2 net/tls/tls_main.c | 10 net/tls/tls_sw.c | 57 ++- net/wireless/core.c | 2 net/wireless/nl80211.c | 2 net/wireless/scan.c | 4 net/xfrm/xfrm_interface_core.c | 22 - net/xfrm/xfrm_policy.c | 21 - samples/fprobe/fprobe_example.c | 6 scripts/kallsyms.c | 5 sound/pci/hda/patch_realtek.c | 27 + sound/soc/codecs/wcd938x-sdw.c | 27 + sound/soc/codecs/wcd938x.c | 50 ++ sound/soc/pxa/pxa-ssp.c | 2 tools/testing/selftests/ftrace/test.d/kprobe/kprobe_non_uniq_symbol.tc | 13 tools/testing/selftests/net/mptcp/mptcp_join.sh | 21 + tools/testing/selftests/net/openvswitch/openvswitch.sh | 4 tools/testing/selftests/net/openvswitch/ovs-dpctl.py | 10 tools/testing/selftests/netfilter/nft_audit.sh | 6 tools/testing/selftests/vm/charge_reserved_hugetlb.sh | 4 tools/testing/selftests/vm/hugetlb_reparenting_test.sh | 4 204 files changed, 2057 insertions(+), 936 deletions(-) Aaron Conole (2): selftests: openvswitch: Catch cases where the tests are killed selftests: openvswitch: Add version check for pyroute2 Albert Huang (1): net/smc: fix smc clc failed issue when netdevice not in init_net Alexander Stein (1): gpio: vf610: make irq_chip immutable Alisa-Dariana Roman (1): iio: adc: ad7192: Correct reference voltage Anand Moon (2): usb: misc: onboard_usb_hub: add Genesys Logic GL852G hub support usb: misc: onboard_usb_hub: add Genesys Logic GL3523 hub support Andy Shevchenko (1): Revert "pinctrl: avoid unsafe code pattern in find_pinctrl()" Arkadiusz Bokowy (1): Bluetooth: vhci: Fix race when opening vhci device Armin Wolf (1): platform/surface: platform_profile: Propagate error if profile registration fails Arnd Bergmann (2): Bluetooth: avoid memcmp() out of bounds warning serial: 8250: omap: convert to modern PM ops Artem Borisov (1): ALSA: hda/realtek: Add quirk for ASUS ROG GU603ZV Avri Altman (1): mmc: core: Capture correct oemid-bits for eMMC cards Ben Greear (1): wifi: iwlwifi: Ensure ack flag is properly cleared. Benjamin Berg (1): wifi: cfg80211: avoid leaking stack data into trace Benoît Monin (1): USB: serial: option: add entry for Sierra EM9191 with new firmware Bibek Kumar Patro (1): mtd: rawnand: qcom: Unmap the right resource upon probe failure Bjorn Helgaas (1): ice: Remove redundant pci_enable_pcie_error_reporting() Borislav Petkov (AMD) (1): x86/sev: Disable MMIO emulation from user mode Chen-Yu Tsai (1): drm/mediatek: Correctly free sg_table in gem prime vmap Chengfeng Ye (1): gpio: timberdale: Fix potential deadlock on &tgpio->lock Christoph Paasch (1): netlink: Correct offload_xstats size Chunhai Guo (1): fs-writeback: do not requeue a clean inode having skipped pages Clément Léger (1): tracing: relax trace_event_eval_update() execution with cond_resched() Dai Ngo (1): nfs42: client needs to strip file mode's suid/sgid bit after ALLOCATE op Damien Le Moal (2): ata: libata-core: Fix compilation warning in ata_dev_config_ncq() ata: libata-eh: Fix compilation warning in ata_eh_link_report() Dan Carpenter (2): net: usb: smsc95xx: Fix an error code in smsc95xx_reset() ASoC: pxa: fix a memory leak in probe() Dan Clash (1): audit,io_uring: io_uring openat triggers audit reference count underflow David Thompson (1): pwr-mlxbf: extend Kconfig to include gpio-mlxbf3 dependency Dinghao Liu (1): s390/cio: fix a memleak in css_alloc_subchannel Dong Chenchen (1): net: xfrm: skip policies marked as dead while reinserting policies Dust Li (1): net/smc: return the right falback reason when prefix checks fail Edward AD (1): Bluetooth: hci_sock: fix slab oob read in create_monitor_event Eric Dumazet (6): xfrm: fix a data-race in xfrm_lookup_with_ifid() xfrm: fix a data-race in xfrm_gen_index() xfrm: interface: use DEV_STATS_INC() tcp: tsq: relax tcp_small_queue_check() when rtx queue contains a single skb tun: prevent negative ifindex ipv4: fib: annotate races around nh->nh_saddr_genid and nh->nh_saddr Fabio Porcedda (1): USB: serial: option: add Telit LE910C4-WWX 0x1035 composition Filipe Manana (5): btrfs: prevent transaction block reserve underflow when starting transaction btrfs: return -EUCLEAN for delayed tree ref with a ref count not equals to 1 btrfs: error out when COWing block using a stale transaction btrfs: error when COWing block from a root that is being deleted btrfs: error out when reallocating block for defrag using a stale transaction Florian Fainelli (1): net: phy: bcm7xxx: Add missing 16nm EPHY statistics Florian Westphal (1): netfilter: nft_payload: fix wrong mac header matching Francis Laniel (2): selftests/ftrace: Add new test case which checks non unique symbol tracing/kprobes: Return EADDRNOTAVAIL when func matches several symbols Gavrilov Ilia (1): net: pktgen: Fix interface flags printing Geert Uytterhoeven (3): neighbor: tracing: Move pin6 inside CONFIG_IPV6=y section mtd: physmap-core: Restore map_rom fallback serial: 8250: omap: Move uart_write() inside PM section Geliang Tang (1): mptcp: avoid sending RST when closing the initial subflow Greg Kroah-Hartman (1): Linux 6.1.60 Gustavo A. R. Silva (1): wifi: mwifiex: Sanity check tlv_len and tlv_bitmap_len Haibo Chen (3): mmc: core: sdio: hold retuning if sdio in 1-bit mode gpio: vf610: set value before the direction to avoid a glitch gpio: vf610: mask the gpio irq in system suspend and support wakeup Hangbin Liu (1): ipv4/fib: send notify when delete source address routes Hannes Reinecke (1): net/tls: split tls_rx_reader_lock Hans de Goede (4): HID: logitech-hidpp: Add Bluetooth ID for the Logitech M720 Triathlon mouse platform/x86: asus-wmi: Change ASUS_WMI_BRN_DOWN code from 0x20 to 0x2e platform/x86: asus-wmi: Only map brightness codes when using asus-wmi backlight control platform/x86: asus-wmi: Map 0x2a code, Ignore 0x2b and 0x2c events Heiner Kallweit (1): i2c: mux: Avoid potential false error message in i2c_mux_add_adapter Hyeonggon Yoo (1): lib/Kconfig.debug: do not enable DEBUG_PREEMPT by default Icenowy Zheng (1): usb: misc: onboard_usb_hub: add Genesys Logic GL850G hub support Ilan Peer (1): wifi: cfg80211: Fix 6GHz scan configuration Ilpo Järvinen (2): serial: Move uart_change_speed() earlier serial: Rename uart_change_speed() to uart_change_line_settings() Jakub Kicinski (4): net: avoid UAF on deleted altname net: fix ifname in netlink ntf during netns move net: check for altname conflicts when changing netdev's netns net: move altnames together with the netdevice Javier Carrasco (1): usb: misc: onboard_hub: add support for Microchip USB2412 USB 2.0 hub Jeff Layton (1): overlayfs: set ctime when setting mtime and atime Jesse Brandeburg (2): ice: fix over-shifted variable ice: reset first in crash dump kernels Jianbo Liu (1): net/mlx5e: Don't offload internal port if filter device is out device Jim Mattson (1): KVM: x86: Mask LVTPC when handling a PMI Jinjie Ruan (1): net: dsa: bcm_sf2: Fix possible memory leak in bcm_sf2_mdio_register() Jiri Wiesner (1): bonding: Return pointer to data after pull on skb Joerg Roedel (2): x86/sev: Check IOBM for IOIO exceptions from user-space x86/sev: Check for user-space IOIO pointing to kernel space Johan Hovold (6): regmap: fix NULL deref on lookup ASoC: codecs: wcd938x-sdw: fix use after free on driver unbind ASoC: codecs: wcd938x-sdw: fix runtime PM imbalance on probe errors ASoC: codecs: wcd938x: drop bogus bind error handling ASoC: codecs: wcd938x: fix unbind tear down order ASoC: codecs: wcd938x: fix resource leaks on bind errors Johannes Berg (2): wifi: cfg80211: use system_unbound_wq for wiphy work wifi: mac80211: work around Cisco AP 9115 VHT MPDU length Josef Bacik (2): btrfs: initialize start_slot in btrfs_log_prealloc_extents btrfs: fix some -Wmaybe-uninitialized warnings in ioctl.c Josua Mayer (1): net: rfkill: gpio: prevent value glitch during probe José Expósito (1): HID: input: map battery system charging Juntong Deng (1): selftests/mm: fix awk usage in charge_reserved_hugetlb.sh and hugetlb_reparenting_test.sh that may cause error Kai Uwe Broulik (1): drm: panel-orientation-quirks: Add quirk for One Mix 2S Kailang Yang (1): ALSA: hda/realtek - Fixed ASUS platform headset Mic issue Kees Cook (2): sky2: Make sure there is at least one frag_addr available Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name Keith Busch (2): nvme: sanitize metadata bounce buffer for reads nvme-pci: add BOGUS_NID for Intel 0a54 device Kenneth Feng (1): drm/amd/pm: add unique_id for gc 11.0.3 Konstantin Komarov (1): fs/ntfs3: fix deadlock in mark_as_free_ex Krzysztof Kozlowski (2): nfc: nci: fix possible NULL pointer dereference in send_acknowledge() dt-bindings: mmc: sdhci-msm: correct minimum number of clocks Kuniyuki Iwashima (1): tcp: Fix listen() warning with v4-mapped-v6 address. Lee, Chun-Yi (2): Bluetooth: hci_event: Ignore NULL link key Bluetooth: Reject connection with the device which has same BD_ADDR Luiz Augusto von Dentz (3): Bluetooth: hci_event: Fix coding style Bluetooth: hci_core: Fix build warnings Bluetooth: hci_event: Fix using memcmp when comparing keys Luka Guzenko (1): ALSA: hda/relatek: Enable Mute LED on HP Laptop 15s-fq5xxx Lukas Wunner (1): serial: Reduce spinlocked portion of uart_rs485_config() Ma Ke (3): net: ipv4: fix return value check in esp_remove_trailer net: ipv6: fix return value check in esp_remove_trailer HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event Maher Sanalla (1): net/mlx5: Handle fw tracer change ownership event based on MTRC Manish Chopra (1): qed: fix LL2 RX buffer allocation Martin Kurbanov (1): mtd: spinand: micron: correct bitmask for ecc status Martino Fontana (1): HID: nintendo: reinitialize USB Pro Controller after resuming from suspend Masami Hiramatsu (Google) (3): fprobe: Pass entry_data to handlers fprobe: Add nr_maxactive to specify rethook_node pool size fprobe: Fix to ensure the number of active retprobes is not zero Matthieu Baerts (2): selftests: mptcp: join: correctly check for no RST selftests: mptcp: join: no RST when rm subflow/addr Matti Vaittinen (1): iio: adc: ad7192: Simplify using devm_regulator_get_enable() Maurizio Lombardi (2): nvmet-auth: complete a request only after freeing the dhchap pointers nvme-rdma: do not try to stop unallocated queues Maxim Levitsky (2): x86: KVM: SVM: add support for Invalid IPI Vector interception x86: KVM: SVM: refresh AVIC inhibition in svm_leave_nested() Michal Schmidt (1): i40e: prevent crash on probe if hw registers have invalid values Michał Mirosław (1): regulator/core: Revert "fix kobject release warning and memory leak in regulator_register()" Miquel Raynal (3): mtd: rawnand: pl353: Ensure program page operations are successful mtd: rawnand: marvell: Ensure program page operations are successful mtd: rawnand: arasan: Ensure program page operations are successful Muhammad Husaini Zulkifli (4): igc: remove I226 Qbv BaseTime restriction igc: Remove reset adapter task for i226 during disable tsn config igc: Add qbv_config_change_errors counter igc: Add condition for qbv_config_change_errors counter Neal Cardwell (1): tcp: fix excessive TLP and RACK timeouts from HZ rounding Niklas Schnelle (1): s390/pci: fix iommu bitmap allocation Nuno Sá (1): iio: core: introduce iio_device_{claim|release}_buffer_mode() APIs Olga Kornievskaia (1): NFSv4.1: fixup use EXCHGID4_FLAG_USE_PNFS_DS for DS server Pablo Neira Ayuso (3): netfilter: nft_set_rbtree: .deactivate fails if element has expired netfilter: nf_tables: do not remove elements if set backend implements .abort netfilter: nf_tables: revert do not remove elements if set backend implements .abort Pablo Sun (1): mmc: mtk-sd: Use readl_poll_timeout_atomic in msdc_reset_hw Paolo Abeni (4): tcp: check mptcp-level constraints for backlog coalescing mptcp: more conservative check for zero probes tcp: allow again tcp_disconnect() when threads are waiting tcp_bpf: properly release resources on error paths Pedro Tammela (1): net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve Peter Zijlstra (1): perf: Disallow mis-matched inherited group reads Phil Sutter (1): selftests: netfilter: Run nft_audit.sh in its own netns Puliang Lu (1): USB: serial: option: add Fibocom to DELL custom modem FM101R-GL Rahul Rameshbabu (1): HID: multitouch: Add required quirk for Synaptics 0xcd7e device Renan Guilherme Lebre Ramos (1): platform/x86: touchscreen_dmi: Add info for the Positivo C4128B Rocky Liao (1): Bluetooth: btusb: add shutdown function for QCA6174 Sagi Grimberg (1): nvmet-tcp: Fix a possible UAF in queue intialization setup Sean Christopherson (3): x86/fpu: Allow caller to constrain xfeatures when copying to uabi buffer KVM: x86: Constrain guest-supported xfeatures only at KVM_GET_XSAVE{2} KVM: x86/mmu: Stop zapping invalidated TDP MMU roots asynchronously Shay Drory (1): net/mlx5: E-switch, register event handler before arming the event Shinas Rasheed (1): octeon_ep: update BQL sent bytes before ringing doorbell Srinivas Pandruvada (1): platform/x86: intel-uncore-freq: Conditionally create attribute for read frequency Stephen Boyd (1): drm/bridge: ti-sn65dsi86: Associate DSI device lifetime with auxiliary device Sunil V L (1): ACPI: irq: Fix incorrect return value in acpi_register_gsi() Sven van Ashbrook (1): mmc: sdhci-pci-gli: fix LPM negotiation so x86/S0ix SoCs can suspend Tan Tee Min (1): igc: enable Qbv configuration for 2nd GCL Tony Lindgren (6): serial: 8250: omap: Fix imprecise external abort for omap_8250_pm() serial: 8250_omap: Fix errors with no_console_suspend ARM: dts: ti: omap: Fix noisy serial with overrun-throttle-ms for mapphone phy: mapphone-mdm6600: Fix runtime disable on probe phy: mapphone-mdm6600: Fix runtime PM for remove phy: mapphone-mdm6600: Fix pinctrl_pm handling for sleep pins Trond Myklebust (2): pNFS: Fix a hang in nfs4_evict_inode() pNFS/flexfiles: Check the layout validity in ff_layout_mirror_prepare_stats Tzung-Bi Shih (1): iio: cros_ec: fix an use-after-free in cros_ec_sensors_push_data() Ville Syrjälä (1): drm/i915: Retry gtt fault when out of fence registers Vinicius Costa Gomes (1): igc: Fix race condition in PTP tx code Wen Gong (1): wifi: mac80211: allow transmitting EAPOL frames with tainted key Xuewen Yan (1): cpufreq: schedutil: Update next_freq when cpufreq_limits change Ying Hsu (1): Bluetooth: Avoid redundant authentication Zeng Heng (1): fs/ntfs3: fix panic about slab-out-of-bounds caused by ntfs_list_ea() Zhang Changzhong (1): xfrm6: fix inet6_dev refcount underflow problem Zhen Lei (2): kallsyms: Reduce the memory occupied by kallsyms_seqs_of_names[] kallsyms: Add helper kallsyms_on_each_match_symbol() Ziqi Zhao (1): fs/ntfs3: Fix possible null-pointer dereference in hdr_find_e() Ziyang Xuan (1): Bluetooth: Fix a refcnt underflow problem for hci_conn Zygo Blaxell (1): btrfs: fix stripe length calculation for non-zoned data chunk allocation

2 years

1
1
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror