2022-06-13 16:30:55

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.18 000/339] 5.18.4-rc1 review

This is the start of the stable review cycle for the 5.18.4 release.
There are 339 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.

Responses should be made by Wed, 15 Jun 2022 09:47:08 +0000.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.18.4-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.18.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>
Linux 5.18.4-rc1

Damien Le Moal <[email protected]>
zonefs: fix handling of explicit_open option on mount

Pascal Hambourg <[email protected]>
md/raid0: Ignore RAID0 layout if the second zone has only one device

Jason A. Donenfeld <[email protected]>
random: account for arch randomness in bits

Jason A. Donenfeld <[email protected]>
random: mark bootloader randomness code as __init

Jason A. Donenfeld <[email protected]>
random: avoid checking crng_ready() twice in random_init()

Michael Ellerman <[email protected]>
powerpc/32: Fix overread/overwrite of thread_struct via ptrace

Jason Wang <[email protected]>
virtio-rng: make device ready before making request

Alex Deucher <[email protected]>
drm/amdgpu: update VCN codec support for Yellow Carp

Aurabindo Pillai <[email protected]>
drm/amd/display: remove stale config guards

Mohammad Zafar Ziya <[email protected]>
drm/amdgpu/jpeg2: Add jpeg vmid update under IB submit

Brian Norris <[email protected]>
drm/atomic: Force bridge self-refresh-exit on CRTC switch

Brian Norris <[email protected]>
drm/bridge: analogix_dp: Support PSR-exit to disable transition

Jesse Zhang <[email protected]>
drm/amdkfd:Fix fw version for 10.3.6

Michael Ellerman <[email protected]>
powerpc: Don't select HAVE_IRQ_EXIT_ON_IRQ_STACK

Matthew Wilcox (Oracle) <[email protected]>
mm/huge_memory: Fix xarray node memory leak

Peter Zijlstra <[email protected]>
cpuidle,intel_idle: Fix CPUIDLE_FLAG_IRQ_ENABLE

Xie Yongji <[email protected]>
vduse: Fix NULL pointer dereference on sysfs access

Mathias Nyman <[email protected]>
Input: bcm5974 - set missing URB_NO_TRANSFER_DMA_MAP urb flag

Olivier Matz <[email protected]>
ixgbe: fix unexpected VLAN Rx in promisc mode on VF

Olivier Matz <[email protected]>
ixgbe: fix bcast packets Rx on VF after promisc removal

Martin Faltesek <[email protected]>
nfc: st21nfca: fix incorrect sizing calculations in EVT_TRANSACTION

Martin Faltesek <[email protected]>
nfc: st21nfca: fix memory leaks in EVT_TRANSACTION handling

Martin Faltesek <[email protected]>
nfc: st21nfca: fix incorrect validating logic in EVT_TRANSACTION

Jchao Sun <[email protected]>
writeback: Fix inode->i_io_list not be protected by inode->i_lock error

Ilya Maximets <[email protected]>
net: openvswitch: fix misuse of the cached connection on tuple changes

Tan Tee Min <[email protected]>
net: phy: dp83867: retrigger SGMII AN when link change

Adrian Hunter <[email protected]>
mmc: block: Fix CQE recovery reset success

Ben Chuang <[email protected]>
mmc: sdhci-pci-gli: Fix GL9763E runtime PM when the system resumes from suspend

Sergey Shtylyov <[email protected]>
ata: libata-transport: fix {dma|pio|xfer}_mode sysfs files

Tyler Erickson <[email protected]>
libata: fix translation of concurrent positioning ranges

Tyler Erickson <[email protected]>
libata: fix reading concurrent positioning ranges log

David Safford <[email protected]>
KEYS: trusted: tpm2: Fix migratable logic

Matthew Wilcox (Oracle) <[email protected]>
filemap: Cache the value of vm_flags

Maxim Levitsky <[email protected]>
KVM: SVM: fix tsc scaling cache logic

Shaoqin Huang <[email protected]>
KVM: x86/mmu: Check every prev_roots in __kvm_mmu_free_obsolete_roots()

James Smart <[email protected]>
scsi: lpfc: Address NULL pointer dereference after starget_to_rport()

James Smart <[email protected]>
scsi: lpfc: Resolve some cleanup issues following SLI path refactoring

James Smart <[email protected]>
scsi: lpfc: Resolve some cleanup issues following abort path refactoring

Tyler Erickson <[email protected]>
scsi: sd: Fix interpretation of VPD B9h length

Shyam Prasad N <[email protected]>
cifs: populate empty hostnames for extra channels

Paulo Alcantara <[email protected]>
cifs: fix reconnect on smb3 mount types

Shyam Prasad N <[email protected]>
cifs: return errors during session setup during reconnects

Jeremy Soller <[email protected]>
ALSA: hda/realtek: Add quirk for HP Dev One

Cameron Berkenpas <[email protected]>
ALSA: hda/realtek: Fix for quirk to enable speaker output on the Lenovo Yoga DuetITL 2021

huangwenhui <[email protected]>
ALSA: hda/conexant - Fix loopback issue with CX20632

Takashi Iwai <[email protected]>
ALSA: usb-audio: Set up (implicit) sync for Saffire 6

Takashi Iwai <[email protected]>
ALSA: usb-audio: Skip generic sync EP parse for secondary EP

Bedant Patnaik <[email protected]>
platform/x86: hp-wmi: Use zero insize parameter only when supported

Jorge Lopez <[email protected]>
platform/x86: hp-wmi: Resolve WMI query failures on some devices

Kuan-Ying Lee <[email protected]>
scripts/gdb: change kernel config dumping method

Jiasheng Jiang <[email protected]>
platform/x86: barco-p50-gpio: Add check for platform_driver_register

Xie Yongji <[email protected]>
vringh: Fix loop descriptors check in the indirect cases

James Smart <[email protected]>
scsi: lpfc: Correct BDE type for XMIT_SEQ64_WQE in lpfc_ct_reject_event()

Kees Cook <[email protected]>
nodemask: Fix return values to be unsigned

Yury Norov <[email protected]>
drm/amd/pm: use bitmap_{from,to}_arr32 where appropriate

Steve French <[email protected]>
cifs: version operations for smb20 unneeded when legacy support disabled

Christian Borntraeger <[email protected]>
s390/gmap: voluntarily schedule during key setting

Vincent Whitchurch <[email protected]>
cifs: fix potential deadlock in direct reclaim

Bjorn Helgaas <[email protected]>
Revert "PCI: brcmstb: Split brcm_pcie_setup() into two funcs"

Bjorn Helgaas <[email protected]>
Revert "PCI: brcmstb: Add mechanism to turn on subdev regulators"

Bjorn Helgaas <[email protected]>
Revert "PCI: brcmstb: Add control of subdevice voltage regulators"

Bjorn Helgaas <[email protected]>
Revert "PCI: brcmstb: Do not turn off WOL regulators on suspend"

Yu Kuai <[email protected]>
nbd: fix io hung while disconnecting device

Yu Kuai <[email protected]>
nbd: fix race between nbd_alloc_config() and module removal

Yu Kuai <[email protected]>
nbd: call genl_unregister_family() first in nbd_cleanup()

Peter Zijlstra <[email protected]>
jump_label,noinstr: Avoid instrumentation for JUMP_LABEL=n builds

Peter Zijlstra <[email protected]>
x86/cpu: Elide KCSAN for cpu_has() and friends

Peter Zijlstra <[email protected]>
objtool: Mark __ubsan_handle_builtin_unreachable() as noreturn

Masahiro Yamada <[email protected]>
modpost: fix undefined behavior of is_arm_mapping_symbol()

Johannes Berg <[email protected]>
um: line: Use separate IRQs per line

Evan Quan <[email protected]>
drm/amd/pm: correct the metrics version for SMU 11.0.11/12/13

Lijo Lazar <[email protected]>
drm/amd/pm: Fix missing thermal throttler status

Gong Yuanjun <[email protected]>
drm/amd/pm: fix a potential gpu_metrics_table memory leak

Gong Yuanjun <[email protected]>
drm/radeon: fix a possible null pointer dereference

Nicholas Kazlauskas <[email protected]>
drm/amd/display: Check zero planes for OTG disable W/A on clock change

David Galiffi <[email protected]>
drm/amd/display: Check if modulo is 0 before dividing.

Daniel Borkmann <[email protected]>
net, neigh: Set lower cap for neigh_managed_work rearming

Xiubo Li <[email protected]>
ceph: fix possible deadlock when holding Fwb to get inline_data

Xiubo Li <[email protected]>
ceph: flush the mdlog for filesystem sync

Venky Shankar <[email protected]>
ceph: allow ceph.dir.rctime xattr to be updatable

Michal Kubecek <[email protected]>
Revert "net: af_key: add check for pfkey_broadcast in function pfkey_process"

Oder Chiou <[email protected]>
ASoC: rt5640: Do not manipulate pin "Platform Clock" if the "Platform Clock" is not in the DAPM

Hannes Reinecke <[email protected]>
scsi: myrb: Fix up null pointer access on myrb_cleanup()

Syed Saba kareem <[email protected]>
ASoC: SOF: amd: Fixed Build error

Guoqing Jiang <[email protected]>
md: protect md_unregister_thread from reentrancy

Hyunchul Lee <[email protected]>
ksmbd: smbd: fix connection dropped issue

Liu Xinpeng <[email protected]>
watchdog: wdat_wdt: Stop watchdog when rebooting the system

Hao Luo <[email protected]>
kernfs: Separate kernfs_pr_cont_buf and rename_lock.

John Ogness <[email protected]>
serial: msm_serial: disable interrupts in __msm_console_write()

Wang Cheng <[email protected]>
staging: rtl8712: fix uninit-value in r871xu_drv_init()

Wang Cheng <[email protected]>
staging: rtl8712: fix uninit-value in usb_read8() and friends

Andre Przywara <[email protected]>
clocksource/drivers/sp804: Avoid error on multiple instances

bumwoo lee <[email protected]>
extcon: Modify extcon device to be created after driver data is set

Dan Carpenter <[email protected]>
extcon: Fix extcon_get_extcon_dev() error handling

Shuah Khan <[email protected]>
misc: rtsx: set NULL intfdata when probe fails

Srinivas Kandagatla <[email protected]>
soundwire: qcom: adjust autoenumeration timeout

Thinh Nguyen <[email protected]>
usb: dwc3: gadget: Only End Transfer for ep0 data phase

Heikki Krogerus <[email protected]>
usb: dwc3: host: Stop setting the ACPI companion

Marek Szyprowski <[email protected]>
usb: dwc2: gadget: don't reset gadget's driver->bus

Changbin Du <[email protected]>
sysrq: do not omit current cpu when showing backtrace of all active CPUs

Hangyu Hua <[email protected]>
char: xillybus: fix a refcount leak in cleanup_dev()

Evan Green <[email protected]>
USB: hcd-pci: Fully suspend across freeze/thaw cycle

Duoming Zhou <[email protected]>
drivers: usb: host: Fix deadlock in oxu_bus_suspend()

Duoming Zhou <[email protected]>
drivers: tty: serial: Fix deadlock in sa1100_set_termios()

Zhen Ni <[email protected]>
USB: host: isp116x: check return value after calling platform_get_resource()

Duoming Zhou <[email protected]>
drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop()

Duoming Zhou <[email protected]>
drivers: staging: rtl8192u: Fix deadlock in ieee80211_beacons_stop()

Mika Westerberg <[email protected]>
thunderbolt: Use different lane for second DisplayPort tunnel

Huang Guobin <[email protected]>
tty: Fix a possible resource leak in icom_probe

Zheyu Ma <[email protected]>
tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()

Duoming Zhou <[email protected]>
drivers: staging: rtl8192eu: Fix deadlock in rtw_joinbss_event_prehandle

Duoming Zhou <[email protected]>
drivers: staging: rtl8192bs: Fix deadlock in rtw_joinbss_event_prehandle()

Duoming Zhou <[email protected]>
drivers: staging: rtl8723bs: Fix deadlock in rtw_surveydone_event_callback()

Kees Cook <[email protected]>
lkdtm/usercopy: Expand size of "out of frame" object

Miquel Raynal <[email protected]>
iio: st_sensors: Add a local lock for protecting odr

Xiaoke Wang <[email protected]>
staging: rtl8712: fix a potential memory leak in r871xu_drv_init()

Xiaoke Wang <[email protected]>
iio: dummy: iio_simple_dummy: check the return value of kstrdup()

David Howells <[email protected]>
iov_iter: Fix iter_xarray_get_pages{,_alloc}()

Andrea Mayer <[email protected]>
net: seg6: fix seg6_lookup_any_nexthop() to handle VRFs using flowi_l3mdev

Etienne van der Linde <[email protected]>
nfp: flower: restructure flow-key for gre+vlan combination

Linus Torvalds <[email protected]>
drm: imx: fix compiler warning with gcc-12

Muchun Song <[email protected]>
tcp: use alloc_large_system_hash() to allocate table_perturb

Alvin Šipraga <[email protected]>
net: dsa: realtek: rtl8365mb: fix GMII caps for ports with internal PHY

Marek Behún <[email protected]>
net: dsa: mv88e6xxx: use BMSR_ANEGCOMPLETE bit for filling an_complete

Miaoqian Lin <[email protected]>
net: altera: Fix refcount leak in altera_tse_mdio_create

Willem de Bruijn <[email protected]>
ip_gre: test csum_start instead of transport header

Mark Bloch <[email protected]>
net/mlx5: fs, fail conflicting actions

Feras Daoud <[email protected]>
net/mlx5: Rearm the FW tracer after each tracer event

Saeed Mahameed <[email protected]>
net/mlx5: Fix mlx5_get_next_dev() peer device matching

Mark Bloch <[email protected]>
net/mlx5: Lag, filter non compatible devices

Paul Blakey <[email protected]>
net/mlx5e: CT: Fix cleanup of CT before cleanup of TC ct rules

Masahiro Yamada <[email protected]>
net: ipv6: unexport __init-annotated seg6_hmac_init()

Masahiro Yamada <[email protected]>
net: xfrm: unexport __init-annotated xfrm4_protocol_init()

Masahiro Yamada <[email protected]>
net: mdio: unexport __init-annotated mdio_bus_init()

Chuck Lever <[email protected]>
SUNRPC: Fix the calculation of xdr->end in xdr_get_next_encode_buffer()

Christian König <[email protected]>
drm/amdgpu: fix limiting AV1 to the first instance on VCN3

Maciej Fijalkowski <[email protected]>
xsk: Fix handling of invalid descriptors in XSK TX batching API

Gal Pressman <[email protected]>
net/mlx4_en: Fix wrong return value on ioctl EEPROM query failure

Miaoqian Lin <[email protected]>
net: dsa: lantiq_gswip: Fix refcount leak in gswip_gphy_fw_list

Eric Dumazet <[email protected]>
bpf, arm64: Clear prog->jited_len along prog->jited

Jan Beulich <[email protected]>
x86: drop bogus "cc" clobber from __try_cmpxchg_user_asm()

Lina Wang <[email protected]>
selftests net: fix bpf build error

Kuniyuki Iwashima <[email protected]>
af_unix: Fix a data-race in unix_dgram_peer_wake_me().

Christophe JAILLET <[email protected]>
stmmac: intel: Fix an error handling path in intel_eth_pci_probe()

Masahiro Yamada <[email protected]>
xen: unexport __init-annotated xen_xlate_map_ballooned_pages()

Miaoqian Lin <[email protected]>
net: ethernet: bgmac: Fix refcount leak in bcma_mdio_mii_register

Taehee Yoo <[email protected]>
amt: fix wrong type string definition

Taehee Yoo <[email protected]>
amt: fix possible null-ptr-deref in amt_rcv()

Taehee Yoo <[email protected]>
amt: fix wrong usage of pskb_may_pull()

Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: bail out early if hardware offload is not supported

Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: memleak flow rule from commit path

Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: release new hooks on unsupported flowtable flags

Miaoqian Lin <[email protected]>
ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe

Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: always initialize flowtable hook list in transaction

Chuck Lever <[email protected]>
SUNRPC: Trap RDMA segment overflows

Chuck Lever <[email protected]>
NFSD: Fix potential use-after-free in nfsd_file_put()

Michael Ellerman <[email protected]>
powerpc/kasan: Force thread size increase with KASAN

Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: delete flowtable hooks via transaction list

Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: use kfree_rcu(ptr, rcu) to release hooks in clean_net path

Florian Westphal <[email protected]>
netfilter: nat: really support inet nat without l3 address

Vaibhav Jain <[email protected]>
powerpc/papr_scm: don't requests stats with '0' sized stats buffer

Steven Price <[email protected]>
drm/panfrost: Job should reference MMU not file_priv

Marek Vasut <[email protected]>
drm/bridge: ti-sn65dsi83: Handle dsi_lanes == 0 as invalid

Kinglong Mee <[email protected]>
xprtrdma: treat all calls not a bcall when bc_serv is NULL

Chao Yu <[email protected]>
f2fs: fix to tag gcing flag on page during file defragment

Daniel Bristot de Oliveira <[email protected]>
rtla/Makefile: Properly handle dependencies

Greg Ungerer <[email protected]>
m68knommu: fix undefined reference to `mach_get_rtc_pll'

Liao Chang <[email protected]>
RISC-V: use memcpy for kexec_file mode

Yang Yingliang <[email protected]>
video: fbdev: pxa3xx-gcu: release the resources correctly in pxa3xx_gcu_probe/remove()

Saurabh Sengar <[email protected]>
video: fbdev: hyperv_fb: Allow resolutions with size > 64 MB for Gen1

Trond Myklebust <[email protected]>
NFSv4: Don't hold the layoutget locks across multiple RPC calls

Radhey Shyam Pandey <[email protected]>
dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type

Greg Ungerer <[email protected]>
m68knommu: fix undefined reference to `_init_sp'

Greg Ungerer <[email protected]>
m68knommu: set ZERO_PAGE() to the allocated zeroed page

Lucas Tanure <[email protected]>
i2c: cadence: Increase timeout per message if necessary

Jaegeuk Kim <[email protected]>
f2fs: avoid infinite loop to flush node pages

Dongliang Mu <[email protected]>
f2fs: remove WARN_ON in f2fs_is_valid_blkaddr

Yang Yingliang <[email protected]>
iommu/arm-smmu-v3: check return value after calling platform_get_resource()

Yang Yingliang <[email protected]>
iommu/arm-smmu: fix possible null-ptr-deref in arm_smmu_device_probe()

AngeloGioacchino Del Regno <[email protected]>
i2c: mediatek: Optimize master_xfer() and avoid circular locking

Mark-PK Tsai <[email protected]>
tracing: Avoid adding tracer option before update_tracer_options

Jun Miao <[email protected]>
tracing: Fix sleeping function called from invalid context on RT kernel

Jeff Xie <[email protected]>
tracing: Make tp_printk work on syscall tracepoints

Masami Hiramatsu <[email protected]>
bootconfig: Make the bootconfig.o as a normal object file

Gong Yuanjun <[email protected]>
mips: cpc: Fix refcount leak in mips_cpc_default_phys_base

Dave Jiang <[email protected]>
dmaengine: idxd: set DMA_INTERRUPT cap bit

Linus Torvalds <[email protected]>
bluetooth: don't use bitmaps for random flag accesses

Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_sync: Fix attempting to suspend with unfiltered passive scan

Luiz Augusto von Dentz <[email protected]>
Bluetooth: MGMT: Add conditions for setting HCI_CONN_FLAG_REMOTE_WAKEUP

Leo Yan <[email protected]>
perf c2c: Fix sorting in percent_rmt_hitm_cmp()

Zhengjun Xing <[email protected]>
perf record: Support sample-read topdown metric group for hybrid platforms

Kan Liang <[email protected]>
perf parse-events: Move slots event for the hybrid platform too

Kan Liang <[email protected]>
perf evsel: Fixes topdown events in a weak group for the hybrid platform

Saravana Kannan <[email protected]>
driver core: Fix wait_for_device_probe() & deferred_probe_timeout interaction

Hoang Le <[email protected]>
tipc: check attribute length for bearer name

Fei Qin <[email protected]>
nfp: remove padding in nfp_nfdk_tx_desc

Duoming Zhou <[email protected]>
ax25: Fix ax25 session cleanup problems

Damien Le Moal <[email protected]>
scsi: sd: Fix potential NULL pointer dereference

Kuogee Hsieh <[email protected]>
drm/msm/dp: Always clear mask bits to disable interrupts at dp_ctrl_reset_irq_ctrl()

David Howells <[email protected]>
afs: Fix infinite loop found by xfstest generic/676

Haibo Chen <[email protected]>
gpio: pca953x: use the correct register address to do regcache sync

Dan Carpenter <[email protected]>
net/sched: act_api: fix error code in tcf_ct_flow_table_fill_tuple_ipv6()

Aya Levin <[email protected]>
net: ping6: Fix ping -6 with interface name

Fabien Parent <[email protected]>
regulator: mt6315-regulator: fix invalid allowed mode

Alexander Gordeev <[email protected]>
s390/mcck: isolate SIE instruction when setting CIF_MCCK_GUEST flag

Dan Carpenter <[email protected]>
octeontx2-af: fix error code in is_valid_offset()

Hangbin Liu <[email protected]>
bonding: guard ns_targets by CONFIG_IPV6

Jason Wang <[email protected]>
vdpa: ifcvf: set pci driver data in probe

Eric Dumazet <[email protected]>
tcp: tcp_rtx_synack() can be called from process context

Guoju Fang <[email protected]>
net: sched: add barrier to fix packet stuck problem for lockless qdisc

Maxim Mikityanskiy <[email protected]>
net/mlx5e: Update netdev features after changing XDP state

Changcheng Liu <[email protected]>
net/mlx5: correct ECE offset in query qp output

Maxim Mikityanskiy <[email protected]>
net/mlx5e: Disable softirq in mlx5e_activate_rq to avoid race condition

Paul Blakey <[email protected]>
net/mlx5: CT: Fix header-rewrite re-use for tupels

Maor Dickman <[email protected]>
net/mlx5e: TC NIC mode, fix tc chains miss table

Leon Romanovsky <[email protected]>
net/mlx5: Don't use already freed action pointer

Christophe JAILLET <[email protected]>
virtio: pci: Fix an error handling path in vp_modern_probe()

Eli Cohen <[email protected]>
vdpa: Fix error logic in vdpa_nl_cmd_dev_get_doit

Weizhao Ouyang <[email protected]>
erofs: fix 'backmost' member of z_erofs_decompress_frontend

Hangbin Liu <[email protected]>
bonding: show NS IPv6 targets in proc master info

Viorel Suman <[email protected]>
net: phy: at803x: disable WOL at probe

Haisu Wang <[email protected]>
blk-mq: do not update io_ticks with passthrough requests

Peter Zijlstra <[email protected]>
sched/autogroup: Fix sysctl move

Jens Axboe <[email protected]>
block: make bioset_exit() fully resilient against being called twice

Íñigo Huguet <[email protected]>
sfc: fix wrong tx channel offset with efx_separate_tx_channels

Martin Habets <[email protected]>
sfc: fix considering that all channels have TX queues

Hangbin Liu <[email protected]>
bonding: NS target should accept link local address

Christoph Hellwig <[email protected]>
block: use bio_queue_enter instead of blk_queue_enter in bio_poll

Yu Xiao <[email protected]>
nfp: only report pause frame configuration for physical device

Eric Dumazet <[email protected]>
tcp: add accessors to read/set tp->snd_cwnd

Guangguan Wang <[email protected]>
net/smc: fixes for converting from "struct smc_cdc_tx_pend **" to "struct smc_wr_tx_pend_priv *"

Heinrich Schuchardt <[email protected]>
riscv: read-only pages should not be writable

Zhang Wensheng <[email protected]>
nbd: fix possible overflow on 'first_minor' in nbd_dev_add()

Yu Kuai <[email protected]>
nbd: don't clear 'NBD_CMD_INFLIGHT' flag if request is not completed

Christoph Hellwig <[email protected]>
block: take destination bvec offsets into account in bio_copy_data_iter

Menglong Dong <[email protected]>
bpf: Fix probe read error in ___bpf_prog_run()

Song Liu <[email protected]>
selftests/bpf: fix stacktrace_build_id with missing kprobe/urandom_read

Zhihao Cheng <[email protected]>
ubi: ubi_create_volume: Fix use-after-free when volume creation failed

Zhihao Cheng <[email protected]>
ubi: fastmap: Fix high cpu usage of ubi_bgt by making sure wl_pool not empty

Baokun Li <[email protected]>
jffs2: fix memory leak in jffs2_do_fill_super

Genjian Zhang <[email protected]>
ep93xx: clock: Do not return the address of the freed memory

Christoph Hellwig <[email protected]>
block, loop: support partitions without scanning

Alexander Lobakin <[email protected]>
modpost: fix removing numeric suffixes

Miaoqian Lin <[email protected]>
net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register

Miaoqian Lin <[email protected]>
net: ethernet: ti: am65-cpsw-nuss: Fix some refcount leaks

Dan Carpenter <[email protected]>
net: ethernet: mtk_eth_soc: out of bounds read in mtk_hwlro_get_fdir_entry()

Vincent Ray <[email protected]>
net: sched: fixed barrier to prevent skbuff sticking in qdisc backlog

Michael Walle <[email protected]>
net: lan966x: check devm_of_phy_get() for -EDEFER_PROBE

Dan Carpenter <[email protected]>
drm/amdgpu: Off by one in dm_dmub_outbox1_low_irq()

Eddie James <[email protected]>
spi: fsi: Fix spurious timeout

liuyacan <[email protected]>
net/smc: set ini->smcrv2.ib_dev_v2 to NULL if SMC-Rv2 is unavailable

Siddharth Vadapalli <[email protected]>
net: ethernet: ti: am65-cpsw: Fix fwnode passed to phylink_create()

Taehee Yoo <[email protected]>
amt: fix possible memory leak in amt_rcv()

Taehee Yoo <[email protected]>
amt: fix return value of amt_update_handler()

Jann Horn <[email protected]>
s390/crypto: fix scatterwalk_unmap() callers in AES-GCM

Krzysztof Kozlowski <[email protected]>
clocksource/drivers/oxnas-rps: Fix irq_of_parse_and_map() return value

Christoph Hellwig <[email protected]>
scsi: sd: Don't call blk_cleanup_disk() in sd_probe()

Shengjiu Wang <[email protected]>
ASoC: fsl_sai: Fix FSL_SAI_xDR/xFR definition

Ming Lei <[email protected]>
blk-mq: don't touch ->tagset in blk_mq_get_sq_hctx

Miaoqian Lin <[email protected]>
watchdog: ts4800_wdt: Fix refcount leak in ts4800_wdt_probe

Miaoqian Lin <[email protected]>
watchdog: rti-wdt: Fix pm_runtime_get_sync() error checking

Zhang Wensheng <[email protected]>
driver core: fix deadlock in __device_attach

Schspa Shi <[email protected]>
driver: base: fix UAF when driver_attach failed

Tony Lindgren <[email protected]>
bus: ti-sysc: Fix warnings for unbind for serial

Miaoqian Lin <[email protected]>
firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle

Ilpo Järvinen <[email protected]>
serial: stm32-usart: Correct CSIZE, bits, and parity

Ilpo Järvinen <[email protected]>
serial: st-asc: Sanitize CSIZE and correct PARENB for CS7

Ilpo Järvinen <[email protected]>
serial: sifive: Sanitize CSIZE and c_iflag

Ilpo Järvinen <[email protected]>
serial: sh-sci: Don't allow CS5-6

Ilpo Järvinen <[email protected]>
serial: txx9: Don't allow CS5-6

Ilpo Järvinen <[email protected]>
serial: rda-uart: Don't allow CS5-6

Ilpo Järvinen <[email protected]>
serial: digicolor-usart: Don't allow CS5-6

Ilpo Järvinen <[email protected]>
serial: uartlite: Fix BRKINT clearing

YueHaibing <[email protected]>
serial: cpm_uart: Fix build error without CONFIG_SERIAL_CPM_CONSOLE

Ilpo Järvinen <[email protected]>
serial: 8250_fintek: Check SER_RS485_RTS_* only with RS485

AngeloGioacchino Del Regno <[email protected]>
Revert "serial: 8250_mtk: Make sure to select the right FEATURE_SEL"

John Ogness <[email protected]>
serial: meson: acquire port->lock in startup()

Jiasheng Jiang <[email protected]>
staging: r8188eu: add check for kzalloc

Miaoqian Lin <[email protected]>
rtc: ftrtc010: Fix error handling in ftrtc010_rtc_probe

Yang Yingliang <[email protected]>
rtc: mt6397: check return value after calling platform_get_resource()

Howard Chiu <[email protected]>
ARM: dts: aspeed: ast2600-evb: Enable RX delay for MAC0/MAC1

Samuel Holland <[email protected]>
clocksource/drivers/riscv: Events are stopped during CPU suspend

Miaoqian Lin <[email protected]>
soc: rockchip: Fix refcount leak in rockchip_grf_init

Nícolas F. R. A. Prado <[email protected]>
dt-bindings: remoteproc: mediatek: Make l1tcm reg exclusive to mt819x

Li Jun <[email protected]>
extcon: ptn5150: Add queue work sync before driver release

Xin Xiong <[email protected]>
ksmbd: fix reference count leak in smb_check_perm_dacl()

Guilherme G. Piccoli <[email protected]>
coresight: cpu-debug: Replace mutex with mutex_trylock on panic notifier

Pierre-Louis Bossart <[email protected]>
soundwire: qcom: return error when pm_runtime_get_sync fails

Pierre-Louis Bossart <[email protected]>
soundwire: intel: prevent pm_runtime resume prior to system suspend

Biju Das <[email protected]>
watchdog: rzg2l_wdt: Fix reset control imbalance

Biju Das <[email protected]>
watchdog: rzg2l_wdt: Fix 'BUG: Invalid wait context'

Biju Das <[email protected]>
watchdog: rzg2l_wdt: Fix Runtime PM usage

Biju Das <[email protected]>
watchdog: rzg2l_wdt: Fix 32bit overflow issue

Greg Kroah-Hartman <[email protected]>
export: fix string handling of namespace in EXPORT_SYMBOL_NS

Maciej W. Rozycki <[email protected]>
serial: sifive: Report actual baud base rather than fixed 115200

Linus Walleij <[email protected]>
power: supply: ab8500_fg: Allocate wq in probe

Hans de Goede <[email protected]>
power: supply: axp288_fuel_gauge: Drop BIOS version check from "T3 MRD" DMI quirk

Hans de Goede <[email protected]>
power: supply: axp288_fuel_gauge: Fix battery reporting on the One Mix 1

Linus Walleij <[email protected]>
power: supply: core: Initialize struct to zero

Johan Hovold <[email protected]>
phy: qcom-qmp: fix pipe-clock imbalance on power-on failure

Guilherme G. Piccoli <[email protected]>
misc/pvpanic: Convert regular spinlock into trylock on panic path

Krzysztof Kozlowski <[email protected]>
rpmsg: qcom_smd: Fix returning 0 if irq_of_parse_and_map() fails

Cixi Geng <[email protected]>
iio: adc: sc27xx: Fine tune the scale calibration values

Cixi Geng <[email protected]>
iio: adc: sc27xx: fix read big scale voltage not right

Miaoqian Lin <[email protected]>
iio: proximity: vl53l0x: Fix return value check of wait_for_completion_timeout

Miaoqian Lin <[email protected]>
iio: adc: stmpe-adc: Fix wait_for_completion_timeout return value check

Arnaud Pouliquen <[email protected]>
rpmsg: virtio: Fix the unregistration of the device rpmsg_ctrl

Hangyu Hua <[email protected]>
rpmsg: virtio: Fix possible double free in rpmsg_virtio_add_ctrl_dev()

Hangyu Hua <[email protected]>
rpmsg: virtio: Fix possible double free in rpmsg_probe()

Bjorn Andersson <[email protected]>
usb: typec: mux: Check dev_set_name() return value

Xiaomeng Tong <[email protected]>
firmware: stratix10-svc: fix a missing check on list iterator

Xiaomeng Tong <[email protected]>
misc: fastrpc: fix an incorrect NULL check on list iterator

SeongJae Park <[email protected]>
scripts/get_abi: Fix wrong script file name in the help message

Zheng Yongjun <[email protected]>
usb: dwc3: pci: Fix pm_runtime_get_sync() error checking

Wesley Cheng <[email protected]>
usb: dwc3: gadget: Replace list_for_each_entry_safe() if using giveback

Krzysztof Kozlowski <[email protected]>
rpmsg: qcom_smd: Fix irq_of_parse_and_map() return value

Uwe Kleine-König <[email protected]>
pwm: raspberrypi-poe: Fix endianness in firmware struct

Uwe Kleine-König <[email protected]>
pwm: lp3943: Fix duty calculation in case period was clamped

Christophe JAILLET <[email protected]>
staging: fieldbus: Fix the error handling path in anybuss_host_common_probe()

Miaoqian Lin <[email protected]>
usb: musb: Fix missing of_node_put() in omap2430_probe

Lin Ma <[email protected]>
USB: storage: karma: fix rio_karma_init return

Niels Dossche <[email protected]>
usb: usbip: add missing device lock on tweak configuration cmd

Hangyu Hua <[email protected]>
usb: usbip: fix a refcount leak in stub_probe()

Michael Straube <[email protected]>
staging: r8188eu: fix struct rt_firmware_hdr

Samuel Holland <[email protected]>
phy: rockchip-inno-usb2: Fix muxed interrupt support

Peng Fan <[email protected]>
remoteproc: imx_rproc: Ignore create mem entry for resource table

Sherry Sun <[email protected]>
tty: serial: fsl_lpuart: fix potential bug when using both of_alias_get_id and ida_simple_get

Miaoqian Lin <[email protected]>
serial: 8250_aspeed_vuart: Fix potential NULL dereference in aspeed_vuart_probe

Daniel Gibson <[email protected]>
tty: n_tty: Restore EOF push handling behavior

Miaoqian Lin <[email protected]>
tty: serial: owl: Fix missing clk_disable_unprepare() in owl_uart_probe

Wang Weiyang <[email protected]>
tty: goldfish: Use tty_port_destroy() to destroy port

Christophe Leroy <[email protected]>
lkdtm/bugs: Don't expect thread termination without CONFIG_UBSAN_TRAP

Jiasheng Jiang <[email protected]>
lkdtm/bugs: Check for the NULL pointer after calling kmalloc

Christophe JAILLET <[email protected]>
remoteproc: mtk_scp: Fix a potential double free

Tinghan Shen <[email protected]>
remoteproc: mediatek: Fix side effect of mt8195 sram power on

Dan Carpenter <[email protected]>
soundwire: qcom: fix an error message in swrm_wait_for_frame_gen_enabled()

Alexandru Tachici <[email protected]>
iio: adc: ad7124: Remove shift from scan_type

Jakob Koschel <[email protected]>
staging: greybus: codecs: fix type confusion of list iterator variable

Randy Dunlap <[email protected]>
pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards


-------------

Diffstat:

Documentation/ABI/testing/sysfs-ata | 11 +-
.../bindings/regulator/mt6315-regulator.yaml | 4 +-
.../devicetree/bindings/remoteproc/mtk,scp.yaml | 44 ++--
Documentation/tools/rtla/Makefile | 14 +-
Makefile | 4 +-
arch/arm/boot/dts/aspeed-ast2600-evb.dts | 4 +-
arch/arm/mach-ep93xx/clock.c | 10 +-
arch/arm64/net/bpf_jit_comp.c | 1 +
arch/m68k/Kconfig.machine | 1 +
arch/m68k/include/asm/pgtable_no.h | 3 +-
arch/m68k/kernel/setup_mm.c | 7 -
arch/m68k/kernel/setup_no.c | 1 -
arch/m68k/kernel/time.c | 9 +
arch/mips/kernel/mips-cpc.c | 1 +
arch/powerpc/Kconfig | 2 -
arch/powerpc/include/asm/thread_info.h | 10 +-
arch/powerpc/kernel/ptrace/ptrace-fpu.c | 20 +-
arch/powerpc/kernel/ptrace/ptrace.c | 3 +
arch/powerpc/platforms/pseries/papr_scm.c | 3 +
arch/riscv/kernel/efi.c | 2 +-
arch/riscv/kernel/machine_kexec.c | 4 +-
arch/s390/crypto/aes_s390.c | 4 +-
arch/s390/kernel/entry.S | 6 +-
arch/s390/mm/gmap.c | 14 ++
arch/um/drivers/chan_kern.c | 10 +-
arch/um/drivers/line.c | 22 +-
arch/um/drivers/line.h | 4 +-
arch/um/drivers/ssl.c | 2 -
arch/um/drivers/stdio_console.c | 2 -
arch/um/include/asm/irq.h | 22 +-
arch/x86/include/asm/cpufeature.h | 2 +-
arch/x86/include/asm/uaccess.h | 2 +-
arch/x86/kvm/mmu/mmu.c | 2 +-
arch/x86/kvm/svm/nested.c | 4 +-
arch/x86/kvm/svm/svm.c | 32 ++-
arch/x86/kvm/svm/svm.h | 2 +-
block/bio.c | 9 +-
block/blk-core.c | 2 +-
block/blk-mq.c | 10 +-
block/genhd.c | 2 +
drivers/ata/libata-core.c | 21 +-
drivers/ata/libata-scsi.c | 2 +-
drivers/ata/libata-transport.c | 2 +-
drivers/ata/pata_octeon_cf.c | 3 +
drivers/base/bus.c | 4 +-
drivers/base/dd.c | 10 +-
drivers/block/loop.c | 8 +-
drivers/block/nbd.c | 78 ++++---
drivers/bus/ti-sysc.c | 4 +-
drivers/char/hw_random/virtio-rng.c | 2 +
drivers/char/random.c | 15 +-
drivers/char/xillybus/xillyusb.c | 1 +
drivers/clocksource/timer-oxnas-rps.c | 2 +-
drivers/clocksource/timer-riscv.c | 2 +-
drivers/clocksource/timer-sp804.c | 10 +-
drivers/dma/idxd/dma.c | 1 +
drivers/dma/xilinx/zynqmp_dma.c | 5 +-
drivers/extcon/extcon-axp288.c | 4 +-
drivers/extcon/extcon-ptn5150.c | 11 +
drivers/extcon/extcon.c | 33 +--
drivers/firmware/dmi-sysfs.c | 2 +-
drivers/firmware/stratix10-svc.c | 12 +-
drivers/gpio/gpio-pca953x.c | 19 +-
drivers/gpu/drm/amd/amdgpu/jpeg_v2_0.c | 6 +-
drivers/gpu/drm/amd/amdgpu/jpeg_v2_0.h | 1 +
drivers/gpu/drm/amd/amdgpu/nv.c | 1 +
drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 17 +-
drivers/gpu/drm/amd/amdkfd/kfd_device.c | 4 +-
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +-
.../amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c | 5 +-
.../amd/display/dc/clk_mgr/dcn316/dcn316_clk_mgr.c | 3 +-
.../gpu/drm/amd/display/dc/dce/dce_clock_source.c | 9 +-
drivers/gpu/drm/amd/display/dc/dml/dml_wrapper.c | 2 -
.../drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c | 57 +++--
drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c | 2 +-
drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c | 1 +
drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 2 +-
.../gpu/drm/amd/pm/swsmu/smu13/yellow_carp_ppt.c | 3 +
drivers/gpu/drm/bridge/analogix/analogix_dp_core.c | 42 +++-
drivers/gpu/drm/bridge/ti-sn65dsi83.c | 2 +-
drivers/gpu/drm/drm_atomic_helper.c | 16 +-
drivers/gpu/drm/imx/ipuv3-crtc.c | 2 +-
drivers/gpu/drm/msm/dp/dp_ctrl.c | 9 +-
drivers/gpu/drm/panfrost/panfrost_drv.c | 5 +-
drivers/gpu/drm/panfrost/panfrost_job.c | 6 +-
drivers/gpu/drm/panfrost/panfrost_job.h | 2 +-
drivers/gpu/drm/radeon/radeon_connectors.c | 4 +
drivers/hwtracing/coresight/coresight-cpu-debug.c | 7 +-
drivers/i2c/busses/i2c-cadence.c | 12 +-
drivers/i2c/busses/i2c-mt65xx.c | 11 +-
drivers/idle/intel_idle.c | 32 ++-
drivers/iio/adc/ad7124.c | 1 -
drivers/iio/adc/sc27xx_adc.c | 20 +-
drivers/iio/adc/stmpe-adc.c | 8 +-
drivers/iio/common/st_sensors/st_sensors_core.c | 24 +-
drivers/iio/dummy/iio_simple_dummy.c | 20 +-
drivers/iio/proximity/vl53l0x-i2c.c | 7 +-
drivers/input/mouse/bcm5974.c | 7 +-
drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 2 +
drivers/iommu/arm/arm-smmu/arm-smmu.c | 5 +-
drivers/md/md.c | 15 +-
drivers/md/raid0.c | 31 +--
drivers/misc/cardreader/rtsx_usb.c | 1 +
drivers/misc/fastrpc.c | 9 +-
drivers/misc/lkdtm/bugs.c | 10 +-
drivers/misc/lkdtm/lkdtm.h | 8 +-
drivers/misc/lkdtm/usercopy.c | 17 +-
drivers/misc/pvpanic/pvpanic.c | 10 +-
drivers/mmc/core/block.c | 3 +-
drivers/mmc/host/sdhci-pci-gli.c | 3 +
drivers/mtd/ubi/fastmap-wl.c | 69 ++++--
drivers/mtd/ubi/fastmap.c | 11 -
drivers/mtd/ubi/ubi.h | 4 +-
drivers/mtd/ubi/vmt.c | 1 -
drivers/mtd/ubi/wl.c | 19 +-
drivers/net/amt.c | 59 +++--
drivers/net/bonding/bond_main.c | 2 +
drivers/net/bonding/bond_netlink.c | 5 -
drivers/net/bonding/bond_options.c | 10 +-
drivers/net/bonding/bond_procfs.c | 15 ++
drivers/net/dsa/lantiq_gswip.c | 4 +-
drivers/net/dsa/mv88e6xxx/chip.c | 1 +
drivers/net/dsa/mv88e6xxx/serdes.c | 27 +--
drivers/net/dsa/realtek/rtl8365mb.c | 38 +--
drivers/net/ethernet/altera/altera_tse_main.c | 6 +-
drivers/net/ethernet/broadcom/bgmac-bcma-mdio.c | 1 +
drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c | 8 +-
.../net/ethernet/marvell/octeontx2/af/rvu_cpt.c | 2 +-
drivers/net/ethernet/mediatek/mtk_eth_soc.c | 3 +
drivers/net/ethernet/mellanox/mlx4/en_ethtool.c | 2 +-
drivers/net/ethernet/mellanox/mlx5/core/dev.c | 72 ++++--
.../ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 7 +-
drivers/net/ethernet/mellanox/mlx5/core/en.h | 4 +
drivers/net/ethernet/mellanox/mlx5/core/en/fs.h | 2 +
drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c | 1 +
.../ethernet/mellanox/mlx5/core/en/reporter_rx.c | 6 +
drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c | 19 +-
drivers/net/ethernet/mellanox/mlx5/core/en/trap.c | 1 +
.../net/ethernet/mellanox/mlx5/core/en/xsk/pool.c | 1 +
.../net/ethernet/mellanox/mlx5/core/en/xsk/setup.c | 5 +-
drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 29 ++-
drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 31 +--
drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 38 ++-
drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 37 ++-
drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c | 12 +-
.../net/ethernet/mellanox/mlx5/core/mlx5_core.h | 1 +
.../ethernet/mellanox/mlx5/core/steering/fs_dr.c | 9 +-
.../net/ethernet/microchip/lan966x/lan966x_main.c | 9 +-
.../net/ethernet/netronome/nfp/flower/conntrack.c | 32 +--
drivers/net/ethernet/netronome/nfp/flower/match.c | 16 +-
drivers/net/ethernet/netronome/nfp/nfdk/dp.c | 12 +-
drivers/net/ethernet/netronome/nfp/nfdk/nfdk.h | 3 +-
drivers/net/ethernet/netronome/nfp/nfp_net.h | 11 +-
.../net/ethernet/netronome/nfp/nfp_net_ethtool.c | 4 +-
drivers/net/ethernet/sfc/efx_channels.c | 6 +-
drivers/net/ethernet/sfc/net_driver.h | 2 +-
drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c | 4 +-
drivers/net/ethernet/ti/am65-cpsw-nuss.c | 8 +-
drivers/net/phy/at803x.c | 33 ++-
drivers/net/phy/dp83867.c | 29 +++
drivers/net/phy/mdio_bus.c | 1 -
drivers/nfc/st21nfca/se.c | 53 +++--
drivers/pci/controller/pcie-brcmstb.c | 257 +++------------------
drivers/pcmcia/Kconfig | 2 +-
drivers/phy/qualcomm/phy-qcom-qmp.c | 2 +-
drivers/phy/rockchip/phy-rockchip-inno-usb2.c | 10 +-
drivers/platform/x86/barco-p50-gpio.c | 5 +-
drivers/platform/x86/hp-wmi.c | 29 ++-
drivers/power/supply/ab8500_fg.c | 19 +-
drivers/power/supply/axp288_charger.c | 17 +-
drivers/power/supply/axp288_fuel_gauge.c | 41 +++-
drivers/power/supply/charger-manager.c | 7 +-
drivers/power/supply/max8997_charger.c | 8 +-
drivers/power/supply/power_supply_core.c | 2 +-
drivers/pwm/pwm-lp3943.c | 1 +
drivers/pwm/pwm-raspberrypi-poe.c | 2 +-
drivers/remoteproc/imx_rproc.c | 3 +
drivers/remoteproc/mtk_common.h | 2 +
drivers/remoteproc/mtk_scp.c | 70 ++++--
drivers/rpmsg/qcom_smd.c | 4 +-
drivers/rpmsg/virtio_rpmsg_bus.c | 9 +-
drivers/rtc/rtc-ftrtc010.c | 34 ++-
drivers/rtc/rtc-mt6397.c | 2 +
drivers/scsi/lpfc/lpfc_crtn.h | 4 +-
drivers/scsi/lpfc/lpfc_ct.c | 2 +-
drivers/scsi/lpfc/lpfc_init.c | 2 +-
drivers/scsi/lpfc/lpfc_nvme.c | 6 +-
drivers/scsi/lpfc/lpfc_scsi.c | 6 +
drivers/scsi/lpfc/lpfc_sli.c | 25 +-
drivers/scsi/myrb.c | 11 +-
drivers/scsi/sd.c | 5 +-
drivers/soc/rockchip/grf.c | 2 +
drivers/soundwire/intel.c | 3 +
drivers/soundwire/qcom.c | 6 +-
drivers/spi/spi-fsi.c | 12 +-
drivers/staging/fieldbus/anybuss/host.c | 2 +-
drivers/staging/greybus/audio_codec.c | 4 +-
drivers/staging/r8188eu/core/rtw_fw.c | 2 +-
drivers/staging/r8188eu/core/rtw_mlme.c | 6 +-
drivers/staging/r8188eu/core/rtw_xmit.c | 13 +-
drivers/staging/r8188eu/include/rtw_xmit.h | 2 +-
drivers/staging/rtl8192e/rtllib_softmac.c | 2 +-
.../staging/rtl8192u/ieee80211/ieee80211_softmac.c | 2 +-
drivers/staging/rtl8712/os_intfs.c | 1 -
drivers/staging/rtl8712/usb_intf.c | 12 +-
drivers/staging/rtl8712/usb_ops.c | 27 ++-
drivers/staging/rtl8723bs/core/rtw_mlme.c | 12 +-
drivers/thunderbolt/tb.c | 19 +-
drivers/thunderbolt/test.c | 16 +-
drivers/thunderbolt/tunnel.c | 11 +-
drivers/thunderbolt/tunnel.h | 4 +-
drivers/tty/goldfish.c | 2 +
drivers/tty/n_tty.c | 38 ++-
drivers/tty/serial/8250/8250_aspeed_vuart.c | 2 +
drivers/tty/serial/8250/8250_fintek.c | 8 +-
drivers/tty/serial/8250/8250_mtk.c | 7 -
drivers/tty/serial/cpm_uart/cpm_uart_core.c | 2 +-
drivers/tty/serial/digicolor-usart.c | 2 +
drivers/tty/serial/fsl_lpuart.c | 24 +-
drivers/tty/serial/icom.c | 2 +-
drivers/tty/serial/meson_uart.c | 13 ++
drivers/tty/serial/msm_serial.c | 5 +
drivers/tty/serial/owl-uart.c | 1 +
drivers/tty/serial/rda-uart.c | 2 +
drivers/tty/serial/sa1100.c | 4 +-
drivers/tty/serial/serial_txx9.c | 2 +
drivers/tty/serial/sh-sci.c | 6 +-
drivers/tty/serial/sifive.c | 8 +-
drivers/tty/serial/st-asc.c | 4 +
drivers/tty/serial/stm32-usart.c | 15 +-
drivers/tty/serial/uartlite.c | 3 +-
drivers/tty/synclink_gt.c | 2 +
drivers/tty/sysrq.c | 13 +-
drivers/usb/core/hcd-pci.c | 4 +-
drivers/usb/dwc2/gadget.c | 1 -
drivers/usb/dwc3/drd.c | 9 +-
drivers/usb/dwc3/dwc3-pci.c | 2 +-
drivers/usb/dwc3/gadget.c | 31 ++-
drivers/usb/dwc3/host.c | 2 -
drivers/usb/host/isp116x-hcd.c | 6 +-
drivers/usb/host/oxu210hp-hcd.c | 2 +
drivers/usb/musb/omap2430.c | 1 +
drivers/usb/phy/phy-omap-otg.c | 4 +-
drivers/usb/storage/karma.c | 15 +-
drivers/usb/typec/mux.c | 14 +-
drivers/usb/typec/tcpm/fusb302.c | 4 +-
drivers/usb/usbip/stub_dev.c | 2 +-
drivers/usb/usbip/stub_rx.c | 2 +
drivers/vdpa/ifcvf/ifcvf_main.c | 3 +-
drivers/vdpa/vdpa.c | 13 +-
drivers/vdpa/vdpa_user/vduse_dev.c | 7 +-
drivers/vhost/vringh.c | 10 +-
drivers/video/fbdev/hyperv_fb.c | 19 +-
drivers/video/fbdev/pxa3xx-gcu.c | 12 +-
drivers/virtio/virtio_pci_modern_dev.c | 1 +
drivers/watchdog/rti_wdt.c | 2 +-
drivers/watchdog/rzg2l_wdt.c | 46 ++--
drivers/watchdog/ts4800_wdt.c | 5 +-
drivers/watchdog/wdat_wdt.c | 1 +
drivers/xen/xlate_mmu.c | 1 -
fs/afs/dir.c | 5 +-
fs/ceph/addr.c | 33 +--
fs/ceph/mds_client.c | 33 ++-
fs/ceph/xattr.c | 10 +-
fs/cifs/cifs_swn.c | 4 +-
fs/cifs/cifsencrypt.c | 8 +-
fs/cifs/cifsfs.c | 2 +-
fs/cifs/cifsfs.h | 2 +-
fs/cifs/cifsglob.h | 24 +-
fs/cifs/connect.c | 30 +--
fs/cifs/dfs_cache.c | 4 +-
fs/cifs/misc.c | 27 ++-
fs/cifs/sess.c | 11 +-
fs/cifs/smb1ops.c | 6 +-
fs/cifs/smb2ops.c | 7 +-
fs/cifs/smb2pdu.c | 9 +-
fs/cifs/smbdirect.c | 4 +-
fs/cifs/transport.c | 40 ++--
fs/erofs/zdata.c | 2 +-
fs/f2fs/checkpoint.c | 12 +-
fs/f2fs/f2fs.h | 23 +-
fs/f2fs/file.c | 1 +
fs/f2fs/node.c | 23 +-
fs/fs-writeback.c | 37 ++-
fs/inode.c | 2 +-
fs/jffs2/fs.c | 1 +
fs/kernfs/dir.c | 31 ++-
fs/ksmbd/smbacl.c | 1 +
fs/ksmbd/transport_rdma.c | 1 +
fs/nfs/nfs4proc.c | 4 +
fs/nfsd/filecache.c | 9 +-
fs/zonefs/super.c | 11 +-
include/linux/blkdev.h | 1 +
include/linux/export.h | 7 +-
include/linux/extcon.h | 2 +-
include/linux/iio/common/st_sensors.h | 3 +
include/linux/jump_label.h | 4 +-
include/linux/mlx5/mlx5_ifc.h | 5 +-
include/linux/nodemask.h | 38 +--
include/linux/random.h | 2 +-
include/linux/xarray.h | 1 +
include/net/ax25.h | 1 +
include/net/bluetooth/hci_core.h | 17 +-
include/net/bonding.h | 6 +
include/net/flow_offload.h | 1 +
include/net/netfilter/nf_tables.h | 1 -
include/net/netfilter/nf_tables_offload.h | 2 +-
include/net/sch_generic.h | 42 ++--
include/net/tcp.h | 19 +-
include/trace/events/tcp.h | 2 +-
kernel/bpf/core.c | 14 +-
kernel/sched/autogroup.c | 2 +-
kernel/trace/trace.c | 13 +-
kernel/trace/trace_syscalls.c | 35 +--
lib/Makefile | 2 +-
lib/iov_iter.c | 20 +-
lib/nodemask.c | 4 +-
lib/xarray.c | 5 +-
mm/filemap.c | 9 +-
mm/huge_memory.c | 3 +-
net/ax25/af_ax25.c | 27 ++-
net/ax25/ax25_dev.c | 1 +
net/ax25/ax25_subr.c | 2 +-
net/bluetooth/hci_core.c | 4 +-
net/bluetooth/hci_request.c | 2 +-
net/bluetooth/hci_sync.c | 62 +++--
net/bluetooth/mgmt.c | 45 ++--
net/core/filter.c | 2 +-
net/core/flow_offload.c | 6 +
net/core/neighbour.c | 2 +-
net/ipv4/inet_hashtables.c | 10 +-
net/ipv4/ip_gre.c | 11 +-
net/ipv4/tcp.c | 8 +-
net/ipv4/tcp_bbr.c | 20 +-
net/ipv4/tcp_bic.c | 14 +-
net/ipv4/tcp_cdg.c | 30 +--
net/ipv4/tcp_cong.c | 18 +-
net/ipv4/tcp_cubic.c | 22 +-
net/ipv4/tcp_dctcp.c | 11 +-
net/ipv4/tcp_highspeed.c | 18 +-
net/ipv4/tcp_htcp.c | 10 +-
net/ipv4/tcp_hybla.c | 18 +-
net/ipv4/tcp_illinois.c | 12 +-
net/ipv4/tcp_input.c | 36 +--
net/ipv4/tcp_ipv4.c | 2 +-
net/ipv4/tcp_lp.c | 6 +-
net/ipv4/tcp_metrics.c | 12 +-
net/ipv4/tcp_nv.c | 24 +-
net/ipv4/tcp_output.c | 34 +--
net/ipv4/tcp_rate.c | 2 +-
net/ipv4/tcp_scalable.c | 4 +-
net/ipv4/tcp_vegas.c | 21 +-
net/ipv4/tcp_veno.c | 24 +-
net/ipv4/tcp_westwood.c | 3 +-
net/ipv4/tcp_yeah.c | 30 +--
net/ipv4/xfrm4_protocol.c | 1 -
net/ipv6/ping.c | 8 +-
net/ipv6/seg6_hmac.c | 1 -
net/ipv6/seg6_local.c | 1 +
net/ipv6/tcp_ipv6.c | 2 +-
net/key/af_key.c | 10 +-
net/netfilter/nf_tables_api.c | 54 ++---
net/netfilter/nf_tables_offload.c | 23 +-
net/netfilter/nft_nat.c | 3 +-
net/openvswitch/actions.c | 6 +
net/openvswitch/conntrack.c | 4 +-
net/sched/act_ct.c | 2 +-
net/smc/af_smc.c | 1 +
net/smc/smc_cdc.c | 2 +-
net/sunrpc/xdr.c | 6 +-
net/sunrpc/xprtrdma/rpc_rdma.c | 5 +
net/sunrpc/xprtrdma/svc_rdma_rw.c | 4 +-
net/tipc/bearer.c | 3 +-
net/unix/af_unix.c | 2 +-
net/xdp/xsk.c | 5 +-
net/xdp/xsk_queue.h | 8 -
scripts/gdb/linux/config.py | 6 +-
scripts/get_abi.pl | 4 +-
scripts/mod/modpost.c | 5 +-
security/keys/trusted-keys/trusted_tpm2.c | 4 +-
sound/pci/hda/patch_conexant.c | 7 +
sound/pci/hda/patch_realtek.c | 2 +
sound/soc/amd/acp/acp-pci.c | 1 +
sound/soc/codecs/rt5640.c | 11 +-
sound/soc/codecs/rt5640.h | 2 +
sound/soc/fsl/fsl_sai.h | 4 +-
sound/soc/intel/boards/bytcr_rt5640.c | 2 +
sound/usb/pcm.c | 5 +-
sound/usb/quirks-table.h | 7 +-
tools/objtool/check.c | 3 +-
tools/perf/arch/x86/util/evlist.c | 5 +-
tools/perf/arch/x86/util/evsel.c | 24 +-
tools/perf/arch/x86/util/evsel.h | 7 +
tools/perf/arch/x86/util/topdown.c | 46 ++--
tools/perf/arch/x86/util/topdown.h | 7 +
tools/perf/builtin-c2c.c | 4 +-
.../selftests/bpf/progs/test_stacktrace_build_id.c | 2 +-
tools/testing/selftests/net/bpf/Makefile | 4 +-
tools/testing/selftests/netfilter/nft_nat.sh | 43 ++++
tools/tracing/rtla/Makefile | 35 +++
400 files changed, 2758 insertions(+), 1806 deletions(-)



2022-06-13 16:30:59

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.18 215/339] net: altera: Fix refcount leak in altera_tse_mdio_create

From: Miaoqian Lin <[email protected]>

[ Upstream commit 11ec18b1d8d92b9df307d31950dcba0b3dd7283c ]

Every iteration of for_each_child_of_node() decrements
the reference count of the previous node.
When break from a for_each_child_of_node() loop,
we need to explicitly call of_node_put() on the child node when
not need anymore.
Add missing of_node_put() to avoid refcount leak.

Fixes: bbd2190ce96d ("Altera TSE: Add main and header file for Altera Ethernet Driver")
Signed-off-by: Miaoqian Lin <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Jakub Kicinski <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/net/ethernet/altera/altera_tse_main.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/altera/altera_tse_main.c b/drivers/net/ethernet/altera/altera_tse_main.c
index a3816264c35c..8c5828582c21 100644
--- a/drivers/net/ethernet/altera/altera_tse_main.c
+++ b/drivers/net/ethernet/altera/altera_tse_main.c
@@ -163,7 +163,8 @@ static int altera_tse_mdio_create(struct net_device *dev, unsigned int id)
mdio = mdiobus_alloc();
if (mdio == NULL) {
netdev_err(dev, "Error allocating MDIO bus\n");
- return -ENOMEM;
+ ret = -ENOMEM;
+ goto put_node;
}

mdio->name = ALTERA_TSE_RESOURCE_NAME;
@@ -180,6 +181,7 @@ static int altera_tse_mdio_create(struct net_device *dev, unsigned int id)
mdio->id);
goto out_free_mdio;
}
+ of_node_put(mdio_node);

if (netif_msg_drv(priv))
netdev_info(dev, "MDIO bus %s: created\n", mdio->id);
@@ -189,6 +191,8 @@ static int altera_tse_mdio_create(struct net_device *dev, unsigned int id)
out_free_mdio:
mdiobus_free(mdio);
mdio = NULL;
+put_node:
+ of_node_put(mdio_node);
return ret;
}

--
2.35.1



2022-06-13 16:31:34

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.18 261/339] ceph: flush the mdlog for filesystem sync

From: Xiubo Li <[email protected]>

[ Upstream commit 1b2ba3c5616e17ff951359e25c658a1c3f146f1e ]

Before waiting for a request's safe reply, we will send the mdlog flush
request to the relevant MDS. And this will also flush the mdlog for all
the other unsafe requests in the same session, so we can record the last
session and no need to flush mdlog again in the next loop. But there
still have cases that it may send the mdlog flush requst twice or more,
but that should be not often.

Rename wait_unsafe_requests() to
flush_mdlog_and_wait_mdsc_unsafe_requests() to make it more
descriptive.

[xiubli: fold in MDS request refcount leak fix from Jeff]

URL: https://tracker.ceph.com/issues/55284
URL: https://tracker.ceph.com/issues/55411
Signed-off-by: Xiubo Li <[email protected]>
Reviewed-by: Jeff Layton <[email protected]>
Signed-off-by: Ilya Dryomov <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
fs/ceph/mds_client.c | 33 +++++++++++++++++++++++++++------
1 file changed, 27 insertions(+), 6 deletions(-)

diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index 1bd3e1bb0fdf..8c249511344d 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -4700,15 +4700,17 @@ void ceph_mdsc_pre_umount(struct ceph_mds_client *mdsc)
}

/*
- * wait for all write mds requests to flush.
+ * flush the mdlog and wait for all write mds requests to flush.
*/
-static void wait_unsafe_requests(struct ceph_mds_client *mdsc, u64 want_tid)
+static void flush_mdlog_and_wait_mdsc_unsafe_requests(struct ceph_mds_client *mdsc,
+ u64 want_tid)
{
struct ceph_mds_request *req = NULL, *nextreq;
+ struct ceph_mds_session *last_session = NULL;
struct rb_node *n;

mutex_lock(&mdsc->mutex);
- dout("wait_unsafe_requests want %lld\n", want_tid);
+ dout("%s want %lld\n", __func__, want_tid);
restart:
req = __get_oldest_req(mdsc);
while (req && req->r_tid <= want_tid) {
@@ -4720,14 +4722,32 @@ static void wait_unsafe_requests(struct ceph_mds_client *mdsc, u64 want_tid)
nextreq = NULL;
if (req->r_op != CEPH_MDS_OP_SETFILELOCK &&
(req->r_op & CEPH_MDS_OP_WRITE)) {
+ struct ceph_mds_session *s = req->r_session;
+
+ if (!s) {
+ req = nextreq;
+ continue;
+ }
+
/* write op */
ceph_mdsc_get_request(req);
if (nextreq)
ceph_mdsc_get_request(nextreq);
+ s = ceph_get_mds_session(s);
mutex_unlock(&mdsc->mutex);
- dout("wait_unsafe_requests wait on %llu (want %llu)\n",
+
+ /* send flush mdlog request to MDS */
+ if (last_session != s) {
+ send_flush_mdlog(s);
+ ceph_put_mds_session(last_session);
+ last_session = s;
+ } else {
+ ceph_put_mds_session(s);
+ }
+ dout("%s wait on %llu (want %llu)\n", __func__,
req->r_tid, want_tid);
wait_for_completion(&req->r_safe_completion);
+
mutex_lock(&mdsc->mutex);
ceph_mdsc_put_request(req);
if (!nextreq)
@@ -4742,7 +4762,8 @@ static void wait_unsafe_requests(struct ceph_mds_client *mdsc, u64 want_tid)
req = nextreq;
}
mutex_unlock(&mdsc->mutex);
- dout("wait_unsafe_requests done\n");
+ ceph_put_mds_session(last_session);
+ dout("%s done\n", __func__);
}

void ceph_mdsc_sync(struct ceph_mds_client *mdsc)
@@ -4771,7 +4792,7 @@ void ceph_mdsc_sync(struct ceph_mds_client *mdsc)
dout("sync want tid %lld flush_seq %lld\n",
want_tid, want_flush);

- wait_unsafe_requests(mdsc, want_tid);
+ flush_mdlog_and_wait_mdsc_unsafe_requests(mdsc, want_tid);
wait_caps_flush(mdsc, want_flush);
}

--
2.35.1



2022-06-13 16:31:56

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.18 148/339] perf parse-events: Move slots event for the hybrid platform too

From: Kan Liang <[email protected]>

[ Upstream commit e0e14cdff31d326f81e0edbd5140f788c870756c ]

The commit 94dbfd6781a0e87b ("perf parse-events: Architecture specific
leader override") introduced a feature to reorder the slots event to
fulfill the restriction of the perf metrics topdown group. But the
feature doesn't work on the hybrid machine.

$ perf stat -e "{cpu_core/instructions/,cpu_core/slots/,cpu_core/topdown-retiring/}" -a sleep 1

Performance counter stats for 'system wide':

<not counted> cpu_core/instructions/
<not counted> cpu_core/slots/
<not supported> cpu_core/topdown-retiring/

1.002871801 seconds time elapsed

A hybrid platform has a different PMU name for the core PMUs, while
current perf hard code the PMU name "cpu".

Introduce a new function to check whether the system supports the perf
metrics feature. The result is cached for the future usage.

For X86, the core PMU name always has "cpu" prefix.

With the patch:

$ perf stat -e "{cpu_core/instructions/,cpu_core/slots/,cpu_core/topdown-retiring/}" -a sleep 1

Performance counter stats for 'system wide':

76,337,010 cpu_core/slots/
10,416,809 cpu_core/instructions/
11,692,372 cpu_core/topdown-retiring/

1.002805453 seconds time elapsed

Reviewed-by: Ian Rogers <[email protected]>
Signed-off-by: Kan Liang <[email protected]>
Cc: Adrian Hunter <[email protected]>
Cc: Andi Kleen <[email protected]>
Cc: Ingo Molnar <[email protected]>
Cc: Jiri Olsa <[email protected]>
Cc: Namhyung Kim <[email protected]>
Cc: Peter Zijlstra <[email protected]>
Cc: Stephane Eranian <[email protected]>
Cc: Xing Zhengjun <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Arnaldo Carvalho de Melo <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
tools/perf/arch/x86/util/evlist.c | 5 +++--
tools/perf/arch/x86/util/topdown.c | 25 +++++++++++++++++++++++++
tools/perf/arch/x86/util/topdown.h | 7 +++++++
3 files changed, 35 insertions(+), 2 deletions(-)
create mode 100644 tools/perf/arch/x86/util/topdown.h

diff --git a/tools/perf/arch/x86/util/evlist.c b/tools/perf/arch/x86/util/evlist.c
index 75564a7df15b..68f681ad54c1 100644
--- a/tools/perf/arch/x86/util/evlist.c
+++ b/tools/perf/arch/x86/util/evlist.c
@@ -3,6 +3,7 @@
#include "util/pmu.h"
#include "util/evlist.h"
#include "util/parse-events.h"
+#include "topdown.h"

#define TOPDOWN_L1_EVENTS "{slots,topdown-retiring,topdown-bad-spec,topdown-fe-bound,topdown-be-bound}"
#define TOPDOWN_L2_EVENTS "{slots,topdown-retiring,topdown-bad-spec,topdown-fe-bound,topdown-be-bound,topdown-heavy-ops,topdown-br-mispredict,topdown-fetch-lat,topdown-mem-bound}"
@@ -25,12 +26,12 @@ struct evsel *arch_evlist__leader(struct list_head *list)

first = list_first_entry(list, struct evsel, core.node);

- if (!pmu_have_event("cpu", "slots"))
+ if (!topdown_sys_has_perf_metrics())
return first;

/* If there is a slots event and a topdown event then the slots event comes first. */
__evlist__for_each_entry(list, evsel) {
- if (evsel->pmu_name && !strcmp(evsel->pmu_name, "cpu") && evsel->name) {
+ if (evsel->pmu_name && !strncmp(evsel->pmu_name, "cpu", 3) && evsel->name) {
if (strcasestr(evsel->name, "slots")) {
slots = evsel;
if (slots == first)
diff --git a/tools/perf/arch/x86/util/topdown.c b/tools/perf/arch/x86/util/topdown.c
index 2f3d96aa92a5..f4d5422e9960 100644
--- a/tools/perf/arch/x86/util/topdown.c
+++ b/tools/perf/arch/x86/util/topdown.c
@@ -3,6 +3,31 @@
#include "api/fs/fs.h"
#include "util/pmu.h"
#include "util/topdown.h"
+#include "topdown.h"
+
+/* Check whether there is a PMU which supports the perf metrics. */
+bool topdown_sys_has_perf_metrics(void)
+{
+ static bool has_perf_metrics;
+ static bool cached;
+ struct perf_pmu *pmu;
+
+ if (cached)
+ return has_perf_metrics;
+
+ /*
+ * The perf metrics feature is a core PMU feature.
+ * The PERF_TYPE_RAW type is the type of a core PMU.
+ * The slots event is only available when the core PMU
+ * supports the perf metrics feature.
+ */
+ pmu = perf_pmu__find_by_type(PERF_TYPE_RAW);
+ if (pmu && pmu_have_event(pmu->name, "slots"))
+ has_perf_metrics = true;
+
+ cached = true;
+ return has_perf_metrics;
+}

/*
* Check whether we can use a group for top down.
diff --git a/tools/perf/arch/x86/util/topdown.h b/tools/perf/arch/x86/util/topdown.h
new file mode 100644
index 000000000000..46bf9273e572
--- /dev/null
+++ b/tools/perf/arch/x86/util/topdown.h
@@ -0,0 +1,7 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef _TOPDOWN_H
+#define _TOPDOWN_H 1
+
+bool topdown_sys_has_perf_metrics(void);
+
+#endif
--
2.35.1



2022-06-13 16:31:56

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.18 308/339] KEYS: trusted: tpm2: Fix migratable logic

From: David Safford <[email protected]>

commit dda5384313a40ecbaafd8a9a80f47483255e4c4d upstream.

When creating (sealing) a new trusted key, migratable
trusted keys have the FIXED_TPM and FIXED_PARENT attributes
set, and non-migratable keys don't. This is backwards, and
also causes creation to fail when creating a migratable key
under a migratable parent. (The TPM thinks you are trying to
seal a non-migratable blob under a migratable parent.)

The following simple patch fixes the logic, and has been
tested for all four combinations of migratable and non-migratable
trusted keys and parent storage keys. With this logic, you will
get a proper failure if you try to create a non-migratable
trusted key under a migratable parent storage key, and all other
combinations work correctly.

Cc: [email protected] # v5.13+
Fixes: e5fb5d2c5a03 ("security: keys: trusted: Make sealed key properly interoperable")
Signed-off-by: David Safford <[email protected]>
Reviewed-by: Ahmad Fatoum <[email protected]>
Reviewed-by: Jarkko Sakkinen <[email protected]>
Signed-off-by: Jarkko Sakkinen <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
security/keys/trusted-keys/trusted_tpm2.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

--- a/security/keys/trusted-keys/trusted_tpm2.c
+++ b/security/keys/trusted-keys/trusted_tpm2.c
@@ -283,8 +283,8 @@ int tpm2_seal_trusted(struct tpm_chip *c
/* key properties */
flags = 0;
flags |= options->policydigest_len ? 0 : TPM2_OA_USER_WITH_AUTH;
- flags |= payload->migratable ? (TPM2_OA_FIXED_TPM |
- TPM2_OA_FIXED_PARENT) : 0;
+ flags |= payload->migratable ? 0 : (TPM2_OA_FIXED_TPM |
+ TPM2_OA_FIXED_PARENT);
tpm_buf_append_u32(&buf, flags);

/* policy */


2022-06-13 16:32:00

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.18 194/339] net: ethernet: bgmac: Fix refcount leak in bcma_mdio_mii_register

From: Miaoqian Lin <[email protected]>

[ Upstream commit b8d91399775c55162073bb2aca061ec42e3d4bc1 ]

of_get_child_by_name() returns a node pointer with refcount
incremented, we should use of_node_put() on it when not need anymore.
Add missing of_node_put() to avoid refcount leak.

Fixes: 55954f3bfdac ("net: ethernet: bgmac: move BCMA MDIO Phy code into a separate file")
Signed-off-by: Miaoqian Lin <[email protected]>
Reviewed-by: Andrew Lunn <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Jakub Kicinski <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/net/ethernet/broadcom/bgmac-bcma-mdio.c | 1 +
1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/broadcom/bgmac-bcma-mdio.c b/drivers/net/ethernet/broadcom/bgmac-bcma-mdio.c
index 086739e4f40a..9b83d5361699 100644
--- a/drivers/net/ethernet/broadcom/bgmac-bcma-mdio.c
+++ b/drivers/net/ethernet/broadcom/bgmac-bcma-mdio.c
@@ -234,6 +234,7 @@ struct mii_bus *bcma_mdio_mii_register(struct bgmac *bgmac)
np = of_get_child_by_name(core->dev.of_node, "mdio");

err = of_mdiobus_register(mii_bus, np);
+ of_node_put(np);
if (err) {
dev_err(&core->dev, "Registration of mii bus failed\n");
goto err_free_bus;
--
2.35.1



2022-06-13 16:32:11

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.18 197/339] af_unix: Fix a data-race in unix_dgram_peer_wake_me().

From: Kuniyuki Iwashima <[email protected]>

[ Upstream commit 662a80946ce13633ae90a55379f1346c10f0c432 ]

unix_dgram_poll() calls unix_dgram_peer_wake_me() without `other`'s
lock held and check if its receive queue is full. Here we need to
use unix_recvq_full_lockless() instead of unix_recvq_full(), otherwise
KCSAN will report a data-race.

Fixes: 7d267278a9ec ("unix: avoid use-after-free in ep_remove_wait_queue")
Signed-off-by: Kuniyuki Iwashima <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Paolo Abeni <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
net/unix/af_unix.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index e71a312faa1e..4aed12e94221 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -490,7 +490,7 @@ static int unix_dgram_peer_wake_me(struct sock *sk, struct sock *other)
* -ECONNREFUSED. Otherwise, if we haven't queued any skbs
* to other and its full, we will hang waiting for POLLOUT.
*/
- if (unix_recvq_full(other) && !sock_flag(other, SOCK_DEAD))
+ if (unix_recvq_full_lockless(other) && !sock_flag(other, SOCK_DEAD))
return 1;

if (connected)
--
2.35.1



2022-06-13 16:32:20

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.18 119/339] net: phy: at803x: disable WOL at probe

From: Viorel Suman <[email protected]>

[ Upstream commit d7cd5e06c9dd70a82f1461c7b5f676bc03f5cd61 ]

Before 7beecaf7d507b ("net: phy: at803x: improve the WOL feature") patch
"at803x_get_wol" implementation used AT803X_INTR_ENABLE_WOL value to set
WAKE_MAGIC flag, and now AT803X_WOL_EN value is used for the same purpose.
The problem here is that the values of these two bits are different after
hardware reset: AT803X_INTR_ENABLE_WOL=0 after hardware reset, but
AT803X_WOL_EN=1. So now, if called right after boot, "at803x_get_wol" will
set WAKE_MAGIC flag, even if WOL function is not enabled by calling
"at803x_set_wol" function. The patch disables WOL function on probe thus
the behavior is consistent.

Fixes: 7beecaf7d507b ("net: phy: at803x: improve the WOL feature")
Signed-off-by: Viorel Suman <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Jakub Kicinski <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/net/phy/at803x.c | 33 ++++++++++++++++++++++-----------
1 file changed, 22 insertions(+), 11 deletions(-)

diff --git a/drivers/net/phy/at803x.c b/drivers/net/phy/at803x.c
index 73926006d319..6a467e7817a6 100644
--- a/drivers/net/phy/at803x.c
+++ b/drivers/net/phy/at803x.c
@@ -433,20 +433,21 @@ static void at803x_context_restore(struct phy_device *phydev,
static int at803x_set_wol(struct phy_device *phydev,
struct ethtool_wolinfo *wol)
{
- struct net_device *ndev = phydev->attached_dev;
- const u8 *mac;
int ret, irq_enabled;
- unsigned int i;
- static const unsigned int offsets[] = {
- AT803X_LOC_MAC_ADDR_32_47_OFFSET,
- AT803X_LOC_MAC_ADDR_16_31_OFFSET,
- AT803X_LOC_MAC_ADDR_0_15_OFFSET,
- };
-
- if (!ndev)
- return -ENODEV;

if (wol->wolopts & WAKE_MAGIC) {
+ struct net_device *ndev = phydev->attached_dev;
+ const u8 *mac;
+ unsigned int i;
+ static const unsigned int offsets[] = {
+ AT803X_LOC_MAC_ADDR_32_47_OFFSET,
+ AT803X_LOC_MAC_ADDR_16_31_OFFSET,
+ AT803X_LOC_MAC_ADDR_0_15_OFFSET,
+ };
+
+ if (!ndev)
+ return -ENODEV;
+
mac = (const u8 *) ndev->dev_addr;

if (!is_valid_ether_addr(mac))
@@ -857,6 +858,9 @@ static int at803x_probe(struct phy_device *phydev)
if (phydev->drv->phy_id == ATH8031_PHY_ID) {
int ccr = phy_read(phydev, AT803X_REG_CHIP_CONFIG);
int mode_cfg;
+ struct ethtool_wolinfo wol = {
+ .wolopts = 0,
+ };

if (ccr < 0)
goto err;
@@ -872,6 +876,13 @@ static int at803x_probe(struct phy_device *phydev)
priv->is_fiber = true;
break;
}
+
+ /* Disable WOL by default */
+ ret = at803x_set_wol(phydev, &wol);
+ if (ret < 0) {
+ phydev_err(phydev, "failed to disable WOL on probe: %d\n", ret);
+ goto err;
+ }
}

return 0;
--
2.35.1



2022-06-13 16:32:48

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.18 321/339] ixgbe: fix unexpected VLAN Rx in promisc mode on VF

From: Olivier Matz <[email protected]>

commit 7bb0fb7c63df95d6027dc50d6af3bc3bbbc25483 upstream.

When the promiscuous mode is enabled on a VF, the IXGBE_VMOLR_VPE
bit (VLAN Promiscuous Enable) is set. This means that the VF will
receive packets whose VLAN is not the same than the VLAN of the VF.

For instance, in this situation:

┌────────┐ ┌────────┐ ┌────────┐
│ │ │ │ │ │
│ │ │ │ │ │
│ VF0├────┤VF1 VF2├────┤VF3 │
│ │ │ │ │ │
└────────┘ └────────┘ └────────┘
VM1 VM2 VM3

vf 0: vlan 1000
vf 1: vlan 1000
vf 2: vlan 1001
vf 3: vlan 1001

If we tcpdump on VF3, we see all the packets, even those transmitted
on vlan 1000.

This behavior prevents to bridge VF1 and VF2 in VM2, because it will
create a loop: packets transmitted on VF1 will be received by VF2 and
vice-versa, and bridged again through the software bridge.

This patch remove the activation of VLAN Promiscuous when a VF enables
the promiscuous mode. However, the IXGBE_VMOLR_UPE bit (Unicast
Promiscuous) is kept, so that a VF receives all packets that has the
same VLAN, whatever the destination MAC address.

Fixes: 8443c1a4b192 ("ixgbe, ixgbevf: Add new mbox API xcast mode")
Cc: [email protected]
Cc: Nicolas Dichtel <[email protected]>
Signed-off-by: Olivier Matz <[email protected]>
Tested-by: Konrad Jankowski <[email protected]>
Signed-off-by: Tony Nguyen <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
@@ -1208,9 +1208,9 @@ static int ixgbe_update_vf_xcast_mode(st
return -EPERM;
}

- disable = 0;
+ disable = IXGBE_VMOLR_VPE;
enable = IXGBE_VMOLR_BAM | IXGBE_VMOLR_ROMPE |
- IXGBE_VMOLR_MPE | IXGBE_VMOLR_UPE | IXGBE_VMOLR_VPE;
+ IXGBE_VMOLR_MPE | IXGBE_VMOLR_UPE;
break;
default:
return -EOPNOTSUPP;


2022-06-13 16:32:53

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.18 315/339] net: openvswitch: fix misuse of the cached connection on tuple changes

From: Ilya Maximets <[email protected]>

commit 2061ecfdf2350994e5b61c43e50e98a7a70e95ee upstream.

If packet headers changed, the cached nfct is no longer relevant
for the packet and attempt to re-use it leads to the incorrect packet
classification.

This issue is causing broken connectivity in OpenStack deployments
with OVS/OVN due to hairpin traffic being unexpectedly dropped.

The setup has datapath flows with several conntrack actions and tuple
changes between them:

actions:ct(commit,zone=8,mark=0/0x1,nat(src)),
set(eth(src=00:00:00:00:00:01,dst=00:00:00:00:00:06)),
set(ipv4(src=172.18.2.10,dst=192.168.100.6,ttl=62)),
ct(zone=8),recirc(0x4)

After the first ct() action the packet headers are almost fully
re-written. The next ct() tries to re-use the existing nfct entry
and marks the packet as invalid, so it gets dropped later in the
pipeline.

Clearing the cached conntrack entry whenever packet tuple is changed
to avoid the issue.

The flow key should not be cleared though, because we should still
be able to match on the ct_state if the recirculation happens after
the tuple change but before the next ct() action.

Cc: [email protected]
Fixes: 7f8a436eaa2c ("openvswitch: Add conntrack action")
Reported-by: Frode Nordahl <[email protected]>
Link: https://mail.openvswitch.org/pipermail/ovs-discuss/2022-May/051829.html
Link: https://bugs.launchpad.net/ubuntu/+source/ovn/+bug/1967856
Signed-off-by: Ilya Maximets <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Jakub Kicinski <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
net/openvswitch/actions.c | 6 ++++++
net/openvswitch/conntrack.c | 4 +++-
2 files changed, 9 insertions(+), 1 deletion(-)

--- a/net/openvswitch/actions.c
+++ b/net/openvswitch/actions.c
@@ -373,6 +373,7 @@ static void set_ip_addr(struct sk_buff *
update_ip_l4_checksum(skb, nh, *addr, new_addr);
csum_replace4(&nh->check, *addr, new_addr);
skb_clear_hash(skb);
+ ovs_ct_clear(skb, NULL);
*addr = new_addr;
}

@@ -420,6 +421,7 @@ static void set_ipv6_addr(struct sk_buff
update_ipv6_checksum(skb, l4_proto, addr, new_addr);

skb_clear_hash(skb);
+ ovs_ct_clear(skb, NULL);
memcpy(addr, new_addr, sizeof(__be32[4]));
}

@@ -660,6 +662,7 @@ static int set_nsh(struct sk_buff *skb,
static void set_tp_port(struct sk_buff *skb, __be16 *port,
__be16 new_port, __sum16 *check)
{
+ ovs_ct_clear(skb, NULL);
inet_proto_csum_replace2(check, skb, *port, new_port, false);
*port = new_port;
}
@@ -699,6 +702,7 @@ static int set_udp(struct sk_buff *skb,
uh->dest = dst;
flow_key->tp.src = src;
flow_key->tp.dst = dst;
+ ovs_ct_clear(skb, NULL);
}

skb_clear_hash(skb);
@@ -761,6 +765,8 @@ static int set_sctp(struct sk_buff *skb,
sh->checksum = old_csum ^ old_correct_csum ^ new_csum;

skb_clear_hash(skb);
+ ovs_ct_clear(skb, NULL);
+
flow_key->tp.src = sh->source;
flow_key->tp.dst = sh->dest;

--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -1342,7 +1342,9 @@ int ovs_ct_clear(struct sk_buff *skb, st

nf_ct_put(ct);
nf_ct_set(skb, NULL, IP_CT_UNTRACKED);
- ovs_ct_fill_key(skb, key, false);
+
+ if (key)
+ ovs_ct_fill_key(skb, key, false);

return 0;
}


2022-06-13 16:32:56

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.18 013/339] tty: serial: fsl_lpuart: fix potential bug when using both of_alias_get_id and ida_simple_get

From: Sherry Sun <[email protected]>

[ Upstream commit f398e0aa325c61fa20903833a5b534ecb8e6e418 ]

Now fsl_lpuart driver use both of_alias_get_id() and ida_simple_get() in
.probe(), which has the potential bug. For example, when remove the
lpuart7 alias in dts, of_alias_get_id() will return error, then call
ida_simple_get() to allocate the id 0 for lpuart7, this may confilct
with the lpuart4 which has alias 0.

aliases {
...
serial0 = &lpuart4;
serial1 = &lpuart5;
serial2 = &lpuart6;
serial3 = &lpuart7;
}

So remove the ida_simple_get() in .probe(), return an error directly
when calling of_alias_get_id() fails, which is consistent with other
uart drivers behavior.

Fixes: 3bc3206e1c0f ("serial: fsl_lpuart: Remove the alias node dependence")
Signed-off-by: Sherry Sun <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/tty/serial/fsl_lpuart.c | 24 ++++--------------------
1 file changed, 4 insertions(+), 20 deletions(-)

diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
index be12fee94db5..2cb89491dd09 100644
--- a/drivers/tty/serial/fsl_lpuart.c
+++ b/drivers/tty/serial/fsl_lpuart.c
@@ -239,8 +239,6 @@
/* IMX lpuart has four extra unused regs located at the beginning */
#define IMX_REG_OFF 0x10

-static DEFINE_IDA(fsl_lpuart_ida);
-
enum lpuart_type {
VF610_LPUART,
LS1021A_LPUART,
@@ -276,7 +274,6 @@ struct lpuart_port {
int rx_dma_rng_buf_len;
unsigned int dma_tx_nents;
wait_queue_head_t dma_wait;
- bool id_allocated;
};

struct lpuart_soc_data {
@@ -2717,23 +2714,18 @@ static int lpuart_probe(struct platform_device *pdev)

ret = of_alias_get_id(np, "serial");
if (ret < 0) {
- ret = ida_simple_get(&fsl_lpuart_ida, 0, UART_NR, GFP_KERNEL);
- if (ret < 0) {
- dev_err(&pdev->dev, "port line is full, add device failed\n");
- return ret;
- }
- sport->id_allocated = true;
+ dev_err(&pdev->dev, "failed to get alias id, errno %d\n", ret);
+ return ret;
}
if (ret >= ARRAY_SIZE(lpuart_ports)) {
dev_err(&pdev->dev, "serial%d out of range\n", ret);
- ret = -EINVAL;
- goto failed_out_of_range;
+ return -EINVAL;
}
sport->port.line = ret;

ret = lpuart_enable_clks(sport);
if (ret)
- goto failed_clock_enable;
+ return ret;
sport->port.uartclk = lpuart_get_baud_clk_rate(sport);

lpuart_ports[sport->port.line] = sport;
@@ -2781,10 +2773,6 @@ static int lpuart_probe(struct platform_device *pdev)
uart_remove_one_port(&lpuart_reg, &sport->port);
failed_attach_port:
lpuart_disable_clks(sport);
-failed_clock_enable:
-failed_out_of_range:
- if (sport->id_allocated)
- ida_simple_remove(&fsl_lpuart_ida, sport->port.line);
return ret;
}

@@ -2794,9 +2782,6 @@ static int lpuart_remove(struct platform_device *pdev)

uart_remove_one_port(&lpuart_reg, &sport->port);

- if (sport->id_allocated)
- ida_simple_remove(&fsl_lpuart_ida, sport->port.line);
-
lpuart_disable_clks(sport);

if (sport->dma_tx_chan)
@@ -2926,7 +2911,6 @@ static int __init lpuart_serial_init(void)

static void __exit lpuart_serial_exit(void)
{
- ida_destroy(&fsl_lpuart_ida);
platform_driver_unregister(&lpuart_driver);
uart_unregister_driver(&lpuart_reg);
}
--
2.35.1



2022-06-13 16:36:00

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.18 168/339] dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type

From: Radhey Shyam Pandey <[email protected]>

[ Upstream commit f9a9f43a62a04ec3183fb0da9226c7706eed0115 ]

In zynqmp_dma_alloc/free_chan_resources functions there is a
potential overflow in the below expressions.

dma_alloc_coherent(chan->dev, (2 * chan->desc_size *
ZYNQMP_DMA_NUM_DESCS),
&chan->desc_pool_p, GFP_KERNEL);

dma_free_coherent(chan->dev,(2 * ZYNQMP_DMA_DESC_SIZE(chan) *
ZYNQMP_DMA_NUM_DESCS),
chan->desc_pool_v, chan->desc_pool_p);

The arguments desc_size and ZYNQMP_DMA_NUM_DESCS were 32 bit. Though
this overflow condition is not observed but it is a potential problem
in the case of 32-bit multiplication. Hence fix it by changing the
desc_size data type to size_t.

In addition to coverity fix it also reuse ZYNQMP_DMA_DESC_SIZE macro in
dma_alloc_coherent API argument.

Addresses-Coverity: Event overflow_before_widen.
Signed-off-by: Radhey Shyam Pandey <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Vinod Koul <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/dma/xilinx/zynqmp_dma.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/dma/xilinx/zynqmp_dma.c b/drivers/dma/xilinx/zynqmp_dma.c
index 7aa63b652027..3ffa7f37c701 100644
--- a/drivers/dma/xilinx/zynqmp_dma.c
+++ b/drivers/dma/xilinx/zynqmp_dma.c
@@ -229,7 +229,7 @@ struct zynqmp_dma_chan {
bool is_dmacoherent;
struct tasklet_struct tasklet;
bool idle;
- u32 desc_size;
+ size_t desc_size;
bool err;
u32 bus_width;
u32 src_burst_len;
@@ -486,7 +486,8 @@ static int zynqmp_dma_alloc_chan_resources(struct dma_chan *dchan)
}

chan->desc_pool_v = dma_alloc_coherent(chan->dev,
- (2 * chan->desc_size * ZYNQMP_DMA_NUM_DESCS),
+ (2 * ZYNQMP_DMA_DESC_SIZE(chan) *
+ ZYNQMP_DMA_NUM_DESCS),
&chan->desc_pool_p, GFP_KERNEL);
if (!chan->desc_pool_v)
return -ENOMEM;
--
2.35.1



2022-06-13 16:36:35

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.18 019/339] USB: storage: karma: fix rio_karma_init return

From: Lin Ma <[email protected]>

[ Upstream commit b92ffb1eddd9a66a90defc556dcbf65a43c196c7 ]

The function rio_karam_init() should return -ENOMEM instead of
value 0 (USB_STOR_TRANSPORT_GOOD) when allocation fails.

Similarly, it should return -EIO when rio_karma_send_command() fails.

Fixes: dfe0d3ba20e8 ("USB Storage: add rio karma eject support")
Acked-by: Alan Stern <[email protected]>
Signed-off-by: Lin Ma <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/usb/storage/karma.c | 15 ++++++++-------
1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/drivers/usb/storage/karma.c b/drivers/usb/storage/karma.c
index 05cec81dcd3f..38ddfedef629 100644
--- a/drivers/usb/storage/karma.c
+++ b/drivers/usb/storage/karma.c
@@ -174,24 +174,25 @@ static void rio_karma_destructor(void *extra)

static int rio_karma_init(struct us_data *us)
{
- int ret = 0;
struct karma_data *data = kzalloc(sizeof(struct karma_data), GFP_NOIO);

if (!data)
- goto out;
+ return -ENOMEM;

data->recv = kmalloc(RIO_RECV_LEN, GFP_NOIO);
if (!data->recv) {
kfree(data);
- goto out;
+ return -ENOMEM;
}

us->extra = data;
us->extra_destructor = rio_karma_destructor;
- ret = rio_karma_send_command(RIO_ENTER_STORAGE, us);
- data->in_storage = (ret == 0);
-out:
- return ret;
+ if (rio_karma_send_command(RIO_ENTER_STORAGE, us))
+ return -EIO;
+
+ data->in_storage = 1;
+
+ return 0;
}

static struct scsi_host_template karma_host_template;
--
2.35.1



2022-06-13 16:36:37

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.18 191/339] amt: fix wrong usage of pskb_may_pull()

From: Taehee Yoo <[email protected]>

[ Upstream commit f55a07074fdd38cab8c097ac5bd397d68eff733c ]

It adds missing pskb_may_pull() in amt_update_handler() and
amt_multicast_data_handler().
And it fixes wrong parameter of pskb_may_pull() in
amt_advertisement_handler() and amt_membership_query_handler().

Reported-by: Jakub Kicinski <[email protected]>
Fixes: cbc21dc1cfe9 ("amt: add data plane of amt interface")
Signed-off-by: Taehee Yoo <[email protected]>
Signed-off-by: Jakub Kicinski <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/net/amt.c | 55 +++++++++++++++++++++++++++++++----------------
1 file changed, 37 insertions(+), 18 deletions(-)

diff --git a/drivers/net/amt.c b/drivers/net/amt.c
index 22d7da749a24..fbb03562cb95 100644
--- a/drivers/net/amt.c
+++ b/drivers/net/amt.c
@@ -2220,8 +2220,7 @@ static bool amt_advertisement_handler(struct amt_dev *amt, struct sk_buff *skb)
struct amt_header_advertisement *amta;
int hdr_size;

- hdr_size = sizeof(*amta) - sizeof(struct amt_header);
-
+ hdr_size = sizeof(*amta) + sizeof(struct udphdr);
if (!pskb_may_pull(skb, hdr_size))
return true;

@@ -2251,19 +2250,27 @@ static bool amt_multicast_data_handler(struct amt_dev *amt, struct sk_buff *skb)
struct ethhdr *eth;
struct iphdr *iph;

+ hdr_size = sizeof(*amtmd) + sizeof(struct udphdr);
+ if (!pskb_may_pull(skb, hdr_size))
+ return true;
+
amtmd = (struct amt_header_mcast_data *)(udp_hdr(skb) + 1);
if (amtmd->reserved || amtmd->version)
return true;

- hdr_size = sizeof(*amtmd) + sizeof(struct udphdr);
if (iptunnel_pull_header(skb, hdr_size, htons(ETH_P_IP), false))
return true;
+
skb_reset_network_header(skb);
skb_push(skb, sizeof(*eth));
skb_reset_mac_header(skb);
skb_pull(skb, sizeof(*eth));
eth = eth_hdr(skb);
+
+ if (!pskb_may_pull(skb, sizeof(*iph)))
+ return true;
iph = ip_hdr(skb);
+
if (iph->version == 4) {
if (!ipv4_is_multicast(iph->daddr))
return true;
@@ -2274,6 +2281,9 @@ static bool amt_multicast_data_handler(struct amt_dev *amt, struct sk_buff *skb)
} else if (iph->version == 6) {
struct ipv6hdr *ip6h;

+ if (!pskb_may_pull(skb, sizeof(*ip6h)))
+ return true;
+
ip6h = ipv6_hdr(skb);
if (!ipv6_addr_is_multicast(&ip6h->daddr))
return true;
@@ -2306,8 +2316,7 @@ static bool amt_membership_query_handler(struct amt_dev *amt,
struct iphdr *iph;
int hdr_size, len;

- hdr_size = sizeof(*amtmq) - sizeof(struct amt_header);
-
+ hdr_size = sizeof(*amtmq) + sizeof(struct udphdr);
if (!pskb_may_pull(skb, hdr_size))
return true;

@@ -2315,22 +2324,27 @@ static bool amt_membership_query_handler(struct amt_dev *amt,
if (amtmq->reserved || amtmq->version)
return true;

- hdr_size = sizeof(*amtmq) + sizeof(struct udphdr) - sizeof(*eth);
+ hdr_size -= sizeof(*eth);
if (iptunnel_pull_header(skb, hdr_size, htons(ETH_P_TEB), false))
return true;
+
oeth = eth_hdr(skb);
skb_reset_mac_header(skb);
skb_pull(skb, sizeof(*eth));
skb_reset_network_header(skb);
eth = eth_hdr(skb);
+ if (!pskb_may_pull(skb, sizeof(*iph)))
+ return true;
+
iph = ip_hdr(skb);
if (iph->version == 4) {
- if (!ipv4_is_multicast(iph->daddr))
- return true;
if (!pskb_may_pull(skb, sizeof(*iph) + AMT_IPHDR_OPTS +
sizeof(*ihv3)))
return true;

+ if (!ipv4_is_multicast(iph->daddr))
+ return true;
+
ihv3 = skb_pull(skb, sizeof(*iph) + AMT_IPHDR_OPTS);
skb_reset_transport_header(skb);
skb_push(skb, sizeof(*iph) + AMT_IPHDR_OPTS);
@@ -2345,15 +2359,17 @@ static bool amt_membership_query_handler(struct amt_dev *amt,
ip_eth_mc_map(iph->daddr, eth->h_dest);
#if IS_ENABLED(CONFIG_IPV6)
} else if (iph->version == 6) {
- struct ipv6hdr *ip6h = ipv6_hdr(skb);
struct mld2_query *mld2q;
+ struct ipv6hdr *ip6h;

- if (!ipv6_addr_is_multicast(&ip6h->daddr))
- return true;
if (!pskb_may_pull(skb, sizeof(*ip6h) + AMT_IP6HDR_OPTS +
sizeof(*mld2q)))
return true;

+ ip6h = ipv6_hdr(skb);
+ if (!ipv6_addr_is_multicast(&ip6h->daddr))
+ return true;
+
mld2q = skb_pull(skb, sizeof(*ip6h) + AMT_IP6HDR_OPTS);
skb_reset_transport_header(skb);
skb_push(skb, sizeof(*ip6h) + AMT_IP6HDR_OPTS);
@@ -2389,23 +2405,23 @@ static bool amt_update_handler(struct amt_dev *amt, struct sk_buff *skb)
{
struct amt_header_membership_update *amtmu;
struct amt_tunnel_list *tunnel;
- struct udphdr *udph;
struct ethhdr *eth;
struct iphdr *iph;
- int len;
+ int len, hdr_size;

iph = ip_hdr(skb);
- udph = udp_hdr(skb);

- if (__iptunnel_pull_header(skb, sizeof(*udph), skb->protocol,
- false, false))
+ hdr_size = sizeof(*amtmu) + sizeof(struct udphdr);
+ if (!pskb_may_pull(skb, hdr_size))
return true;

- amtmu = (struct amt_header_membership_update *)skb->data;
+ amtmu = (struct amt_header_membership_update *)(udp_hdr(skb) + 1);
if (amtmu->reserved || amtmu->version)
return true;

- skb_pull(skb, sizeof(*amtmu));
+ if (iptunnel_pull_header(skb, hdr_size, skb->protocol, false))
+ return true;
+
skb_reset_network_header(skb);

list_for_each_entry_rcu(tunnel, &amt->tunnel_list, list) {
@@ -2426,6 +2442,9 @@ static bool amt_update_handler(struct amt_dev *amt, struct sk_buff *skb)
return true;

report:
+ if (!pskb_may_pull(skb, sizeof(*iph)))
+ return true;
+
iph = ip_hdr(skb);
if (iph->version == 4) {
if (ip_mc_check_igmp(skb)) {
--
2.35.1



2022-06-13 16:36:46

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.18 336/339] random: mark bootloader randomness code as __init

From: "Jason A. Donenfeld" <[email protected]>

commit 39e0f991a62ed5efabd20711a7b6e7da92603170 upstream.

add_bootloader_randomness() and the variables it touches are only used
during __init and not after, so mark these as __init. At the same time,
unexport this, since it's only called by other __init code that's
built-in.

Cc: [email protected]
Fixes: 428826f5358c ("fdt: add support for rng-seed")
Signed-off-by: Jason A. Donenfeld <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/char/random.c | 7 +++----
include/linux/random.h | 2 +-
2 files changed, 4 insertions(+), 5 deletions(-)

--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -793,8 +793,8 @@ static void __cold _credit_init_bits(siz
*
**********************************************************************/

-static bool trust_cpu __ro_after_init = IS_ENABLED(CONFIG_RANDOM_TRUST_CPU);
-static bool trust_bootloader __ro_after_init = IS_ENABLED(CONFIG_RANDOM_TRUST_BOOTLOADER);
+static bool trust_cpu __initdata = IS_ENABLED(CONFIG_RANDOM_TRUST_CPU);
+static bool trust_bootloader __initdata = IS_ENABLED(CONFIG_RANDOM_TRUST_BOOTLOADER);
static int __init parse_trust_cpu(char *arg)
{
return kstrtobool(arg, &trust_cpu);
@@ -890,13 +890,12 @@ EXPORT_SYMBOL_GPL(add_hwgenerator_random
* Handle random seed passed by bootloader, and credit it if
* CONFIG_RANDOM_TRUST_BOOTLOADER is set.
*/
-void __cold add_bootloader_randomness(const void *buf, size_t len)
+void __init add_bootloader_randomness(const void *buf, size_t len)
{
mix_pool_bytes(buf, len);
if (trust_bootloader)
credit_init_bits(len * 8);
}
-EXPORT_SYMBOL_GPL(add_bootloader_randomness);

#if IS_ENABLED(CONFIG_VMGENID)
static BLOCKING_NOTIFIER_HEAD(vmfork_chain);
--- a/include/linux/random.h
+++ b/include/linux/random.h
@@ -13,7 +13,7 @@
struct notifier_block;

void add_device_randomness(const void *buf, size_t len);
-void add_bootloader_randomness(const void *buf, size_t len);
+void __init add_bootloader_randomness(const void *buf, size_t len);
void add_input_randomness(unsigned int type, unsigned int code,
unsigned int value) __latent_entropy;
void add_interrupt_randomness(int irq) __latent_entropy;


2022-06-13 16:36:52

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.18 017/339] usb: usbip: fix a refcount leak in stub_probe()

From: Hangyu Hua <[email protected]>

[ Upstream commit 9ec4cbf1cc55d126759051acfe328d489c5d6e60 ]

usb_get_dev() is called in stub_device_alloc(). When stub_probe() fails
after that, usb_put_dev() needs to be called to release the reference.

Fix this by moving usb_put_dev() to sdev_free error path handling.

Find this by code review.

Fixes: 3ff67445750a ("usbip: fix error handling in stub_probe()")
Reviewed-by: Shuah Khan <[email protected]>
Signed-off-by: Hangyu Hua <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/usb/usbip/stub_dev.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/usbip/stub_dev.c b/drivers/usb/usbip/stub_dev.c
index d8d3892e5a69..3c6d452e3bf4 100644
--- a/drivers/usb/usbip/stub_dev.c
+++ b/drivers/usb/usbip/stub_dev.c
@@ -393,7 +393,6 @@ static int stub_probe(struct usb_device *udev)

err_port:
dev_set_drvdata(&udev->dev, NULL);
- usb_put_dev(udev);

/* we already have busid_priv, just lock busid_lock */
spin_lock(&busid_priv->busid_lock);
@@ -408,6 +407,7 @@ static int stub_probe(struct usb_device *udev)
put_busid_priv(busid_priv);

sdev_free:
+ usb_put_dev(udev);
stub_device_free(sdev);

return rc;
--
2.35.1



2022-06-13 16:36:56

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.18 187/339] ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe

From: Miaoqian Lin <[email protected]>

[ Upstream commit 10d6bdf532902be1d8aa5900b3c03c5671612aa2 ]

of_find_device_by_node() takes reference, we should use put_device()
to release it when not need anymore.
Add missing put_device() to avoid refcount leak.

Fixes: 43f01da0f279 ("MIPS/OCTEON/ata: Convert pata_octeon_cf.c to use device tree.")
Signed-off-by: Miaoqian Lin <[email protected]>
Reviewed-by: Sergey Shtylyov <[email protected]>
Signed-off-by: Damien Le Moal <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/ata/pata_octeon_cf.c | 3 +++
1 file changed, 3 insertions(+)

diff --git a/drivers/ata/pata_octeon_cf.c b/drivers/ata/pata_octeon_cf.c
index 6b5ed3046b44..35608a0cf552 100644
--- a/drivers/ata/pata_octeon_cf.c
+++ b/drivers/ata/pata_octeon_cf.c
@@ -856,12 +856,14 @@ static int octeon_cf_probe(struct platform_device *pdev)
int i;
res_dma = platform_get_resource(dma_dev, IORESOURCE_MEM, 0);
if (!res_dma) {
+ put_device(&dma_dev->dev);
of_node_put(dma_node);
return -EINVAL;
}
cf_port->dma_base = (u64)devm_ioremap(&pdev->dev, res_dma->start,
resource_size(res_dma));
if (!cf_port->dma_base) {
+ put_device(&dma_dev->dev);
of_node_put(dma_node);
return -EINVAL;
}
@@ -871,6 +873,7 @@ static int octeon_cf_probe(struct platform_device *pdev)
irq = i;
irq_handler = octeon_cf_interrupt;
}
+ put_device(&dma_dev->dev);
}
of_node_put(dma_node);
}
--
2.35.1



2022-06-13 16:37:04

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.18 313/339] mmc: block: Fix CQE recovery reset success

From: Adrian Hunter <[email protected]>

commit a051246b786af7e4a9d9219cc7038a6e8a411531 upstream.

The intention of the use of mmc_blk_reset_success() in
mmc_blk_cqe_recovery() was to prevent repeated resets when retrying and
getting the same error. However, that may not be the case - any amount
of time and I/O may pass before another recovery is needed, in which
case there would be no reason to deny it the opportunity to recover via
a reset if necessary. CQE recovery is expected seldom and failure to
recover (if the clear tasks command fails), even more seldom, so it is
better to allow the reset always, which can be done by calling
mmc_blk_reset_success() always.

Fixes: 1e8e55b67030c6 ("mmc: block: Add CQE support")
Cc: [email protected]
Signed-off-by: Adrian Hunter <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Ulf Hansson <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/mmc/core/block.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)

--- a/drivers/mmc/core/block.c
+++ b/drivers/mmc/core/block.c
@@ -1482,8 +1482,7 @@ void mmc_blk_cqe_recovery(struct mmc_que
err = mmc_cqe_recovery(host);
if (err)
mmc_blk_reset(mq->blkdata, host, MMC_BLK_CQE_RECOVERY);
- else
- mmc_blk_reset_success(mq->blkdata, MMC_BLK_CQE_RECOVERY);
+ mmc_blk_reset_success(mq->blkdata, MMC_BLK_CQE_RECOVERY);

pr_debug("%s: CQE recovery done\n", mmc_hostname(host));
}


2022-06-13 16:37:17

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.18 236/339] drivers: tty: serial: Fix deadlock in sa1100_set_termios()

From: Duoming Zhou <[email protected]>

[ Upstream commit 62b2caef400c1738b6d22f636c628d9f85cd4c4c ]

There is a deadlock in sa1100_set_termios(), which is shown
below:

(Thread 1) | (Thread 2)
| sa1100_enable_ms()
sa1100_set_termios() | mod_timer()
spin_lock_irqsave() //(1) | (wait a time)
... | sa1100_timeout()
del_timer_sync() | spin_lock_irqsave() //(2)
(wait timer to stop) | ...

We hold sport->port.lock in position (1) of thread 1 and
use del_timer_sync() to wait timer to stop, but timer handler
also need sport->port.lock in position (2) of thread 2. As a result,
sa1100_set_termios() will block forever.

This patch moves del_timer_sync() before spin_lock_irqsave()
in order to prevent the deadlock.

Signed-off-by: Duoming Zhou <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/tty/serial/sa1100.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/tty/serial/sa1100.c b/drivers/tty/serial/sa1100.c
index 5fe6cccfc1ae..e64e42a19d1a 100644
--- a/drivers/tty/serial/sa1100.c
+++ b/drivers/tty/serial/sa1100.c
@@ -446,6 +446,8 @@ sa1100_set_termios(struct uart_port *port, struct ktermios *termios,
baud = uart_get_baud_rate(port, termios, old, 0, port->uartclk/16);
quot = uart_get_divisor(port, baud);

+ del_timer_sync(&sport->timer);
+
spin_lock_irqsave(&sport->port.lock, flags);

sport->port.read_status_mask &= UTSR0_TO_SM(UTSR0_TFS);
@@ -476,8 +478,6 @@ sa1100_set_termios(struct uart_port *port, struct ktermios *termios,
UTSR1_TO_SM(UTSR1_ROR);
}

- del_timer_sync(&sport->timer);
-
/*
* Update the per-port timeout.
*/
--
2.35.1



2022-06-13 16:52:21

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.18 001/339] pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards

From: Randy Dunlap <[email protected]>

[ Upstream commit 3928cf08334ed895a31458cbebd8d4ec6d84c080 ]

When the MIPS_ALCHEMY board selection is MIPS_XXS1500 instead of
MIPS_DB1XXX, the PCMCIA driver 'db1xxx_ss' has build errors due
to missing DB1XXX symbols. The PCMCIA driver should be restricted
to MIPS_DB1XXX instead of MIPS_ALCHEMY to fix this build error.

ERROR: modpost: "bcsr_read" [drivers/pcmcia/db1xxx_ss.ko] undefined!
ERROR: modpost: "bcsr_mod" [drivers/pcmcia/db1xxx_ss.ko] undefined!

Fixes: 42a4f17dc356 ("MIPS: Alchemy: remove SOC_AU1X00 in favor of MIPS_ALCHEMY")
Signed-off-by: Randy Dunlap <[email protected]>
Reported-by: kernel test robot <[email protected]>
Cc: Arnd Bergmann <[email protected]>
Cc: Daniel Vetter <[email protected]>
Cc: Kees Cook <[email protected]>
Cc: Thomas Bogendoerfer <[email protected]>
Cc: [email protected]
Acked-by: Manuel Lauss <[email protected]>
Signed-off-by: Dominik Brodowski <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/pcmcia/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pcmcia/Kconfig b/drivers/pcmcia/Kconfig
index 2ce261cfff8e..89e4511e9c43 100644
--- a/drivers/pcmcia/Kconfig
+++ b/drivers/pcmcia/Kconfig
@@ -151,7 +151,7 @@ config TCIC

config PCMCIA_ALCHEMY_DEVBOARD
tristate "Alchemy Db/Pb1xxx PCMCIA socket services"
- depends on MIPS_ALCHEMY && PCMCIA
+ depends on MIPS_DB1XXX && PCMCIA
help
Enable this driver of you want PCMCIA support on your Alchemy
Db1000, Db/Pb1100, Db/Pb1500, Db/Pb1550, Db/Pb1200, DB1300
--
2.35.1



2022-06-13 16:59:55

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.18 174/339] rtla/Makefile: Properly handle dependencies

From: Daniel Bristot de Oliveira <[email protected]>

[ Upstream commit fe4d0d5dde457bb5832b866418b5036f4f0c8d13 ]

Linus had a problem compiling RTLA, saying:

"[...] I wish the tracing tools would do a bit more package
checking and helpful error messages too, rather than just
fail with:

fatal error: tracefs.h: No such file or directory"

Which is indeed not a helpful message. Update the Makefile, adding
proper checks for the dependencies, with useful information about
how to resolve possible problems.

For example, the previous error is now reported as:

$ make
********************************************
** NOTICE: libtracefs version 1.3 or higher not found
**
** Consider installing the latest libtracefs from your
** distribution, e.g., 'dnf install libtracefs' on Fedora,
** or from source:
**
** https://git.kernel.org/pub/scm/libs/libtrace/libtracefs.git/
**
********************************************

These messages are inspired by the ones used on trace-cmd, as suggested
by Stevel Rostedt.

Link: https://lore.kernel.org/r/CAHk-=whxmA86E=csNv76DuxX_wYsg8mW15oUs3XTabu2Yc80yw@mail.gmail.com/

Changes from V1:
- Moved the rst2man check to the install phase (when it is used).
- Removed the procps-ng lib check [1] as it is being removed.

[1] a0f9f8c1030c66305c9b921057c3d483064d5529.1651220820.git.bristot@kernel.org

Link: https://lkml.kernel.org/r/3f1fac776c37e4b67c876a94e5a0e45ed022ff3d.1651238057.git.bristot@kernel.org

Cc: Ingo Molnar <[email protected]>
Cc: Andrew Morton <[email protected]>
Reported-by: Linus Torvalds <[email protected]>
Suggested-by: Steven Rostedt <[email protected]>
Signed-off-by: Daniel Bristot de Oliveira <[email protected]>
Signed-off-by: Steven Rostedt (Google) <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
Documentation/tools/rtla/Makefile | 14 ++++++++++++-
tools/tracing/rtla/Makefile | 35 +++++++++++++++++++++++++++++++
2 files changed, 48 insertions(+), 1 deletion(-)

diff --git a/Documentation/tools/rtla/Makefile b/Documentation/tools/rtla/Makefile
index 9f2b84af1a6c..093af6d7a0e9 100644
--- a/Documentation/tools/rtla/Makefile
+++ b/Documentation/tools/rtla/Makefile
@@ -17,9 +17,21 @@ DOC_MAN1 = $(addprefix $(OUTPUT),$(_DOC_MAN1))
RST2MAN_DEP := $(shell command -v rst2man 2>/dev/null)
RST2MAN_OPTS += --verbose

+TEST_RST2MAN = $(shell sh -c "rst2man --version > /dev/null 2>&1 || echo n")
+
$(OUTPUT)%.1: %.rst
ifndef RST2MAN_DEP
- $(error "rst2man not found, but required to generate man pages")
+ $(info ********************************************)
+ $(info ** NOTICE: rst2man not found)
+ $(info **)
+ $(info ** Consider installing the latest rst2man from your)
+ $(info ** distribution, e.g., 'dnf install python3-docutils' on Fedora,)
+ $(info ** or from source:)
+ $(info **)
+ $(info ** https://docutils.sourceforge.io/docs/dev/repository.html )
+ $(info **)
+ $(info ********************************************)
+ $(error NOTICE: rst2man required to generate man pages)
endif
rst2man $(RST2MAN_OPTS) $< > $@

diff --git a/tools/tracing/rtla/Makefile b/tools/tracing/rtla/Makefile
index 523f0a8c38c2..3822f4ea5f49 100644
--- a/tools/tracing/rtla/Makefile
+++ b/tools/tracing/rtla/Makefile
@@ -58,6 +58,41 @@ else
DOCSRC = $(SRCTREE)/../../../Documentation/tools/rtla/
endif

+LIBTRACEEVENT_MIN_VERSION = 1.5
+LIBTRACEFS_MIN_VERSION = 1.3
+
+TEST_LIBTRACEEVENT = $(shell sh -c "$(PKG_CONFIG) --atleast-version $(LIBTRACEEVENT_MIN_VERSION) libtraceevent > /dev/null 2>&1 || echo n")
+ifeq ("$(TEST_LIBTRACEEVENT)", "n")
+.PHONY: warning_traceevent
+warning_traceevent:
+ @echo "********************************************"
+ @echo "** NOTICE: libtraceevent version $(LIBTRACEEVENT_MIN_VERSION) or higher not found"
+ @echo "**"
+ @echo "** Consider installing the latest libtraceevent from your"
+ @echo "** distribution, e.g., 'dnf install libtraceevent' on Fedora,"
+ @echo "** or from source:"
+ @echo "**"
+ @echo "** https://git.kernel.org/pub/scm/libs/libtrace/libtraceevent.git/ "
+ @echo "**"
+ @echo "********************************************"
+endif
+
+TEST_LIBTRACEFS = $(shell sh -c "$(PKG_CONFIG) --atleast-version $(LIBTRACEFS_MIN_VERSION) libtracefs > /dev/null 2>&1 || echo n")
+ifeq ("$(TEST_LIBTRACEFS)", "n")
+.PHONY: warning_tracefs
+warning_tracefs:
+ @echo "********************************************"
+ @echo "** NOTICE: libtracefs version $(LIBTRACEFS_MIN_VERSION) or higher not found"
+ @echo "**"
+ @echo "** Consider installing the latest libtracefs from your"
+ @echo "** distribution, e.g., 'dnf install libtracefs' on Fedora,"
+ @echo "** or from source:"
+ @echo "**"
+ @echo "** https://git.kernel.org/pub/scm/libs/libtrace/libtracefs.git/ "
+ @echo "**"
+ @echo "********************************************"
+endif
+
.PHONY: all
all: rtla

--
2.35.1



2022-06-13 17:00:02

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.18 270/339] um: line: Use separate IRQs per line

From: Johannes Berg <[email protected]>

[ Upstream commit d5a9597d6916a76663085db984cb8fe97f0a5c56 ]

Today, all possible serial lines (ssl*=) as well as all
possible consoles (con*=) each share a single interrupt
(with a fixed number) with others of the same type.

Now, if you have two lines, say ssl0 and ssl1, and one
of them is connected to an fd you cannot read (e.g. a
file), but the other gets a read interrupt, then both
of them get the interrupt since it's shared. Then, the
read() call will return EOF, since it's a file being
written and there's nothing to read (at least not at
the current offset, at the end).

Unfortunately, this is treated as a read error, and we
close this line, losing all the possible output.

It might be possible to work around this and make the
IRQ sharing work, however, now that we have dynamically
allocated IRQs that are easy to use, simply use that to
achieve separating between the events; then there's no
interrupt for that line and we never attempt the read
in the first place, thus not closing the line.

This manifested itself in the wifi hostap/hwsim tests
where the parallel script communicates via one serial
console and the kernel messages go to another (a file)
and sending data on the communication console caused
the kernel messages to stop flowing into the file.

Reported-by: Jouni Malinen <[email protected]>
Signed-off-by: Johannes Berg <[email protected]>
Acked-By: anton ivanov <[email protected]>
Signed-off-by: Richard Weinberger <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
arch/um/drivers/chan_kern.c | 10 +++++-----
arch/um/drivers/line.c | 22 +++++++++++++---------
arch/um/drivers/line.h | 4 ++--
arch/um/drivers/ssl.c | 2 --
arch/um/drivers/stdio_console.c | 2 --
arch/um/include/asm/irq.h | 22 +++++++++-------------
6 files changed, 29 insertions(+), 33 deletions(-)

diff --git a/arch/um/drivers/chan_kern.c b/arch/um/drivers/chan_kern.c
index 62997055c454..26a702a06515 100644
--- a/arch/um/drivers/chan_kern.c
+++ b/arch/um/drivers/chan_kern.c
@@ -133,7 +133,7 @@ static void line_timer_cb(struct work_struct *work)
struct line *line = container_of(work, struct line, task.work);

if (!line->throttled)
- chan_interrupt(line, line->driver->read_irq);
+ chan_interrupt(line, line->read_irq);
}

int enable_chan(struct line *line)
@@ -195,9 +195,9 @@ void free_irqs(void)
chan = list_entry(ele, struct chan, free_list);

if (chan->input && chan->enabled)
- um_free_irq(chan->line->driver->read_irq, chan);
+ um_free_irq(chan->line->read_irq, chan);
if (chan->output && chan->enabled)
- um_free_irq(chan->line->driver->write_irq, chan);
+ um_free_irq(chan->line->write_irq, chan);
chan->enabled = 0;
}
}
@@ -215,9 +215,9 @@ static void close_one_chan(struct chan *chan, int delay_free_irq)
spin_unlock_irqrestore(&irqs_to_free_lock, flags);
} else {
if (chan->input && chan->enabled)
- um_free_irq(chan->line->driver->read_irq, chan);
+ um_free_irq(chan->line->read_irq, chan);
if (chan->output && chan->enabled)
- um_free_irq(chan->line->driver->write_irq, chan);
+ um_free_irq(chan->line->write_irq, chan);
chan->enabled = 0;
}
if (chan->ops->close != NULL)
diff --git a/arch/um/drivers/line.c b/arch/um/drivers/line.c
index 8febf95da96e..02b0befd6763 100644
--- a/arch/um/drivers/line.c
+++ b/arch/um/drivers/line.c
@@ -139,7 +139,7 @@ static int flush_buffer(struct line *line)
count = line->buffer + LINE_BUFSIZE - line->head;

n = write_chan(line->chan_out, line->head, count,
- line->driver->write_irq);
+ line->write_irq);
if (n < 0)
return n;
if (n == count) {
@@ -156,7 +156,7 @@ static int flush_buffer(struct line *line)

count = line->tail - line->head;
n = write_chan(line->chan_out, line->head, count,
- line->driver->write_irq);
+ line->write_irq);

if (n < 0)
return n;
@@ -195,7 +195,7 @@ int line_write(struct tty_struct *tty, const unsigned char *buf, int len)
ret = buffer_data(line, buf, len);
else {
n = write_chan(line->chan_out, buf, len,
- line->driver->write_irq);
+ line->write_irq);
if (n < 0) {
ret = n;
goto out_up;
@@ -215,7 +215,7 @@ void line_throttle(struct tty_struct *tty)
{
struct line *line = tty->driver_data;

- deactivate_chan(line->chan_in, line->driver->read_irq);
+ deactivate_chan(line->chan_in, line->read_irq);
line->throttled = 1;
}

@@ -224,7 +224,7 @@ void line_unthrottle(struct tty_struct *tty)
struct line *line = tty->driver_data;

line->throttled = 0;
- chan_interrupt(line, line->driver->read_irq);
+ chan_interrupt(line, line->read_irq);
}

static irqreturn_t line_write_interrupt(int irq, void *data)
@@ -260,19 +260,23 @@ int line_setup_irq(int fd, int input, int output, struct line *line, void *data)
int err;

if (input) {
- err = um_request_irq(driver->read_irq, fd, IRQ_READ,
- line_interrupt, IRQF_SHARED,
+ err = um_request_irq(UM_IRQ_ALLOC, fd, IRQ_READ,
+ line_interrupt, 0,
driver->read_irq_name, data);
if (err < 0)
return err;
+
+ line->read_irq = err;
}

if (output) {
- err = um_request_irq(driver->write_irq, fd, IRQ_WRITE,
- line_write_interrupt, IRQF_SHARED,
+ err = um_request_irq(UM_IRQ_ALLOC, fd, IRQ_WRITE,
+ line_write_interrupt, 0,
driver->write_irq_name, data);
if (err < 0)
return err;
+
+ line->write_irq = err;
}

return 0;
diff --git a/arch/um/drivers/line.h b/arch/um/drivers/line.h
index bdb16b96e76f..f15be75a3bf3 100644
--- a/arch/um/drivers/line.h
+++ b/arch/um/drivers/line.h
@@ -23,9 +23,7 @@ struct line_driver {
const short minor_start;
const short type;
const short subtype;
- const int read_irq;
const char *read_irq_name;
- const int write_irq;
const char *write_irq_name;
struct mc_device mc;
struct tty_driver *driver;
@@ -35,6 +33,8 @@ struct line {
struct tty_port port;
int valid;

+ int read_irq, write_irq;
+
char *init_str;
struct list_head chan_list;
struct chan *chan_in, *chan_out;
diff --git a/arch/um/drivers/ssl.c b/arch/um/drivers/ssl.c
index 41eae2e8fb65..8514966778d5 100644
--- a/arch/um/drivers/ssl.c
+++ b/arch/um/drivers/ssl.c
@@ -47,9 +47,7 @@ static struct line_driver driver = {
.minor_start = 64,
.type = TTY_DRIVER_TYPE_SERIAL,
.subtype = 0,
- .read_irq = SSL_IRQ,
.read_irq_name = "ssl",
- .write_irq = SSL_WRITE_IRQ,
.write_irq_name = "ssl-write",
.mc = {
.list = LIST_HEAD_INIT(driver.mc.list),
diff --git a/arch/um/drivers/stdio_console.c b/arch/um/drivers/stdio_console.c
index e8b762f4d8c2..489d5a746ed3 100644
--- a/arch/um/drivers/stdio_console.c
+++ b/arch/um/drivers/stdio_console.c
@@ -53,9 +53,7 @@ static struct line_driver driver = {
.minor_start = 0,
.type = TTY_DRIVER_TYPE_CONSOLE,
.subtype = SYSTEM_TYPE_CONSOLE,
- .read_irq = CONSOLE_IRQ,
.read_irq_name = "console",
- .write_irq = CONSOLE_WRITE_IRQ,
.write_irq_name = "console-write",
.mc = {
.list = LIST_HEAD_INIT(driver.mc.list),
diff --git a/arch/um/include/asm/irq.h b/arch/um/include/asm/irq.h
index e187c789369d..749dfe8512e8 100644
--- a/arch/um/include/asm/irq.h
+++ b/arch/um/include/asm/irq.h
@@ -4,19 +4,15 @@

#define TIMER_IRQ 0
#define UMN_IRQ 1
-#define CONSOLE_IRQ 2
-#define CONSOLE_WRITE_IRQ 3
-#define UBD_IRQ 4
-#define UM_ETH_IRQ 5
-#define SSL_IRQ 6
-#define SSL_WRITE_IRQ 7
-#define ACCEPT_IRQ 8
-#define MCONSOLE_IRQ 9
-#define WINCH_IRQ 10
-#define SIGIO_WRITE_IRQ 11
-#define TELNETD_IRQ 12
-#define XTERM_IRQ 13
-#define RANDOM_IRQ 14
+#define UBD_IRQ 2
+#define UM_ETH_IRQ 3
+#define ACCEPT_IRQ 4
+#define MCONSOLE_IRQ 5
+#define WINCH_IRQ 6
+#define SIGIO_WRITE_IRQ 7
+#define TELNETD_IRQ 8
+#define XTERM_IRQ 9
+#define RANDOM_IRQ 10

#ifdef CONFIG_UML_NET_VECTOR

--
2.35.1



2022-06-13 17:00:11

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.18 015/339] phy: rockchip-inno-usb2: Fix muxed interrupt support

From: Samuel Holland <[email protected]>

[ Upstream commit 6a98df08ccd55e87947d253b19925691763e755c ]

This commit fixes two issues with the muxed interrupt handler. First,
the OTG port has the "bvalid" interrupt enabled, not "linestate". Since
only the linestate interrupt was handled, and not the bvalid interrupt,
plugging in a cable to the OTG port caused an interrupt storm.

Second, the return values from the individual port IRQ handlers need to
be OR-ed together. Otherwise, the lack of an interrupt from the last
port would cause the handler to erroneously return IRQ_NONE.

Fixes: ed2b5a8e6b98 ("phy: phy-rockchip-inno-usb2: support muxed interrupts")
Signed-off-by: Samuel Holland <[email protected]>
Tested-by: Michael Riesch <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Vinod Koul <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/phy/rockchip/phy-rockchip-inno-usb2.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/phy/rockchip/phy-rockchip-inno-usb2.c b/drivers/phy/rockchip/phy-rockchip-inno-usb2.c
index eca77e44a4c1..cba5c32cbaee 100644
--- a/drivers/phy/rockchip/phy-rockchip-inno-usb2.c
+++ b/drivers/phy/rockchip/phy-rockchip-inno-usb2.c
@@ -940,8 +940,14 @@ static irqreturn_t rockchip_usb2phy_irq(int irq, void *data)
if (!rport->phy)
continue;

- /* Handle linestate irq for both otg port and host port */
- ret = rockchip_usb2phy_linestate_irq(irq, rport);
+ switch (rport->port_id) {
+ case USB2PHY_PORT_OTG:
+ ret |= rockchip_usb2phy_otg_mux_irq(irq, rport);
+ break;
+ case USB2PHY_PORT_HOST:
+ ret |= rockchip_usb2phy_linestate_irq(irq, rport);
+ break;
+ }
}

return ret;
--
2.35.1



2022-06-13 17:00:18

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.18 027/339] scripts/get_abi: Fix wrong script file name in the help message

From: SeongJae Park <[email protected]>

[ Upstream commit 5b5bfecaa333fb6a0cce1bfc4852a622dacfed1d ]

The help message of 'get_abi.pl' is mistakenly saying it's
'abi_book.pl'. This commit fixes the wrong name in the help message.

Fixes: bbc249f2b859 ("scripts: add an script to parse the ABI files")
Signed-off-by: SeongJae Park <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
scripts/get_abi.pl | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/scripts/get_abi.pl b/scripts/get_abi.pl
index 1389db76cff3..0ffd5531242a 100755
--- a/scripts/get_abi.pl
+++ b/scripts/get_abi.pl
@@ -981,11 +981,11 @@ __END__

=head1 NAME

-abi_book.pl - parse the Linux ABI files and produce a ReST book.
+get_abi.pl - parse the Linux ABI files and produce a ReST book.

=head1 SYNOPSIS

-B<abi_book.pl> [--debug <level>] [--enable-lineno] [--man] [--help]
+B<get_abi.pl> [--debug <level>] [--enable-lineno] [--man] [--help]
[--(no-)rst-source] [--dir=<dir>] [--show-hints]
[--search-string <regex>]
<COMMAND> [<ARGUMENT>]
--
2.35.1



2022-06-13 17:01:15

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.18 248/339] clocksource/drivers/sp804: Avoid error on multiple instances

From: Andre Przywara <[email protected]>

[ Upstream commit a98399cbc1e05f7b977419f03905501d566cf54e ]

When a machine sports more than one SP804 timer instance, we only bring
up the first one, since multiple timers of the same kind are not useful
to Linux. As this is intentional behaviour, we should not return an
error message, as we do today:
===============
[ 0.000800] Failed to initialize '/bus@8000000/motherboard-bus@8000000/iofpga-bus@300000000/timer@120000': -22
===============

Replace the -EINVAL return with a debug message and return 0 instead.

Also we do not reach the init function anymore if the DT node is
disabled (as this is now handled by OF_DECLARE), so remove the explicit
check for that case.

This fixes a long standing bogus error when booting ARM's fastmodels.

Signed-off-by: Andre Przywara <[email protected]>
Reviewed-by: Robin Murphy <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Daniel Lezcano <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/clocksource/timer-sp804.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/clocksource/timer-sp804.c b/drivers/clocksource/timer-sp804.c
index 401d592e85f5..e6a87f4af2b5 100644
--- a/drivers/clocksource/timer-sp804.c
+++ b/drivers/clocksource/timer-sp804.c
@@ -259,6 +259,11 @@ static int __init sp804_of_init(struct device_node *np, struct sp804_timer *time
struct clk *clk1, *clk2;
const char *name = of_get_property(np, "compatible", NULL);

+ if (initialized) {
+ pr_debug("%pOF: skipping further SP804 timer device\n", np);
+ return 0;
+ }
+
base = of_iomap(np, 0);
if (!base)
return -ENXIO;
@@ -270,11 +275,6 @@ static int __init sp804_of_init(struct device_node *np, struct sp804_timer *time
writel(0, timer1_base + timer->ctrl);
writel(0, timer2_base + timer->ctrl);

- if (initialized || !of_device_is_available(np)) {
- ret = -EINVAL;
- goto err;
- }
-
clk1 = of_clk_get(np, 0);
if (IS_ERR(clk1))
clk1 = NULL;
--
2.35.1



2022-06-13 17:02:00

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.18 081/339] blk-mq: dont touch ->tagset in blk_mq_get_sq_hctx

From: Ming Lei <[email protected]>

[ Upstream commit 5d05426e2d5fd7df8afc866b78c36b37b00188b7 ]

blk_mq_run_hw_queues() could be run when there isn't queued request and
after queue is cleaned up, at that time tagset is freed, because tagset
lifetime is covered by driver, and often freed after blk_cleanup_queue()
returns.

So don't touch ->tagset for figuring out current default hctx by the mapping
built in request queue, so use-after-free on tagset can be avoided. Meantime
this way should be fast than retrieving mapping from tagset.

Cc: "yukuai (C)" <[email protected]>
Cc: Jan Kara <[email protected]>
Fixes: b6e68ee82585 ("blk-mq: Improve performance of non-mq IO schedulers with multiple HW queues")
Signed-off-by: Ming Lei <[email protected]>
Reviewed-by: Jan Kara <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Jens Axboe <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
block/blk-mq.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/block/blk-mq.c b/block/blk-mq.c
index 84d749511f55..9d33e0032fee 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -2123,8 +2123,7 @@ static bool blk_mq_has_sqsched(struct request_queue *q)
*/
static struct blk_mq_hw_ctx *blk_mq_get_sq_hctx(struct request_queue *q)
{
- struct blk_mq_hw_ctx *hctx;
-
+ struct blk_mq_ctx *ctx = blk_mq_get_ctx(q);
/*
* If the IO scheduler does not respect hardware queues when
* dispatching, we just don't bother with multiple HW queues and
@@ -2132,8 +2131,8 @@ static struct blk_mq_hw_ctx *blk_mq_get_sq_hctx(struct request_queue *q)
* just causes lock contention inside the scheduler and pointless cache
* bouncing.
*/
- hctx = blk_mq_map_queue_type(q, HCTX_TYPE_DEFAULT,
- raw_smp_processor_id());
+ struct blk_mq_hw_ctx *hctx = blk_mq_map_queue(q, 0, ctx);
+
if (!blk_mq_hctx_stopped(hctx))
return hctx;
return NULL;
--
2.35.1



2022-06-13 17:04:32

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.18 154/339] dmaengine: idxd: set DMA_INTERRUPT cap bit

From: Dave Jiang <[email protected]>

[ Upstream commit 4e5a4eb20393b851590b4465f1197a8041c2076b ]

Even though idxd driver has always supported interrupt, it never actually
set the DMA_INTERRUPT cap bit. Rectify this mistake so the interrupt
capability is advertised.

Reported-by: Ben Walker <[email protected]>
Signed-off-by: Dave Jiang <[email protected]>
Link: https://lore.kernel.org/r/164971497859.2201379.17925303210723708961.stgit@djiang5-desk3.ch.intel.com
Signed-off-by: Vinod Koul <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/dma/idxd/dma.c | 1 +
1 file changed, 1 insertion(+)

diff --git a/drivers/dma/idxd/dma.c b/drivers/dma/idxd/dma.c
index bfff59617d04..13e061944db9 100644
--- a/drivers/dma/idxd/dma.c
+++ b/drivers/dma/idxd/dma.c
@@ -193,6 +193,7 @@ int idxd_register_dma_device(struct idxd_device *idxd)
INIT_LIST_HEAD(&dma->channels);
dma->dev = dev;

+ dma_cap_set(DMA_INTERRUPT, dma->cap_mask);
dma_cap_set(DMA_PRIVATE, dma->cap_mask);
dma_cap_set(DMA_COMPLETION_NO_ORDER, dma->cap_mask);
dma->device_release = idxd_dma_release;
--
2.35.1



2022-06-13 17:04:34

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.18 133/339] bonding: guard ns_targets by CONFIG_IPV6

From: Hangbin Liu <[email protected]>

[ Upstream commit c4caa500ffebf64795d1c0f6f9d6f179b502c6b7 ]

Guard ns_targets in struct bond_params by CONFIG_IPV6, which could save
256 bytes if IPv6 not configed. Also add this protection for function
bond_is_ip6_target_ok() and bond_get_targets_ip6().

Remove the IS_ENABLED() check for bond_opts[] as this will make
BOND_OPT_NS_TARGETS uninitialized if CONFIG_IPV6 not enabled. Add
a dummy bond_option_ns_ip6_targets_set() for this situation.

Fixes: 4e24be018eb9 ("bonding: add new parameter ns_targets")
Signed-off-by: Hangbin Liu <[email protected]>
Acked-by: Jonathan Toppins <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Paolo Abeni <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/net/bonding/bond_main.c | 2 ++
drivers/net/bonding/bond_options.c | 10 ++++++----
include/net/bonding.h | 6 ++++++
3 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index b5c5196e03ee..26a6573adf0f 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -6159,7 +6159,9 @@ static int bond_check_params(struct bond_params *params)
strscpy_pad(params->primary, primary, sizeof(params->primary));

memcpy(params->arp_targets, arp_target, sizeof(arp_target));
+#if IS_ENABLED(CONFIG_IPV6)
memset(params->ns_targets, 0, sizeof(struct in6_addr) * BOND_MAX_NS_TARGETS);
+#endif

return 0;
}
diff --git a/drivers/net/bonding/bond_options.c b/drivers/net/bonding/bond_options.c
index 64f7db2627ce..1f8323ad5282 100644
--- a/drivers/net/bonding/bond_options.c
+++ b/drivers/net/bonding/bond_options.c
@@ -34,10 +34,8 @@ static int bond_option_arp_ip_target_add(struct bonding *bond, __be32 target);
static int bond_option_arp_ip_target_rem(struct bonding *bond, __be32 target);
static int bond_option_arp_ip_targets_set(struct bonding *bond,
const struct bond_opt_value *newval);
-#if IS_ENABLED(CONFIG_IPV6)
static int bond_option_ns_ip6_targets_set(struct bonding *bond,
const struct bond_opt_value *newval);
-#endif
static int bond_option_arp_validate_set(struct bonding *bond,
const struct bond_opt_value *newval);
static int bond_option_arp_all_targets_set(struct bonding *bond,
@@ -299,7 +297,6 @@ static const struct bond_option bond_opts[BOND_OPT_LAST] = {
.flags = BOND_OPTFLAG_RAWVAL,
.set = bond_option_arp_ip_targets_set
},
-#if IS_ENABLED(CONFIG_IPV6)
[BOND_OPT_NS_TARGETS] = {
.id = BOND_OPT_NS_TARGETS,
.name = "ns_ip6_target",
@@ -307,7 +304,6 @@ static const struct bond_option bond_opts[BOND_OPT_LAST] = {
.flags = BOND_OPTFLAG_RAWVAL,
.set = bond_option_ns_ip6_targets_set
},
-#endif
[BOND_OPT_DOWNDELAY] = {
.id = BOND_OPT_DOWNDELAY,
.name = "downdelay",
@@ -1254,6 +1250,12 @@ static int bond_option_ns_ip6_targets_set(struct bonding *bond,

return 0;
}
+#else
+static int bond_option_ns_ip6_targets_set(struct bonding *bond,
+ const struct bond_opt_value *newval)
+{
+ return -EPERM;
+}
#endif

static int bond_option_arp_validate_set(struct bonding *bond,
diff --git a/include/net/bonding.h b/include/net/bonding.h
index b14f4c0b4e9e..cb904d356e31 100644
--- a/include/net/bonding.h
+++ b/include/net/bonding.h
@@ -149,7 +149,9 @@ struct bond_params {
struct reciprocal_value reciprocal_packets_per_slave;
u16 ad_actor_sys_prio;
u16 ad_user_port_key;
+#if IS_ENABLED(CONFIG_IPV6)
struct in6_addr ns_targets[BOND_MAX_NS_TARGETS];
+#endif

/* 2 bytes of padding : see ether_addr_equal_64bits() */
u8 ad_actor_system[ETH_ALEN + 2];
@@ -503,12 +505,14 @@ static inline int bond_is_ip_target_ok(__be32 addr)
return !ipv4_is_lbcast(addr) && !ipv4_is_zeronet(addr);
}

+#if IS_ENABLED(CONFIG_IPV6)
static inline int bond_is_ip6_target_ok(struct in6_addr *addr)
{
return !ipv6_addr_any(addr) &&
!ipv6_addr_loopback(addr) &&
!ipv6_addr_is_multicast(addr);
}
+#endif

/* Get the oldest arp which we've received on this slave for bond's
* arp_targets.
@@ -746,6 +750,7 @@ static inline int bond_get_targets_ip(__be32 *targets, __be32 ip)
return -1;
}

+#if IS_ENABLED(CONFIG_IPV6)
static inline int bond_get_targets_ip6(struct in6_addr *targets, struct in6_addr *ip)
{
int i;
@@ -758,6 +763,7 @@ static inline int bond_get_targets_ip6(struct in6_addr *targets, struct in6_addr

return -1;
}
+#endif

/* exported from bond_main.c */
extern unsigned int bond_net_id;
--
2.35.1



2022-06-13 17:04:47

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.18 324/339] cpuidle,intel_idle: Fix CPUIDLE_FLAG_IRQ_ENABLE

From: Peter Zijlstra <[email protected]>

commit 32d4fd5751eadbe1823a37eb38df85ec5c8e6207 upstream.

Commit c227233ad64c ("intel_idle: enable interrupts before C1 on
Xeons") wrecked intel_idle in two ways:

- must not have tracing in idle functions
- must return with IRQs disabled

Additionally, it added a branch for no good reason.

Fixes: c227233ad64c ("intel_idle: enable interrupts before C1 on Xeons")
Signed-off-by: Peter Zijlstra (Intel) <[email protected]>
[ rjw: Moved the intel_idle() kerneldoc comment next to the function ]
Cc: 5.16+ <[email protected]> # 5.16+
Signed-off-by: Rafael J. Wysocki <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/idle/intel_idle.c | 32 +++++++++++++++++++++++++-------
1 file changed, 25 insertions(+), 7 deletions(-)

--- a/drivers/idle/intel_idle.c
+++ b/drivers/idle/intel_idle.c
@@ -115,6 +115,18 @@ static unsigned int mwait_substates __in
#define flg2MWAIT(flags) (((flags) >> 24) & 0xFF)
#define MWAIT2flg(eax) ((eax & 0xFF) << 24)

+static __always_inline int __intel_idle(struct cpuidle_device *dev,
+ struct cpuidle_driver *drv, int index)
+{
+ struct cpuidle_state *state = &drv->states[index];
+ unsigned long eax = flg2MWAIT(state->flags);
+ unsigned long ecx = 1; /* break on interrupt flag */
+
+ mwait_idle_with_hints(eax, ecx);
+
+ return index;
+}
+
/**
* intel_idle - Ask the processor to enter the given idle state.
* @dev: cpuidle device of the target CPU.
@@ -132,16 +144,19 @@ static unsigned int mwait_substates __in
static __cpuidle int intel_idle(struct cpuidle_device *dev,
struct cpuidle_driver *drv, int index)
{
- struct cpuidle_state *state = &drv->states[index];
- unsigned long eax = flg2MWAIT(state->flags);
- unsigned long ecx = 1; /* break on interrupt flag */
+ return __intel_idle(dev, drv, index);
+}

- if (state->flags & CPUIDLE_FLAG_IRQ_ENABLE)
- local_irq_enable();
+static __cpuidle int intel_idle_irq(struct cpuidle_device *dev,
+ struct cpuidle_driver *drv, int index)
+{
+ int ret;

- mwait_idle_with_hints(eax, ecx);
+ raw_local_irq_enable();
+ ret = __intel_idle(dev, drv, index);
+ raw_local_irq_disable();

- return index;
+ return ret;
}

/**
@@ -1668,6 +1683,9 @@ static void __init intel_idle_init_cstat
/* Structure copy. */
drv->states[drv->state_count] = cpuidle_state_table[cstate];

+ if (cpuidle_state_table[cstate].flags & CPUIDLE_FLAG_IRQ_ENABLE)
+ drv->states[drv->state_count].enter = intel_idle_irq;
+
if ((disabled_states_mask & BIT(drv->state_count)) ||
((icpu->use_acpi || force_use_acpi) &&
intel_idle_off_by_default(mwait_hint) &&


2022-06-13 17:04:54

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.18 046/339] export: fix string handling of namespace in EXPORT_SYMBOL_NS

From: Greg Kroah-Hartman <[email protected]>

[ Upstream commit d143b9db8069f0e2a0fa34484e806a55a0dd4855 ]

Commit c3a6cf19e695 ("export: avoid code duplication in
include/linux/export.h") broke the ability for a defined string to be
used as a namespace value. Fix this up by using stringify to properly
encode the namespace name.

Fixes: c3a6cf19e695 ("export: avoid code duplication in include/linux/export.h")
Cc: Miroslav Benes <[email protected]>
Cc: Emil Velikov <[email protected]>
Cc: Jessica Yu <[email protected]>
Cc: Quentin Perret <[email protected]>
Cc: Matthias Maennich <[email protected]>
Reviewed-by: Masahiro Yamada <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
include/linux/export.h | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/include/linux/export.h b/include/linux/export.h
index 27d848712b90..5910ccb66ca2 100644
--- a/include/linux/export.h
+++ b/include/linux/export.h
@@ -2,6 +2,8 @@
#ifndef _LINUX_EXPORT_H
#define _LINUX_EXPORT_H

+#include <linux/stringify.h>
+
/*
* Export symbols from the kernel to modules. Forked from module.h
* to reduce the amount of pointless cruft we feed to gcc when only
@@ -154,7 +156,6 @@ struct kernel_symbol {
#endif /* CONFIG_MODULES */

#ifdef DEFAULT_SYMBOL_NAMESPACE
-#include <linux/stringify.h>
#define _EXPORT_SYMBOL(sym, sec) __EXPORT_SYMBOL(sym, sec, __stringify(DEFAULT_SYMBOL_NAMESPACE))
#else
#define _EXPORT_SYMBOL(sym, sec) __EXPORT_SYMBOL(sym, sec, "")
@@ -162,8 +163,8 @@ struct kernel_symbol {

#define EXPORT_SYMBOL(sym) _EXPORT_SYMBOL(sym, "")
#define EXPORT_SYMBOL_GPL(sym) _EXPORT_SYMBOL(sym, "_gpl")
-#define EXPORT_SYMBOL_NS(sym, ns) __EXPORT_SYMBOL(sym, "", #ns)
-#define EXPORT_SYMBOL_NS_GPL(sym, ns) __EXPORT_SYMBOL(sym, "_gpl", #ns)
+#define EXPORT_SYMBOL_NS(sym, ns) __EXPORT_SYMBOL(sym, "", __stringify(ns))
+#define EXPORT_SYMBOL_NS_GPL(sym, ns) __EXPORT_SYMBOL(sym, "_gpl", __stringify(ns))

#endif /* !__ASSEMBLY__ */

--
2.35.1



2022-06-13 17:05:55

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.18 246/339] extcon: Fix extcon_get_extcon_dev() error handling

From: Dan Carpenter <[email protected]>

[ Upstream commit 58e4a2d27d3255e4e8c507fdc13734dccc9fc4c7 ]

The extcon_get_extcon_dev() function returns error pointers on error,
NULL when it's a -EPROBE_DEFER defer situation, and ERR_PTR(-ENODEV)
when the CONFIG_EXTCON option is disabled. This is very complicated for
the callers to handle and a number of them had bugs that would lead to
an Oops.

In real life, there are two things which prevented crashes. First,
error pointers would only be returned if there was bug in the caller
where they passed a NULL "extcon_name" and none of them do that.
Second, only two out of the eight drivers will build when CONFIG_EXTCON
is disabled.

The normal way to write this would be to return -EPROBE_DEFER directly
when appropriate and return NULL when CONFIG_EXTCON is disabled. Then
the error handling is simple and just looks like:

dev->edev = extcon_get_extcon_dev(acpi_dev_name(adev));
if (IS_ERR(dev->edev))
return PTR_ERR(dev->edev);

For the two drivers which can build with CONFIG_EXTCON disabled, then
extcon_get_extcon_dev() will now return NULL which is not treated as an
error and the probe will continue successfully. Those two drivers are
"typec_fusb302" and "max8997-battery". In the original code, the
typec_fusb302 driver had an 800ms hang in tcpm_get_current_limit() but
now that function is a no-op. For the max8997-battery driver everything
should continue working as is.

Signed-off-by: Dan Carpenter <[email protected]>
Reviewed-by: Hans de Goede <[email protected]>
Reviewed-by: Heikki Krogerus <[email protected]>
Reviewed-by: Guenter Roeck <[email protected]>
Acked-by: Sebastian Reichel <[email protected]>
Signed-off-by: Chanwoo Choi <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/extcon/extcon-axp288.c | 4 ++--
drivers/extcon/extcon.c | 4 +++-
drivers/power/supply/axp288_charger.c | 17 ++++++++++-------
drivers/power/supply/charger-manager.c | 7 ++-----
drivers/power/supply/max8997_charger.c | 8 ++++----
drivers/usb/dwc3/drd.c | 9 ++-------
drivers/usb/phy/phy-omap-otg.c | 4 ++--
drivers/usb/typec/tcpm/fusb302.c | 4 ++--
include/linux/extcon.h | 2 +-
9 files changed, 28 insertions(+), 31 deletions(-)

diff --git a/drivers/extcon/extcon-axp288.c b/drivers/extcon/extcon-axp288.c
index 7c6d5857ff25..180be768c215 100644
--- a/drivers/extcon/extcon-axp288.c
+++ b/drivers/extcon/extcon-axp288.c
@@ -394,8 +394,8 @@ static int axp288_extcon_probe(struct platform_device *pdev)
if (adev) {
info->id_extcon = extcon_get_extcon_dev(acpi_dev_name(adev));
put_device(&adev->dev);
- if (!info->id_extcon)
- return -EPROBE_DEFER;
+ if (IS_ERR(info->id_extcon))
+ return PTR_ERR(info->id_extcon);

dev_info(dev, "controlling USB role\n");
} else {
diff --git a/drivers/extcon/extcon.c b/drivers/extcon/extcon.c
index a09e704fd0fa..adb957470c65 100644
--- a/drivers/extcon/extcon.c
+++ b/drivers/extcon/extcon.c
@@ -851,6 +851,8 @@ EXPORT_SYMBOL_GPL(extcon_set_property_capability);
* @extcon_name: the extcon name provided with extcon_dev_register()
*
* Return the pointer of extcon device if success or ERR_PTR(err) if fail.
+ * NOTE: This function returns -EPROBE_DEFER so it may only be called from
+ * probe() functions.
*/
struct extcon_dev *extcon_get_extcon_dev(const char *extcon_name)
{
@@ -864,7 +866,7 @@ struct extcon_dev *extcon_get_extcon_dev(const char *extcon_name)
if (!strcmp(sd->name, extcon_name))
goto out;
}
- sd = NULL;
+ sd = ERR_PTR(-EPROBE_DEFER);
out:
mutex_unlock(&extcon_dev_list_lock);
return sd;
diff --git a/drivers/power/supply/axp288_charger.c b/drivers/power/supply/axp288_charger.c
index 19746e658a6a..15219ed43ce9 100644
--- a/drivers/power/supply/axp288_charger.c
+++ b/drivers/power/supply/axp288_charger.c
@@ -865,17 +865,20 @@ static int axp288_charger_probe(struct platform_device *pdev)
info->regmap_irqc = axp20x->regmap_irqc;

info->cable.edev = extcon_get_extcon_dev(AXP288_EXTCON_DEV_NAME);
- if (info->cable.edev == NULL) {
- dev_dbg(dev, "%s is not ready, probe deferred\n",
- AXP288_EXTCON_DEV_NAME);
- return -EPROBE_DEFER;
+ if (IS_ERR(info->cable.edev)) {
+ dev_err_probe(dev, PTR_ERR(info->cable.edev),
+ "extcon_get_extcon_dev(%s) failed\n",
+ AXP288_EXTCON_DEV_NAME);
+ return PTR_ERR(info->cable.edev);
}

if (acpi_dev_present(USB_HOST_EXTCON_HID, NULL, -1)) {
info->otg.cable = extcon_get_extcon_dev(USB_HOST_EXTCON_NAME);
- if (info->otg.cable == NULL) {
- dev_dbg(dev, "EXTCON_USB_HOST is not ready, probe deferred\n");
- return -EPROBE_DEFER;
+ if (IS_ERR(info->otg.cable)) {
+ dev_err_probe(dev, PTR_ERR(info->otg.cable),
+ "extcon_get_extcon_dev(%s) failed\n",
+ USB_HOST_EXTCON_NAME);
+ return PTR_ERR(info->otg.cable);
}
dev_info(dev, "Using " USB_HOST_EXTCON_HID " extcon for usb-id\n");
}
diff --git a/drivers/power/supply/charger-manager.c b/drivers/power/supply/charger-manager.c
index d67edb760c94..92db79400a6a 100644
--- a/drivers/power/supply/charger-manager.c
+++ b/drivers/power/supply/charger-manager.c
@@ -985,13 +985,10 @@ static int charger_extcon_init(struct charger_manager *cm,
cable->nb.notifier_call = charger_extcon_notifier;

cable->extcon_dev = extcon_get_extcon_dev(cable->extcon_name);
- if (IS_ERR_OR_NULL(cable->extcon_dev)) {
+ if (IS_ERR(cable->extcon_dev)) {
pr_err("Cannot find extcon_dev for %s (cable: %s)\n",
cable->extcon_name, cable->name);
- if (cable->extcon_dev == NULL)
- return -EPROBE_DEFER;
- else
- return PTR_ERR(cable->extcon_dev);
+ return PTR_ERR(cable->extcon_dev);
}

for (i = 0; i < ARRAY_SIZE(extcon_mapping); i++) {
diff --git a/drivers/power/supply/max8997_charger.c b/drivers/power/supply/max8997_charger.c
index 127c73b0b3bd..1ec3535a257d 100644
--- a/drivers/power/supply/max8997_charger.c
+++ b/drivers/power/supply/max8997_charger.c
@@ -242,10 +242,10 @@ static int max8997_battery_probe(struct platform_device *pdev)
dev_info(&pdev->dev, "couldn't get charger regulator\n");
}
charger->edev = extcon_get_extcon_dev("max8997-muic");
- if (IS_ERR_OR_NULL(charger->edev)) {
- if (!charger->edev)
- return -EPROBE_DEFER;
- dev_info(charger->dev, "couldn't get extcon device\n");
+ if (IS_ERR(charger->edev)) {
+ dev_err_probe(charger->dev, PTR_ERR(charger->edev),
+ "couldn't get extcon device: max8997-muic\n");
+ return PTR_ERR(charger->edev);
}

if (!IS_ERR(charger->reg) && !IS_ERR_OR_NULL(charger->edev)) {
diff --git a/drivers/usb/dwc3/drd.c b/drivers/usb/dwc3/drd.c
index 8cad9e7d3368..4982edd13047 100644
--- a/drivers/usb/dwc3/drd.c
+++ b/drivers/usb/dwc3/drd.c
@@ -455,13 +455,8 @@ static struct extcon_dev *dwc3_get_extcon(struct dwc3 *dwc)
* This device property is for kernel internal use only and
* is expected to be set by the glue code.
*/
- if (device_property_read_string(dev, "linux,extcon-name", &name) == 0) {
- edev = extcon_get_extcon_dev(name);
- if (!edev)
- return ERR_PTR(-EPROBE_DEFER);
-
- return edev;
- }
+ if (device_property_read_string(dev, "linux,extcon-name", &name) == 0)
+ return extcon_get_extcon_dev(name);

/*
* Try to get an extcon device from the USB PHY controller's "port"
diff --git a/drivers/usb/phy/phy-omap-otg.c b/drivers/usb/phy/phy-omap-otg.c
index ee0863c6553e..6e6ef8c0bc7e 100644
--- a/drivers/usb/phy/phy-omap-otg.c
+++ b/drivers/usb/phy/phy-omap-otg.c
@@ -95,8 +95,8 @@ static int omap_otg_probe(struct platform_device *pdev)
return -ENODEV;

extcon = extcon_get_extcon_dev(config->extcon);
- if (!extcon)
- return -EPROBE_DEFER;
+ if (IS_ERR(extcon))
+ return PTR_ERR(extcon);

otg_dev = devm_kzalloc(&pdev->dev, sizeof(*otg_dev), GFP_KERNEL);
if (!otg_dev)
diff --git a/drivers/usb/typec/tcpm/fusb302.c b/drivers/usb/typec/tcpm/fusb302.c
index 72f9001b0792..96c55eaf3f80 100644
--- a/drivers/usb/typec/tcpm/fusb302.c
+++ b/drivers/usb/typec/tcpm/fusb302.c
@@ -1708,8 +1708,8 @@ static int fusb302_probe(struct i2c_client *client,
*/
if (device_property_read_string(dev, "linux,extcon-name", &name) == 0) {
chip->extcon = extcon_get_extcon_dev(name);
- if (!chip->extcon)
- return -EPROBE_DEFER;
+ if (IS_ERR(chip->extcon))
+ return PTR_ERR(chip->extcon);
}

chip->vbus = devm_regulator_get(chip->dev, "vbus");
diff --git a/include/linux/extcon.h b/include/linux/extcon.h
index 0c19010da77f..685401d94d39 100644
--- a/include/linux/extcon.h
+++ b/include/linux/extcon.h
@@ -296,7 +296,7 @@ static inline void devm_extcon_unregister_notifier_all(struct device *dev,

static inline struct extcon_dev *extcon_get_extcon_dev(const char *extcon_name)
{
- return ERR_PTR(-ENODEV);
+ return NULL;
}

static inline struct extcon_dev *extcon_find_edev_by_node(struct device_node *node)
--
2.35.1



2022-06-13 17:06:07

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.18 024/339] rpmsg: qcom_smd: Fix irq_of_parse_and_map() return value

From: Krzysztof Kozlowski <[email protected]>

[ Upstream commit 1a358d35066487d228a68303d808bc4721c6b1b9 ]

The irq_of_parse_and_map() returns 0 on failure, not a negative ERRNO.

Fixes: 53e2822e56c7 ("rpmsg: Introduce Qualcomm SMD backend")
Signed-off-by: Krzysztof Kozlowski <[email protected]>
Signed-off-by: Bjorn Andersson <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/rpmsg/qcom_smd.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/rpmsg/qcom_smd.c b/drivers/rpmsg/qcom_smd.c
index 764c980507be..6ccfa12abd10 100644
--- a/drivers/rpmsg/qcom_smd.c
+++ b/drivers/rpmsg/qcom_smd.c
@@ -1407,7 +1407,7 @@ static int qcom_smd_parse_edge(struct device *dev,
edge->name = node->name;

irq = irq_of_parse_and_map(node, 0);
- if (irq < 0) {
+ if (!irq) {
dev_err(dev, "required smd interrupt missing\n");
ret = irq;
goto put_node;
--
2.35.1



2022-06-13 17:06:11

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.18 205/339] SUNRPC: Fix the calculation of xdr->end in xdr_get_next_encode_buffer()

From: Chuck Lever <[email protected]>

[ Upstream commit 6c254bf3b637dd4ef4f78eb78c7447419c0161d7 ]

I found that NFSD's new NFSv3 READDIRPLUS XDR encoder was screwing up
right at the end of the page array. xdr_get_next_encode_buffer() does
not compute the value of xdr->end correctly:

* The check to see if we're on the final available page in xdr->buf
needs to account for the space consumed by @nbytes.

* The new xdr->end value needs to account for the portion of @nbytes
that is to be encoded into the previous buffer.

Fixes: 2825a7f90753 ("nfsd4: allow encoding across page boundaries")
Signed-off-by: Chuck Lever <[email protected]>
Reviewed-by: NeilBrown <[email protected]>
Reviewed-by: J. Bruce Fields <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
net/sunrpc/xdr.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
index df194cc07035..b57cf9df4de8 100644
--- a/net/sunrpc/xdr.c
+++ b/net/sunrpc/xdr.c
@@ -979,7 +979,11 @@ static __be32 *xdr_get_next_encode_buffer(struct xdr_stream *xdr,
*/
xdr->p = (void *)p + frag2bytes;
space_left = xdr->buf->buflen - xdr->buf->len;
- xdr->end = (void *)p + min_t(int, space_left, PAGE_SIZE);
+ if (space_left - nbytes >= PAGE_SIZE)
+ xdr->end = (void *)p + PAGE_SIZE;
+ else
+ xdr->end = (void *)p + space_left - frag1bytes;
+
xdr->buf->page_len += frag2bytes;
xdr->buf->len += nbytes;
return p;
--
2.35.1



2022-06-13 17:06:20

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.18 028/339] misc: fastrpc: fix an incorrect NULL check on list iterator

From: Xiaomeng Tong <[email protected]>

[ Upstream commit 5ac11fe03a0a83042d1a040dbce4fa2fb5521e23 ]

The bug is here:
if (!buf) {

The list iterator value 'buf' will *always* be set and non-NULL
by list_for_each_entry(), so it is incorrect to assume that the
iterator value will be NULL if the list is empty (in this case, the
check 'if (!buf) {' will always be false and never exit expectly).

To fix the bug, use a new variable 'iter' as the list iterator,
while use the original variable 'buf' as a dedicated pointer to
point to the found element.

Fixes: 2419e55e532de ("misc: fastrpc: add mmap/unmap support")
Signed-off-by: Xiaomeng Tong <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/misc/fastrpc.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
index 29cf292c0aba..93ebd174d848 100644
--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -1606,17 +1606,18 @@ static int fastrpc_req_munmap_impl(struct fastrpc_user *fl,
struct fastrpc_req_munmap *req)
{
struct fastrpc_invoke_args args[1] = { [0] = { 0 } };
- struct fastrpc_buf *buf, *b;
+ struct fastrpc_buf *buf = NULL, *iter, *b;
struct fastrpc_munmap_req_msg req_msg;
struct device *dev = fl->sctx->dev;
int err;
u32 sc;

spin_lock(&fl->lock);
- list_for_each_entry_safe(buf, b, &fl->mmaps, node) {
- if ((buf->raddr == req->vaddrout) && (buf->size == req->size))
+ list_for_each_entry_safe(iter, b, &fl->mmaps, node) {
+ if ((iter->raddr == req->vaddrout) && (iter->size == req->size)) {
+ buf = iter;
break;
- buf = NULL;
+ }
}
spin_unlock(&fl->lock);

--
2.35.1



2022-06-13 17:06:24

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.18 089/339] net/smc: set ini->smcrv2.ib_dev_v2 to NULL if SMC-Rv2 is unavailable

From: liuyacan <[email protected]>

[ Upstream commit b3b1a17538d3ef6a9667b2271216fd16d7678ab5 ]

In the process of checking whether RDMAv2 is available, the current
implementation first sets ini->smcrv2.ib_dev_v2, and then allocates
smc buf desc and register rmb, but the latter may fail. In this case,
the pointer should be reset.

Fixes: e49300a6bf62 ("net/smc: add listen processing for SMC-Rv2")
Signed-off-by: liuyacan <[email protected]>
Reviewed-by: Karsten Graul <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Jakub Kicinski <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
net/smc/af_smc.c | 1 +
1 file changed, 1 insertion(+)

diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index 45a24d24210f..540b32d86d9b 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -2136,6 +2136,7 @@ static void smc_find_rdma_v2_device_serv(struct smc_sock *new_smc,

not_found:
ini->smcr_version &= ~SMC_V2;
+ ini->smcrv2.ib_dev_v2 = NULL;
ini->check_smcrv2 = false;
}

--
2.35.1



2022-06-13 17:06:32

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.18 072/339] serial: sifive: Sanitize CSIZE and c_iflag

From: Ilpo Järvinen <[email protected]>

[ Upstream commit c069d2756c01ed36121fae6a42c14fdf1325c71d ]

Only CS8 is supported but CSIZE was not sanitized to CS8.

Set CSIZE correctly so that userspace knows the effective value.
Incorrect CSIZE also results in miscalculation of the frame bits in
tty_get_char_size() or in its predecessor where the roughly the same
code is directly within uart_update_timeout().

Similarly, INPCK, PARMRK, and BRKINT are reported textually unsupported
but were not cleared in termios c_iflag which is the machine-readable
format.

Fixes: 45c054d0815b (tty: serial: add driver for the SiFive UART)
Cc: Paul Walmsley <[email protected]>
Signed-off-by: Ilpo Järvinen <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/tty/serial/sifive.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/tty/serial/sifive.c b/drivers/tty/serial/sifive.c
index 6140166b7ed5..776aec6516c4 100644
--- a/drivers/tty/serial/sifive.c
+++ b/drivers/tty/serial/sifive.c
@@ -666,12 +666,16 @@ static void sifive_serial_set_termios(struct uart_port *port,
int rate;
char nstop;

- if ((termios->c_cflag & CSIZE) != CS8)
+ if ((termios->c_cflag & CSIZE) != CS8) {
dev_err_once(ssp->port.dev, "only 8-bit words supported\n");
+ termios->c_cflag &= ~CSIZE;
+ termios->c_cflag |= CS8;
+ }
if (termios->c_iflag & (INPCK | PARMRK))
dev_err_once(ssp->port.dev, "parity checking not supported\n");
if (termios->c_iflag & BRKINT)
dev_err_once(ssp->port.dev, "BREAK detection not supported\n");
+ termios->c_iflag &= ~(INPCK|PARMRK|BRKINT);

/* Set number of stop bits */
nstop = (termios->c_cflag & CSTOPB) ? 2 : 1;
--
2.35.1



2022-06-13 17:07:50

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.18 041/339] power: supply: core: Initialize struct to zero

From: Linus Walleij <[email protected]>

[ Upstream commit e56a4be2843c95c08cf8421dc1f8e880cafbaf91 ]

As we rely on pointers in the battery info to be zero-initialized
such as in the helper function power_supply_supports_vbat2ri()
we certainly need to allocate the struct power_supply_battery_info
with kzalloc() as well. Else this happens:

Unable to handle kernel paging request at virtual address 00280000
(...)
PC is at power_supply_vbat2ri+0x50/0x12c
LR is at ab8500_fg_battery_resistance+0x34/0x108

Fixes: e9e7d165b4b0 ("power: supply: Support VBAT-to-Ri lookup tables")
Signed-off-by: Linus Walleij <[email protected]>
Signed-off-by: Sebastian Reichel <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/power/supply/power_supply_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/power/supply/power_supply_core.c b/drivers/power/supply/power_supply_core.c
index d925cb137e12..fad5890c899e 100644
--- a/drivers/power/supply/power_supply_core.c
+++ b/drivers/power/supply/power_supply_core.c
@@ -616,7 +616,7 @@ int power_supply_get_battery_info(struct power_supply *psy,
goto out_put_node;
}

- info = devm_kmalloc(&psy->dev, sizeof(*info), GFP_KERNEL);
+ info = devm_kzalloc(&psy->dev, sizeof(*info), GFP_KERNEL);
if (!info) {
err = -ENOMEM;
goto out_put_node;
--
2.35.1



2022-06-13 17:08:19

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.18 022/339] pwm: lp3943: Fix duty calculation in case period was clamped

From: Uwe Kleine-König <[email protected]>

[ Upstream commit 5e3b07ca5cc78cd4a987e78446849e41288d87cb ]

The hardware only supports periods <= 1.6 ms and if a bigger period is
requested it is clamped to 1.6 ms. In this case duty_cycle might be bigger
than 1.6 ms and then the duty cycle register is written with a value
bigger than LP3943_MAX_DUTY. So clamp duty_cycle accordingly.

Fixes: af66b3c0934e ("pwm: Add LP3943 PWM driver")
Signed-off-by: Uwe Kleine-König <[email protected]>
Signed-off-by: Thierry Reding <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/pwm/pwm-lp3943.c | 1 +
1 file changed, 1 insertion(+)

diff --git a/drivers/pwm/pwm-lp3943.c b/drivers/pwm/pwm-lp3943.c
index ea17d446a627..2bd04ecb508c 100644
--- a/drivers/pwm/pwm-lp3943.c
+++ b/drivers/pwm/pwm-lp3943.c
@@ -125,6 +125,7 @@ static int lp3943_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
if (err)
return err;

+ duty_ns = min(duty_ns, period_ns);
val = (u8)(duty_ns * LP3943_MAX_DUTY / period_ns);

return lp3943_write_byte(lp3943, reg_duty, val);
--
2.35.1



2022-06-13 20:46:15

by Ronald Warsow

[permalink] [raw]
Subject: Re: [PATCH 5.18 000/339] 5.18.4-rc1 review

hallo Greg

5.18.4-rc1

compiles (not without warnings), boots and runs here on x86_64
(Intel i5-11400, Fedora 36)

Tested-by: Ronald Warsow <[email protected]


Thanks

Ronald

2022-06-13 22:59:32

by Zan Aziz

[permalink] [raw]
Subject: Re: [PATCH 5.18 000/339] 5.18.4-rc1 review

On Mon, Jun 13, 2022 at 10:15 AM Greg Kroah-Hartman
<[email protected]> wrote:
>
> This is the start of the stable review cycle for the 5.18.4 release.
> There are 339 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 15 Jun 2022 09:47:08 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.18.4-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.18.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h

Hi Greg,

Compiled and booted on my test system Lenovo P50s: Intel Core i7
No emergency and critical messages in the dmesg

./perf bench sched all
# Running sched/messaging benchmark...
# 20 sender and receiver processes per group
# 10 groups == 400 processes run

Total time: 0.444 [sec]

# Running sched/pipe benchmark...
# Executed 1000000 pipe operations between two processes

Total time: 7.007 [sec]

7.007223 usecs/op
142709 ops/sec

Tested-by: Zan Aziz <[email protected]>

Thanks
-Zan

2022-06-14 07:28:37

by Bagas Sanjaya

[permalink] [raw]
Subject: Re: [PATCH 5.18 000/339] 5.18.4-rc1 review

On Mon, Jun 13, 2022 at 12:07:05PM +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.18.4 release.
> There are 339 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>

Successfully cross-compiled for arm (multi_v7_defconfig, GCC 12.1.0,
ARMv7 with neon FPU) and arm64 (bcm2711_defconfig, GCC 12.1.0).

Tested-by: Bagas Sanjaya <[email protected]>

--
An old man doll... just what I always wanted! - Clara