This is the start of the stable review cycle for the 5.10.150 release.
There are 390 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 26 Oct 2022 11:29:24 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.150-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.10.150-rc1
Martin Liska <[email protected]>
gcov: support GCC 12.1 and newer compilers
Chao Yu <[email protected]>
f2fs: fix wrong condition to trigger background checkpoint correctly
Rafael J. Wysocki <[email protected]>
thermal: intel_powerclamp: Use first online CPU as control_cpu
Eric Dumazet <[email protected]>
inet: fully convert sk->sk_rx_dst to RCU rules
Jerry Lee 李修賢 <[email protected]>
ext4: continue to expand file system when the target size doesn't reach
Shuah Khan <[email protected]>
Revert "drm/amdgpu: use dirty framebuffer helper"
Shuah Khan <[email protected]>
Revert "drm/amdgpu: move nbio sdma_doorbell_range() into sdma code for vega"
Tetsuo Handa <[email protected]>
net/ieee802154: don't warn zero-sized raw_sendmsg()
Alexander Aring <[email protected]>
Revert "net/ieee802154: reject zero-sized raw_sendmsg()"
Alexander Aring <[email protected]>
net: ieee802154: return -EINVAL for unknown addr type
Liu Shixin <[email protected]>
mm: hugetlb: fix UAF in hugetlb_handle_userfault
Pavel Begunkov <[email protected]>
io_uring/af_unix: defer registered files gc to io_uring release
Pavel Begunkov <[email protected]>
io_uring: correct pinned_vm accounting
Sergey Shtylyov <[email protected]>
arm64: topology: fix possible overflow in amu_fie_setup()
Adrian Hunter <[email protected]>
perf intel-pt: Fix segfault in intel_pt_print_info() with uClibc
Maxime Ripard <[email protected]>
clk: bcm2835: Make peripheral PLLC critical
Dongliang Mu <[email protected]>
usb: idmouse: fix an uninit-value in idmouse_open
Varun Prakash <[email protected]>
nvmet-tcp: add bounds check on Transfer Tag
Keith Busch <[email protected]>
nvme: copy firmware_rev on each init
Xiaoke Wang <[email protected]>
staging: rtl8723bs: fix a potential memory leak in rtw_init_cmd_priv()
sunghwan jung <[email protected]>
Revert "usb: storage: Add quirk for Samsung Fit flash"
Robin Guo <[email protected]>
usb: musb: Fix musb_gadget.c rxstate overflow bug
Jianglei Nie <[email protected]>
usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info()
Logan Gunthorpe <[email protected]>
md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d
Hyunwoo Kim <[email protected]>
HID: roccat: Fix use-after-free in roccat_read()
Pierre-Louis Bossart <[email protected]>
soundwire: intel: fix error handling on dai registration issues
Richard Fitzgerald <[email protected]>
soundwire: cadence: Don't overwrite msg->buf during write commands
Coly Li <[email protected]>
bcache: fix set_at_max_writeback_rate() for multiple attached devices
Serge Semin <[email protected]>
ata: libahci_platform: Sanity check the DT child nodes number
Yu Kuai <[email protected]>
blk-throttle: prevent overflow while calculating wait time
Nam Cao <[email protected]>
staging: vt6655: fix potential memory leak
Wei Yongjun <[email protected]>
power: supply: adp5061: fix out-of-bounds read in adp5061_get_chg_type()
Shigeru Yoshida <[email protected]>
nbd: Fix hung when signal interrupts nbd_start_device_ioctl()
Letu Ren <[email protected]>
scsi: 3w-9xxx: Avoid disabling device if failing to enable it
Justin Chen <[email protected]>
usb: host: xhci-plat: suspend/resume clks for brcm
Justin Chen <[email protected]>
usb: host: xhci-plat: suspend and resume clocks
Quanyang Wang <[email protected]>
clk: zynqmp: pll: rectify rate rounding in zynqmp_pll_round_rate
Zheyu Ma <[email protected]>
media: cx88: Fix a null-ptr-deref bug in buffer_prepare()
Ian Nam <[email protected]>
clk: zynqmp: Fix stack-out-of-bounds in strncpy`
Qu Wenruo <[email protected]>
btrfs: scrub: try to fix super block errors
Sebastian Krzyszkowiak <[email protected]>
arm64: dts: imx8mq-librem5: Add bq25895 as max17055's power supply
Mark Brown <[email protected]>
kselftest/arm64: Fix validatation termination record after EXTRA_CONTEXT
Alexander Stein <[email protected]>
ARM: dts: imx6sx: add missing properties for sram
Alexander Stein <[email protected]>
ARM: dts: imx6sll: add missing properties for sram
Alexander Stein <[email protected]>
ARM: dts: imx6sl: add missing properties for sram
Alexander Stein <[email protected]>
ARM: dts: imx6qp: add missing properties for sram
Alexander Stein <[email protected]>
ARM: dts: imx6dl: add missing properties for sram
Alexander Stein <[email protected]>
ARM: dts: imx6q: add missing properties for sram
Haibo Chen <[email protected]>
ARM: dts: imx7d-sdb: config the max pressure for tsc2046
Aric Cyr <[email protected]>
drm/amd/display: Remove interface for periodic interrupt 1
Khaled Almahallawy <[email protected]>
drm/dp: Don't rewrite link config when setting phy test pattern
Richard Acayan <[email protected]>
mmc: sdhci-msm: add compatible string check for sdm670
Adrián Larumbe <[email protected]>
drm/meson: explicitly remove aggregate driver at module unload time
hongao <[email protected]>
drm/amdgpu: fix initial connector audio value
Jairaj Arava <[email protected]>
ASoC: SOF: pci: Change DMI match info to support all Chrome platforms
Hans de Goede <[email protected]>
platform/x86: msi-laptop: Change DMI match / alias strings to fix module autoloading
Jameson Thies <[email protected]>
platform/chrome: cros_ec: Notify the PM of wake events during resume
Maya Matuszczyk <[email protected]>
drm: panel-orientation-quirks: Add quirk for Anbernic Win600
Mateusz Kwiatkowski <[email protected]>
drm/vc4: vec: Fix timings for VEC modes
Lucas Stach <[email protected]>
drm: bridge: dw_hdmi: only trigger hotplug event on link change
Vivek Kasireddy <[email protected]>
udmabuf: Set ubuf->sg = NULL if the creation of sg table fails
David Gow <[email protected]>
drm/amd/display: fix overflow on MIN_I64 definition
Zeng Jingxiang <[email protected]>
gpu: lontium-lt9611: Fix NULL pointer dereference in lt9611_connector_init()
Javier Martinez Canillas <[email protected]>
drm: Prevent drm_copy_field() to attempt copying a NULL pointer
Javier Martinez Canillas <[email protected]>
drm: Use size_t type for len variable in drm_copy_field()
Jianglei Nie <[email protected]>
drm/nouveau/nouveau_bo: fix potential memory leak in nouveau_bo_alloc()
Andrew Gaul <[email protected]>
r8152: Rate limit overflow messages
Luiz Augusto von Dentz <[email protected]>
Bluetooth: L2CAP: Fix user-after-free
Liu Jian <[email protected]>
net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory
Daniel Golle <[email protected]>
wifi: rt2x00: correctly set BBP register 86 for MT7620
Daniel Golle <[email protected]>
wifi: rt2x00: set SoC wmac clock register
Daniel Golle <[email protected]>
wifi: rt2x00: set VGC gain for both chains of MT7620
Daniel Golle <[email protected]>
wifi: rt2x00: set correct TX_SW_CFG1 MAC register for MT7620
Daniel Golle <[email protected]>
wifi: rt2x00: don't run Rt5592 IQ calibration on MT7620
Ziyang Xuan <[email protected]>
can: bcm: check the result of can_send() in bcm_can_tx()
Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times
Tetsuo Handa <[email protected]>
Bluetooth: L2CAP: initialize delayed works at l2cap_chan_create()
Patrick Rudolph <[email protected]>
regulator: core: Prevent integer underflow
Alexander Coffin <[email protected]>
wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit()
Khalid Masum <[email protected]>
xfrm: Update ipcomp_scratches with NULL when freed
Tetsuo Handa <[email protected]>
wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg()
Eric Dumazet <[email protected]>
tcp: annotate data-race around tcp_md5sig_pool_populated
Mike Pattrick <[email protected]>
openvswitch: Fix overreporting of drops in dropwatch
Mike Pattrick <[email protected]>
openvswitch: Fix double reporting of drops in dropwatch
Quentin Monnet <[email protected]>
bpftool: Clear errno after libcap's checks
Wright Feng <[email protected]>
wifi: brcmfmac: fix invalid address access when enabling SCAN log level
Dai Ngo <[email protected]>
NFSD: fix use-after-free on source server when doing inter-server copy
Anna Schumaker <[email protected]>
NFSD: Return nfserr_serverfault if splice_ok but buf->pages have data
Kees Cook <[email protected]>
x86/entry: Work around Clang __bdos() bug
Kees Cook <[email protected]>
ARM: decompressor: Include .data.rel.ro.local
Srinivas Pandruvada <[email protected]>
thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash
Chao Qin <[email protected]>
powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue
Kees Cook <[email protected]>
MIPS: BCM47XX: Cast memcmp() of function to (void *)
Arvid Norlander <[email protected]>
ACPI: video: Add Toshiba Satellite/Portege Z830 quirk
Zqiang <[email protected]>
rcu-tasks: Convert RCU_LOCKDEP_WARN() to WARN_ONCE()
Michal Hocko <[email protected]>
rcu: Back off upon fill_page_cache_func() allocation failure
Stefan Berger <[email protected]>
selftest: tpm2: Add Client.__del__() to close /dev/tpm* handle
Chao Yu <[email protected]>
f2fs: fix to account FS_CP_DATA_IO correctly
Chao Yu <[email protected]>
f2fs: fix to avoid REQ_TIME and CP_TIME collision
Zhang Qilong <[email protected]>
f2fs: fix race condition on setting FI_NO_EXTENT flag
Shuai Xue <[email protected]>
ACPI: APEI: do not add task_work to kernel thread to avoid memory leak
Vincent Knecht <[email protected]>
thermal/drivers/qcom/tsens-v0_1: Fix MSM8939 fourth sensor hw_id
Dan Carpenter <[email protected]>
crypto: cavium - prevent integer overflow loading firmware
Dan Carpenter <[email protected]>
crypto: marvell/octeontx - prevent integer overflows
Janis Schoetterl-Glausch <[email protected]>
kbuild: rpm-pkg: fix breakage when V=1 is used
Masahiro Yamada <[email protected]>
kbuild: remove the target in signal traps when interrupted
Yipeng Zou <[email protected]>
tracing: kprobe: Make gen test module work in arm and riscv
Yipeng Zou <[email protected]>
tracing: kprobe: Fix kprobe event gen test module on exit
Robin Murphy <[email protected]>
iommu/iova: Fix module config properly
Damian Muszynski <[email protected]>
crypto: qat - fix DMA transfer direction
Giovanni Cabiddu <[email protected]>
crypto: qat - use pre-allocated buffers in datapath
Hui Tang <[email protected]>
crypto: qat - fix use of 'dma_map_single'
Peter Harliman Liem <[email protected]>
crypto: inside-secure - Change swab to swab32
Koba Ko <[email protected]>
crypto: ccp - Release dma channels before dmaengine unrgister
Ignat Korchagin <[email protected]>
crypto: akcipher - default implementation for setting a private key
Dan Carpenter <[email protected]>
iommu/omap: Fix buffer overflow in debugfs
Waiman Long <[email protected]>
cgroup/cpuset: Enable update_tasks_cpumask() on top_cpuset
Kshitiz Varshney <[email protected]>
hwrng: imx-rngc - Moving IRQ handler registering after imx_rngc_irq_mask_clear()
Ye Weihua <[email protected]>
crypto: hisilicon/zip - fix mismatch in get/set sgl_sge_nr
Zhengchao Shao <[email protected]>
crypto: sahara - don't sleep when in softirq
Pali Rohár <[email protected]>
powerpc: Fix SPE Power ISA properties for e500v1 platforms
Nicholas Piggin <[email protected]>
powerpc/64s: Fix GENERIC_CPU build flags for PPC970 / G5
Vitaly Kuznetsov <[email protected]>
x86/hyperv: Fix 'struct hv_enlightened_vmcs' definition
Zheng Yongjun <[email protected]>
powerpc/powernv: add missing of_node_put() in opal_export_attrs()
Liang He <[email protected]>
powerpc/pci_dn: Add missing of_node_put()
Liang He <[email protected]>
powerpc/sysdev/fsl_msi: Add missing of_node_put()
Nathan Chancellor <[email protected]>
powerpc/math_emu/efp: Include module.h
Jack Wang <[email protected]>
mailbox: bcm-ferxrm-mailbox: Fix error check for dma_map_sg
Joel Stanley <[email protected]>
clk: ast2600: BCLK comes from EPLL
Miaoqian Lin <[email protected]>
clk: ti: dra7-atl: Fix reference leak in of_dra7_atl_clk_probe
Stefan Wahren <[email protected]>
clk: bcm2835: fix bcm2835_clock_rate_from_divisor declaration
Serge Semin <[email protected]>
clk: baikal-t1: Add SATA internal ref clock buffer
Serge Semin <[email protected]>
clk: baikal-t1: Add shared xGMAC ref/ptp clocks internal parent
Serge Semin <[email protected]>
clk: baikal-t1: Fix invalid xGMAC PTP clock divider
Serge Semin <[email protected]>
clk: vc5: Fix 5P49V6901 outputs disabling when enabling FOD
David Collins <[email protected]>
spmi: pmic-arb: correct duplicate APID to PPID mapping logic
Dave Jiang <[email protected]>
dmaengine: ioat: stop mod_timer from resurrecting deleted timer in __cleanup()
Chen-Yu Tsai <[email protected]>
clk: mediatek: mt8183: mfgcfg: Propagate rate changes to parent
Jiasheng Jiang <[email protected]>
mfd: sm501: Add check for platform_driver_register()
Dan Carpenter <[email protected]>
mfd: fsl-imx25: Fix check for platform_get_irq() errors
Christophe JAILLET <[email protected]>
mfd: lp8788: Fix an error handling path in lp8788_irq_init() and lp8788_irq_init()
Christophe JAILLET <[email protected]>
mfd: lp8788: Fix an error handling path in lp8788_probe()
Christophe JAILLET <[email protected]>
mfd: fsl-imx25: Fix an error handling path in mx25_tsadc_setup_irq()
Christophe JAILLET <[email protected]>
mfd: intel_soc_pmic: Fix an error handling path in intel_soc_pmic_i2c_probe()
Jiasheng Jiang <[email protected]>
fsi: core: Check error number after calling ida_simple_get
Robert Marko <[email protected]>
clk: qcom: apss-ipq6018: mark apcs_alias0_core_clk as critical
Mike Christie <[email protected]>
scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername()
Duoming Zhou <[email protected]>
scsi: libsas: Fix use-after-free bug in smp_execute_task_sg()
Pali Rohár <[email protected]>
serial: 8250: Fix restoring termios speed after suspend
Guilherme G. Piccoli <[email protected]>
firmware: google: Test spinlock on panic path to avoid lockups
Nam Cao <[email protected]>
staging: vt6655: fix some erroneous memory clean-up loops
Dongliang Mu <[email protected]>
phy: qualcomm: call clk_disable_unprepare in the error handling
Sherry Sun <[email protected]>
tty: serial: fsl_lpuart: disable dma rx/tx use flags in lpuart_dma_shutdown
Ilpo Järvinen <[email protected]>
serial: 8250: Toggle IER bits on only after irq has been set up
Christophe JAILLET <[email protected]>
serial: 8250: Add an empty line and remove some useless {}
Dan Carpenter <[email protected]>
drivers: serial: jsm: fix some leaks in probe
Albert Briscoe <[email protected]>
usb: gadget: function: fix dangling pnp_string in f_printer.c
Mario Limonciello <[email protected]>
xhci: Don't show warning for reinit on known broken suspend
Daisuke Matsuda <[email protected]>
IB: Set IOVA/LENGTH on IB_MR in core/uverbs layers
Mark Zhang <[email protected]>
RDMA/cm: Use SLID in the work completion as the DLID in responder side
Logan Gunthorpe <[email protected]>
md/raid5: Ensure stripe_fill happens on non-read IO with journal
Saurabh Sengar <[email protected]>
md: Replace snprintf with scnprintf
Dan Carpenter <[email protected]>
mtd: rawnand: meson: fix bit map use in meson_nfc_ecc_correct()
Niklas Cassel <[email protected]>
ata: fix ata_id_has_dipm()
Niklas Cassel <[email protected]>
ata: fix ata_id_has_ncq_autosense()
Niklas Cassel <[email protected]>
ata: fix ata_id_has_devslp()
Niklas Cassel <[email protected]>
ata: fix ata_id_sense_reporting_enabled() and ata_id_has_sense_reporting()
Bernard Metzler <[email protected]>
RDMA/siw: Always consume all skbuf data in sk_data_ready() upcall.
Pali Rohár <[email protected]>
mtd: rawnand: fsl_elbc: Fix none ECC mode
William Dean <[email protected]>
mtd: devices: docg3: check the return value of devm_ioremap() in the probe
Jim Cromie <[email protected]>
dyndbg: drop EXPORTed dynamic_debug_exec_queries
Jim Cromie <[email protected]>
dyndbg: let query-modname override actual module name
Jim Cromie <[email protected]>
dyndbg: fix module.dyndbg handling
Jim Cromie <[email protected]>
dyndbg: fix static_branch manipulation
Jie Hai <[email protected]>
dmaengine: hisilicon: Add multi-thread support for a DMA channel
Jie Hai <[email protected]>
dmaengine: hisilicon: Fix CQ head update
Jie Hai <[email protected]>
dmaengine: hisilicon: Disable channels when unregister hisi_dma
Dan Carpenter <[email protected]>
fpga: prevent integer overflow in dfl_feature_ioctl_set_irq()
Hangyu Hua <[email protected]>
misc: ocxl: fix possible refcount leak in afu_ioctl()
Zhu Yanjun <[email protected]>
RDMA/rxe: Fix the error caused by qp->sk
Zhu Yanjun <[email protected]>
RDMA/rxe: Fix "kernel NULL pointer dereference" error
Miaoqian Lin <[email protected]>
media: xilinx: vipp: Fix refcount leak in xvip_graph_dma_init
Xu Qiang <[email protected]>
media: meson: vdec: add missing clk_disable_unprepare on error in vdec_hevc_start()
Shubhrajyoti Datta <[email protected]>
tty: xilinx_uartps: Fix the ignore_status
Liang He <[email protected]>
media: exynos4-is: fimc-is: Add of_node_put() when breaking out of loop
Jack Wang <[email protected]>
HSI: omap_ssi_port: Fix dma_map_sg error check
Miaoqian Lin <[email protected]>
HSI: omap_ssi: Fix refcount leak in ssi_probe
Miaoqian Lin <[email protected]>
clk: tegra20: Fix refcount leak in tegra20_clock_init
Miaoqian Lin <[email protected]>
clk: tegra: Fix refcount leak in tegra114_clock_init
Miaoqian Lin <[email protected]>
clk: tegra: Fix refcount leak in tegra210_clock_init
Liang He <[email protected]>
clk: sprd: Hold reference returned by of_get_parent()
Liang He <[email protected]>
clk: berlin: Add of_node_put() for of_get_parent()
Liang He <[email protected]>
clk: qoriq: Hold reference returned by of_get_parent()
Liang He <[email protected]>
clk: oxnas: Hold reference returned by of_get_parent()
Liang He <[email protected]>
clk: meson: Hold reference returned by of_get_parent()
Thinh Nguyen <[email protected]>
usb: common: debug: Check non-standard control requests
Chunfeng Yun <[email protected]>
usb: common: move function's kerneldoc next to its definition
Chunfeng Yun <[email protected]>
usb: common: add function to get interval expressed in us unit
Thinh Nguyen <[email protected]>
usb: common: Parse for USB SSP genXxY
Thinh Nguyen <[email protected]>
usb: ch9: Add USB 3.2 SSP attributes
Jonathan Cameron <[email protected]>
iio: ABI: Fix wrong format of differential capacitance channel ABI.
Nuno Sá <[email protected]>
iio: inkern: only release the device node when done with it
Claudiu Beznea <[email protected]>
iio: adc: at91-sama5d2_adc: disable/prepare buffer on suspend/resume
Claudiu Beznea <[email protected]>
iio: adc: at91-sama5d2_adc: lock around oversampling and sample freq
Claudiu Beznea <[email protected]>
iio: adc: at91-sama5d2_adc: check return status for pressure and touch
Claudiu Beznea <[email protected]>
iio: adc: at91-sama5d2_adc: fix AT91_SAMA5D2_MR_TRACKTIM_MAX
Dmitry Torokhov <[email protected]>
ARM: dts: exynos: fix polarity of VBUS GPIO of Origen
Mark Rutland <[email protected]>
arm64: ftrace: fix module PLTs with mcount
Geert Uytterhoeven <[email protected]>
ARM: Drop CMDLINE_* dependency on ATAGS
Dmitry Torokhov <[email protected]>
ARM: dts: exynos: correct s5k6a3 reset polarity on Midas family
Dmitry Osipenko <[email protected]>
soc/tegra: fuse: Drop Kconfig dependency on TEGRA20_APB_DMA
Randy Dunlap <[email protected]>
ia64: export memory_add_physaddr_to_nid to fix cxl build error
Michael Walle <[email protected]>
ARM: dts: kirkwood: lsxl: remove first ethernet port
Michael Walle <[email protected]>
ARM: dts: kirkwood: lsxl: fix serial line
Marek Behún <[email protected]>
ARM: dts: turris-omnia: Fix mpp26 pin name and comment
Liang He <[email protected]>
soc: qcom: smem_state: Add refcounting for the 'state->of_node'
Liang He <[email protected]>
soc: qcom: smsm: Fix refcount leak bugs in qcom_smsm_probe()
Liang He <[email protected]>
memory: of: Fix refcount leak bug in of_lpddr3_get_ddr_timings()
Liang He <[email protected]>
memory: of: Fix refcount leak bug in of_get_ddr_timings()
Liang He <[email protected]>
memory: pl353-smc: Fix refcount leak bug in pl353_smc_probe()
Takashi Iwai <[email protected]>
ALSA: hda/hdmi: Don't skip notification handling during PM operation
Zhang Qilong <[email protected]>
ASoC: mt6660: Fix PM disable depth imbalance in mt6660_i2c_probe
Zhang Qilong <[email protected]>
ASoC: wm5102: Fix PM disable depth imbalance in wm5102_probe
Zhang Qilong <[email protected]>
ASoC: wm5110: Fix PM disable depth imbalance in wm5110_probe
Zhang Qilong <[email protected]>
ASoC: wm8997: Fix PM disable depth imbalance in wm8997_probe
Christophe JAILLET <[email protected]>
mmc: wmt-sdmmc: Fix an error handling path in wmt_mci_probe()
Andreas Pape <[email protected]>
ALSA: dmaengine: increment buffer pointer atomically
Christophe JAILLET <[email protected]>
ASoC: da7219: Fix an error handling path in da7219_register_dai_clks()
Kuogee Hsieh <[email protected]>
drm/msm/dp: correct 1.62G link rate at dp_catalog_ctrl_config_msa()
Dmitry Baryshkov <[email protected]>
drm/msm/dpu: index dpu_kms->hw_vbif using vbif_idx
Liang He <[email protected]>
ASoC: eureka-tlv320: Hold reference returned from of_find_xxx API
Christophe JAILLET <[email protected]>
mmc: au1xmmc: Fix an error handling path in au1xmmc_probe()
Liang He <[email protected]>
drm/omap: dss: Fix refcount leak bugs
Takashi Iwai <[email protected]>
ALSA: hda: beep: Simplify keep-power-at-enable behavior
Jiasheng Jiang <[email protected]>
ASoC: rsnd: Add check for rsnd_mod_power_on
Zheyu Ma <[email protected]>
drm/bridge: megachips: Fix a null pointer dereference bug
Randy Dunlap <[email protected]>
drm: fix drm_mipi_dbi build errors
Hans de Goede <[email protected]>
platform/x86: msi-laptop: Fix resource cleanup
Hans de Goede <[email protected]>
platform/x86: msi-laptop: Fix old-ec check for backlight registering
Martin Povišer <[email protected]>
ASoC: tas2764: Fix mute/unmute
Martin Povišer <[email protected]>
ASoC: tas2764: Drop conflicting set_bias_level power setting
Martin Povišer <[email protected]>
ASoC: tas2764: Allow mono streams
Dan Carpenter <[email protected]>
platform/chrome: fix memory corruption in ioctl
Rustam Subkhankulov <[email protected]>
platform/chrome: fix double-free in chromeos_laptop_prepare()
Liang He <[email protected]>
drm:pl111: Add of_node_put() when breaking out of for_each_available_child_of_node()
Simon Ser <[email protected]>
drm/dp_mst: fix drm_dp_dpcd_read return value checks
Chen-Yu Tsai <[email protected]>
drm/bridge: parade-ps8640: Fix regulator supply order
Maxime Ripard <[email protected]>
drm/mipi-dsi: Detach devices when removing the host
Dan Carpenter <[email protected]>
drm/bridge: Avoid uninitialized variable warning
Alvin Šipraga <[email protected]>
drm: bridge: adv7511: fix CEC power down control register offset
Russell King (Oracle) <[email protected]>
net: mvpp2: fix mvpp2 debugfs leak
Eric Dumazet <[email protected]>
once: add DO_ONCE_SLOW() for sleepable contexts
Tetsuo Handa <[email protected]>
net/ieee802154: reject zero-sized raw_sendmsg()
Jianglei Nie <[email protected]>
bnx2x: fix potential memory leak in bnx2x_tpa_stop()
Tetsuo Handa <[email protected]>
net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks()
Marek Szyprowski <[email protected]>
spi: Ensure that sg_table won't be used after being freed
Neal Cardwell <[email protected]>
tcp: fix tcp_cwnd_validate() to not forget is_cwnd_limited
Xin Long <[email protected]>
sctp: handle the error returned from sctp_auth_asoc_init_active_key
Duoming Zhou <[email protected]>
mISDN: fix use-after-free bugs in l1oip timer handlers
Junichi Uekawa <[email protected]>
vhost/vsock: Use kvmalloc/kvfree for larger packets.
Bitterblue Smith <[email protected]>
wifi: rtl8xxxu: Fix AIFS written to REG_EDCA_*_PARAM
Vincent Whitchurch <[email protected]>
spi: s3c64xx: Fix large transfers with DMA
Phil Sutter <[email protected]>
netfilter: nft_fib: Fix for rpath check with VRF devices
Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_core: Fix not handling link timeouts propertly
Asmaa Mnebhi <[email protected]>
i2c: mlxbf: support lock mechanism
Zhang Qilong <[email protected]>
spi/omap100k:Fix PM disable depth imbalance in omap1_spi100k_probe
Zhang Qilong <[email protected]>
spi: dw: Fix PM disable depth imbalance in dw_spi_bt1_probe
Luciano Leão <[email protected]>
x86/cpu: Include the header of init_ia32_feat_ctl()'s prototype
Kees Cook <[email protected]>
x86/microcode/AMD: Track patch allocation size explicitly
Jesus Fernandez Manzano <[email protected]>
wifi: ath11k: fix number of VHT beamformee spatial streams
Tetsuo Handa <[email protected]>
Bluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failure
Lee Jones <[email protected]>
bpf: Ensure correct locking around vulnerable function find_vpid()
Zheng Yongjun <[email protected]>
net: fs_enet: Fix wrong check in do_pd_setup
Bitterblue Smith <[email protected]>
wifi: rtl8xxxu: Remove copy-paste leftover in gen2_update_rate_mask
Bitterblue Smith <[email protected]>
wifi: rtl8xxxu: gen2: Fix mistake in path B IQ calibration
Lorenz Bauer <[email protected]>
bpf: btf: fix truncated last_member_type_id in btf_struct_resolve
Neil Armstrong <[email protected]>
spi: meson-spicc: do not rely on busy flag in pow2 clk ops
Bitterblue Smith <[email protected]>
wifi: rtl8xxxu: Fix skb misuse in TX queue selection
Xu Qiang <[email protected]>
spi: qup: add missing clk_disable_unprepare on error in spi_qup_pm_resume_runtime()
Xu Qiang <[email protected]>
spi: qup: add missing clk_disable_unprepare on error in spi_qup_resume()
Ian Rogers <[email protected]>
selftests/xsk: Avoid use-after-free on ctx
Dan Carpenter <[email protected]>
wifi: rtl8xxxu: tighten bounds checking in rtl8xxxu_read_efuse()
Sean Wang <[email protected]>
Bluetooth: btusb: mediatek: fix WMT failure during runtime suspend
Arnd Bergmann <[email protected]>
Bluetooth: btusb: fix excessive stack usage
Mark Chen <[email protected]>
Bluetooth: btusb: Fine-tune mt7663 mechanism.
Kohei Tarumizu <[email protected]>
x86/resctrl: Fix to restore to original value when re-enabling hardware prefetch register
Christophe JAILLET <[email protected]>
spi: mt7621: Fix an error message in mt7621_spi_probe()
Lam Thai <[email protected]>
bpftool: Fix a wrong type cast in btf_dumper_int
Hari Chandrakanthan <[email protected]>
wifi: mac80211: allow bw change during channel switch in mesh
Uwe Kleine-König <[email protected]>
leds: lm3601x: Don't use mutex after it was destroyed
Wen Gong <[email protected]>
wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state()
Christophe JAILLET <[email protected]>
nfsd: Fix a memory leak in an error handling path
Sami Tolvanen <[email protected]>
objtool: Preserve special st_shndx indexes in elf_update_symbol
Wang Kefeng <[email protected]>
ARM: 9247/1: mm: set readonly for MT_MEMORY_RO with ARM_LPAE
Wang Kefeng <[email protected]>
ARM: 9244/1: dump: Fix wrong pg_level in walk_pmd()
Lin Yujun <[email protected]>
MIPS: SGI-IP27: Fix platform-device leak in bridge_platform_create()
Christophe JAILLET <[email protected]>
MIPS: SGI-IP27: Free some unused memory
Kees Cook <[email protected]>
sh: machvec: Use char[] for section boundaries
Ondrej Mosnacek <[email protected]>
userfaultfd: open userfaultfds with O_RDONLY
Greg Kroah-Hartman <[email protected]>
selinux: use "grep -E" instead of "egrep"
Steve French <[email protected]>
smb3: must initialize two ACL struct fields to zero
Ville Syrjälä <[email protected]>
drm/i915: Fix watermark calculations for gen12+ MC CCS modifier
Ville Syrjälä <[email protected]>
drm/i915: Fix watermark calculations for gen12+ RC CCS modifier
Jianglei Nie <[email protected]>
drm/nouveau: fix a use-after-free in nouveau_gem_prime_import_sg_table()
Lyude Paul <[email protected]>
drm/nouveau/kms/nv140-: Disable interlacing
Greg Kroah-Hartman <[email protected]>
staging: greybus: audio_helper: remove unused and wrong debugfs usage
Sean Christopherson <[email protected]>
KVM: VMX: Drop bits 31:16 when shoving exception error code into VMCS
Sean Christopherson <[email protected]>
KVM: nVMX: Unconditionally purge queued/injected events on nested "exit"
Michal Luczaj <[email protected]>
KVM: x86/emulator: Fix handing of POP SS to correctly set interruptibility
Dmitry Osipenko <[email protected]>
media: cedrus: Set the platform driver data earlier
Ard Biesheuvel <[email protected]>
efi: libstub: drop pointless get_memory_map() call
Mario Limonciello <[email protected]>
thunderbolt: Explicitly enable lane adapter hotplug events at startup
Waiman Long <[email protected]>
tracing: Disable interrupt or preemption before acquiring arch_spinlock_t
Steven Rostedt (Google) <[email protected]>
ring-buffer: Fix race between reset page and reading page
Steven Rostedt (Google) <[email protected]>
ring-buffer: Add ring_buffer_wake_waiters()
Steven Rostedt (Google) <[email protected]>
ring-buffer: Check pending waiters when doing wake ups as well
Steven Rostedt (Google) <[email protected]>
ring-buffer: Have the shortest_full queue be the shortest not longest
Steven Rostedt (Google) <[email protected]>
ring-buffer: Allow splice to read previous partially read pages
Zheng Yejian <[email protected]>
ftrace: Properly unset FTRACE_HASH_FL_MOD
Rik van Riel <[email protected]>
livepatch: fix race between fork and KLP transition
Ye Bin <[email protected]>
ext4: update 'state->fc_regions_size' after successful memory allocation
Ye Bin <[email protected]>
ext4: fix potential memory leak in ext4_fc_record_regions()
Ye Bin <[email protected]>
ext4: fix potential memory leak in ext4_fc_record_modified_inode()
Ye Bin <[email protected]>
ext4: fix miss release buffer head in ext4_fc_write_inode
Jinke Han <[email protected]>
ext4: place buffer head allocation before handle start
Zhang Yi <[email protected]>
ext4: ext4_read_bh_lock() should submit IO if the buffer isn't uptodate
Lukas Czerner <[email protected]>
ext4: don't increase iversion counter for ea_inodes
Jan Kara <[email protected]>
ext4: fix check for block being out of directory size
Lalith Rajendran <[email protected]>
ext4: make ext4_lazyinit_thread freezable
Baokun Li <[email protected]>
ext4: fix null-ptr-deref in ext4_write_info
Jan Kara <[email protected]>
ext4: avoid crash when inline data creation follows DIO write
Ye Bin <[email protected]>
jbd2: add miss release buffer head in fc_do_one_pass()
Ye Bin <[email protected]>
jbd2: fix potential use-after-free in jbd2_fc_wait_bufs
Ye Bin <[email protected]>
jbd2: fix potential buffer head reference count leak
Andrew Perepechko <[email protected]>
jbd2: wake up journal waiters in FIFO order, not LIFO
Kees Cook <[email protected]>
hardening: Remove Clang's enable flag for -ftrivial-auto-var-init=zero
Kees Cook <[email protected]>
hardening: Avoid harmless Clang option under CONFIG_INIT_STACK_ALL_ZERO
Kees Cook <[email protected]>
hardening: Clarify Kconfig text for auto-var-init
Chao Yu <[email protected]>
f2fs: fix to do sanity check on summary info
Chao Yu <[email protected]>
f2fs: fix to do sanity check on destination blkaddr during recovery
Jaegeuk Kim <[email protected]>
f2fs: increase the limit for reserve_root
Filipe Manana <[email protected]>
btrfs: fix race between quota enable and quota rescan ioctl
Hyunwoo Kim <[email protected]>
fbdev: smscufx: Fix use-after-free in ufx_ops_open()
Saurav Kashyap <[email protected]>
scsi: qedf: Populate sysfs attributes for vport
Pali Rohár <[email protected]>
powerpc/boot: Explicitly disable usage of SPE instructions
Zhang Rui <[email protected]>
powercap: intel_rapl: Use standard Energy Unit for SPR Dram RAPL domain
Maciej W. Rozycki <[email protected]>
serial: 8250: Let drivers request full 16550A feature probing
Maciej W. Rozycki <[email protected]>
PCI: Sanitise firmware BAR assignments behind a PCI-PCI bridge
Carlos Llamas <[email protected]>
mm/mmap: undo ->mmap() when arch_validate_flags() fails
Jeffle Xu <[email protected]>
block: fix inflight statistics of part0
Takashi Iwai <[email protected]>
drm/udl: Restore display mode on resume
Dmitry Osipenko <[email protected]>
drm/virtio: Check whether transferred 2D BO is shmem
Rishabh Bhatnagar <[email protected]>
nvme-pci: set min_align_mask before calculating max_hw_sectors
Huacai Chen <[email protected]>
UM: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
Fangrui Song <[email protected]>
riscv: Pass -mno-relax only on lld < 15.0.0
Andrew Bresticker <[email protected]>
riscv: Make VM_WRITE imply VM_READ
Andrew Bresticker <[email protected]>
riscv: Allow PROT_WRITE-only mmap()
Helge Deller <[email protected]>
parisc: fbdev/stifb: Align graphics memory size to 4MB
Maciej W. Rozycki <[email protected]>
RISC-V: Make port I/O string accessors actually work
Linus Walleij <[email protected]>
regulator: qcom_rpm: Fix circular deferral regression
Liang He <[email protected]>
hwmon: (gsc-hwmon) Call of_node_get() before of_find_xxx API
Krzysztof Kozlowski <[email protected]>
ASoC: wcd934x: fix order of Slimbus unprepare/disable
Krzysztof Kozlowski <[email protected]>
ASoC: wcd9335: fix order of Slimbus unprepare/disable
Patryk Duda <[email protected]>
platform/chrome: cros_ec_proto: Update version on GET_NEXT_EVENT failure
Zhihao Cheng <[email protected]>
quota: Check next/prev free block number after reading from quota file
Andri Yngvason <[email protected]>
HID: multitouch: Add memory barriers
Alexander Aring <[email protected]>
fs: dlm: handle -EBUSY first in lock arg validation
Alexander Aring <[email protected]>
fs: dlm: fix race between test_bit() and queue_work()
Wenchao Chen <[email protected]>
mmc: sdhci-sprd: Fix minimum clock limit
Anssi Hannula <[email protected]>
can: kvaser_usb_leaf: Fix CAN state after restart
Anssi Hannula <[email protected]>
can: kvaser_usb_leaf: Fix TX queue out of sync after restart
Anssi Hannula <[email protected]>
can: kvaser_usb_leaf: Fix overread with an invalid command
Anssi Hannula <[email protected]>
can: kvaser_usb: Fix use of uninitialized completion
Jean-Francois Le Fillatre <[email protected]>
usb: add quirks for Lenovo OneLink+ Dock
Eddie James <[email protected]>
iio: pressure: dps310: Reset chip after timeout
Eddie James <[email protected]>
iio: pressure: dps310: Refactor startup procedure
Nuno Sá <[email protected]>
iio: adc: ad7923: fix channel readings for some variants
Uwe Kleine-König <[email protected]>
iio: ltc2497: Fix reading conversion results
Michael Hennerich <[email protected]>
iio: dac: ad5593r: Fix i2c read protocol requirements
Zhang Xiaoxu <[email protected]>
cifs: Fix the error length of VALIDATE_NEGOTIATE_INFO message
Ronnie Sahlberg <[email protected]>
cifs: destage dirty pages before re-reading them for cache=none
Tudor Ambarus <[email protected]>
mtd: rawnand: atmel: Unmap streaming DMA mappings
Saranya Gopal <[email protected]>
ALSA: hda/realtek: Add Intel Reference SSID to support headset keys
Luke D. Jones <[email protected]>
ALSA: hda/realtek: Add quirk for ASUS GV601R laptop
Luke D. Jones <[email protected]>
ALSA: hda/realtek: Correct pin configs for ASUS G533Z
Callum Osmotherly <[email protected]>
ALSA: hda/realtek: remove ALC289_FIXUP_DUAL_SPK for Dell 5530
Takashi Iwai <[email protected]>
ALSA: usb-audio: Fix NULL dererence at error path
Takashi Iwai <[email protected]>
ALSA: usb-audio: Fix potential memory leaks
Takashi Iwai <[email protected]>
ALSA: rawmidi: Drop register_mutex in snd_rawmidi_free()
Takashi Iwai <[email protected]>
ALSA: oss: Fix potential deadlock at unregistration
-------------
Diffstat:
Documentation/ABI/testing/sysfs-bus-iio | 2 +-
Makefile | 10 +-
arch/arm/Kconfig | 1 -
arch/arm/boot/compressed/vmlinux.lds.S | 2 +
arch/arm/boot/dts/armada-385-turris-omnia.dts | 4 +-
arch/arm/boot/dts/exynos4412-midas.dtsi | 2 +-
arch/arm/boot/dts/exynos4412-origen.dts | 2 +-
arch/arm/boot/dts/imx6dl.dtsi | 3 +
arch/arm/boot/dts/imx6q.dtsi | 3 +
arch/arm/boot/dts/imx6qp.dtsi | 6 +
arch/arm/boot/dts/imx6sl.dtsi | 3 +
arch/arm/boot/dts/imx6sll.dtsi | 3 +
arch/arm/boot/dts/imx6sx.dtsi | 6 +
arch/arm/boot/dts/imx7d-sdb.dts | 7 +-
arch/arm/boot/dts/kirkwood-lsxl.dtsi | 16 +-
arch/arm/mm/dump.c | 2 +-
arch/arm/mm/mmu.c | 4 +
arch/arm64/boot/dts/freescale/imx8mq-librem5.dtsi | 1 +
arch/arm64/kernel/ftrace.c | 17 +-
arch/arm64/kernel/topology.c | 2 +-
arch/ia64/mm/numa.c | 1 +
arch/mips/bcm47xx/prom.c | 4 +-
arch/mips/sgi-ip27/ip27-xtalk.c | 74 ++++--
arch/powerpc/Makefile | 2 +-
arch/powerpc/boot/Makefile | 1 +
arch/powerpc/boot/dts/fsl/e500v1_power_isa.dtsi | 51 ++++
arch/powerpc/boot/dts/fsl/mpc8540ads.dts | 2 +-
arch/powerpc/boot/dts/fsl/mpc8541cds.dts | 2 +-
arch/powerpc/boot/dts/fsl/mpc8555cds.dts | 2 +-
arch/powerpc/boot/dts/fsl/mpc8560ads.dts | 2 +-
arch/powerpc/kernel/pci_dn.c | 1 +
arch/powerpc/math-emu/math_efp.c | 1 +
arch/powerpc/platforms/powernv/opal.c | 1 +
arch/powerpc/sysdev/fsl_msi.c | 2 +
arch/riscv/Makefile | 2 +
arch/riscv/include/asm/io.h | 16 +-
arch/riscv/kernel/sys_riscv.c | 3 -
arch/riscv/mm/fault.c | 3 +-
arch/sh/include/asm/sections.h | 2 +-
arch/sh/kernel/machvec.c | 10 +-
arch/um/kernel/um_arch.c | 2 +-
arch/x86/include/asm/hyperv-tlfs.h | 4 +-
arch/x86/include/asm/microcode.h | 1 +
arch/x86/kernel/cpu/feat_ctl.c | 2 +-
arch/x86/kernel/cpu/microcode/amd.c | 3 +-
arch/x86/kernel/cpu/resctrl/pseudo_lock.c | 12 +-
arch/x86/kvm/emulate.c | 2 +-
arch/x86/kvm/vmx/nested.c | 30 ++-
arch/x86/kvm/vmx/vmx.c | 12 +-
arch/x86/xen/enlighten_pv.c | 3 +-
block/blk-mq.c | 3 +-
block/blk-throttle.c | 8 +-
crypto/akcipher.c | 8 +
drivers/acpi/acpi_video.c | 16 ++
drivers/acpi/apei/ghes.c | 2 +-
drivers/ata/libahci_platform.c | 14 +-
drivers/block/nbd.c | 6 +-
drivers/bluetooth/btusb.c | 47 +++-
drivers/bluetooth/hci_ldisc.c | 7 +-
drivers/bluetooth/hci_serdev.c | 10 +-
drivers/char/hw_random/imx-rngc.c | 14 +-
drivers/clk/baikal-t1/ccu-div.c | 65 +++++
drivers/clk/baikal-t1/ccu-div.h | 10 +
drivers/clk/baikal-t1/clk-ccu-div.c | 26 +-
drivers/clk/bcm/clk-bcm2835.c | 8 +-
drivers/clk/berlin/bg2.c | 5 +-
drivers/clk/berlin/bg2q.c | 6 +-
drivers/clk/clk-ast2600.c | 2 +-
drivers/clk/clk-oxnas.c | 6 +-
drivers/clk/clk-qoriq.c | 10 +-
drivers/clk/clk-versaclock5.c | 2 +-
drivers/clk/mediatek/clk-mt8183-mfgcfg.c | 6 +-
drivers/clk/meson/meson-aoclk.c | 5 +-
drivers/clk/meson/meson-eeclk.c | 5 +-
drivers/clk/meson/meson8b.c | 5 +-
drivers/clk/qcom/apss-ipq6018.c | 2 +-
drivers/clk/sprd/common.c | 9 +-
drivers/clk/tegra/clk-tegra114.c | 1 +
drivers/clk/tegra/clk-tegra20.c | 1 +
drivers/clk/tegra/clk-tegra210.c | 1 +
drivers/clk/ti/clk-dra7-atl.c | 9 +-
drivers/clk/zynqmp/clkc.c | 7 +
drivers/clk/zynqmp/pll.c | 31 ++-
drivers/crypto/cavium/cpt/cptpf_main.c | 6 +-
drivers/crypto/ccp/ccp-dmaengine.c | 6 +-
drivers/crypto/hisilicon/zip/zip_crypto.c | 4 +-
drivers/crypto/inside-secure/safexcel_hash.c | 8 +-
drivers/crypto/marvell/octeontx/otx_cptpf_ucode.c | 18 +-
drivers/crypto/qat/qat_common/qat_algs.c | 109 +++++----
drivers/crypto/qat/qat_common/qat_crypto.h | 24 ++
drivers/crypto/sahara.c | 18 +-
drivers/dma-buf/udmabuf.c | 9 +-
drivers/dma/hisi_dma.c | 28 +--
drivers/dma/ioat/dma.c | 6 +-
drivers/firmware/efi/libstub/fdt.c | 8 -
drivers/firmware/google/gsmi.c | 9 +
drivers/fpga/dfl.c | 2 +-
drivers/fsi/fsi-core.c | 3 +
drivers/gpu/drm/Kconfig | 1 +
drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | 7 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 2 -
drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 5 -
drivers/gpu/drm/amd/amdgpu/soc15.c | 25 ++
drivers/gpu/drm/amd/display/dc/calcs/bw_fixed.c | 6 +-
drivers/gpu/drm/amd/display/dc/core/dc.c | 16 +-
drivers/gpu/drm/amd/display/dc/dc_stream.h | 6 +-
.../drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c | 35 +--
.../drm/amd/display/dc/dcn10/dcn10_hw_sequencer.h | 3 +-
drivers/gpu/drm/amd/display/dc/inc/hw_sequencer.h | 8 +-
drivers/gpu/drm/bridge/adv7511/adv7511.h | 5 +-
drivers/gpu/drm/bridge/adv7511/adv7511_cec.c | 4 +-
drivers/gpu/drm/bridge/lontium-lt9611.c | 3 +-
.../drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c | 4 +-
drivers/gpu/drm/bridge/parade-ps8640.c | 4 +-
drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 13 +-
drivers/gpu/drm/drm_bridge.c | 4 +-
drivers/gpu/drm/drm_dp_helper.c | 9 -
drivers/gpu/drm/drm_dp_mst_topology.c | 6 +-
drivers/gpu/drm/drm_ioctl.c | 8 +-
drivers/gpu/drm/drm_mipi_dsi.c | 1 +
drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 +
drivers/gpu/drm/i915/intel_pm.c | 8 +-
drivers/gpu/drm/meson/meson_drv.c | 8 +
drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 12 +-
drivers/gpu/drm/msm/disp/dpu1/dpu_vbif.c | 29 +--
drivers/gpu/drm/msm/dp/dp_catalog.c | 2 +-
drivers/gpu/drm/nouveau/nouveau_bo.c | 4 +-
drivers/gpu/drm/nouveau/nouveau_connector.c | 3 +-
drivers/gpu/drm/nouveau/nouveau_prime.c | 1 -
drivers/gpu/drm/omapdrm/dss/dss.c | 3 +
drivers/gpu/drm/pl111/pl111_versatile.c | 1 +
drivers/gpu/drm/udl/udl_modeset.c | 3 -
drivers/gpu/drm/vc4/vc4_vec.c | 4 +-
drivers/gpu/drm/virtio/virtgpu_vq.c | 2 +-
drivers/hid/hid-multitouch.c | 8 +-
drivers/hid/hid-roccat.c | 4 +
drivers/hsi/controllers/omap_ssi_core.c | 1 +
drivers/hsi/controllers/omap_ssi_port.c | 8 +-
drivers/hwmon/gsc-hwmon.c | 1 +
drivers/i2c/busses/i2c-mlxbf.c | 44 +++-
drivers/iio/adc/ad7923.c | 4 +-
drivers/iio/adc/at91-sama5d2_adc.c | 28 ++-
drivers/iio/adc/ltc2497.c | 13 +
drivers/iio/dac/ad5593r.c | 46 ++--
drivers/iio/inkern.c | 6 +-
drivers/iio/pressure/dps310.c | 262 +++++++++++++--------
drivers/infiniband/core/cm.c | 14 +-
drivers/infiniband/core/uverbs_cmd.c | 5 +-
drivers/infiniband/core/verbs.c | 2 +
drivers/infiniband/hw/hns/hns_roce_mr.c | 1 -
drivers/infiniband/hw/mlx4/mr.c | 1 -
drivers/infiniband/sw/rxe/rxe_qp.c | 10 +-
drivers/infiniband/sw/siw/siw_qp_rx.c | 27 ++-
drivers/iommu/omap-iommu-debug.c | 6 +-
drivers/isdn/mISDN/l1oip.h | 1 +
drivers/isdn/mISDN/l1oip_core.c | 13 +-
drivers/leds/leds-lm3601x.c | 2 -
drivers/mailbox/bcm-flexrm-mailbox.c | 8 +-
drivers/md/bcache/writeback.c | 73 ++++--
drivers/md/raid0.c | 2 +-
drivers/md/raid5.c | 14 +-
drivers/media/pci/cx88/cx88-vbi.c | 9 +-
drivers/media/pci/cx88/cx88-video.c | 43 ++--
drivers/media/platform/exynos4-is/fimc-is.c | 1 +
drivers/media/platform/xilinx/xilinx-vipp.c | 9 +-
drivers/memory/of_memory.c | 2 +
drivers/memory/pl353-smc.c | 1 +
drivers/mfd/fsl-imx25-tsadc.c | 34 ++-
drivers/mfd/intel_soc_pmic_core.c | 1 +
drivers/mfd/lp8788-irq.c | 3 +
drivers/mfd/lp8788.c | 12 +-
drivers/mfd/sm501.c | 7 +-
drivers/misc/ocxl/file.c | 2 +
drivers/mmc/host/au1xmmc.c | 3 +-
drivers/mmc/host/sdhci-msm.c | 1 +
drivers/mmc/host/sdhci-sprd.c | 2 +-
drivers/mmc/host/wmt-sdmmc.c | 5 +-
drivers/mtd/devices/docg3.c | 7 +-
drivers/mtd/nand/raw/atmel/nand-controller.c | 1 +
drivers/mtd/nand/raw/fsl_elbc_nand.c | 28 ++-
drivers/mtd/nand/raw/meson_nand.c | 4 +-
drivers/net/can/usb/kvaser_usb/kvaser_usb.h | 2 +
drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c | 3 +-
drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 2 +-
drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 79 +++++++
drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 1 +
drivers/net/ethernet/freescale/fs_enet/mac-fec.c | 2 +-
drivers/net/ethernet/marvell/mvpp2/mvpp2.h | 1 +
drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c | 10 +-
drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 13 +-
drivers/net/usb/r8152.c | 4 +-
drivers/net/wireless/ath/ath10k/mac.c | 54 +++--
drivers/net/wireless/ath/ath11k/mac.c | 25 +-
drivers/net/wireless/ath/ath9k/htc_hst.c | 43 ++--
.../wireless/broadcom/brcm80211/brcmfmac/core.c | 3 +-
.../net/wireless/broadcom/brcm80211/brcmfmac/pno.c | 12 +-
drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 34 ++-
.../net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 75 +++++-
drivers/nvme/host/core.c | 3 +-
drivers/nvme/host/pci.c | 3 +-
drivers/nvme/target/tcp.c | 11 +-
drivers/pci/setup-res.c | 11 +
drivers/phy/qualcomm/phy-qcom-usb-hsic.c | 6 +-
drivers/platform/chrome/chromeos_laptop.c | 24 +-
drivers/platform/chrome/cros_ec.c | 8 +-
drivers/platform/chrome/cros_ec_chardev.c | 3 +
drivers/platform/chrome/cros_ec_proto.c | 32 +++
drivers/platform/x86/msi-laptop.c | 14 +-
drivers/power/supply/adp5061.c | 6 +-
drivers/powercap/intel_rapl_common.c | 4 +-
drivers/regulator/core.c | 2 +-
drivers/regulator/qcom_rpm-regulator.c | 24 +-
drivers/scsi/3w-9xxx.c | 2 +-
drivers/scsi/iscsi_tcp.c | 73 ++++--
drivers/scsi/iscsi_tcp.h | 2 +
drivers/scsi/libsas/sas_expander.c | 2 +-
drivers/scsi/qedf/qedf_main.c | 21 ++
drivers/soc/qcom/smem_state.c | 3 +-
drivers/soc/qcom/smsm.c | 20 +-
drivers/soc/tegra/Kconfig | 1 -
drivers/soundwire/cadence_master.c | 9 +-
drivers/soundwire/intel.c | 1 -
drivers/spi/spi-dw-bt1.c | 4 +-
drivers/spi/spi-meson-spicc.c | 6 +-
drivers/spi/spi-mt7621.c | 8 +-
drivers/spi/spi-omap-100k.c | 1 +
drivers/spi/spi-qup.c | 21 +-
drivers/spi/spi-s3c64xx.c | 9 +
drivers/spi/spi.c | 2 +
drivers/spmi/spmi-pmic-arb.c | 13 +-
drivers/staging/greybus/audio_helper.c | 11 -
drivers/staging/media/meson/vdec/vdec_hevc.c | 6 +-
drivers/staging/media/sunxi/cedrus/cedrus.c | 4 +-
drivers/staging/rtl8723bs/core/rtw_cmd.c | 16 +-
drivers/staging/vt6655/device_main.c | 8 +-
drivers/thermal/intel/intel_powerclamp.c | 4 +-
drivers/thermal/qcom/tsens-v0_1.c | 2 +-
drivers/thunderbolt/switch.c | 24 ++
drivers/thunderbolt/tb.h | 1 +
drivers/thunderbolt/tb_regs.h | 1 +
drivers/thunderbolt/usb4.c | 20 ++
drivers/tty/serial/8250/8250_core.c | 19 +-
drivers/tty/serial/8250/8250_port.c | 18 +-
drivers/tty/serial/fsl_lpuart.c | 2 +
drivers/tty/serial/jsm/jsm_driver.c | 3 +-
drivers/tty/serial/xilinx_uartps.c | 2 +
drivers/usb/common/common.c | 102 +++++++-
drivers/usb/common/debug.c | 78 ++++--
drivers/usb/core/devices.c | 21 +-
drivers/usb/core/endpoint.c | 35 +--
drivers/usb/core/quirks.c | 4 +
drivers/usb/gadget/function/f_printer.c | 12 +-
drivers/usb/host/xhci-mem.c | 7 +-
drivers/usb/host/xhci-plat.c | 18 +-
drivers/usb/host/xhci.c | 3 +-
drivers/usb/host/xhci.h | 1 +
drivers/usb/misc/idmouse.c | 8 +-
drivers/usb/musb/musb_gadget.c | 3 +
drivers/usb/storage/unusual_devs.h | 6 -
drivers/vhost/vsock.c | 2 +-
drivers/video/fbdev/smscufx.c | 14 +-
drivers/video/fbdev/stifb.c | 2 +-
fs/btrfs/qgroup.c | 15 ++
fs/btrfs/scrub.c | 36 +++
fs/cifs/file.c | 9 +
fs/cifs/smb2pdu.c | 7 +-
fs/dlm/ast.c | 6 +-
fs/dlm/lock.c | 16 +-
fs/ext4/fast_commit.c | 40 ++--
fs/ext4/file.c | 6 +
fs/ext4/inode.c | 14 +-
fs/ext4/namei.c | 2 +-
fs/ext4/resize.c | 2 +-
fs/ext4/super.c | 19 +-
fs/f2fs/checkpoint.c | 23 +-
fs/f2fs/data.c | 4 +-
fs/f2fs/extent_cache.c | 3 +-
fs/f2fs/f2fs.h | 27 ++-
fs/f2fs/gc.c | 10 +-
fs/f2fs/recovery.c | 23 +-
fs/f2fs/segment.c | 47 ++--
fs/f2fs/super.c | 4 +-
fs/io_uring.c | 8 +-
fs/jbd2/commit.c | 2 +-
fs/jbd2/journal.c | 10 +-
fs/jbd2/recovery.c | 1 +
fs/jbd2/transaction.c | 6 +-
fs/nfsd/nfs4recover.c | 4 +-
fs/nfsd/nfs4state.c | 5 +
fs/nfsd/nfs4xdr.c | 2 +-
fs/quota/quota_tree.c | 38 +++
fs/userfaultfd.c | 4 +-
include/linux/ata.h | 39 +--
include/linux/dynamic_debug.h | 11 +-
include/linux/iova.h | 2 +-
include/linux/once.h | 28 +++
include/linux/ring_buffer.h | 2 +-
include/linux/serial_8250.h | 1 +
include/linux/serial_core.h | 3 +-
include/linux/skbuff.h | 2 +
include/linux/tcp.h | 2 +-
include/linux/usb/ch9.h | 62 +----
include/net/ieee802154_netdev.h | 12 +-
include/net/sock.h | 2 +-
include/net/tcp.h | 5 +-
include/uapi/linux/usb/ch9.h | 13 +
kernel/bpf/btf.c | 2 +-
kernel/bpf/syscall.c | 2 +
kernel/cgroup/cpuset.c | 18 +-
kernel/gcov/gcc_4_7.c | 18 +-
kernel/livepatch/transition.c | 18 +-
kernel/rcu/tasks.h | 2 +-
kernel/rcu/tree.c | 17 +-
kernel/trace/ftrace.c | 8 +-
kernel/trace/kprobe_event_gen_test.c | 49 +++-
kernel/trace/ring_buffer.c | 87 ++++++-
kernel/trace/trace.c | 23 ++
lib/dynamic_debug.c | 45 +---
lib/once.c | 30 +++
mm/hugetlb.c | 29 +--
mm/mmap.c | 5 +-
net/bluetooth/hci_core.c | 34 ++-
net/bluetooth/hci_sysfs.c | 3 +
net/bluetooth/l2cap_core.c | 17 +-
net/can/bcm.c | 7 +-
net/core/stream.c | 3 +-
net/ieee802154/socket.c | 4 +
net/ipv4/af_inet.c | 2 +-
net/ipv4/inet_hashtables.c | 4 +-
net/ipv4/netfilter/nft_fib_ipv4.c | 3 +
net/ipv4/tcp.c | 19 +-
net/ipv4/tcp_input.c | 2 +-
net/ipv4/tcp_ipv4.c | 11 +-
net/ipv4/tcp_output.c | 19 +-
net/ipv4/udp.c | 6 +-
net/ipv6/netfilter/nft_fib_ipv6.c | 6 +-
net/ipv6/tcp_ipv6.c | 11 +-
net/ipv6/udp.c | 4 +-
net/mac80211/cfg.c | 3 -
net/openvswitch/datapath.c | 18 +-
net/rds/tcp.c | 2 +-
net/sctp/auth.c | 18 +-
net/unix/garbage.c | 20 ++
net/vmw_vsock/virtio_transport_common.c | 2 +-
net/xfrm/xfrm_ipcomp.c | 1 +
scripts/Kbuild.include | 23 +-
scripts/package/mkspec | 4 +-
scripts/selinux/install_policy.sh | 2 +-
security/Kconfig.hardening | 63 +++--
sound/core/pcm_dmaengine.c | 8 +-
sound/core/rawmidi.c | 2 -
sound/core/sound_oss.c | 13 +-
sound/pci/hda/hda_beep.c | 15 +-
sound/pci/hda/hda_beep.h | 1 +
sound/pci/hda/patch_hdmi.c | 6 -
sound/pci/hda/patch_realtek.c | 11 +-
sound/pci/hda/patch_sigmatel.c | 25 +-
sound/soc/codecs/da7219.c | 5 +-
sound/soc/codecs/mt6660.c | 8 +-
sound/soc/codecs/tas2764.c | 78 ++----
sound/soc/codecs/wcd9335.c | 2 +-
sound/soc/codecs/wcd934x.c | 2 +-
sound/soc/codecs/wm5102.c | 6 +-
sound/soc/codecs/wm5110.c | 6 +-
sound/soc/codecs/wm8997.c | 6 +-
sound/soc/fsl/eukrea-tlv320.c | 8 +-
sound/soc/sh/rcar/ctu.c | 6 +-
sound/soc/sh/rcar/dvc.c | 6 +-
sound/soc/sh/rcar/mix.c | 6 +-
sound/soc/sh/rcar/src.c | 5 +-
sound/soc/sh/rcar/ssi.c | 4 +-
sound/soc/sof/sof-pci-dev.c | 2 +-
sound/usb/endpoint.c | 6 +-
tools/bpf/bpftool/btf_dumper.c | 2 +-
tools/bpf/bpftool/main.c | 10 +
tools/lib/bpf/xsk.c | 6 +-
tools/objtool/elf.c | 7 +-
tools/perf/util/intel-pt.c | 9 +-
.../selftests/arm64/signal/testcases/testcases.c | 2 +-
tools/testing/selftests/tpm2/tpm2.py | 4 +
380 files changed, 3236 insertions(+), 1455 deletions(-)
From: Jianglei Nie <[email protected]>
commit 540dfd188ea2940582841c1c220bd035a7db0e51 upstream.
nouveau_bo_init() is backed by ttm_bo_init() and ferries its return code
back to the caller. On failures, ttm will call nouveau_bo_del_ttm() and
free the memory.Thus, when nouveau_bo_init() returns an error, the gem
object has already been released. Then the call to nouveau_bo_ref() will
use the freed "nvbo->bo" and lead to a use-after-free bug.
We should delete the call to nouveau_bo_ref() to avoid the use-after-free.
Signed-off-by: Jianglei Nie <[email protected]>
Reviewed-by: Lyude Paul <[email protected]>
Signed-off-by: Lyude Paul <[email protected]>
Fixes: 019cbd4a4feb ("drm/nouveau: Initialize GEM object before TTM object")
Cc: Thierry Reding <[email protected]>
Cc: <[email protected]> # v5.4+
Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/gpu/drm/nouveau/nouveau_prime.c | 1 -
1 file changed, 1 deletion(-)
--- a/drivers/gpu/drm/nouveau/nouveau_prime.c
+++ b/drivers/gpu/drm/nouveau/nouveau_prime.c
@@ -89,7 +89,6 @@ struct drm_gem_object *nouveau_gem_prime
ret = nouveau_bo_init(nvbo, size, align, NOUVEAU_GEM_DOMAIN_GART,
sg, robj);
if (ret) {
- nouveau_bo_ref(NULL, &nvbo);
obj = ERR_PTR(ret);
goto unlock;
}
From: Anssi Hannula <[email protected]>
commit 455561fb618fde40558776b5b8435f9420f335db upstream.
The TX queue seems to be implicitly flushed by the hardware during
bus-off or bus-off recovery, but the driver does not reset the TX
bookkeeping.
Despite not resetting TX bookkeeping the driver still re-enables TX
queue unconditionally, leading to "cannot find free context" /
NETDEV_TX_BUSY errors if the TX queue was full at bus-off time.
Fix that by resetting TX bookkeeping on CAN restart.
Tested with 0bfd:0124 Kvaser Mini PCI Express 2xHS FW 4.18.778.
Cc: [email protected]
Fixes: 080f40a6fa28 ("can: kvaser_usb: Add support for Kvaser CAN/USB devices")
Tested-by: Jimmy Assarsson <[email protected]>
Signed-off-by: Anssi Hannula <[email protected]>
Signed-off-by: Jimmy Assarsson <[email protected]>
Link: https://lore.kernel.org/all/[email protected]
Signed-off-by: Marc Kleine-Budde <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/net/can/usb/kvaser_usb/kvaser_usb.h | 2 ++
drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c | 2 +-
drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 2 ++
3 files changed, 5 insertions(+), 1 deletion(-)
--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb.h
+++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb.h
@@ -178,6 +178,8 @@ struct kvaser_usb_dev_cfg {
extern const struct kvaser_usb_dev_ops kvaser_usb_hydra_dev_ops;
extern const struct kvaser_usb_dev_ops kvaser_usb_leaf_dev_ops;
+void kvaser_usb_unlink_tx_urbs(struct kvaser_usb_net_priv *priv);
+
int kvaser_usb_recv_cmd(const struct kvaser_usb *dev, void *cmd, int len,
int *actual_len);
--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c
+++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c
@@ -453,7 +453,7 @@ static void kvaser_usb_reset_tx_urb_cont
/* This method might sleep. Do not call it in the atomic context
* of URB completions.
*/
-static void kvaser_usb_unlink_tx_urbs(struct kvaser_usb_net_priv *priv)
+void kvaser_usb_unlink_tx_urbs(struct kvaser_usb_net_priv *priv)
{
usb_kill_anchored_urbs(&priv->tx_submitted);
kvaser_usb_reset_tx_urb_contexts(priv);
--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
+++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
@@ -1430,6 +1430,8 @@ static int kvaser_usb_leaf_set_mode(stru
switch (mode) {
case CAN_MODE_START:
+ kvaser_usb_unlink_tx_urbs(priv);
+
err = kvaser_usb_leaf_simple_cmd_async(priv, CMD_START_CHIP);
if (err)
return err;
From: Damian Muszynski <[email protected]>
[ Upstream commit cf5bb835b7c8a5fee7f26455099cca7feb57f5e9 ]
When CONFIG_DMA_API_DEBUG is selected, while running the crypto self
test on the QAT crypto algorithms, the function add_dma_entry() reports
a warning similar to the one below, saying that overlapping mappings
are not supported. This occurs in tests where the input and the output
scatter list point to the same buffers (i.e. two different scatter lists
which point to the same chunks of memory).
The logic that implements the mapping uses the flag DMA_BIDIRECTIONAL
for both the input and the output scatter lists which leads to
overlapped write mappings. These are not supported by the DMA layer.
Fix by specifying the correct DMA transfer directions when mapping
buffers. For in-place operations where the input scatter list
matches the output scatter list, buffers are mapped once with
DMA_BIDIRECTIONAL, otherwise input buffers are mapped using the flag
DMA_TO_DEVICE and output buffers are mapped with DMA_FROM_DEVICE.
Overlapping a read mapping with a write mapping is a valid case in
dma-coherent devices like QAT.
The function that frees and unmaps the buffers, qat_alg_free_bufl()
has been changed accordingly to the changes to the mapping function.
DMA-API: 4xxx 0000:06:00.0: cacheline tracking EEXIST, overlapping mappings aren't supported
WARNING: CPU: 53 PID: 4362 at kernel/dma/debug.c:570 add_dma_entry+0x1e9/0x270
...
Call Trace:
dma_map_page_attrs+0x82/0x2d0
? preempt_count_add+0x6a/0xa0
qat_alg_sgl_to_bufl+0x45b/0x990 [intel_qat]
qat_alg_aead_dec+0x71/0x250 [intel_qat]
crypto_aead_decrypt+0x3d/0x70
test_aead_vec_cfg+0x649/0x810
? number+0x310/0x3a0
? vsnprintf+0x2a3/0x550
? scnprintf+0x42/0x70
? valid_sg_divisions.constprop.0+0x86/0xa0
? test_aead_vec+0xdf/0x120
test_aead_vec+0xdf/0x120
alg_test_aead+0x185/0x400
alg_test+0x3d8/0x500
? crypto_acomp_scomp_free_ctx+0x30/0x30
? __schedule+0x32a/0x12a0
? ttwu_queue_wakelist+0xbf/0x110
? _raw_spin_unlock_irqrestore+0x23/0x40
? try_to_wake_up+0x83/0x570
? _raw_spin_unlock_irqrestore+0x23/0x40
? __set_cpus_allowed_ptr_locked+0xea/0x1b0
? crypto_acomp_scomp_free_ctx+0x30/0x30
cryptomgr_test+0x27/0x50
kthread+0xe6/0x110
? kthread_complete_and_exit+0x20/0x20
ret_from_fork+0x1f/0x30
Fixes: d370cec ("crypto: qat - Intel(R) QAT crypto interface")
Link: https://lore.kernel.org/linux-crypto/[email protected]/
Signed-off-by: Damian Muszynski <[email protected]>
Signed-off-by: Giovanni Cabiddu <[email protected]>
Signed-off-by: Herbert Xu <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/crypto/qat/qat_common/qat_algs.c | 18 ++++++++++++------
1 file changed, 12 insertions(+), 6 deletions(-)
diff --git a/drivers/crypto/qat/qat_common/qat_algs.c b/drivers/crypto/qat/qat_common/qat_algs.c
index 2e2c2ac53609..5b71768fc0c7 100644
--- a/drivers/crypto/qat/qat_common/qat_algs.c
+++ b/drivers/crypto/qat/qat_common/qat_algs.c
@@ -624,11 +624,14 @@ static void qat_alg_free_bufl(struct qat_crypto_instance *inst,
dma_addr_t blpout = qat_req->buf.bloutp;
size_t sz = qat_req->buf.sz;
size_t sz_out = qat_req->buf.sz_out;
+ int bl_dma_dir;
int i;
+ bl_dma_dir = blp != blpout ? DMA_TO_DEVICE : DMA_BIDIRECTIONAL;
+
for (i = 0; i < bl->num_bufs; i++)
dma_unmap_single(dev, bl->bufers[i].addr,
- bl->bufers[i].len, DMA_BIDIRECTIONAL);
+ bl->bufers[i].len, bl_dma_dir);
dma_unmap_single(dev, blp, sz, DMA_TO_DEVICE);
@@ -642,7 +645,7 @@ static void qat_alg_free_bufl(struct qat_crypto_instance *inst,
for (i = bufless; i < blout->num_bufs; i++) {
dma_unmap_single(dev, blout->bufers[i].addr,
blout->bufers[i].len,
- DMA_BIDIRECTIONAL);
+ DMA_FROM_DEVICE);
}
dma_unmap_single(dev, blpout, sz_out, DMA_TO_DEVICE);
@@ -666,6 +669,7 @@ static int qat_alg_sgl_to_bufl(struct qat_crypto_instance *inst,
struct scatterlist *sg;
size_t sz_out, sz = struct_size(bufl, bufers, n);
int node = dev_to_node(&GET_DEV(inst->accel_dev));
+ int bufl_dma_dir;
if (unlikely(!n))
return -EINVAL;
@@ -683,6 +687,8 @@ static int qat_alg_sgl_to_bufl(struct qat_crypto_instance *inst,
qat_req->buf.sgl_src_valid = true;
}
+ bufl_dma_dir = sgl != sglout ? DMA_TO_DEVICE : DMA_BIDIRECTIONAL;
+
for_each_sg(sgl, sg, n, i)
bufl->bufers[i].addr = DMA_MAPPING_ERROR;
@@ -694,7 +700,7 @@ static int qat_alg_sgl_to_bufl(struct qat_crypto_instance *inst,
bufl->bufers[y].addr = dma_map_single(dev, sg_virt(sg),
sg->length,
- DMA_BIDIRECTIONAL);
+ bufl_dma_dir);
bufl->bufers[y].len = sg->length;
if (unlikely(dma_mapping_error(dev, bufl->bufers[y].addr)))
goto err_in;
@@ -737,7 +743,7 @@ static int qat_alg_sgl_to_bufl(struct qat_crypto_instance *inst,
bufers[y].addr = dma_map_single(dev, sg_virt(sg),
sg->length,
- DMA_BIDIRECTIONAL);
+ DMA_FROM_DEVICE);
if (unlikely(dma_mapping_error(dev, bufers[y].addr)))
goto err_out;
bufers[y].len = sg->length;
@@ -767,7 +773,7 @@ static int qat_alg_sgl_to_bufl(struct qat_crypto_instance *inst,
if (!dma_mapping_error(dev, buflout->bufers[i].addr))
dma_unmap_single(dev, buflout->bufers[i].addr,
buflout->bufers[i].len,
- DMA_BIDIRECTIONAL);
+ DMA_FROM_DEVICE);
if (!qat_req->buf.sgl_dst_valid)
kfree(buflout);
@@ -781,7 +787,7 @@ static int qat_alg_sgl_to_bufl(struct qat_crypto_instance *inst,
if (!dma_mapping_error(dev, bufl->bufers[i].addr))
dma_unmap_single(dev, bufl->bufers[i].addr,
bufl->bufers[i].len,
- DMA_BIDIRECTIONAL);
+ bufl_dma_dir);
if (!qat_req->buf.sgl_src_valid)
kfree(bufl);
--
2.35.1
From: Randy Dunlap <[email protected]>
[ Upstream commit 97c318bfbe84efded246e80428054f300042f110 ]
cxl_pmem.ko uses memory_add_physaddr_to_nid() but ia64 does not export it,
so this causes a build error:
ERROR: modpost: "memory_add_physaddr_to_nid" [drivers/cxl/cxl_pmem.ko] undefined!
Fix this by exporting that function.
Fixes: 8c2676a5870a ("hot-add-mem x86_64: memory_add_physaddr_to_nid node fixup")
Reported-by: kernel test robot <[email protected]>
Signed-off-by: Randy Dunlap <[email protected]>
Cc: Dan Williams <[email protected]>
Cc: Ben Widawsky <[email protected]>
Cc: Jonathan Cameron <[email protected]>
Cc: [email protected]
Cc: Arnd Bergmann <[email protected]>
Cc: Keith Mannthey <[email protected]>
Cc: Andrew Morton <[email protected]>
Signed-off-by: Arnd Bergmann <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
arch/ia64/mm/numa.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/ia64/mm/numa.c b/arch/ia64/mm/numa.c
index f34964271101..6cd002e8163d 100644
--- a/arch/ia64/mm/numa.c
+++ b/arch/ia64/mm/numa.c
@@ -106,5 +106,6 @@ int memory_add_physaddr_to_nid(u64 addr)
return 0;
return nid;
}
+EXPORT_SYMBOL(memory_add_physaddr_to_nid);
#endif
#endif
--
2.35.1
From: Dan Carpenter <[email protected]>
[ Upstream commit 1d5859ef229e381f4db38dce8ed58e4bf862006b ]
This error path needs to unwind instead of just returning directly.
Fixes: 03a8482c17dd ("drivers: serial: jsm: Enable support for Digi Classic adapters")
Signed-off-by: Dan Carpenter <[email protected]>
Link: https://lore.kernel.org/r/YyxFh1+lOeZ9WfKO@kili
Signed-off-by: Greg Kroah-Hartman <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/tty/serial/jsm/jsm_driver.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/tty/serial/jsm/jsm_driver.c b/drivers/tty/serial/jsm/jsm_driver.c
index cd30da0ef083..b5b61e598b53 100644
--- a/drivers/tty/serial/jsm/jsm_driver.c
+++ b/drivers/tty/serial/jsm/jsm_driver.c
@@ -212,7 +212,8 @@ static int jsm_probe_one(struct pci_dev *pdev, const struct pci_device_id *ent)
break;
default:
- return -ENXIO;
+ rc = -ENXIO;
+ goto out_kfree_brd;
}
rc = request_irq(brd->irq, brd->bd_ops->intr, IRQF_SHARED, "JSM", brd);
--
2.35.1
From: Rishabh Bhatnagar <[email protected]>
commit 61ce339f19fabbc3e51237148a7ef6f2270e44fa upstream.
If swiotlb is force enabled dma_max_mapping_size ends up calling
swiotlb_max_mapping_size which takes into account the min align mask for
the device. Set the min align mask for nvme driver before calling
dma_max_mapping_size while calculating max hw sectors.
Signed-off-by: Rishabh Bhatnagar <[email protected]>
Signed-off-by: Christoph Hellwig <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/nvme/host/pci.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -2624,6 +2624,8 @@ static void nvme_reset_work(struct work_
if (result)
goto out_unlock;
+ dma_set_min_align_mask(dev->dev, NVME_CTRL_PAGE_SIZE - 1);
+
/*
* Limit the max command size to prevent iod->sg allocations going
* over a single page.
@@ -2636,7 +2638,6 @@ static void nvme_reset_work(struct work_
* Don't limit the IOMMU merged segment size.
*/
dma_set_max_seg_size(dev->dev, 0xffffffff);
- dma_set_min_align_mask(dev->dev, NVME_CTRL_PAGE_SIZE - 1);
mutex_unlock(&dev->shutdown_lock);
From: Liang He <[email protected]>
[ Upstream commit 90681f53b9381c23ff7762a3b13826d620c272de ]
In qcom_smem_state_register() and qcom_smem_state_release(), we
should better use of_node_get() and of_node_put() for the reference
creation and destruction of 'device_node'.
Fixes: 9460ae2ff308 ("soc: qcom: Introduce common SMEM state machine code")
Signed-off-by: Liang He <[email protected]>
Signed-off-by: Bjorn Andersson <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/soc/qcom/smem_state.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/soc/qcom/smem_state.c b/drivers/soc/qcom/smem_state.c
index d2b558438deb..41e929407196 100644
--- a/drivers/soc/qcom/smem_state.c
+++ b/drivers/soc/qcom/smem_state.c
@@ -136,6 +136,7 @@ static void qcom_smem_state_release(struct kref *ref)
struct qcom_smem_state *state = container_of(ref, struct qcom_smem_state, refcount);
list_del(&state->list);
+ of_node_put(state->of_node);
kfree(state);
}
@@ -169,7 +170,7 @@ struct qcom_smem_state *qcom_smem_state_register(struct device_node *of_node,
kref_init(&state->refcount);
- state->of_node = of_node;
+ state->of_node = of_node_get(of_node);
state->ops = *ops;
state->priv = priv;
--
2.35.1
From: Saurav Kashyap <[email protected]>
commit 592642e6b11e620e4b43189f8072752429fc8dc3 upstream.
Few vport parameters were displayed by systool as 'Unknown' or 'NULL'.
Copy speed, supported_speed, frame_size and update port_type for NPIV port.
Link: https://lore.kernel.org/r/[email protected]
Cc: [email protected]
Tested-by: Guangwu Zhang <[email protected]>
Reviewed-by: John Meneghini <[email protected]>
Signed-off-by: Saurav Kashyap <[email protected]>
Signed-off-by: Nilesh Javali <[email protected]>
Signed-off-by: Martin K. Petersen <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/scsi/qedf/qedf_main.c | 21 +++++++++++++++++++++
1 file changed, 21 insertions(+)
--- a/drivers/scsi/qedf/qedf_main.c
+++ b/drivers/scsi/qedf/qedf_main.c
@@ -1917,6 +1917,27 @@ static int qedf_vport_create(struct fc_v
fc_vport_setlink(vn_port);
}
+ /* Set symbolic node name */
+ if (base_qedf->pdev->device == QL45xxx)
+ snprintf(fc_host_symbolic_name(vn_port->host), 256,
+ "Marvell FastLinQ 45xxx FCoE v%s", QEDF_VERSION);
+
+ if (base_qedf->pdev->device == QL41xxx)
+ snprintf(fc_host_symbolic_name(vn_port->host), 256,
+ "Marvell FastLinQ 41xxx FCoE v%s", QEDF_VERSION);
+
+ /* Set supported speed */
+ fc_host_supported_speeds(vn_port->host) = n_port->link_supported_speeds;
+
+ /* Set speed */
+ vn_port->link_speed = n_port->link_speed;
+
+ /* Set port type */
+ fc_host_port_type(vn_port->host) = FC_PORTTYPE_NPIV;
+
+ /* Set maxframe size */
+ fc_host_maxframe_size(vn_port->host) = n_port->mfs;
+
QEDF_INFO(&(base_qedf->dbg_ctx), QEDF_LOG_NPIV, "vn_port=%p.\n",
vn_port);
From: Christophe JAILLET <[email protected]>
[ Upstream commit 48749cabba109397b4e7dd556e85718ec0ec114d ]
The commit in Fixes: has added a pwm_add_table() call in the probe() and
a pwm_remove_table() call in the remove(), but forget to update the error
handling path of the probe.
Add the missing pwm_remove_table() call.
Fixes: a3aa9a93df9f ("mfd: intel_soc_pmic_core: ADD PWM lookup table for CRC PMIC based PWM")
Signed-off-by: Christophe JAILLET <[email protected]>
Signed-off-by: Andy Shevchenko <[email protected]>
Reviewed-by: Hans de Goede <[email protected]>
Signed-off-by: Lee Jones <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/mfd/intel_soc_pmic_core.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/mfd/intel_soc_pmic_core.c b/drivers/mfd/intel_soc_pmic_core.c
index ddd64f9e3341..926653e1f603 100644
--- a/drivers/mfd/intel_soc_pmic_core.c
+++ b/drivers/mfd/intel_soc_pmic_core.c
@@ -95,6 +95,7 @@ static int intel_soc_pmic_i2c_probe(struct i2c_client *i2c,
return 0;
err_del_irq_chip:
+ pwm_remove_table(crc_pwm_lookup, ARRAY_SIZE(crc_pwm_lookup));
regmap_del_irq_chip(pmic->irq, pmic->irq_chip_data);
return ret;
}
--
2.35.1
From: Krzysztof Kozlowski <[email protected]>
commit ea8ef003aa53ad23e7705c5cab1c4e664faa6c79 upstream.
Slimbus streams are first prepared and then enabled, so the cleanup path
should reverse it. The unprepare sets stream->num_ports to 0 and frees
the stream->ports. Calling disable after unprepare was not really
effective (channels was not deactivated) and could lead to further
issues due to making transfers on unprepared stream.
Fixes: 20aedafdf492 ("ASoC: wcd9335: add support to wcd9335 codec")
Cc: <[email protected]>
Signed-off-by: Krzysztof Kozlowski <[email protected]>
Reviewed-by: Srinivas Kandagatla <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Mark Brown <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
sound/soc/codecs/wcd9335.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/sound/soc/codecs/wcd9335.c
+++ b/sound/soc/codecs/wcd9335.c
@@ -1971,8 +1971,8 @@ static int wcd9335_trigger(struct snd_pc
case SNDRV_PCM_TRIGGER_STOP:
case SNDRV_PCM_TRIGGER_SUSPEND:
case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
- slim_stream_unprepare(dai_data->sruntime);
slim_stream_disable(dai_data->sruntime);
+ slim_stream_unprepare(dai_data->sruntime);
break;
default:
break;
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 448a496f760664d3e2e79466aa1787e6abc922b5 ]
device_add shall not be called multiple times as stated in its
documentation:
'Do not call this routine or device_register() more than once for
any device structure'
Syzkaller reports a bug as follows [1]:
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:33!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
[...]
Call Trace:
<TASK>
__list_add include/linux/list.h:69 [inline]
list_add_tail include/linux/list.h:102 [inline]
kobj_kset_join lib/kobject.c:164 [inline]
kobject_add_internal+0x18f/0x8f0 lib/kobject.c:214
kobject_add_varg lib/kobject.c:358 [inline]
kobject_add+0x150/0x1c0 lib/kobject.c:410
device_add+0x368/0x1e90 drivers/base/core.c:3452
hci_conn_add_sysfs+0x9b/0x1b0 net/bluetooth/hci_sysfs.c:53
hci_le_cis_estabilished_evt+0x57c/0xae0 net/bluetooth/hci_event.c:6799
hci_le_meta_evt+0x2b8/0x510 net/bluetooth/hci_event.c:7110
hci_event_func net/bluetooth/hci_event.c:7440 [inline]
hci_event_packet+0x63d/0xfd0 net/bluetooth/hci_event.c:7495
hci_rx_work+0xae7/0x1230 net/bluetooth/hci_core.c:4007
process_one_work+0x991/0x1610 kernel/workqueue.c:2289
worker_thread+0x665/0x1080 kernel/workqueue.c:2436
kthread+0x2e4/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
</TASK>
Link: https://syzkaller.appspot.com/bug?id=da3246e2d33afdb92d66bc166a0934c5b146404a
Signed-off-by: Luiz Augusto von Dentz <[email protected]>
Tested-by: Hawkins Jiawei <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
net/bluetooth/hci_sysfs.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
index b69d88b88d2e..ccd2c377bf83 100644
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@ -48,6 +48,9 @@ void hci_conn_add_sysfs(struct hci_conn *conn)
BT_DBG("conn %p", conn);
+ if (device_is_registered(&conn->dev))
+ return;
+
dev_set_name(&conn->dev, "%s:%d", hdev->name, conn->handle);
if (device_add(&conn->dev) < 0) {
--
2.35.1
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 116523c8fac05d1d26f748fee7919a4ec5df67ea ]
Change that introduced the use of __check_timeout did not account for
link types properly, it always assumes ACL_LINK is used thus causing
hdev->acl_last_tx to be used even in case of LE_LINK and then again
uses ACL_LINK with hci_link_tx_to.
To fix this __check_timeout now takes the link type as parameter and
then procedure to use the right last_tx based on the link type and pass
it to hci_link_tx_to.
Fixes: 1b1d29e51499 ("Bluetooth: Make use of __check_timeout on hci_sched_le")
Signed-off-by: Luiz Augusto von Dentz <[email protected]>
Tested-by: David Beinder <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
net/bluetooth/hci_core.c | 34 +++++++++++++++++++++++-----------
1 file changed, 23 insertions(+), 11 deletions(-)
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 2cb0cf035476..866eb22432de 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -4482,15 +4482,27 @@ static inline int __get_blocks(struct hci_dev *hdev, struct sk_buff *skb)
return DIV_ROUND_UP(skb->len - HCI_ACL_HDR_SIZE, hdev->block_len);
}
-static void __check_timeout(struct hci_dev *hdev, unsigned int cnt)
+static void __check_timeout(struct hci_dev *hdev, unsigned int cnt, u8 type)
{
- if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
- /* ACL tx timeout must be longer than maximum
- * link supervision timeout (40.9 seconds) */
- if (!cnt && time_after(jiffies, hdev->acl_last_tx +
- HCI_ACL_TX_TIMEOUT))
- hci_link_tx_to(hdev, ACL_LINK);
+ unsigned long last_tx;
+
+ if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
+ return;
+
+ switch (type) {
+ case LE_LINK:
+ last_tx = hdev->le_last_tx;
+ break;
+ default:
+ last_tx = hdev->acl_last_tx;
+ break;
}
+
+ /* tx timeout must be longer than maximum link supervision timeout
+ * (40.9 seconds)
+ */
+ if (!cnt && time_after(jiffies, last_tx + HCI_ACL_TX_TIMEOUT))
+ hci_link_tx_to(hdev, type);
}
/* Schedule SCO */
@@ -4548,7 +4560,7 @@ static void hci_sched_acl_pkt(struct hci_dev *hdev)
struct sk_buff *skb;
int quote;
- __check_timeout(hdev, cnt);
+ __check_timeout(hdev, cnt, ACL_LINK);
while (hdev->acl_cnt &&
(chan = hci_chan_sent(hdev, ACL_LINK, "e))) {
@@ -4591,8 +4603,6 @@ static void hci_sched_acl_blk(struct hci_dev *hdev)
int quote;
u8 type;
- __check_timeout(hdev, cnt);
-
BT_DBG("%s", hdev->name);
if (hdev->dev_type == HCI_AMP)
@@ -4600,6 +4610,8 @@ static void hci_sched_acl_blk(struct hci_dev *hdev)
else
type = ACL_LINK;
+ __check_timeout(hdev, cnt, type);
+
while (hdev->block_cnt > 0 &&
(chan = hci_chan_sent(hdev, type, "e))) {
u32 priority = (skb_peek(&chan->data_q))->priority;
@@ -4673,7 +4685,7 @@ static void hci_sched_le(struct hci_dev *hdev)
cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
- __check_timeout(hdev, cnt);
+ __check_timeout(hdev, cnt, LE_LINK);
tmp = cnt;
while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, "e))) {
--
2.35.1
From: Mark Brown <[email protected]>
[ Upstream commit 5c152c2f66f9368394b89ac90dc7483476ef7b88 ]
When arm64 signal context data overflows the base struct sigcontext it gets
placed in an extra buffer pointed to by a record of type EXTRA_CONTEXT in
the base struct sigcontext which is required to be the last record in the
base struct sigframe. The current validation code attempts to check this
by using GET_RESV_NEXT_HEAD() to step forward from the current record to
the next but that is a macro which assumes it is being provided with a
struct _aarch64_ctx and uses the size there to skip forward to the next
record. Instead validate_extra_context() passes it a struct extra_context
which has a separate size field. This compiles but results in us trying
to validate a termination record in completely the wrong place, at best
failing validation and at worst just segfaulting. Fix this by passing
the struct _aarch64_ctx we meant to into the macro.
Signed-off-by: Mark Brown <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Catalin Marinas <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
tools/testing/selftests/arm64/signal/testcases/testcases.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/testing/selftests/arm64/signal/testcases/testcases.c b/tools/testing/selftests/arm64/signal/testcases/testcases.c
index 61ebcdf63831..a3ac5c2d8aac 100644
--- a/tools/testing/selftests/arm64/signal/testcases/testcases.c
+++ b/tools/testing/selftests/arm64/signal/testcases/testcases.c
@@ -33,7 +33,7 @@ bool validate_extra_context(struct extra_context *extra, char **err)
return false;
fprintf(stderr, "Validating EXTRA...\n");
- term = GET_RESV_NEXT_HEAD(extra);
+ term = GET_RESV_NEXT_HEAD(&extra->head);
if (!term || term->magic || term->size) {
*err = "Missing terminator after EXTRA context";
return false;
--
2.35.1
From: Dave Jiang <[email protected]>
[ Upstream commit 898ec89dbb55b8294695ad71694a0684e62b2a73 ]
User reports observing timer event report channel halted but no error
observed in CHANERR register. The driver finished self-test and released
channel resources. Debug shows that __cleanup() can call
mod_timer() after the timer has been deleted and thus resurrect the
timer. While harmless, it causes suprious error message to be emitted.
Use mod_timer_pending() call to prevent deleted timer from being
resurrected.
Fixes: 3372de5813e4 ("dmaengine: ioatdma: removal of dma_v3.c and relevant ioat3 references")
Signed-off-by: Dave Jiang <[email protected]>
Link: https://lore.kernel.org/r/166360672197.3851724.17040290563764838369.stgit@djiang5-desk3.ch.intel.com
Signed-off-by: Vinod Koul <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/dma/ioat/dma.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/dma/ioat/dma.c b/drivers/dma/ioat/dma.c
index 37ff4ec7db76..e2070df6cad2 100644
--- a/drivers/dma/ioat/dma.c
+++ b/drivers/dma/ioat/dma.c
@@ -656,7 +656,7 @@ static void __cleanup(struct ioatdma_chan *ioat_chan, dma_addr_t phys_complete)
if (active - i == 0) {
dev_dbg(to_dev(ioat_chan), "%s: cancel completion timeout\n",
__func__);
- mod_timer(&ioat_chan->timer, jiffies + IDLE_TIMEOUT);
+ mod_timer_pending(&ioat_chan->timer, jiffies + IDLE_TIMEOUT);
}
/* microsecond delay by sysfs variable per pending descriptor */
@@ -682,7 +682,7 @@ static void ioat_cleanup(struct ioatdma_chan *ioat_chan)
if (chanerr &
(IOAT_CHANERR_HANDLE_MASK | IOAT_CHANERR_RECOVER_MASK)) {
- mod_timer(&ioat_chan->timer, jiffies + IDLE_TIMEOUT);
+ mod_timer_pending(&ioat_chan->timer, jiffies + IDLE_TIMEOUT);
ioat_eh(ioat_chan);
}
}
@@ -879,7 +879,7 @@ static void check_active(struct ioatdma_chan *ioat_chan)
}
if (test_and_clear_bit(IOAT_CHAN_ACTIVE, &ioat_chan->state))
- mod_timer(&ioat_chan->timer, jiffies + IDLE_TIMEOUT);
+ mod_timer_pending(&ioat_chan->timer, jiffies + IDLE_TIMEOUT);
}
static void ioat_reboot_chan(struct ioatdma_chan *ioat_chan)
--
2.35.1
From: Zheng Yongjun <[email protected]>
[ Upstream commit ec3f06b542a960806a81345042e4eee3f8c5dec4 ]
Should check of_iomap return value 'fep->fec.fecp' instead of 'fep->fcc.fccp'
Fixes: 976de6a8c304 ("fs_enet: Be an of_platform device when CONFIG_PPC_CPM_NEW_BINDING is set.")
Signed-off-by: Zheng Yongjun <[email protected]>
Reviewed-by: Christophe Leroy <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/net/ethernet/freescale/fs_enet/mac-fec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/freescale/fs_enet/mac-fec.c b/drivers/net/ethernet/freescale/fs_enet/mac-fec.c
index 99fe2c210d0f..61f4b6e50d29 100644
--- a/drivers/net/ethernet/freescale/fs_enet/mac-fec.c
+++ b/drivers/net/ethernet/freescale/fs_enet/mac-fec.c
@@ -98,7 +98,7 @@ static int do_pd_setup(struct fs_enet_private *fep)
return -EINVAL;
fep->fec.fecp = of_iomap(ofdev->dev.of_node, 0);
- if (!fep->fcc.fccp)
+ if (!fep->fec.fecp)
return -EINVAL;
return 0;
--
2.35.1
From: Randy Dunlap <[email protected]>
[ Upstream commit eb7de496451bd969e203f02f66585131228ba4ae ]
drm_mipi_dbi needs lots of DRM_KMS_HELPER support, so select
that Kconfig symbol like it is done is most other uses, and
the way that it was before MIPS_DBI was moved from tinydrm
to its core location.
Fixes these build errors:
ld: drivers/gpu/drm/drm_mipi_dbi.o: in function `mipi_dbi_buf_copy':
drivers/gpu/drm/drm_mipi_dbi.c:205: undefined reference to `drm_gem_fb_get_obj'
ld: drivers/gpu/drm/drm_mipi_dbi.c:211: undefined reference to `drm_gem_fb_begin_cpu_access'
ld: drivers/gpu/drm/drm_mipi_dbi.c:215: undefined reference to `drm_gem_fb_vmap'
ld: drivers/gpu/drm/drm_mipi_dbi.c:222: undefined reference to `drm_fb_swab'
ld: drivers/gpu/drm/drm_mipi_dbi.c:224: undefined reference to `drm_fb_memcpy'
ld: drivers/gpu/drm/drm_mipi_dbi.c:227: undefined reference to `drm_fb_xrgb8888_to_rgb565'
ld: drivers/gpu/drm/drm_mipi_dbi.c:235: undefined reference to `drm_gem_fb_vunmap'
ld: drivers/gpu/drm/drm_mipi_dbi.c:237: undefined reference to `drm_gem_fb_end_cpu_access'
ld: drivers/gpu/drm/drm_mipi_dbi.o: in function `mipi_dbi_dev_init_with_formats':
ld: drivers/gpu/drm/drm_mipi_dbi.o:/X64/../drivers/gpu/drm/drm_mipi_dbi.c:469: undefined reference to `drm_gem_fb_create_with_dirty'
Fixes: 174102f4de23 ("drm/tinydrm: Move mipi-dbi")
Signed-off-by: Randy Dunlap <[email protected]>
Reported-by: kernel test robot <[email protected]>
Cc: Dillon Min <[email protected]>
Cc: Linus Walleij <[email protected]>
Cc: Sam Ravnborg <[email protected]>
Cc: Noralf Trønnes <[email protected]>
Cc: Thomas Zimmermann <[email protected]>
Cc: Thierry Reding <[email protected]>
Cc: [email protected]
Cc: David Airlie <[email protected]>
Cc: Daniel Vetter <[email protected]>
Signed-off-by: Linus Walleij <[email protected]>
Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/gpu/drm/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/Kconfig b/drivers/gpu/drm/Kconfig
index ca868271f4c4..4e9b3a95fa7c 100644
--- a/drivers/gpu/drm/Kconfig
+++ b/drivers/gpu/drm/Kconfig
@@ -30,6 +30,7 @@ menuconfig DRM
config DRM_MIPI_DBI
tristate
depends on DRM
+ select DRM_KMS_HELPER
config DRM_MIPI_DSI
bool
--
2.35.1
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 7538f80ae0d98bf51eb89eee5344aec219902d42 ]
Remove loops over hw_vbif. Instead always VBIF's idx as an index in the
array. This fixes an error in dpu_kms_hw_init(), where we fill
dpu_kms->hw_vbif[i], but check for an error pointer at
dpu_kms->hw_vbif[vbif_idx].
Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support")
Signed-off-by: Dmitry Baryshkov <[email protected]>
Reviewed-by: Abhinav Kumar <[email protected]>
Patchwork: https://patchwork.freedesktop.org/patch/489569/
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Dmitry Baryshkov <[email protected]>
Signed-off-by: Rob Clark <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 12 ++++------
drivers/gpu/drm/msm/disp/dpu1/dpu_vbif.c | 29 +++++++++++-------------
2 files changed, 18 insertions(+), 23 deletions(-)
diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c
index 7503f093f3b6..b7841f7fc10a 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c
@@ -675,12 +675,10 @@ static void _dpu_kms_hw_destroy(struct dpu_kms *dpu_kms)
_dpu_kms_mmu_destroy(dpu_kms);
if (dpu_kms->catalog) {
- for (i = 0; i < dpu_kms->catalog->vbif_count; i++) {
- u32 vbif_idx = dpu_kms->catalog->vbif[i].id;
-
- if ((vbif_idx < VBIF_MAX) && dpu_kms->hw_vbif[vbif_idx]) {
- dpu_hw_vbif_destroy(dpu_kms->hw_vbif[vbif_idx]);
- dpu_kms->hw_vbif[vbif_idx] = NULL;
+ for (i = 0; i < ARRAY_SIZE(dpu_kms->hw_vbif); i++) {
+ if (dpu_kms->hw_vbif[i]) {
+ dpu_hw_vbif_destroy(dpu_kms->hw_vbif[i]);
+ dpu_kms->hw_vbif[i] = NULL;
}
}
}
@@ -987,7 +985,7 @@ static int dpu_kms_hw_init(struct msm_kms *kms)
for (i = 0; i < dpu_kms->catalog->vbif_count; i++) {
u32 vbif_idx = dpu_kms->catalog->vbif[i].id;
- dpu_kms->hw_vbif[i] = dpu_hw_vbif_init(vbif_idx,
+ dpu_kms->hw_vbif[vbif_idx] = dpu_hw_vbif_init(vbif_idx,
dpu_kms->vbif[vbif_idx], dpu_kms->catalog);
if (IS_ERR_OR_NULL(dpu_kms->hw_vbif[vbif_idx])) {
rc = PTR_ERR(dpu_kms->hw_vbif[vbif_idx]);
diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_vbif.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_vbif.c
index 5e8c3f3e6625..fc86d34aec80 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_vbif.c
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_vbif.c
@@ -11,6 +11,14 @@
#include "dpu_hw_vbif.h"
#include "dpu_trace.h"
+static struct dpu_hw_vbif *dpu_get_vbif(struct dpu_kms *dpu_kms, enum dpu_vbif vbif_idx)
+{
+ if (vbif_idx < ARRAY_SIZE(dpu_kms->hw_vbif))
+ return dpu_kms->hw_vbif[vbif_idx];
+
+ return NULL;
+}
+
/**
* _dpu_vbif_wait_for_xin_halt - wait for the xin to halt
* @vbif: Pointer to hardware vbif driver
@@ -148,20 +156,15 @@ static u32 _dpu_vbif_get_ot_limit(struct dpu_hw_vbif *vbif,
void dpu_vbif_set_ot_limit(struct dpu_kms *dpu_kms,
struct dpu_vbif_set_ot_params *params)
{
- struct dpu_hw_vbif *vbif = NULL;
+ struct dpu_hw_vbif *vbif;
struct dpu_hw_mdp *mdp;
bool forced_on = false;
u32 ot_lim;
- int ret, i;
+ int ret;
mdp = dpu_kms->hw_mdp;
- for (i = 0; i < ARRAY_SIZE(dpu_kms->hw_vbif); i++) {
- if (dpu_kms->hw_vbif[i] &&
- dpu_kms->hw_vbif[i]->idx == params->vbif_idx)
- vbif = dpu_kms->hw_vbif[i];
- }
-
+ vbif = dpu_get_vbif(dpu_kms, params->vbif_idx);
if (!vbif || !mdp) {
DPU_DEBUG("invalid arguments vbif %d mdp %d\n",
vbif != NULL, mdp != NULL);
@@ -204,7 +207,7 @@ void dpu_vbif_set_ot_limit(struct dpu_kms *dpu_kms,
void dpu_vbif_set_qos_remap(struct dpu_kms *dpu_kms,
struct dpu_vbif_set_qos_params *params)
{
- struct dpu_hw_vbif *vbif = NULL;
+ struct dpu_hw_vbif *vbif;
struct dpu_hw_mdp *mdp;
bool forced_on = false;
const struct dpu_vbif_qos_tbl *qos_tbl;
@@ -216,13 +219,7 @@ void dpu_vbif_set_qos_remap(struct dpu_kms *dpu_kms,
}
mdp = dpu_kms->hw_mdp;
- for (i = 0; i < ARRAY_SIZE(dpu_kms->hw_vbif); i++) {
- if (dpu_kms->hw_vbif[i] &&
- dpu_kms->hw_vbif[i]->idx == params->vbif_idx) {
- vbif = dpu_kms->hw_vbif[i];
- break;
- }
- }
+ vbif = dpu_get_vbif(dpu_kms, params->vbif_idx);
if (!vbif || !vbif->cap) {
DPU_ERROR("invalid vbif %d\n", params->vbif_idx);
--
2.35.1
From: Zhang Qilong <[email protected]>
[ Upstream commit 41a736ac20602f64773e80f0f5b32cde1830a44a ]
The pm_runtime_enable will increase power disable depth. Thus
a pairing decrement is needed on the error handling path to
keep it balanced according to context. We fix it by moving
pm_runtime_enable to the endding of wm8997_probe
Fixes:40843aea5a9bd ("ASoC: wm8997: Initial CODEC driver")
Signed-off-by: Zhang Qilong <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Mark Brown <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
sound/soc/codecs/wm8997.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/sound/soc/codecs/wm8997.c b/sound/soc/codecs/wm8997.c
index 229f2986cd96..07378714b013 100644
--- a/sound/soc/codecs/wm8997.c
+++ b/sound/soc/codecs/wm8997.c
@@ -1156,9 +1156,6 @@ static int wm8997_probe(struct platform_device *pdev)
regmap_update_bits(arizona->regmap, wm8997_digital_vu[i],
WM8997_DIG_VU, WM8997_DIG_VU);
- pm_runtime_enable(&pdev->dev);
- pm_runtime_idle(&pdev->dev);
-
arizona_init_common(arizona);
ret = arizona_init_vol_limit(arizona);
@@ -1177,6 +1174,9 @@ static int wm8997_probe(struct platform_device *pdev)
goto err_spk_irqs;
}
+ pm_runtime_enable(&pdev->dev);
+ pm_runtime_idle(&pdev->dev);
+
return ret;
err_spk_irqs:
--
2.35.1
From: Hyunwoo Kim <[email protected]>
[ Upstream commit cacdb14b1c8d3804a3a7d31773bc7569837b71a4 ]
roccat_report_event() is responsible for registering
roccat-related reports in struct roccat_device.
int roccat_report_event(int minor, u8 const *data)
{
struct roccat_device *device;
struct roccat_reader *reader;
struct roccat_report *report;
uint8_t *new_value;
device = devices[minor];
new_value = kmemdup(data, device->report_size, GFP_ATOMIC);
if (!new_value)
return -ENOMEM;
report = &device->cbuf[device->cbuf_end];
/* passing NULL is safe */
kfree(report->value);
...
The registered report is stored in the struct roccat_device member
"struct roccat_report cbuf[ROCCAT_CBUF_SIZE];".
If more reports are received than the "ROCCAT_CBUF_SIZE" value,
kfree() the saved report from cbuf[0] and allocates a new reprot.
Since there is no lock when this kfree() is performed,
kfree() can be performed even while reading the saved report.
static ssize_t roccat_read(struct file *file, char __user *buffer,
size_t count, loff_t *ppos)
{
struct roccat_reader *reader = file->private_data;
struct roccat_device *device = reader->device;
struct roccat_report *report;
ssize_t retval = 0, len;
DECLARE_WAITQUEUE(wait, current);
mutex_lock(&device->cbuf_lock);
...
report = &device->cbuf[reader->cbuf_start];
/*
* If report is larger than requested amount of data, rest of report
* is lost!
*/
len = device->report_size > count ? count : device->report_size;
if (copy_to_user(buffer, report->value, len)) {
retval = -EFAULT;
goto exit_unlock;
}
...
The roccat_read() function receives the device->cbuf report and
delivers it to the user through copy_to_user().
If the N+ROCCAT_CBUF_SIZE th report is received while copying of
the Nth report->value is in progress, the pointer that copy_to_user()
is working on is kfree()ed and UAF read may occur. (race condition)
Since the device node of this driver does not set separate permissions,
this is not a security vulnerability, but because it is used for
requesting screen display of profile or dpi settings,
a user using the roccat device can apply udev to this device node or
There is a possibility to use it by giving.
Signed-off-by: Hyunwoo Kim <[email protected]>
Signed-off-by: Jiri Kosina <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/hid/hid-roccat.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/hid/hid-roccat.c b/drivers/hid/hid-roccat.c
index 26373b82fe81..6da80e442fdd 100644
--- a/drivers/hid/hid-roccat.c
+++ b/drivers/hid/hid-roccat.c
@@ -257,6 +257,8 @@ int roccat_report_event(int minor, u8 const *data)
if (!new_value)
return -ENOMEM;
+ mutex_lock(&device->cbuf_lock);
+
report = &device->cbuf[device->cbuf_end];
/* passing NULL is safe */
@@ -276,6 +278,8 @@ int roccat_report_event(int minor, u8 const *data)
reader->cbuf_start = (reader->cbuf_start + 1) % ROCCAT_CBUF_SIZE;
}
+ mutex_unlock(&device->cbuf_lock);
+
wake_up_interruptible(&device->wait);
return 0;
}
--
2.35.1
From: Tetsuo Handa <[email protected]>
[ Upstream commit 3a4d061c699bd3eedc80dc97a4b2a2e1af83c6f5 ]
syzbot is hitting skb_assert_len() warning at raw_sendmsg() for ieee802154
socket. What commit dc633700f00f726e ("net/af_packet: check len when
min_header_len equals to 0") does also applies to ieee802154 socket.
Link: https://syzkaller.appspot.com/bug?extid=5ea725c25d06fb9114c4
Reported-by: syzbot <[email protected]>
Fixes: fd1894224407c484 ("bpf: Don't redirect packets with invalid pkt_len")
Signed-off-by: Tetsuo Handa <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
net/ieee802154/socket.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/ieee802154/socket.c b/net/ieee802154/socket.c
index 7edec210780a..d4c162d63634 100644
--- a/net/ieee802154/socket.c
+++ b/net/ieee802154/socket.c
@@ -252,6 +252,9 @@ static int raw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
return -EOPNOTSUPP;
}
+ if (!size)
+ return -EINVAL;
+
lock_sock(sk);
if (!sk->sk_bound_dev_if)
dev = dev_getfirstbyhwtype(sock_net(sk), ARPHRD_IEEE802154);
--
2.35.1
Hi!
> This is the start of the stable review cycle for the 5.10.150 release.
> There are 390 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
CIP testing did not find any problems here:
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/tree/linux-5.10.y
Tested-by: Pavel Machek (CIP) <[email protected]>
Best regards,
Pavel
--
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
From: Stefan Wahren <[email protected]>
[ Upstream commit 0b919a3728691c172312dee99ba654055ccd8c84 ]
The return value of bcm2835_clock_rate_from_divisor is always unsigned
and also all caller expect this. So fix the declaration accordingly.
Fixes: 41691b8862e2 ("clk: bcm2835: Add support for programming the audio domain clocks")
Signed-off-by: Stefan Wahren <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Reviewed-by: Ivan T. Ivanov <[email protected]>
Reviewed-by: Florian Fainelli <[email protected]>
Signed-off-by: Stephen Boyd <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/clk/bcm/clk-bcm2835.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c
index 178886823b90..f306b959297d 100644
--- a/drivers/clk/bcm/clk-bcm2835.c
+++ b/drivers/clk/bcm/clk-bcm2835.c
@@ -968,9 +968,9 @@ static u32 bcm2835_clock_choose_div(struct clk_hw *hw,
return div;
}
-static long bcm2835_clock_rate_from_divisor(struct bcm2835_clock *clock,
- unsigned long parent_rate,
- u32 div)
+static unsigned long bcm2835_clock_rate_from_divisor(struct bcm2835_clock *clock,
+ unsigned long parent_rate,
+ u32 div)
{
const struct bcm2835_clock_data *data = clock->data;
u64 temp;
--
2.35.1
From: Haibo Chen <[email protected]>
[ Upstream commit e7c4ebe2f9cd68588eb24ba4ed122e696e2d5272 ]
Use the general touchscreen method to config the max pressure for
touch tsc2046(data sheet suggest 8 bit pressure), otherwise, for
ABS_PRESSURE, when config the same max and min value, weston will
meet the following issue,
[17:19:39.183] event1 - ADS7846 Touchscreen: is tagged by udev as: Touchscreen
[17:19:39.183] event1 - ADS7846 Touchscreen: kernel bug: device has min == max on ABS_PRESSURE
[17:19:39.183] event1 - ADS7846 Touchscreen: was rejected
[17:19:39.183] event1 - not using input device '/dev/input/event1'
This will then cause the APP weston-touch-calibrator can't list touch devices.
root@imx6ul7d:~# weston-touch-calibrator
could not load cursor 'dnd-move'
could not load cursor 'dnd-copy'
could not load cursor 'dnd-none'
No devices listed.
And accroding to binding Doc, "ti,x-max", "ti,y-max", "ti,pressure-max"
belong to the deprecated properties, so remove them. Also for "ti,x-min",
"ti,y-min", "ti,x-plate-ohms", the value set in dts equal to the default
value in driver, so are redundant, also remove here.
Signed-off-by: Haibo Chen <[email protected]>
Signed-off-by: Shawn Guo <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
arch/arm/boot/dts/imx7d-sdb.dts | 7 +------
1 file changed, 1 insertion(+), 6 deletions(-)
diff --git a/arch/arm/boot/dts/imx7d-sdb.dts b/arch/arm/boot/dts/imx7d-sdb.dts
index 6823b9f1a2a3..6d562ebe9029 100644
--- a/arch/arm/boot/dts/imx7d-sdb.dts
+++ b/arch/arm/boot/dts/imx7d-sdb.dts
@@ -199,12 +199,7 @@
interrupt-parent = <&gpio2>;
interrupts = <29 0>;
pendown-gpio = <&gpio2 29 GPIO_ACTIVE_HIGH>;
- ti,x-min = /bits/ 16 <0>;
- ti,x-max = /bits/ 16 <0>;
- ti,y-min = /bits/ 16 <0>;
- ti,y-max = /bits/ 16 <0>;
- ti,pressure-max = /bits/ 16 <0>;
- ti,x-plate-ohms = /bits/ 16 <400>;
+ touchscreen-max-pressure = <255>;
wakeup-source;
};
};
--
2.35.1
From: Zhang Xiaoxu <[email protected]>
commit e98ecc6e94f4e6d21c06660b0f336df02836694f upstream.
Commit d5c7076b772a ("smb3: add smb3.1.1 to default dialect list")
extend the dialects from 3 to 4, but forget to decrease the extended
length when specific the dialect, then the message length is larger
than expected.
This maybe leak some info through network because not initialize the
message body.
After apply this patch, the VALIDATE_NEGOTIATE_INFO message length is
reduced from 28 bytes to 26 bytes.
Fixes: d5c7076b772a ("smb3: add smb3.1.1 to default dialect list")
Signed-off-by: Zhang Xiaoxu <[email protected]>
Cc: <[email protected]>
Acked-by: Paulo Alcantara (SUSE) <[email protected]>
Reviewed-by: Tom Talpey <[email protected]>
Signed-off-by: Steve French <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
fs/cifs/smb2pdu.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -1075,9 +1075,9 @@ int smb3_validate_negotiate(const unsign
pneg_inbuf->Dialects[0] =
cpu_to_le16(server->vals->protocol_id);
pneg_inbuf->DialectCount = cpu_to_le16(1);
- /* structure is big enough for 3 dialects, sending only 1 */
+ /* structure is big enough for 4 dialects, sending only 1 */
inbuflen = sizeof(*pneg_inbuf) -
- sizeof(pneg_inbuf->Dialects[0]) * 2;
+ sizeof(pneg_inbuf->Dialects[0]) * 3;
}
rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID,
From: Rafael J. Wysocki <[email protected]>
commit 4bb7f6c2781e46fc5bd00475a66df2ea30ef330d upstream.
Commit 68b99e94a4a2 ("thermal: intel_powerclamp: Use get_cpu() instead
of smp_processor_id() to avoid crash") fixed an issue related to using
smp_processor_id() in preemptible context by replacing it with a pair
of get_cpu()/put_cpu(), but what is needed there really is any online
CPU and not necessarily the one currently running the code. Arguably,
getting the one that's running the code in there is confusing.
For this reason, simply give the control CPU role to the first online
one which automatically will be CPU0 if it is online, so one check
can be dropped from the code for an added benefit.
Link: https://lore.kernel.org/linux-pm/[email protected]/
Fixes: 68b99e94a4a2 ("thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash")
Signed-off-by: Rafael J. Wysocki <[email protected]>
Reviewed-by: Chen Yu <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/thermal/intel/intel_powerclamp.c | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
--- a/drivers/thermal/intel/intel_powerclamp.c
+++ b/drivers/thermal/intel/intel_powerclamp.c
@@ -531,11 +531,7 @@ static int start_power_clamp(void)
get_online_cpus();
/* prefer BSP */
- control_cpu = 0;
- if (!cpu_online(control_cpu)) {
- control_cpu = get_cpu();
- put_cpu();
- }
+ control_cpu = cpumask_first(cpu_online_mask);
clamping = true;
schedule_delayed_work(&poll_pkg_cstate_work, 0);
From: Anssi Hannula <[email protected]>
commit 1499ecaea9d2ba68d5e18d80573b4561a8dc4ee7 upstream.
For command events read from the device,
kvaser_usb_leaf_read_bulk_callback() verifies that cmd->len does not
exceed the size of the received data, but the actual kvaser_cmd handlers
will happily read any kvaser_cmd fields without checking for cmd->len.
This can cause an overread if the last cmd in the buffer is shorter than
expected for the command type (with cmd->len showing the actual short
size).
Maximum overread seems to be 22 bytes (CMD_LEAF_LOG_MESSAGE), some of
which are delivered to userspace as-is.
Fix that by verifying the length of command before handling it.
This issue can only occur after RX URBs have been set up, i.e. the
interface has been opened at least once.
Cc: [email protected]
Fixes: 080f40a6fa28 ("can: kvaser_usb: Add support for Kvaser CAN/USB devices")
Tested-by: Jimmy Assarsson <[email protected]>
Signed-off-by: Anssi Hannula <[email protected]>
Signed-off-by: Jimmy Assarsson <[email protected]>
Link: https://lore.kernel.org/all/[email protected]
Signed-off-by: Marc Kleine-Budde <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 75 +++++++++++++++++++++++
1 file changed, 75 insertions(+)
--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
+++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
@@ -309,6 +309,38 @@ struct kvaser_cmd {
} u;
} __packed;
+#define CMD_SIZE_ANY 0xff
+#define kvaser_fsize(field) sizeof_field(struct kvaser_cmd, field)
+
+static const u8 kvaser_usb_leaf_cmd_sizes_leaf[] = {
+ [CMD_START_CHIP_REPLY] = kvaser_fsize(u.simple),
+ [CMD_STOP_CHIP_REPLY] = kvaser_fsize(u.simple),
+ [CMD_GET_CARD_INFO_REPLY] = kvaser_fsize(u.cardinfo),
+ [CMD_TX_ACKNOWLEDGE] = kvaser_fsize(u.tx_acknowledge_header),
+ [CMD_GET_SOFTWARE_INFO_REPLY] = kvaser_fsize(u.leaf.softinfo),
+ [CMD_RX_STD_MESSAGE] = kvaser_fsize(u.leaf.rx_can),
+ [CMD_RX_EXT_MESSAGE] = kvaser_fsize(u.leaf.rx_can),
+ [CMD_LEAF_LOG_MESSAGE] = kvaser_fsize(u.leaf.log_message),
+ [CMD_CHIP_STATE_EVENT] = kvaser_fsize(u.leaf.chip_state_event),
+ [CMD_CAN_ERROR_EVENT] = kvaser_fsize(u.leaf.error_event),
+ /* ignored events: */
+ [CMD_FLUSH_QUEUE_REPLY] = CMD_SIZE_ANY,
+};
+
+static const u8 kvaser_usb_leaf_cmd_sizes_usbcan[] = {
+ [CMD_START_CHIP_REPLY] = kvaser_fsize(u.simple),
+ [CMD_STOP_CHIP_REPLY] = kvaser_fsize(u.simple),
+ [CMD_GET_CARD_INFO_REPLY] = kvaser_fsize(u.cardinfo),
+ [CMD_TX_ACKNOWLEDGE] = kvaser_fsize(u.tx_acknowledge_header),
+ [CMD_GET_SOFTWARE_INFO_REPLY] = kvaser_fsize(u.usbcan.softinfo),
+ [CMD_RX_STD_MESSAGE] = kvaser_fsize(u.usbcan.rx_can),
+ [CMD_RX_EXT_MESSAGE] = kvaser_fsize(u.usbcan.rx_can),
+ [CMD_CHIP_STATE_EVENT] = kvaser_fsize(u.usbcan.chip_state_event),
+ [CMD_CAN_ERROR_EVENT] = kvaser_fsize(u.usbcan.error_event),
+ /* ignored events: */
+ [CMD_USBCAN_CLOCK_OVERFLOW_EVENT] = CMD_SIZE_ANY,
+};
+
/* Summary of a kvaser error event, for a unified Leaf/Usbcan error
* handling. Some discrepancies between the two families exist:
*
@@ -396,6 +428,43 @@ static const struct kvaser_usb_dev_cfg k
.bittiming_const = &kvaser_usb_flexc_bittiming_const,
};
+static int kvaser_usb_leaf_verify_size(const struct kvaser_usb *dev,
+ const struct kvaser_cmd *cmd)
+{
+ /* buffer size >= cmd->len ensured by caller */
+ u8 min_size = 0;
+
+ switch (dev->driver_info->family) {
+ case KVASER_LEAF:
+ if (cmd->id < ARRAY_SIZE(kvaser_usb_leaf_cmd_sizes_leaf))
+ min_size = kvaser_usb_leaf_cmd_sizes_leaf[cmd->id];
+ break;
+ case KVASER_USBCAN:
+ if (cmd->id < ARRAY_SIZE(kvaser_usb_leaf_cmd_sizes_usbcan))
+ min_size = kvaser_usb_leaf_cmd_sizes_usbcan[cmd->id];
+ break;
+ }
+
+ if (min_size == CMD_SIZE_ANY)
+ return 0;
+
+ if (min_size) {
+ min_size += CMD_HEADER_LEN;
+ if (cmd->len >= min_size)
+ return 0;
+
+ dev_err_ratelimited(&dev->intf->dev,
+ "Received command %u too short (size %u, needed %u)",
+ cmd->id, cmd->len, min_size);
+ return -EIO;
+ }
+
+ dev_warn_ratelimited(&dev->intf->dev,
+ "Unhandled command (%d, size %d)\n",
+ cmd->id, cmd->len);
+ return -EINVAL;
+}
+
static void *
kvaser_usb_leaf_frame_to_cmd(const struct kvaser_usb_net_priv *priv,
const struct sk_buff *skb, int *frame_len,
@@ -503,6 +572,9 @@ static int kvaser_usb_leaf_wait_cmd(cons
end:
kfree(buf);
+ if (err == 0)
+ err = kvaser_usb_leaf_verify_size(dev, cmd);
+
return err;
}
@@ -1137,6 +1209,9 @@ static void kvaser_usb_leaf_stop_chip_re
static void kvaser_usb_leaf_handle_command(const struct kvaser_usb *dev,
const struct kvaser_cmd *cmd)
{
+ if (kvaser_usb_leaf_verify_size(dev, cmd) < 0)
+ return;
+
switch (cmd->id) {
case CMD_START_CHIP_REPLY:
kvaser_usb_leaf_start_chip_reply(dev, cmd);
From: Uwe Kleine-König <[email protected]>
commit 7f4f1096d5921f5d90547596f9ce80e0b924f887 upstream.
After the result of the previous conversion is read the chip
automatically starts a new conversion and doesn't accept new i2c
transfers until this conversion is completed which makes the function
return failure.
So add an early return iff the programming of the new address isn't
needed. Note this will not fix the problem in general, but all cases
that are currently used. Once this changes we get the failure back, but
this can be addressed when the need arises.
Fixes: 69548b7c2c4f ("iio: adc: ltc2497: split protocol independent part in a separate module ")
Reported-by: Meng Li <[email protected]>
Signed-off-by: Uwe Kleine-König <[email protected]>
Tested-by: Denys Zagorui <[email protected]>
Cc: <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Jonathan Cameron <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/iio/adc/ltc2497.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
--- a/drivers/iio/adc/ltc2497.c
+++ b/drivers/iio/adc/ltc2497.c
@@ -41,6 +41,19 @@ static int ltc2497_result_and_measure(st
}
*val = (be32_to_cpu(st->buf) >> 14) - (1 << 17);
+
+ /*
+ * The part started a new conversion at the end of the above i2c
+ * transfer, so if the address didn't change since the last call
+ * everything is fine and we can return early.
+ * If not (which should only happen when some sort of bulk
+ * conversion is implemented) we have to program the new
+ * address. Note that this probably fails as the conversion that
+ * was triggered above is like not complete yet and the two
+ * operations have to be done in a single transfer.
+ */
+ if (ddata->addr_prev == address)
+ return 0;
}
ret = i2c_smbus_write_byte(st->client,
From: Andrew Bresticker <[email protected]>
commit 9e2e6042a7ec6504fe8e366717afa2f40cf16488 upstream.
Commit 2139619bcad7 ("riscv: mmap with PROT_WRITE but no PROT_READ is
invalid") made mmap() return EINVAL if PROT_WRITE was set wihtout
PROT_READ with the justification that a write-only PTE is considered a
reserved PTE permission bit pattern in the privileged spec. This check
is unnecessary since we let VM_WRITE imply VM_READ on RISC-V, and it is
inconsistent with other architectures that don't support write-only PTEs,
creating a potential software portability issue. Just remove the check
altogether and let PROT_WRITE imply PROT_READ as is the case on other
architectures.
Note that this also allows PROT_WRITE|PROT_EXEC mappings which were
disallowed prior to the aforementioned commit; PROT_READ is implied in
such mappings as well.
Fixes: 2139619bcad7 ("riscv: mmap with PROT_WRITE but no PROT_READ is invalid")
Reviewed-by: Atish Patra <[email protected]>
Signed-off-by: Andrew Bresticker <[email protected]>
Cc: [email protected]
Link: https://lore.kernel.org/r/[email protected]/
Signed-off-by: Palmer Dabbelt <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
arch/riscv/kernel/sys_riscv.c | 3 ---
1 file changed, 3 deletions(-)
--- a/arch/riscv/kernel/sys_riscv.c
+++ b/arch/riscv/kernel/sys_riscv.c
@@ -18,9 +18,6 @@ static long riscv_sys_mmap(unsigned long
if (unlikely(offset & (~PAGE_MASK >> page_shift_offset)))
return -EINVAL;
- if (unlikely((prot & PROT_WRITE) && !(prot & PROT_READ)))
- return -EINVAL;
-
return ksys_mmap_pgoff(addr, len, prot, flags, fd,
offset >> (PAGE_SHIFT - page_shift_offset));
}
On 10/24/22 7:26 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.10.150 release.
> There are 390 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 26 Oct 2022 11:29:24 +0000.
> Anything received after that time might be too late.
5.10.150-rc1 compiled and booted on my x86_64 test system. No errors or
regressions.
Tested-by: Slade Watkins <[email protected]>
All the best,
-srw
On Mon, Oct 24, 2022 at 01:26:37PM +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.10.150 release.
> There are 390 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 26 Oct 2022 11:29:24 +0000.
> Anything received after that time might be too late.
>
Build results:
total: 163 pass: 163 fail: 0
Qemu test results:
total: 475 pass: 475 fail: 0
Tested-by: Guenter Roeck <[email protected]>
Guenter
On Mon, 24 Oct 2022 at 17:46, Greg Kroah-Hartman
<[email protected]> wrote:
>
> This is the start of the stable review cycle for the 5.10.150 release.
> There are 390 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 26 Oct 2022 11:29:24 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.150-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
Results from Linaro's test farm.
No regressions on arm64, arm, x86_64, and i386.
Tested-by: Linux Kernel Functional Testing <[email protected]>
## Build
* kernel: 5.10.150-rc1
* git: https://gitlab.com/Linaro/lkft/mirrors/stable/linux-stable-rc
* git branch: linux-5.10.y
* git commit: b4f4370de958b2655d6a93d4fc386eed8fe36cd6
* git describe: v5.10.149-391-gb4f4370de958
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-5.10.y/build/v5.10.149-391-gb4f4370de958
## No Test Regressions (compared to v5.10.149)
## No Metric Regressions (compared to v5.10.149)
## No Test Fixes (compared to v5.10.149)
## No Metric Fixes (compared to v5.10.149)
## Test result summary
total: 127551, pass: 110248, fail: 1637, skip: 15380, xfail: 286
## Build Summary
* arc: 10 total, 10 passed, 0 failed
* arm: 333 total, 333 passed, 0 failed
* arm64: 65 total, 63 passed, 2 failed
* i386: 55 total, 53 passed, 2 failed
* mips: 56 total, 56 passed, 0 failed
* parisc: 12 total, 12 passed, 0 failed
* powerpc: 60 total, 55 passed, 5 failed
* riscv: 27 total, 27 passed, 0 failed
* s390: 24 total, 24 passed, 0 failed
* sh: 24 total, 24 passed, 0 failed
* sparc: 12 total, 12 passed, 0 failed
* x86_64: 58 total, 56 passed, 2 failed
## Test suites summary
* fwts
* igt-gpu-tools
* kselftest-android
* kselftest-arm64
* kselftest-arm64/arm64.btitest.bti_c_func
* kselftest-arm64/arm64.btitest.bti_j_func
* kselftest-arm64/arm64.btitest.bti_jc_func
* kselftest-arm64/arm64.btitest.bti_none_func
* kselftest-arm64/arm64.btitest.nohint_func
* kselftest-arm64/arm64.btitest.paciasp_func
* kselftest-arm64/arm64.nobtitest.bti_c_func
* kselftest-arm64/arm64.nobtitest.bti_j_func
* kselftest-arm64/arm64.nobtitest.bti_jc_func
* kselftest-arm64/arm64.nobtitest.bti_none_func
* kselftest-arm64/arm64.nobtitest.nohint_func
* kselftest-arm64/arm64.nobtitest.paciasp_func
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-drivers-dma-buf
* kselftest-efivarfs
* kselftest-filesystems
* kselftest-filesystems-binderfs
* kselftest-firmware
* kselftest-fpu
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-ir
* kselftest-kcmp
* kselftest-kexec
* kselftest-kvm
* kselftest-lib
* kselftest-livepatch
* kselftest-membarrier
* kselftest-memfd
* kselftest-memory-hotplug
* kselftest-mincore
* kselftest-mount
* kselftest-mqueue
* kselftest-net
* kselftest-net-forwarding
* kselftest-netfilter
* kselftest-nsfs
* kselftest-openat2
* kselftest-pid_namespace
* kselftest-pidfd
* kselftest-proc
* kselftest-pstore
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-tc-testing
* kselftest-timens
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user
* kselftest-vm
* kselftest-x86
* kselftest-zram
* kunit
* kvm-unit-tests
* libgpiod
* libhugetlbfs
* log-parser-boot
* log-parser-test
* ltp-cap_bounds
* ltp-commands
* ltp-containers
* ltp-controllers
* ltp-cpuhotplug
* ltp-crypto
* ltp-cve
* ltp-dio
* ltp-fcntl-locktests
* ltp-filecaps
* ltp-fs
* ltp-fs_bind
* ltp-fs_perms_simple
* ltp-fsx
* ltp-hugetlb
* ltp-io
* ltp-ipc
* ltp-math
* ltp-mm
* ltp-nptl
* ltp-open-posix-tests
* ltp-pty
* ltp-sched
* ltp-securebits
* ltp-smoke
* ltp-syscalls
* ltp-tracing
* network-basic-tests
* perf
* perf/Zstd-perf.data-compression
* rcutorture
* v4l2-compliance
* vdso
--
Linaro LKFT
https://lkft.linaro.org