2022-02-14 21:04:09

by Greg KH

[permalink] [raw]
Subject: [PATCH 5.15 000/172] 5.15.24-rc1 review

This is the start of the stable review cycle for the 5.15.24 release.
There are 172 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.

Responses should be made by Wed, 16 Feb 2022 09:24:36 +0000.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.24-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>
Linux 5.15.24-rc1

Vijayanand Jitta <[email protected]>
iommu: Fix potential use-after-free during probe

Song Liu <[email protected]>
perf: Fix list corruption in perf_cgroup_switch()

Alexander Stein <[email protected]>
arm64: dts: imx8mq: fix lcdif port node

Thomas Bogendoerfer <[email protected]>
MIPS: octeon: Fix missed PTR->PTR_WD conversion

James Smart <[email protected]>
scsi: lpfc: Reduce log messages seen after firmware download

James Smart <[email protected]>
scsi: lpfc: Remove NVMe support if kernel has NVME_FC disabled

Nathan Chancellor <[email protected]>
Makefile.extrawarn: Move -Wunaligned-access to W=1

Tadeusz Struk <[email protected]>
sched/fair: Fix fault in reweight_entity

Reinette Chatre <[email protected]>
x86/sgx: Silence softlockup detection when releasing large enclaves

Armin Wolf <[email protected]>
hwmon: (dell-smm) Speed up setting of fan speed

Slark Xiao <[email protected]>
bus: mhi: pci_generic: Add mru_default for Cinterion MV31-W

Slark Xiao <[email protected]>
bus: mhi: pci_generic: Add mru_default for Foxconn SDX55

Vineeth Vijayan <[email protected]>
s390/cio: verify the driver availability for path_event call

Kees Cook <[email protected]>
signal: HANDLER_EXIT should clear SIGNAL_UNKILLABLE

Kees Cook <[email protected]>
seccomp: Invalidate seccomp mode to catch death failures

Roman Gushchin <[email protected]>
mm: memcg: synchronize objcg lists with a dedicated spinlock

Mathias Krause <[email protected]>
iio: buffer: Fix file related error handling in IIO_BUFFER_GET_FD_IOCTL

Kishon Vijay Abraham I <[email protected]>
phy: ti: Fix missing sentinel for clk_div_table

Samuel Thibault <[email protected]>
speakup-dectlk: Restore pitch setting

Johan Hovold <[email protected]>
USB: serial: cp210x: add CPI Bulk Coin Recycler id

Johan Hovold <[email protected]>
USB: serial: cp210x: add NCR Retail IO box id

Stephan Brunner <[email protected]>
USB: serial: ch341: add support for GW Instek USB2.0-Serial devices

Pawel Dembicki <[email protected]>
USB: serial: option: add ZTE MF286D modem

Cameron Williams <[email protected]>
USB: serial: ftdi_sio: add support for Brainboxes US-159/235/320

Jann Horn <[email protected]>
usb: raw-gadget: fix handling of dual-direction-capable endpoints

Pavel Hofman <[email protected]>
usb: gadget: f_uac2: Define specific wTerminalType

Greg Kroah-Hartman <[email protected]>
usb: gadget: rndis: check size of RNDIS_MSG_SET command

Szymon Heidrich <[email protected]>
USB: gadget: validate interface OS descriptor requests

Adam Ford <[email protected]>
usb: gadget: udc: renesas_usb3: Fix host to USB_ROLE_NONE transition

Udipto Goswami <[email protected]>
usb: dwc3: gadget: Prevent core from processing stale TRBs

Sean Anderson <[email protected]>
usb: ulpi: Call of_node_put correctly

Sean Anderson <[email protected]>
usb: ulpi: Move of_node_put to ulpi_dev_release

Jann Horn <[email protected]>
net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup

Greg Kroah-Hartman <[email protected]>
Revert "usb: dwc2: drd: fix soft connect when gadget is unconfigured"

Fabrice Gasnier <[email protected]>
usb: dwc2: drd: fix soft connect when gadget is unconfigured

Jonas Malaco <[email protected]>
eeprom: ee1004: limit i2c reads to I2C_SMBUS_BLOCK_MAX

TATSUKAWA KOSUKE (立川 江介) <[email protected]>
n_tty: wake up poll(POLLRDNORM) on receiving data

Jakob Koschel <[email protected]>
vt_ioctl: add array_index_nospec to VT_ACTIVATE

Jakob Koschel <[email protected]>
vt_ioctl: fix array_index_nospec in vt_setactivate

Vladimir Oltean <[email protected]>
net: dsa: mv88e6xxx: fix use-after-free in mv88e6xxx_mdios_unregister

Colin Foster <[email protected]>
net: mscc: ocelot: fix mutex lock error during ethtool stats read

Dave Ertman <[email protected]>
ice: Avoid RTNL lock when re-creating auxiliary device

Dave Ertman <[email protected]>
ice: Fix KASAN error in LAG NETDEV_UNREGISTER handler

Jesse Brandeburg <[email protected]>
ice: fix IPIP and SIT TSO offload

Dan Carpenter <[email protected]>
ice: fix an error code in ice_cfg_phy_fec()

Robert-Ionut Alexa <[email protected]>
dpaa2-eth: unregister the netdev before disconnecting from the PHY

Kishen Maloor <[email protected]>
mptcp: netlink: process IPv6 addrs in creating listening sockets

Yang Wang <[email protected]>
drm/amd/pm: fix hwmon node of power1_label create issue

Raju Rangoju <[email protected]>
net: amd-xgbe: disable interrupts during pci removal

Jon Maloy <[email protected]>
tipc: rate limit warning for received illegal binding update

Joel Stanley <[email protected]>
net: mdio: aspeed: Add missing MODULE_DEVICE_TABLE

Eric Dumazet <[email protected]>
veth: fix races around rq->rx_notify_masked

Antoine Tenart <[email protected]>
net: fix a memleak when uncloning an skb dst and its metadata

Antoine Tenart <[email protected]>
net: do not keep the dst cache when uncloning an skb dst and its metadata

Louis Peens <[email protected]>
nfp: flower: fix ida_idx not being released

Eric Dumazet <[email protected]>
ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path

Vladimir Oltean <[email protected]>
net: dsa: lantiq_gswip: don't use devres for mdiobus

Vladimir Oltean <[email protected]>
net: dsa: mt7530: fix kernel bug in mdiobus_free() when unbinding

Vladimir Oltean <[email protected]>
net: dsa: felix: don't use devres for mdiobus

Vladimir Oltean <[email protected]>
net: dsa: bcm_sf2: don't use devres for mdiobus

Vladimir Oltean <[email protected]>
net: dsa: ar9331: register the mdiobus under devres

Vladimir Oltean <[email protected]>
net: dsa: mv88e6xxx: don't use devres for mdiobus

Mahesh Bandewar <[email protected]>
bonding: pair enable_port with slave_arr_updates

Helge Deller <[email protected]>
fbcon: Avoid 'cap' set but not used warning

Niklas Cassel <[email protected]>
gpio: sifive: use the correct register to read output values

Andy Shevchenko <[email protected]>
gpiolib: Never return internal error codes to user space

Rafael J. Wysocki <[email protected]>
ACPI: PM: s2idle: Cancel wakeup before dispatching EC GPE

Christoph Niedermaier <[email protected]>
drm/panel: simple: Assign data from panel_dpi_probe() correctly

Samuel Mendoza-Jonas <[email protected]>
ixgbevf: Require large buffers for build_skb on 82599VF

Lutz Koschorreck <[email protected]>
arm64: dts: meson-sm1-odroid: fix boot loop after reboot

Dongjin Kim <[email protected]>
arm64: dts: meson-sm1-bananapi-m5: fix wrong GPIO domain for GPIOE_2

Lutz Koschorreck <[email protected]>
arm64: dts: meson-sm1-odroid: use correct enable-gpio pin for tf-io regulator

Dongjin Kim <[email protected]>
arm64: dts: meson-g12b-odroid-n2: fix typo 'dio2133'

Florian Westphal <[email protected]>
netfilter: ctnetlink: disable helper autoassign

Steen Hegelund <[email protected]>
net: sparx5: Fix get_stat64 crash in tcpdump

Mathias Krause <[email protected]>
misc: fastrpc: avoid double fput() on failed usercopy

Dave Stevenson <[email protected]>
drm/vc4: hdmi: Allow DBLCLK modes even if horz timing is odd.

[email protected] <[email protected]>
NFS: Don't skip directory entries when doing uncached readdir

[email protected] <[email protected]>
NFS: Don't overfill uncached readdir pages

Geert Uytterhoeven <[email protected]>
gpio: aggregator: Fix calling into sleeping GPIO controllers

Liu Ying <[email protected]>
phy: dphy: Correct clk_pre parameter

Udipto Goswami <[email protected]>
usb: f_fs: Fix use-after-free for epfile

Martin Kepplinger <[email protected]>
arm64: dts: imx8mq: fix mipi_csi bidirectional port numbers

Rob Herring <[email protected]>
ARM: dts: imx7ulp: Fix 'assigned-clocks-parents' typo

Dan Carpenter <[email protected]>
phy: stm32: fix a refcount leak in stm32_usbphyc_pll_enable()

Robert Hancock <[email protected]>
phy: xilinx: zynqmp: Fix bus width setting for SGMII

Fabio Estevam <[email protected]>
ARM: dts: imx6qdl-udoo: Properly describe the SD card detect

Uwe Kleine-König <[email protected]>
staging: fbtft: Fix error path in fbtft_driver_module_init()

Al Cooper <[email protected]>
phy: broadcom: Kconfig: Fix PHY_BRCM_USB config option

Martin Blumenstingl <[email protected]>
ARM: dts: meson8b: Fix the UART device-tree schema validation

Martin Blumenstingl <[email protected]>
ARM: dts: meson8: Fix the UART device-tree schema validation

Martin Blumenstingl <[email protected]>
ARM: dts: meson: Fix the UART compatible strings

Tony Lindgren <[email protected]>
ARM: dts: Fix timer regression for beagleboard revision c

Ville Syrjälä <[email protected]>
drm/i915: Populate pipe dbuf slices more accurately during readout

Ville Syrjälä <[email protected]>
drm/i915: Allow !join_mbus cases for adlp+ dbuf configuration

Brian Norris <[email protected]>
drm/rockchip: vop: Correct RK3399 VOP register fields

Alex Deucher <[email protected]>
drm/amdgpu/display: change pipe policy for DCN 2.0

Rafael J. Wysocki <[email protected]>
PM: s2idle: ACPI: Fix wakeup interrupts handling

Robin Murphy <[email protected]>
ACPI/IORT: Check node revision for PMCG resources

Sagi Grimberg <[email protected]>
nvme-tcp: fix bogus request completion when failing to send AER

Krzysztof Kozlowski <[email protected]>
ARM: socfpga: fix missing RESET_CONTROLLER

Linus Walleij <[email protected]>
ARM: dts: Fix boot regression on Skomer

Fabio Estevam <[email protected]>
ARM: dts: imx23-evk: Remove MX23_PAD_SSP1_DETECT from hog group

Bob Peterson <[email protected]>
gfs2: Fix gfs2_release for non-writers regression

Changbin Du <[email protected]>
riscv: eliminate unreliable __builtin_frame_address(1)

Pingfan Liu <[email protected]>
riscv: cpu-hotplug: clear cpu from numa map when teardown

Aurelien Jarno <[email protected]>
riscv: fix build with binutils 2.38

Jim Mattson <[email protected]>
KVM: x86: Report deprecated x87 features in supported CPUID

Sean Christopherson <[email protected]>
KVM: VMX: Set vmcs.PENDING_DBG.BS on #DB in STI/MOVSS blocking shadow

Sean Christopherson <[email protected]>
KVM: SVM: Don't kill SEV guest if SMAP erratum triggers in usermode

Vitaly Kuznetsov <[email protected]>
KVM: nVMX: Also filter MSR_IA32_VMX_TRUE_PINBASED_CTLS when eVMCS

Vitaly Kuznetsov <[email protected]>
KVM: nVMX: eVMCS: Filter out VM_EXIT_SAVE_VMX_PREEMPTION_TIMER

Hou Wenlong <[email protected]>
KVM: eventfd: Fix false positive RCU usage warning

Jisheng Zhang <[email protected]>
net: stmmac: dwmac-sun8i: use return val of readl_poll_timeout()

Thomas Bogendoerfer <[email protected]>
MIPS: Fix build error due to PTR used in more places

Wu Zheng <[email protected]>
nvme-pci: add the IGNORE_DEV_SUBNQN quirk for Intel P4500/P4600 SSDs

James Clark <[email protected]>
perf: Always wake the parent event

Amelie Delaunay <[email protected]>
usb: dwc2: gadget: don't try to disable ep0 in dwc2_hsotg_suspend

Zhan Liu <[email protected]>
drm/amd/display: Correct MPC split policy for DCN301

Amadeusz Sławiński <[email protected]>
PM: hibernate: Remove register_nosave_region_late()

Jisheng Zhang <[email protected]>
net: stmmac: reduce unnecessary wakeups from eee sw timer

Tong Zhang <[email protected]>
scsi: myrs: Fix crash in error case

Kiwoong Kim <[email protected]>
scsi: ufs: Treat link loss as fatal error

Kiwoong Kim <[email protected]>
scsi: ufs: Use generic error code in ufshcd_set_dev_pwr_mode()

John Garry <[email protected]>
scsi: pm8001: Fix bogus FW crash for maxcpus=1

Saurav Kashyap <[email protected]>
scsi: qedf: Change context reset messages to ratelimited

Saurav Kashyap <[email protected]>
scsi: qedf: Fix refcount issue when LOGO is received during TMF

Saurav Kashyap <[email protected]>
scsi: qedf: Add stag_work to all the vports

Xiaoke Wang <[email protected]>
scsi: ufs: ufshcd-pltfrm: Check the return value of devm_kstrdup()

ZouMingzhe <[email protected]>
scsi: target: iscsi: Make sure the np under each tpg is unique

Christophe Leroy <[email protected]>
powerpc/fixmap: Fix VM debug warning on unmap

Victor Nogueira <[email protected]>
net: sched: Clarify error message when qdisc kind is unknown

Raymond Jay Golo <[email protected]>
drm: panel-orientation-quirks: Add quirk for the 1Netbook OneXPlayer

Padmanabha Srinivasaiah <[email protected]>
drm/vc4: Fix deadlock on DSI device attach error

Peter Zijlstra <[email protected]>
sched: Avoid double preemption in __cond_resched_*lock*()

Andi Kleen <[email protected]>
x86/perf: Avoid warning for Arch LBR without XSAVE

Stephane Eranian <[email protected]>
perf/x86/rapl: fix AMD event handling

Sander Vanheule <[email protected]>
irqchip/realtek-rtl: Service all pending interrupts

Anna Schumaker <[email protected]>
sunrpc: Fix potential race conditions in rpc_sysfs_xprt_state_change()

Xiyu Yang <[email protected]>
net/sunrpc: fix reference count leaks in rpc_sysfs_xprt_state_change

Olga Kornievskaia <[email protected]>
SUNRPC allow for unspecified transport time in rpc_clnt_add_xprt

Olga Kornievskaia <[email protected]>
NFSv4 handle port presence in fs_location server string

Olga Kornievskaia <[email protected]>
NFSv4 expose nfs_parse_server_name function

Olga Kornievskaia <[email protected]>
NFSv4.1 query for fs_location attr on a new file system

Olga Kornievskaia <[email protected]>
NFSv4 store server support for fs_location attribute

Olga Kornievskaia <[email protected]>
NFSv4 remove zero number of fs_locations entries error check

Trond Myklebust <[email protected]>
NFSv4.1: Fix uninitialised variable in devicenotify

Xiaoke Wang <[email protected]>
nfs: nfs4clinet: check the return value of kstrdup()

Olga Kornievskaia <[email protected]>
NFSv4 only print the label when its queried

NeilBrown <[email protected]>
NFS: change nfs_access_get_cached to only report the mask

Tom Zanussi <[email protected]>
tracing: Propagate is_signed to expression

Sumeet Pawnikar <[email protected]>
thermal/drivers/int340x: Fix RFIM mailbox write commands

Arnd Bergmann <[email protected]>
thermal: int340x: Limit Kconfig to 64-bit

Srinivas Pandruvada <[email protected]>
thermal/drivers/int340x: processor_thermal: Suppot 64 bit RFIM responses

Antoine Tenart <[email protected]>
thermal/drivers/int340x: Improve the tcc offset saving for suspend/resume

Chuck Lever <[email protected]>
NFSD: Fix the behavior of READ near OFFSET_MAX

Chuck Lever <[email protected]>
NFSD: Fix offset type in I/O trace points

Chuck Lever <[email protected]>
NFSD: Clamp WRITE offsets

Chuck Lever <[email protected]>
NFSD: Fix ia_size underflow

Chuck Lever <[email protected]>
NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes

Trond Myklebust <[email protected]>
NFS: Fix initialisation of nfs_client cl_flags field

Pavel Parkhomenko <[email protected]>
net: phy: marvell: Fix MDI-x polarity setting in 88e1118-compatible PHYs

Pavel Parkhomenko <[email protected]>
net: phy: marvell: Fix RGMII Tx/Rx delays setting in 88e1121-compatible PHYs

Oliver Hartkopp <[email protected]>
can: isotp: fix error path in isotp_sendmsg() to unlock wait queue

Oliver Hartkopp <[email protected]>
can: isotp: fix potential CAN frame reception race in isotp_rcv()

Andrey Skvortsov <[email protected]>
mmc: core: Wait for command setting 'Power Off Notification' bit to complete

Jiasheng Jiang <[email protected]>
mmc: sdhci-of-esdhc: Check for error num after setting mask

Stefan Berger <[email protected]>
ima: Do not print policy rule with inactive LSM labels

Roberto Sassu <[email protected]>
ima: Allow template selection with ima_template[_fmt]= after ima_hash=

Stefan Berger <[email protected]>
ima: Remove ima_policy file before directory

Eric Biggers <[email protected]>
ima: fix reference leak in asymmetric_verify()

Xiaoke Wang <[email protected]>
integrity: check the return value of audit_log_start()


-------------

Diffstat:

.../devicetree/bindings/arm/omap/omap.txt | 3 +
Makefile | 4 +-
arch/arm/boot/dts/Makefile | 1 +
arch/arm/boot/dts/imx23-evk.dts | 1 -
arch/arm/boot/dts/imx6qdl-udoo.dtsi | 5 +-
arch/arm/boot/dts/imx7ulp.dtsi | 2 +-
arch/arm/boot/dts/meson.dtsi | 8 +-
arch/arm/boot/dts/meson8.dtsi | 24 +--
arch/arm/boot/dts/meson8b.dtsi | 24 +--
arch/arm/boot/dts/omap3-beagle-ab4.dts | 47 ++++++
arch/arm/boot/dts/omap3-beagle.dts | 33 ----
arch/arm/boot/dts/ste-ux500-samsung-skomer.dts | 4 -
arch/arm/mach-socfpga/Kconfig | 2 +
.../boot/dts/amlogic/meson-g12b-odroid-n2.dtsi | 4 +-
.../boot/dts/amlogic/meson-sm1-bananapi-m5.dts | 2 +-
arch/arm64/boot/dts/amlogic/meson-sm1-odroid.dtsi | 2 +-
arch/arm64/boot/dts/freescale/imx8mq.dtsi | 10 +-
arch/mips/cavium-octeon/octeon-memcpy.S | 2 +-
arch/mips/include/asm/asm.h | 4 +-
arch/mips/include/asm/ftrace.h | 4 +-
arch/mips/include/asm/r4kcache.h | 4 +-
arch/mips/include/asm/unaligned-emul.h | 176 ++++++++++-----------
arch/mips/kernel/mips-r2-to-r6-emul.c | 104 ++++++------
arch/mips/kernel/r2300_fpu.S | 6 +-
arch/mips/kernel/r4k_fpu.S | 2 +-
arch/mips/kernel/relocate_kernel.S | 22 +--
arch/mips/kernel/scall32-o32.S | 10 +-
arch/mips/kernel/scall64-n32.S | 2 +-
arch/mips/kernel/scall64-n64.S | 2 +-
arch/mips/kernel/scall64-o32.S | 10 +-
arch/mips/kernel/syscall.c | 8 +-
arch/mips/lib/csum_partial.S | 4 +-
arch/mips/lib/memcpy.S | 4 +-
arch/mips/lib/memset.S | 2 +-
arch/mips/lib/strncpy_user.S | 4 +-
arch/mips/lib/strnlen_user.S | 2 +-
arch/powerpc/include/asm/book3s/32/pgtable.h | 1 +
arch/powerpc/include/asm/book3s/64/pgtable.h | 2 +
arch/powerpc/include/asm/fixmap.h | 6 +-
arch/powerpc/include/asm/nohash/32/pgtable.h | 1 +
arch/powerpc/include/asm/nohash/64/pgtable.h | 1 +
arch/powerpc/mm/pgtable.c | 9 ++
arch/riscv/Makefile | 6 +
arch/riscv/kernel/cpu-hotplug.c | 2 +
arch/riscv/kernel/stacktrace.c | 9 +-
arch/x86/events/intel/lbr.c | 3 +
arch/x86/events/rapl.c | 9 +-
arch/x86/kernel/cpu/sgx/encl.c | 2 +
arch/x86/kvm/cpuid.c | 13 +-
arch/x86/kvm/svm/svm.c | 16 +-
arch/x86/kvm/vmx/evmcs.c | 1 +
arch/x86/kvm/vmx/evmcs.h | 4 +-
arch/x86/kvm/vmx/vmx.c | 25 +++
drivers/accessibility/speakup/speakup_dectlk.c | 1 +
drivers/acpi/arm64/iort.c | 14 +-
drivers/acpi/ec.c | 10 ++
drivers/acpi/sleep.c | 15 +-
drivers/base/power/wakeup.c | 41 ++++-
drivers/bus/mhi/pci_generic.c | 2 +
drivers/clocksource/timer-ti-dm-systimer.c | 2 +-
drivers/gpio/gpio-aggregator.c | 18 ++-
drivers/gpio/gpio-sifive.c | 2 +-
drivers/gpio/gpiolib-cdev.c | 6 +-
drivers/gpio/gpiolib-sysfs.c | 7 +-
drivers/gpio/gpiolib.h | 12 ++
.../gpu/drm/amd/display/dc/dcn20/dcn20_resource.c | 2 +-
.../drm/amd/display/dc/dcn301/dcn301_resource.c | 2 +-
drivers/gpu/drm/amd/pm/amdgpu_pm.c | 3 +-
drivers/gpu/drm/bridge/nwl-dsi.c | 12 +-
drivers/gpu/drm/drm_panel_orientation_quirks.c | 12 ++
drivers/gpu/drm/i915/intel_pm.c | 75 ++++++---
drivers/gpu/drm/panel/panel-simple.c | 1 +
drivers/gpu/drm/rockchip/rockchip_vop_reg.c | 8 +-
drivers/gpu/drm/vc4/vc4_dsi.c | 14 +-
drivers/gpu/drm/vc4/vc4_hdmi.c | 2 +
drivers/hwmon/dell-smm-hwmon.c | 12 +-
drivers/iio/industrialio-buffer.c | 14 +-
drivers/iommu/iommu.c | 9 +-
drivers/irqchip/irq-realtek-rtl.c | 8 +-
drivers/misc/eeprom/ee1004.c | 3 +
drivers/misc/fastrpc.c | 9 +-
drivers/mmc/core/sd.c | 8 +-
drivers/mmc/host/sdhci-of-esdhc.c | 8 +-
drivers/net/bonding/bond_3ad.c | 3 +-
drivers/net/dsa/bcm_sf2.c | 7 +-
drivers/net/dsa/lantiq_gswip.c | 14 +-
drivers/net/dsa/mt7530.c | 2 +-
drivers/net/dsa/mv88e6xxx/chip.c | 15 +-
drivers/net/dsa/ocelot/felix_vsc9959.c | 4 +-
drivers/net/dsa/qca/ar9331.c | 3 +-
drivers/net/ethernet/amd/xgbe/xgbe-pci.c | 3 +
drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 4 +-
drivers/net/ethernet/intel/ice/ice.h | 3 +-
drivers/net/ethernet/intel/ice/ice_common.c | 3 +-
drivers/net/ethernet/intel/ice/ice_lag.c | 34 +++-
drivers/net/ethernet/intel/ice/ice_lan_tx_rx.h | 1 +
drivers/net/ethernet/intel/ice/ice_main.c | 28 +++-
drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c | 13 +-
.../net/ethernet/microchip/sparx5/sparx5_ethtool.c | 2 +-
drivers/net/ethernet/mscc/ocelot.c | 11 +-
.../ethernet/netronome/nfp/flower/tunnel_conf.c | 12 +-
drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c | 2 +-
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 13 +-
drivers/net/mdio/mdio-aspeed.c | 1 +
drivers/net/phy/marvell.c | 17 +-
drivers/net/usb/ax88179_178a.c | 68 ++++----
drivers/net/veth.c | 13 +-
drivers/nvme/host/pci.c | 3 +-
drivers/nvme/host/tcp.c | 10 +-
drivers/phy/amlogic/phy-meson-axg-mipi-dphy.c | 3 +-
drivers/phy/broadcom/Kconfig | 3 +-
drivers/phy/phy-core-mipi-dphy.c | 4 +-
drivers/phy/rockchip/phy-rockchip-inno-dsidphy.c | 3 +-
drivers/phy/st/phy-stm32-usbphyc.c | 2 +-
drivers/phy/ti/phy-j721e-wiz.c | 1 +
drivers/phy/xilinx/phy-zynqmp.c | 11 +-
drivers/s390/cio/device.c | 2 +-
drivers/scsi/lpfc/lpfc.h | 13 +-
drivers/scsi/lpfc/lpfc_attr.c | 4 +-
drivers/scsi/lpfc/lpfc_init.c | 2 +-
drivers/scsi/lpfc/lpfc_sli.c | 8 +-
drivers/scsi/myrs.c | 3 +-
drivers/scsi/pm8001/pm80xx_hwi.c | 16 +-
drivers/scsi/pm8001/pm80xx_hwi.h | 6 +-
drivers/scsi/qedf/qedf_io.c | 1 +
drivers/scsi/qedf/qedf_main.c | 7 +-
drivers/scsi/ufs/ufshcd-pltfrm.c | 7 +
drivers/scsi/ufs/ufshcd.c | 9 +-
drivers/scsi/ufs/ufshci.h | 3 +-
drivers/staging/fbtft/fbtft.h | 5 +-
drivers/target/iscsi/iscsi_target_tpg.c | 3 +
drivers/thermal/intel/int340x_thermal/Kconfig | 4 +-
.../intel/int340x_thermal/int3401_thermal.c | 8 +-
.../int340x_thermal/processor_thermal_device.c | 36 ++++-
.../int340x_thermal/processor_thermal_device.h | 4 +-
.../int340x_thermal/processor_thermal_device_pci.c | 18 ++-
.../processor_thermal_device_pci_legacy.c | 8 +-
.../intel/int340x_thermal/processor_thermal_mbox.c | 104 +++++++-----
.../intel/int340x_thermal/processor_thermal_rfim.c | 23 +--
drivers/tty/n_tty.c | 4 +-
drivers/tty/vt/vt_ioctl.c | 3 +-
drivers/usb/common/ulpi.c | 10 +-
drivers/usb/dwc2/gadget.c | 2 +-
drivers/usb/dwc3/gadget.c | 13 ++
drivers/usb/gadget/composite.c | 3 +
drivers/usb/gadget/function/f_fs.c | 56 +++++--
drivers/usb/gadget/function/f_uac2.c | 4 +-
drivers/usb/gadget/function/rndis.c | 9 +-
drivers/usb/gadget/legacy/raw_gadget.c | 2 +-
drivers/usb/gadget/udc/renesas_usb3.c | 2 +
drivers/usb/serial/ch341.c | 1 +
drivers/usb/serial/cp210x.c | 2 +
drivers/usb/serial/ftdi_sio.c | 3 +
drivers/usb/serial/ftdi_sio_ids.h | 3 +
drivers/usb/serial/option.c | 2 +
drivers/video/fbdev/core/fbcon.c | 7 +-
fs/gfs2/file.c | 7 +-
fs/nfs/callback.h | 2 +-
fs/nfs/callback_proc.c | 2 +-
fs/nfs/callback_xdr.c | 18 +--
fs/nfs/client.c | 9 +-
fs/nfs/dir.c | 24 +--
fs/nfs/nfs4_fs.h | 12 +-
fs/nfs/nfs4client.c | 5 +-
fs/nfs/nfs4namespace.c | 19 ++-
fs/nfs/nfs4proc.c | 96 ++++++++---
fs/nfs/nfs4state.c | 6 +-
fs/nfs/nfs4xdr.c | 9 +-
fs/nfsd/nfs3proc.c | 13 +-
fs/nfsd/nfs3xdr.c | 2 +-
fs/nfsd/nfs4proc.c | 13 +-
fs/nfsd/nfs4xdr.c | 8 +-
fs/nfsd/trace.h | 14 +-
fs/nfsd/vfs.c | 4 +
include/linux/memcontrol.h | 5 +-
include/linux/nfs_fs.h | 4 +-
include/linux/nfs_fs_sb.h | 2 +-
include/linux/nfs_xdr.h | 1 +
include/linux/suspend.h | 15 +-
include/net/dst_metadata.h | 14 +-
include/uapi/linux/netfilter/nf_conntrack_common.h | 2 +-
kernel/events/core.c | 16 +-
kernel/power/main.c | 5 +-
kernel/power/process.c | 2 +-
kernel/power/snapshot.c | 21 +--
kernel/power/suspend.c | 2 -
kernel/sched/core.c | 23 ++-
kernel/seccomp.c | 10 ++
kernel/signal.c | 5 +-
kernel/trace/trace_events_hist.c | 3 +
mm/memcontrol.c | 10 +-
net/can/isotp.c | 29 +++-
net/ipv4/ipmr.c | 2 +
net/ipv6/ip6mr.c | 2 +
net/mptcp/pm_netlink.c | 8 +-
net/netfilter/nf_conntrack_netlink.c | 3 +-
net/sched/sch_api.c | 2 +-
net/sunrpc/clnt.c | 5 +-
net/sunrpc/sysfs.c | 41 ++---
net/tipc/name_distr.c | 2 +-
scripts/Makefile.extrawarn | 1 +
security/integrity/digsig_asymmetric.c | 15 +-
security/integrity/ima/ima_fs.c | 2 +-
security/integrity/ima/ima_policy.c | 8 +
security/integrity/ima/ima_template.c | 10 +-
security/integrity/integrity_audit.c | 2 +
virt/kvm/eventfd.c | 8 +-
207 files changed, 1472 insertions(+), 797 deletions(-)



2022-02-14 21:04:17

by Greg KH

[permalink] [raw]
Subject: [PATCH 5.15 002/172] ima: fix reference leak in asymmetric_verify()

From: Eric Biggers <[email protected]>

commit 926fd9f23b27ca6587492c3f58f4c7f4cd01dad5 upstream.

Don't leak a reference to the key if its algorithm is unknown.

Fixes: 947d70597236 ("ima: Support EC keys for signature verification")
Cc: <[email protected]> # v5.13+
Signed-off-by: Eric Biggers <[email protected]>
Reviewed-by: Stefan Berger <[email protected]>
Reviewed-by: Tianjia Zhang <[email protected]>
Signed-off-by: Mimi Zohar <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
security/integrity/digsig_asymmetric.c | 15 +++++++++------
1 file changed, 9 insertions(+), 6 deletions(-)

--- a/security/integrity/digsig_asymmetric.c
+++ b/security/integrity/digsig_asymmetric.c
@@ -109,22 +109,25 @@ int asymmetric_verify(struct key *keyrin

pk = asymmetric_key_public_key(key);
pks.pkey_algo = pk->pkey_algo;
- if (!strcmp(pk->pkey_algo, "rsa"))
+ if (!strcmp(pk->pkey_algo, "rsa")) {
pks.encoding = "pkcs1";
- else if (!strncmp(pk->pkey_algo, "ecdsa-", 6))
+ } else if (!strncmp(pk->pkey_algo, "ecdsa-", 6)) {
/* edcsa-nist-p192 etc. */
pks.encoding = "x962";
- else if (!strcmp(pk->pkey_algo, "ecrdsa") ||
- !strcmp(pk->pkey_algo, "sm2"))
+ } else if (!strcmp(pk->pkey_algo, "ecrdsa") ||
+ !strcmp(pk->pkey_algo, "sm2")) {
pks.encoding = "raw";
- else
- return -ENOPKG;
+ } else {
+ ret = -ENOPKG;
+ goto out;
+ }

pks.digest = (u8 *)data;
pks.digest_size = datalen;
pks.s = hdr->sig;
pks.s_size = siglen;
ret = verify_signature(key, &pks);
+out:
key_put(key);
pr_debug("%s() = %d\n", __func__, ret);
return ret;


2022-02-14 21:05:36

by Greg KH

[permalink] [raw]
Subject: [PATCH 5.15 111/172] net: dsa: mv88e6xxx: dont use devres for mdiobus

From: Vladimir Oltean <[email protected]>

[ Upstream commit f53a2ce893b2c7884ef94471f170839170a4eba0 ]

As explained in commits:
74b6d7d13307 ("net: dsa: realtek: register the MDIO bus under devres")
5135e96a3dd2 ("net: dsa: don't allocate the slave_mii_bus using devres")

mdiobus_free() will panic when called from devm_mdiobus_free() <-
devres_release_all() <- __device_release_driver(), and that mdiobus was
not previously unregistered.

The mv88e6xxx is an MDIO device, so the initial set of constraints that
I thought would cause this (I2C or SPI buses which call ->remove on
->shutdown) do not apply. But there is one more which applies here.

If the DSA master itself is on a bus that calls ->remove from ->shutdown
(like dpaa2-eth, which is on the fsl-mc bus), there is a device link
between the switch and the DSA master, and device_links_unbind_consumers()
will unbind the Marvell switch driver on shutdown.

systemd-shutdown[1]: Powering off.
mv88e6085 0x0000000008b96000:00 sw_gl0: Link is Down
fsl-mc dpbp.9: Removing from iommu group 7
fsl-mc dpbp.8: Removing from iommu group 7
------------[ cut here ]------------
kernel BUG at drivers/net/phy/mdio_bus.c:677!
Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 1 Comm: systemd-shutdow Not tainted 5.16.5-00040-gdc05f73788e5 #15
pc : mdiobus_free+0x44/0x50
lr : devm_mdiobus_free+0x10/0x20
Call trace:
mdiobus_free+0x44/0x50
devm_mdiobus_free+0x10/0x20
devres_release_all+0xa0/0x100
__device_release_driver+0x190/0x220
device_release_driver_internal+0xac/0xb0
device_links_unbind_consumers+0xd4/0x100
__device_release_driver+0x4c/0x220
device_release_driver_internal+0xac/0xb0
device_links_unbind_consumers+0xd4/0x100
__device_release_driver+0x94/0x220
device_release_driver+0x28/0x40
bus_remove_device+0x118/0x124
device_del+0x174/0x420
fsl_mc_device_remove+0x24/0x40
__fsl_mc_device_remove+0xc/0x20
device_for_each_child+0x58/0xa0
dprc_remove+0x90/0xb0
fsl_mc_driver_remove+0x20/0x5c
__device_release_driver+0x21c/0x220
device_release_driver+0x28/0x40
bus_remove_device+0x118/0x124
device_del+0x174/0x420
fsl_mc_bus_remove+0x80/0x100
fsl_mc_bus_shutdown+0xc/0x1c
platform_shutdown+0x20/0x30
device_shutdown+0x154/0x330
kernel_power_off+0x34/0x6c
__do_sys_reboot+0x15c/0x250
__arm64_sys_reboot+0x20/0x30
invoke_syscall.constprop.0+0x4c/0xe0
do_el0_svc+0x4c/0x150
el0_svc+0x24/0xb0
el0t_64_sync_handler+0xa8/0xb0
el0t_64_sync+0x178/0x17c

So the same treatment must be applied to all DSA switch drivers, which
is: either use devres for both the mdiobus allocation and registration,
or don't use devres at all.

The Marvell driver already has a good structure for mdiobus removal, so
just plug in mdiobus_free and get rid of devres.

Fixes: ac3a68d56651 ("net: phy: don't abuse devres in devm_mdiobus_register()")
Reported-by: Rafael Richter <[email protected]>
Signed-off-by: Vladimir Oltean <[email protected]>
Tested-by: Daniel Klauer <[email protected]>
Reviewed-by: Andrew Lunn <[email protected]>
Reviewed-by: Florian Fainelli <[email protected]>
Signed-off-by: Jakub Kicinski <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/net/dsa/mv88e6xxx/chip.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
index 43d126628610b..206b8a3001b95 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.c
+++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -3416,7 +3416,7 @@ static int mv88e6xxx_mdio_register(struct mv88e6xxx_chip *chip,
return err;
}

- bus = devm_mdiobus_alloc_size(chip->dev, sizeof(*mdio_bus));
+ bus = mdiobus_alloc_size(sizeof(*mdio_bus));
if (!bus)
return -ENOMEM;

@@ -3441,14 +3441,14 @@ static int mv88e6xxx_mdio_register(struct mv88e6xxx_chip *chip,
if (!external) {
err = mv88e6xxx_g2_irq_mdio_setup(chip, bus);
if (err)
- return err;
+ goto out;
}

err = of_mdiobus_register(bus, np);
if (err) {
dev_err(chip->dev, "Cannot register MDIO bus (%d)\n", err);
mv88e6xxx_g2_irq_mdio_free(chip, bus);
- return err;
+ goto out;
}

if (external)
@@ -3457,6 +3457,10 @@ static int mv88e6xxx_mdio_register(struct mv88e6xxx_chip *chip,
list_add(&mdio_bus->list, &chip->mdios);

return 0;
+
+out:
+ mdiobus_free(bus);
+ return err;
}

static void mv88e6xxx_mdios_unregister(struct mv88e6xxx_chip *chip)
@@ -3472,6 +3476,7 @@ static void mv88e6xxx_mdios_unregister(struct mv88e6xxx_chip *chip)
mv88e6xxx_g2_irq_mdio_free(chip, bus);

mdiobus_unregister(bus);
+ mdiobus_free(bus);
}
}

--
2.34.1



2022-02-14 21:06:50

by Greg KH

[permalink] [raw]
Subject: [PATCH 5.15 040/172] drm: panel-orientation-quirks: Add quirk for the 1Netbook OneXPlayer

From: Raymond Jay Golo <[email protected]>

[ Upstream commit d3cbc6e323c9299d10c8d2e4127c77c7d05d07b1 ]

The 1Netbook OneXPlayer uses a panel which has been mounted
90 degrees rotated. Add a quirk for this.

Signed-off-by: Raymond Jay Golo <[email protected]>
Signed-off-by: Daniel Vetter <[email protected]>
Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/gpu/drm/drm_panel_orientation_quirks.c | 12 ++++++++++++
1 file changed, 12 insertions(+)

diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c
index 9d1bd8f491ad7..448c2f2d803a6 100644
--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c
+++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c
@@ -115,6 +115,12 @@ static const struct drm_dmi_panel_orientation_data lcd1280x1920_rightside_up = {
.orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP,
};

+static const struct drm_dmi_panel_orientation_data lcd1600x2560_leftside_up = {
+ .width = 1600,
+ .height = 2560,
+ .orientation = DRM_MODE_PANEL_ORIENTATION_LEFT_UP,
+};
+
static const struct dmi_system_id orientation_data[] = {
{ /* Acer One 10 (S1003) */
.matches = {
@@ -261,6 +267,12 @@ static const struct dmi_system_id orientation_data[] = {
DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "Default string"),
},
.driver_data = (void *)&onegx1_pro,
+ }, { /* OneXPlayer */
+ .matches = {
+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ONE-NETBOOK TECHNOLOGY CO., LTD."),
+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "ONE XPLAYER"),
+ },
+ .driver_data = (void *)&lcd1600x2560_leftside_up,
}, { /* Samsung GalaxyBook 10.6 */
.matches = {
DMI_EXACT_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
--
2.34.1



2022-02-14 21:07:59

by Greg KH

[permalink] [raw]
Subject: [PATCH 5.15 143/172] usb: dwc3: gadget: Prevent core from processing stale TRBs

From: Udipto Goswami <[email protected]>

commit 117b4e96c7f362eb6459543883fc07f77662472c upstream.

With CPU re-ordering on write instructions, there might
be a chance that the HWO is set before the TRB is updated
with the new mapped buffer address.
And in the case where core is processing a list of TRBs
it is possible that it fetched the TRBs when the HWO is set
but before the buffer address is updated.
Prevent this by adding a memory barrier before the HWO
is updated to ensure that the core always process the
updated TRBs.

Fixes: f6bafc6a1c9d ("usb: dwc3: convert TRBs into bitshifts")
Cc: stable <[email protected]>
Reviewed-by: Pavankumar Kondeti <[email protected]>
Signed-off-by: Udipto Goswami <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/usb/dwc3/gadget.c | 13 +++++++++++++
1 file changed, 13 insertions(+)

--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -1271,6 +1271,19 @@ static void __dwc3_prepare_one_trb(struc
if (usb_endpoint_xfer_bulk(dep->endpoint.desc) && dep->stream_capable)
trb->ctrl |= DWC3_TRB_CTRL_SID_SOFN(stream_id);

+ /*
+ * As per data book 4.2.3.2TRB Control Bit Rules section
+ *
+ * The controller autonomously checks the HWO field of a TRB to determine if the
+ * entire TRB is valid. Therefore, software must ensure that the rest of the TRB
+ * is valid before setting the HWO field to '1'. In most systems, this means that
+ * software must update the fourth DWORD of a TRB last.
+ *
+ * However there is a possibility of CPU re-ordering here which can cause
+ * controller to observe the HWO bit set prematurely.
+ * Add a write memory barrier to prevent CPU re-ordering.
+ */
+ wmb();
trb->ctrl |= DWC3_TRB_CTRL_HWO;

dwc3_ep_inc_enq(dep);


2022-02-14 21:09:11

by Greg KH

[permalink] [raw]
Subject: [PATCH 5.15 053/172] PM: hibernate: Remove register_nosave_region_late()

From: Amadeusz Sławiński <[email protected]>

[ Upstream commit 33569ef3c754a82010f266b7b938a66a3ccf90a4 ]

It is an unused wrapper forcing kmalloc allocation for registering
nosave regions. Also, rename __register_nosave_region() to
register_nosave_region() now that there is no need for disambiguation.

Signed-off-by: Amadeusz Sławiński <[email protected]>
Reviewed-by: Cezary Rojewski <[email protected]>
Signed-off-by: Rafael J. Wysocki <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
include/linux/suspend.h | 11 +----------
kernel/power/snapshot.c | 21 +++++++--------------
2 files changed, 8 insertions(+), 24 deletions(-)

diff --git a/include/linux/suspend.h b/include/linux/suspend.h
index 8af13ba60c7e4..c1310c571d805 100644
--- a/include/linux/suspend.h
+++ b/include/linux/suspend.h
@@ -430,15 +430,7 @@ struct platform_hibernation_ops {

#ifdef CONFIG_HIBERNATION
/* kernel/power/snapshot.c */
-extern void __register_nosave_region(unsigned long b, unsigned long e, int km);
-static inline void __init register_nosave_region(unsigned long b, unsigned long e)
-{
- __register_nosave_region(b, e, 0);
-}
-static inline void __init register_nosave_region_late(unsigned long b, unsigned long e)
-{
- __register_nosave_region(b, e, 1);
-}
+extern void register_nosave_region(unsigned long b, unsigned long e);
extern int swsusp_page_is_forbidden(struct page *);
extern void swsusp_set_page_free(struct page *);
extern void swsusp_unset_page_free(struct page *);
@@ -457,7 +449,6 @@ int pfn_is_nosave(unsigned long pfn);
int hibernate_quiet_exec(int (*func)(void *data), void *data);
#else /* CONFIG_HIBERNATION */
static inline void register_nosave_region(unsigned long b, unsigned long e) {}
-static inline void register_nosave_region_late(unsigned long b, unsigned long e) {}
static inline int swsusp_page_is_forbidden(struct page *p) { return 0; }
static inline void swsusp_set_page_free(struct page *p) {}
static inline void swsusp_unset_page_free(struct page *p) {}
diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c
index f7a9860782135..330d499376924 100644
--- a/kernel/power/snapshot.c
+++ b/kernel/power/snapshot.c
@@ -978,8 +978,7 @@ static void memory_bm_recycle(struct memory_bitmap *bm)
* Register a range of page frames the contents of which should not be saved
* during hibernation (to be used in the early initialization code).
*/
-void __init __register_nosave_region(unsigned long start_pfn,
- unsigned long end_pfn, int use_kmalloc)
+void __init register_nosave_region(unsigned long start_pfn, unsigned long end_pfn)
{
struct nosave_region *region;

@@ -995,18 +994,12 @@ void __init __register_nosave_region(unsigned long start_pfn,
goto Report;
}
}
- if (use_kmalloc) {
- /* During init, this shouldn't fail */
- region = kmalloc(sizeof(struct nosave_region), GFP_KERNEL);
- BUG_ON(!region);
- } else {
- /* This allocation cannot fail */
- region = memblock_alloc(sizeof(struct nosave_region),
- SMP_CACHE_BYTES);
- if (!region)
- panic("%s: Failed to allocate %zu bytes\n", __func__,
- sizeof(struct nosave_region));
- }
+ /* This allocation cannot fail */
+ region = memblock_alloc(sizeof(struct nosave_region),
+ SMP_CACHE_BYTES);
+ if (!region)
+ panic("%s: Failed to allocate %zu bytes\n", __func__,
+ sizeof(struct nosave_region));
region->start_pfn = start_pfn;
region->end_pfn = end_pfn;
list_add_tail(&region->list, &nosave_regions);
--
2.34.1



2022-02-14 21:09:33

by Greg KH

[permalink] [raw]
Subject: [PATCH 5.15 165/172] sched/fair: Fix fault in reweight_entity

From: Tadeusz Struk <[email protected]>

commit 13765de8148f71fa795e0a6607de37c49ea5915a upstream.

Syzbot found a GPF in reweight_entity. This has been bisected to
commit 4ef0c5c6b5ba ("kernel/sched: Fix sched_fork() access an invalid
sched_task_group")

There is a race between sched_post_fork() and setpriority(PRIO_PGRP)
within a thread group that causes a null-ptr-deref in
reweight_entity() in CFS. The scenario is that the main process spawns
number of new threads, which then call setpriority(PRIO_PGRP, 0, -20),
wait, and exit. For each of the new threads the copy_process() gets
invoked, which adds the new task_struct and calls sched_post_fork()
for it.

In the above scenario there is a possibility that
setpriority(PRIO_PGRP) and set_one_prio() will be called for a thread
in the group that is just being created by copy_process(), and for
which the sched_post_fork() has not been executed yet. This will
trigger a null pointer dereference in reweight_entity(), as it will
try to access the run queue pointer, which hasn't been set.

Before the mentioned change the cfs_rq pointer for the task has been
set in sched_fork(), which is called much earlier in copy_process(),
before the new task is added to the thread_group. Now it is done in
the sched_post_fork(), which is called after that. To fix the issue
the remove the update_load param from the update_load param() function
and call reweight_task() only if the task flag doesn't have the
TASK_NEW flag set.

Fixes: 4ef0c5c6b5ba ("kernel/sched: Fix sched_fork() access an invalid sched_task_group")
Reported-by: [email protected]
Signed-off-by: Tadeusz Struk <[email protected]>
Signed-off-by: Peter Zijlstra (Intel) <[email protected]>
Reviewed-by: Dietmar Eggemann <[email protected]>
Cc: [email protected]
Link: https://lkml.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
kernel/sched/core.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)

--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -1199,8 +1199,9 @@ int tg_nop(struct task_group *tg, void *
}
#endif

-static void set_load_weight(struct task_struct *p, bool update_load)
+static void set_load_weight(struct task_struct *p)
{
+ bool update_load = !(READ_ONCE(p->__state) & TASK_NEW);
int prio = p->static_prio - MAX_RT_PRIO;
struct load_weight *load = &p->se.load;

@@ -4358,7 +4359,7 @@ int sched_fork(unsigned long clone_flags
p->static_prio = NICE_TO_PRIO(0);

p->prio = p->normal_prio = p->static_prio;
- set_load_weight(p, false);
+ set_load_weight(p);

/*
* We don't need the reset flag anymore after the fork. It has
@@ -6902,7 +6903,7 @@ void set_user_nice(struct task_struct *p
put_prev_task(rq, p);

p->static_prio = NICE_TO_PRIO(nice);
- set_load_weight(p, true);
+ set_load_weight(p);
old_prio = p->prio;
p->prio = effective_prio(p);

@@ -7193,7 +7194,7 @@ static void __setscheduler_params(struct
*/
p->rt_priority = attr->sched_priority;
p->normal_prio = normal_prio(p);
- set_load_weight(p, true);
+ set_load_weight(p);
}

/*
@@ -9431,7 +9432,7 @@ void __init sched_init(void)
#endif
}

- set_load_weight(&init_task, false);
+ set_load_weight(&init_task);

/*
* The boot idle thread does lazy MMU switching as well:


2022-02-14 21:10:28

by Greg KH

[permalink] [raw]
Subject: [PATCH 5.15 104/172] ixgbevf: Require large buffers for build_skb on 82599VF

From: Samuel Mendoza-Jonas <[email protected]>

[ Upstream commit fe68195daf34d5dddacd3f93dd3eafc4beca3a0e ]

>From 4.17 onwards the ixgbevf driver uses build_skb() to build an skb
around new data in the page buffer shared with the ixgbe PF.
This uses either a 2K or 3K buffer, and offsets the DMA mapping by
NET_SKB_PAD + NET_IP_ALIGN. When using a smaller buffer RXDCTL is set to
ensure the PF does not write a full 2K bytes into the buffer, which is
actually 2K minus the offset.

However on the 82599 virtual function, the RXDCTL mechanism is not
available. The driver attempts to work around this by using the SET_LPE
mailbox method to lower the maximm frame size, but the ixgbe PF driver
ignores this in order to keep the PF and all VFs in sync[0].

This means the PF will write up to the full 2K set in SRRCTL, causing it
to write NET_SKB_PAD + NET_IP_ALIGN bytes past the end of the buffer.
With 4K pages split into two buffers, this means it either writes
NET_SKB_PAD + NET_IP_ALIGN bytes past the first buffer (and into the
second), or NET_SKB_PAD + NET_IP_ALIGN bytes past the end of the DMA
mapping.

Avoid this by only enabling build_skb when using "large" buffers (3K).
These are placed in each half of an order-1 page, preventing the PF from
writing past the end of the mapping.

[0]: Technically it only ever raises the max frame size, see
ixgbe_set_vf_lpe() in ixgbe_sriov.c

Fixes: f15c5ba5b6cd ("ixgbevf: add support for using order 1 pages to receive large frames")
Signed-off-by: Samuel Mendoza-Jonas <[email protected]>
Tested-by: Konrad Jankowski <[email protected]>
Signed-off-by: Tony Nguyen <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
index c714e1ecd3089..7ef2e1241a76e 100644
--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
@@ -1984,14 +1984,15 @@ static void ixgbevf_set_rx_buffer_len(struct ixgbevf_adapter *adapter,
if (adapter->flags & IXGBEVF_FLAGS_LEGACY_RX)
return;

- set_ring_build_skb_enabled(rx_ring);
+ if (PAGE_SIZE < 8192)
+ if (max_frame > IXGBEVF_MAX_FRAME_BUILD_SKB)
+ set_ring_uses_large_buffer(rx_ring);

- if (PAGE_SIZE < 8192) {
- if (max_frame <= IXGBEVF_MAX_FRAME_BUILD_SKB)
- return;
+ /* 82599 can't rely on RXDCTL.RLPML to restrict the size of the frame */
+ if (adapter->hw.mac.type == ixgbe_mac_82599_vf && !ring_uses_large_buffer(rx_ring))
+ return;

- set_ring_uses_large_buffer(rx_ring);
- }
+ set_ring_build_skb_enabled(rx_ring);
}

/**
--
2.34.1



2022-02-14 21:11:40

by Greg KH

[permalink] [raw]
Subject: [PATCH 5.15 139/172] Revert "usb: dwc2: drd: fix soft connect when gadget is unconfigured"

From: Greg Kroah-Hartman <[email protected]>

commit 736e8d89044c1c330967fb938fa766cd9e0d8af0 upstream.

This reverts commit 269cbcf7b72de6f0016806d4a0cec1d689b55a87.

It causes build errors as reported by the kernel test robot.

Link: https://lore.kernel.org/r/[email protected]
Reported-by: kernel test robot <[email protected]>
Fixes: 269cbcf7b72d ("usb: dwc2: drd: fix soft connect when gadget is unconfigured")
Cc: [email protected]
Cc: Amelie Delaunay <[email protected]>
Cc: Minas Harutyunyan <[email protected]>
Cc: Fabrice Gasnier <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/usb/dwc2/drd.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)

--- a/drivers/usb/dwc2/drd.c
+++ b/drivers/usb/dwc2/drd.c
@@ -109,10 +109,8 @@ static int dwc2_drd_role_sw_set(struct u
already = dwc2_ovr_avalid(hsotg, true);
} else if (role == USB_ROLE_DEVICE) {
already = dwc2_ovr_bvalid(hsotg, true);
- if (hsotg->enabled) {
- /* This clear DCTL.SFTDISCON bit */
- dwc2_hsotg_core_connect(hsotg);
- }
+ /* This clear DCTL.SFTDISCON bit */
+ dwc2_hsotg_core_connect(hsotg);
} else {
if (dwc2_is_device_mode(hsotg)) {
if (!dwc2_ovr_bvalid(hsotg, false))


2022-02-14 21:13:05

by Greg KH

[permalink] [raw]
Subject: [PATCH 5.15 156/172] iio: buffer: Fix file related error handling in IIO_BUFFER_GET_FD_IOCTL

From: Mathias Krause <[email protected]>

commit c72ea20503610a4a7ba26c769357d31602769c01 upstream.

If we fail to copy the just created file descriptor to userland, we
try to clean up by putting back 'fd' and freeing 'ib'. The code uses
put_unused_fd() for the former which is wrong, as the file descriptor
was already published by fd_install() which gets called internally by
anon_inode_getfd().

This makes the error handling code leaving a half cleaned up file
descriptor table around and a partially destructed 'file' object,
allowing userland to play use-after-free tricks on us, by abusing
the still usable fd and making the code operate on a dangling
'file->private_data' pointer.

Instead of leaving the kernel in a partially corrupted state, don't
attempt to explicitly clean up and leave this to the process exit
path that'll release any still valid fds, including the one created
by the previous call to anon_inode_getfd(). Simply return -EFAULT to
indicate the error.

Fixes: f73f7f4da581 ("iio: buffer: add ioctl() to support opening extra buffers for IIO device")
Cc: [email protected]
Cc: Jonathan Cameron <[email protected]>
Cc: Alexandru Ardelean <[email protected]>
Cc: Lars-Peter Clausen <[email protected]>
Cc: Nuno Sa <[email protected]>
Reported-by: Dan Carpenter <[email protected]>
Signed-off-by: Mathias Krause <[email protected]>
Reviewed-by: Jonathan Cameron <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/iio/industrialio-buffer.c | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)

--- a/drivers/iio/industrialio-buffer.c
+++ b/drivers/iio/industrialio-buffer.c
@@ -1446,9 +1446,17 @@ static long iio_device_buffer_getfd(stru
}

if (copy_to_user(ival, &fd, sizeof(fd))) {
- put_unused_fd(fd);
- ret = -EFAULT;
- goto error_free_ib;
+ /*
+ * "Leak" the fd, as there's not much we can do about this
+ * anyway. 'fd' might have been closed already, as
+ * anon_inode_getfd() called fd_install() on it, which made
+ * it reachable by userland.
+ *
+ * Instead of allowing a malicious user to play tricks with
+ * us, rely on the process exit path to do any necessary
+ * cleanup, as in releasing the file, if still needed.
+ */
+ return -EFAULT;
}

return 0;


2022-02-14 21:13:34

by Greg KH

[permalink] [raw]
Subject: [PATCH 5.15 155/172] phy: ti: Fix missing sentinel for clk_div_table

From: Kishon Vijay Abraham I <[email protected]>

commit 6d1e6bcb31663ee83aaea1f171f3dbfe95dd4a69 upstream.

_get_table_maxdiv() tries to access "clk_div_table" array out of bound
defined in phy-j721e-wiz.c. Add a sentinel entry to prevent
the following global-out-of-bounds error reported by enabling KASAN.

[ 9.552392] BUG: KASAN: global-out-of-bounds in _get_maxdiv+0xc0/0x148
[ 9.558948] Read of size 4 at addr ffff8000095b25a4 by task kworker/u4:1/38
[ 9.565926]
[ 9.567441] CPU: 1 PID: 38 Comm: kworker/u4:1 Not tainted 5.16.0-116492-gdaadb3bd0e8d-dirty #360
[ 9.576242] Hardware name: Texas Instruments J721e EVM (DT)
[ 9.581832] Workqueue: events_unbound deferred_probe_work_func
[ 9.587708] Call trace:
[ 9.590174] dump_backtrace+0x20c/0x218
[ 9.594038] show_stack+0x18/0x68
[ 9.597375] dump_stack_lvl+0x9c/0xd8
[ 9.601062] print_address_description.constprop.0+0x78/0x334
[ 9.606830] kasan_report+0x1f0/0x260
[ 9.610517] __asan_load4+0x9c/0xd8
[ 9.614030] _get_maxdiv+0xc0/0x148
[ 9.617540] divider_determine_rate+0x88/0x488
[ 9.622005] divider_round_rate_parent+0xc8/0x124
[ 9.626729] wiz_clk_div_round_rate+0x54/0x68
[ 9.631113] clk_core_determine_round_nolock+0x124/0x158
[ 9.636448] clk_core_round_rate_nolock+0x68/0x138
[ 9.641260] clk_core_set_rate_nolock+0x268/0x3a8
[ 9.645987] clk_set_rate+0x50/0xa8
[ 9.649499] cdns_sierra_phy_init+0x88/0x248
[ 9.653794] phy_init+0x98/0x108
[ 9.657046] cdns_pcie_enable_phy+0xa0/0x170
[ 9.661340] cdns_pcie_init_phy+0x250/0x2b0
[ 9.665546] j721e_pcie_probe+0x4b8/0x798
[ 9.669579] platform_probe+0x8c/0x108
[ 9.673350] really_probe+0x114/0x630
[ 9.677037] __driver_probe_device+0x18c/0x220
[ 9.681505] driver_probe_device+0xac/0x150
[ 9.685712] __device_attach_driver+0xec/0x170
[ 9.690178] bus_for_each_drv+0xf0/0x158
[ 9.694124] __device_attach+0x184/0x210
[ 9.698070] device_initial_probe+0x14/0x20
[ 9.702277] bus_probe_device+0xec/0x100
[ 9.706223] deferred_probe_work_func+0x124/0x180
[ 9.710951] process_one_work+0x4b0/0xbc0
[ 9.714983] worker_thread+0x74/0x5d0
[ 9.718668] kthread+0x214/0x230
[ 9.721919] ret_from_fork+0x10/0x20
[ 9.725520]
[ 9.727032] The buggy address belongs to the variable:
[ 9.732183] clk_div_table+0x24/0x440

Fixes: 091876cc355d ("phy: ti: j721e-wiz: Add support for WIZ module present in TI J721E SoC")
Cc: [email protected] # v5.10+
Signed-off-by: Kishon Vijay Abraham I <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Vinod Koul <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/phy/ti/phy-j721e-wiz.c | 1 +
1 file changed, 1 insertion(+)

--- a/drivers/phy/ti/phy-j721e-wiz.c
+++ b/drivers/phy/ti/phy-j721e-wiz.c
@@ -233,6 +233,7 @@ static const struct clk_div_table clk_di
{ .val = 1, .div = 2, },
{ .val = 2, .div = 4, },
{ .val = 3, .div = 8, },
+ { /* sentinel */ },
};

static const struct wiz_clk_div_sel clk_div_sel[] = {


2022-02-14 21:14:25

by Greg KH

[permalink] [raw]
Subject: [PATCH 5.15 068/172] riscv: eliminate unreliable __builtin_frame_address(1)

From: Changbin Du <[email protected]>

commit 6a00ef4493706a23120057fafbc62379bcde11ec upstream.

I tried different pieces of code which uses __builtin_frame_address(1)
(with both gcc version 7.5.0 and 10.3.0) to verify whether it works as
expected on riscv64. The result is negative.

What the compiler had generated is as below:
31 fp = (unsigned long)__builtin_frame_address(1);
0xffffffff80006024 <+200>: ld s1,0(s0)

It takes '0(s0)' as the address of frame 1 (caller), but the actual address
should be '-16(s0)'.

| ... | <-+
+-----------------+ |
| return address | |
| previous fp | |
| saved registers | |
| local variables | |
$fp --> | ... | |
+-----------------+ |
| return address | |
| previous fp --------+
| saved registers |
$sp --> | local variables |
+-----------------+

This leads the kernel can not dump the full stack trace on riscv.

[ 7.222126][ T1] Call Trace:
[ 7.222804][ T1] [<ffffffff80006058>] dump_backtrace+0x2c/0x3a

This problem is not exposed on most riscv builds just because the '0(s0)'
occasionally is the address frame 2 (caller's caller), if only ra and fp
are stored in frame 1 (caller).

| ... | <-+
+-----------------+ |
| return address | |
$fp --> | previous fp | |
+-----------------+ |
| return address | |
| previous fp --------+
| saved registers |
$sp --> | local variables |
+-----------------+

This could be a *bug* of gcc that should be fixed. But as noted in gcc
manual "Calling this function with a nonzero argument can have
unpredictable effects, including crashing the calling program.", let's
remove the '__builtin_frame_address(1)' in backtrace code.

With this fix now it can show full stack trace:
[ 10.444838][ T1] Call Trace:
[ 10.446199][ T1] [<ffffffff8000606c>] dump_backtrace+0x2c/0x3a
[ 10.447711][ T1] [<ffffffff800060ac>] show_stack+0x32/0x3e
[ 10.448710][ T1] [<ffffffff80a005c0>] dump_stack_lvl+0x58/0x7a
[ 10.449941][ T1] [<ffffffff80a005f6>] dump_stack+0x14/0x1c
[ 10.450929][ T1] [<ffffffff804c04ee>] ubsan_epilogue+0x10/0x5a
[ 10.451869][ T1] [<ffffffff804c092e>] __ubsan_handle_load_invalid_value+0x6c/0x78
[ 10.453049][ T1] [<ffffffff8018f834>] __pagevec_release+0x62/0x64
[ 10.455476][ T1] [<ffffffff80190830>] truncate_inode_pages_range+0x132/0x5be
[ 10.456798][ T1] [<ffffffff80190ce0>] truncate_inode_pages+0x24/0x30
[ 10.457853][ T1] [<ffffffff8045bb04>] kill_bdev+0x32/0x3c
...

Signed-off-by: Changbin Du <[email protected]>
Fixes: eac2f3059e02 ("riscv: stacktrace: fix the riscv stacktrace when CONFIG_FRAME_POINTER enabled")
Cc: [email protected]
Signed-off-by: Palmer Dabbelt <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
arch/riscv/kernel/stacktrace.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)

--- a/arch/riscv/kernel/stacktrace.c
+++ b/arch/riscv/kernel/stacktrace.c
@@ -22,15 +22,16 @@ void notrace walk_stackframe(struct task
bool (*fn)(void *, unsigned long), void *arg)
{
unsigned long fp, sp, pc;
+ int level = 0;

if (regs) {
fp = frame_pointer(regs);
sp = user_stack_pointer(regs);
pc = instruction_pointer(regs);
} else if (task == NULL || task == current) {
- fp = (unsigned long)__builtin_frame_address(1);
- sp = (unsigned long)__builtin_frame_address(0);
- pc = (unsigned long)__builtin_return_address(0);
+ fp = (unsigned long)__builtin_frame_address(0);
+ sp = sp_in_global;
+ pc = (unsigned long)walk_stackframe;
} else {
/* task blocked in __switch_to */
fp = task->thread.s[0];
@@ -42,7 +43,7 @@ void notrace walk_stackframe(struct task
unsigned long low, high;
struct stackframe *frame;

- if (unlikely(!__kernel_text_address(pc) || !fn(arg, pc)))
+ if (unlikely(!__kernel_text_address(pc) || (level++ >= 1 && !fn(arg, pc))))
break;

/* Validate frame pointer */


2022-02-14 21:15:46

by Greg KH

[permalink] [raw]
Subject: [PATCH 5.15 076/172] drm/amdgpu/display: change pipe policy for DCN 2.0

From: Alex Deucher <[email protected]>

commit 6e7545ddb13416fd200e0b91c0acfd0404e2e27b upstream.

Fixes hangs on driver load with multiple displays on
DCN 2.0 parts.

Bug: https://bugzilla.kernel.org/show_bug.cgi?id=215511
Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1877
Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1886
Fixes: ee2698cf79cc ("drm/amd/display: Changed pipe split policy to allow for multi-display pipe split")
Reviewed-by: Harry Wentland <[email protected]>
Signed-off-by: Alex Deucher <[email protected]>
Cc: [email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
@@ -1067,7 +1067,7 @@ static const struct dc_debug_options deb
.timing_trace = false,
.clock_trace = true,
.disable_pplib_clock_request = true,
- .pipe_split_policy = MPC_SPLIT_DYNAMIC,
+ .pipe_split_policy = MPC_SPLIT_AVOID_MULT_DISP,
.force_single_disp_pipe_split = false,
.disable_dcc = DCC_ENABLE,
.vsr_support = true,


2022-02-14 21:16:25

by Greg KH

[permalink] [raw]
Subject: [PATCH 5.15 033/172] net/sunrpc: fix reference count leaks in rpc_sysfs_xprt_state_change

From: Xiyu Yang <[email protected]>

[ Upstream commit 776d794f28c95051bc70405a7b1fa40115658a18 ]

The refcount leak issues take place in an error handling path. When the
3rd argument buf doesn't match with "offline", "online" or "remove", the
function simply returns -EINVAL and forgets to decrease the reference
count of a rpc_xprt object and a rpc_xprt_switch object increased by
rpc_sysfs_xprt_kobj_get_xprt() and
rpc_sysfs_xprt_kobj_get_xprt_switch(), causing reference count leaks of
both unused objects.

Fix this issue by jumping to the error handling path labelled with
out_put when buf matches none of "offline", "online" or "remove".

Signed-off-by: Xiyu Yang <[email protected]>
Signed-off-by: Xin Xiong <[email protected]>
Signed-off-by: Xin Tan <[email protected]>
Signed-off-by: Anna Schumaker <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
net/sunrpc/sysfs.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/sunrpc/sysfs.c b/net/sunrpc/sysfs.c
index 9a6f17e18f73b..379cf0e4d965b 100644
--- a/net/sunrpc/sysfs.c
+++ b/net/sunrpc/sysfs.c
@@ -291,8 +291,10 @@ static ssize_t rpc_sysfs_xprt_state_change(struct kobject *kobj,
online = 1;
else if (!strncmp(buf, "remove", 6))
remove = 1;
- else
- return -EINVAL;
+ else {
+ count = -EINVAL;
+ goto out_put;
+ }

if (wait_on_bit_lock(&xprt->state, XPRT_LOCKED, TASK_KILLABLE)) {
count = -EINTR;
--
2.34.1



2022-02-14 21:16:32

by Greg KH

[permalink] [raw]
Subject: [PATCH 5.15 124/172] net: amd-xgbe: disable interrupts during pci removal

From: Raju Rangoju <[email protected]>

[ Upstream commit 68c2d6af1f1e469544d6cbe9a601d96fb9c00e7f ]

Hardware interrupts are enabled during the pci probe, however,
they are not disabled during pci removal.

Disable all hardware interrupts during pci removal to avoid any
issues.

Fixes: e75377404726 ("amd-xgbe: Update PCI support to use new IRQ functions")
Suggested-by: Selwin Sebastian <[email protected]>
Signed-off-by: Raju Rangoju <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/net/ethernet/amd/xgbe/xgbe-pci.c | 3 +++
1 file changed, 3 insertions(+)

diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-pci.c b/drivers/net/ethernet/amd/xgbe/xgbe-pci.c
index 90cb55eb54665..014513ce00a14 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-pci.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-pci.c
@@ -418,6 +418,9 @@ static void xgbe_pci_remove(struct pci_dev *pdev)

pci_free_irq_vectors(pdata->pcidev);

+ /* Disable all interrupts in the hardware */
+ XP_IOWRITE(pdata, XP_INT_EN, 0x0);
+
xgbe_free_pdata(pdata);
}

--
2.34.1



2022-02-14 21:17:11

by Greg KH

[permalink] [raw]
Subject: [PATCH 5.15 065/172] KVM: x86: Report deprecated x87 features in supported CPUID

From: Jim Mattson <[email protected]>

[ Upstream commit e3bcfda012edd3564e12551b212afbd2521a1f68 ]

CPUID.(EAX=7,ECX=0):EBX.FDP_EXCPTN_ONLY[bit 6] and
CPUID.(EAX=7,ECX=0):EBX.ZERO_FCS_FDS[bit 13] are "defeature"
bits. Unlike most of the other CPUID feature bits, these bits are
clear if the features are present and set if the features are not
present. These bits should be reported in KVM_GET_SUPPORTED_CPUID,
because if these bits are set on hardware, they cannot be cleared in
the guest CPUID. Doing so would claim guest support for a feature that
the hardware doesn't support and that can't be efficiently emulated.

Of course, any software (e.g WIN87EM.DLL) expecting these features to
be present likely predates these CPUID feature bits and therefore
doesn't know to check for them anyway.

Aaron Lewis added the corresponding X86_FEATURE macros in
commit cbb99c0f5887 ("x86/cpufeatures: Add FDP_EXCPTN_ONLY and
ZERO_FCS_FDS"), with the intention of reporting these bits in
KVM_GET_SUPPORTED_CPUID, but I was unable to find a proposed patch on
the kvm list.

Opportunistically reordered the CPUID_7_0_EBX capability bits from
least to most significant.

Cc: Aaron Lewis <[email protected]>
Signed-off-by: Jim Mattson <[email protected]>
Message-Id: <[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
arch/x86/kvm/cpuid.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
index f666fd79d8ad6..5f1d4a5aa8716 100644
--- a/arch/x86/kvm/cpuid.c
+++ b/arch/x86/kvm/cpuid.c
@@ -421,12 +421,13 @@ void kvm_set_cpu_caps(void)
);

kvm_cpu_cap_mask(CPUID_7_0_EBX,
- F(FSGSBASE) | F(SGX) | F(BMI1) | F(HLE) | F(AVX2) | F(SMEP) |
- F(BMI2) | F(ERMS) | F(INVPCID) | F(RTM) | 0 /*MPX*/ | F(RDSEED) |
- F(ADX) | F(SMAP) | F(AVX512IFMA) | F(AVX512F) | F(AVX512PF) |
- F(AVX512ER) | F(AVX512CD) | F(CLFLUSHOPT) | F(CLWB) | F(AVX512DQ) |
- F(SHA_NI) | F(AVX512BW) | F(AVX512VL) | 0 /*INTEL_PT*/
- );
+ F(FSGSBASE) | F(SGX) | F(BMI1) | F(HLE) | F(AVX2) |
+ F(FDP_EXCPTN_ONLY) | F(SMEP) | F(BMI2) | F(ERMS) | F(INVPCID) |
+ F(RTM) | F(ZERO_FCS_FDS) | 0 /*MPX*/ | F(AVX512F) |
+ F(AVX512DQ) | F(RDSEED) | F(ADX) | F(SMAP) | F(AVX512IFMA) |
+ F(CLFLUSHOPT) | F(CLWB) | 0 /*INTEL_PT*/ | F(AVX512PF) |
+ F(AVX512ER) | F(AVX512CD) | F(SHA_NI) | F(AVX512BW) |
+ F(AVX512VL));

kvm_cpu_cap_mask(CPUID_7_ECX,
F(AVX512VBMI) | F(LA57) | F(PKU) | 0 /*OSPKE*/ | F(RDPID) |
--
2.34.1



2022-02-14 21:19:14

by Greg KH

[permalink] [raw]
Subject: [PATCH 5.15 030/172] NFSv4 expose nfs_parse_server_name function

From: Olga Kornievskaia <[email protected]>

[ Upstream commit f5b27cc6761e27ee6387a24df1a99ca77b360fea ]

Make nfs_parse_server_name available outside of nfs4namespace.c.

Signed-off-by: Olga Kornievskaia <[email protected]>
Signed-off-by: Anna Schumaker <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
fs/nfs/nfs4_fs.h | 3 ++-
fs/nfs/nfs4namespace.c | 4 ++--
2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h
index 1a048ee653a11..0eb8e5d2ec395 100644
--- a/fs/nfs/nfs4_fs.h
+++ b/fs/nfs/nfs4_fs.h
@@ -281,7 +281,8 @@ struct rpc_clnt *nfs4_negotiate_security(struct rpc_clnt *, struct inode *,
int nfs4_submount(struct fs_context *, struct nfs_server *);
int nfs4_replace_transport(struct nfs_server *server,
const struct nfs4_fs_locations *locations);
-
+size_t nfs_parse_server_name(char *string, size_t len, struct sockaddr *sa,
+ size_t salen, struct net *net);
/* nfs4proc.c */
extern int nfs4_handle_exception(struct nfs_server *, int, struct nfs4_exception *);
extern int nfs4_async_handle_error(struct rpc_task *task,
diff --git a/fs/nfs/nfs4namespace.c b/fs/nfs/nfs4namespace.c
index 873342308dc0d..f1ed4f60a7f33 100644
--- a/fs/nfs/nfs4namespace.c
+++ b/fs/nfs/nfs4namespace.c
@@ -164,8 +164,8 @@ static int nfs4_validate_fspath(struct dentry *dentry,
return 0;
}

-static size_t nfs_parse_server_name(char *string, size_t len,
- struct sockaddr *sa, size_t salen, struct net *net)
+size_t nfs_parse_server_name(char *string, size_t len, struct sockaddr *sa,
+ size_t salen, struct net *net)
{
ssize_t ret;

--
2.34.1



2022-02-14 21:20:44

by Greg KH

[permalink] [raw]
Subject: [PATCH 5.15 153/172] USB: serial: cp210x: add CPI Bulk Coin Recycler id

From: Johan Hovold <[email protected]>

commit 6ca0c6283340d819bf9c7d8e76be33c9fbd903ab upstream.

Add the device id for the Crane Payment Innovation / Money Controls Bulk
Coin Recycler:

https://www.cranepi.com/en/system/files/Support/OM_BCR_EN_V1-04_0.pdf

Reported-by: Scott Russell <[email protected]>
Cc: [email protected]
Reviewed-by: Greg Kroah-Hartman <[email protected]>
Signed-off-by: Johan Hovold <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/usb/serial/cp210x.c | 1 +
1 file changed, 1 insertion(+)

--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -69,6 +69,7 @@ static const struct usb_device_id id_tab
{ USB_DEVICE(0x0FCF, 0x1004) }, /* Dynastream ANT2USB */
{ USB_DEVICE(0x0FCF, 0x1006) }, /* Dynastream ANT development board */
{ USB_DEVICE(0x0FDE, 0xCA05) }, /* OWL Wireless Electricity Monitor CM-160 */
+ { USB_DEVICE(0x106F, 0x0003) }, /* CPI / Money Controls Bulk Coin Recycler */
{ USB_DEVICE(0x10A6, 0xAA26) }, /* Knock-off DCU-11 cable */
{ USB_DEVICE(0x10AB, 0x10C5) }, /* Siemens MC60 Cable */
{ USB_DEVICE(0x10B5, 0xAC70) }, /* Nokia CA-42 USB */


2022-02-14 22:04:25

by Florian Fainelli

[permalink] [raw]
Subject: Re: [PATCH 5.15 000/172] 5.15.24-rc1 review

On 2/14/22 1:24 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.15.24 release.
> There are 172 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 16 Feb 2022 09:24:36 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.24-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h

On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels:

Tested-by: Florian Fainelli <[email protected]>
--
Florian

2022-02-15 00:27:55

by Fox Chen

[permalink] [raw]
Subject: RE: [PATCH 5.15 000/172] 5.15.24-rc1 review

On Mon, 14 Feb 2022 10:24:18 +0100, Greg Kroah-Hartman <[email protected]> wrote:
> This is the start of the stable review cycle for the 5.15.24 release.
> There are 172 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 16 Feb 2022 09:24:36 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.24-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>

5.15.24-rc1 Successfully Compiled and booted on my Raspberry PI 4b (8g) (bcm2711)

Tested-by: Fox Chen <[email protected]>

2022-02-15 00:38:05

by Shuah Khan

[permalink] [raw]
Subject: Re: [PATCH 5.15 000/172] 5.15.24-rc1 review

On 2/14/22 2:24 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.15.24 release.
> There are 172 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 16 Feb 2022 09:24:36 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.24-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
Compiled and booted on my test system. No dmesg regressions.

Tested-by: Shuah Khan <[email protected]>

thanks,
-- Shuah

2022-02-15 01:58:40

by Slade's Kernel Patch Bot

[permalink] [raw]
Subject: Re: [PATCH 5.15 000/172] 5.15.24-rc1 review

On Mon, Feb 14, 2022, at 4:24 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.15.24 release.
> There are 172 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 16 Feb 2022 09:24:36 +0000.
> Anything received after that time might be too late.

5.15.24-rc1 on my x86_64 test system compiled and booted with no errors or regressions.

Tested-by: Slade Watkins <[email protected]>

Thanks,
Slade

2022-02-15 02:34:26

by Guenter Roeck

[permalink] [raw]
Subject: Re: [PATCH 5.15 000/172] 5.15.24-rc1 review

On Mon, Feb 14, 2022 at 10:24:18AM +0100, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.15.24 release.
> There are 172 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 16 Feb 2022 09:24:36 +0000.
> Anything received after that time might be too late.
>

Build results:
total: 156 pass: 156 fail: 0
Qemu test results:
total: 488 pass: 488 fail: 0

Tested-by: Guenter Roeck <[email protected]>

Guenter

2022-02-15 03:58:48

by Naresh Kamboju

[permalink] [raw]
Subject: Re: [PATCH 5.15 000/172] 5.15.24-rc1 review

On Mon, 14 Feb 2022 at 15:16, Greg Kroah-Hartman
<[email protected]> wrote:
>
> This is the start of the stable review cycle for the 5.15.24 release.
> There are 172 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 16 Feb 2022 09:24:36 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.24-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h

Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.

Tested-by: Linux Kernel Functional Testing <[email protected]>

## Build
* kernel: 5.15.24-rc1
* git: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
* git branch: linux-5.15.y
* git commit: 2092ea8331071900a0b3ed6ce06daae663215b92
* git describe: v5.15.23-173-g2092ea833107
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-5.15.y/build/v5.15.23-173-g2092ea833107

## Test Regressions (compared to v5.15.22-6-g722769939d60)
No test regressions found.

## Metric Regressions (compared to v5.15.22-6-g722769939d60)
No metric regressions found.

## Test Fixes (compared to v5.15.22-6-g722769939d60)
No test fixes found.

## Metric Fixes (compared to v5.15.22-6-g722769939d60)
No metric fixes found.

## Test result summary
total: 98687, pass: 84389, fail: 1195, skip: 12142, xfail: 961


## Build Summary
* arc: 10 total, 10 passed, 0 failed
* arm: 263 total, 261 passed, 2 failed
* arm64: 42 total, 40 passed, 2 failed
* dragonboard-410c: 1 total, 1 passed, 0 failed
* hi6220-hikey: 1 total, 1 passed, 0 failed
* i386: 40 total, 37 passed, 3 failed
* juno-r2: 1 total, 1 passed, 0 failed
* mips: 37 total, 35 passed, 2 failed
* parisc: 14 total, 14 passed, 0 failed
* powerpc: 56 total, 40 passed, 16 failed
* riscv: 28 total, 24 passed, 4 failed
* s390: 22 total, 20 passed, 2 failed
* sh: 26 total, 24 passed, 2 failed
* sparc: 14 total, 14 passed, 0 failed
* x15: 1 total, 1 passed, 0 failed
* x86: 1 total, 1 passed, 0 failed
* x86_64: 42 total, 42 passed, 0 failed

## Test suites summary
* fwts
* igt-gpu-tools
* kselftest-
* kselftest-android
* kselftest-arm64
* kselftest-arm64/arm64.btitest.bti_c_func
* kselftest-arm64/arm64.btitest.bti_j_func
* kselftest-arm64/arm64.btitest.bti_jc_func
* kselftest-arm64/arm64.btitest.bti_none_func
* kselftest-arm64/arm64.btitest.nohint_func
* kselftest-arm64/arm64.btitest.paciasp_func
* kselftest-arm64/arm64.nobtitest.bti_c_func
* kselftest-arm64/arm64.nobtitest.bti_j_func
* kselftest-arm64/arm64.nobtitest.bti_jc_func
* kselftest-arm64/arm64.nobtitest.bti_none_func
* kselftest-arm64/arm64.nobtitest.nohint_func
* kselftest-arm64/arm64.nobtitest.paciasp_func
* kselftest-bpf
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-drivers
* kselftest-efivarfs
* kselftest-filesystems
* kselftest-firmware
* kselftest-fpu
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-ir
* kselftest-kcmp
* kselftest-kexec
* kselftest-kvm
* kselftest-lib
* kselftest-livepatch
* kselftest-lkdtm
* kselftest-membarrier
* kselftest-memfd
* kselftest-memory-hotplug
* kselftest-mincore
* kselftest-mount
* kselftest-mqueue
* kselftest-net
* kselftest-netfilter
* kselftest-nsfs
* kselftest-openat2
* kselftest-pid_namespace
* kselftest-pidfd
* kselftest-proc
* kselftest-pstore
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-splice
* kselftest-static_keys
* kselftest-sync
* kselftest-sysctl
* kselftest-tc-testing
* kselftest-timens
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user
* kselftest-vm
* kselftest-x86
* kselftest-zram
* kunit
* kvm-unit-tests
* libgpiod
* libhugetlbfs
* linux-log-parser
* ltp-cap_bounds-tests
* ltp-commands-tests
* ltp-containers-tests
* ltp-controllers-tests
* ltp-cpuhotplug-tests
* ltp-crypto-tests
* ltp-cve-tests
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-open-posix-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* ltp-tracing-tests
* network-basic-tests
* packetdrill
* perf
* rcutorture
* ssuite
* v4l2-compliance

--
Linaro LKFT
https://lkft.linaro.org

2022-02-15 08:33:03

by Ron Economos

[permalink] [raw]
Subject: Re: [PATCH 5.15 000/172] 5.15.24-rc1 review

On 2/14/22 01:24, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.15.24 release.
> There are 172 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 16 Feb 2022 09:24:36 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.24-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h

Built and booted successfully on RISC-V RV64 (HiFive Unmatched).

Tested-by: Ron Economos <[email protected]>

2022-02-15 10:01:49

by Bagas Sanjaya

[permalink] [raw]
Subject: Re: [PATCH 5.15 000/172] 5.15.24-rc1 review

On 14/02/22 16.24, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.15.24 release.
> There are 172 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>

Successfully cross-compiled for arm64 (bcm2711_defconfig, clang 13.0.1)
and powerpc (ps3_defconfig, gcc 11.2.0).

Tested-by: Bagas Sanjaya <[email protected]>

--
An old man doll... just what I always wanted! - Clara