Commit Graph

1165241 Commits

Author SHA1 Message Date
Ferry Meng
9b32539590 ocfs2: add bounds checking to ocfs2_xattr_find_entry()
[ Upstream commit 9e3041fecdc8f78a5900c3aa51d3d756e73264d6 ]

Add a paranoia check to make sure it doesn't stray beyond valid memory
region containing ocfs2 xattr entries when scanning for a match.  It will
prevent out-of-bound access in case of crafted images.

Link: https://lkml.kernel.org/r/20240520024024.1976129-1-joseph.qi@linux.alibaba.com
Signed-off-by: Ferry Meng <mengferry@linux.alibaba.com>
Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Reported-by: lei lu <llfamsec@gmail.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Gang He <ghe@suse.com>
Cc: Jun Piao <piaojun@huawei.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Stable-dep-of: af77c4fc1871 ("ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-09-30 16:23:50 +02:00
Geert Uytterhoeven
8220c3e2ab spi: spidev: Add missing spi_device_id for jg10309-01
[ Upstream commit 5478a4f7b94414def7b56d2f18bc2ed9b0f3f1f2 ]

When the of_device_id entry for "elgin,jg10309-01" was added, the
corresponding spi_device_id was forgotten, causing a warning message
during boot-up:

    SPI driver spidev has no spi_device_id for elgin,jg10309-01

Fix module autoloading and shut up the warning by adding the missing
entry.

Fixes: 5f3eee1eef5d0edd ("spi: spidev: Add an entry for elgin,jg10309-01")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/54bbb9d8a8db7e52d13e266f2d4a9bcd8b42a98a.1725366625.git.geert+renesas@glider.be
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-09-30 16:23:50 +02:00
Hongyu Jin
892a5d4f1c block: Fix where bio IO priority gets set
[ Upstream commit f3c89983cb4fc00be64eb0d5cbcfcdf2cacb965e ]

Commit 82b74cac28 ("blk-ioprio: Convert from rqos policy to direct
call") pushed setting bio I/O priority down into blk_mq_submit_bio()
-- which is too low within block core's submit_bio() because it
skips setting I/O priority for block drivers that implement
fops->submit_bio() (e.g. DM, MD, etc).

Fix this by moving bio_set_ioprio() up from blk-mq.c to blk-core.c and
call it from submit_bio().  This ensures all block drivers call
bio_set_ioprio() during initial bio submission.

Fixes: a78418e6a0 ("block: Always initialize bio IO priority on submit")
Co-developed-by: Yibin Ding <yibin.ding@unisoc.com>
Signed-off-by: Yibin Ding <yibin.ding@unisoc.com>
Signed-off-by: Hongyu Jin <hongyu.jin@unisoc.com>
Reviewed-by: Eric Biggers <ebiggers@google.com>
Reviewed-by: Mikulas Patocka <mpatocka@redhat.com>
[snitzer: revised commit header]
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Link: https://lore.kernel.org/r/20240130202638.62600-2-snitzer@kernel.org
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-09-30 16:23:50 +02:00
zhang jiao
ff913aff00 tools: hv: rm .*.cmd when make clean
[ Upstream commit 5e5cc1eb65256e6017e3deec04f9806f2f317853 ]

rm .*.cmd when make clean

Signed-off-by: zhang jiao <zhangjiao2@cmss.chinamobile.com>
Reviewed-by: Saurabh Sengar <ssengar@linux.microsoft.com>
Link: https://lore.kernel.org/r/20240902042103.5867-1-zhangjiao2@cmss.chinamobile.com
Signed-off-by: Wei Liu <wei.liu@kernel.org>
Message-ID: <20240902042103.5867-1-zhangjiao2@cmss.chinamobile.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-09-30 16:23:50 +02:00
Michael Kelley
0b78afa66d x86/hyperv: Set X86_FEATURE_TSC_KNOWN_FREQ when Hyper-V provides frequency
[ Upstream commit 8fcc514809de41153b43ccbe1a0cdf7f72b78e7e ]

A Linux guest on Hyper-V gets the TSC frequency from a synthetic MSR, if
available. In this case, set X86_FEATURE_TSC_KNOWN_FREQ so that Linux
doesn't unnecessarily do refined TSC calibration when setting up the TSC
clocksource.

With this change, a message such as this is no longer output during boot
when the TSC is used as the clocksource:

[    1.115141] tsc: Refined TSC clocksource calibration: 2918.408 MHz

Furthermore, the guest and host will have exactly the same view of the
TSC frequency, which is important for features such as the TSC deadline
timer that are emulated by the Hyper-V host.

Signed-off-by: Michael Kelley <mhklinux@outlook.com>
Reviewed-by: Roman Kisel <romank@linux.microsoft.com>
Link: https://lore.kernel.org/r/20240606025559.1631-1-mhklinux@outlook.com
Signed-off-by: Wei Liu <wei.liu@kernel.org>
Message-ID: <20240606025559.1631-1-mhklinux@outlook.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-09-30 16:23:50 +02:00
Paulo Alcantara
123c2d18f8 smb: client: fix hang in wait_for_response() for negproto
[ Upstream commit 7ccc1465465d78e6411b7bd730d06e7435802b5c ]

Call cifs_reconnect() to wake up processes waiting on negotiate
protocol to handle the case where server abruptly shut down and had no
chance to properly close the socket.

Simple reproducer:

  ssh 192.168.2.100 pkill -STOP smbd
  mount.cifs //192.168.2.100/test /mnt -o ... [never returns]

Cc: Rickard Andersson <rickaran@axis.com>
Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-09-30 16:23:49 +02:00
Liao Chen
a4a5a153df spi: bcm63xx: Enable module autoloading
[ Upstream commit 709df70a20e990d262c473ad9899314039e8ec82 ]

Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded based
on the alias from of_device_id table.

Signed-off-by: Liao Chen <liaochen4@huawei.com>
Link: https://patch.msgid.link/20240831094231.795024-1-liaochen4@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-09-30 16:23:49 +02:00
hongchi.peng
74968adcec drm: komeda: Fix an issue related to normalized zpos
[ Upstream commit 258905cb9a6414be5c9ca4aa20ef855f8dc894d4 ]

We use komeda_crtc_normalize_zpos to normalize zpos of affected planes
to their blending zorder in CU. If there's only one slave plane in
affected planes and its layer_split property is enabled, order++ for
its split layer, so that when calculating the normalized_zpos
of master planes, the split layer of the slave plane is included, but
the max_slave_zorder does not include the split layer and keep zero
because there's only one slave plane in affacted planes, although we
actually use two slave layers in this commit.

In most cases, this bug does not result in a commit failure, but assume
the following situation:
    slave_layer 0: zpos = 0, layer split enabled, normalized_zpos =
    0;(use slave_layer 2 as its split layer)
    master_layer 0: zpos = 2, layer_split enabled, normalized_zpos =
    2;(use master_layer 2 as its split layer)
    master_layer 1: zpos = 4, normalized_zpos = 4;
    master_layer 3: zpos = 5, normalized_zpos = 5;
    kcrtc_st->max_slave_zorder = 0;
When we use master_layer 3 as a input of CU in function
komeda_compiz_set_input and check it with function
komeda_component_check_input, the parameter idx is equal to
normailzed_zpos minus max_slave_zorder, the value of idx is 5
and is euqal to CU's max_active_inputs, so that
komeda_component_check_input returns a -EINVAL value.

To fix the bug described above, when calculating the max_slave_zorder
with the layer_split enabled, count the split layer in this calculation
directly.

Signed-off-by: hongchi.peng <hongchi.peng@siengine.com>
Acked-by: Liviu Dudau <liviu.dudau@arm.com>
Signed-off-by: Liviu Dudau <liviu.dudau@arm.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20240826024517.3739-1-hongchi.peng@siengine.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-09-30 16:23:49 +02:00
Fabio Estevam
fbef47f590 spi: spidev: Add an entry for elgin,jg10309-01
[ Upstream commit 5f3eee1eef5d0edd23d8ac0974f56283649a1512 ]

The rv1108-elgin-r1 board has an LCD controlled via SPI in userspace.
The marking on the LCD is JG10309-01.

Add the "elgin,jg10309-01" compatible string.

Signed-off-by: Fabio Estevam <festevam@gmail.com>
Reviewed-by: Heiko Stuebner <heiko@sntech.de>
Link: https://patch.msgid.link/20240828180057.3167190-2-festevam@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-09-30 16:23:49 +02:00
Liao Chen
d404252ae7 ASoC: tda7419: fix module autoloading
[ Upstream commit 934b44589da9aa300201a00fe139c5c54f421563 ]

Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded
based on the alias from of_device_id table.

Signed-off-by: Liao Chen <liaochen4@huawei.com>
Link: https://patch.msgid.link/20240826084924.368387-4-liaochen4@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-09-30 16:23:49 +02:00
Liao Chen
b013a1e770 ASoC: intel: fix module autoloading
[ Upstream commit ae61a3391088d29aa8605c9f2db84295ab993a49 ]

Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded
based on the alias from of_device_id table.

Signed-off-by: Liao Chen <liaochen4@huawei.com>
Link: https://patch.msgid.link/20240826084924.368387-2-liaochen4@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-09-30 16:23:49 +02:00
Hans de Goede
62386a1614 ASoC: Intel: soc-acpi-cht: Make Lenovo Yoga Tab 3 X90F DMI match less strict
[ Upstream commit 839a4ec06f75cec8fec2cc5fc14e921d0c3f7369 ]

There are 2G and 4G RAM versions of the Lenovo Yoga Tab 3 X90F and it
turns out that the 2G version has a DMI product name of
"CHERRYVIEW D1 PLATFORM" where as the 4G version has
"CHERRYVIEW C0 PLATFORM". The sys-vendor + product-version check are
unique enough that the product-name check is not necessary.

Drop the product-name check so that the existing DMI match for the 4G
RAM version also matches the 2G RAM version.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://patch.msgid.link/20240823074305.16873-1-hdegoede@redhat.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-09-30 16:23:49 +02:00
Marc Kleine-Budde
f1e32334e9 can: mcp251xfd: mcp251xfd_ring_init(): check TX-coalescing configuration
[ Upstream commit ac2b81eb8b2d104033560daea886ee84531e3d0a ]

When changing the interface from CAN-CC to CAN-FD mode the old
coalescing parameters are re-used. This might cause problem, as the
configured parameters are too big for CAN-FD mode.

During testing an invalid TX coalescing configuration has been seen.
The problem should be been fixed in the previous patch, but add a
safeguard here to ensure that the number of TEF coalescing buffers (if
configured) is exactly the half of all TEF buffers.

Link: https://lore.kernel.org/all/20240805-mcp251xfd-fix-ringconfig-v1-2-72086f0ca5ee@pengutronix.de
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-09-30 16:23:48 +02:00
Emmanuel Grumbach
fef6432edc wifi: iwlwifi: clear trans->state earlier upon error
[ Upstream commit 094513f8a2fbddee51b055d8035f995551f98fce ]

When the firmware crashes, we first told the op_mode and only then,
changed the transport's state. This is a problem if the op_mode's
nic_error() handler needs to send a host command: it'll see that the
transport's state still reflects that the firmware is alive.

Today, this has no consequences since we set the STATUS_FW_ERROR bit and
that will prevent sending host commands. iwl_fw_dbg_stop_restart_recording
looks at this bit to know not to send a host command for example.

To fix the hibernation, we needed to reset the firmware without having
an error and checking STATUS_FW_ERROR to see whether the firmware is
alive will no longer hold, so this change is necessary as well.

Change the flow a bit.
Change trans->state before calling the op_mode's nic_error() method and
check trans->state instead of STATUS_FW_ERROR. This will keep the
current behavior of iwl_fw_dbg_stop_restart_recording upon firmware
error, and it'll allow us to call iwl_fw_dbg_stop_restart_recording
safely even if STATUS_FW_ERROR is clear, but yet, the firmware is not
alive.

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20240825191257.9d7427fbdfd7.Ia056ca57029a382c921d6f7b6a6b28fc480f2f22@changeid
[I missed this was a dependency for the hibernation fix, changed
 the commit message a bit accordingly]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-09-30 16:23:48 +02:00
Dmitry Antipov
a8c48e7b83 wifi: mac80211: free skb on error path in ieee80211_beacon_get_ap()
[ Upstream commit 786c5be9ac29a39b6f37f1fdd2ea59d0fe35d525 ]

In 'ieee80211_beacon_get_ap()', free allocated skb in case of error
returned by 'ieee80211_beacon_protect()'. Compile tested only.

Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Link: https://patch.msgid.link/20240805142035.227847-1-dmantipov@yandex.ru
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-09-30 16:23:48 +02:00
Emmanuel Grumbach
1b0cd832c9 wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead
[ Upstream commit 3a84454f5204718ca5b4ad2c1f0bf2031e2403d1 ]

There is a WARNING in iwl_trans_wait_tx_queues_empty() (that was
recently converted from just a message), that can be hit if we
wait for TX queues to become empty after firmware died. Clearly,
we can't expect anything from the firmware after it's declared dead.

Don't call iwl_trans_wait_tx_queues_empty() in this case. While it could
be a good idea to stop the flow earlier, the flush functions do some
maintenance work that is not related to the firmware, so keep that part
of the code running even when the firmware is not running.

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20240825191257.a7cbd794cee9.I44a739fbd4ffcc46b83844dd1c7b2eb0c7b270f6@changeid
[edit commit message]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-09-30 16:23:48 +02:00
Emmanuel Grumbach
5948a19190 wifi: iwlwifi: mvm: pause TCM when the firmware is stopped
[ Upstream commit 0668ebc8c2282ca1e7eb96092a347baefffb5fe7 ]

Not doing so will make us send a host command to the transport while the
firmware is not alive, which will trigger a WARNING.

bad state = 0
WARNING: CPU: 2 PID: 17434 at drivers/net/wireless/intel/iwlwifi/iwl-trans.c:115 iwl_trans_send_cmd+0x1cb/0x1e0 [iwlwifi]
RIP: 0010:iwl_trans_send_cmd+0x1cb/0x1e0 [iwlwifi]
Call Trace:
 <TASK>
 iwl_mvm_send_cmd+0x40/0xc0 [iwlmvm]
 iwl_mvm_config_scan+0x198/0x260 [iwlmvm]
 iwl_mvm_recalc_tcm+0x730/0x11d0 [iwlmvm]
 iwl_mvm_tcm_work+0x1d/0x30 [iwlmvm]
 process_one_work+0x29e/0x640
 worker_thread+0x2df/0x690
 ? rescuer_thread+0x540/0x540
 kthread+0x192/0x1e0
 ? set_kthread_struct+0x90/0x90
 ret_from_fork+0x22/0x30

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20240825191257.5abe71ca1b6b.I97a968cb8be1f24f94652d9b110ecbf6af73f89e@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-09-30 16:23:48 +02:00
Daniel Gabay
051e6cce7a wifi: iwlwifi: mvm: fix iwl_mvm_scan_fits() calculation
[ Upstream commit d44162280899c3fc2c6700e21e491e71c3c96e3d ]

The calculation should consider also the 6GHz IE's len, fix that.
In addition, in iwl_mvm_sched_scan_start() the scan_fits helper is
called only in case non_psc_incldued is true, but it should be called
regardless, fix that as well.

Signed-off-by: Daniel Gabay <daniel.gabay@intel.com>
Reviewed-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20240825191257.7db825442fd2.I99f4d6587709de02072fd57957ec7472331c6b1d@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-09-30 16:23:48 +02:00
Benjamin Berg
ba94a887d2 wifi: iwlwifi: lower message level for FW buffer destination
[ Upstream commit f8a129c1e10256c785164ed5efa5d17d45fbd81b ]

An invalid buffer destination is not a problem for the driver and it
does not make sense to report it with the KERN_ERR message level. As
such, change the message to use IWL_DEBUG_FW.

Reported-by: Len Brown <lenb@kernel.org>
Closes: https://lore.kernel.org/r/CAJvTdKkcxJss=DM2sxgv_MR5BeZ4_OC-3ad6tA40TYH2yqHCWw@mail.gmail.com
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20240825191257.20abf78f05bc.Ifbcecc2ae9fb40b9698302507dcba8b922c8d856@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-09-30 16:23:48 +02:00
Huacai Chen
f0eb100965 LoongArch: Define ARCH_IRQ_INIT_FLAGS as IRQ_NOPROBE
[ Upstream commit 274ea3563e5ab9f468c15bfb9d2492803a66d9be ]

Currently we call irq_set_noprobe() in a loop for all IRQs, but indeed
it only works for IRQs below NR_IRQS_LEGACY because at init_IRQ() only
legacy interrupts have been allocated.

Instead, we can define ARCH_IRQ_INIT_FLAGS as IRQ_NOPROBE in asm/hwirq.h
and the core will automatically set the flag for all interrupts.

Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Tianyang Zhang <zhangtianyang@loongson.cn>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-09-30 16:23:47 +02:00
Jacky Chou
bb06a6e78e net: ftgmac100: Ensure tx descriptor updates are visible
[ Upstream commit 4186c8d9e6af57bab0687b299df10ebd47534a0a ]

The driver must ensure TX descriptor updates are visible
before updating TX pointer and TX clear pointer.

This resolves TX hangs observed on AST2600 when running
iperf3.

Signed-off-by: Jacky Chou <jacky_chou@aspeedtech.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-09-30 16:23:47 +02:00
Mike Rapoport
2e76799725 microblaze: don't treat zero reserved memory regions as error
[ Upstream commit 0075df288dd8a7abfe03b3766176c393063591dd ]

Before commit 721f4a6526da ("mm/memblock: remove empty dummy entry") the
check for non-zero of memblock.reserved.cnt in mmu_init() would always
be true either because  memblock.reserved.cnt is initialized to 1 or
because there were memory reservations earlier.

The removal of dummy empty entry in memblock caused this check to fail
because now memblock.reserved.cnt is initialized to 0.

Remove the check for non-zero of memblock.reserved.cnt because it's
perfectly fine to have an empty memblock.reserved array that early in
boot.

Reported-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Mike Rapoport <rppt@kernel.org>
Reviewed-by: Wei Yang <richard.weiyang@gmail.com>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20240729053327.4091459-1-rppt@kernel.org
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-09-30 16:23:47 +02:00
Ross Brown
0bc618a68e hwmon: (asus-ec-sensors) remove VRM temp X570-E GAMING
[ Upstream commit 9efaebc0072b8e95505544bf385c20ee8a29d799 ]

X570-E GAMING does not have VRM temperature sensor.

Signed-off-by: Ross Brown <true.robot.ross@gmail.com>
Signed-off-by: Eugene Shalygin <eugene.shalygin@gmail.com>
Link: https://lore.kernel.org/r/20240730062320.5188-2-eugene.shalygin@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-09-30 16:23:47 +02:00
Thomas Blocher
2fcf56f513 pinctrl: at91: make it work with current gpiolib
[ Upstream commit 752f387faaae0ae2e84d3f496922524785e77d60 ]

pinctrl-at91 currently does not support the gpio-groups devicetree
property and has no pin-range.
Because of this at91 gpios stopped working since patch
commit 2ab73c6d83 ("gpio: Support GPIO controllers without pin-ranges")
This was discussed in the patches
commit fc328a7d1f ("gpio: Revert regression in sysfs-gpio (gpiolib.c)")
commit 56e337f2cf ("Revert "gpio: Revert regression in sysfs-gpio (gpiolib.c)"")

As a workaround manually set pin-range via gpiochip_add_pin_range() until
a) pinctrl-at91 is reworked to support devicetree gpio-groups
b) another solution as mentioned in
commit 56e337f2cf ("Revert "gpio: Revert regression in sysfs-gpio (gpiolib.c)"")
is found

Signed-off-by: Thomas Blocher <thomas.blocher@ek-dev.de>
Link: https://lore.kernel.org/5b992862-355d-f0de-cd3d-ff99e67a4ff1@ek-dev.de
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-09-30 16:23:47 +02:00
Sherry Yang
5e2a30d6e9 scsi: lpfc: Fix overflow build issue
[ Upstream commit 3417c9574e368f0330637505f00d3814ca8854d2 ]

Build failed while enabling "CONFIG_GCOV_KERNEL=y" and
"CONFIG_GCOV_PROFILE_ALL=y" with following error:

BUILDSTDERR: drivers/scsi/lpfc/lpfc_bsg.c: In function 'lpfc_get_cgnbuf_info':
BUILDSTDERR: ./include/linux/fortify-string.h:114:33: error: '__builtin_memcpy' accessing 18446744073709551615 bytes at offsets 0 and 0 overlaps 9223372036854775807 bytes at offset -9223372036854775808 [-Werror=restrict]
BUILDSTDERR:   114 | #define __underlying_memcpy     __builtin_memcpy
BUILDSTDERR:       |                                 ^
BUILDSTDERR: ./include/linux/fortify-string.h:637:9: note: in expansion of macro '__underlying_memcpy'
BUILDSTDERR:   637 |         __underlying_##op(p, q, __fortify_size);                        \
BUILDSTDERR:       |         ^~~~~~~~~~~~~
BUILDSTDERR: ./include/linux/fortify-string.h:682:26: note: in expansion of macro '__fortify_memcpy_chk'
BUILDSTDERR:   682 | #define memcpy(p, q, s)  __fortify_memcpy_chk(p, q, s,                  \
BUILDSTDERR:       |                          ^~~~~~~~~~~~~~~~~~~~
BUILDSTDERR: drivers/scsi/lpfc/lpfc_bsg.c:5468:9: note: in expansion of macro 'memcpy'
BUILDSTDERR:  5468 |         memcpy(cgn_buff, cp, cinfosz);
BUILDSTDERR:       |         ^~~~~~

This happens from the commit 06bb7fc0feee ("kbuild: turn on -Wrestrict by
default"). Address this issue by using size_t type.

Signed-off-by: Sherry Yang <sherry.yang@oracle.com>
Link: https://lore.kernel.org/r/20240821065131.1180791-1-sherry.yang@oracle.com
Reviewed-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-09-30 16:23:47 +02:00
Kailang Yang
fce0cddf7e ALSA: hda/realtek - FIxed ALC285 headphone no sound
[ Upstream commit 1fa7b099d60ad64f559bd3b8e3f0d94b2e015514 ]

Dell platform with ALC215 ALC285 ALC289 ALC225 ALC295 ALC299, plug
headphone or headset.
It had a chance to get no sound from headphone.
Replace depop procedure will solve this issue.

Signed-off-by: Kailang Yang <kailang@realtek.com>
Link: https://lore.kernel.org/d0de1b03fd174520945dde216d765223@realtek.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-09-30 16:23:47 +02:00
Kailang Yang
85ba7682ee ALSA: hda/realtek - Fixed ALC256 headphone no sound
[ Upstream commit 9b82ff1362f50914c8292902e07be98a9f59d33d ]

Dell platform, plug headphone or headset, it had a chance to get no
sound from headphone.
Replace depop procedure will solve this issue.

Signed-off-by: Kailang Yang <kailang@realtek.com>
Link: https://lore.kernel.org/bb8e2de30d294dc287944efa0667685a@realtek.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-09-30 16:23:47 +02:00
Hongbo Li
555e0d606a ASoC: allow module autoloading for table board_ids
[ Upstream commit 5f7c98b7519a3a847d9182bd99d57ea250032ca1 ]

Add MODULE_DEVICE_TABLE(), so modules could be properly
autoloaded based on the alias from platform_device_id table.

Signed-off-by: Hongbo Li <lihongbo22@huawei.com>
Link: https://patch.msgid.link/20240821061955.2273782-3-lihongbo22@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-09-30 16:23:46 +02:00
Hongbo Li
9434465f3a ASoC: allow module autoloading for table db1200_pids
[ Upstream commit 0e9fdab1e8df490354562187cdbb8dec643eae2c ]

Add MODULE_DEVICE_TABLE(), so modules could be properly
autoloaded based on the alias from platform_device_id table.

Signed-off-by: Hongbo Li <lihongbo22@huawei.com>
Link: https://patch.msgid.link/20240821061955.2273782-2-lihongbo22@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-09-30 16:23:46 +02:00
Albert Jakieła
39d4d5a285 ASoC: SOF: mediatek: Add missing board compatible
[ Upstream commit c0196faaa927321a63e680427e075734ee656e42 ]

Add Google Dojo compatible.

Signed-off-by: Albert Jakieła <jakiela@google.com>
Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
Link: https://patch.msgid.link/20240809135627.544429-1-jakiela@google.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-09-30 16:23:46 +02:00
Faisal Hassan
1105954181 UPSTREAM: usb: dwc3: core: update LC timer as per USB Spec V3.2
This fix addresses STAR 9001285599, which only affects DWC_usb3 version
3.20a. The timer value for PM_LC_TIMER in DWC_usb3 3.20a for the Link
ECN changes is incorrect. If the PM TIMER ECN is enabled via GUCTL2[19],
the link compliance test (TD7.21) may fail. If the ECN is not enabled
(GUCTL2[19] = 0), the controller will use the old timer value (5us),
which is still acceptable for the link compliance test. Therefore, clear
GUCTL2[19] to pass the USB link compliance test: TD 7.21.

Cc: stable@vger.kernel.org
Signed-off-by: Faisal Hassan <quic_faisalh@quicinc.com>
Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://lore.kernel.org/r/20240829094502.26502-1-quic_faisalh@quicinc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

(cherry picked from commit 9149c9b0c7e046273141e41eebd8a517416144ac
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master)

Bug: 366400205
Change-Id: I8708984ce6c626df0c02045199301aa536520e83
Signed-off-by: Faisal Hassan <quic_faisalh@quicinc.com>
2024-09-27 18:42:18 +00:00
Greg Kroah-Hartman
4786dae0bb Merge 6.1.106 into android14-6.1-lts
Changes in 6.1.106
	mptcp: pass addr to mptcp_pm_alloc_anno_list
	mptcp: pm: reduce indentation blocks
	mptcp: pm: don't try to create sf if alloc failed
	mptcp: pm: do not ignore 'subflow' if 'signal' flag is also set
	selftests: mptcp: join: test both signal & subflow
	ASoC: topology: Clean up route loading
	ASoC: topology: Fix route memory corruption
	exec: Fix ToCToU between perm check and set-uid/gid usage
	LoongArch: Define __ARCH_WANT_NEW_STAT in unistd.h
	nfsd: move reply cache initialization into nfsd startup
	nfsd: move init of percpu reply_cache_stats counters back to nfsd_init_net
	NFSD: Refactor nfsd_reply_cache_free_locked()
	NFSD: Rename nfsd_reply_cache_alloc()
	NFSD: Replace nfsd_prune_bucket()
	NFSD: Refactor the duplicate reply cache shrinker
	NFSD: Rewrite synopsis of nfsd_percpu_counters_init()
	NFSD: Fix frame size warning in svc_export_parse()
	sunrpc: don't change ->sv_stats if it doesn't exist
	nfsd: stop setting ->pg_stats for unused stats
	sunrpc: pass in the sv_stats struct through svc_create_pooled
	sunrpc: remove ->pg_stats from svc_program
	sunrpc: use the struct net as the svc proc private
	nfsd: rename NFSD_NET_* to NFSD_STATS_*
	nfsd: expose /proc/net/sunrpc/nfsd in net namespaces
	nfsd: make all of the nfsd stats per-network namespace
	nfsd: remove nfsd_stats, make th_cnt a global counter
	nfsd: make svc_stat per-network namespace instead of global
	nvme/pci: Add APST quirk for Lenovo N60z laptop
	mptcp: fully established after ADD_ADDR echo on MPJ
	drm/i915/gem: Fix Virtual Memory mapping boundaries calculation
	cgroup: Make operations on the cgroup root_list RCU safe
	drm/i915: Add a function to mmap framebuffer obj
	drm/i915: Fix a NULL vs IS_ERR() bug
	drm/i915/gem: Adjust vma offset for framebuffer mmap offset
	binfmt_flat: Fix corruption when not offsetting data start
	cgroup: Move rcu_head up near the top of cgroup_root
	wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values
	KVM: arm64: Don't pass a TLBI level hint when zapping table entries
	media: Revert "media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()"
	Revert "ata: libata-scsi: Honor the D_SENSE bit for CK_COND=1 and no error"
	Linux 6.1.106

Change-Id: Ibdd04313504f34a755a47f1db5def7869ce7882a
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2024-09-27 14:54:53 +00:00
Greg Kroah-Hartman
0450b5433d ANDROID: fix up abi break in arm64 cpu_hwcaps
In commit 286c8ca924 ("arm64: errata: Add workaround for Arm errata
3194386 and 3312417"), we add a new cpucap type, but as that breaks the
existing kernel ABI for Android systems, we need to properly use one of
the reserved slots for it instead of adding a new one.

Fixes: 286c8ca924 ("arm64: errata: Add workaround for Arm errata 3194386 and 3312417")
Change-Id: I7bbb7ffcc59cbfa9a1f03f7081df3387b8151a86
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2024-09-27 14:10:46 +00:00
Greg Kroah-Hartman
d747db6875 Merge 6.1.105 into android14-6.1-lts
Changes in 6.1.105
	irqchip/mbigen: Fix mbigen node address layout
	platform/x86/intel/ifs: Gen2 Scan test support
	platform/x86/intel/ifs: Initialize union ifs_status to zero
	jump_label: Fix the fix, brown paper bags galore
	x86/mm: Fix pti_clone_pgtable() alignment assumption
	x86/mm: Fix pti_clone_entry_text() for i386
	sctp: Fix null-ptr-deref in reuseport_add_sock().
	net: usb: qmi_wwan: fix memory leak for not ip packets
	net: bridge: mcast: wait for previous gc cycles when removing port
	net: linkwatch: use system_unbound_wq
	Bluetooth: l2cap: always unlock channel in l2cap_conless_channel()
	Bluetooth: hci_sync: avoid dup filtering when passive scanning with adv monitor
	net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register()
	l2tp: fix lockdep splat
	net: fec: Stop PPS on driver remove
	rcutorture: Fix rcu_torture_fwd_cb_cr() data race
	md: do not delete safemode_timer in mddev_suspend
	md/raid5: avoid BUG_ON() while continue reshape after reassembling
	block: change rq_integrity_vec to respect the iterator
	rcu: Fix rcu_barrier() VS post CPUHP_TEARDOWN_CPU invocation
	clocksource/drivers/sh_cmt: Address race condition for clock events
	ACPI: battery: create alarm sysfs attribute atomically
	ACPI: SBS: manage alarm sysfs attribute through psy core
	wifi: nl80211: disallow setting special AP channel widths
	net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink
	selftests/bpf: Fix send_signal test with nested CONFIG_PARAVIRT
	af_unix: Don't retry after unix_state_lock_nested() in unix_stream_connect().
	PCI: Add Edimax Vendor ID to pci_ids.h
	udf: prevent integer overflow in udf_bitmap_free_blocks()
	wifi: nl80211: don't give key data to userspace
	can: mcp251xfd: tef: prepare to workaround broken TEF FIFO tail index erratum
	can: mcp251xfd: tef: update workaround for erratum DS80000789E 6 of mcp2518fd
	btrfs: fix bitmap leak when loading free space cache on duplicate entry
	drm/amdgpu/pm: Fix the param type of set_power_profile_mode
	drm/amdgpu/pm: Fix the null pointer dereference for smu7
	drm/amdgpu: Fix the null pointer dereference to ras_manager
	drm/amdgpu/pm: Fix the null pointer dereference in apply_state_adjust_rules
	drm/amdgpu: Add lock around VF RLCG interface
	drm/amd/pm: Fix the null pointer dereference for vega10_hwmgr
	media: amphion: Remove lock in s_ctrl callback
	drm/amd/display: Add NULL check for 'afb' before dereferencing in amdgpu_dm_plane_handle_cursor_update
	drm/amd/display: Add null checker before passing variables
	media: uvcvideo: Ignore empty TS packets
	media: uvcvideo: Fix the bandwdith quirk on USB 3.x
	media: xc2028: avoid use-after-free in load_firmware_cb()
	ext4: fix uninitialized variable in ext4_inlinedir_to_tree
	jbd2: avoid memleak in jbd2_journal_write_metadata_buffer
	s390/sclp: Prevent release of buffer in I/O
	SUNRPC: Fix a race to wake a sync task
	bus: mhi: host: pci_generic: add support for Telit FE990 modem
	Revert "bpftool: Mount bpffs when pinmaps path not under the bpffs"
	profiling: remove profile=sleep support
	scsi: mpt3sas: Avoid IOMMU page faults on REPORT ZONES
	irqchip/meson-gpio: Convert meson_gpio_irq_controller::lock to 'raw_spinlock_t'
	irqchip/loongarch-cpu: Fix return value of lpic_gsi_to_irq()
	sched/cputime: Fix mul_u64_u64_div_u64() precision for cputime
	ext4: fix wrong unit use in ext4_mb_find_by_goal
	arm64: Add Neoverse-V2 part
	arm64: barrier: Restore spec_bar() macro
	arm64: cputype: Add Cortex-X4 definitions
	arm64: cputype: Add Neoverse-V3 definitions
	arm64: errata: Add workaround for Arm errata 3194386 and 3312417
	arm64: cputype: Add Cortex-X3 definitions
	arm64: cputype: Add Cortex-A720 definitions
	arm64: cputype: Add Cortex-X925 definitions
	arm64: errata: Unify speculative SSBS errata logic
	arm64: errata: Expand speculative SSBS workaround
	arm64: cputype: Add Cortex-X1C definitions
	arm64: cputype: Add Cortex-A725 definitions
	arm64: errata: Expand speculative SSBS workaround (again)
	i2c: smbus: Improve handling of stuck alerts
	ASoC: codecs: wcd938x-sdw: Correct Soundwire ports mask
	ASoC: codecs: wsa881x: Correct Soundwire ports mask
	ASoC: codecs: wsa883x: parse port-mapping information
	ASoC: codecs: wsa883x: Correct Soundwire ports mask
	spi: spidev: Add missing spi_device_id for bh2228fv
	ASoC: SOF: Remove libraries from topology lookups
	i2c: smbus: Send alert notifications to all devices if source not found
	bpf: kprobe: remove unused declaring of bpf_kprobe_override
	kprobes: Fix to check symbol prefixes correctly
	i2c: qcom-geni: add desc struct to prepare support for I2C Master Hub variant
	i2c: qcom-geni: Add missing clk_disable_unprepare in geni_i2c_runtime_resume
	i2c: qcom-geni: Add missing geni_icc_disable in geni_i2c_runtime_resume
	spi: spi-fsl-lpspi: Fix scldiv calculation
	ALSA: usb-audio: Re-add ScratchAmp quirk entries
	ASoC: meson: axg-fifo: fix irq scheduling issue with PREEMPT_RT
	drm/amd/display: Skip Recompute DSC Params if no Stream on Link
	drm/client: fix null pointer dereference in drm_client_modeset_probe
	ALSA: line6: Fix racy access to midibuf
	ALSA: hda: Add HP MP9 G4 Retail System AMS to force connect list
	ALSA: hda/realtek: Add Framework Laptop 13 (Intel Core Ultra) to quirks
	ALSA: hda/hdmi: Yet more pin fix for HP EliteDesk 800 G4
	usb: vhci-hcd: Do not drop references before new references are gained
	USB: serial: debug: do not echo input by default
	usb: gadget: core: Check for unset descriptor
	usb: gadget: u_serial: Set start_delayed during suspend
	usb: gadget: u_audio: Check return codes from usb_ep_enable and config_ep_by_speed.
	scsi: mpi3mr: Avoid IOMMU page faults on REPORT ZONES
	scsi: ufs: core: Fix hba->last_dme_cmd_tstamp timestamp updating logic
	tick/broadcast: Move per CPU pointer access into the atomic section
	vhost-vdpa: switch to use vmf_insert_pfn() in the fault handler
	ntp: Clamp maxerror and esterror to operating range
	torture: Enable clocksource watchdog with "tsc=watchdog"
	clocksource: Scale the watchdog read retries automatically
	clocksource: Fix brown-bag boolean thinko in cs_watchdog_read()
	driver core: Fix uevent_show() vs driver detach race
	ntp: Safeguard against time_constant overflow
	timekeeping: Fix bogus clock_was_set() invocation in do_adjtimex()
	serial: core: check uartclk for zero to avoid divide by zero
	ASoC: amd: yc: Add quirk entry for OMEN by HP Gaming Laptop 16-n0xxx
	kcov: properly check for softirq context
	irqchip/xilinx: Fix shift out of bounds
	genirq/irqdesc: Honor caller provided affinity in alloc_desc()
	power: supply: axp288_charger: Fix constant_charge_voltage writes
	power: supply: axp288_charger: Round constant_charge_voltage writes down
	tracing: Fix overflow in get_free_elt()
	padata: Fix possible divide-by-0 panic in padata_mt_helper()
	smb3: fix setting SecurityFlags when encryption is required
	btrfs: avoid using fixed char array size for tree names
	x86/mtrr: Check if fixed MTRRs exist before saving them
	sched/smt: Introduce sched_smt_present_inc/dec() helper
	sched/smt: Fix unbalance sched_smt_present dec/inc
	drm/bridge: analogix_dp: properly handle zero sized AUX transactions
	drm/dp_mst: Skip CSN if topology probing is not done yet
	drm/lima: Mark simple_ondemand governor as softdep
	drm/mgag200: Set DDC timeout in milliseconds
	drm/mgag200: Bind I2C lifetime to DRM device
	mptcp: mib: count MPJ with backup flag
	mptcp: export local_address
	mptcp: pm: fix backup support in signal endpoints
	selftests: mptcp: join: validate backup in MPJ
	selftests: mptcp: join: check backup support in signal endp
	mptcp: pm: deny endp with signal + subflow + port
	block: use the right type for stub rq_integrity_vec()
	Revert "drm/amd/display: Add NULL check for 'afb' before dereferencing in amdgpu_dm_plane_handle_cursor_update"
	mm: huge_memory: use !CONFIG_64BIT to relax huge page alignment on 32 bit machines
	btrfs: fix corruption after buffer fault in during direct IO append write
	ipv6: fix source address selection with route leak
	tools headers arm64: Sync arm64's cputype.h with the kernel sources
	mm/hugetlb: fix potential race in __update_and_free_hugetlb_folio()
	block: Call .limit_depth() after .hctx has been set
	block/mq-deadline: Fix the tag reservation code
	xfs: fix log recovery buffer allocation for the legacy h_size fixup
	netfilter: nf_tables: bail out if stateful expression provides no .clone
	netfilter: nf_tables: allow clone callbacks to sleep
	netfilter: nf_tables: prefer nft_chain_validate
	i2c: qcom-geni: fix missing clk_disable_unprepare() and geni_se_resources_off()
	btrfs: fix double inode unlock for direct IO sync writes
	Linux 6.1.105

Change-Id: I63c645dee46d43a3f1b166622e1858afba6ae3a8
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2024-09-27 14:10:38 +00:00
Greg Kroah-Hartman
2caf29dc67 Merge branch 'android14-6.1' into android14-6.1-lts
Merge the recent changes in android14-6.1 into android14-6.1-lts to
catch up on abi changes and other issues fixed there already.  Changes
included in here are:

* 5a912daf87 ANDROID: OPP: fix function args mismatch for dev_pm_opp_add in pm_opp.h
* bcc435d374 ANDROID: GKI: Update KMI symbol list for ASR
* 9e167c1c27 ANDROID: GKI: Export a symbol “next_arg” for honor
* 4dcae85afd BACKPORT: netem: fix return value if duplicate enqueue fails
* f4bcd4ef0f ANDROID: 16K: Fixup padding vm_flags bits on VMA splits
* 9027204d5a ANDROID: 16K: Introduce pgsize_migration_inline.h
* 03b93dc707 FROMLIST: binder: fix BINDER_WORK_FROZEN_BINDER debug logs
* 9c6fdb6bf8 BACKPORT: FROMLIST: binder: fix freeze UAF in binder_release_work()
* 07a43515b0 FROMLIST: binder: fix OOB in binder_add_freeze_work()
* a26cde4055 FROMLIST: binder: fix node UAF in binder_add_freeze_work()
* df571cd9f1 FROMGIT: virtio_pmem: Check device status before requesting flush
* b2a0a8f709 ANDROID: GKI: update rockchip symbols sync with kernel update
* 83e7e0486e ANDROID: GKI: Update symbol list for honor
* 5c7d0d4f4a ANDROID: GKI: Update `kernel_aarch64_16k` build config to match `kernel_aarch64`
* 2cd8ac816d ANDROID: ABI: update symbol list for honor
* b5ee53c64e ANDROID: Allow vendor modules perform more operationson on sock.
* e64a80a096 ANDROID: GKI: update symbol list file for xiaomi
* 530ff6a3e6 ANDROID: GKI: add vendor hooks android_vh_page_should_be_protected() and android_vh_modify_scan_control().
* 41e1c6f937 Merge tag 'android14-6.1.99_r00' into android14-6.1
* 3b95e54867 ANDROID: Update the ABI symbol list
* b3a2458fc6 ANDROID: mm: add vh for kcompactd_cpu_online()
* 532fad0092 ANDROID: ABI: update symbol list for honor
* 145b08312d ANDROID: vendor_hooks: add hook to perform targeted memory management
* c105083ac6 ANDROID: ABI: update symbol list for honor
* eda4e9fa64 ANDROID: mm: add vendor hook in fault and read file
* 814dd5bfa8 ANDROID: Update the ABI symbol list
* 8a268cb981 ANDROID: GKI: Update symbol list for honor
* be07389110 ANDROID: Allow vendor modules perform operationson on memleak detect
* 47871c381d ANDROID: GKI: Update symbol list for honor
* c7b8f95c21 ANDROID: Allow vendor modules perform more operations on binder transaction.
* d1f3a046a6 FROMGIT: f2fs: prevent atomic file from being dirtied before commit
* 6e5b92a6a1 ANDROID: GKI: Add symbol list for exynosauto
* b18f8bbc04 ANDROID: GKI: Update symbol list for BCMSTB
* ff74052448 BACKPORT: binder_alloc: Fix sleeping function called from invalid context
* 75c9b1955b UPSTREAM: bpf: Fix overrunning reservations in ringbuf
* fdec2610bf ANDROID: gki_config: Disable CONFIG_DEBUG_STACK_USAGE
* d02968a023 ANDROID: gki_defconfig: Enable CONFIG_SERIAL_8250_BCM7271
* a752cdd96f BACKPORT: serial: 8250_bcm7271: improve bcm7271 8250 port
* 04212acc42 ANDROID: GKI: Add initial symbol list for honor
* 27310ed6b6 ANDROID: binder: fix KMI issues due to frozen notification
* 2f43c68d05 FROMGIT: binder: frozen notification binder_features flag
* eda0570485 BACKPORT: FROMGIT: binder: frozen notification
* 822682e75d ANDROID: KVM: arm64: Fix cpu type for tracing HVCs
* c7596f093d ANDROID: gki_defconfig: Enable CONFIG_RTC_HCTOSYS for x86
* d1af8906d9 ANDROID: GKI: Update symbol list for vivo
* 9eca8763c1 ANDROID: vendor_hooks: add hooks for exting task's swp_entrys
* 03a4ae5d99 ANDROID: gki_defconfig: Enable Broadcom SoCs
* ef0ea14d63 ANDROID: ABI: Update xiaomi symbol list
* eabf8327ed ANDROID: Update the ABI symbol list
* f88293625b UPSTREAM: PM: domains: Add helper functions to attach/detach multiple PM domains
* 7b1e2d9798 UPSTREAM: OPP: Fix -Wunsequenced in _of_add_opp_table_v1()
* c33dbb3b87 UPSTREAM: firmware: arm_scmi: Specify the performance level when adding an OPP
* 47933171f3 BACKPORT: firmware: arm_scmi: Simplify error path in scmi_dvfs_device_opps_add()
* b50a013d33 BACKPORT: OPP: Extend support for the opp-level beyond required-opps
* 9ba5e19e0d UPSTREAM: OPP: Extend dev_pm_opp_data with a level
* adf41f4737 BACKPORT: OPP: Add dev_pm_opp_add_dynamic() to allow more flexibility
* 9c1597d2e4 UPSTREAM: dt-bindings: power: Clarify performance capabilities of power-domains
* dda942f010 UPSTREAM: dt-bindings: firmware: arm,scmi: Extend bindings for protocol@13
* ff18572d05 UPSTREAM: dt-bindings: arm: cpus: Add a power-domain-name for a performance-domain
* 5c0092ff97 UPSTREAM: PM: domains: Allow genpd providers to manage OPP tables directly by its FW
* c638aef4e9 UPSTREAM: cpufreq: scmi: Add support to parse domain-id using #power-domain-cells
* 0ccb8d6efa UPSTREAM: cpufreq: scmi: Avoid one OF parsing in scmi_get_sharing_cpus()
* 1a6e883184 UPSTREAM: firmware: arm_scmi: Drop redundant ->device_domain_id() from perf ops
* 3aa5b5408f UPSTREAM: firmware: arm_scmi: Align perf ops to use domain-id as in-parameter
* 49da9f2745 UPSTREAM: cpufreq: scmi: Prepare to move OF parsing of domain-id to cpufreq
* 742d32f206 BACKPORT: firmware: arm_scmi: Extend perf protocol ops to get information of a domain
* b99f37e4a6 BACKPORT: firmware: arm_scmi: Extend perf protocol ops to get number of domains
* 09ab235661 ANDROID: vendor_hooks: export shrink_slab
* 8a0fa49a77 UPSTREAM: erofs: fix out-of-bound access when z_erofs_gbuf_growsize() partially fails
* 7c5c6b6397 UPSTREAM: netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type
* a1895da8bd ANDROID: GKI: Add initial sunxi symbol list
* b5e374dda9 FROMLIST: usb: typec: fix up incorrectly backported "usb: typec: tcpm: unregister existing source caps before re-registration"
* 841cae8810 UPSTREAM: net: sched: sch_multiq: fix possible OOB write in multiq_tune()
* 3bb5a64ae9 ANDROID: Update the ABI symbol list
* 6cbdf0e239 ANDROID: Update the ABI symbol list
* 25641a61ba ANDROID: GKI: Update symbol list for mtk
* 82b9eb64eb FROMGIT: KVM: arm64: Ensure TLBI uses correct VMID after changing context
* 9920d2584e FROMGIT: KVM: arm64: Invalidate EL1&0 TLB entries for all VMIDs in nvhe hyp init
* 1a48a88fcb FROMGIT: BACKPORT: KVM: arm64: Don't pass a TLBI level hint when zapping table entries
* 02fcfc12fc Merge tag 'android14-6.1.93_r00' into android14-6.1
* 42515e9246 ANDROID: sched: Add android_vh_set_task_comm
* 0f23336b97 BACKPORT: UPSTREAM: sched: Move psi_account_irqtime() out of update_rq_clock_task() hotpath
* 370ea8bc2e FROMLIST: binder: fix UAF caused by offsets overwrite
* f8f9a197f4 ANDROID: binder: fix KMI-break due to proc->dmap
* a55053f3a8 UPSTREAM: binder: fix descriptor lookup for context manager
* c5f1e68340 BACKPORT: binder: use bitmap for faster descriptor lookup
* 514bdc80b9 UPSTREAM: perf/core: Fix potential NULL deref
* faf32723dc BACKPORT: scsi: ufs: core: Fix ufshcd_abort_one racing issue
* 4d735ca7bb BACKPORT: scsi: ufs: core: Fix ufshcd_clear_cmd racing issue

Change-Id: Ib03de3ba63c1e5c7fc2782fefe352aaa5d234ba1
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2024-09-27 14:08:16 +00:00
Kever Yang
cc274231f6 ANDROID: GKI: Add symbol for pci power limit
INFO: 1 function symbol(s) added
  'u32 of_pci_get_slot_power_limit(struct device_node*, u8*, u8*)'

Bug: 300024866
Change-Id: I558dbc6126dfd509ef200b08d5394c888aef9685
Signed-off-by: Kever Yang <kever.yang@rock-chips.com>
2024-09-27 18:29:11 +08:00
Anant Goel
5a912daf87 ANDROID: OPP: fix function args mismatch for dev_pm_opp_add in pm_opp.h
The function prototype for dev_pm_opp_add differs between a
configuration when CONFIG_PM_OPP is set versus when CONFIG_PM_OPP is not
set.
Fix this mismatch by aligning the function arguments for the dummy
dev_pm_opp_add with the non-dummy version.

Bug: 369659366
Fixes: adf41f4737 ("BACKPORT: OPP: Add dev_pm_opp_add_dynamic() to allow more flexibility")
Change-Id: If23af6ba28bb493d619f96846545cb86608b285d
Signed-off-by: Anant Goel <quic_anantg@quicinc.com>
2024-09-27 00:34:46 +00:00
meitaogao
bcc435d374 ANDROID: GKI: Update KMI symbol list for ASR
INFO: 9 function symbol(s) added
  'unsigned int kmem_cache_size(struct kmem_cache*)'
  'void media_device_unregister_entity(struct media_entity*)'
  'void* memset16(uint16_t*, uint16_t, size_t)'
  'const char* const* v4l2_ctrl_get_menu(u32)'
  'bool v4l2_ctrl_type_op_equal(const struct v4l2_ctrl*, union v4l2_ctrl_ptr, union v4l2_ctrl_ptr)'
  'void v4l2_ctrl_type_op_init(const struct v4l2_ctrl*, u32, union v4l2_ctrl_ptr)'
  'void v4l2_ctrl_type_op_log(const struct v4l2_ctrl*)'
  'void v4l2_m2m_buf_done_and_job_finish(struct v4l2_m2m_dev*, struct v4l2_m2m_ctx*, enum vb2_buffer_state)'
  'struct vb2_v4l2_buffer* v4l2_m2m_last_buf(struct v4l2_m2m_queue_ctx*)'

Bug: 369670477
Change-Id: I5c3fa32e903685836b7812d33df8ddd6b2c65054
Signed-off-by: meitaogao <meitaogao@asrmicro.com>
2024-09-26 18:25:55 +08:00
yipeng xiang
9e167c1c27 ANDROID: GKI: Export a symbol “next_arg” for honor
Export a symbol “next_arg” in android/abi_gki_aarch64_honor

Bug: 368221985
Change-Id: I0bd8fc321752f0fa3d103b56510b33eadcb6e39b
Signed-off-by: yipeng xiang <yipengxiang@honor.corp-partner.google.com>
2024-09-25 19:24:24 +00:00
Stephen Hemminger
4dcae85afd BACKPORT: netem: fix return value if duplicate enqueue fails
[ Upstream commit c07ff8592d57ed258afee5a5e04991a48dbaf382 ]

There is a bug in netem_enqueue() introduced by
commit 5845f70638 ("net: netem: fix skb length BUG_ON in __skb_to_sgvec")
that can lead to a use-after-free.

This commit made netem_enqueue() always return NET_XMIT_SUCCESS
when a packet is duplicated, which can cause the parent qdisc's q.qlen
to be mistakenly incremented. When this happens qlen_notify() may be
skipped on the parent during destruction, leaving a dangling pointer
for some classful qdiscs like DRR.

There are two ways for the bug happen:

- If the duplicated packet is dropped by rootq->enqueue() and then
  the original packet is also dropped.
- If rootq->enqueue() sends the duplicated packet to a different qdisc
  and the original packet is dropped.

In both cases NET_XMIT_SUCCESS is returned even though no packets
are enqueued at the netem qdisc.

The fix is to defer the enqueue of the duplicate packet until after
the original packet has been guaranteed to return NET_XMIT_SUCCESS.

Bug: 362391455
Fixes: 5845f70638 ("net: netem: fix skb length BUG_ON in __skb_to_sgvec")
Reported-by: Budimir Markovic <markovicbudimir@gmail.com>
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20240819175753.5151-1-stephen@networkplumber.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 0486d31dd8)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I390f02549c726e961f57daace468d5cd48468722
2024-09-25 18:41:03 +00:00
Kalesh Singh
f4bcd4ef0f ANDROID: 16K: Fixup padding vm_flags bits on VMA splits
In some cases VMAs are split without the mmap write lock held;
later the lock is taken to fixup vm_flags of the original VMA.
Since some uppper bits of vm_flags are used to encode the ELF
padding ranges, they need to be modified on splits. This is
usually handled correctly by __split_vma(). However in the above
case, the flags get over witten later under the write lock.

Preserve vm_flag bits on reset to correctly represent padding.

Bug: 357901498
Change-Id: I1cb75419e614791a47cbdb0341373f619daf0bf2
Signed-off-by: Kalesh Singh <kaleshsingh@google.com>
2024-09-25 17:23:10 +00:00
Kalesh Singh
9027204d5a ANDROID: 16K: Introduce pgsize_migration_inline.h
Introduce inline header to avoid circular dependency. This
will be used in a subsequent patch.

Also take opportunity to do some small noop refactor in
vma_pad_pages() and split_pad_vma() for more robust code.

Bug: 357901498
Change-Id: Ia5f447758d0d07ed3e1429ca1e35dcc0741cc22a
Signed-off-by: Kalesh Singh <kaleshsingh@google.com>
2024-09-25 17:23:10 +00:00
Carlos Llamas
03b93dc707 FROMLIST: binder: fix BINDER_WORK_FROZEN_BINDER debug logs
The BINDER_WORK_FROZEN_BINDER type is not handled in the binder_logs
entries and it shows up as "unknown work" when logged:

  proc 649
  context binder-test
    thread 649: l 00 need_return 0 tr 0
    ref 13: desc 1 node 8 s 1 w 0 d 0000000053c4c0c3
    unknown work: type 10

This patch add the freeze work type and is now logged as such:

  proc 637
  context binder-test
    thread 637: l 00 need_return 0 tr 0
    ref 8: desc 1 node 3 s 1 w 0 d 00000000dc39e9c6
    has frozen binder

Fixes: d579b04a52a1 ("binder: frozen notification")
Cc: stable@vger.kernel.org
Signed-off-by: Carlos Llamas <cmllamas@google.com>

Bug: 366003708
Link: https://lore.kernel.org/all/20240924184401.76043-5-cmllamas@google.com/
Change-Id: I06f888aa5218db19eeda79e315385506af09d9d5
Signed-off-by: Carlos Llamas <cmllamas@google.com>
2024-09-25 03:06:31 +00:00
Carlos Llamas
9c6fdb6bf8 BACKPORT: FROMLIST: binder: fix freeze UAF in binder_release_work()
When a binder reference is cleaned up, any freeze work queued in the
associated process should also be removed. Otherwise, the reference is
freed while its ref->freeze.work is still queued in proc->work leading
to a use-after-free issue as shown by the following KASAN report:

  ==================================================================
  BUG: KASAN: slab-use-after-free in binder_release_work+0x398/0x3d0
  Read of size 8 at addr ffff31600ee91488 by task kworker/5:1/211

  CPU: 5 UID: 0 PID: 211 Comm: kworker/5:1 Not tainted 6.11.0-rc7-00382-gfc6c92196396 #22
  Hardware name: linux,dummy-virt (DT)
  Workqueue: events binder_deferred_func
  Call trace:
   binder_release_work+0x398/0x3d0
   binder_deferred_func+0xb60/0x109c
   process_one_work+0x51c/0xbd4
   worker_thread+0x608/0xee8

  Allocated by task 703:
   __kmalloc_cache_noprof+0x130/0x280
   binder_thread_write+0xdb4/0x42a0
   binder_ioctl+0x18f0/0x25ac
   __arm64_sys_ioctl+0x124/0x190
   invoke_syscall+0x6c/0x254

  Freed by task 211:
   kfree+0xc4/0x230
   binder_deferred_func+0xae8/0x109c
   process_one_work+0x51c/0xbd4
   worker_thread+0x608/0xee8
  ==================================================================

This commit fixes the issue by ensuring any queued freeze work is removed
when cleaning up a binder reference.

Fixes: d579b04a52a1 ("binder: frozen notification")
Cc: stable@vger.kernel.org
Signed-off-by: Carlos Llamas <cmllamas@google.com>

Bug: 366003708
Link: https://lore.kernel.org/all/20240924184401.76043-4-cmllamas@google.com/
Change-Id: Icc40e7dd6157981f4adbea7243e55be118552321
[cmllamas: drop BINDER_STAT_FREEZE as it's not supported here]
Signed-off-by: Carlos Llamas <cmllamas@google.com>
2024-09-25 03:06:31 +00:00
Carlos Llamas
07a43515b0 FROMLIST: binder: fix OOB in binder_add_freeze_work()
In binder_add_freeze_work() we iterate over the proc->nodes with the
proc->inner_lock held. However, this lock is temporarily dropped to
acquire the node->lock first (lock nesting order). This can race with
binder_deferred_release() which removes the nodes from the proc->nodes
rbtree and adds them into binder_dead_nodes list. This leads to a broken
iteration in binder_add_freeze_work() as rb_next() will use data from
binder_dead_nodes, triggering an out-of-bounds access:

  ==================================================================
  BUG: KASAN: global-out-of-bounds in rb_next+0xfc/0x124
  Read of size 8 at addr ffffcb84285f7170 by task freeze/660

  CPU: 8 UID: 0 PID: 660 Comm: freeze Not tainted 6.11.0-07343-ga727812a8d45 #18
  Hardware name: linux,dummy-virt (DT)
  Call trace:
   rb_next+0xfc/0x124
   binder_add_freeze_work+0x344/0x534
   binder_ioctl+0x1e70/0x25ac
   __arm64_sys_ioctl+0x124/0x190

  The buggy address belongs to the variable:
   binder_dead_nodes+0x10/0x40
  [...]
  ==================================================================

This is possible because proc->nodes (rbtree) and binder_dead_nodes
(list) share entries in binder_node through a union:

	struct binder_node {
	[...]
		union {
			struct rb_node rb_node;
			struct hlist_node dead_node;
		};

Fix the race by checking that the proc is still alive. If not, simply
break out of the iteration.

Fixes: d579b04a52a1 ("binder: frozen notification")
Cc: stable@vger.kernel.org
Signed-off-by: Carlos Llamas <cmllamas@google.com>

Bug: 366003708
Link: https://lore.kernel.org/all/20240924184401.76043-3-cmllamas@google.com/
Change-Id: I5ec9d49277a23b864862665b52213460750c535e
Signed-off-by: Carlos Llamas <cmllamas@google.com>
2024-09-25 03:06:31 +00:00
Carlos Llamas
a26cde4055 FROMLIST: binder: fix node UAF in binder_add_freeze_work()
In binder_add_freeze_work() we iterate over the proc->nodes with the
proc->inner_lock held. However, this lock is temporarily dropped in
order to acquire the node->lock first (lock nesting order). This can
race with binder_node_release() and trigger a use-after-free:

  ==================================================================
  BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x19c
  Write of size 4 at addr ffff53c04c29dd04 by task freeze/640

  CPU: 5 UID: 0 PID: 640 Comm: freeze Not tainted 6.11.0-07343-ga727812a8d45 #17
  Hardware name: linux,dummy-virt (DT)
  Call trace:
   _raw_spin_lock+0xe4/0x19c
   binder_add_freeze_work+0x148/0x478
   binder_ioctl+0x1e70/0x25ac
   __arm64_sys_ioctl+0x124/0x190

  Allocated by task 637:
   __kmalloc_cache_noprof+0x12c/0x27c
   binder_new_node+0x50/0x700
   binder_transaction+0x35ac/0x6f74
   binder_thread_write+0xfb8/0x42a0
   binder_ioctl+0x18f0/0x25ac
   __arm64_sys_ioctl+0x124/0x190

  Freed by task 637:
   kfree+0xf0/0x330
   binder_thread_read+0x1e88/0x3a68
   binder_ioctl+0x16d8/0x25ac
   __arm64_sys_ioctl+0x124/0x190
  ==================================================================

Fix the race by taking a temporary reference on the node before
releasing the proc->inner lock. This ensures the node remains alive
while in use.

Fixes: d579b04a52a1 ("binder: frozen notification")
Cc: stable@vger.kernel.org
Signed-off-by: Carlos Llamas <cmllamas@google.com>

Bug: 366003708
Link: https://lore.kernel.org/all/20240924184401.76043-2-cmllamas@google.com/
Change-Id: I47b053532dd4cd3424d35d6f254ca4d00c426411
Signed-off-by: Carlos Llamas <cmllamas@google.com>
2024-09-25 03:06:31 +00:00
Philip Chen
df571cd9f1 FROMGIT: virtio_pmem: Check device status before requesting flush
If a pmem device is in a bad status, the driver side could wait for
host ack forever in virtio_pmem_flush(), causing the system to hang.

So add a status check in the beginning of virtio_pmem_flush() to return
early if the device is not activated.

Signed-off-by: Philip Chen <philipchen@chromium.org>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Pankaj Gupta <pankaj.gupta.linux@gmail.com

Bug: 358391069
Change-Id: I325e6f0ea047c4c5fa82cf4b590cbf7240f39b7b
(cherry picked from commit e25fbcd97cf52c3c9824d44b5c56c19673c3dd50 https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master)
Signed-off-by: Philip Chen <philipchen@google.com>
2024-09-25 00:08:28 +00:00
Kever Yang
b2a0a8f709 ANDROID: GKI: update rockchip symbols sync with kernel update
INFO: 2 function symbol(s) added
  'struct clk* devm_clk_get_enabled(struct device*, const char*)'
  'int devm_regulator_bulk_get_enable(struct device*, int, const char* const*)'

Bug: 300024866
Change-Id: Ib10dc7eb710fc09c185513ba8bf5789c2c7ef5d1
Signed-off-by: Kever Yang <kever.yang@rock-chips.com>
2024-09-24 23:09:49 +00:00
Chenghao Zhao
83e7e0486e ANDROID: GKI: Update symbol list for honor
Update symbol list for honor in android/abi_gki_aarch64_honor

Bug: 369259421
Change-Id: I6954293467a50a758b27444bf51b7205d68dd34d
Signed-off-by: Chenghao Zhao <zhaochenghao@honor.com>
2024-09-24 23:07:46 +00:00
Vilas Bhat
5c7d0d4f4a ANDROID: GKI: Update kernel_aarch64_16k build config to match kernel_aarch64
Test: Built & Flashed 16k page size kernel to Pixel 8a.
Bug: 361155105
Change-Id: Ibfaa96aeabe627f99effc1ae8dbaf3e86156425e
Signed-off-by: Vilas Bhat <vilasbhat@google.com>
2024-09-24 19:54:26 +00:00