mirror of
https://github.com/hardkernel/linux.git
synced 2026-06-11 13:27:06 +09:00
3b2e004494de3fa54fffaf220eeb1512cc49dada
1165241 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Greg Kroah-Hartman
|
c0dded0f8b |
Revert "Bluetooth: fix use-after-free in accessing skb after sending it"
This reverts commit
|
||
|
Greg Kroah-Hartman
|
7386876ffd |
Revert "Bluetooth: hci_core: Fix missing instances using HCI_MAX_AD_LENGTH"
This reverts commit |
||
|
Greg Kroah-Hartman
|
0ba60e394b |
Revert "Bluetooth: Fix eir name length"
This reverts commit
|
||
|
Natanael Copa
|
ff903561b7 |
UPSTREAM: tools/resolve_btfids: fix build with musl libc
commit 62248b22d01e96a4d669cde0d7005bd51ebf9e76 upstream.
Include the header that defines u32.
This fixes build of 6.6.23 and 6.1.83 kernels for Alpine Linux, which
uses musl libc. I assume that GNU libc indirecly pulls in linux/types.h.
Fixes: 9707ac4fe2f5 ("tools/resolve_btfids: Refactor set sorting with types from btf_ids.h")
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218647
Cc: stable@vger.kernel.org
Change-Id: I34cd9d80bc1623c0caa1c2f894710e6640b4c0bc
Signed-off-by: Natanael Copa <ncopa@alpinelinux.org>
Tested-by: Greg Thelen <gthelen@google.com>
Link: https://lore.kernel.org/r/20240328110103.28734-1-ncopa@alpinelinux.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit
|
||
|
Greg Kroah-Hartman
|
0328f7d241 |
Merge 6.1.83 into android14-6.1-lts
Changes in 6.1.83
md: fix data corruption for raid456 when reshape restart while grow up
md/raid10: prevent soft lockup while flush writes
io_uring/unix: drop usage of io_uring socket
io_uring: drop any code related to SCM_RIGHTS
nfsd: allow nfsd_file_get to sanely handle a NULL pointer
nfsd: don't open-code clear_and_wake_up_bit
nfsd: NFSD_FILE_KEY_INODE only needs to find GC'ed entries
nfsd: simplify test_bit return in NFSD_FILE_KEY_FULL comparator
nfsd: don't kill nfsd_files because of lease break error
nfsd: add some comments to nfsd_file_do_acquire
nfsd: don't take/put an extra reference when putting a file
nfsd: update comment over __nfsd_file_cache_purge
nfsd: allow reaping files still under writeback
NFSD: Convert filecache to rhltable
nfsd: simplify the delayed disposal list code
NFSD: Fix problem of COMMIT and NFS4ERR_DELAY in infinite loop
NFSD: Add an nfsd4_encode_nfstime4() helper
nfsd: Fix creation time serialization order
media: rkisp1: Fix IRQ handling due to shared interrupts
perf/arm-cmn: Workaround AmpereOneX errata AC04_MESH_1 (incorrect child count)
selftests: tls: use exact comparison in recv_partial
ASoC: rt5645: Make LattePanda board DMI match more precise
ASoC: amd: yc: Fix non-functional mic on Lenovo 82UU
x86/xen: Add some null pointer checking to smp.c
MIPS: Clear Cause.BD in instruction_pointer_set
HID: multitouch: Add required quirk for Synaptics 0xcddc device
gen_compile_commands: fix invalid escape sequence warning
arm64/sve: Lower the maximum allocation for the SVE ptrace regset
soc: microchip: Fix POLARFIRE_SOC_SYS_CTRL input prompt
RDMA/mlx5: Fix fortify source warning while accessing Eth segment
RDMA/mlx5: Relax DEVX access upon modify commands
riscv: dts: sifive: add missing #interrupt-cells to pmic
x86/mm: Move is_vsyscall_vaddr() into asm/vsyscall.h
x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault()
net/iucv: fix the allocation size of iucv_path_table array
parisc/ftrace: add missing CONFIG_DYNAMIC_FTRACE check
block: sed-opal: handle empty atoms when parsing response
dm-verity, dm-crypt: align "struct bvec_iter" correctly
arm64: dts: Fix dtc interrupt_provider warnings
btrfs: fix data races when accessing the reserved amount of block reserves
btrfs: fix data race at btrfs_use_block_rsv() when accessing block reserve
net: smsc95xx: add support for SYS TEC USB-SPEmodule1
wifi: mac80211: only call drv_sta_rc_update for uploaded stations
ASoC: amd: yc: Add Lenovo ThinkBook 21J0 into DMI quirk table
scsi: mpt3sas: Prevent sending diag_reset when the controller is ready
ALSA: hda/realtek - ALC285 reduce pop noise from Headphone port
drm/amdgpu: Enable gpu reset for S3 abort cases on Raven series
ASoC: amd: yc: Fix non-functional mic on Lenovo 21J2
Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security
Bluetooth: mgmt: Fix limited discoverable off timeout
firewire: core: use long bus reset on gap count error
arm64: tegra: Set the correct PHY mode for MGBE
ASoC: Intel: bytcr_rt5640: Add an extra entry for the Chuwi Vi8 tablet
Input: gpio_keys_polled - suppress deferred probe error for gpio
ASoC: wm8962: Enable oscillator if selecting WM8962_FLL_OSC
ASoC: wm8962: Enable both SPKOUTR_ENA and SPKOUTL_ENA in mono mode
ASoC: wm8962: Fix up incorrect error message in wm8962_set_fll
do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak
fs: Fix rw_hint validation
s390/dasd: add autoquiesce feature
s390/dasd: Use dev_*() for device log messages
s390/dasd: fix double module refcount decrement
rcu/exp: Fix RCU expedited parallel grace period kworker allocation failure recovery
rcu/exp: Handle RCU expedited grace period kworker allocation failure
nbd: null check for nla_nest_start
fs/select: rework stack allocation hack for clang
md: Don't clear MD_CLOSING when the raid is about to stop
lib/cmdline: Fix an invalid format specifier in an assertion msg
lib: memcpy_kunit: Fix an invalid format specifier in an assertion msg
time: test: Fix incorrect format specifier
rtc: test: Fix invalid format specifier.
io_uring/net: unify how recvmsg and sendmsg copy in the msghdr
io_uring/net: move receive multishot out of the generic msghdr path
io_uring/net: fix overflow check in io_recvmsg_mshot_prep()
aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts
x86/resctrl: Implement new mba_MBps throttling heuristic
x86/sme: Fix memory encryption setting if enabled by default and not overridden
timekeeping: Fix cross-timestamp interpolation on counter wrap
timekeeping: Fix cross-timestamp interpolation corner case decision
timekeeping: Fix cross-timestamp interpolation for non-x86
sched/fair: Take the scheduling domain into account in select_idle_smt()
sched/fair: Take the scheduling domain into account in select_idle_core()
wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev()
wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled
wifi: b43: Stop/wake correct queue in PIO Tx path when QoS is disabled
wifi: b43: Stop correct queue in DMA worker when QoS is disabled
wifi: b43: Disable QoS for bcm4331
wifi: wilc1000: fix declarations ordering
wifi: wilc1000: fix RCU usage in connect path
wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work
wifi: wilc1000: do not realloc workqueue everytime an interface is added
wifi: wilc1000: fix multi-vif management when deleting a vif
wifi: mwifiex: debugfs: Drop unnecessary error check for debugfs_create_dir()
ARM: dts: renesas: r8a73a4: Fix external clocks and clock rate
cpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return value
cpufreq: Explicitly include correct DT includes
cpufreq: mediatek-hw: Wait for CPU supplies before probing
sock_diag: annotate data-races around sock_diag_handlers[family]
inet_diag: annotate data-races around inet_diag_table[]
bpftool: Silence build warning about calloc()
libbpf: Apply map_set_def_max_entries() for inner_maps on creation
selftest/bpf: Add map_in_maps with BPF_MAP_TYPE_PERF_EVENT_ARRAY values
af_unix: Annotate data-race of gc_in_progress in wait_for_unix_gc().
cpufreq: mediatek-hw: Don't error out if supply is not found
libbpf: Fix faccessat() usage on Android
pmdomain: qcom: rpmhpd: Drop SA8540P gfx.lvl
arm64: dts: imx8mm-kontron: Disable pullups for I2C signals on OSM-S i.MX8MM
arm64: dts: imx8mm-kontron: Disable pullups for I2C signals on SL/BL i.MX8MM
arm64: dts: imx8mm-kontron: Disable pullups for onboard UART signals on BL OSM-S board
arm64: dts: imx8mm-kontron: Disable pullups for onboard UART signals on BL board
arm64: dts: imx8mm-kontron: Disable pull resistors for SD card signals on BL OSM-S board
arm64: dts: imx8mm-kontron: Disable pull resistors for SD card signals on BL board
arm64: dts: imx8mm-kontron: Fix interrupt for RTC on OSM-S i.MX8MM module
libbpf: Add missing LIBBPF_API annotation to libbpf_set_memlock_rlim API
wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete
wifi: iwlwifi: mvm: report beacon protection failures
wifi: iwlwifi: dbg-tlv: ensure NUL termination
wifi: iwlwifi: fix EWRD table validity check
gpio: vf610: allow disabling the vf610 driver
arm64: dts: imx8mm-venice-gw71xx: fix USB OTG VBUS
pwm: atmel-hlcdc: Convert to platform remove callback returning void
pwm: atmel-hlcdc: Use consistent variable naming
pwm: atmel-hlcdc: Fix clock imbalance related to suspend support
net: blackhole_dev: fix build warning for ethh set but not used
wifi: ath11k: initialize rx_mcs_80 and rx_mcs_160 before use
wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()
wifi: wfx: fix memory leak when starting AP
printk: Disable passing console lock owner completely during panic()
pwm: sti: Fix capture for st,pwm-num-chan < st,capture-num-chan
tools/resolve_btfids: Refactor set sorting with types from btf_ids.h
tools/resolve_btfids: Fix cross-compilation to non-host endianness
wifi: iwlwifi: mvm: don't set replay counters to 0xff
s390/pai: fix attr_event_free upper limit for pai device drivers
s390/vdso: drop '-fPIC' from LDFLAGS
selftests: forwarding: Add missing config entries
selftests: forwarding: Add missing multicast routing config entries
ipv6: mcast: remove one synchronize_net() barrier in ipv6_mc_down()
arm64: dts: mt8183: kukui: Split out keyboard node and describe detachables
arm64: dts: mt8183: Move CrosEC base detection node to kukui-based DTs
arm64: dts: mediatek: mt7986: add "#reset-cells" to infracfg
arm64: dts: mediatek: mt8192-asurada: Remove CrosEC base detection node
arm64: dts: mediatek: mt8192: fix vencoder clock name
arm64: dts: mediatek: mt7622: add missing "device_type" to memory nodes
bpf: Mark bpf_spin_{lock,unlock}() helpers with notrace correctly
ARM: dts: qcom: msm8974: correct qfprom node size
wifi: wilc1000: prevent use-after-free on vif when cleaning up all interfaces
ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit()
bus: tegra-aconnect: Update dependency to ARCH_TEGRA
iommu/amd: Mark interrupt as managed
wifi: brcmsmac: avoid function pointer casts
arm64: dts: qcom: sdm845-db845c: correct PCIe wake-gpios
arm64: dts: qcom: sm8150: use 'gpios' suffix for PCI GPIOs
arm64: dts: qcom: sm8150: correct PCIe wake-gpios
powercap: dtpm_cpu: Fix error check against freq_qos_add_request()
net: ena: Remove ena_select_queue
arm64: dts: mt8195-cherry-tomato: change watchdog reset boot flow
firmware: arm_scmi: Fix double free in SMC transport cleanup path
wifi: wilc1000: revert reset line logic flip
ARM: dts: arm: realview: Fix development chip ROM compatible value
arm64: dts: renesas: r9a07g043: Split out RZ/G2UL SoC specific parts
arm64: dts: renesas: r9a07g043u: Add IRQC node
arm64: dts: renesas: rzg2l: Add missing interrupts to IRQC nodes
arm64: dts: renesas: r8a779a0: Update to R-Car Gen4 compatible values
arm64: dts: renesas: r8a779a0: Correct avb[01] reg sizes
arm64: dts: renesas: r8a779g0: Correct avb[01] reg sizes
net: mctp: copy skb ext data when fragmenting
pstore: inode: Convert mutex usage to guard(mutex)
pstore: inode: Only d_invalidate() is needed
arm64: dts: allwinner: h6: Add RX DMA channel for SPDIF
ARM: dts: imx6dl-yapp4: Move phy reset into switch node
ARM: dts: imx6dl-yapp4: Fix typo in the QCA switch register address
ARM: dts: imx6dl-yapp4: Move the internal switch PHYs under the switch node
arm64: dts: marvell: reorder crypto interrupts on Armada SoCs
ACPI: resource: Add Infinity laptops to irq1_edge_low_force_override
ACPI: resource: Do IRQ override on Lunnen Ground laptops
ACPI: resource: Add MAIBENBEN X577 to irq1_edge_low_force_override
ACPI: scan: Fix device check notification handling
arm64: dts: rockchip: add missing interrupt-names for rk356x vdpu
x86, relocs: Ignore relocations in .notes section
SUNRPC: fix some memleaks in gssx_dec_option_array
mmc: wmt-sdmmc: remove an incorrect release_mem_region() call in the .remove function
ACPI: CPPC: enable AMD CPPC V2 support for family 17h processors
wifi: rtw88: 8821c: Fix beacon loss and disconnect
wifi: rtw88: 8821c: Fix false alarm count
PCI: Make pci_dev_is_disconnected() helper public for other drivers
iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected
igb: Fix missing time sync events
Bluetooth: Remove HCI_POWER_OFF_TIMEOUT
Bluetooth: mgmt: Remove leftover queuing of power_off work
Bluetooth: Remove superfluous call to hci_conn_check_pending()
Bluetooth: hci_qca: don't use IS_ERR_OR_NULL() with gpiod_get_optional()
Bluetooth: Cancel sync command before suspend and power off
Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running
Bluetooth: hci_conn: Consolidate code for aborting connections
Bluetooth: hci_core: Cancel request on command timeout
Bluetooth: hci_sync: Fix overwriting request callback
Bluetooth: hci_core: Fix possible buffer overflow
Bluetooth: af_bluetooth: Fix deadlock
Bluetooth: fix use-after-free in accessing skb after sending it
sr9800: Add check for usbnet_get_endpoints
s390/cache: prevent rebuild of shared_cpu_list
bpf: Fix DEVMAP_HASH overflow check on 32-bit arches
bpf: Fix hashtab overflow check on 32-bit arches
bpf: Fix stackmap overflow check on 32-bit arches
iommu/vt-d: Retrieve IOMMU perfmon capability information
iommu: Fix compilation without CONFIG_IOMMU_INTEL
ipv6: fib6_rules: flush route cache when rule is changed
net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()
net: phy: fix phy_get_internal_delay accessing an empty array
net: hns3: fix wrong judgment condition issue
net: hns3: fix kernel crash when 1588 is received on HIP08 devices
net: hns3: fix port duplex configure error in IMP reset
Bluetooth: MGMT: Fix always using HCI_MAX_AD_LENGTH
Bluetooth: hci_core: Fix missing instances using HCI_MAX_AD_LENGTH
Bluetooth: Fix eir name length
net: phy: dp83822: Fix RGMII TX delay configuration
OPP: debugfs: Fix warning around icc_get_name()
tcp: fix incorrect parameter validation in the do_tcp_getsockopt() function
ipmr: fix incorrect parameter validation in the ip_mroute_getsockopt() function
l2tp: fix incorrect parameter validation in the pppol2tp_getsockopt() function
udp: fix incorrect parameter validation in the udp_lib_getsockopt() function
net: kcm: fix incorrect parameter validation in the kcm_getsockopt) function
net/x25: fix incorrect parameter validation in the x25_getsockopt() function
nfp: flower: handle acti_netdevs allocation failure
bpf: hardcode BPF_PROG_PACK_SIZE to 2MB * num_possible_nodes()
dm raid: fix false positive for requeue needed during reshape
dm: call the resume method on internal suspend
drm/tegra: dsi: Add missing check for of_find_device_by_node
drm/tegra: dpaux: Fix PM disable depth imbalance in tegra_dpaux_probe
drm/tegra: dsi: Make use of the helper function dev_err_probe()
drm/tegra: dsi: Fix some error handling paths in tegra_dsi_probe()
drm/tegra: dsi: Fix missing pm_runtime_disable() in the error handling path of tegra_dsi_probe()
drm/tegra: hdmi: Convert to devm_platform_ioremap_resource()
drm/tegra: hdmi: Fix some error handling paths in tegra_hdmi_probe()
drm/tegra: rgb: Fix some error handling paths in tegra_dc_rgb_probe()
drm/tegra: rgb: Fix missing clk_put() in the error handling paths of tegra_dc_rgb_probe()
drm/tegra: output: Fix missing i2c_put_adapter() in the error handling paths of tegra_output_probe()
drm/rockchip: inno_hdmi: Fix video timing
drm: Don't treat 0 as -1 in drm_fixp2int_ceil
drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node
drm/rockchip: lvds: do not overwrite error code
drm/rockchip: lvds: do not print scary message when probing defer
drm/panel-edp: use put_sync in unprepare
drm/lima: fix a memleak in lima_heap_alloc
ASoC: amd: acp: Add missing error handling in sof-mach
dmaengine: tegra210-adma: Update dependency to ARCH_TEGRA
media: tc358743: register v4l2 async device only after successful setup
PCI/DPC: Print all TLP Prefixes, not just the first
perf record: Fix possible incorrect free in record__switch_output()
HID: lenovo: Add middleclick_workaround sysfs knob for cptkbd
drm/amd/display: Fix a potential buffer overflow in 'dp_dsc_clock_en_read()'
drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()'
pinctrl: renesas: r8a779g0: Add Audio SSI pins, groups, and functions
pinctrl: renesas: r8a779g0: Add missing SCIF_CLK2 pin group/function
clk: samsung: exynos850: Propagate SPI IPCLK rate change
perf evsel: Fix duplicate initialization of data->id in evsel__parse_sample()
clk: meson: Add missing clocks to axg_clk_regmaps
media: em28xx: annotate unchecked call to media_device_register()
media: v4l2-tpg: fix some memleaks in tpg_alloc
media: v4l2-mem2mem: fix a memleak in v4l2_m2m_register_entity
media: edia: dvbdev: fix a use-after-free
pinctrl: mediatek: Drop bogus slew rate register range for MT8186
pinctrl: mediatek: Drop bogus slew rate register range for MT8192
clk: qcom: reset: Commonize the de/assert functions
clk: qcom: reset: Ensure write completion on reset de/assertion
quota: simplify drop_dquot_ref()
quota: Fix potential NULL pointer dereference
quota: Fix rcu annotations of inode dquot pointers
PCI: switchtec: Fix an error handling path in switchtec_pci_probe()
crypto: xilinx - call finalize with bh disabled
perf thread_map: Free strlist on normal path in thread_map__new_by_tid_str()
drm/msm/dpu: fix the programming of INTF_CFG2_DATA_HCTL_EN
drm/msm/dpu: Only enable DSC_MODE_MULTIPLEX if dsc_merge is enabled
drm/radeon/ni: Fix wrong firmware size logging in ni_init_microcode()
clk: renesas: r8a779g0: Add CMT clocks
clk: renesas: r8a779g0: Add Audio clocks
clk: renesas: r8a779g0: Add thermal clock
clk: renesas: r8a779g0: Correct PFC/GPIO parent clocks
clk: renesas: r8a779f0: Correct PFC/GPIO parent clock
ALSA: seq: fix function cast warnings
perf stat: Avoid metric-only segv
ASoC: meson: aiu: fix function pointer type mismatch
ASoC: meson: t9015: fix function pointer type mismatch
powerpc: Force inlining of arch_vmap_p{u/m}d_supported()
ASoC: SOF: Introduce container struct for SOF firmware
ASoC: SOF: Add some bounds checking to firmware data
NTB: EPF: fix possible memory leak in pci_vntb_probe()
NTB: fix possible name leak in ntb_register_device()
media: cedrus: h265: Associate mv col buffers with buffer
media: cedrus: h265: Fix configuring bitstream size
media: sun8i-di: Fix coefficient writes
media: sun8i-di: Fix power on/off sequences
media: sun8i-di: Fix chroma difference threshold
media: imx: csc/scaler: fix v4l2_ctrl_handler memory leak
media: go7007: add check of return value of go7007_read_addr()
media: pvrusb2: remove redundant NULL check
media: pvrusb2: fix pvr2_stream_callback casts
clk: qcom: dispcc-sdm845: Adjust internal GDSC wait times
drm/mediatek: dsi: Fix DSI RGB666 formats and definitions
PCI: Mark 3ware-9650SE Root Port Extended Tags as broken
clk: hisilicon: hi3519: Release the correct number of gates in hi3519_clk_unregister()
clk: hisilicon: hi3559a: Fix an erroneous devm_kfree()
drm/tegra: put drm_gem_object ref on error in tegra_fb_create
mfd: syscon: Call of_node_put() only when of_parse_phandle() takes a ref
mfd: altera-sysmgr: Call of_node_put() only when of_parse_phandle() takes a ref
crypto: arm/sha - fix function cast warnings
crypto: jitter - fix CRYPTO_JITTERENTROPY help text
drm/tidss: Fix initial plane zpos values
drm/tidss: Fix sync-lost issue with two displays
mtd: maps: physmap-core: fix flash size larger than 32-bit
mtd: rawnand: lpc32xx_mlc: fix irq handler prototype
ASoC: meson: axg-tdm-interface: fix mclk setup without mclk-fs
ASoC: meson: axg-tdm-interface: add frame rate constraint
HID: amd_sfh: Update HPD sensor structure elements
HID: amd_sfh: Avoid disabling the interrupt
drm/amdgpu: Fix missing break in ATOM_ARG_IMM Case of atom_get_src_int()
media: pvrusb2: fix uaf in pvr2_context_set_notify
media: dvb-frontends: avoid stack overflow warnings with clang
media: go7007: fix a memleak in go7007_load_encoder
media: ttpci: fix two memleaks in budget_av_attach
media: mediatek: vcodec: avoid -Wcast-function-type-strict warning
gpio: nomadik: fix offset bug in nmk_pmx_set()
drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip
powerpc/pseries: Fix potential memleak in papr_get_attr()
powerpc/hv-gpci: Fix the H_GET_PERF_COUNTER_INFO hcall return value checks
drm/msm/dpu: add division of drm_display_mode's hskew parameter
modules: wait do_free_init correctly
powerpc/embedded6xx: Fix no previous prototype for avr_uart_send() etc.
leds: aw2013: Unlock mutex before destroying it
leds: sgm3140: Add missing timer cleanup and flash gpio control
backlight: lm3630a: Initialize backlight_properties on init
backlight: lm3630a: Don't set bl->props.brightness in get_brightness
backlight: da9052: Fully initialize backlight_properties during probe
backlight: lm3639: Fully initialize backlight_properties during probe
backlight: lp8788: Fully initialize backlight_properties during probe
sparc32: Fix section mismatch in leon_pci_grpci
clk: Fix clk_core_get NULL dereference
clk: zynq: Prevent null pointer dereference caused by kmalloc failure
ALSA: hda/realtek: fix ALC285 issues on HP Envy x360 laptops
ALSA: usb-audio: Stop parsing channels bits when all channels are found.
RDMA/irdma: Allow accurate reporting on QP max send/recv WR
RDMA/irdma: Remove duplicate assignment
RDMA/srpt: Do not register event handler until srpt device is fully setup
f2fs: reduce stack memory cost by using bitfield in struct f2fs_io_info
f2fs: compress: fix to guarantee persisting compressed blocks by CP
f2fs: compress: fix to cover normal cluster write with cp_rwsem
f2fs: compress: fix to check unreleased compressed cluster
f2fs: simplify __allocate_data_block
f2fs: delete obsolete FI_FIRST_BLOCK_WRITTEN
f2fs: delete obsolete FI_DROP_CACHE
f2fs: introduce get_dnode_addr() to clean up codes
f2fs: update blkaddr in __set_data_blkaddr() for cleanup
f2fs: compress: fix to avoid inconsistence bewteen i_blocks and dnode
f2fs: compress: fix to cover f2fs_disable_compressed_file() w/ i_sem
f2fs: fix to avoid potential panic during recovery
scsi: csiostor: Avoid function pointer casts
RDMA/hns: Fix mis-modifying default congestion control algorithm
RDMA/device: Fix a race between mad_client and cm_client init
RDMA/rtrs-clt: Check strnlen return len in sysfs mpath_policy_store()
scsi: bfa: Fix function pointer type mismatch for hcb_qe->cbfn
f2fs: compress: fix to check zstd compress level correctly in mount option
net: sunrpc: Fix an off by one in rpc_sockaddr2uaddr()
NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102
NFSv4.2: fix listxattr maximum XDR buffer size
f2fs: compress: fix to check compress flag w/ .i_sem lock
f2fs: check number of blocks in a current section
watchdog: stm32_iwdg: initialize default timeout
f2fs: ro: compress: fix to avoid caching unaligned extent
NFS: Fix an off by one in root_nfs_cat()
f2fs: convert to use sbi directly
f2fs: compress: relocate some judgments in f2fs_reserve_compress_blocks
f2fs: compress: fix reserve_cblocks counting error when out of space
perf/x86/amd/core: Avoid register reset when CPU is dead
afs: Revert "afs: Hide silly-rename files from userspace"
nfs: fix panic when nfs4_ff_layout_prepare_ds() fails
io_uring/net: correct the type of variable
comedi: comedi_test: Prevent timers rescheduling during deletion
remoteproc: stm32: use correct format strings on 64-bit
remoteproc: stm32: Fix incorrect type in assignment for va
remoteproc: stm32: Fix incorrect type assignment returned by stm32_rproc_get_loaded_rsc_tablef
usb: phy: generic: Get the vbus supply
tty: vt: fix 20 vs 0x20 typo in EScsiignore
serial: max310x: fix syntax error in IRQ error message
tty: serial: samsung: fix tx_empty() to return TIOCSER_TEMT
arm64: dts: broadcom: bcmbca: bcm4908: drop invalid switch cells
kconfig: fix infinite loop when expanding a macro at the end of file
hwtracing: hisi_ptt: Move type check to the beginning of hisi_ptt_pmu_event_init()
rtc: mt6397: select IRQ_DOMAIN instead of depending on it
serial: 8250_exar: Don't remove GPIO device on suspend
staging: greybus: fix get_channel_from_mode() failure path
usb: gadget: net2272: Use irqflags in the call to net2272_probe_fin
ASoC: rockchip: i2s-tdm: Fix inaccurate sampling rates
nouveau: reset the bo resource bus info after an eviction
tcp: Fix NEW_SYN_RECV handling in inet_twsk_purge()
rds: tcp: Fix use-after-free of net in reqsk_timer_handler().
octeontx2-af: Use matching wake_up API variant in CGX command interface
s390/vtime: fix average steal time calculation
net/sched: taprio: proper TCA_TAPRIO_TC_ENTRY_INDEX check
soc: fsl: dpio: fix kcalloc() argument order
tcp: Fix refcnt handling in __inet_hash_connect().
hsr: Fix uninit-value access in hsr_get_node()
nvme: only set reserved_tags in nvme_alloc_io_tag_set for fabrics controllers
nvme: add the Apple shared tag workaround to nvme_alloc_io_tag_set
nvme: fix reconnection fail due to reserved tag allocation
net: mediatek: mtk_eth_soc: clear MAC_MCR_FORCE_LINK only when MAC is up
net: ethernet: mtk_eth_soc: fix PPE hanging issue
packet: annotate data-races around ignore_outgoing
net: veth: do not manipulate GRO when using XDP
net: dsa: mt7530: prevent possible incorrect XTAL frequency selection
drm: Fix drm_fixp2int_round() making it add 0.5
vdpa_sim: reset must not run
vdpa/mlx5: Allow CVQ size changes
wireguard: receive: annotate data-race around receiving_counter.counter
rds: introduce acquire/release ordering in acquire/release_in_xmit()
hsr: Handle failures in module init
ipv4: raw: Fix sending packets from raw sockets via IPsec tunnels
net: phy: fix phy_read_poll_timeout argument type in genphy_loopback
dm-integrity: fix a memory leak when rechecking the data
net/bnx2x: Prevent access to a freed page in page_pool
octeontx2-af: recover CPT engine when it gets fault
octeontx2-af: add mbox for CPT LF reset
octeontx2-af: optimize cpt pf identification
octeontx2-af: add mbox to return CPT_AF_FLT_INT info
octeontx2: Detect the mbox up or down message via register
net: octeontx2: Use alloc_ordered_workqueue() to create ordered workqueues
octeontx2-pf: Use default max_active works instead of one
octeontx2-pf: Send UP messages to VF only when VF is up.
octeontx2-af: Use separate handlers for interrupts
netfilter: nft_set_pipapo: release elements in clone only from destroy path
netfilter: nf_tables: do not compare internal table flags on updates
rcu: add a helper to report consolidated flavor QS
net: report RCU QS on threaded NAPI repolling
bpf: report RCU QS in cpumap kthread
net: dsa: mt7530: fix link-local frames that ingress vlan filtering ports
net: dsa: mt7530: fix handling of all link-local frames
spi: spi-mt65xx: Fix NULL pointer access in interrupt handler
selftests: forwarding: Fix ping failure due to short timeout
dm: address indent/space issues
dm io: Support IO priority
dm-integrity: align the outgoing bio in integrity_recheck
x86/efistub: Clear decompressor BSS in native EFI entrypoint
x86/efistub: Don't clear BSS twice in mixed mode
remoteproc: stm32: fix incorrect optional pointers
Linux 6.1.83
Change-Id: I621b271ff4a4603b0a348b64edc9c942bf050047
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
|
||
|
Greg Kroah-Hartman
|
96cbfc5879 |
Merge 6.1.82 into android14-6.1-lts
Changes in 6.1.82
ceph: switch to corrected encoding of max_xattr_size in mdsmap
net: lan78xx: fix runtime PM count underflow on link stop
ixgbe: {dis, en}able irqs in ixgbe_txrx_ring_{dis, en}able
i40e: disable NAPI right after disabling irqs when handling xsk_pool
ice: reorder disabling IRQ and NAPI in ice_qp_dis
tracing/net_sched: Fix tracepoints that save qdisc_dev() as a string
geneve: make sure to pull inner header in geneve_rx()
net: sparx5: Fix use after free inside sparx5_del_mact_entry
ice: virtchnl: stop pretending to support RSS over AQ or registers
net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink()
igc: avoid returning frame twice in XDP_REDIRECT
net/ipv6: avoid possible UAF in ip6_route_mpath_notify()
cpumap: Zero-initialise xdp_rxq_info struct before running XDP program
net: dsa: microchip: fix register write order in ksz8_ind_write8()
net/rds: fix WARNING in rds_conn_connect_if_down
netfilter: nft_ct: fix l3num expectations with inet pseudo family
netfilter: nf_conntrack_h323: Add protection for bmp length out of range
erofs: apply proper VMA alignment for memory mapped files on THP
netrom: Fix a data-race around sysctl_netrom_default_path_quality
netrom: Fix a data-race around sysctl_netrom_obsolescence_count_initialiser
netrom: Fix data-races around sysctl_netrom_network_ttl_initialiser
netrom: Fix a data-race around sysctl_netrom_transport_timeout
netrom: Fix a data-race around sysctl_netrom_transport_maximum_tries
netrom: Fix a data-race around sysctl_netrom_transport_acknowledge_delay
netrom: Fix a data-race around sysctl_netrom_transport_busy_delay
netrom: Fix a data-race around sysctl_netrom_transport_requested_window_size
netrom: Fix a data-race around sysctl_netrom_transport_no_activity_timeout
netrom: Fix a data-race around sysctl_netrom_routing_control
netrom: Fix a data-race around sysctl_netrom_link_fails_count
netrom: Fix data-races around sysctl_net_busy_read
KVM: s390: add stat counter for shadow gmap events
KVM: s390: vsie: fix race during shadow creation
ASoC: codecs: wcd938x: fix headphones volume controls
drm/amd/display: Fix uninitialized variable usage in core_link_ 'read_dpcd() & write_dpcd()' functions
nfp: flower: add goto_chain_index for ct entry
nfp: flower: add hardware offload check for post ct entry
readahead: avoid multiple marked readahead pages
selftests/mm: switch to bash from sh
selftests: mm: fix map_hugetlb failure on 64K page size systems
xhci: process isoc TD properly when there was a transaction error mid TD.
xhci: handle isoc Babble and Buffer Overrun events properly
drm/amdgpu: Reset IH OVERFLOW_CLEAR bit
x86/mmio: Disable KVM mitigation when X86_FEATURE_CLEAR_CPU_BUF is set
Documentation/hw-vuln: Add documentation for RFDS
x86/rfds: Mitigate Register File Data Sampling (RFDS)
KVM/x86: Export RFDS_NO and RFDS_CLEAR to guests
selftests: mptcp: decrease BW in simult flows
drm/amd/display: Wrong colorimetry workaround
drm/amd/display: Fix MST Null Ptr for RV
getrusage: add the "signal_struct *sig" local variable
getrusage: move thread_group_cputime_adjusted() outside of lock_task_sighand()
getrusage: use __for_each_thread()
getrusage: use sig->stats_lock rather than lock_task_sighand()
fs/proc: do_task_stat: use __for_each_thread()
fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats
Linux 6.1.82
Change-Id: I8d895a098144f39d40badf314fbb4a632c5ace49
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
|
||
|
Robin Hsu
|
274e3e9696 |
ANDROID: export one function for mm metrics
export function for sysfs node formating Bug: 299190787 Change-Id: I71e6a0815efa8df99d036bf457b8a0081999f3de Signed-off-by: Robin Hsu <robinhsu@google.com> |
||
|
Qais Yousef
|
117a941226 |
ANDROID: Update the ABI symbol list
Adding the following symbols: - drm_hdmi_avi_infoframe_from_display_mode - hdmi_avi_infoframe_pack - sysctl_sched_wakeup_granularity Bug: 337139487 Change-Id: I08ff1f4406e14fd42fee255d3eb49ccbd9c9b338 Signed-off-by: Qais Yousef <qyousef@google.com> |
||
|
Qais Yousef
|
0d080e01a2 |
ANDROID: Export sysctl_sched_wakeup_granularity to enable modifying it
The value is only available in debugfs. Export it to allow out of tree modules to modify it. Bug: 337139487 Signed-off-by: Qais Yousef <qyousef@google.com> Change-Id: I4b3a5aeeee0539b88756aacc97df6181f68d9d0d |
||
|
Matias Ezequiel Vara Larsen
|
039d2a958c |
UPSTREAM: ALSA: virtio: use ack callback
This commit uses the ack() callback to determine when a buffer has been updated, then exposes it to guest. The current mechanism splits a dma buffer into descriptors that are exposed to the device. This dma buffer is shared with the user application. When the device consumes a buffer, the driver moves the request from the used ring to available ring. The driver exposes the buffer to the device without knowing if the content has been updated from the user. The section 2.8.21.1 of the virtio spec states that: "The device MAY access the descriptor chains the driver created and the memory they refer to immediately". If the device picks up buffers from the available ring just after it is notified, it happens that the content may be old. When the ack() callback is invoked, the driver exposes only the buffers that have already been updated, i.e., enqueued in the available ring. Thus, the device always picks up a buffer that is updated. For capturing, the driver starts by exposing all the available buffers to device. After device updates the content of a buffer, it enqueues it in the used ring. It is only after the ack() for capturing is issued that the driver re-enqueues the buffer in the available ring. Co-developed-by: Anton Yakovlev <anton.yakovlev@opensynergy.com> Signed-off-by: Anton Yakovlev <anton.yakovlev@opensynergy.com> Signed-off-by: Matias Ezequiel Vara Larsen <mvaralar@redhat.com> Link: https://lore.kernel.org/r/ZTjkn1YAFz67yfqx@fedora Signed-off-by: Takashi Iwai <tiwai@suse.de> Bug: 331600622 Change-Id: If1269f1777432256eea0e0275b678d0d649753bb (cherry picked from commit fe981e67568c41de6caae25d70b5f203b94452cc) Signed-off-by: Brian Daniels <briandaniels@google.com> |
||
|
Greg Kroah-Hartman
|
045f29a0bd |
Revert "usb: gadget: Properly configure the device for remote wakeup"
This reverts commit |
||
|
Greg Kroah-Hartman
|
2e193db1b4 |
Revert "scsi: sd: usb_storage: uas: Access media prior to querying device properties"
This reverts commit
|
||
|
Greg Kroah-Hartman
|
3011e898b2 |
Revert "Bluetooth: hci_qca: mark OF related data as maybe unused"
This reverts commit |
||
|
Greg Kroah-Hartman
|
a3778f3e13 |
Revert "Bluetooth: hci_qca: Add support for QTI Bluetooth chip wcn6855"
This reverts commit |
||
|
Greg Kroah-Hartman
|
d9340ec8dd |
Revert "Bluetooth: btqca: use le32_to_cpu for ver.soc_id"
This reverts commit |
||
|
Greg Kroah-Hartman
|
b904eebfd4 |
Revert "Bluetooth: btqca: Add WCN3988 support"
This reverts commit |
||
|
Greg Kroah-Hartman
|
55a316da31 |
Revert "Bluetooth: qca: use switch case for soc type behavior"
This reverts commit |
||
|
Greg Kroah-Hartman
|
360b41bc65 |
Revert "Bluetooth: qca: add support for WCN7850"
This reverts commit |
||
|
Greg Kroah-Hartman
|
e075d7f47a |
Revert "Bluetooth: hci_qca: Set BDA quirk bit if fwnode exists in DT"
This reverts commit
|
||
|
RD Babiera
|
47dfe41d57 |
UPSTREAM: usb: typec: tcpm: clear pd_event queue in PORT_RESET
When a Fast Role Swap control message attempt results in a transition
to ERROR_RECOVERY, the TCPC can still queue a TCPM_SOURCING_VBUS event.
If the event is queued but processed after the tcpm_reset_port() call
in the PORT_RESET state, then the following occurs:
1. tcpm_reset_port() calls tcpm_init_vbus() to reset the vbus sourcing and
sinking state
2. tcpm_pd_event_handler() turns VBUS on before the port is in the default
state.
3. The port resolves as a sink. In the SNK_DISCOVERY state,
tcpm_set_charge() cannot set vbus to charge.
Clear pd events within PORT_RESET to get rid of non-applicable events.
Fixes:
|
||
|
RD Babiera
|
93188d7732 |
BACKPORT: usb: typec: tcpm: enforce ready state when queueing alt mode vdm
Before sending Enter Mode for an Alt Mode, there is a gap between Discover
Modes and the Alt Mode driver queueing the Enter Mode VDM for the port
partner to send a message to the port.
If this message results in unregistering Alt Modes such as in a DR_SWAP,
then the following deadlock can occur with respect to the DisplayPort Alt
Mode driver:
1. The DR_SWAP state holds port->lock. Unregistering the Alt Mode driver
results in a cancel_work_sync() that waits for the current dp_altmode_work
to finish.
2. dp_altmode_work makes a call to tcpm_altmode_enter. The deadlock occurs
because tcpm_queue_vdm_unlock attempts to hold port->lock.
Before attempting to grab the lock, ensure that the port is in a state
vdm_run_state_machine can run in. Alt Mode unregistration will not occur
in these states.
Fixes:
|
||
|
Joe Fradley
|
4d55129aea |
UPSTREAM: crypto: x86/curve25519 - disable gcov
curve25519-x86_64.c fails to build when CONFIG_GCOV_KERNEL is enabled.
The error is "inline assembly requires more registers than available"
thrown from the `fsqr()` function. Therefore, excluding this file from
GCOV profiling until this issue is resolved. Thereby allowing
CONFIG_GCOV_PROFILE_ALL to be enabled for x86.
Change-Id: Icbb1ed0e1b99f1cb0a21ea7a2920b3edce70c38d
Signed-off-by: Joe Fradley <joefradley@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
(cherry picked from commit
|
||
|
Priyansh Jain
|
cf685d2b02 |
ANDROID: GKI: Update QCOM symbol list and ABI STG
Update QCOM symbol list in android/abi_gki_aarch64_qcom with following
symbols.
4 function symbol(s) added
'struct powercap_control_type* powercap_register_control_type(struct powercap_control_type*,
const char*, const struct powercap_control_type_ops*)'
'struct powercap_zone* powercap_register_zone(struct powercap_zone*,
struct powercap_control_type*, const char*, struct powercap_zone*,
const struct powercap_zone_ops*, int, const struct powercap_zone_constraint_ops*)'
'int powercap_unregister_control_type(struct powercap_control_type*)'
'int powercap_unregister_zone(struct powercap_control_type*, struct powercap_zone*)'
Bug: 338523446
Change-Id: Ie1305e6231532c824bd11bcc1e0abecdb55109aa
Signed-off-by: Priyansh Jain <quic_priyjain@quicinc.com>
Signed-off-by: Will McVicker <willmcvicker@google.com>
|
||
|
fengqi
|
fae94bc4e7 |
ANDROID: GKI: update symbol list file for xiaomi
INFO: 68 function symbol(s) added 'int __break_lease(struct inode*, unsigned int, unsigned int)' 'void __d_lookup_unhash_wake(struct dentry*)' 'int __folio_lock_killable(struct folio*)' 'int add_swap_extent(struct swap_info_struct*, unsigned long, unsigned long, sector_t)' 'int asn1_ber_decoder(const struct asn1_decoder*, void*, const unsigned char*, size_t)' 'size_t copy_page_from_iter(struct page*, size_t, size_t, struct iov_iter*)' 'size_t copy_page_to_iter(struct page*, size_t, size_t, struct iov_iter*)' 'struct dentry* d_alloc_parallel(struct dentry*, const struct qstr*, wait_queue_head_t*)' 'void d_drop(struct dentry*)' 'struct dentry* d_hash_and_lookup(struct dentry*, struct qstr*)' 'void d_invalidate(struct dentry*)' 'void d_move(struct dentry*, struct dentry*)' 'void deactivate_super(struct super_block*)' 'int errseq_check(errseq_t*, errseq_t)' 'int file_modified(struct file*)' 'vm_fault_t filemap_map_pages(struct vm_fault*, unsigned long, unsigned long)' 'int finish_no_open(struct file*, struct dentry*)' 'int finish_open(struct file*, struct dentry*, int(*)(struct inode*, struct file*))' 'bool folio_clear_dirty_for_io(struct folio*)' 'void folio_wait_private_2(struct folio*)' 'int fs_param_is_bool(struct p_log*, const struct fs_parameter_spec*, struct fs_parameter*, struct fs_parse_result*)' 'int fs_param_is_u64(struct p_log*, const struct fs_parameter_spec*, struct fs_parameter*, struct fs_parse_result*)' 'void generate_random_uuid(unsigned char*)' 'ssize_t generic_copy_file_range(struct file*, loff_t, struct file*, loff_t, size_t, unsigned int)' 'ssize_t generic_file_write_iter(struct kiocb*, struct iov_iter*)' 'int generic_key_instantiate(struct key*, struct key_preparsed_payload*)' 'int generic_setlease(struct file*, long, struct file_lock**, void**)' 'int invalidate_inode_pages2(struct address_space*)' 'void iov_iter_bvec(struct iov_iter*, unsigned int, const struct bio_vec*, unsigned long, size_t)' 'void iov_iter_discard(struct iov_iter*, unsigned int, size_t)' 'ssize_t iov_iter_get_pages_alloc2(struct iov_iter*, struct page***, size_t, size_t*)' 'int iov_iter_npages(const struct iov_iter*, int)' 'void key_invalidate(struct key*)' 'void key_revoke(struct key*)' 'int key_validate(const struct key*)' 'void lock_two_nondirectories(struct inode*, struct inode*)' 'int locks_lock_inode_wait(struct inode*, struct file_lock*)' 'enum OID look_up_OID(const void*, size_t)' 'struct dentry* lookup_positive_unlocked(const char*, struct dentry*, int)' 'int out_of_line_wait_on_bit_lock(void*, int, wait_bit_action_f*, unsigned int)' 'const struct cred* override_creds(const struct cred*)' 'int posix_lock_file(struct file*, struct file_lock*, struct file_lock*)' 'void posix_test_lock(struct file*, struct file_lock*)' 'struct cred* prepare_kernel_cred(struct task_struct*)' 'int register_key_type(struct key_type*)' 'struct key* request_key_tag(struct key_type*, const char*, struct key_tag*, const char*)' 'void revert_creds(const struct cred*)' 'int security_sb_eat_lsm_opts(char*, void**)' 'void seq_escape_mem(struct seq_file*, const char*, size_t, unsigned int, const char*)' 'int set_anon_super(struct super_block*, void*)' 'struct super_block* sget(struct file_system_type*, int(*)(struct super_block*, void*), int(*)(struct super_block*, void*), int, void*)' 'int sock_sendmsg(struct socket*, struct msghdr*)' 'int sprint_oid(const void*, size_t, char*, size_t)' 'int super_setup_bdi(struct super_block*)' 'void tcp_sock_set_cork(struct sock*, bool)' 'void tcp_sock_set_nodelay(struct sock*)' 'void truncate_inode_pages_range(struct address_space*, loff_t, loff_t)' 'void truncate_pagecache_range(struct inode*, loff_t, loff_t)' 'void unlock_two_nondirectories(struct inode*, struct inode*)' 'void unregister_key_type(struct key_type*)' 'void user_describe(const struct key*, struct seq_file*)' 'void user_destroy(struct key*)' 'long user_read(const struct key*, char*, size_t)' 'void user_revoke(struct key*)' 'int utf8s_to_utf16s(const u8*, int, enum utf16_endian, wchar_t*, int)' 'int vfs_parse_fs_string(struct fs_context*, const char*, const char*, size_t)' 'loff_t vfs_setpos(struct file*, loff_t, loff_t)' 'void wait_on_page_writeback(struct page*)' 1 variable symbol(s) added 'struct key_type key_type_logon' Bug: 334801999 Change-Id: I89f2029bb73155ffd0dd4236de32a7c74d1a8f48 Signed-off-by: fengqi <fengqi@xiaomi.corp-partner.google.com> |
||
|
Florian Westphal
|
d5e04556d4 |
UPSTREAM: netfilter: nft_set_pipapo: do not free live element
[ Upstream commit 3cfc9ec039af60dbd8965ae085b2c2ccdcfbe1cc ]
Pablo reports a crash with large batches of elements with a
back-to-back add/remove pattern. Quoting Pablo:
add_elem("00000000") timeout 100 ms
...
add_elem("0000000X") timeout 100 ms
del_elem("0000000X") <---------------- delete one that was just added
...
add_elem("00005000") timeout 100 ms
1) nft_pipapo_remove() removes element 0000000X
Then, KASAN shows a splat.
Looking at the remove function there is a chance that we will drop a
rule that maps to a non-deactivated element.
Removal happens in two steps, first we do a lookup for key k and return the
to-be-removed element and mark it as inactive in the next generation.
Then, in a second step, the element gets removed from the set/map.
The _remove function does not work correctly if we have more than one
element that share the same key.
This can happen if we insert an element into a set when the set already
holds an element with same key, but the element mapping to the existing
key has timed out or is not active in the next generation.
In such case its possible that removal will unmap the wrong element.
If this happens, we will leak the non-deactivated element, it becomes
unreachable.
The element that got deactivated (and will be freed later) will
remain reachable in the set data structure, this can result in
a crash when such an element is retrieved during lookup (stale
pointer).
Add a check that the fully matching key does in fact map to the element
that we have marked as inactive in the deactivation step.
If not, we need to continue searching.
Add a bug/warn trap at the end of the function as well, the remove
function must not ever be called with an invisible/unreachable/non-existent
element.
v2: avoid uneeded temporary variable (Stefano)
Bug: 336735501
Fixes:
|
||
|
Jakub Kicinski
|
dc6facfe02 |
UPSTREAM: net: tls: handle backlogging of crypto requests
commit 8590541473188741055d27b955db0777569438e3 upstream.
Since we're setting the CRYPTO_TFM_REQ_MAY_BACKLOG flag on our
requests to the crypto API, crypto_aead_{encrypt,decrypt} can return
-EBUSY instead of -EINPROGRESS in valid situations. For example, when
the cryptd queue for AESNI is full (easy to trigger with an
artificially low cryptd.cryptd_max_cpu_qlen), requests will be enqueued
to the backlog but still processed. In that case, the async callback
will also be called twice: first with err == -EINPROGRESS, which it
seems we can just ignore, then with err == 0.
Compared to Sabrina's original patch this version uses the new
tls_*crypt_async_wait() helpers and converts the EBUSY to
EINPROGRESS to avoid having to modify all the error handling
paths. The handling is identical.
Bug: 326215202
Fixes:
|
||
|
Kalesh Singh
|
1794308d46 |
ANDROID: 16K: Fix show maps CFI failure
If the kernel is built CONFIG_CFI_CLANG=y, reading smaps may cause a panic. This is due to a failed CFI check; which is triggered becuase the signature of the function pointer for printing smaps padding VMAs does not match exactly with that for show_smap(). Fix this by casting the function pointer to the expected type based on whether printing maps or smaps padding. Bug: 330117029 Bug: 327600007 Bug: 330767927 Bug: 328266487 Bug: 329803029 Change-Id: I65564a547dacbc4131f8557344c8c96e51f90cd5 Signed-off-by: Kalesh Singh <kaleshsingh@google.com> |
||
|
Kalesh Singh
|
72a9c0a205 |
ANDROID: 16K: Handle pad VMA splits and merges
In some cases a VMA with padding representation may be split, and
therefore the padding flags must be updated accordingly.
There are 3 cases to handle:
Given:
| DDDDPPPP |
where:
- D represents 1 page of data;
- P represents 1 page of padding;
- | represents the boundaries (start/end) of the VMA
1) Split exactly at the padding boundary
| DDDDPPPP | --> | DDDD | PPPP |
- Remove padding flags from the first VMA.
- The second VMA is all padding
2) Split within the padding area
| DDDDPPPP | --> | DDDDPP | PP |
- Subtract the length of the second VMA from the first VMA's
padding.
- The second VMA is all padding, adjust its padding length (flags)
3) Split within the data area
| DDDDPPPP | --> | DD | DDPPPP |
- Remove padding flags from the first VMA.
- The second VMA is has the same padding as from before the split.
To simplify the semantics merging of padding VMAs is not allowed.
If a split produces a VMA that is entirely padding, show_[s]maps()
only outputs the padding VMA entry (as the data entry is of length 0).
Bug: 330117029
Bug: 327600007
Bug: 330767927
Bug: 328266487
Bug: 329803029
Change-Id: Ie2628ced5512e2c7f8af25fabae1f38730c8bb1a
Signed-off-by: Kalesh Singh <kaleshsingh@google.com>
|
||
|
Kalesh Singh
|
b86b5cb22d |
ANDROID: 16K: madvise_vma_pad_pages: Remove filemap_fault check
Some file systems like F2FS use a custom filemap_fault ops. Remove this check, as checking vm_file is sufficient. Bug: 330117029 Bug: 327600007 Bug: 330767927 Bug: 328266487 Bug: 329803029 Change-Id: Id6a584d934f06650c0a95afd1823669fc77ba2c2 Signed-off-by: Kalesh Singh <kaleshsingh@google.com> |
||
|
Kalesh Singh
|
1657717c12 |
ANDROID: 16K: Only madvise padding from dynamic linker context
Only preform padding advise from the execution context on bionic's dynamic linker. This ensures that madvise() doesn't have unwanted side effects. Also rearrange the order of fail checks in madvise_vma_pad_pages() in order of ascending cost. Bug: 330117029 Bug: 327600007 Bug: 330767927 Bug: 328266487 Bug: 329803029 Change-Id: I3e05b8780c6eda78007f86b613f8c11dd18ac28f Signed-off-by: Kalesh Singh <kaleshsingh@google.com> |
||
|
Kalesh Singh
|
2ca5e076c9 |
ANDROID: 16K: Separate padding from ELF LOAD segment mappings
In has been found that some in-field apps depend on the output of
/proc/*/maps to determine the address ranges of other operations.
With the extension of LOAD segments VMAs to be contiguous in memory,
the apps may perform operations on an area that is not backed by the
underlying file, which results in a SIGBUS. Other apps have crashed
with yet unindentified reasons.
To avoid breaking in-field apps, maintain the output of /proc/*/[s]maps
with PROT_NONE VMAs for the padding pages of LOAD segments instead of
showing the segment extensions.
NOTE: This does not allocate actual backing VMAs for the shown
PROT_NONE mappings.
This approach maintains 2 possible assumptions that userspace (apps)
could be depending on:
1) That LOAD segment mappings are "contiguous" (not speparated by
unrelated mappings) in memory.
2) That no virtual address space is available between mappings of
consecutive LOAD segments for the same ELF.
For example the output of /proc/*/[s]maps before and after this change
is shown below. Segments maintain PROT_NONE gaps ("[page size compat]")
for app compatiblity but these are not backed by actual slab VMA memory.
Maps Before:
7fb03604d000-7fb036051000 r--p 00000000 fe:09 21935719 /system/lib64/libnetd_client.so
7fb036051000-7fb036055000 r-xp 00004000 fe:09 21935719 /system/lib64/libnetd_client.so
7fb036055000-7fb036059000 r--p 00008000 fe:09 21935719 /system/lib64/libnetd_client.so
7fb036059000-7fb03605a000 rw-p 0000c000 fe:09 21935719 /system/lib64/libnetd_client.so
Maps After:
7fc707390000-7fc707393000 r--p 00000000 fe:09 21935719 /system/lib64/libnetd_client.so
7fc707393000-7fc707394000 ---p 00000000 00:00 0 [page size compat]
7fc707394000-7fc707398000 r-xp 00004000 fe:09 21935719 /system/lib64/libnetd_client.so
7fc707398000-7fc707399000 r--p 00008000 fe:09 21935719 /system/lib64/libnetd_client.so
7fc707399000-7fc70739c000 ---p 00000000 00:00 0 [page size compat]
7fc70739c000-7fc70739d000 rw-p 0000c000 fe:09 21935719 /system/lib64/libnetd_client.so
Smaps Before:
7fb03604d000-7fb036051000 r--p 00000000 fe:09 21935719 /system/lib64/libnetd_client.so
Size: 16 kB
KernelPageSize: 4 kB
MMUPageSize: 4 kB
Rss: 16 kB
Pss: 0 kB
Pss_Dirty: 0 kB
Shared_Clean: 16 kB
Shared_Dirty: 0 kB
Private_Clean: 0 kB
Private_Dirty: 0 kB
Referenced: 16 kB
Anonymous: 0 kB
LazyFree: 0 kB
AnonHugePages: 0 kB
ShmemPmdMapped: 0 kB
FilePmdMapped: 0 kB
Shared_Hugetlb: 0 kB
Private_Hugetlb: 0 kB
Swap: 0 kB
SwapPss: 0 kB
Locked: 0 kB
THPeligible: 0
VmFlags: rd mr mw me
7fb036051000-7fb036055000 r-xp 00004000 fe:09 21935719 /system/lib64/libnetd_client.so
Size: 16 kB
KernelPageSize: 4 kB
MMUPageSize: 4 kB
Rss: 16 kB
Pss: 0 kB
Pss_Dirty: 0 kB
Shared_Clean: 16 kB
Shared_Dirty: 0 kB
Private_Clean: 0 kB
Private_Dirty: 0 kB
Referenced: 16 kB
Anonymous: 0 kB
LazyFree: 0 kB
AnonHugePages: 0 kB
ShmemPmdMapped: 0 kB
FilePmdMapped: 0 kB
Shared_Hugetlb: 0 kB
Private_Hugetlb: 0 kB
Swap: 0 kB
SwapPss: 0 kB
Locked: 0 kB
THPeligible: 0
VmFlags: rd ex mr mw me
7fb036055000-7fb036059000 r--p 00008000 fe:09 21935719 /system/lib64/libnetd_client.so
Size: 16 kB
KernelPageSize: 4 kB
MMUPageSize: 4 kB
Rss: 4 kB
Pss: 4 kB
Pss_Dirty: 4 kB
Shared_Clean: 0 kB
Shared_Dirty: 0 kB
Private_Clean: 0 kB
Private_Dirty: 4 kB
Referenced: 4 kB
Anonymous: 4 kB
LazyFree: 0 kB
AnonHugePages: 0 kB
ShmemPmdMapped: 0 kB
FilePmdMapped: 0 kB
Shared_Hugetlb: 0 kB
Private_Hugetlb: 0 kB
Swap: 0 kB
SwapPss: 0 kB
Locked: 0 kB
THPeligible: 0
VmFlags: rd mr mw me ac
7fb036059000-7fb03605a000 rw-p 0000c000 fe:09 21935719 /system/lib64/libnetd_client.so
Size: 4 kB
KernelPageSize: 4 kB
MMUPageSize: 4 kB
Rss: 4 kB
Pss: 4 kB
Pss_Dirty: 4 kB
Shared_Clean: 0 kB
Shared_Dirty: 0 kB
Private_Clean: 0 kB
Private_Dirty: 4 kB
Referenced: 4 kB
Anonymous: 4 kB
LazyFree: 0 kB
AnonHugePages: 0 kB
ShmemPmdMapped: 0 kB
FilePmdMapped: 0 kB
Shared_Hugetlb: 0 kB
Private_Hugetlb: 0 kB
Swap: 0 kB
SwapPss: 0 kB
Locked: 0 kB
THPeligible: 0
VmFlags: rd wr mr mw me ac
Smaps After:
7fc707390000-7fc707393000 r--p 00000000 fe:09 21935719 /system/lib64/libnetd_client.so
Size: 12 kB
KernelPageSize: 4 kB
MMUPageSize: 4 kB
Rss: 12 kB
Pss: 0 kB
Shared_Clean: 12 kB
Shared_Dirty: 0 kB
Private_Clean: 0 kB
Private_Dirty: 0 kB
Referenced: 12 kB
Anonymous: 0 kB
LazyFree: 0 kB
AnonHugePages: 0 kB
ShmemPmdMapped: 0 kB
FilePmdMapped: 0 kB
Shared_Hugetlb: 0 kB
Private_Hugetlb: 0 kB
Swap: 0 kB
SwapPss: 0 kB
Locked: 0 kB
THPeligible: 0
VmFlags: rd mr mw me ??
7fc707393000-7fc707394000 ---p 00000000 00:00 0 [page size compat]
Size: 4 kB
KernelPageSize: 4 kB
MMUPageSize: 4 kB
Rss: 0 kB
Pss: 0 kB
Shared_Clean: 0 kB
Shared_Dirty: 0 kB
Private_Clean: 0 kB
Private_Dirty: 0 kB
Referenced: 0 kB
Anonymous: 0 kB
LazyFree: 0 kB
AnonHugePages: 0 kB
ShmemPmdMapped: 0 kB
FilePmdMapped: 0 kB
Shared_Hugetlb: 0 kB
Private_Hugetlb: 0 kB
Swap: 0 kB
SwapPss: 0 kB
Locked: 0 kB
THPeligible: 0
VmFlags: mr mw me
7fc707394000-7fc707398000 r-xp 00004000 fe:09 21935719 /system/lib64/libnetd_client.so
Size: 16 kB
KernelPageSize: 4 kB
MMUPageSize: 4 kB
Rss: 16 kB
Pss: 0 kB
Shared_Clean: 16 kB
Shared_Dirty: 0 kB
Private_Clean: 0 kB
Private_Dirty: 0 kB
Referenced: 16 kB
Anonymous: 0 kB
LazyFree: 0 kB
AnonHugePages: 0 kB
ShmemPmdMapped: 0 kB
FilePmdMapped: 0 kB
Shared_Hugetlb: 0 kB
Private_Hugetlb: 0 kB
Swap: 0 kB
SwapPss: 0 kB
Locked: 0 kB
THPeligible: 0
VmFlags: rd ex mr mw me
7fc707398000-7fc707399000 r--p 00008000 fe:09 21935719 /system/lib64/libnetd_client.so
Size: 4 kB
KernelPageSize: 4 kB
MMUPageSize: 4 kB
Rss: 4 kB
Pss: 4 kB
Shared_Clean: 0 kB
Shared_Dirty: 0 kB
Private_Clean: 0 kB
Private_Dirty: 4 kB
Referenced: 4 kB
Anonymous: 4 kB
LazyFree: 0 kB
AnonHugePages: 0 kB
ShmemPmdMapped: 0 kB
FilePmdMapped: 0 kB
Shared_Hugetlb: 0 kB
Private_Hugetlb: 0 kB
Swap: 0 kB
SwapPss: 0 kB
Locked: 0 kB
THPeligible: 0
VmFlags: rd mr mw me ac ?? ??
7fc707399000-7fc70739c000 ---p 00000000 00:00 0 [page size compat]
Size: 12 kB
KernelPageSize: 4 kB
MMUPageSize: 4 kB
Rss: 0 kB
Pss: 0 kB
Shared_Clean: 0 kB
Shared_Dirty: 0 kB
Private_Clean: 0 kB
Private_Dirty: 0 kB
Referenced: 0 kB
Anonymous: 0 kB
LazyFree: 0 kB
AnonHugePages: 0 kB
ShmemPmdMapped: 0 kB
FilePmdMapped: 0 kB
Shared_Hugetlb: 0 kB
Private_Hugetlb: 0 kB
Swap: 0 kB
SwapPss: 0 kB
Locked: 0 kB
THPeligible: 0
VmFlags: mr mw me ac
7fc70739c000-7fc70739d000 rw-p 0000c000 fe:09 21935719 /system/lib64/libnetd_client.so
Size: 4 kB
KernelPageSize: 4 kB
MMUPageSize: 4 kB
Rss: 4 kB
Pss: 4 kB
Shared_Clean: 0 kB
Shared_Dirty: 0 kB
Private_Clean: 0 kB
Private_Dirty: 4 kB
Referenced: 4 kB
Anonymous: 4 kB
LazyFree: 0 kB
AnonHugePages: 0 kB
ShmemPmdMapped: 0 kB
FilePmdMapped: 0 kB
Shared_Hugetlb: 0 kB
Private_Hugetlb: 0 kB
Swap: 0 kB
SwapPss: 0 kB
Locked: 0 kB
THPeligible: 0
VmFlags: rd wr mr mw me ac
Bug: 330117029
Bug: 327600007
Bug: 330767927
Bug: 328266487
Bug: 329803029
Change-Id: I12bf2c106fafc74a500d79155b81dde5db42661e
Signed-off-by: Kalesh Singh <kaleshsingh@google.com>
|
||
|
Kalesh Singh
|
1537dbe21b |
ANDROID: 16K: Exclude ELF padding for fault around range
Userspace apps often analyze memory consumption by the use of mm rss_stat counters -- via the kmem/rss_stat trace event or from /proc/<pid>/statm. rss_stat counters are only updated when the PTEs are updated. What this means is that pages can be present in the page cache from readahead but not visible to userspace (not attributed to the app) as there is no corresponding VMA (PTEs) for the respective page cache pages. A side effect of the loader now extending ELF LOAD segments to be contiguously mapped in the virtual address space, means that the VMA is extended to cover the padding pages. When filesystems, such as f2fs and ext4, that implement vm_ops->map_pages() attempt to perform a do_fault_around() the extent of the fault around is restricted by the area of the enclosing VMA. Since the loader extends LOAD segment VMAs to be contiguously mapped, the extent of the fault around is also increased. The result of which, is that the PTEs corresponding to the padding pages are updated and reflected in the rss_stat counters. It is not common that userspace application developers be aware of this nuance in the kernel's memory accounting. To avoid apparent regressions in memory usage to userspace, restrict the fault around range to only valid data pages (i.e. exclude the padding pages at the end of the VMA). Bug: 330117029 Bug: 327600007 Bug: 330767927 Bug: 328266487 Bug: 329803029 Change-Id: I2c7a39ec1b040be2b9fb47801f95042f5dbf869d Signed-off-by: Kalesh Singh <kaleshsingh@google.com> |
||
|
Kalesh Singh
|
6815ef3195 |
ANDROID: 16K: Use MADV_DONTNEED to save VMA padding pages.
When performing LOAD segment extension, the dynamic linker knows what portion of the VMA is padding. In order for the kernel to implement mitigations that ensure app compatibility, the extent of the padding must be made available to the kernel. To achieve this, reuse MADV_DONTNEED on single VMAs to hint the padding range to the kernel. This information is then stored in vm_flag bits. This allows userspace (dynamic linker) to set the padding pages on the VMA without a need for new out-of-tree UAPI. Bug: 330117029 Bug: 327600007 Bug: 330767927 Bug: 328266487 Bug: 329803029 Change-Id: I3421de32ab38ad3cb0fbce73ecbd8f7314287cde Signed-off-by: Kalesh Singh <kaleshsingh@google.com> |
||
|
Kalesh Singh
|
6b9e404675 |
ANDROID: 16K: Introduce ELF padding representation for VMAs
The dynamic linker may extend ELF LOAD segment mappings to be contiguous in memory when loading a 16kB compatible ELF on a 4kB page-size system. This is done to reduce the use of unreclaimable VMA slab memory for the otherwise necessary "gap" VMAs. The extended portion of the mapping (VMA) can be viewed as "padding", meaning that the mapping in that range corresponds to an area of the file that does not contain contents of the respective segments (maybe zero's depending on how the ELF is built). For some compatibility mitigations, the region of a VMA corresponding to these padding sections need to be known. In order to represent such regions without adding addtional overhead or breaking ABI, some upper bits of vm_flags are used. Add the VMA padding pages representation and the necessary APIs to manipulate it. Bug: 330117029 Bug: 327600007 Bug: 330767927 Bug: 328266487 Bug: 329803029 Change-Id: Ieb9fa98e30ec9b0bec62256624f14e3ed6062a75 Signed-off-by: Kalesh Singh <kaleshsingh@google.com> |
||
|
Kalesh Singh
|
e79c1d4590 |
ANDROID: 16K: Introduce /sys/kernel/mm/pgsize_miration/enabled
Migrating from 4kB to 16kB page-size in Android requires first making
the platform page-agnostic, which involves increasing Android-ELFs'
max-page-size (p_align) from 4kB to 16kB.
Increasing the ELF max-page-size was found to cause compatibility issues
in apps that use obfuscation or depend on the ELF segments being mapped
based on 4kB-alignment.
Working around these compatibility issues involves both kernel and
userspace (dynamic linker) changes.
Introduce a knob for userspace (dynamic linker) to determine whether the
kernel supports the mitigations needed for page-size migration compatibility.
The knob also allows for userspace to turn on or off these mitigations
by writing 1 or 0 to /sys/kernel/mm/pgsize_miration/enabled:
echo 1 > /sys/kernel/mm//pgsize_miration/enabled # Enable
echo 0 > /sys/kernel/mm//pgsize_miration/enabled # Disable
Bug: 330117029
Bug: 327600007
Bug: 330767927
Bug: 328266487
Bug: 329803029
Change-Id: I9ac1d15d397b8226b27827ecffa30502da91e10e
Signed-off-by: Kalesh Singh <kaleshsingh@google.com>
|
||
|
Greg Kroah-Hartman
|
909ba1f1b4 |
Linux 6.1.90
Link: https://lore.kernel.org/r/20240430103047.561802595@linuxfoundation.org Tested-by: Salvatore Bonaccorso <carnil@debian.org> Tested-by: SeongJae Park <sj@kernel.org> Tested-by: Florian Fainelli <florian.fainelli@broadcom.com> Tested-by: Ron Economos <re@w6rz.net> Tested-by: Linux Kernel Functional Testing <lkft@linaro.org> Tested-by: Miguel Ojeda <ojeda@kernel.org> Tested-by: Jon Hunter <jonathanh@nvidia.com> Tested-by: Mateusz Jończyk <mat.jonczyk@o2.pl> Tested-by: Pavel Machek (CIP) <pavel@denx.de> Tested-by: Shuah Khan <skhan@linuxfoundation.org> Tested-by: Pascal Ernster <git@hardfalcon.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|
Rahul Rameshbabu
|
ca817d44be |
net/mlx5e: Advertise mlx5 ethernet driver updates sk_buff md_dst for MACsec
commit 39d26a8f2efcb8b5665fe7d54a7dba306a8f1dff upstream.
mlx5 Rx flow steering and CQE handling enable the driver to be able to
update an skb's md_dst attribute as MACsec when MACsec traffic arrives when
a device is configured for offloading. Advertise this to the core stack to
take advantage of this capability.
Cc: stable@vger.kernel.org
Fixes:
|
||
|
Rahul Rameshbabu
|
21e042d29e |
macsec: Detect if Rx skb is macsec-related for offloading devices that update md_dst
commit 642c984dd0e37dbaec9f87bd1211e5fac1f142bf upstream.
Can now correctly identify where the packets should be delivered by using
md_dst or its absence on devices that provide it.
This detection is not possible without device drivers that update md_dst. A
fallback pattern should be used for supporting such device drivers. This
fallback mode causes multicast messages to be cloned to both the non-macsec
and macsec ports, independent of whether the multicast message received was
encrypted over MACsec or not. Other non-macsec traffic may also fail to be
handled correctly for devices in promiscuous mode.
Link: https://lore.kernel.org/netdev/ZULRxX9eIbFiVi7v@hog/
Cc: Sabrina Dubroca <sd@queasysnail.net>
Cc: stable@vger.kernel.org
Fixes:
|
||
|
Rahul Rameshbabu
|
6536f12fe2 |
macsec: Enable devices to advertise whether they update sk_buff md_dst during offloads
commit 475747a19316b08e856c666a20503e73d7ed67ed upstream.
Omit rx_use_md_dst comment in upstream commit since macsec_ops is not
documented.
Cannot know whether a Rx skb missing md_dst is intended for MACsec or not
without knowing whether the device is able to update this field during an
offload. Assume that an offload to a MACsec device cannot support updating
md_dst by default. Capable devices can advertise that they do indicate that
an skb is related to a MACsec offloaded packet using the md_dst.
Cc: Sabrina Dubroca <sd@queasysnail.net>
Cc: stable@vger.kernel.org
Fixes:
|
||
|
Matthew Wilcox (Oracle)
|
9b7c5004d7 |
bounds: Use the right number of bits for power-of-two CONFIG_NR_CPUS
commit 5af385f5f4cddf908f663974847a4083b2ff2c79 upstream. bits_per() rounds up to the next power of two when passed a power of two. This causes crashes on some machines and configurations. Reported-by: Михаил Новоселов <m.novosyolov@rosalinux.ru> Tested-by: Ильфат Гаптрахманов <i.gaptrakhmanov@rosalinux.ru> Link: https://gitlab.freedesktop.org/drm/amd/-/issues/3347 Link: https://lore.kernel.org/all/1c978cf1-2934-4e66-e4b3-e81b04cb3571@rosalinux.ru/ Fixes: f2d5dcb48f7b (bounds: support non-power-of-two CONFIG_NR_CPUS) Cc: <stable@vger.kernel.org> Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org> Cc: Rik van Riel <riel@surriel.com> Cc: Mel Gorman <mgorman@techsingularity.net> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Ingo Molnar <mingo@kernel.org> Cc: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|
Wolfram Sang
|
4e75e222d3 |
i2c: smbus: fix NULL function pointer dereference
[ Upstream commit 91811a31b68d3765b3065f4bb6d7d6d84a7cfc9f ]
Baruch reported an OOPS when using the designware controller as target
only. Target-only modes break the assumption of one transfer function
always being available. Fix this by always checking the pointer in
__i2c_transfer.
Reported-by: Baruch Siach <baruch@tkos.co.il>
Closes: https://lore.kernel.org/r/4269631780e5ba789cf1ae391eec1b959def7d99.1712761976.git.baruch@tkos.co.il
Fixes:
|
||
|
Hans de Goede
|
25b3498485 |
phy: ti: tusb1210: Resolve charger-det crash if charger psy is unregistered
[ Upstream commit bf6e4ee5c43690e4c5a8a057bbcd4ff986bed052 ]
The power_supply frame-work is not really designed for there to be
long living in kernel references to power_supply devices.
Specifically unregistering a power_supply while some other code has
a reference to it triggers a WARN in power_supply_unregister():
WARN_ON(atomic_dec_return(&psy->use_cnt));
Folllowed by the power_supply still getting removed and the
backing data freed anyway, leaving the tusb1210 charger-detect code
with a dangling reference, resulting in a crash the next time
tusb1210_get_online() is called.
Fix this by only holding the reference in tusb1210_get_online()
freeing it at the end of the function. Note this still leaves
a theoretical race window, but it avoids the issue when manually
rmmod-ing the charger chip driver during development.
Fixes:
|
||
|
Samuel Holland
|
4201b8c8f2 |
riscv: Fix TASK_SIZE on 64-bit NOMMU
[ Upstream commit 6065e736f82c817c9a597a31ee67f0ce4628e948 ] On NOMMU, userspace memory can come from anywhere in physical RAM. The current definition of TASK_SIZE is wrong if any RAM exists above 4G, causing spurious failures in the userspace access routines. Fixes: |
||
|
Baoquan He
|
0b947c90e3 |
riscv: fix VMALLOC_START definition
[ Upstream commit ac88ff6b9d7dea9f0907c86bdae204dde7d5c0e6 ]
When below config items are set, compiler complained:
--------------------
CONFIG_CRASH_CORE=y
CONFIG_KEXEC_CORE=y
CONFIG_CRASH_DUMP=y
......
-----------------------
-------------------------------------------------------------------
arch/riscv/kernel/crash_core.c: In function 'arch_crash_save_vmcoreinfo':
arch/riscv/kernel/crash_core.c:11:58: warning: format '%lx' expects argument of type 'long unsigned int', but argument 2 has type 'int' [-Wformat=]
11 | vmcoreinfo_append_str("NUMBER(VMALLOC_START)=0x%lx\n", VMALLOC_START);
| ~~^
| |
| long unsigned int
| %x
----------------------------------------------------------------------
This is because on riscv macro VMALLOC_START has different type when
CONFIG_MMU is set or unset.
arch/riscv/include/asm/pgtable.h:
--------------------------------------------------
Changing it to _AC(0, UL) in case CONFIG_MMU=n can fix the warning.
Link: https://lkml.kernel.org/r/ZW7OsX4zQRA3mO4+@MiWiFi-R3L-srv
Signed-off-by: Baoquan He <bhe@redhat.com>
Reported-by: Randy Dunlap <rdunlap@infradead.org>
Acked-by: Randy Dunlap <rdunlap@infradead.org>
Tested-by: Randy Dunlap <rdunlap@infradead.org> # build-tested
Cc: Eric DeVolder <eric_devolder@yahoo.com>
Cc: Ignat Korchagin <ignat@cloudflare.com>
Cc: Stephen Rothwell <sfr@canb.auug.org.au>
Cc: Paul Walmsley <paul.walmsley@sifive.com>
Cc: Palmer Dabbelt <palmer@dabbelt.com>
Cc: Albert Ou <aou@eecs.berkeley.edu>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Stable-dep-of: 6065e736f82c ("riscv: Fix TASK_SIZE on 64-bit NOMMU")
Signed-off-by: Sasha Levin <sashal@kernel.org>
|
||
|
Fenghua Yu
|
023b6390a1 |
dmaengine: idxd: Fix oops during rmmod on single-CPU platforms
[ Upstream commit f221033f5c24659dc6ad7e5cf18fb1b075f4a8be ]
During the removal of the idxd driver, registered offline callback is
invoked as part of the clean up process. However, on systems with only
one CPU online, no valid target is available to migrate the
perf context, resulting in a kernel oops:
BUG: unable to handle page fault for address: 000000000002a2b8
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
PGD 1470e1067 P4D 0
Oops: 0002 [#1] PREEMPT SMP NOPTI
CPU: 0 PID: 20 Comm: cpuhp/0 Not tainted 6.8.0-rc6-dsa+ #57
Hardware name: Intel Corporation AvenueCity/AvenueCity, BIOS BHSDCRB1.86B.2492.D03.2307181620 07/18/2023
RIP: 0010:mutex_lock+0x2e/0x50
...
Call Trace:
<TASK>
__die+0x24/0x70
page_fault_oops+0x82/0x160
do_user_addr_fault+0x65/0x6b0
__pfx___rdmsr_safe_on_cpu+0x10/0x10
exc_page_fault+0x7d/0x170
asm_exc_page_fault+0x26/0x30
mutex_lock+0x2e/0x50
mutex_lock+0x1e/0x50
perf_pmu_migrate_context+0x87/0x1f0
perf_event_cpu_offline+0x76/0x90 [idxd]
cpuhp_invoke_callback+0xa2/0x4f0
__pfx_perf_event_cpu_offline+0x10/0x10 [idxd]
cpuhp_thread_fun+0x98/0x150
smpboot_thread_fn+0x27/0x260
smpboot_thread_fn+0x1af/0x260
__pfx_smpboot_thread_fn+0x10/0x10
kthread+0x103/0x140
__pfx_kthread+0x10/0x10
ret_from_fork+0x31/0x50
__pfx_kthread+0x10/0x10
ret_from_fork_asm+0x1b/0x30
<TASK>
Fix the issue by preventing the migration of the perf context to an
invalid target.
Fixes:
|
||
|
Sean Anderson
|
8bf5741832 |
dma: xilinx_dpdma: Fix locking
[ Upstream commit 244296cc3a155199a8b080d19e645d7d49081a38 ]
There are several places where either chan->lock or chan->vchan.lock was
not held. Add appropriate locking. This fixes lockdep warnings like
[ 31.077578] ------------[ cut here ]------------
[ 31.077831] WARNING: CPU: 2 PID: 40 at drivers/dma/xilinx/xilinx_dpdma.c:834 xilinx_dpdma_chan_queue_transfer+0x274/0x5e0
[ 31.077953] Modules linked in:
[ 31.078019] CPU: 2 PID: 40 Comm: kworker/u12:1 Not tainted 6.6.20+ #98
[ 31.078102] Hardware name: xlnx,zynqmp (DT)
[ 31.078169] Workqueue: events_unbound deferred_probe_work_func
[ 31.078272] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 31.078377] pc : xilinx_dpdma_chan_queue_transfer+0x274/0x5e0
[ 31.078473] lr : xilinx_dpdma_chan_queue_transfer+0x270/0x5e0
[ 31.078550] sp : ffffffc083bb2e10
[ 31.078590] x29: ffffffc083bb2e10 x28: 0000000000000000 x27: ffffff880165a168
[ 31.078754] x26: ffffff880164e920 x25: ffffff880164eab8 x24: ffffff880164d480
[ 31.078920] x23: ffffff880165a148 x22: ffffff880164e988 x21: 0000000000000000
[ 31.079132] x20: ffffffc082aa3000 x19: ffffff880164e880 x18: 0000000000000000
[ 31.079295] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
[ 31.079453] x14: 0000000000000000 x13: ffffff8802263dc0 x12: 0000000000000001
[ 31.079613] x11: 0001ffc083bb2e34 x10: 0001ff880164e98f x9 : 0001ffc082aa3def
[ 31.079824] x8 : 0001ffc082aa3dec x7 : 0000000000000000 x6 : 0000000000000516
[ 31.079982] x5 : ffffffc7f8d43000 x4 : ffffff88003c9c40 x3 : ffffffffffffffff
[ 31.080147] x2 : ffffffc7f8d43000 x1 : 00000000000000c0 x0 : 0000000000000000
[ 31.080307] Call trace:
[ 31.080340] xilinx_dpdma_chan_queue_transfer+0x274/0x5e0
[ 31.080518] xilinx_dpdma_issue_pending+0x11c/0x120
[ 31.080595] zynqmp_disp_layer_update+0x180/0x3ac
[ 31.080712] zynqmp_dpsub_plane_atomic_update+0x11c/0x21c
[ 31.080825] drm_atomic_helper_commit_planes+0x20c/0x684
[ 31.080951] drm_atomic_helper_commit_tail+0x5c/0xb0
[ 31.081139] commit_tail+0x234/0x294
[ 31.081246] drm_atomic_helper_commit+0x1f8/0x210
[ 31.081363] drm_atomic_commit+0x100/0x140
[ 31.081477] drm_client_modeset_commit_atomic+0x318/0x384
[ 31.081634] drm_client_modeset_commit_locked+0x8c/0x24c
[ 31.081725] drm_client_modeset_commit+0x34/0x5c
[ 31.081812] __drm_fb_helper_restore_fbdev_mode_unlocked+0x104/0x168
[ 31.081899] drm_fb_helper_set_par+0x50/0x70
[ 31.081971] fbcon_init+0x538/0xc48
[ 31.082047] visual_init+0x16c/0x23c
[ 31.082207] do_bind_con_driver.isra.0+0x2d0/0x634
[ 31.082320] do_take_over_console+0x24c/0x33c
[ 31.082429] do_fbcon_takeover+0xbc/0x1b0
[ 31.082503] fbcon_fb_registered+0x2d0/0x34c
[ 31.082663] register_framebuffer+0x27c/0x38c
[ 31.082767] __drm_fb_helper_initial_config_and_unlock+0x5c0/0x91c
[ 31.082939] drm_fb_helper_initial_config+0x50/0x74
[ 31.083012] drm_fbdev_dma_client_hotplug+0xb8/0x108
[ 31.083115] drm_client_register+0xa0/0xf4
[ 31.083195] drm_fbdev_dma_setup+0xb0/0x1cc
[ 31.083293] zynqmp_dpsub_drm_init+0x45c/0x4e0
[ 31.083431] zynqmp_dpsub_probe+0x444/0x5e0
[ 31.083616] platform_probe+0x8c/0x13c
[ 31.083713] really_probe+0x258/0x59c
[ 31.083793] __driver_probe_device+0xc4/0x224
[ 31.083878] driver_probe_device+0x70/0x1c0
[ 31.083961] __device_attach_driver+0x108/0x1e0
[ 31.084052] bus_for_each_drv+0x9c/0x100
[ 31.084125] __device_attach+0x100/0x298
[ 31.084207] device_initial_probe+0x14/0x20
[ 31.084292] bus_probe_device+0xd8/0xdc
[ 31.084368] deferred_probe_work_func+0x11c/0x180
[ 31.084451] process_one_work+0x3ac/0x988
[ 31.084643] worker_thread+0x398/0x694
[ 31.084752] kthread+0x1bc/0x1c0
[ 31.084848] ret_from_fork+0x10/0x20
[ 31.084932] irq event stamp: 64549
[ 31.084970] hardirqs last enabled at (64548): [<ffffffc081adf35c>] _raw_spin_unlock_irqrestore+0x80/0x90
[ 31.085157] hardirqs last disabled at (64549): [<ffffffc081adf010>] _raw_spin_lock_irqsave+0xc0/0xdc
[ 31.085277] softirqs last enabled at (64503): [<ffffffc08001071c>] __do_softirq+0x47c/0x500
[ 31.085390] softirqs last disabled at (64498): [<ffffffc080017134>] ____do_softirq+0x10/0x1c
[ 31.085501] ---[ end trace 0000000000000000 ]---
Fixes:
|
||
|
Sebastian Reichel
|
e71d5ec7c0 |
phy: rockchip-snps-pcie3: fix clearing PHP_GRF_PCIESEL_CON bits
[ Upstream commit 55491a5fa163bf15158f34f3650b3985f25622b9 ]
Currently the PCIe v3 PHY driver only sets the pcie1ln_sel bits, but
does not clear them because of an incorrect write mask. This fixes up
the issue by using a newly introduced constant for the write mask.
While at it also introduces a proper GENMASK based constant for the
PCIE30_PHY_MODE.
Fixes:
|
||
|
Michal Tomek
|
199895b8b6 |
phy: rockchip-snps-pcie3: fix bifurcation on rk3588
[ Upstream commit f8020dfb311d2b6cf657668792aaa5fa8863a7dd ]
So far all RK3588 boards use fully aggregated PCIe. CM3588 is one
of the few boards using this feature and apparently it is broken.
The PHY offers the following mapping options:
port 0 lane 0 - always mapped to controller 0 (4L)
port 0 lane 1 - to controller 0 or 2 (1L0)
port 1 lane 0 - to controller 0 or 1 (2L)
port 1 lane 1 - to controller 0, 1 or 3 (1L1)
The data-lanes DT property maps these as follows:
0 = no controller (unsupported by the HW)
1 = 4L
2 = 2L
3 = 1L0
4 = 1L1
That allows the following configurations with first column being the
mainline data-lane mapping, second column being the downstream name,
third column being PCIE3PHY_GRF_CMN_CON0 and PHP_GRF_PCIESEL register
values and final column being the user visible lane setup:
<1 1 1 1> = AGGREG = [4 0] = x4 (aggregation)
<1 1 2 2> = NANBNB = [0 0] = x2 x2 (no bif.)
<1 3 2 2> = NANBBI = [1 1] = x2 x1x1 (bif. of port 0)
<1 1 2 4> = NABINB = [2 2] = x1x1 x2 (bif. of port 1)
<1 3 2 4> = NABIBI = [3 3] = x1x1 x1x1 (bif. of both ports)
The driver currently does not program PHP_GRF_PCIESEL correctly, which
is fixed by this patch. As a side-effect the new logic is much simpler
than the old logic.
Fixes:
|
||
|
Marcel Ziswiler
|
4723dfe76d |
phy: freescale: imx8m-pcie: fix pcie link-up instability
[ Upstream commit 3a161017f1de55cc48be81f6156004c151f32677 ]
Leaving AUX_PLL_REFCLK_SEL at its reset default of AUX_IN (PLL clock)
proves to be more stable on the i.MX 8M Mini.
Fixes:
|
||
|
Richard Zhu
|
ed4b981b1d |
phy: freescale: imx8m-pcie: Refine i.MX8MM PCIe PHY driver
[ Upstream commit
|