Commit Graph

1069353 Commits

Author SHA1 Message Date
Greg Kroah-Hartman
403dbb90c2 Merge 5.15.117 into android14-5.15-lts
Changes in 5.15.117
	ata: ahci: fix enum constants for gcc-13
	gcc-plugins: Reorganize gimple includes for GCC 13
	remove the sx8 block driver
	sfc (gcc13): synchronize ef100_enqueue_skb()'s return type
	i40e: Remove string printing for i40e_status
	i40e: use int for i40e_status
	i40e: fix build warning in ice_fltr_add_mac_to_list()
	bonding (gcc13): synchronize bond_{a,t}lb_xmit() types
	f2fs: fix iostat lock protection
	blk-iocost: avoid 64-bit division in ioc_timer_fn
	platform/surface: aggregator: Allow completion work-items to be executed in parallel
	spi: qup: Request DMA before enabling clocks
	afs: Fix setting of mtime when creating a file/dir/symlink
	wifi: mt76: mt7615: fix possible race in mt7615_mac_sta_poll
	neighbour: fix unaligned access to pneigh_entry
	net: dsa: lan9303: allow vid != 0 in port_fdb_{add|del} methods
	bpf: Fix UAF in task local storage
	net/ipv6: fix bool/int mismatch for skip_notify_on_dev_down
	net/smc: Avoid to access invalid RMBs' MRs in SMCRv1 ADD LINK CONT
	net: enetc: correct the statistics of rx bytes
	net/sched: fq_pie: ensure reasonable TCA_FQ_PIE_QUANTUM values
	drm/i915: Explain the magic numbers for AUX SYNC/precharge length
	drm/i915: Use 18 fast wake AUX sync len
	Bluetooth: Fix l2cap_disconnect_req deadlock
	Bluetooth: L2CAP: Add missing checks for invalid DCID
	qed/qede: Fix scheduling while atomic
	wifi: cfg80211: fix locking in sched scan stop work
	selftests/bpf: Verify optval=NULL case
	selftests/bpf: Fix sockopt_sk selftest
	netfilter: conntrack: fix NULL pointer dereference in nf_confirm_cthelper
	netfilter: ipset: Add schedule point in call_ad().
	ipv6: rpl: Fix Route of Death.
	rfs: annotate lockless accesses to sk->sk_rxhash
	rfs: annotate lockless accesses to RFS sock flow table
	drm/i915/selftests: Increase timeout for live_parallel_switch
	drm/i915/selftests: Stop using kthread_stop()
	drm/i915/selftests: Add some missing error propagation
	net: sched: move rtm_tca_policy declaration to include file
	net: sched: act_police: fix sparse errors in tcf_police_dump()
	net: sched: fix possible refcount leak in tc_chain_tmplt_add()
	bpf: Add extra path pointer check to d_path helper
	lib: cpu_rmap: Fix potential use-after-free in irq_cpu_rmap_release()
	bnxt_en: Don't issue AP reset during ethtool's reset operation
	bnxt_en: Query default VLAN before VNIC setup on a VF
	bnxt_en: Implement .set_port / .unset_port UDP tunnel callbacks
	batman-adv: Broken sync while rescheduling delayed work
	Input: xpad - delete a Razer DeathAdder mouse VID/PID entry
	Input: psmouse - fix OOB access in Elantech protocol
	Input: fix open count when closing inhibited device
	ALSA: hda/realtek: Add quirk for Clevo NS50AU
	ALSA: hda/realtek: Add a quirk for HP Slim Desktop S01
	ALSA: hda/realtek: Add Lenovo P3 Tower platform
	drm/i915/gt: Use the correct error value when kernel_context() fails
	drm/amd/pm: conditionally disable pcie lane switching for some sienna_cichlid SKUs
	drm/amdgpu: fix xclk freq on CHIP_STONEY
	drm/amd/pm: Fix power context allocation in SMU13
	can: j1939: j1939_sk_send_loop_abort(): improved error queue handling in J1939 Socket
	can: j1939: change j1939_netdev_lock type to mutex
	can: j1939: avoid possible use-after-free when j1939_can_rx_register fails
	ceph: fix use-after-free bug for inodes when flushing capsnaps
	s390/dasd: Use correct lock while counting channel queue length
	Bluetooth: Fix use-after-free in hci_remove_ltk/hci_remove_irk
	Bluetooth: hci_qca: fix debugfs registration
	tee: amdtee: Add return_origin to 'struct tee_cmd_load_ta'
	rbd: move RBD_OBJ_FLAG_COPYUP_ENABLED flag setting
	rbd: get snapshot context after exclusive lock is ensured to be held
	pinctrl: meson-axg: add missing GPIOA_18 gpio group
	usb: usbfs: Enforce page requirements for mmap
	usb: usbfs: Use consistent mmap functions
	ARM: dts: at91: sama7g5ek: fix debounce delay property for shdwc
	ASoC: codecs: wsa881x: do not set can_multi_write flag
	arm64: dts: qcom: sc7180-lite: Fix SDRAM freq for misidentified sc7180-lite boards
	arm64: dts: imx8qm-mek: correct GPIOs for USDHC2 CD and WP signals
	arm64: dts: imx8-ss-dma: assign default clock rate for lpuarts
	ASoC: mediatek: mt8195-afe-pcm: Convert to platform remove callback returning void
	ASoC: mediatek: mt8195: fix use-after-free in driver remove path
	arm64: dts: imx8mn-beacon: Fix SPI CS pinmux
	i2c: mv64xxx: Fix reading invalid status value in atomic mode
	firmware: arm_ffa: Set handle field to zero in memory descriptor
	i2c: sprd: Delete i2c adapter in .remove's error path
	eeprom: at24: also select REGMAP
	riscv: fix kprobe __user string arg print fault issue
	vduse: avoid empty string for dev name
	vhost: support PACKED when setting-getting vring_base
	vhost_vdpa: support PACKED when setting-getting vring_base
	Revert "ext4: don't clear SB_RDONLY when remounting r/w until quota is re-enabled"
	ext4: only check dquot_initialize_needed() when debugging
	Revert "debugobject: Ensure pool refill (again)"
	xfs: verify buffer contents when we skip log replay
	Revert "staging: rtl8192e: Replace macro RTL_PCI_DEVICE with PCI_DEVICE"
	Linux 5.15.117

Change-Id: Id16f2f6c857fc2d8e3b990d71f475d69a47ed1b6
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-06-15 15:16:34 +00:00
Greg Kroah-Hartman
97a41de737 Revert "tcp: deny tcp_disconnect() when threads are waiting"
This reverts commit fade445f39.

It breaks the Android kernel abi, but will be brought in through a
different branch to ensure it ends up in the tree properly.

Bug: 161946584
Change-Id: Id69a6eb41bd7cb59e307ad71de4331e4bee4f84a
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-06-15 14:45:49 +00:00
Greg Kroah-Hartman
8340dc3122 Merge 5.15.116 into android14-5.15-lts
Changes in 5.15.116
	RDMA/bnxt_re: Fix the page_size used during the MR creation
	RDMA/efa: Fix unsupported page sizes in device
	RDMA/hns: Fix base address table allocation
	RDMA/hns: Modify the value of long message loopback slice
	dmaengine: at_xdmac: Move the free desc to the tail of the desc list
	dmaengine: at_xdmac: fix potential Oops in at_xdmac_prep_interleaved()
	RDMA/bnxt_re: Fix a possible memory leak
	RDMA/bnxt_re: Fix return value of bnxt_re_process_raw_qp_pkt_rx
	iommu/rockchip: Fix unwind goto issue
	iommu/amd: Don't block updates to GATag if guest mode is on
	dmaengine: pl330: rename _start to prevent build error
	riscv: Fix unused variable warning when BUILTIN_DTB is set
	net/mlx5: fw_tracer, Fix event handling
	net/mlx5e: Don't attach netdev profile while handling internal error
	net: mellanox: mlxbf_gige: Fix skb_panic splat under memory pressure
	netrom: fix info-leak in nr_write_internal()
	af_packet: Fix data-races of pkt_sk(sk)->num.
	amd-xgbe: fix the false linkup in xgbe_phy_status
	mtd: rawnand: ingenic: fix empty stub helper definitions
	RDMA/irdma: Add SW mechanism to generate completions on error
	RDMA/irdma: Prevent QP use after free
	RDMA/irdma: Fix Local Invalidate fencing
	af_packet: do not use READ_ONCE() in packet_bind()
	tcp: deny tcp_disconnect() when threads are waiting
	tcp: Return user_mss for TCP_MAXSEG in CLOSE/LISTEN state if user_mss set
	net/sched: sch_ingress: Only create under TC_H_INGRESS
	net/sched: sch_clsact: Only create under TC_H_CLSACT
	net/sched: Reserve TC_H_INGRESS (TC_H_CLSACT) for ingress (clsact) Qdiscs
	net/sched: Prohibit regrafting ingress or clsact Qdiscs
	net: sched: fix NULL pointer dereference in mq_attach
	net/netlink: fix NETLINK_LIST_MEMBERSHIPS length report
	udp6: Fix race condition in udp6_sendmsg & connect
	net/mlx5e: Fix error handling in mlx5e_refresh_tirs
	net/mlx5: Read embedded cpu after init bit cleared
	net/sched: flower: fix possible OOB write in fl_set_geneve_opt()
	net: dsa: mv88e6xxx: Increase wait after reset deactivation
	mtd: rawnand: marvell: ensure timing values are written
	mtd: rawnand: marvell: don't set the NAND frequency select
	rtnetlink: call validate_linkmsg in rtnl_create_link
	drm/amdgpu: release gpu full access after "amdgpu_device_ip_late_init"
	watchdog: menz069_wdt: fix watchdog initialisation
	ALSA: hda: Glenfly: add HD Audio PCI IDs and HDMI Codec Vendor IDs.
	drm/amdgpu: Use the default reset when loading or reloading the driver
	mailbox: mailbox-test: Fix potential double-free in mbox_test_message_write()
	drm/ast: Fix ARM compatibility
	btrfs: abort transaction when sibling keys check fails for leaves
	ARM: 9295/1: unwind:fix unwind abort for uleb128 case
	media: rcar-vin: Select correct interrupt mode for V4L2_FIELD_ALTERNATE
	platform/x86: intel_scu_pcidrv: Add back PCI ID for Medfield
	gfs2: Don't deref jdesc in evict
	fbdev: imsttfb: Fix use after free bug in imsttfb_probe
	fbdev: modedb: Add 1920x1080 at 60 Hz video mode
	fbdev: stifb: Fix info entry in sti_struct on error path
	nbd: Fix debugfs_create_dir error checking
	block/rnbd: replace REQ_OP_FLUSH with REQ_OP_WRITE
	nvme-pci: add NVME_QUIRK_BOGUS_NID for HS-SSD-FUTURE 2048G
	nvme-pci: add quirk for missing secondary temperature thresholds
	ASoC: dwc: limit the number of overrun messages
	um: harddog: fix modular build
	xfrm: Check if_id in inbound policy/secpath match
	ASoC: dt-bindings: Adjust #sound-dai-cells on TI's single-DAI codecs
	ASoC: ssm2602: Add workaround for playback distortions
	media: dvb_demux: fix a bug for the continuity counter
	media: dvb-usb: az6027: fix three null-ptr-deref in az6027_i2c_xfer()
	media: dvb-usb-v2: ec168: fix null-ptr-deref in ec168_i2c_xfer()
	media: dvb-usb-v2: ce6230: fix null-ptr-deref in ce6230_i2c_master_xfer()
	media: dvb-usb-v2: rtl28xxu: fix null-ptr-deref in rtl28xxu_i2c_xfer
	media: dvb-usb: digitv: fix null-ptr-deref in digitv_i2c_xfer()
	media: dvb-usb: dw2102: fix uninit-value in su3000_read_mac_address
	media: netup_unidvb: fix irq init by register it at the end of probe
	media: dvb_ca_en50221: fix a size write bug
	media: ttusb-dec: fix memory leak in ttusb_dec_exit_dvb()
	media: mn88443x: fix !CONFIG_OF error by drop of_match_ptr from ID table
	media: dvb-core: Fix use-after-free due on race condition at dvb_net
	media: dvb-core: Fix use-after-free due to race at dvb_register_device()
	media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*()
	media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221
	s390/pkey: zeroize key blobs
	s390/topology: honour nr_cpu_ids when adding CPUs
	ACPI: resource: Add IRQ override quirk for LG UltraPC 17U70P
	wifi: rtl8xxxu: fix authentication timeout due to incorrect RCR value
	ARM: dts: stm32: add pin map for CAN controller on stm32f7
	arm64/mm: mark private VM_FAULT_X defines as vm_fault_t
	arm64: vdso: Pass (void *) to virt_to_page()
	wifi: mac80211: simplify chanctx allocation
	scsi: core: Decrease scsi_device's iorequest_cnt if dispatch failed
	wifi: b43: fix incorrect __packed annotation
	netfilter: conntrack: define variables exp_nat_nla_policy and any_addr with CONFIG_NF_NAT
	nvme-multipath: don't call blk_mark_disk_dead in nvme_mpath_remove_disk
	ALSA: oss: avoid missing-prototype warnings
	drm/msm: Be more shouty if per-process pgtables aren't working
	atm: hide unused procfs functions
	drm/amdgpu: skip disabling fence driver src_irqs when device is unplugged
	nvme-pci: Add quirk for Teamgroup MP33 SSD
	mailbox: mailbox-test: fix a locking issue in mbox_test_message_write()
	media: uvcvideo: Don't expose unsupported formats to userspace
	iio: accel: st_accel: Fix invalid mount_matrix on devices without ACPI _ONT method
	iio: adc: mxs-lradc: fix the order of two cleanup operations
	HID: google: add jewel USB id
	HID: wacom: avoid integer overflow in wacom_intuos_inout()
	iio: imu: inv_icm42600: fix timestamp reset
	dt-bindings: iio: adc: renesas,rcar-gyroadc: Fix adi,ad7476 compatible value
	iio: light: vcnl4035: fixed chip ID check
	iio: adc: ad_sigma_delta: Fix IRQ issue by setting IRQ_DISABLE_UNLAZY flag
	iio: dac: mcp4725: Fix i2c_master_send() return value handling
	iio: adc: ad7192: Change "shorted" channels to differential
	iio: dac: build ad5758 driver when AD5758 is selected
	net: usb: qmi_wwan: Set DTR quirk for BroadMobi BM818
	dt-bindings: usb: snps,dwc3: Fix "snps,hsphy_interface" type
	usb: gadget: f_fs: Add unbind event before functionfs_unbind
	md/raid5: fix miscalculation of 'end_sector' in raid5_read_one_chunk()
	misc: fastrpc: return -EPIPE to invocations on device removal
	misc: fastrpc: reject new invocations during device removal
	scsi: stex: Fix gcc 13 warnings
	ata: libata-scsi: Use correct device no in ata_find_dev()
	drm/amd/pm: reverse mclk and fclk clocks levels for vangogh
	drm/amd/pm: reverse mclk and fclk clocks levels for yellow carp
	drm/amd/pm: reverse mclk and fclk clocks levels for renoir
	x86/boot: Wrap literal addresses in absolute_pointer()
	ath6kl: Use struct_group() to avoid size-mismatched casting
	block/blk-iocost (gcc13): keep large values in a new enum
	mmc: vub300: fix invalid response handling
	mmc: pwrseq: sd8787: Fix WILC CHIP_EN and RESETN toggling order
	tty: serial: fsl_lpuart: use UARTCTRL_TXINV to send break instead of UARTCTRL_SBK
	btrfs: fix csum_tree_block page iteration to avoid tripping on -Werror=array-bounds
	powerpc/iommu: Limit number of TCEs to 512 for H_STUFF_TCE hcall
	iommu/amd: Fix domain flush size when syncing iotlb
	usb: cdns3: allocate TX FIFO size according to composite EP number
	usb: cdns3: fix NCM gadget RX speed 20x slow than expection at iMX8QM
	block: fix revalidate performance regression
	selinux: don't use make's grouped targets feature yet
	tracing/probe: trace_probe_primary_from_call(): checked list_first_entry
	selftests: mptcp: connect: skip if MPTCP is not supported
	selftests: mptcp: pm nl: skip if MPTCP is not supported
	selftests: mptcp: sockopt: skip if MPTCP is not supported
	ext4: add EA_INODE checking to ext4_iget()
	ext4: set lockdep subclass for the ea_inode in ext4_xattr_inode_cache_find()
	ext4: disallow ea_inodes with extended attributes
	ext4: add lockdep annotations for i_data_sem for ea_inode's
	fbcon: Fix null-ptr-deref in soft_cursor
	serial: 8250_tegra: Fix an error handling path in tegra_uart_probe()
	test_firmware: fix the memory leak of the allocated firmware buffer
	KVM: x86: Account fastpath-only VM-Exits in vCPU stats
	ksmbd: fix credit count leakage
	ksmbd: fix incorrect AllocationSize set in smb2_get_info
	KEYS: asymmetric: Copy sig and digest in public_key_verify_signature()
	regmap: Account for register length when chunking
	tpm, tpm_tis: Request threaded interrupt handler
	drm/rcar: stop using 'imply' for dependencies
	scsi: dpt_i2o: Remove broken pass-through ioctl (I2OUSERCMD)
	scsi: dpt_i2o: Do not process completions with invalid addresses
	drm/amdgpu/gfx10: Disable gfxoff before disabling powergating.
	selftests: mptcp: diag: skip if MPTCP is not supported
	selftests: mptcp: simult flows: skip if MPTCP is not supported
	selftests: mptcp: join: skip if MPTCP is not supported
	ext4: enable the lazy init thread when remounting read/write
	ARM: defconfig: drop CONFIG_DRM_RCAR_LVDS
	RDMA/irdma: Fix drain SQ hang with no completion
	RDMA/irdma: Do not generate SW completions for NOPs
	Linux 5.15.116

Change-Id: I9c1fcca4400982e913153ad26f22826434c3c4d8
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-06-15 12:41:38 +00:00
Greg Kroah-Hartman
6720675504 Revert "Revert "binder_alloc: add missing mmap_lock calls when using the VMA""
This reverts commit 6802c70090.

It breaks the Android kernel abi, but will be brought in through a
different branch to ensure it ends up in the tree properly.

Bug: 161946584
Change-Id: I62354c3b354cd686e2da92741f6c5ec75b70f667
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-06-15 12:11:15 +00:00
Greg Kroah-Hartman
1b16baaf8b Revert "Revert "android: binder: stop saving a pointer to the VMA""
This reverts commit dd7aff43d0.

It breaks the Android kernel abi, but will be brought in through a
different branch to ensure it ends up in the tree properly.

Bug: 161946584
Change-Id: I68e86d71156cf28cc6160f90a44c8fbf476d9930
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-06-15 12:11:13 +00:00
Greg Kroah-Hartman
d62b5b7db6 Revert "binder: add lockless binder_alloc_(set|get)_vma()"
This reverts commit 1cae0d5136.

It breaks the Android kernel abi, but will be brought in through a
different branch to ensure it ends up in the tree properly.

Bug: 161946584
Change-Id: Ie86172232c2dca2f30c1b100ead68a5599937380
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-06-15 12:11:11 +00:00
Greg Kroah-Hartman
4bbb48a4fe Revert "binder: fix UAF of alloc->vma in race with munmap()"
This reverts commit 1bb8a65190.

It breaks the Android kernel abi, but will be brought in through a
different branch to ensure it ends up in the tree properly.

Bug: 161946584
Change-Id: I68007ae6d5eb0aaebd76817b9f53110eed86b597
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-06-15 12:10:58 +00:00
Greg Kroah-Hartman
e772cc3c8f Merge 5.15.115 into android14-5.15-lts
Changes in 5.15.115
	power: supply: bq27xxx: expose battery data when CI=1
	power: supply: bq27xxx: Move bq27xxx_battery_update() down
	power: supply: bq27xxx: Ensure power_supply_changed() is called on current sign changes
	power: supply: bq27xxx: After charger plug in/out wait 0.5s for things to stabilize
	power: supply: core: Refactor power_supply_set_input_current_limit_from_supplier()
	power: supply: bq24190: Call power_supply_changed() after updating input current
	bpf: fix a memory leak in the LRU and LRU_PERCPU hash maps
	net/mlx5: devcom only supports 2 ports
	net/mlx5e: Fix deadlock in tc route query code
	net/mlx5: Devcom, serialize devcom registration
	platform/x86: ISST: PUNIT device mapping with Sub-NUMA clustering
	platform/x86: ISST: Remove 8 socket limit
	net: phy: mscc: enable VSC8501/2 RGMII RX clock
	net: dsa: introduce helpers for iterating through ports using dp
	net: dsa: mt7530: rework mt753[01]_setup
	net: dsa: mt7530: split-off common parts from mt7531_setup
	net: dsa: mt7530: fix network connectivity with multiple CPU ports
	Bonding: add arp_missed_max option
	bonding: fix send_peer_notif overflow
	binder: fix UAF caused by faulty buffer cleanup
	irqchip/mips-gic: Get rid of the reliance on irq_cpu_online()
	irqchip/mips-gic: Use raw spinlock for gic_lock
	net/mlx5e: Fix SQ wake logic in ptp napi_poll context
	xdp: Allow registering memory model without rxq reference
	net: page_pool: use in_softirq() instead
	page_pool: fix inconsistency for page_pool_ring_[un]lock()
	irqchip/mips-gic: Don't touch vl_map if a local interrupt is not routable
	xdp: xdp_mem_allocator can be NULL in trace_mem_connect().
	bluetooth: Add cmd validity checks at the start of hci_sock_ioctl()
	Revert "binder_alloc: add missing mmap_lock calls when using the VMA"
	Revert "android: binder: stop saving a pointer to the VMA"
	binder: add lockless binder_alloc_(set|get)_vma()
	binder: fix UAF of alloc->vma in race with munmap()
	ipv{4,6}/raw: fix output xfrm lookup wrt protocol
	netfilter: ctnetlink: Support offloaded conntrack entry deletion
	Linux 5.15.115

Change-Id: I04ebd85160057dcc604a7b2b13f7fdadc08329ac
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-06-15 08:02:25 +00:00
Greg Kroah-Hartman
b5c8629086 Merge branch 'android14-5.15' into 'android14-5.15-lts'
This catches the -lts branch up with all of the recent changes that have
gone into the non-lts branch, INCLUDING the ABI update which we want
here to ensure that we do NOT break any newly added dependent symbols
(and to bring back in the reverts that were required before the ABI
break).

This includes the following commits:

1463dca508 ANDROID: 6/16/2023 KMI update
61d1582c93 UPSTREAM: tipc: check the bearer min mtu properly when setting it by netlink
5b20b206c4 UPSTREAM: tipc: do not update mtu if msg_max is too small in mtu negotiation
b288e3eb9a UPSTREAM: tipc: add tipc_bearer_min_mtu to calculate min mtu
63225f30d6 UPSTREAM: ASoC: fsl_micfil: Fix error handler with pm_runtime_enable
b64f71ac97 UPSTREAM: firmware: arm_sdei: Fix sleep from invalid context BUG
a45af5569a UPSTREAM: uapi/linux/const.h: prefer ISO-friendly __typeof__
18bae38a20 UPSTREAM: sched: Fix DEBUG && !SCHEDSTATS warn
8b4a04dce2 UPSTREAM: sched: Make struct sched_statistics independent of fair sched class
7f1bd76f41 UPSTREAM: platform: Provide a remove callback that returns no value
b529f9de5b ANDROID: GKI: reserve extra arm64 cpucaps for ABI preservation
2ab1955d56 ANDROID: KVM: arm64: Allow setting {P,U}XN in stage-2 PTEs
69e2ba2e16 ANDROID: KVM: arm64: Restrict host-to-hyp MMIO donations
3f060ac3de ANDROID: KVM: arm64: Allow state changes of MMIO pages
57574f0ae2 ANDROID: KVM: arm64: Allow MMIO perm changes from modules
951d15786a ANDROID: KVM: arm64: Don't allocate from handle_host_mem_abort
e609adf5cb ANDROID: KVM: arm64: Donate IOMMU regions to pKVM
1386a01618 ANDROID: KVM: arm64: Map MMIO donation as device at EL2
9debaf482d ANDROID: KVM: arm64: Don't recycle pages from host mem abort
aa4b272b34 ANDROID: KVM: arm64: Pin host stage-2 tables
97877e974b ANDROID: KVM: arm64: Move kvm_pte_follow() to header
76380240a2 ANDROID: KVM: arm64: Pre-populate host stage2
a2b45ad90a ANDROID: KVM: arm64: Fix the host ownership later
d522a07153 ANDROID: KVM: arm64: Don't recycle non-default PTEs
2bad47ce33 ANDROID: KVM: arm64: Introduce kvm_pgtable_stage2_reclaim_leaves
da5b14f0a1 ANDROID: KVM: arm64: Deprecate late pKVM module loading
2c641cfce1 BACKPORT: FROMGIT: usb: core: add sysfs entry for usb device state
61067bd1c2 BACKPORT: usb: xhci: plat: remove error log for failure to get usb-phy
4b219f7fc9 BACKPORT: usb: xhci: plat: Add USB 3.0 phy support
7b23f0d62a UPSTREAM: usb: dwc3: core: add support for realtek SoCs custom's global register start address
2c2c2503ed ANDROID: GKI: Enable CONFIG_RPMSG_CTRL
182ac7a9d9 UPSTREAM: mailbox: mailbox-test: fix a locking issue in mbox_test_message_write()
a6c1ea62c9 UPSTREAM: mailbox: mailbox-test: Fix potential double-free in mbox_test_message_write()
ad90aba4d6 UPSTREAM: net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize
267d3e1f3f ANDROID: set CONFIG_IKHEADERS=m for gki_defconfig.
c1d1130811 UPSTREAM: usb: gadget: uvc: queue empty isoc requests if no video buffer is available
634ea38c4e ANDROID: Update the ABI symbol list
719fc80624 ANDROID: fs: Add vendor hooks for ep_create_wakeup_source & timerfd_create
4742f48a5a BACKPORT: arm64: Enable KCSAN
d2d27f72cf ANDROID: block: Partially revert "Send requeued requests to the I/O scheduler"
cc244e96d7 Revert "ANDROID: block: Warn if a zoned write is about to be reordered"

Change-Id: Ifb116236a7ed04eaf472d088aa36a470eb6b138d
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-06-14 19:54:55 +00:00
Greg Kroah-Hartman
7a20f4ad2b Revert "usb: gadget: Properly configure the device for remote wakeup"
This reverts commit 7919af1dcb.

It breaks the Android kernel abi, but will be brought in through a
different branch to ensure it ends up in the tree properly.

Bug: 161946584
Change-Id: I259c54a3c0d6fbaf33cca4978a6aaae413967dc1
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-06-14 19:43:26 +00:00
Greg Kroah-Hartman
c51cba3cb0 Revert "usb: dwc3: fix gadget mode suspend interrupt handler issue"
This reverts commit f191711553.

It breaks the Android kernel abi, but will be brought in through a
different branch to ensure it ends up in the tree properly.

Bug: 161946584
Change-Id: I7393417fd72169adce4460c33e283085dcc86ad5
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-06-14 19:43:19 +00:00
Carlos Llamas
1463dca508 ANDROID: 6/16/2023 KMI update
Set KMI_GENERATION=9 for 6/16 KMI update

variable symbol changed from 'struct static_key_false cpu_hwcap_keys[75]' to 'struct static_key_false cpu_hwcap_keys[95]'
  CRC changed from 0xfe9a697c to 0x41aad71d
  type changed from 'struct static_key_false[75]' to 'struct static_key_false[95]'
    number of elements changed from 75 to 95

function symbol 'struct block_device* I_BDEV(struct inode*)' changed
  CRC changed from 0x6ad768b0 to 0x8d400dbd

function symbol 'void* PDE_DATA(const struct inode*)' changed
  CRC changed from 0x1b12d990 to 0xc3c38b5c

function symbol 'void __ClearPageMovable(struct page*)' changed
  CRC changed from 0x5ed16e08 to 0xf489e5e8

... 3676 omitted; 3679 symbols have only CRC changes

type 'enum cpuhp_state' changed
  enumerator 'CPUHP_AP_ARM_SDEI_STARTING' (114) was removed
  enumerator 'CPUHP_AP_ARM_VFP_STARTING' value changed from 115 to 114
  enumerator 'CPUHP_AP_ARM64_DEBUG_MONITORS_STARTING' value changed from 116 to 115
  enumerator 'CPUHP_AP_PERF_ARM_HW_BREAKPOINT_STARTING' value changed from 117 to 116
  enumerator 'CPUHP_AP_PERF_ARM_ACPI_STARTING' value changed from 118 to 117
  enumerator 'CPUHP_AP_PERF_ARM_STARTING' value changed from 119 to 118
  enumerator 'CPUHP_AP_ARM_L2X0_STARTING' value changed from 120 to 119
  enumerator 'CPUHP_AP_EXYNOS4_MCT_TIMER_STARTING' value changed from 121 to 120
  enumerator 'CPUHP_AP_ARM_ARCH_TIMER_STARTING' value changed from 122 to 121
  enumerator 'CPUHP_AP_ARM_GLOBAL_TIMER_STARTING' value changed from 123 to 122
  enumerator 'CPUHP_AP_JCORE_TIMER_STARTING' value changed from 124 to 123
  enumerator 'CPUHP_AP_ARM_TWD_STARTING' value changed from 125 to 124
  enumerator 'CPUHP_AP_QCOM_TIMER_STARTING' value changed from 126 to 125
  enumerator 'CPUHP_AP_TEGRA_TIMER_STARTING' value changed from 127 to 126
  enumerator 'CPUHP_AP_ARMADA_TIMER_STARTING' value changed from 128 to 127
  enumerator 'CPUHP_AP_MARCO_TIMER_STARTING' value changed from 129 to 128
  enumerator 'CPUHP_AP_MIPS_GIC_TIMER_STARTING' value changed from 130 to 129
  enumerator 'CPUHP_AP_ARC_TIMER_STARTING' value changed from 131 to 130
  enumerator 'CPUHP_AP_RISCV_TIMER_STARTING' value changed from 132 to 131
  enumerator 'CPUHP_AP_CLINT_TIMER_STARTING' value changed from 133 to 132
  enumerator 'CPUHP_AP_CSKY_TIMER_STARTING' value changed from 134 to 133
  enumerator 'CPUHP_AP_TI_GP_TIMER_STARTING' value changed from 135 to 134
  enumerator 'CPUHP_AP_HYPERV_TIMER_STARTING' value changed from 136 to 135
  enumerator 'CPUHP_AP_KVM_STARTING' value changed from 137 to 136
  enumerator 'CPUHP_AP_KVM_ARM_VGIC_INIT_STARTING' value changed from 138 to 137
  enumerator 'CPUHP_AP_KVM_ARM_VGIC_STARTING' value changed from 139 to 138
  enumerator 'CPUHP_AP_KVM_ARM_TIMER_STARTING' value changed from 140 to 139
  enumerator 'CPUHP_AP_DUMMY_TIMER_STARTING' value changed from 141 to 140
  enumerator 'CPUHP_AP_ARM_XEN_STARTING' value changed from 142 to 141
  enumerator 'CPUHP_AP_ARM_CORESIGHT_STARTING' value changed from 143 to 142
  enumerator 'CPUHP_AP_ARM_CORESIGHT_CTI_STARTING' value changed from 144 to 143
  enumerator 'CPUHP_AP_ARM64_ISNDEP_STARTING' value changed from 145 to 144
  enumerator 'CPUHP_AP_SMPCFD_DYING' value changed from 146 to 145
  enumerator 'CPUHP_AP_X86_TBOOT_DYING' value changed from 147 to 146
  enumerator 'CPUHP_AP_ARM_CACHE_B15_RAC_DYING' value changed from 148 to 147
  enumerator 'CPUHP_AP_ONLINE' value changed from 149 to 148
  enumerator 'CPUHP_TEARDOWN_CPU' value changed from 150 to 149
  enumerator 'CPUHP_AP_ONLINE_IDLE' value changed from 151 to 150
  enumerator 'CPUHP_AP_SCHED_WAIT_EMPTY' value changed from 152 to 151
  enumerator 'CPUHP_AP_SMPBOOT_THREADS' value changed from 153 to 152
  enumerator 'CPUHP_AP_X86_VDSO_VMA_ONLINE' value changed from 154 to 153
  enumerator 'CPUHP_AP_IRQ_AFFINITY_ONLINE' value changed from 155 to 154
  enumerator 'CPUHP_AP_BLK_MQ_ONLINE' value changed from 156 to 155
  enumerator 'CPUHP_AP_ARM_MVEBU_SYNC_CLOCKS' value changed from 157 to 156
  enumerator 'CPUHP_AP_X86_INTEL_EPB_ONLINE' value changed from 158 to 157
  enumerator 'CPUHP_AP_PERF_ONLINE' value changed from 159 to 158
  enumerator 'CPUHP_AP_PERF_X86_ONLINE' value changed from 160 to 159
  enumerator 'CPUHP_AP_PERF_X86_UNCORE_ONLINE' value changed from 161 to 160
  enumerator 'CPUHP_AP_PERF_X86_AMD_UNCORE_ONLINE' value changed from 162 to 161
  enumerator 'CPUHP_AP_PERF_X86_AMD_POWER_ONLINE' value changed from 163 to 162
  enumerator 'CPUHP_AP_PERF_X86_RAPL_ONLINE' value changed from 164 to 163
  enumerator 'CPUHP_AP_PERF_X86_CQM_ONLINE' value changed from 165 to 164
  enumerator 'CPUHP_AP_PERF_X86_CSTATE_ONLINE' value changed from 166 to 165
  enumerator 'CPUHP_AP_PERF_X86_IDXD_ONLINE' value changed from 167 to 166
  enumerator 'CPUHP_AP_PERF_S390_CF_ONLINE' value changed from 168 to 167
  enumerator 'CPUHP_AP_PERF_S390_SF_ONLINE' value changed from 169 to 168
  enumerator 'CPUHP_AP_PERF_ARM_CCI_ONLINE' value changed from 170 to 169
  enumerator 'CPUHP_AP_PERF_ARM_CCN_ONLINE' value changed from 171 to 170
  enumerator 'CPUHP_AP_PERF_ARM_HISI_DDRC_ONLINE' value changed from 172 to 171
  enumerator 'CPUHP_AP_PERF_ARM_HISI_HHA_ONLINE' value changed from 173 to 172
  enumerator 'CPUHP_AP_PERF_ARM_HISI_L3_ONLINE' value changed from 174 to 173
  enumerator 'CPUHP_AP_PERF_ARM_HISI_PA_ONLINE' value changed from 175 to 174
  enumerator 'CPUHP_AP_PERF_ARM_HISI_SLLC_ONLINE' value changed from 176 to 175
  enumerator 'CPUHP_AP_PERF_ARM_L2X0_ONLINE' value changed from 177 to 176
  enumerator 'CPUHP_AP_PERF_ARM_QCOM_L2_ONLINE' value changed from 178 to 177
  enumerator 'CPUHP_AP_PERF_ARM_QCOM_L3_ONLINE' value changed from 179 to 178
  enumerator 'CPUHP_AP_PERF_ARM_APM_XGENE_ONLINE' value changed from 180 to 179
  enumerator 'CPUHP_AP_PERF_ARM_CAVIUM_TX2_UNCORE_ONLINE' value changed from 181 to 180
  enumerator 'CPUHP_AP_PERF_POWERPC_NEST_IMC_ONLINE' value changed from 182 to 181
  enumerator 'CPUHP_AP_PERF_POWERPC_CORE_IMC_ONLINE' value changed from 183 to 182
  enumerator 'CPUHP_AP_PERF_POWERPC_THREAD_IMC_ONLINE' value changed from 184 to 183
  enumerator 'CPUHP_AP_PERF_POWERPC_TRACE_IMC_ONLINE' value changed from 185 to 184
  enumerator 'CPUHP_AP_PERF_POWERPC_HV_24x7_ONLINE' value changed from 186 to 185
  enumerator 'CPUHP_AP_PERF_POWERPC_HV_GPCI_ONLINE' value changed from 187 to 186
  enumerator 'CPUHP_AP_PERF_CSKY_ONLINE' value changed from 188 to 187
  enumerator 'CPUHP_AP_WATCHDOG_ONLINE' value changed from 189 to 188
  enumerator 'CPUHP_AP_WORKQUEUE_ONLINE' value changed from 190 to 189
  enumerator 'CPUHP_AP_RANDOM_ONLINE' value changed from 191 to 190
  enumerator 'CPUHP_AP_RCUTREE_ONLINE' value changed from 192 to 191
  enumerator 'CPUHP_AP_BASE_CACHEINFO_ONLINE' value changed from 193 to 192
  enumerator 'CPUHP_AP_ONLINE_DYN' value changed from 194 to 193
  enumerator 'CPUHP_AP_ONLINE_DYN_END' value changed from 224 to 223
  enumerator 'CPUHP_AP_MM_DEMOTION_ONLINE' value changed from 225 to 224
  enumerator 'CPUHP_AP_X86_HPET_ONLINE' value changed from 226 to 225
  enumerator 'CPUHP_AP_X86_KVM_CLK_ONLINE' value changed from 227 to 226
  enumerator 'CPUHP_AP_DTPM_CPU_ONLINE' value changed from 228 to 227
  enumerator 'CPUHP_AP_ACTIVE' value changed from 229 to 228
  enumerator 'CPUHP_ANDROID_RESERVED_1' value changed from 230 to 229
  enumerator 'CPUHP_ANDROID_RESERVED_2' value changed from 231 to 230
  enumerator 'CPUHP_ANDROID_RESERVED_3' value changed from 232 to 231
  enumerator 'CPUHP_ANDROID_RESERVED_4' value changed from 233 to 232
  enumerator 'CPUHP_ONLINE' value changed from 234 to 233

type 'struct task_struct' changed
  byte size changed from 4672 to 4736
  5 members ('struct sched_rt_entity rt' .. 'struct uclamp_se uclamp[2]') changed
    offset changed by -1536
  member 'struct sched_statistics stats' was added
  189 members ('struct hlist_head preempt_notifiers' .. 'u64 android_kabi_reserved8') changed
    offset changed by 832
  member 'struct thread_struct thread' changed
    offset changed by 768

type 'struct platform_driver' changed
  byte size changed from 240 to 248
  member 'void(* remove_new)(struct platform_device*)' was added
  7 members ('void(* shutdown)(struct platform_device*)' .. 'u64 android_kabi_reserved1') changed
    offset changed by 64

type 'struct sched_entity' changed
  byte size changed from 512 to 320
  member 'struct sched_statistics statistics' was removed
  5 members ('int depth' .. 'unsigned long runnable_weight') changed
    offset changed by -1728
  5 members ('struct sched_avg avg' .. 'u64 android_kabi_reserved4') changed
    offset changed by -1536

type 'struct tipc_bearer' changed
  member 'u16 encap_hlen' was added

type 'enum kvm_pgtable_prot' changed
  enumerator 'KVM_PGTABLE_PROT_PXN' (32) was added
  enumerator 'KVM_PGTABLE_PROT_UXN' (64) was added

Bug: 287162457
Change-Id: Icccb0e4826e7693fdae5c4463be6664db1de421c
Signed-off-by: Carlos Llamas <cmllamas@google.com>
2023-06-14 12:35:34 +00:00
Xin Long
61d1582c93 UPSTREAM: tipc: check the bearer min mtu properly when setting it by netlink
[ Upstream commit 35a089b5d7 ]

Checking the bearer min mtu with tipc_udp_mtu_bad() only works for
IPv4 UDP bearer, and IPv6 UDP bearer has a different value for the
min mtu. This patch checks with encap_hlen + TIPC_MIN_BEARER_MTU
for min mtu, which works for both IPv4 and IPv6 UDP bearer.

Note that tipc_udp_mtu_bad() is still used to check media min mtu
in __tipc_nl_media_set(), as m->mtu currently is only used by the
IPv4 UDP bearer as its default mtu value.

Fixes: 682cd3cf94 ("tipc: confgiure and apply UDP bearer MTU on running links")
Change-Id: I585703598475f2de30353fcc7a96e295fe63549b
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Jon Maloy <jmaloy@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 673cb47989)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-06-14 12:35:34 +00:00
Xin Long
5b20b206c4 UPSTREAM: tipc: do not update mtu if msg_max is too small in mtu negotiation
[ Upstream commit 56077b56cd ]

When doing link mtu negotiation, a malicious peer may send Activate msg
with a very small mtu, e.g. 4 in Shuang's testing, without checking for
the minimum mtu, l->mtu will be set to 4 in tipc_link_proto_rcv(), then
n->links[bearer_id].mtu is set to 4294967228, which is a overflow of
'4 - INT_H_SIZE - EMSG_OVERHEAD' in tipc_link_mss().

With tipc_link.mtu = 4, tipc_link_xmit() kept printing the warning:

 tipc: Too large msg, purging xmit list 1 5 0 40 4!
 tipc: Too large msg, purging xmit list 1 15 0 60 4!

And with tipc_link_entry.mtu 4294967228, a huge skb was allocated in
named_distribute(), and when purging it in tipc_link_xmit(), a crash
was even caused:

  general protection fault, probably for non-canonical address 0x2100001011000dd: 0000 [#1] PREEMPT SMP PTI
  CPU: 0 PID: 0 Comm: swapper/0 Kdump: loaded Not tainted 6.3.0.neta #19
  RIP: 0010:kfree_skb_list_reason+0x7e/0x1f0
  Call Trace:
   <IRQ>
   skb_release_data+0xf9/0x1d0
   kfree_skb_reason+0x40/0x100
   tipc_link_xmit+0x57a/0x740 [tipc]
   tipc_node_xmit+0x16c/0x5c0 [tipc]
   tipc_named_node_up+0x27f/0x2c0 [tipc]
   tipc_node_write_unlock+0x149/0x170 [tipc]
   tipc_rcv+0x608/0x740 [tipc]
   tipc_udp_recv+0xdc/0x1f0 [tipc]
   udp_queue_rcv_one_skb+0x33e/0x620
   udp_unicast_rcv_skb.isra.72+0x75/0x90
   __udp4_lib_rcv+0x56d/0xc20
   ip_protocol_deliver_rcu+0x100/0x2d0

This patch fixes it by checking the new mtu against tipc_bearer_min_mtu(),
and not updating mtu if it is too small.

Fixes: ed193ece26 ("tipc: simplify link mtu negotiation")
Reported-by: Shuang Li <shuali@redhat.com>
Change-Id: I84fb5694b763c1e9d1a93643d849d8d17dbf5cd8
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Jon Maloy <jmaloy@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 575e84d90a)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-06-14 12:35:34 +00:00
Xin Long
b288e3eb9a UPSTREAM: tipc: add tipc_bearer_min_mtu to calculate min mtu
[ Upstream commit 3ae6d66b60 ]

As different media may requires different min mtu, and even the
same media with different net family requires different min mtu,
add tipc_bearer_min_mtu() to calculate min mtu accordingly.

This API will be used to check the new mtu when doing the link
mtu negotiation in the next patch.

Change-Id: Ic9917ba5e26138b813dd037d38c52ce7adb3ea03
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Jon Maloy <jmaloy@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stable-dep-of: 56077b56cd ("tipc: do not update mtu if msg_max is too small in mtu negotiation")
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 5cf99d5f65)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-06-14 12:35:34 +00:00
Shengjiu Wang
63225f30d6 UPSTREAM: ASoC: fsl_micfil: Fix error handler with pm_runtime_enable
[ Upstream commit 17955aba78 ]

There is error message when defer probe happens:

fsl-micfil-dai 30ca0000.micfil: Unbalanced pm_runtime_enable!

Fix the error handler with pm_runtime_enable and add
fsl_micfil_remove() for pm_runtime_disable.

Fixes: 47a70e6fc9 ("ASoC: Add MICFIL SoC Digital Audio Interface driver.")
Change-Id: I23884128f83bba7623102583f0ee154485fd3f89
Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com
Link: https://lore.kernel.org/r/1683540996-6136-1-git-send-email-shengjiu.wang@nxp.com
Signed-off-by: Mark Brown <broonie@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 3a4ff14b0e)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-06-14 12:35:34 +00:00
Pierre Gondois
b64f71ac97 UPSTREAM: firmware: arm_sdei: Fix sleep from invalid context BUG
[ Upstream commit d2c48b2387 ]

Running a preempt-rt (v6.2-rc3-rt1) based kernel on an Ampere Altra
triggers:

  BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:46
  in_atomic(): 0, irqs_disabled(): 128, non_block: 0, pid: 24, name: cpuhp/0
  preempt_count: 0, expected: 0
  RCU nest depth: 0, expected: 0
  3 locks held by cpuhp/0/24:
    #0: ffffda30217c70d0 (cpu_hotplug_lock){++++}-{0:0}, at: cpuhp_thread_fun+0x5c/0x248
    #1: ffffda30217c7120 (cpuhp_state-up){+.+.}-{0:0}, at: cpuhp_thread_fun+0x5c/0x248
    #2: ffffda3021c711f0 (sdei_list_lock){....}-{3:3}, at: sdei_cpuhp_up+0x3c/0x130
  irq event stamp: 36
  hardirqs last  enabled at (35): [<ffffda301e85b7bc>] finish_task_switch+0xb4/0x2b0
  hardirqs last disabled at (36): [<ffffda301e812fec>] cpuhp_thread_fun+0x21c/0x248
  softirqs last  enabled at (0): [<ffffda301e80b184>] copy_process+0x63c/0x1ac0
  softirqs last disabled at (0): [<0000000000000000>] 0x0
  CPU: 0 PID: 24 Comm: cpuhp/0 Not tainted 5.19.0-rc3-rt5-[...]
  Hardware name: WIWYNN Mt.Jade Server [...]
  Call trace:
    dump_backtrace+0x114/0x120
    show_stack+0x20/0x70
    dump_stack_lvl+0x9c/0xd8
    dump_stack+0x18/0x34
    __might_resched+0x188/0x228
    rt_spin_lock+0x70/0x120
    sdei_cpuhp_up+0x3c/0x130
    cpuhp_invoke_callback+0x250/0xf08
    cpuhp_thread_fun+0x120/0x248
    smpboot_thread_fn+0x280/0x320
    kthread+0x130/0x140
    ret_from_fork+0x10/0x20

sdei_cpuhp_up() is called in the STARTING hotplug section,
which runs with interrupts disabled. Use a CPUHP_AP_ONLINE_DYN entry
instead to execute the cpuhp cb later, with preemption enabled.

SDEI originally got its own cpuhp slot to allow interacting
with perf. It got superseded by pNMI and this early slot is not
relevant anymore. [1]

Some SDEI calls (e.g. SDEI_1_0_FN_SDEI_PE_MASK) take actions on the
calling CPU. It is checked that preemption is disabled for them.
_ONLINE cpuhp cb are executed in the 'per CPU hotplug thread'.
Preemption is enabled in those threads, but their cpumask is limited
to 1 CPU.
Move 'WARN_ON_ONCE(preemptible())' statements so that SDEI cpuhp cb
don't trigger them.

Also add a check for the SDEI_1_0_FN_SDEI_PRIVATE_RESET SDEI call
which acts on the calling CPU.

[1]:
https://lore.kernel.org/all/5813b8c5-ae3e-87fd-fccc-94c9cd08816d@arm.com/

Suggested-by: James Morse <james.morse@arm.com>
Change-Id: If68806613938a753ba8113cf3421c545934cf3a2
Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Reviewed-by: James Morse <james.morse@arm.com>
Link: https://lore.kernel.org/r/20230216084920.144064-1-pierre.gondois@arm.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 66caf22787)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-06-14 12:35:34 +00:00
Kevin Brodsky
a45af5569a UPSTREAM: uapi/linux/const.h: prefer ISO-friendly __typeof__
[ Upstream commit 31088f6f79 ]

typeof is (still) a GNU extension, which means that it cannot be used when
building ISO C (e.g.  -std=c99).  It should therefore be avoided in uapi
headers in favour of the ISO-friendly __typeof__.

Unfortunately this issue could not be detected by
CONFIG_UAPI_HEADER_TEST=y as the __ALIGN_KERNEL() macro is not expanded in
any uapi header.

This matters from a userspace perspective, not a kernel one. uapi
headers and their contents are expected to be usable in a variety of
situations, and in particular when building ISO C applications (with
-std=c99 or similar).

This particular problem can be reproduced by trying to use the
__ALIGN_KERNEL macro directly in application code, say:

int align(int x, int a)
{
	return __KERNEL_ALIGN(x, a);
}

and trying to build that with -std=c99.

Link: https://lkml.kernel.org/r/20230411092747.3759032-1-kevin.brodsky@arm.com
Fixes: a79ff731a1 ("netfilter: xtables: make XT_ALIGN() usable in exported headers by exporting __ALIGN_KERNEL()")
Change-Id: I4204df6f16689acb4d0786e3edf2b6ebc457c4e3
Signed-off-by: Kevin Brodsky <kevin.brodsky@arm.com>
Reported-by: Ruben Ayrapetyan <ruben.ayrapetyan@arm.com>
Tested-by: Ruben Ayrapetyan <ruben.ayrapetyan@arm.com>
Reviewed-by: Petr Vorel <pvorel@suse.cz>
Tested-by: Petr Vorel <pvorel@suse.cz>
Reviewed-by: Masahiro Yamada <masahiroy@kernel.org>
Cc: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 397eb669da)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-06-14 12:35:34 +00:00
Peter Zijlstra
18bae38a20 UPSTREAM: sched: Fix DEBUG && !SCHEDSTATS warn
commit 769fdf83df upstream.

When !SCHEDSTATS schedstat_enabled() is an unconditional 0 and the
whole block doesn't exist, however GCC figures the scoped variable
'stats' is unused and complains about it.

Upgrade the warning from -Wunused-variable to -Wunused-but-set-variable
by writing it in two statements. This fixes the build because the new
warning is in W=1.

Given that whole if(0) {} thing, I don't feel motivated to change
things overly much and quite strongly feel this is the compiler being
daft.

Fixes: cb3e971c435d ("sched: Make struct sched_statistics independent of fair sched class")
Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Change-Id: I3b1f6cc605ae53a43f4a75a8d1a6cf2a947998ea
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 0a008c5098)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-06-14 12:35:34 +00:00
Yafang Shao
8b4a04dce2 UPSTREAM: sched: Make struct sched_statistics independent of fair sched class
[ Upstream commit ceeadb83ae ]

If we want to use the schedstats facility to trace other sched classes, we
should make it independent of fair sched class. The struct sched_statistics
is the schedular statistics of a task_struct or a task_group. So we can
move it into struct task_struct and struct task_group to achieve the goal.

After the patch, schestats are orgnized as follows,

    struct task_struct {
       ...
       struct sched_entity se;
       struct sched_rt_entity rt;
       struct sched_dl_entity dl;
       ...
       struct sched_statistics stats;
       ...
   };

Regarding the task group, schedstats is only supported for fair group
sched, and a new struct sched_entity_stats is introduced, suggested by
Peter -

    struct sched_entity_stats {
        struct sched_entity     se;
        struct sched_statistics stats;
    } __no_randomize_layout;

Then with the se in a task_group, we can easily get the stats.

The sched_statistics members may be frequently modified when schedstats is
enabled, in order to avoid impacting on random data which may in the same
cacheline with them, the struct sched_statistics is defined as cacheline
aligned.

As this patch changes the core struct of scheduler, so I verified the
performance it may impact on the scheduler with 'perf bench sched
pipe', suggested by Mel. Below is the result, in which all the values
are in usecs/op.
                                  Before               After
      kernel.sched_schedstats=0  5.2~5.4               5.2~5.4
      kernel.sched_schedstats=1  5.3~5.5               5.3~5.5
[These data is a little difference with the earlier version, that is
 because my old test machine is destroyed so I have to use a new
 different test machine.]

Almost no impact on the sched performance.

No functional change.

[lkp@intel.com: reported build failure in earlier version]

Change-Id: I3df219ae37b431796057e380098afa7f6bb2bc63
Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Mel Gorman <mgorman@suse.de>
Link: https://lore.kernel.org/r/20210905143547.4668-3-laoar.shao@gmail.com
Stable-dep-of: 39afe5d6fc ("sched/fair: Fix inaccurate tally of ttwu_move_affine")
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit c3b9f95598)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-06-14 12:35:34 +00:00
Uwe Kleine-König
7f1bd76f41 UPSTREAM: platform: Provide a remove callback that returns no value
[ Upstream commit 5c5a7680e6 ]

struct platform_driver::remove returning an integer made driver authors
expect that returning an error code was proper error handling. However
the driver core ignores the error and continues to remove the device
because there is nothing the core could do anyhow and reentering the
remove callback again is only calling for trouble.

So this is an source for errors typically yielding resource leaks in the
error path.

As there are too many platform drivers to neatly convert them all to
return void in a single go, do it in several steps after this patch:

 a) Convert all drivers to implement .remove_new() returning void instead
    of .remove() returning int;
 b) Change struct platform_driver::remove() to return void and so make
    it identical to .remove_new();
 c) Change all drivers back to .remove() now with the better prototype;
 d) drop struct platform_driver::remove_new().

While this touches all drivers eventually twice, steps a) and c) can be
done one driver after another and so reduces coordination efforts
immensely and simplifies review.

Change-Id: I35e14b74375e32f1351bfebfa794e2f3fec99776
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Link: https://lore.kernel.org/r/20221209150914.3557650-1-u.kleine-koenig@pengutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: c766c90faf ("media: rcar_fdp1: Fix refcount leak in probe and remove function")
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit d18789f434)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-06-14 12:35:34 +00:00
Greg Kroah-Hartman
b529f9de5b ANDROID: GKI: reserve extra arm64 cpucaps for ABI preservation
Over the lifetime of the kernel, new arm64 cpucaps need to be added to
handle errata and other fun stuff.  So reserve 20 spots for us to use in
the future as this is an ABI-stable structure that we can not increase
over time without major problems.

Bug: 151154716
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I37bdac374e2570f61ab54919712fd62c7e541e67
2023-06-14 12:35:34 +00:00
Quentin Perret
2ab1955d56 ANDROID: KVM: arm64: Allow setting {P,U}XN in stage-2 PTEs
FEAT_XNX allows to specify PXN and UXN attributes on stage-2 entries.
Make this usable from pKVM by exposing two new kvm_pgtable_prot entries
for each of them.

No functional changes intended.

Bug: 264070847
Change-Id: I47d861fa64ba511370b182f4609fe1c27695a949
Signed-off-by: Quentin Perret <qperret@google.com>
2023-06-14 12:35:34 +00:00
Quentin Perret
69e2ba2e16 ANDROID: KVM: arm64: Restrict host-to-hyp MMIO donations
Nothing currently prevents the donation of an MMIO region to the
hypervisor for backing e.g. guest stage-2 page-tables, tracing buffers,
hyp vm and vcpu metadata, or any other donation to EL2. However, the
only confirmed use-case for MMIO donations are for protecting the IOMMU
registers as well as for vendor module usage.

Restrict the donation of MMIO regions to these two paths only by
introducing a new helper function.

Bug: 264070847
Change-Id: I914508fb3e3547fcfabca8557bdf7948cb796099
Signed-off-by: Quentin Perret <qperret@google.com>
2023-06-14 12:35:34 +00:00
Quentin Perret
3f060ac3de ANDROID: KVM: arm64: Allow state changes of MMIO pages
We've historically disallowed state changes for MMIO pages -- the host
had sole ownership of all of them. However, changing the state of those
pages has clearly become a goal both to support vendor extensions to
the hypervisor, as well as to support device assignment in the longer
term. To pave the way towards this support, let's allow certain state
transitions for MMIO pages.

Bug: 264070847
Change-Id: I9803b572c90d8a694c3d43a0ee0d7b4f4124fe4a
Signed-off-by: Quentin Perret <qperret@google.com>
2023-06-14 12:35:34 +00:00
Quentin Perret
57574f0ae2 ANDROID: KVM: arm64: Allow MMIO perm changes from modules
We now allow donations of MMIO ranges, let's also allow modules to
change host stage-2 permissions.

Bug: 264070847
Change-Id: Ia72678bb27559d9a7963dbc5ffb5a101efcbbad2
Signed-off-by: Quentin Perret <qperret@google.com>
2023-06-14 12:35:34 +00:00
Quentin Perret
951d15786a ANDROID: KVM: arm64: Don't allocate from handle_host_mem_abort
There shouldn't be any reason to ever need allocating from the host
stage-2 pool during mem aborts now that the base page-table structure
is pinned. To prevent future regressions in this area, introduce a new
sanity check that will warn when hyp_page_alloc() is used from the mem
wrong paths.

Bug: 264070847
Change-Id: I7a7c606fe01558790e4ffcd3534f8976caf48bd0
Signed-off-by: Quentin Perret <qperret@google.com>
2023-06-14 12:35:34 +00:00
Quentin Perret
e609adf5cb ANDROID: KVM: arm64: Donate IOMMU regions to pKVM
The MMIO register space for IOMMUs controlled by the hypervisor is
currently unmapped from the host stage-2, and we rely on the host abort
path to not accidentally map them. However, this approach becomes
increasingly difficult to maintain as we introduce support for donating
MMIO regions and not just memory -- nothing prevents the host from
donating a protected MMIO register to another entity for example.

Now that MMIO donations are possible, let's use the proper
host-donate-hyp machinery to implement this. As a nice side effect, this
guarantees the host stage-2 page-table is annotated with hyp ownership
for those IOMMU regions, which guarantees the core range alignment
feature in the host mem abort parth will do the right thing without
requiring a second pass in the IOMMU code. This also turns the host
stage-2 PTEs into "non-default" entries, hence avoiding issues with the
coallescing code looking forward.

Bug: 264070847
Change-Id: I1fad1b1be36f3b654190a912617e780141945a8f
Signed-off-by: Quentin Perret <qperret@google.com>
2023-06-14 12:35:34 +00:00
Quentin Perret
1386a01618 ANDROID: KVM: arm64: Map MMIO donation as device at EL2
We now support donations of MMIO ranges to the hypervisor. Make sure to
update the donation logic to correctly map these pages with device
mappings.

Bug: 264070847
Change-Id: I36558f05ed47d1e3dc06e4e24151241474b4ff77
Signed-off-by: Quentin Perret <qperret@google.com>
2023-06-14 12:35:34 +00:00
Quentin Perret
9debaf482d ANDROID: KVM: arm64: Don't recycle pages from host mem abort
We're now guaranteed by construction to not require structural changes
to the host stage-2 page-table from the host memory abort path, so let's
use the low-level __host_stage2_idmap() function directly instead of the
higher-level wrapper that attempts page recycling when running out of
memory.

Bug: 264070847
Change-Id: I2db34777386931bfb3f93ea3b3e51e1e2a10ea79
Signed-off-by: Quentin Perret <qperret@google.com>
2023-06-14 12:35:34 +00:00
Quentin Perret
aa4b272b34 ANDROID: KVM: arm64: Pin host stage-2 tables
Now that the host stage-2 page-table is entirely pre-populated in
__pkvm_init_finalize(), we know that by the end of this function, the
structure of the page-table will remain stable until the host calls in
the hypervisor to require e.g. a page-table changes (by e.g. running a
guest). This does not necessarily mean that no host mem aborts will
occur -- there may be null PTEs in the host stage-2 due to collapsed
block mappings from fix_host_ownership() for example -- but all those
aborts should be trivially handled without requiring structural changes
to the page-table. This has the nice side effect of guaranteeing that
host_mem_abort() will not allocate from the host stage-2 pool. In order
to ensure this desirable property is retained for the lifetime of the
system even in the presence of the coalescing feature, let's 'pin' the
structure of the page-table as-is by taking an additional reference
from each table entry.

Bug: 264070847
Change-Id: If870d7485cc38f6ad714901e710287911f111897
Signed-off-by: Quentin Perret <qperret@google.com>
2023-06-14 12:35:34 +00:00
Quentin Perret
97877e974b ANDROID: KVM: arm64: Move kvm_pte_follow() to header
We will soon need to use kvm_pte_follow() from outside pgtable.c, so
move it to the header file as static inline.

Bug: 264070847
Change-Id: I319dff1b352a4acd8d9a5cc74acb5f1758be358f
Signed-off-by: Quentin Perret <qperret@google.com>
2023-06-14 12:35:34 +00:00
Quentin Perret
76380240a2 ANDROID: KVM: arm64: Pre-populate host stage2
We will soon attempt to avoid any memory allocations from the host mem
abort path. In order to pave the way towards supporting this, let's
pre-populate the host stage-2 for the entire address space using as many
block mappings as possible. Some of these mappings may need to be
collapsed shortly after from fix_host_ownership() for example, so this
doesn't guarantee the absence of memory aborts altogether, but helps
getting the structure of the page-table in the right shape early on.

Bug: 264070847
Change-Id: Ib3ce25c893f779437ce473d64e08e8876870556c
Signed-off-by: Quentin Perret <qperret@google.com>
2023-06-14 12:35:34 +00:00
Quentin Perret
a2b45ad90a ANDROID: KVM: arm64: Fix the host ownership later
The fix_host_ownership() path walks the hypervisor's stage-1 page-table
to adjust the host's stage-2 accordingly. However, this is done before
the hyp stage-1 refcount has been fixed up, and before the hyp percpu
fixmap has been created. This all works right now as we start off with
an empty host stage-2, so none of the changes require the usage of the
fixmap for e.g. CMOs.

To prepare the ground for doing fix_host_ownership() with a non-empty
page-table, finalize the hyp stage-1 upfront.

Bug: 264070847
Change-Id: I6aff3ac2f835be3fb3fba7660540c0a9b99c097d
Signed-off-by: Quentin Perret <qperret@google.com>
2023-06-14 12:35:34 +00:00
Quentin Perret
d522a07153 ANDROID: KVM: arm64: Don't recycle non-default PTEs
When recycling host stage-2 page-table pages, we currenly blindly
unmap all 'non-moveable' regions. To prepare the ground for allowing the
mapping of those regions with non-default attributes, let's switch to
using the recently introduced kvm_pgtable_stage2_reclaim_leaf() helper
which will only reclaim pages containing PTEs with default attributes.

Bug: 264070847
Change-Id: I4a441a20abe84d2405efcfa403908078c10be841
Signed-off-by: Quentin Perret <qperret@google.com>
2023-06-14 12:35:34 +00:00
Quentin Perret
2bad47ce33 ANDROID: KVM: arm64: Introduce kvm_pgtable_stage2_reclaim_leaves
We will soon improve the mechanism by which the host's stage-2
page-table pages are recycled whenever its pool runs out of pages. To
prepare thecground for this, introduce a new helper function in the
page-table code allowing to reclaim leaf pages that don't hold counted
PTEs.

Bug: 264070847
Change-Id: Ie172bf11f2980e45bc908002368759f74f42d195
Signed-off-by: Quentin Perret <qperret@google.com>
2023-06-14 12:35:34 +00:00
Vincent Donnefort
da5b14f0a1 ANDROID: KVM: arm64: Deprecate late pKVM module loading
Previously it was possible to load a pKVM module after the userspace has
started, leaving on the modules the task of disabling the feature
(__pkvm_close_module_registration HVC).

Depreacte this way of loading modules in favor of the pre-userspace
loading via the cmdline kvm-arm.protected_modules=<module1>,<module2>.

Bug: 254835242
Change-Id: I38eef46b1482ff03af610b3b5d21b3ebfadda59b
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
[ qperret: fixed trivial conflict in nvhe/iommu.c due to aosp/2571370 ]
Signed-off-by: Quentin Perret <qperret@google.com>
2023-06-14 12:35:34 +00:00
Greg Kroah-Hartman
dc7c06dba7 Merge 5.15.114 into android14-5.15-lts
Changes in 5.15.114
	usb: gadget: Properly configure the device for remote wakeup
	usb: dwc3: fix gadget mode suspend interrupt handler issue
	dt-bindings: ata: ahci-ceva: convert to yaml
	dt-bindings: ata: ahci-ceva: Cover all 4 iommus entries
	watchdog: sp5100_tco: Immediately trigger upon starting.
	ARM: dts: stm32: fix AV96 board SAI2 pin muxing on stm32mp15
	spi: fsl-spi: Re-organise transfer bits_per_word adaptation
	spi: fsl-cpm: Use 16 bit mode for large transfers with even size
	ocfs2: Switch to security_inode_init_security()
	arm64: Also reset KASAN tag if page is not PG_mte_tagged
	ALSA: hda/ca0132: add quirk for EVGA X299 DARK
	ALSA: hda: Fix unhandled register update during auto-suspend period
	ALSA: hda/realtek: Enable headset onLenovo M70/M90
	mmc: sdhci-esdhc-imx: make "no-mmc-hs400" works
	ASoC: rt5682: Disable jack detection interrupt during suspend
	net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize
	m68k: Move signal frame following exception on 68020/030
	parisc: Handle kgdb breakpoints only in kernel context
	parisc: Allow to reboot machine after system halt
	gpio: mockup: Fix mode of debugfs files
	btrfs: use nofs when cleaning up aborted transactions
	dt-binding: cdns,usb3: Fix cdns,on-chip-buff-size type
	x86/mm: Avoid incomplete Global INVLPG flushes
	selftests/memfd: Fix unknown type name build failure
	parisc: Fix flush_dcache_page() for usage from irq context
	perf/x86/uncore: Correct the number of CHAs on SPR
	x86/topology: Fix erroneous smp_num_siblings on Intel Hybrid platforms
	debugobjects: Don't wake up kswapd from fill_pool()
	fbdev: udlfb: Fix endpoint check
	net: fix stack overflow when LRO is disabled for virtual interfaces
	udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated().
	USB: core: Add routines for endpoint checks in old drivers
	USB: sisusbvga: Add endpoint checks
	media: radio-shark: Add endpoint checks
	ASoC: lpass: Fix for KASAN use_after_free out of bounds
	net: fix skb leak in __skb_tstamp_tx()
	selftests: fib_tests: mute cleanup error message
	octeontx2-pf: Fix TSOv6 offload
	bpf: Fix mask generation for 32-bit narrow loads of 64-bit fields
	ipv6: Fix out-of-bounds access in ipv6_find_tlv()
	cifs: mapchars mount option ignored
	power: supply: leds: Fix blink to LED on transition
	power: supply: mt6360: add a check of devm_work_autocancel in mt6360_charger_probe
	power: supply: bq27xxx: Fix bq27xxx_battery_update() race condition
	power: supply: bq27xxx: Fix I2C IRQ race on remove
	power: supply: bq27xxx: Fix poll_interval handling and races on remove
	power: supply: bq27xxx: Add cache parameter to bq27xxx_battery_current_and_status()
	power: supply: sbs-charger: Fix INHIBITED bit for Status reg
	firmware: arm_ffa: Check if ffa_driver remove is present before executing
	firmware: arm_ffa: Fix FFA device names for logical partitions
	fs: fix undefined behavior in bit shift for SB_NOUSER
	regulator: pca9450: Fix BUCK2 enable_mask
	coresight: Fix signedness bug in tmc_etr_buf_insert_barrier_packet()
	xen/pvcalls-back: fix double frees with pvcalls_new_active_socket()
	x86/show_trace_log_lvl: Ensure stack pointer is aligned, again
	ASoC: Intel: Skylake: Fix declaration of enum skl_ch_cfg
	sctp: fix an issue that plpmtu can never go to complete state
	forcedeth: Fix an error handling path in nv_probe()
	platform/mellanox: mlxbf-pmc: fix sscanf() error checking
	net/mlx5e: do as little as possible in napi poll when budget is 0
	net/mlx5: DR, Fix crc32 calculation to work on big-endian (BE) CPUs
	net/mlx5: DR, Check force-loopback RC QP capability independently from RoCE
	net/mlx5: Fix error message when failing to allocate device memory
	net/mlx5: Devcom, fix error flow in mlx5_devcom_register_device
	arm64: dts: imx8mn-var-som: fix PHY detection bug by adding deassert delay
	firmware: arm_ffa: Set reserved/MBZ fields to zero in the memory descriptors
	regulator: mt6359: add read check for PMIC MT6359
	3c589_cs: Fix an error handling path in tc589_probe()
	net: phy: mscc: add VSC8502 to MODULE_DEVICE_TABLE
	Linux 5.15.114

Change-Id: Id1e4400f1ebeb6b72fb01fb1093dc807d8a9acc3
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-06-14 12:26:35 +00:00
Greg Kroah-Hartman
49839eb143 ANDROID: GKI: preserve CRC generation for some bluetooth symbols
In commit 392a06f965 ("Bluetooth: hci_bcm: Fall back to getting bdaddr
from EFI if not set"), a "#include <linux/efi.h>" was added which caused
the CRC generation of some bluetooth symbols to be modified due to some
structures now coming into "scope".

Fix this up by hacking in our favorite __GENKSYMS__ test, which fixes
everything up right and all is calm again.

Bug: 161946584
Fixes: 392a06f965 ("Bluetooth: hci_bcm: Fall back to getting bdaddr from EFI if not set")
Change-Id: I5ddb1d3895f079980c3efd64ae773b91da3ca809
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-06-14 12:19:24 +00:00
Greg Kroah-Hartman
471e639e59 Linux 5.15.117
Link: https://lore.kernel.org/r/20230612101702.085813286@linuxfoundation.org
Tested-by: Chris Paterson (CIP) <chris.paterson2@renesas.com>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Bagas Sanjaya <bagasdotme@gmail.com>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Tested-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
Tested-by: Allen Pais <apais@linux.microsoft.com>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Ron Economos <re@w6rz.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-06-14 11:13:10 +02:00
Greg Kroah-Hartman
ef876dd258 Revert "staging: rtl8192e: Replace macro RTL_PCI_DEVICE with PCI_DEVICE"
This reverts commit a97e60bd28 which is
commit fda2093860 upstream.

Ben reports that this should not have been backported to the older
kernels as the rest of the macro is not empty.  It was a clean-up patch
in 6.4-rc1 only, it did not add new device ids.

Reported-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Philipp Hortmann <philipp.g.hortmann@gmail.com>
Cc: Sasha Levin <sashal@kernel.org>
Link: https://lore.kernel.org/r/aa0d401a7f63448cd4c2fe4a2d7e8495d9aa123e.camel@decadent.org.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-06-14 11:13:10 +02:00
Darrick J. Wong
6cfe9ddb6a xfs: verify buffer contents when we skip log replay
commit 22ed903eee upstream.

syzbot detected a crash during log recovery:

XFS (loop0): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791
XFS (loop0): Torn write (CRC failure) detected at log block 0x180. Truncating head block from 0x200.
XFS (loop0): Starting recovery (logdev: internal)
==================================================================
BUG: KASAN: slab-out-of-bounds in xfs_btree_lookup_get_block+0x15c/0x6d0 fs/xfs/libxfs/xfs_btree.c:1813
Read of size 8 at addr ffff88807e89f258 by task syz-executor132/5074

CPU: 0 PID: 5074 Comm: syz-executor132 Not tainted 6.2.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1b1/0x290 lib/dump_stack.c:106
 print_address_description+0x74/0x340 mm/kasan/report.c:306
 print_report+0x107/0x1f0 mm/kasan/report.c:417
 kasan_report+0xcd/0x100 mm/kasan/report.c:517
 xfs_btree_lookup_get_block+0x15c/0x6d0 fs/xfs/libxfs/xfs_btree.c:1813
 xfs_btree_lookup+0x346/0x12c0 fs/xfs/libxfs/xfs_btree.c:1913
 xfs_btree_simple_query_range+0xde/0x6a0 fs/xfs/libxfs/xfs_btree.c:4713
 xfs_btree_query_range+0x2db/0x380 fs/xfs/libxfs/xfs_btree.c:4953
 xfs_refcount_recover_cow_leftovers+0x2d1/0xa60 fs/xfs/libxfs/xfs_refcount.c:1946
 xfs_reflink_recover_cow+0xab/0x1b0 fs/xfs/xfs_reflink.c:930
 xlog_recover_finish+0x824/0x920 fs/xfs/xfs_log_recover.c:3493
 xfs_log_mount_finish+0x1ec/0x3d0 fs/xfs/xfs_log.c:829
 xfs_mountfs+0x146a/0x1ef0 fs/xfs/xfs_mount.c:933
 xfs_fs_fill_super+0xf95/0x11f0 fs/xfs/xfs_super.c:1666
 get_tree_bdev+0x400/0x620 fs/super.c:1282
 vfs_get_tree+0x88/0x270 fs/super.c:1489
 do_new_mount+0x289/0xad0 fs/namespace.c:3145
 do_mount fs/namespace.c:3488 [inline]
 __do_sys_mount fs/namespace.c:3697 [inline]
 __se_sys_mount+0x2d3/0x3c0 fs/namespace.c:3674
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f89fa3f4aca
Code: 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fffd5fb5ef8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00646975756f6e2c RCX: 00007f89fa3f4aca
RDX: 0000000020000100 RSI: 0000000020009640 RDI: 00007fffd5fb5f10
RBP: 00007fffd5fb5f10 R08: 00007fffd5fb5f50 R09: 000000000000970d
R10: 0000000000200800 R11: 0000000000000206 R12: 0000000000000004
R13: 0000555556c6b2c0 R14: 0000000000200800 R15: 00007fffd5fb5f50
 </TASK>

The fuzzed image contains an AGF with an obviously garbage
agf_refcount_level value of 32, and a dirty log with a buffer log item
for that AGF.  The ondisk AGF has a higher LSN than the recovered log
item.  xlog_recover_buf_commit_pass2 reads the buffer, compares the
LSNs, and decides to skip replay because the ondisk buffer appears to be
newer.

Unfortunately, the ondisk buffer is corrupt, but recovery just read the
buffer with no buffer ops specified:

	error = xfs_buf_read(mp->m_ddev_targp, buf_f->blf_blkno,
			buf_f->blf_len, buf_flags, &bp, NULL);

Skipping the buffer leaves its contents in memory unverified.  This sets
us up for a kernel crash because xfs_refcount_recover_cow_leftovers
reads the buffer (which is still around in XBF_DONE state, so no read
verification) and creates a refcountbt cursor of height 32.  This is
impossible so we run off the end of the cursor object and crash.

Fix this by invoking the verifier on all skipped buffers and aborting
log recovery if the ondisk buffer is corrupt.  It might be smarter to
force replay the log item atop the buffer and then see if it'll pass the
write verifier (like ext4 does) but for now let's go with the
conservative option where we stop immediately.

Link: https://syzkaller.appspot.com/bug?extid=7e9494b8b399902e994e
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
Signed-off-by: Dave Chinner <david@fromorbit.com>
Signed-off-by: Leah Rumancik <leah.rumancik@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-06-14 11:13:09 +02:00
Greg Kroah-Hartman
b5a52009d9 Revert "debugobject: Ensure pool refill (again)"
This reverts commit 503e554782 which is
commit 0af462f19e upstream.

Guenter reports problems with it, and it's not quite obvious why, so
revert it for now.

Reported-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/d35b1ff1-e198-481c-b1be-9e22445efe06@roeck-us.net
Cc: Ido Schimmel <idosch@nvidia.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-06-14 11:13:09 +02:00
Theodore Ts'o
3cc6805547 ext4: only check dquot_initialize_needed() when debugging
commit dea9d8f764 upstream.

ext4_xattr_block_set() relies on its caller to call dquot_initialize()
on the inode.  To assure that this has happened there are WARN_ON
checks.  Unfortunately, this is subject to false positives if there is
an antagonist thread which is flipping the file system at high rates
between r/o and rw.  So only do the check if EXT4_XATTR_DEBUG is
enabled.

Link: https://lore.kernel.org/r/20230608044056.GA1418535@mit.edu
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-06-14 11:13:09 +02:00
Theodore Ts'o
86ebb5b534 Revert "ext4: don't clear SB_RDONLY when remounting r/w until quota is re-enabled"
commit 1b29243933 upstream.

This reverts commit a44be64bbe.

Link: https://lore.kernel.org/r/653b3359-2005-21b1-039d-c55ca4cffdcc@gmail.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-06-14 11:13:09 +02:00
Shannon Nelson
9945284195 vhost_vdpa: support PACKED when setting-getting vring_base
[ Upstream commit beee7fdb5b ]

Use the right structs for PACKED or split vqs when setting and
getting the vring base.

Fixes: 4c8cf31885 ("vhost: introduce vDPA-based backend")
Signed-off-by: Shannon Nelson <shannon.nelson@amd.com>
Message-Id: <20230424225031.18947-4-shannon.nelson@amd.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-06-14 11:13:09 +02:00
Shannon Nelson
17882a3556 vhost: support PACKED when setting-getting vring_base
[ Upstream commit 55d8122f5c ]

Use the right structs for PACKED or split vqs when setting and
getting the vring base.

Fixes: 4c8cf31885 ("vhost: introduce vDPA-based backend")
Signed-off-by: Shannon Nelson <shannon.nelson@amd.com>
Message-Id: <20230424225031.18947-3-shannon.nelson@amd.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-06-14 11:13:09 +02:00
Sheng Zhao
d18688ff42 vduse: avoid empty string for dev name
[ Upstream commit a90e8608eb ]

Syzkaller hits a kernel WARN when the first character of the dev name
provided is NULL. Solution is to add a NULL check before calling
cdev_device_add() in vduse_create_dev().

kobject: (0000000072042169): attempted to be registered with empty name!
WARNING: CPU: 0 PID: 112695 at lib/kobject.c:236
Call Trace:
 kobject_add_varg linux/src/lib/kobject.c:390 [inline]
 kobject_add+0xf6/0x150 linux/src/lib/kobject.c:442
 device_add+0x28f/0xc20 linux/src/drivers/base/core.c:2167
 cdev_device_add+0x83/0xc0 linux/src/fs/char_dev.c:546
 vduse_create_dev linux/src/drivers/vdpa/vdpa_user/vduse_dev.c:2254 [inline]
 vduse_ioctl+0x7b5/0xf30 linux/src/drivers/vdpa/vdpa_user/vduse_dev.c:2316
 vfs_ioctl linux/src/fs/ioctl.c:47 [inline]
 file_ioctl linux/src/fs/ioctl.c:510 [inline]
 do_vfs_ioctl+0x14b/0xa80 linux/src/fs/ioctl.c:697
 ksys_ioctl+0x7c/0xa0 linux/src/fs/ioctl.c:714
 __do_sys_ioctl linux/src/fs/ioctl.c:721 [inline]
 __se_sys_ioctl linux/src/fs/ioctl.c:719 [inline]
 __x64_sys_ioctl+0x42/0x50 linux/src/fs/ioctl.c:719
 do_syscall_64+0x94/0x330 linux/src/arch/x86/entry/common.c:291
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Fixes: c8a6153b6c ("vduse: Introduce VDUSE - vDPA Device in Userspace")
Cc: "Xie Yongji" <xieyongji@bytedance.com>
Reported-by: Xianjun Zeng <zengxianjun@bytedance.com>
Signed-off-by: Sheng Zhao <sheng.zhao@bytedance.com>
Message-Id: <20230530033626.1266794-1-sheng.zhao@bytedance.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Xie Yongji <xieyongji@bytedance.com>
Cc: "Michael S. Tsirkin"<mst@redhat.com>, "Jason Wang"<jasowang@redhat.com>,
Reviewed-by: Xie Yongji <xieyongji@bytedance.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-06-14 11:13:09 +02:00
Ruan Jinjie
952d1e4cbc riscv: fix kprobe __user string arg print fault issue
[ Upstream commit 99a670b206 ]

On riscv qemu platform, when add kprobe event on do_sys_open() to show
filename string arg, it just print fault as follow:

echo 'p:myprobe do_sys_open dfd=$arg1 filename=+0($arg2):string flags=$arg3
mode=$arg4' > kprobe_events

bash-166     [000] ...1.   360.195367: myprobe: (do_sys_open+0x0/0x84)
dfd=0xffffffffffffff9c filename=(fault) flags=0x8241 mode=0x1b6

bash-166     [000] ...1.   360.219369: myprobe: (do_sys_open+0x0/0x84)
dfd=0xffffffffffffff9c filename=(fault) flags=0x8241 mode=0x1b6

bash-191     [000] ...1.   360.378827: myprobe: (do_sys_open+0x0/0x84)
dfd=0xffffffffffffff9c filename=(fault) flags=0x98800 mode=0x0

As riscv do not select ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE,
the +0($arg2) addr is processed as a kernel address though it is a
userspace address, cause the above filename=(fault) print. So select
ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE to avoid the issue, after that the
kprobe trace is ok as below:

bash-166     [000] ...1.    96.767641: myprobe: (do_sys_open+0x0/0x84)
dfd=0xffffffffffffff9c filename="/dev/null" flags=0x8241 mode=0x1b6

bash-166     [000] ...1.    96.793751: myprobe: (do_sys_open+0x0/0x84)
dfd=0xffffffffffffff9c filename="/dev/null" flags=0x8241 mode=0x1b6

bash-177     [000] ...1.    96.962354: myprobe: (do_sys_open+0x0/0x84)
dfd=0xffffffffffffff9c filename="/sys/kernel/debug/tracing/events/kprobes/"
flags=0x98800 mode=0x0

Signed-off-by: Ruan Jinjie <ruanjinjie@huawei.com>
Acked-by: Björn Töpel <bjorn@rivosinc.com>
Fixes: 0ebeea8ca8 ("bpf: Restrict bpf_probe_read{, str}() only to archs where they work")
Link: https://lore.kernel.org/r/20230504072910.3742842-1-ruanjinjie@huawei.com
Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-06-14 11:13:09 +02:00
Randy Dunlap
62958e78b7 eeprom: at24: also select REGMAP
[ Upstream commit 7f3c782b39 ]

Selecting only REGMAP_I2C can leave REGMAP unset, causing build errors,
so also select REGMAP to prevent the build errors.

../drivers/misc/eeprom/at24.c:540:42: warning: 'struct regmap_config' declared inside parameter list will not be visible outside of this definition or declaration
  540 |                                   struct regmap_config *regmap_config)
../drivers/misc/eeprom/at24.c: In function 'at24_make_dummy_client':
../drivers/misc/eeprom/at24.c:552:18: error: implicit declaration of function 'devm_regmap_init_i2c' [-Werror=implicit-function-declaration]
  552 |         regmap = devm_regmap_init_i2c(dummy_client, regmap_config);
../drivers/misc/eeprom/at24.c:552:16: warning: assignment to 'struct regmap *' from 'int' makes pointer from integer without a cast [-Wint-conversion]
  552 |         regmap = devm_regmap_init_i2c(dummy_client, regmap_config);
../drivers/misc/eeprom/at24.c: In function 'at24_probe':
../drivers/misc/eeprom/at24.c:586:16: error: variable 'regmap_config' has initializer but incomplete type
  586 |         struct regmap_config regmap_config = { };
../drivers/misc/eeprom/at24.c:586:30: error: storage size of 'regmap_config' isn't known
  586 |         struct regmap_config regmap_config = { };
../drivers/misc/eeprom/at24.c:586:30: warning: unused variable 'regmap_config' [-Wunused-variable]

Fixes: 5c01525847 ("eeprom: at24: add basic regmap_i2c support")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-06-14 11:13:08 +02:00