The change Ifdb1ba19f7147da286ea5e044e84dfb679050a94 ("FROMGIT: usb:
typec: tcpci: Prevent Sink disconnection before vPpsShutdown in SPR
PPS") breaks the KMI. Prevent the breakage by combining the parameters
"requested_vbus_voltage" and "pps_apdo_min_voltage" to a single u32
variable whose value is selected according to the values of parameter
"mode" and parameter "pps_active".
Bug: 388029777
Change-Id: I85872b9490561d248169bc8e008f3d907cc6c3c0
Signed-off-by: Kyle Tso <kyletso@google.com>
The Source can drop its output voltage to the minimum of the requested
PPS APDO voltage range when it is in Current Limit Mode. If this voltage
falls within the range of vPpsShutdown, the Source initiates a Hard
Reset and discharges Vbus. However, currently the Sink may disconnect
before the voltage reaches vPpsShutdown, leading to unexpected behavior.
Prevent premature disconnection by setting the Sink's disconnect
threshold to the minimum vPpsShutdown value. Additionally, consider the
voltage drop due to IR drop when calculating the appropriate threshold.
This ensures a robust and reliable interaction between the Source and
Sink during SPR PPS Current Limit Mode operation.
Fixes: 4288debeaa ("usb: typec: tcpci: Fix up sink disconnect thresholds for PD")
Cc: stable <stable@kernel.org>
Signed-off-by: Kyle Tso <kyletso@google.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Reviewed-by: Badhri Jagan Sridharan <badhri@google.com>
Link: https://lore.kernel.org/r/20250114142435.2093857-1-kyletso@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 388029777
(cherry picked from commit 4d27afbf256028a1f54363367f30efc8854433c3
https: //git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git/
usb-next)
Change-Id: Ifdb1ba19f7147da286ea5e044e84dfb679050a94
Signed-off-by: Kyle Tso <kyletso@google.com>
Function f2fs_invalidate_blocks() can process consecutive
blocks at a time, so f2fs_truncate_data_blocks_range() is
optimized to use the new functionality of
f2fs_invalidate_blocks().
Add two variables @blkstart and @blklen, @blkstart records
the first address of the consecutive blocks, and @blkstart
records the number of consecutive blocks.
Bug: 394006856
Change-Id: I219866b6c60a8f23f92aee64429064a04e7282d2
Signed-off-by: Yi Sun <yi.sun@unisoc.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
(cherry picked from commit 120ac1dc322f402544423582234f441d98ea4a6e)
New function can process some consecutive blocks at a time.
Function f2fs_invalidate_blocks()->down_write() and up_write()
are very time-consuming, so if f2fs_invalidate_blocks() can
process consecutive blocks at one time, it will save a lot of time.
Bug: 394006856
Change-Id: I6600c5be55f0261b142285fc45212921da8121fb
Signed-off-by: Yi Sun <yi.sun@unisoc.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
(cherry picked from commit e53c568f4603e997426712146dce0bc194c1db12)
This function can process some consecutive blocks at a time.
When using update_sit_entry() to release consecutive blocks,
ensure that the consecutive blocks belong to the same segment.
Because after update_sit_entry_for_realese(), @segno is still
in use in update_sit_entry().
Bug: 394006856
Change-Id: Ia6be213c3838351292d1000a52bd54a1090f1137
Signed-off-by: Yi Sun <yi.sun@unisoc.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
(cherry picked from commit 81ffbd224e5f926bf8df01d6107db9c8779f7d57)
No logical changes, just for cleanliness.
Bug: 394006856
Change-Id: I4dddab6be974476879af46cda814dee2223ed21d
Signed-off-by: Yi Sun <yi.sun@unisoc.com>
Reviewed-by: Chao Yu <chao@kernel.org>
[Dylan: Resolved minor conflict in fs/f2fs/segment.c ]
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
(cherry picked from commit 66baee2b886d72ab6be11a08d4c7897f9612e25b)
New function can process some consecutive blocks at a time.
Bug: 394006856
Change-Id: I6741915ec3fba137ae6295688b6c4f8474411177
Signed-off-by: Yi Sun <yi.sun@unisoc.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
(cherry picked from commit d217b5cea488c0f644c189f91b636aeefa12deb9)
New function f2fs_invalidate_compress_pages_range() adds the @len
parameter. So it can process some consecutive blocks at a time.
Bug: 394006856
Change-Id: I3b30396567771e1d3608395fa0b7e5e379ddc805
Signed-off-by: Yi Sun <yi.sun@unisoc.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
(cherry picked from commit 3d56fbb1f03f2abf8c806aee14df2f462350dfba)
Below race case can cause data corruption:
Thread A GC thread
- gc_data_segment
- ra_data_block
- locked meta_inode page
- f2fs_inplace_write_data
- invalidate_mapping_pages
: fail to invalidate meta_inode page
due to lock failure or dirty|writeback
status
- f2fs_submit_page_bio
: write last dirty data to old blkaddr
- move_data_block
- load old data from meta_inode page
- f2fs_submit_page_write
: write old data to new blkaddr
Because invalidate_mapping_pages() will skip invalidating page which
has unclear status including locked, dirty, writeback and so on, so
we need to use truncate_inode_pages_range() instead of
invalidate_mapping_pages() to make sure meta_inode page will be dropped.
Fixes: 6aa58d8ad2 ("f2fs: readahead encrypted block during GC")
Fixes: e3b49ea368 ("f2fs: invalidate META_MAPPING before IPU/DIO write")
Bug: 394006856
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
(cherry picked from commit 7bb861b0b15b42d58669a0a23ce0b7efb1b6c6e5)
Change-Id: I4ba1f509a7257dd5a6636d22a0908edd91318dd8
Commit "mm,page_alloc,cma: conditionally prefer cma pageblocks for
movable allocations" (1686766493) introduced balancing of movable
allocations between CMA and normal areas.
Commit "ANDROID: cma: redirect page allocation to CMA" (f60c5572d2)
removes it, making allocations go in CMA area first.
1. Reintroduce the condition, so that CMA and normal area are used
in a balanced way(as it used to be), so it prevents depleting of CMA
region;
2. Back-port a command line option(from 6.6), "restrict_cma_redirect",
that can be used if only MOVABLE allocations marked as __GFP_CMA are
eligible to be redirected to CMA region. By default it is true.
The purpose of this change is to keep using CMA for movable allocations,
but at the same time, to have enough free CMA pages for critical system
areas such as modem initialization, GPU initialization and so on.
Bug: 381168812
Signed-off-by: Sebastian Achim <sebastian.1.achim@sony.com>
Signed-off-by: Uladzislau Rezki <uladzislau.rezki@sony.com>
Signed-off-by: Oleksiy Avramchenko <oleksiy.avramchenko@sony.com>
Change-Id: I5fd6d022340715e27754c687189c5ea0e56d9ee6
When allocating guest stage-2 page-table pages at EL2, pKVM can consume
pages from the host-provided kvm_hyp_memcache. As pgtable.c expects
zeroed pages, guest_s2_zalloc_page() actively implements this zeroing
with a PAGE_SIZE memset. Unfortunately, we don't check the page
alignment of the host-provided address before doing so, which could
lead to the memset overrunning the page if the host was malicious.
Fix this by simply force-aligning all kvm_hyp_memcache allocations to
page boundaries.
Bug: 396116221
Fixes: 60dfe093ec ("KVM: arm64: Instantiate guest stage-2 page-tables at EL2")
Reported-by: Ben Simner <ben.simner@cl.cam.ac.uk>
Link: https://lore.kernel.org/r/20250213153615.3642515-1-qperret@google.com
Change-Id: Icd8c79495a28c014aa3b320ca44a03ee46ede2ce
Signed-off-by: Quentin Perret <qperret@google.com>
INFO: 1 function symbol(s) added
'int snd_ctl_remove_id(struct snd_card*, struct snd_ctl_elem_id*)'
snd_ctl_remove_id: remove the control of the given id and release it
audio amp driver need to remove kcontrol when reload dapm control.
Bug: 391517506
Change-Id: Ic8641be7a06d2dfcacd93e1c065f71704690a5bb
Signed-off-by: Injune Choi <injune.choi@samsung.com>
6.1.127 includes commit "hrtimers: Handle CPU state correctly on
hotplug". This commit is supposed to fix "hrtimers: Push pending
hrtimers away from outgoing CPU earlier". However commit "hrtimers:
Push pending hrtimers away from outgoing CPU earlier" was reverted
earlier on 6.1-lts. 6.1.127 incorrectly merged parts of "hrtimers:
Handle CPU state correctly on hotplug", which leads to random reboots.
Let´s revert those parts.
Fixes: 79f1b689da ("Merge 6.1.127 into android14-6.1-lts")
Change-Id: Ieb5e3910d631034eb8d4376c6f5a8e9751cae936
Signed-off-by: Micha Lechner <michalechner92@googlemail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
These symbols are missing from the symbol list and are not available at runtime for unsigned modules:
iio_get_channel_type
Bug: 386822958
Change-Id: I188d191a5a23451f155584e86d66ae56c235ad64
Signed-off-by: Rishi Sikka <rishisikka@google.com>
Adding the following symbols:
- __traceiter_android_trigger_vendor_lmk_kill
- __tracepoint_android_trigger_vendor_lmk_kill
Bug: 385050909
Change-Id: I82e202177d870fe0a55c69172817c260ece41ff6
Signed-off-by: Martin Liu <liumartin@google.com>
This change adds an android_trigger_vendor_lmk_kill() trace event
which can be used by vendor modules to send LMKD kill requests.
LMKD attaches a BPF program to this trace event if it exists and
expects it to be in a particular format. To provide a standardized
definition for this event, we define and export it inside the GKI
even though there are no users. Android vendors can use this event
to emit this trace event inside their modules and experiment with
different kill strategies before upstreaming them into LMKD.
Bug: 385050909
Test: build and check the ftrace event
Change-Id: Ida4d9202675a90d6cc891e242c0621c5386df8cc
Signed-off-by: Martin Liu <liumartin@google.com>
Changes in 6.1.128
ASoC: wm8994: Add depends on MFD core
ASoC: samsung: Add missing selects for MFD_WM8994
seccomp: Stub for !CONFIG_SECCOMP
scsi: iscsi: Fix redundant response for ISCSI_UEVENT_GET_HOST_STATS request
drm/amd/display: Use HW lock mgr for PSR1
irqchip/sunxi-nmi: Add missing SKIP_WAKE flag
ASoC: samsung: midas_wm1811: Map missing jack kcontrols
ASoC: samsung: Add missing depends on I2C
regmap: detach regmap from dev on regmap_exit
ipv6: Fix soft lockups in fib6_select_path under high next hop churn
softirq: Allow raising SCHED_SOFTIRQ from SMP-call-function on RT kernel
xfs: bump max fsgeom struct version
xfs: hoist freeing of rt data fork extent mappings
xfs: prevent rt growfs when quota is enabled
xfs: rt stubs should return negative errnos when rt disabled
xfs: fix units conversion error in xfs_bmap_del_extent_delay
xfs: make sure maxlen is still congruent with prod when rounding down
xfs: introduce protection for drop nlink
xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space
xfs: allow read IO and FICLONE to run concurrently
xfs: factor out xfs_defer_pending_abort
xfs: abort intent items when recovery intents fail
xfs: only remap the written blocks in xfs_reflink_end_cow_extent
xfs: up(ic_sema) if flushing data device fails
xfs: fix internal error from AGFL exhaustion
xfs: inode recovery does not validate the recovered inode
xfs: clean up dqblk extraction
xfs: dquot recovery does not validate the recovered dquot
xfs: clean up FS_XFLAG_REALTIME handling in xfs_ioctl_setattr_xflags
xfs: respect the stable writes flag on the RT device
gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag
io_uring: fix waiters missing wake ups
net: sched: fix ets qdisc OOB Indexing
block: fix integer overflow in BLKSECDISCARD
Revert "HID: multitouch: Add support for lenovo Y9000P Touchpad"
vfio/platform: check the bounds of read/write syscalls
ext4: fix access to uninitialised lock in fc replay path
ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find()
scsi: storvsc: Ratelimit warning logs to prevent VM denial of service
wifi: iwlwifi: add a few rate index validity checks
smb: client: fix UAF in async decryption
USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb()
Revert "usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null"
ALSA: usb-audio: Add delay quirk for USB Audio Device
Input: atkbd - map F23 key to support default copilot shortcut
Input: xpad - add unofficial Xbox 360 wireless receiver clone
Input: xpad - add support for wooting two he (arm)
smb: client: fix NULL ptr deref in crypto_aead_setkey()
ASoC: samsung: midas_wm1811: Fix 'Headphone Switch' control creation
drm/v3d: Assign job pointer to NULL before signaling the fence
Linux 6.1.128
Change-Id: Ia1ddc5824b498862a5eb730dd99bd3a76dd16015
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
This reverts commit bb00b1190b which is
commit 2b2fc0be98a828cf33a88a28e9745e8599fb05cf upstream.
It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.
Bug: 161946584
Change-Id: Ib6926beda39531de3e1a1025b981b560535347a4
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
This reverts commit 760f415e08 which is
commit fd4f101edbd9f99567ab2adb1f2169579ede7c13 upstream.
It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.
Bug: 161946584
Change-Id: I7cd575ae9e9d99f5181fdc297649d7e9f96d56fc
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
This reverts commit a3fdd5f3d6 which is
commit 6eedda01b2bfdcf427b37759e053dc27232f3af1 upstream.
It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.
Bug: 161946584
Change-Id: I6d0ce9375026632d6e27f9ec83c408fdee344963
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
This reverts commit c91e694619 which is
commit 46841c7053e6d25fb33e0534ef023833bf03e382 upstream.
It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.
Bug: 161946584
Change-Id: I1b6ed883c57437964fcfbcb2479ecf19f6a167f7
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
This reverts commit efec287cba which is
commit eb28fd76c0a08a47b470677c6cef9dd1c60e92d1 upstream.
It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.
Bug: 161946584
Change-Id: I8f64380576053dce28f0f73ef06ccf0a27469ed1
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Changes in 6.1.127
net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field()
bpf: Fix bpf_sk_select_reuseport() memory leak
openvswitch: fix lockup on tx to unregistering netdev with carrier
pktgen: Avoid out-of-bounds access in get_imix_entries
net: add exit_batch_rtnl() method
gtp: use exit_batch_rtnl() method
gtp: Use for_each_netdev_rcu() in gtp_genl_dump_pdp().
gtp: Destroy device along with udp socket's netns dismantle.
nfp: bpf: prevent integer overflow in nfp_bpf_event_output()
net: xilinx: axienet: Fix IRQ coalescing packet count overflow
net/mlx5: Fix RDMA TX steering prio
net/mlx5: Clear port select structure when fail to create
drm/v3d: Ensure job pointer is set to NULL after job completion
hwmon: (tmp513) Fix division of negative numbers
Revert "mtd: spi-nor: core: replace dummy buswidth from addr to data"
i2c: mux: demux-pinctrl: check initial mux selection, too
i2c: rcar: fix NACK handling when being a target
nvmet: propagate npwg topology
mac802154: check local interfaces before deleting sdata list
hfs: Sanity check the root record
fs: fix missing declaration of init_files
kheaders: Ignore silly-rename files
cachefiles: Parse the "secctx" immediately
scsi: ufs: core: Honor runtime/system PM levels if set by host controller drivers
selftests: tc-testing: reduce rshift value
ACPI: resource: acpi_dev_irq_override(): Check DMI match last
iomap: avoid avoid truncating 64-bit offset to 32 bits
poll_wait: add mb() to fix theoretical race between waitqueue_active() and .poll()
x86/asm: Make serialize() always_inline
ALSA: hda/realtek: Add support for Ayaneo System using CS35L41 HDA
zram: fix potential UAF of zram table
mptcp: be sure to send ack when mptcp-level window re-opens
selftests: mptcp: avoid spurious errors on disconnect
net: ethernet: xgbe: re-add aneg to supported features in PHY quirks
vsock/virtio: discard packets if the transport changes
vsock/virtio: cancel close work in the destructor
vsock: reset socket state when de-assigning the transport
vsock: prevent null-ptr-deref in vsock_*[has_data|has_space]
filemap: avoid truncating 64-bit offset to 32 bits
fs/proc: fix softlockup in __read_vmcore (part 2)
gpiolib: cdev: Fix use after free in lineinfo_changed_notify
pmdomain: imx8mp-blk-ctrl: add missing loop break condition
irqchip: Plug a OF node reference leak in platform_irqchip_probe()
irqchip/gic-v3: Handle CPU_PM_ENTER_FAILED correctly
irqchip/gic-v3-its: Don't enable interrupts in its_irq_set_vcpu_affinity()
hrtimers: Handle CPU state correctly on hotplug
drm/i915/fb: Relax clear color alignment to 64 bytes
Revert "PCI: Use preserve_config in place of pci_flags"
iio: imu: inv_icm42600: fix spi burst write not supported
iio: imu: inv_icm42600: fix timestamps after suspend if sensor is on
iio: adc: rockchip_saradc: fix information leak in triggered buffer
drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create'
drm/amdgpu: fix usage slab after free
block: fix uaf for flush rq while iterating tags
Revert "drm/amdgpu: rework resume handling for display (v2)"
RDMA/rxe: Fix the qp flush warnings in req
scsi: sg: Fix slab-use-after-free read in sg_release()
Revert "regmap: detach regmap from dev on regmap_exit"
wifi: ath10k: avoid NULL pointer error during sdio remove
erofs: tidy up EROFS on-disk naming
erofs: handle NONHEAD !delta[1] lclusters gracefully
nfsd: add list_head nf_gc to struct nfsd_file
x86/xen: fix SLS mitigation in xen_hypercall_iret()
net: fix data-races around sk->sk_forward_alloc
Linux 6.1.127
Change-Id: I5621f4287b21d7fbcc2f19d46e02d97afe5f0451
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
If a command is queued to the final usable TRB of a ring segment, the
enqueue pointer is advanced to the subsequent link TRB and no further.
If the command is later aborted, when the abort completion is handled
the dequeue pointer is advanced to the first TRB of the next segment.
If no further commands are queued, xhci_handle_stopped_cmd_ring() sees
the ring pointers unequal and assumes that there is a pending command,
so it calls xhci_mod_cmd_timer() which crashes if cur_cmd was NULL.
Don't attempt timer setup if cur_cmd is NULL. The subsequent doorbell
ring likely is unnecessary too, but it's harmless. Leave it alone.
This is probably Bug 219532, but no confirmation has been received.
The issue has been independently reproduced and confirmed fixed using
a USB MCU programmed to NAK the Status stage of SET_ADDRESS forever.
Everything continued working normally after several prevented crashes.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=219532
Fixes: c311e391a7 ("xhci: rework command timeout and cancellation,")
CC: stable@vger.kernel.org
Signed-off-by: Michal Pecio <michal.pecio@gmail.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20241227120142.1035206-4-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 393469846
(cherry picked from commit 1e0a19912adb68a4b2b74fd77001c96cd83eb073)
[Sriram: Resolved minor conflict drivers/usb/host/xhci-ring.c ]
Change-Id: I0228fb40e139eb06b9ab68fd3e66ca3444da7077
Signed-off-by: Sriram Dash <quic_sriramd@quicinc.com>
Commit b50a013d33 ("BACKPORT: OPP: Extend support for the opp-level
beyond required-opps") used dev_pm_genpd_set_performance_state()
as a substitute for dev_pm_domain_set_performance_state(), since
introducing dev_pm_domain_set_performance_state() required breaking the
ABI on this branch.
However, directly invoking dev_pm_genpd_set_performance_state() is not
equivalent to dev_pm_domain_set_performance_state(), as the latter
only invokes a PM domain's set_performance_state callback if the device
it is invoked on uses a PM domain, and if that PM domain supports that
callback. If that check fails, then the invocation is simply a nop, and
no error code is returned.
In contrast, dev_pm_genpd_set_performance_state() checks to ensure that the
device uses a PM domain, and that the PM domain is a generic PM domain.
If that is not the case, then the invocation returns an error which is
then propagated up the call chain.
Therefore, fix _set_opp_level() to function as a nop for devices without
PM domains to align it to its original intent.
Bug: 394178898
Fixes: b50a013d33 ("BACKPORT: OPP: Extend support for the opp-level beyond required-opps")
Change-Id: I664d45168404d62aecf59a0afcd2e001d6b7a247
Signed-off-by: Isaac J. Manjarres <isaacmanjarres@google.com>
commit 48c6253fef upstream.
'Headphone Switch' control is already registered from
sound/soc/codecs/wm_hubs.c:479, so duplicating it in midas_wm1811
causes following probe failure:
midas-audio sound: control 2:0:0:Headphone Switch:0 is already present
midas-audio sound: ASoC: Failed to add Headphone Switch: -16
midas-audio sound: Failed to register card: -16
midas-audio: probe of sound failed with error -16
Fix this by dropping duplicated control.
Fixes: d27224a45e ("ASoC: samsung: midas_wm1811: Map missing jack kcontrols")
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Link: https://lore.kernel.org/r/20230809100446.2105825-1-m.szyprowski@samsung.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 907bc9268a5a9f823ffa751957a5c1dd59f83f42 upstream.
Microsoft defined Meta+Shift+F23 as the Copilot shortcut instead of a
dedicated keycode, and multiple vendors have their keyboards emit this
sequence in response to users pressing a dedicated "Copilot" key.
Unfortunately the default keymap table in atkbd does not map scancode
0x6e (F23) and so the key combination does not work even if userspace
is ready to handle it.
Because this behavior is common between multiple vendors and the
scancode is currently unused map 0x6e to keycode 193 (KEY_F23) so that
key sequence is generated properly.
MS documentation for the scan code:
https://learn.microsoft.com/en-us/windows/win32/inputdev/about-keyboard-input#scan-codes
Confirmed on Lenovo, HP and Dell machines by Canonical.
Tested on Lenovo T14s G6 AMD.
Signed-off-by: Mark Pearson <mpearson-lenovo@squebb.ca>
Link: https://lore.kernel.org/r/20250107034554.25843-1-mpearson-lenovo@squebb.ca
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 575a5adf48b06a2980c9eeffedf699ed5534fade upstream.
This patch addresses a null-ptr-deref in qt2_process_read_urb() due to
an incorrect bounds check in the following:
if (newport > serial->num_ports) {
dev_err(&port->dev,
"%s - port change to invalid port: %i\n",
__func__, newport);
break;
}
The condition doesn't account for the valid range of the serial->port
buffer, which is from 0 to serial->num_ports - 1. When newport is equal
to serial->num_ports, the assignment of "port" in the
following code is out-of-bounds and NULL:
serial_priv->current_port = newport;
port = serial->port[serial_priv->current_port];
The fix checks if newport is greater than or equal to serial->num_ports
indicating it is out-of-bounds.
Reported-by: syzbot <syzbot+506479ebf12fe435d01a@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=506479ebf12fe435d01a
Fixes: f7a33e608d ("USB: serial: add quatech2 usb to serial driver")
Cc: <stable@vger.kernel.org> # 3.5
Signed-off-by: Qasim Ijaz <qasdev00@gmail.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 90e0569dd3d32f4f4d2ca691d3fa5a8a14a13c12 upstream.
The per-netns IP tunnel hash table is protected by the RTNL mutex and
ip_tunnel_find() is only called from the control path where the mutex is
taken.
Add a lockdep expression to hlist_for_each_entry_rcu() in
ip_tunnel_find() in order to validate that the mutex is held and to
silence the suspicious RCU usage warning [1].
[1]
WARNING: suspicious RCU usage
6.12.0-rc3-custom-gd95d9a31aceb #139 Not tainted
-----------------------------
net/ipv4/ip_tunnel.c:221 RCU-list traversed in non-reader section!!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
1 lock held by ip/362:
#0: ffffffff86fc7cb0 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x377/0xf60
stack backtrace:
CPU: 12 UID: 0 PID: 362 Comm: ip Not tainted 6.12.0-rc3-custom-gd95d9a31aceb #139
Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
Call Trace:
<TASK>
dump_stack_lvl+0xba/0x110
lockdep_rcu_suspicious.cold+0x4f/0xd6
ip_tunnel_find+0x435/0x4d0
ip_tunnel_newlink+0x517/0x7a0
ipgre_newlink+0x14c/0x170
__rtnl_newlink+0x1173/0x19c0
rtnl_newlink+0x6c/0xa0
rtnetlink_rcv_msg+0x3cc/0xf60
netlink_rcv_skb+0x171/0x450
netlink_unicast+0x539/0x7f0
netlink_sendmsg+0x8c1/0xd80
____sys_sendmsg+0x8f9/0xc20
___sys_sendmsg+0x197/0x1e0
__sys_sendmsg+0x122/0x1f0
do_syscall_64+0xbb/0x1d0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Fixes: c544193214 ("GRE: Refactor GRE tunneling code.")
Suggested-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20241023123009.749764-1-idosch@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Alva Lan <alvalan9@foxmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 23dfdb56581ad92a9967bcd720c8c23356af74c1 upstream.
The following kernel trace can be triggered with fstest generic/629 when
executed against a filesystem with fast-commit feature enabled:
INFO: trying to register non-static key.
The code is fine but needs lockdep annotation, or maybe
you didn't initialize this object before use?
turning off the locking correctness validator.
CPU: 0 PID: 866 Comm: mount Not tainted 6.10.0+ #11
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-3-gd478f380-prebuilt.qemu.org 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x66/0x90
register_lock_class+0x759/0x7d0
__lock_acquire+0x85/0x2630
? __find_get_block+0xb4/0x380
lock_acquire+0xd1/0x2d0
? __ext4_journal_get_write_access+0xd5/0x160
_raw_spin_lock+0x33/0x40
? __ext4_journal_get_write_access+0xd5/0x160
__ext4_journal_get_write_access+0xd5/0x160
ext4_reserve_inode_write+0x61/0xb0
__ext4_mark_inode_dirty+0x79/0x270
? ext4_ext_replay_set_iblocks+0x2f8/0x450
ext4_ext_replay_set_iblocks+0x330/0x450
ext4_fc_replay+0x14c8/0x1540
? jread+0x88/0x2e0
? rcu_is_watching+0x11/0x40
do_one_pass+0x447/0xd00
jbd2_journal_recover+0x139/0x1b0
jbd2_journal_load+0x96/0x390
ext4_load_and_init_journal+0x253/0xd40
ext4_fill_super+0x2cc6/0x3180
...
In the replay path there's an attempt to lock sbi->s_bdev_wb_lock in
function ext4_check_bdev_write_error(). Unfortunately, at this point this
spinlock has not been initialized yet. Moving it's initialization to an
earlier point in __ext4_fill_super() fixes this splat.
Signed-off-by: Luis Henriques (SUSE) <luis.henriques@linux.dev>
Link: https://patch.msgid.link/20240718094356.7863-1-luis.henriques@linux.dev
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
Signed-off-by: Bruno VERNAY <bruno.vernay@se.com>
Signed-off-by: Victor Giraud <vgiraud.opensource@witekio.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 3d88ba86ba6f35a0467f25a88c38aa5639190d04 upstream.
This reverts commit 251efae73bd46b097deec4f9986d926813aed744.
Quoting Wang Yuli:
"The 27C6:01E0 touchpad doesn't require the workaround and applying it
would actually break functionality.
The initial report came from a BBS forum, but we suspect the
information provided by the forum user may be incorrect which could
happen sometimes. [1]
Further investigation showed that the Lenovo Y9000P 2024 doesn't even
use a Goodix touchpad. [2]
For the broader issue of 27c6:01e0 being unusable on some devices, it
just need to address it with a libinput quirk.
In conclusion, we should revert this commit, which is the best
solution."
Reported-by: Ulrich Müller <ulm@gentoo.org>
Reported-by: WangYuli <wangyuli@uniontech.com>
Link: https://lore.kernel.org/all/uikt4wwpw@gentoo.org/
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
