Commit Graph

37997 Commits

Author SHA1 Message Date
Greg Kroah-Hartman
5ee2de48ea Merge 5.15.10 into android13-5.15
Changes in 5.15.10
	nfc: fix segfault in nfc_genl_dump_devices_done
	hwmon: (corsair-psu) fix plain integer used as NULL pointer
	RDMA: Fix use-after-free in rxe_queue_cleanup
	RDMA/mlx5: Fix releasing unallocated memory in dereg MR flow
	mtd: rawnand: Fix nand_erase_op delay
	mtd: rawnand: Fix nand_choose_best_timings() on unsupported interface
	inet: use #ifdef CONFIG_SOCK_RX_QUEUE_MAPPING consistently
	dt-bindings: media: nxp,imx7-mipi-csi2: Drop bad if/then schema
	clk: qcom: sm6125-gcc: Swap ops of ice and apps on sdcc1
	perf bpf_skel: Do not use typedef to avoid error on old clang
	netfs: Fix lockdep warning from taking sb_writers whilst holding mmap_lock
	RDMA/irdma: Fix a user-after-free in add_pble_prm
	RDMA/irdma: Fix a potential memory allocation issue in 'irdma_prm_add_pble_mem()'
	RDMA/irdma: Report correct WC errors
	RDMA/irdma: Don't arm the CQ more than two times if no CE for this CQ
	ice: fix FDIR init missing when reset VF
	vmxnet3: fix minimum vectors alloc issue
	i2c: virtio: fix completion handling
	drm/msm: Fix null ptr access msm_ioctl_gem_submit()
	drm/msm/a6xx: Fix uinitialized use of gpu_scid
	drm/msm/dsi: set default num_data_lanes
	drm/msm/dp: Avoid unpowered AUX xfers that caused crashes
	KVM: arm64: Save PSTATE early on exit
	s390/test_unwind: use raw opcode instead of invalid instruction
	Revert "tty: serial: fsl_lpuart: drop earlycon entry for i.MX8QXP"
	net/mlx4_en: Update reported link modes for 1/10G
	loop: Use pr_warn_once() for loop_control_remove() warning
	ALSA: hda: Add Intel DG2 PCI ID and HDMI codec vid
	ALSA: hda/hdmi: fix HDA codec entry table order for ADL-P
	parisc/agp: Annotate parisc agp init functions with __init
	i2c: rk3x: Handle a spurious start completion interrupt flag
	net: netlink: af_netlink: Prevent empty skb by adding a check on len.
	drm/amdgpu: cancel the correct hrtimer on exit
	drm/amdgpu: check atomic flag to differeniate with legacy path
	drm/amd/display: Fix for the no Audio bug with Tiled Displays
	drm/amdkfd: fix double free mem structure
	drm/amd/display: add connector type check for CRC source set
	drm/amdkfd: process_info lock not needed for svm
	tracing: Fix a kmemleak false positive in tracing_map
	staging: most: dim2: use device release method
	fuse: make sure reclaim doesn't write the inode
	perf inject: Fix itrace space allowed for new attributes
	Linux 5.15.10

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I611aba3cbaa414f3dc6e3922245e140c36cbcb14
2021-12-29 11:32:01 +01:00
Chun-Hung Wu
39b50e0685 ANDROID: GKI: Export sched_clock_register
clocksource driver may use sched_clock_register
to resigter itself as a sched_clock source.
Export it to support building such driver
as module, like timer-mediatek.c

Bug: 161675989
Signed-off-by: Chun-Hung Wu <chun-hung.wu@mediatek.com>
Change-Id: I610b48abe1d2ec612023173bc847994c34703f56
2021-12-23 18:52:20 +08:00
Chen Jun
9985d29c47 tracing: Fix a kmemleak false positive in tracing_map
[ Upstream commit f25667e598 ]

Doing the command:
  echo 'hist:key=common_pid.execname,common_timestamp' > /sys/kernel/debug/tracing/events/xxx/trigger

Triggers many kmemleak reports:

unreferenced object 0xffff0000c7ea4980 (size 128):
  comm "bash", pid 338, jiffies 4294912626 (age 9339.324s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000f3469921>] kmem_cache_alloc_trace+0x4c0/0x6f0
    [<0000000054ca40c3>] hist_trigger_elt_data_alloc+0x140/0x178
    [<00000000633bd154>] tracing_map_init+0x1f8/0x268
    [<000000007e814ab9>] event_hist_trigger_func+0xca0/0x1ad0
    [<00000000bf8520ed>] trigger_process_regex+0xd4/0x128
    [<00000000f549355a>] event_trigger_write+0x7c/0x120
    [<00000000b80f898d>] vfs_write+0xc4/0x380
    [<00000000823e1055>] ksys_write+0x74/0xf8
    [<000000008a9374aa>] __arm64_sys_write+0x24/0x30
    [<0000000087124017>] do_el0_svc+0x88/0x1c0
    [<00000000efd0dcd1>] el0_svc+0x1c/0x28
    [<00000000dbfba9b3>] el0_sync_handler+0x88/0xc0
    [<00000000e7399680>] el0_sync+0x148/0x180
unreferenced object 0xffff0000c7ea4980 (size 128):
  comm "bash", pid 338, jiffies 4294912626 (age 9339.324s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000f3469921>] kmem_cache_alloc_trace+0x4c0/0x6f0
    [<0000000054ca40c3>] hist_trigger_elt_data_alloc+0x140/0x178
    [<00000000633bd154>] tracing_map_init+0x1f8/0x268
    [<000000007e814ab9>] event_hist_trigger_func+0xca0/0x1ad0
    [<00000000bf8520ed>] trigger_process_regex+0xd4/0x128
    [<00000000f549355a>] event_trigger_write+0x7c/0x120
    [<00000000b80f898d>] vfs_write+0xc4/0x380
    [<00000000823e1055>] ksys_write+0x74/0xf8
    [<000000008a9374aa>] __arm64_sys_write+0x24/0x30
    [<0000000087124017>] do_el0_svc+0x88/0x1c0
    [<00000000efd0dcd1>] el0_svc+0x1c/0x28
    [<00000000dbfba9b3>] el0_sync_handler+0x88/0xc0
    [<00000000e7399680>] el0_sync+0x148/0x180

The reason is elts->pages[i] is alloced by get_zeroed_page.
and kmemleak will not scan the area alloced by get_zeroed_page.
The address stored in elts->pages will be regarded as leaked.

That is, the elts->pages[i] will have pointers loaded onto it as well, and
without telling kmemleak about it, those pointers will look like memory
without a reference.

To fix this, call kmemleak_alloc to tell kmemleak to scan elts->pages[i]

Link: https://lkml.kernel.org/r/20211124140801.87121-1-chenjun102@huawei.com

Signed-off-by: Chen Jun <chenjun102@huawei.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-12-17 10:30:16 +01:00
Greg Kroah-Hartman
1dcc7190fe Merge 5.15.8 into android13-5.15
Changes in 5.15.8
	usb: gadget: uvc: fix multiple opens
	HID: quirks: Add quirk for the Microsoft Surface 3 type-cover
	HID: google: add eel USB id
	HID: intel-ish-hid: ipc: only enable IRQ wakeup when requested
	HID: add hid_is_usb() function to make it simpler for USB detection
	HID: add USB_HID dependancy to hid-prodikeys
	HID: add USB_HID dependancy to hid-chicony
	HID: add USB_HID dependancy on some USB HID drivers
	HID: bigbenff: prevent null pointer dereference
	HID: wacom: fix problems when device is not a valid USB device
	HID: check for valid USB device for many HID drivers
	mtd: dataflash: Add device-tree SPI IDs
	mmc: spi: Add device-tree SPI IDs
	HID: sony: fix error path in probe
	HID: Ignore battery for Elan touchscreen on Asus UX550VE
	platform/x86/intel: hid: add quirk to support Surface Go 3
	nft_set_pipapo: Fix bucket load in AVX2 lookup routine for six 8-bit groups
	IB/hfi1: Insure use of smp_processor_id() is preempt disabled
	IB/hfi1: Fix early init panic
	IB/hfi1: Fix leak of rcvhdrtail_dummy_kvaddr
	can: kvaser_usb: get CAN clock frequency from device
	can: kvaser_pciefd: kvaser_pciefd_rx_error_frame(): increase correct stats->{rx,tx}_errors counter
	can: sja1000: fix use after free in ems_pcmcia_add_card()
	can: pch_can: pch_can_rx_normal: fix use after free
	can: m_can: m_can_read_fifo: fix memory leak in error branch
	can: m_can: pci: fix incorrect reference clock rate
	can: m_can: pci: fix iomap_read_fifo() and iomap_write_fifo()
	can: m_can: Disable and ignore ELO interrupt
	net: dsa: mv88e6xxx: fix "don't use PHY_DETECT on internal PHY's"
	net: dsa: mv88e6xxx: allow use of PHYs on CPU and DSA ports
	x86/sme: Explicitly map new EFI memmap table as encrypted
	platform/x86: amd-pmc: Fix s2idle failures on certain AMD laptops
	nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done
	selftests: netfilter: add a vrf+conntrack testcase
	vrf: don't run conntrack on vrf with !dflt qdisc
	bpf, x86: Fix "no previous prototype" warning
	bpf, sockmap: Attach map progs to psock early for feature probes
	bpf: Make sure bpf_disable_instrumentation() is safe vs preemption.
	bpf: Fix the off-by-two error in range markings
	ice: ignore dropped packets during init
	ethtool: do not perform operations on net devices being unregistered
	bonding: make tx_rebalance_counter an atomic
	nfp: Fix memory leak in nfp_cpp_area_cache_add()
	seg6: fix the iif in the IPv6 socket control block
	udp: using datalen to cap max gso segments
	netfilter: nft_exthdr: break evaluation if setting TCP option fails
	netfilter: conntrack: annotate data-races around ct->timeout
	iavf: restore MSI state on reset
	iavf: Fix reporting when setting descriptor count
	IB/hfi1: Correct guard on eager buffer deallocation
	devlink: fix netns refcount leak in devlink_nl_cmd_reload()
	net: bcm4908: Handle dma_set_coherent_mask error codes
	net: dsa: mv88e6xxx: error handling for serdes_power functions
	net: dsa: felix: Fix memory leak in felix_setup_mmio_filtering
	net/sched: fq_pie: prevent dismantle issue
	net: mvpp2: fix XDP rx queues registering
	KVM: x86: Don't WARN if userspace mucks with RCX during string I/O exit
	KVM: x86: Ignore sparse banks size for an "all CPUs", non-sparse IPI req
	KVM: x86: Wait for IPIs to be delivered when handling Hyper-V TLB flush hypercall
	timers: implement usleep_idle_range()
	mm/damon/core: fix fake load reports due to uninterruptible sleeps
	mm/slub: fix endianness bug for alloc/free_traces attributes
	mm: bdi: initialize bdi_min_ratio when bdi is unregistered
	ALSA: ctl: Fix copy of updated id with element read/write
	ALSA: hda/realtek - Add headset Mic support for Lenovo ALC897 platform
	ALSA: hda/realtek: Fix quirk for TongFang PHxTxX1
	ALSA: pcm: oss: Fix negative period/buffer sizes
	ALSA: pcm: oss: Limit the period size to 16MB
	ALSA: pcm: oss: Handle missing errors in snd_pcm_oss_change_params*()
	cifs: Fix crash on unload of cifs_arc4.ko
	scsi: qla2xxx: Format log strings only if needed
	btrfs: clear extent buffer uptodate when we fail to write it
	btrfs: fix re-dirty process of tree-log nodes
	btrfs: replace the BUG_ON in btrfs_del_root_ref with proper error handling
	btrfs: free exchange changeset on failures
	perf intel-pt: Fix some PGE (packet generation enable/control flow packets) usage
	perf intel-pt: Fix sync state when a PSB (synchronization) packet is found
	perf intel-pt: Fix intel_pt_fup_event() assumptions about setting state type
	perf intel-pt: Fix state setting when receiving overflow (OVF) packet
	perf intel-pt: Fix next 'err' value, walking trace
	perf intel-pt: Fix missing 'instruction' events with 'q' option
	perf intel-pt: Fix error timestamp setting on the decoder error path
	md: fix update super 1.0 on rdev size change
	nfsd: fix use-after-free due to delegation race
	nfsd: Fix nsfd startup race (again)
	tracefs: Have new files inherit the ownership of their parent
	selftests: KVM: avoid failures due to reserved HyperTransport region
	hwmon: (pwm-fan) Ensure the fan going on in .probe()
	mmc: renesas_sdhi: initialize variable properly when tuning
	clk: qcom: regmap-mux: fix parent clock lookup
	thermal: int340x: Fix VCoRefLow MMIO bit offset for TGL
	drm/syncobj: Deal with signalled fences in drm_syncobj_find_fence.
	libata: add horkage for ASMedia 1092
	io_uring: ensure task_work gets run as part of cancelations
	wait: add wake_up_pollfree()
	binder: use wake_up_pollfree()
	signalfd: use wake_up_pollfree()
	aio: keep poll requests on waitqueue until completed
	aio: fix use-after-free due to missing POLLFREE handling
	tracefs: Set all files to the same group ownership as the mount option
	i2c: mpc: Use atomic read and fix break condition
	block: fix ioprio_get(IOPRIO_WHO_PGRP) vs setuid(2)
	scsi: pm80xx: Do not call scsi_remove_host() in pm8001_alloc()
	scsi: scsi_debug: Fix buffer size of REPORT ZONES command
	ALSA: usb-audio: Reorder snd_djm_devices[] entries
	qede: validate non LSO skb length
	PM: runtime: Fix pm_runtime_active() kerneldoc comment
	ASoC: rt5682: Fix crash due to out of scope stack vars
	ASoC: qdsp6: q6routing: Fix return value from msm_routing_put_audio_mixer
	ASoC: codecs: wsa881x: fix return values from kcontrol put
	ASoC: codecs: wcd934x: handle channel mappping list correctly
	ASoC: codecs: wcd934x: return correct value from mixer put
	RDMA/hns: Do not halt commands during reset until later
	RDMA/hns: Do not destroy QP resources in the hw resetting phase
	hwmon: (dell-smm) Fix warning on /proc/i8k creation error
	clk: imx: use module_platform_driver
	clk: qcom: clk-alpha-pll: Don't reconfigure running Trion
	i40e: Fix failed opcode appearing if handling messages from VF
	i40e: Fix pre-set max number of queues for VF
	mtd: rawnand: fsmc: Take instruction delay into account
	mtd: rawnand: fsmc: Fix timing computation
	bpf, sockmap: Re-evaluate proto ops when psock is removed from sockmap
	i40e: Fix NULL pointer dereference in i40e_dbg_dump_desc
	Revert "PCI: aardvark: Fix support for PCI_ROM_ADDRESS1 on emulated bridge"
	drm/amd/display: Fix DPIA outbox timeout after S3/S4/reset
	perf tools: Fix SMT detection fast read path
	Documentation/locking/locktypes: Update migrate_disable() bits.
	dt-bindings: net: Reintroduce PHY no lane swap binding
	tools build: Remove needless libpython-version feature check that breaks test-all fast path
	net: cdc_ncm: Allow for dwNtbOutMaxSize to be unset or zero
	net: altera: set a couple error code in probe()
	net: fec: only clear interrupt of handling queue in fec_enet_rx_queue()
	net, neigh: clear whole pneigh_entry at alloc time
	net/qla3xxx: fix an error code in ql_adapter_up()
	selftests/fib_tests: Rework fib_rp_filter_test()
	USB: gadget: detect too-big endpoint 0 requests
	USB: gadget: zero allocate endpoint 0 buffers
	Revert "usb: dwc3: dwc3-qcom: Enable tx-fifo-resize property by default"
	usb: core: config: fix validation of wMaxPacketValue entries
	xhci: Remove CONFIG_USB_DEFAULT_PERSIST to prevent xHCI from runtime suspending
	usb: core: config: using bit mask instead of individual bits
	xhci: avoid race between disable slot command and host runtime suspend
	iio: gyro: adxrs290: fix data signedness
	iio: trigger: Fix reference counting
	iio: trigger: stm32-timer: fix MODULE_ALIAS
	iio: stk3310: Don't return error code in interrupt handler
	iio: mma8452: Fix trigger reference couting
	iio: ltr501: Don't return error code in trigger handler
	iio: kxsd9: Don't return error code in trigger handler
	iio: itg3200: Call iio_trigger_notify_done() on error
	iio: dln2-adc: Fix lockdep complaint
	iio: dln2: Check return value of devm_iio_trigger_register()
	iio: at91-sama5d2: Fix incorrect sign extension
	iio: adc: stm32: fix a current leak by resetting pcsel before disabling vdda
	iio: adc: axp20x_adc: fix charging current reporting on AXP22x
	iio: ad7768-1: Call iio_trigger_notify_done() on error
	iio: accel: kxcjk-1013: Fix possible memory leak in probe and remove
	misc: rtsx: Avoid mangling IRQ during runtime PM
	nvmem: eeprom: at25: fix FRAM byte_len
	bus: mhi: pci_generic: Fix device recovery failed issue
	bus: mhi: core: Add support for forced PM resume
	csky: fix typo of fpu config macro
	irqchip/aspeed-scu: Replace update_bits with write_bits.
	irqchip/armada-370-xp: Fix return value of armada_370_xp_msi_alloc()
	irqchip/armada-370-xp: Fix support for Multi-MSI interrupts
	aio: Fix incorrect usage of eventfd_signal_allowed()
	irqchip/irq-gic-v3-its.c: Force synchronisation when issuing INVALL
	irqchip: nvic: Fix offset for Interrupt Priority Offsets
	misc: fastrpc: fix improper packet size calculation
	clocksource/drivers/dw_apb_timer_of: Fix probe failure
	bpf: Add selftests to cover packet access corner cases
	Linux 5.15.8

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I4d543d6826c20e322ce477fe82c462791dc36ce4
2021-12-15 18:34:21 +01:00
Tengfei Fan
46161882da ANDROID: sched: add hook point in do_sched_yield()
When a task yields, it relinquishes the cpu and
scheduler is tasked to find another task.
However our vendor scheduler logic implementation
could return the same task leading to a loop where
the yielded task gets to run back, so add hook point
in do_sched_yield() for vendor can do some work
before task is scheduled.

Bug: 205804537
Change-Id: I6528c3f4b0ee360559ef9c97cb1eb2b2d1357870
Signed-off-by: Tengfei Fan <quic_tengfan@quicinc.com>
Signed-off-by: Sai Harshini Nimmala <quic_snimmala@quicinc.com>
2021-12-14 15:21:59 +00:00
Eric Biggers
1ebb6cd8c7 wait: add wake_up_pollfree()
commit 42288cb44c upstream.

Several ->poll() implementations are special in that they use a
waitqueue whose lifetime is the current task, rather than the struct
file as is normally the case.  This is okay for blocking polls, since a
blocking poll occurs within one task; however, non-blocking polls
require another solution.  This solution is for the queue to be cleared
before it is freed, using 'wake_up_poll(wq, EPOLLHUP | POLLFREE);'.

However, that has a bug: wake_up_poll() calls __wake_up() with
nr_exclusive=1.  Therefore, if there are multiple "exclusive" waiters,
and the wakeup function for the first one returns a positive value, only
that one will be called.  That's *not* what's needed for POLLFREE;
POLLFREE is special in that it really needs to wake up everyone.

Considering the three non-blocking poll systems:

- io_uring poll doesn't handle POLLFREE at all, so it is broken anyway.

- aio poll is unaffected, since it doesn't support exclusive waits.
  However, that's fragile, as someone could add this feature later.

- epoll doesn't appear to be broken by this, since its wakeup function
  returns 0 when it sees POLLFREE.  But this is fragile.

Although there is a workaround (see epoll), it's better to define a
function which always sends POLLFREE to all waiters.  Add such a
function.  Also make it verify that the queue really becomes empty after
all waiters have been woken up.

Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20211209010455.42744-2-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-14 10:57:15 +01:00
SeongJae Park
5a960e533c timers: implement usleep_idle_range()
commit e4779015fd upstream.

Patch series "mm/damon: Fix fake /proc/loadavg reports", v3.

This patchset fixes DAMON's fake load report issue.  The first patch
makes yet another variant of usleep_range() for this fix, and the second
patch fixes the issue of DAMON by making it using the newly introduced
function.

This patch (of 2):

Some kernel threads such as DAMON could need to repeatedly sleep in
micro seconds level.  Because usleep_range() sleeps in uninterruptible
state, however, such threads would make /proc/loadavg reports fake load.

To help such cases, this commit implements a variant of usleep_range()
called usleep_idle_range().  It is same to usleep_range() but sets the
state of the current task as TASK_IDLE while sleeping.

Link: https://lkml.kernel.org/r/20211126145015.15862-1-sj@kernel.org
Link: https://lkml.kernel.org/r/20211126145015.15862-2-sj@kernel.org
Signed-off-by: SeongJae Park <sj@kernel.org>
Suggested-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Oleksandr Natalenko <oleksandr@natalenko.name>
Cc: John Stultz <john.stultz@linaro.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-14 10:57:11 +01:00
Maxim Mikityanskiy
b4fb67fd1a bpf: Fix the off-by-two error in range markings
commit 2fa7d94afc upstream.

The first commit cited below attempts to fix the off-by-one error that
appeared in some comparisons with an open range. Due to this error,
arithmetically equivalent pieces of code could get different verdicts
from the verifier, for example (pseudocode):

  // 1. Passes the verifier:
  if (data + 8 > data_end)
      return early
  read *(u64 *)data, i.e. [data; data+7]

  // 2. Rejected by the verifier (should still pass):
  if (data + 7 >= data_end)
      return early
  read *(u64 *)data, i.e. [data; data+7]

The attempted fix, however, shifts the range by one in a wrong
direction, so the bug not only remains, but also such piece of code
starts failing in the verifier:

  // 3. Rejected by the verifier, but the check is stricter than in #1.
  if (data + 8 >= data_end)
      return early
  read *(u64 *)data, i.e. [data; data+7]

The change performed by that fix converted an off-by-one bug into
off-by-two. The second commit cited below added the BPF selftests
written to ensure than code chunks like #3 are rejected, however,
they should be accepted.

This commit fixes the off-by-two error by adjusting new_range in the
right direction and fixes the tests by changing the range into the
one that should actually fail.

Fixes: fb2a311a31 ("bpf: fix off by one for range markings with L{T, E} patterns")
Fixes: b37242c773 ("bpf: add test cases to bpf selftests to cover all access tests")
Signed-off-by: Maxim Mikityanskiy <maximmi@nvidia.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20211130181607.593149-1-maximmi@nvidia.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-14 10:57:09 +01:00
Vincent Donnefort
889f8be857 ANDROID: sched: Introducing PELT multiplier
The new sysctl sched_pelt_multiplier allows a user to set a clock
multiplier x2 or x4 (x1 being the default). This clock multiplier
artificially speed-up PELT ramp up/down similarly to a faster half-life.
Indeed, if we write PELT as a first order filter:

  y(t) = G * (1 - exp(t/tau))

Then we can see that multiplying the time by a constant X, is the same as
dividing the time constant tau by X.

  y(t) = G * (1 - exp((t*X)/tau))
  y(t) = G * (1 - exp(t/(tau/X)))

Tau being half-life*ln(2), multiplying the PELT time is the same as
dividing the half-life:

  - x1: 32ms half-life
  - x2: 16ms half-life
  - x4: 8ms  half-life

Internally, a new clock is created: rq->clock_task_mult. It sits in the
clock hierarchy between rq->clock_task and rq->clock_pelt.

Bug: 177593580
Change-Id: I67e6ca7994bebea22bf75732ee11d2b10e0d6b7e
Suggested-by: Morten Rasmussen <morten.rasmussen@arm.com>
Signed-off-by: Vincent Donnefort <vincent.donnefort@arm.com>
2021-12-09 11:04:07 -08:00
Greg Kroah-Hartman
e5f6d1dffb Merge 5.15.7 into android13-5.15
Changes in 5.15.7
	ALSA: usb-audio: Restrict rates for the shared clocks
	ALSA: usb-audio: Rename early_playback_start flag with lowlatency_playback
	ALSA: usb-audio: Disable low-latency playback for free-wheel mode
	ALSA: usb-audio: Disable low-latency mode for implicit feedback sync
	ALSA: usb-audio: Check available frames for the next packet size
	ALSA: usb-audio: Add spinlock to stop_urbs()
	ALSA: usb-audio: Improved lowlatency playback support
	ALSA: usb-audio: Avoid killing in-flight URBs during draining
	ALSA: usb-audio: Fix packet size calculation regression
	ALSA: usb-audio: Less restriction for low-latency playback mode
	ALSA: usb-audio: Switch back to non-latency mode at a later point
	ALSA: usb-audio: Don't start stream for capture at prepare
	gfs2: release iopen glock early in evict
	gfs2: Fix length of holes reported at end-of-file
	powerpc/pseries/ddw: Revert "Extend upper limit for huge DMA window for persistent memory"
	powerpc/pseries/ddw: Do not try direct mapping with persistent memory and one window
	drm/sun4i: fix unmet dependency on RESET_CONTROLLER for PHY_SUN6I_MIPI_DPHY
	mac80211: do not access the IV when it was stripped
	mac80211: fix throughput LED trigger
	x86/hyperv: Move required MSRs check to initial platform probing
	net/smc: Transfer remaining wait queue entries during fallback
	atlantic: Fix OOB read and write in hw_atl_utils_fw_rpc_wait
	net: return correct error code
	pinctrl: qcom: fix unmet dependencies on GPIOLIB for GPIOLIB_IRQCHIP
	platform/x86: dell-wmi-descriptor: disable by default
	platform/x86: thinkpad_acpi: Add support for dual fan control
	platform/x86: thinkpad_acpi: Fix WWAN device disabled issue after S3 deep
	s390/setup: avoid using memblock_enforce_memory_limit
	btrfs: silence lockdep when reading chunk tree during mount
	btrfs: check-integrity: fix a warning on write caching disabled disk
	thermal: core: Reset previous low and high trip during thermal zone init
	scsi: iscsi: Unblock session then wake up error handler
	net: usb: r8152: Add MAC passthrough support for more Lenovo Docks
	drm/amd/pm: Remove artificial freq level on Navi1x
	drm/amd/amdkfd: Fix kernel panic when reset failed and been triggered again
	drm/amd/amdgpu: fix potential memleak
	ata: ahci: Add Green Sardine vendor ID as board_ahci_mobile
	ata: libahci: Adjust behavior when StorageD3Enable _DSD is set
	ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port()
	ipv6: check return value of ipv6_skip_exthdr
	net: tulip: de4x5: fix the problem that the array 'lp->phy[8]' may be out of bound
	net: ethernet: dec: tulip: de4x5: fix possible array overflows in type3_infoblock()
	perf sort: Fix the 'weight' sort key behavior
	perf sort: Fix the 'ins_lat' sort key behavior
	perf sort: Fix the 'p_stage_cyc' sort key behavior
	perf inject: Fix ARM SPE handling
	perf hist: Fix memory leak of a perf_hpp_fmt
	perf report: Fix memory leaks around perf_tip()
	tracing: Don't use out-of-sync va_list in event printing
	net/smc: Avoid warning of possible recursive locking
	ACPI: Add stubs for wakeup handler functions
	net/tls: Fix authentication failure in CCM mode
	vrf: Reset IPCB/IP6CB when processing outbound pkts in vrf dev xmit
	kprobes: Limit max data_size of the kretprobe instances
	ALSA: hda/cs8409: Set PMSG_ON earlier inside cs8409 driver
	rt2x00: do not mark device gone on EPROTO errors during start
	ipmi: Move remove_work to dedicated workqueue
	cpufreq: Fix get_cpu_device() failure in add_cpu_dev_symlink()
	iwlwifi: mvm: retry init flow if failed
	dma-buf: system_heap: Use 'for_each_sgtable_sg' in pages free flow
	s390/pci: move pseudo-MMIO to prevent MIO overlap
	fget: check that the fd still exists after getting a ref to it
	sata_fsl: fix UAF in sata_fsl_port_stop when rmmod sata_fsl
	sata_fsl: fix warning in remove_proc_entry when rmmod sata_fsl
	scsi: lpfc: Fix non-recovery of remote ports following an unsolicited LOGO
	scsi: ufs: ufs-pci: Add support for Intel ADL
	ipv6: fix memory leak in fib6_rule_suppress
	drm/amd/display: Allow DSC on supported MST branch devices
	drm/i915/dp: Perform 30ms delay after source OUI write
	KVM: fix avic_set_running for preemptable kernels
	KVM: Disallow user memslot with size that exceeds "unsigned long"
	KVM: x86/mmu: Fix TLB flush range when handling disconnected pt
	KVM: Ensure local memslot copies operate on up-to-date arch-specific data
	KVM: x86: ignore APICv if LAPIC is not enabled
	KVM: nVMX: Emulate guest TLB flush on nested VM-Enter with new vpid12
	KVM: nVMX: Flush current VPID (L1 vs. L2) for KVM_REQ_TLB_FLUSH_GUEST
	KVM: nVMX: Abide to KVM_REQ_TLB_FLUSH_GUEST request on nested vmentry/vmexit
	KVM: VMX: prepare sync_pir_to_irr for running with APICv disabled
	KVM: x86: Use a stable condition around all VT-d PI paths
	KVM: MMU: shadow nested paging does not have PKU
	KVM: arm64: Avoid setting the upper 32 bits of TCR_EL2 and CPTR_EL2 to 1
	KVM: X86: Use vcpu->arch.walk_mmu for kvm_mmu_invlpg()
	KVM: x86: check PIR even for vCPUs with disabled APICv
	tracing/histograms: String compares should not care about signed values
	net: dsa: mv88e6xxx: Fix application of erratum 4.8 for 88E6393X
	net: dsa: mv88e6xxx: Drop unnecessary check in mv88e6393x_serdes_erratum_4_6()
	net: dsa: mv88e6xxx: Save power by disabling SerDes trasmitter and receiver
	net: dsa: mv88e6xxx: Add fix for erratum 5.2 of 88E6393X family
	net: dsa: mv88e6xxx: Fix inband AN for 2500base-x on 88E6393X family
	net: dsa: mv88e6xxx: Link in pcs_get_state() if AN is bypassed
	wireguard: selftests: increase default dmesg log size
	wireguard: allowedips: add missing __rcu annotation to satisfy sparse
	wireguard: selftests: actually test for routing loops
	wireguard: selftests: rename DEBUG_PI_LIST to DEBUG_PLIST
	wireguard: device: reset peer src endpoint when netns exits
	wireguard: receive: use ring buffer for incoming handshakes
	wireguard: receive: drop handshakes if queue lock is contended
	wireguard: ratelimiter: use kvcalloc() instead of kvzalloc()
	i2c: stm32f7: flush TX FIFO upon transfer errors
	i2c: stm32f7: recover the bus on access timeout
	i2c: stm32f7: stop dma transfer in case of NACK
	i2c: cbus-gpio: set atomic transfer callback
	natsemi: xtensa: fix section mismatch warnings
	tcp: fix page frag corruption on page fault
	net: qlogic: qlcnic: Fix a NULL pointer dereference in qlcnic_83xx_add_rings()
	net: mpls: Fix notifications when deleting a device
	siphash: use _unaligned version by default
	arm64: ftrace: add missing BTIs
	iwlwifi: fix warnings produced by kernel debug options
	net/mlx5e: IPsec: Fix Software parser inner l3 type setting in case of encapsulation
	net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources()
	selftests: net: Correct case name
	net: dsa: b53: Add SPI ID table
	mt76: mt7915: fix NULL pointer dereference in mt7915_get_phy_mode
	ASoC: tegra: Fix wrong value type in ADMAIF
	ASoC: tegra: Fix wrong value type in I2S
	ASoC: tegra: Fix wrong value type in DMIC
	ASoC: tegra: Fix wrong value type in DSPK
	ASoC: tegra: Fix kcontrol put callback in ADMAIF
	ASoC: tegra: Fix kcontrol put callback in I2S
	ASoC: tegra: Fix kcontrol put callback in DMIC
	ASoC: tegra: Fix kcontrol put callback in DSPK
	ASoC: tegra: Fix kcontrol put callback in AHUB
	rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle()
	rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer()
	ALSA: intel-dsp-config: add quirk for CML devices based on ES8336 codec
	net: stmmac: Avoid DMA_CHAN_CONTROL write if no Split Header support
	net: usb: lan78xx: lan78xx_phy_init(): use PHY_POLL instead of "0" if no IRQ is available
	net: marvell: mvpp2: Fix the computation of shared CPUs
	dpaa2-eth: destroy workqueue at the end of remove function
	octeontx2-af: Fix a memleak bug in rvu_mbox_init()
	net: annotate data-races on txq->xmit_lock_owner
	ipv4: convert fib_num_tclassid_users to atomic_t
	net/smc: fix wrong list_del in smc_lgr_cleanup_early
	net/rds: correct socket tunable error in rds_tcp_tune()
	net/smc: Keep smc_close_final rc during active close
	drm/msm/a6xx: Allocate enough space for GMU registers
	drm/msm: Do hw_init() before capturing GPU state
	drm/vc4: kms: Wait for the commit before increasing our clock rate
	drm/vc4: kms: Fix return code check
	drm/vc4: kms: Add missing drm_crtc_commit_put
	drm/vc4: kms: Clear the HVS FIFO commit pointer once done
	drm/vc4: kms: Don't duplicate pending commit
	drm/vc4: kms: Fix previous HVS commit wait
	atlantic: Increase delay for fw transactions
	atlatnic: enable Nbase-t speeds with base-t
	atlantic: Fix to display FW bundle version instead of FW mac version.
	atlantic: Add missing DIDs and fix 115c.
	Remove Half duplex mode speed capabilities.
	atlantic: Fix statistics logic for production hardware
	atlantic: Remove warn trace message.
	KVM: x86/mmu: Skip tlb flush if it has been done in zap_gfn_range()
	KVM: x86/mmu: Pass parameter flush as false in kvm_tdp_mmu_zap_collapsible_sptes()
	drm/msm/devfreq: Fix OPP refcnt leak
	drm/msm: Fix mmap to include VM_IO and VM_DONTDUMP
	drm/msm: Fix wait_fence submitqueue leak
	drm/msm: Restore error return on invalid fence
	ASoC: rk817: Add module alias for rk817-codec
	iwlwifi: Fix memory leaks in error handling path
	KVM: X86: Fix when shadow_root_level=5 && guest root_level<4
	KVM: SEV: initialize regions_list of a mirror VM
	net/mlx5e: Fix missing IPsec statistics on uplink representor
	net/mlx5: Move MODIFY_RQT command to ignore list in internal error state
	net/mlx5: E-switch, Respect BW share of the new group
	net/mlx5: E-Switch, fix single FDB creation on BlueField
	net/mlx5: E-Switch, Check group pointer before reading bw_share value
	KVM: x86/pmu: Fix reserved bits for AMD PerfEvtSeln register
	KVM: VMX: Set failure code in prepare_vmcs02()
	mctp: Don't let RTM_DELROUTE delete local routes
	Revert "drm/i915: Implement Wa_1508744258"
	io-wq: don't retry task_work creation failure on fatal conditions
	x86/sev: Fix SEV-ES INS/OUTS instructions for word, dword, and qword
	x86/entry: Add a fence for kernel entry SWAPGS in paranoid_entry()
	x86/entry: Use the correct fence macro after swapgs in kernel CR3
	x86/xen: Add xenpv_restore_regs_and_return_to_usermode()
	preempt/dynamic: Fix setup_preempt_mode() return value
	sched/uclamp: Fix rq->uclamp_max not set on first enqueue
	KVM: SEV: Return appropriate error codes if SEV-ES scratch setup fails
	KVM: x86/mmu: Rename slot_handle_leaf to slot_handle_level_4k
	KVM: x86/mmu: Remove spurious TLB flushes in TDP MMU zap collapsible path
	net/mlx5e: Rename lro_timeout to packet_merge_timeout
	net/mlx5e: Rename TIR lro functions to TIR packet merge functions
	net/mlx5e: Sync TIR params updates against concurrent create/modify
	serial: 8250_bcm7271: UART errors after resuming from S2
	parisc: Fix KBUILD_IMAGE for self-extracting kernel
	parisc: Fix "make install" on newer debian releases
	parisc: Mark cr16 CPU clocksource unstable on all SMP machines
	vgacon: Propagate console boot parameters before calling `vc_resize'
	xhci: Fix commad ring abort, write all 64 bits to CRCR register.
	USB: NO_LPM quirk Lenovo Powered USB-C Travel Hub
	usb: typec: tcpm: Wait in SNK_DEBOUNCED until disconnect
	usb: cdns3: gadget: fix new urb never complete if ep cancel previous requests
	usb: cdnsp: Fix a NULL pointer dereference in cdnsp_endpoint_init()
	x86/tsc: Add a timer to make sure TSC_adjust is always checked
	x86/tsc: Disable clocksource watchdog for TSC on qualified platorms
	x86/64/mm: Map all kernel memory into trampoline_pgd
	tty: serial: msm_serial: Deactivate RX DMA for polling support
	serial: pl011: Add ACPI SBSA UART match id
	serial: tegra: Change lower tolerance baud rate limit for tegra20 and tegra30
	serial: core: fix transmit-buffer reset and memleak
	serial: 8250_pci: Fix ACCES entries in pci_serial_quirks array
	serial: 8250_pci: rewrite pericom_do_set_divisor()
	serial: 8250: Fix RTS modem control while in rs485 mode
	serial: liteuart: Fix NULL pointer dereference in ->remove()
	serial: liteuart: fix use-after-free and memleak on unbind
	serial: liteuart: fix minor-number leak on probe errors
	ipmi: msghandler: Make symbol 'remove_work_wq' static
	Linux 5.15.7

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I9300a10911f6205d2fb76f18255b017d34d68d1d
2021-12-08 13:46:21 +01:00
Qais Yousef
a246d92dda sched/uclamp: Fix rq->uclamp_max not set on first enqueue
[ Upstream commit 315c4f8848 ]

Commit d81ae8aac8 ("sched/uclamp: Fix initialization of struct
uclamp_rq") introduced a bug where uclamp_max of the rq is not reset to
match the woken up task's uclamp_max when the rq is idle.

The code was relying on rq->uclamp_max initialized to zero, so on first
enqueue

	static inline void uclamp_rq_inc_id(struct rq *rq, struct task_struct *p,
					    enum uclamp_id clamp_id)
	{
		...

		if (uc_se->value > READ_ONCE(uc_rq->value))
			WRITE_ONCE(uc_rq->value, uc_se->value);
	}

was actually resetting it. But since commit d81ae8aac8 changed the
default to 1024, this no longer works. And since rq->uclamp_flags is
also initialized to 0, neither above code path nor uclamp_idle_reset()
update the rq->uclamp_max on first wake up from idle.

This is only visible from first wake up(s) until the first dequeue to
idle after enabling the static key. And it only matters if the
uclamp_max of this task is < 1024 since only then its uclamp_max will be
effectively ignored.

Fix it by properly initializing rq->uclamp_flags = UCLAMP_FLAG_IDLE to
ensure uclamp_idle_reset() is called which then will update the rq
uclamp_max value as expected.

Fixes: d81ae8aac8 ("sched/uclamp: Fix initialization of struct uclamp_rq")
Signed-off-by: Qais Yousef <qais.yousef@arm.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Valentin Schneider <Valentin.Schneider@arm.com>
Tested-by: Dietmar Eggemann <dietmar.eggemann@arm.com>
Link: https://lkml.kernel.org/r/20211202112033.1705279-1-qais.yousef@arm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-12-08 09:04:54 +01:00
Andrew Halaney
fcf7147760 preempt/dynamic: Fix setup_preempt_mode() return value
[ Upstream commit 9ed20bafc8 ]

__setup() callbacks expect 1 for success and 0 for failure. Correct the
usage here to reflect that.

Fixes: 826bfeb37b ("preempt/dynamic: Support dynamic preempt with preempt= boot option")
Reported-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Andrew Halaney <ahalaney@redhat.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20211203233203.133581-1-ahalaney@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-12-08 09:04:54 +01:00
Steven Rostedt (VMware)
f7b4f571d5 tracing/histograms: String compares should not care about signed values
commit 450fec13d9 upstream.

When comparing two strings for the "onmatch" histogram trigger, fields
that are strings use string comparisons, which do not care about being
signed or not.

Do not fail to match two string fields if one is unsigned char array and
the other is a signed char array.

Link: https://lore.kernel.org/all/20211129123043.5cfd687a@gandalf.local.home/

Cc: stable@vgerk.kernel.org
Cc: Tom Zanussi <zanussi@kernel.org>
Cc: Yafang Shao <laoar.shao@gmail.com>
Fixes: b05e89ae7c ("tracing: Accept different type for synthetic event fields")
Reviewed-by: Masami Hiramatsu <mhiramatsu@kernel.org>
Reported-by: Sven Schnelle <svens@linux.ibm.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-08 09:04:44 +01:00
Masami Hiramatsu
16ccd481e3 kprobes: Limit max data_size of the kretprobe instances
commit 6bbfa44116 upstream.

The 'kprobe::data_size' is unsigned, thus it can not be negative.  But if
user sets it enough big number (e.g. (size_t)-8), the result of 'data_size
+ sizeof(struct kretprobe_instance)' becomes smaller than sizeof(struct
kretprobe_instance) or zero. In result, the kretprobe_instance are
allocated without enough memory, and kretprobe accesses outside of
allocated memory.

To avoid this issue, introduce a max limitation of the
kretprobe::data_size. 4KB per instance should be OK.

Link: https://lkml.kernel.org/r/163836995040.432120.10322772773821182925.stgit@devnote2

Cc: stable@vger.kernel.org
Fixes: f47cd9b553 ("kprobes: kretprobe user entry-handler")
Reported-by: zhangyue <zhangyue1@kylinos.cn>
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-08 09:04:41 +01:00
Nikita Yushchenko
859ea5a20e tracing: Don't use out-of-sync va_list in event printing
[ Upstream commit 2ef75e9bd2 ]

If trace_seq becomes full, trace_seq_vprintf() no longer consumes
arguments from va_list, making va_list out of sync with format
processing by trace_check_vprintf().

This causes va_arg() in trace_check_vprintf() to return wrong
positional argument, which results into a WARN_ON_ONCE() hit.

ftrace_stress_test from LTP triggers this situation.

Fix it by explicitly avoiding further use if va_list at the point
when it's consistency can no longer be guaranteed.

Link: https://lkml.kernel.org/r/20211118145516.13219-1-nikita.yushchenko@virtuozzo.com

Signed-off-by: Nikita Yushchenko <nikita.yushchenko@virtuozzo.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-12-08 09:04:41 +01:00
Rick Yiu
7aa82e72a1 ANDROID: sched: Export available_idle_cpu
Previously idle_cpu is exported which is used by vendor module to check
if a cpu is in idle state, but later we think available_idle_cpu is
better than idle_cpu because it also checks vcpu_is_preempted.

Bug: 171740453
Change-Id: I17ccc4925650431f334a9eb2bbc94a138ab36ae0
Signed-off-by: Rick Yiu <rickyiu@google.com>
Signed-off-by: Will McVicker <willmcvicker@google.com>
Signed-off-by: Shaleen Agrawal <quic_shalagra@quicinc.com>
2021-12-06 15:14:21 -08:00
Rick Yiu
f0a317610a ANDROID: sched: Export symbol for vendor RT hook funcion
Export task_may_not_preempt.

Bug: 174030348
Change-Id: I71b50f876306811f008414096043b883dc43b4d5
Signed-off-by: Rick Yiu <rickyiu@google.com>
Signed-off-by: Will McVicker <willmcvicker@google.com>
Signed-off-by: Shaleen Agrawal <quic_shalagra@quicinc.com>
2021-12-06 15:14:20 -08:00
Rick Yiu
468e34ac93 ANDROID: sched: Export symbol for vendor RT hook funcion
Export cpupri_find_fitness.

Bug: 174030348
Change-Id: I47b2af2395bc7a618eb4f4af4469cc2422e25446
Signed-off-by: Rick Yiu <rickyiu@google.com>
Signed-off-by: Will McVicker <willmcvicker@google.com>
Signed-off-by: Shaleen Agrawal <quic_shalagra@quicinc.com>
2021-12-06 15:14:19 -08:00
Satya Durga Srinivasu Prabhala
c44fcf911c ANDROID: sched/fair: fix place_entity() vendor hook
place_entity() vendor hook is meant to tweak vruntime by vendor
modules as needed, but with current form of the hook that is not
possible as vruntime is passed by it's value. Fix it by switching
to pass by reference.

Bug: 175448877
Change-Id: Ibb51592f94da31019fa98a6767d080ec61daafe6
Signed-off-by: Satya Durga Srinivasu Prabhala <satyap@codeaurora.org>
2021-12-03 22:17:58 +00:00
Quentin Perret
3efa38ae9b ANDROID: sched: Make uclamp changes depend on CAP_SYS_NICE
There is currently nothing preventing tasks from changing their per-task
clamp values in anyway that they like. The rationale is probably that
system administrators are still able to limit those clamps thanks to the
cgroup interface. However, this causes pain in a system where both
per-task and per-cgroup clamp values are expected to be under the
control of core system components (as is the case for Android).

To fix this, let's require CAP_SYS_NICE to change per-task clamp values.
There are ongoing discussions upstream about more flexible approaches
than this using the RLIMIT API -- see [1]. But the upstream discussion
has not converged yet, and this is way too late for UAPI changes in
android12-5.10 anyway, so let's apply this change which provides the
behaviour we want without actually impacting UAPIs.

[1] https://lore.kernel.org/lkml/20210623123441.592348-4-qperret@google.com/

Bug: 187186685
Signed-off-by: Quentin Perret <qperret@google.com>
Change-Id: I749312a77306460318ac5374cf243d00b78120dd
2021-12-03 10:13:56 +00:00
Greg Kroah-Hartman
eb2f3d6b8d Merge 5.15.6 into android13-5.15
Changes in 5.15.6
	scsi: sd: Fix sd_do_mode_sense() buffer length handling
	ACPI: Get acpi_device's parent from the parent field
	ACPI: CPPC: Add NULL pointer check to cppc_get_perf()
	USB: serial: pl2303: fix GC type detection
	USB: serial: option: add Telit LE910S1 0x9200 composition
	USB: serial: option: add Fibocom FM101-GL variants
	usb: dwc2: gadget: Fix ISOC flow for elapsed frames
	usb: dwc2: hcd_queue: Fix use of floating point literal
	usb: dwc3: leave default DMA for PCI devices
	usb: dwc3: core: Revise GHWPARAMS9 offset
	usb: dwc3: gadget: Ignore NoStream after End Transfer
	usb: dwc3: gadget: Check for L1/L2/U3 for Start Transfer
	usb: dwc3: gadget: Fix null pointer exception
	net: usb: Correct PHY handling of smsc95xx
	net: nexthop: fix null pointer dereference when IPv6 is not enabled
	usb: chipidea: ci_hdrc_imx: fix potential error pointer dereference in probe
	usb: typec: fusb302: Fix masking of comparator and bc_lvl interrupts
	usb: xhci: tegra: Check padctrl interrupt presence in device tree
	usb: hub: Fix usb enumeration issue due to address0 race
	usb: hub: Fix locking issues with address0_mutex
	binder: fix test regression due to sender_euid change
	ALSA: ctxfi: Fix out-of-range access
	ALSA: hda/realtek: Add quirk for ASRock NUC Box 1100
	ALSA: hda/realtek: Fix LED on HP ProBook 435 G7
	media: cec: copy sequence field for the reply
	Revert "parisc: Fix backtrace to always include init funtion names"
	HID: wacom: Use "Confidence" flag to prevent reporting invalid contacts
	staging/fbtft: Fix backlight
	staging: greybus: Add missing rwsem around snd_ctl_remove() calls
	staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect()
	staging: r8188eu: Use kzalloc() with GFP_ATOMIC in atomic context
	staging: r8188eu: Fix breakage introduced when 5G code was removed
	staging: r8188eu: use GFP_ATOMIC under spinlock
	staging: r8188eu: fix a memory leak in rtw_wx_read32()
	fuse: release pipe buf after last use
	xen: don't continue xenstore initialization in case of errors
	xen: detect uninitialized xenbus in xenbus_init
	io_uring: correct link-list traversal locking
	io_uring: fail cancellation for EXITING tasks
	io_uring: fix link traversal locking
	drm/amdgpu: IH process reset count when restart
	drm/amdgpu/pm: fix powerplay OD interface
	drm/nouveau: recognise GA106
	ksmbd: downgrade addition info error msg to debug in smb2_get_info_sec()
	ksmbd: contain default data stream even if xattr is empty
	ksmbd: fix memleak in get_file_stream_info()
	KVM: PPC: Book3S HV: Prevent POWER7/8 TLB flush flushing SLB
	tracing/uprobe: Fix uprobe_perf_open probes iteration
	tracing: Fix pid filtering when triggers are attached
	mmc: sdhci-esdhc-imx: disable CMDQ support
	mmc: sdhci: Fix ADMA for PAGE_SIZE >= 64KiB
	mdio: aspeed: Fix "Link is Down" issue
	arm64: mm: Fix VM_BUG_ON(mm != &init_mm) for trans_pgd
	cpufreq: intel_pstate: Fix active mode offline/online EPP handling
	powerpc/32: Fix hardlockup on vmap stack overflow
	iomap: Fix inline extent handling in iomap_readpage
	NFSv42: Fix pagecache invalidation after COPY/CLONE
	PCI: aardvark: Deduplicate code in advk_pcie_rd_conf()
	PCI: aardvark: Implement re-issuing config requests on CRS response
	PCI: aardvark: Simplify initialization of rootcap on virtual bridge
	PCI: aardvark: Fix link training
	drm/amd/display: Fix OLED brightness control on eDP
	proc/vmcore: fix clearing user buffer by properly using clear_user()
	ASoC: SOF: Intel: hda: fix hotplug when only codec is suspended
	netfilter: ctnetlink: fix filtering with CTA_TUPLE_REPLY
	netfilter: ctnetlink: do not erase error code with EINVAL
	netfilter: ipvs: Fix reuse connection if RS weight is 0
	netfilter: flowtable: fix IPv6 tunnel addr match
	media: v4l2-core: fix VIDIOC_DQEVENT handling on non-x86
	firmware: arm_scmi: Fix null de-reference on error path
	ARM: dts: BCM5301X: Fix I2C controller interrupt
	ARM: dts: BCM5301X: Add interrupt properties to GPIO node
	ARM: dts: bcm2711: Fix PCIe interrupts
	ASoC: qdsp6: q6routing: Conditionally reset FrontEnd Mixer
	ASoC: qdsp6: q6asm: fix q6asm_dai_prepare error handling
	ASoC: topology: Add missing rwsem around snd_ctl_remove() calls
	ASoC: codecs: wcd938x: fix volatile register range
	ASoC: codecs: wcd934x: return error code correctly from hw_params
	ASoC: codecs: lpass-rx-macro: fix HPHR setting CLSH mask
	net: ieee802154: handle iftypes as u32
	firmware: arm_scmi: Fix base agent discover response
	firmware: arm_scmi: pm: Propagate return value to caller
	ASoC: stm32: i2s: fix 32 bits channel length without mclk
	NFSv42: Don't fail clone() unless the OP_CLONE operation failed
	ARM: socfpga: Fix crash with CONFIG_FORTIRY_SOURCE
	drm/nouveau/acr: fix a couple NULL vs IS_ERR() checks
	scsi: qla2xxx: edif: Fix off by one bug in qla_edif_app_getfcinfo()
	scsi: mpt3sas: Fix kernel panic during drive powercycle test
	scsi: mpt3sas: Fix system going into read-only mode
	scsi: mpt3sas: Fix incorrect system timestamp
	drm/vc4: fix error code in vc4_create_object()
	drm/aspeed: Fix vga_pw sysfs output
	net: marvell: prestera: fix brige port operation
	net: marvell: prestera: fix double free issue on err path
	HID: input: Fix parsing of HID_CP_CONSUMER_CONTROL fields
	HID: input: set usage type to key on keycode remap
	HID: magicmouse: prevent division by 0 on scroll
	iavf: Prevent changing static ITR values if adaptive moderation is on
	iavf: Fix refreshing iavf adapter stats on ethtool request
	iavf: Fix VLAN feature flags after VFR
	x86/pvh: add prototype for xen_pvh_init()
	xen/pvh: add missing prototype to header
	ALSA: intel-dsp-config: add quirk for JSL devices based on ES8336 codec
	mptcp: fix delack timer
	mptcp: use delegate action to schedule 3rd ack retrans
	af_unix: fix regression in read after shutdown
	firmware: smccc: Fix check for ARCH_SOC_ID not implemented
	ipv6: fix typos in __ip6_finish_output()
	nfp: checking parameter process for rx-usecs/tx-usecs is invalid
	net: stmmac: retain PTP clock time during SIOCSHWTSTAMP ioctls
	net: ipv6: add fib6_nh_release_dsts stub
	net: nexthop: release IPv6 per-cpu dsts when replacing a nexthop group
	ice: fix vsi->txq_map sizing
	ice: avoid bpf_prog refcount underflow
	scsi: core: sysfs: Fix setting device state to SDEV_RUNNING
	scsi: scsi_debug: Zero clear zones at reset write pointer
	erofs: fix deadlock when shrink erofs slab
	i2c: virtio: disable timeout handling
	net/smc: Ensure the active closing peer first closes clcsock
	mlxsw: spectrum: Protect driver from buggy firmware
	net: ipa: directly disable ipa-setup-ready interrupt
	net: ipa: separate disabling setup from modem stop
	net: ipa: kill ipa_cmd_pipeline_clear()
	net: marvell: mvpp2: increase MTU limit when XDP enabled
	cpufreq: intel_pstate: Add Ice Lake server to out-of-band IDs
	nvmet-tcp: fix incomplete data digest send
	drm/hyperv: Fix device removal on Gen1 VMs
	arm64: uaccess: avoid blocking within critical sections
	net/ncsi : Add payload to be 32-bit aligned to fix dropped packets
	PM: hibernate: use correct mode for swsusp_close()
	drm/amd/display: Fix DPIA outbox timeout after GPU reset
	drm/amd/display: Set plane update flags for all planes in reset
	tcp_cubic: fix spurious Hystart ACK train detections for not-cwnd-limited flows
	lan743x: fix deadlock in lan743x_phy_link_status_change()
	net: phylink: Force link down and retrigger resolve on interface change
	net: phylink: Force retrigger in case of latched link-fail indicator
	net/smc: Fix NULL pointer dereferencing in smc_vlan_by_tcpsk()
	net/smc: Fix loop in smc_listen
	nvmet: use IOCB_NOWAIT only if the filesystem supports it
	igb: fix netpoll exit with traffic
	MIPS: loongson64: fix FTLB configuration
	MIPS: use 3-level pgtable for 64KB page size on MIPS_VA_BITS_48
	tls: splice_read: fix record type check
	tls: splice_read: fix accessing pre-processed records
	tls: fix replacing proto_ops
	net: stmmac: Disable Tx queues when reconfiguring the interface
	net/sched: sch_ets: don't peek at classes beyond 'nbands'
	ethtool: ioctl: fix potential NULL deref in ethtool_set_coalesce()
	net: vlan: fix underflow for the real_dev refcnt
	net/smc: Don't call clcsock shutdown twice when smc shutdown
	net: hns3: fix VF RSS failed problem after PF enable multi-TCs
	net: hns3: fix incorrect components info of ethtool --reset command
	net: mscc: ocelot: don't downgrade timestamping RX filters in SIOCSHWTSTAMP
	net: mscc: ocelot: correctly report the timestamping RX filters in ethtool
	locking/rwsem: Make handoff bit handling more consistent
	perf: Ignore sigtrap for tracepoints destined for other tasks
	sched/scs: Reset task stack state in bringup_cpu()
	iommu/rockchip: Fix PAGE_DESC_HI_MASKs for RK3568
	iommu/vt-d: Fix unmap_pages support
	f2fs: quota: fix potential deadlock
	f2fs: set SBI_NEED_FSCK flag when inconsistent node block found
	riscv: dts: microchip: fix board compatible
	riscv: dts: microchip: drop duplicated MMC/SDHC node
	cifs: nosharesock should not share socket with future sessions
	ceph: properly handle statfs on multifs setups
	iommu/amd: Clarify AMD IOMMUv2 initialization messages
	vdpa_sim: avoid putting an uninitialized iova_domain
	vhost/vsock: fix incorrect used length reported to the guest
	ksmbd: Fix an error handling path in 'smb2_sess_setup()'
	tracing: Check pid filtering when creating events
	cifs: nosharesock should be set on new server
	io_uring: fix soft lockup when call __io_remove_buffers
	firmware: arm_scmi: Fix type error assignment in voltage protocol
	firmware: arm_scmi: Fix type error in sensor protocol
	docs: accounting: update delay-accounting.rst reference
	blk-mq: cancel blk-mq dispatch work in both blk_cleanup_queue and disk_release()
	block: avoid to quiesce queue in elevator_init_mq
	drm/amdgpu/gfx10: add wraparound gpu counter check for APUs as well
	drm/amdgpu/gfx9: switch to golden tsc registers for renoir+
	Linux 5.15.6

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ibe65221ba285038e25de36ad3659e0ce201408c2
2021-12-02 09:55:34 +01:00
Greg Kroah-Hartman
ae4825a553 Revert "ANDROID: rwsem: Add vendor hook to the rw-semaphore"
This reverts commit df18d99dab.

And also revert portions of 9ad8ff902e ("ANDROID: vendor_hooks: add
waiting information for blocked tasks")

In the 5.15.6 kernel release, the rwsem code was reworked such that the
existing Android trace hooks became incorrect and were causing major
merge issues.  Revert the hooks and if they are still needed, they can
be added back later.

Bug: 161400830
Bug: 162776704
Cc: Sangmoon Kim <sangmoon.kim@samsung.com>
Cc: JianMin Liu <jian-min.liu@mediatek.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ifb3d2ed0bdc73b70718820fbf31e775fedb387c5
2021-12-01 13:17:46 +01:00
Steven Rostedt (VMware)
c9c8c054a0 tracing: Check pid filtering when creating events
commit 6cb206508b upstream.

When pid filtering is activated in an instance, all of the events trace
files for that instance has the PID_FILTER flag set. This determines
whether or not pid filtering needs to be done on the event, otherwise the
event is executed as normal.

If pid filtering is enabled when an event is created (via a dynamic event
or modules), its flag is not updated to reflect the current state, and the
events are not filtered properly.

Cc: stable@vger.kernel.org
Fixes: 3fdaf80f4a ("tracing: Implement event pid filtering")
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-01 09:04:55 +01:00
Mark Rutland
229c555260 sched/scs: Reset task stack state in bringup_cpu()
[ Upstream commit dce1ca0525 ]

To hot unplug a CPU, the idle task on that CPU calls a few layers of C
code before finally leaving the kernel. When KASAN is in use, poisoned
shadow is left around for each of the active stack frames, and when
shadow call stacks are in use. When shadow call stacks (SCS) are in use
the task's saved SCS SP is left pointing at an arbitrary point within
the task's shadow call stack.

When a CPU is offlined than onlined back into the kernel, this stale
state can adversely affect execution. Stale KASAN shadow can alias new
stackframes and result in bogus KASAN warnings. A stale SCS SP is
effectively a memory leak, and prevents a portion of the shadow call
stack being used. Across a number of hotplug cycles the idle task's
entire shadow call stack can become unusable.

We previously fixed the KASAN issue in commit:

  e1b77c9298 ("sched/kasan: remove stale KASAN poison after hotplug")

... by removing any stale KASAN stack poison immediately prior to
onlining a CPU.

Subsequently in commit:

  f1a0a376ca ("sched/core: Initialize the idle task with preemption disabled")

... the refactoring left the KASAN and SCS cleanup in one-time idle
thread initialization code rather than something invoked prior to each
CPU being onlined, breaking both as above.

We fixed SCS (but not KASAN) in commit:

  63acd42c0d ("sched/scs: Reset the shadow stack when idle_task_exit")

... but as this runs in the context of the idle task being offlined it's
potentially fragile.

To fix these consistently and more robustly, reset the SCS SP and KASAN
shadow of a CPU's idle task immediately before we online that CPU in
bringup_cpu(). This ensures the idle task always has a consistent state
when it is running, and removes the need to so so when exiting an idle
task.

Whenever any thread is created, dup_task_struct() will give the task a
stack which is free of KASAN shadow, and initialize the task's SCS SP,
so there's no need to specially initialize either for idle thread within
init_idle(), as this was only necessary to handle hotplug cycles.

I've tested this on arm64 with:

* gcc 11.1.0, defconfig +KASAN_INLINE, KASAN_STACK
* clang 12.0.0, defconfig +KASAN_INLINE, KASAN_STACK, SHADOW_CALL_STACK

... offlining and onlining CPUS with:

| while true; do
|   for C in /sys/devices/system/cpu/cpu*/online; do
|     echo 0 > $C;
|     echo 1 > $C;
|   done
| done

Fixes: f1a0a376ca ("sched/core: Initialize the idle task with preemption disabled")
Reported-by: Qian Cai <quic_qiancai@quicinc.com>
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Valentin Schneider <valentin.schneider@arm.com>
Tested-by: Qian Cai <quic_qiancai@quicinc.com>
Link: https://lore.kernel.org/lkml/20211115113310.35693-1-mark.rutland@arm.com/
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-12-01 09:04:54 +01:00
Marco Elver
5f8c2755f8 perf: Ignore sigtrap for tracepoints destined for other tasks
[ Upstream commit 73743c3b09 ]

syzbot reported that the warning in perf_sigtrap() fires, saying that
the event's task does not match current:

 | WARNING: CPU: 0 PID: 9090 at kernel/events/core.c:6446 perf_pending_event+0x40d/0x4b0 kernel/events/core.c:6513
 | Modules linked in:
 | CPU: 0 PID: 9090 Comm: syz-executor.1 Not tainted 5.15.0-syzkaller #0
 | Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 | RIP: 0010:perf_sigtrap kernel/events/core.c:6446 [inline]
 | RIP: 0010:perf_pending_event_disable kernel/events/core.c:6470 [inline]
 | RIP: 0010:perf_pending_event+0x40d/0x4b0 kernel/events/core.c:6513
 | ...
 | Call Trace:
 |  <IRQ>
 |  irq_work_single+0x106/0x220 kernel/irq_work.c:211
 |  irq_work_run_list+0x6a/0x90 kernel/irq_work.c:242
 |  irq_work_run+0x4f/0xd0 kernel/irq_work.c:251
 |  __sysvec_irq_work+0x95/0x3d0 arch/x86/kernel/irq_work.c:22
 |  sysvec_irq_work+0x8e/0xc0 arch/x86/kernel/irq_work.c:17
 |  </IRQ>
 |  <TASK>
 |  asm_sysvec_irq_work+0x12/0x20 arch/x86/include/asm/idtentry.h:664
 | RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
 | RIP: 0010:_raw_spin_unlock_irqrestore+0x38/0x70 kernel/locking/spinlock.c:194
 | ...
 |  coredump_task_exit kernel/exit.c:371 [inline]
 |  do_exit+0x1865/0x25c0 kernel/exit.c:771
 |  do_group_exit+0xe7/0x290 kernel/exit.c:929
 |  get_signal+0x3b0/0x1ce0 kernel/signal.c:2820
 |  arch_do_signal_or_restart+0x2a9/0x1c40 arch/x86/kernel/signal.c:868
 |  handle_signal_work kernel/entry/common.c:148 [inline]
 |  exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
 |  exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:207
 |  __syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline]
 |  syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:300
 |  do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
 |  entry_SYSCALL_64_after_hwframe+0x44/0xae

On x86 this shouldn't happen, which has arch_irq_work_raise().

The test program sets up a perf event with sigtrap set to fire on the
'sched_wakeup' tracepoint, which fired in ttwu_do_wakeup().

This happened because the 'sched_wakeup' tracepoint also takes a task
argument passed on to perf_tp_event(), which is used to deliver the
event to that other task.

Since we cannot deliver synchronous signals to other tasks, skip an event if
perf_tp_event() is targeted at another task and perf_event_attr::sigtrap is
set, which will avoid ever entering perf_sigtrap() for such events.

Fixes: 97ba62b278 ("perf: Add support for SIGTRAP on perf events")
Reported-by: syzbot+663359e32ce6f1a305ad@syzkaller.appspotmail.com
Signed-off-by: Marco Elver <elver@google.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/YYpoCOBmC/kJWfmI@elver.google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-12-01 09:04:54 +01:00
Waiman Long
76723ed1fb locking/rwsem: Make handoff bit handling more consistent
[ Upstream commit d257cc8cb8 ]

There are some inconsistency in the way that the handoff bit is being
handled in readers and writers that lead to a race condition.

Firstly, when a queue head writer set the handoff bit, it will clear
it when the writer is being killed or interrupted on its way out
without acquiring the lock. That is not the case for a queue head
reader. The handoff bit will simply be inherited by the next waiter.

Secondly, in the out_nolock path of rwsem_down_read_slowpath(), both
the waiter and handoff bits are cleared if the wait queue becomes
empty.  For rwsem_down_write_slowpath(), however, the handoff bit is
not checked and cleared if the wait queue is empty. This can
potentially make the handoff bit set with empty wait queue.

Worse, the situation in rwsem_down_write_slowpath() relies on wstate,
a variable set outside of the critical section containing the ->count
manipulation, this leads to race condition where RWSEM_FLAG_HANDOFF
can be double subtracted, corrupting ->count.

To make the handoff bit handling more consistent and robust, extract
out handoff bit clearing code into the new rwsem_del_waiter() helper
function. Also, completely eradicate wstate; always evaluate
everything inside the same critical section.

The common function will only use atomic_long_andnot() to clear bits
when the wait queue is empty to avoid possible race condition.  If the
first waiter with handoff bit set is killed or interrupted to exit the
slowpath without acquiring the lock, the next waiter will inherit the
handoff bit.

While at it, simplify the trylock for loop in
rwsem_down_write_slowpath() to make it easier to read.

Fixes: 4f23dbc1e6 ("locking/rwsem: Implement lock handoff to prevent lock starvation")
Reported-by: Zhenhua Ma <mazhenhua@xiaomi.com>
Suggested-by: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Waiman Long <longman@redhat.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20211116012912.723980-1-longman@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-12-01 09:04:54 +01:00
Thomas Zeitlhofer
c83f27576c PM: hibernate: use correct mode for swsusp_close()
[ Upstream commit cefcf24b4d ]

Commit 39fbef4b0f ("PM: hibernate: Get block device exclusively in
swsusp_check()") changed the opening mode of the block device to
(FMODE_READ | FMODE_EXCL).

In the corresponding calls to swsusp_close(), the mode is still just
FMODE_READ which triggers the warning in blkdev_flush_mapping() on
resume from hibernate.

So, use the mode (FMODE_READ | FMODE_EXCL) also when closing the
device.

Fixes: 39fbef4b0f ("PM: hibernate: Get block device exclusively in swsusp_check()")
Signed-off-by: Thomas Zeitlhofer <thomas.zeitlhofer+lkml@ze-it.at>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-12-01 09:04:51 +01:00
Steven Rostedt (VMware)
55bc443776 tracing: Fix pid filtering when triggers are attached
commit a55f224ff5 upstream.

If a event is filtered by pid and a trigger that requires processing of
the event to happen is a attached to the event, the discard portion does
not take the pid filtering into account, and the event will then be
recorded when it should not have been.

Cc: stable@vger.kernel.org
Fixes: 3fdaf80f4a ("tracing: Implement event pid filtering")
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-01 09:04:43 +01:00
Jiri Olsa
a3e90db518 tracing/uprobe: Fix uprobe_perf_open probes iteration
commit 1880ed71ce upstream.

Add missing 'tu' variable initialization in the probes loop,
otherwise the head 'tu' is used instead of added probes.

Link: https://lkml.kernel.org/r/20211123142801.182530-1-jolsa@kernel.org

Cc: stable@vger.kernel.org
Fixes: 99c9a923e9 ("tracing/uprobe: Fix double perf_event linking on multiprobe uprobe")
Acked-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-01 09:04:43 +01:00
Greg Kroah-Hartman
966869fb2a Merge 5.15.5 into android13-5.15
Changes in 5.15.5
	arm64: zynqmp: Do not duplicate flash partition label property
	arm64: zynqmp: Fix serial compatible string
	clk: sunxi-ng: Unregister clocks/resets when unbinding
	ARM: dts: sunxi: Fix OPPs node name
	arm64: dts: allwinner: h5: Fix GPU thermal zone node name
	arm64: dts: allwinner: a100: Fix thermal zone node name
	staging: wfx: ensure IRQ is ready before enabling it
	ARM: dts: BCM5301X: Fix nodes names
	ARM: dts: BCM5301X: Fix MDIO mux binding
	ARM: dts: NSP: Fix mpcore, mmc node names
	arm64: dts: broadcom: bcm4908: Move reboot syscon out of bus
	scsi: pm80xx: Fix memory leak during rmmod
	scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()
	ASoC: mediatek: mt8195: Add missing of_node_put()
	arm64: dts: rockchip: Disable CDN DP on Pinebook Pro
	arm64: dts: hisilicon: fix arm,sp805 compatible string
	RDMA/bnxt_re: Check if the vlan is valid before reporting
	bus: ti-sysc: Add quirk handling for reinit on context lost
	bus: ti-sysc: Use context lost quirk for otg
	usb: musb: tusb6010: check return value after calling platform_get_resource()
	usb: typec: tipd: Remove WARN_ON in tps6598x_block_read
	ARM: dts: ux500: Skomer regulator fixes
	staging: rtl8723bs: remove possible deadlock when disconnect (v2)
	staging: rtl8723bs: remove a second possible deadlock
	staging: rtl8723bs: remove a third possible deadlock
	ARM: BCM53016: Specify switch ports for Meraki MR32
	arm64: dts: qcom: msm8998: Fix CPU/L2 idle state latency and residency
	arm64: dts: qcom: ipq6018: Fix qcom,controlled-remotely property
	arm64: dts: qcom: ipq8074: Fix qcom,controlled-remotely property
	arm64: dts: qcom: sdm845: Fix qcom,controlled-remotely property
	arm64: dts: freescale: fix arm,sp805 compatible string
	arm64: dts: ls1012a: Add serial alias for ls1012a-rdb
	RDMA/rxe: Separate HW and SW l/rkeys
	ASoC: SOF: Intel: hda-dai: fix potential locking issue
	scsi: core: Fix scsi_mode_sense() buffer length handling
	ALSA: usb-audio: disable implicit feedback sync for Behringer UFX1204 and UFX1604
	clk: imx: imx6ul: Move csi_sel mux to correct base register
	ASoC: es8316: Use IRQF_NO_AUTOEN when requesting the IRQ
	ASoC: rt5651: Use IRQF_NO_AUTOEN when requesting the IRQ
	ASoC: nau8824: Add DMI quirk mechanism for active-high jack-detect
	scsi: advansys: Fix kernel pointer leak
	scsi: smartpqi: Add controller handshake during kdump
	arm64: dts: imx8mm-kontron: Fix reset delays for ethernet PHY
	ALSA: intel-dsp-config: add quirk for APL/GLK/TGL devices based on ES8336 codec
	ASoC: Intel: soc-acpi: add missing quirk for TGL SDCA single amp
	ASoC: Intel: sof_sdw: add missing quirk for Dell SKU 0A45
	firmware_loader: fix pre-allocated buf built-in firmware use
	HID: multitouch: disable sticky fingers for UPERFECT Y
	ALSA: usb-audio: Add support for the Pioneer DJM 750MK2 Mixer/Soundcard
	ARM: dts: omap: fix gpmc,mux-add-data type
	usb: host: ohci-tmio: check return value after calling platform_get_resource()
	ASoC: rt5682: fix a little pop while playback
	ARM: dts: ls1021a: move thermal-zones node out of soc/
	ARM: dts: ls1021a-tsn: use generic "jedec,spi-nor" compatible for flash
	ALSA: ISA: not for M68K
	iommu/vt-d: Do not falsely log intel_iommu is unsupported kernel option
	tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc
	MIPS: sni: Fix the build
	scsi: scsi_debug: Fix out-of-bound read in resp_readcap16()
	scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs()
	scsi: target: Fix ordered tag handling
	scsi: target: Fix alua_tg_pt_gps_count tracking
	iio: imu: st_lsm6dsx: Avoid potential array overflow in st_lsm6dsx_set_odr()
	RDMA/core: Use kvzalloc when allocating the struct ib_port
	scsi: lpfc: Fix use-after-free in lpfc_unreg_rpi() routine
	scsi: lpfc: Fix link down processing to address NULL pointer dereference
	scsi: lpfc: Allow fabric node recovery if recovery is in progress before devloss
	memory: tegra20-emc: Add runtime dependency on devfreq governor module
	powerpc/5200: dts: fix memory node unit name
	ARM: dts: qcom: fix memory and mdio nodes naming for RB3011
	arm64: dts: qcom: Fix node name of rpm-msg-ram device nodes
	ALSA: gus: fix null pointer dereference on pointer block
	ALSA: usb-audio: fix null pointer dereference on pointer cs_desc
	clk: at91: sama7g5: remove prescaler part of master clock
	iommu/dart: Initialize DART_STREAMS_ENABLE
	powerpc/dcr: Use cmplwi instead of 3-argument cmpli
	powerpc/8xx: Fix Oops with STRICT_KERNEL_RWX without DEBUG_RODATA_TEST
	sh: check return code of request_irq
	maple: fix wrong return value of maple_bus_init().
	f2fs: fix up f2fs_lookup tracepoints
	f2fs: fix to use WHINT_MODE
	f2fs: fix wrong condition to trigger background checkpoint correctly
	sh: fix kconfig unmet dependency warning for FRAME_POINTER
	sh: math-emu: drop unused functions
	sh: define __BIG_ENDIAN for math-emu
	f2fs: compress: disallow disabling compress on non-empty compressed file
	f2fs: fix incorrect return value in f2fs_sanity_check_ckpt()
	clk: ingenic: Fix bugs with divided dividers
	clk/ast2600: Fix soc revision for AHB
	clk: qcom: gcc-msm8996: Drop (again) gcc_aggre1_pnoc_ahb_clk
	KVM: arm64: Fix host stage-2 finalization
	mips: BCM63XX: ensure that CPU_SUPPORTS_32BIT_KERNEL is set
	MIPS: boot/compressed/: add __bswapdi2() to target for ZSTD decompression
	sched/core: Mitigate race cpus_share_cache()/update_top_cache_domain()
	sched/fair: Prevent dead task groups from regaining cfs_rq's
	perf/x86/vlbr: Add c->flags to vlbr event constraints
	blkcg: Remove extra blkcg_bio_issue_init
	tracing/histogram: Do not copy the fixed-size char array field over the field size
	perf bpf: Avoid memory leak from perf_env__insert_btf()
	perf bench futex: Fix memory leak of perf_cpu_map__new()
	perf tests: Remove bash construct from record+zstd_comp_decomp.sh
	drm/nouveau: hdmigv100.c: fix corrupted HDMI Vendor InfoFrame
	bpf: Fix inner map state pruning regression.
	samples/bpf: Fix summary per-sec stats in xdp_sample_user
	samples/bpf: Fix incorrect use of strlen in xdp_redirect_cpu
	selftests: net: switch to socat in the GSO GRE test
	net/ipa: ipa_resource: Fix wrong for loop range
	tcp: Fix uninitialized access in skb frags array for Rx 0cp.
	tracing: Add length protection to histogram string copies
	nl80211: fix radio statistics in survey dump
	mac80211: fix monitor_sdata RCU/locking assertions
	net: ipa: HOLB register sometimes must be written twice
	net: ipa: disable HOLB drop when updating timer
	selftests: gpio: fix gpio compiling error
	net: bnx2x: fix variable dereferenced before check
	bnxt_en: reject indirect blk offload when hw-tc-offload is off
	tipc: only accept encrypted MSG_CRYPTO msgs
	sock: fix /proc/net/sockstat underflow in sk_clone_lock()
	net/smc: Make sure the link_id is unique
	NFSD: Fix exposure in nfsd4_decode_bitmap()
	iavf: Fix return of set the new channel count
	iavf: check for null in iavf_fix_features
	iavf: free q_vectors before queues in iavf_disable_vf
	iavf: don't clear a lock we don't hold
	iavf: Fix failure to exit out from last all-multicast mode
	iavf: prevent accidental free of filter structure
	iavf: validate pointers
	iavf: Fix for the false positive ASQ/ARQ errors while issuing VF reset
	iavf: Fix for setting queues to 0
	iavf: Restore VLAN filters after link down
	bpf: Fix toctou on read-only map's constant scalar tracking
	MIPS: generic/yamon-dt: fix uninitialized variable error
	mips: bcm63xx: add support for clk_get_parent()
	mips: lantiq: add support for clk_get_parent()
	gpio: rockchip: needs GENERIC_IRQ_CHIP to fix build errors
	platform/x86: hp_accel: Fix an error handling path in 'lis3lv02d_probe()'
	platform/x86: think-lmi: Abort probe on analyze failure
	udp: Validate checksum in udp_read_sock()
	btrfs: make 1-bit bit-fields of scrub_page unsigned int
	RDMA/core: Set send and receive CQ before forwarding to the driver
	net/mlx5e: kTLS, Fix crash in RX resync flow
	net/mlx5e: Wait for concurrent flow deletion during neigh/fib events
	net/mlx5: E-Switch, Fix resetting of encap mode when entering switchdev
	net/mlx5e: nullify cq->dbg pointer in mlx5_debug_cq_remove()
	net/mlx5: Update error handler for UCTX and UMEM
	net/mlx5: E-Switch, rebuild lag only when needed
	net/mlx5e: CT, Fix multiple allocations and memleak of mod acts
	net/mlx5: Lag, update tracker when state change event received
	net/mlx5: E-Switch, return error if encap isn't supported
	scsi: ufs: core: Improve SCSI abort handling
	scsi: core: sysfs: Fix hang when device state is set via sysfs
	scsi: ufs: core: Fix task management completion timeout race
	scsi: ufs: core: Fix another task management completion race
	net: mvmdio: fix compilation warning
	net: sched: act_mirred: drop dst for the direction from egress to ingress
	net: dpaa2-eth: fix use-after-free in dpaa2_eth_remove
	net: virtio_net_hdr_to_skb: count transport header in UFO
	i40e: Fix correct max_pkt_size on VF RX queue
	i40e: Fix NULL ptr dereference on VSI filter sync
	i40e: Fix changing previously set num_queue_pairs for PFs
	i40e: Fix ping is lost after configuring ADq on VF
	RDMA/mlx4: Do not fail the registration on port stats
	i40e: Fix warning message and call stack during rmmod i40e driver
	i40e: Fix creation of first queue by omitting it if is not power of two
	i40e: Fix display error code in dmesg
	NFC: reorganize the functions in nci_request
	NFC: reorder the logic in nfc_{un,}register_device
	NFC: add NCI_UNREG flag to eliminate the race
	e100: fix device suspend/resume
	ptp: ocp: Fix a couple NULL vs IS_ERR() checks
	tools build: Fix removal of feature-sync-compare-and-swap feature detection
	riscv: fix building external modules
	KVM: PPC: Book3S HV: Use GLOBAL_TOC for kvmppc_h_set_dabr/xdabr()
	powerpc: clean vdso32 and vdso64 directories
	powerpc/pseries: rename numa_dist_table to form2_distances
	powerpc/pseries: Fix numa FORM2 parsing fallback code
	pinctrl: qcom: sdm845: Enable dual edge errata
	pinctrl: qcom: sm8350: Correct UFS and SDC offsets
	perf/x86/intel/uncore: Fix filter_tid mask for CHA events on Skylake Server
	perf/x86/intel/uncore: Fix IIO event constraints for Skylake Server
	perf/x86/intel/uncore: Fix IIO event constraints for Snowridge
	s390/kexec: fix return code handling
	blk-cgroup: fix missing put device in error path from blkg_conf_pref()
	dmaengine: remove debugfs #ifdef
	tun: fix bonding active backup with arp monitoring
	Revert "mark pstore-blk as broken"
	pstore/blk: Use "%lu" to format unsigned long
	hexagon: export raw I/O routines for modules
	hexagon: clean up timer-regs.h
	tipc: check for null after calling kmemdup
	ipc: WARN if trying to remove ipc object which is absent
	shm: extend forced shm destroy to support objects from several IPC nses
	mm: kmemleak: slob: respect SLAB_NOLEAKTRACE flag
	hugetlb, userfaultfd: fix reservation restore on userfaultfd error
	kmap_local: don't assume kmap PTEs are linear arrays in memory
	mm/damon/dbgfs: use '__GFP_NOWARN' for user-specified size buffer allocation
	mm/damon/dbgfs: fix missed use of damon_dbgfs_lock
	x86/boot: Pull up cmdline preparation and early param parsing
	x86/sgx: Fix free page accounting
	x86/hyperv: Fix NULL deref in set_hv_tscchange_cb() if Hyper-V setup fails
	KVM: x86: Assume a 64-bit hypercall for guests with protected state
	KVM: x86: Fix uninitialized eoi_exit_bitmap usage in vcpu_load_eoi_exitmap()
	KVM: x86/mmu: include EFER.LMA in extended mmu role
	KVM: x86/xen: Fix get_attr of KVM_XEN_ATTR_TYPE_SHARED_INFO
	powerpc/signal32: Fix sigset_t copy
	powerpc/xive: Change IRQ domain to a tree domain
	powerpc/8xx: Fix pinned TLBs with CONFIG_STRICT_KERNEL_RWX
	Revert "drm/i915/tgl/dsi: Gate the ddi clocks after pll mapping"
	Revert "parisc: Reduce sigreturn trampoline to 3 instructions"
	ata: libata: improve ata_read_log_page() error message
	ata: libata: add missing ata_identify_page_supported() calls
	scsi: qla2xxx: Fix mailbox direction flags in qla2xxx_get_adapter_id()
	pinctrl: ralink: include 'ralink_regs.h' in 'pinctrl-mt7620.c'
	s390/setup: avoid reserving memory above identity mapping
	s390/boot: simplify and fix kernel memory layout setup
	s390/vdso: filter out -mstack-guard and -mstack-size
	s390/kexec: fix memory leak of ipl report buffer
	s390/dump: fix copying to user-space of swapped kdump oldmem
	block: Check ADMIN before NICE for IOPRIO_CLASS_RT
	fbdev: Prevent probing generic drivers if a FB is already registered
	KVM: SEV: Disallow COPY_ENC_CONTEXT_FROM if target has created vCPUs
	KVM: nVMX: don't use vcpu->arch.efer when checking host state on nested state load
	drm/cma-helper: Release non-coherent memory with dma_free_noncoherent()
	printk: restore flushing of NMI buffers on remote CPUs after NMI backtraces
	udf: Fix crash after seekdir
	spi: fix use-after-free of the add_lock mutex
	net: stmmac: socfpga: add runtime suspend/resume callback for stratix10 platform
	Drivers: hv: balloon: Use VMBUS_RING_SIZE() wrapper for dm_ring_size
	btrfs: fix memory ordering between normal and ordered work functions
	fs: handle circular mappings correctly
	net: stmmac: Fix signed/unsigned wreckage
	parisc/sticon: fix reverse colors
	cfg80211: call cfg80211_stop_ap when switch from P2P_GO type
	mac80211: fix radiotap header generation
	mac80211: drop check for DONT_REORDER in __ieee80211_select_queue
	drm/amd/display: Update swizzle mode enums
	drm/amd/display: Limit max DSC target bpp for specific monitors
	drm/i915/guc: Fix outstanding G2H accounting
	drm/i915/guc: Don't enable scheduling on a banned context, guc_id invalid, not registered
	drm/i915/guc: Workaround reset G2H is received after schedule done G2H
	drm/i915/guc: Don't drop ce->guc_active.lock when unwinding context
	drm/i915/guc: Unwind context requests in reverse order
	drm/udl: fix control-message timeout
	drm/prime: Fix use after free in mmap with drm_gem_ttm_mmap
	drm/nouveau: Add a dedicated mutex for the clients list
	drm/nouveau: use drm_dev_unplug() during device removal
	drm/nouveau: clean up all clients on device removal
	drm/i915/dp: Ensure sink rate values are always valid
	drm/i915/dp: Ensure max link params are always valid
	drm/i915: Fix type1 DVI DP dual mode adapter heuristic for modern platforms
	drm/amdgpu: fix set scaling mode Full/Full aspect/Center not works on vga and dvi connectors
	drm/amd/pm: avoid duplicate powergate/ungate setting
	signal: Implement force_fatal_sig
	exit/syscall_user_dispatch: Send ordinary signals on failure
	signal/powerpc: On swapcontext failure force SIGSEGV
	signal/s390: Use force_sigsegv in default_trap_handler
	signal/sparc32: Exit with a fatal signal when try_to_clear_window_buffer fails
	signal/sparc32: In setup_rt_frame and setup_fram use force_fatal_sig
	signal/vm86_32: Properly send SIGSEGV when the vm86 state cannot be saved.
	signal/x86: In emulate_vsyscall force a signal instead of calling do_exit
	signal: Replace force_sigsegv(SIGSEGV) with force_fatal_sig(SIGSEGV)
	signal: Don't always set SA_IMMUTABLE for forced signals
	signal: Replace force_fatal_sig with force_exit_sig when in doubt
	hugetlbfs: flush TLBs correctly after huge_pmd_unshare
	RDMA/netlink: Add __maybe_unused to static inline in C file
	bpf: Forbid bpf_ktime_get_coarse_ns and bpf_timer_* in tracing progs
	selinux: fix NULL-pointer dereference when hashtab allocation fails
	ASoC: DAPM: Cover regression by kctl change notification fix
	ASoC: rsnd: fixup DMAEngine API
	usb: max-3421: Use driver data instead of maintaining a list of bound devices
	ice: Fix VF true promiscuous mode
	ice: Delete always true check of PF pointer
	fs: export an inode_update_time helper
	btrfs: update device path inode time instead of bd_inode
	net: add and use skb_unclone_keeptruesize() helper
	x86/Kconfig: Fix an unused variable error in dell-smm-hwmon
	ALSA: hda: hdac_ext_stream: fix potential locking issues
	ALSA: hda: hdac_stream: fix potential locking issue in snd_hdac_stream_assign()
	Linux 5.15.5

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: If86a02ba2cf9af765d9838ada3b9a2cbcea9a08d
2021-11-25 10:40:10 +01:00
Dmitrii Banshchikov
439b99314b bpf: Forbid bpf_ktime_get_coarse_ns and bpf_timer_* in tracing progs
commit 5e0bc3082e upstream.

Use of bpf_ktime_get_coarse_ns() and bpf_timer_* helpers in tracing
progs may result in locking issues.

bpf_ktime_get_coarse_ns() uses ktime_get_coarse_ns() time accessor that
isn't safe for any context:
======================================================
WARNING: possible circular locking dependency detected
5.15.0-syzkaller #0 Not tainted
------------------------------------------------------
syz-executor.4/14877 is trying to acquire lock:
ffffffff8cb30008 (tk_core.seq.seqcount){----}-{0:0}, at: ktime_get_coarse_ts64+0x25/0x110 kernel/time/timekeeping.c:2255

but task is already holding lock:
ffffffff90dbf200 (&obj_hash[i].lock){-.-.}-{2:2}, at: debug_object_deactivate+0x61/0x400 lib/debugobjects.c:735

which lock already depends on the new lock.

the existing dependency chain (in reverse order) is:

-> #1 (&obj_hash[i].lock){-.-.}-{2:2}:
       lock_acquire+0x19f/0x4d0 kernel/locking/lockdep.c:5625
       __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
       _raw_spin_lock_irqsave+0xd1/0x120 kernel/locking/spinlock.c:162
       __debug_object_init+0xd9/0x1860 lib/debugobjects.c:569
       debug_hrtimer_init kernel/time/hrtimer.c:414 [inline]
       debug_init kernel/time/hrtimer.c:468 [inline]
       hrtimer_init+0x20/0x40 kernel/time/hrtimer.c:1592
       ntp_init_cmos_sync kernel/time/ntp.c:676 [inline]
       ntp_init+0xa1/0xad kernel/time/ntp.c:1095
       timekeeping_init+0x512/0x6bf kernel/time/timekeeping.c:1639
       start_kernel+0x267/0x56e init/main.c:1030
       secondary_startup_64_no_verify+0xb1/0xbb

-> #0 (tk_core.seq.seqcount){----}-{0:0}:
       check_prev_add kernel/locking/lockdep.c:3051 [inline]
       check_prevs_add kernel/locking/lockdep.c:3174 [inline]
       validate_chain+0x1dfb/0x8240 kernel/locking/lockdep.c:3789
       __lock_acquire+0x1382/0x2b00 kernel/locking/lockdep.c:5015
       lock_acquire+0x19f/0x4d0 kernel/locking/lockdep.c:5625
       seqcount_lockdep_reader_access+0xfe/0x230 include/linux/seqlock.h:103
       ktime_get_coarse_ts64+0x25/0x110 kernel/time/timekeeping.c:2255
       ktime_get_coarse include/linux/timekeeping.h:120 [inline]
       ktime_get_coarse_ns include/linux/timekeeping.h:126 [inline]
       ____bpf_ktime_get_coarse_ns kernel/bpf/helpers.c:173 [inline]
       bpf_ktime_get_coarse_ns+0x7e/0x130 kernel/bpf/helpers.c:171
       bpf_prog_a99735ebafdda2f1+0x10/0xb50
       bpf_dispatcher_nop_func include/linux/bpf.h:721 [inline]
       __bpf_prog_run include/linux/filter.h:626 [inline]
       bpf_prog_run include/linux/filter.h:633 [inline]
       BPF_PROG_RUN_ARRAY include/linux/bpf.h:1294 [inline]
       trace_call_bpf+0x2cf/0x5d0 kernel/trace/bpf_trace.c:127
       perf_trace_run_bpf_submit+0x7b/0x1d0 kernel/events/core.c:9708
       perf_trace_lock+0x37c/0x440 include/trace/events/lock.h:39
       trace_lock_release+0x128/0x150 include/trace/events/lock.h:58
       lock_release+0x82/0x810 kernel/locking/lockdep.c:5636
       __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:149 [inline]
       _raw_spin_unlock_irqrestore+0x75/0x130 kernel/locking/spinlock.c:194
       debug_hrtimer_deactivate kernel/time/hrtimer.c:425 [inline]
       debug_deactivate kernel/time/hrtimer.c:481 [inline]
       __run_hrtimer kernel/time/hrtimer.c:1653 [inline]
       __hrtimer_run_queues+0x2f9/0xa60 kernel/time/hrtimer.c:1749
       hrtimer_interrupt+0x3b3/0x1040 kernel/time/hrtimer.c:1811
       local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1086 [inline]
       __sysvec_apic_timer_interrupt+0xf9/0x270 arch/x86/kernel/apic/apic.c:1103
       sysvec_apic_timer_interrupt+0x8c/0xb0 arch/x86/kernel/apic/apic.c:1097
       asm_sysvec_apic_timer_interrupt+0x12/0x20
       __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
       _raw_spin_unlock_irqrestore+0xd4/0x130 kernel/locking/spinlock.c:194
       try_to_wake_up+0x702/0xd20 kernel/sched/core.c:4118
       wake_up_process kernel/sched/core.c:4200 [inline]
       wake_up_q+0x9a/0xf0 kernel/sched/core.c:953
       futex_wake+0x50f/0x5b0 kernel/futex/waitwake.c:184
       do_futex+0x367/0x560 kernel/futex/syscalls.c:127
       __do_sys_futex kernel/futex/syscalls.c:199 [inline]
       __se_sys_futex+0x401/0x4b0 kernel/futex/syscalls.c:180
       do_syscall_x64 arch/x86/entry/common.c:50 [inline]
       do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
       entry_SYSCALL_64_after_hwframe+0x44/0xae

There is a possible deadlock with bpf_timer_* set of helpers:
hrtimer_start()
  lock_base();
  trace_hrtimer...()
    perf_event()
      bpf_run()
        bpf_timer_start()
          hrtimer_start()
            lock_base()         <- DEADLOCK

Forbid use of bpf_ktime_get_coarse_ns() and bpf_timer_* helpers in
BPF_PROG_TYPE_KPROBE, BPF_PROG_TYPE_TRACEPOINT, BPF_PROG_TYPE_PERF_EVENT
and BPF_PROG_TYPE_RAW_TRACEPOINT prog types.

Fixes: d055126180 ("bpf: Add bpf_ktime_get_coarse_ns helper")
Fixes: b00628b1c7 ("bpf: Introduce bpf timers.")
Reported-by: syzbot+43fd005b5a1b4d10781e@syzkaller.appspotmail.com
Signed-off-by: Dmitrii Banshchikov <me@ubique.spb.ru>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20211113142227.566439-2-me@ubique.spb.ru
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-11-25 09:49:07 +01:00
Eric W. Biederman
686bf79203 signal: Replace force_fatal_sig with force_exit_sig when in doubt
commit fcb116bc43 upstream.

Recently to prevent issues with SECCOMP_RET_KILL and similar signals
being changed before they are delivered SA_IMMUTABLE was added.

Unfortunately this broke debuggers[1][2] which reasonably expect
to be able to trap synchronous SIGTRAP and SIGSEGV even when
the target process is not configured to handle those signals.

Add force_exit_sig and use it instead of force_fatal_sig where
historically the code has directly called do_exit.  This has the
implementation benefits of going through the signal exit path
(including generating core dumps) without the danger of allowing
userspace to ignore or change these signals.

This avoids userspace regressions as older kernels exited with do_exit
which debuggers also can not intercept.

In the future is should be possible to improve the quality of
implementation of the kernel by changing some of these force_exit_sig
calls to force_fatal_sig.  That can be done where it matters on
a case-by-case basis with careful analysis.

Reported-by: Kyle Huey <me@kylehuey.com>
Reported-by: kernel test robot <oliver.sang@intel.com>
[1] https://lkml.kernel.org/r/CAP045AoMY4xf8aC_4QU_-j7obuEPYgTcnQQP3Yxk=2X90jtpjw@mail.gmail.com
[2] https://lkml.kernel.org/r/20211117150258.GB5403@xsang-OptiPlex-9020
Fixes: 00b06da29c ("signal: Add SA_IMMUTABLE to ensure forced siganls do not get changed")
Fixes: a3616a3c02 ("signal/m68k: Use force_sigsegv(SIGSEGV) in fpsp040_die")
Fixes: 83a1f27ad7 ("signal/powerpc: On swapcontext failure force SIGSEGV")
Fixes: 9bc508cf07 ("signal/s390: Use force_sigsegv in default_trap_handler")
Fixes: 086ec444f8 ("signal/sparc32: In setup_rt_frame and setup_fram use force_fatal_sig")
Fixes: c317d306d5 ("signal/sparc32: Exit with a fatal signal when try_to_clear_window_buffer fails")
Fixes: 695dd0d634 ("signal/x86: In emulate_vsyscall force a signal instead of calling do_exit")
Fixes: 1fbd60df8a ("signal/vm86_32: Properly send SIGSEGV when the vm86 state cannot be saved.")
Fixes: 941edc5bf1 ("exit/syscall_user_dispatch: Send ordinary signals on failure")
Link: https://lkml.kernel.org/r/871r3dqfv8.fsf_-_@email.froward.int.ebiederm.org
Reviewed-by: Kees Cook <keescook@chromium.org>
Tested-by: Kees Cook <keescook@chromium.org>
Tested-by: Kyle Huey <khuey@kylehuey.com>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Thomas Backlund <tmb@iki.fi>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-11-25 09:49:07 +01:00
Eric W. Biederman
7614e046ed signal: Don't always set SA_IMMUTABLE for forced signals
commit e349d945fa upstream.

Recently to prevent issues with SECCOMP_RET_KILL and similar signals
being changed before they are delivered SA_IMMUTABLE was added.

Unfortunately this broke debuggers[1][2] which reasonably expect to be
able to trap synchronous SIGTRAP and SIGSEGV even when the target
process is not configured to handle those signals.

Update force_sig_to_task to support both the case when we can allow
the debugger to intercept and possibly ignore the signal and the case
when it is not safe to let userspace know about the signal until the
process has exited.

Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Reported-by: Kyle Huey <me@kylehuey.com>
Reported-by: kernel test robot <oliver.sang@intel.com>
Cc: stable@vger.kernel.org
[1] https://lkml.kernel.org/r/CAP045AoMY4xf8aC_4QU_-j7obuEPYgTcnQQP3Yxk=2X90jtpjw@mail.gmail.com
[2] https://lkml.kernel.org/r/20211117150258.GB5403@xsang-OptiPlex-9020
Fixes: 00b06da29c ("signal: Add SA_IMMUTABLE to ensure forced siganls do not get changed")
Link: https://lkml.kernel.org/r/877dd5qfw5.fsf_-_@email.froward.int.ebiederm.org
Reviewed-by: Kees Cook <keescook@chromium.org>
Tested-by: Kees Cook <keescook@chromium.org>
Tested-by: Kyle Huey <khuey@kylehuey.com>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Thomas Backlund <tmb@iki.fi>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-11-25 09:49:06 +01:00
Eric W. Biederman
fe67da49f7 exit/syscall_user_dispatch: Send ordinary signals on failure
commit 941edc5bf1 upstream.

Use force_fatal_sig instead of calling do_exit directly.  This ensures
the ordinary signal handling path gets invoked, core dumps as
appropriate get created, and for multi-threaded processes all of the
threads are terminated not just a single thread.

When asked Gabriel Krisman Bertazi <krisman@collabora.com> said [1]:
> ebiederm@xmission.com (Eric W. Biederman) asked:
>
> > Why does do_syscal_user_dispatch call do_exit(SIGSEGV) and
> > do_exit(SIGSYS) instead of force_sig(SIGSEGV) and force_sig(SIGSYS)?
> >
> > Looking at the code these cases are not expected to happen, so I would
> > be surprised if userspace depends on any particular behaviour on the
> > failure path so I think we can change this.
>
> Hi Eric,
>
> There is not really a good reason, and the use case that originated the
> feature doesn't rely on it.
>
> Unless I'm missing yet another problem and others correct me, I think
> it makes sense to change it as you described.
>
> > Is using do_exit in this way something you copied from seccomp?
>
> I'm not sure, its been a while, but I think it might be just that.  The
> first prototype of SUD was implemented as a seccomp mode.

If at some point it becomes interesting we could relax
"force_fatal_sig(SIGSEGV)" to instead say
"force_sig_fault(SIGSEGV, SEGV_MAPERR, sd->selector)".

I avoid doing that in this patch to avoid making it possible
to catch currently uncatchable signals.

Cc: Gabriel Krisman Bertazi <krisman@collabora.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Andy Lutomirski <luto@kernel.org>
[1] https://lkml.kernel.org/r/87mtr6gdvi.fsf@collabora.com
Link: https://lkml.kernel.org/r/20211020174406.17889-14-ebiederm@xmission.com
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Cc: Thomas Backlund <tmb@iki.fi>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-11-25 09:49:06 +01:00
Eric W. Biederman
110ae07d22 signal: Implement force_fatal_sig
commit 26d5badbcc upstream.

Add a simple helper force_fatal_sig that causes a signal to be
delivered to a process as if the signal handler was set to SIG_DFL.

Reimplement force_sigsegv based upon this new helper.  This fixes
force_sigsegv so that when it forces the default signal handler
to be used the code now forces the signal to be unblocked as well.

Reusing the tested logic in force_sig_info_to_task that was built for
force_sig_seccomp this makes the implementation trivial.

This is interesting both because it makes force_sigsegv simpler and
because there are a couple of buggy places in the kernel that call
do_exit(SIGILL) or do_exit(SIGSYS) because there is no straight
forward way today for those places to simply force the exit of a
process with the chosen signal.  Creating force_fatal_sig allows
those places to be implemented with normal signal exits.

Link: https://lkml.kernel.org/r/20211020174406.17889-13-ebiederm@xmission.com
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Cc: Thomas Backlund <tmb@iki.fi>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-11-25 09:49:06 +01:00
Nicholas Piggin
c3b0ab956d printk: restore flushing of NMI buffers on remote CPUs after NMI backtraces
commit 5d5e4522a7 upstream.

printk from NMI context relies on irq work being raised on the local CPU
to print to console. This can be a problem if the NMI was raised by a
lockup detector to print lockup stack and regs, because the CPU may not
enable irqs (because it is locked up).

Introduce printk_trigger_flush() that can be called another CPU to try
to get those messages to the console, call that where printk_safe_flush
was previously called.

Fixes: 93d102f094 ("printk: remove safe buffers")
Cc: stable@vger.kernel.org # 5.15
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Petr Mladek <pmladek@suse.com>
Reviewed-by: John Ogness <john.ogness@linutronix.de>
Signed-off-by: Petr Mladek <pmladek@suse.com>
Link: https://lore.kernel.org/r/20211107045116.1754411-1-npiggin@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-11-25 09:48:45 +01:00
Daniel Borkmann
a5d1d35222 bpf: Fix toctou on read-only map's constant scalar tracking
[ Upstream commit 353050be4c ]

Commit a23740ec43 ("bpf: Track contents of read-only maps as scalars") is
checking whether maps are read-only both from BPF program side and user space
side, and then, given their content is constant, reading out their data via
map->ops->map_direct_value_addr() which is then subsequently used as known
scalar value for the register, that is, it is marked as __mark_reg_known()
with the read value at verification time. Before a23740ec43, the register
content was marked as an unknown scalar so the verifier could not make any
assumptions about the map content.

The current implementation however is prone to a TOCTOU race, meaning, the
value read as known scalar for the register is not guaranteed to be exactly
the same at a later point when the program is executed, and as such, the
prior made assumptions of the verifier with regards to the program will be
invalid which can cause issues such as OOB access, etc.

While the BPF_F_RDONLY_PROG map flag is always fixed and required to be
specified at map creation time, the map->frozen property is initially set to
false for the map given the map value needs to be populated, e.g. for global
data sections. Once complete, the loader "freezes" the map from user space
such that no subsequent updates/deletes are possible anymore. For the rest
of the lifetime of the map, this freeze one-time trigger cannot be undone
anymore after a successful BPF_MAP_FREEZE cmd return. Meaning, any new BPF_*
cmd calls which would update/delete map entries will be rejected with -EPERM
since map_get_sys_perms() removes the FMODE_CAN_WRITE permission. This also
means that pending update/delete map entries must still complete before this
guarantee is given. This corner case is not an issue for loaders since they
create and prepare such program private map in successive steps.

However, a malicious user is able to trigger this TOCTOU race in two different
ways: i) via userfaultfd, and ii) via batched updates. For i) userfaultfd is
used to expand the competition interval, so that map_update_elem() can modify
the contents of the map after map_freeze() and bpf_prog_load() were executed.
This works, because userfaultfd halts the parallel thread which triggered a
map_update_elem() at the time where we copy key/value from the user buffer and
this already passed the FMODE_CAN_WRITE capability test given at that time the
map was not "frozen". Then, the main thread performs the map_freeze() and
bpf_prog_load(), and once that had completed successfully, the other thread
is woken up to complete the pending map_update_elem() which then changes the
map content. For ii) the idea of the batched update is similar, meaning, when
there are a large number of updates to be processed, it can increase the
competition interval between the two. It is therefore possible in practice to
modify the contents of the map after executing map_freeze() and bpf_prog_load().

One way to fix both i) and ii) at the same time is to expand the use of the
map's map->writecnt. The latter was introduced in fc9702273e ("bpf: Add mmap()
support for BPF_MAP_TYPE_ARRAY") and further refined in 1f6cb19be2 ("bpf:
Prevent re-mmap()'ing BPF map as writable for initially r/o mapping") with
the rationale to make a writable mmap()'ing of a map mutually exclusive with
read-only freezing. The counter indicates writable mmap() mappings and then
prevents/fails the freeze operation. Its semantics can be expanded beyond
just mmap() by generally indicating ongoing write phases. This would essentially
span any parallel regular and batched flavor of update/delete operation and
then also have map_freeze() fail with -EBUSY. For the check_mem_access() in
the verifier we expand upon the bpf_map_is_rdonly() check ensuring that all
last pending writes have completed via bpf_map_write_active() test. Once the
map->frozen is set and bpf_map_write_active() indicates a map->writecnt of 0
only then we are really guaranteed to use the map's data as known constants.
For map->frozen being set and pending writes in process of still being completed
we fall back to marking that register as unknown scalar so we don't end up
making assumptions about it. With this, both TOCTOU reproducers from i) and
ii) are fixed.

Note that the map->writecnt has been converted into a atomic64 in the fix in
order to avoid a double freeze_mutex mutex_{un,}lock() pair when updating
map->writecnt in the various map update/delete BPF_* cmd flavors. Spanning
the freeze_mutex over entire map update/delete operations in syscall side
would not be possible due to then causing everything to be serialized.
Similarly, something like synchronize_rcu() after setting map->frozen to wait
for update/deletes to complete is not possible either since it would also
have to span the user copy which can sleep. On the libbpf side, this won't
break d66562fba1 ("libbpf: Add BPF object skeleton support") as the
anonymous mmap()-ed "map initialization image" is remapped as a BPF map-backed
mmap()-ed memory where for .rodata it's non-writable.

Fixes: a23740ec43 ("bpf: Track contents of read-only maps as scalars")
Reported-by: w1tcher.bupt@gmail.com
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-11-25 09:48:36 +01:00
Steven Rostedt (VMware)
85f4a563c9 tracing: Add length protection to histogram string copies
[ Upstream commit 938aa33f14 ]

The string copies to the histogram storage has a max size of 256 bytes
(defined by MAX_FILTER_STR_VAL). Only the string size of the event field
needs to be copied to the event storage, but no more than what is in the
event storage. Although nothing should be bigger than 256 bytes, there's
no protection against overwriting of the storage if one day there is.

Copy no more than the destination size, and enforce it.

Also had to turn MAX_FILTER_STR_VAL into an unsigned int, to keep the
min() comparison of the string sizes of comparable types.

Link: https://lore.kernel.org/all/CAHk-=wjREUihCGrtRBwfX47y_KrLCGjiq3t6QtoNJpmVrAEb1w@mail.gmail.com/
Link: https://lkml.kernel.org/r/20211114132834.183429a4@rorschach.local.home

Cc: Ingo Molnar <mingo@kernel.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Tom Zanussi <zanussi@kernel.org>
Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
Reviewed-by: Masami Hiramatsu <mhiramat@kernel.org>
Fixes: 63f84ae6b8 ("tracing/histogram: Do not copy the fixed-size char array field over the field size")
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-11-25 09:48:34 +01:00
Alexei Starovoitov
bd45420066 bpf: Fix inner map state pruning regression.
[ Upstream commit 34d11a440c ]

Introduction of map_uid made two lookups from outer map to be distinct.
That distinction is only necessary when inner map has an embedded timer.
Otherwise it will make the verifier state pruning to be conservative
which will cause complex programs to hit 1M insn_processed limit.
Tighten map_uid logic to apply to inner maps with timers only.

Fixes: 3e8ce29850 ("bpf: Prevent pointer mismatch in bpf_timer_init.")
Reported-by: Lorenz Bauer <lmb@cloudflare.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Tested-by: Lorenz Bauer <lmb@cloudflare.com>
Link: https://lore.kernel.org/bpf/CACAyw99hVEJFoiBH_ZGyy=+oO-jyydoz6v1DeKPKs2HVsUH28w@mail.gmail.com
Link: https://lore.kernel.org/bpf/20211110172556.20754-1-alexei.starovoitov@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-11-25 09:48:33 +01:00
Masami Hiramatsu
05e13b4a53 tracing/histogram: Do not copy the fixed-size char array field over the field size
[ Upstream commit 63f84ae6b8 ]

Do not copy the fixed-size char array field of the events over
the field size. The histogram treats char array as a string and
there are 2 types of char array in the event, fixed-size and
dynamic string. The dynamic string (__data_loc) field must be
null terminated, but the fixed-size char array field may not
be null terminated (not a string, but just a data).
In that case, histogram can copy the data after the field.
This uses the original field size for fixed-size char array
field to restrict the histogram not to access over the original
field size.

Link: https://lkml.kernel.org/r/163673292822.195747.3696966210526410250.stgit@devnote2

Fixes: 02205a6752 (tracing: Add support for 'field variables')
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-11-25 09:48:33 +01:00
Mathias Krause
512e21c150 sched/fair: Prevent dead task groups from regaining cfs_rq's
[ Upstream commit b027789e5e ]

Kevin is reporting crashes which point to a use-after-free of a cfs_rq
in update_blocked_averages(). Initial debugging revealed that we've
live cfs_rq's (on_list=1) in an about to be kfree()'d task group in
free_fair_sched_group(). However, it was unclear how that can happen.

His kernel config happened to lead to a layout of struct sched_entity
that put the 'my_q' member directly into the middle of the object
which makes it incidentally overlap with SLUB's freelist pointer.
That, in combination with SLAB_FREELIST_HARDENED's freelist pointer
mangling, leads to a reliable access violation in form of a #GP which
made the UAF fail fast.

Michal seems to have run into the same issue[1]. He already correctly
diagnosed that commit a7b359fc6a ("sched/fair: Correctly insert
cfs_rq's to list on unthrottle") is causing the preconditions for the
UAF to happen by re-adding cfs_rq's also to task groups that have no
more running tasks, i.e. also to dead ones. His analysis, however,
misses the real root cause and it cannot be seen from the crash
backtrace only, as the real offender is tg_unthrottle_up() getting
called via sched_cfs_period_timer() via the timer interrupt at an
inconvenient time.

When unregister_fair_sched_group() unlinks all cfs_rq's from the dying
task group, it doesn't protect itself from getting interrupted. If the
timer interrupt triggers while we iterate over all CPUs or after
unregister_fair_sched_group() has finished but prior to unlinking the
task group, sched_cfs_period_timer() will execute and walk the list of
task groups, trying to unthrottle cfs_rq's, i.e. re-add them to the
dying task group. These will later -- in free_fair_sched_group() -- be
kfree()'ed while still being linked, leading to the fireworks Kevin
and Michal are seeing.

To fix this race, ensure the dying task group gets unlinked first.
However, simply switching the order of unregistering and unlinking the
task group isn't sufficient, as concurrent RCU walkers might still see
it, as can be seen below:

    CPU1:                                      CPU2:
      :                                        timer IRQ:
      :                                          do_sched_cfs_period_timer():
      :                                            :
      :                                            distribute_cfs_runtime():
      :                                              rcu_read_lock();
      :                                              :
      :                                              unthrottle_cfs_rq():
    sched_offline_group():                             :
      :                                                walk_tg_tree_from(…,tg_unthrottle_up,…):
      list_del_rcu(&tg->list);                           :
 (1)  :                                                  list_for_each_entry_rcu(child, &parent->children, siblings)
      :                                                    :
 (2)  list_del_rcu(&tg->siblings);                         :
      :                                                    tg_unthrottle_up():
      unregister_fair_sched_group():                         struct cfs_rq *cfs_rq = tg->cfs_rq[cpu_of(rq)];
        :                                                    :
        list_del_leaf_cfs_rq(tg->cfs_rq[cpu]);               :
        :                                                    :
        :                                                    if (!cfs_rq_is_decayed(cfs_rq) || cfs_rq->nr_running)
 (3)    :                                                        list_add_leaf_cfs_rq(cfs_rq);
      :                                                      :
      :                                                    :
      :                                                  :
      :                                                :
      :                                              :
 (4)  :                                              rcu_read_unlock();

CPU 2 walks the task group list in parallel to sched_offline_group(),
specifically, it'll read the soon to be unlinked task group entry at
(1). Unlinking it on CPU 1 at (2) therefore won't prevent CPU 2 from
still passing it on to tg_unthrottle_up(). CPU 1 now tries to unlink
all cfs_rq's via list_del_leaf_cfs_rq() in
unregister_fair_sched_group().  Meanwhile CPU 2 will re-add some of
these at (3), which is the cause of the UAF later on.

To prevent this additional race from happening, we need to wait until
walk_tg_tree_from() has finished traversing the task groups, i.e.
after the RCU read critical section ends in (4). Afterwards we're safe
to call unregister_fair_sched_group(), as each new walk won't see the
dying task group any more.

On top of that, we need to wait yet another RCU grace period after
unregister_fair_sched_group() to ensure print_cfs_stats(), which might
run concurrently, always sees valid objects, i.e. not already free'd
ones.

This patch survives Michal's reproducer[2] for 8h+ now, which used to
trigger within minutes before.

  [1] https://lore.kernel.org/lkml/20211011172236.11223-1-mkoutny@suse.com/
  [2] https://lore.kernel.org/lkml/20211102160228.GA57072@blackbody.suse.cz/

Fixes: a7b359fc6a ("sched/fair: Correctly insert cfs_rq's to list on unthrottle")
[peterz: shuffle code around a bit]
Reported-by: Kevin Tanguy <kevin.tanguy@corp.ovh.com>
Signed-off-by: Mathias Krause <minipli@grsecurity.net>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-11-25 09:48:32 +01:00
Vincent Donnefort
e4511d8dc2 sched/core: Mitigate race cpus_share_cache()/update_top_cache_domain()
[ Upstream commit 42dc938a59 ]

Nothing protects the access to the per_cpu variable sd_llc_id. When testing
the same CPU (i.e. this_cpu == that_cpu), a race condition exists with
update_top_cache_domain(). One scenario being:

              CPU1                            CPU2
  ==================================================================

  per_cpu(sd_llc_id, CPUX) => 0
                                    partition_sched_domains_locked()
      				      detach_destroy_domains()
  cpus_share_cache(CPUX, CPUX)          update_top_cache_domain(CPUX)
    per_cpu(sd_llc_id, CPUX) => 0
                                          per_cpu(sd_llc_id, CPUX) = CPUX
    per_cpu(sd_llc_id, CPUX) => CPUX
    return false

ttwu_queue_cond() wouldn't catch smp_processor_id() == cpu and the result
is a warning triggered from ttwu_queue_wakelist().

Avoid a such race in cpus_share_cache() by always returning true when
this_cpu == that_cpu.

Fixes: 518cd62341 ("sched: Only queue remote wakeups when crossing cache boundaries")
Reported-by: Jing-Ting Wu <jing-ting.wu@mediatek.com>
Signed-off-by: Vincent Donnefort <vincent.donnefort@arm.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Valentin Schneider <valentin.schneider@arm.com>
Reviewed-by: Vincent Guittot <vincent.guittot@linaro.org>
Link: https://lore.kernel.org/r/20211104175120.857087-1-vincent.donnefort@arm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-11-25 09:48:32 +01:00
Mukesh Ojha
0820d8e399 ANDROID: logbuf: Add new logbuf vendor hook to support pr_cont()
Add new logbuf vendor hook android_vh_logbuf_pr_cont()
to capture pr_cont logs.

Bug: 199236943
Change-Id: I76b310fc9caac71b344b6cc25ea36f7f81cb7148
Signed-off-by: Mukesh Ojha <mojha@codeaurora.org>
(cherry picked from commit 01f2392e13)
Signed-off-by: Yogesh Lal <ylal@codeaurora.org>
2021-11-23 09:43:15 +00:00
Mukesh Ojha
976f1840da ANDROID: logbuf: vendor hook for logbuf dump on oops
Initial kernel bootup logs get overwritten after running
for a long time, and there can be debugging scenario where
we need initial ~100s bootup logs for debugging.
'android_vh_initial_logbuf' vendor hook is helping in
achieving this purpose.

Bug: 199236943
Change-Id: I706824aeb566c09ecaf4b5900973d6cee8a2f35b
Signed-off-by: Mukesh Ojha <mojha@codeaurora.org>
(cherry picked from commit 34fde61f72)
Signed-off-by: Yogesh Lal <ylal@codeaurora.org>
2021-11-23 09:43:07 +00:00
Prasad Sodagudi
b2df67a932 ANDROID: android: Create debug_symbols driver
Introduce new API to expose symbols useful for debugging the GKI kernel.
Symbols exported from this driver would be difficult to maintain via the
traditional EXPORT_SYMBOL_GPL.

Bug: 199236943
Change-Id: I1cadb409289ca9ce36b0084efc9ac46f6bec6741
Signed-off-by: Elliot Berman <eberman@codeaurora.org>
Signed-off-by: Prasad Sodagudi <psodagud@codeaurora.org>
Signed-off-by: Yogesh Lal <ylal@codeaurora.org>
2021-11-23 11:59:24 +05:30
Greg Kroah-Hartman
8a39139a10 Merge 5.15.4 into android13-5.15
Changes in 5.15.4
	string: uninline memcpy_and_pad
	Revert "drm: fb_helper: improve CONFIG_FB dependency"
	Revert "drm: fb_helper: fix CONFIG_FB dependency"
	KVM: Fix steal time asm constraints
	btrfs: introduce btrfs_is_data_reloc_root
	btrfs: zoned: add a dedicated data relocation block group
	btrfs: zoned: only allow one process to add pages to a relocation inode
	btrfs: zoned: use regular writes for relocation
	btrfs: check for relocation inodes on zoned btrfs in should_nocow
	btrfs: zoned: allow preallocation for relocation inodes
	fortify: Explicitly disable Clang support
	block: Add a helper to validate the block size
	loop: Use blk_validate_block_size() to validate block size
	Bluetooth: btusb: Add support for TP-Link UB500 Adapter
	parisc/entry: fix trace test in syscall exit path
	PCI/MSI: Deal with devices lying about their MSI mask capability
	PCI: Add MSI masking quirk for Nvidia ION AHCI
	perf/core: Avoid put_page() when GUP fails
	thermal: Fix NULL pointer dereferences in of_thermal_ functions
	Revert "ACPI: scan: Release PM resources blocked by unused objects"
	Linux 5.15.4

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ifadab2a01217d1f57c0c7d598b5ef3fb75a1bb65
2021-11-21 14:30:53 +01:00
Greg Thelen
bd378dcd50 perf/core: Avoid put_page() when GUP fails
commit 4716023a8f upstream.

PEBS PERF_SAMPLE_PHYS_ADDR events use perf_virt_to_phys() to convert PMU
sampled virtual addresses to physical using get_user_page_fast_only()
and page_to_phys().

Some get_user_page_fast_only() error cases return false, indicating no
page reference, but still initialize the output page pointer with an
unreferenced page. In these error cases perf_virt_to_phys() calls
put_page(). This causes page reference count underflow, which can lead
to unintentional page sharing.

Fix perf_virt_to_phys() to only put_page() if get_user_page_fast_only()
returns a referenced page.

Fixes: fc7ce9c74c ("perf/core, x86: Add PERF_SAMPLE_PHYS_ADDR")
Signed-off-by: Greg Thelen <gthelen@google.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20211111021814.757086-1-gthelen@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-11-21 13:44:14 +01:00
Kalesh Singh
90342f7225 UPSTREAM: tracing/histogram: Fix UAF in destroy_hist_field()
Calling destroy_hist_field() on an expression will recursively free
any operands associated with the expression. If during expression
parsing the operands of the expression are already set when an error
is encountered, there is no need to explicity free the operands. Doing
so will result in destroy_hist_field() being called twice for the
operands and lead to a use-after-free (UAF) error.

If the operands are associated with the expression, only call
destroy_hist_field() on the expression since the operands will be
recursively freed.

Link: https://lore.kernel.org/all/CAHk-=wgcrEbFgkw9720H3tW-AhHOoEKhYwZinYJw4FpzSaJ6_Q@mail.gmail.com/
Link: https://lkml.kernel.org/r/20211118011542.1420131-1-kaleshsingh@google.com

Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Kalesh Singh <kaleshsingh@google.com>
Fixes: 8b5d46fd7a ("tracing/histogram: Optimize division by constants")
Reported-by: kernel test robot <oliver.sang@intel.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
(cherry picked from commit f86b0aaad7)

Bug: 146055070
Bug: 145972256
Signed-off-by: Kalesh Singh <kaleshsingh@google.com>
Change-Id: I007b17b31e56a1571f91c97993a7fd1fe1140f43
2021-11-19 14:09:34 -08:00
Greg Kroah-Hartman
36de88a855 Merge 5.15.3 into android13-5.15
Changes in 5.15.3
	xhci: Fix USB 3.1 enumeration issues by increasing roothub power-on-good delay
	usb: xhci: Enable runtime-pm by default on AMD Yellow Carp platform
	Input: iforce - fix control-message timeout
	Input: elantench - fix misreporting trackpoint coordinates
	Input: i8042 - Add quirk for Fujitsu Lifebook T725
	libata: fix read log timeout value
	ocfs2: fix data corruption on truncate
	scsi: scsi_ioctl: Validate command size
	scsi: core: Avoid leaving shost->last_reset with stale value if EH does not run
	scsi: core: Remove command size deduction from scsi_setup_scsi_cmnd()
	scsi: lpfc: Don't release final kref on Fport node while ABTS outstanding
	scsi: lpfc: Fix FCP I/O flush functionality for TMF routines
	scsi: qla2xxx: Fix crash in NVMe abort path
	scsi: qla2xxx: Fix kernel crash when accessing port_speed sysfs file
	scsi: qla2xxx: Fix use after free in eh_abort path
	ce/gf100: fix incorrect CE0 address calculation on some GPUs
	char: xillybus: fix msg_ep UAF in xillyusb_probe()
	mmc: mtk-sd: Add wait dma stop done flow
	mmc: dw_mmc: Dont wait for DRTO on Write RSP error
	exfat: fix incorrect loading of i_blocks for large files
	io-wq: remove worker to owner tw dependency
	parisc: Fix set_fixmap() on PA1.x CPUs
	parisc: Fix ptrace check on syscall return
	tpm: Check for integer overflow in tpm2_map_response_body()
	firmware/psci: fix application of sizeof to pointer
	crypto: s5p-sss - Add error handling in s5p_aes_probe()
	media: rkvdec: Do not override sizeimage for output format
	media: ite-cir: IR receiver stop working after receive overflow
	media: rkvdec: Support dynamic resolution changes
	media: ir-kbd-i2c: improve responsiveness of hauppauge zilog receivers
	media: v4l2-ioctl: Fix check_ext_ctrls
	ALSA: hda/realtek: Fix mic mute LED for the HP Spectre x360 14
	ALSA: hda/realtek: Add a quirk for HP OMEN 15 mute LED
	ALSA: hda/realtek: Add quirk for Clevo PC70HS
	ALSA: hda/realtek: Headset fixup for Clevo NH77HJQ
	ALSA: hda/realtek: Add a quirk for Acer Spin SP513-54N
	ALSA: hda/realtek: Add quirk for ASUS UX550VE
	ALSA: hda/realtek: Add quirk for HP EliteBook 840 G7 mute LED
	ALSA: ua101: fix division by zero at probe
	ALSA: 6fire: fix control and bulk message timeouts
	ALSA: line6: fix control and interrupt message timeouts
	ALSA: mixer: oss: Fix racy access to slots
	ALSA: mixer: fix deadlock in snd_mixer_oss_set_volume
	ALSA: usb-audio: Line6 HX-Stomp XL USB_ID for 48k-fixed quirk
	ALSA: usb-audio: Add registration quirk for JBL Quantum 400
	ALSA: hda: Free card instance properly at probe errors
	ALSA: synth: missing check for possible NULL after the call to kstrdup
	ALSA: pci: rme: Fix unaligned buffer addresses
	ALSA: PCM: Fix NULL dereference at mmap checks
	ALSA: timer: Fix use-after-free problem
	ALSA: timer: Unconditionally unlink slave instances, too
	Revert "ext4: enforce buffer head state assertion in ext4_da_map_blocks"
	ext4: fix lazy initialization next schedule time computation in more granular unit
	ext4: ensure enough credits in ext4_ext_shift_path_extents
	ext4: refresh the ext4_ext_path struct after dropping i_data_sem.
	fuse: fix page stealing
	x86/sme: Use #define USE_EARLY_PGTABLE_L5 in mem_encrypt_identity.c
	x86/cpu: Fix migration safety with X86_BUG_NULL_SEL
	x86/irq: Ensure PI wakeup handler is unregistered before module unload
	x86/iopl: Fake iopl(3) CLI/STI usage
	btrfs: clear MISSING device status bit in btrfs_close_one_device
	btrfs: fix lost error handling when replaying directory deletes
	btrfs: call btrfs_check_rw_degradable only if there is a missing device
	KVM: x86/mmu: Drop a redundant, broken remote TLB flush
	KVM: VMX: Unregister posted interrupt wakeup handler on hardware unsetup
	KVM: PPC: Tick accounting should defer vtime accounting 'til after IRQ handling
	ia64: kprobes: Fix to pass correct trampoline address to the handler
	selinux: fix race condition when computing ocontext SIDs
	ipmi:watchdog: Set panic count to proper value on a panic
	md/raid1: only allocate write behind bio for WriteMostly device
	hwmon: (pmbus/lm25066) Add offset coefficients
	regulator: s5m8767: do not use reset value as DVS voltage if GPIO DVS is disabled
	regulator: dt-bindings: samsung,s5m8767: correct s5m8767,pmic-buck-default-dvs-idx property
	EDAC/sb_edac: Fix top-of-high-memory value for Broadwell/Haswell
	mwifiex: fix division by zero in fw download path
	ath6kl: fix division by zero in send path
	ath6kl: fix control-message timeout
	ath10k: fix control-message timeout
	ath10k: fix division by zero in send path
	PCI: Mark Atheros QCA6174 to avoid bus reset
	rtl8187: fix control-message timeouts
	evm: mark evm_fixmode as __ro_after_init
	ifb: Depend on netfilter alternatively to tc
	platform/surface: aggregator_registry: Add support for Surface Laptop Studio
	mt76: mt7615: fix skb use-after-free on mac reset
	HID: surface-hid: Use correct event registry for managing HID events
	HID: surface-hid: Allow driver matching for target ID 1 devices
	wcn36xx: Fix HT40 capability for 2Ghz band
	wcn36xx: Fix tx_status mechanism
	wcn36xx: Fix (QoS) null data frame bitrate/modulation
	PM: sleep: Do not let "syscore" devices runtime-suspend during system transitions
	mwifiex: Read a PCI register after writing the TX ring write pointer
	mwifiex: Try waking the firmware until we get an interrupt
	libata: fix checking of DMA state
	dma-buf: fix and rework dma_buf_poll v7
	wcn36xx: handle connection loss indication
	rsi: fix occasional initialisation failure with BT coex
	rsi: fix key enabled check causing unwanted encryption for vap_id > 0
	rsi: fix rate mask set leading to P2P failure
	rsi: Fix module dev_oper_mode parameter description
	perf/x86/intel/uncore: Support extra IMC channel on Ice Lake server
	perf/x86/intel/uncore: Fix invalid unit check
	perf/x86/intel/uncore: Fix Intel ICX IIO event constraints
	RDMA/qedr: Fix NULL deref for query_qp on the GSI QP
	ASoC: tegra: Set default card name for Trimslice
	ASoC: tegra: Restore AC97 support
	signal: Remove the bogus sigkill_pending in ptrace_stop
	memory: renesas-rpc-if: Correct QSPI data transfer in Manual mode
	signal/mips: Update (_save|_restore)_fp_context to fail with -EFAULT
	signal: Add SA_IMMUTABLE to ensure forced siganls do not get changed
	soc: samsung: exynos-pmu: Fix compilation when nothing selects CONFIG_MFD_CORE
	soc: fsl: dpio: replace smp_processor_id with raw_smp_processor_id
	soc: fsl: dpio: use the combined functions to protect critical zone
	mtd: rawnand: socrates: Keep the driver compatible with on-die ECC engines
	mctp: handle the struct sockaddr_mctp padding fields
	power: supply: max17042_battery: Prevent int underflow in set_soc_threshold
	power: supply: max17042_battery: use VFSOC for capacity when no rsns
	iio: core: fix double free in iio_device_unregister_sysfs()
	iio: core: check return value when calling dev_set_name()
	KVM: arm64: Extract ESR_ELx.EC only
	KVM: x86: Fix recording of guest steal time / preempted status
	KVM: x86: Add helper to consolidate core logic of SET_CPUID{2} flows
	KVM: nVMX: Query current VMCS when determining if MSR bitmaps are in use
	KVM: nVMX: Handle dynamic MSR intercept toggling
	can: peak_usb: always ask for BERR reporting for PCAN-USB devices
	can: mcp251xfd: mcp251xfd_irq(): add missing can_rx_offload_threaded_irq_finish() in case of bus off
	can: j1939: j1939_tp_cmd_recv(): ignore abort message in the BAM transport
	can: j1939: j1939_can_recv(): ignore messages with invalid source address
	can: j1939: j1939_tp_cmd_recv(): check the dst address of TP.CM_BAM
	iio: adc: tsc2046: fix scan interval warning
	powerpc/85xx: Fix oops when mpc85xx_smp_guts_ids node cannot be found
	io_uring: honour zeroes as io-wq worker limits
	ring-buffer: Protect ring_buffer_reset() from reentrancy
	serial: core: Fix initializing and restoring termios speed
	ifb: fix building without CONFIG_NET_CLS_ACT
	xen/balloon: add late_initcall_sync() for initial ballooning done
	ovl: fix use after free in struct ovl_aio_req
	ovl: fix filattr copy-up failure
	PCI: pci-bridge-emul: Fix emulation of W1C bits
	PCI: cadence: Add cdns_plat_pcie_probe() missing return
	cxl/pci: Fix NULL vs ERR_PTR confusion
	PCI: aardvark: Do not clear status bits of masked interrupts
	PCI: aardvark: Fix checking for link up via LTSSM state
	PCI: aardvark: Do not unmask unused interrupts
	PCI: aardvark: Fix reporting Data Link Layer Link Active
	PCI: aardvark: Fix configuring Reference clock
	PCI: aardvark: Fix return value of MSI domain .alloc() method
	PCI: aardvark: Read all 16-bits from PCIE_MSI_PAYLOAD_REG
	PCI: aardvark: Fix support for bus mastering and PCI_COMMAND on emulated bridge
	PCI: aardvark: Fix support for PCI_BRIDGE_CTL_BUS_RESET on emulated bridge
	PCI: aardvark: Set PCI Bridge Class Code to PCI Bridge
	PCI: aardvark: Fix support for PCI_ROM_ADDRESS1 on emulated bridge
	quota: check block number when reading the block in quota file
	quota: correct error number in free_dqentry()
	cifs: To match file servers, make sure the server hostname matches
	cifs: set a minimum of 120s for next dns resolution
	mfd: simple-mfd-i2c: Select MFD_CORE to fix build error
	pinctrl: core: fix possible memory leak in pinctrl_enable()
	coresight: cti: Correct the parameter for pm_runtime_put
	coresight: trbe: Fix incorrect access of the sink specific data
	coresight: trbe: Defer the probe on offline CPUs
	iio: buffer: check return value of kstrdup_const()
	iio: buffer: Fix memory leak in iio_buffers_alloc_sysfs_and_mask()
	iio: buffer: Fix memory leak in __iio_buffer_alloc_sysfs_and_mask()
	iio: buffer: Fix memory leak in iio_buffer_register_legacy_sysfs_groups()
	drivers: iio: dac: ad5766: Fix dt property name
	iio: dac: ad5446: Fix ad5622_write() return value
	iio: ad5770r: make devicetree property reading consistent
	Documentation:devicetree:bindings:iio:dac: Fix val
	USB: serial: keyspan: fix memleak on probe errors
	serial: 8250: fix racy uartclk update
	ksmbd: set unique value to volume serial field in FS_VOLUME_INFORMATION
	io-wq: serialize hash clear with wakeup
	serial: 8250: Fix reporting real baudrate value in c_ospeed field
	Revert "serial: 8250: Fix reporting real baudrate value in c_ospeed field"
	most: fix control-message timeouts
	USB: iowarrior: fix control-message timeouts
	USB: chipidea: fix interrupt deadlock
	power: supply: max17042_battery: Clear status bits in interrupt handler
	component: do not leave master devres group open after bind
	dma-buf: WARN on dmabuf release with pending attachments
	drm: panel-orientation-quirks: Update the Lenovo Ideapad D330 quirk (v2)
	drm: panel-orientation-quirks: Add quirk for KD Kurio Smart C15200 2-in-1
	drm: panel-orientation-quirks: Add quirk for the Samsung Galaxy Book 10.6
	Bluetooth: sco: Fix lock_sock() blockage by memcpy_from_msg()
	Bluetooth: fix use-after-free error in lock_sock_nested()
	Bluetooth: call sock_hold earlier in sco_conn_del
	drm/panel-orientation-quirks: add Valve Steam Deck
	rcutorture: Avoid problematic critical section nesting on PREEMPT_RT
	platform/x86: wmi: do not fail if disabling fails
	drm/amdgpu: move iommu_resume before ip init/resume
	MIPS: lantiq: dma: add small delay after reset
	MIPS: lantiq: dma: reset correct number of channel
	locking/lockdep: Avoid RCU-induced noinstr fail
	net: sched: update default qdisc visibility after Tx queue cnt changes
	ACPI: resources: Add DMI-based legacy IRQ override quirk
	rcu-tasks: Move RTGS_WAIT_CBS to beginning of rcu_tasks_kthread() loop
	smackfs: Fix use-after-free in netlbl_catmap_walk()
	ath11k: Align bss_chan_info structure with firmware
	crypto: aesni - check walk.nbytes instead of err
	x86/mm/64: Improve stack overflow warnings
	x86: Increase exception stack sizes
	mwifiex: Run SET_BSS_MODE when changing from P2P to STATION vif-type
	mwifiex: Properly initialize private structure on interface type changes
	spi: Check we have a spi_device_id for each DT compatible
	fscrypt: allow 256-bit master keys with AES-256-XTS
	drm/amdgpu: Fix MMIO access page fault
	drm/amd/display: Fix null pointer dereference for encoders
	selftests: net: fib_nexthops: Wait before checking reported idle time
	ath11k: Avoid reg rules update during firmware recovery
	ath11k: add handler for scan event WMI_SCAN_EVENT_DEQUEUED
	ath11k: Change DMA_FROM_DEVICE to DMA_TO_DEVICE when map reinjected packets
	ath10k: high latency fixes for beacon buffer
	octeontx2-pf: Enable promisc/allmulti match MCAM entries.
	media: mt9p031: Fix corrupted frame after restarting stream
	media: netup_unidvb: handle interrupt properly according to the firmware
	media: atomisp: Fix error handling in probe
	media: stm32: Potential NULL pointer dereference in dcmi_irq_thread()
	media: uvcvideo: Set capability in s_param
	media: uvcvideo: Return -EIO for control errors
	media: uvcvideo: Set unique vdev name based in type
	media: vidtv: Fix memory leak in remove
	media: s5p-mfc: fix possible null-pointer dereference in s5p_mfc_probe()
	media: s5p-mfc: Add checking to s5p_mfc_probe().
	media: videobuf2: rework vb2_mem_ops API
	media: imx: set a media_device bus_info string
	media: rcar-vin: Use user provided buffers when starting
	media: mceusb: return without resubmitting URB in case of -EPROTO error.
	ia64: don't do IA64_CMPXCHG_DEBUG without CONFIG_PRINTK
	rtw88: fix RX clock gate setting while fifo dump
	brcmfmac: Add DMI nvram filename quirk for Cyberbook T116 tablet
	media: rcar-csi2: Add checking to rcsi2_start_receiver()
	ipmi: Disable some operations during a panic
	fs/proc/uptime.c: Fix idle time reporting in /proc/uptime
	kselftests/sched: cleanup the child processes
	ACPICA: Avoid evaluating methods too early during system resume
	cpufreq: Make policy min/max hard requirements
	ice: Move devlink port to PF/VF struct
	media: imx-jpeg: Fix possible null pointer dereference
	media: ipu3-imgu: imgu_fmt: Handle properly try
	media: ipu3-imgu: VIDIOC_QUERYCAP: Fix bus_info
	media: usb: dvd-usb: fix uninit-value bug in dibusb_read_eeprom_byte()
	net-sysfs: try not to restart the syscall if it will fail eventually
	drm/amdkfd: rm BO resv on validation to avoid deadlock
	tracefs: Have tracefs directories not set OTH permission bits by default
	tracing: Disable "other" permission bits in the tracefs files
	ath: dfs_pattern_detector: Fix possible null-pointer dereference in channel_detector_create()
	KVM: arm64: Propagate errors from __pkvm_prot_finalize hypercall
	mmc: moxart: Fix reference count leaks in moxart_probe
	iov_iter: Fix iov_iter_get_pages{,_alloc} page fault return value
	ACPI: battery: Accept charges over the design capacity as full
	ACPI: scan: Release PM resources blocked by unused objects
	drm/amd/display: fix null pointer deref when plugging in display
	drm/amdkfd: fix resume error when iommu disabled in Picasso
	net: phy: micrel: make *-skew-ps check more lenient
	leaking_addresses: Always print a trailing newline
	thermal/core: Fix null pointer dereference in thermal_release()
	drm/msm: prevent NULL dereference in msm_gpu_crashstate_capture()
	thermal/drivers/tsens: Add timeout to get_temp_tsens_valid
	block: bump max plugged deferred size from 16 to 32
	floppy: fix calling platform_device_unregister() on invalid drives
	md: update superblock after changing rdev flags in state_store
	memstick: r592: Fix a UAF bug when removing the driver
	locking/rwsem: Disable preemption for spinning region
	lib/xz: Avoid overlapping memcpy() with invalid input with in-place decompression
	lib/xz: Validate the value before assigning it to an enum variable
	workqueue: make sysfs of unbound kworker cpumask more clever
	tracing/cfi: Fix cmp_entries_* functions signature mismatch
	mt76: mt7915: fix an off-by-one bound check
	mwl8k: Fix use-after-free in mwl8k_fw_state_machine()
	iwlwifi: change all JnP to NO-160 configuration
	block: remove inaccurate requeue check
	media: allegro: ignore interrupt if mailbox is not initialized
	drm/amdgpu/pm: properly handle sclk for profiling modes on vangogh
	nvmet: fix use-after-free when a port is removed
	nvmet-rdma: fix use-after-free when a port is removed
	nvmet-tcp: fix use-after-free when a port is removed
	nvme: drop scan_lock and always kick requeue list when removing namespaces
	samples/bpf: Fix application of sizeof to pointer
	arm64: vdso32: suppress error message for 'make mrproper'
	PM: hibernate: Get block device exclusively in swsusp_check()
	selftests: kvm: fix mismatched fclose() after popen()
	selftests/bpf: Fix perf_buffer test on system with offline cpus
	iwlwifi: mvm: disable RX-diversity in powersave
	smackfs: use __GFP_NOFAIL for smk_cipso_doi()
	ARM: clang: Do not rely on lr register for stacktrace
	gre/sit: Don't generate link-local addr if addr_gen_mode is IN6_ADDR_GEN_MODE_NONE
	can: bittiming: can_fixup_bittiming(): change type of tseg1 and alltseg to unsigned int
	gfs2: Cancel remote delete work asynchronously
	gfs2: Fix glock_hash_walk bugs
	ARM: 9136/1: ARMv7-M uses BE-8, not BE-32
	tools/latency-collector: Use correct size when writing queue_full_warning
	vrf: run conntrack only in context of lower/physdev for locally generated packets
	net: annotate data-race in neigh_output()
	ACPI: AC: Quirk GK45 to skip reading _PSR
	ACPI: resources: Add one more Medion model in IRQ override quirk
	btrfs: reflink: initialize return value to 0 in btrfs_extent_same()
	btrfs: do not take the uuid_mutex in btrfs_rm_device
	spi: bcm-qspi: Fix missing clk_disable_unprepare() on error in bcm_qspi_probe()
	wcn36xx: Correct band/freq reporting on RX
	wcn36xx: Fix packet drop on resume
	Revert "wcn36xx: Enable firmware link monitoring"
	ftrace: do CPU checking after preemption disabled
	inet: remove races in inet{6}_getname()
	x86/hyperv: Protect set_hv_tscchange_cb() against getting preempted
	drm/amd/display: dcn20_resource_construct reduce scope of FPU enabled
	selftests/core: fix conflicting types compile error for close_range()
	perf/x86/intel: Fix ICL/SPR INST_RETIRED.PREC_DIST encodings
	parisc: fix warning in flush_tlb_all
	task_stack: Fix end_of_stack() for architectures with upwards-growing stack
	erofs: don't trigger WARN() when decompression fails
	parisc/unwind: fix unwinder when CONFIG_64BIT is enabled
	parisc/kgdb: add kgdb_roundup() to make kgdb work with idle polling
	netfilter: conntrack: set on IPS_ASSURED if flows enters internal stream state
	selftests/bpf: Fix strobemeta selftest regression
	fbdev/efifb: Release PCI device's runtime PM ref during FB destroy
	drm/bridge: anx7625: Propagate errors from sp_tx_rst_aux()
	perf/x86/intel/uncore: Fix Intel SPR CHA event constraints
	perf/x86/intel/uncore: Fix Intel SPR IIO event constraints
	perf/x86/intel/uncore: Fix Intel SPR M2PCIE event constraints
	perf/x86/intel/uncore: Fix Intel SPR M3UPI event constraints
	drm/bridge: it66121: Initialize {device,vendor}_ids
	drm/bridge: it66121: Wait for next bridge to be probed
	Bluetooth: fix init and cleanup of sco_conn.timeout_work
	libbpf: Don't crash on object files with no symbol tables
	Bluetooth: hci_uart: fix GPF in h5_recv
	rcu: Fix existing exp request check in sync_sched_exp_online_cleanup()
	MIPS: lantiq: dma: fix burst length for DEU
	x86/xen: Mark cpu_bringup_and_idle() as dead_end_function
	objtool: Handle __sanitize_cov*() tail calls
	net/mlx5: Publish and unpublish all devlink parameters at once
	drm/v3d: fix wait for TMU write combiner flush
	crypto: sm4 - Do not change section of ck and sbox
	virtio-gpu: fix possible memory allocation failure
	lockdep: Let lock_is_held_type() detect recursive read as read
	net: net_namespace: Fix undefined member in key_remove_domain()
	net: phylink: don't call netif_carrier_off() with NULL netdev
	drm: bridge: it66121: Fix return value it66121_probe
	spi: Fixed division by zero warning
	cgroup: Make rebind_subsystems() disable v2 controllers all at once
	wcn36xx: Fix Antenna Diversity Switching
	wilc1000: fix possible memory leak in cfg_scan_result()
	Bluetooth: btmtkuart: fix a memleak in mtk_hci_wmt_sync
	drm/amdgpu: Fix crash on device remove/driver unload
	drm/amd/display: Pass display_pipe_params_st as const in DML
	drm/amdgpu: move amdgpu_virt_release_full_gpu to fini_early stage
	crypto: caam - disable pkc for non-E SoCs
	crypto: qat - power up 4xxx device
	Bluetooth: hci_h5: Fix (runtime)suspend issues on RTL8723BS HCIs
	bnxt_en: Check devlink allocation and registration status
	qed: Don't ignore devlink allocation failures
	rxrpc: Fix _usecs_to_jiffies() by using usecs_to_jiffies()
	mptcp: do not shrink snd_nxt when recovering
	fortify: Fix dropped strcpy() compile-time write overflow check
	mac80211: twt: don't use potentially unaligned pointer
	cfg80211: always free wiphy specific regdomain
	net/mlx5: Accept devlink user input after driver initialization complete
	net: dsa: rtl8366rb: Fix off-by-one bug
	net: dsa: rtl8366: Fix a bug in deleting VLANs
	bpf/tests: Fix error in tail call limit tests
	ath11k: fix some sleeping in atomic bugs
	ath11k: Avoid race during regd updates
	ath11k: fix packet drops due to incorrect 6 GHz freq value in rx status
	ath11k: Fix memory leak in ath11k_qmi_driver_event_work
	gve: DQO: avoid unused variable warnings
	ath10k: Fix missing frame timestamp for beacon/probe-resp
	ath10k: sdio: Add missing BH locking around napi_schdule()
	drm/ttm: stop calling tt_swapin in vm_access
	arm64: mm: update max_pfn after memory hotplug
	drm/amdgpu: fix warning for overflow check
	libbpf: Fix skel_internal.h to set errno on loader retval < 0
	media: em28xx: add missing em28xx_close_extension
	media: meson-ge2d: Fix rotation parameter changes detection in 'ge2d_s_ctrl()'
	media: cxd2880-spi: Fix a null pointer dereference on error handling path
	media: ttusb-dec: avoid release of non-acquired mutex
	media: dvb-usb: fix ununit-value in az6027_rc_query
	media: imx258: Fix getting clock frequency
	media: v4l2-ioctl: S_CTRL output the right value
	media: mtk-vcodec: venc: fix return value when start_streaming fails
	media: TDA1997x: handle short reads of hdmi info frame.
	media: mtk-vpu: Fix a resource leak in the error handling path of 'mtk_vpu_probe()'
	media: imx-jpeg: Fix the error handling path of 'mxc_jpeg_probe()'
	media: i2c: ths8200 needs V4L2_ASYNC
	media: sun6i-csi: Allow the video device to be open multiple times
	media: radio-wl1273: Avoid card name truncation
	media: si470x: Avoid card name truncation
	media: tm6000: Avoid card name truncation
	media: cx23885: Fix snd_card_free call on null card pointer
	media: atmel: fix the ispck initialization
	scs: Release kasan vmalloc poison in scs_free process
	kprobes: Do not use local variable when creating debugfs file
	crypto: ecc - fix CRYPTO_DEFAULT_RNG dependency
	drm: fb_helper: fix CONFIG_FB dependency
	cpuidle: Fix kobject memory leaks in error paths
	media: em28xx: Don't use ops->suspend if it is NULL
	ath10k: Don't always treat modem stop events as crashes
	ath9k: Fix potential interrupt storm on queue reset
	PM: EM: Fix inefficient states detection
	x86/insn: Use get_unaligned() instead of memcpy()
	EDAC/amd64: Handle three rank interleaving mode
	rcu: Always inline rcu_dynticks_task*_{enter,exit}()
	rcu: Fix rcu_dynticks_curr_cpu_in_eqs() vs noinstr
	netfilter: nft_dynset: relax superfluous check on set updates
	media: venus: fix vpp frequency calculation for decoder
	media: dvb-frontends: mn88443x: Handle errors of clk_prepare_enable()
	crypto: ccree - avoid out-of-range warnings from clang
	crypto: qat - detect PFVF collision after ACK
	crypto: qat - disregard spurious PFVF interrupts
	hwrng: mtk - Force runtime pm ops for sleep ops
	ima: fix deadlock when traversing "ima_default_rules".
	b43legacy: fix a lower bounds test
	b43: fix a lower bounds test
	gve: Recover from queue stall due to missed IRQ
	gve: Track RX buffer allocation failures
	mmc: sdhci-omap: Fix NULL pointer exception if regulator is not configured
	mmc: sdhci-omap: Fix context restore
	memstick: avoid out-of-range warning
	memstick: jmb38x_ms: use appropriate free function in jmb38x_ms_alloc_host()
	net, neigh: Fix NTF_EXT_LEARNED in combination with NTF_USE
	hwmon: Fix possible memleak in __hwmon_device_register()
	hwmon: (pmbus/lm25066) Let compiler determine outer dimension of lm25066_coeff
	ath10k: fix max antenna gain unit
	kernel/sched: Fix sched_fork() access an invalid sched_task_group
	net: fealnx: fix build for UML
	net: intel: igc_ptp: fix build for UML
	net: tulip: winbond-840: fix build for UML
	tcp: switch orphan_count to bare per-cpu counters
	crypto: octeontx2 - set assoclen in aead_do_fallback()
	thermal/core: fix a UAF bug in __thermal_cooling_device_register()
	drm/msm/dsi: do not enable irq handler before powering up the host
	drm/msm: Fix potential Oops in a6xx_gmu_rpmh_init()
	drm/msm: potential error pointer dereference in init()
	drm/msm: unlock on error in get_sched_entity()
	drm/msm: fix potential NULL dereference in cleanup
	drm/msm: uninitialized variable in msm_gem_import()
	net: stream: don't purge sk_error_queue in sk_stream_kill_queues()
	thermal/drivers/qcom/lmh: make QCOM_LMH depends on QCOM_SCM
	mailbox: Remove WARN_ON for async_cb.cb in cmdq_exec_done
	media: ivtv: fix build for UML
	media: ir_toy: assignment to be16 should be of correct type
	mmc: mxs-mmc: disable regulator on error and in the remove function
	io-wq: Remove duplicate code in io_workqueue_create()
	block: ataflop: fix breakage introduced at blk-mq refactoring
	blk-wbt: prevent NULL pointer dereference in wb_timer_fn
	platform/x86: thinkpad_acpi: Fix bitwise vs. logical warning
	mailbox: mtk-cmdq: Validate alias_id on probe
	mailbox: mtk-cmdq: Fix local clock ID usage
	ACPI: PM: Turn off unused wakeup power resources
	ACPI: PM: Fix sharing of wakeup power resources
	drm/amdkfd: Fix an inappropriate error handling in allloc memory of gpu
	mt76: mt7921: fix endianness in mt7921_mcu_tx_done_event
	mt76: mt7915: fix endianness warning in mt7915_mac_add_txs_skb
	mt76: mt7921: fix endianness warning in mt7921_update_txs
	mt76: mt7615: fix endianness warning in mt7615_mac_write_txwi
	mt76: mt7915: fix info leak in mt7915_mcu_set_pre_cal()
	mt76: connac: fix mt76_connac_gtk_rekey_tlv usage
	mt76: fix build error implicit enumeration conversion
	mt76: mt7921: fix survey-dump reporting
	mt76: mt76x02: fix endianness warnings in mt76x02_mac.c
	mt76: mt7921: Fix out of order process by invalid event pkt
	mt76: mt7915: fix potential overflow of eeprom page index
	mt76: mt7915: fix bit fields for HT rate idx
	mt76: mt7921: fix dma hang in rmmod
	mt76: connac: fix GTK rekey offload failure on WPA mixed mode
	mt76: overwrite default reg_ops if necessary
	mt76: mt7921: report HE MU radiotap
	mt76: mt7921: fix firmware usage of RA info using legacy rates
	mt76: mt7921: fix kernel warning from cfg80211_calculate_bitrate
	mt76: mt7921: always wake device if necessary in debugfs
	mt76: mt7915: fix hwmon temp sensor mem use-after-free
	mt76: mt7615: fix hwmon temp sensor mem use-after-free
	mt76: mt7915: fix possible infinite loop release semaphore
	mt76: mt7921: fix retrying release semaphore without end
	mt76: mt7615: fix monitor mode tear down crash
	mt76: connac: fix possible NULL pointer dereference in mt76_connac_get_phy_mode_v2
	mt76: mt7915: fix sta_rec_wtbl tag len
	mt76: mt7915: fix muar_idx in mt7915_mcu_alloc_sta_req()
	rsi: stop thread firstly in rsi_91x_init() error handling
	mwifiex: Send DELBA requests according to spec
	iwlwifi: mvm: reset PM state on unsuccessful resume
	iwlwifi: pnvm: don't kmemdup() more than we have
	iwlwifi: pnvm: read EFI data only if long enough
	net: enetc: unmap DMA in enetc_send_cmd()
	phy: micrel: ksz8041nl: do not use power down mode
	nbd: Fix use-after-free in pid_show
	nvme-rdma: fix error code in nvme_rdma_setup_ctrl
	PM: hibernate: fix sparse warnings
	clocksource/drivers/timer-ti-dm: Select TIMER_OF
	x86/sev: Fix stack type check in vc_switch_off_ist()
	drm/msm: Fix potential NULL dereference in DPU SSPP
	drm/msm/dsi: fix wrong type in msm_dsi_host
	crypto: tcrypt - fix skcipher multi-buffer tests for 1420B blocks
	smackfs: use netlbl_cfg_cipsov4_del() for deleting cipso_v4_doi
	KVM: selftests: Fix nested SVM tests when built with clang
	libbpf: Fix memory leak in btf__dedup()
	bpftool: Avoid leaking the JSON writer prepared for program metadata
	libbpf: Fix overflow in BTF sanity checks
	libbpf: Fix BTF header parsing checks
	mt76: mt7615: mt7622: fix ibss and meshpoint
	s390/gmap: validate VMA in __gmap_zap()
	s390/gmap: don't unconditionally call pte_unmap_unlock() in __gmap_zap()
	s390/mm: validate VMA in PGSTE manipulation functions
	s390/mm: fix VMA and page table handling code in storage key handling functions
	s390/uv: fully validate the VMA before calling follow_page()
	KVM: s390: pv: avoid double free of sida page
	KVM: s390: pv: avoid stalls for kvm_s390_pv_init_vm
	irq: mips: avoid nested irq_enter()
	net: dsa: avoid refcount warnings when ->port_{fdb,mdb}_del returns error
	ARM: 9142/1: kasan: work around LPAE build warning
	ath10k: fix module load regression with iram-recovery feature
	block: ataflop: more blk-mq refactoring fixes
	blk-cgroup: synchronize blkg creation against policy deactivation
	libbpf: Fix off-by-one bug in bpf_core_apply_relo()
	tpm: fix Atmel TPM crash caused by too frequent queries
	tpm_tis_spi: Add missing SPI ID
	libbpf: Fix endianness detection in BPF_CORE_READ_BITFIELD_PROBED()
	tcp: don't free a FIN sk_buff in tcp_remove_empty_skb()
	tracing: Fix missing trace_boot_init_histograms kstrdup NULL checks
	cpufreq: intel_pstate: Fix cpu->pstate.turbo_freq initialization
	spi: spi-rpc-if: Check return value of rpcif_sw_init()
	samples/kretprobes: Fix return value if register_kretprobe() failed
	KVM: s390: Fix handle_sske page fault handling
	libertas_tf: Fix possible memory leak in probe and disconnect
	libertas: Fix possible memory leak in probe and disconnect
	wcn36xx: add proper DMA memory barriers in rx path
	wcn36xx: Fix discarded frames due to wrong sequence number
	bpf: Avoid races in __bpf_prog_run() for 32bit arches
	bpf: Fixes possible race in update_prog_stats() for 32bit arches
	wcn36xx: Channel list update before hardware scan
	drm/amdgpu: fix a potential memory leak in amdgpu_device_fini_sw()
	drm/amdgpu/gmc6: fix DMA mask from 44 to 40 bits
	selftests/bpf: Fix fd cleanup in sk_lookup test
	selftests/bpf: Fix memory leak in test_ima
	sctp: allow IP fragmentation when PLPMTUD enters Error state
	sctp: reset probe_timer in sctp_transport_pl_update
	sctp: subtract sctphdr len in sctp_transport_pl_hlen
	sctp: return true only for pathmtu update in sctp_transport_pl_toobig
	net: amd-xgbe: Toggle PLL settings during rate change
	ipmi: kcs_bmc: Fix a memory leak in the error handling path of 'kcs_bmc_serio_add_device()'
	nfp: fix NULL pointer access when scheduling dim work
	nfp: fix potential deadlock when canceling dim work
	net: phylink: avoid mvneta warning when setting pause parameters
	net: bridge: fix uninitialized variables when BRIDGE_CFM is disabled
	selftests: net: bridge: update IGMP/MLD membership interval value
	crypto: pcrypt - Delay write to padata->info
	selftests/bpf: Fix fclose/pclose mismatch in test_progs
	udp6: allow SO_MARK ctrl msg to affect routing
	ibmvnic: don't stop queue in xmit
	ibmvnic: Process crqs after enabling interrupts
	ibmvnic: delay complete()
	selftests: mptcp: fix proto type in link_failure tests
	skmsg: Lose offset info in sk_psock_skb_ingress
	cgroup: Fix rootcg cpu.stat guest double counting
	bpf: Fix propagation of bounds from 64-bit min/max into 32-bit and var_off.
	bpf: Fix propagation of signed bounds from 64-bit min/max into 32-bit.
	of: unittest: fix EXPECT text for gpio hog errors
	cpufreq: Fix parameter in parse_perf_domain()
	staging: r8188eu: fix memory leak in rtw_set_key
	arm64: dts: meson: sm1: add Ethernet PHY reset line for ODROID-C4/HC4
	iio: st_sensors: disable regulators after device unregistration
	RDMA/rxe: Fix wrong port_cap_flags
	ARM: dts: BCM5301X: Fix memory nodes names
	arm64: dts: broadcom: bcm4908: Fix UART clock name
	clk: mvebu: ap-cpu-clk: Fix a memory leak in error handling paths
	scsi: pm80xx: Fix lockup in outbound queue management
	scsi: qla2xxx: edif: Use link event to wake up app
	scsi: lpfc: Fix NVMe I/O failover to non-optimized path
	ARM: s3c: irq-s3c24xx: Fix return value check for s3c24xx_init_intc()
	arm64: dts: rockchip: Fix GPU register width for RK3328
	ARM: dts: qcom: msm8974: Add xo_board reference clock to DSI0 PHY
	RDMA/bnxt_re: Fix query SRQ failure
	arm64: dts: ti: k3-j721e-main: Fix "max-virtual-functions" in PCIe EP nodes
	arm64: dts: ti: k3-j721e-main: Fix "bus-range" upto 256 bus number for PCIe
	arm64: dts: ti: j7200-main: Fix "vendor-id"/"device-id" properties of pcie node
	arm64: dts: ti: j7200-main: Fix "bus-range" upto 256 bus number for PCIe
	arm64: dts: meson-g12a: Fix the pwm regulator supply properties
	arm64: dts: meson-g12b: Fix the pwm regulator supply properties
	arm64: dts: meson-sm1: Fix the pwm regulator supply properties
	bus: ti-sysc: Fix timekeeping_suspended warning on resume
	ARM: dts: at91: tse850: the emac<->phy interface is rmii
	arm64: dts: qcom: sc7180: Base dynamic CPU power coefficients in reality
	soc: qcom: llcc: Disable MMUHWT retention
	arm64: dts: qcom: sc7280: fix display port phy reg property
	scsi: dc395: Fix error case unwinding
	MIPS: loongson64: make CPU_LOONGSON64 depends on MIPS_FP_SUPPORT
	JFS: fix memleak in jfs_mount
	pinctrl: renesas: rzg2l: Fix missing port register 21h
	ASoC: wcd9335: Use correct version to initialize Class H
	arm64: dts: qcom: msm8916: Fix Secondary MI2S bit clock
	arm64: dts: renesas: beacon: Fix Ethernet PHY mode
	iommu/mediatek: Fix out-of-range warning with clang
	arm64: dts: qcom: pm8916: Remove wrong reg-names for rtc@6000
	iommu/dma: Fix sync_sg with swiotlb
	iommu/dma: Fix arch_sync_dma for map
	ALSA: hda: Reduce udelay() at SKL+ position reporting
	ALSA: hda: Use position buffer for SKL+ again
	ALSA: usb-audio: Fix possible race at sync of urb completions
	soundwire: debugfs: use controller id and link_id for debugfs
	power: reset: at91-reset: check properly the return value of devm_of_iomap
	scsi: ufs: core: Fix ufshcd_probe_hba() prototype to match the definition
	scsi: ufs: core: Stop clearing UNIT ATTENTIONS
	scsi: megaraid_sas: Fix concurrent access to ISR between IRQ polling and real interrupt
	scsi: pm80xx: Fix misleading log statement in pm8001_mpi_get_nvmd_resp()
	driver core: Fix possible memory leak in device_link_add()
	arm: dts: omap3-gta04a4: accelerometer irq fix
	ASoC: SOF: topology: do not power down primary core during topology removal
	iio: st_pressure_spi: Add missing entries SPI to device ID table
	soc/tegra: Fix an error handling path in tegra_powergate_power_up()
	memory: fsl_ifc: fix leak of irq and nand_irq in fsl_ifc_ctrl_probe
	clk: at91: check pmc node status before registering syscore ops
	powerpc/mem: Fix arch/powerpc/mm/mem.c:53:12: error: no previous prototype for 'create_section_mapping'
	video: fbdev: chipsfb: use memset_io() instead of memset()
	powerpc: fix unbalanced node refcount in check_kvm_guest()
	powerpc/paravirt: correct preempt debug splat in vcpu_is_preempted()
	serial: 8250_dw: Drop wrong use of ACPI_PTR()
	usb: gadget: hid: fix error code in do_config()
	power: supply: rt5033_battery: Change voltage values to µV
	power: supply: max17040: fix null-ptr-deref in max17040_probe()
	scsi: csiostor: Uninitialized data in csio_ln_vnp_read_cbfn()
	RDMA/mlx4: Return missed an error if device doesn't support steering
	usb: musb: select GENERIC_PHY instead of depending on it
	staging: most: dim2: do not double-register the same device
	staging: ks7010: select CRYPTO_HASH/CRYPTO_MICHAEL_MIC
	RDMA/core: Set sgtable nents when using ib_dma_virt_map_sg()
	dyndbg: make dyndbg a known cli param
	powerpc/perf: Fix cycles/instructions as PM_CYC/PM_INST_CMPL in power10
	pinctrl: renesas: checker: Fix off-by-one bug in drive register check
	ARM: dts: stm32: Reduce DHCOR SPI NOR frequency to 50 MHz
	ARM: dts: stm32: fix STUSB1600 Type-C irq level on stm32mp15xx-dkx
	ARM: dts: stm32: fix SAI sub nodes register range
	ARM: dts: stm32: fix AV96 board SAI2 pin muxing on stm32mp15
	ASoC: cs42l42: Always configure both ASP TX channels
	ASoC: cs42l42: Correct some register default values
	ASoC: cs42l42: Defer probe if request_threaded_irq() returns EPROBE_DEFER
	soc: qcom: rpmhpd: Make power_on actually enable the domain
	soc: qcom: socinfo: add two missing PMIC IDs
	iio: buffer: Fix double-free in iio_buffers_alloc_sysfs_and_mask()
	usb: typec: STUSB160X should select REGMAP_I2C
	iio: adis: do not disabe IRQs in 'adis_init()'
	soundwire: bus: stop dereferencing invalid slave pointer
	scsi: ufs: ufshcd-pltfrm: Fix memory leak due to probe defer
	scsi: lpfc: Wait for successful restart of SLI3 adapter during host sg_reset
	serial: imx: fix detach/attach of serial console
	usb: dwc2: drd: fix dwc2_force_mode call in dwc2_ovr_init
	usb: dwc2: drd: fix dwc2_drd_role_sw_set when clock could be disabled
	usb: dwc2: drd: reset current session before setting the new one
	powerpc/booke: Disable STRICT_KERNEL_RWX, DEBUG_PAGEALLOC and KFENCE
	usb: dwc3: gadget: Skip resizing EP's TX FIFO if already resized
	firmware: qcom_scm: Fix error retval in __qcom_scm_is_call_available()
	soc: qcom: rpmhpd: fix sm8350_mxc's peer domain
	soc: qcom: apr: Add of_node_put() before return
	arm64: dts: qcom: pmi8994: Fix "eternal"->"external" typo in WLED node
	arm64: dts: qcom: sdm845: Use RPMH_CE_CLK macro directly
	arm64: dts: qcom: sdm845: Fix Qualcomm crypto engine bus clock
	pinctrl: equilibrium: Fix function addition in multiple groups
	ASoC: topology: Fix stub for snd_soc_tplg_component_remove()
	phy: qcom-qusb2: Fix a memory leak on probe
	phy: ti: gmii-sel: check of_get_address() for failure
	phy: qcom-qmp: another fix for the sc8180x PCIe definition
	phy: qcom-snps: Correct the FSEL_MASK
	phy: Sparx5 Eth SerDes: Fix return value check in sparx5_serdes_probe()
	serial: xilinx_uartps: Fix race condition causing stuck TX
	clk: at91: sam9x60-pll: use DIV_ROUND_CLOSEST_ULL
	clk: at91: clk-master: check if div or pres is zero
	clk: at91: clk-master: fix prescaler logic
	HID: u2fzero: clarify error check and length calculations
	HID: u2fzero: properly handle timeouts in usb_submit_urb
	powerpc/nohash: Fix __ptep_set_access_flags() and ptep_set_wrprotect()
	powerpc/book3e: Fix set_memory_x() and set_memory_nx()
	powerpc/44x/fsp2: add missing of_node_put
	powerpc/xmon: fix task state output
	ALSA: oxfw: fix functional regression for Mackie Onyx 1640i in v5.14 or later
	iommu/dma: Fix incorrect error return on iommu deferred attach
	powerpc: Don't provide __kernel_map_pages() without ARCH_SUPPORTS_DEBUG_PAGEALLOC
	ASoC: cs42l42: Correct configuring of switch inversion from ts-inv
	RDMA/hns: Fix initial arm_st of CQ
	RDMA/hns: Modify the value of MAX_LP_MSG_LEN to meet hardware compatibility
	ASoC: rsnd: Fix an error handling path in 'rsnd_node_count()'
	serial: cpm_uart: Protect udbg definitions by CONFIG_SERIAL_CPM_CONSOLE
	virtio_ring: check desc == NULL when using indirect with packed
	vdpa/mlx5: Fix clearing of VIRTIO_NET_F_MAC feature bit
	mips: cm: Convert to bitfield API to fix out-of-bounds access
	power: supply: bq27xxx: Fix kernel crash on IRQ handler register error
	RDMA/core: Require the driver to set the IOVA correctly during rereg_mr
	apparmor: fix error check
	rpmsg: Fix rpmsg_create_ept return when RPMSG config is not defined
	mtd: rawnand: intel: Fix potential buffer overflow in probe
	nfsd: don't alloc under spinlock in rpc_parse_scope_id
	rtc: ds1302: Add SPI ID table
	rtc: ds1390: Add SPI ID table
	rtc: pcf2123: Add SPI ID table
	remoteproc: imx_rproc: Fix TCM io memory type
	i2c: i801: Use PCI bus rescan mutex to protect P2SB access
	dmaengine: idxd: move out percpu_ref_exit() to ensure it's outside submission
	rtc: mcp795: Add SPI ID table
	Input: ariel-pwrbutton - add SPI device ID table
	i2c: mediatek: fixing the incorrect register offset
	NFS: Default change_attr_type to NFS4_CHANGE_TYPE_IS_UNDEFINED
	NFS: Don't set NFS_INO_DATA_INVAL_DEFER and NFS_INO_INVALID_DATA
	NFS: Ignore the directory size when marking for revalidation
	NFS: Fix dentry verifier races
	pnfs/flexfiles: Fix misplaced barrier in nfs4_ff_layout_prepare_ds
	drm/bridge/lontium-lt9611uxc: fix provided connector suport
	drm/plane-helper: fix uninitialized variable reference
	PCI: aardvark: Don't spam about PIO Response Status
	PCI: aardvark: Fix preserving PCI_EXP_RTCTL_CRSSVE flag on emulated bridge
	opp: Fix return in _opp_add_static_v2()
	NFS: Fix deadlocks in nfs_scan_commit_list()
	sparc: Add missing "FORCE" target when using if_changed
	fs: orangefs: fix error return code of orangefs_revalidate_lookup()
	Input: st1232 - increase "wait ready" timeout
	drm/bridge: nwl-dsi: Add atomic_get_input_bus_fmts
	mtd: spi-nor: hisi-sfc: Remove excessive clk_disable_unprepare()
	PCI: uniphier: Serialize INTx masking/unmasking and fix the bit operation
	mtd: rawnand: arasan: Prevent an unsupported configuration
	mtd: core: don't remove debugfs directory if device is in use
	remoteproc: Fix a memory leak in an error handling path in 'rproc_handle_vdev()'
	rtc: rv3032: fix error handling in rv3032_clkout_set_rate()
	dmaengine: at_xdmac: call at_xdmac_axi_config() on resume path
	dmaengine: at_xdmac: fix AT_XDMAC_CC_PERID() macro
	dmaengine: stm32-dma: fix stm32_dma_get_max_width
	NFS: Fix up commit deadlocks
	NFS: Fix an Oops in pnfs_mark_request_commit()
	Fix user namespace leak
	auxdisplay: img-ascii-lcd: Fix lock-up when displaying empty string
	auxdisplay: ht16k33: Connect backlight to fbdev
	auxdisplay: ht16k33: Fix frame buffer device blanking
	soc: fsl: dpaa2-console: free buffer before returning from dpaa2_console_read
	netfilter: nfnetlink_queue: fix OOB when mac header was cleared
	dmaengine: dmaengine_desc_callback_valid(): Check for `callback_result`
	dmaengine: tegra210-adma: fix pm runtime unbalance
	dmanegine: idxd: fix resource free ordering on driver removal
	dmaengine: idxd: reconfig device after device reset command
	signal/sh: Use force_sig(SIGKILL) instead of do_group_exit(SIGKILL)
	m68k: set a default value for MEMORY_RESERVE
	watchdog: f71808e_wdt: fix inaccurate report in WDIOC_GETTIMEOUT
	ar7: fix kernel builds for compiler test
	scsi: target: core: Remove from tmr_list during LUN unlink
	scsi: qla2xxx: Relogin during fabric disturbance
	scsi: qla2xxx: Fix gnl list corruption
	scsi: qla2xxx: Turn off target reset during issue_lip
	scsi: qla2xxx: edif: Fix app start fail
	scsi: qla2xxx: edif: Fix app start delay
	scsi: qla2xxx: edif: Flush stale events and msgs on session down
	scsi: qla2xxx: edif: Increase ELS payload
	scsi: qla2xxx: edif: Fix EDIF bsg
	NFSv4: Fix a regression in nfs_set_open_stateid_locked()
	dmaengine: idxd: fix resource leak on dmaengine driver disable
	i2c: xlr: Fix a resource leak in the error handling path of 'xlr_i2c_probe()'
	gpio: realtek-otto: fix GPIO line IRQ offset
	xen-pciback: Fix return in pm_ctrl_init()
	nbd: fix max value for 'first_minor'
	nbd: fix possible overflow for 'first_minor' in nbd_dev_add()
	io-wq: fix max-workers not correctly set on multi-node system
	net: davinci_emac: Fix interrupt pacing disable
	kselftests/net: add missed icmp.sh test to Makefile
	kselftests/net: add missed setup_loopback.sh/setup_veth.sh to Makefile
	kselftests/net: add missed SRv6 tests
	kselftests/net: add missed vrf_strict_mode_test.sh test to Makefile
	kselftests/net: add missed toeplitz.sh/toeplitz_client.sh to Makefile
	ethtool: fix ethtool msg len calculation for pause stats
	openrisc: fix SMP tlb flush NULL pointer dereference
	net: vlan: fix a UAF in vlan_dev_real_dev()
	net: dsa: felix: fix broken VLAN-tagged PTP under VLAN-aware bridge
	ice: Fix replacing VF hardware MAC to existing MAC filter
	ice: Fix not stopping Tx queues for VFs
	kdb: Adopt scheduler's task classification
	ACPI: PMIC: Fix intel_pmic_regs_handler() read accesses
	PCI: j721e: Fix j721e_pcie_probe() error path
	nvdimm/btt: do not call del_gendisk() if not needed
	scsi: bsg: Fix errno when scsi_bsg_register_queue() fails
	scsi: ufs: ufshpb: Use proper power management API
	scsi: ufs: core: Fix NULL pointer dereference
	scsi: ufs: ufshpb: Properly handle max-single-cmd
	selftests: net: properly support IPv6 in GSO GRE test
	drm/nouveau/svm: Fix refcount leak bug and missing check against null bug
	nvdimm/pmem: cleanup the disk if pmem_release_disk() is yet assigned
	block/ataflop: use the blk_cleanup_disk() helper
	block/ataflop: add registration bool before calling del_gendisk()
	block/ataflop: provide a helper for cleanup up an atari disk
	ataflop: remove ataflop_probe_lock mutex
	PCI: Do not enable AtomicOps on VFs
	cpufreq: intel_pstate: Clear HWP desired on suspend/shutdown and offline
	net: phy: fix duplex out of sync problem while changing settings
	block: fix device_add_disk() kobject_create_and_add() error handling
	drm/ttm: remove ttm_bo_vm_insert_huge()
	bonding: Fix a use-after-free problem when bond_sysfs_slave_add() failed
	octeontx2-pf: select CONFIG_NET_DEVLINK
	ALSA: memalloc: Catch call with NULL snd_dma_buffer pointer
	mfd: core: Add missing of_node_put for loop iteration
	mfd: cpcap: Add SPI device ID table
	mfd: sprd: Add SPI device ID table
	mfd: altera-sysmgr: Fix a mistake caused by resource_size conversion
	ACPI: PM: Fix device wakeup power reference counting error
	libbpf: Fix lookup_and_delete_elem_flags error reporting
	selftests/bpf/xdp_redirect_multi: Put the logs to tmp folder
	selftests/bpf/xdp_redirect_multi: Use arping to accurate the arp number
	selftests/bpf/xdp_redirect_multi: Give tcpdump a chance to terminate cleanly
	selftests/bpf/xdp_redirect_multi: Limit the tests in netns
	drm: fb_helper: improve CONFIG_FB dependency
	Revert "drm/imx: Annotate dma-fence critical section in commit path"
	drm/amdgpu/powerplay: fix sysfs_emit/sysfs_emit_at handling
	can: etas_es58x: es58x_rx_err_msg(): fix memory leak in error path
	can: mcp251xfd: mcp251xfd_chip_start(): fix error handling for mcp251xfd_chip_rx_int_enable()
	mm/zsmalloc.c: close race window between zs_pool_dec_isolated() and zs_unregister_migration()
	zram: off by one in read_block_state()
	perf bpf: Add missing free to bpf_event__print_bpf_prog_info()
	llc: fix out-of-bound array index in llc_sk_dev_hash()
	nfc: pn533: Fix double free when pn533_fill_fragment_skbs() fails
	litex_liteeth: Fix a double free in the remove function
	arm64: arm64_ftr_reg->name may not be a human-readable string
	arm64: pgtable: make __pte_to_phys/__phys_to_pte_val inline functions
	bpf, sockmap: Remove unhash handler for BPF sockmap usage
	bpf, sockmap: Fix race in ingress receive verdict with redirect to self
	bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding
	bpf, sockmap: sk_skb data_end access incorrect when src_reg = dst_reg
	dmaengine: stm32-dma: fix burst in case of unaligned memory address
	dmaengine: stm32-dma: avoid 64-bit division in stm32_dma_get_max_width
	gve: Fix off by one in gve_tx_timeout()
	drm/i915/fb: Fix rounding error in subsampled plane size calculation
	init: make unknown command line param message clearer
	seq_file: fix passing wrong private data
	drm/amdgpu: fix uvd crash on Polaris12 during driver unloading
	net: dsa: mv88e6xxx: Don't support >1G speeds on 6191X on ports other than 10
	net/sched: sch_taprio: fix undefined behavior in ktime_mono_to_any
	net: hns3: fix ROCE base interrupt vector initialization bug
	net: hns3: fix pfc packet number incorrect after querying pfc parameters
	net: hns3: fix kernel crash when unload VF while it is being reset
	net: hns3: allow configure ETS bandwidth of all TCs
	net: stmmac: allow a tc-taprio base-time of zero
	net: ethernet: ti: cpsw_ale: Fix access to un-initialized memory
	net: marvell: mvpp2: Fix wrong SerDes reconfiguration order
	vsock: prevent unnecessary refcnt inc for nonblocking connect
	net/smc: fix sk_refcnt underflow on linkdown and fallback
	cxgb4: fix eeprom len when diagnostics not implemented
	selftests/net: udpgso_bench_rx: fix port argument
	thermal: int340x: fix build on 32-bit targets
	smb3: do not error on fsync when readonly
	ARM: 9155/1: fix early early_iounmap()
	ARM: 9156/1: drop cc-option fallbacks for architecture selection
	parisc: Fix backtrace to always include init funtion names
	parisc: Flush kernel data mapping in set_pte_at() when installing pte for user page
	MIPS: fix duplicated slashes for Platform file path
	MIPS: fix *-pkg builds for loongson2ef platform
	MIPS: Fix assembly error from MIPSr2 code used within MIPS_ISA_ARCH_LEVEL
	x86/mce: Add errata workaround for Skylake SKX37
	PCI/MSI: Move non-mask check back into low level accessors
	PCI/MSI: Destroy sysfs before freeing entries
	KVM: x86: move guest_pv_has out of user_access section
	posix-cpu-timers: Clear task::posix_cputimers_work in copy_process()
	irqchip/sifive-plic: Fixup EOI failed when masked
	f2fs: should use GFP_NOFS for directory inodes
	f2fs: include non-compressed blocks in compr_written_block
	f2fs: fix UAF in f2fs_available_free_memory
	ceph: fix mdsmap decode when there are MDS's beyond max_mds
	erofs: fix unsafe pagevec reuse of hooked pclusters
	drm/i915/guc: Fix blocked context accounting
	block: Hold invalidate_lock in BLKDISCARD ioctl
	block: Hold invalidate_lock in BLKZEROOUT ioctl
	block: Hold invalidate_lock in BLKRESETZONE ioctl
	ksmbd: Fix buffer length check in fsctl_validate_negotiate_info()
	ksmbd: don't need 8byte alignment for request length in ksmbd_check_message
	dmaengine: ti: k3-udma: Set bchan to NULL if a channel request fail
	dmaengine: ti: k3-udma: Set r/tchan or rflow to NULL if request fail
	dmaengine: bestcomm: fix system boot lockups
	net, neigh: Enable state migration between NUD_PERMANENT and NTF_USE
	9p/net: fix missing error check in p9_check_errors
	mm/filemap.c: remove bogus VM_BUG_ON
	memcg: prohibit unconditional exceeding the limit of dying tasks
	mm, oom: pagefault_out_of_memory: don't force global OOM for dying tasks
	mm, oom: do not trigger out_of_memory from the #PF
	mm, thp: lock filemap when truncating page cache
	mm, thp: fix incorrect unmap behavior for private pages
	mfd: dln2: Add cell for initializing DLN2 ADC
	video: backlight: Drop maximum brightness override for brightness zero
	bcache: fix use-after-free problem in bcache_device_free()
	bcache: Revert "bcache: use bvec_virt"
	PM: sleep: Avoid calling put_device() under dpm_list_mtx
	s390/cpumf: cpum_cf PMU displays invalid value after hotplug remove
	s390/cio: check the subchannel validity for dev_busid
	s390/tape: fix timer initialization in tape_std_assign()
	s390/ap: Fix hanging ioctl caused by orphaned replies
	s390/cio: make ccw_device_dma_* more robust
	remoteproc: elf_loader: Fix loading segment when is_iomem true
	remoteproc: Fix the wrong default value of is_iomem
	remoteproc: imx_rproc: Fix ignoring mapping vdev regions
	remoteproc: imx_rproc: Fix rsc-table name
	mtd: rawnand: fsmc: Fix use of SM ORDER
	mtd: rawnand: ams-delta: Keep the driver compatible with on-die ECC engines
	mtd: rawnand: xway: Keep the driver compatible with on-die ECC engines
	mtd: rawnand: mpc5121: Keep the driver compatible with on-die ECC engines
	mtd: rawnand: gpio: Keep the driver compatible with on-die ECC engines
	mtd: rawnand: pasemi: Keep the driver compatible with on-die ECC engines
	mtd: rawnand: orion: Keep the driver compatible with on-die ECC engines
	mtd: rawnand: plat_nand: Keep the driver compatible with on-die ECC engines
	mtd: rawnand: au1550nd: Keep the driver compatible with on-die ECC engines
	powerpc/vas: Fix potential NULL pointer dereference
	powerpc/bpf: Fix write protecting JIT code
	powerpc/32e: Ignore ESR in instruction storage interrupt handler
	powerpc/powernv/prd: Unregister OPAL_MSG_PRD2 notifier during module unload
	powerpc/security: Use a mutex for interrupt exit code patching
	powerpc/64s/interrupt: Fix check_return_regs_valid() false positive
	powerpc/pseries/mobility: ignore ibm, platform-facilities updates
	powerpc/85xx: fix timebase sync issue when CONFIG_HOTPLUG_CPU=n
	drm/sun4i: Fix macros in sun8i_csc.h
	PCI: Add PCI_EXP_DEVCTL_PAYLOAD_* macros
	PCI: aardvark: Fix PCIe Max Payload Size setting
	SUNRPC: Partial revert of commit 6f9f17287e
	drm/amd/display: Look at firmware version to determine using dmub on dcn21
	media: vidtv: move kfree(dvb) to vidtv_bridge_dev_release()
	cifs: fix memory leak of smb3_fs_context_dup::server_hostname
	ath10k: fix invalid dma_addr_t token assignment
	mmc: moxart: Fix null pointer dereference on pointer host
	selftests/x86/iopl: Adjust to the faked iopl CLI/STI usage
	selftests/bpf: Fix also no-alu32 strobemeta selftest
	arch/cc: Introduce a function to check for confidential computing features
	x86/sev: Add an x86 version of cc_platform_has()
	x86/sev: Make the #VC exception stacks part of the default stacks storage
	media: videobuf2: always set buffer vb2 pointer
	media: videobuf2-dma-sg: Fix buf->vb NULL pointer dereference
	Linux 5.15.3

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I09574eb6b4fbe930bd13f932cc618846972fcc27
2021-11-19 15:38:07 +01:00
Shaleen Agrawal
12d9e3b85d ANDROID: Add vendor hook while registering energy model
Vendor architectures may contain CPUs running on the same clock line
which contain different capacities. Add a tracehook in this path to
allow vendor modules to skip implicit check to prevent crashes.

Bug: 206602617
Change-Id: Ica01a214689607b8d79b370c20bc9a8c44ca2117
Signed-off-by: Shaleen Agrawal <shalagra@codeaurora.org>
2021-11-18 20:49:39 +00:00