Commit Graph

1168390 Commits

Author SHA1 Message Date
Greg Kroah-Hartman
6e376e10ea Merge 17d426628c ("usb: typec: tcpm: set SRC_SEND_CAPABILITIES timeout to PD_T_SENDER_RESPONSE") into android14-6.1-lts
Steps on the way to 6.1.129

Resolves merge conflicts in:
	drivers/usb/dwc3/core.c

Change-Id: I2c283da276b9179cd76403d2fa83da077615d0be
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-03-07 08:37:04 +00:00
Greg Kroah-Hartman
11cb0c5d29 Merge 2c3e83538f ("usb: gadget: f_tcm: Fix Get/SetInterface return value") into android14-6.1-lts
Steps on the way to 6.1.129

Change-Id: Id44c263751cf95215390ad95c101ec68edf461ed
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-03-07 08:34:36 +00:00
Greg Kroah-Hartman
c6490faa0a Merge 93a56dbe12 ("drivers/card_reader/rtsx_usb: Restore interrupt based detection") into android14-6.1-lts
Steps on the way to 6.1.129

Resolves merge conflicts in:
	drivers/usb/host/xhci-ring.c

Change-Id: Ie123285eab89802392003b95ec495b21820ad41b
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-03-07 08:31:24 +00:00
Greg Kroah-Hartman
9fb90380c1 Merge e10b392a74 ("net: usb: rtl8150: enable basic endpoint checking") into android14-6.1-lts
Steps on the way to 6.1.129

Resolves merge conflicts in:
	scripts/Makefile.lib

Change-Id: Id496f510e74b8576bd71449bf8ffa338072eb8e4
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-03-07 08:11:45 +00:00
Greg Kroah-Hartman
015c802557 Merge ad8f71d64a ("tools/bootconfig: Fix the wrong format specifier") into android14-6.1-lts
Steps on the way to 6.1.129

Change-Id: I30bcf71d285ba65a092b9a4899532cde31208c48
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-03-07 08:09:42 +00:00
Greg Kroah-Hartman
3e716b1ee2 Revert "bpf: tcp: Mark bpf_load_hdr_opt() arg2 as read-write"
This reverts commit 8f7cc7c763 which is
commit 8ac412a3361173e3000b16167af3d1f6f90af613 upstream.

It breaks the Android kernel build and can be brought back in the future
in an build-safe way if it is really needed.

Bug: 161946584
Change-Id: I150a126d974ab67537cdb11d1348441834b154c5
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-03-07 08:07:24 +00:00
Greg Kroah-Hartman
9775060702 Merge 8f7cc7c763 ("bpf: tcp: Mark bpf_load_hdr_opt() arg2 as read-write") into android14-6.1-lts
Steps on the way to 6.1.129

Change-Id: I624b68d0d97588c1934baa197d65c1a48c05ae34
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-03-07 08:06:49 +00:00
Greg Kroah-Hartman
0bc46e8fb4 Merge be42a09fe8 ("bpf: Send signals asynchronously if !preemptible") into android14-6.1-lts
Steps on the way to 6.1.129

Change-Id: Ibd1adb3cc93660336fe0bd65b91d65f4ca1e0fcb
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-03-07 08:04:25 +00:00
Greg Kroah-Hartman
0d704e39b1 Merge e397ad3f16 ("ASoC: Intel: avs: Fix theoretical infinite loop") into android14-6.1-lts
Steps on the way to 6.1.129

Change-Id: I1dccc0094c873f1be70ee97b941f74b5ace58e1e
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-03-06 08:49:40 +00:00
Greg Kroah-Hartman
759b090e5d Merge 220883fba3 ("HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check") into android14-6.1-lts
Steps on the way to 6.1.129

Change-Id: I12ddac7329f6db60e21f195f3e500ac786f2db7c
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-03-06 08:48:15 +00:00
Greg Kroah-Hartman
ef5c5ad7df Merge 0f1719a2ba ("genirq: Make handle_enforce_irqctx() unconditionally available") into android14-6.1-lts
Steps on the way to 6.1.129

Change-Id: I2092799139b4c393c1c99953d110500920fa3200
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-03-06 08:35:22 +00:00
Greg Kroah-Hartman
309e9dd394 Revert "OPP: Rearrange entries in pm_opp.h"
This reverts commit 4dff070117 which is
commit 754833b319 upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: Iee1382014bb394455d5d39e5dee9a036e8988cae
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-03-06 08:34:59 +00:00
Greg Kroah-Hartman
4fd8e25317 Revert "OPP: Introduce dev_pm_opp_find_freq_{ceil/floor}_indexed() APIs"
This reverts commit 92fcb46659 which is
commit 142e17c1c2 upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: I1af7c9d9e49c81fae8706dc5fcb1f80e5aaac0b0
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-03-06 08:34:58 +00:00
Greg Kroah-Hartman
44a6d4af33 Revert "OPP: Introduce dev_pm_opp_get_freq_indexed() API"
This reverts commit 7f73098bc6 which is
commit 5f756d03e2 upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: I2e361b5c7e9306d76e606eaa5eb1fa87af5eed28
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-03-06 08:34:58 +00:00
Greg Kroah-Hartman
f7d6d8d971 Revert "OPP: Add dev_pm_opp_find_freq_exact_indexed()"
This reverts commit 7baa59f83f which is
commit a5893928bb upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: I00b677f975738c791bf7074c982a8e215f8054ac
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-03-06 08:34:58 +00:00
Greg Kroah-Hartman
6811b9303c Revert "OPP: Reuse dev_pm_opp_get_freq_indexed()"
This reverts commit e20fd4d3a4 which is
commit 746de82550 upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: I13648075fb2871b25977bc22ce6d11bd9e795506
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-03-06 08:34:58 +00:00
Greg Kroah-Hartman
f7d86656ca Revert "OPP: add index check to assert to avoid buffer overflow in _read_freq()"
This reverts commit 774dd6f0f0 which is
commit d659bc68ed489022ea33342cfbda2911a81e7a0d upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: I6295c420bb6642fb9f04770a9f3baefa2d0aee72
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-03-06 08:34:58 +00:00
Greg Kroah-Hartman
3e0043876d Revert "OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized"
This reverts commit 8532fd078d which is
commit b44b9bc7cab2967c3d6a791b1cd542c89fc07f0e upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: I2ae4174ecb2214b5c1bc30b07970dd3468c1b43f
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-03-06 08:34:57 +00:00
Greg Kroah-Hartman
635b2890f4 Merge 8532fd078d ("OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized") into android14-6.1-lts
Steps on the way to 6.1.129

Change-Id: I9feed811f2bd01f2c28c951c949936d87b886ee8
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-03-06 08:34:57 +00:00
Greg Kroah-Hartman
3df8fd8f21 Revert "sched/psi: Use task->psi_flags to clear in CPU migration"
This reverts commit 371e1a0e38 which is
commit 52b33d87b9 upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: Ic3741eb342637ace98373f24857a4d302cf7cfc7
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-03-06 06:07:52 +00:00
Greg Kroah-Hartman
0b3a7df78d Revert "sched/fair: Fix value reported by hot tasks pulled in /proc/schedstat"
This reverts commit a18682ccd2 which is
commit a430d99e349026d53e2557b7b22bd2ebd61fe12a upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: Ia71eb1867950bae93b6c426a596d584716137b29
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-03-06 06:07:31 +00:00
Greg Kroah-Hartman
d4e5cb0cd9 Merge 0764df6b80 ("drm/rockchip: vop2: Check linear format for Cluster windows on rk3566/8") into android14-6.1-lts
Steps on the way to 6.1.129

Resolves merge conflicts in:
	kernel/sched/fair.c

Change-Id: I875e1c0846dd439a019d0d5b81f09cdac4a5c74e
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-03-05 16:54:20 +00:00
Greg Kroah-Hartman
b3026e7cef Merge branch 'android14-6.1' into android14-6.1-lts
Catch the lts branch up with changes made in the normal one.  Commits
include in here are:

* a624f97c9a Merge tag 'android14-6.1.128_r00' into android14-6.1
* 52a41f0bf1 ANDROID: usb: typec: tcpci: Combine the parameters of set_auto_vbus_discharge_threshold
* f84d5a5fad FROMGIT: usb: typec: tcpci: Prevent Sink disconnection before vPpsShutdown in SPR PPS
* a5f88b6529 UPSTREAM: f2fs: Optimize f2fs_truncate_data_blocks_range()
* 8171ecc314 BACKPORT: f2fs: add parameter @len to f2fs_invalidate_blocks()
* 2e7c1f7a45 UPSTREAM: f2fs: update_sit_entry_for_release() supports consecutive blocks.
* 80b35f89f0 BACKPORT: f2fs: introduce update_sit_entry_for_release/alloc()
* 600d7eac27 BACKPORT: f2fs: add parameter @len to f2fs_invalidate_internal_cache()
* 187a48cb98 UPSTREAM: f2fs: expand f2fs_invalidate_compress_page() to f2fs_invalidate_compress_pages_range()
* edcfc793f8 UPSTREAM: f2fs: fix to truncate meta inode pages forcely
* 3812bc69b2 BACKPORT: f2fs: introduce f2fs_invalidate_internal_cache() for cleanup
* ccc9157843 ANDROID: cma: Add restrict_cma_redirect boot parameter
* 34a86330cc FROMLIST: KVM: arm64: Fix alignment of kvm_hyp_memcache allocations
* c93dcf3b53 UPSTREAM: binder: log transaction code on failure
* 4e534b8a58 ANDROID: GKI: Galaxy android14-6.1 update symbol for alsa audio device
* 1ac09f5c05 ANDROID: GKI: Update symbol list for arg
* e5f309b277 ANDROID: dm-bow: Protect Ranges fetched and erased from the RB tree
* 09717ac61c ANDROID: Update the ABI symbol list
* 3031fa1817 ANDROID: Adding an Android vendor LMK event
* 7658169f5f BACKPORT: usb: xhci: Fix NULL pointer dereference on certain command aborts
* 4033df202b ANDROID: OPP: Fix incorrectly backported logic in _set_opp_level()
* 1cf6be7092 UPSTREAM: io_uring: fix waiters missing wake ups
* 2055772ead UPSTREAM: f2fs: avoid trying to get invalid block address
* 554eb9d61a ANDROID: KABI macros to release excess KABI fields for use with backports
* 773ad7ab13 ANDROID: GKI: Add new symbol list for arg

Change-Id: I71e368853a486e3893c0cc5b964b8fc3c390a4e9
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-02-22 10:42:36 +00:00
Greg Kroah-Hartman
a624f97c9a Merge tag 'android14-6.1.128_r00' into android14-6.1
This merges the android14-6.1.128_r00 tag into the android14-6.1 branch,
catching it up with the latest LTS releases.

It contains the following commits:

* 8ae119f6f2 ANDROID: hrtimers: revert mismerged commit in 6.1.127 LTS merge
*   e6d1ba5430 Merge 6.1.128 into android14-6.1-lts
|\
| * 0cbb5f65e5 Linux 6.1.128
| * a9401cd5d1 drm/v3d: Assign job pointer to NULL before signaling the fence
| * 7d06d97e23 ASoC: samsung: midas_wm1811: Fix 'Headphone Switch' control creation
| * 44c495818d smb: client: fix NULL ptr deref in crypto_aead_setkey()
| * 4982cc83da Input: xpad - add support for wooting two he (arm)
| * b336f58326 Input: xpad - add unofficial Xbox 360 wireless receiver clone
| * dd00051871 Input: atkbd - map F23 key to support default copilot shortcut
| * 4631653d8d ALSA: usb-audio: Add delay quirk for USB Audio Device
| * 33233b06ad Revert "usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null"
| * 4b9b41fabc USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb()
| * bce966530f smb: client: fix UAF in async decryption
| * 49a27ee475 wifi: iwlwifi: add a few rate index validity checks
| * 182a4b7c73 scsi: storvsc: Ratelimit warning logs to prevent VM denial of service
| * ce11424026 ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find()
| * 13ea954776 ext4: fix access to uninitialised lock in fc replay path
| * 6bcb8a5b70 vfio/platform: check the bounds of read/write syscalls
| * 1a1b2b8c28 Revert "HID: multitouch: Add support for lenovo Y9000P Touchpad"
| * 8476f8428e block: fix integer overflow in BLKSECDISCARD
| * 1332c6ed44 net: sched: fix ets qdisc OOB Indexing
| * 74a37ce697 io_uring: fix waiters missing wake ups
| * 2a40a140e1 gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag
| * 754df8c9b7 xfs: respect the stable writes flag on the RT device
| * bc4ad69947 xfs: clean up FS_XFLAG_REALTIME handling in xfs_ioctl_setattr_xflags
| * 7880b1f0ad xfs: dquot recovery does not validate the recovered dquot
| * df716416db xfs: clean up dqblk extraction
| * 318cac2b98 xfs: inode recovery does not validate the recovered inode
| * 6e7826272e xfs: fix internal error from AGFL exhaustion
| * 323a707978 xfs: up(ic_sema) if flushing data device fails
| * 67c362b810 xfs: only remap the written blocks in xfs_reflink_end_cow_extent
| * b655ee7d1a xfs: abort intent items when recovery intents fail
| * 16cf312bf0 xfs: factor out xfs_defer_pending_abort
| * 6685b88514 xfs: allow read IO and FICLONE to run concurrently
| * 4eb3b579b4 xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space
| * feb30fe495 xfs: introduce protection for drop nlink
| * 4d607041cf xfs: make sure maxlen is still congruent with prod when rounding down
| * 34167d0216 xfs: fix units conversion error in xfs_bmap_del_extent_delay
| * 9153644934 xfs: rt stubs should return negative errnos when rt disabled
| * 9670abd18c xfs: prevent rt growfs when quota is enabled
| * 8ee604ac13 xfs: hoist freeing of rt data fork extent mappings
| * 79bdab54b6 xfs: bump max fsgeom struct version
| * f1bc570611 softirq: Allow raising SCHED_SOFTIRQ from SMP-call-function on RT kernel
| * d0ec61c9f3 ipv6: Fix soft lockups in fib6_select_path under high next hop churn
| * 9fdec47866 regmap: detach regmap from dev on regmap_exit
| * 87d6969081 ASoC: samsung: Add missing depends on I2C
| * 656100f656 ASoC: samsung: midas_wm1811: Map missing jack kcontrols
| * d2b4b39b75 irqchip/sunxi-nmi: Add missing SKIP_WAKE flag
| * b7d2461858 drm/amd/display: Use HW lock mgr for PSR1
| * 2104ad7193 scsi: iscsi: Fix redundant response for ISCSI_UEVENT_GET_HOST_STATS request
| * 18cb5798df seccomp: Stub for !CONFIG_SECCOMP
| * b873c88bfc ASoC: samsung: Add missing selects for MFD_WM8994
| * 8cf587aab9 ASoC: wm8994: Add depends on MFD core
* | 979fb1d6ec Revert "fs: fix missing declaration of init_files"
* | 42cbb80279 Revert "net: add exit_batch_rtnl() method"
* | 5b18fc7e2e Revert "gtp: use exit_batch_rtnl() method"
* | da69d6681f Revert "gtp: Use for_each_netdev_rcu() in gtp_genl_dump_pdp()."
* | f3dfa82675 Revert "gtp: Destroy device along with udp socket's netns dismantle."
* | 79f1b689da Merge 6.1.127 into android14-6.1-lts
|\|
| * 75cefdf153 Linux 6.1.127
| * be7c61ea5f net: fix data-races around sk->sk_forward_alloc
| * 060de3717c x86/xen: fix SLS mitigation in xen_hypercall_iret()
| * 400fb0e9c2 nfsd: add list_head nf_gc to struct nfsd_file
| * 75a0a6dde8 erofs: handle NONHEAD !delta[1] lclusters gracefully
| * 6326a3dc14 erofs: tidy up EROFS on-disk naming
| * 6e5dbd1c04 wifi: ath10k: avoid NULL pointer error during sdio remove
| * cd862903fa Revert "regmap: detach regmap from dev on regmap_exit"
| * 275b8347e2 scsi: sg: Fix slab-use-after-free read in sg_release()
| * 9e95518eca RDMA/rxe: Fix the qp flush warnings in req
| * e77360374f Revert "drm/amdgpu: rework resume handling for display (v2)"
| * 1921fe7d28 block: fix uaf for flush rq while iterating tags
| * 05b1b33936 drm/amdgpu: fix usage slab after free
| * 5bd410c210 drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create'
| * 64b79afdca iio: adc: rockchip_saradc: fix information leak in triggered buffer
| * d3e25180ba iio: imu: inv_icm42600: fix timestamps after suspend if sensor is on
| * f2e4823baa iio: imu: inv_icm42600: fix spi burst write not supported
| * 479a42eedb Revert "PCI: Use preserve_config in place of pci_flags"
| * 6603aca936 drm/i915/fb: Relax clear color alignment to 64 bytes
| * 3d41dbf82e hrtimers: Handle CPU state correctly on hotplug
| * d7b0e89610 irqchip/gic-v3-its: Don't enable interrupts in its_irq_set_vcpu_affinity()
| * e64612f8e8 irqchip/gic-v3: Handle CPU_PM_ENTER_FAILED correctly
| * e1994d0f50 irqchip: Plug a OF node reference leak in platform_irqchip_probe()
| * 699cc10cc3 pmdomain: imx8mp-blk-ctrl: add missing loop break condition
| * d38c49f7bd gpiolib: cdev: Fix use after free in lineinfo_changed_notify
| * 65c367bd9d fs/proc: fix softlockup in __read_vmcore (part 2)
| * 80fc836f3e filemap: avoid truncating 64-bit offset to 32 bits
| * b52e50dd4f vsock: prevent null-ptr-deref in vsock_*[has_data|has_space]
| * cc586af35b vsock: reset socket state when de-assigning the transport
| * a3c9390f14 vsock/virtio: cancel close work in the destructor
| * 88244163bc vsock/virtio: discard packets if the transport changes
| * 435349d49f net: ethernet: xgbe: re-add aneg to supported features in PHY quirks
| * 9e1f509476 selftests: mptcp: avoid spurious errors on disconnect
| * 73411e09d0 mptcp: be sure to send ack when mptcp-level window re-opens
| * fe3de867f9 zram: fix potential UAF of zram table
| * f983099430 ALSA: hda/realtek: Add support for Ayaneo System using CS35L41 HDA
| * 0b30238c5c x86/asm: Make serialize() always_inline
| * 3375bdf84c poll_wait: add mb() to fix theoretical race between waitqueue_active() and .poll()
| * 7ca4bd6b75 iomap: avoid avoid truncating 64-bit offset to 32 bits
| * a5045ca6eb ACPI: resource: acpi_dev_irq_override(): Check DMI match last
| * bea2a4cf27 selftests: tc-testing: reduce rshift value
| * 435df80d46 scsi: ufs: core: Honor runtime/system PM levels if set by host controller drivers
| * f937130b8d cachefiles: Parse the "secctx" immediately
| * d8680dad14 kheaders: Ignore silly-rename files
| * bb00b1190b fs: fix missing declaration of init_files
| * 190218579c hfs: Sanity check the root record
| * 41e4ca8acb mac802154: check local interfaces before deleting sdata list
| * cce9254a04 nvmet: propagate npwg topology
| * 75505de002 i2c: rcar: fix NACK handling when being a target
| * 53336f3367 i2c: mux: demux-pinctrl: check initial mux selection, too
| * 4c833c3652 Revert "mtd: spi-nor: core: replace dummy buswidth from addr to data"
| * 79fe53ed76 hwmon: (tmp513) Fix division of negative numbers
| * 2a1c88f7ca drm/v3d: Ensure job pointer is set to NULL after job completion
| * efc92a260e net/mlx5: Clear port select structure when fail to create
| * edb43b46a2 net/mlx5: Fix RDMA TX steering prio
| * 207c81e2ec net: xilinx: axienet: Fix IRQ coalescing packet count overflow
| * c385389ab0 nfp: bpf: prevent integer overflow in nfp_bpf_event_output()
| * efec287cba gtp: Destroy device along with udp socket's netns dismantle.
| * c91e694619 gtp: Use for_each_netdev_rcu() in gtp_genl_dump_pdp().
| * a3fdd5f3d6 gtp: use exit_batch_rtnl() method
| * 760f415e08 net: add exit_batch_rtnl() method
| * e5d24a7074 pktgen: Avoid out-of-bounds access in get_imix_entries
| * ea9e990356 openvswitch: fix lockup on tx to unregistering netdev with carrier
| * d0a3b3d117 bpf: Fix bpf_sk_select_reuseport() memory leak
| * 075248178c net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field()
* | 766d61c1b6 Merge branch 'android14-6.1' into android14-6.1-lts
* | 12fe448232 Merge 6.1.126 into android14-6.1-lts
|\|
| * f4f677285b Linux 6.1.126
| * f6247d3e3f Partial revert of xhci: use pm_ptr() instead #ifdef for CONFIG_PM conditionals
* | 3ad3cca387 Merge 6.1.125 into android14-6.1-lts
|\|
| * 60ceadf924 Linux 6.1.125
| * 9734fd7a27 xhci: use pm_ptr() instead of #ifdef for CONFIG_PM conditionals
| * d208571943 drm: adv7511: Fix use-after-free in adv7533_attach_dsi()
| * 90d4d2718e drm: bridge: adv7511: use dev_err_probe in probe function
| * 2d43119248 ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv
| * 18a1cd923b ocfs2: correct return value of ocfs2_local_free_info()
| * ad9ec26aba of: address: Preserve the flags portion on 1:1 dma-ranges mapping
| * 007662f785 of: address: Store number of bus flag cells rather than bool
| * 7eb954ec96 of: address: Remove duplicated functions
| * 30eb1123b2 of: address: Fix address translation when address-size is greater than 2
| * 46dfdb0f93 of/address: Add support for 3 address cell bus
| * 57e3220c28 of: unittest: Add bus address range parsing tests
| * 40153aae1c arm64: dts: rockchip: add hevc power domain clock to rk3328
| * 2550149fcd block, bfq: fix waker_bfqq UAF after bfq_split_bfqq()
| * 64b0aebed9 ARM: dts: imxrt1050: Fix clocks for mmc
| * 6b63308c28 io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period
| * 3e871c1d51 iio: adc: ad7124: Disable all channels at probe time
| * 6c92d6f2c7 iio: inkern: call iio_device_put() only on mapped devices
| * 25ef52f1c1 iio: adc: at91: call input_free_device() on allocated iio_dev
| * 26016d08c4 iio: adc: ti-ads124s08: Use gpiod_set_value_cansleep()
| * 7bc7e9d6bd iio: gyro: fxas21002c: Fix missing data update in trigger handler
| * ebe2672bc4 iio: adc: ti-ads8688: fix information leak in triggered buffer
| * 6985ba4467 iio: imu: kmx61: fix information leak in triggered buffer
| * 47d245be86 iio: light: vcnl4035: fix information leak in triggered buffer
| * b0642d9c87 iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer
| * b7849f62e6 iio: pressure: zpa2326: fix information leak in triggered buffer
| * 82f60f3600 usb: gadget: f_fs: Remove WARN_ON in functionfs_bind
| * 9981c33aae usb: gadget: f_uac2: Fix incorrect setting of bNumEndpoints
| * dc51b66ec2 usb: fix reference leak in usb_new_device()
| * c6f763b54c USB: core: Disable LPM only for non-suspended ports
| * 39219c2611 USB: usblp: return error when setting unsupported protocol
| * 92a185bf7e usb: dwc3-am62: Disable autosuspend during remove
| * 3d730e8758 usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null
| * d26b9f0b99 misc: microchip: pci1xxxx: Resolve return code mismatch during GPIO set config
| * 79aef6187e misc: microchip: pci1xxxx: Resolve kernel panic during GPIO IRQ handling
| * ca47e933a9 topology: Keep the cpumask unchanged when printing cpumap
| * 20a5725627 usb: dwc3: gadget: fix writing NYET threshold
| * 32af3bcca3 USB: serial: cp210x: add Phoenix Contact UPS Device
| * 65cb57b9f1 usb-storage: Add max sectors quirk for Nokia 208
| * 78e8abbdf7 staging: iio: ad9832: Correct phase range check
| * 331e6e9fb0 staging: iio: ad9834: Correct phase range check
| * c712fa6158 USB: serial: option: add Neoway N723-EA support
| * fb94621286 USB: serial: option: add MeiG Smart SRM815
* | afc952d5b1 Merge 43f4df339a ("bpf: Fix overloading of MEM_UNINIT's meaning") into android14-6.1-lts
|\|
| * 43f4df339a bpf: Fix overloading of MEM_UNINIT's meaning
* | 22d4625eb5 Merge 2a72b2ce9e ("bpf: Add MEM_WRITE attribute") into android14-6.1-lts
|\|
| * 2a72b2ce9e bpf: Add MEM_WRITE attribute
* | b3b3e04dad Merge 6bc6ee3111 ("dm-verity FEC: Fix RS FEC repair for roots unaligned to block size (take 2)") into android14-6.1-lts
|\|
| * 6bc6ee3111 dm-verity FEC: Fix RS FEC repair for roots unaligned to block size (take 2)
| * e3ce913a32 drm/amd/display: increase MAX_SURFACES to the value supported by hw
| * abe587a4eb ACPI: resource: Add Asus Vivobook X1504VAP to irq1_level_low_skip_override[]
| * 88b9cf8f11 ACPI: resource: Add TongFang GM5HG0A to irq1_edge_low_force_override[]
| * c21df31fc2 riscv: Fix sleeping in invalid context in die()
| * d0645e1114 thermal: of: fix OF node leak in of_thermal_zone_find()
| * f3d1e4062e drm/amd/display: Add check for granularity in dml ceil/floor helpers
| * 44ee863592 sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy
| * e919197fb8 sctp: sysctl: udp_port: avoid using current->nsproxy
| * 1b67030d39 sctp: sysctl: auth_enable: avoid using current->nsproxy
| * 4059507e34 sctp: sysctl: rto_min/max: avoid using current->nsproxy
| * 3cd0659deb sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy
* | c0e2451628 Merge c0dde4a52b ("dm-ebs: don't set the flag DM_TARGET_PASSES_INTEGRITY") into android14-6.1-lts
|/
* c0dde4a52b dm-ebs: don't set the flag DM_TARGET_PASSES_INTEGRITY
* 12771050b6 dm thin: make get_first_thin use rcu-safe list first function
* bb87b494ae cpuidle: riscv-sbi: fix device node release in early exit of for_each_possible_cpu
* 13e41c58c7 ksmbd: fix unexpectedly changed path in ksmbd_vfs_kern_path_locked
* aabe47cf5a afs: Fix the maximum cell name length
* ee7e40f7fb ksmbd: fix a missing return value check bug
* f05f5ab5e7 drm/mediatek: Add return value check when reading DPCD
* 4e6749237d drm/mediatek: Fix mode valid issue for dp
* e0ad4b014c drm/mediatek: Fix YCbCr422 color format issue for DP
* 21c501e66a drm/mediatek: stop selecting foreign drivers
* f0a2808767 net/mlx5: Fix variable not being completed when function returns
* a777e06dfc sched: sch_cake: add bounds checks to host bulk flow fairness counts
* 5552b4fd44 netfilter: conntrack: clamp maximum hashtable size to INT_MAX
* d470b92593 netfilter: nf_tables: imbalance in flowtable binding
* 636d7b95c2 tcp: Annotate data-race around sk->sk_mark in tcp_v4_send_reset
* faa8a33e86 Bluetooth: hci_sync: Fix not setting Random Address when required
* ecb1356a97 tls: Fix tls_sw_sendmsg error handling
* 657a87c2a0 ice: fix incorrect PHY settings for 100 GB/s
* 8a7b73f19f cxgb4: Avoid removal of uninserted tid
* b958283830 bnxt_en: Fix possible memory leak when hwrm_req_replace fails
* 2011749ca9 net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute
* 2d230410a9 tcp/dccp: allow a connection when sk_max_ack_backlog is zero
* c0b0d9ae36 tcp/dccp: complete lockless accesses to sk->sk_max_ack_backlog
* 0a5026be1a net: 802: LLC+SNAP OID:PID lookup on start of skb data
* 4589abf8c4 ieee802154: ca8210: Add missing check for kfifo_alloc() in ca8210_probe()
* f6dce4dc12 ASoC: mediatek: disable buffer pre-allocation
* 939d239fe8 scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity
* d23f2621fc exfat: fix the infinite loop in __exfat_free_cluster()
* 31beabd0f4 exfat: fix the infinite loop in exfat_readdir()
* 43c38c3b73 dm array: fix cursor index when skipping across block boundaries
* 956a74b22d dm array: fix unreleased btree blocks on closing a faulty array cursor
* e477021d25 dm array: fix releasing a faulty array block twice in dm_array_cursor_end
* 5af095cb86 jbd2: flush filesystem device before updating tail sequence
* 62834f5bf5 jbd2: increase IO priority for writing revoke records
* 397383db9c sched/task_stack: fix object_is_on_stack() for KASAN tagged pointers
* b79a0d1e9a bpf, sockmap: Fix race between element replace and close()
* e4b168c64d ceph: give up on paths longer than PATH_MAX

Change-Id: Ia18514bdd4d67e9850b55a4637d0fbe4a138658f
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-02-22 02:15:06 -08:00
Kyle Tso
52a41f0bf1 ANDROID: usb: typec: tcpci: Combine the parameters of set_auto_vbus_discharge_threshold
The change Ifdb1ba19f7147da286ea5e044e84dfb679050a94 ("FROMGIT: usb:
typec: tcpci: Prevent Sink disconnection before vPpsShutdown in SPR
PPS") breaks the KMI. Prevent the breakage by combining the parameters
"requested_vbus_voltage" and "pps_apdo_min_voltage" to a single u32
variable whose value is selected according to the values of parameter
"mode" and parameter "pps_active".

Bug: 388029777
Change-Id: I85872b9490561d248169bc8e008f3d907cc6c3c0
Signed-off-by: Kyle Tso <kyletso@google.com>
2025-02-21 11:14:03 -08:00
Kyle Tso
f84d5a5fad FROMGIT: usb: typec: tcpci: Prevent Sink disconnection before vPpsShutdown in SPR PPS
The Source can drop its output voltage to the minimum of the requested
PPS APDO voltage range when it is in Current Limit Mode. If this voltage
falls within the range of vPpsShutdown, the Source initiates a Hard
Reset and discharges Vbus. However, currently the Sink may disconnect
before the voltage reaches vPpsShutdown, leading to unexpected behavior.

Prevent premature disconnection by setting the Sink's disconnect
threshold to the minimum vPpsShutdown value. Additionally, consider the
voltage drop due to IR drop when calculating the appropriate threshold.
This ensures a robust and reliable interaction between the Source and
Sink during SPR PPS Current Limit Mode operation.

Fixes: 4288debeaa ("usb: typec: tcpci: Fix up sink disconnect thresholds for PD")
Cc: stable <stable@kernel.org>
Signed-off-by: Kyle Tso <kyletso@google.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Reviewed-by: Badhri Jagan Sridharan <badhri@google.com>
Link: https://lore.kernel.org/r/20250114142435.2093857-1-kyletso@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 388029777
(cherry picked from commit 4d27afbf256028a1f54363367f30efc8854433c3
 https: //git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git/
 usb-next)
Change-Id: Ifdb1ba19f7147da286ea5e044e84dfb679050a94
Signed-off-by: Kyle Tso <kyletso@google.com>
2025-02-21 11:14:03 -08:00
Jos Wang
17d426628c usb: typec: tcpm: set SRC_SEND_CAPABILITIES timeout to PD_T_SENDER_RESPONSE
commit 2eb3da037c2c20fa30bc502bc092479b2a1aaae2 upstream.

As PD2.0 spec ("8.3.3.2.3 PE_SRC_Send_Capabilities state"), after the
Source receives the GoodCRC Message from the Sink in response to the
Source_Capabilities message, it should start the SenderResponseTimer,
after the timer times out, the state machine transitions to the
HARD_RESET state.

Fixes: f0690a25a1 ("staging: typec: USB Type-C Port Manager (tcpm)")
Cc: stable@vger.kernel.org
Signed-off-by: Jos Wang <joswang@lenovo.com>
Reviewed-by: Badhri Jagan Sridharan <badhri@google.com>
Link: https://lore.kernel.org/r/20250105135245.7493-1-joswang1221@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-02-21 13:49:27 +01:00
Kyle Tso
64925ab46c usb: dwc3: core: Defer the probe until USB power supply ready
commit 66e0ea341a2a78d14336117f19763bd9be26d45d upstream.

Currently, DWC3 driver attempts to acquire the USB power supply only
once during the probe. If the USB power supply is not ready at that
time, the driver simply ignores the failure and continues the probe,
leading to permanent non-functioning of the gadget vbus_draw callback.

Address this problem by delaying the dwc3 driver initialization until
the USB power supply is registered.

Fixes: 6f0764b5ad ("usb: dwc3: add a power supply for current control")
Cc: stable <stable@kernel.org>
Signed-off-by: Kyle Tso <kyletso@google.com>
Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://lore.kernel.org/r/20250115044548.2701138-1-kyletso@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-02-21 13:49:27 +01:00
Thinh Nguyen
2c3e83538f usb: gadget: f_tcm: Fix Get/SetInterface return value
commit 3b997089903b909684114aca6f79d683e5c64a0e upstream.

Check to make sure that the GetInterface and SetInterface are for valid
interface. Return proper alternate setting number on GetInterface.

Fixes: 0b8b1a1fed ("usb: gadget: f_tcm: Provide support to get alternate setting in tcm function")
Cc: stable@vger.kernel.org
Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://lore.kernel.org/r/ffd91b4640945ea4d3b4f4091cf1abbdbd9cf4fc.1733876548.git.Thinh.Nguyen@synopsys.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-02-21 13:49:26 +01:00
Sean Rhodes
93a56dbe12 drivers/card_reader/rtsx_usb: Restore interrupt based detection
commit 235b630eda072d7e7b102ab346d6b8a2c028a772 upstream.

This commit reintroduces interrupt-based card detection previously
used in the rts5139 driver. This functionality was removed in commit
00d8521dcd ("staging: remove rts5139 driver code").

Reintroducing this mechanism fixes presence detection for certain card
readers, which with the current driver, will taken approximately 20
seconds to enter S3 as `mmc_rescan` has to be frozen.

Fixes: 00d8521dcd ("staging: remove rts5139 driver code")
Cc: stable@vger.kernel.org
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sean Rhodes <sean@starlabs.systems>
Link: https://lore.kernel.org/r/20241119085815.11769-1-sean@starlabs.systems
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-02-21 13:49:26 +01:00
Nikita Zhandarovich
e10b392a74 net: usb: rtl8150: enable basic endpoint checking
commit 90b7f2961798793275b4844348619b622f983907 upstream.

Syzkaller reports [1] encountering a common issue of utilizing a wrong
usb endpoint type during URB submitting stage. This, in turn, triggers
a warning shown below.

For now, enable simple endpoint checking (specifically, bulk and
interrupt eps, testing control one is not essential) to mitigate
the issue with a view to do other related cosmetic changes later,
if they are necessary.

[1] Syzkaller report:
usb 1-1: BOGUS urb xfer, pipe 3 != type 1
WARNING: CPU: 1 PID: 2586 at drivers/usb/core/urb.c:503 usb_submit_urb+0xe4b/0x1730 driv>
Modules linked in:
CPU: 1 UID: 0 PID: 2586 Comm: dhcpcd Not tainted 6.11.0-rc4-syzkaller-00069-gfc88bb11617>
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
RIP: 0010:usb_submit_urb+0xe4b/0x1730 drivers/usb/core/urb.c:503
Code: 84 3c 02 00 00 e8 05 e4 fc fc 4c 89 ef e8 fd 25 d7 fe 45 89 e0 89 e9 4c 89 f2 48 8>
RSP: 0018:ffffc9000441f740 EFLAGS: 00010282
RAX: 0000000000000000 RBX: ffff888112487a00 RCX: ffffffff811a99a9
RDX: ffff88810df6ba80 RSI: ffffffff811a99b6 RDI: 0000000000000001
RBP: 0000000000000003 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001
R13: ffff8881023bf0a8 R14: ffff888112452a20 R15: ffff888112487a7c
FS:  00007fc04eea5740(0000) GS:ffff8881f6300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f0a1de9f870 CR3: 000000010dbd0000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 rtl8150_open+0x300/0xe30 drivers/net/usb/rtl8150.c:733
 __dev_open+0x2d4/0x4e0 net/core/dev.c:1474
 __dev_change_flags+0x561/0x720 net/core/dev.c:8838
 dev_change_flags+0x8f/0x160 net/core/dev.c:8910
 devinet_ioctl+0x127a/0x1f10 net/ipv4/devinet.c:1177
 inet_ioctl+0x3aa/0x3f0 net/ipv4/af_inet.c:1003
 sock_do_ioctl+0x116/0x280 net/socket.c:1222
 sock_ioctl+0x22e/0x6c0 net/socket.c:1341
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:907 [inline]
 __se_sys_ioctl fs/ioctl.c:893 [inline]
 __x64_sys_ioctl+0x193/0x220 fs/ioctl.c:893
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc04ef73d49
...

This change has not been tested on real hardware.

Reported-and-tested-by: syzbot+d7e968426f644b567e31@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d7e968426f644b567e31
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
Link: https://patch.msgid.link/20250124093020.234642-1-n.zhandarovich@fintech.ru
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-02-21 13:49:26 +01:00
Joe Hattori
32814861f1 usb: dwc3-am62: Fix an OF node leak in phy_syscon_pll_refclk()
commit a266462b937beba065e934a563efe13dd246a164 upstream.

phy_syscon_pll_refclk() leaks an OF node obtained by
of_parse_phandle_with_fixed_args(), thus add an of_node_put() call.

Cc: stable <stable@kernel.org>
Fixes: e8784c0aec ("drivers: usb: dwc3: Add AM62 USB wrapper driver")
Signed-off-by: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://lore.kernel.org/r/20250109001638.70033-1-joe@pf.is.s.u-tokyo.ac.jp
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-02-21 13:49:26 +01:00
Michal Pecio
4ff18870af usb: xhci: Fix NULL pointer dereference on certain command aborts
commit 1e0a19912adb68a4b2b74fd77001c96cd83eb073 upstream.

If a command is queued to the final usable TRB of a ring segment, the
enqueue pointer is advanced to the subsequent link TRB and no further.
If the command is later aborted, when the abort completion is handled
the dequeue pointer is advanced to the first TRB of the next segment.

If no further commands are queued, xhci_handle_stopped_cmd_ring() sees
the ring pointers unequal and assumes that there is a pending command,
so it calls xhci_mod_cmd_timer() which crashes if cur_cmd was NULL.

Don't attempt timer setup if cur_cmd is NULL. The subsequent doorbell
ring likely is unnecessary too, but it's harmless. Leave it alone.

This is probably Bug 219532, but no confirmation has been received.

The issue has been independently reproduced and confirmed fixed using
a USB MCU programmed to NAK the Status stage of SET_ADDRESS forever.
Everything continued working normally after several prevented crashes.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=219532
Fixes: c311e391a7 ("xhci: rework command timeout and cancellation,")
CC: stable@vger.kernel.org
Signed-off-by: Michal Pecio <michal.pecio@gmail.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20241227120142.1035206-4-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-02-21 13:49:26 +01:00
Lianqin Hu
485997cc74 ALSA: usb-audio: Add delay quirk for iBasso DC07 Pro
commit d85fc52cbb9a719c8335d93a28d6a79d7acd419f upstream.

Audio control requests that sets sampling frequency sometimes fail on
this card. Adding delay between control messages eliminates that problem.

usb 1-1: New USB device found, idVendor=2fc6, idProduct=f0b7
usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 1-1: Product: iBasso DC07 Pro
usb 1-1: Manufacturer: iBasso
usb 1-1: SerialNumber: CTUA171130B

Signed-off-by: Lianqin Hu <hulianqin@vivo.com>
Cc: <stable@vger.kernel.org>
Link: https://patch.msgid.link/TYUPR06MB62174A48D04E09A37996DF84D2ED2@TYUPR06MB6217.apcprd06.prod.outlook.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-02-21 13:49:26 +01:00
Ricardo B. Marliere
2d0ce53755 ktest.pl: Check kernelrelease return in get_version
commit a4e17a8f239a545c463f8ec27db4ed6e74b31841 upstream.

In the case of a test that uses the special option ${KERNEL_VERSION} in one
of its settings but has no configuration available in ${OUTPUT_DIR}, for
example if it's a new empty directory, then the `make kernelrelease` call
will fail and the subroutine will chomp an empty string, silently. Fix that
by adding an empty configuration and retrying.

Cc: stable@vger.kernel.org
Cc: John Hawley <warthog9@eaglescrag.net>
Fixes: 5f9b6ced04 ("ktest: Bisecting, install modules, add logging")
Link: https://lore.kernel.org/20241205-ktest_kver_fallback-v2-1-869dae4c7777@suse.com
Signed-off-by: Ricardo B. Marliere <rbm@suse.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-02-21 13:49:26 +01:00
Tim Huang
df948b5ba6 drm/amd/display: fix double free issue during amdgpu module unload
commit 20b5a8f9f4670a8503aa9fa95ca632e77c6bf55d upstream.

Flexible endpoints use DIGs from available inflexible endpoints,
so only the encoders of inflexible links need to be freed.
Otherwise, a double free issue may occur when unloading the
amdgpu module.

[  279.190523] RIP: 0010:__slab_free+0x152/0x2f0
[  279.190577] Call Trace:
[  279.190580]  <TASK>
[  279.190582]  ? show_regs+0x69/0x80
[  279.190590]  ? die+0x3b/0x90
[  279.190595]  ? do_trap+0xc8/0xe0
[  279.190601]  ? do_error_trap+0x73/0xa0
[  279.190605]  ? __slab_free+0x152/0x2f0
[  279.190609]  ? exc_invalid_op+0x56/0x70
[  279.190616]  ? __slab_free+0x152/0x2f0
[  279.190642]  ? asm_exc_invalid_op+0x1f/0x30
[  279.190648]  ? dcn10_link_encoder_destroy+0x19/0x30 [amdgpu]
[  279.191096]  ? __slab_free+0x152/0x2f0
[  279.191102]  ? dcn10_link_encoder_destroy+0x19/0x30 [amdgpu]
[  279.191469]  kfree+0x260/0x2b0
[  279.191474]  dcn10_link_encoder_destroy+0x19/0x30 [amdgpu]
[  279.191821]  link_destroy+0xd7/0x130 [amdgpu]
[  279.192248]  dc_destruct+0x90/0x270 [amdgpu]
[  279.192666]  dc_destroy+0x19/0x40 [amdgpu]
[  279.193020]  amdgpu_dm_fini+0x16e/0x200 [amdgpu]
[  279.193432]  dm_hw_fini+0x26/0x40 [amdgpu]
[  279.193795]  amdgpu_device_fini_hw+0x24c/0x400 [amdgpu]
[  279.194108]  amdgpu_driver_unload_kms+0x4f/0x70 [amdgpu]
[  279.194436]  amdgpu_pci_remove+0x40/0x80 [amdgpu]
[  279.194632]  pci_device_remove+0x3a/0xa0
[  279.194638]  device_remove+0x40/0x70
[  279.194642]  device_release_driver_internal+0x1ad/0x210
[  279.194647]  driver_detach+0x4e/0xa0
[  279.194650]  bus_remove_driver+0x6f/0xf0
[  279.194653]  driver_unregister+0x33/0x60
[  279.194657]  pci_unregister_driver+0x44/0x90
[  279.194662]  amdgpu_exit+0x19/0x1f0 [amdgpu]
[  279.194939]  __do_sys_delete_module.isra.0+0x198/0x2f0
[  279.194946]  __x64_sys_delete_module+0x16/0x20
[  279.194950]  do_syscall_64+0x58/0x120
[  279.194954]  entry_SYSCALL_64_after_hwframe+0x6e/0x76
[  279.194980]  </TASK>

Reviewed-by: Rodrigo Siqueira <rodrigo.siqueira@amd.com>
Signed-off-by: Tim Huang <tim.huang@amd.com>
Reviewed-by: Roman Li <roman.li@amd.com>
Signed-off-by: Roman Li <roman.li@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-02-21 13:49:25 +01:00
Puranjay Mohan
2e44c96083 nvme: fix metadata handling in nvme-passthrough
commit 7c2fd76048e95dd267055b5f5e0a48e6e7c81fd9 upstream.

On an NVMe namespace that does not support metadata, it is possible to
send an IO command with metadata through io-passthru. This allows issues
like [1] to trigger in the completion code path.
nvme_map_user_request() doesn't check if the namespace supports metadata
before sending it forward. It also allows admin commands with metadata to
be processed as it ignores metadata when bdev == NULL and may report
success.

Reject an IO command with metadata when the NVMe namespace doesn't
support it and reject an admin command if it has metadata.

[1] https://lore.kernel.org/all/mb61pcylvnym8.fsf@amazon.com/

Suggested-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Puranjay Mohan <pjy@amazon.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Reviewed-by: Anuj Gupta <anuj20.g@samsung.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
[ Minor changes to make it work on 6.1 ]
Signed-off-by: Puranjay Mohan <pjy@amazon.com>
Signed-off-by: Hagar Hemdan <hagarhem@amazon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-02-21 13:49:25 +01:00
Pablo Neira Ayuso
2ac254343d netfilter: nf_tables: reject mismatching sum of field_len with set key length
commit 1b9335a8000fb70742f7db10af314104b6ace220 upstream.

The field length description provides the length of each separated key
field in the concatenation, each field gets rounded up to 32-bits to
calculate the pipapo rule width from pipapo_init(). The set key length
provides the total size of the key aligned to 32-bits.

Register-based arithmetics still allows for combining mismatching set
key length and field length description, eg. set key length 10 and field
description [ 5, 4 ] leading to pipapo width of 12.

Cc: stable@vger.kernel.org
Fixes: 3ce67e3793f4 ("netfilter: nf_tables: do not allow mismatch field size and set key length")
Reported-by: Noam Rathaus <noamr@ssd-disclosure.com>
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-02-21 13:49:25 +01:00
Parth Pancholi
256a57b2f7 kbuild: switch from lz4c to lz4 for compression
commit e397a603e49cc7c7c113fad9f55a09637f290c34 upstream.

Replace lz4c with lz4 for kernel image compression.
Although lz4 and lz4c are functionally similar, lz4c has been deprecated
upstream since 2018. Since as early as Ubuntu 16.04 and Fedora 25, lz4
and lz4c have been packaged together, making it safe to update the
requirement from lz4c to lz4.

Consequently, some distributions and build systems, such as OpenEmbedded,
have fully transitioned to using lz4. OpenEmbedded core adopted this
change in commit fe167e082cbd ("bitbake.conf: require lz4 instead of
lz4c"), causing compatibility issues when building the mainline kernel
in the latest OpenEmbedded environment, as seen in the errors below.

This change also updates the LZ4 compression commands to make it backward
compatible by replacing stdin and stdout with the '-' option, due to some
unclear reason, the stdout keyword does not work for lz4 and '-' works for
both. In addition, this modifies the legacy '-c1' with '-9' which is also
compatible with both. This fixes the mainline kernel build failures with
the latest master OpenEmbedded builds associated with the mentioned
compatibility issues.

LZ4     arch/arm/boot/compressed/piggy_data
/bin/sh: 1: lz4c: not found
...
...
ERROR: oe_runmake failed

Link: https://github.com/lz4/lz4/pull/553
Suggested-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Signed-off-by: Parth Pancholi <parth.pancholi@toradex.com>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Cc: Salvatore Bonaccorso <carnil@debian.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-02-21 13:49:25 +01:00
Chuck Lever
386aca2053 NFSD: Reset cb_seq_status after NFS4ERR_DELAY
commit 961b4b5e86bf56a2e4b567f81682defa5cba957e upstream.

I noticed that once an NFSv4.1 callback operation gets a
NFS4ERR_DELAY status on CB_SEQUENCE and then the connection is lost,
the callback client loops, resending it indefinitely.

The switch arm in nfsd4_cb_sequence_done() that handles
NFS4ERR_DELAY uses rpc_restart_call() to rearm the RPC state machine
for the retransmit, but that path does not call the rpc_prepare_call
callback again. Thus cb_seq_status is set to -10008 by the first
NFS4ERR_DELAY result, but is never set back to 1 for the retransmits.

nfsd4_cb_sequence_done() thinks it's getting nothing but a
long series of CB_SEQUENCE NFS4ERR_DELAY replies.

Fixes: 7ba6cad6c8 ("nfsd: New helper nfsd4_cb_sequence_done() for processing more cb errors")
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-02-21 13:49:25 +01:00
Daniel Lee
de605097eb f2fs: Introduce linear search for dentries
commit 91b587ba79e1b68bb718d12b0758dbcdab4e9cb7 upstream.

This patch addresses an issue where some files in case-insensitive
directories become inaccessible due to changes in how the kernel function,
utf8_casefold(), generates case-folded strings from the commit 5c26d2f1d3f5
("unicode: Don't special case ignorable code points").

F2FS uses these case-folded names to calculate hash values for locating
dentries and stores them on disk. Since utf8_casefold() can produce
different output across kernel versions, stored hash values and newly
calculated hash values may differ. This results in affected files no
longer being found via the hash-based lookup.

To resolve this, the patch introduces a linear search fallback.
If the initial hash-based search fails, F2FS will sequentially scan the
directory entries.

Fixes: 5c26d2f1d3f5 ("unicode: Don't special case ignorable code points")
Link: https://bugzilla.kernel.org/show_bug.cgi?id=219586
Signed-off-by: Daniel Lee <chullee@google.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Cc: Daniel Rosenberg <drosen@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-02-21 13:49:25 +01:00
Lin Yujun
9a1889f5fe hexagon: Fix unbalanced spinlock in die()
[ Upstream commit 03410e87563a122075c3721acc7d5510e41d8332 ]

die executes holding the spinlock of &die.lock and unlock
it after printing the oops message.
However in the code if the notify_die() returns NOTIFY_STOP
, die() exit with returning 1 but never unlocked the spinlock.

Fix this by adding spin_unlock_irq(&die.lock) before returning.

Fixes: cf9750bae2 ("Hexagon: Provide basic debugging and system trap support.")
Signed-off-by: Lin Yujun <linyujun809@huawei.com>
Link: https://lore.kernel.org/r/20230522025608.2515558-1-linyujun809@huawei.com
Signed-off-by: Brian Cain <bcain@quicinc.com>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-02-21 13:49:25 +01:00
Willem de Bruijn
1803219423 hexagon: fix using plain integer as NULL pointer warning in cmpxchg
[ Upstream commit 8a20030038742b9915c6d811a4e6c14b126cafb4 ]

Sparse reports

    net/ipv4/inet_diag.c:1511:17: sparse: sparse: Using plain integer as NULL pointer

Due to this code calling cmpxchg on a non-integer type
struct inet_diag_handler *

    return !cmpxchg((const struct inet_diag_handler**)&inet_diag_table[type],
                    NULL, h) ? 0 : -EEXIST;

While hexagon's cmpxchg assigns an integer value to a variable of this
type.

    __typeof__(*(ptr)) __oldval = 0;

Update this assignment to cast 0 to the correct type.

The original issue is easily reproduced at head with the below block,
and is absent after this change.

    make LLVM=1 ARCH=hexagon defconfig
    make C=1 LLVM=1 ARCH=hexagon net/ipv4/inet_diag.o

Fixes: 99a70aa051 ("Hexagon: Add processor and system headers")
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202411091538.PGSTqUBi-lkp@intel.com/
Signed-off-by: Willem de Bruijn <willemb@google.com>
Tested-by: Christian Gmeiner <cgmeiner@igalia.com>
Link: https://lore.kernel.org/r/20241203221736.282020-1-willemdebruijn.kernel@gmail.com
Signed-off-by: Brian Cain <bcain@quicinc.com>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-02-21 13:49:25 +01:00
Masahiro Yamada
bdaa726c15 kconfig: fix memory leak in sym_warn_unmet_dep()
[ Upstream commit a409fc1463d664002ea9bf700ae4674df03de111 ]

The string allocated in sym_warn_unmet_dep() is never freed, leading
to a memory leak when an unmet dependency is detected.

Fixes: f8f69dc0b4 ("kconfig: make unmet dependency warnings readable")
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Reviewed-by: Petr Vorel <pvorel@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-02-21 13:49:24 +01:00
Sergey Senozhatsky
261bafc8bf kconfig: WERROR unmet symbol dependency
[ Upstream commit 15d3f7664d2776c086f813f1efbfe2ae20a85e89 ]

When KCONFIG_WERROR env variable is set treat unmet direct
symbol dependency as a terminal condition (error).

Suggested-by: Stefan Reinauer <reinauer@google.com>
Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Stable-dep-of: a409fc1463d6 ("kconfig: fix memory leak in sym_warn_unmet_dep()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-02-21 13:49:24 +01:00
Masahiro Yamada
ccc65c06b1 kconfig: deduplicate code in conf_read_simple()
[ Upstream commit d854b4b21de684a16a7d6163c7b0e9c5ff8a09d3 ]

Kconfig accepts both "# CONFIG_FOO is not set" and "CONFIG_FOO=n" as
a valid input, but conf_read_simple() duplicates similar code to handle
them. Factor out the common code.

Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Stable-dep-of: a409fc1463d6 ("kconfig: fix memory leak in sym_warn_unmet_dep()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-02-21 13:49:24 +01:00
Masahiro Yamada
d2a7e49ae2 kconfig: remove unused code for S_DEF_AUTO in conf_read_simple()
[ Upstream commit 92d4fe0a48f1ab6cf20143dd0b376f4fe842854b ]

The 'else' arm here is unreachable in practical use cases.

include/config/auto.conf does not include "# CONFIG_... is not set"
line unless it is manually hacked.

Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Stable-dep-of: a409fc1463d6 ("kconfig: fix memory leak in sym_warn_unmet_dep()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-02-21 13:49:24 +01:00
Masahiro Yamada
fc4f353d8f kconfig: require a space after '#' for valid input
[ Upstream commit 4d137ab0107ead0f2590fc0314e627431e3b9e3f ]

Currently, when an input line starts with '#', (line + 2) is passed to
memcmp() without checking line[1].

It means that line[1] can be any arbitrary character. For example,
"#KCONFIG_FOO is not set" is accepted as valid input, functioning the
same as "# CONFIG_FOO is not set".

More importantly, this can potentially lead to a buffer overrun if
line[1] == '\0'. It occurs if the input only contains '#', as
(line + 2) points to an uninitialized buffer.

Check line[1], and skip the line if it is not a space.

Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Stable-dep-of: a409fc1463d6 ("kconfig: fix memory leak in sym_warn_unmet_dep()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-02-21 13:49:24 +01:00
Sergey Senozhatsky
328e41aae2 kconfig: add warn-unknown-symbols sanity check
[ Upstream commit 7cd343008b ]

Introduce KCONFIG_WARN_UNKNOWN_SYMBOLS environment variable,
which makes Kconfig warn about unknown config symbols.

This is especially useful for continuous kernel uprevs when
some symbols can be either removed or renamed between kernel
releases (which can go unnoticed otherwise).

By default KCONFIG_WARN_UNKNOWN_SYMBOLS generates warnings,
which are non-terminal. There is an additional environment
variable KCONFIG_WERROR that overrides this behaviour and
turns warnings into errors.

Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Stable-dep-of: a409fc1463d6 ("kconfig: fix memory leak in sym_warn_unmet_dep()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-02-21 13:49:24 +01:00
Masahiro Yamada
5aa5075b61 kconfig: fix file name in warnings when loading KCONFIG_DEFCONFIG_LIST
[ Upstream commit a314f52a0210730d0d556de76bb7388e76d4597d ]

Most 'make *config' commands use .config as the base configuration file.

When .config does not exist, Kconfig tries to load a file listed in
KCONFIG_DEFCONFIG_LIST instead.

However, since commit b75b0a819a ("kconfig: change defconfig_list
option to environment variable"), warning messages have displayed an
incorrect file name in such cases.

Below is a demonstration using Debian Trixie. While loading
/boot/config-6.12.9-amd64, the warning messages incorrectly show .config
as the file name.

With this commit, the correct file name is displayed in warnings.

[Before]

  $ rm -f .config
  $ make config
  #
  # using defaults found in /boot/config-6.12.9-amd64
  #
  .config:6804:warning: symbol value 'm' invalid for FB_BACKLIGHT
  .config:9895:warning: symbol value 'm' invalid for ANDROID_BINDER_IPC

[After]

  $ rm -f .config
  $ make config
  #
  # using defaults found in /boot/config-6.12.9-amd64
  #
  /boot/config-6.12.9-amd64:6804:warning: symbol value 'm' invalid for FB_BACKLIGHT
  /boot/config-6.12.9-amd64:9895:warning: symbol value 'm' invalid for ANDROID_BINDER_IPC

Fixes: b75b0a819a ("kconfig: change defconfig_list option to environment variable")
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-02-21 13:49:24 +01:00