Commit Graph

41486 Commits

Author SHA1 Message Date
Greg Kroah-Hartman
9154eb052f Revert "Revert "sched/psi: Stop relying on timer_pending() for poll_work rescheduling""
This reverts commit 02bdd918e6.  It was
perserving the ABI, but that is not needed anymore at this point in
time.

Change-Id: I486cebed8ec0f91985d117eed3e1069d6160e267
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-03-15 16:41:08 +00:00
Greg Kroah-Hartman
5b483d8a04 Merge changes I95ce33fb,I03723a9f,I4b1cf7f1,I6e17c9b3,I446172f8, ... into android14-6.1
* changes:
  Merge 6.1.17 into android14-6.1
  ANDROID: update abi definition due to io_uring changes.
  UPSTREAM: Revert "blk-cgroup: dropping parent refcount after pd_free_fn() is done"
  UPSTREAM: Revert "blk-cgroup: synchronize pd_free_fn() from blkg_free_workfn() and blkcg_deactivate_policy()"
  Revert "kobject: modify kobject_get_path() to take a const *"
  Revert "wait: Return number of exclusive waiters awaken"
  Revert "sbitmap: Use single per-bitmap counting to wake up queued tags"
  Revert "sbitmap: correct wake_batch recalculation to avoid potential IO hung"
  Revert "sbitmap: Advance the queue index before waking up a queue"
  Revert "sbitmap: Try each queue to wake up at least one waiter"
  Revert "HID: retain initial quirks set up when creating HID devices"
  Merge 6.1.16 into android14-6.1
2023-03-14 17:38:04 +00:00
Sangmoon Kim
c5ea4db533 ANDROID: power: add vendor hooks for try_to_freeze fail
Add hooks to gather data of unfrozen tasks and summarize it
with other information.

Bug: 273189923

Signed-off-by: Sangmoon Kim <sangmoon.kim@samsung.com>
Change-Id: I61da3d253bd9959c6f06e09c9a35c4b242cedafe
(cherry picked from commit 2232e3fc85)
2023-03-13 20:34:25 +00:00
Sangmoon Kim
8635a09118 ANDROID: softlockup: add vendor hook for a softlockup task
Add hook to gather data of softlockup and summarize it with
other information.

Bug: 273189923

Signed-off-by: Sangmoon Kim <sangmoon.kim@samsung.com>
Change-Id: I5263bbd573c3fa4b4c981ac26c943721ce09506d
(cherry picked from commit 5cc613a916)
2023-03-13 20:34:25 +00:00
Greg Kroah-Hartman
2b47e2bee0 Revert "wait: Return number of exclusive waiters awaken"
This reverts commit d710b1e91b.

It breaks the ABI right now, but will be brought back at the next ABI
break as it will be needed for Android systems.

Bug: 161946584
Change-Id: I1dcf1f311ce25059466d000543b020fb33d237b4
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-03-13 18:51:55 +00:00
Greg Kroah-Hartman
2cb73a87e4 Merge 6.1.16 into android14-6.1
Changes in 6.1.16
	HID: asus: use spinlock to protect concurrent accesses
	HID: asus: use spinlock to safely schedule workers
	powerpc/mm: Rearrange if-else block to avoid clang warning
	ata: ahci: Revert "ata: ahci: Add Tiger Lake UP{3,4} AHCI controller"
	ARM: OMAP2+: Fix memory leak in realtime_counter_init()
	arm64: dts: qcom: qcs404: use symbol names for PCIe resets
	arm64: dts: qcom: msm8996-tone: Fix USB taking 6 minutes to wake up
	arm64: dts: qcom: sm8150-kumano: Panel framebuffer is 2.5k instead of 4k
	arm64: dts: qcom: sm6350: Fix up the ramoops node
	arm64: dts: qcom: sm6125: Reorder HSUSB PHY clocks to match bindings
	arm64: dts: qcom: sm6125-seine: Clean up gpio-keys (volume down)
	arm64: dts: imx8m: Align SoC unique ID node unit address
	ARM: zynq: Fix refcount leak in zynq_early_slcr_init
	arm64: dts: mediatek: mt8195: Add power domain to U3PHY1 T-PHY
	arm64: dts: mediatek: mt8183: Fix systimer 13 MHz clock description
	arm64: dts: mediatek: mt8192: Fix systimer 13 MHz clock description
	arm64: dts: mediatek: mt8195: Fix systimer 13 MHz clock description
	arm64: dts: mediatek: mt8186: Fix systimer 13 MHz clock description
	arm64: dts: qcom: sdm845-db845c: fix audio codec interrupt pin name
	x86/acpi/boot: Do not register processors that cannot be onlined for x2APIC
	arm64: dts: qcom: sc7180: correct SPMI bus address cells
	arm64: dts: qcom: sc7280: correct SPMI bus address cells
	arm64: dts: qcom: sc8280xp: correct SPMI bus address cells
	arm64: dts: qcom: sc8280xp: Vote for CX in USB controllers
	arm64: dts: meson-gxl: jethub-j80: Fix WiFi MAC address node
	arm64: dts: meson-gxl: jethub-j80: Fix Bluetooth MAC node name
	arm64: dts: meson-axg: jethub-j1xx: Fix MAC address node names
	arm64: dts: meson-gx: Fix Ethernet MAC address unit name
	arm64: dts: meson-g12a: Fix internal Ethernet PHY unit name
	arm64: dts: meson-gx: Fix the SCPI DVFS node name and unit address
	cpuidle, intel_idle: Fix CPUIDLE_FLAG_IRQ_ENABLE *again*
	arm64: dts: ti: k3-am62: Enable SPI nodes at the board level
	arm64: dts: ti: k3-am62-main: Fix clocks for McSPI
	arm64: tegra: Fix duplicate regulator on Jetson TX1
	arm64: dts: msm8992-bullhead: add memory hole region
	arm64: dts: qcom: msm8992-bullhead: Fix cont_splash_mem size
	arm64: dts: qcom: msm8992-bullhead: Disable dfps_data_mem
	arm64: dts: qcom: ipq8074: correct USB3 QMP PHY-s clock output names
	arm64: dts: qcom: ipq8074: fix Gen2 PCIe QMP PHY
	arm64: dts: qcom: ipq8074: fix Gen3 PCIe QMP PHY
	arm64: dts: qcom: ipq8074: correct Gen2 PCIe ranges
	arm64: dts: qcom: ipq8074: fix Gen3 PCIe node
	arm64: dts: qcom: ipq8074: correct PCIe QMP PHY output clock names
	arm64: dts: meson: remove CPU opps below 1GHz for G12A boards
	ARM: OMAP1: call platform_device_put() in error case in omap1_dm_timer_init()
	arm64: dts: mediatek: mt8192: Mark scp_adsp clock as broken
	ARM: bcm2835_defconfig: Enable the framebuffer
	ARM: s3c: fix s3c64xx_set_timer_source prototype
	arm64: dts: ti: k3-j7200: Fix wakeup pinmux range
	ARM: dts: exynos: correct wr-active property in Exynos3250 Rinato
	ARM: imx: Call ida_simple_remove() for ida_simple_get
	arm64: dts: amlogic: meson-gx: fix SCPI clock dvfs node name
	arm64: dts: amlogic: meson-axg: fix SCPI clock dvfs node name
	arm64: dts: amlogic: meson-gx: add missing SCPI sensors compatible
	arm64: dts: amlogic: meson-axg-jethome-jethub-j1xx: fix supply name of USB controller node
	arm64: dts: amlogic: meson-gxl-s905d-sml5442tw: drop invalid clock-names property
	arm64: dts: amlogic: meson-gx: add missing unit address to rng node name
	arm64: dts: amlogic: meson-gxl-s905w-jethome-jethub-j80: fix invalid rtc node name
	arm64: dts: amlogic: meson-axg-jethome-jethub-j1xx: fix invalid rtc node name
	arm64: dts: amlogic: meson-gxl: add missing unit address to eth-phy-mux node name
	arm64: dts: amlogic: meson-gx-libretech-pc: fix update button name
	arm64: dts: amlogic: meson-sm1-bananapi-m5: fix adc keys node names
	arm64: dts: amlogic: meson-gxl-s905d-phicomm-n1: fix led node name
	arm64: dts: amlogic: meson-gxbb-kii-pro: fix led node name
	arm64: dts: amlogic: meson-sm1-odroid-hc4: fix active fan thermal trip
	locking/rwsem: Disable preemption in all down_read*() and up_read() code paths
	arm64: dts: renesas: beacon-renesom: Fix gpio expander reference
	arm64: dts: meson: radxa-zero: allow usb otg mode
	arm64: dts: meson: bananapi-m5: switch VDDIO_C pin to OPEN_DRAIN
	ARM: dts: sun8i: nanopi-duo2: Fix regulator GPIO reference
	ublk_drv: remove nr_aborted_queues from ublk_device
	ublk_drv: don't probe partitions if the ubq daemon isn't trusted
	ARM: dts: imx7s: correct iomuxc gpr mux controller cells
	sbitmap: remove redundant check in __sbitmap_queue_get_batch
	sbitmap: Use single per-bitmap counting to wake up queued tags
	sbitmap: correct wake_batch recalculation to avoid potential IO hung
	arm64: dts: mt8195: Fix CPU map for single-cluster SoC
	arm64: dts: mt8192: Fix CPU map for single-cluster SoC
	arm64: dts: mt8186: Fix CPU map for single-cluster SoC
	arm64: dts: mediatek: mt7622: Add missing pwm-cells to pwm node
	arm64: dts: mediatek: mt8186: Fix watchdog compatible
	arm64: dts: mediatek: mt8195: Fix watchdog compatible
	arm64: dts: mediatek: mt7986: Fix watchdog compatible
	ARM: dts: stm32: Update part number NVMEM description on stm32mp131
	blk-mq: avoid sleep in blk_mq_alloc_request_hctx
	blk-mq: remove stale comment for blk_mq_sched_mark_restart_hctx
	blk-mq: wait on correct sbitmap_queue in blk_mq_mark_tag_wait
	blk-mq: Fix potential io hung for shared sbitmap per tagset
	blk-mq: correct stale comment of .get_budget
	arm64: dts: qcom: msm8996: support using GPLL0 as kryocc input
	arm64: dts: qcom: msm8996 switch from RPM_SMD_BB_CLK1 to RPM_SMD_XO_CLK_SRC
	arm64: dts: qcom: sm8350: drop incorrect cells from serial
	arm64: dts: qcom: sm8450: drop incorrect cells from serial
	arm64: dts: qcom: msm8992-lg-bullhead: Correct memory overlaps with the SMEM and MPSS memory regions
	arm64: dts: qcom: msm8953: correct TLMM gpio-ranges
	arm64: dts: qcom: msm8992-*: Fix up comments
	arm64: dts: qcom: msm8992-lg-bullhead: Enable regulators
	s390/dasd: Fix potential memleak in dasd_eckd_init()
	sched/rt: pick_next_rt_entity(): check list_entry
	perf/x86/intel/ds: Fix the conversion from TSC to perf time
	x86/perf/zhaoxin: Add stepping check for ZXC
	KEYS: asymmetric: Fix ECDSA use via keyctl uapi
	block: ublk: check IO buffer based on flag need_get_data
	arm64: dts: qcom: pmk8350: Specify PBS register for PON
	arm64: dts: qcom: pmk8350: Use the correct PON compatible
	erofs: relinquish volume with mutex held
	block: sync mixed merged request's failfast with 1st bio's
	block: Fix io statistics for cgroup in throttle path
	block: bio-integrity: Copy flags when bio_integrity_payload is cloned
	block: use proper return value from bio_failfast()
	wifi: mt76: mt7915: add missing of_node_put()
	wifi: mt76: mt7921s: fix slab-out-of-bounds access in sdio host
	wifi: mt76: mt7915: check return value before accessing free_block_num
	wifi: mt76: mt7915: drop always true condition of __mt7915_reg_addr()
	wifi: mt76: mt7915: fix unintended sign extension of mt7915_hw_queue_read()
	wifi: mt76: fix coverity uninit_use_in_call in mt76_connac2_reverse_frag0_hdr_trans()
	wifi: rsi: Fix memory leak in rsi_coex_attach()
	wifi: rtlwifi: rtl8821ae: don't call kfree_skb() under spin_lock_irqsave()
	wifi: rtlwifi: rtl8188ee: don't call kfree_skb() under spin_lock_irqsave()
	wifi: rtlwifi: rtl8723be: don't call kfree_skb() under spin_lock_irqsave()
	wifi: iwlegacy: common: don't call dev_kfree_skb() under spin_lock_irqsave()
	wifi: libertas: fix memory leak in lbs_init_adapter()
	wifi: rtl8xxxu: don't call dev_kfree_skb() under spin_lock_irqsave()
	wifi: rtw89: 8852c: rfk: correct DACK setting
	wifi: rtw89: 8852c: rfk: correct DPK settings
	wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit()
	libbpf: Fix btf__align_of() by taking into account field offsets
	wifi: ipw2x00: don't call dev_kfree_skb() under spin_lock_irqsave()
	wifi: ipw2200: fix memory leak in ipw_wdev_init()
	wifi: wilc1000: fix potential memory leak in wilc_mac_xmit()
	wifi: wilc1000: add missing unregister_netdev() in wilc_netdev_ifc_init()
	wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit()
	wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid()
	wifi: libertas_tf: don't call kfree_skb() under spin_lock_irqsave()
	wifi: libertas: if_usb: don't call kfree_skb() under spin_lock_irqsave()
	wifi: libertas: main: don't call kfree_skb() under spin_lock_irqsave()
	wifi: libertas: cmdresp: don't call kfree_skb() under spin_lock_irqsave()
	wifi: wl3501_cs: don't call kfree_skb() under spin_lock_irqsave()
	libbpf: Fix invalid return address register in s390
	crypto: x86/ghash - fix unaligned access in ghash_setkey()
	ACPICA: Drop port I/O validation for some regions
	genirq: Fix the return type of kstat_cpu_irqs_sum()
	rcu-tasks: Improve comments explaining tasks_rcu_exit_srcu purpose
	rcu-tasks: Remove preemption disablement around srcu_read_[un]lock() calls
	rcu-tasks: Fix synchronize_rcu_tasks() VS zap_pid_ns_processes()
	lib/mpi: Fix buffer overrun when SG is too long
	crypto: ccp - Avoid page allocation failure warning for SEV_GET_ID2
	platform/chrome: cros_ec_typec: Update port DP VDO
	ACPICA: nsrepair: handle cases without a return value correctly
	selftests/xsk: print correct payload for packet dump
	selftests/xsk: print correct error codes when exiting
	arm64/cpufeature: Fix field sign for DIT hwcap detection
	kselftest/arm64: Fix syscall-abi for systems without 128 bit SME
	workqueue: Protects wq_unbound_cpumask with wq_pool_attach_mutex
	s390/early: fix sclp_early_sccb variable lifetime
	s390/vfio-ap: fix an error handling path in vfio_ap_mdev_probe_queue()
	x86/signal: Fix the value returned by strict_sas_size()
	thermal/drivers/tsens: Drop msm8976-specific defines
	thermal/drivers/tsens: Sort out msm8976 vs msm8956 data
	thermal/drivers/tsens: fix slope values for msm8939
	thermal/drivers/tsens: limit num_sensors to 9 for msm8939
	wifi: rtw89: fix potential leak in rtw89_append_probe_req_ie()
	wifi: rtw89: Add missing check for alloc_workqueue
	wifi: rtl8xxxu: Fix memory leaks with RTL8723BU, RTL8192EU
	wifi: orinoco: check return value of hermes_write_wordrec()
	thermal/drivers/imx_sc_thermal: Drop empty platform remove function
	thermal/drivers/imx_sc_thermal: Fix the loop condition
	wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no callback function
	wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails
	wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback()
	wifi: ath11k: Fix memory leak in ath11k_peer_rx_frag_setup
	wifi: cfg80211: Fix extended KCK key length check in nl80211_set_rekey_data()
	ACPI: battery: Fix missing NUL-termination with large strings
	selftests/bpf: Fix build errors if CONFIG_NF_CONNTRACK=m
	crypto: ccp - Failure on re-initialization due to duplicate sysfs filename
	crypto: essiv - Handle EBUSY correctly
	crypto: seqiv - Handle EBUSY correctly
	powercap: fix possible name leak in powercap_register_zone()
	x86/microcode: Add a parameter to microcode_check() to store CPU capabilities
	x86/microcode: Check CPU capabilities after late microcode update correctly
	x86/microcode: Adjust late loading result reporting message
	selftests/bpf: Use consistent build-id type for liburandom_read.so
	selftests/bpf: Fix vmtest static compilation error
	crypto: xts - Handle EBUSY correctly
	leds: led-class: Add missing put_device() to led_put()
	s390/bpf: Add expoline to tail calls
	wifi: iwlwifi: mei: fix compilation errors in rfkill()
	kselftest/arm64: Fix enumeration of systems without 128 bit SME
	can: rcar_canfd: Fix R-Car V3U GAFLCFG field accesses
	selftests/bpf: Initialize tc in xdp_synproxy
	crypto: ccp - Flush the SEV-ES TMR memory before giving it to firmware
	bpftool: profile online CPUs instead of possible
	wifi: mt76: mt7915: call mt7915_mcu_set_thermal_throttling() only after init_work
	wifi: mt76: mt7915: fix memory leak in mt7915_mcu_exit
	wifi: mt76: mt7915: fix WED TxS reporting
	wifi: mt76: add memory barrier to SDIO queue kick
	wifi: mt76: mt7921: fix error code of return in mt7921_acpi_read
	net/mlx5: Enhance debug print in page allocation failure
	irqchip: Fix refcount leak in platform_irqchip_probe
	irqchip/alpine-msi: Fix refcount leak in alpine_msix_init_domains
	irqchip/irq-mvebu-gicp: Fix refcount leak in mvebu_gicp_probe
	irqchip/ti-sci: Fix refcount leak in ti_sci_intr_irq_domain_probe
	s390/mem_detect: fix detect_memory() error handling
	s390/vmem: fix empty page tables cleanup under KASAN
	s390/boot: cleanup decompressor header files
	s390/mem_detect: rely on diag260() if sclp_early_get_memsize() fails
	s390/boot: fix mem_detect extended area allocation
	net: add sock_init_data_uid()
	tun: tun_chr_open(): correctly initialize socket uid
	tap: tap_open(): correctly initialize socket uid
	OPP: fix error checking in opp_migrate_dentry()
	cpufreq: davinci: Fix clk use after free
	Bluetooth: hci_conn: Refactor hci_bind_bis() since it always succeeds
	Bluetooth: L2CAP: Fix potential user-after-free
	Bluetooth: hci_qca: get wakeup status from serdev device handle
	net: ipa: generic command param fix
	s390: vfio-ap: tighten the NIB validity check
	s390/ap: fix status returned by ap_aqic()
	s390/ap: fix status returned by ap_qact()
	libbpf: Fix alen calculation in libbpf_nla_dump_errormsg()
	xen/grant-dma-iommu: Implement a dummy probe_device() callback
	rds: rds_rm_zerocopy_callback() correct order for list_add_tail()
	crypto: rsa-pkcs1pad - Use akcipher_request_complete
	m68k: /proc/hardware should depend on PROC_FS
	RISC-V: time: initialize hrtimer based broadcast clock event device
	clocksource/drivers/riscv: Patch riscv_clock_next_event() jump before first use
	wifi: iwl3945: Add missing check for create_singlethread_workqueue
	wifi: iwl4965: Add missing check for create_singlethread_workqueue()
	wifi: mwifiex: fix loop iterator in mwifiex_update_ampdu_txwinsize()
	selftests/bpf: Fix out-of-srctree build
	ACPI: resource: Add IRQ overrides for MAINGEAR Vector Pro 2 models
	ACPI: resource: Do IRQ override on all TongFang GMxRGxx
	crypto: octeontx2 - Fix objects shared between several modules
	crypto: crypto4xx - Call dma_unmap_page when done
	wifi: mac80211: move color collision detection report in a delayed work
	wifi: mac80211: make rate u32 in sta_set_rate_info_rx()
	wifi: mac80211: fix non-MLO station association
	wifi: mac80211: Don't translate MLD addresses for multicast
	wifi: mac80211: avoid u32_encode_bits() warning
	wifi: mac80211: fix off-by-one link setting
	tools/lib/thermal: Fix thermal_sampling_exit()
	thermal/drivers/hisi: Drop second sensor hi3660
	selftests/bpf: Fix map_kptr test.
	wifi: mac80211: pass 'sta' to ieee80211_rx_data_set_sta()
	bpf: Zeroing allocated object from slab in bpf memory allocator
	selftests/bpf: Fix xdp_do_redirect on s390x
	can: esd_usb: Move mislocated storage of SJA1000_ECC_SEG bits in case of a bus error
	can: esd_usb: Make use of can_change_state() and relocate checking skb for NULL
	xsk: check IFF_UP earlier in Tx path
	LoongArch, bpf: Use 4 instructions for function address in JIT
	bpf: Fix global subprog context argument resolution logic
	irqchip/irq-brcmstb-l2: Set IRQ_LEVEL for level triggered interrupts
	irqchip/irq-bcm7120-l2: Set IRQ_LEVEL for level triggered interrupts
	net/smc: fix potential panic dues to unprotected smc_llc_srv_add_link()
	net/smc: fix application data exception
	selftests/net: Interpret UDP_GRO cmsg data as an int value
	l2tp: Avoid possible recursive deadlock in l2tp_tunnel_register()
	net: bcmgenet: fix MoCA LED control
	net: lan966x: Fix possible deadlock inside PTP
	net/mlx4_en: Introduce flexible array to silence overflow warning
	selftest: fib_tests: Always cleanup before exit
	sefltests: netdevsim: wait for devlink instance after netns removal
	drm: Fix potential null-ptr-deref due to drmm_mode_config_init()
	drm/fourcc: Add missing big-endian XRGB1555 and RGB565 formats
	drm/bridge: ti-sn65dsi83: Fix delay after reset deassert to match spec
	drm: mxsfb: DRM_IMX_LCDIF should depend on ARCH_MXC
	drm: mxsfb: DRM_MXSFB should depend on ARCH_MXS || ARCH_MXC
	drm/bridge: megachips: Fix error handling in i2c_register_driver()
	drm/vkms: Fix memory leak in vkms_init()
	drm/vkms: Fix null-ptr-deref in vkms_release()
	drm/vc4: dpi: Fix format mapping for RGB565
	drm: tidss: Fix pixel format definition
	gpu: ipu-v3: common: Add of_node_put() for reference returned by of_graph_get_port_by_id()
	drm/vc4: drop all currently held locks if deadlock happens
	hwmon: (ftsteutates) Fix scaling of measurements
	drm/msm/dpu: check for null return of devm_kzalloc() in dpu_writeback_init()
	drm/msm/hdmi: Add missing check for alloc_ordered_workqueue
	pinctrl: qcom: pinctrl-msm8976: Correct function names for wcss pins
	pinctrl: stm32: Fix refcount leak in stm32_pctrl_get_irq_domain
	pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups
	drm/vc4: hvs: Set AXI panic modes
	drm/vc4: hvs: SCALER_DISPBKGND_AUTOHS is only valid on HVS4
	drm/vc4: hvs: Correct interrupt masking bit assignment for HVS5
	drm/vc4: hvs: Fix colour order for xRGB1555 on HVS5
	drm/vc4: hdmi: Correct interlaced timings again
	drm/msm: clean event_thread->worker in case of an error
	drm/panel-edp: fix name for IVO product id 854b
	scsi: qla2xxx: Fix exchange oversubscription
	scsi: qla2xxx: Fix exchange oversubscription for management commands
	scsi: qla2xxx: edif: Fix clang warning
	ASoC: fsl_sai: initialize is_dsp_mode flag
	drm/bridge: tc358767: Set default CLRSIPO count
	drm/msm/adreno: Fix null ptr access in adreno_gpu_cleanup()
	ALSA: hda/ca0132: minor fix for allocation size
	drm/amdgpu: Use the sched from entity for amdgpu_cs trace
	drm/msm/gem: Add check for kmalloc
	drm/msm/dpu: Disallow unallocated resources to be returned
	drm/bridge: lt9611: fix sleep mode setup
	drm/bridge: lt9611: fix HPD reenablement
	drm/bridge: lt9611: fix polarity programming
	drm/bridge: lt9611: fix programming of video modes
	drm/bridge: lt9611: fix clock calculation
	drm/bridge: lt9611: pass a pointer to the of node
	regulator: tps65219: use IS_ERR() to detect an error pointer
	drm/mipi-dsi: Fix byte order of 16-bit DCS set/get brightness
	drm: exynos: dsi: Fix MIPI_DSI*_NO_* mode flags
	drm/msm/dsi: Allow 2 CTRLs on v2.5.0
	scsi: ufs: exynos: Fix DMA alignment for PAGE_SIZE != 4096
	drm/msm/dpu: sc7180: add missing WB2 clock control
	drm/msm: use strscpy instead of strncpy
	drm/msm/dpu: Add check for cstate
	drm/msm/dpu: Add check for pstates
	drm/msm/mdp5: Add check for kzalloc
	habanalabs: bugs fixes in timestamps buff alloc
	pinctrl: bcm2835: Remove of_node_put() in bcm2835_of_gpio_ranges_fallback()
	pinctrl: mediatek: Initialize variable pullen and pullup to zero
	pinctrl: mediatek: Initialize variable *buf to zero
	gpu: host1x: Fix mask for syncpoint increment register
	gpu: host1x: Don't skip assigning syncpoints to channels
	drm/tegra: firewall: Check for is_addr_reg existence in IMM check
	pinctrl: renesas: rzg2l: Fix configuring the GPIO pins as interrupts
	drm/msm/dpu: set pdpu->is_rt_pipe early in dpu_plane_sspp_atomic_update()
	drm/mediatek: dsi: Reduce the time of dsi from LP11 to sending cmd
	drm/mediatek: Use NULL instead of 0 for NULL pointer
	drm/mediatek: Drop unbalanced obj unref
	drm/mediatek: mtk_drm_crtc: Add checks for devm_kcalloc
	drm/mediatek: Clean dangling pointer on bind error path
	ASoC: soc-compress.c: fixup private_data on snd_soc_new_compress()
	dt-bindings: display: mediatek: Fix the fallback for mediatek,mt8186-disp-ccorr
	gpio: vf610: connect GPIO label to dev name
	ASoC: topology: Properly access value coming from topology file
	spi: dw_bt1: fix MUX_MMIO dependencies
	ASoC: mchp-spdifrx: fix controls which rely on rsr register
	ASoC: mchp-spdifrx: fix return value in case completion times out
	ASoC: mchp-spdifrx: fix controls that works with completion mechanism
	ASoC: mchp-spdifrx: disable all interrupts in mchp_spdifrx_dai_remove()
	dm: improve shrinker debug names
	regmap: apply reg_base and reg_downshift for single register ops
	ASoC: rsnd: fixup #endif position
	ASoC: mchp-spdifrx: Fix uninitialized use of mr in mchp_spdifrx_hw_params()
	ASoC: dt-bindings: meson: fix gx-card codec node regex
	regulator: tps65219: use generic set_bypass()
	hwmon: (asus-ec-sensors) add missing mutex path
	hwmon: (ltc2945) Handle error case in ltc2945_value_store
	ALSA: hda: Fix the control element identification for multiple codecs
	drm/amdgpu: fix enum odm_combine_mode mismatch
	scsi: mpt3sas: Fix a memory leak
	scsi: aic94xx: Add missing check for dma_map_single()
	HID: multitouch: Add quirks for flipped axes
	HID: retain initial quirks set up when creating HID devices
	ASoC: qcom: q6apm-lpass-dai: unprepare stream if its already prepared
	ASoC: qcom: q6apm-dai: fix race condition while updating the position pointer
	ASoC: qcom: q6apm-dai: Add SNDRV_PCM_INFO_BATCH flag
	ASoC: codecs: lpass: register mclk after runtime pm
	ASoC: codecs: lpass: fix incorrect mclk rate
	drm/amd/display: don't call dc_interrupt_set() for disabled crtcs
	HID: logitech-hidpp: Hard-code HID++ 1.0 fast scroll support
	spi: bcm63xx-hsspi: Fix multi-bit mode setting
	hwmon: (mlxreg-fan) Return zero speed for broken fan
	ASoC: tlv320adcx140: fix 'ti,gpio-config' DT property init
	dm: remove flush_scheduled_work() during local_exit()
	nfs4trace: fix state manager flag printing
	NFS: fix disabling of swap
	spi: synquacer: Fix timeout handling in synquacer_spi_transfer_one()
	ASoC: soc-dapm.h: fixup warning struct snd_pcm_substream not declared
	HID: bigben: use spinlock to protect concurrent accesses
	HID: bigben_worker() remove unneeded check on report_field
	HID: bigben: use spinlock to safely schedule workers
	hid: bigben_probe(): validate report count
	ALSA: hda/hdmi: Register with vga_switcheroo on Dual GPU Macbooks
	drm/shmem-helper: Fix locking for drm_gem_shmem_get_pages_sgt()
	NFSD: enhance inter-server copy cleanup
	NFSD: fix leaked reference count of nfsd4_ssc_umount_item
	nfsd: fix race to check ls_layouts
	nfsd: clean up potential nfsd_file refcount leaks in COPY codepath
	NFSD: fix problems with cleanup on errors in nfsd4_copy
	nfsd: fix courtesy client with deny mode handling in nfs4_upgrade_open
	nfsd: don't fsync nfsd_files on last close
	NFSD: copy the whole verifier in nfsd_copy_write_verifier
	cifs: Fix lost destroy smbd connection when MR allocate failed
	cifs: Fix warning and UAF when destroy the MR list
	cifs: use tcon allocation functions even for dummy tcon
	gfs2: jdata writepage fix
	perf llvm: Fix inadvertent file creation
	leds: led-core: Fix refcount leak in of_led_get()
	leds: is31fl319x: Wrap mutex_destroy() for devm_add_action_or_rest()
	leds: simatic-ipc-leds-gpio: Make sure we have the GPIO providing driver
	tools/tracing/rtla: osnoise_hist: use total duration for average calculation
	perf inject: Use perf_data__read() for auxtrace
	perf intel-pt: Do not try to queue auxtrace data on pipe
	perf test bpf: Skip test if kernel-debuginfo is not present
	perf tools: Fix auto-complete on aarch64
	sparc: allow PM configs for sparc32 COMPILE_TEST
	selftests: find echo binary to use -ne options
	selftests/ftrace: Fix bash specific "==" operator
	selftests: use printf instead of echo -ne
	perf record: Fix segfault with --overwrite and --max-size
	printf: fix errname.c list
	perf tests stat_all_metrics: Change true workload to sleep workload for system wide check
	objtool: add UACCESS exceptions for __tsan_volatile_read/write
	mfd: cs5535: Don't build on UML
	mfd: pcf50633-adc: Fix potential memleak in pcf50633_adc_async_read()
	dmaengine: idxd: Set traffic class values in GRPCFG on DSA 2.0
	RDMA/erdma: Fix refcount leak in erdma_mmap
	dmaengine: HISI_DMA should depend on ARCH_HISI
	RDMA/hns: Fix refcount leak in hns_roce_mmap
	iio: light: tsl2563: Do not hardcode interrupt trigger type
	usb: gadget: fusb300_udc: free irq on the error path in fusb300_probe()
	i2c: designware: fix i2c_dw_clk_rate() return size to be u32
	soundwire: cadence: Don't overflow the command FIFOs
	driver core: fix potential null-ptr-deref in device_add()
	kobject: modify kobject_get_path() to take a const *
	kobject: Fix slab-out-of-bounds in fill_kobj_path()
	alpha/boot/tools/objstrip: fix the check for ELF header
	media: uvcvideo: Check for INACTIVE in uvc_ctrl_is_accessible()
	media: uvcvideo: Implement mask for V4L2_CTRL_TYPE_MENU
	media: uvcvideo: Refactor uvc_ctrl_mappings_uvcXX
	media: uvcvideo: Refactor power_line_frequency_controls_limited
	coresight: etm4x: Fix accesses to TRCSEQRSTEVR and TRCSEQSTR
	coresight: cti: Prevent negative values of enable count
	coresight: cti: Add PM runtime call in enable_store
	usb: typec: intel_pmc_mux: Don't leak the ACPI device reference count
	PCI/IOV: Enlarge virtfn sysfs name buffer
	PCI: switchtec: Return -EFAULT for copy_to_user() errors
	PCI: endpoint: pci-epf-vntb: Clean up kernel_doc warning
	PCI: endpoint: pci-epf-vntb: Add epf_ntb_mw_bar_clear() num_mws kernel-doc
	hwtracing: hisi_ptt: Only add the supported devices to the filters list
	tty: serial: fsl_lpuart: disable Rx/Tx DMA in lpuart32_shutdown()
	tty: serial: fsl_lpuart: clear LPUART Status Register in lpuart32_shutdown()
	serial: tegra: Add missing clk_disable_unprepare() in tegra_uart_hw_init()
	Revert "char: pcmcia: cm4000_cs: Replace mdelay with usleep_range in set_protocol"
	eeprom: idt_89hpesx: Fix error handling in idt_init()
	applicom: Fix PCI device refcount leak in applicom_init()
	firmware: stratix10-svc: add missing gen_pool_destroy() in stratix10_svc_drv_probe()
	firmware: stratix10-svc: fix error handle while alloc/add device failed
	VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF
	mei: pxp: Use correct macros to initialize uuid_le
	misc/mei/hdcp: Use correct macros to initialize uuid_le
	misc: fastrpc: Fix an error handling path in fastrpc_rpmsg_probe()
	driver core: fix resource leak in device_add()
	driver core: location: Free struct acpi_pld_info *pld before return false
	drivers: base: transport_class: fix possible memory leak
	drivers: base: transport_class: fix resource leak when transport_add_device() fails
	firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle
	fotg210-udc: Add missing completion handler
	dmaengine: dw-edma: Fix missing src/dst address of interleaved xfers
	fpga: microchip-spi: move SPI I/O buffers out of stack
	fpga: microchip-spi: rewrite status polling in a time measurable way
	usb: early: xhci-dbc: Fix a potential out-of-bound memory access
	tty: serial: fsl_lpuart: Fix the wrong RXWATER setting for rx dma case
	RDMA/cxgb4: add null-ptr-check after ip_dev_find()
	usb: musb: mediatek: don't unregister something that wasn't registered
	usb: gadget: configfs: Restrict symlink creation is UDC already binded
	phy: mediatek: remove temporary variable @mask_
	PCI: mt7621: Delay phy ports initialization
	iommu: dart: Add suspend/resume support
	iommu: dart: Support >64 stream IDs
	iommu/dart: Fix apple_dart_device_group for PCI groups
	iommu/vt-d: Set No Execute Enable bit in PASID table entry
	power: supply: remove faulty cooling logic
	RDMA/cxgb4: Fix potential null-ptr-deref in pass_establish()
	usb: max-3421: Fix setting of I/O pins
	RDMA/irdma: Cap MSIX used to online CPUs + 1
	serial: fsl_lpuart: fix RS485 RTS polariy inverse issue
	tty: serial: imx: Handle RS485 DE signal active high
	tty: serial: imx: disable Ageing Timer interrupt request irq
	driver core: fw_devlink: Add DL_FLAG_CYCLE support to device links
	driver core: fw_devlink: Don't purge child fwnode's consumer links
	driver core: fw_devlink: Allow marking a fwnode link as being part of a cycle
	driver core: fw_devlink: Consolidate device link flag computation
	driver core: fw_devlink: Improve check for fwnode with no device/driver
	driver core: fw_devlink: Make cycle detection more robust
	mtd: mtdpart: Don't create platform device that'll never probe
	usb: host: fsl-mph-dr-of: reuse device_set_of_node_from_dev
	dmaengine: dw-edma: Fix readq_ch() return value truncation
	PCI: Fix dropping valid root bus resources with .end = zero
	phy: rockchip-typec: fix tcphy_get_mode error case
	PCI: qcom: Fix host-init error handling
	iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry()
	iommu: Fix error unwind in iommu_group_alloc()
	iommu/amd: Do not identity map v2 capable device when snp is enabled
	dmaengine: sf-pdma: pdma_desc memory leak fix
	dmaengine: dw-axi-dmac: Do not dereference NULL structure
	dmaengine: ptdma: check for null desc before calling pt_cmd_callback
	iommu/vt-d: Fix error handling in sva enable/disable paths
	iommu/vt-d: Allow to use flush-queue when first level is default
	RDMA/rxe: cleanup some error handling in rxe_verbs.c
	RDMA/rxe: Fix missing memory barriers in rxe_queue.h
	IB/hfi1: Fix math bugs in hfi1_can_pin_pages()
	IB/hfi1: Fix sdma.h tx->num_descs off-by-one errors
	Revert "remoteproc: qcom_q6v5_mss: map/unmap metadata region before/after use"
	remoteproc: qcom_q6v5_mss: Use a carveout to authenticate modem headers
	media: ti: cal: fix possible memory leak in cal_ctx_create()
	media: platform: ti: Add missing check for devm_regulator_get
	media: imx: imx7-media-csi: fix missing clk_disable_unprepare() in imx7_csi_init()
	powerpc: Remove linker flag from KBUILD_AFLAGS
	s390/vdso: Drop '-shared' from KBUILD_CFLAGS_64
	builddeb: clean generated package content
	media: max9286: Fix memleak in max9286_v4l2_register()
	media: ov2740: Fix memleak in ov2740_init_controls()
	media: ov5675: Fix memleak in ov5675_init_controls()
	media: ov5640: Fix soft reset sequence and timings
	media: ov5640: Handle delays when no reset_gpio set
	media: mc: Get media_device directly from pad
	media: i2c: ov772x: Fix memleak in ov772x_probe()
	media: i2c: imx219: Split common registers from mode tables
	media: i2c: imx219: Fix binning for RAW8 capture
	media: platform: mtk-mdp3: Fix return value check in mdp_probe()
	media: camss: csiphy-3ph: avoid undefined behavior
	media: platform: mtk-mdp3: remove unused VIDEO_MEDIATEK_VPU config
	media: platform: mtk-mdp3: fix Kconfig dependencies
	media: v4l2-jpeg: correct the skip count in jpeg_parse_app14_data
	media: v4l2-jpeg: ignore the unknown APP14 marker
	media: hantro: Fix JPEG encoder ENUM_FRMSIZE on RK3399
	media: imx-jpeg: Apply clk_bulk api instead of operating specific clk
	media: amphion: correct the unspecified color space
	media: drivers/media/v4l2-core/v4l2-h264 : add detection of null pointers
	media: rc: Fix use-after-free bugs caused by ene_tx_irqsim()
	media: atomisp: Only set default_run_mode on first open of a stream/asd
	media: i2c: ov7670: 0 instead of -EINVAL was returned
	media: usb: siano: Fix use after free bugs caused by do_submit_urb
	media: saa7134: Use video_unregister_device for radio_dev
	rpmsg: glink: Avoid infinite loop on intent for missing channel
	rpmsg: glink: Release driver_override
	ARM: OMAP2+: omap4-common: Fix refcount leak bug
	arm64: dts: qcom: msm8996: Add additional A2NoC clocks
	udf: Define EFSCORRUPTED error code
	context_tracking: Fix noinstr vs KASAN
	exit: Detect and fix irq disabled state in oops
	ARM: dts: exynos: Use Exynos5420 compatible for the MIPI video phy
	fs: Use CHECK_DATA_CORRUPTION() when kernel bugs are detected
	blk-iocost: fix divide by 0 error in calc_lcoefs()
	blk-cgroup: dropping parent refcount after pd_free_fn() is done
	blk-cgroup: synchronize pd_free_fn() from blkg_free_workfn() and blkcg_deactivate_policy()
	trace/blktrace: fix memory leak with using debugfs_lookup()
	btrfs: scrub: improve tree block error reporting
	arm64: zynqmp: Enable hs termination flag for USB dwc3 controller
	cpuidle, intel_idle: Fix CPUIDLE_FLAG_INIT_XSTATE
	x86/fpu: Don't set TIF_NEED_FPU_LOAD for PF_IO_WORKER threads
	cpuidle: drivers: firmware: psci: Dont instrument suspend code
	cpuidle: lib/bug: Disable rcu_is_watching() during WARN/BUG
	perf/x86/intel/uncore: Add Meteor Lake support
	wifi: ath9k: Fix use-after-free in ath9k_hif_usb_disconnect()
	wifi: ath11k: fix monitor mode bringup crash
	wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds()
	rcu: Make RCU_LOCKDEP_WARN() avoid early lockdep checks
	rcu: Suppress smp_processor_id() complaint in synchronize_rcu_expedited_wait()
	srcu: Delegate work to the boot cpu if using SRCU_SIZE_SMALL
	rcu-tasks: Make rude RCU-Tasks work well with CPU hotplug
	rcu-tasks: Handle queue-shrink/callback-enqueue race condition
	wifi: ath11k: debugfs: fix to work with multiple PCI devices
	thermal: intel: Fix unsigned comparison with less than zero
	timers: Prevent union confusion from unexpected restart_syscall()
	x86/bugs: Reset speculation control settings on init
	bpftool: Always disable stack protection for BPF objects
	wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds
	wifi: mt7601u: fix an integer underflow
	inet: fix fast path in __inet_hash_connect()
	ice: restrict PTP HW clock freq adjustments to 100, 000, 000 PPB
	ice: add missing checks for PF vsi type
	ACPI: Don't build ACPICA with '-Os'
	bpf, docs: Fix modulo zero, division by zero, overflow, and underflow
	thermal: intel: intel_pch: Add support for Wellsburg PCH
	clocksource: Suspend the watchdog temporarily when high read latency detected
	crypto: hisilicon: Wipe entire pool on error
	net: bcmgenet: Add a check for oversized packets
	m68k: Check syscall_trace_enter() return code
	s390/mm,ptdump: avoid Kasan vs Memcpy Real markers swapping
	netfilter: nf_tables: NULL pointer dereference in nf_tables_updobj()
	can: isotp: check CAN address family in isotp_bind()
	gcc-plugins: drop -std=gnu++11 to fix GCC 13 build
	tools/power/x86/intel-speed-select: Add Emerald Rapid quirk
	wifi: mt76: dma: free rx_head in mt76_dma_rx_cleanup
	ACPI: video: Fix Lenovo Ideapad Z570 DMI match
	net/mlx5: fw_tracer: Fix debug print
	coda: Avoid partial allocation of sig_inputArgs
	uaccess: Add minimum bounds check on kernel buffer size
	s390/idle: mark arch_cpu_idle() noinstr
	time/debug: Fix memory leak with using debugfs_lookup()
	PM: domains: fix memory leak with using debugfs_lookup()
	PM: EM: fix memory leak with using debugfs_lookup()
	Bluetooth: Fix issue with Actions Semi ATS2851 based devices
	Bluetooth: btusb: Add new PID/VID 0489:e0f2 for MT7921
	Bluetooth: btusb: Add VID:PID 13d3:3529 for Realtek RTL8821CE
	wifi: rtw89: debug: avoid invalid access on RTW89_DBG_SEL_MAC_30
	hv_netvsc: Check status in SEND_RNDIS_PKT completion message
	s390/kfence: fix page fault reporting
	devlink: Fix TP_STRUCT_entry in trace of devlink health report
	scm: add user copy checks to put_cmsg()
	drm: panel-orientation-quirks: Add quirk for Lenovo Yoga Tab 3 X90F
	drm: panel-orientation-quirks: Add quirk for DynaBook K50
	drm/amd/display: Reduce expected sdp bandwidth for dcn321
	drm/amd/display: Revert Reduce delay when sink device not able to ACK 00340h write
	drm/amd/display: Fix potential null-deref in dm_resume
	drm/omap: dsi: Fix excessive stack usage
	HID: Add Mapping for System Microphone Mute
	drm/tiny: ili9486: Do not assume 8-bit only SPI controllers
	drm/amd/display: Defer DIG FIFO disable after VID stream enable
	drm/radeon: free iio for atombios when driver shutdown
	drm/amd: Avoid BUG() for case of SRIOV missing IP version
	drm/amdkfd: Page aligned memory reserve size
	scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write
	Revert "fbcon: don't lose the console font across generic->chip driver switch"
	drm/amd: Avoid ASSERT for some message failures
	drm: amd: display: Fix memory leakage
	drm/amd/display: fix mapping to non-allocated address
	HID: uclogic: Add frame type quirk
	HID: uclogic: Add battery quirk
	HID: uclogic: Add support for XP-PEN Deco Pro SW
	HID: uclogic: Add support for XP-PEN Deco Pro MW
	drm/msm/dsi: Add missing check for alloc_ordered_workqueue
	drm: rcar-du: Add quirk for H3 ES1.x pclk workaround
	drm: rcar-du: Fix setting a reserved bit in DPLLCR
	drm/drm_print: correct format problem
	drm/amd/display: Set hvm_enabled flag for S/G mode
	habanalabs: extend fatal messages to contain PCI info
	habanalabs: fix bug in timestamps registration code
	docs/scripts/gdb: add necessary make scripts_gdb step
	drm/msm/dpu: Add DSC hardware blocks to register snapshot
	ASoC: soc-compress: Reposition and add pcm_mutex
	ASoC: kirkwood: Iterate over array indexes instead of using pointer math
	regulator: max77802: Bounds check regulator id against opmode
	regulator: s5m8767: Bounds check id indexing into arrays
	Revert "drm/amdgpu: TA unload messages are not actually sent to psp when amdgpu is uninstalled"
	drm/amd/display: fix FCLK pstate change underflow
	gfs2: Improve gfs2_make_fs_rw error handling
	hwmon: (coretemp) Simplify platform device handling
	hwmon: (nct6775) Directly call ASUS ACPI WMI method
	hwmon: (nct6775) B650/B660/X670 ASUS boards support
	pinctrl: at91: use devm_kasprintf() to avoid potential leaks
	drm/amd/display: Do not commit pipe when updating DRR
	scsi: snic: Fix memory leak with using debugfs_lookup()
	scsi: ufs: core: Fix device management cmd timeout flow
	HID: logitech-hidpp: Don't restart communication if not necessary
	drm/amd/display: Enable P-state validation checks for DCN314
	drm: panel-orientation-quirks: Add quirk for Lenovo IdeaPad Duet 3 10IGL5
	drm/amd/display: Disable HUBP/DPP PG on DCN314 for now
	dm thin: add cond_resched() to various workqueue loops
	dm cache: add cond_resched() to various workqueue loops
	nfsd: zero out pointers after putting nfsd_files on COPY setup error
	nfsd: don't hand out delegation on setuid files being opened for write
	cifs: prevent data race in smb2_reconnect()
	drm/shmem-helper: Revert accidental non-GPL export
	driver core: fw_devlink: Avoid spurious error message
	wifi: rtl8xxxu: fixing transmisison failure for rtl8192eu
	scsi: mpt3sas: Remove usage of dma_get_required_mask() API
	firmware: coreboot: framebuffer: Ignore reserved pixel color bits
	block: don't allow multiple bios for IOCB_NOWAIT issue
	block: clear bio->bi_bdev when putting a bio back in the cache
	block: be a bit more careful in checking for NULL bdev while polling
	rtc: pm8xxx: fix set-alarm race
	ipmi: ipmb: Fix the MODULE_PARM_DESC associated to 'retry_time_ms'
	ipmi:ssif: resend_msg() cannot fail
	ipmi_ssif: Rename idle state and check
	io_uring: Replace 0-length array with flexible array
	io_uring: use user visible tail in io_uring_poll()
	io_uring: handle TIF_NOTIFY_RESUME when checking for task_work
	io_uring: add a conditional reschedule to the IOPOLL cancelation loop
	io_uring: add reschedule point to handle_tw_list()
	io_uring/rsrc: disallow multi-source reg buffers
	io_uring: remove MSG_NOSIGNAL from recvmsg
	io_uring: fix fget leak when fs don't support nowait buffered read
	s390/extmem: return correct segment type in __segment_load()
	s390: discard .interp section
	s390/kprobes: fix irq mask clobbering on kprobe reenter from post_handler
	s390/kprobes: fix current_kprobe never cleared after kprobes reenter
	KVM: s390: disable migration mode when dirty tracking is disabled
	cifs: Fix uninitialized memory read in smb3_qfs_tcon()
	cifs: Fix uninitialized memory reads for oparms.mode
	cifs: fix mount on old smb servers
	cifs: introduce cifs_io_parms in smb2_async_writev()
	cifs: split out smb3_use_rdma_offload() helper
	cifs: don't try to use rdma offload on encrypted connections
	cifs: Check the lease context if we actually got a lease
	cifs: return a single-use cfid if we did not get a lease
	scsi: mpi3mr: Fix missing mrioc->evtack_cmds initialization
	scsi: mpi3mr: Fix issues in mpi3mr_get_all_tgt_info()
	scsi: mpi3mr: Remove unnecessary memcpy() to alltgt_info->dmi
	btrfs: hold block group refcount during async discard
	locking/rwsem: Prevent non-first waiter from spinning in down_write() slowpath
	ksmbd: fix wrong data area length for smb2 lock request
	ksmbd: do not allow the actual frame length to be smaller than the rfc1002 length
	ksmbd: fix possible memory leak in smb2_lock()
	torture: Fix hang during kthread shutdown phase
	ARM: dts: exynos: correct HDMI phy compatible in Exynos4
	io_uring: mark task TASK_RUNNING before handling resume/task work
	hfs: fix missing hfs_bnode_get() in __hfs_bnode_create
	fs: hfsplus: fix UAF issue in hfsplus_put_super
	exfat: fix reporting fs error when reading dir beyond EOF
	exfat: fix unexpected EOF while reading dir
	exfat: redefine DIR_DELETED as the bad cluster number
	exfat: fix inode->i_blocks for non-512 byte sector size device
	fs: dlm: don't set stop rx flag after node reset
	fs: dlm: move sending fin message into state change handling
	fs: dlm: send FIN ack back in right cases
	f2fs: fix information leak in f2fs_move_inline_dirents()
	f2fs: retry to update the inode page given data corruption
	f2fs: fix cgroup writeback accounting with fs-layer encryption
	f2fs: fix kernel crash due to null io->bio
	ocfs2: fix defrag path triggering jbd2 ASSERT
	ocfs2: fix non-auto defrag path not working issue
	fs/cramfs/inode.c: initialize file_ra_state
	selftests/landlock: Skip overlayfs tests when not supported
	selftests/landlock: Test ptrace as much as possible with Yama
	udf: Truncate added extents on failed expansion
	udf: Do not bother merging very long extents
	udf: Do not update file length for failed writes to inline files
	udf: Preserve link count of system files
	udf: Detect system inodes linked into directory hierarchy
	udf: Fix file corruption when appending just after end of preallocated extent
	md: don't update recovery_cp when curr_resync is ACTIVE
	RDMA/siw: Fix user page pinning accounting
	KVM: Destroy target device if coalesced MMIO unregistration fails
	KVM: VMX: Fix crash due to uninitialized current_vmcs
	KVM: Register /dev/kvm as the _very_ last thing during initialization
	KVM: x86: Purge "highest ISR" cache when updating APICv state
	KVM: x86: Blindly get current x2APIC reg value on "nodecode write" traps
	KVM: x86: Don't inhibit APICv/AVIC on xAPIC ID "change" if APIC is disabled
	KVM: x86: Don't inhibit APICv/AVIC if xAPIC ID mismatch is due to 32-bit ID
	KVM: SVM: Flush the "current" TLB when activating AVIC
	KVM: SVM: Process ICR on AVIC IPI delivery failure due to invalid target
	KVM: SVM: Don't put/load AVIC when setting virtual APIC mode
	KVM: x86: Inject #GP if WRMSR sets reserved bits in APIC Self-IPI
	KVM: x86: Inject #GP on x2APIC WRMSR that sets reserved bits 63:32
	KVM: SVM: Fix potential overflow in SEV's send|receive_update_data()
	KVM: SVM: hyper-v: placate modpost section mismatch error
	selftests: x86: Fix incorrect kernel headers search path
	x86/virt: Force GIF=1 prior to disabling SVM (for reboot flows)
	x86/crash: Disable virt in core NMI crash handler to avoid double shootdown
	x86/reboot: Disable virtualization in an emergency if SVM is supported
	x86/reboot: Disable SVM, not just VMX, when stopping CPUs
	x86/kprobes: Fix __recover_optprobed_insn check optimizing logic
	x86/kprobes: Fix arch_check_optimized_kprobe check within optimized_kprobe range
	x86/microcode/amd: Remove load_microcode_amd()'s bsp parameter
	x86/microcode/AMD: Add a @cpu parameter to the reloading functions
	x86/microcode/AMD: Fix mixed steppings support
	x86/speculation: Allow enabling STIBP with legacy IBRS
	Documentation/hw-vuln: Document the interaction between IBRS and STIBP
	virt/sev-guest: Return -EIO if certificate buffer is not large enough
	brd: mark as nowait compatible
	brd: return 0/-error from brd_insert_page()
	brd: check for REQ_NOWAIT and set correct page allocation mask
	ima: fix error handling logic when file measurement failed
	ima: Align ima_file_mmap() parameters with mmap_file LSM hook
	selftests/powerpc: Fix incorrect kernel headers search path
	selftests/ftrace: Fix eprobe syntax test case to check filter support
	selftests: sched: Fix incorrect kernel headers search path
	selftests: core: Fix incorrect kernel headers search path
	selftests: pid_namespace: Fix incorrect kernel headers search path
	selftests: arm64: Fix incorrect kernel headers search path
	selftests: clone3: Fix incorrect kernel headers search path
	selftests: pidfd: Fix incorrect kernel headers search path
	selftests: membarrier: Fix incorrect kernel headers search path
	selftests: kcmp: Fix incorrect kernel headers search path
	selftests: media_tests: Fix incorrect kernel headers search path
	selftests: gpio: Fix incorrect kernel headers search path
	selftests: filesystems: Fix incorrect kernel headers search path
	selftests: user_events: Fix incorrect kernel headers search path
	selftests: ptp: Fix incorrect kernel headers search path
	selftests: sync: Fix incorrect kernel headers search path
	selftests: rseq: Fix incorrect kernel headers search path
	selftests: move_mount_set_group: Fix incorrect kernel headers search path
	selftests: mount_setattr: Fix incorrect kernel headers search path
	selftests: perf_events: Fix incorrect kernel headers search path
	selftests: ipc: Fix incorrect kernel headers search path
	selftests: futex: Fix incorrect kernel headers search path
	selftests: drivers: Fix incorrect kernel headers search path
	selftests: dmabuf-heaps: Fix incorrect kernel headers search path
	selftests: vm: Fix incorrect kernel headers search path
	selftests: seccomp: Fix incorrect kernel headers search path
	irqdomain: Fix association race
	irqdomain: Fix disassociation race
	irqdomain: Look for existing mapping only once
	irqdomain: Drop bogus fwspec-mapping error handling
	irqdomain: Refactor __irq_domain_alloc_irqs()
	irqdomain: Fix mapping-creation race
	irqdomain: Fix domain registration race
	crypto: qat - fix out-of-bounds read
	mm/damon/paddr: fix missing folio_put()
	ALSA: ice1712: Do not left ice->gpio_mutex locked in aureon_add_controls()
	ALSA: hda/realtek: Add quirk for HP EliteDesk 800 G6 Tower PC
	jbd2: fix data missing when reusing bh which is ready to be checkpointed
	ext4: optimize ea_inode block expansion
	ext4: refuse to create ea block when umounted
	cxl/pmem: Fix nvdimm registration races
	mtd: spi-nor: sfdp: Fix index value for SCCR dwords
	mtd: spi-nor: spansion: Consider reserved bits in CFR5 register
	mtd: spi-nor: Fix shift-out-of-bounds in spi_nor_set_erase_type
	dm: send just one event on resize, not two
	dm: add cond_resched() to dm_wq_work()
	dm: add cond_resched() to dm_wq_requeue_work()
	wifi: rtw88: use RTW_FLAG_POWERON flag to prevent to power on/off twice
	wifi: rtl8xxxu: Use a longer retry limit of 48
	wifi: ath11k: allow system suspend to survive ath11k
	wifi: cfg80211: Fix use after free for wext
	wifi: cfg80211: Set SSID if it is not already set
	cpuidle: add ARCH_SUSPEND_POSSIBLE dependencies
	qede: fix interrupt coalescing configuration
	thermal: intel: powerclamp: Fix cur_state for multi package system
	dm flakey: fix logic when corrupting a bio
	dm cache: free background tracker's queued work in btracker_destroy
	dm flakey: don't corrupt the zero page
	dm flakey: fix a bug with 32-bit highmem systems
	hwmon: (peci/cputemp) Fix off-by-one in coretemp_label allocation
	hwmon: (nct6775) Fix incorrect parenthesization in nct6775_write_fan_div()
	ARM: dts: qcom: sdx65: Add Qcom SMMU-500 as the fallback for IOMMU node
	ARM: dts: qcom: sdx55: Add Qcom SMMU-500 as the fallback for IOMMU node
	ARM: dts: exynos: correct TMU phandle in Exynos4210
	ARM: dts: exynos: correct TMU phandle in Exynos4
	ARM: dts: exynos: correct TMU phandle in Odroid XU3 family
	ARM: dts: exynos: correct TMU phandle in Exynos5250
	ARM: dts: exynos: correct TMU phandle in Odroid XU
	ARM: dts: exynos: correct TMU phandle in Odroid HC1
	arm64: mm: hugetlb: Disable HUGETLB_PAGE_OPTIMIZE_VMEMMAP
	fuse: add inode/permission checks to fileattr_get/fileattr_set
	rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails
	ceph: update the time stamps and try to drop the suid/sgid
	regulator: core: Use ktime_get_boottime() to determine how long a regulator was off
	panic: fix the panic_print NMI backtrace setting
	mm/hwpoison: convert TTU_IGNORE_HWPOISON to TTU_HWPOISON
	alpha: fix FEN fault handling
	dax/kmem: Fix leak of memory-hotplug resources
	mips: fix syscall_get_nr
	media: ipu3-cio2: Fix PM runtime usage_count in driver unbind
	remoteproc/mtk_scp: Move clk ops outside send_lock
	docs: gdbmacros: print newest record
	mm: memcontrol: deprecate charge moving
	mm/thp: check and bail out if page in deferred queue already
	ktest.pl: Give back console on Ctrt^C on monitor
	kprobes: Fix to handle forcibly unoptimized kprobes on freeing_list
	ktest.pl: Fix missing "end_monitor" when machine check fails
	ktest.pl: Add RUN_TIMEOUT option with default unlimited
	memory tier: release the new_memtier in find_create_memory_tier()
	ring-buffer: Handle race between rb_move_tail and rb_check_pages
	tools/bootconfig: fix single & used for logical condition
	tracing/eprobe: Fix to add filter on eprobe description in README file
	iommu/amd: Add a length limitation for the ivrs_acpihid command-line parameter
	iommu/amd: Improve page fault error reporting
	scsi: aacraid: Allocate cmd_priv with scsicmd
	scsi: qla2xxx: Fix link failure in NPIV environment
	scsi: qla2xxx: Check if port is online before sending ELS
	scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests
	scsi: qla2xxx: Remove unintended flag clearing
	scsi: qla2xxx: Fix erroneous link down
	scsi: qla2xxx: Remove increment of interface err cnt
	scsi: ses: Don't attach if enclosure has no components
	scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process()
	scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses
	scsi: ses: Fix possible desc_ptr out-of-bounds accesses
	scsi: ses: Fix slab-out-of-bounds in ses_intf_remove()
	RISC-V: add a spin_shadow_stack declaration
	riscv: Avoid enabling interrupts in die()
	riscv: mm: fix regression due to update_mmu_cache change
	riscv: jump_label: Fixup unaligned arch_static_branch function
	riscv, mm: Perform BPF exhandler fixup on page fault
	riscv: ftrace: Remove wasted nops for !RISCV_ISA_C
	riscv: ftrace: Reduce the detour code size to half
	MIPS: DTS: CI20: fix otg power gpio
	PCI/PM: Observe reset delay irrespective of bridge_d3
	PCI: Unify delay handling for reset and resume
	PCI: hotplug: Allow marking devices as disconnected during bind/unbind
	PCI: Avoid FLR for AMD FCH AHCI adapters
	PCI/DPC: Await readiness of secondary bus after reset
	bus: mhi: ep: Only send -ENOTCONN status if client driver is available
	bus: mhi: ep: Move chan->lock to the start of processing queued ch ring
	bus: mhi: ep: Save channel state locally during suspend and resume
	iommu/vt-d: Avoid superfluous IOTLB tracking in lazy mode
	iommu/vt-d: Fix PASID directory pointer coherency
	vfio/type1: exclude mdevs from VFIO_UPDATE_VADDR
	vfio/type1: prevent underflow of locked_vm via exec()
	vfio/type1: track locked_vm per dma
	vfio/type1: restore locked_vm
	drm/amd: Fix initialization for nbio 7.5.1
	drm/i915/quirks: Add inverted backlight quirk for HP 14-r206nv
	drm/radeon: Fix eDP for single-display iMac11,2
	drm/i915: Don't use stolen memory for ring buffers with LLC
	drm/i915: Don't use BAR mappings for ring buffers with LLC
	drm/gud: Fix UBSAN warning
	drm/edid: fix AVI infoframe aspect ratio handling
	drm/edid: fix parsing of 3D modes from HDMI VSDB
	qede: avoid uninitialized entries in coal_entry array
	brd: use radix_tree_maybe_preload instead of radix_tree_preload
	sbitmap: Advance the queue index before waking up a queue
	wait: Return number of exclusive waiters awaken
	sbitmap: Try each queue to wake up at least one waiter
	kbuild: Port silent mode detection to future gnu make.
	net: avoid double iput when sock_alloc_file fails
	Linux 6.1.16

Change-Id: I705caf70ee547e6d55f38d133bdcd50713aed745
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-03-13 15:45:34 +00:00
Vincent Donnefort
34411786c7 ANDROID: ring-buffer: Fix ring_buffer_read_page for external writers
No shortcut is possible for reading a page without removing it from
the ring-buffer. The reader needs to be moved and its timestamp
updated.

Bug: 249050813
Change-Id: I80fbc1e265500e419278346e2973df2488b7e8b3
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
2023-03-13 13:36:34 +00:00
Sangmoon Kim
1e6d82d241 ANDROID: Re-apply vendor hooks for information of blocked tasks
This reverts commit 66330b896c (Revert "ANDROID: vendor_hooks:
add waiting information for blocked tasks")

The original patch has been reverted to resolve merge issues
with 5.18-rc1. This patch adds again the vendor hooks for the
original purpose.

Bug: 271799327

Signed-off-by: Sangmoon Kim <sangmoon.kim@samsung.com>
Change-Id: I86b9b7dd553b7b6a5930ace6280ecd66dc5dc4df
2023-03-10 18:16:02 +00:00
Gabriel Krisman Bertazi
d710b1e91b wait: Return number of exclusive waiters awaken
commit ee7dc86b6d upstream.

Sbitmap code will need to know how many waiters were actually woken for
its batched wakeups implementation.  Return the number of woken
exclusive waiters from __wake_up() to facilitate that.

Suggested-by: Jan Kara <jack@suse.cz>
Signed-off-by: Gabriel Krisman Bertazi <krisman@suse.de>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20221115224553.23594-3-krisman@suse.de
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-03-10 09:34:34 +01:00
Masami Hiramatsu (Google)
4aa7389400 tracing/eprobe: Fix to add filter on eprobe description in README file
commit 133921530c upstream.

Fix to add a description of the filter on eprobe in README file. This
is required to identify the kernel supports the filter on eprobe or not.

Link: https://lore.kernel.org/all/167309833728.640500.12232259238201433587.stgit@devnote3/

Fixes: 752be5c5c9 ("tracing/eprobe: Add eprobe filter support")
Cc: stable@vger.kernel.org
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-03-10 09:34:27 +01:00
Mukesh Ojha
9674390ac5 ring-buffer: Handle race between rb_move_tail and rb_check_pages
commit 8843e06f67 upstream.

It seems a data race between ring_buffer writing and integrity check.
That is, RB_FLAG of head_page is been updating, while at same time
RB_FLAG was cleared when doing integrity check rb_check_pages():

  rb_check_pages()            rb_handle_head_page():
  --------                    --------
  rb_head_page_deactivate()
                              rb_head_page_set_normal()
  rb_head_page_activate()

We do intergrity test of the list to check if the list is corrupted and
it is still worth doing it. So, let's refactor rb_check_pages() such that
we no longer clear and set flag during the list sanity checking.

[1] and [2] are the test to reproduce and the crash report respectively.

1:
``` read_trace.sh
  while true;
  do
    # the "trace" file is closed after read
    head -1 /sys/kernel/tracing/trace > /dev/null
  done
```
``` repro.sh
  sysctl -w kernel.panic_on_warn=1
  # function tracer will writing enough data into ring_buffer
  echo function > /sys/kernel/tracing/current_tracer
  ./read_trace.sh &
  ./read_trace.sh &
  ./read_trace.sh &
  ./read_trace.sh &
  ./read_trace.sh &
  ./read_trace.sh &
  ./read_trace.sh &
  ./read_trace.sh &
```

2:
------------[ cut here ]------------
WARNING: CPU: 9 PID: 62 at kernel/trace/ring_buffer.c:2653
rb_move_tail+0x450/0x470
Modules linked in:
CPU: 9 PID: 62 Comm: ksoftirqd/9 Tainted: G        W          6.2.0-rc6+
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014
RIP: 0010:rb_move_tail+0x450/0x470
Code: ff ff 4c 89 c8 f0 4d 0f b1 02 48 89 c2 48 83 e2 fc 49 39 d0 75 24
83 e0 03 83 f8 02 0f 84 e1 fb ff ff 48 8b 57 10 f0 ff 42 08 <0f> 0b 83
f8 02 0f 84 ce fb ff ff e9 db
RSP: 0018:ffffb5564089bd00 EFLAGS: 00000203
RAX: 0000000000000000 RBX: ffff9db385a2bf81 RCX: ffffb5564089bd18
RDX: ffff9db281110100 RSI: 0000000000000fe4 RDI: ffff9db380145400
RBP: ffff9db385a2bf80 R08: ffff9db385a2bfc0 R09: ffff9db385a2bfc2
R10: ffff9db385a6c000 R11: ffff9db385a2bf80 R12: 0000000000000000
R13: 00000000000003e8 R14: ffff9db281110100 R15: ffffffffbb006108
FS:  0000000000000000(0000) GS:ffff9db3bdcc0000(0000)
knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005602323024c8 CR3: 0000000022e0c000 CR4: 00000000000006e0
Call Trace:
 <TASK>
 ring_buffer_lock_reserve+0x136/0x360
 ? __do_softirq+0x287/0x2df
 ? __pfx_rcu_softirq_qs+0x10/0x10
 trace_function+0x21/0x110
 ? __pfx_rcu_softirq_qs+0x10/0x10
 ? __do_softirq+0x287/0x2df
 function_trace_call+0xf6/0x120
 0xffffffffc038f097
 ? rcu_softirq_qs+0x5/0x140
 rcu_softirq_qs+0x5/0x140
 __do_softirq+0x287/0x2df
 run_ksoftirqd+0x2a/0x30
 smpboot_thread_fn+0x188/0x220
 ? __pfx_smpboot_thread_fn+0x10/0x10
 kthread+0xe7/0x110
 ? __pfx_kthread+0x10/0x10
 ret_from_fork+0x2c/0x50
 </TASK>
---[ end trace 0000000000000000 ]---

[ crash report and test reproducer credit goes to Zheng Yejian]

Link: https://lore.kernel.org/linux-trace-kernel/1676376403-16462-1-git-send-email-quic_mojha@quicinc.com

Cc: <mhiramat@kernel.org>
Cc: stable@vger.kernel.org
Fixes: 1039221cc2 ("ring-buffer: Do not disable recording when there is an iterator")
Reported-by: Zheng Yejian <zhengyejian1@huawei.com>
Signed-off-by: Mukesh Ojha <quic_mojha@quicinc.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-03-10 09:34:27 +01:00
Masami Hiramatsu (Google)
a467e3e04d kprobes: Fix to handle forcibly unoptimized kprobes on freeing_list
commit 4fbd2f83fd upstream.

Since forcibly unoptimized kprobes will be put on the freeing_list directly
in the unoptimize_kprobe(), do_unoptimize_kprobes() must continue to check
the freeing_list even if unoptimizing_list is empty.

This bug can happen if a kprobe is put in an instruction which is in the
middle of the jump-replaced instruction sequence of an optprobe, *and* the
optprobe is recently unregistered and queued on unoptimizing_list.
In this case, the optprobe will be unoptimized forcibly (means immediately)
and put it into the freeing_list, expecting the optprobe will be handled in
do_unoptimize_kprobe().
But if there is no other optprobes on the unoptimizing_list, current code
returns from the do_unoptimize_kprobe() soon and does not handle the
optprobe which is on the freeing_list. Then the optprobe will hit the
WARN_ON_ONCE() in the do_free_cleaned_kprobes(), because it is not handled
in the latter loop of the do_unoptimize_kprobe().

To solve this issue, do not return from do_unoptimize_kprobes() immediately
even if unoptimizing_list is empty.

Moreover, this change affects another case. kill_optimized_kprobes() expects
kprobe_optimizer() will just free the optprobe on freeing_list.
So I changed it to just do list_move() to freeing_list if optprobes are on
unoptimizing list. And the do_unoptimize_kprobe() will skip
arch_disarm_kprobe() if the probe on freeing_list has gone flag.

Link: https://lore.kernel.org/all/Y8URdIfVr3pq2X8w@xpf.sh.intel.com/
Link: https://lore.kernel.org/all/167448024501.3253718.13037333683110512967.stgit@devnote3/

Fixes: e4add24778 ("kprobes: Fix optimize_kprobe()/unoptimize_kprobe() cancellation logic")
Reported-by: Pengfei Xu <pengfei.xu@intel.com>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Cc: stable@vger.kernel.org
Acked-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-03-10 09:34:27 +01:00
Dan Williams
6b60250d8a dax/kmem: Fix leak of memory-hotplug resources
commit e686c32590 upstream.

While experimenting with CXL region removal the following corruption of
/proc/iomem appeared.

Before:
f010000000-f04fffffff : CXL Window 0
  f010000000-f02fffffff : region4
    f010000000-f02fffffff : dax4.0
      f010000000-f02fffffff : System RAM (kmem)

After (modprobe -r cxl_test):
f010000000-f02fffffff : **redacted binary garbage**
  f010000000-f02fffffff : System RAM (kmem)

...and testing further the same is visible with persistent memory
assigned to kmem:

Before:
480000000-243fffffff : Persistent Memory
  480000000-57e1fffff : namespace3.0
  580000000-243fffffff : dax3.0
    580000000-243fffffff : System RAM (kmem)

After (ndctl disable-region all):
480000000-243fffffff : Persistent Memory
  580000000-243fffffff : ***redacted binary garbage***
    580000000-243fffffff : System RAM (kmem)

The corrupted data is from a use-after-free of the "dax4.0" and "dax3.0"
resources, and it also shows that the "System RAM (kmem)" resource is
not being removed. The bug does not appear after "modprobe -r kmem", it
requires the parent of "dax4.0" and "dax3.0" to be removed which
re-parents the leaked "System RAM (kmem)" instances. Those in turn
reference the freed resource as a parent.

First up for the fix is release_mem_region_adjustable() needs to
reliably delete the resource inserted by add_memory_driver_managed().
That is thwarted by a check for IORESOURCE_SYSRAM that predates the
dax/kmem driver, from commit:

65c7878413 ("kernel, resource: check for IORESOURCE_SYSRAM in release_mem_region_adjustable")

That appears to be working around the behavior of HMM's
"MEMORY_DEVICE_PUBLIC" facility that has since been deleted. With that
check removed the "System RAM (kmem)" resource gets removed, but
corruption still occurs occasionally because the "dax" resource is not
reliably removed.

The dax range information is freed before the device is unregistered, so
the driver can not reliably recall (another use after free) what it is
meant to release. Lastly if that use after free got lucky, the driver
was covering up the leak of "System RAM (kmem)" due to its use of
release_resource() which detaches, but does not free, child resources.
The switch to remove_resource() forces remove_memory() to be responsible
for the deletion of the resource added by add_memory_driver_managed().

Fixes: c2f3011ee6 ("device-dax: add an allocation interface for device-dax instances")
Cc: <stable@vger.kernel.org>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: David Hildenbrand <david@redhat.com>
Cc: Pavel Tatashin <pasha.tatashin@soleen.com>
Reviewed-by: Vishal Verma <vishal.l.verma@intel.com>
Reviewed-by: Pasha Tatashin <pasha.tatashin@soleen.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Link: https://lore.kernel.org/r/167653656244.3147810.5705900882794040229.stgit@dwillia2-xfh.jf.intel.com
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-03-10 09:34:25 +01:00
Guilherme G. Piccoli
e6737d9772 panic: fix the panic_print NMI backtrace setting
commit b905039e42 upstream.

Commit 8d470a45d1 ("panic: add option to dump all CPUs backtraces in
panic_print") introduced a setting for the "panic_print" kernel parameter
to allow users to request a NMI backtrace on panic.  Problem is that the
panic_print handling happens after the secondary CPUs are already
disabled, hence this option ended-up being kind of a no-op - kernel skips
the NMI trace in idling CPUs, which is the case of offline CPUs.

Fix it by checking the NMI backtrace bit in the panic_print prior to the
CPU disabling function.

Link: https://lkml.kernel.org/r/20230226160838.414257-1-gpiccoli@igalia.com
Fixes: 8d470a45d1 ("panic: add option to dump all CPUs backtraces in panic_print")
Signed-off-by: Guilherme G. Piccoli <gpiccoli@igalia.com>
Cc: <stable@vger.kernel.org>
Cc: Baoquan He <bhe@redhat.com>
Cc: Dave Young <dyoung@redhat.com>
Cc: Feng Tang <feng.tang@intel.com>
Cc: HATAYAMA Daisuke <d.hatayama@jp.fujitsu.com>
Cc: Hidehiro Kawai <hidehiro.kawai.ez@hitachi.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Michael Kelley <mikelley@microsoft.com>
Cc: Petr Mladek <pmladek@suse.com>
Cc: Vivek Goyal <vgoyal@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-03-10 09:34:25 +01:00
Marc Zyngier
d2bea57888 irqdomain: Fix domain registration race
commit 8932c32c30 upstream.

Hierarchical domains created using irq_domain_create_hierarchy() are
currently added to the domain list before having been fully initialised.

This specifically means that a racing allocation request might fail to
allocate irq data for the inner domains of a hierarchy in case the
parent domain pointer has not yet been set up.

Note that this is not really any issue for irqchip drivers that are
registered early (e.g. via IRQCHIP_DECLARE() or IRQCHIP_ACPI_DECLARE())
but could potentially cause trouble with drivers that are registered
later (e.g. modular drivers using IRQCHIP_PLATFORM_DRIVER_BEGIN(),
gpiochip drivers, etc.).

Fixes: afb7da83b9 ("irqdomain: Introduce helper function irq_domain_add_hierarchy()")
Cc: stable@vger.kernel.org      # 3.19
Signed-off-by: Marc Zyngier <maz@kernel.org>
[ johan: add commit message ]
Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20230213104302.17307-8-johan+linaro@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-03-10 09:34:19 +01:00
Johan Hovold
b89b0c737d irqdomain: Fix mapping-creation race
commit 601363cc08 upstream.

Parallel probing of devices that share interrupts (e.g. when a driver
uses asynchronous probing) can currently result in two mappings for the
same hardware interrupt to be created due to missing serialisation.

Make sure to hold the irq_domain_mutex when creating mappings so that
looking for an existing mapping before creating a new one is done
atomically.

Fixes: 765230b5f0 ("driver-core: add asynchronous probing support for drivers")
Fixes: b62b2cf575 ("irqdomain: Fix handling of type settings for existing mappings")
Link: https://lore.kernel.org/r/YuJXMHoT4ijUxnRb@hovoldconsulting.com
Cc: stable@vger.kernel.org      # 4.8
Cc: Dmitry Torokhov <dtor@chromium.org>
Cc: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Hsin-Yi Wang <hsinyi@chromium.org>
Tested-by: Mark-PK Tsai <mark-pk.tsai@mediatek.com>
Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20230213104302.17307-7-johan+linaro@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-03-10 09:34:19 +01:00
Johan Hovold
1c89f39e75 irqdomain: Refactor __irq_domain_alloc_irqs()
commit d55f7f4c58 upstream.

Refactor __irq_domain_alloc_irqs() so that it can be called internally
while holding the irq_domain_mutex.

This will be used to fix a shared-interrupt mapping race, hence the
Fixes tag.

Fixes: b62b2cf575 ("irqdomain: Fix handling of type settings for existing mappings")
Cc: stable@vger.kernel.org      # 4.8
Tested-by: Hsin-Yi Wang <hsinyi@chromium.org>
Tested-by: Mark-PK Tsai <mark-pk.tsai@mediatek.com>
Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20230213104302.17307-6-johan+linaro@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-03-10 09:34:19 +01:00
Johan Hovold
1b4aa065ea irqdomain: Drop bogus fwspec-mapping error handling
commit e3b7ab025e upstream.

In case a newly allocated IRQ ever ends up not having any associated
struct irq_data it would not even be possible to dispose the mapping.

Replace the bogus disposal with a WARN_ON().

This will also be used to fix a shared-interrupt mapping race, hence the
CC-stable tag.

Fixes: 1e2a7d7849 ("irqdomain: Don't set type when mapping an IRQ")
Cc: stable@vger.kernel.org      # 4.8
Tested-by: Hsin-Yi Wang <hsinyi@chromium.org>
Tested-by: Mark-PK Tsai <mark-pk.tsai@mediatek.com>
Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20230213104302.17307-4-johan+linaro@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-03-10 09:34:19 +01:00
Johan Hovold
b6655a4910 irqdomain: Look for existing mapping only once
commit 6e6f75c9c9 upstream.

Avoid looking for an existing mapping twice when creating a new mapping
using irq_create_fwspec_mapping() by factoring out the actual allocation
which is shared with irq_create_mapping_affinity().

The new helper function will also be used to fix a shared-interrupt
mapping race, hence the Fixes tag.

Fixes: b62b2cf575 ("irqdomain: Fix handling of type settings for existing mappings")
Cc: stable@vger.kernel.org      # 4.8
Tested-by: Hsin-Yi Wang <hsinyi@chromium.org>
Tested-by: Mark-PK Tsai <mark-pk.tsai@mediatek.com>
Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20230213104302.17307-5-johan+linaro@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-03-10 09:34:19 +01:00
Johan Hovold
deb243ca05 irqdomain: Fix disassociation race
commit 3f883c38f5 upstream.

The global irq_domain_mutex is held when mapping interrupts from
non-hierarchical domains but currently not when disposing them.

This specifically means that updates of the domain mapcount is racy
(currently only used for statistics in debugfs).

Make sure to hold the global irq_domain_mutex also when disposing
mappings from non-hierarchical domains.

Fixes: 9dc6be3d41 ("genirq/irqdomain: Add map counter")
Cc: stable@vger.kernel.org      # 4.13
Tested-by: Hsin-Yi Wang <hsinyi@chromium.org>
Tested-by: Mark-PK Tsai <mark-pk.tsai@mediatek.com>
Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20230213104302.17307-3-johan+linaro@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-03-10 09:34:19 +01:00
Johan Hovold
33bf92b1d0 irqdomain: Fix association race
commit b06730a571 upstream.

The sanity check for an already mapped virq is done outside of the
irq_domain_mutex-protected section which means that an (unlikely) racing
association may not be detected.

Fix this by factoring out the association implementation, which will
also be used in a follow-on change to fix a shared-interrupt mapping
race.

Fixes: ddaf144c61 ("irqdomain: Refactor irq_domain_associate_many()")
Cc: stable@vger.kernel.org      # 3.11
Tested-by: Hsin-Yi Wang <hsinyi@chromium.org>
Tested-by: Mark-PK Tsai <mark-pk.tsai@mediatek.com>
Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20230213104302.17307-2-johan+linaro@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-03-10 09:34:19 +01:00
Yang Jihong
57d9df9187 x86/kprobes: Fix arch_check_optimized_kprobe check within optimized_kprobe range
commit f1c97a1b4e upstream.

When arch_prepare_optimized_kprobe calculating jump destination address,
it copies original instructions from jmp-optimized kprobe (see
__recover_optprobed_insn), and calculated based on length of original
instruction.

arch_check_optimized_kprobe does not check KPROBE_FLAG_OPTIMATED when
checking whether jmp-optimized kprobe exists.
As a result, setup_detour_execution may jump to a range that has been
overwritten by jump destination address, resulting in an inval opcode error.

For example, assume that register two kprobes whose addresses are
<func+9> and <func+11> in "func" function.
The original code of "func" function is as follows:

   0xffffffff816cb5e9 <+9>:     push   %r12
   0xffffffff816cb5eb <+11>:    xor    %r12d,%r12d
   0xffffffff816cb5ee <+14>:    test   %rdi,%rdi
   0xffffffff816cb5f1 <+17>:    setne  %r12b
   0xffffffff816cb5f5 <+21>:    push   %rbp

1.Register the kprobe for <func+11>, assume that is kp1, corresponding optimized_kprobe is op1.
  After the optimization, "func" code changes to:

   0xffffffff816cc079 <+9>:     push   %r12
   0xffffffff816cc07b <+11>:    jmp    0xffffffffa0210000
   0xffffffff816cc080 <+16>:    incl   0xf(%rcx)
   0xffffffff816cc083 <+19>:    xchg   %eax,%ebp
   0xffffffff816cc084 <+20>:    (bad)
   0xffffffff816cc085 <+21>:    push   %rbp

Now op1->flags == KPROBE_FLAG_OPTIMATED;

2. Register the kprobe for <func+9>, assume that is kp2, corresponding optimized_kprobe is op2.

register_kprobe(kp2)
  register_aggr_kprobe
    alloc_aggr_kprobe
      __prepare_optimized_kprobe
        arch_prepare_optimized_kprobe
          __recover_optprobed_insn    // copy original bytes from kp1->optinsn.copied_insn,
                                      // jump address = <func+14>

3. disable kp1:

disable_kprobe(kp1)
  __disable_kprobe
    ...
    if (p == orig_p || aggr_kprobe_disabled(orig_p)) {
      ret = disarm_kprobe(orig_p, true)       // add op1 in unoptimizing_list, not unoptimized
      orig_p->flags |= KPROBE_FLAG_DISABLED;  // op1->flags ==  KPROBE_FLAG_OPTIMATED | KPROBE_FLAG_DISABLED
    ...

4. unregister kp2
__unregister_kprobe_top
  ...
  if (!kprobe_disabled(ap) && !kprobes_all_disarmed) {
    optimize_kprobe(op)
      ...
      if (arch_check_optimized_kprobe(op) < 0) // because op1 has KPROBE_FLAG_DISABLED, here not return
        return;
      p->kp.flags |= KPROBE_FLAG_OPTIMIZED;   //  now op2 has KPROBE_FLAG_OPTIMIZED
  }

"func" code now is:

   0xffffffff816cc079 <+9>:     int3
   0xffffffff816cc07a <+10>:    push   %rsp
   0xffffffff816cc07b <+11>:    jmp    0xffffffffa0210000
   0xffffffff816cc080 <+16>:    incl   0xf(%rcx)
   0xffffffff816cc083 <+19>:    xchg   %eax,%ebp
   0xffffffff816cc084 <+20>:    (bad)
   0xffffffff816cc085 <+21>:    push   %rbp

5. if call "func", int3 handler call setup_detour_execution:

  if (p->flags & KPROBE_FLAG_OPTIMIZED) {
    ...
    regs->ip = (unsigned long)op->optinsn.insn + TMPL_END_IDX;
    ...
  }

The code for the destination address is

   0xffffffffa021072c:  push   %r12
   0xffffffffa021072e:  xor    %r12d,%r12d
   0xffffffffa0210731:  jmp    0xffffffff816cb5ee <func+14>

However, <func+14> is not a valid start instruction address. As a result, an error occurs.

Link: https://lore.kernel.org/all/20230216034247.32348-3-yangjihong1@huawei.com/

Fixes: f66c0447cc ("kprobes: Set unoptimized flag after unoptimizing code")
Signed-off-by: Yang Jihong <yangjihong1@huawei.com>
Cc: stable@vger.kernel.org
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-03-10 09:34:13 +01:00
Yang Jihong
1a3439f548 x86/kprobes: Fix __recover_optprobed_insn check optimizing logic
commit 868a6fc0ca upstream.

Since the following commit:

  commit f66c0447cc ("kprobes: Set unoptimized flag after unoptimizing code")

modified the update timing of the KPROBE_FLAG_OPTIMIZED, a optimized_kprobe
may be in the optimizing or unoptimizing state when op.kp->flags
has KPROBE_FLAG_OPTIMIZED and op->list is not empty.

The __recover_optprobed_insn check logic is incorrect, a kprobe in the
unoptimizing state may be incorrectly determined as unoptimizing.
As a result, incorrect instructions are copied.

The optprobe_queued_unopt function needs to be exported for invoking in
arch directory.

Link: https://lore.kernel.org/all/20230216034247.32348-2-yangjihong1@huawei.com/

Fixes: f66c0447cc ("kprobes: Set unoptimized flag after unoptimizing code")
Cc: stable@vger.kernel.org
Signed-off-by: Yang Jihong <yangjihong1@huawei.com>
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-03-10 09:34:13 +01:00
Joel Fernandes (Google)
77837a24bc torture: Fix hang during kthread shutdown phase
commit d52d3a2bf4 upstream.

During rcutorture shutdown, the rcu_torture_cleanup() function calls
torture_cleanup_begin(), which sets the fullstop global variable to
FULLSTOP_RMMOD. This causes the rcutorture threads for readers and
fakewriters to exit all of their "while" loops and start shutting down.

They then call torture_kthread_stopping(), which in turn waits for
kthread_stop() to be called.  However, rcu_torture_cleanup() has
not yet called kthread_stop() on those threads, and before it gets a
chance to do so, multiple instances of torture_kthread_stopping() invoke
schedule_timeout_interruptible(1) in a tight loop.  Tracing confirms that
TIMER_SOFTIRQ can then continuously execute timer callbacks.  If that
TIMER_SOFTIRQ preempts the task executing rcu_torture_cleanup(), that
task might never invoke kthread_stop().

This commit improves this situation by increasing the timeout passed to
schedule_timeout_interruptible() from one jiffy to 1/20th of a second.
This change prevents TIMER_SOFTIRQ from monopolizing its CPU, thus
allowing rcu_torture_cleanup() to carry out the needed kthread_stop()
invocations.  Testing has shown 100 runs of TREE07 passing reliably,
as oppose to the tens-of-percent failure rates seen beforehand.

Cc: Paul McKenney <paulmck@kernel.org>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: Zhouyi Zhou <zhouzhouyi@gmail.com>
Cc: <stable@vger.kernel.org> # 6.0.x
Signed-off-by: Joel Fernandes (Google) <joel@joelfernandes.org>
Tested-by: Zhouyi Zhou <zhouzhouyi@gmail.com>
Reviewed-by: Davidlohr Bueso <dave@stgolabs.net>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-03-10 09:34:07 +01:00
Waiman Long
35ab0cadbc locking/rwsem: Prevent non-first waiter from spinning in down_write() slowpath
commit b613c7f314 upstream.

A non-first waiter can potentially spin in the for loop of
rwsem_down_write_slowpath() without sleeping but fail to acquire the
lock even if the rwsem is free if the following sequence happens:

  Non-first RT waiter    First waiter      Lock holder
  -------------------    ------------      -----------
  Acquire wait_lock
  rwsem_try_write_lock():
    Set handoff bit if RT or
      wait too long
    Set waiter->handoff_set
  Release wait_lock
                         Acquire wait_lock
                         Inherit waiter->handoff_set
                         Release wait_lock
					   Clear owner
                                           Release lock
  if (waiter.handoff_set) {
    rwsem_spin_on_owner(();
    if (OWNER_NULL)
      goto trylock_again;
  }
  trylock_again:
  Acquire wait_lock
  rwsem_try_write_lock():
     if (first->handoff_set && (waiter != first))
	return false;
  Release wait_lock

A non-first waiter cannot really acquire the rwsem even if it mistakenly
believes that it can spin on OWNER_NULL value. If that waiter happens
to be an RT task running on the same CPU as the first waiter, it can
block the first waiter from acquiring the rwsem leading to live lock.
Fix this problem by making sure that a non-first waiter cannot spin in
the slowpath loop without sleeping.

Fixes: d257cc8cb8 ("locking/rwsem: Make handoff bit handling more consistent")
Signed-off-by: Waiman Long <longman@redhat.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Tested-by: Mukesh Ojha <quic_mojha@quicinc.com>
Reviewed-by: Mukesh Ojha <quic_mojha@quicinc.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20230126003628.365092-2-longman@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-03-10 09:34:06 +01:00
Greg Kroah-Hartman
5100c4efc3 PM: EM: fix memory leak with using debugfs_lookup()
[ Upstream commit a0e8c13ccd ]

When calling debugfs_lookup() the result must have dput() called on it,
otherwise the memory will leak over time.  To make things simpler, just
call debugfs_lookup_and_remove() instead which handles all of the logic
at once.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-10 09:33:53 +01:00
Greg Kroah-Hartman
15cffd01ed time/debug: Fix memory leak with using debugfs_lookup()
[ Upstream commit 5b268d8aba ]

When calling debugfs_lookup() the result must have dput() called on it,
otherwise the memory will leak over time.  To make things simpler, just
call debugfs_lookup_and_remove() instead which handles all of the logic at
once.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/r/20230202151214.2306822-1-gregkh@linuxfoundation.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-10 09:33:52 +01:00
Feng Tang
856dbac0a8 clocksource: Suspend the watchdog temporarily when high read latency detected
[ Upstream commit b7082cdfc4 ]

Bugs have been reported on 8 sockets x86 machines in which the TSC was
wrongly disabled when the system is under heavy workload.

 [ 818.380354] clocksource: timekeeping watchdog on CPU336: hpet wd-wd read-back delay of 1203520ns
 [ 818.436160] clocksource: wd-tsc-wd read-back delay of 181880ns, clock-skew test skipped!
 [ 819.402962] clocksource: timekeeping watchdog on CPU338: hpet wd-wd read-back delay of 324000ns
 [ 819.448036] clocksource: wd-tsc-wd read-back delay of 337240ns, clock-skew test skipped!
 [ 819.880863] clocksource: timekeeping watchdog on CPU339: hpet read-back delay of 150280ns, attempt 3, marking unstable
 [ 819.936243] tsc: Marking TSC unstable due to clocksource watchdog
 [ 820.068173] TSC found unstable after boot, most likely due to broken BIOS. Use 'tsc=unstable'.
 [ 820.092382] sched_clock: Marking unstable (818769414384, 1195404998)
 [ 820.643627] clocksource: Checking clocksource tsc synchronization from CPU 267 to CPUs 0,4,25,70,126,430,557,564.
 [ 821.067990] clocksource: Switched to clocksource hpet

This can be reproduced by running memory intensive 'stream' tests,
or some of the stress-ng subcases such as 'ioport'.

The reason for these issues is the when system is under heavy load, the
read latency of the clocksources can be very high.  Even lightweight TSC
reads can show high latencies, and latencies are much worse for external
clocksources such as HPET or the APIC PM timer.  These latencies can
result in false-positive clocksource-unstable determinations.

These issues were initially reported by a customer running on a production
system, and this problem was reproduced on several generations of Xeon
servers, especially when running the stress-ng test.  These Xeon servers
were not production systems, but they did have the latest steppings
and firmware.

Given that the clocksource watchdog is a continual diagnostic check with
frequency of twice a second, there is no need to rush it when the system
is under heavy load.  Therefore, when high clocksource read latencies
are detected, suspend the watchdog timer for 5 minutes.

Signed-off-by: Feng Tang <feng.tang@intel.com>
Acked-by: Waiman Long <longman@redhat.com>
Cc: John Stultz <jstultz@google.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Stephen Boyd <sboyd@kernel.org>
Cc: Feng Tang <feng.tang@intel.com>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-10 09:33:50 +01:00
Jann Horn
3a43a366ec timers: Prevent union confusion from unexpected restart_syscall()
[ Upstream commit 9f76d59173 ]

The nanosleep syscalls use the restart_block mechanism, with a quirk:
The `type` and `rmtp`/`compat_rmtp` fields are set up unconditionally on
syscall entry, while the rest of the restart_block is only set up in the
unlikely case that the syscall is actually interrupted by a signal (or
pseudo-signal) that doesn't have a signal handler.

If the restart_block was set up by a previous syscall (futex(...,
FUTEX_WAIT, ...) or poll()) and hasn't been invalidated somehow since then,
this will clobber some of the union fields used by futex_wait_restart() and
do_restart_poll().

If userspace afterwards wrongly calls the restart_syscall syscall,
futex_wait_restart()/do_restart_poll() will read struct fields that have
been clobbered.

This doesn't actually lead to anything particularly interesting because
none of the union fields contain trusted kernel data, and
futex(..., FUTEX_WAIT, ...) and poll() aren't syscalls where it makes much
sense to apply seccomp filters to their arguments.

So the current consequences are just of the "if userspace does bad stuff,
it can damage itself, and that's not a problem" flavor.

But still, it seems like a hazard for future developers, so invalidate the
restart_block when partly setting it up in the nanosleep syscalls.

Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/r/20230105134403.754986-1-jannh@google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-10 09:33:49 +01:00
Zqiang
5a2153b83c rcu-tasks: Handle queue-shrink/callback-enqueue race condition
[ Upstream commit a4fcfbee8f ]

The rcu_tasks_need_gpcb() determines whether or not: (1) There are
callbacks needing another grace period, (2) There are callbacks ready
to be invoked, and (3) It would be a good time to shrink back down to a
single-CPU callback list.  This third case is interesting because some
other CPU might be adding new callbacks, which might suddenly make this
a very bad time to be shrinking.

This is currently handled by requiring call_rcu_tasks_generic() to
enqueue callbacks under the protection of rcu_read_lock() and requiring
rcu_tasks_need_gpcb() to wait for an RCU grace period to elapse before
finalizing the transition.  This works well in practice.

Unfortunately, the current code assumes that a grace period whose end is
detected by the poll_state_synchronize_rcu() in the second "if" condition
actually ended before the earlier code counted the callbacks queued on
CPUs other than CPU 0 (local variable "ncbsnz").  Given the current code,
it is possible that a long-delayed call_rcu_tasks_generic() invocation
will queue a callback on a non-zero CPU after these CPUs have had their
callbacks counted and zero has been stored to ncbsnz.  Such a callback
would trigger the WARN_ON_ONCE() in the second "if" statement.

To see this, consider the following sequence of events:

o	CPU 0 invokes rcu_tasks_one_gp(), and counts fewer than
	rcu_task_collapse_lim callbacks.  It sees at least one
	callback queued on some other CPU, thus setting ncbsnz
	to a non-zero value.

o	CPU 1 invokes call_rcu_tasks_generic() and loads 42 from
	->percpu_enqueue_lim.  It therefore decides to enqueue its
	callback onto CPU 1's callback list, but is delayed.

o	CPU 0 sees the rcu_task_cb_adjust is non-zero and that the number
	of callbacks does not exceed rcu_task_collapse_lim.  It therefore
	checks percpu_enqueue_lim, and sees that its value is greater
	than the value one.  CPU 0 therefore  starts the shift back
	to a single callback list.  It sets ->percpu_enqueue_lim to 1,
	but CPU 1 has already read the old value of 42.  It also gets
	a grace-period state value from get_state_synchronize_rcu().

o	CPU 0 sees that ncbsnz is non-zero in its second "if" statement,
	so it declines to finalize the shrink operation.

o	CPU 0 again invokes rcu_tasks_one_gp(), and counts fewer than
	rcu_task_collapse_lim callbacks.  It also sees that there are
	no callback queued on any other CPU, and thus sets ncbsnz to zero.

o	CPU 1 resumes execution and enqueues its callback onto its own
	list.  This invalidates the value of ncbsnz.

o	CPU 0 sees the rcu_task_cb_adjust is non-zero and that the number
	of callbacks does not exceed rcu_task_collapse_lim.  It therefore
	checks percpu_enqueue_lim, but sees that its value is already
	unity.	It therefore does not get a new grace-period state value.

o	CPU 0 sees that rcu_task_cb_adjust is non-zero, ncbsnz is zero,
	and that poll_state_synchronize_rcu() says that the grace period
	has completed.  it therefore finalizes the shrink operation,
	setting ->percpu_dequeue_lim to the value one.

o	CPU 0 does a debug check, scanning the other CPUs' callback lists.
	It sees that CPU 1's list has a callback, so it (rightly)
	triggers the WARN_ON_ONCE().  After all, the new value of
	->percpu_dequeue_lim says to not bother looking at CPU 1's
	callback list, which means that this callback will never be
	invoked.  This can result in hangs and maybe even OOMs.

Based on long experience with rcutorture, this is an extremely
low-probability race condition, but it really can happen, especially in
preemptible kernels or within guest OSes.

This commit therefore checks for completion of the grace period
before counting callbacks.  With this change, in the above failure
scenario CPU 0 would know not to prematurely end the shrink operation
because the grace period would not have completed before the count
operation started.

[ paulmck: Adjust grace-period end rather than adding RCU reader. ]
[ paulmck: Avoid spurious WARN_ON_ONCE() with ->percpu_dequeue_lim check. ]

Signed-off-by: Zqiang <qiang1.zhang@intel.com>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-10 09:33:48 +01:00
Zqiang
94ed8ac1bb rcu-tasks: Make rude RCU-Tasks work well with CPU hotplug
[ Upstream commit ea5c8987fe ]

The synchronize_rcu_tasks_rude() function invokes rcu_tasks_rude_wait_gp()
to wait one rude RCU-tasks grace period.  The rcu_tasks_rude_wait_gp()
function in turn checks if there is only a single online CPU.  If so, it
will immediately return, because a call to synchronize_rcu_tasks_rude()
is by definition a grace period on a single-CPU system.  (We could
have blocked!)

Unfortunately, this check uses num_online_cpus() without synchronization,
which can result in too-short grace periods.  To see this, consider the
following scenario:

        CPU0                                   CPU1 (going offline)
                                          migration/1 task:
                                      cpu_stopper_thread
                                       -> take_cpu_down
                                          -> _cpu_disable
                                           (dec __num_online_cpus)
                                          ->cpuhp_invoke_callback
                                                preempt_disable
                                                access old_data0
           task1
 del old_data0                                  .....
 synchronize_rcu_tasks_rude()
 task1 schedule out
 ....
 task2 schedule in
 rcu_tasks_rude_wait_gp()
     ->__num_online_cpus == 1
       ->return
 ....
 task1 schedule in
 ->free old_data0
                                                preempt_enable

When CPU1 decrements __num_online_cpus, its value becomes 1.  However,
CPU1 has not finished going offline, and will take one last trip through
the scheduler and the idle loop before it actually stops executing
instructions.  Because synchronize_rcu_tasks_rude() is mostly used for
tracing, and because both the scheduler and the idle loop can be traced,
this means that CPU0's prematurely ended grace period might disrupt the
tracing on CPU1.  Given that this disruption might include CPU1 executing
instructions in memory that was just now freed (and maybe reallocated),
this is a matter of some concern.

This commit therefore removes that problematic single-CPU check from the
rcu_tasks_rude_wait_gp() function.  This dispenses with the single-CPU
optimization, but there is no evidence indicating that this optimization
is important.  In addition, synchronize_rcu_tasks_generic() contains a
similar optimization (albeit only for early boot), which also splats.
(As in exactly why are you invoking synchronize_rcu_tasks_rude() so
early in boot, anyway???)

It is OK for the synchronize_rcu_tasks_rude() function's check to be
unsynchronized because the only times that this check can evaluate to
true is when there is only a single CPU running with preemption
disabled.

While in the area, this commit also fixes a minor bug in which a
call to synchronize_rcu_tasks_rude() would instead be attributed to
synchronize_rcu_tasks().

[ paulmck: Add "synchronize_" prefix and "()" suffix. ]

Signed-off-by: Zqiang <qiang1.zhang@intel.com>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-10 09:33:48 +01:00
Pingfan Liu
2c4d26dad7 srcu: Delegate work to the boot cpu if using SRCU_SIZE_SMALL
[ Upstream commit 7f24626d6d ]

Commit 994f706872 ("srcu: Make Tree SRCU able to operate without
snp_node array") assumes that cpu 0 is always online.  However, there
really are situations when some other CPU is the boot CPU, for example,
when booting a kdump kernel with the maxcpus=1 boot parameter.

On PowerPC, the kdump kernel can hang as follows:
...
[    1.740036] systemd[1]: Hostname set to <xyz.com>
[  243.686240] INFO: task systemd:1 blocked for more than 122 seconds.
[  243.686264]       Not tainted 6.1.0-rc1 #1
[  243.686272] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[  243.686281] task:systemd         state:D stack:0     pid:1     ppid:0      flags:0x00042000
[  243.686296] Call Trace:
[  243.686301] [c000000016657640] [c000000016657670] 0xc000000016657670 (unreliable)
[  243.686317] [c000000016657830] [c00000001001dec0] __switch_to+0x130/0x220
[  243.686333] [c000000016657890] [c000000010f607b8] __schedule+0x1f8/0x580
[  243.686347] [c000000016657940] [c000000010f60bb4] schedule+0x74/0x140
[  243.686361] [c0000000166579b0] [c000000010f699b8] schedule_timeout+0x168/0x1c0
[  243.686374] [c000000016657a80] [c000000010f61de8] __wait_for_common+0x148/0x360
[  243.686387] [c000000016657b20] [c000000010176bb0] __flush_work.isra.0+0x1c0/0x3d0
[  243.686401] [c000000016657bb0] [c0000000105f2768] fsnotify_wait_marks_destroyed+0x28/0x40
[  243.686415] [c000000016657bd0] [c0000000105f21b8] fsnotify_destroy_group+0x68/0x160
[  243.686428] [c000000016657c40] [c0000000105f6500] inotify_release+0x30/0xa0
[  243.686440] [c000000016657cb0] [c0000000105751a8] __fput+0xc8/0x350
[  243.686452] [c000000016657d00] [c00000001017d524] task_work_run+0xe4/0x170
[  243.686464] [c000000016657d50] [c000000010020e94] do_notify_resume+0x134/0x140
[  243.686478] [c000000016657d80] [c00000001002eb18] interrupt_exit_user_prepare_main+0x198/0x270
[  243.686493] [c000000016657de0] [c00000001002ec60] syscall_exit_prepare+0x70/0x180
[  243.686505] [c000000016657e10] [c00000001000bf7c] system_call_vectored_common+0xfc/0x280
[  243.686520] --- interrupt: 3000 at 0x7fffa47d5ba4
[  243.686528] NIP:  00007fffa47d5ba4 LR: 0000000000000000 CTR: 0000000000000000
[  243.686538] REGS: c000000016657e80 TRAP: 3000   Not tainted  (6.1.0-rc1)
[  243.686548] MSR:  800000000000d033 <SF,EE,PR,ME,IR,DR,RI,LE>  CR: 42044440  XER: 00000000
[  243.686572] IRQMASK: 0
[  243.686572] GPR00: 0000000000000006 00007ffffa606710 00007fffa48e7200 0000000000000000
[  243.686572] GPR04: 0000000000000002 000000000000000a 0000000000000000 0000000000000001
[  243.686572] GPR08: 000001000c172dd0 0000000000000000 0000000000000000 0000000000000000
[  243.686572] GPR12: 0000000000000000 00007fffa4ff4bc0 0000000000000000 0000000000000000
[  243.686572] GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
[  243.686572] GPR20: 0000000132dfdc50 000000000000000e 0000000000189375 0000000000000000
[  243.686572] GPR24: 00007ffffa606ae0 0000000000000005 000001000c185490 000001000c172570
[  243.686572] GPR28: 000001000c172990 000001000c184850 000001000c172e00 00007fffa4fedd98
[  243.686683] NIP [00007fffa47d5ba4] 0x7fffa47d5ba4
[  243.686691] LR [0000000000000000] 0x0
[  243.686698] --- interrupt: 3000
[  243.686708] INFO: task kworker/u16:1:24 blocked for more than 122 seconds.
[  243.686717]       Not tainted 6.1.0-rc1 #1
[  243.686724] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[  243.686733] task:kworker/u16:1   state:D stack:0     pid:24    ppid:2      flags:0x00000800
[  243.686747] Workqueue: events_unbound fsnotify_mark_destroy_workfn
[  243.686758] Call Trace:
[  243.686762] [c0000000166736e0] [c00000004fd91000] 0xc00000004fd91000 (unreliable)
[  243.686775] [c0000000166738d0] [c00000001001dec0] __switch_to+0x130/0x220
[  243.686788] [c000000016673930] [c000000010f607b8] __schedule+0x1f8/0x580
[  243.686801] [c0000000166739e0] [c000000010f60bb4] schedule+0x74/0x140
[  243.686814] [c000000016673a50] [c000000010f699b8] schedule_timeout+0x168/0x1c0
[  243.686827] [c000000016673b20] [c000000010f61de8] __wait_for_common+0x148/0x360
[  243.686840] [c000000016673bc0] [c000000010210840] __synchronize_srcu.part.0+0xa0/0xe0
[  243.686855] [c000000016673c30] [c0000000105f2c64] fsnotify_mark_destroy_workfn+0xc4/0x1a0
[  243.686868] [c000000016673ca0] [c000000010174ea8] process_one_work+0x2a8/0x570
[  243.686882] [c000000016673d40] [c000000010175208] worker_thread+0x98/0x5e0
[  243.686895] [c000000016673dc0] [c0000000101828d4] kthread+0x124/0x130
[  243.686908] [c000000016673e10] [c00000001000cd40] ret_from_kernel_thread+0x5c/0x64
[  366.566274] INFO: task systemd:1 blocked for more than 245 seconds.
[  366.566298]       Not tainted 6.1.0-rc1 #1
[  366.566305] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[  366.566314] task:systemd         state:D stack:0     pid:1     ppid:0      flags:0x00042000
[  366.566329] Call Trace:
...

The above splat occurs because PowerPC really does use maxcpus=1
instead of nr_cpus=1 in the kernel command line.  Consequently, the
(quite possibly non-zero) kdump CPU is the only online CPU in the kdump
kernel.  SRCU unconditionally queues a sdp->work on cpu 0, for which no
worker thread has been created, so sdp->work will be never executed and
__synchronize_srcu() will never be completed.

This commit therefore replaces CPU ID 0 with get_boot_cpu_id() in key
places in Tree SRCU.  Since the CPU indicated by get_boot_cpu_id()
is guaranteed to be online, this avoids the above splat.

Signed-off-by: Pingfan Liu <kernelfans@gmail.com>
Cc: "Paul E. McKenney" <paulmck@kernel.org>
Cc: Lai Jiangshan <jiangshanlai@gmail.com>
Cc: Josh Triplett <josh@joshtriplett.org>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
To: rcu@vger.kernel.org
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-10 09:33:48 +01:00
Paul E. McKenney
05737bd85c rcu: Suppress smp_processor_id() complaint in synchronize_rcu_expedited_wait()
[ Upstream commit 2d7f00b2f0 ]

The normal grace period's RCU CPU stall warnings are invoked from the
scheduling-clock interrupt handler, and can thus invoke smp_processor_id()
with impunity, which allows them to directly invoke dump_cpu_task().
In contrast, the expedited grace period's RCU CPU stall warnings are
invoked from process context, which causes the dump_cpu_task() function's
calls to smp_processor_id() to complain bitterly in debug kernels.

This commit therefore causes synchronize_rcu_expedited_wait() to disable
preemption around its call to dump_cpu_task().

Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-10 09:33:48 +01:00
Peter Zijlstra
b78434f6ee cpuidle: lib/bug: Disable rcu_is_watching() during WARN/BUG
[ Upstream commit 5a5d7e9bad ]

In order to avoid WARN/BUG from generating nested or even recursive
warnings, force rcu_is_watching() true during
WARN/lockdep_rcu_suspicious().

Notably things like unwinding the stack can trigger rcu_dereference()
warnings, which then triggers more unwinding which then triggers more
warnings etc..

Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Link: https://lore.kernel.org/r/20230126151323.408156109@infradead.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-10 09:33:47 +01:00
Greg Kroah-Hartman
3036f5f5ae trace/blktrace: fix memory leak with using debugfs_lookup()
[ Upstream commit 83e8864fee ]

When calling debugfs_lookup() the result must have dput() called on it,
otherwise the memory will leak over time.  To make things simpler, just
call debugfs_lookup_and_remove() instead which handles all of the logic
at once.

Cc: Jens Axboe <axboe@kernel.dk>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: linux-block@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: linux-trace-kernel@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Link: https://lore.kernel.org/r/20230202141956.2299521-1-gregkh@linuxfoundation.org
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-10 09:33:46 +01:00
Nicholas Piggin
711bd1b553 exit: Detect and fix irq disabled state in oops
[ Upstream commit 001c28e571 ]

If a task oopses with irqs disabled, this can cause various cascading
problems in the oops path such as sleep-from-invalid warnings, and
potentially worse.

Since commit 0258b5fd7c ("coredump: Limit coredumps to a single
thread group"), the unconditional irq enable in coredump_task_exit()
will "fix" the irq state to be enabled early in do_exit(), so currently
this may not be triggerable, but that is coincidental and fragile.

Detect and fix the irqs_disabled() condition in the oops path before
calling do_exit(), similarly to the way in_atomic() is handled.

Reported-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: "Eric W. Biederman" <ebiederm@xmission.com>
Link: https://lore.kernel.org/lkml/20221004094401.708299-1-npiggin@gmail.com/
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-10 09:33:45 +01:00
Peter Zijlstra
982f8ef8ec context_tracking: Fix noinstr vs KASAN
[ Upstream commit 0e26e1de00 ]

Low level noinstr context-tracking code is calling out to instrumented
code on KASAN:

  vmlinux.o: warning: objtool: __ct_user_enter+0x72: call to __kasan_check_write() leaves .noinstr.text section
  vmlinux.o: warning: objtool: __ct_user_exit+0x47: call to __kasan_check_write() leaves .noinstr.text section

Use even lower level atomic methods to avoid the instrumentation.

Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Link: https://lore.kernel.org/r/20230112195542.458034262@infradead.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-10 09:33:45 +01:00
Andrii Nakryiko
bb1cc7fc3e bpf: Fix global subprog context argument resolution logic
[ Upstream commit d384dce281 ]

KPROBE program's user-facing context type is defined as typedef
bpf_user_pt_regs_t. This leads to a problem when trying to passing
kprobe/uprobe/usdt context argument into global subprog, as kernel
always strip away mods and typedefs of user-supplied type, but takes
expected type from bpf_ctx_convert as is, which causes mismatch.

Current way to work around this is to define a fake struct with the same
name as expected typedef:

  struct bpf_user_pt_regs_t {};

  __noinline my_global_subprog(struct bpf_user_pt_regs_t *ctx) { ... }

This patch fixes the issue by resolving expected type, if it's not
a struct. It still leaves the above work-around working for backwards
compatibility.

Fixes: 91cc1a9974 ("bpf: Annotate context types")
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Stanislav Fomichev <sdf@google.com>
Link: https://lore.kernel.org/bpf/20230216045954.3002473-2-andrii@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-10 09:33:06 +01:00
Hou Tao
678ea18d62 bpf: Zeroing allocated object from slab in bpf memory allocator
[ Upstream commit 997849c4b9 ]

Currently the freed element in bpf memory allocator may be immediately
reused, for htab map the reuse will reinitialize special fields in map
value (e.g., bpf_spin_lock), but lookup procedure may still access
these special fields, and it may lead to hard-lockup as shown below:

 NMI backtrace for cpu 16
 CPU: 16 PID: 2574 Comm: htab.bin Tainted: G             L     6.1.0+ #1
 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
 RIP: 0010:queued_spin_lock_slowpath+0x283/0x2c0
 ......
 Call Trace:
  <TASK>
  copy_map_value_locked+0xb7/0x170
  bpf_map_copy_value+0x113/0x3c0
  __sys_bpf+0x1c67/0x2780
  __x64_sys_bpf+0x1c/0x20
  do_syscall_64+0x30/0x60
  entry_SYSCALL_64_after_hwframe+0x46/0xb0
 ......
  </TASK>

For htab map, just like the preallocated case, these is no need to
initialize these special fields in map value again once these fields
have been initialized. For preallocated htab map, these fields are
initialized through __GFP_ZERO in bpf_map_area_alloc(), so do the
similar thing for non-preallocated htab in bpf memory allocator. And
there is no need to use __GFP_ZERO for per-cpu bpf memory allocator,
because __alloc_percpu_gfp() does it implicitly.

Fixes: 0fd7c5d433 ("bpf: Optimize call_rcu in non-preallocated hash map.")
Signed-off-by: Hou Tao <houtao1@huawei.com>
Link: https://lore.kernel.org/r/20230215082132.3856544-2-houtao@huaweicloud.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-10 09:33:06 +01:00
Lai Jiangshan
0903111d67 workqueue: Protects wq_unbound_cpumask with wq_pool_attach_mutex
[ Upstream commit 99c621ef24 ]

When unbind_workers() reads wq_unbound_cpumask to set the affinity of
freshly-unbound kworkers, it only holds wq_pool_attach_mutex. This isn't
sufficient as wq_unbound_cpumask is only protected by wq_pool_mutex.

Make wq_unbound_cpumask protected with wq_pool_attach_mutex and also
remove the need of temporary saved_cpumask.

Fixes: 10a5a651e3 ("workqueue: Restrict kworker in the offline CPU pool running on housekeeping CPUs")
Reported-by: Valentin Schneider <vschneid@redhat.com>
Signed-off-by: Lai Jiangshan <jiangshan.ljs@antgroup.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-10 09:32:53 +01:00
Frederic Weisbecker
62030a4915 rcu-tasks: Fix synchronize_rcu_tasks() VS zap_pid_ns_processes()
[ Upstream commit 28319d6dc5 ]

RCU Tasks and PID-namespace unshare can interact in do_exit() in a
complicated circular dependency:

1) TASK A calls unshare(CLONE_NEWPID), this creates a new PID namespace
   that every subsequent child of TASK A will belong to. But TASK A
   doesn't itself belong to that new PID namespace.

2) TASK A forks() and creates TASK B. TASK A stays attached to its PID
   namespace (let's say PID_NS1) and TASK B is the first task belonging
   to the new PID namespace created by unshare()  (let's call it PID_NS2).

3) Since TASK B is the first task attached to PID_NS2, it becomes the
   PID_NS2 child reaper.

4) TASK A forks() again and creates TASK C which get attached to PID_NS2.
   Note how TASK C has TASK A as a parent (belonging to PID_NS1) but has
   TASK B (belonging to PID_NS2) as a pid_namespace child_reaper.

5) TASK B exits and since it is the child reaper for PID_NS2, it has to
   kill all other tasks attached to PID_NS2, and wait for all of them to
   die before getting reaped itself (zap_pid_ns_process()).

6) TASK A calls synchronize_rcu_tasks() which leads to
   synchronize_srcu(&tasks_rcu_exit_srcu).

7) TASK B is waiting for TASK C to get reaped. But TASK B is under a
   tasks_rcu_exit_srcu SRCU critical section (exit_notify() is between
   exit_tasks_rcu_start() and exit_tasks_rcu_finish()), blocking TASK A.

8) TASK C exits and since TASK A is its parent, it waits for it to reap
   TASK C, but it can't because TASK A waits for TASK B that waits for
   TASK C.

Pid_namespace semantics can hardly be changed at this point. But the
coverage of tasks_rcu_exit_srcu can be reduced instead.

The current task is assumed not to be concurrently reapable at this
stage of exit_notify() and therefore tasks_rcu_exit_srcu can be
temporarily relaxed without breaking its constraints, providing a way
out of the deadlock scenario.

[ paulmck: Fix build failure by adding additional declaration. ]

Fixes: 3f95aa81d2 ("rcu: Make TASKS_RCU handle tasks that are almost done exiting")
Reported-by: Pengfei Xu <pengfei.xu@intel.com>
Suggested-by: Boqun Feng <boqun.feng@gmail.com>
Suggested-by: Neeraj Upadhyay <quic_neeraju@quicinc.com>
Suggested-by: Paul E. McKenney <paulmck@kernel.org>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Lai Jiangshan <jiangshanlai@gmail.com>
Cc: Eric W . Biederman <ebiederm@xmission.com>
Signed-off-by: Frederic Weisbecker <frederic@kernel.org>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-10 09:32:52 +01:00
Frederic Weisbecker
24f259ce3a rcu-tasks: Remove preemption disablement around srcu_read_[un]lock() calls
[ Upstream commit 4475709295 ]

Ever since the following commit:

	5a41344a3d ("srcu: Simplify __srcu_read_unlock() via this_cpu_dec()")

SRCU doesn't rely anymore on preemption to be disabled in order to
modify the per-CPU counter. And even then it used to be done from the API
itself.

Therefore and after checking further, it appears to be safe to remove
the preemption disablement around __srcu_read_[un]lock() in
exit_tasks_rcu_start() and exit_tasks_rcu_finish()

Suggested-by: Boqun Feng <boqun.feng@gmail.com>
Suggested-by: Paul E. McKenney <paulmck@kernel.org>
Suggested-by: Neeraj Upadhyay <quic_neeraju@quicinc.com>
Cc: Lai Jiangshan <jiangshanlai@gmail.com>
Signed-off-by: Frederic Weisbecker <frederic@kernel.org>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Stable-dep-of: 28319d6dc5 ("rcu-tasks: Fix synchronize_rcu_tasks() VS zap_pid_ns_processes()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-10 09:32:51 +01:00
Frederic Weisbecker
a2b0cda452 rcu-tasks: Improve comments explaining tasks_rcu_exit_srcu purpose
[ Upstream commit e4e1e8089c ]

Make sure we don't need to look again into the depths of git blame in
order not to miss a subtle part about how rcu-tasks is dealing with
exiting tasks.

Suggested-by: Boqun Feng <boqun.feng@gmail.com>
Suggested-by: Neeraj Upadhyay <quic_neeraju@quicinc.com>
Suggested-by: Paul E. McKenney <paulmck@kernel.org>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Lai Jiangshan <jiangshanlai@gmail.com>
Cc: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Frederic Weisbecker <frederic@kernel.org>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Stable-dep-of: 28319d6dc5 ("rcu-tasks: Fix synchronize_rcu_tasks() VS zap_pid_ns_processes()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-10 09:32:51 +01:00
Pietro Borrello
6b4fcc4e8a sched/rt: pick_next_rt_entity(): check list_entry
[ Upstream commit 7c4a5b89a0 ]

Commit 326587b840 ("sched: fix goto retry in pick_next_task_rt()")
removed any path which could make pick_next_rt_entity() return NULL.
However, BUG_ON(!rt_se) in _pick_next_task_rt() (the only caller of
pick_next_rt_entity()) still checks the error condition, which can
never happen, since list_entry() never returns NULL.
Remove the BUG_ON check, and instead emit a warning in the only
possible error condition here: the queue being empty which should
never happen.

Fixes: 326587b840 ("sched: fix goto retry in pick_next_task_rt()")
Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Phil Auld <pauld@redhat.com>
Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Link: https://lore.kernel.org/r/20230128-list-entry-null-check-sched-v3-1-b1a71bd1ac6b@diag.uniroma1.it
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-10 09:32:45 +01:00
Waiman Long
fd38b56f3a locking/rwsem: Disable preemption in all down_read*() and up_read() code paths
[ Upstream commit 3f5245538a ]

Commit:

  91d2a812df ("locking/rwsem: Make handoff writer optimistically spin on owner")

... assumes that when the owner field is changed to NULL, the lock will
become free soon. But commit:

  48dfb5d256 ("locking/rwsem: Disable preemption while trying for rwsem lock")

... disabled preemption when acquiring rwsem for write.

However, preemption has not yet been disabled when acquiring a read lock
on a rwsem.  So a reader can add a RWSEM_READER_BIAS to count without
setting owner to signal a reader, got preempted out by a RT task which
then spins in the writer slowpath as owner remains NULL leading to live lock.

One easy way to fix this problem is to disable preemption at all the
down_read*() and up_read() code paths as implemented in this patch.

Fixes: 91d2a812df ("locking/rwsem: Make handoff writer optimistically spin on owner")
Reported-by: Mukesh Ojha <quic_mojha@quicinc.com>
Suggested-by: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Waiman Long <longman@redhat.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Link: https://lore.kernel.org/r/20230126003628.365092-3-longman@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-10 09:32:41 +01:00
Neill Kapron
bd772a54d2 Revert "exit: Remove profile_task_exit & profile_munmap"
This reverts commit 2d4bcf886e, which
removed hooks required for Android uid_sys_stats.c.

Bug: 219790626
Change-Id: Icea00bbf9abe2fb17312b25f2d575d29aa360999
[nkapron: resolve conflict with 2873cd31a2 exit: Remove profile_handoff_task]
Signed-off-by: Neill Kapron <nkapron@google.com>
2023-03-09 23:13:08 +00:00
YOUNGJIN JOO
b97cdd877a ANDROID: printk: export symbol for tracepoint_console
Initial kernel bootup logs get overwritten after running
for a long time, and there can be debugging scenario where
we need initial ~100s bootup logs for debugging.
'tracepoint_console' is helping in achieving this purpose.

'tracepoint_console' replaces 'android_vh_log_buf' and
'android_vh_logbuf_pr_cong' vendor hooks in previous GKI kernels.

Bug: 271373835
Change-Id: If68801ba584e8e71e3e7aa16c64a5588c1f5a114
Signed-off-by: YOUNGJIN JOO <youngjin79.joo@samsung.com>
2023-03-03 17:15:34 +00:00
Greg Kroah-Hartman
e1300f4942 Merge 6.1.15 into android14-6.1
Changes in 6.1.15
	Fix XFRM-I support for nested ESP tunnels
	arm64: dts: rockchip: reduce thermal limits on rk3399-pinephone-pro
	arm64: dts: rockchip: drop unused LED mode property from rk3328-roc-cc
	ARM: dts: rockchip: add power-domains property to dp node on rk3288
	arm64: dts: rockchip: add missing #interrupt-cells to rk356x pcie2x1
	arm64: dts: rockchip: fix probe of analog sound card on rock-3a
	HID: elecom: add support for TrackBall 056E:011C
	HID: Ignore battery for Elan touchscreen on Asus TP420IA
	ACPI: NFIT: fix a potential deadlock during NFIT teardown
	pinctrl: amd: Fix debug output for debounce time
	btrfs: send: limit number of clones and allocated memory size
	arm64: dts: rockchip: align rk3399 DMC OPP table with bindings
	ASoC: rt715-sdca: fix clock stop prepare timeout issue
	IB/hfi1: Assign npages earlier
	powerpc: Don't select ARCH_WANTS_NO_INSTR
	ASoC: SOF: amd: Fix for handling spurious interrupts from DSP
	ARM: dts: stihxxx-b2120: fix polarity of reset line of tsin0 port
	neigh: make sure used and confirmed times are valid
	HID: core: Fix deadloop in hid_apply_multiplier.
	ASoC: codecs: es8326: Fix DTS properties reading
	HID: Ignore battery for ELAN touchscreen 29DF on HP
	selftests: ocelot: tc_flower_chains: make test_vlan_ingress_modify() more comprehensive
	x86/cpu: Add Lunar Lake M
	PM: sleep: Avoid using pr_cont() in the tasks freezing code
	bpf: bpf_fib_lookup should not return neigh in NUD_FAILED state
	net: Remove WARN_ON_ONCE(sk->sk_forward_alloc) from sk_stream_kill_queues().
	vc_screen: don't clobber return value in vcs_read
	drm/amd/display: Move DCN314 DOMAIN power control to DMCUB
	drm/amd/display: Fix race condition in DPIA AUX transfer
	usb: dwc3: pci: add support for the Intel Meteor Lake-M
	USB: serial: option: add support for VW/Skoda "Carstick LTE"
	usb: gadget: u_serial: Add null pointer check in gserial_resume
	arm64: dts: uniphier: Fix property name in PXs3 USB node
	usb: typec: pd: Remove usb_suspend_supported sysfs from sink PDO
	drm/amd/display: Properly reuse completion structure
	attr: add in_group_or_capable()
	fs: move should_remove_suid()
	attr: add setattr_should_drop_sgid()
	attr: use consistent sgid stripping checks
	fs: use consistent setgid checks in is_sxid()
	scripts/tags.sh: fix incompatibility with PCRE2
	USB: core: Don't hold device lock while reading the "descriptors" sysfs file
	Linux 6.1.15

Change-Id: I2489d74e0905d26c0afb69f1036cb43890bec060
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-03-03 12:21:45 +00:00
Rafael J. Wysocki
f2173508b1 PM: sleep: Avoid using pr_cont() in the tasks freezing code
commit a449dfbfc0 upstream.

Using pr_cont() in the tasks freezing code related to system-wide
suspend and hibernation is problematic, because the continuation
messages printed there are susceptible to interspersing with other
unrelated messages which results in output that is hard to
understand.

Address this issue by modifying try_to_freeze_tasks() to print
messages that don't require continuations and adjusting its
callers accordingly.

Reported-by: Thomas Weißschuh <linux@weissschuh.net>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Petr Mladek <pmladek@suse.com>
Cc: Paul Menzel <pmenzel@molgen.mpg.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-03-03 11:52:23 +01:00
Will McVicker
d834db9f2c ANDROID: modules: re-introduce the MODULE_SCMVERSION config
Config MODULE_SCMVERSION introduces a new module attribute --
`scmversion` -- which can be used to identify a given module's SCM
version.  This is very useful for developers that update their kernel
independently from their kernel modules or vice-versa since the SCM
version provided by UTS_RELEASE (`uname -r`) will now differ from the
module's vermagic attribute.

For example, we have a CI setup that tests new kernel changes on the
hikey960 and db845c devices without updating their kernel modules. When
these tests fail, we need to be able to identify the exact device
configuration the test was using. By including MODULE_SCMVERSION, we can
identify the exact kernel and modules' SCM versions for debugging the
failures.

Additionally, by exposing the SCM version via the sysfs node
/sys/module/MODULENAME/scmversion, one can also verify the SCM versions
of the modules loaded from the initramfs. Currently, modinfo can only
retrieve module attributes from the module's ko on disk and not from the
actual module that is loaded in RAM.

You can retrieve the SCM version in two ways,

1) By using modinfo:
    > modinfo -F scmversion MODULENAME
2) By module sysfs node:
    > cat /sys/module/MODULENAME/scmversion

Bug: 180027765
Link: https://lore.kernel.org/all/20210121213641.3477522-1-willmcvicker@google.com/
Signed-off-by: Will McVicker <willmcvicker@google.com>
Change-Id: Ib7c72c72f95c4545adb7cd4e842729557039ce3a
2023-03-01 01:47:13 +00:00