Commit Graph

440 Commits

Author SHA1 Message Date
Greg Kroah-Hartman
642354c26d Merge 5.15.128 into android14-5.15-lts
Changes in 5.15.128
	mmc: sdhci-f-sdh30: Replace with sdhci_pltfm
	selftests: forwarding: tc_actions: cleanup temporary files when test is aborted
	selftests: forwarding: tc_actions: Use ncat instead of nc
	macsec: Fix traffic counters/statistics
	macsec: use DEV_STATS_INC()
	net/tls: Perform immediate device ctx cleanup when possible
	net/tls: Multi-threaded calls to TX tls_dev_del
	net: tls: avoid discarding data on record close
	PCI: tegra194: Fix possible array out of bounds access
	ARM: dts: imx6dl: prtrvt, prtvt7, prti6q, prtwd2: fix USB related warnings
	iopoll: Call cpu_relax() in busy loops
	ASoC: SOF: Intel: fix SoundWire/HDaudio mutual exclusion
	dma-remap: use kvmalloc_array/kvfree for larger dma memory remap
	HID: logitech-hidpp: Add USB and Bluetooth IDs for the Logitech G915 TKL Keyboard
	drm/amdgpu: install stub fence into potential unused fence pointers
	HID: add quirk for 03f0:464a HP Elite Presenter Mouse
	RDMA/mlx5: Return the firmware result upon destroying QP/RQ
	ovl: check type and offset of struct vfsmount in ovl_entry
	smb: client: fix warning in cifs_smb3_do_mount()
	media: v4l2-mem2mem: add lock to protect parameter num_rdy
	usb: gadget: u_serial: Avoid spinlock recursion in __gs_console_push
	media: platform: mediatek: vpu: fix NULL ptr dereference
	thunderbolt: Read retimer NVM authentication status prior tb_retimer_set_inbound_sbtx()
	usb: chipidea: imx: don't request QoS for imx8ulp
	usb: chipidea: imx: add missing USB PHY DPDM wakeup setting
	gfs2: Fix possible data races in gfs2_show_options()
	pcmcia: rsrc_nonstatic: Fix memory leak in nonstatic_release_resource_db()
	firewire: net: fix use after free in fwnet_finish_incoming_packet()
	watchdog: sp5100_tco: support Hygon FCH/SCH (Server Controller Hub)
	Bluetooth: L2CAP: Fix use-after-free
	Bluetooth: btusb: Add MT7922 bluetooth ID for the Asus Ally
	drm/amdgpu: Fix potential fence use-after-free v2
	fs/ntfs3: Enhance sanity check while generating attr_list
	fs: ntfs3: Fix possible null-pointer dereferences in mi_read()
	fs/ntfs3: Mark ntfs dirty when on-disk struct is corrupted
	ALSA: hda/realtek: Add quirks for Unis H3C Desktop B760 & Q760
	ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync()
	powerpc/kasan: Disable KCOV in KASAN code
	ring-buffer: Do not swap cpu_buffer during resize process
	iio: add addac subdirectory
	iio: adc: stx104: Utilize iomap interface
	iio: adc: stx104: Implement and utilize register structures
	iio: stx104: Move to addac subdirectory
	iio: addac: stx104: Fix race condition for stx104_write_raw()
	iio: addac: stx104: Fix race condition when converting analog-to-digital
	igc: read before write to SRRCTL register
	ARM: dts: aspeed: asrock: Correct firmware flash SPI clocks
	drm/amd/display: save restore hdcp state when display is unplugged from mst hub
	drm/amd/display: phase3 mst hdcp for multiple displays
	drm/amd/display: fix access hdcp_workqueue assert
	usb: dwc3: gadget: Synchronize IRQ between soft connect/disconnect
	usb: dwc3: Remove DWC3 locking during gadget suspend/resume
	usb: dwc3: Fix typos in gadget.c
	USB: dwc3: gadget: drop dead hibernation code
	usb: dwc3: gadget: Improve dwc3_gadget_suspend() and dwc3_gadget_resume()
	tty: serial: fsl_lpuart: Add i.MXRT1050 support
	tty: serial: fsl_lpuart: make rx_watermark configurable for different platforms
	tty: serial: fsl_lpuart: reduce RX watermark to 0 on LS1028A
	USB: dwc3: qcom: fix NULL-deref on suspend
	USB: dwc3: fix use-after-free on core driver unbind
	mmc: bcm2835: fix deferred probing
	mmc: sunxi: fix deferred probing
	ARM: dts: imx6sll: fixup of operating points
	ARM: dts: nxp/imx6sll: fix wrong property name in usbphy node
	btrfs: move out now unused BG from the reclaim list
	virtio-mmio: don't break lifecycle of vm_dev
	vduse: Use proper spinlock for IRQ injection
	cifs: fix potential oops in cifs_oplock_break
	i2c: bcm-iproc: Fix bcm_iproc_i2c_isr deadlock issue
	i2c: hisi: Only handle the interrupt of the driver's transfer
	fbdev: mmp: fix value check in mmphw_probe()
	powerpc/rtas_flash: allow user copy to flash block cache objects
	tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux
	tty: serial: fsl_lpuart: Clear the error flags by writing 1 for lpuart32 platforms
	btrfs: fix BUG_ON condition in btrfs_cancel_balance
	i2c: designware: Correct length byte validation logic
	i2c: designware: Handle invalid SMBus block data response length value
	net: xfrm: Fix xfrm_address_filter OOB read
	net: af_key: fix sadb_x_filter validation
	net: xfrm: Amend XFRMA_SEC_CTX nla_policy structure
	xfrm: fix slab-use-after-free in decode_session6
	ip6_vti: fix slab-use-after-free in decode_session6
	ip_vti: fix potential slab-use-after-free in decode_session6
	xfrm: add NULL check in xfrm_update_ae_params
	xfrm: add forgotten nla_policy for XFRMA_MTIMER_THRESH
	net: phy: fix IRQ-based wake-on-lan over hibernate / power off
	selftests: mirror_gre_changes: Tighten up the TTL test match
	drm/panel: simple: Fix AUO G121EAN01 panel timings according to the docs
	netfilter: nf_tables: fix false-positive lockdep splat
	netfilter: nf_tables: deactivate catchall elements in next generation
	ipvs: fix racy memcpy in proc_do_sync_threshold
	netfilter: nft_dynset: disallow object maps
	net: phy: broadcom: stub c45 read/write for 54810
	team: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves
	iavf: fix FDIR rule fields masks validation
	i40e: fix misleading debug logs
	net: dsa: mv88e6xxx: Wait for EEPROM done before HW reset
	sock: Fix misuse of sk_under_memory_pressure()
	net: do not allow gso_size to be set to GSO_BY_FRAGS
	bus: ti-sysc: Flush posted write on enable before reset
	arm64: dts: qcom: qrb5165-rb5: fix thermal zone conflict
	ARM: dts: imx: Set default tuning step for imx6sx usdhc
	ASoC: rt5665: add missed regulator_bulk_disable
	ASoC: meson: axg-tdm-formatter: fix channel slot allocation
	soc: aspeed: socinfo: Add kfree for kstrdup
	ALSA: hda/realtek - Remodified 3k pull low procedure
	riscv: uaccess: Return the number of bytes effectively not copied
	serial: 8250: Fix oops for port->pm on uart_change_pm()
	ALSA: usb-audio: Add support for Mythware XA001AU capture and playback interfaces.
	cifs: Release folio lock on fscache read hit.
	mmc: wbsd: fix double mmc_free_host() in wbsd_init()
	mmc: block: Fix in_flight[issue_type] value error
	drm/qxl: fix UAF on handle creation
	drm/amd: flush any delayed gfxoff on suspend entry
	netfilter: set default timeout to 3 secs for sctp shutdown send and recv state
	exfat: check if filename entries exceeds max filename length
	arm64: dts: rockchip: Disable HS400 for eMMC on ROCK Pi 4
	af_unix: Fix null-ptr-deref in unix_stream_sendpage().
	virtio-net: set queues after driver_ok
	net: fix the RTO timer retransmitting skb every 1ms if linear option is enabled
	mmc: f-sdh30: fix order of function calls in sdhci_f_sdh30_remove
	x86/cpu: Fix __x86_return_thunk symbol type
	x86/cpu: Fix up srso_safe_ret() and __x86_return_thunk()
	x86/alternative: Make custom return thunk unconditional
	objtool: Add frame-pointer-specific function ignore
	x86/ibt: Add ANNOTATE_NOENDBR
	x86/cpu: Clean up SRSO return thunk mess
	x86/cpu: Rename original retbleed methods
	x86/cpu: Rename srso_(.*)_alias to srso_alias_\1
	x86/cpu: Cleanup the untrain mess
	x86/srso: Explain the untraining sequences a bit more
	x86/static_call: Fix __static_call_fixup()
	x86/retpoline: Don't clobber RFLAGS during srso_safe_ret()
	x86/CPU/AMD: Fix the DIV(0) initial fix attempt
	x86/srso: Disable the mitigation on unaffected configurations
	x86/retpoline,kprobes: Fix position of thunk sections with CONFIG_LTO_CLANG
	objtool/x86: Fixup frame-pointer vs rethunk
	x86/srso: Correct the mitigation status when SMT is disabled
	Linux 5.15.128

Change-Id: Ifcc5fc8c3027b6550eab4996c9458438f7d065b4
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-09-01 20:05:06 +00:00
Greg Kroah-Hartman
a662b58fb5 Revert "ring-buffer: Fix wrong stat of cpu_buffer->read"
This reverts commit 23e8a65f9a which is
commit 2d093282b0 upstream.

It breaks the Android abi and isn't really needed for Android systems.
If it is needed in the future, it can come back in an ABI-safe way.

Bug: 161946584
Change-Id: I1def9966078008125f445941af21e518617a0011
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-08-29 16:52:47 +00:00
Chen Lin
49b830d75f ring-buffer: Do not swap cpu_buffer during resize process
[ Upstream commit 8a96c0288d ]

When ring_buffer_swap_cpu was called during resize process,
the cpu buffer was swapped in the middle, resulting in incorrect state.
Continuing to run in the wrong state will result in oops.

This issue can be easily reproduced using the following two scripts:
/tmp # cat test1.sh
//#! /bin/sh
for i in `seq 0 100000`
do
         echo 2000 > /sys/kernel/debug/tracing/buffer_size_kb
         sleep 0.5
         echo 5000 > /sys/kernel/debug/tracing/buffer_size_kb
         sleep 0.5
done
/tmp # cat test2.sh
//#! /bin/sh
for i in `seq 0 100000`
do
        echo irqsoff > /sys/kernel/debug/tracing/current_tracer
        sleep 1
        echo nop > /sys/kernel/debug/tracing/current_tracer
        sleep 1
done
/tmp # ./test1.sh &
/tmp # ./test2.sh &

A typical oops log is as follows, sometimes with other different oops logs.

[  231.711293] WARNING: CPU: 0 PID: 9 at kernel/trace/ring_buffer.c:2026 rb_update_pages+0x378/0x3f8
[  231.713375] Modules linked in:
[  231.714735] CPU: 0 PID: 9 Comm: kworker/0:1 Tainted: G        W          6.5.0-rc1-00276-g20edcec23f92 #15
[  231.716750] Hardware name: linux,dummy-virt (DT)
[  231.718152] Workqueue: events update_pages_handler
[  231.719714] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[  231.721171] pc : rb_update_pages+0x378/0x3f8
[  231.722212] lr : rb_update_pages+0x25c/0x3f8
[  231.723248] sp : ffff800082b9bd50
[  231.724169] x29: ffff800082b9bd50 x28: ffff8000825f7000 x27: 0000000000000000
[  231.726102] x26: 0000000000000001 x25: fffffffffffff010 x24: 0000000000000ff0
[  231.728122] x23: ffff0000c3a0b600 x22: ffff0000c3a0b5c0 x21: fffffffffffffe0a
[  231.730203] x20: ffff0000c3a0b600 x19: ffff0000c0102400 x18: 0000000000000000
[  231.732329] x17: 0000000000000000 x16: 0000000000000000 x15: 0000ffffe7aa8510
[  231.734212] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000002
[  231.736291] x11: ffff8000826998a8 x10: ffff800082b9baf0 x9 : ffff800081137558
[  231.738195] x8 : fffffc00030e82c8 x7 : 0000000000000000 x6 : 0000000000000001
[  231.740192] x5 : ffff0000ffbafe00 x4 : 0000000000000000 x3 : 0000000000000000
[  231.742118] x2 : 00000000000006aa x1 : 0000000000000001 x0 : ffff0000c0007208
[  231.744196] Call trace:
[  231.744892]  rb_update_pages+0x378/0x3f8
[  231.745893]  update_pages_handler+0x1c/0x38
[  231.746893]  process_one_work+0x1f0/0x468
[  231.747852]  worker_thread+0x54/0x410
[  231.748737]  kthread+0x124/0x138
[  231.749549]  ret_from_fork+0x10/0x20
[  231.750434] ---[ end trace 0000000000000000 ]---
[  233.720486] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
[  233.721696] Mem abort info:
[  233.721935]   ESR = 0x0000000096000004
[  233.722283]   EC = 0x25: DABT (current EL), IL = 32 bits
[  233.722596]   SET = 0, FnV = 0
[  233.722805]   EA = 0, S1PTW = 0
[  233.723026]   FSC = 0x04: level 0 translation fault
[  233.723458] Data abort info:
[  233.723734]   ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
[  233.724176]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0
[  233.724589]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[  233.725075] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000104943000
[  233.725592] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000
[  233.726231] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
[  233.726720] Modules linked in:
[  233.727007] CPU: 0 PID: 9 Comm: kworker/0:1 Tainted: G        W          6.5.0-rc1-00276-g20edcec23f92 #15
[  233.727777] Hardware name: linux,dummy-virt (DT)
[  233.728225] Workqueue: events update_pages_handler
[  233.728655] pstate: 200000c5 (nzCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[  233.729054] pc : rb_update_pages+0x1a8/0x3f8
[  233.729334] lr : rb_update_pages+0x154/0x3f8
[  233.729592] sp : ffff800082b9bd50
[  233.729792] x29: ffff800082b9bd50 x28: ffff8000825f7000 x27: 0000000000000000
[  233.730220] x26: 0000000000000000 x25: ffff800082a8b840 x24: ffff0000c0102418
[  233.730653] x23: 0000000000000000 x22: fffffc000304c880 x21: 0000000000000003
[  233.731105] x20: 00000000000001f4 x19: ffff0000c0102400 x18: ffff800082fcbc58
[  233.731727] x17: 0000000000000000 x16: 0000000000000001 x15: 0000000000000001
[  233.732282] x14: ffff8000825fe0c8 x13: 0000000000000001 x12: 0000000000000000
[  233.732709] x11: ffff8000826998a8 x10: 0000000000000ae0 x9 : ffff8000801b760c
[  233.733148] x8 : fefefefefefefeff x7 : 0000000000000018 x6 : ffff0000c03298c0
[  233.733553] x5 : 0000000000000002 x4 : 0000000000000000 x3 : 0000000000000000
[  233.733972] x2 : ffff0000c3a0b600 x1 : 0000000000000000 x0 : 0000000000000000
[  233.734418] Call trace:
[  233.734593]  rb_update_pages+0x1a8/0x3f8
[  233.734853]  update_pages_handler+0x1c/0x38
[  233.735148]  process_one_work+0x1f0/0x468
[  233.735525]  worker_thread+0x54/0x410
[  233.735852]  kthread+0x124/0x138
[  233.736064]  ret_from_fork+0x10/0x20
[  233.736387] Code: 92400000 910006b5 aa000021 aa0303f7 (f9400060)
[  233.736959] ---[ end trace 0000000000000000 ]---

After analysis, the seq of the error is as follows [1-5]:

int ring_buffer_resize(struct trace_buffer *buffer, unsigned long size,
			int cpu_id)
{
	for_each_buffer_cpu(buffer, cpu) {
		cpu_buffer = buffer->buffers[cpu];
		//1. get cpu_buffer, aka cpu_buffer(A)
		...
		...
		schedule_work_on(cpu,
		 &cpu_buffer->update_pages_work);
		//2. 'update_pages_work' is queue on 'cpu', cpu_buffer(A) is passed to
		// update_pages_handler, do the update process, set 'update_done' in
		// complete(&cpu_buffer->update_done) and to wakeup resize process.
	//---->
		//3. Just at this moment, ring_buffer_swap_cpu is triggered,
		//cpu_buffer(A) be swaped to cpu_buffer(B), the max_buffer.
		//ring_buffer_swap_cpu is called as the 'Call trace' below.

		Call trace:
		 dump_backtrace+0x0/0x2f8
		 show_stack+0x18/0x28
		 dump_stack+0x12c/0x188
		 ring_buffer_swap_cpu+0x2f8/0x328
		 update_max_tr_single+0x180/0x210
		 check_critical_timing+0x2b4/0x2c8
		 tracer_hardirqs_on+0x1c0/0x200
		 trace_hardirqs_on+0xec/0x378
		 el0_svc_common+0x64/0x260
		 do_el0_svc+0x90/0xf8
		 el0_svc+0x20/0x30
		 el0_sync_handler+0xb0/0xb8
		 el0_sync+0x180/0x1c0
	//<----

	/* wait for all the updates to complete */
	for_each_buffer_cpu(buffer, cpu) {
		cpu_buffer = buffer->buffers[cpu];
		//4. get cpu_buffer, cpu_buffer(B) is used in the following process,
		//the state of cpu_buffer(A) and cpu_buffer(B) is totally wrong.
		//for example, cpu_buffer(A)->update_done will leave be set 1, and will
		//not 'wait_for_completion' at the next resize round.
		  if (!cpu_buffer->nr_pages_to_update)
			continue;

		if (cpu_online(cpu))
			wait_for_completion(&cpu_buffer->update_done);
		cpu_buffer->nr_pages_to_update = 0;
	}
	...
}
	//5. the state of cpu_buffer(A) and cpu_buffer(B) is totally wrong,
	//Continuing to run in the wrong state, then oops occurs.

Link: https://lore.kernel.org/linux-trace-kernel/202307191558478409990@zte.com.cn

Signed-off-by: Chen Lin <chen.lin5@zte.com.cn>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-08-26 14:23:26 +02:00
Greg Kroah-Hartman
5f5a985931 Merge 5.15.124 into android14-5.15-lts
Changes in 5.15.124
	jbd2: Fix wrongly judgement for buffer head removing while doing checkpoint
	KVM: s390: pv: fix index value of replaced ASCE
	io_uring: don't audit the capability check in io_uring_create()
	gpio: tps68470: Make tps68470_gpio_output() always set the initial value
	pwm: Add a stub for devm_pwmchip_add()
	gpio: mvebu: Make use of devm_pwmchip_add
	gpio: mvebu: fix irq domain leak
	btrfs: fix race between quota disable and relocation
	i2c: Delete error messages for failed memory allocations
	i2c: Improve size determinations
	i2c: nomadik: Remove unnecessary goto label
	i2c: nomadik: Use devm_clk_get_enabled()
	i2c: nomadik: Remove a useless call in the remove function
	PCI/ASPM: Return 0 or -ETIMEDOUT from pcie_retrain_link()
	PCI/ASPM: Factor out pcie_wait_for_retrain()
	PCI/ASPM: Avoid link retraining race
	PCI: rockchip: Remove writes to unused registers
	PCI: rockchip: Fix window mapping and address translation for endpoint
	PCI: rockchip: Don't advertise MSI-X in PCIe capabilities
	dlm: cleanup plock_op vs plock_xop
	dlm: rearrange async condition return
	fs: dlm: interrupt posix locks only when process is killed
	drm/ttm: Don't print error message if eviction was interrupted
	drm/ttm: Don't leak a resource on eviction error
	n_tty: Rename tail to old_tail in n_tty_read()
	tty: fix hang on tty device with no_room set
	drm/ttm: never consider pinned BOs for eviction&swap
	cifs: missing directory in MAINTAINERS file
	cifs: use fs_context for automounts
	ksmbd: remove internal.h include
	cifs: if deferred close is disabled then close files immediately
	pwm: meson: Simplify duplicated per-channel tracking
	pwm: meson: fix handling of period/duty if greater than UINT_MAX
	tracing/probes: Add symstr type for dynamic events
	tracing/probes: Fix to avoid double count of the string length on the array
	tracing: Allow synthetic events to pass around stacktraces
	Revert "tracing: Add "(fault)" name injection to kernel probes"
	tracing/probes: Fix to record 0-length data_loc in fetch_store_string*() if fails
	scsi: qla2xxx: Remove unused declarations for qla2xxx
	scsi: qla2xxx: Multi-que support for TMF
	scsi: qla2xxx: Fix task management cmd failure
	scsi: qla2xxx: Fix task management cmd fail due to unavailable resource
	scsi: qla2xxx: Add debug prints in the device remove path
	scsi: qla2xxx: Fix hang in task management
	drm/amdgpu: fix vkms crtc settings
	drm/amdgpu/vkms: relax timer deactivation by hrtimer_try_to_cancel
	phy: qcom-snps: Use dev_err_probe() to simplify code
	phy: qcom-snps: correct struct qcom_snps_hsphy kerneldoc
	phy: qcom-snps-femto-v2: keep cfg_ahb_clk enabled during runtime suspend
	phy: qcom-snps-femto-v2: properly enable ref clock
	soundwire: qcom: update status correctly with mask
	media: staging: atomisp: select V4L2_FWNODE
	i40e: Fix an NULL vs IS_ERR() bug for debugfs_create_dir()
	iavf: fix potential deadlock on allocation failure
	iavf: check for removal state before IAVF_FLAG_PF_COMMS_FAILED
	net: phy: marvell10g: fix 88x3310 power up
	net: hns3: fix wrong tc bandwidth weight data issue
	net: hns3: fix wrong bw weight of disabled tc issue
	vxlan: move to its own directory
	vxlan: calculate correct header length for GPE
	phy: hisilicon: Fix an out of bounds check in hisi_inno_phy_probe()
	ethernet: atheros: fix return value check in atl1e_tso_csum()
	ipv6 addrconf: fix bug where deleting a mngtmpaddr can create a new temporary address
	tcp: Reduce chance of collisions in inet6_hashfn().
	ice: Fix memory management in ice_ethtool_fdir.c
	bonding: reset bond's flags when down link is P2P device
	team: reset team's flags when down link is P2P device
	net: stmmac: Apply redundant write work around on 4.xx too
	platform/x86: msi-laptop: Fix rfkill out-of-sync on MSI Wind U100
	igc: Fix Kernel Panic during ndo_tx_timeout callback
	netfilter: nft_set_rbtree: fix overlap expiration walk
	netfilter: nf_tables: skip immediate deactivate in _PREPARE_ERROR
	netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID
	net/sched: mqprio: refactor nlattr parsing to a separate function
	net/sched: mqprio: add extack to mqprio_parse_nlattr()
	net/sched: mqprio: Add length check for TCA_MQPRIO_{MAX/MIN}_RATE64
	benet: fix return value check in be_lancer_xmit_workarounds()
	tipc: check return value of pskb_trim()
	tipc: stop tipc crypto on failure in tipc_node_create
	RDMA/mlx4: Make check for invalid flags stricter
	drm/msm/dpu: drop enum dpu_core_perf_data_bus_id
	drm/msm/adreno: Fix snapshot BINDLESS_DATA size
	RDMA/irdma: Add missing read barriers
	RDMA/irdma: Fix data race on CQP completion stats
	RDMA/irdma: Fix data race on CQP request done
	RDMA/mthca: Fix crash when polling CQ for shared QPs
	RDMA/bnxt_re: Prevent handling any completions after qp destroy
	drm/msm: Fix IS_ERR_OR_NULL() vs NULL check in a5xx_submit_in_rb()
	ASoC: fsl_spdif: Silence output on stop
	block: Fix a source code comment in include/uapi/linux/blkzoned.h
	dm raid: fix missing reconfig_mutex unlock in raid_ctr() error paths
	dm raid: clean up four equivalent goto tags in raid_ctr()
	dm raid: protect md_stop() with 'reconfig_mutex'
	drm/amd: Fix an error handling mistake in psp_sw_init()
	RDMA/irdma: Report correct WC error
	ata: pata_ns87415: mark ns87560_tf_read static
	ring-buffer: Fix wrong stat of cpu_buffer->read
	tracing: Fix warning in trace_buffered_event_disable()
	Revert "usb: gadget: tegra-xudc: Fix error check in tegra_xudc_powerdomain_init()"
	usb: gadget: call usb_gadget_check_config() to verify UDC capability
	USB: gadget: Fix the memory leak in raw_gadget driver
	KVM: Grab a reference to KVM for VM and vCPU stats file descriptors
	KVM: VMX: Don't fudge CR0 and CR4 for restricted L2 guest
	serial: qcom-geni: drop bogus runtime pm state update
	serial: 8250_dw: Preserve original value of DLF register
	serial: sifive: Fix sifive_serial_console_setup() section
	USB: serial: option: support Quectel EM060K_128
	USB: serial: option: add Quectel EC200A module support
	USB: serial: simple: add Kaufmann RKS+CAN VCP
	USB: serial: simple: sort driver entries
	can: gs_usb: gs_can_close(): add missing set of CAN state to CAN_STATE_STOPPED
	Revert "usb: dwc3: core: Enable AutoRetry feature in the controller"
	usb: dwc3: pci: skip BYT GPIO lookup table for hardwired phy
	usb: dwc3: don't reset device side if dwc3 was configured as host-only
	usb: ohci-at91: Fix the unhandle interrupt when resume
	USB: quirks: add quirk for Focusrite Scarlett
	usb: cdns3: fix incorrect calculation of ep_buf_size when more than one config
	usb: xhci-mtk: set the dma max_seg_size
	Revert "usb: xhci: tegra: Fix error check"
	Documentation: security-bugs.rst: update preferences when dealing with the linux-distros group
	Documentation: security-bugs.rst: clarify CVE handling
	staging: r8712: Fix memory leak in _r8712_init_xmit_priv()
	staging: ks7010: potential buffer overflow in ks_wlan_set_encode_ext()
	tty: n_gsm: fix UAF in gsm_cleanup_mux
	Revert "xhci: add quirk for host controllers that don't update endpoint DCS"
	ALSA: hda/relatek: Enable Mute LED on HP 250 G8
	hwmon: (k10temp) Enable AMD3255 Proc to show negative temperature
	hwmon: (nct7802) Fix for temp6 (PECI1) processed even if PECI1 disabled
	btrfs: check if the transaction was aborted at btrfs_wait_for_commit()
	btrfs: check for commit error at btrfs_attach_transaction_barrier()
	file: always lock position for FMODE_ATOMIC_POS
	nfsd: Remove incorrect check in nfsd4_validate_stateid
	tpm_tis: Explicitly check for error code
	irq-bcm6345-l1: Do not assume a fixed block to cpu mapping
	irqchip/gic-v4.1: Properly lock VPEs when doing a directLPI invalidation
	locking/rtmutex: Fix task->pi_waiters integrity
	KVM: x86: Disallow KVM_SET_SREGS{2} if incoming CR0 is invalid
	virtio-net: fix race between set queues and probe
	s390/dasd: fix hanging device after quiesce/resume
	ASoC: wm8904: Fill the cache for WM8904_ADC_TEST_0 register
	ceph: never send metrics if disable_send_metrics is set
	dm cache policy smq: ensure IO doesn't prevent cleaner policy progress
	rbd: make get_lock_owner_info() return a single locker or NULL
	rbd: harden get_lock_owner_info() a bit
	rbd: retrieve and check lock owner twice before blocklisting
	tracing: Fix trace_event_raw_event_synth() if else statement
	ACPI: processor: perflib: Use the "no limit" frequency QoS
	ACPI: processor: perflib: Avoid updating frequency QoS unnecessarily
	cpufreq: intel_pstate: Drop ACPI _PSS states table patching
	selftests: mptcp: sockopt: use 'iptables-legacy' if available
	io_uring: treat -EAGAIN for REQ_F_NOWAIT as final for io-wq
	ASoC: cs42l51: fix driver to properly autoload with automatic module loading
	selftests: mptcp: join: only check for ip6tables if needed
	Linux 5.15.124

Change-Id: Ifeb2357cc7522671aff42c1408cc917a0f1aa905
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-08-25 16:54:16 +00:00
Greg Kroah-Hartman
9f5bde3ccf Merge 5.15.121 into android14-5.15-lts
Changes in 5.15.121
	netfilter: nf_tables: drop map element references from preparation phase
	fs: pipe: reveal missing function protoypes
	x86/resctrl: Only show tasks' pid in current pid namespace
	blk-iocost: use spin_lock_irqsave in adjust_inuse_and_calc_cost
	md/raid10: check slab-out-of-bounds in md_bitmap_get_counter
	md/raid10: fix overflow of md/safe_mode_delay
	md/raid10: fix wrong setting of max_corr_read_errors
	md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request
	md/raid10: fix io loss while replacement replace rdev
	irqchip/jcore-aic: Fix missing allocation of IRQ descriptors
	svcrdma: Prevent page release when nothing was received
	posix-timers: Prevent RT livelock in itimer_delete()
	tracing/timer: Add missing hrtimer modes to decode_hrtimer_mode().
	clocksource/drivers/cadence-ttc: Fix memory leak in ttc_timer_probe
	PM: domains: fix integer overflow issues in genpd_parse_state()
	perf/arm-cmn: Fix DTC reset
	powercap: RAPL: Fix CONFIG_IOSF_MBI dependency
	ARM: 9303/1: kprobes: avoid missing-declaration warnings
	cpufreq: intel_pstate: Fix energy_performance_preference for passive
	thermal/drivers/sun8i: Fix some error handling paths in sun8i_ths_probe()
	rcutorture: Correct name of use_softirq module parameter
	rcuscale: Always log error message
	rcuscale: Move shutdown from wait_event() to wait_event_idle()
	rcu/rcuscale: Move rcu_scale_*() after kfree_scale_cleanup()
	rcu/rcuscale: Stop kfree_scale_thread thread(s) after unloading rcuscale
	kselftest: vDSO: Fix accumulation of uninitialized ret when CLOCK_REALTIME is undefined
	perf/ibs: Fix interface via core pmu events
	x86/mm: Fix __swp_entry_to_pte() for Xen PV guests
	locking/atomic: arm: fix sync ops
	evm: Complete description of evm_inode_setattr()
	evm: Fix build warnings
	ima: Fix build warnings
	pstore/ram: Add check for kstrdup
	igc: Enable and fix RX hash usage by netstack
	wifi: ath9k: fix AR9003 mac hardware hang check register offset calculation
	wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx
	libbpf: btf_dump_type_data_check_overflow needs to consider BTF_MEMBER_BITFIELD_SIZE
	samples/bpf: Fix buffer overflow in tcp_basertt
	spi: spi-geni-qcom: Correct CS_TOGGLE bit in SPI_TRANS_CFG
	wifi: wilc1000: fix for absent RSN capabilities WFA testcase
	wifi: mwifiex: Fix the size of a memory allocation in mwifiex_ret_802_11_scan()
	sctp: add bpf_bypass_getsockopt proto callback
	libbpf: fix offsetof() and container_of() to work with CO-RE
	bpf: Don't EFAULT for {g,s}setsockopt with wrong optlen
	spi: dw: Round of n_bytes to power of 2
	nfc: llcp: fix possible use of uninitialized variable in nfc_llcp_send_connect()
	bpftool: JIT limited misreported as negative value on aarch64
	regulator: core: Fix more error checking for debugfs_create_dir()
	regulator: core: Streamline debugfs operations
	wifi: orinoco: Fix an error handling path in spectrum_cs_probe()
	wifi: orinoco: Fix an error handling path in orinoco_cs_probe()
	wifi: atmel: Fix an error handling path in atmel_probe()
	wl3501_cs: use eth_hw_addr_set()
	wifi: wl3501_cs: Fix an error handling path in wl3501_probe()
	wifi: ray_cs: Utilize strnlen() in parse_addr()
	wifi: ray_cs: Drop useless status variable in parse_addr()
	wifi: ray_cs: Fix an error handling path in ray_probe()
	wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes
	selftests/bpf: Fix check_mtu using wrong variable type
	wifi: rsi: Do not configure WoWlan in shutdown hook if not enabled
	wifi: rsi: Do not set MMC_PM_KEEP_POWER in shutdown
	watchdog/perf: define dummy watchdog_update_hrtimer_threshold() on correct config
	watchdog/perf: more properly prevent false positives with turbo modes
	kexec: fix a memory leak in crash_shrink_memory()
	memstick r592: make memstick_debug_get_tpc_name() static
	wifi: ath9k: Fix possible stall on ath9k_txq_list_has_key()
	rtnetlink: extend RTEXT_FILTER_SKIP_STATS to IFLA_VF_INFO
	wifi: iwlwifi: pull from TXQs with softirqs disabled
	iwlwifi: don't dump_stack() when we get an unexpected interrupt
	wifi: iwlwifi: pcie: fix NULL pointer dereference in iwl_pcie_irq_rx_msix_handler()
	wifi: cfg80211: rewrite merging of inherited elements
	wifi: iwlwifi: mvm: indicate HW decrypt for beacon protection
	wifi: ath9k: convert msecs to jiffies where needed
	bpf: Omit superfluous address family check in __bpf_skc_lookup
	bpf: Factor out socket lookup functions for the TC hookpoint.
	bpf: Call __bpf_sk_lookup()/__bpf_skc_lookup() directly via TC hookpoint
	bpf: Fix bpf socket lookup from tc/xdp to respect socket VRF bindings
	can: length: fix bitstuffing count
	igc: Fix race condition in PTP tx code
	net: stmmac: fix double serdes powerdown
	netlink: fix potential deadlock in netlink_set_err()
	netlink: do not hard code device address lenth in fdb dumps
	bonding: do not assume skb mac_header is set
	selftests: rtnetlink: remove netdevsim device after ipsec offload test
	gtp: Fix use-after-free in __gtp_encap_destroy().
	net: axienet: Move reset before 64-bit DMA detection
	sfc: fix crash when reading stats while NIC is resetting
	nfc: llcp: simplify llcp_sock_connect() error paths
	net: nfc: Fix use-after-free caused by nfc_llcp_find_local
	lib/ts_bm: reset initial match offset for every block of text
	netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one
	netfilter: nf_conntrack_sip: fix the ct_sip_parse_numerical_param() return value.
	ipvlan: Fix return value of ipvlan_queue_xmit()
	netlink: Add __sock_i_ino() for __netlink_diag_dump().
	drm/amd/display: Add logging for display MALL refresh setting
	radeon: avoid double free in ci_dpm_init()
	drm/amd/display: Explicitly specify update type per plane info change
	Input: drv260x - sleep between polling GO bit
	drm/bridge: tc358768: always enable HS video mode
	drm/bridge: tc358768: fix PLL parameters computation
	drm/bridge: tc358768: fix PLL target frequency
	drm/bridge: tc358768: fix TCLK_ZEROCNT computation
	drm/bridge: tc358768: Add atomic_get_input_bus_fmts() implementation
	drm/bridge: tc358768: fix TCLK_TRAILCNT computation
	drm/bridge: tc358768: fix THS_ZEROCNT computation
	drm/bridge: tc358768: fix TXTAGOCNT computation
	drm/bridge: tc358768: fix THS_TRAILCNT computation
	drm/vram-helper: fix function names in vram helper doc
	ARM: dts: BCM5301X: Drop "clock-names" from the SPI node
	ARM: dts: meson8b: correct uart_B and uart_C clock references
	Input: adxl34x - do not hardcode interrupt trigger type
	drm: sun4i_tcon: use devm_clk_get_enabled in `sun4i_tcon_init_clocks`
	drm/panel: sharp-ls043t1le01: adjust mode settings
	ARM: dts: stm32: Move ethernet MAC EEPROM from SoM to carrier boards
	bus: ti-sysc: Fix dispc quirk masking bool variables
	arm64: dts: microchip: sparx5: do not use PSCI on reference boards
	clk: imx: scu: use _safe list iterator to avoid a use after free
	RDMA/bnxt_re: Disable/kill tasklet only if it is enabled
	RDMA/bnxt_re: Fix to remove unnecessary return labels
	RDMA/bnxt_re: Use unique names while registering interrupts
	RDMA/bnxt_re: Remove a redundant check inside bnxt_re_update_gid
	RDMA/bnxt_re: Fix to remove an unnecessary log
	drm/msm/dsi: don't allow enabling 14nm VCO with unprogrammed rate
	drm/msm/disp/dpu: get timing engine status from intf status register
	drm/msm/dpu: Set DPU_DATA_HCTL_EN for in INTF_SC7180_MASK
	ARM: dts: gta04: Move model property out of pinctrl node
	arm64: dts: qcom: msm8916: correct camss unit address
	arm64: dts: qcom: msm8994: correct SPMI unit address
	arm64: dts: qcom: msm8996: correct camss unit address
	arm64: dts: qcom: sdm630: correct camss unit address
	arm64: dts: qcom: sdm845: correct camss unit address
	arm64: dts: qcom: db820c: Move blsp1_uart2 pin states to msm8996.dtsi
	arm64: dts: qcom: apq8016-sbc: Update modem and WiFi firmware path
	arm64: dts: qcom: apq8016-sbc: Clarify firmware-names
	arm64: dts: qcom: apq8016-sbc: fix mpps state names
	arm64: dts: qcom: Drop unneeded extra device-specific includes
	arm64: dts: qcom: apq8016-sbc: Fix regulator constraints
	arm64: dts: qcom: apq8016-sbc: Fix 1.8V power rail on LS expansion
	drm/panel: simple: fix active size for Ampire AM-480272H3TMQW-T01H
	ARM: ep93xx: fix missing-prototype warnings
	ARM: omap2: fix missing tick_broadcast() prototype
	arm64: dts: qcom: apq8096: fix fixed regulator name property
	arm64: dts: mediatek: mt8183: Add mediatek,broken-save-restore-fw to kukui
	ARM: dts: stm32: Shorten the AV96 HDMI sound card name
	memory: brcmstb_dpfe: fix testing array offset after use
	ASoC: es8316: Increment max value for ALC Capture Target Volume control
	ASoC: es8316: Do not set rate constraints for unsupported MCLKs
	ARM: dts: meson8: correct uart_B and uart_C clock references
	soc/fsl/qe: fix usb.c build errors
	RDMA/irdma: avoid fortify-string warning in irdma_clr_wqes
	IB/hfi1: Use bitmap_zalloc() when applicable
	IB/hfi1: Fix wrong mmu_node used for user SDMA packet after invalidate
	RDMA/hns: Fix hns_roce_table_get return value
	ARM: dts: iwg20d-q7-common: Fix backlight pwm specifier
	arm64: dts: renesas: ulcb-kf: Remove flow control for SCIF1
	fbdev: omapfb: lcd_mipid: Fix an error handling path in mipid_spi_probe()
	arm64: dts: ti: k3-j7200: Fix physical address of pin
	ARM: dts: stm32: Fix audio routing on STM32MP15xx DHCOM PDK2
	ARM: dts: stm32: fix i2s endpoint format property for stm32mp15xx-dkx
	hwmon: (gsc-hwmon) fix fan pwm temperature scaling
	hwmon: (adm1275) Allow setting sample averaging
	hwmon: (pmbus/adm1275) Fix problems with temperature monitoring on ADM1272
	ARM: dts: BCM5301X: fix duplex-full => full-duplex
	drm/amdkfd: Fix potential deallocation of previously deallocated memory.
	drm/amd/display: Fix artifacting on eDP panels when engaging freesync video mode
	drm/radeon: fix possible division-by-zero errors
	amdgpu: validate offset_in_bo of drm_amdgpu_gem_va
	drm/msm/a5xx: really check for A510 in a5xx_gpu_init
	RDMA/bnxt_re: wraparound mbox producer index
	RDMA/bnxt_re: Avoid calling wake_up threads from spin_lock context
	clk: imx: clk-imx8mn: fix memory leak in imx8mn_clocks_probe
	clk: imx: clk-imx8mp: improve error handling in imx8mp_clocks_probe()
	arm64: dts: qcom: sm8250-edo: Panel framebuffer is 2.5k instead of 4k
	clk: clocking-wizard: Fix Oops in clk_wzrd_register_divider()
	clk: tegra: tegra124-emc: Fix potential memory leak
	ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer
	drm/msm/dpu: do not enable color-management if DSPPs are not available
	drm/msm/dp: Free resources after unregistering them
	arm64: dts: mediatek: Add cpufreq nodes for MT8192
	arm64: dts: mediatek: mt8192: Fix CPUs capacity-dmips-mhz
	drm/msm/dpu: correct MERGE_3D length
	clk: vc5: check memory returned by kasprintf()
	clk: cdce925: check return value of kasprintf()
	clk: si5341: return error if one synth clock registration fails
	clk: si5341: check return value of {devm_}kasprintf()
	clk: si5341: free unused memory on probe failure
	clk: keystone: sci-clk: check return value of kasprintf()
	clk: ti: clkctrl: check return value of kasprintf()
	drivers: meson: secure-pwrc: always enable DMA domain
	ovl: update of dentry revalidate flags after copy up
	ASoC: imx-audmix: check return value of devm_kasprintf()
	clk: Fix memory leak in devm_clk_notifier_register()
	PCI: cadence: Fix Gen2 Link Retraining process
	PCI: vmd: Reset VMD config register between soft reboots
	scsi: qedf: Fix NULL dereference in error handling
	pinctrl: bcm2835: Handle gpiochip_add_pin_range() errors
	PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free
	scsi: 3w-xxxx: Add error handling for initialization failure in tw_probe()
	PCI: pciehp: Cancel bringup sequence if card is not present
	PCI: ftpci100: Release the clock resources
	PCI: Add pci_clear_master() stub for non-CONFIG_PCI
	perf bench: Use unbuffered output when pipe/tee'ing to a file
	perf bench: Add missing setlocale() call to allow usage of %'d style formatting
	pinctrl: cherryview: Return correct value if pin in push-pull mode
	kcsan: Don't expect 64 bits atomic builtins from 32 bits architectures
	powerpc/interrupt: Don't read MSR from interrupt_exit_kernel_prepare()
	powerpc/signal32: Force inlining of __unsafe_save_user_regs() and save_tm_user_regs_unsafe()
	perf script: Fix allocation of evsel->priv related to per-event dump files
	perf dwarf-aux: Fix off-by-one in die_get_varname()
	powerpc/64s: Fix VAS mm use after free
	pinctrl: microchip-sgpio: check return value of devm_kasprintf()
	pinctrl: at91-pio4: check return value of devm_kasprintf()
	powerpc/powernv/sriov: perform null check on iov before dereferencing iov
	powerpc: simplify ppc_save_regs
	powerpc: update ppc_save_regs to save current r1 in pt_regs
	riscv: uprobes: Restore thread.bad_cause
	powerpc/book3s64/mm: Fix DirectMap stats in /proc/meminfo
	powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary
	hwrng: virtio - add an internal buffer
	hwrng: virtio - don't wait on cleanup
	hwrng: virtio - don't waste entropy
	hwrng: virtio - always add a pending request
	hwrng: virtio - Fix race on data_avail and actual data
	modpost: remove broken calculation of exception_table_entry size
	crypto: nx - fix build warnings when DEBUG_FS is not enabled
	modpost: fix section mismatch message for R_ARM_ABS32
	modpost: fix section mismatch message for R_ARM_{PC24,CALL,JUMP24}
	crypto: marvell/cesa - Fix type mismatch warning
	modpost: fix off by one in is_executable_section()
	ARC: define ASM_NL and __ALIGN(_STR) outside #ifdef __ASSEMBLY__ guard
	crypto: qat - honor CRYPTO_TFM_REQ_MAY_SLEEP flag
	crypto: qat - replace get_current_node() with numa_node_id()
	crypto: qat - use reference to structure in dma_map_single()
	crypto: kpp - Add helper to set reqsize
	crypto: qat - Use helper to set reqsize
	crypto: qat - unmap buffer before free for DH
	crypto: qat - unmap buffers before free for RSA
	NFSv4.1: freeze the session table upon receiving NFS4ERR_BADSESSION
	SMB3: Do not send lease break acknowledgment if all file handles have been closed
	dax: Fix dax_mapping_release() use after free
	dax: Introduce alloc_dev_dax_id()
	dax/kmem: Pass valid argument to memory_group_register_static
	hwrng: st - keep clock enabled while hwrng is registered
	kbuild: Disable GCOV for *.mod.o
	efi/libstub: Disable PCI DMA before grabbing the EFI memory map
	ksmbd: avoid field overflow warning
	ACPI: utils: Fix acpi_evaluate_dsm_typed() redefinition error
	bootmem: remove the vmemmap pages from kmemleak in free_bootmem_page
	io_uring: ensure IOPOLL locks around deferred work
	USB: serial: option: add LARA-R6 01B PIDs
	usb: dwc3: gadget: Propagate core init errors to UDC during pullup
	phy: tegra: xusb: Clear the driver reference in usb-phy dev
	iio: adc: ad7192: Fix null ad7192_state pointer access
	iio: adc: ad7192: Fix internal/external clock selection
	iio: accel: fxls8962af: errata bug only applicable for FXLS8962AF
	iio: accel: fxls8962af: fixup buffer scan element type
	ALSA: hda/realtek: Add quirk for Clevo NPx0SNx
	ALSA: jack: Fix mutex call in snd_jack_report()
	block: fix signed int overflow in Amiga partition support
	block: add overflow checks for Amiga partition support
	block: change all __u32 annotations to __be32 in affs_hardblocks.h
	block: increment diskseq on all media change events
	SUNRPC: Fix UAF in svc_tcp_listen_data_ready()
	w1: w1_therm: fix locking behavior in convert_t
	w1: fix loop in w1_fini()
	sh: j2: Use ioremap() to translate device tree address into kernel memory
	usb: dwc2: platform: Improve error reporting for problems during .remove()
	usb: dwc2: Fix some error handling paths
	serial: 8250: omap: Fix freeing of resources on failed register
	clk: qcom: camcc-sc7180: Add parent dependency to all camera GDSCs
	clk: qcom: gcc-ipq6018: Use floor ops for sdcc clocks
	media: usb: Check az6007_read() return value
	media: videodev2.h: Fix struct v4l2_input tuner index comment
	media: usb: siano: Fix warning due to null work_func_t function pointer
	media: i2c: Correct format propagation for st-mipid02
	clk: qcom: reset: Allow specifying custom reset delay
	clk: qcom: reset: support resetting multiple bits
	clk: qcom: ipq6018: fix networking resets
	usb: dwc3: qcom: Fix potential memory leak
	usb: gadget: u_serial: Add null pointer check in gserial_suspend
	extcon: Fix kernel doc of property fields to avoid warnings
	extcon: Fix kernel doc of property capability fields to avoid warnings
	usb: phy: phy-tahvo: fix memory leak in tahvo_usb_probe()
	usb: hide unused usbfs_notify_suspend/resume functions
	serial: 8250: lock port for stop_rx() in omap8250_irq()
	serial: 8250: lock port for UART_IER access in omap8250_irq()
	kernfs: fix missing kernfs_idr_lock to remove an ID from the IDR
	coresight: Fix loss of connection info when a module is unloaded
	mfd: rt5033: Drop rt5033-battery sub-device
	media: venus: helpers: Fix ALIGN() of non power of two
	media: atomisp: gmin_platform: fix out_len in gmin_get_config_dsm_var()
	KVM: s390: fix KVM_S390_GET_CMMA_BITS for GFNs in memslot holes
	usb: dwc3: qcom: Release the correct resources in dwc3_qcom_remove()
	usb: dwc3: qcom: Fix an error handling path in dwc3_qcom_probe()
	usb: common: usb-conn-gpio: Set last role to unknown before initial detection
	usb: dwc3-meson-g12a: Fix an error handling path in dwc3_meson_g12a_probe()
	mfd: intel-lpss: Add missing check for platform_get_resource
	Revert "usb: common: usb-conn-gpio: Set last role to unknown before initial detection"
	serial: 8250_omap: Use force_suspend and resume for system suspend
	test_firmware: return ENOMEM instead of ENOSPC on failed memory allocation
	nvmem: rmem: Use NVMEM_DEVID_AUTO
	mfd: stmfx: Fix error path in stmfx_chip_init
	mfd: stmfx: Nullify stmfx->vdd in case of error
	KVM: s390: vsie: fix the length of APCB bitmap
	KVM: s390/diag: fix racy access of physical cpu number in diag 9c handler
	mfd: stmpe: Only disable the regulators if they are enabled
	phy: tegra: xusb: check return value of devm_kzalloc()
	pwm: imx-tpm: force 'real_period' to be zero in suspend
	pwm: sysfs: Do not apply state to already disabled PWMs
	pwm: ab8500: Fix error code in probe()
	pwm: mtk_disp: Fix the disable flow of disp_pwm
	md/raid10: fix the condition to call bio_end_io_acct()
	rtc: st-lpc: Release some resources in st_rtc_probe() in case of error
	drm/i915/psr: Use hw.adjusted mode when calculating io/fast wake times
	media: cec: i2c: ch7322: also select REGMAP
	sctp: fix potential deadlock on &net->sctp.addr_wq_lock
	net/sched: act_ipt: add sanity checks on table name and hook locations
	Add MODULE_FIRMWARE() for FIRMWARE_TG357766.
	ibmvnic: Do not reset dql stats on NON_FATAL err
	net: dsa: vsc73xx: fix MTU configuration
	spi: bcm-qspi: return error if neither hif_mspi nor mspi is available
	mailbox: ti-msgmgr: Fill non-message tx data fields with 0x0
	f2fs: fix error path handling in truncate_dnode()
	octeontx2-af: Fix mapping for NIX block from CGX connection
	octeontx2-af: Add validation before accessing cgx and lmac
	ntfs: Fix panic about slab-out-of-bounds caused by ntfs_listxattr()
	powerpc: allow PPC_EARLY_DEBUG_CPM only when SERIAL_CPM=y
	net: bridge: keep ports without IFF_UNICAST_FLT in BR_PROMISC mode
	tcp: annotate data races in __tcp_oow_rate_limited()
	xsk: Honor SO_BINDTODEVICE on bind
	net/sched: act_pedit: Add size check for TCA_PEDIT_PARMS_EX
	riscv: move memblock_allow_resize() after linear mapping is ready
	pptp: Fix fib lookup calls.
	net: dsa: tag_sja1105: fix MAC DA patching from meta frames
	octeontx-af: fix hardware timestamp configuration
	s390/qeth: Fix vipa deletion
	sh: dma: Fix DMA channel offset calculation
	apparmor: fix missing error check for rhashtable_insert_fast
	i2c: xiic: Defer xiic_wakeup() and __xiic_start_xfer() in xiic_process()
	i2c: xiic: Don't try to handle more interrupt events after error
	extcon: usbc-tusb320: Convert to i2c's .probe_new()
	btrfs: do not BUG_ON() on tree mod log failure at balance_level()
	i2c: qup: Add missing unwind goto in qup_i2c_probe()
	NFSD: add encoding of op_recall flag for write delegation
	io_uring: wait interruptibly for request completions on exit
	mmc: core: disable TRIM on Kingston EMMC04G-M627
	mmc: core: disable TRIM on Micron MTFC4GACAJCN-1M
	mmc: mmci: Set PROBE_PREFER_ASYNCHRONOUS
	mmc: sdhci: fix DMA configure compatibility issue when 64bit DMA mode is used.
	bcache: fixup btree_cache_wait list damage
	bcache: Remove unnecessary NULL point check in node allocations
	bcache: Fix __bch_btree_node_alloc to make the failure behavior consistent
	um: Use HOST_DIR for mrproper
	integrity: Fix possible multiple allocation in integrity_inode_get()
	autofs: use flexible array in ioctl structure
	shmem: use ramfs_kill_sb() for kill_sb method of ramfs-based tmpfs
	ext4: Remove ext4 locking of moved directory
	Revert "f2fs: fix potential corruption when moving a directory"
	fs: Establish locking order for unrelated directories
	fs: Lock moved directories
	ipvs: increase ip_vs_conn_tab_bits range for 64BIT
	jffs2: reduce stack usage in jffs2_build_xattr_subsystem()
	fs: avoid empty option when generating legacy mount string
	btrfs: add handling for RAID1C23/DUP to btrfs_reduce_alloc_profile
	btrfs: delete unused BGs while reclaiming BGs
	btrfs: bail out reclaim process if filesystem is read-only
	btrfs: reinsert BGs failed to reclaim
	btrfs: fix race when deleting quota root from the dirty cow roots list
	btrfs: fix extent buffer leak after tree mod log failure at split_node()
	btrfs: do not BUG_ON() on tree mod log failure at __btrfs_cow_block()
	ASoC: mediatek: mt8173: Fix irq error path
	ASoC: mediatek: mt8173: Fix snd_soc_component_initialize error path
	ARM: dts: qcom: ipq4019: fix broken NAND controller properties override
	ARM: orion5x: fix d2net gpio initialization
	leds: trigger: netdev: Recheck NETDEV_LED_MODE_LINKUP on dev rename
	fs: no need to check source
	ovl: fix null pointer dereference in ovl_get_acl_rcu()
	fanotify: disallow mount/sb marks on kernel internal pseudo fs
	netfilter: nf_tables: unbind non-anonymous set if rule construction fails
	netfilter: conntrack: Avoid nf_ct_helper_hash uses after free
	netfilter: nf_tables: do not ignore genmask when looking up chain by id
	netfilter: nf_tables: prevent OOB access in nft_byteorder_eval
	wireguard: queueing: use saner cpu selection wrapping
	wireguard: netlink: send staged packets when setting initial private key
	tty: serial: fsl_lpuart: add earlycon for imx8ulp platform
	block/partition: fix signedness issue for Amiga partitions
	io_uring: Use io_schedule* in cqring wait
	io_uring: add reschedule point to handle_tw_list()
	net: lan743x: Don't sleep in atomic context
	workqueue: clean up WORK_* constant types, clarify masking
	ksmbd: use ksmbd_req_buf_next() in ksmbd_smb2_check_message()
	ksmbd: validate command payload size
	ksmbd: fix out-of-bound read in smb2_write
	ksmbd: validate session id and tree id in the compound request
	drm/panel: simple: Add connector_type for innolux_at043tn24
	drm/bridge: ti-sn65dsi86: Fix auxiliary bus lifetime
	drm/panel: simple: Add Powertip PH800480T013 drm_display_mode flags
	igc: Remove delay during TX ring configuration
	net/mlx5e: fix double free in mlx5e_destroy_flow_table
	net/mlx5e: fix memory leak in mlx5e_ptp_open
	net/mlx5e: Check for NOT_READY flag state after locking
	igc: set TP bit in 'supported' and 'advertising' fields of ethtool_link_ksettings
	igc: Handle PPS start time programming for past time values
	scsi: qla2xxx: Fix error code in qla2x00_start_sp()
	bpf: Fix max stack depth check for async callbacks
	net: mvneta: fix txq_map in case of txq_number==1
	net/sched: cls_fw: Fix improper refcount update leads to use-after-free
	gve: Set default duplex configuration to full
	ionic: remove WARN_ON to prevent panic_on_warn
	net: bgmac: postpone turning IRQs off to avoid SoC hangs
	net: prevent skb corruption on frag list segmentation
	icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev().
	udp6: fix udp6_ehashfn() typo
	ntb: idt: Fix error handling in idt_pci_driver_init()
	NTB: amd: Fix error handling in amd_ntb_pci_driver_init()
	ntb: intel: Fix error handling in intel_ntb_pci_driver_init()
	NTB: ntb_transport: fix possible memory leak while device_register() fails
	NTB: ntb_tool: Add check for devm_kcalloc
	ipv6/addrconf: fix a potential refcount underflow for idev
	platform/x86: wmi: remove unnecessary argument
	platform/x86: wmi: use guid_t and guid_equal()
	platform/x86: wmi: move variables
	platform/x86: wmi: Break possible infinite loop when parsing GUID
	kernel/trace: Fix cleanup logic of enable_trace_eprobe
	igc: Fix launchtime before start of cycle
	igc: Fix inserting of empty frame for launchtime
	bpf, riscv: Support riscv jit to provide bpf_line_info
	riscv, bpf: Fix inconsistent JIT image generation
	drm/i915: Fix one wrong caching mode enum usage
	octeontx2-pf: Add additional check for MCAM rules
	erofs: avoid infinite loop in z_erofs_do_read_page() when reading beyond EOF
	erofs: decouple basic mount options from fs_context
	erofs: fix fsdax unavailability for chunk-based regular files
	wifi: airo: avoid uninitialized warning in airo_get_rate()
	bpf: cpumap: Fix memory leak in cpu_map_update_elem
	net/sched: flower: Ensure both minimum and maximum ports are specified
	riscv: mm: fix truncation warning on RV32
	netdevsim: fix uninitialized data in nsim_dev_trap_fa_cookie_write()
	net/sched: make psched_mtu() RTNL-less safe
	net/sched: sch_qfq: refactor parsing of netlink parameters
	net/sched: sch_qfq: account for stab overhead in qfq_enqueue
	nvme-pci: remove nvme_queue from nvme_iod
	nvme-pci: fix DMA direction of unmapping integrity data
	fs/ntfs3: Check fields while reading
	f2fs: fix to avoid NULL pointer dereference f2fs_write_end_io()
	pinctrl: amd: Fix mistake in handling clearing pins at startup
	pinctrl: amd: Detect internal GPIO0 debounce handling
	pinctrl: amd: Detect and mask spurious interrupts
	pinctrl: amd: Only use special debounce behavior for GPIO 0
	tpm: tpm_vtpm_proxy: fix a race condition in /dev/vtpmx creation
	mtd: rawnand: meson: fix unaligned DMA buffers handling
	net: bcmgenet: Ensure MDIO unregistration has clocks enabled
	mm/damon/ops-common: atomically test and clear young on ptes and pmds
	powerpc: Fail build if using recordmcount with binutils v2.37
	misc: fastrpc: Create fastrpc scalar with correct buffer count
	powerpc/security: Fix Speculation_Store_Bypass reporting on Power10
	arm64: errata: Add detection for TRBE overwrite in FILL mode
	erofs: fix compact 4B support for 16k block size
	MIPS: Loongson: Fix cpu_probe_loongson() again
	MIPS: KVM: Fix NULL pointer dereference
	ext4: Fix reusing stale buffer heads from last failed mounting
	ext4: fix wrong unit use in ext4_mb_clear_bb
	ext4: get block from bh in ext4_free_blocks for fast commit replay
	ext4: fix wrong unit use in ext4_mb_new_blocks
	ext4: fix to check return value of freeze_bdev() in ext4_shutdown()
	ext4: turn quotas off if mount failed after enabling quotas
	ext4: only update i_reserved_data_blocks on successful block allocation
	jfs: jfs_dmap: Validate db_l2nbperpage while mounting
	hwrng: imx-rngc - fix the timeout for init and self check
	dm integrity: reduce vmalloc space footprint on 32-bit architectures
	PCI/PM: Avoid putting EloPOS E2/S2/H2 PCIe Ports in D3cold
	PCI: Add function 1 DMA alias quirk for Marvell 88SE9235
	PCI: qcom: Disable write access to read only registers for IP v2.3.3
	PCI: rockchip: Assert PCI Configuration Enable bit after probe
	PCI: rockchip: Write PCI Device ID to correct register
	PCI: rockchip: Add poll and timeout to wait for PHY PLLs to be locked
	PCI: rockchip: Fix legacy IRQ generation for RK3399 PCIe endpoint core
	PCI: rockchip: Use u32 variable to access 32-bit registers
	PCI: rockchip: Set address alignment for endpoint mode
	misc: pci_endpoint_test: Free IRQs before removing the device
	misc: pci_endpoint_test: Re-init completion for every test
	mfd: pm8008: Fix module autoloading
	md/raid0: add discard support for the 'original' layout
	dm init: add dm-mod.waitfor to wait for asynchronously probed block devices
	fs: dlm: return positive pid value for F_GETLK
	drm/atomic: Allow vblank-enabled + self-refresh "disable"
	drm/rockchip: vop: Leave vblank enabled in self-refresh
	drm/amdgpu: fix clearing mappings for BOs that are always valid in VM
	drm/amd/display: Correct `DMUB_FW_VERSION` macro
	drm/amdgpu: avoid restore process run into dead loop.
	drm/ttm: Don't leak a resource on swapout move error
	serial: atmel: don't enable IRQs prematurely
	tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() in case of error
	tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() when iterating clk
	tty: serial: imx: fix rs485 rx after tx
	firmware: stratix10-svc: Fix a potential resource leak in svc_create_memory_pool()
	libceph: harden msgr2.1 frame segment length checks
	ceph: don't let check_caps skip sending responses for revoke msgs
	xhci: Fix resume issue of some ZHAOXIN hosts
	xhci: Fix TRB prefetch issue of ZHAOXIN hosts
	xhci: Show ZHAOXIN xHCI root hub speed correctly
	meson saradc: fix clock divider mask length
	opp: Fix use-after-free in lazy_opp_tables after probe deferral
	soundwire: qcom: fix storing port config out-of-bounds
	Revert "8250: add support for ASIX devices with a FIFO bug"
	bus: ixp4xx: fix IXP4XX_EXP_T1_MASK
	s390/decompressor: fix misaligned symbol build error
	tracing/histograms: Add histograms to hist_vars if they have referenced variables
	tracing: Fix memory leak of iter->temp when reading trace_pipe
	samples: ftrace: Save required argument registers in sample trampolines
	net: ena: fix shift-out-of-bounds in exponential backoff
	ring-buffer: Fix deadloop issue on reading trace_pipe
	ftrace: Fix possible warning on checking all pages used in ftrace_process_locs()
	xtensa: ISS: fix call to split_if_spec
	tracing: Fix null pointer dereference in tracing_err_log_open()
	selftests: mptcp: sockopt: return error if wrong mark
	selftests: mptcp: depend on SYN_COOKIES
	tracing/probes: Fix not to count error code to total length
	tracing/probes: Fix to update dynamic data counter if fetcharg uses it
	scsi: qla2xxx: Wait for io return on terminate rport
	scsi: qla2xxx: Array index may go out of bound
	scsi: qla2xxx: Avoid fcport pointer dereference
	scsi: qla2xxx: Fix buffer overrun
	scsi: qla2xxx: Fix potential NULL pointer dereference
	scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport()
	scsi: qla2xxx: Correct the index of array
	scsi: qla2xxx: Pointer may be dereferenced
	scsi: qla2xxx: Remove unused nvme_ls_waitq wait queue
	MIPS: kvm: Fix build error with KVM_MIPS_DEBUG_COP0_COUNTERS enabled
	net/sched: sch_qfq: reintroduce lmax bound check for MTU
	drm/atomic: Fix potential use-after-free in nonblocking commits
	Linux 5.15.121

Note, this merges away commit e4e7f67cc1 ("arm64: errata: Add
detection for TRBE overwrite in FILL mode") as it causes ABI issues.  If
that is to be needed for this branch, it can come back later in an
ABI-safe way.

It also merges away commit 7eeed3ed1a ("mm/damon/ops-common:
atomically test and clear young on ptes and pmds") as it had too many
merge conflicts.  If that is needed in a future release it needs to be
added as a proper BACKPORT.

Change-Id: Ie91971a85cbb2672e9d2ef1d90814817697ca7b3
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-08-03 18:15:58 +00:00
Zheng Yejian
23e8a65f9a ring-buffer: Fix wrong stat of cpu_buffer->read
[ Upstream commit 2d093282b0 ]

When pages are removed in rb_remove_pages(), 'cpu_buffer->read' is set
to 0 in order to make sure any read iterators reset themselves. However,
this will mess 'entries' stating, see following steps:

  # cd /sys/kernel/tracing/
  # 1. Enlarge ring buffer prepare for later reducing:
  # echo 20 > per_cpu/cpu0/buffer_size_kb
  # 2. Write a log into ring buffer of cpu0:
  # taskset -c 0 echo "hello1" > trace_marker
  # 3. Read the log:
  # cat per_cpu/cpu0/trace_pipe
       <...>-332     [000] .....    62.406844: tracing_mark_write: hello1
  # 4. Stop reading and see the stats, now 0 entries, and 1 event readed:
  # cat per_cpu/cpu0/stats
   entries: 0
   [...]
   read events: 1
  # 5. Reduce the ring buffer
  # echo 7 > per_cpu/cpu0/buffer_size_kb
  # 6. Now entries became unexpected 1 because actually no entries!!!
  # cat per_cpu/cpu0/stats
   entries: 1
   [...]
   read events: 0

To fix it, introduce 'page_removed' field to count total removed pages
since last reset, then use it to let read iterators reset themselves
instead of changing the 'read' pointer.

Link: https://lore.kernel.org/linux-trace-kernel/20230724054040.3489499-1-zhengyejian1@huawei.com

Cc: <mhiramat@kernel.org>
Cc: <vnagarnaik@google.com>
Fixes: 83f40318da ("ring-buffer: Make removal of ring buffer pages atomic")
Signed-off-by: Zheng Yejian <zhengyejian1@huawei.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-08-03 10:22:39 +02:00
Zheng Yejian
bb14a93bcc ring-buffer: Fix deadloop issue on reading trace_pipe
commit 7e42907f3a upstream.

Soft lockup occurs when reading file 'trace_pipe':

  watchdog: BUG: soft lockup - CPU#6 stuck for 22s! [cat:4488]
  [...]
  RIP: 0010:ring_buffer_empty_cpu+0xed/0x170
  RSP: 0018:ffff88810dd6fc48 EFLAGS: 00000246
  RAX: 0000000000000000 RBX: 0000000000000246 RCX: ffffffff93d1aaeb
  RDX: ffff88810a280040 RSI: 0000000000000008 RDI: ffff88811164b218
  RBP: ffff88811164b218 R08: 0000000000000000 R09: ffff88815156600f
  R10: ffffed102a2acc01 R11: 0000000000000001 R12: 0000000051651901
  R13: 0000000000000000 R14: ffff888115e49500 R15: 0000000000000000
  [...]
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 00007f8d853c2000 CR3: 000000010dcd8000 CR4: 00000000000006e0
  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
  Call Trace:
   __find_next_entry+0x1a8/0x4b0
   ? peek_next_entry+0x250/0x250
   ? down_write+0xa5/0x120
   ? down_write_killable+0x130/0x130
   trace_find_next_entry_inc+0x3b/0x1d0
   tracing_read_pipe+0x423/0xae0
   ? tracing_splice_read_pipe+0xcb0/0xcb0
   vfs_read+0x16b/0x490
   ksys_read+0x105/0x210
   ? __ia32_sys_pwrite64+0x200/0x200
   ? switch_fpu_return+0x108/0x220
   do_syscall_64+0x33/0x40
   entry_SYSCALL_64_after_hwframe+0x61/0xc6

Through the vmcore, I found it's because in tracing_read_pipe(),
ring_buffer_empty_cpu() found some buffer is not empty but then it
cannot read anything due to "rb_num_of_entries() == 0" always true,
Then it infinitely loop the procedure due to user buffer not been
filled, see following code path:

  tracing_read_pipe() {
    ... ...
    waitagain:
      tracing_wait_pipe() // 1. find non-empty buffer here
      trace_find_next_entry_inc()  // 2. loop here try to find an entry
        __find_next_entry()
          ring_buffer_empty_cpu();  // 3. find non-empty buffer
          peek_next_entry()  // 4. but peek always return NULL
            ring_buffer_peek()
              rb_buffer_peek()
                rb_get_reader_page()
                  // 5. because rb_num_of_entries() == 0 always true here
                  //    then return NULL
      // 6. user buffer not been filled so goto 'waitgain'
      //    and eventually leads to an deadloop in kernel!!!
  }

By some analyzing, I found that when resetting ringbuffer, the 'entries'
of its pages are not all cleared (see rb_reset_cpu()). Then when reducing
the ringbuffer, and if some reduced pages exist dirty 'entries' data, they
will be added into 'cpu_buffer->overrun' (see rb_remove_pages()), which
cause wrong 'overrun' count and eventually cause the deadloop issue.

To fix it, we need to clear every pages in rb_reset_cpu().

Link: https://lore.kernel.org/linux-trace-kernel/20230708225144.3785600-1-zhengyejian1@huawei.com

Cc: stable@vger.kernel.org
Fixes: a5fb833172 ("ring-buffer: Fix uninitialized read_stamp")
Signed-off-by: Zheng Yejian <zhengyejian1@huawei.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-07-23 13:47:55 +02:00
Greg Kroah-Hartman
e42a74b5f8 Merge 5.15.112 into android14-5.15-lts
Changes in 5.15.112
	ring-buffer: Ensure proper resetting of atomic variables in ring_buffer_reset_online_cpus
	crypto: ccp - Clear PSP interrupt status register before calling handler
	ubifs: Fix AA deadlock when setting xattr for encrypted file
	ubifs: Fix memory leak in do_rename
	bus: mhi: Move host MHI code to "host" directory
	bus: mhi: host: Remove duplicate ee check for syserr
	bus: mhi: host: Use mhi_tryset_pm_state() for setting fw error state
	bus: mhi: host: Range check CHDBOFF and ERDBOFF
	mailbox: zynq: Switch to flexible array to simplify code
	mailbox: zynqmp: Fix counts of child nodes
	ASoC: soc-pcm: use GFP_ATOMIC for dpcm structure
	ASoC: soc-pcm: align BE 'atomicity' with that of the FE
	ASoC: soc-pcm: Fix and cleanup DPCM locking
	ASoC: soc-pcm: serialize BE triggers
	ASoC: soc-pcm: test refcount before triggering
	ASoC: soc-pcm: fix BE handling of PAUSE_RELEASE
	fs/ntfs3: Fix null-ptr-deref on inode->i_op in ntfs_lookup()
	drm/hyperv: Don't overwrite dirt_needed value set by host
	scsi: qedi: Fix use after free bug in qedi_remove()
	net/ncsi: clear Tx enable mode when handling a Config required AEN
	net/sched: cls_api: remove block_cb from driver_list before freeing
	sit: update dev->needed_headroom in ipip6_tunnel_bind_dev()
	selftests: srv6: make srv6_end_dt46_l3vpn_test more robust
	net: dsa: mv88e6xxx: add mv88e6321 rsvd2cpu
	writeback: fix call of incorrect macro
	watchdog: dw_wdt: Fix the error handling path of dw_wdt_drv_probe()
	RISC-V: mm: Enable huge page support to kernel_page_present() function
	net/sched: act_mirred: Add carrier check
	r8152: fix flow control issue of RTL8156A
	r8152: fix the poor throughput for 2.5G devices
	r8152: move setting r8153b_rx_agg_chg_indicate()
	sfc: Fix module EEPROM reporting for QSFP modules
	rxrpc: Fix hard call timeout units
	octeontx2-af: Secure APR table update with the lock
	octeontx2-af: Skip PFs if not enabled
	octeontx2-pf: Disable packet I/O for graceful exit
	octeontx2-vf: Detach LF resources on probe cleanup
	ionic: remove noise from ethtool rxnfc error msg
	ethtool: Fix uninitialized number of lanes
	ionic: catch failure from devlink_alloc
	af_packet: Don't send zero-byte data in packet_sendmsg_spkt().
	drm/amdgpu: add a missing lock for AMDGPU_SCHED
	ALSA: caiaq: input: Add error handling for unsupported input methods in `snd_usb_caiaq_input_init`
	net: dsa: mt7530: fix corrupt frames using trgmii on 40 MHz XTAL MT7621
	virtio_net: split free_unused_bufs()
	virtio_net: suppress cpu stall when free_unused_bufs
	net: enetc: check the index of the SFI rather than the handle
	perf scripts intel-pt-events.py: Fix IPC output for Python 2
	perf vendor events power9: Remove UTF-8 characters from JSON files
	perf pmu: zfree() expects a pointer to a pointer to zero it after freeing its contents
	perf map: Delete two variable initialisations before null pointer checks in sort__sym_from_cmp()
	crypto: sun8i-ss - Fix a test in sun8i_ss_setup_ivs()
	crypto: engine - check if BH is disabled during completion
	crypto: api - Add scaffolding to change completion function signature
	crypto: engine - Use crypto_request_complete
	crypto: engine - fix crypto_queue backlog handling
	perf symbols: Fix return incorrect build_id size in elf_read_build_id()
	perf evlist: Refactor evlist__for_each_cpu()
	perf stat: Separate bperf from bpf_profiler
	btrfs: fix btrfs_prev_leaf() to not return the same key twice
	btrfs: zoned: fix wrong use of bitops API in btrfs_ensure_empty_zones
	btrfs: fix encoded write i_size corruption with no-holes
	btrfs: don't free qgroup space unless specified
	btrfs: zero the buffer before marking it dirty in btrfs_redirty_list_add
	btrfs: print-tree: parent bytenr must be aligned to sector size
	btrfs: fix space cache inconsistency after error loading it from disk
	cifs: fix pcchunk length type in smb2_copychunk_range
	cifs: release leases for deferred close handles when freezing
	platform/x86: touchscreen_dmi: Add upside-down quirk for GDIX1002 ts on the Juno Tablet
	platform/x86: touchscreen_dmi: Add info for the Dexp Ursus KX210i
	inotify: Avoid reporting event with invalid wd
	smb3: fix problem remounting a share after shutdown
	SMB3: force unmount was failing to close deferred close files
	sh: math-emu: fix macro redefined warning
	sh: mcount.S: fix build error when PRINTK is not enabled
	sh: init: use OF_EARLY_FLATTREE for early init
	sh: nmi_debug: fix return value of __setup handler
	remoteproc: stm32: Call of_node_put() on iteration error
	remoteproc: st: Call of_node_put() on iteration error
	remoteproc: imx_rproc: Call of_node_put() on iteration error
	ARM: dts: exynos: fix WM8960 clock name in Itop Elite
	ARM: dts: s5pv210: correct MIPI CSIS clock name
	drm/bridge: lt8912b: Fix DSI Video Mode
	drm/msm: fix NULL-deref on snapshot tear down
	drm/msm: fix NULL-deref on irq uninstall
	f2fs: fix potential corruption when moving a directory
	drm/panel: otm8009a: Set backlight parent to panel device
	drm/amd/display: fix flickering caused by S/G mode
	drm/amdgpu: fix an amdgpu_irq_put() issue in gmc_v9_0_hw_fini()
	drm/amdgpu/gfx: disable gfx9 cp_ecc_error_irq only when enabling legacy gfx ras
	drm/amdgpu: Fix vram recover doesn't work after whole GPU reset (v2)
	drm/amdgpu: disable sdma ecc irq only when sdma RAS is enabled in suspend
	HID: wacom: Set a default resolution for older tablets
	HID: wacom: insert timestamp to packed Bluetooth (BT) events
	fs/ntfs3: Refactoring of various minor issues
	ASoC: soc-pcm: Fix DPCM lockdep warning due to nested stream locks
	ASoC: soc-compress: Inherit atomicity from DAI link for Compress FE
	ASoC: soc-pcm: Move debugfs removal out of spinlock
	ASoC: DPCM: Don't pick up BE without substream
	ASoC: soc-pcm.c: call __soc_pcm_close() in soc_pcm_close()
	drm/i915/dg2: Support 4k@30 on HDMI
	drm/i915/dg2: Add additional HDMI pixel clock frequencies
	drm/i915/dg2: Add HDMI pixel clock frequencies 267.30 and 319.89 MHz
	drm/msm: Remove struct_mutex usage
	drm/msm/adreno: fix runtime PM imbalance at gpu load
	drm/amd/display: Refine condition of cursor visibility for pipe-split
	drm/amd/display: Add NULL plane_state check for cursor disable logic
	wifi: rtw88: rtw8821c: Fix rfe_option field width
	ksmbd: set RSS capable in FSCTL_QUERY_NETWORK_INTERFACE_INFO
	ksmbd: fix multi session connection failure
	ksmbd: replace sessions list in connection with xarray
	ksmbd: add channel rwlock
	ksmbd: fix kernel oops from idr_remove()
	ksmbd: fix racy issue while destroying session on multichannel
	ksmbd: fix deadlock in ksmbd_find_crypto_ctx()
	ksmbd: not allow guest user on multichannel
	locking/rwsem: Add __always_inline annotation to __down_read_common() and inlined callers
	ext4: fix WARNING in mb_find_extent
	ext4: avoid a potential slab-out-of-bounds in ext4_group_desc_csum
	ext4: fix data races when using cached status extents
	ext4: check iomap type only if ext4_iomap_begin() does not fail
	ext4: improve error recovery code paths in __ext4_remount()
	ext4: improve error handling from ext4_dirhash()
	ext4: fix deadlock when converting an inline directory in nojournal mode
	ext4: add bounds checking in get_max_inline_xattr_value_size()
	ext4: bail out of ext4_xattr_ibody_get() fails for any reason
	ext4: remove a BUG_ON in ext4_mb_release_group_pa()
	ext4: fix invalid free tracking in ext4_xattr_move_to_block()
	drm/msm/adreno: adreno_gpu: Use suspend() instead of idle() on load error
	serial: 8250: Fix serial8250_tx_empty() race with DMA Tx
	drbd: correctly submit flush bio on barrier
	RISC-V: Fix up a cherry-pick warning in setup_vm_final()
	drm/amd/display: Fix hang when skipping modeset
	Linux 5.15.112

Change-Id: Ie61cc0aea78266c2c5adb0a889f55affa78883e5
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-06-12 20:22:34 +00:00
Greg Kroah-Hartman
c2773262b8 Merge 5.15.111 into android14-5.15-lts
Changes in 5.15.111
	ASOC: Intel: sof_sdw: add quirk for Intel 'Rooks County' NUC M15
	ASoC: soc-pcm: fix hw->formats cleared by soc_pcm_hw_init() for dpcm
	x86/hyperv: Block root partition functionality in a Confidential VM
	iio: adc: palmas_gpadc: fix NULL dereference on rmmod
	ASoC: Intel: bytcr_rt5640: Add quirk for the Acer Iconia One 7 B1-750
	selftests mount: Fix mount_setattr_test builds failed
	asm-generic/io.h: suppress endianness warnings for readq() and writeq()
	x86/cpu: Add model number for Intel Arrow Lake processor
	wireguard: timers: cast enum limits members to int in prints
	wifi: mt76: mt7921e: Set memory space enable in PCI_COMMAND if unset
	arm64: Always load shadow stack pointer directly from the task struct
	arm64: Stash shadow stack pointer in the task struct on interrupt
	PCI: pciehp: Fix AB-BA deadlock between reset_lock and device_lock
	PCI: qcom: Fix the incorrect register usage in v2.7.0 config
	IMA: allow/fix UML builds
	USB: dwc3: fix runtime pm imbalance on probe errors
	USB: dwc3: fix runtime pm imbalance on unbind
	hwmon: (k10temp) Check range scale when CUR_TEMP register is read-write
	hwmon: (adt7475) Use device_property APIs when configuring polarity
	posix-cpu-timers: Implement the missing timer_wait_running callback
	blk-mq: release crypto keyslot before reporting I/O complete
	blk-crypto: make blk_crypto_evict_key() return void
	blk-crypto: make blk_crypto_evict_key() more robust
	ext4: use ext4_journal_start/stop for fast commit transactions
	staging: iio: resolver: ads1210: fix config mode
	tty: Prevent writing chars during tcsetattr TCSADRAIN/FLUSH
	xhci: fix debugfs register accesses while suspended
	tick/nohz: Fix cpu_is_hotpluggable() by checking with nohz subsystem
	MIPS: fw: Allow firmware to pass a empty env
	ipmi:ssif: Add send_retries increment
	ipmi: fix SSIF not responding under certain cond.
	kheaders: Use array declaration instead of char
	wifi: mt76: add missing locking to protect against concurrent rx/status calls
	pwm: meson: Fix axg ao mux parents
	pwm: meson: Fix g12a ao clk81 name
	soundwire: qcom: correct setting ignore bit on v1.5.1
	pinctrl: qcom: lpass-lpi: set output value before enabling output
	ring-buffer: Sync IRQ works before buffer destruction
	crypto: api - Demote BUG_ON() in crypto_unregister_alg() to a WARN_ON()
	crypto: safexcel - Cleanup ring IRQ workqueues on load failure
	rcu: Avoid stack overflow due to __rcu_irq_enter_check_tick() being kprobe-ed
	reiserfs: Add security prefix to xattr name in reiserfs_security_write()
	KVM: nVMX: Emulate NOPs in L2, and PAUSE if it's not intercepted
	relayfs: fix out-of-bounds access in relay_file_read
	writeback, cgroup: fix null-ptr-deref write in bdi_split_work_to_wbs
	ksmbd: call rcu_barrier() in ksmbd_server_exit()
	ksmbd: fix NULL pointer dereference in smb2_get_info_filesystem()
	ksmbd: fix memleak in session setup
	i2c: omap: Fix standard mode false ACK readings
	riscv: mm: remove redundant parameter of create_fdt_early_page_table
	tracing: Fix permissions for the buffer_percent file
	iommu/amd: Fix "Guest Virtual APIC Table Root Pointer" configuration in IRTE
	Revert "ubifs: dirty_cow_znode: Fix memleak in error handling path"
	ubifs: Fix memleak when insert_old_idx() failed
	ubi: Fix return value overwrite issue in try_write_vid_and_data()
	ubifs: Free memory for tmpfile name
	xfs: don't consider future format versions valid
	sound/oss/dmasound: fix build when drivers are mixed =y/=m
	rcu: Fix missing TICK_DEP_MASK_RCU_EXP dependency check
	selftests/resctrl: Return NULL if malloc_and_init_memory() did not alloc mem
	selftests/resctrl: Extend CPU vendor detection
	selftests/resctrl: Move ->setup() call outside of test specific branches
	selftests/resctrl: Allow ->setup() to return errors
	selftests/resctrl: Check for return value after write_schemata()
	selinux: fix Makefile dependencies of flask.h
	selinux: ensure av_permissions.h is built when needed
	tpm, tpm_tis: Do not skip reset of original interrupt vector
	tpm, tpm_tis: Claim locality before writing TPM_INT_ENABLE register
	tpm, tpm_tis: Disable interrupts if tpm_tis_probe_irq() failed
	tpm, tpm_tis: Claim locality before writing interrupt registers
	tpm, tpm: Implement usage counter for locality
	tpm, tpm_tis: Claim locality when interrupts are reenabled on resume
	erofs: stop parsing non-compact HEAD index if clusterofs is invalid
	erofs: fix potential overflow calculating xattr_isize
	drm/rockchip: Drop unbalanced obj unref
	drm/vgem: add missing mutex_destroy
	drm/probe-helper: Cancel previous job before starting new one
	tools/x86/kcpuid: Fix avx512bw and avx512lvl fields in Fn00000007
	soc: ti: pm33xx: Fix refcount leak in am33xx_pm_probe
	arm64: dts: renesas: r8a77990: Remove bogus voltages from OPP table
	arm64: dts: renesas: r8a774c0: Remove bogus voltages from OPP table
	drm/msm/disp/dpu: check for crtc enable rather than crtc active to release shared resources
	EDAC/skx: Fix overflows on the DRAM row address mapping arrays
	regulator: core: Shorten off-on-delay-us for always-on/boot-on by time since booted
	arm64: dts: ti: k3-j721e-main: Remove ti,strobe-sel property
	arm64: dts: broadcom: bcm4908: add DT for Netgear RAXE500
	arm64: dts: Add DTS files for bcmbca SoC BCM63158
	arm64: dts: Add DTS files for bcmbca SoC BCM4912
	ARM64: dts: Add DTS files for bcmbca SoC BCM6858
	arm64: dts: Add base DTS file for bcmbca device Asus GT-AX6000
	arm64: dts: Move BCM4908 dts to bcmbca folder
	arm64: dts: broadcom: bcmbca: bcm4908: fix NAND interrupt name
	arm64: dts: broadcom: bcmbca: bcm4908: fix procmon nodename
	arm64: dts: qcom: msm8998: Fix stm-stimulus-base reg name
	arm64: dts: qcom: sdm845: correct dynamic power coefficients
	arm64: dts: qcom: sdm845: Fix the PCI I/O port range
	arm64: dts: qcom: msm8998: Fix the PCI I/O port range
	arm64: dts: qcom: ipq8074: Fix the PCI I/O port range
	arm64: dts: qcom: ipq6018: Fix the PCI I/O port range
	arm64: dts: qcom: msm8996: Fix the PCI I/O port range
	arm64: dts: qcom: sm8250: Fix the PCI I/O port range
	ARM: dts: qcom: ipq4019: Fix the PCI I/O port range
	ARM: dts: qcom: ipq8064: reduce pci IO size to 64K
	ARM: dts: qcom: ipq8064: Fix the PCI I/O port range
	x86/MCE/AMD: Use an u64 for bank_map
	media: bdisp: Add missing check for create_workqueue
	media: av7110: prevent underflow in write_ts_to_decoder()
	firmware: qcom_scm: Clear download bit during reboot
	drm/bridge: adv7533: Fix adv7533_mode_valid for adv7533 and adv7535
	media: max9286: Free control handler
	drm/msm/adreno: Defer enabling runpm until hw_init()
	drm/msm/adreno: drop bogus pm_runtime_set_active()
	drm: msm: adreno: Disable preemption on Adreno 510
	drm/amd/display/dc/dce60/Makefile: Fix previous attempt to silence known override-init warnings
	ACPI: processor: Fix evaluating _PDC method when running as Xen dom0
	mmc: sdhci-of-esdhc: fix quirk to ignore command inhibit for data
	drm: rcar-du: Fix a NULL vs IS_ERR() bug
	ARM: dts: gta04: fix excess dma channel usage
	firmware: arm_scmi: Fix xfers allocation on Rx channel
	ACPI: VIOT: Initialize the correct IOMMU fwspec
	drm/lima/lima_drv: Add missing unwind goto in lima_pdev_probe()
	mailbox: mpfs: switch to txdone_poll
	arm64: dts: qcom: sc7180-trogdor-lazor: correct trackpad supply
	arm64: dts: qcom: msm8994-kitakami: drop unit address from PMI8994 regulator
	arm64: dts: qcom: msm8994-msft-lumia-octagon: drop unit address from PMI8994 regulator
	drm/ttm: optimize pool allocations a bit v2
	drm/ttm/pool: Fix ttm_pool_alloc error path
	regulator: core: Consistently set mutex_owner when using ww_mutex_lock_slow()
	regulator: core: Avoid lockdep reports when resolving supplies
	x86/apic: Fix atomic update of offset in reserve_eilvt_offset()
	media: rkvdec: fix use after free bug in rkvdec_remove
	media: dm1105: Fix use after free bug in dm1105_remove due to race condition
	media: saa7134: fix use after free bug in saa7134_finidev due to race condition
	media: rcar_fdp1: Make use of the helper function devm_platform_ioremap_resource()
	media: rcar_fdp1: Fix the correct variable assignments
	platform: Provide a remove callback that returns no value
	media: rcar_fdp1: Convert to platform remove callback returning void
	media: rcar_fdp1: Fix refcount leak in probe and remove function
	drm/amd/display: Fix potential null dereference
	media: rc: gpio-ir-recv: Fix support for wake-up
	media: venus: dec: Fix handling of the start cmd
	regulator: stm32-pwr: fix of_iomap leak
	x86/ioapic: Don't return 0 from arch_dynirq_lower_bound()
	arm64: kgdb: Set PSTATE.SS to 1 to re-enable single-step
	debugobject: Prevent init race with static objects
	drm/i915: Make intel_get_crtc_new_encoder() less oopsy
	tick/common: Align tick period with the HZ tick.
	cpufreq: use correct unit when verify cur freq
	hwmon: (pmbus/fsp-3y) Fix functionality bitmask in FSP-3Y YM-2151E
	wifi: ath6kl: minor fix for allocation size
	wifi: ath9k: hif_usb: fix memory leak of remain_skbs
	wifi: ath5k: fix an off by one check in ath5k_eeprom_read_freq_list()
	wifi: brcmfmac: support CQM RSSI notification with older firmware
	wifi: ath6kl: reduce WARN to dev_dbg() in callback
	tools: bpftool: Remove invalid \' json escape
	wifi: rtw88: mac: Return the original error from rtw_pwr_seq_parser()
	wifi: rtw88: mac: Return the original error from rtw_mac_power_switch()
	bpf: take into account liveness when propagating precision
	bpf: fix precision propagation verbose logging
	scm: fix MSG_CTRUNC setting condition for SO_PASSSEC
	selftests/bpf: Fix a fd leak in an error path in network_helpers.c
	bpf: Remove misleading spec_v1 check on var-offset stack read
	net: pcs: xpcs: remove double-read of link state when using AN
	vlan: partially enable SIOCSHWTSTAMP in container
	net/packet: annotate accesses to po->xmit
	net/packet: convert po->origdev to an atomic flag
	net/packet: convert po->auxdata to an atomic flag
	scsi: target: Fix multiple LUN_RESET handling
	scsi: target: iscsit: Fix TAS handling during conn cleanup
	scsi: megaraid: Fix mega_cmd_done() CMDID_INT_CMDS
	f2fs: handle dqget error in f2fs_transfer_project_quota()
	f2fs: enforce single zone capacity
	f2fs: apply zone capacity to all zone type
	f2fs: compress: fix to call f2fs_wait_on_page_writeback() in f2fs_write_raw_pages()
	crypto: caam - Clear some memory in instantiate_rng
	crypto: sa2ul - Select CRYPTO_DES
	wifi: rtlwifi: fix incorrect error codes in rtl_debugfs_set_write_rfreg()
	wifi: rtlwifi: fix incorrect error codes in rtl_debugfs_set_write_reg()
	wifi: rt2x00: Fix memory leak when handling surveys
	net: qrtr: correct types of trace event parameters
	selftests: xsk: Disable IPv6 on VETH1
	selftests/bpf: Wait for receive in cg_storage_multi test
	bpftool: Fix bug for long instructions in program CFG dumps
	crypto: drbg - make drbg_prepare_hrng() handle jent instantiation errors
	crypto: drbg - Only fail when jent is unavailable in FIPS mode
	xsk: Fix unaligned descriptor validation
	f2fs: fix to avoid use-after-free for cached IPU bio
	scsi: lpfc: Fix ioremap issues in lpfc_sli4_pci_mem_setup()
	net: ethernet: stmmac: dwmac-rk: fix optional phy regulator handling
	bpf, sockmap: fix deadlocks in the sockhash and sockmap
	nvmet: use i_size_read() to set size for file-ns
	nvmet: move the call to nvmet_ns_changed out of nvmet_ns_revalidate
	nvmet: fix error handling in nvmet_execute_identify_cns_cs_ns()
	nvmet: fix Identify Namespace handling
	nvmet: fix Identify Controller handling
	nvmet: fix Identify Active Namespace ID list handling
	nvmet: fix I/O Command Set specific Identify Controller
	nvme: handle the persistent internal error AER
	nvme: fix async event trace event
	nvme-fcloop: fix "inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage"
	selftests/bpf: Fix leaked bpf_link in get_stackid_cannot_attach
	bpf, sockmap: Revert buggy deadlock fix in the sockhash and sockmap
	md: drop queue limitation for RAID1 and RAID10
	md: raid10 add nowait support
	md/raid10: factor out code from wait_barrier() to stop_waiting_barrier()
	md/raid10: fix task hung in raid10d
	md/raid10: fix leak of 'r10bio->remaining' for recovery
	md/raid10: fix memleak for 'conf->bio_split'
	md/raid10: fix memleak of md thread
	md/raid10: don't call bio_start_io_acct twice for bio which experienced read error
	wifi: iwlwifi: yoyo: skip dump correctly on hw error
	wifi: iwlwifi: yoyo: Fix possible division by zero
	wifi: iwlwifi: mvm: initialize seq variable
	wifi: iwlwifi: fw: move memset before early return
	jdb2: Don't refuse invalidation of already invalidated buffers
	wifi: iwlwifi: make the loop for card preparation effective
	wifi: mt76: handle failure of vzalloc in mt7615_coredump_work
	wifi: mt76: add flexible polling wait-interval support
	wifi: mt76: mt7921e: fix probe timeout after reboot
	wifi: mt76: fix 6GHz high channel not be scanned
	wifi: mt76: mt7921e: improve reliability of dma reset
	wifi: iwlwifi: mvm: check firmware response size
	wifi: iwlwifi: fw: fix memory leak in debugfs
	ixgbe: Allow flow hash to be set via ethtool
	ixgbe: Enable setting RSS table to default values
	net/mlx5: E-switch, Don't destroy indirect table in split rule
	net: stmmac:fix system hang when setting up tag_8021q VLAN for DSA ports
	bpf: Don't EFAULT for getsockopt with optval=NULL
	netfilter: nf_tables: don't write table validation state without mutex
	net/sched: sch_fq: fix integer overflow of "credit"
	ipv4: Fix potential uninit variable access bug in __ip_make_skb()
	Revert "Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work"
	netlink: Use copy_to_user() for optval in netlink_getsockopt().
	net: amd: Fix link leak when verifying config failed
	tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp.
	ipmi: ASPEED_BT_IPMI_BMC: select REGMAP_MMIO instead of depending on it
	drivers: staging: rtl8723bs: Fix locking in _rtw_join_timeout_handler()
	drivers: staging: rtl8723bs: Fix locking in rtw_scan_timeout_handler()
	pstore: Revert pmsg_lock back to a normal mutex
	usb: host: xhci-rcar: remove leftover quirk handling
	usb: dwc3: gadget: Change condition for processing suspend event
	serial: stm32: re-introduce an irq flag condition in usart_receive_chars
	serial: stm32: Re-assert RTS/DE GPIO in RS485 mode only if more data are transmitted
	fpga: bridge: fix kernel-doc parameter description
	iio: light: max44009: add missing OF device matching
	serial: 8250_bcm7271: Fix arbitration handling
	spi: spi-imx: using pm_runtime_resume_and_get instead of pm_runtime_get_sync
	spi: imx: Don't skip cleanup in remove's error path
	usb: gadget: udc: renesas_usb3: Fix use after free bug in renesas_usb3_remove due to race condition
	PCI: imx6: Install the fault handler only on compatible match
	ASoC: es8316: Handle optional IRQ assignment
	linux/vt_buffer.h: allow either builtin or modular for macros
	spi: qup: Don't skip cleanup in remove's error path
	spi: fsl-spi: Fix CPM/QE mode Litte Endian
	vmci_host: fix a race condition in vmci_host_poll() causing GPF
	of: Fix modalias string generation
	PCI/EDR: Clear Device Status after EDR error recovery
	ia64: mm/contig: fix section mismatch warning/error
	ia64: salinfo: placate defined-but-not-used warning
	scripts/gdb: bail early if there are no clocks
	scripts/gdb: bail early if there are no generic PD
	HID: amd_sfh: Add support for shutdown operation
	coresight: etm_pmu: Set the module field
	ASoC: fsl_mqs: move of_node_put() to the correct location
	spi: cadence-quadspi: fix suspend-resume implementations
	i2c: cadence: cdns_i2c_master_xfer(): Fix runtime PM leak on error path
	scripts/gdb: raise error with reduced debugging information
	uapi/linux/const.h: prefer ISO-friendly __typeof__
	sh: sq: Fix incorrect element size for allocating bitmap buffer
	usb: gadget: tegra-xudc: Fix crash in vbus_draw
	usb: chipidea: fix missing goto in `ci_hdrc_probe`
	usb: mtu3: fix kernel panic at qmu transfer done irq handler
	firmware: stratix10-svc: Fix an NULL vs IS_ERR() bug in probe
	tty: serial: fsl_lpuart: adjust buffer length to the intended size
	serial: 8250: Add missing wakeup event reporting
	staging: rtl8192e: Fix W_DISABLE# does not work after stop/start
	spmi: Add a check for remove callback when removing a SPMI driver
	virtio_ring: don't update event idx on get_buf
	macintosh/windfarm_smu_sat: Add missing of_node_put()
	powerpc/mpc512x: fix resource printk format warning
	powerpc/wii: fix resource printk format warnings
	powerpc/sysdev/tsi108: fix resource printk format warnings
	macintosh: via-pmu-led: requires ATA to be set
	powerpc/rtas: use memmove for potentially overlapping buffer copy
	sched/fair: Use __schedstat_set() in set_next_entity()
	sched: Make struct sched_statistics independent of fair sched class
	sched/fair: Fix inaccurate tally of ttwu_move_affine
	perf/core: Fix hardlockup failure caused by perf throttle
	Revert "objtool: Support addition to set CFA base"
	sched/rt: Fix bad task migration for rt tasks
	clk: at91: clk-sam9x60-pll: fix return value check
	RDMA/siw: Fix potential page_array out of range access
	RDMA/rdmavt: Delete unnecessary NULL check
	workqueue: Introduce show_one_worker_pool and show_one_workqueue.
	workqueue: Fix hung time report of worker pools
	rtc: omap: include header for omap_rtc_power_off_program prototype
	RDMA/mlx4: Prevent shift wrapping in set_user_sq_size()
	rtc: meson-vrtc: Use ktime_get_real_ts64() to get the current time
	fs/ntfs3: Fix memory leak if ntfs_read_mft failed
	fs/ntfs3: Add check for kmemdup
	fs/ntfs3: Fix OOB read in indx_insert_into_buffer
	fs/ntfs3: Fix slab-out-of-bounds read in hdr_delete_de()
	power: supply: generic-adc-battery: fix unit scaling
	clk: add missing of_node_put() in "assigned-clocks" property parsing
	RDMA/siw: Remove namespace check from siw_netdev_event()
	clk: qcom: gcc-sm6115: Mark RCGs shared where applicable
	RDMA/cm: Trace icm_send_rej event before the cm state is reset
	RDMA/srpt: Add a check for valid 'mad_agent' pointer
	IB/hfi1: Fix SDMA mmu_rb_node not being evicted in LRU order
	IB/hfi1: Fix bugs with non-PAGE_SIZE-end multi-iovec user SDMA requests
	NFSv4.1: Always send a RECLAIM_COMPLETE after establishing lease
	clk: qcom: regmap: add PHY clock source implementation
	clk: qcom: gcc-sm8350: fix PCIe PIPE clocks handling
	Input: raspberrypi-ts - fix refcount leak in rpi_ts_probe
	RDMA/mlx5: Fix flow counter query via DEVX
	SUNRPC: remove the maximum number of retries in call_bind_status
	RDMA/mlx5: Use correct device num_ports when modify DC
	clocksource/drivers/davinci: Fix memory leak in davinci_timer_register when init fails
	openrisc: Properly store r31 to pt_regs on unhandled exceptions
	timekeeping: Fix references to nonexistent ktime_get_fast_ns()
	SMB3: Add missing locks to protect deferred close file list
	SMB3: Close deferred file handles in case of handle lease break
	ext4: fix i_disksize exceeding i_size problem in paritally written case
	ext4: fix use-after-free read in ext4_find_extent for bigalloc + inline
	pinctrl: renesas: r8a779a0: Remove incorrect AVB[01] pinmux configuration
	leds: TI_LMU_COMMON: select REGMAP instead of depending on it
	dmaengine: mv_xor_v2: Fix an error code.
	leds: tca6507: Fix error handling of using fwnode_property_read_string
	pwm: mtk-disp: Disable shadow registers before setting backlight values
	pwm: mtk-disp: Configure double buffering before reading in .get_state()
	phy: tegra: xusb: Add missing tegra_xusb_port_unregister for usb2_port and ulpi_port
	dma: gpi: remove spurious unlock in gpi_ch_init
	dmaengine: dw-edma: Fix to change for continuous transfer
	dmaengine: dw-edma: Fix to enable to issue dma request on DMA processing
	dmaengine: at_xdmac: Fix concurrency over chan's completed_cookie
	dmaengine: at_xdmac: Fix race for the tx desc callback
	dmaengine: at_xdmac: do not enable all cyclic channels
	thermal/drivers/mediatek: Use devm_of_iomap to avoid resource leak in mtk_thermal_probe
	mfd: tqmx86: Do not access I2C_DETECT register through io_base
	mfd: tqmx86: Specify IO port register range more precisely
	mfd: tqmx86: Correct board names for TQMxE39x
	afs: Fix updating of i_size with dv jump from server
	parisc: Fix argument pointer in real64_call_asm()
	ALSA: usb-audio: Add quirk for Pioneer DDJ-800
	nilfs2: do not write dirty data after degenerating to read-only
	nilfs2: fix infinite loop in nilfs_mdt_get_block()
	md/raid10: fix null-ptr-deref in raid10_sync_request
	mtd: core: provide unique name for nvmem device, take two
	mtd: core: fix nvmem error reporting
	mtd: core: fix error path for nvmem provider
	mailbox: zynqmp: Fix IPI isr handling
	mailbox: zynqmp: Fix typo in IPI documentation
	wifi: rtl8xxxu: RTL8192EU always needs full init
	clk: rockchip: rk3399: allow clk_cifout to force clk_cifout_src to reparent
	scripts/gdb: fix lx-timerlist for Python3
	btrfs: scrub: reject unsupported scrub flags
	s390/dasd: fix hanging blockdevice after request requeue
	ia64: fix an addr to taddr in huge_pte_offset()
	dm verity: fix error handling for check_at_most_once on FEC
	dm clone: call kmem_cache_destroy() in dm_clone_init() error path
	dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path
	dm flakey: fix a crash with invalid table line
	dm ioctl: fix nested locking in table_clear() to remove deadlock concern
	dm: don't lock fs when the map is NULL in process of resume
	perf auxtrace: Fix address filter entire kernel size
	perf intel-pt: Fix CYC timestamps after standalone CBR
	debugobject: Ensure pool refill (again)
	sound/oss/dmasound: fix 'dmasound_setup' defined but not used
	arm64: dts: qcom: sdm845: correct dynamic power coefficients - again
	netfilter: nf_tables: deactivate anonymous set from preparation phase
	sched: Fix DEBUG && !SCHEDSTATS warn
	Linux 5.15.111

Change-Id: Ic17a1be536afd1897c1b88d5d054afbac9182d1a
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-06-08 13:25:38 +00:00
Tze-nan Wu
93f8b66403 ring-buffer: Ensure proper resetting of atomic variables in ring_buffer_reset_online_cpus
[ Upstream commit 7c339fb4d8 ]

In ring_buffer_reset_online_cpus, the buffer_size_kb write operation
may permanently fail if the cpu_online_mask changes between two
for_each_online_buffer_cpu loops. The number of increases and decreases
on both cpu_buffer->resize_disabled and cpu_buffer->record_disabled may be
inconsistent, causing some CPUs to have non-zero values for these atomic
variables after the function returns.

This issue can be reproduced by "echo 0 > trace" while hotplugging cpu.
After reproducing success, we can find out buffer_size_kb will not be
functional anymore.

To prevent leaving 'resize_disabled' and 'record_disabled' non-zero after
ring_buffer_reset_online_cpus returns, we ensure that each atomic variable
has been set up before atomic_sub() to it.

Link: https://lore.kernel.org/linux-trace-kernel/20230426062027.17451-1-Tze-nan.Wu@mediatek.com

Cc: stable@vger.kernel.org
Cc: <mhiramat@kernel.org>
Cc: npiggin@gmail.com
Fixes: b23d7a5f4a ("ring-buffer: speed up buffer resets by avoiding synchronize_rcu for each CPU")
Reviewed-by: Cheng-Jui Wang <cheng-jui.wang@mediatek.com>
Signed-off-by: Tze-nan Wu <Tze-nan.Wu@mediatek.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-05-17 11:50:13 +02:00
Johannes Berg
c63741e872 ring-buffer: Sync IRQ works before buffer destruction
commit 675751bb20 upstream.

If something was written to the buffer just before destruction,
it may be possible (maybe not in a real system, but it did
happen in ARCH=um with time-travel) to destroy the ringbuffer
before the IRQ work ran, leading this KASAN report (or a crash
without KASAN):

    BUG: KASAN: slab-use-after-free in irq_work_run_list+0x11a/0x13a
    Read of size 8 at addr 000000006d640a48 by task swapper/0

    CPU: 0 PID: 0 Comm: swapper Tainted: G        W  O       6.3.0-rc1 #7
    Stack:
     60c4f20f 0c203d48 41b58ab3 60f224fc
     600477fa 60f35687 60c4f20f 601273dd
     00000008 6101eb00 6101eab0 615be548
    Call Trace:
     [<60047a58>] show_stack+0x25e/0x282
     [<60c609e0>] dump_stack_lvl+0x96/0xfd
     [<60c50d4c>] print_report+0x1a7/0x5a8
     [<603078d3>] kasan_report+0xc1/0xe9
     [<60308950>] __asan_report_load8_noabort+0x1b/0x1d
     [<60232844>] irq_work_run_list+0x11a/0x13a
     [<602328b4>] irq_work_tick+0x24/0x34
     [<6017f9dc>] update_process_times+0x162/0x196
     [<6019f335>] tick_sched_handle+0x1a4/0x1c3
     [<6019fd9e>] tick_sched_timer+0x79/0x10c
     [<601812b9>] __hrtimer_run_queues.constprop.0+0x425/0x695
     [<60182913>] hrtimer_interrupt+0x16c/0x2c4
     [<600486a3>] um_timer+0x164/0x183
     [...]

    Allocated by task 411:
     save_stack_trace+0x99/0xb5
     stack_trace_save+0x81/0x9b
     kasan_save_stack+0x2d/0x54
     kasan_set_track+0x34/0x3e
     kasan_save_alloc_info+0x25/0x28
     ____kasan_kmalloc+0x8b/0x97
     __kasan_kmalloc+0x10/0x12
     __kmalloc+0xb2/0xe8
     load_elf_phdrs+0xee/0x182
     [...]

    The buggy address belongs to the object at 000000006d640800
     which belongs to the cache kmalloc-1k of size 1024
    The buggy address is located 584 bytes inside of
     freed 1024-byte region [000000006d640800, 000000006d640c00)

Add the appropriate irq_work_sync() so the work finishes before
the buffers are destroyed.

Prior to the commit in the Fixes tag below, there was only a
single global IRQ work, so this issue didn't exist.

Link: https://lore.kernel.org/linux-trace-kernel/20230427175920.a76159263122.I8295e405c44362a86c995e9c2c37e3e03810aa56@changeid

Cc: stable@vger.kernel.org
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Fixes: 15693458c4 ("tracing/ring-buffer: Move poll wake ups into ring buffer code")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-05-11 23:00:17 +09:00
Greg Kroah-Hartman
82dadab157 Merge 5.15.107 into android14-5.15
Changes in 5.15.107
	ocfs2: ocfs2_mount_volume does cleanup job before return error
	ocfs2: rewrite error handling of ocfs2_fill_super
	ocfs2: fix memory leak in ocfs2_mount_volume()
	NFSD: Fix sparse warning
	NFSD: pass range end to vfs_fsync_range() instead of count
	RDMA/irdma: Do not request 2-level PBLEs for CQ alloc
	platform/x86: int3472: Split into 2 drivers
	platform/x86: int3472/discrete: Ensure the clk/power enable pins are in output mode
	iavf: return errno code instead of status code
	iavf/iavf_main: actually log ->src mask when talking about it
	serial: 8250_exar: derive nr_ports from PCI ID for Acces I/O cards
	serial: exar: Add support for Sealevel 7xxxC serial cards
	bpf: hash map, avoid deadlock with suitable hash mask
	gpio: GPIO_REGMAP: select REGMAP instead of depending on it
	Drivers: vmbus: Check for channel allocation before looking up relids
	pwm: cros-ec: Explicitly set .polarity in .get_state()
	pwm: sprd: Explicitly set .polarity in .get_state()
	KVM: s390: pv: fix external interruption loop not always detected
	wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta
	net: qrtr: combine nameservice into main module
	net: qrtr: Fix a refcount bug in qrtr_recvmsg()
	NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL
	icmp: guard against too small mtu
	net: don't let netpoll invoke NAPI if in xmit context
	net: dsa: mv88e6xxx: Reset mv88e6393x force WD event bit
	sctp: check send stream number after wait_for_sndbuf
	net: qrtr: Do not do DEL_SERVER broadcast after DEL_CLIENT
	ipv6: Fix an uninit variable access bug in __ip6_make_skb()
	platform/x86: think-lmi: Fix memory leak when showing current settings
	platform/x86: think-lmi: Fix memory leaks when parsing ThinkStation WMI strings
	platform/x86: think-lmi: Clean up display of current_value on Thinkstation
	gpio: davinci: Add irq chip flag to skip set wake
	net: ethernet: ti: am65-cpsw: Fix mdio cleanup in probe
	net: stmmac: fix up RX flow hash indirection table when setting channels
	sunrpc: only free unix grouplist after RCU settles
	NFSD: callback request does not use correct credential for AUTH_SYS
	ice: fix wrong fallback logic for FDIR
	ice: Reset FDIR counter in FDIR init stage
	ethtool: reset #lanes when lanes is omitted
	gve: Secure enough bytes in the first TX desc for all TCP pkts
	kbuild: refactor single builds of *.ko
	usb: xhci: tegra: fix sleep in atomic call
	xhci: also avoid the XHCI_ZERO_64B_REGS quirk with a passthrough iommu
	usb: cdnsp: Fixes error: uninitialized symbol 'len'
	usb: dwc3: pci: add support for the Intel Meteor Lake-S
	USB: serial: cp210x: add Silicon Labs IFS-USB-DATACABLE IDs
	usb: typec: altmodes/displayport: Fix configure initial pin assignment
	USB: serial: option: add Telit FE990 compositions
	USB: serial: option: add Quectel RM500U-CN modem
	iio: adis16480: select CONFIG_CRC32
	iio: adc: ti-ads7950: Set `can_sleep` flag for GPIO chip
	iio: dac: cio-dac: Fix max DAC write value check for 12-bit
	iio: light: cm32181: Unregister second I2C client if present
	tty: serial: sh-sci: Fix transmit end interrupt handler
	tty: serial: sh-sci: Fix Rx on RZ/G2L SCI
	tty: serial: fsl_lpuart: avoid checking for transfer complete when UARTCTRL_SBK is asserted in lpuart32_tx_empty
	nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread()
	nilfs2: fix sysfs interface lifetime
	dt-bindings: serial: renesas,scif: Fix 4th IRQ for 4-IRQ SCIFs
	ksmbd: do not call kvmalloc() with __GFP_NORETRY | __GFP_NO_WARN
	ALSA: hda/realtek: Add quirk for Clevo X370SNW
	coresight: etm4x: Do not access TRCIDR1 for identification
	coresight-etm4: Fix for() loop drvdata->nr_addr_cmp range bug
	iio: adc: ad7791: fix IRQ flags
	scsi: qla2xxx: Fix memory leak in qla2x00_probe_one()
	scsi: iscsi_tcp: Check that sock is valid before iscsi_set_param()
	smb3: allow deferred close timeout to be configurable
	smb3: lower default deferred close timeout to address perf regression
	cifs: sanitize paths in cifs_update_super_prepath.
	perf/core: Fix the same task check in perf_event_set_output
	ftrace: Mark get_lock_parent_ip() __always_inline
	ftrace: Fix issue that 'direct->addr' not restored in modify_ftrace_direct()
	fs: drop peer group ids under namespace lock
	can: j1939: j1939_tp_tx_dat_new(): fix out-of-bounds memory access
	can: isotp: isotp_ops: fix poll() to not report false EPOLLOUT events
	tracing: Free error logs of tracing instances
	ASoC: hdac_hdmi: use set_stream() instead of set_tdm_slots()
	mm: vmalloc: avoid warn_alloc noise caused by fatal signal
	drm/panfrost: Fix the panfrost_mmu_map_fault_addr() error path
	drm/nouveau/disp: Support more modes by checking with lower bpc
	ring-buffer: Fix race while reader and writer are on the same page
	mm/swap: fix swap_info_struct race between swapoff and get_swap_pages()
	drm/bridge: lt9611: Fix PLL being unable to lock
	mm: take a page reference when removing device exclusive entries
	kbuild: fix single directory build
	ocfs2: fix freeing uninitialized resource on ocfs2_dlm_shutdown
	bpftool: Print newline before '}' for struct with padding only fields
	Linux 5.15.107

Change-Id: I88efacf4aaf63d4b21429eef2350c78da7e2528e
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-04-17 11:31:12 +00:00
Zheng Yejian
cbe5f7fed7 ring-buffer: Fix race while reader and writer are on the same page
commit 6455b6163d upstream.

When user reads file 'trace_pipe', kernel keeps printing following logs
that warn at "cpu_buffer->reader_page->read > rb_page_size(reader)" in
rb_get_reader_page(). It just looks like there's an infinite loop in
tracing_read_pipe(). This problem occurs several times on arm64 platform
when testing v5.10 and below.

  Call trace:
   rb_get_reader_page+0x248/0x1300
   rb_buffer_peek+0x34/0x160
   ring_buffer_peek+0xbc/0x224
   peek_next_entry+0x98/0xbc
   __find_next_entry+0xc4/0x1c0
   trace_find_next_entry_inc+0x30/0x94
   tracing_read_pipe+0x198/0x304
   vfs_read+0xb4/0x1e0
   ksys_read+0x74/0x100
   __arm64_sys_read+0x24/0x30
   el0_svc_common.constprop.0+0x7c/0x1bc
   do_el0_svc+0x2c/0x94
   el0_svc+0x20/0x30
   el0_sync_handler+0xb0/0xb4
   el0_sync+0x160/0x180

Then I dump the vmcore and look into the problematic per_cpu ring_buffer,
I found that tail_page/commit_page/reader_page are on the same page while
reader_page->read is obviously abnormal:
  tail_page == commit_page == reader_page == {
    .write = 0x100d20,
    .read = 0x8f9f4805,  // Far greater than 0xd20, obviously abnormal!!!
    .entries = 0x10004c,
    .real_end = 0x0,
    .page = {
      .time_stamp = 0x857257416af0,
      .commit = 0xd20,  // This page hasn't been full filled.
      // .data[0...0xd20] seems normal.
    }
 }

The root cause is most likely the race that reader and writer are on the
same page while reader saw an event that not fully committed by writer.

To fix this, add memory barriers to make sure the reader can see the
content of what is committed. Since commit a0fcaaed0c ("ring-buffer: Fix
race between reset page and reading page") has added the read barrier in
rb_get_reader_page(), here we just need to add the write barrier.

Link: https://lore.kernel.org/linux-trace-kernel/20230325021247.2923907-1-zhengyejian1@huawei.com

Cc: stable@vger.kernel.org
Fixes: 77ae365eca ("ring-buffer: make lockless")
Suggested-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Zheng Yejian <zhengyejian1@huawei.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-04-13 16:48:26 +02:00
Greg Kroah-Hartman
4403c58acc Merge 5.15.100 into android14-5.15
Changes in 5.15.100
	net/sched: Retire tcindex classifier
	auxdisplay: hd44780: Fix potential memory leak in hd44780_remove()
	fs/jfs: fix shift exponent db_agl2size negative
	objtool: Fix memory leak in create_static_call_sections()
	pwm: sifive: Reduce time the controller lock is held
	pwm: sifive: Always let the first pwm_apply_state succeed
	pwm: stm32-lp: fix the check on arr and cmp registers update
	f2fs: use memcpy_{to,from}_page() where possible
	fs: f2fs: initialize fsdata in pagecache_write()
	f2fs: allow set compression option of files without blocks
	um: vector: Fix memory leak in vector_config
	ubi: ensure that VID header offset + VID header size <= alloc, size
	ubifs: Fix build errors as symbol undefined
	ubifs: Rectify space budget for ubifs_symlink() if symlink is encrypted
	ubifs: Rectify space budget for ubifs_xrename()
	ubifs: Fix wrong dirty space budget for dirty inode
	ubifs: do_rename: Fix wrong space budget when target inode's nlink > 1
	ubifs: Reserve one leb for each journal head while doing budget
	ubi: Fix use-after-free when volume resizing failed
	ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume()
	ubifs: Fix memory leak in alloc_wbufs()
	ubi: Fix possible null-ptr-deref in ubi_free_volume()
	ubifs: Re-statistic cleaned znode count if commit failed
	ubifs: dirty_cow_znode: Fix memleak in error handling path
	ubifs: ubifs_writepage: Mark page dirty after writing inode failed
	ubi: fastmap: Fix missed fm_anchor PEB in wear-leveling after disabling fastmap
	ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show()
	ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed
	f2fs: fix to avoid potential memory corruption in __update_iostat_latency()
	ext4: use ext4_fc_tl_mem in fast-commit replay path
	netfilter: nf_tables: allow to fetch set elements when table has an owner
	x86: um: vdso: Add '%rcx' and '%r11' to the syscall clobber list
	um: virtio_uml: free command if adding to virtqueue failed
	um: virtio_uml: mark device as unregistered when breaking it
	um: virtio_uml: move device breaking into workqueue
	um: virt-pci: properly remove PCI device from bus
	watchdog: at91sam9_wdt: use devm_request_irq to avoid missing free_irq() in error path
	watchdog: Fix kmemleak in watchdog_cdev_register
	watchdog: pcwd_usb: Fix attempting to access uninitialized memory
	watchdog: sbsa_wdog: Make sure the timeout programming is within the limits
	netfilter: ctnetlink: fix possible refcount leak in ctnetlink_create_conntrack()
	netfilter: ebtables: fix table blob use-after-free
	netfilter: x_tables: fix percpu counter block leak on error path when creating new netns
	ipv6: Add lwtunnel encap size of all siblings in nexthop calculation
	sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop
	octeontx2-pf: Use correct struct reference in test condition
	net: fix __dev_kfree_skb_any() vs drop monitor
	9p/xen: fix version parsing
	9p/xen: fix connection sequence
	9p/rdma: unmap receive dma buffer in rdma_request()/post_recv()
	net/mlx5e: Verify flow_source cap before using it
	net/mlx5: Geneve, Fix handling of Geneve object id as error code
	nfc: fix memory leak of se_io context in nfc_genl_se_io
	net/sched: transition act_pedit to rcu and percpu stats
	net/sched: act_pedit: fix action bind logic
	net/sched: act_mpls: fix action bind logic
	net/sched: act_sample: fix action bind logic
	ARM: dts: spear320-hmi: correct STMPE GPIO compatible
	tcp: tcp_check_req() can be called from process context
	vc_screen: modify vcs_size() handling in vcs_read()
	rtc: sun6i: Always export the internal oscillator
	genirq: Refactor accessors to use irq_data_get_affinity_mask
	genirq: Add and use an irq_data_update_affinity helper
	scsi: ipr: Work around fortify-string warning
	rtc: allow rtc_read_alarm without read_alarm callback
	loop: loop_set_status_from_info() check before assignment
	ASoC: adau7118: don't disable regulators on device unbind
	ASoC: zl38060: Remove spurious gpiolib select
	ASoC: zl38060 add gpiolib dependency
	ASoC: mediatek: mt8195: add missing initialization
	thermal: intel: quark_dts: fix error pointer dereference
	thermal: intel: BXT_PMIC: select REGMAP instead of depending on it
	tracing: Add NULL checks for buffer in ring_buffer_free_read_page()
	kernel/printk/index.c: fix memory leak with using debugfs_lookup()
	firmware/efi sysfb_efi: Add quirk for Lenovo IdeaPad Duet 3
	bootconfig: Increase max nodes of bootconfig from 1024 to 8192 for DCC support
	mfd: arizona: Use pm_runtime_resume_and_get() to prevent refcnt leak
	IB/hfi1: Update RMT size calculation
	iommu/amd: Fix error handling for pdev_pri_ats_enable()
	media: uvcvideo: Remove format descriptions
	media: uvcvideo: Handle cameras with invalid descriptors
	media: uvcvideo: Handle errors from calls to usb_string
	media: uvcvideo: Quirk for autosuspend in Logitech B910 and C910
	media: uvcvideo: Silence memcpy() run-time false positive warnings
	USB: fix memory leak with using debugfs_lookup()
	staging: emxx_udc: Add checks for dma_alloc_coherent()
	tty: fix out-of-bounds access in tty_driver_lookup_tty()
	tty: serial: fsl_lpuart: disable the CTS when send break signal
	serial: sc16is7xx: setup GPIO controller later in probe
	mei: bus-fixup:upon error print return values of send and receive
	tools/iio/iio_utils:fix memory leak
	iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_status_word()
	iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_config_word()
	soundwire: bus_type: Avoid lockdep assert in sdw_drv_probe()
	PCI: loongson: Prevent LS7A MRRS increases
	USB: dwc3: fix memory leak with using debugfs_lookup()
	USB: chipidea: fix memory leak with using debugfs_lookup()
	USB: uhci: fix memory leak with using debugfs_lookup()
	USB: sl811: fix memory leak with using debugfs_lookup()
	USB: fotg210: fix memory leak with using debugfs_lookup()
	USB: isp116x: fix memory leak with using debugfs_lookup()
	USB: isp1362: fix memory leak with using debugfs_lookup()
	USB: gadget: gr_udc: fix memory leak with using debugfs_lookup()
	USB: gadget: bcm63xx_udc: fix memory leak with using debugfs_lookup()
	USB: gadget: lpc32xx_udc: fix memory leak with using debugfs_lookup()
	USB: gadget: pxa25x_udc: fix memory leak with using debugfs_lookup()
	USB: gadget: pxa27x_udc: fix memory leak with using debugfs_lookup()
	usb: host: xhci: mvebu: Iterate over array indexes instead of using pointer math
	USB: ene_usb6250: Allocate enough memory for full object
	usb: uvc: Enumerate valid values for color matching
	usb: gadget: uvc: Make bSourceID read/write
	PCI: Align extra resources for hotplug bridges properly
	PCI: Take other bus devices into account when distributing resources
	tty: pcn_uart: fix memory leak with using debugfs_lookup()
	misc: vmw_balloon: fix memory leak with using debugfs_lookup()
	drivers: base: component: fix memory leak with using debugfs_lookup()
	drivers: base: dd: fix memory leak with using debugfs_lookup()
	kernel/fail_function: fix memory leak with using debugfs_lookup()
	PCI: loongson: Add more devices that need MRRS quirk
	PCI: Add ACS quirk for Wangxun NICs
	phy: rockchip-typec: Fix unsigned comparison with less than zero
	soundwire: cadence: Remove wasted space in response_buf
	soundwire: cadence: Drain the RX FIFO after an IO timeout
	net: tls: avoid hanging tasks on the tx_lock
	x86/resctl: fix scheduler confusion with 'current'
	drm/display/dp_mst: Fix down/up message handling after sink disconnect
	drm/display/dp_mst: Fix down message handling after a packet reception error
	Bluetooth: hci_sock: purge socket queues in the destruct() callback
	media: uvcvideo: Fix race condition with usb_kill_urb
	drm/virtio: Fix error code in virtio_gpu_object_shmem_init()
	Revert "scsi: mpt3sas: Fix return value check of dma_get_required_mask()"
	scsi: mpt3sas: Don't change DMA mask while reallocating pools
	scsi: mpt3sas: re-do lost mpt3sas DMA mask fix
	scsi: mpt3sas: Remove usage of dma_get_required_mask() API
	malidp: Fix NULL vs IS_ERR() checking
	usb: gadget: uvc: fix missing mutex_unlock() if kstrtou8() fails
	Linux 5.15.100

Change-Id: If8949c57602ea5475c2f68a78d0d2e421d7969f2
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-03-21 10:16:45 +00:00
Greg Kroah-Hartman
ea8aebc48c Merge 5.15.99 into android14-5.15
Changes in 5.15.99
	HID: asus: use spinlock to protect concurrent accesses
	HID: asus: use spinlock to safely schedule workers
	powerpc/mm: Rearrange if-else block to avoid clang warning
	ARM: OMAP2+: Fix memory leak in realtime_counter_init()
	arm64: dts: qcom: qcs404: use symbol names for PCIe resets
	arm64: dts: qcom: msm8996-tone: Fix USB taking 6 minutes to wake up
	arm64: dts: qcom: sm8150-kumano: Panel framebuffer is 2.5k instead of 4k
	arm64: dts: qcom: sm6125: Reorder HSUSB PHY clocks to match bindings
	arm64: dts: imx8m: Align SoC unique ID node unit address
	ARM: zynq: Fix refcount leak in zynq_early_slcr_init
	arm64: dts: mediatek: mt8183: Fix systimer 13 MHz clock description
	arm64: dts: qcom: sdm845-db845c: fix audio codec interrupt pin name
	arm64: dts: qcom: sc7180: correct SPMI bus address cells
	arm64: dts: qcom: sc7280: correct SPMI bus address cells
	arm64: dts: meson-gx: Fix Ethernet MAC address unit name
	arm64: dts: meson-g12a: Fix internal Ethernet PHY unit name
	arm64: dts: meson-gx: Fix the SCPI DVFS node name and unit address
	arm64: dts: msm8992-bullhead: add memory hole region
	arm64: dts: qcom: msm8992-bullhead: Fix cont_splash_mem size
	arm64: dts: qcom: msm8992-bullhead: Disable dfps_data_mem
	arm64: dts: qcom: ipq8074: correct USB3 QMP PHY-s clock output names
	arm64: dts: qcom: Fix IPQ8074 PCIe PHY nodes
	arm64: dts: qcom: ipq8074: fix PCIe PHY serdes size
	arm64: dts: qcom: ipq8074: fix Gen3 PCIe QMP PHY
	arm64: dts: qcom: ipq8074: correct Gen2 PCIe ranges
	arm64: dts: qcom: ipq8074: fix Gen3 PCIe node
	arm64: dts: qcom: ipq8074: correct PCIe QMP PHY output clock names
	arm64: dts: meson: remove CPU opps below 1GHz for G12A boards
	ARM: OMAP1: call platform_device_put() in error case in omap1_dm_timer_init()
	ARM: bcm2835_defconfig: Enable the framebuffer
	ARM: s3c: fix s3c64xx_set_timer_source prototype
	arm64: dts: ti: k3-j7200: Fix wakeup pinmux range
	ARM: dts: exynos: correct wr-active property in Exynos3250 Rinato
	ARM: imx: Call ida_simple_remove() for ida_simple_get
	arm64: dts: amlogic: meson-gx: fix SCPI clock dvfs node name
	arm64: dts: amlogic: meson-axg: fix SCPI clock dvfs node name
	arm64: dts: amlogic: meson-gx: add missing SCPI sensors compatible
	arm64: dts: amlogic: meson-gxl-s905d-sml5442tw: drop invalid clock-names property
	arm64: dts: amlogic: meson-gx: add missing unit address to rng node name
	arm64: dts: amlogic: meson-gxl: add missing unit address to eth-phy-mux node name
	arm64: dts: amlogic: meson-gx-libretech-pc: fix update button name
	arm64: dts: amlogic: meson-sm1-bananapi-m5: fix adc keys node names
	arm64: dts: amlogic: meson-gxl-s905d-phicomm-n1: fix led node name
	arm64: dts: amlogic: meson-gxbb-kii-pro: fix led node name
	arm64: dts: amlogic: meson-sm1-odroid-hc4: fix active fan thermal trip
	locking/rwsem: Optimize down_read_trylock() under highly contended case
	locking/rwsem: Disable preemption in all down_read*() and up_read() code paths
	arm64: dts: renesas: beacon-renesom: Fix gpio expander reference
	arm64: dts: meson: bananapi-m5: switch VDDIO_C pin to OPEN_DRAIN
	ARM: dts: sun8i: nanopi-duo2: Fix regulator GPIO reference
	ARM: dts: imx7s: correct iomuxc gpr mux controller cells
	arm64: dts: mt8192: Fix CPU map for single-cluster SoC
	arm64: dts: mediatek: mt7622: Add missing pwm-cells to pwm node
	blk-mq: avoid sleep in blk_mq_alloc_request_hctx
	blk-mq: remove stale comment for blk_mq_sched_mark_restart_hctx
	blk-mq: correct stale comment of .get_budget
	arm64: dts: qcom: msm8992-lg-bullhead: Correct memory overlaps with the SMEM and MPSS memory regions
	s390/dasd: Fix potential memleak in dasd_eckd_init()
	sched/deadline,rt: Remove unused parameter from pick_next_[rt|dl]_entity()
	sched/rt: pick_next_rt_entity(): check list_entry
	x86/perf/zhaoxin: Add stepping check for ZXC
	KEYS: asymmetric: Fix ECDSA use via keyctl uapi
	arm64: dts: qcom: pmk8350: Specify PBS register for PON
	arm64: dts: qcom: pmk8350: Use the correct PON compatible
	block: bio-integrity: Copy flags when bio_integrity_payload is cloned
	wifi: rsi: Fix memory leak in rsi_coex_attach()
	wifi: rtlwifi: rtl8821ae: don't call kfree_skb() under spin_lock_irqsave()
	wifi: rtlwifi: rtl8188ee: don't call kfree_skb() under spin_lock_irqsave()
	wifi: rtlwifi: rtl8723be: don't call kfree_skb() under spin_lock_irqsave()
	wifi: iwlegacy: common: don't call dev_kfree_skb() under spin_lock_irqsave()
	wifi: libertas: fix memory leak in lbs_init_adapter()
	wifi: rtl8xxxu: don't call dev_kfree_skb() under spin_lock_irqsave()
	wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit()
	libbpf: Fix btf__align_of() by taking into account field offsets
	wifi: ipw2x00: don't call dev_kfree_skb() under spin_lock_irqsave()
	wifi: ipw2200: fix memory leak in ipw_wdev_init()
	wifi: wilc1000: fix potential memory leak in wilc_mac_xmit()
	wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit()
	wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid()
	wifi: libertas_tf: don't call kfree_skb() under spin_lock_irqsave()
	wifi: libertas: if_usb: don't call kfree_skb() under spin_lock_irqsave()
	wifi: libertas: main: don't call kfree_skb() under spin_lock_irqsave()
	wifi: libertas: cmdresp: don't call kfree_skb() under spin_lock_irqsave()
	wifi: wl3501_cs: don't call kfree_skb() under spin_lock_irqsave()
	crypto: x86/ghash - fix unaligned access in ghash_setkey()
	ACPICA: Drop port I/O validation for some regions
	genirq: Fix the return type of kstat_cpu_irqs_sum()
	rcu-tasks: Improve comments explaining tasks_rcu_exit_srcu purpose
	rcu-tasks: Remove preemption disablement around srcu_read_[un]lock() calls
	rcu-tasks: Fix synchronize_rcu_tasks() VS zap_pid_ns_processes()
	lib/mpi: Fix buffer overrun when SG is too long
	crypto: ccp - Avoid page allocation failure warning for SEV_GET_ID2
	ACPICA: nsrepair: handle cases without a return value correctly
	thermal/drivers/tsens: Drop msm8976-specific defines
	thermal/drivers/tsens: Add compat string for the qcom,msm8960
	thermal/drivers/tsens: Sort out msm8976 vs msm8956 data
	thermal/drivers/tsens: fix slope values for msm8939
	thermal/drivers/tsens: limit num_sensors to 9 for msm8939
	wifi: rtl8xxxu: Fix memory leaks with RTL8723BU, RTL8192EU
	wifi: orinoco: check return value of hermes_write_wordrec()
	wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no callback function
	ath9k: hif_usb: simplify if-if to if-else
	ath9k: htc: clean up statistics macros
	wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails
	wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback()
	wifi: ath11k: Fix memory leak in ath11k_peer_rx_frag_setup
	wifi: cfg80211: Fix extended KCK key length check in nl80211_set_rekey_data()
	ACPI: battery: Fix missing NUL-termination with large strings
	crypto: ccp - Failure on re-initialization due to duplicate sysfs filename
	crypto: essiv - Handle EBUSY correctly
	crypto: seqiv - Handle EBUSY correctly
	powercap: fix possible name leak in powercap_register_zone()
	x86: Mark stop_this_cpu() __noreturn
	x86/microcode: Rip out the OLD_INTERFACE
	x86/microcode: Default-disable late loading
	x86/microcode: Print previous version of microcode after reload
	x86/microcode: Add a parameter to microcode_check() to store CPU capabilities
	x86/microcode: Check CPU capabilities after late microcode update correctly
	x86/microcode: Adjust late loading result reporting message
	crypto: xts - Handle EBUSY correctly
	leds: led-class: Add missing put_device() to led_put()
	crypto: ccp - Refactor out sev_fw_alloc()
	crypto: ccp - Flush the SEV-ES TMR memory before giving it to firmware
	bpftool: profile online CPUs instead of possible
	mt76: mt7915: fix polling firmware-own status
	net/mlx5: Enhance debug print in page allocation failure
	irqchip: Fix refcount leak in platform_irqchip_probe
	irqchip/alpine-msi: Fix refcount leak in alpine_msix_init_domains
	irqchip/irq-mvebu-gicp: Fix refcount leak in mvebu_gicp_probe
	irqchip/ti-sci: Fix refcount leak in ti_sci_intr_irq_domain_probe
	s390/mem_detect: fix detect_memory() error handling
	s390/vmem: fix empty page tables cleanup under KASAN
	net: add sock_init_data_uid()
	tun: tun_chr_open(): correctly initialize socket uid
	tap: tap_open(): correctly initialize socket uid
	OPP: fix error checking in opp_migrate_dentry()
	Bluetooth: L2CAP: Fix potential user-after-free
	Bluetooth: hci_qca: get wakeup status from serdev device handle
	s390/ap: fix status returned by ap_aqic()
	s390/ap: fix status returned by ap_qact()
	libbpf: Fix alen calculation in libbpf_nla_dump_errormsg()
	rds: rds_rm_zerocopy_callback() correct order for list_add_tail()
	crypto: rsa-pkcs1pad - Use akcipher_request_complete
	m68k: /proc/hardware should depend on PROC_FS
	RISC-V: time: initialize hrtimer based broadcast clock event device
	wifi: iwl3945: Add missing check for create_singlethread_workqueue
	wifi: iwl4965: Add missing check for create_singlethread_workqueue()
	wifi: mwifiex: fix loop iterator in mwifiex_update_ampdu_txwinsize()
	selftests/bpf: Fix out-of-srctree build
	ACPI: resource: Add IRQ overrides for MAINGEAR Vector Pro 2 models
	ACPI: resource: Do IRQ override on all TongFang GMxRGxx
	crypto: crypto4xx - Call dma_unmap_page when done
	wifi: mac80211: make rate u32 in sta_set_rate_info_rx()
	thermal/drivers/hisi: Drop second sensor hi3660
	can: esd_usb: Move mislocated storage of SJA1000_ECC_SEG bits in case of a bus error
	bpf: Fix global subprog context argument resolution logic
	irqchip/irq-brcmstb-l2: Set IRQ_LEVEL for level triggered interrupts
	irqchip/irq-bcm7120-l2: Set IRQ_LEVEL for level triggered interrupts
	selftests/net: Interpret UDP_GRO cmsg data as an int value
	l2tp: Avoid possible recursive deadlock in l2tp_tunnel_register()
	net: bcmgenet: fix MoCA LED control
	selftest: fib_tests: Always cleanup before exit
	sefltests: netdevsim: wait for devlink instance after netns removal
	drm: Fix potential null-ptr-deref due to drmm_mode_config_init()
	drm/fourcc: Add missing big-endian XRGB1555 and RGB565 formats
	drm/bridge: ti-sn65dsi83: Fix delay after reset deassert to match spec
	drm: mxsfb: DRM_MXSFB should depend on ARCH_MXS || ARCH_MXC
	drm/bridge: megachips: Fix error handling in i2c_register_driver()
	drm/vkms: Fix memory leak in vkms_init()
	drm/vkms: Fix null-ptr-deref in vkms_release()
	drm/vc4: dpi: Add option for inverting pixel clock and output enable
	drm/vc4: dpi: Fix format mapping for RGB565
	drm: tidss: Fix pixel format definition
	gpu: ipu-v3: common: Add of_node_put() for reference returned by of_graph_get_port_by_id()
	hwmon: (ftsteutates) Fix scaling of measurements
	drm/msm/hdmi: Add missing check for alloc_ordered_workqueue
	pinctrl: qcom: pinctrl-msm8976: Correct function names for wcss pins
	pinctrl: stm32: Fix refcount leak in stm32_pctrl_get_irq_domain
	pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups
	drm/vc4: hvs: Set AXI panic modes
	drm/vc4: hvs: Fix colour order for xRGB1555 on HVS5
	drm/vc4: hdmi: Correct interlaced timings again
	drm/msm: clean event_thread->worker in case of an error
	scsi: qla2xxx: edif: Fix I/O timeout due to over-subscription
	scsi: qla2xxx: Fix exchange oversubscription
	scsi: qla2xxx: Fix exchange oversubscription for management commands
	ASoC: fsl_sai: Update to modern clocking terminology
	ASoC: fsl_sai: initialize is_dsp_mode flag
	drm/msm/adreno: Fix null ptr access in adreno_gpu_cleanup()
	ALSA: hda/ca0132: minor fix for allocation size
	drm/msm/gem: Add check for kmalloc
	drm/msm/dpu: Disallow unallocated resources to be returned
	drm/bridge: lt9611: fix sleep mode setup
	drm/bridge: lt9611: fix HPD reenablement
	drm/bridge: lt9611: fix polarity programming
	drm/bridge: lt9611: fix programming of video modes
	drm/bridge: lt9611: fix clock calculation
	drm/bridge: lt9611: pass a pointer to the of node
	drm/mipi-dsi: Fix byte order of 16-bit DCS set/get brightness
	drm: exynos: dsi: Fix MIPI_DSI*_NO_* mode flags
	drm/msm/dsi: Allow 2 CTRLs on v2.5.0
	drm/msm: use strscpy instead of strncpy
	drm/msm/dpu: Add check for cstate
	drm/msm/dpu: Add check for pstates
	drm/msm/mdp5: Add check for kzalloc
	pinctrl: bcm2835: Remove of_node_put() in bcm2835_of_gpio_ranges_fallback()
	pinctrl: mediatek: fix coding style
	pinctrl: mediatek: Initialize variable pullen and pullup to zero
	pinctrl: mediatek: Initialize variable *buf to zero
	gpu: host1x: Don't skip assigning syncpoints to channels
	drm/tegra: firewall: Check for is_addr_reg existence in IMM check
	drm/msm/dpu: set pdpu->is_rt_pipe early in dpu_plane_sspp_atomic_update()
	drm/mediatek: dsi: Reduce the time of dsi from LP11 to sending cmd
	drm/mediatek: Use NULL instead of 0 for NULL pointer
	drm/mediatek: Drop unbalanced obj unref
	drm/mediatek: mtk_drm_crtc: Add checks for devm_kcalloc
	drm/mediatek: Clean dangling pointer on bind error path
	ASoC: soc-compress.c: fixup private_data on snd_soc_new_compress()
	gpio: vf610: connect GPIO label to dev name
	spi: dw_bt1: fix MUX_MMIO dependencies
	ASoC: mchp-spdifrx: fix controls which rely on rsr register
	ASoC: mchp-spdifrx: fix return value in case completion times out
	ASoC: mchp-spdifrx: fix controls that works with completion mechanism
	ASoC: mchp-spdifrx: disable all interrupts in mchp_spdifrx_dai_remove()
	ASoC: rsnd: fixup #endif position
	ASoC: mchp-spdifrx: Fix uninitialized use of mr in mchp_spdifrx_hw_params()
	ASoC: dt-bindings: meson: fix gx-card codec node regex
	hwmon: (ltc2945) Handle error case in ltc2945_value_store
	drm/amdgpu: fix enum odm_combine_mode mismatch
	scsi: mpt3sas: Fix a memory leak
	scsi: aic94xx: Add missing check for dma_map_single()
	HID: multitouch: Add quirks for flipped axes
	HID: retain initial quirks set up when creating HID devices
	ASoC: codecs: Change bulk clock voting to optional voting in digital codecs
	ASoC: codecs: rx-macro: move clk provider to managed variants
	ASoC: codecs: tx-macro: move clk provider to managed variants
	ASoC: codecs: rx-macro: move to individual clks from bulk
	ASoC: codecs: tx-macro: move to individual clks from bulk
	ASoC: codecs: lpass: fix incorrect mclk rate
	spi: bcm63xx-hsspi: Fix multi-bit mode setting
	hwmon: (mlxreg-fan) Return zero speed for broken fan
	ASoC: tlv320adcx140: fix 'ti,gpio-config' DT property init
	dm: remove flush_scheduled_work() during local_exit()
	NFSv4: keep state manager thread active if swap is enabled
	nfs4trace: fix state manager flag printing
	NFS: fix disabling of swap
	spi: synquacer: Fix timeout handling in synquacer_spi_transfer_one()
	ASoC: soc-dapm.h: fixup warning struct snd_pcm_substream not declared
	HID: bigben: use spinlock to protect concurrent accesses
	HID: bigben_worker() remove unneeded check on report_field
	HID: bigben: use spinlock to safely schedule workers
	hid: bigben_probe(): validate report count
	drm/shmem-helper: Fix locking for drm_gem_shmem_get_pages_sgt()
	nfsd: fix race to check ls_layouts
	cifs: Fix lost destroy smbd connection when MR allocate failed
	cifs: Fix warning and UAF when destroy the MR list
	gfs2: jdata writepage fix
	perf llvm: Fix inadvertent file creation
	leds: led-core: Fix refcount leak in of_led_get()
	perf inject: Use perf_data__read() for auxtrace
	perf intel-pt: Add documentation for Event Trace and TNT disable
	perf intel-pt: Add link to the perf wiki's Intel PT page
	perf intel-pt: Add support for emulated ptwrite
	perf intel-pt: Do not try to queue auxtrace data on pipe
	perf tools: Fix auto-complete on aarch64
	sparc: allow PM configs for sparc32 COMPILE_TEST
	selftests/ftrace: Fix bash specific "==" operator
	printf: fix errname.c list
	objtool: add UACCESS exceptions for __tsan_volatile_read/write
	mfd: cs5535: Don't build on UML
	mfd: pcf50633-adc: Fix potential memleak in pcf50633_adc_async_read()
	dmaengine: idxd: Set traffic class values in GRPCFG on DSA 2.0
	dmaengine: HISI_DMA should depend on ARCH_HISI
	iio: light: tsl2563: Do not hardcode interrupt trigger type
	usb: gadget: fusb300_udc: free irq on the error path in fusb300_probe()
	i2c: designware: fix i2c_dw_clk_rate() return size to be u32
	soundwire: cadence: Don't overflow the command FIFOs
	driver core: fix potential null-ptr-deref in device_add()
	kobject: modify kobject_get_path() to take a const *
	kobject: Fix slab-out-of-bounds in fill_kobj_path()
	alpha/boot/tools/objstrip: fix the check for ELF header
	media: uvcvideo: Do not check for V4L2_CTRL_WHICH_DEF_VAL
	media: uvcvideo: Remove s_ctrl and g_ctrl
	media: uvcvideo: refactor __uvc_ctrl_add_mapping
	media: uvcvideo: Add support for V4L2_CTRL_TYPE_CTRL_CLASS
	media: uvcvideo: Use control names from framework
	media: uvcvideo: Check controls flags before accessing them
	media: uvcvideo: Check for INACTIVE in uvc_ctrl_is_accessible()
	coresight: etm4x: Fix accesses to TRCSEQRSTEVR and TRCSEQSTR
	coresight: cti: Prevent negative values of enable count
	coresight: cti: Add PM runtime call in enable_store
	ACPI: resource: Add helper function acpi_dev_get_memory_resources()
	usb: typec: intel_pmc_mux: Use the helper acpi_dev_get_memory_resources()
	usb: typec: intel_pmc_mux: Don't leak the ACPI device reference count
	PCI/IOV: Enlarge virtfn sysfs name buffer
	PCI: switchtec: Return -EFAULT for copy_to_user() errors
	tty: serial: fsl_lpuart: disable Rx/Tx DMA in lpuart32_shutdown()
	tty: serial: fsl_lpuart: clear LPUART Status Register in lpuart32_shutdown()
	serial: tegra: Add missing clk_disable_unprepare() in tegra_uart_hw_init()
	Revert "char: pcmcia: cm4000_cs: Replace mdelay with usleep_range in set_protocol"
	eeprom: idt_89hpesx: Fix error handling in idt_init()
	applicom: Fix PCI device refcount leak in applicom_init()
	firmware: stratix10-svc: add missing gen_pool_destroy() in stratix10_svc_drv_probe()
	VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF
	misc/mei/hdcp: Use correct macros to initialize uuid_le
	driver core: fix resource leak in device_add()
	drivers: base: transport_class: fix possible memory leak
	drivers: base: transport_class: fix resource leak when transport_add_device() fails
	firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle
	fotg210-udc: Add missing completion handler
	dmaengine: dw-edma: Fix missing src/dst address of interleaved xfers
	usb: early: xhci-dbc: Fix a potential out-of-bound memory access
	tty: serial: fsl_lpuart: Fix the wrong RXWATER setting for rx dma case
	RDMA/cxgb4: add null-ptr-check after ip_dev_find()
	usb: musb: mediatek: don't unregister something that wasn't registered
	usb: gadget: configfs: use to_config_usb_cfg() in os_desc_link()
	usb: gadget: configfs: use to_usb_function_instance() in cfg (un)link func
	usb: gadget: configfs: remove using list iterator after loop body as a ptr
	usb: gadget: configfs: Restrict symlink creation is UDC already binded
	iommu/vt-d: Set No Execute Enable bit in PASID table entry
	power: supply: remove faulty cooling logic
	RDMA/cxgb4: Fix potential null-ptr-deref in pass_establish()
	usb: max-3421: Fix setting of I/O pins
	RDMA/irdma: Cap MSIX used to online CPUs + 1
	serial: fsl_lpuart: fix RS485 RTS polariy inverse issue
	tty: serial: imx: Handle RS485 DE signal active high
	tty: serial: imx: disable Ageing Timer interrupt request irq
	dmaengine: dw-edma: Fix readq_ch() return value truncation
	phy: rockchip-typec: fix tcphy_get_mode error case
	iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry()
	iommu: Fix error unwind in iommu_group_alloc()
	dmaengine: sf-pdma: pdma_desc memory leak fix
	dmaengine: dw-axi-dmac: Do not dereference NULL structure
	iommu/vt-d: Fix error handling in sva enable/disable paths
	iommu/vt-d: Remove duplicate identity domain flag
	iommu/vt-d: Check FL and SL capability sanity in scalable mode
	iommu/vt-d: Use second level for GPA->HPA translation
	iommu/vt-d: Allow to use flush-queue when first level is default
	IB/hfi1: Fix math bugs in hfi1_can_pin_pages()
	IB/hfi1: Fix sdma.h tx->num_descs off-by-one errors
	remoteproc: qcom_q6v5_mss: Use a carveout to authenticate modem headers
	media: ti: cal: fix possible memory leak in cal_ctx_create()
	media: platform: ti: Add missing check for devm_regulator_get
	powerpc: Remove linker flag from KBUILD_AFLAGS
	s390/vdso: remove -nostdlib compiler flag
	s390/vdso: Drop '-shared' from KBUILD_CFLAGS_64
	builddeb: clean generated package content
	media: max9286: Fix memleak in max9286_v4l2_register()
	media: ov2740: Fix memleak in ov2740_init_controls()
	media: ov5675: Fix memleak in ov5675_init_controls()
	media: i2c: ov772x: Fix memleak in ov772x_probe()
	media: i2c: imx219: Split common registers from mode tables
	media: i2c: imx219: Fix binning for RAW8 capture
	media: v4l2-jpeg: correct the skip count in jpeg_parse_app14_data
	media: v4l2-jpeg: ignore the unknown APP14 marker
	media: imx-jpeg: Apply clk_bulk api instead of operating specific clk
	media: rc: Fix use-after-free bugs caused by ene_tx_irqsim()
	media: i2c: ov7670: 0 instead of -EINVAL was returned
	media: usb: siano: Fix use after free bugs caused by do_submit_urb
	media: saa7134: Use video_unregister_device for radio_dev
	rpmsg: glink: Avoid infinite loop on intent for missing channel
	udf: Define EFSCORRUPTED error code
	ARM: dts: exynos: Use Exynos5420 compatible for the MIPI video phy
	blk-iocost: fix divide by 0 error in calc_lcoefs()
	trace/blktrace: fix memory leak with using debugfs_lookup()
	wifi: ath9k: Fix use-after-free in ath9k_hif_usb_disconnect()
	wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds()
	rcu: Make RCU_LOCKDEP_WARN() avoid early lockdep checks
	rcu: Suppress smp_processor_id() complaint in synchronize_rcu_expedited_wait()
	rcu-tasks: Make rude RCU-Tasks work well with CPU hotplug
	wifi: ath11k: debugfs: fix to work with multiple PCI devices
	thermal: intel: Fix unsigned comparison with less than zero
	timers: Prevent union confusion from unexpected restart_syscall()
	x86/bugs: Reset speculation control settings on init
	wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds
	wifi: mt7601u: fix an integer underflow
	inet: fix fast path in __inet_hash_connect()
	ice: restrict PTP HW clock freq adjustments to 100, 000, 000 PPB
	ice: add missing checks for PF vsi type
	ACPI: Don't build ACPICA with '-Os'
	thermal: intel: intel_pch: Add support for Wellsburg PCH
	clocksource: Suspend the watchdog temporarily when high read latency detected
	crypto: hisilicon: Wipe entire pool on error
	net: bcmgenet: Add a check for oversized packets
	m68k: Check syscall_trace_enter() return code
	netfilter: nf_tables: NULL pointer dereference in nf_tables_updobj()
	tools/power/x86/intel-speed-select: Add Emerald Rapid quirk
	wifi: mt76: dma: free rx_head in mt76_dma_rx_cleanup
	ACPI: video: Fix Lenovo Ideapad Z570 DMI match
	net/mlx5: fw_tracer: Fix debug print
	coda: Avoid partial allocation of sig_inputArgs
	uaccess: Add minimum bounds check on kernel buffer size
	s390/idle: mark arch_cpu_idle() noinstr
	time/debug: Fix memory leak with using debugfs_lookup()
	PM: domains: fix memory leak with using debugfs_lookup()
	PM: EM: fix memory leak with using debugfs_lookup()
	Bluetooth: btusb: Add VID:PID 13d3:3529 for Realtek RTL8821CE
	hv_netvsc: Check status in SEND_RNDIS_PKT completion message
	scm: add user copy checks to put_cmsg()
	drm/amd/display: Revert Reduce delay when sink device not able to ACK 00340h write
	drm/amd/display: Fix potential null-deref in dm_resume
	drm/omap: dsi: Fix excessive stack usage
	HID: Add Mapping for System Microphone Mute
	drm/tiny: ili9486: Do not assume 8-bit only SPI controllers
	drm/radeon: free iio for atombios when driver shutdown
	scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write
	Revert "fbcon: don't lose the console font across generic->chip driver switch"
	drm: amd: display: Fix memory leakage
	drm/msm/dsi: Add missing check for alloc_ordered_workqueue
	docs/scripts/gdb: add necessary make scripts_gdb step
	ASoC: soc-compress: Reposition and add pcm_mutex
	ASoC: kirkwood: Iterate over array indexes instead of using pointer math
	regulator: max77802: Bounds check regulator id against opmode
	regulator: s5m8767: Bounds check id indexing into arrays
	gfs2: Improve gfs2_make_fs_rw error handling
	hwmon: (coretemp) Simplify platform device handling
	pinctrl: at91: use devm_kasprintf() to avoid potential leaks
	scsi: snic: Fix memory leak with using debugfs_lookup()
	HID: logitech-hidpp: Don't restart communication if not necessary
	drm: panel-orientation-quirks: Add quirk for Lenovo IdeaPad Duet 3 10IGL5
	dm thin: add cond_resched() to various workqueue loops
	dm cache: add cond_resched() to various workqueue loops
	nfsd: zero out pointers after putting nfsd_files on COPY setup error
	drm/shmem-helper: Revert accidental non-GPL export
	wifi: rtl8xxxu: fixing transmisison failure for rtl8192eu
	firmware: coreboot: framebuffer: Ignore reserved pixel color bits
	block: don't allow multiple bios for IOCB_NOWAIT issue
	rtc: pm8xxx: fix set-alarm race
	ipmi:ssif: resend_msg() cannot fail
	ipmi_ssif: Rename idle state and check
	s390/extmem: return correct segment type in __segment_load()
	s390: discard .interp section
	s390/kprobes: fix irq mask clobbering on kprobe reenter from post_handler
	s390/kprobes: fix current_kprobe never cleared after kprobes reenter
	cifs: Fix uninitialized memory read in smb3_qfs_tcon()
	btrfs: hold block group refcount during async discard
	locking/rwsem: Prevent non-first waiter from spinning in down_write() slowpath
	ksmbd: fix wrong data area length for smb2 lock request
	ksmbd: do not allow the actual frame length to be smaller than the rfc1002 length
	ARM: dts: exynos: correct HDMI phy compatible in Exynos4
	hfs: fix missing hfs_bnode_get() in __hfs_bnode_create
	fs: hfsplus: fix UAF issue in hfsplus_put_super
	exfat: fix reporting fs error when reading dir beyond EOF
	exfat: fix unexpected EOF while reading dir
	exfat: redefine DIR_DELETED as the bad cluster number
	exfat: fix inode->i_blocks for non-512 byte sector size device
	fs: dlm: don't set stop rx flag after node reset
	fs: dlm: move sending fin message into state change handling
	fs: dlm: send FIN ack back in right cases
	f2fs: fix information leak in f2fs_move_inline_dirents()
	f2fs: fix cgroup writeback accounting with fs-layer encryption
	ocfs2: fix defrag path triggering jbd2 ASSERT
	ocfs2: fix non-auto defrag path not working issue
	selftests/landlock: Skip overlayfs tests when not supported
	selftests/landlock: Test ptrace as much as possible with Yama
	udf: Truncate added extents on failed expansion
	udf: Do not bother merging very long extents
	udf: Do not update file length for failed writes to inline files
	udf: Preserve link count of system files
	udf: Detect system inodes linked into directory hierarchy
	udf: Fix file corruption when appending just after end of preallocated extent
	RDMA/siw: Fix user page pinning accounting
	KVM: Destroy target device if coalesced MMIO unregistration fails
	KVM: x86: Inject #GP if WRMSR sets reserved bits in APIC Self-IPI
	KVM: SVM: Fix potential overflow in SEV's send|receive_update_data()
	KVM: SVM: hyper-v: placate modpost section mismatch error
	KVM: s390: disable migration mode when dirty tracking is disabled
	x86/virt: Force GIF=1 prior to disabling SVM (for reboot flows)
	x86/crash: Disable virt in core NMI crash handler to avoid double shootdown
	x86/reboot: Disable virtualization in an emergency if SVM is supported
	x86/reboot: Disable SVM, not just VMX, when stopping CPUs
	x86/kprobes: Fix __recover_optprobed_insn check optimizing logic
	x86/kprobes: Fix arch_check_optimized_kprobe check within optimized_kprobe range
	x86/microcode/amd: Remove load_microcode_amd()'s bsp parameter
	x86/microcode/AMD: Add a @cpu parameter to the reloading functions
	x86/microcode/AMD: Fix mixed steppings support
	x86/speculation: Allow enabling STIBP with legacy IBRS
	Documentation/hw-vuln: Document the interaction between IBRS and STIBP
	brd: return 0/-error from brd_insert_page()
	ima: Align ima_file_mmap() parameters with mmap_file LSM hook
	irqdomain: Fix association race
	irqdomain: Fix disassociation race
	irqdomain: Look for existing mapping only once
	irqdomain: Drop bogus fwspec-mapping error handling
	irqdomain: Fix domain registration race
	crypto: qat - fix out-of-bounds read
	io_uring: handle TIF_NOTIFY_RESUME when checking for task_work
	io_uring: mark task TASK_RUNNING before handling resume/task work
	io_uring: add a conditional reschedule to the IOPOLL cancelation loop
	io_uring/rsrc: disallow multi-source reg buffers
	io_uring: remove MSG_NOSIGNAL from recvmsg
	io_uring/poll: allow some retries for poll triggering spuriously
	ALSA: ice1712: Do not left ice->gpio_mutex locked in aureon_add_controls()
	ALSA: hda/realtek: Add quirk for HP EliteDesk 800 G6 Tower PC
	jbd2: fix data missing when reusing bh which is ready to be checkpointed
	ext4: optimize ea_inode block expansion
	ext4: refuse to create ea block when umounted
	mtd: spi-nor: sfdp: Fix index value for SCCR dwords
	mtd: spi-nor: spansion: Consider reserved bits in CFR5 register
	mtd: spi-nor: Fix shift-out-of-bounds in spi_nor_set_erase_type
	dm: send just one event on resize, not two
	dm: add cond_resched() to dm_wq_work()
	wifi: rtl8xxxu: Use a longer retry limit of 48
	wifi: ath11k: allow system suspend to survive ath11k
	wifi: cfg80211: Fix use after free for wext
	qede: fix interrupt coalescing configuration
	thermal: intel: powerclamp: Fix cur_state for multi package system
	dm flakey: fix logic when corrupting a bio
	dm flakey: don't corrupt the zero page
	dm flakey: fix a bug with 32-bit highmem systems
	ARM: dts: qcom: sdx55: Add Qcom SMMU-500 as the fallback for IOMMU node
	ARM: dts: exynos: correct TMU phandle in Exynos4210
	ARM: dts: exynos: correct TMU phandle in Exynos4
	ARM: dts: exynos: correct TMU phandle in Odroid XU3 family
	ARM: dts: exynos: correct TMU phandle in Exynos5250
	ARM: dts: exynos: correct TMU phandle in Odroid XU
	ARM: dts: exynos: correct TMU phandle in Odroid HC1
	fuse: add inode/permission checks to fileattr_get/fileattr_set
	rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails
	ceph: update the time stamps and try to drop the suid/sgid
	alpha: fix FEN fault handling
	dax/kmem: Fix leak of memory-hotplug resources
	mips: fix syscall_get_nr
	media: ipu3-cio2: Fix PM runtime usage_count in driver unbind
	remoteproc/mtk_scp: Move clk ops outside send_lock
	docs: gdbmacros: print newest record
	mm: memcontrol: deprecate charge moving
	mm/thp: check and bail out if page in deferred queue already
	ktest.pl: Give back console on Ctrt^C on monitor
	ktest.pl: Fix missing "end_monitor" when machine check fails
	ktest.pl: Add RUN_TIMEOUT option with default unlimited
	ring-buffer: Handle race between rb_move_tail and rb_check_pages
	tools/bootconfig: fix single & used for logical condition
	scsi: qla2xxx: Fix link failure in NPIV environment
	scsi: qla2xxx: Check if port is online before sending ELS
	scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests
	scsi: qla2xxx: Remove unintended flag clearing
	scsi: qla2xxx: Fix erroneous link down
	scsi: qla2xxx: Remove increment of interface err cnt
	scsi: ses: Don't attach if enclosure has no components
	scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process()
	scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses
	scsi: ses: Fix possible desc_ptr out-of-bounds accesses
	scsi: ses: Fix slab-out-of-bounds in ses_intf_remove()
	RISC-V: add a spin_shadow_stack declaration
	riscv: mm: fix regression due to update_mmu_cache change
	riscv: jump_label: Fixup unaligned arch_static_branch function
	riscv, mm: Perform BPF exhandler fixup on page fault
	riscv: ftrace: Remove wasted nops for !RISCV_ISA_C
	riscv: ftrace: Reduce the detour code size to half
	MIPS: DTS: CI20: fix otg power gpio
	PCI/PM: Observe reset delay irrespective of bridge_d3
	PCI: hotplug: Allow marking devices as disconnected during bind/unbind
	PCI: Avoid FLR for AMD FCH AHCI adapters
	iommu/vt-d: Avoid superfluous IOTLB tracking in lazy mode
	vfio/type1: prevent underflow of locked_vm via exec()
	vfio/type1: track locked_vm per dma
	vfio/type1: restore locked_vm
	drm/i915/quirks: Add inverted backlight quirk for HP 14-r206nv
	drm/radeon: Fix eDP for single-display iMac11,2
	drm/i915: Don't use BAR mappings for ring buffers with LLC
	drm/edid: fix AVI infoframe aspect ratio handling
	perf intel-pt: pkt-decoder: Add CFE and EVD packets
	qede: avoid uninitialized entries in coal_entry array
	media: uvcvideo: Fix memory leak of object map on error exit path
	iommu/vt-d: Fix an unbalanced rcu_read_lock/rcu_read_unlock()
	arm64: dts: qcom: ipq8074: fix Gen2 PCIe QMP PHY
	wifi: ath9k: use proper statements in conditionals
	kbuild: Port silent mode detection to future gnu make.
	Linux 5.15.99

Change-Id: I52781008c0a83946c09698b9b5625a5f7ee2e545
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-03-17 13:35:31 +00:00
Vincent Donnefort
c8d86d177a ANDROID: ring-buffer: Fix ring_buffer_read_page for external writers
No shortcut is possible for reading a page without removing it from
the ring-buffer. The reader needs to be moved and its timestamp
updated.

Bug: 249050813
Change-Id: I80fbc1e265500e419278346e2973df2488b7e8b3
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
2023-03-14 13:02:13 +00:00
Jia-Ju Bai
ba279dc7e4 tracing: Add NULL checks for buffer in ring_buffer_free_read_page()
[ Upstream commit 3e4272b995 ]

In a previous commit 7433632c9f, buffer, buffer->buffers and
buffer->buffers[cpu] in ring_buffer_wake_waiters() can be NULL,
and thus the related checks are added.

However, in the same call stack, these variables are also used in
ring_buffer_free_read_page():

tracing_buffers_release()
  ring_buffer_wake_waiters(iter->array_buffer->buffer)
    cpu_buffer = buffer->buffers[cpu] -> Add checks by previous commit
  ring_buffer_free_read_page(iter->array_buffer->buffer)
    cpu_buffer = buffer->buffers[cpu] -> No check

Thus, to avod possible null-pointer derefernces, the related checks
should be added.

These results are reported by a static tool designed by myself.

Link: https://lkml.kernel.org/r/20230113125501.760324-1-baijiaju1990@gmail.com

Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-11 13:57:32 +01:00
Mukesh Ojha
d41db100bc ring-buffer: Handle race between rb_move_tail and rb_check_pages
commit 8843e06f67 upstream.

It seems a data race between ring_buffer writing and integrity check.
That is, RB_FLAG of head_page is been updating, while at same time
RB_FLAG was cleared when doing integrity check rb_check_pages():

  rb_check_pages()            rb_handle_head_page():
  --------                    --------
  rb_head_page_deactivate()
                              rb_head_page_set_normal()
  rb_head_page_activate()

We do intergrity test of the list to check if the list is corrupted and
it is still worth doing it. So, let's refactor rb_check_pages() such that
we no longer clear and set flag during the list sanity checking.

[1] and [2] are the test to reproduce and the crash report respectively.

1:
``` read_trace.sh
  while true;
  do
    # the "trace" file is closed after read
    head -1 /sys/kernel/tracing/trace > /dev/null
  done
```
``` repro.sh
  sysctl -w kernel.panic_on_warn=1
  # function tracer will writing enough data into ring_buffer
  echo function > /sys/kernel/tracing/current_tracer
  ./read_trace.sh &
  ./read_trace.sh &
  ./read_trace.sh &
  ./read_trace.sh &
  ./read_trace.sh &
  ./read_trace.sh &
  ./read_trace.sh &
  ./read_trace.sh &
```

2:
------------[ cut here ]------------
WARNING: CPU: 9 PID: 62 at kernel/trace/ring_buffer.c:2653
rb_move_tail+0x450/0x470
Modules linked in:
CPU: 9 PID: 62 Comm: ksoftirqd/9 Tainted: G        W          6.2.0-rc6+
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014
RIP: 0010:rb_move_tail+0x450/0x470
Code: ff ff 4c 89 c8 f0 4d 0f b1 02 48 89 c2 48 83 e2 fc 49 39 d0 75 24
83 e0 03 83 f8 02 0f 84 e1 fb ff ff 48 8b 57 10 f0 ff 42 08 <0f> 0b 83
f8 02 0f 84 ce fb ff ff e9 db
RSP: 0018:ffffb5564089bd00 EFLAGS: 00000203
RAX: 0000000000000000 RBX: ffff9db385a2bf81 RCX: ffffb5564089bd18
RDX: ffff9db281110100 RSI: 0000000000000fe4 RDI: ffff9db380145400
RBP: ffff9db385a2bf80 R08: ffff9db385a2bfc0 R09: ffff9db385a2bfc2
R10: ffff9db385a6c000 R11: ffff9db385a2bf80 R12: 0000000000000000
R13: 00000000000003e8 R14: ffff9db281110100 R15: ffffffffbb006108
FS:  0000000000000000(0000) GS:ffff9db3bdcc0000(0000)
knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005602323024c8 CR3: 0000000022e0c000 CR4: 00000000000006e0
Call Trace:
 <TASK>
 ring_buffer_lock_reserve+0x136/0x360
 ? __do_softirq+0x287/0x2df
 ? __pfx_rcu_softirq_qs+0x10/0x10
 trace_function+0x21/0x110
 ? __pfx_rcu_softirq_qs+0x10/0x10
 ? __do_softirq+0x287/0x2df
 function_trace_call+0xf6/0x120
 0xffffffffc038f097
 ? rcu_softirq_qs+0x5/0x140
 rcu_softirq_qs+0x5/0x140
 __do_softirq+0x287/0x2df
 run_ksoftirqd+0x2a/0x30
 smpboot_thread_fn+0x188/0x220
 ? __pfx_smpboot_thread_fn+0x10/0x10
 kthread+0xe7/0x110
 ? __pfx_kthread+0x10/0x10
 ret_from_fork+0x2c/0x50
 </TASK>
---[ end trace 0000000000000000 ]---

[ crash report and test reproducer credit goes to Zheng Yejian]

Link: https://lore.kernel.org/linux-trace-kernel/1676376403-16462-1-git-send-email-quic_mojha@quicinc.com

Cc: <mhiramat@kernel.org>
Cc: stable@vger.kernel.org
Fixes: 1039221cc2 ("ring-buffer: Do not disable recording when there is an iterator")
Reported-by: Zheng Yejian <zhengyejian1@huawei.com>
Signed-off-by: Mukesh Ojha <quic_mojha@quicinc.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-03-10 09:40:10 +01:00
Vincent Donnefort
a7640ce6cf ANDROID: KVM: arm64: RAW interface to the nVHE hyp tracing
This interface intends to be used by userspace tools to store raw
version of events. In such case, the kernel does not decode anything.

Bug: 229972309
Change-Id: Ib1fca21a34a308ad1361240ef598033ecab3b4ad
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
2023-01-27 11:11:25 +00:00
Vincent Donnefort
13188635cc ANDROID: ring-buffer: Introducing external writer support
The ring buffer is convenient: it has a page granularity and its format
is already supported by userspace tools such as trace-cmd. It is a
natural solution to store events that would come from outside the kernel
such as a hypervisor.

In that case, where a writer is external to the kernel, the latter would
only be responsible for the allocation and to read back the ring buffer.

The allocation is done with the newly introduced function which just
needs a size and a set of callbacks (notice only the overwrite mode is
supported at the moment):

  ring_buffer_alloc_ext(unsigned long size,
                        struct ring_buffer_ext_cb *cb)

The callbacks given to this allocator enables communication with the
external writer:

  (*swap_reader)(int cpu):    Ask the writer to swap the current reader
                              page with the head.

  (*update_footers)(int cpu): Ask the writer to update material in the
                              page footers.

Each page from the ring buffer has indeed a footer in which statistics
and page status can be retrieved. This allows the kernel to update its
view on the ring buffer, following a reader page swap or a footers
update.

After the trace_buffer is allocated, a helper serializes the relevant
information into a structure that can be easily sent to the external
writer:

  trace_buffer_pack(struct trace_buffer *trace_buffer,
                    struct trace_buffer_pack *pack)

The footer and pack description can be found in the newly introduced
header file include/linux/ring_buffer_ext.h.

When the kernel is writing to the ring buffer, it can wake up quite
easily the reader. That's not the case when the writer is external. A
new function allows polling for reading the ring buffer:

  ring_buffer_poke(struct trace_buffer *buffer, int cpu)

A ring-buffer allocated for an external writer will forbid any writing
(the whole design of the ring buffer mandates a single writer) and will
also prevent extending or extracting pages.

When I presented this work to the tracingsummit, rosted@ told me he saw
some overlapping with an idea he had to enable him to map the tracing
buffers in userspace. We designed together a solution that would enable
both features. Problem now, if on one hand, the development of the new
design has started already... it would nonetheless impose a significant
revamp of this patchset, which wouldn't make it to Android14. Nothing
technically wrong with anything here, but sending it to LKML wouldn't
make sense, as I know already this isn't as "reusable" as the version
agreed upon.

Bug: 229972309
Change-Id: Iafcc1e2683a7460c94de3db116878c303601df64
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
2023-01-27 11:11:24 +00:00
Vincent Donnefort
39f43996ba ANDROID: ring-buffer: Expose buffer_data_page material
In preparation for allowing the write of ring-buffer compliant pages
outside of ring_buffer.c move to the header, struct buffer_data_page and
timestamp encoding functions.

When I presented this work to the tracingsummit, rosted@ told me he saw
some overlapping with an idea he had to enable him to map the tracing
buffers in userspace. We designed together a solution that would enable
both features. Problem now, if on one hand, the development of the new
design has started already... it would nonetheless impose a significant
revamp of this patchset, which wouldn't make it to Android14. Nothing
technically wrong with anything here, but sending it to LKML wouldn't
make sense, as I know already this isn't as "reusable" as the version
agreed upon.

Bug: 229972309
Change-Id: Icf3329bd899a3dd91279d1bbadaf2dc4e243455c
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
2023-01-27 11:11:24 +00:00
Steven Rostedt (Google)
73cf0ff9a3 ring-buffer: Include dropped pages in counting dirty patches
[ Upstream commit 31029a8b2c ]

The function ring_buffer_nr_dirty_pages() was created to find out how many
pages are filled in the ring buffer. There's two running counters. One is
incremented whenever a new page is touched (pages_touched) and the other
is whenever a page is read (pages_read). The dirty count is the number
touched minus the number read. This is used to determine if a blocked task
should be woken up if the percentage of the ring buffer it is waiting for
is hit.

The problem is that it does not take into account dropped pages (when the
new writes overwrite pages that were not read). And then the dirty pages
will always be greater than the percentage.

This makes the "buffer_percent" file inaccurate, as the number of dirty
pages end up always being larger than the percentage, event when it's not
and this causes user space to be woken up more than it wants to be.

Add a new counter to keep track of lost pages, and include that in the
accounting of dirty pages so that it is actually accurate.

Link: https://lkml.kernel.org/r/20221021123013.55fb6055@gandalf.local.home

Fixes: 2c2b0a78b3 ("ring-buffer: Add percentage of ring buffer full to wake up reader")
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-11-26 09:24:49 +01:00
Steven Rostedt (Google)
8b318f3032 tracing/ring-buffer: Have polling block on watermark
commit 42fb0a1e84 upstream.

Currently the way polling works on the ring buffer is broken. It will
return immediately if there's any data in the ring buffer whereas a read
will block until the watermark (defined by the tracefs buffer_percent file)
is hit.

That is, a select() or poll() will return as if there's data available,
but then the following read will block. This is broken for the way
select()s and poll()s are supposed to work.

Have the polling on the ring buffer also block the same way reads and
splice does on the ring buffer.

Link: https://lkml.kernel.org/r/20221020231427.41be3f26@gandalf.local.home

Cc: Linux Trace Kernel <linux-trace-kernel@vger.kernel.org>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Primiano Tucci <primiano@google.com>
Cc: stable@vger.kernel.org
Fixes: 1e0d6714ac ("ring-buffer: Do not wake up a splice waiter when page is not full")
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-11-26 09:24:42 +01:00
Daniil Tatianin
00f74b1a98 ring_buffer: Do not deactivate non-existant pages
commit 56f4ca0a79 upstream.

rb_head_page_deactivate() expects cpu_buffer to contain a valid list of
->pages, so verify that the list is actually present before calling it.

Found by Linux Verification Center (linuxtesting.org) with the SVACE
static analysis tool.

Link: https://lkml.kernel.org/r/20221114143129.3534443-1-d-tatianin@yandex-team.ru

Cc: stable@vger.kernel.org
Fixes: 77ae365eca ("ring-buffer: make lockless")
Signed-off-by: Daniil Tatianin <d-tatianin@yandex-team.ru>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-11-26 09:24:42 +01:00
Steven Rostedt (Google)
b5074df412 ring-buffer: Check for NULL cpu_buffer in ring_buffer_wake_waiters()
commit 7433632c9f upstream.

On some machines the number of listed CPUs may be bigger than the actual
CPUs that exist. The tracing subsystem allocates a per_cpu directory with
access to the per CPU ring buffer via a cpuX file. But to save space, the
ring buffer will only allocate buffers for online CPUs, even though the
CPU array will be as big as the nr_cpu_ids.

With the addition of waking waiters on the ring buffer when closing the
file, the ring_buffer_wake_waiters() now needs to make sure that the
buffer is allocated (with the irq_work allocated with it) before trying to
wake waiters, as it will cause a NULL pointer dereference.

While debugging this, I added a NULL check for the buffer itself (which is
OK to do), and also NULL pointer checks against buffer->buffers (which is
not fine, and will WARN) as well as making sure the CPU number passed in
is within the nr_cpu_ids (which is also not fine if it isn't).

Link: https://lore.kernel.org/all/87h6zklb6n.wl-tiwai@suse.de/
Link: https://lore.kernel.org/all/CAM6Wdxc0KRJMXVAA0Y=u6Jh2V=uWB-_Fn6M4xRuNppfXzL1mUg@mail.gmail.com/
Link: https://lkml.kernel.org/linux-trace-kernel/20221101191009.1e7378c8@rorschach.local.home

Cc: stable@vger.kernel.org
Cc: Steven Noonan <steven.noonan@gmail.com>
Bugzilla: https://bugzilla.opensuse.org/show_bug.cgi?id=1204705
Reported-by: Takashi Iwai <tiwai@suse.de>
Reported-by: Roland Ruckerbauer <roland.rucky@gmail.com>
Fixes: f3ddb74ad0 ("tracing: Wake up ring buffer waiters on closing of the file")
Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-11-10 18:15:38 +01:00
Steven Rostedt (Google)
d4ab9bc5f5 ring-buffer: Fix race between reset page and reading page
commit a0fcaaed0c upstream.

The ring buffer is broken up into sub buffers (currently of page size).
Each sub buffer has a pointer to its "tail" (the last event written to the
sub buffer). When a new event is requested, the tail is locally
incremented to cover the size of the new event. This is done in a way that
there is no need for locking.

If the tail goes past the end of the sub buffer, the process of moving to
the next sub buffer takes place. After setting the current sub buffer to
the next one, the previous one that had the tail go passed the end of the
sub buffer needs to be reset back to the original tail location (before
the new event was requested) and the rest of the sub buffer needs to be
"padded".

The race happens when a reader takes control of the sub buffer. As readers
do a "swap" of sub buffers from the ring buffer to get exclusive access to
the sub buffer, it replaces the "head" sub buffer with an empty sub buffer
that goes back into the writable portion of the ring buffer. This swap can
happen as soon as the writer moves to the next sub buffer and before it
updates the last sub buffer with padding.

Because the sub buffer can be released to the reader while the writer is
still updating the padding, it is possible for the reader to see the event
that goes past the end of the sub buffer. This can cause obvious issues.

To fix this, add a few memory barriers so that the reader definitely sees
the updates to the sub buffer, and also waits until the writer has put
back the "tail" of the sub buffer back to the last event that was written
on it.

To be paranoid, it will only spin for 1 second, otherwise it will
warn and shutdown the ring buffer code. 1 second should be enough as
the writer does have preemption disabled. If the writer doesn't move
within 1 second (with preemption disabled) something is horribly
wrong. No interrupt should last 1 second!

Link: https://lore.kernel.org/all/20220830120854.7545-1-jiazi.li@transsion.com/
Link: https://bugzilla.kernel.org/show_bug.cgi?id=216369
Link: https://lkml.kernel.org/r/20220929104909.0650a36c@gandalf.local.home

Cc: Ingo Molnar <mingo@kernel.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: stable@vger.kernel.org
Fixes: c7b0930857 ("ring-buffer: prevent adding write in discarded area")
Reported-by: Jiazi.Li <jiazi.li@transsion.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-10-26 12:34:31 +02:00
Steven Rostedt (Google)
be60f698c2 ring-buffer: Add ring_buffer_wake_waiters()
commit 7e9fbbb1b7 upstream.

On closing of a file that represents a ring buffer or flushing the file,
there may be waiters on the ring buffer that needs to be woken up and exit
the ring_buffer_wait() function.

Add ring_buffer_wake_waiters() to wake up the waiters on the ring buffer
and allow them to exit the wait loop.

Link: https://lkml.kernel.org/r/20220928133938.28dc2c27@gandalf.local.home

Cc: stable@vger.kernel.org
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Fixes: 15693458c4 ("tracing/ring-buffer: Move poll wake ups into ring buffer code")
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-10-26 12:34:31 +02:00
Steven Rostedt (Google)
5201dd81ae ring-buffer: Check pending waiters when doing wake ups as well
commit ec0bbc5ec5 upstream.

The wake up waiters only checks the "wakeup_full" variable and not the
"full_waiters_pending". The full_waiters_pending is set when a waiter is
added to the wait queue. The wakeup_full is only set when an event is
triggered, and it clears the full_waiters_pending to avoid multiple calls
to irq_work_queue().

The irq_work callback really needs to check both wakeup_full as well as
full_waiters_pending such that this code can be used to wake up waiters
when a file is closed that represents the ring buffer and the waiters need
to be woken up.

Link: https://lkml.kernel.org/r/20220927231824.209460321@goodmis.org

Cc: stable@vger.kernel.org
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Fixes: 15693458c4 ("tracing/ring-buffer: Move poll wake ups into ring buffer code")
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-10-26 12:34:30 +02:00
Steven Rostedt (Google)
bc6d4e9d64 ring-buffer: Have the shortest_full queue be the shortest not longest
commit 3b19d614b6 upstream.

The logic to know when the shortest waiters on the ring buffer should be
woken up or not has uses a less than instead of a greater than compare,
which causes the shortest_full to actually be the longest.

Link: https://lkml.kernel.org/r/20220927231823.718039222@goodmis.org

Cc: stable@vger.kernel.org
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Fixes: 2c2b0a78b3 ("ring-buffer: Add percentage of ring buffer full to wake up reader")
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-10-26 12:34:30 +02:00
Steven Rostedt (Google)
e8d1167385 ring-buffer: Allow splice to read previous partially read pages
commit fa8f4a8973 upstream.

If a page is partially read, and then the splice system call is run
against the ring buffer, it will always fail to read, no matter how much
is in the ring buffer. That's because the code path for a partial read of
the page does will fail if the "full" flag is set.

The splice system call wants full pages, so if the read of the ring buffer
is not yet full, it should return zero, and the splice will block. But if
a previous read was done, where the beginning has been consumed, it should
still be given to the splice caller if the rest of the page has been
written to.

This caused the splice command to never consume data in this scenario, and
let the ring buffer just fill up and lose events.

Link: https://lkml.kernel.org/r/20220927144317.46be6b80@gandalf.local.home

Cc: stable@vger.kernel.org
Fixes: 8789a9e7df ("ring-buffer: read page interface")
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-10-26 12:34:30 +02:00
Steven Rostedt (VMware)
34c2a0d0a7 ring-buffer: Protect ring_buffer_reset() from reentrancy
commit 51d1579466 upstream.

The resetting of the entire ring buffer use to simply go through and reset
each individual CPU buffer that had its own protection and synchronization.
But this was very slow, due to performing a synchronization for each CPU.
The code was reshuffled to do one disabling of all CPU buffers, followed
by a single RCU synchronization, and then the resetting of each of the CPU
buffers. But unfortunately, the mutex that prevented multiple occurrences
of resetting the buffer was not moved to the upper function, and there is
nothing to protect from it.

Take the ring buffer mutex around the global reset.

Cc: stable@vger.kernel.org
Fixes: b23d7a5f4a ("ring-buffer: speed up buffer resets by avoiding synchronize_rcu for each CPU")
Reported-by: "Tzvetomir Stoyanov (VMware)" <tz.stoyanov@gmail.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-11-18 19:16:03 +01:00
Sebastian Andrzej Siewior
99c37d1a63 tracing: Replace deprecated CPU-hotplug functions.
The functions get_online_cpus() and put_online_cpus() have been
deprecated during the CPU hotplug rework. They map directly to
cpus_read_lock() and cpus_read_unlock().

Replace deprecated CPU-hotplug functions with the official version.
The behavior remains unchanged.

Link: https://lkml.kernel.org/r/20210803141621.780504-37-bigeasy@linutronix.de

Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Ingo Molnar <mingo@redhat.com>
Acked-by: Daniel Bristot de Oliveira <bristot@kernel.org>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
2021-08-17 15:47:14 -04:00
Haoran Luo
67f0d6d988 tracing: Fix bug in rb_per_cpu_empty() that might cause deadloop.
The "rb_per_cpu_empty()" misinterpret the condition (as not-empty) when
"head_page" and "commit_page" of "struct ring_buffer_per_cpu" points to
the same buffer page, whose "buffer_data_page" is empty and "read" field
is non-zero.

An error scenario could be constructed as followed (kernel perspective):

1. All pages in the buffer has been accessed by reader(s) so that all of
them will have non-zero "read" field.

2. Read and clear all buffer pages so that "rb_num_of_entries()" will
return 0 rendering there's no more data to read. It is also required
that the "read_page", "commit_page" and "tail_page" points to the same
page, while "head_page" is the next page of them.

3. Invoke "ring_buffer_lock_reserve()" with large enough "length"
so that it shot pass the end of current tail buffer page. Now the
"head_page", "commit_page" and "tail_page" points to the same page.

4. Discard current event with "ring_buffer_discard_commit()", so that
"head_page", "commit_page" and "tail_page" points to a page whose buffer
data page is now empty.

When the error scenario has been constructed, "tracing_read_pipe" will
be trapped inside a deadloop: "trace_empty()" returns 0 since
"rb_per_cpu_empty()" returns 0 when it hits the CPU containing such
constructed ring buffer. Then "trace_find_next_entry_inc()" always
return NULL since "rb_num_of_entries()" reports there's no more entry
to read. Finally "trace_seq_to_user()" returns "-EBUSY" spanking
"tracing_read_pipe" back to the start of the "waitagain" loop.

I've also written a proof-of-concept script to construct the scenario
and trigger the bug automatically, you can use it to trace and validate
my reasoning above:

  https://github.com/aegistudio/RingBufferDetonator.git

Tests has been carried out on linux kernel 5.14-rc2
(2734d6c1b1), my fixed version
of kernel (for testing whether my update fixes the bug) and
some older kernels (for range of affected kernels). Test result is
also attached to the proof-of-concept repository.

Link: https://lore.kernel.org/linux-trace-devel/YPaNxsIlb2yjSi5Y@aegistudio/
Link: https://lore.kernel.org/linux-trace-devel/YPgrN85WL9VyrZ55@aegistudio

Cc: stable@vger.kernel.org
Fixes: bf41a158ca ("ring-buffer: make reentrant")
Suggested-by: Linus Torvalds <torvalds@linuxfoundation.org>
Signed-off-by: Haoran Luo <www@aegistudio.net>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
2021-07-22 11:52:33 -04:00
Wei Ming Chen
957cdcd9bd ring-buffer: Use fallthrough pseudo-keyword
Replace /* fall through */ comment with pseudo-keyword macro fallthrough[1]

[1] https://www.kernel.org/doc/html/latest/process/deprecated.html?highlight=fallthrough#implicit-switch-case-fall-through

Link: https://lkml.kernel.org/r/20210511140246.18868-1-jj251510319013@gmail.com

Signed-off-by: Wei Ming Chen <jj251510319013@gmail.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
2021-06-10 11:16:20 -04:00
Yordan Karadzhov (VMware)
f3ef7202ef tracing: Remove unused argument from "ring_buffer_time_stamp()
The "cpu" parameter is not being used by the function.

Link: https://lkml.kernel.org/r/20210329130331.199402-1-y.karadz@gmail.com

Signed-off-by: Yordan Karadzhov (VMware) <y.karadz@gmail.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
2021-04-01 14:18:32 -04:00
Ingo Molnar
f2cc020d78 tracing: Fix various typos in comments
Fix ~59 single-word typos in the tracing code comments, and fix
the grammar in a handful of places.

Link: https://lore.kernel.org/r/20210322224546.GA1981273@gmail.com
Link: https://lkml.kernel.org/r/20210323174935.GA4176821@gmail.com

Reviewed-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
2021-03-23 14:08:18 -04:00
Steven Rostedt (VMware)
a948c69d6f ring-buffer: Add verifier for using ring_buffer_event_time_stamp()
The ring_buffer_event_time_stamp() must be only called by an event that has
not been committed yet, and is on the buffer that is passed in. This was
used to help debug converting the histogram logic over to using the new
time stamp code, and was proven to be very useful.

Add a verifier that can check that this is the case, and extra WARN_ONs to
catch unexpected use cases.

Link: https://lkml.kernel.org/r/20210316164113.987294354@goodmis.org

Reviewed-by: Tom Zanussi <zanussi@kernel.org>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
2021-03-18 12:58:26 -04:00
Steven Rostedt (VMware)
efe6196a6b ring-buffer: Allow ring_buffer_event_time_stamp() to return time stamp of all events
Currently, ring_buffer_event_time_stamp() only returns an accurate time
stamp of the event if it has an absolute extended time stamp attached to
it. To make it more robust, use the event_stamp() in case the event does
not have an absolute value attached to it.

This will allow ring_buffer_event_time_stamp() to be used in more cases
than just histograms, and it will also allow histograms to not require
including absolute values all the time.

Link: https://lkml.kernel.org/r/20210316164113.704830885@goodmis.org

Reviewed-by: Tom Zanussi <zanussi@kernel.org>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
2021-03-18 12:58:26 -04:00
Steven Rostedt (VMware)
8672e4948d ring-buffer: Add a event_stamp to cpu_buffer for each level of nesting
Add a place to save the current event time stamp for each level of nesting.
This will be used to retrieve the time stamp of the current event before it
is committed.

Link: https://lkml.kernel.org/r/20210316164113.399089673@goodmis.org

Reviewed-by: Tom Zanussi <zanussi@kernel.org>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
2021-03-18 12:58:25 -04:00
Steven Rostedt (VMware)
e20044f7e9 ring-buffer: Separate out internal use of ring_buffer_event_time_stamp()
The exported use of ring_buffer_event_time_stamp() is going to become
different than how it is used internally. Move the internal logic out into a
static function called rb_event_time_stamp(), and have the internal callers
call that instead.

Link: https://lkml.kernel.org/r/20210316164113.257790481@goodmis.org

Reviewed-by: Tom Zanussi <zanussi@kernel.org>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
2021-03-18 12:58:25 -04:00
Steven Rostedt (VMware)
6549de1fe3 ring-buffer: Add a little more information and a WARN when time stamp going backwards is detected
When the CONFIG_RING_BUFFER_VALIDATE_TIME_DELTAS is enabled, and the time
stamps are detected as not being valid, it reports information about the
write stamp, but does not show the before_stamp which is still useful
information. Also, it should give a warning once, such that tests detect
this happening.

Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
2021-03-04 09:45:17 -05:00
Steven Rostedt (VMware)
6f6be606e7 ring-buffer: Force before_stamp and write_stamp to be different on discard
Part of the logic of the new time stamp code depends on the before_stamp and
the write_stamp to be different if the write_stamp does not match the last
event on the buffer, as it will be used to calculate the delta of the next
event written on the buffer.

The discard logic depends on this, as the next event to come in needs to
inject a full timestamp as it can not rely on the last event timestamp in
the buffer because it is unknown due to events after it being discarded. But
by changing the write_stamp back to the time before it, it forces the next
event to use a full time stamp, instead of relying on it.

The issue came when a full time stamp was used for the event, and
rb_time_delta() returns zero in that case. The update to the write_stamp
(which subtracts delta) made it not change. Then when the event is removed
from the buffer, because the before_stamp and write_stamp still match, the
next event written would calculate its delta from the write_stamp, but that
would be wrong as the write_stamp is of the time of the event that was
discarded.

In the case that the delta change being made to write_stamp is zero, set the
before_stamp to zero as well, and this will force the next event to inject a
full timestamp and not use the current write_stamp.

Cc: stable@vger.kernel.org
Fixes: a389d86f7f ("ring-buffer: Have nested events still record running time stamp")
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
2021-03-04 09:45:17 -05:00
Qiujun Huang
c6358bacdc ring-buffer: Drop unneeded check in ring_buffer_resize()
Remove the cpumask check, as we has done it at the beginning of
the function.
Also fix a typo. s/also the on the/also on the/

Link: https://lkml.kernel.org/r/20201224144634.3210-1-hqjagain@gmail.com

Signed-off-by: Qiujun Huang <hqjagain@gmail.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
2021-02-02 17:02:06 -05:00
Qiujun Huang
6689bed36c ring-buffer: Remove cpu_buffer argument from the rb_inc_page()
The cpu_buffer argument is not used inside the rb_inc_page() after
commit 3adc54fa82 ("ring-buffer: make the buffer a true circular link
list").
And cpu_buffer argument is not used inside the two functions too,
rb_is_head_page/rb_set_list_to_head.

Link: https://lkml.kernel.org/r/20201225140356.23008-1-hqjagain@gmail.com

Signed-off-by: Qiujun Huang <hqjagain@gmail.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
2021-02-02 17:02:06 -05:00
Linus Torvalds
09c0796adf Merge tag 'trace-v5.11' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace
Pull tracing updates from Steven Rostedt:
 "The major update to this release is that there's a new arch config
  option called CONFIG_HAVE_DYNAMIC_FTRACE_WITH_ARGS.

  Currently, only x86_64 enables it. All the ftrace callbacks now take a
  struct ftrace_regs instead of a struct pt_regs. If the architecture
  has HAVE_DYNAMIC_FTRACE_WITH_ARGS enabled, then the ftrace_regs will
  have enough information to read the arguments of the function being
  traced, as well as access to the stack pointer.

  This way, if a user (like live kernel patching) only cares about the
  arguments, then it can avoid using the heavier weight "regs" callback,
  that puts in enough information in the struct ftrace_regs to simulate
  a breakpoint exception (needed for kprobes).

  A new config option that audits the timestamps of the ftrace ring
  buffer at most every event recorded.

  Ftrace recursion protection has been cleaned up to move the protection
  to the callback itself (this saves on an extra function call for those
  callbacks).

  Perf now handles its own RCU protection and does not depend on ftrace
  to do it for it (saving on that extra function call).

  New debug option to add "recursed_functions" file to tracefs that
  lists all the places that triggered the recursion protection of the
  function tracer. This will show where things need to be fixed as
  recursion slows down the function tracer.

  The eval enum mapping updates done at boot up are now offloaded to a
  work queue, as it caused a noticeable pause on slow embedded boards.

  Various clean ups and last minute fixes"

* tag 'trace-v5.11' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: (33 commits)
  tracing: Offload eval map updates to a work queue
  Revert: "ring-buffer: Remove HAVE_64BIT_ALIGNED_ACCESS"
  ring-buffer: Add rb_check_bpage in __rb_allocate_pages
  ring-buffer: Fix two typos in comments
  tracing: Drop unneeded assignment in ring_buffer_resize()
  tracing: Disable ftrace selftests when any tracer is running
  seq_buf: Avoid type mismatch for seq_buf_init
  ring-buffer: Fix a typo in function description
  ring-buffer: Remove obsolete rb_event_is_commit()
  ring-buffer: Add test to validate the time stamp deltas
  ftrace/documentation: Fix RST C code blocks
  tracing: Clean up after filter logic rewriting
  tracing: Remove the useless value assignment in test_create_synth_event()
  livepatch: Use the default ftrace_ops instead of REGS when ARGS is available
  ftrace/x86: Allow for arguments to be passed in to ftrace_regs by default
  ftrace: Have the callbacks receive a struct ftrace_regs instead of pt_regs
  MAINTAINERS: assign ./fs/tracefs to TRACING
  tracing: Fix some typos in comments
  ftrace: Remove unused varible 'ret'
  ring-buffer: Add recording of ring buffer recursion into recursed_functions
  ...
2020-12-17 13:22:17 -08:00
Steven Rostedt (VMware)
adab66b71a Revert: "ring-buffer: Remove HAVE_64BIT_ALIGNED_ACCESS"
It was believed that metag was the only architecture that required the ring
buffer to keep 8 byte words aligned on 8 byte architectures, and with its
removal, it was assumed that the ring buffer code did not need to handle
this case. It appears that sparc64 also requires this.

The following was reported on a sparc64 boot up:

   kernel: futex hash table entries: 65536 (order: 9, 4194304 bytes, linear)
   kernel: Running postponed tracer tests:
   kernel: Testing tracer function:
   kernel: Kernel unaligned access at TPC[552a20] trace_function+0x40/0x140
   kernel: Kernel unaligned access at TPC[552a24] trace_function+0x44/0x140
   kernel: Kernel unaligned access at TPC[552a20] trace_function+0x40/0x140
   kernel: Kernel unaligned access at TPC[552a24] trace_function+0x44/0x140
   kernel: Kernel unaligned access at TPC[552a20] trace_function+0x40/0x140
   kernel: PASSED

Need to put back the 64BIT aligned code for the ring buffer.

Link: https://lore.kernel.org/r/CADxRZqzXQRYgKc=y-KV=S_yHL+Y8Ay2mh5ezeZUnpRvg+syWKw@mail.gmail.com

Cc: stable@vger.kernel.org
Fixes: 86b3de60a0 ("ring-buffer: Remove HAVE_64BIT_ALIGNED_ACCESS")
Reported-by: Anatoly Pugachev <matorola@gmail.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
2020-12-14 12:33:51 -05:00
Qiujun Huang
74e2afc6df ring-buffer: Add rb_check_bpage in __rb_allocate_pages
It may be better to check each page is aligned by 4 bytes. The 2
least significant bits of the address will be used as flags.

Link: https://lkml.kernel.org/r/20201015113842.2921-1-hqjagain@gmail.com

Signed-off-by: Qiujun Huang <hqjagain@gmail.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
2020-12-14 12:26:32 -05:00
Qiujun Huang
82db909e6b ring-buffer: Fix two typos in comments
s/inerrupting/interrupting/
s/beween/between/

Link: https://lkml.kernel.org/r/20201014152749.29986-1-hqjagain@gmail.com

Signed-off-by: Qiujun Huang <hqjagain@gmail.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
2020-12-14 12:21:27 -05:00
Lukas Bulwahn
3b3493531c tracing: Drop unneeded assignment in ring_buffer_resize()
Since commit 0a1754b2a9 ("ring-buffer: Return 0 on success from
ring_buffer_resize()"), computing the size is not needed anymore.

Drop unneeded assignment in ring_buffer_resize().

Link: https://lkml.kernel.org/r/20201214084503.3079-1-lukas.bulwahn@gmail.com

Signed-off-by: Lukas Bulwahn <lukas.bulwahn@gmail.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
2020-12-14 12:09:54 -05:00
Qiujun Huang
888834903d ring-buffer: Fix a typo in function description
s/ring_buffer_commit_discard/ring_buffer_discard_commit/

Link: https://lkml.kernel.org/r/20201112151800.14382-1-hqjagain@gmail.com

Signed-off-by: Qiujun Huang <hqjagain@gmail.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
2020-12-07 18:14:53 -05:00