7305 Commits

Author	SHA1	Message	Date
Greg Kroah-Hartman	7ae847d162	Merge 5.15.129 into android14-5.15-lts ... Changes in 5.15.129 objtool/x86: Fix SRSO mess NFSv4.2: fix error handling in nfs42_proc_getxattr NFSv4: fix out path in __nfs4_get_acl_uncached xprtrdma: Remap Receive buffers after a reconnect PCI: acpiphp: Reassign resources on bridge if necessary dlm: improve plock logging if interrupted dlm: replace usage of found with dedicated list iterator variable fs: dlm: add pid to debug log fs: dlm: change plock interrupted message to debug again fs: dlm: use dlm_plock_info for do_unlock_close fs: dlm: fix mismatch of plock results from userspace MIPS: cpu-features: Enable octeon_cache by cpu_type MIPS: cpu-features: Use boot_cpu_type for CPU type based features fbdev: Improve performance of sys_imageblit() fbdev: Fix sys_imageblit() for arbitrary image widths fbdev: fix potential OOB read in fast_imageblit() ALSA: pcm: Fix potential data race at PCM memory allocation helpers jbd2: remove t_checkpoint_io_list jbd2: remove journal_clean_one_cp_list() jbd2: fix a race when checking checkpoint buffer busy can: raw: fix receiver memory leak drm/amd/display: do not wait for mpc idle if tg is disabled drm/amd/display: check TG is non-null before checking if enabled can: raw: fix lockdep issue in raw_release() tracing: Fix cpu buffers unavailable due to 'record_disabled' missed tracing: Fix memleak due to race between current_tracer and trace octeontx2-af: SDP: fix receive link config sock: annotate data-races around prot->memory_pressure dccp: annotate data-races in dccp_poll() ipvlan: Fix a reference count leak warning in ipvlan_ns_exit() net: bgmac: Fix return value check for fixed_phy_register() net: bcmgenet: Fix return value check for fixed_phy_register() net: validate veth and vxcan peer ifindexes ice: fix receive buffer size miscalculation igb: Avoid starting unnecessary workqueues igc: Fix the typo in the PTM Control macro net/sched: fix a qdisc modification with ambiguous command request netfilter: nf_tables: flush pending destroy work before netlink notifier netfilter: nf_tables: fix out of memory error handling rtnetlink: return ENODEV when ifname does not exist and group is given rtnetlink: Reject negative ifindexes in RTM_NEWLINK net: remove bond_slave_has_mac_rcu() bonding: fix macvlan over alb bond support net/ncsi: make one oem_gma function for all mfr id net/ncsi: change from ndo_set_mac_address to dev_set_mac_address Revert "KVM: x86: enable TDP MMU by default" ibmveth: Use dcbf rather than dcbfl NFSv4: Fix dropped lock for racing OPEN and delegation return clk: Fix slab-out-of-bounds error in devm_clk_release() ALSA: ymfpci: Fix the missing snd_card_free() call at probe error mm: add a call to flush_cache_vmap() in vmap_pfn() NFS: Fix a use after free in nfs_direct_join_group() nfsd: Fix race to FREE_STATEID and cl_revoked selinux: set next pointer before attaching to list batman-adv: Trigger events for auto adjusted MTU batman-adv: Don't increase MTU when set by user batman-adv: Do not get eth header before batadv_check_management_packet batman-adv: Fix TT global entry leak when client roamed back batman-adv: Fix batadv_v_ogm_aggr_send memory leak batman-adv: Hold rtnl lock during MTU update via netlink lib/clz_ctz.c: Fix __clzdi2() and __ctzdi2() for 32-bit kernels radix tree: remove unused variable of: unittest: Fix EXPECT for parse_phandle_with_args_map() test of: dynamic: Refactor action prints to not use "%pOF" inside devtree_lock media: vcodec: Fix potential array out-of-bounds in encoder queue_setup PCI: acpiphp: Use pci_assign_unassigned_bridge_resources() only for non-root bus drm/vmwgfx: Fix shader stage validation drm/display/dp: Fix the DP DSC Receiver cap size x86/fpu: Invalidate FPU state correctly on exec() x86/fpu: Set X86_FEATURE_OSXSAVE feature after enabling OSXSAVE in CR4 nfs: use vfs setgid helper nfsd: use vfs setgid helper torture: Fix hang during kthread shutdown phase cgroup/cpuset: Rename functions dealing with DEADLINE accounting sched/cpuset: Bring back cpuset_mutex sched/cpuset: Keep track of SCHED_DEADLINE task in cpusets cgroup/cpuset: Iterate only if DEADLINE tasks are present sched/deadline: Create DL BW alloc, free & check overflow interface cgroup/cpuset: Free DL BW in case can_attach() fails drm/i915: Fix premature release of request's reusable memory can: raw: add missing refcount for memory leak fix scsi: snic: Fix double free in snic_tgt_create() scsi: core: raid_class: Remove raid_component_add() clk: Fix undefined reference to `clk_rate_exclusive_{get,put}' pinctrl: renesas: rza2: Add lock around pinctrl_generic{{add,remove}_group,{add,remove}_function} dma-buf/sw_sync: Avoid recursive lock during fence signal mm: memory-failure: kill soft_offline_free_page() mm: memory-failure: fix unexpected return value in soft_offline_page() mm,ima,kexec,of: use memblock_free_late from ima_free_kexec_buffer Linux 5.15.129 Change-Id: I196922313560df14873ab83e55b11961989f33de Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-09-01 20:11:57 +00:00
Arnd Bergmann	ce66cd4786	radix tree: remove unused variable ... commit d59070d107 upstream. Recent versions of clang warn about an unused variable, though older versions saw the 'slot++' as a use and did not warn: radix-tree.c:1136:50: error: parameter 'slot' set but not used [-Werror,-Wunused-but-set-parameter] It's clearly not needed any more, so just remove it. Link: https://lkml.kernel.org/r/20230811131023.2226509-1-arnd@kernel.org Fixes: 3a08cd52c3 ("radix tree: Remove multiorder support") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Cc: Matthew Wilcox <willy@infradead.org> Cc: Nathan Chancellor <nathan@kernel.org> Cc: Nick Desaulniers <ndesaulniers@google.com> Cc: Peng Zhang <zhangpeng.00@bytedance.com> Cc: Rong Tao <rongtao@cestc.cn> Cc: Tom Rix <trix@redhat.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-08-30 16:18:18 +02:00
Helge Deller	898c8c5b11	lib/clz_ctz.c: Fix __clzdi2() and __ctzdi2() for 32-bit kernels ... commit 382d4cd184 upstream. The gcc compiler translates on some architectures the 64-bit __builtin_clzll() function to a call to the libgcc function __clzdi2(), which should take a 64-bit parameter on 32- and 64-bit platforms. But in the current kernel code, the built-in __clzdi2() function is defined to operate (wrongly) on 32-bit parameters if BITS_PER_LONG == 32, thus the return values on 32-bit kernels are in the range from [0..31] instead of the expected [0..63] range. This patch fixes the in-kernel functions __clzdi2() and __ctzdi2() to take a 64-bit parameter on 32-bit kernels as well, thus it makes the functions identical for 32- and 64-bit kernels. This bug went unnoticed since kernel 3.11 for over 10 years, and here are some possible reasons for that: a) Some architectures have assembly instructions to count the bits and which are used instead of calling __clzdi2(), e.g. on x86 the bsr instruction and on ppc cntlz is used. On such architectures the wrong __clzdi2() implementation isn't used and as such the bug has no effect and won't be noticed. b) Some architectures link to libgcc.a, and the in-kernel weak functions get replaced by the correct 64-bit variants from libgcc.a. c) __builtin_clzll() and __clzdi2() doesn't seem to be used in many places in the kernel, and most likely only in uncritical functions, e.g. when printing hex values via seq_put_hex_ll(). The wrong return value will still print the correct number, but just in a wrong formatting (e.g. with too many leading zeroes). d) 32-bit kernels aren't used that much any longer, so they are less tested. A trivial testcase to verify if the currently running 32-bit kernel is affected by the bug is to look at the output of /proc/self/maps: Here the kernel uses a correct implementation of __clzdi2(): root@debian:~# cat /proc/self/maps 00010000-00019000 r-xp 00000000 08:05 787324 /usr/bin/cat 00019000-0001a000 rwxp 00009000 08:05 787324 /usr/bin/cat 0001a000-0003b000 rwxp 00000000 00:00 0 [heap] f7551000-f770d000 r-xp 00000000 08:05 794765 /usr/lib/hppa-linux-gnu/libc.so.6 ... and this kernel uses the broken implementation of __clzdi2(): root@debian:~# cat /proc/self/maps 0000000010000-0000000019000 r-xp 00000000 000000008:000000005 787324 /usr/bin/cat 0000000019000-000000001a000 rwxp 000000009000 000000008:000000005 787324 /usr/bin/cat 000000001a000-000000003b000 rwxp 00000000 00:00 0 [heap] 00000000f73d1000-00000000f758d000 r-xp 00000000 000000008:000000005 794765 /usr/lib/hppa-linux-gnu/libc.so.6 ... Signed-off-by: Helge Deller <deller@gmx.de> Fixes: 4df87bb7b6 ("lib: add weak clz/ctz functions") Cc: Chanho Min <chanho.min@lge.com> Cc: Geert Uytterhoeven <geert@linux-m68k.org> Cc: stable@vger.kernel.org # v3.11+ Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-08-30 16:18:18 +02:00
Greg Kroah-Hartman	9f5bde3ccf	Merge 5.15.121 into android14-5.15-lts ... Changes in 5.15.121 netfilter: nf_tables: drop map element references from preparation phase fs: pipe: reveal missing function protoypes x86/resctrl: Only show tasks' pid in current pid namespace blk-iocost: use spin_lock_irqsave in adjust_inuse_and_calc_cost md/raid10: check slab-out-of-bounds in md_bitmap_get_counter md/raid10: fix overflow of md/safe_mode_delay md/raid10: fix wrong setting of max_corr_read_errors md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request md/raid10: fix io loss while replacement replace rdev irqchip/jcore-aic: Fix missing allocation of IRQ descriptors svcrdma: Prevent page release when nothing was received posix-timers: Prevent RT livelock in itimer_delete() tracing/timer: Add missing hrtimer modes to decode_hrtimer_mode(). clocksource/drivers/cadence-ttc: Fix memory leak in ttc_timer_probe PM: domains: fix integer overflow issues in genpd_parse_state() perf/arm-cmn: Fix DTC reset powercap: RAPL: Fix CONFIG_IOSF_MBI dependency ARM: 9303/1: kprobes: avoid missing-declaration warnings cpufreq: intel_pstate: Fix energy_performance_preference for passive thermal/drivers/sun8i: Fix some error handling paths in sun8i_ths_probe() rcutorture: Correct name of use_softirq module parameter rcuscale: Always log error message rcuscale: Move shutdown from wait_event() to wait_event_idle() rcu/rcuscale: Move rcu_scale_*() after kfree_scale_cleanup() rcu/rcuscale: Stop kfree_scale_thread thread(s) after unloading rcuscale kselftest: vDSO: Fix accumulation of uninitialized ret when CLOCK_REALTIME is undefined perf/ibs: Fix interface via core pmu events x86/mm: Fix __swp_entry_to_pte() for Xen PV guests locking/atomic: arm: fix sync ops evm: Complete description of evm_inode_setattr() evm: Fix build warnings ima: Fix build warnings pstore/ram: Add check for kstrdup igc: Enable and fix RX hash usage by netstack wifi: ath9k: fix AR9003 mac hardware hang check register offset calculation wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx libbpf: btf_dump_type_data_check_overflow needs to consider BTF_MEMBER_BITFIELD_SIZE samples/bpf: Fix buffer overflow in tcp_basertt spi: spi-geni-qcom: Correct CS_TOGGLE bit in SPI_TRANS_CFG wifi: wilc1000: fix for absent RSN capabilities WFA testcase wifi: mwifiex: Fix the size of a memory allocation in mwifiex_ret_802_11_scan() sctp: add bpf_bypass_getsockopt proto callback libbpf: fix offsetof() and container_of() to work with CO-RE bpf: Don't EFAULT for {g,s}setsockopt with wrong optlen spi: dw: Round of n_bytes to power of 2 nfc: llcp: fix possible use of uninitialized variable in nfc_llcp_send_connect() bpftool: JIT limited misreported as negative value on aarch64 regulator: core: Fix more error checking for debugfs_create_dir() regulator: core: Streamline debugfs operations wifi: orinoco: Fix an error handling path in spectrum_cs_probe() wifi: orinoco: Fix an error handling path in orinoco_cs_probe() wifi: atmel: Fix an error handling path in atmel_probe() wl3501_cs: use eth_hw_addr_set() wifi: wl3501_cs: Fix an error handling path in wl3501_probe() wifi: ray_cs: Utilize strnlen() in parse_addr() wifi: ray_cs: Drop useless status variable in parse_addr() wifi: ray_cs: Fix an error handling path in ray_probe() wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes selftests/bpf: Fix check_mtu using wrong variable type wifi: rsi: Do not configure WoWlan in shutdown hook if not enabled wifi: rsi: Do not set MMC_PM_KEEP_POWER in shutdown watchdog/perf: define dummy watchdog_update_hrtimer_threshold() on correct config watchdog/perf: more properly prevent false positives with turbo modes kexec: fix a memory leak in crash_shrink_memory() memstick r592: make memstick_debug_get_tpc_name() static wifi: ath9k: Fix possible stall on ath9k_txq_list_has_key() rtnetlink: extend RTEXT_FILTER_SKIP_STATS to IFLA_VF_INFO wifi: iwlwifi: pull from TXQs with softirqs disabled iwlwifi: don't dump_stack() when we get an unexpected interrupt wifi: iwlwifi: pcie: fix NULL pointer dereference in iwl_pcie_irq_rx_msix_handler() wifi: cfg80211: rewrite merging of inherited elements wifi: iwlwifi: mvm: indicate HW decrypt for beacon protection wifi: ath9k: convert msecs to jiffies where needed bpf: Omit superfluous address family check in __bpf_skc_lookup bpf: Factor out socket lookup functions for the TC hookpoint. bpf: Call __bpf_sk_lookup()/__bpf_skc_lookup() directly via TC hookpoint bpf: Fix bpf socket lookup from tc/xdp to respect socket VRF bindings can: length: fix bitstuffing count igc: Fix race condition in PTP tx code net: stmmac: fix double serdes powerdown netlink: fix potential deadlock in netlink_set_err() netlink: do not hard code device address lenth in fdb dumps bonding: do not assume skb mac_header is set selftests: rtnetlink: remove netdevsim device after ipsec offload test gtp: Fix use-after-free in __gtp_encap_destroy(). net: axienet: Move reset before 64-bit DMA detection sfc: fix crash when reading stats while NIC is resetting nfc: llcp: simplify llcp_sock_connect() error paths net: nfc: Fix use-after-free caused by nfc_llcp_find_local lib/ts_bm: reset initial match offset for every block of text netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one netfilter: nf_conntrack_sip: fix the ct_sip_parse_numerical_param() return value. ipvlan: Fix return value of ipvlan_queue_xmit() netlink: Add __sock_i_ino() for __netlink_diag_dump(). drm/amd/display: Add logging for display MALL refresh setting radeon: avoid double free in ci_dpm_init() drm/amd/display: Explicitly specify update type per plane info change Input: drv260x - sleep between polling GO bit drm/bridge: tc358768: always enable HS video mode drm/bridge: tc358768: fix PLL parameters computation drm/bridge: tc358768: fix PLL target frequency drm/bridge: tc358768: fix TCLK_ZEROCNT computation drm/bridge: tc358768: Add atomic_get_input_bus_fmts() implementation drm/bridge: tc358768: fix TCLK_TRAILCNT computation drm/bridge: tc358768: fix THS_ZEROCNT computation drm/bridge: tc358768: fix TXTAGOCNT computation drm/bridge: tc358768: fix THS_TRAILCNT computation drm/vram-helper: fix function names in vram helper doc ARM: dts: BCM5301X: Drop "clock-names" from the SPI node ARM: dts: meson8b: correct uart_B and uart_C clock references Input: adxl34x - do not hardcode interrupt trigger type drm: sun4i_tcon: use devm_clk_get_enabled in `sun4i_tcon_init_clocks` drm/panel: sharp-ls043t1le01: adjust mode settings ARM: dts: stm32: Move ethernet MAC EEPROM from SoM to carrier boards bus: ti-sysc: Fix dispc quirk masking bool variables arm64: dts: microchip: sparx5: do not use PSCI on reference boards clk: imx: scu: use _safe list iterator to avoid a use after free RDMA/bnxt_re: Disable/kill tasklet only if it is enabled RDMA/bnxt_re: Fix to remove unnecessary return labels RDMA/bnxt_re: Use unique names while registering interrupts RDMA/bnxt_re: Remove a redundant check inside bnxt_re_update_gid RDMA/bnxt_re: Fix to remove an unnecessary log drm/msm/dsi: don't allow enabling 14nm VCO with unprogrammed rate drm/msm/disp/dpu: get timing engine status from intf status register drm/msm/dpu: Set DPU_DATA_HCTL_EN for in INTF_SC7180_MASK ARM: dts: gta04: Move model property out of pinctrl node arm64: dts: qcom: msm8916: correct camss unit address arm64: dts: qcom: msm8994: correct SPMI unit address arm64: dts: qcom: msm8996: correct camss unit address arm64: dts: qcom: sdm630: correct camss unit address arm64: dts: qcom: sdm845: correct camss unit address arm64: dts: qcom: db820c: Move blsp1_uart2 pin states to msm8996.dtsi arm64: dts: qcom: apq8016-sbc: Update modem and WiFi firmware path arm64: dts: qcom: apq8016-sbc: Clarify firmware-names arm64: dts: qcom: apq8016-sbc: fix mpps state names arm64: dts: qcom: Drop unneeded extra device-specific includes arm64: dts: qcom: apq8016-sbc: Fix regulator constraints arm64: dts: qcom: apq8016-sbc: Fix 1.8V power rail on LS expansion drm/panel: simple: fix active size for Ampire AM-480272H3TMQW-T01H ARM: ep93xx: fix missing-prototype warnings ARM: omap2: fix missing tick_broadcast() prototype arm64: dts: qcom: apq8096: fix fixed regulator name property arm64: dts: mediatek: mt8183: Add mediatek,broken-save-restore-fw to kukui ARM: dts: stm32: Shorten the AV96 HDMI sound card name memory: brcmstb_dpfe: fix testing array offset after use ASoC: es8316: Increment max value for ALC Capture Target Volume control ASoC: es8316: Do not set rate constraints for unsupported MCLKs ARM: dts: meson8: correct uart_B and uart_C clock references soc/fsl/qe: fix usb.c build errors RDMA/irdma: avoid fortify-string warning in irdma_clr_wqes IB/hfi1: Use bitmap_zalloc() when applicable IB/hfi1: Fix wrong mmu_node used for user SDMA packet after invalidate RDMA/hns: Fix hns_roce_table_get return value ARM: dts: iwg20d-q7-common: Fix backlight pwm specifier arm64: dts: renesas: ulcb-kf: Remove flow control for SCIF1 fbdev: omapfb: lcd_mipid: Fix an error handling path in mipid_spi_probe() arm64: dts: ti: k3-j7200: Fix physical address of pin ARM: dts: stm32: Fix audio routing on STM32MP15xx DHCOM PDK2 ARM: dts: stm32: fix i2s endpoint format property for stm32mp15xx-dkx hwmon: (gsc-hwmon) fix fan pwm temperature scaling hwmon: (adm1275) Allow setting sample averaging hwmon: (pmbus/adm1275) Fix problems with temperature monitoring on ADM1272 ARM: dts: BCM5301X: fix duplex-full => full-duplex drm/amdkfd: Fix potential deallocation of previously deallocated memory. drm/amd/display: Fix artifacting on eDP panels when engaging freesync video mode drm/radeon: fix possible division-by-zero errors amdgpu: validate offset_in_bo of drm_amdgpu_gem_va drm/msm/a5xx: really check for A510 in a5xx_gpu_init RDMA/bnxt_re: wraparound mbox producer index RDMA/bnxt_re: Avoid calling wake_up threads from spin_lock context clk: imx: clk-imx8mn: fix memory leak in imx8mn_clocks_probe clk: imx: clk-imx8mp: improve error handling in imx8mp_clocks_probe() arm64: dts: qcom: sm8250-edo: Panel framebuffer is 2.5k instead of 4k clk: clocking-wizard: Fix Oops in clk_wzrd_register_divider() clk: tegra: tegra124-emc: Fix potential memory leak ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer drm/msm/dpu: do not enable color-management if DSPPs are not available drm/msm/dp: Free resources after unregistering them arm64: dts: mediatek: Add cpufreq nodes for MT8192 arm64: dts: mediatek: mt8192: Fix CPUs capacity-dmips-mhz drm/msm/dpu: correct MERGE_3D length clk: vc5: check memory returned by kasprintf() clk: cdce925: check return value of kasprintf() clk: si5341: return error if one synth clock registration fails clk: si5341: check return value of {devm_}kasprintf() clk: si5341: free unused memory on probe failure clk: keystone: sci-clk: check return value of kasprintf() clk: ti: clkctrl: check return value of kasprintf() drivers: meson: secure-pwrc: always enable DMA domain ovl: update of dentry revalidate flags after copy up ASoC: imx-audmix: check return value of devm_kasprintf() clk: Fix memory leak in devm_clk_notifier_register() PCI: cadence: Fix Gen2 Link Retraining process PCI: vmd: Reset VMD config register between soft reboots scsi: qedf: Fix NULL dereference in error handling pinctrl: bcm2835: Handle gpiochip_add_pin_range() errors PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free scsi: 3w-xxxx: Add error handling for initialization failure in tw_probe() PCI: pciehp: Cancel bringup sequence if card is not present PCI: ftpci100: Release the clock resources PCI: Add pci_clear_master() stub for non-CONFIG_PCI perf bench: Use unbuffered output when pipe/tee'ing to a file perf bench: Add missing setlocale() call to allow usage of %'d style formatting pinctrl: cherryview: Return correct value if pin in push-pull mode kcsan: Don't expect 64 bits atomic builtins from 32 bits architectures powerpc/interrupt: Don't read MSR from interrupt_exit_kernel_prepare() powerpc/signal32: Force inlining of __unsafe_save_user_regs() and save_tm_user_regs_unsafe() perf script: Fix allocation of evsel->priv related to per-event dump files perf dwarf-aux: Fix off-by-one in die_get_varname() powerpc/64s: Fix VAS mm use after free pinctrl: microchip-sgpio: check return value of devm_kasprintf() pinctrl: at91-pio4: check return value of devm_kasprintf() powerpc/powernv/sriov: perform null check on iov before dereferencing iov powerpc: simplify ppc_save_regs powerpc: update ppc_save_regs to save current r1 in pt_regs riscv: uprobes: Restore thread.bad_cause powerpc/book3s64/mm: Fix DirectMap stats in /proc/meminfo powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary hwrng: virtio - add an internal buffer hwrng: virtio - don't wait on cleanup hwrng: virtio - don't waste entropy hwrng: virtio - always add a pending request hwrng: virtio - Fix race on data_avail and actual data modpost: remove broken calculation of exception_table_entry size crypto: nx - fix build warnings when DEBUG_FS is not enabled modpost: fix section mismatch message for R_ARM_ABS32 modpost: fix section mismatch message for R_ARM_{PC24,CALL,JUMP24} crypto: marvell/cesa - Fix type mismatch warning modpost: fix off by one in is_executable_section() ARC: define ASM_NL and __ALIGN(_STR) outside #ifdef __ASSEMBLY__ guard crypto: qat - honor CRYPTO_TFM_REQ_MAY_SLEEP flag crypto: qat - replace get_current_node() with numa_node_id() crypto: qat - use reference to structure in dma_map_single() crypto: kpp - Add helper to set reqsize crypto: qat - Use helper to set reqsize crypto: qat - unmap buffer before free for DH crypto: qat - unmap buffers before free for RSA NFSv4.1: freeze the session table upon receiving NFS4ERR_BADSESSION SMB3: Do not send lease break acknowledgment if all file handles have been closed dax: Fix dax_mapping_release() use after free dax: Introduce alloc_dev_dax_id() dax/kmem: Pass valid argument to memory_group_register_static hwrng: st - keep clock enabled while hwrng is registered kbuild: Disable GCOV for *.mod.o efi/libstub: Disable PCI DMA before grabbing the EFI memory map ksmbd: avoid field overflow warning ACPI: utils: Fix acpi_evaluate_dsm_typed() redefinition error bootmem: remove the vmemmap pages from kmemleak in free_bootmem_page io_uring: ensure IOPOLL locks around deferred work USB: serial: option: add LARA-R6 01B PIDs usb: dwc3: gadget: Propagate core init errors to UDC during pullup phy: tegra: xusb: Clear the driver reference in usb-phy dev iio: adc: ad7192: Fix null ad7192_state pointer access iio: adc: ad7192: Fix internal/external clock selection iio: accel: fxls8962af: errata bug only applicable for FXLS8962AF iio: accel: fxls8962af: fixup buffer scan element type ALSA: hda/realtek: Add quirk for Clevo NPx0SNx ALSA: jack: Fix mutex call in snd_jack_report() block: fix signed int overflow in Amiga partition support block: add overflow checks for Amiga partition support block: change all __u32 annotations to __be32 in affs_hardblocks.h block: increment diskseq on all media change events SUNRPC: Fix UAF in svc_tcp_listen_data_ready() w1: w1_therm: fix locking behavior in convert_t w1: fix loop in w1_fini() sh: j2: Use ioremap() to translate device tree address into kernel memory usb: dwc2: platform: Improve error reporting for problems during .remove() usb: dwc2: Fix some error handling paths serial: 8250: omap: Fix freeing of resources on failed register clk: qcom: camcc-sc7180: Add parent dependency to all camera GDSCs clk: qcom: gcc-ipq6018: Use floor ops for sdcc clocks media: usb: Check az6007_read() return value media: videodev2.h: Fix struct v4l2_input tuner index comment media: usb: siano: Fix warning due to null work_func_t function pointer media: i2c: Correct format propagation for st-mipid02 clk: qcom: reset: Allow specifying custom reset delay clk: qcom: reset: support resetting multiple bits clk: qcom: ipq6018: fix networking resets usb: dwc3: qcom: Fix potential memory leak usb: gadget: u_serial: Add null pointer check in gserial_suspend extcon: Fix kernel doc of property fields to avoid warnings extcon: Fix kernel doc of property capability fields to avoid warnings usb: phy: phy-tahvo: fix memory leak in tahvo_usb_probe() usb: hide unused usbfs_notify_suspend/resume functions serial: 8250: lock port for stop_rx() in omap8250_irq() serial: 8250: lock port for UART_IER access in omap8250_irq() kernfs: fix missing kernfs_idr_lock to remove an ID from the IDR coresight: Fix loss of connection info when a module is unloaded mfd: rt5033: Drop rt5033-battery sub-device media: venus: helpers: Fix ALIGN() of non power of two media: atomisp: gmin_platform: fix out_len in gmin_get_config_dsm_var() KVM: s390: fix KVM_S390_GET_CMMA_BITS for GFNs in memslot holes usb: dwc3: qcom: Release the correct resources in dwc3_qcom_remove() usb: dwc3: qcom: Fix an error handling path in dwc3_qcom_probe() usb: common: usb-conn-gpio: Set last role to unknown before initial detection usb: dwc3-meson-g12a: Fix an error handling path in dwc3_meson_g12a_probe() mfd: intel-lpss: Add missing check for platform_get_resource Revert "usb: common: usb-conn-gpio: Set last role to unknown before initial detection" serial: 8250_omap: Use force_suspend and resume for system suspend test_firmware: return ENOMEM instead of ENOSPC on failed memory allocation nvmem: rmem: Use NVMEM_DEVID_AUTO mfd: stmfx: Fix error path in stmfx_chip_init mfd: stmfx: Nullify stmfx->vdd in case of error KVM: s390: vsie: fix the length of APCB bitmap KVM: s390/diag: fix racy access of physical cpu number in diag 9c handler mfd: stmpe: Only disable the regulators if they are enabled phy: tegra: xusb: check return value of devm_kzalloc() pwm: imx-tpm: force 'real_period' to be zero in suspend pwm: sysfs: Do not apply state to already disabled PWMs pwm: ab8500: Fix error code in probe() pwm: mtk_disp: Fix the disable flow of disp_pwm md/raid10: fix the condition to call bio_end_io_acct() rtc: st-lpc: Release some resources in st_rtc_probe() in case of error drm/i915/psr: Use hw.adjusted mode when calculating io/fast wake times media: cec: i2c: ch7322: also select REGMAP sctp: fix potential deadlock on &net->sctp.addr_wq_lock net/sched: act_ipt: add sanity checks on table name and hook locations Add MODULE_FIRMWARE() for FIRMWARE_TG357766. ibmvnic: Do not reset dql stats on NON_FATAL err net: dsa: vsc73xx: fix MTU configuration spi: bcm-qspi: return error if neither hif_mspi nor mspi is available mailbox: ti-msgmgr: Fill non-message tx data fields with 0x0 f2fs: fix error path handling in truncate_dnode() octeontx2-af: Fix mapping for NIX block from CGX connection octeontx2-af: Add validation before accessing cgx and lmac ntfs: Fix panic about slab-out-of-bounds caused by ntfs_listxattr() powerpc: allow PPC_EARLY_DEBUG_CPM only when SERIAL_CPM=y net: bridge: keep ports without IFF_UNICAST_FLT in BR_PROMISC mode tcp: annotate data races in __tcp_oow_rate_limited() xsk: Honor SO_BINDTODEVICE on bind net/sched: act_pedit: Add size check for TCA_PEDIT_PARMS_EX riscv: move memblock_allow_resize() after linear mapping is ready pptp: Fix fib lookup calls. net: dsa: tag_sja1105: fix MAC DA patching from meta frames octeontx-af: fix hardware timestamp configuration s390/qeth: Fix vipa deletion sh: dma: Fix DMA channel offset calculation apparmor: fix missing error check for rhashtable_insert_fast i2c: xiic: Defer xiic_wakeup() and __xiic_start_xfer() in xiic_process() i2c: xiic: Don't try to handle more interrupt events after error extcon: usbc-tusb320: Convert to i2c's .probe_new() btrfs: do not BUG_ON() on tree mod log failure at balance_level() i2c: qup: Add missing unwind goto in qup_i2c_probe() NFSD: add encoding of op_recall flag for write delegation io_uring: wait interruptibly for request completions on exit mmc: core: disable TRIM on Kingston EMMC04G-M627 mmc: core: disable TRIM on Micron MTFC4GACAJCN-1M mmc: mmci: Set PROBE_PREFER_ASYNCHRONOUS mmc: sdhci: fix DMA configure compatibility issue when 64bit DMA mode is used. bcache: fixup btree_cache_wait list damage bcache: Remove unnecessary NULL point check in node allocations bcache: Fix __bch_btree_node_alloc to make the failure behavior consistent um: Use HOST_DIR for mrproper integrity: Fix possible multiple allocation in integrity_inode_get() autofs: use flexible array in ioctl structure shmem: use ramfs_kill_sb() for kill_sb method of ramfs-based tmpfs ext4: Remove ext4 locking of moved directory Revert "f2fs: fix potential corruption when moving a directory" fs: Establish locking order for unrelated directories fs: Lock moved directories ipvs: increase ip_vs_conn_tab_bits range for 64BIT jffs2: reduce stack usage in jffs2_build_xattr_subsystem() fs: avoid empty option when generating legacy mount string btrfs: add handling for RAID1C23/DUP to btrfs_reduce_alloc_profile btrfs: delete unused BGs while reclaiming BGs btrfs: bail out reclaim process if filesystem is read-only btrfs: reinsert BGs failed to reclaim btrfs: fix race when deleting quota root from the dirty cow roots list btrfs: fix extent buffer leak after tree mod log failure at split_node() btrfs: do not BUG_ON() on tree mod log failure at __btrfs_cow_block() ASoC: mediatek: mt8173: Fix irq error path ASoC: mediatek: mt8173: Fix snd_soc_component_initialize error path ARM: dts: qcom: ipq4019: fix broken NAND controller properties override ARM: orion5x: fix d2net gpio initialization leds: trigger: netdev: Recheck NETDEV_LED_MODE_LINKUP on dev rename fs: no need to check source ovl: fix null pointer dereference in ovl_get_acl_rcu() fanotify: disallow mount/sb marks on kernel internal pseudo fs netfilter: nf_tables: unbind non-anonymous set if rule construction fails netfilter: conntrack: Avoid nf_ct_helper_hash uses after free netfilter: nf_tables: do not ignore genmask when looking up chain by id netfilter: nf_tables: prevent OOB access in nft_byteorder_eval wireguard: queueing: use saner cpu selection wrapping wireguard: netlink: send staged packets when setting initial private key tty: serial: fsl_lpuart: add earlycon for imx8ulp platform block/partition: fix signedness issue for Amiga partitions io_uring: Use io_schedule* in cqring wait io_uring: add reschedule point to handle_tw_list() net: lan743x: Don't sleep in atomic context workqueue: clean up WORK_* constant types, clarify masking ksmbd: use ksmbd_req_buf_next() in ksmbd_smb2_check_message() ksmbd: validate command payload size ksmbd: fix out-of-bound read in smb2_write ksmbd: validate session id and tree id in the compound request drm/panel: simple: Add connector_type for innolux_at043tn24 drm/bridge: ti-sn65dsi86: Fix auxiliary bus lifetime drm/panel: simple: Add Powertip PH800480T013 drm_display_mode flags igc: Remove delay during TX ring configuration net/mlx5e: fix double free in mlx5e_destroy_flow_table net/mlx5e: fix memory leak in mlx5e_ptp_open net/mlx5e: Check for NOT_READY flag state after locking igc: set TP bit in 'supported' and 'advertising' fields of ethtool_link_ksettings igc: Handle PPS start time programming for past time values scsi: qla2xxx: Fix error code in qla2x00_start_sp() bpf: Fix max stack depth check for async callbacks net: mvneta: fix txq_map in case of txq_number==1 net/sched: cls_fw: Fix improper refcount update leads to use-after-free gve: Set default duplex configuration to full ionic: remove WARN_ON to prevent panic_on_warn net: bgmac: postpone turning IRQs off to avoid SoC hangs net: prevent skb corruption on frag list segmentation icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev(). udp6: fix udp6_ehashfn() typo ntb: idt: Fix error handling in idt_pci_driver_init() NTB: amd: Fix error handling in amd_ntb_pci_driver_init() ntb: intel: Fix error handling in intel_ntb_pci_driver_init() NTB: ntb_transport: fix possible memory leak while device_register() fails NTB: ntb_tool: Add check for devm_kcalloc ipv6/addrconf: fix a potential refcount underflow for idev platform/x86: wmi: remove unnecessary argument platform/x86: wmi: use guid_t and guid_equal() platform/x86: wmi: move variables platform/x86: wmi: Break possible infinite loop when parsing GUID kernel/trace: Fix cleanup logic of enable_trace_eprobe igc: Fix launchtime before start of cycle igc: Fix inserting of empty frame for launchtime bpf, riscv: Support riscv jit to provide bpf_line_info riscv, bpf: Fix inconsistent JIT image generation drm/i915: Fix one wrong caching mode enum usage octeontx2-pf: Add additional check for MCAM rules erofs: avoid infinite loop in z_erofs_do_read_page() when reading beyond EOF erofs: decouple basic mount options from fs_context erofs: fix fsdax unavailability for chunk-based regular files wifi: airo: avoid uninitialized warning in airo_get_rate() bpf: cpumap: Fix memory leak in cpu_map_update_elem net/sched: flower: Ensure both minimum and maximum ports are specified riscv: mm: fix truncation warning on RV32 netdevsim: fix uninitialized data in nsim_dev_trap_fa_cookie_write() net/sched: make psched_mtu() RTNL-less safe net/sched: sch_qfq: refactor parsing of netlink parameters net/sched: sch_qfq: account for stab overhead in qfq_enqueue nvme-pci: remove nvme_queue from nvme_iod nvme-pci: fix DMA direction of unmapping integrity data fs/ntfs3: Check fields while reading f2fs: fix to avoid NULL pointer dereference f2fs_write_end_io() pinctrl: amd: Fix mistake in handling clearing pins at startup pinctrl: amd: Detect internal GPIO0 debounce handling pinctrl: amd: Detect and mask spurious interrupts pinctrl: amd: Only use special debounce behavior for GPIO 0 tpm: tpm_vtpm_proxy: fix a race condition in /dev/vtpmx creation mtd: rawnand: meson: fix unaligned DMA buffers handling net: bcmgenet: Ensure MDIO unregistration has clocks enabled mm/damon/ops-common: atomically test and clear young on ptes and pmds powerpc: Fail build if using recordmcount with binutils v2.37 misc: fastrpc: Create fastrpc scalar with correct buffer count powerpc/security: Fix Speculation_Store_Bypass reporting on Power10 arm64: errata: Add detection for TRBE overwrite in FILL mode erofs: fix compact 4B support for 16k block size MIPS: Loongson: Fix cpu_probe_loongson() again MIPS: KVM: Fix NULL pointer dereference ext4: Fix reusing stale buffer heads from last failed mounting ext4: fix wrong unit use in ext4_mb_clear_bb ext4: get block from bh in ext4_free_blocks for fast commit replay ext4: fix wrong unit use in ext4_mb_new_blocks ext4: fix to check return value of freeze_bdev() in ext4_shutdown() ext4: turn quotas off if mount failed after enabling quotas ext4: only update i_reserved_data_blocks on successful block allocation jfs: jfs_dmap: Validate db_l2nbperpage while mounting hwrng: imx-rngc - fix the timeout for init and self check dm integrity: reduce vmalloc space footprint on 32-bit architectures PCI/PM: Avoid putting EloPOS E2/S2/H2 PCIe Ports in D3cold PCI: Add function 1 DMA alias quirk for Marvell 88SE9235 PCI: qcom: Disable write access to read only registers for IP v2.3.3 PCI: rockchip: Assert PCI Configuration Enable bit after probe PCI: rockchip: Write PCI Device ID to correct register PCI: rockchip: Add poll and timeout to wait for PHY PLLs to be locked PCI: rockchip: Fix legacy IRQ generation for RK3399 PCIe endpoint core PCI: rockchip: Use u32 variable to access 32-bit registers PCI: rockchip: Set address alignment for endpoint mode misc: pci_endpoint_test: Free IRQs before removing the device misc: pci_endpoint_test: Re-init completion for every test mfd: pm8008: Fix module autoloading md/raid0: add discard support for the 'original' layout dm init: add dm-mod.waitfor to wait for asynchronously probed block devices fs: dlm: return positive pid value for F_GETLK drm/atomic: Allow vblank-enabled + self-refresh "disable" drm/rockchip: vop: Leave vblank enabled in self-refresh drm/amdgpu: fix clearing mappings for BOs that are always valid in VM drm/amd/display: Correct `DMUB_FW_VERSION` macro drm/amdgpu: avoid restore process run into dead loop. drm/ttm: Don't leak a resource on swapout move error serial: atmel: don't enable IRQs prematurely tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() in case of error tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() when iterating clk tty: serial: imx: fix rs485 rx after tx firmware: stratix10-svc: Fix a potential resource leak in svc_create_memory_pool() libceph: harden msgr2.1 frame segment length checks ceph: don't let check_caps skip sending responses for revoke msgs xhci: Fix resume issue of some ZHAOXIN hosts xhci: Fix TRB prefetch issue of ZHAOXIN hosts xhci: Show ZHAOXIN xHCI root hub speed correctly meson saradc: fix clock divider mask length opp: Fix use-after-free in lazy_opp_tables after probe deferral soundwire: qcom: fix storing port config out-of-bounds Revert "8250: add support for ASIX devices with a FIFO bug" bus: ixp4xx: fix IXP4XX_EXP_T1_MASK s390/decompressor: fix misaligned symbol build error tracing/histograms: Add histograms to hist_vars if they have referenced variables tracing: Fix memory leak of iter->temp when reading trace_pipe samples: ftrace: Save required argument registers in sample trampolines net: ena: fix shift-out-of-bounds in exponential backoff ring-buffer: Fix deadloop issue on reading trace_pipe ftrace: Fix possible warning on checking all pages used in ftrace_process_locs() xtensa: ISS: fix call to split_if_spec tracing: Fix null pointer dereference in tracing_err_log_open() selftests: mptcp: sockopt: return error if wrong mark selftests: mptcp: depend on SYN_COOKIES tracing/probes: Fix not to count error code to total length tracing/probes: Fix to update dynamic data counter if fetcharg uses it scsi: qla2xxx: Wait for io return on terminate rport scsi: qla2xxx: Array index may go out of bound scsi: qla2xxx: Avoid fcport pointer dereference scsi: qla2xxx: Fix buffer overrun scsi: qla2xxx: Fix potential NULL pointer dereference scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport() scsi: qla2xxx: Correct the index of array scsi: qla2xxx: Pointer may be dereferenced scsi: qla2xxx: Remove unused nvme_ls_waitq wait queue MIPS: kvm: Fix build error with KVM_MIPS_DEBUG_COP0_COUNTERS enabled net/sched: sch_qfq: reintroduce lmax bound check for MTU drm/atomic: Fix potential use-after-free in nonblocking commits Linux 5.15.121 Note, this merges away commit e4e7f67cc1 ("arm64: errata: Add detection for TRBE overwrite in FILL mode") as it causes ABI issues. If that is to be needed for this branch, it can come back later in an ABI-safe way. It also merges away commit 7eeed3ed1a ("mm/damon/ops-common: atomically test and clear young on ptes and pmds") as it had too many merge conflicts. If that is needed in a future release it needs to be added as a proper BACKPORT. Change-Id: Ie91971a85cbb2672e9d2ef1d90814817697ca7b3 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-08-03 18:15:58 +00:00
Mirsad Goran Todorovac	e6bd54f497	test_firmware: return ENOMEM instead of ENOSPC on failed memory allocation ... [ Upstream commit 7dae593cd2 ] In a couple of situations like name = kstrndup(buf, count, GFP_KERNEL); if (!name) return -ENOSPC; the error is not actually "No space left on device", but "Out of memory". It is semantically correct to return -ENOMEM in all failed kstrndup() and kzalloc() cases in this driver, as it is not a problem with disk space, but with kernel memory allocator failing allocation. The semantically correct should be: name = kstrndup(buf, count, GFP_KERNEL); if (!name) return -ENOMEM; Cc: Dan Carpenter <error27@gmail.com> Cc: Takashi Iwai <tiwai@suse.de> Cc: Kees Cook <keescook@chromium.org> Cc: "Luis R. Rodriguez" <mcgrof@ruslug.rutgers.edu> Cc: Scott Branden <sbranden@broadcom.com> Cc: Hans de Goede <hdegoede@redhat.com> Cc: Brian Norris <briannorris@chromium.org> Fixes: c92316bf8e ("test_firmware: add batched firmware tests") Fixes: 0a8adf5847 ("test: add firmware_class loader test") Fixes: 548193cba2 ("test_firmware: add support for firmware_request_platform") Fixes: eb910947c8 ("test: firmware_class: add asynchronous request trigger") Fixes: 061132d2b9 ("test_firmware: add test custom fallback trigger") Fixes: 7feebfa487 ("test_firmware: add support for request_firmware_into_buf") Signed-off-by: Mirsad Goran Todorovac <mirsad.todorovac@alu.unizg.hr> Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org> Message-ID: <20230606070808.9300-1-mirsad.todorovac@alu.unizg.hr> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-07-23 13:47:25 +02:00
Jeremy Sowden	5848ad4250	lib/ts_bm: reset initial match offset for every block of text ... [ Upstream commit 6f67fbf819 ] The `shift` variable which indicates the offset in the string at which to start matching the pattern is initialized to `bm->patlen - 1`, but it is not reset when a new block is retrieved. This means the implemen- tation may start looking at later and later positions in each successive block and miss occurrences of the pattern at the beginning. E.g., consider a HTTP packet held in a non-linear skb, where the HTTP request line occurs in the second block: [... 52 bytes of packet headers ...] GET /bmtest HTTP/1.1\r\nHost: www.example.com\r\n\r\n and the pattern is "GET /bmtest". Once the first block comprising the packet headers has been examined, `shift` will be pointing to somewhere near the end of the block, and so when the second block is examined the request line at the beginning will be missed. Reinitialize the variable for each new block. Fixes: 8082e4ed0a ("[LIB]: Boyer-Moore extension for textsearch infrastructure strike #2") Link: https://bugzilla.netfilter.org/show_bug.cgi?id=1390 Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-07-23 13:46:56 +02:00
Greg Kroah-Hartman	87e8932c28	Merge 5.15.118 into android14-5.15-lts ... Changes in 5.15.118 test_firmware: Use kstrtobool() instead of strtobool() test_firmware: prevent race conditions by a correct implementation of locking test_firmware: fix a memory leak with reqs buffer ksmbd: fix slab-out-of-bounds read in smb2_handle_negotiate drm/amdgpu: fix Null pointer dereference error in amdgpu_device_recover_vram of: overlay: rename variables to be consistent of: overlay: rework overlay apply and remove kfree()s of: overlay: Fix missing of_node_put() in error case of init_overlay_changeset() power: supply: ab8500: Fix external_power_changed race power: supply: sc27xx: Fix external_power_changed race power: supply: bq27xxx: Use mod_delayed_work() instead of cancel() + schedule() ARM: dts: vexpress: add missing cache properties tools: gpio: fix debounce_period_us output of lsgpio power: supply: Ratelimit no data debug output platform/x86: asus-wmi: Ignore WMI events with codes 0x7B, 0xC0 regulator: Fix error checking for debugfs_create_dir irqchip/gic-v3: Disable pseudo NMIs on Mediatek devices w/ firmware issues power: supply: Fix logic checking if system is running from battery btrfs: scrub: try harder to mark RAID56 block groups read-only btrfs: handle memory allocation failure in btrfs_csum_one_bio ASoC: soc-pcm: test if a BE can be prepared parisc: Improve cache flushing for PCXL in arch_sync_dma_for_cpu() parisc: Flush gatt writes and adjust gatt mask in parisc_agp_mask_memory() MIPS: unhide PATA_PLATFORM MIPS: Alchemy: fix dbdma2 mips: Move initrd_start check after initrd address sanitisation. ASoC: dwc: move DMA init to snd_soc_dai_driver probe() xen/blkfront: Only check REQ_FUA for writes drm:amd:amdgpu: Fix missing buffer object unlock in failure path NVMe: Add MAXIO 1602 to bogus nid list. irqchip/gic: Correctly validate OF quirk descriptors io_uring: hold uring mutex around poll removal wifi: cfg80211: fix locking in regulatory disconnect wifi: cfg80211: fix double lock bug in reg_wdev_chan_valid() epoll: ep_autoremove_wake_function should use list_del_init_careful ocfs2: fix use-after-free when unmounting read-only filesystem ocfs2: check new file size on fallocate call nios2: dts: Fix tse_mac "max-frame-size" property nilfs2: fix incomplete buffer cleanup in nilfs_btnode_abort_change_key() nilfs2: fix possible out-of-bounds segment allocation in resize ioctl kexec: support purgatories with .text.hot sections x86/purgatory: remove PGO flags powerpc/purgatory: remove PGO flags ALSA: usb-audio: Add quirk flag for HEM devices to enable native DSD playback dm thin metadata: check fail_io before using data_sm nouveau: fix client work fence deletion race RDMA/uverbs: Restrict usage of privileged QKEYs net: usb: qmi_wwan: add support for Compal RXM-G1 drm/amd/display: edp do not add non-edid timings drm/amdgpu: add missing radeon secondary PCI ID ALSA: hda/realtek: Add a quirk for Compaq N14JP6 Remove DECnet support from kernel thunderbolt: dma_test: Use correct value for absent rings when creating paths thunderbolt: Mask ring interrupt on Intel hardware as well USB: serial: option: add Quectel EM061KGL series serial: lantiq: add missing interrupt ack usb: dwc3: gadget: Reset num TRBs before giving back the request RDMA/rtrs: Fix the last iu->buf leak in err path RDMA/rtrs: Fix rxe_dealloc_pd warning RDMA/rxe: Fix packet length checks spi: fsl-dspi: avoid SCK glitches with continuous transfers netfilter: nf_tables: integrate pipapo into commit protocol netfilter: nfnetlink: skip error delivery on batch in case of ENOMEM netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE net: enetc: correct the indexes of highest and 2nd highest TCs ping6: Fix send to link-local addresses with VRF. net/sched: simplify tcf_pedit_act net/sched: act_pedit: remove extra check for key type net/sched: act_pedit: Parse L3 Header for L4 offset net/sched: cls_u32: Fix reference counter leak leading to overflow RDMA/rxe: Remove the unused variable obj RDMA/rxe: Removed unused name from rxe_task struct RDMA/rxe: Fix the use-before-initialization error of resp_pkts iavf: remove mask from iavf_irq_enable_queues() octeontx2-af: fixed resource availability check octeontx2-af: fix lbk link credits on cn10k RDMA/mlx5: Initiate dropless RQ for RAW Ethernet functions RDMA/cma: Always set static rate to 0 for RoCE IB/uverbs: Fix to consider event queue closing also upon non-blocking mode IB/isert: Fix dead lock in ib_isert IB/isert: Fix possible list corruption in CMA handler IB/isert: Fix incorrect release of isert connection net: ethtool: correct MAX attribute value for stats ipvlan: fix bound dev checking for IPv6 l3s mode sctp: fix an error code in sctp_sf_eat_auth() igc: Clean the TX buffer and TX descriptor ring igb: fix nvm.ops.read() error handling drm/nouveau: don't detect DSM for non-NVIDIA device drm/nouveau/dp: check for NULL nv_connector->native_mode drm/nouveau: add nv_encoder pointer check for NULL cifs: fix lease break oops in xfstest generic/098 ext4: drop the call to ext4_error() from ext4_get_group_info() net/sched: cls_api: Fix lockup on flushing explicitly created chain net: lapbether: only support ethernet devices dm: don't lock fs when the map is NULL during suspend or resume net: tipc: resize nlattr array to correct size selftests/ptp: Fix timestamp printf format for PTP_SYS_OFFSET afs: Fix vlserver probe RTT handling cgroup: always put cset in cgroup_css_set_put_fork rcu/kvfree: Avoid freeing new kfree_rcu() memory after old grace period neighbour: Remove unused inline function neigh_key_eq16() net: Remove unused inline function dst_hold_and_use() net: Remove DECnet leftovers from flow.h. neighbour: delete neigh_lookup_nodev as not used of: overlay: add entry to of_overlay_action_name[] mmc: block: ensure error propagation for non-blk nilfs2: reject devices with insufficient block count Linux 5.15.118 Change-Id: I204c9793d0734c32f6ef9a739adc0691f98e8ae9 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-06-21 18:21:33 +00:00
Mirsad Goran Todorovac	de091a6e1f	test_firmware: fix a memory leak with reqs buffer ... [ Upstream commit be37bed754 ] Dan Carpenter spotted that test_fw_config->reqs will be leaked if trigger_batched_requests_store() is called two or more times. The same appears with trigger_batched_requests_async_store(). This bug wasn't trigger by the tests, but observed by Dan's visual inspection of the code. The recommended workaround was to return -EBUSY if test_fw_config->reqs is already allocated. Fixes: 7feebfa487 ("test_firmware: add support for request_firmware_into_buf") Cc: Luis Chamberlain <mcgrof@kernel.org> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Russ Weight <russell.h.weight@intel.com> Cc: Tianfei Zhang <tianfei.zhang@intel.com> Cc: Shuah Khan <shuah@kernel.org> Cc: Colin Ian King <colin.i.king@gmail.com> Cc: Randy Dunlap <rdunlap@infradead.org> Cc: linux-kselftest@vger.kernel.org Cc: stable@vger.kernel.org # v5.4 Suggested-by: Dan Carpenter <error27@gmail.com> Suggested-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Mirsad Goran Todorovac <mirsad.todorovac@alu.unizg.hr> Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org> Acked-by: Luis Chamberlain <mcgrof@kernel.org> Link: https://lore.kernel.org/r/20230509084746.48259-2-mirsad.todorovac@alu.unizg.hr Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-06-21 15:59:12 +02:00
Mirsad Goran Todorovac	bfb0b366e8	test_firmware: prevent race conditions by a correct implementation of locking ... [ Upstream commit 4acfe3dfde ] Dan Carpenter spotted a race condition in a couple of situations like these in the test_firmware driver: static int test_dev_config_update_u8(const char *buf, size_t size, u8 *cfg) { u8 val; int ret; ret = kstrtou8(buf, 10, &val); if (ret) return ret; mutex_lock(&test_fw_mutex); *(u8 *)cfg = val; mutex_unlock(&test_fw_mutex); /* Always return full write size even if we didn't consume all */ return size; } static ssize_t config_num_requests_store(struct device *dev, struct device_attribute *attr, const char *buf, size_t count) { int rc; mutex_lock(&test_fw_mutex); if (test_fw_config->reqs) { pr_err("Must call release_all_firmware prior to changing config\n"); rc = -EINVAL; mutex_unlock(&test_fw_mutex); goto out; } mutex_unlock(&test_fw_mutex); rc = test_dev_config_update_u8(buf, count, &test_fw_config->num_requests); out: return rc; } static ssize_t config_read_fw_idx_store(struct device *dev, struct device_attribute *attr, const char *buf, size_t count) { return test_dev_config_update_u8(buf, count, &test_fw_config->read_fw_idx); } The function test_dev_config_update_u8() is called from both the locked and the unlocked context, function config_num_requests_store() and config_read_fw_idx_store() which can both be called asynchronously as they are driver's methods, while test_dev_config_update_u8() and siblings change their argument pointed to by u8 *cfg or similar pointer. To avoid deadlock on test_fw_mutex, the lock is dropped before calling test_dev_config_update_u8() and re-acquired within test_dev_config_update_u8() itself, but alas this creates a race condition. Having two locks wouldn't assure a race-proof mutual exclusion. This situation is best avoided by the introduction of a new, unlocked function __test_dev_config_update_u8() which can be called from the locked context and reducing test_dev_config_update_u8() to: static int test_dev_config_update_u8(const char *buf, size_t size, u8 *cfg) { int ret; mutex_lock(&test_fw_mutex); ret = __test_dev_config_update_u8(buf, size, cfg); mutex_unlock(&test_fw_mutex); return ret; } doing the locking and calling the unlocked primitive, which enables both locked and unlocked versions without duplication of code. The similar approach was applied to all functions called from the locked and the unlocked context, which safely mitigates both deadlocks and race conditions in the driver. __test_dev_config_update_bool(), __test_dev_config_update_u8() and __test_dev_config_update_size_t() unlocked versions of the functions were introduced to be called from the locked contexts as a workaround without releasing the main driver's lock and thereof causing a race condition. The test_dev_config_update_bool(), test_dev_config_update_u8() and test_dev_config_update_size_t() locked versions of the functions are being called from driver methods without the unnecessary multiplying of the locking and unlocking code for each method, and complicating the code with saving of the return value across lock. Fixes: 7feebfa487 ("test_firmware: add support for request_firmware_into_buf") Cc: Luis Chamberlain <mcgrof@kernel.org> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Russ Weight <russell.h.weight@intel.com> Cc: Takashi Iwai <tiwai@suse.de> Cc: Tianfei Zhang <tianfei.zhang@intel.com> Cc: Shuah Khan <shuah@kernel.org> Cc: Colin Ian King <colin.i.king@gmail.com> Cc: Randy Dunlap <rdunlap@infradead.org> Cc: linux-kselftest@vger.kernel.org Cc: stable@vger.kernel.org # v5.4 Suggested-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Mirsad Goran Todorovac <mirsad.todorovac@alu.unizg.hr> Link: https://lore.kernel.org/r/20230509084746.48259-1-mirsad.todorovac@alu.unizg.hr Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-06-21 15:59:12 +02:00
Christophe JAILLET	4b5511aa0a	test_firmware: Use kstrtobool() instead of strtobool() ... [ Upstream commit f7d85515bd ] strtobool() is the same as kstrtobool(). However, the latter is more used within the kernel. In order to remove strtobool() and slightly simplify kstrtox.h, switch to the other function name. While at it, include the corresponding header file (<linux/kstrtox.h>) Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Acked-by: Luis Chamberlain <mcgrof@kernel.org> Link: https://lore.kernel.org/r/34f04735d20e0138695dd4070651bd860a36b81c.1673688120.git.christophe.jaillet@wanadoo.fr Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Stable-dep-of: 4acfe3dfde ("test_firmware: prevent race conditions by a correct implementation of locking") Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-06-21 15:59:11 +02:00
Greg Kroah-Hartman	403dbb90c2	Merge 5.15.117 into android14-5.15-lts ... Changes in 5.15.117 ata: ahci: fix enum constants for gcc-13 gcc-plugins: Reorganize gimple includes for GCC 13 remove the sx8 block driver sfc (gcc13): synchronize ef100_enqueue_skb()'s return type i40e: Remove string printing for i40e_status i40e: use int for i40e_status i40e: fix build warning in ice_fltr_add_mac_to_list() bonding (gcc13): synchronize bond_{a,t}lb_xmit() types f2fs: fix iostat lock protection blk-iocost: avoid 64-bit division in ioc_timer_fn platform/surface: aggregator: Allow completion work-items to be executed in parallel spi: qup: Request DMA before enabling clocks afs: Fix setting of mtime when creating a file/dir/symlink wifi: mt76: mt7615: fix possible race in mt7615_mac_sta_poll neighbour: fix unaligned access to pneigh_entry net: dsa: lan9303: allow vid != 0 in port_fdb_{add|del} methods bpf: Fix UAF in task local storage net/ipv6: fix bool/int mismatch for skip_notify_on_dev_down net/smc: Avoid to access invalid RMBs' MRs in SMCRv1 ADD LINK CONT net: enetc: correct the statistics of rx bytes net/sched: fq_pie: ensure reasonable TCA_FQ_PIE_QUANTUM values drm/i915: Explain the magic numbers for AUX SYNC/precharge length drm/i915: Use 18 fast wake AUX sync len Bluetooth: Fix l2cap_disconnect_req deadlock Bluetooth: L2CAP: Add missing checks for invalid DCID qed/qede: Fix scheduling while atomic wifi: cfg80211: fix locking in sched scan stop work selftests/bpf: Verify optval=NULL case selftests/bpf: Fix sockopt_sk selftest netfilter: conntrack: fix NULL pointer dereference in nf_confirm_cthelper netfilter: ipset: Add schedule point in call_ad(). ipv6: rpl: Fix Route of Death. rfs: annotate lockless accesses to sk->sk_rxhash rfs: annotate lockless accesses to RFS sock flow table drm/i915/selftests: Increase timeout for live_parallel_switch drm/i915/selftests: Stop using kthread_stop() drm/i915/selftests: Add some missing error propagation net: sched: move rtm_tca_policy declaration to include file net: sched: act_police: fix sparse errors in tcf_police_dump() net: sched: fix possible refcount leak in tc_chain_tmplt_add() bpf: Add extra path pointer check to d_path helper lib: cpu_rmap: Fix potential use-after-free in irq_cpu_rmap_release() bnxt_en: Don't issue AP reset during ethtool's reset operation bnxt_en: Query default VLAN before VNIC setup on a VF bnxt_en: Implement .set_port / .unset_port UDP tunnel callbacks batman-adv: Broken sync while rescheduling delayed work Input: xpad - delete a Razer DeathAdder mouse VID/PID entry Input: psmouse - fix OOB access in Elantech protocol Input: fix open count when closing inhibited device ALSA: hda/realtek: Add quirk for Clevo NS50AU ALSA: hda/realtek: Add a quirk for HP Slim Desktop S01 ALSA: hda/realtek: Add Lenovo P3 Tower platform drm/i915/gt: Use the correct error value when kernel_context() fails drm/amd/pm: conditionally disable pcie lane switching for some sienna_cichlid SKUs drm/amdgpu: fix xclk freq on CHIP_STONEY drm/amd/pm: Fix power context allocation in SMU13 can: j1939: j1939_sk_send_loop_abort(): improved error queue handling in J1939 Socket can: j1939: change j1939_netdev_lock type to mutex can: j1939: avoid possible use-after-free when j1939_can_rx_register fails ceph: fix use-after-free bug for inodes when flushing capsnaps s390/dasd: Use correct lock while counting channel queue length Bluetooth: Fix use-after-free in hci_remove_ltk/hci_remove_irk Bluetooth: hci_qca: fix debugfs registration tee: amdtee: Add return_origin to 'struct tee_cmd_load_ta' rbd: move RBD_OBJ_FLAG_COPYUP_ENABLED flag setting rbd: get snapshot context after exclusive lock is ensured to be held pinctrl: meson-axg: add missing GPIOA_18 gpio group usb: usbfs: Enforce page requirements for mmap usb: usbfs: Use consistent mmap functions ARM: dts: at91: sama7g5ek: fix debounce delay property for shdwc ASoC: codecs: wsa881x: do not set can_multi_write flag arm64: dts: qcom: sc7180-lite: Fix SDRAM freq for misidentified sc7180-lite boards arm64: dts: imx8qm-mek: correct GPIOs for USDHC2 CD and WP signals arm64: dts: imx8-ss-dma: assign default clock rate for lpuarts ASoC: mediatek: mt8195-afe-pcm: Convert to platform remove callback returning void ASoC: mediatek: mt8195: fix use-after-free in driver remove path arm64: dts: imx8mn-beacon: Fix SPI CS pinmux i2c: mv64xxx: Fix reading invalid status value in atomic mode firmware: arm_ffa: Set handle field to zero in memory descriptor i2c: sprd: Delete i2c adapter in .remove's error path eeprom: at24: also select REGMAP riscv: fix kprobe __user string arg print fault issue vduse: avoid empty string for dev name vhost: support PACKED when setting-getting vring_base vhost_vdpa: support PACKED when setting-getting vring_base Revert "ext4: don't clear SB_RDONLY when remounting r/w until quota is re-enabled" ext4: only check dquot_initialize_needed() when debugging Revert "debugobject: Ensure pool refill (again)" xfs: verify buffer contents when we skip log replay Revert "staging: rtl8192e: Replace macro RTL_PCI_DEVICE with PCI_DEVICE" Linux 5.15.117 Change-Id: Id16f2f6c857fc2d8e3b990d71f475d69a47ed1b6 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-06-15 15:16:34 +00:00
Greg Kroah-Hartman	8340dc3122	Merge 5.15.116 into android14-5.15-lts ... Changes in 5.15.116 RDMA/bnxt_re: Fix the page_size used during the MR creation RDMA/efa: Fix unsupported page sizes in device RDMA/hns: Fix base address table allocation RDMA/hns: Modify the value of long message loopback slice dmaengine: at_xdmac: Move the free desc to the tail of the desc list dmaengine: at_xdmac: fix potential Oops in at_xdmac_prep_interleaved() RDMA/bnxt_re: Fix a possible memory leak RDMA/bnxt_re: Fix return value of bnxt_re_process_raw_qp_pkt_rx iommu/rockchip: Fix unwind goto issue iommu/amd: Don't block updates to GATag if guest mode is on dmaengine: pl330: rename _start to prevent build error riscv: Fix unused variable warning when BUILTIN_DTB is set net/mlx5: fw_tracer, Fix event handling net/mlx5e: Don't attach netdev profile while handling internal error net: mellanox: mlxbf_gige: Fix skb_panic splat under memory pressure netrom: fix info-leak in nr_write_internal() af_packet: Fix data-races of pkt_sk(sk)->num. amd-xgbe: fix the false linkup in xgbe_phy_status mtd: rawnand: ingenic: fix empty stub helper definitions RDMA/irdma: Add SW mechanism to generate completions on error RDMA/irdma: Prevent QP use after free RDMA/irdma: Fix Local Invalidate fencing af_packet: do not use READ_ONCE() in packet_bind() tcp: deny tcp_disconnect() when threads are waiting tcp: Return user_mss for TCP_MAXSEG in CLOSE/LISTEN state if user_mss set net/sched: sch_ingress: Only create under TC_H_INGRESS net/sched: sch_clsact: Only create under TC_H_CLSACT net/sched: Reserve TC_H_INGRESS (TC_H_CLSACT) for ingress (clsact) Qdiscs net/sched: Prohibit regrafting ingress or clsact Qdiscs net: sched: fix NULL pointer dereference in mq_attach net/netlink: fix NETLINK_LIST_MEMBERSHIPS length report udp6: Fix race condition in udp6_sendmsg & connect net/mlx5e: Fix error handling in mlx5e_refresh_tirs net/mlx5: Read embedded cpu after init bit cleared net/sched: flower: fix possible OOB write in fl_set_geneve_opt() net: dsa: mv88e6xxx: Increase wait after reset deactivation mtd: rawnand: marvell: ensure timing values are written mtd: rawnand: marvell: don't set the NAND frequency select rtnetlink: call validate_linkmsg in rtnl_create_link drm/amdgpu: release gpu full access after "amdgpu_device_ip_late_init" watchdog: menz069_wdt: fix watchdog initialisation ALSA: hda: Glenfly: add HD Audio PCI IDs and HDMI Codec Vendor IDs. drm/amdgpu: Use the default reset when loading or reloading the driver mailbox: mailbox-test: Fix potential double-free in mbox_test_message_write() drm/ast: Fix ARM compatibility btrfs: abort transaction when sibling keys check fails for leaves ARM: 9295/1: unwind:fix unwind abort for uleb128 case media: rcar-vin: Select correct interrupt mode for V4L2_FIELD_ALTERNATE platform/x86: intel_scu_pcidrv: Add back PCI ID for Medfield gfs2: Don't deref jdesc in evict fbdev: imsttfb: Fix use after free bug in imsttfb_probe fbdev: modedb: Add 1920x1080 at 60 Hz video mode fbdev: stifb: Fix info entry in sti_struct on error path nbd: Fix debugfs_create_dir error checking block/rnbd: replace REQ_OP_FLUSH with REQ_OP_WRITE nvme-pci: add NVME_QUIRK_BOGUS_NID for HS-SSD-FUTURE 2048G nvme-pci: add quirk for missing secondary temperature thresholds ASoC: dwc: limit the number of overrun messages um: harddog: fix modular build xfrm: Check if_id in inbound policy/secpath match ASoC: dt-bindings: Adjust #sound-dai-cells on TI's single-DAI codecs ASoC: ssm2602: Add workaround for playback distortions media: dvb_demux: fix a bug for the continuity counter media: dvb-usb: az6027: fix three null-ptr-deref in az6027_i2c_xfer() media: dvb-usb-v2: ec168: fix null-ptr-deref in ec168_i2c_xfer() media: dvb-usb-v2: ce6230: fix null-ptr-deref in ce6230_i2c_master_xfer() media: dvb-usb-v2: rtl28xxu: fix null-ptr-deref in rtl28xxu_i2c_xfer media: dvb-usb: digitv: fix null-ptr-deref in digitv_i2c_xfer() media: dvb-usb: dw2102: fix uninit-value in su3000_read_mac_address media: netup_unidvb: fix irq init by register it at the end of probe media: dvb_ca_en50221: fix a size write bug media: ttusb-dec: fix memory leak in ttusb_dec_exit_dvb() media: mn88443x: fix !CONFIG_OF error by drop of_match_ptr from ID table media: dvb-core: Fix use-after-free due on race condition at dvb_net media: dvb-core: Fix use-after-free due to race at dvb_register_device() media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*() media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221 s390/pkey: zeroize key blobs s390/topology: honour nr_cpu_ids when adding CPUs ACPI: resource: Add IRQ override quirk for LG UltraPC 17U70P wifi: rtl8xxxu: fix authentication timeout due to incorrect RCR value ARM: dts: stm32: add pin map for CAN controller on stm32f7 arm64/mm: mark private VM_FAULT_X defines as vm_fault_t arm64: vdso: Pass (void *) to virt_to_page() wifi: mac80211: simplify chanctx allocation scsi: core: Decrease scsi_device's iorequest_cnt if dispatch failed wifi: b43: fix incorrect __packed annotation netfilter: conntrack: define variables exp_nat_nla_policy and any_addr with CONFIG_NF_NAT nvme-multipath: don't call blk_mark_disk_dead in nvme_mpath_remove_disk ALSA: oss: avoid missing-prototype warnings drm/msm: Be more shouty if per-process pgtables aren't working atm: hide unused procfs functions drm/amdgpu: skip disabling fence driver src_irqs when device is unplugged nvme-pci: Add quirk for Teamgroup MP33 SSD mailbox: mailbox-test: fix a locking issue in mbox_test_message_write() media: uvcvideo: Don't expose unsupported formats to userspace iio: accel: st_accel: Fix invalid mount_matrix on devices without ACPI _ONT method iio: adc: mxs-lradc: fix the order of two cleanup operations HID: google: add jewel USB id HID: wacom: avoid integer overflow in wacom_intuos_inout() iio: imu: inv_icm42600: fix timestamp reset dt-bindings: iio: adc: renesas,rcar-gyroadc: Fix adi,ad7476 compatible value iio: light: vcnl4035: fixed chip ID check iio: adc: ad_sigma_delta: Fix IRQ issue by setting IRQ_DISABLE_UNLAZY flag iio: dac: mcp4725: Fix i2c_master_send() return value handling iio: adc: ad7192: Change "shorted" channels to differential iio: dac: build ad5758 driver when AD5758 is selected net: usb: qmi_wwan: Set DTR quirk for BroadMobi BM818 dt-bindings: usb: snps,dwc3: Fix "snps,hsphy_interface" type usb: gadget: f_fs: Add unbind event before functionfs_unbind md/raid5: fix miscalculation of 'end_sector' in raid5_read_one_chunk() misc: fastrpc: return -EPIPE to invocations on device removal misc: fastrpc: reject new invocations during device removal scsi: stex: Fix gcc 13 warnings ata: libata-scsi: Use correct device no in ata_find_dev() drm/amd/pm: reverse mclk and fclk clocks levels for vangogh drm/amd/pm: reverse mclk and fclk clocks levels for yellow carp drm/amd/pm: reverse mclk and fclk clocks levels for renoir x86/boot: Wrap literal addresses in absolute_pointer() ath6kl: Use struct_group() to avoid size-mismatched casting block/blk-iocost (gcc13): keep large values in a new enum mmc: vub300: fix invalid response handling mmc: pwrseq: sd8787: Fix WILC CHIP_EN and RESETN toggling order tty: serial: fsl_lpuart: use UARTCTRL_TXINV to send break instead of UARTCTRL_SBK btrfs: fix csum_tree_block page iteration to avoid tripping on -Werror=array-bounds powerpc/iommu: Limit number of TCEs to 512 for H_STUFF_TCE hcall iommu/amd: Fix domain flush size when syncing iotlb usb: cdns3: allocate TX FIFO size according to composite EP number usb: cdns3: fix NCM gadget RX speed 20x slow than expection at iMX8QM block: fix revalidate performance regression selinux: don't use make's grouped targets feature yet tracing/probe: trace_probe_primary_from_call(): checked list_first_entry selftests: mptcp: connect: skip if MPTCP is not supported selftests: mptcp: pm nl: skip if MPTCP is not supported selftests: mptcp: sockopt: skip if MPTCP is not supported ext4: add EA_INODE checking to ext4_iget() ext4: set lockdep subclass for the ea_inode in ext4_xattr_inode_cache_find() ext4: disallow ea_inodes with extended attributes ext4: add lockdep annotations for i_data_sem for ea_inode's fbcon: Fix null-ptr-deref in soft_cursor serial: 8250_tegra: Fix an error handling path in tegra_uart_probe() test_firmware: fix the memory leak of the allocated firmware buffer KVM: x86: Account fastpath-only VM-Exits in vCPU stats ksmbd: fix credit count leakage ksmbd: fix incorrect AllocationSize set in smb2_get_info KEYS: asymmetric: Copy sig and digest in public_key_verify_signature() regmap: Account for register length when chunking tpm, tpm_tis: Request threaded interrupt handler drm/rcar: stop using 'imply' for dependencies scsi: dpt_i2o: Remove broken pass-through ioctl (I2OUSERCMD) scsi: dpt_i2o: Do not process completions with invalid addresses drm/amdgpu/gfx10: Disable gfxoff before disabling powergating. selftests: mptcp: diag: skip if MPTCP is not supported selftests: mptcp: simult flows: skip if MPTCP is not supported selftests: mptcp: join: skip if MPTCP is not supported ext4: enable the lazy init thread when remounting read/write ARM: defconfig: drop CONFIG_DRM_RCAR_LVDS RDMA/irdma: Fix drain SQ hang with no completion RDMA/irdma: Do not generate SW completions for NOPs Linux 5.15.116 Change-Id: I9c1fcca4400982e913153ad26f22826434c3c4d8 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-06-15 12:41:38 +00:00
Greg Kroah-Hartman	dc7c06dba7	Merge 5.15.114 into android14-5.15-lts ... Changes in 5.15.114 usb: gadget: Properly configure the device for remote wakeup usb: dwc3: fix gadget mode suspend interrupt handler issue dt-bindings: ata: ahci-ceva: convert to yaml dt-bindings: ata: ahci-ceva: Cover all 4 iommus entries watchdog: sp5100_tco: Immediately trigger upon starting. ARM: dts: stm32: fix AV96 board SAI2 pin muxing on stm32mp15 spi: fsl-spi: Re-organise transfer bits_per_word adaptation spi: fsl-cpm: Use 16 bit mode for large transfers with even size ocfs2: Switch to security_inode_init_security() arm64: Also reset KASAN tag if page is not PG_mte_tagged ALSA: hda/ca0132: add quirk for EVGA X299 DARK ALSA: hda: Fix unhandled register update during auto-suspend period ALSA: hda/realtek: Enable headset onLenovo M70/M90 mmc: sdhci-esdhc-imx: make "no-mmc-hs400" works ASoC: rt5682: Disable jack detection interrupt during suspend net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize m68k: Move signal frame following exception on 68020/030 parisc: Handle kgdb breakpoints only in kernel context parisc: Allow to reboot machine after system halt gpio: mockup: Fix mode of debugfs files btrfs: use nofs when cleaning up aborted transactions dt-binding: cdns,usb3: Fix cdns,on-chip-buff-size type x86/mm: Avoid incomplete Global INVLPG flushes selftests/memfd: Fix unknown type name build failure parisc: Fix flush_dcache_page() for usage from irq context perf/x86/uncore: Correct the number of CHAs on SPR x86/topology: Fix erroneous smp_num_siblings on Intel Hybrid platforms debugobjects: Don't wake up kswapd from fill_pool() fbdev: udlfb: Fix endpoint check net: fix stack overflow when LRO is disabled for virtual interfaces udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated(). USB: core: Add routines for endpoint checks in old drivers USB: sisusbvga: Add endpoint checks media: radio-shark: Add endpoint checks ASoC: lpass: Fix for KASAN use_after_free out of bounds net: fix skb leak in __skb_tstamp_tx() selftests: fib_tests: mute cleanup error message octeontx2-pf: Fix TSOv6 offload bpf: Fix mask generation for 32-bit narrow loads of 64-bit fields ipv6: Fix out-of-bounds access in ipv6_find_tlv() cifs: mapchars mount option ignored power: supply: leds: Fix blink to LED on transition power: supply: mt6360: add a check of devm_work_autocancel in mt6360_charger_probe power: supply: bq27xxx: Fix bq27xxx_battery_update() race condition power: supply: bq27xxx: Fix I2C IRQ race on remove power: supply: bq27xxx: Fix poll_interval handling and races on remove power: supply: bq27xxx: Add cache parameter to bq27xxx_battery_current_and_status() power: supply: sbs-charger: Fix INHIBITED bit for Status reg firmware: arm_ffa: Check if ffa_driver remove is present before executing firmware: arm_ffa: Fix FFA device names for logical partitions fs: fix undefined behavior in bit shift for SB_NOUSER regulator: pca9450: Fix BUCK2 enable_mask coresight: Fix signedness bug in tmc_etr_buf_insert_barrier_packet() xen/pvcalls-back: fix double frees with pvcalls_new_active_socket() x86/show_trace_log_lvl: Ensure stack pointer is aligned, again ASoC: Intel: Skylake: Fix declaration of enum skl_ch_cfg sctp: fix an issue that plpmtu can never go to complete state forcedeth: Fix an error handling path in nv_probe() platform/mellanox: mlxbf-pmc: fix sscanf() error checking net/mlx5e: do as little as possible in napi poll when budget is 0 net/mlx5: DR, Fix crc32 calculation to work on big-endian (BE) CPUs net/mlx5: DR, Check force-loopback RC QP capability independently from RoCE net/mlx5: Fix error message when failing to allocate device memory net/mlx5: Devcom, fix error flow in mlx5_devcom_register_device arm64: dts: imx8mn-var-som: fix PHY detection bug by adding deassert delay firmware: arm_ffa: Set reserved/MBZ fields to zero in the memory descriptors regulator: mt6359: add read check for PMIC MT6359 3c589_cs: Fix an error handling path in tc589_probe() net: phy: mscc: add VSC8502 to MODULE_DEVICE_TABLE Linux 5.15.114 Change-Id: Id1e4400f1ebeb6b72fb01fb1093dc807d8a9acc3 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-06-14 12:26:35 +00:00
Greg Kroah-Hartman	b5a52009d9	Revert "debugobject: Ensure pool refill (again)" ... This reverts commit 503e554782 which is commit 0af462f19e upstream. Guenter reports problems with it, and it's not quite obvious why, so revert it for now. Reported-by: Guenter Roeck <linux@roeck-us.net> Link: https://lore.kernel.org/r/d35b1ff1-e198-481c-b1be-9e22445efe06@roeck-us.net Cc: Ido Schimmel <idosch@nvidia.com> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-06-14 11:13:09 +02:00
Ben Hutchings	40d074f7e4	lib: cpu_rmap: Fix potential use-after-free in irq_cpu_rmap_release() ... [ Upstream commit 7c5d4801ec ] irq_cpu_rmap_release() calls cpu_rmap_put(), which may free the rmap. So we need to clear the pointer to our glue structure in rmap before doing that, not after. Fixes: 4e0473f106 ("lib: cpu_rmap: Avoid use after free on rmap->obj array entries") Signed-off-by: Ben Hutchings <ben@decadent.org.uk> Reviewed-by: Simon Horman <simon.horman@corigine.com> Link: https://lore.kernel.org/r/ZHo0vwquhOy3FaXc@decadent.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-06-14 11:13:04 +02:00
Greg Kroah-Hartman	f373d7e7f5	Merge 5.15.113 into android14-5.15-lts ... Changes in 5.15.113 drm/mipi-dsi: Set the fwnode for mipi_dsi_device ARM: 9296/1: HP Jornada 7XX: fix kernel-doc warnings net: mdio: mvusb: Fix an error handling path in mvusb_mdio_probe() scsi: ufs: core: Fix I/O hang that occurs when BKOPS fails in W-LUN suspend tick/broadcast: Make broadcast device replacement work correctly linux/dim: Do nothing if no time delta between samples net: stmmac: switch to use interrupt for hw crosstimestamping net: stmmac: Initialize MAC_ONEUS_TIC_COUNTER register net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs(). netfilter: nf_tables: always release netdev hooks from notifier netfilter: conntrack: fix possible bug_on with enable_hooks=1 netlink: annotate accesses to nlk->cb_running net: annotate sk->sk_err write from do_recvmmsg() net: deal with most data-races in sk_wait_event() net: add vlan_get_protocol_and_depth() helper tcp: add annotations around sk->sk_shutdown accesses gve: Remove the code of clearing PBA bit ipvlan:Fix out-of-bounds caused by unclear skb->cb net: datagram: fix data-races in datagram_poll() af_unix: Fix a data race of sk->sk_receive_queue->qlen. af_unix: Fix data races around sk->sk_shutdown. drm/i915/dp: prevent potential div-by-zero fbdev: arcfb: Fix error handling in arcfb_probe() ext4: remove an unused variable warning with CONFIG_QUOTA=n ext4: reflect error codes from ext4_multi_mount_protect() to its callers ext4: don't clear SB_RDONLY when remounting r/w until quota is re-enabled ext4: fix lockdep warning when enabling MMP ext4: allow to find by goal if EXT4_MB_HINT_GOAL_ONLY is set ext4: allow ext4_get_group_info() to fail refscale: Move shutdown from wait_event() to wait_event_idle() rcu: Protect rcu_print_task_exp_stall() ->exp_tasks access fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode() drm/displayid: add displayid_get_header() and check bounds better drm/amd/display: Use DC_LOG_DC in the trasform pixel function regmap: cache: Return error in cache sync operations for REGCACHE_NONE arm64: dts: qcom: msm8996: Add missing DWC3 quirks media: cx23885: Fix a null-ptr-deref bug in buffer_prepare() and buffer_finish() media: pci: tw68: Fix null-ptr-deref bug in buf prepare and finish memstick: r592: Fix UAF bug in r592_remove due to race condition firmware: arm_sdei: Fix sleep from invalid context BUG ACPI: EC: Fix oops when removing custom query handlers remoteproc: stm32_rproc: Add mutex protection for workqueue drm/tegra: Avoid potential 32-bit integer overflow drm/msm/dp: Clean up handling of DP AUX interrupts ACPICA: Avoid undefined behavior: applying zero offset to null pointer ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in acpi_db_display_objects drm/amd: Fix an out of bounds error in BIOS parser media: Prefer designated initializers over memset for subdev pad ops wifi: ath: Silence memcpy run-time false positive warning bpf: Annotate data races in bpf_local_storage wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex ext2: Check block size validity during mount scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow bnxt: avoid overflow in bnxt_get_nvram_directory() net: pasemi: Fix return type of pasemi_mac_start_tx() net: Catch invalid index in XPS mapping scsi: target: iscsit: Free cmds before session free lib: cpu_rmap: Avoid use after free on rmap->obj array entries scsi: message: mptlan: Fix use after free bug in mptlan_remove() due to race condition gfs2: Fix inode height consistency check scsi: ufs: ufs-pci: Add support for Intel Lunar Lake ext4: set goal start correctly in ext4_mb_normalize_request ext4: Fix best extent lstart adjustment logic in ext4_mb_new_inode_pa() f2fs: fix to drop all dirty pages during umount() if cp_error is set f2fs: fix to check readonly condition correctly samples/bpf: Fix fout leak in hbm's run_bpf_prog bpf: Add preempt_count_{sub,add} into btf id deny list wifi: iwlwifi: pcie: fix possible NULL pointer dereference wifi: iwlwifi: pcie: Fix integer overflow in iwl_write_to_user_buf null_blk: Always check queue mode setting from configfs wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace wifi: ath11k: Fix SKB corruption in REO destination ring nbd: fix incomplete validation of ioctl arg ipvs: Update width of source for ip_vs_sync_conn_options Bluetooth: btintel: Add LE States quirk support Bluetooth: hci_bcm: Fall back to getting bdaddr from EFI if not set Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp staging: rtl8192e: Replace macro RTL_PCI_DEVICE with PCI_DEVICE HID: logitech-hidpp: Don't use the USB serial for USB devices HID: logitech-hidpp: Reconcile USB and Unifying serials spi: spi-imx: fix MX51_ECSPI_* macros when cs > 3 HID: wacom: generic: Set battery quirk only when we see battery data usb: typec: tcpm: fix multiple times discover svids error serial: 8250: Reinit port->pm on port specific driver unbind mcb-pci: Reallocate memory region to avoid memory overlapping sched: Fix KCSAN noinstr violation recordmcount: Fix memory leaks in the uwrite function RDMA/core: Fix multiple -Warray-bounds warnings iommu/arm-smmu-qcom: Limit the SMR groups to 128 fs/ntfs3: Fix NULL pointer dereference in 'ni_write_inode' fs/ntfs3: Enhance the attribute size check fs/ntfs3: Fix NULL dereference in ni_write_inode fs/ntfs3: Validate MFT flags before replaying logs fs/ntfs3: Add length check in indx_get_root fs/ntfs3: Fix a possible null-pointer dereference in ni_clear() clk: tegra20: fix gcc-7 constant overflow warning iommu/arm-smmu-v3: Acknowledge pri/event queue overflow if any iommu/sprd: Release dma buffer to avoid memory leak Input: xpad - add constants for GIP interface numbers phy: st: miphy28lp: use _poll_timeout functions for waits soundwire: qcom: gracefully handle too many ports in DT mfd: dln2: Fix memory leak in dln2_probe() parisc: Replace regular spinlock with spin_trylock on panic path platform/x86: hp-wmi: Support touchpad on/off platform/x86: Move existing HP drivers to a new hp subdir platform/x86: hp-wmi: add micmute to hp_wmi_keymap struct xfrm: don't check the default policy if the policy allows the packet Revert "Fix XFRM-I support for nested ESP tunnels" drm/msm/dp: unregister audio driver during unbind drm/msm/dpu: Add INTF_5 interrupts drm/msm/dpu: Move non-MDP_TOP INTF_INTR offsets out of hwio header drm/msm/dpu: Remove duplicate register defines from INTF dt-bindings: display/msm: dsi-controller-main: Document qcom, master-dsi and qcom, sync-dual-dsi ASoC: fsl_micfil: Fix error handler with pm_runtime_enable cpupower: Make TSC read per CPU for Mperf monitor af_key: Reject optional tunnel/BEET mode templates in outbound policies selftests: seg6: disable DAD on IPv6 router cfg for srv6_end_dt4_l3vpn_test selftets: seg6: disable rp_filter by default in srv6_end_dt4_l3vpn_test net: fec: Better handle pm_runtime_get() failing in .remove() net: phy: dp83867: add w/a for packet errors seen with short cables ALSA: firewire-digi00x: prevent potential use after free ALSA: hda/realtek: Apply HP B&O top speaker profile to Pavilion 15 vsock: avoid to close connected socket after the timeout tcp: fix possible sk_priority leak in tcp_v4_send_reset() serial: arc_uart: fix of_iomap leak in `arc_serial_probe` serial: 8250_bcm7271: balance clk_enable calls serial: 8250_bcm7271: fix leak in `brcmuart_probe` erspan: get the proto with the md version for collect_md net: hns3: fix output information incomplete for dumping tx queue info with debugfs net: hns3: fix sending pfc frames after reset issue net: hns3: fix reset delay time to avoid configuration timeout media: netup_unidvb: fix use-after-free at del_timer() SUNRPC: double free xprt_ctxt while still in use tracing: Introduce helpers to safely handle dynamic-sized sockaddrs SUNRPC: Clean up svc_deferred_class trace events SUNRPC: Remove dead code in svc_tcp_release_rqst() SUNRPC: Remove svc_rqst::rq_xprt_hlen SUNRPC: always free ctxt when freeing deferred request SUNRPC: Fix trace_svc_register() call site drm/exynos: fix g2d_open/close helper function definitions net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() virtio-net: Maintain reverse cleanup order virtio_net: Fix error unwinding of XDP initialization tipc: add tipc_bearer_min_mtu to calculate min mtu tipc: do not update mtu if msg_max is too small in mtu negotiation tipc: check the bearer min mtu properly when setting it by netlink s390/cio: include subchannels without devices also for evaluation net: bcmgenet: Remove phy_stop() from bcmgenet_netif_stop() net: bcmgenet: Restore phy_stop() depending upon suspend/close wifi: mac80211: fix min center freq offset tracing wifi: iwlwifi: mvm: fix cancel_delayed_work_sync() deadlock wifi: iwlwifi: mvm: don't trust firmware n_channels scsi: storvsc: Don't pass unused PFNs to Hyper-V host cassini: Fix a memory leak in the error handling path of cas_init_one() net: dsa: mv88e6xxx: Fix mv88e6393x EPC write command offset igb: fix bit_shift to be in [1..8] range vlan: fix a potential uninit-value in vlan_dev_hard_start_xmit() netfilter: nf_tables: fix nft_trans type confusion netfilter: nft_set_rbtree: fix null deref on element insertion bridge: always declare tunnel functions ALSA: usb-audio: Add a sample rate workaround for Line6 Pod Go USB: usbtmc: Fix direction for 0-length ioctl control messages usb-storage: fix deadlock when a scsi command timeouts more than once USB: UHCI: adjust zhaoxin UHCI controllers OverCurrent bit value usb: dwc3: debugfs: Resume dwc3 before accessing registers usb: gadget: u_ether: Fix host MAC address case usb: typec: altmodes/displayport: fix pin_assignment_show xhci-pci: Only run d3cold avoidance quirk for s2idle xhci: Fix incorrect tracking of free space on transfer rings ALSA: hda: Fix Oops by 9.1 surround channel names ALSA: hda: Add NVIDIA codec IDs a3 through a7 to patch table ALSA: hda/realtek: Add quirk for Clevo L140AU ALSA: hda/realtek: Add a quirk for HP EliteDesk 805 ALSA: hda/realtek: Add quirk for 2nd ASUS GU603 can: j1939: recvmsg(): allow MSG_CMSG_COMPAT flag can: isotp: recvmsg(): allow MSG_CMSG_COMPAT flag can: kvaser_pciefd: Set CAN_STATE_STOPPED in kvaser_pciefd_stop() can: kvaser_pciefd: Call request_irq() before enabling interrupts can: kvaser_pciefd: Empty SRB buffer in probe can: kvaser_pciefd: Clear listen-only bit if not explicitly requested can: kvaser_pciefd: Do not send EFLUSH command on TFD interrupt can: kvaser_pciefd: Disable interrupts in probe error path SMB3: Close all deferred handles of inode in case of handle lease break SMB3: drop reference to cfile before sending oplock break ksmbd: smb2: Allow messages padded to 8byte boundary ksmbd: allocate one more byte for implied bcc[0] ksmbd: fix wrong UserName check in session_user ksmbd: fix global-out-of-bounds in smb2_find_context_vals statfs: enforce statfs[64] structure initialization serial: Add support for Advantech PCI-1611U card serial: 8250_exar: Add support for USR298x PCI Modems serial: qcom-geni: fix enabling deactivated interrupt thunderbolt: Clear registers properly when auto clear isn't in use vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF ceph: force updating the msg pointer in non-split case powerpc/iommu: Incorrect DDW Table is referenced for SR-IOV device tpm/tpm_tis: Disable interrupts for more Lenovo devices powerpc/64s/radix: Fix soft dirty tracking nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode() s390/qdio: fix do_sqbs() inline assembly constraint HID: wacom: Force pen out of prox if no events have been received in a while HID: wacom: Add new Intuos Pro Small (PTH-460) device IDs HID: wacom: add three styli to wacom_intuos_get_tool_type Linux 5.15.113 Change-Id: I569d3206b4380293549c195bf71ae101fc818c78 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-06-13 09:30:12 +00:00
Mirsad Goran Todorovac	808ed7d86e	test_firmware: fix the memory leak of the allocated firmware buffer ... commit 48e1560230 upstream. The following kernel memory leak was noticed after running tools/testing/selftests/firmware/fw_run_tests.sh: [root@pc-mtodorov firmware]# cat /sys/kernel/debug/kmemleak . . . unreferenced object 0xffff955389bc3400 (size 1024): comm "test_firmware-0", pid 5451, jiffies 4294944822 (age 65.652s) hex dump (first 32 bytes): 47 48 34 35 36 37 0a 00 00 00 00 00 00 00 00 00 GH4567.......... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff962f5dec>] slab_post_alloc_hook+0x8c/0x3c0 [<ffffffff962fcca4>] __kmem_cache_alloc_node+0x184/0x240 [<ffffffff962704de>] kmalloc_trace+0x2e/0xc0 [<ffffffff9665b42d>] test_fw_run_batch_request+0x9d/0x180 [<ffffffff95fd813b>] kthread+0x10b/0x140 [<ffffffff95e033e9>] ret_from_fork+0x29/0x50 unreferenced object 0xffff9553c334b400 (size 1024): comm "test_firmware-1", pid 5452, jiffies 4294944822 (age 65.652s) hex dump (first 32 bytes): 47 48 34 35 36 37 0a 00 00 00 00 00 00 00 00 00 GH4567.......... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff962f5dec>] slab_post_alloc_hook+0x8c/0x3c0 [<ffffffff962fcca4>] __kmem_cache_alloc_node+0x184/0x240 [<ffffffff962704de>] kmalloc_trace+0x2e/0xc0 [<ffffffff9665b42d>] test_fw_run_batch_request+0x9d/0x180 [<ffffffff95fd813b>] kthread+0x10b/0x140 [<ffffffff95e033e9>] ret_from_fork+0x29/0x50 unreferenced object 0xffff9553c334f000 (size 1024): comm "test_firmware-2", pid 5453, jiffies 4294944822 (age 65.652s) hex dump (first 32 bytes): 47 48 34 35 36 37 0a 00 00 00 00 00 00 00 00 00 GH4567.......... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff962f5dec>] slab_post_alloc_hook+0x8c/0x3c0 [<ffffffff962fcca4>] __kmem_cache_alloc_node+0x184/0x240 [<ffffffff962704de>] kmalloc_trace+0x2e/0xc0 [<ffffffff9665b42d>] test_fw_run_batch_request+0x9d/0x180 [<ffffffff95fd813b>] kthread+0x10b/0x140 [<ffffffff95e033e9>] ret_from_fork+0x29/0x50 unreferenced object 0xffff9553c3348400 (size 1024): comm "test_firmware-3", pid 5454, jiffies 4294944822 (age 65.652s) hex dump (first 32 bytes): 47 48 34 35 36 37 0a 00 00 00 00 00 00 00 00 00 GH4567.......... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff962f5dec>] slab_post_alloc_hook+0x8c/0x3c0 [<ffffffff962fcca4>] __kmem_cache_alloc_node+0x184/0x240 [<ffffffff962704de>] kmalloc_trace+0x2e/0xc0 [<ffffffff9665b42d>] test_fw_run_batch_request+0x9d/0x180 [<ffffffff95fd813b>] kthread+0x10b/0x140 [<ffffffff95e033e9>] ret_from_fork+0x29/0x50 [root@pc-mtodorov firmware]# Note that the size 1024 corresponds to the size of the test firmware buffer. The actual number of the buffers leaked is around 70-110, depending on the test run. The cause of the leak is the following: request_partial_firmware_into_buf() and request_firmware_into_buf() provided firmware buffer isn't released on release_firmware(), we have allocated it and we are responsible for deallocating it manually. This is introduced in a number of context where previously only release_firmware() was called, which was insufficient. Reported-by: Mirsad Goran Todorovac <mirsad.todorovac@alu.unizg.hr> Fixes: 7feebfa487 ("test_firmware: add support for request_firmware_into_buf") Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Dan Carpenter <error27@gmail.com> Cc: Takashi Iwai <tiwai@suse.de> Cc: Luis Chamberlain <mcgrof@kernel.org> Cc: Russ Weight <russell.h.weight@intel.com> Cc: Tianfei zhang <tianfei.zhang@intel.com> Cc: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Cc: Zhengchao Shao <shaozhengchao@huawei.com> Cc: Colin Ian King <colin.i.king@gmail.com> Cc: linux-kernel@vger.kernel.org Cc: Kees Cook <keescook@chromium.org> Cc: Scott Branden <sbranden@broadcom.com> Cc: Luis R. Rodriguez <mcgrof@kernel.org> Cc: linux-kselftest@vger.kernel.org Cc: stable@vger.kernel.org # v5.4 Signed-off-by: Mirsad Goran Todorovac <mirsad.todorovac@alu.unizg.hr> Link: https://lore.kernel.org/r/20230509084746.48259-3-mirsad.todorovac@alu.unizg.hr Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-06-09 10:32:33 +02:00
Greg Kroah-Hartman	c2773262b8	Merge 5.15.111 into android14-5.15-lts ... Changes in 5.15.111 ASOC: Intel: sof_sdw: add quirk for Intel 'Rooks County' NUC M15 ASoC: soc-pcm: fix hw->formats cleared by soc_pcm_hw_init() for dpcm x86/hyperv: Block root partition functionality in a Confidential VM iio: adc: palmas_gpadc: fix NULL dereference on rmmod ASoC: Intel: bytcr_rt5640: Add quirk for the Acer Iconia One 7 B1-750 selftests mount: Fix mount_setattr_test builds failed asm-generic/io.h: suppress endianness warnings for readq() and writeq() x86/cpu: Add model number for Intel Arrow Lake processor wireguard: timers: cast enum limits members to int in prints wifi: mt76: mt7921e: Set memory space enable in PCI_COMMAND if unset arm64: Always load shadow stack pointer directly from the task struct arm64: Stash shadow stack pointer in the task struct on interrupt PCI: pciehp: Fix AB-BA deadlock between reset_lock and device_lock PCI: qcom: Fix the incorrect register usage in v2.7.0 config IMA: allow/fix UML builds USB: dwc3: fix runtime pm imbalance on probe errors USB: dwc3: fix runtime pm imbalance on unbind hwmon: (k10temp) Check range scale when CUR_TEMP register is read-write hwmon: (adt7475) Use device_property APIs when configuring polarity posix-cpu-timers: Implement the missing timer_wait_running callback blk-mq: release crypto keyslot before reporting I/O complete blk-crypto: make blk_crypto_evict_key() return void blk-crypto: make blk_crypto_evict_key() more robust ext4: use ext4_journal_start/stop for fast commit transactions staging: iio: resolver: ads1210: fix config mode tty: Prevent writing chars during tcsetattr TCSADRAIN/FLUSH xhci: fix debugfs register accesses while suspended tick/nohz: Fix cpu_is_hotpluggable() by checking with nohz subsystem MIPS: fw: Allow firmware to pass a empty env ipmi:ssif: Add send_retries increment ipmi: fix SSIF not responding under certain cond. kheaders: Use array declaration instead of char wifi: mt76: add missing locking to protect against concurrent rx/status calls pwm: meson: Fix axg ao mux parents pwm: meson: Fix g12a ao clk81 name soundwire: qcom: correct setting ignore bit on v1.5.1 pinctrl: qcom: lpass-lpi: set output value before enabling output ring-buffer: Sync IRQ works before buffer destruction crypto: api - Demote BUG_ON() in crypto_unregister_alg() to a WARN_ON() crypto: safexcel - Cleanup ring IRQ workqueues on load failure rcu: Avoid stack overflow due to __rcu_irq_enter_check_tick() being kprobe-ed reiserfs: Add security prefix to xattr name in reiserfs_security_write() KVM: nVMX: Emulate NOPs in L2, and PAUSE if it's not intercepted relayfs: fix out-of-bounds access in relay_file_read writeback, cgroup: fix null-ptr-deref write in bdi_split_work_to_wbs ksmbd: call rcu_barrier() in ksmbd_server_exit() ksmbd: fix NULL pointer dereference in smb2_get_info_filesystem() ksmbd: fix memleak in session setup i2c: omap: Fix standard mode false ACK readings riscv: mm: remove redundant parameter of create_fdt_early_page_table tracing: Fix permissions for the buffer_percent file iommu/amd: Fix "Guest Virtual APIC Table Root Pointer" configuration in IRTE Revert "ubifs: dirty_cow_znode: Fix memleak in error handling path" ubifs: Fix memleak when insert_old_idx() failed ubi: Fix return value overwrite issue in try_write_vid_and_data() ubifs: Free memory for tmpfile name xfs: don't consider future format versions valid sound/oss/dmasound: fix build when drivers are mixed =y/=m rcu: Fix missing TICK_DEP_MASK_RCU_EXP dependency check selftests/resctrl: Return NULL if malloc_and_init_memory() did not alloc mem selftests/resctrl: Extend CPU vendor detection selftests/resctrl: Move ->setup() call outside of test specific branches selftests/resctrl: Allow ->setup() to return errors selftests/resctrl: Check for return value after write_schemata() selinux: fix Makefile dependencies of flask.h selinux: ensure av_permissions.h is built when needed tpm, tpm_tis: Do not skip reset of original interrupt vector tpm, tpm_tis: Claim locality before writing TPM_INT_ENABLE register tpm, tpm_tis: Disable interrupts if tpm_tis_probe_irq() failed tpm, tpm_tis: Claim locality before writing interrupt registers tpm, tpm: Implement usage counter for locality tpm, tpm_tis: Claim locality when interrupts are reenabled on resume erofs: stop parsing non-compact HEAD index if clusterofs is invalid erofs: fix potential overflow calculating xattr_isize drm/rockchip: Drop unbalanced obj unref drm/vgem: add missing mutex_destroy drm/probe-helper: Cancel previous job before starting new one tools/x86/kcpuid: Fix avx512bw and avx512lvl fields in Fn00000007 soc: ti: pm33xx: Fix refcount leak in am33xx_pm_probe arm64: dts: renesas: r8a77990: Remove bogus voltages from OPP table arm64: dts: renesas: r8a774c0: Remove bogus voltages from OPP table drm/msm/disp/dpu: check for crtc enable rather than crtc active to release shared resources EDAC/skx: Fix overflows on the DRAM row address mapping arrays regulator: core: Shorten off-on-delay-us for always-on/boot-on by time since booted arm64: dts: ti: k3-j721e-main: Remove ti,strobe-sel property arm64: dts: broadcom: bcm4908: add DT for Netgear RAXE500 arm64: dts: Add DTS files for bcmbca SoC BCM63158 arm64: dts: Add DTS files for bcmbca SoC BCM4912 ARM64: dts: Add DTS files for bcmbca SoC BCM6858 arm64: dts: Add base DTS file for bcmbca device Asus GT-AX6000 arm64: dts: Move BCM4908 dts to bcmbca folder arm64: dts: broadcom: bcmbca: bcm4908: fix NAND interrupt name arm64: dts: broadcom: bcmbca: bcm4908: fix procmon nodename arm64: dts: qcom: msm8998: Fix stm-stimulus-base reg name arm64: dts: qcom: sdm845: correct dynamic power coefficients arm64: dts: qcom: sdm845: Fix the PCI I/O port range arm64: dts: qcom: msm8998: Fix the PCI I/O port range arm64: dts: qcom: ipq8074: Fix the PCI I/O port range arm64: dts: qcom: ipq6018: Fix the PCI I/O port range arm64: dts: qcom: msm8996: Fix the PCI I/O port range arm64: dts: qcom: sm8250: Fix the PCI I/O port range ARM: dts: qcom: ipq4019: Fix the PCI I/O port range ARM: dts: qcom: ipq8064: reduce pci IO size to 64K ARM: dts: qcom: ipq8064: Fix the PCI I/O port range x86/MCE/AMD: Use an u64 for bank_map media: bdisp: Add missing check for create_workqueue media: av7110: prevent underflow in write_ts_to_decoder() firmware: qcom_scm: Clear download bit during reboot drm/bridge: adv7533: Fix adv7533_mode_valid for adv7533 and adv7535 media: max9286: Free control handler drm/msm/adreno: Defer enabling runpm until hw_init() drm/msm/adreno: drop bogus pm_runtime_set_active() drm: msm: adreno: Disable preemption on Adreno 510 drm/amd/display/dc/dce60/Makefile: Fix previous attempt to silence known override-init warnings ACPI: processor: Fix evaluating _PDC method when running as Xen dom0 mmc: sdhci-of-esdhc: fix quirk to ignore command inhibit for data drm: rcar-du: Fix a NULL vs IS_ERR() bug ARM: dts: gta04: fix excess dma channel usage firmware: arm_scmi: Fix xfers allocation on Rx channel ACPI: VIOT: Initialize the correct IOMMU fwspec drm/lima/lima_drv: Add missing unwind goto in lima_pdev_probe() mailbox: mpfs: switch to txdone_poll arm64: dts: qcom: sc7180-trogdor-lazor: correct trackpad supply arm64: dts: qcom: msm8994-kitakami: drop unit address from PMI8994 regulator arm64: dts: qcom: msm8994-msft-lumia-octagon: drop unit address from PMI8994 regulator drm/ttm: optimize pool allocations a bit v2 drm/ttm/pool: Fix ttm_pool_alloc error path regulator: core: Consistently set mutex_owner when using ww_mutex_lock_slow() regulator: core: Avoid lockdep reports when resolving supplies x86/apic: Fix atomic update of offset in reserve_eilvt_offset() media: rkvdec: fix use after free bug in rkvdec_remove media: dm1105: Fix use after free bug in dm1105_remove due to race condition media: saa7134: fix use after free bug in saa7134_finidev due to race condition media: rcar_fdp1: Make use of the helper function devm_platform_ioremap_resource() media: rcar_fdp1: Fix the correct variable assignments platform: Provide a remove callback that returns no value media: rcar_fdp1: Convert to platform remove callback returning void media: rcar_fdp1: Fix refcount leak in probe and remove function drm/amd/display: Fix potential null dereference media: rc: gpio-ir-recv: Fix support for wake-up media: venus: dec: Fix handling of the start cmd regulator: stm32-pwr: fix of_iomap leak x86/ioapic: Don't return 0 from arch_dynirq_lower_bound() arm64: kgdb: Set PSTATE.SS to 1 to re-enable single-step debugobject: Prevent init race with static objects drm/i915: Make intel_get_crtc_new_encoder() less oopsy tick/common: Align tick period with the HZ tick. cpufreq: use correct unit when verify cur freq hwmon: (pmbus/fsp-3y) Fix functionality bitmask in FSP-3Y YM-2151E wifi: ath6kl: minor fix for allocation size wifi: ath9k: hif_usb: fix memory leak of remain_skbs wifi: ath5k: fix an off by one check in ath5k_eeprom_read_freq_list() wifi: brcmfmac: support CQM RSSI notification with older firmware wifi: ath6kl: reduce WARN to dev_dbg() in callback tools: bpftool: Remove invalid \' json escape wifi: rtw88: mac: Return the original error from rtw_pwr_seq_parser() wifi: rtw88: mac: Return the original error from rtw_mac_power_switch() bpf: take into account liveness when propagating precision bpf: fix precision propagation verbose logging scm: fix MSG_CTRUNC setting condition for SO_PASSSEC selftests/bpf: Fix a fd leak in an error path in network_helpers.c bpf: Remove misleading spec_v1 check on var-offset stack read net: pcs: xpcs: remove double-read of link state when using AN vlan: partially enable SIOCSHWTSTAMP in container net/packet: annotate accesses to po->xmit net/packet: convert po->origdev to an atomic flag net/packet: convert po->auxdata to an atomic flag scsi: target: Fix multiple LUN_RESET handling scsi: target: iscsit: Fix TAS handling during conn cleanup scsi: megaraid: Fix mega_cmd_done() CMDID_INT_CMDS f2fs: handle dqget error in f2fs_transfer_project_quota() f2fs: enforce single zone capacity f2fs: apply zone capacity to all zone type f2fs: compress: fix to call f2fs_wait_on_page_writeback() in f2fs_write_raw_pages() crypto: caam - Clear some memory in instantiate_rng crypto: sa2ul - Select CRYPTO_DES wifi: rtlwifi: fix incorrect error codes in rtl_debugfs_set_write_rfreg() wifi: rtlwifi: fix incorrect error codes in rtl_debugfs_set_write_reg() wifi: rt2x00: Fix memory leak when handling surveys net: qrtr: correct types of trace event parameters selftests: xsk: Disable IPv6 on VETH1 selftests/bpf: Wait for receive in cg_storage_multi test bpftool: Fix bug for long instructions in program CFG dumps crypto: drbg - make drbg_prepare_hrng() handle jent instantiation errors crypto: drbg - Only fail when jent is unavailable in FIPS mode xsk: Fix unaligned descriptor validation f2fs: fix to avoid use-after-free for cached IPU bio scsi: lpfc: Fix ioremap issues in lpfc_sli4_pci_mem_setup() net: ethernet: stmmac: dwmac-rk: fix optional phy regulator handling bpf, sockmap: fix deadlocks in the sockhash and sockmap nvmet: use i_size_read() to set size for file-ns nvmet: move the call to nvmet_ns_changed out of nvmet_ns_revalidate nvmet: fix error handling in nvmet_execute_identify_cns_cs_ns() nvmet: fix Identify Namespace handling nvmet: fix Identify Controller handling nvmet: fix Identify Active Namespace ID list handling nvmet: fix I/O Command Set specific Identify Controller nvme: handle the persistent internal error AER nvme: fix async event trace event nvme-fcloop: fix "inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage" selftests/bpf: Fix leaked bpf_link in get_stackid_cannot_attach bpf, sockmap: Revert buggy deadlock fix in the sockhash and sockmap md: drop queue limitation for RAID1 and RAID10 md: raid10 add nowait support md/raid10: factor out code from wait_barrier() to stop_waiting_barrier() md/raid10: fix task hung in raid10d md/raid10: fix leak of 'r10bio->remaining' for recovery md/raid10: fix memleak for 'conf->bio_split' md/raid10: fix memleak of md thread md/raid10: don't call bio_start_io_acct twice for bio which experienced read error wifi: iwlwifi: yoyo: skip dump correctly on hw error wifi: iwlwifi: yoyo: Fix possible division by zero wifi: iwlwifi: mvm: initialize seq variable wifi: iwlwifi: fw: move memset before early return jdb2: Don't refuse invalidation of already invalidated buffers wifi: iwlwifi: make the loop for card preparation effective wifi: mt76: handle failure of vzalloc in mt7615_coredump_work wifi: mt76: add flexible polling wait-interval support wifi: mt76: mt7921e: fix probe timeout after reboot wifi: mt76: fix 6GHz high channel not be scanned wifi: mt76: mt7921e: improve reliability of dma reset wifi: iwlwifi: mvm: check firmware response size wifi: iwlwifi: fw: fix memory leak in debugfs ixgbe: Allow flow hash to be set via ethtool ixgbe: Enable setting RSS table to default values net/mlx5: E-switch, Don't destroy indirect table in split rule net: stmmac:fix system hang when setting up tag_8021q VLAN for DSA ports bpf: Don't EFAULT for getsockopt with optval=NULL netfilter: nf_tables: don't write table validation state without mutex net/sched: sch_fq: fix integer overflow of "credit" ipv4: Fix potential uninit variable access bug in __ip_make_skb() Revert "Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work" netlink: Use copy_to_user() for optval in netlink_getsockopt(). net: amd: Fix link leak when verifying config failed tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp. ipmi: ASPEED_BT_IPMI_BMC: select REGMAP_MMIO instead of depending on it drivers: staging: rtl8723bs: Fix locking in _rtw_join_timeout_handler() drivers: staging: rtl8723bs: Fix locking in rtw_scan_timeout_handler() pstore: Revert pmsg_lock back to a normal mutex usb: host: xhci-rcar: remove leftover quirk handling usb: dwc3: gadget: Change condition for processing suspend event serial: stm32: re-introduce an irq flag condition in usart_receive_chars serial: stm32: Re-assert RTS/DE GPIO in RS485 mode only if more data are transmitted fpga: bridge: fix kernel-doc parameter description iio: light: max44009: add missing OF device matching serial: 8250_bcm7271: Fix arbitration handling spi: spi-imx: using pm_runtime_resume_and_get instead of pm_runtime_get_sync spi: imx: Don't skip cleanup in remove's error path usb: gadget: udc: renesas_usb3: Fix use after free bug in renesas_usb3_remove due to race condition PCI: imx6: Install the fault handler only on compatible match ASoC: es8316: Handle optional IRQ assignment linux/vt_buffer.h: allow either builtin or modular for macros spi: qup: Don't skip cleanup in remove's error path spi: fsl-spi: Fix CPM/QE mode Litte Endian vmci_host: fix a race condition in vmci_host_poll() causing GPF of: Fix modalias string generation PCI/EDR: Clear Device Status after EDR error recovery ia64: mm/contig: fix section mismatch warning/error ia64: salinfo: placate defined-but-not-used warning scripts/gdb: bail early if there are no clocks scripts/gdb: bail early if there are no generic PD HID: amd_sfh: Add support for shutdown operation coresight: etm_pmu: Set the module field ASoC: fsl_mqs: move of_node_put() to the correct location spi: cadence-quadspi: fix suspend-resume implementations i2c: cadence: cdns_i2c_master_xfer(): Fix runtime PM leak on error path scripts/gdb: raise error with reduced debugging information uapi/linux/const.h: prefer ISO-friendly __typeof__ sh: sq: Fix incorrect element size for allocating bitmap buffer usb: gadget: tegra-xudc: Fix crash in vbus_draw usb: chipidea: fix missing goto in `ci_hdrc_probe` usb: mtu3: fix kernel panic at qmu transfer done irq handler firmware: stratix10-svc: Fix an NULL vs IS_ERR() bug in probe tty: serial: fsl_lpuart: adjust buffer length to the intended size serial: 8250: Add missing wakeup event reporting staging: rtl8192e: Fix W_DISABLE# does not work after stop/start spmi: Add a check for remove callback when removing a SPMI driver virtio_ring: don't update event idx on get_buf macintosh/windfarm_smu_sat: Add missing of_node_put() powerpc/mpc512x: fix resource printk format warning powerpc/wii: fix resource printk format warnings powerpc/sysdev/tsi108: fix resource printk format warnings macintosh: via-pmu-led: requires ATA to be set powerpc/rtas: use memmove for potentially overlapping buffer copy sched/fair: Use __schedstat_set() in set_next_entity() sched: Make struct sched_statistics independent of fair sched class sched/fair: Fix inaccurate tally of ttwu_move_affine perf/core: Fix hardlockup failure caused by perf throttle Revert "objtool: Support addition to set CFA base" sched/rt: Fix bad task migration for rt tasks clk: at91: clk-sam9x60-pll: fix return value check RDMA/siw: Fix potential page_array out of range access RDMA/rdmavt: Delete unnecessary NULL check workqueue: Introduce show_one_worker_pool and show_one_workqueue. workqueue: Fix hung time report of worker pools rtc: omap: include header for omap_rtc_power_off_program prototype RDMA/mlx4: Prevent shift wrapping in set_user_sq_size() rtc: meson-vrtc: Use ktime_get_real_ts64() to get the current time fs/ntfs3: Fix memory leak if ntfs_read_mft failed fs/ntfs3: Add check for kmemdup fs/ntfs3: Fix OOB read in indx_insert_into_buffer fs/ntfs3: Fix slab-out-of-bounds read in hdr_delete_de() power: supply: generic-adc-battery: fix unit scaling clk: add missing of_node_put() in "assigned-clocks" property parsing RDMA/siw: Remove namespace check from siw_netdev_event() clk: qcom: gcc-sm6115: Mark RCGs shared where applicable RDMA/cm: Trace icm_send_rej event before the cm state is reset RDMA/srpt: Add a check for valid 'mad_agent' pointer IB/hfi1: Fix SDMA mmu_rb_node not being evicted in LRU order IB/hfi1: Fix bugs with non-PAGE_SIZE-end multi-iovec user SDMA requests NFSv4.1: Always send a RECLAIM_COMPLETE after establishing lease clk: qcom: regmap: add PHY clock source implementation clk: qcom: gcc-sm8350: fix PCIe PIPE clocks handling Input: raspberrypi-ts - fix refcount leak in rpi_ts_probe RDMA/mlx5: Fix flow counter query via DEVX SUNRPC: remove the maximum number of retries in call_bind_status RDMA/mlx5: Use correct device num_ports when modify DC clocksource/drivers/davinci: Fix memory leak in davinci_timer_register when init fails openrisc: Properly store r31 to pt_regs on unhandled exceptions timekeeping: Fix references to nonexistent ktime_get_fast_ns() SMB3: Add missing locks to protect deferred close file list SMB3: Close deferred file handles in case of handle lease break ext4: fix i_disksize exceeding i_size problem in paritally written case ext4: fix use-after-free read in ext4_find_extent for bigalloc + inline pinctrl: renesas: r8a779a0: Remove incorrect AVB[01] pinmux configuration leds: TI_LMU_COMMON: select REGMAP instead of depending on it dmaengine: mv_xor_v2: Fix an error code. leds: tca6507: Fix error handling of using fwnode_property_read_string pwm: mtk-disp: Disable shadow registers before setting backlight values pwm: mtk-disp: Configure double buffering before reading in .get_state() phy: tegra: xusb: Add missing tegra_xusb_port_unregister for usb2_port and ulpi_port dma: gpi: remove spurious unlock in gpi_ch_init dmaengine: dw-edma: Fix to change for continuous transfer dmaengine: dw-edma: Fix to enable to issue dma request on DMA processing dmaengine: at_xdmac: Fix concurrency over chan's completed_cookie dmaengine: at_xdmac: Fix race for the tx desc callback dmaengine: at_xdmac: do not enable all cyclic channels thermal/drivers/mediatek: Use devm_of_iomap to avoid resource leak in mtk_thermal_probe mfd: tqmx86: Do not access I2C_DETECT register through io_base mfd: tqmx86: Specify IO port register range more precisely mfd: tqmx86: Correct board names for TQMxE39x afs: Fix updating of i_size with dv jump from server parisc: Fix argument pointer in real64_call_asm() ALSA: usb-audio: Add quirk for Pioneer DDJ-800 nilfs2: do not write dirty data after degenerating to read-only nilfs2: fix infinite loop in nilfs_mdt_get_block() md/raid10: fix null-ptr-deref in raid10_sync_request mtd: core: provide unique name for nvmem device, take two mtd: core: fix nvmem error reporting mtd: core: fix error path for nvmem provider mailbox: zynqmp: Fix IPI isr handling mailbox: zynqmp: Fix typo in IPI documentation wifi: rtl8xxxu: RTL8192EU always needs full init clk: rockchip: rk3399: allow clk_cifout to force clk_cifout_src to reparent scripts/gdb: fix lx-timerlist for Python3 btrfs: scrub: reject unsupported scrub flags s390/dasd: fix hanging blockdevice after request requeue ia64: fix an addr to taddr in huge_pte_offset() dm verity: fix error handling for check_at_most_once on FEC dm clone: call kmem_cache_destroy() in dm_clone_init() error path dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path dm flakey: fix a crash with invalid table line dm ioctl: fix nested locking in table_clear() to remove deadlock concern dm: don't lock fs when the map is NULL in process of resume perf auxtrace: Fix address filter entire kernel size perf intel-pt: Fix CYC timestamps after standalone CBR debugobject: Ensure pool refill (again) sound/oss/dmasound: fix 'dmasound_setup' defined but not used arm64: dts: qcom: sdm845: correct dynamic power coefficients - again netfilter: nf_tables: deactivate anonymous set from preparation phase sched: Fix DEBUG && !SCHEDSTATS warn Linux 5.15.111 Change-Id: Ic17a1be536afd1897c1b88d5d054afbac9182d1a Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-06-08 13:25:38 +00:00
Tetsuo Handa	aee97eec77	debugobjects: Don't wake up kswapd from fill_pool() ... commit eb799279fb upstream. syzbot is reporting a lockdep warning in fill_pool() because the allocation from debugobjects is using GFP_ATOMIC, which is (__GFP_HIGH | __GFP_KSWAPD_RECLAIM) and therefore tries to wake up kswapd, which acquires kswapd_wait::lock. Since fill_pool() might be called with arbitrary locks held, fill_pool() should not assume that acquiring kswapd_wait::lock is safe. Use __GFP_HIGH instead and remove __GFP_NORETRY as it is pointless for !__GFP_DIRECT_RECLAIM allocation. Fixes: 3ac7fe5a4a ("infrastructure to debug (dynamic) objects") Reported-by: syzbot <syzbot+fe0c72f0ccbb93786380@syzkaller.appspotmail.com> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Link: https://lore.kernel.org/r/6577e1fa-b6ee-f2be-2414-a2b51b1c5e30@I-love.SAKURA.ne.jp Closes: https://syzkaller.appspot.com/bug?extid=fe0c72f0ccbb93786380 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-05-30 13:55:31 +01:00
Eli Cohen	c6ed54dd90	lib: cpu_rmap: Avoid use after free on rmap->obj array entries ... [ Upstream commit 4e0473f106 ] When calling irq_set_affinity_notifier() with NULL at the notify argument, it will cause freeing of the glue pointer in the corresponding array entry but will leave the pointer in the array. A subsequent call to free_irq_cpu_rmap() will try to free this entry again leading to possible use after free. Fix that by setting NULL to the array entry and checking that we have non-zero at the array entry when iterating over the array in free_irq_cpu_rmap(). The current code does not suffer from this since there are no cases where irq_set_affinity_notifier(irq, NULL) (note the NULL passed for the notify arg) is called, followed by a call to free_irq_cpu_rmap() so we don't hit and issue. Subsequent patches in this series excersize this flow, hence the required fix. Cc: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Eli Cohen <elic@nvidia.com> Signed-off-by: Saeed Mahameed <saeedm@nvidia.com> Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-05-24 17:36:45 +01:00
Roy Novich	46e100be0f	linux/dim: Do nothing if no time delta between samples ... [ Upstream commit 162bd18eb5 ] Add return value for dim_calc_stats. This is an indication for the caller if curr_stats was assigned by the function. Avoid using curr_stats uninitialized over {rdma/net}_dim, when no time delta between samples. Coverity reported this potential use of an uninitialized variable. Fixes: 4c4dbb4a73 ("net/mlx5e: Move dynamic interrupt coalescing code to include/linux") Fixes: cb3c7fd4f8 ("net/mlx5e: Support adaptive RX coalescing") Signed-off-by: Roy Novich <royno@nvidia.com> Reviewed-by: Aya Levin <ayal@nvidia.com> Reviewed-by: Saeed Mahameed <saeedm@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Reviewed-by: Leon Romanovsky <leonro@nvidia.com> Reviewed-by: Michal Kubiak <michal.kubiak@intel.com> Link: https://lore.kernel.org/r/20230507135743.138993-1-tariqt@nvidia.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-05-24 17:36:41 +01:00
Thomas Gleixner	503e554782	debugobject: Ensure pool refill (again) ... commit 0af462f19e upstream. The recent fix to ensure atomicity of lookup and allocation inadvertently broke the pool refill mechanism. Prior to that change debug_objects_activate() and debug_objecs_assert_init() invoked debug_objecs_init() to set up the tracking object for statically initialized objects. That's not longer the case and debug_objecs_init() is now the only place which does pool refills. Depending on the number of statically initialized objects this can be enough to actually deplete the pool, which was observed by Ido via a debugobjects OOM warning. Restore the old behaviour by adding explicit refill opportunities to debug_objects_activate() and debug_objecs_assert_init(). Fixes: 63a759694e ("debugobject: Prevent init race with static objects") Reported-by: Ido Schimmel <idosch@nvidia.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Tested-by: Ido Schimmel <idosch@nvidia.com> Link: https://lore.kernel.org/r/871qk05a9d.ffs@tglx Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-05-11 23:00:40 +09:00
Thomas Gleixner	500ffa58e7	debugobject: Prevent init race with static objects ... [ Upstream commit 63a759694e ] Statically initialized objects are usually not initialized via the init() function of the subsystem. They are special cased and the subsystem provides a function to validate whether an object which is not yet tracked by debugobjects is statically initialized. This means the object is started to be tracked on first use, e.g. activation. This works perfectly fine, unless there are two concurrent operations on that object. Schspa decoded the problem: T0 T1 debug_object_assert_init(addr) lock_hash_bucket() obj = lookup_object(addr); if (!obj) { unlock_hash_bucket(); - > preemption lock_subsytem_object(addr); activate_object(addr) lock_hash_bucket(); obj = lookup_object(addr); if (!obj) { unlock_hash_bucket(); if (is_static_object(addr)) init_and_track(addr); lock_hash_bucket(); obj = lookup_object(addr); obj->state = ACTIVATED; unlock_hash_bucket(); subsys function modifies content of addr, so static object detection does not longer work. unlock_subsytem_object(addr); if (is_static_object(addr)) <- Fails debugobject emits a warning and invokes the fixup function which reinitializes the already active object in the worst case. This race exists forever, but was never observed until mod_timer() got a debug_object_assert_init() added which is outside of the timer base lock held section right at the beginning of the function to cover the lockless early exit points too. Rework the code so that the lookup, the static object check and the tracking object association happens atomically under the hash bucket lock. This prevents the issue completely as all callers are serialized on the hash bucket lock and therefore cannot observe inconsistent state. Fixes: 3ac7fe5a4a ("infrastructure to debug (dynamic) objects") Reported-by: syzbot+5093ba19745994288b53@syzkaller.appspotmail.com Debugged-by: Schspa Shi <schspa@gmail.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Reviewed-by: Stephen Boyd <swboyd@chromium.org> Link: https://syzkaller.appspot.com/bug?id=22c8a5938eab640d1c6bcc0e3dc7be519d878462 Link: https://lore.kernel.org/lkml/20230303161906.831686-1-schspa@gmail.com Link: https://lore.kernel.org/r/87zg7dzgao.ffs@tglx Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-05-11 23:00:25 +09:00
Greg Kroah-Hartman	ea8aebc48c	Merge 5.15.99 into android14-5.15 ... Changes in 5.15.99 HID: asus: use spinlock to protect concurrent accesses HID: asus: use spinlock to safely schedule workers powerpc/mm: Rearrange if-else block to avoid clang warning ARM: OMAP2+: Fix memory leak in realtime_counter_init() arm64: dts: qcom: qcs404: use symbol names for PCIe resets arm64: dts: qcom: msm8996-tone: Fix USB taking 6 minutes to wake up arm64: dts: qcom: sm8150-kumano: Panel framebuffer is 2.5k instead of 4k arm64: dts: qcom: sm6125: Reorder HSUSB PHY clocks to match bindings arm64: dts: imx8m: Align SoC unique ID node unit address ARM: zynq: Fix refcount leak in zynq_early_slcr_init arm64: dts: mediatek: mt8183: Fix systimer 13 MHz clock description arm64: dts: qcom: sdm845-db845c: fix audio codec interrupt pin name arm64: dts: qcom: sc7180: correct SPMI bus address cells arm64: dts: qcom: sc7280: correct SPMI bus address cells arm64: dts: meson-gx: Fix Ethernet MAC address unit name arm64: dts: meson-g12a: Fix internal Ethernet PHY unit name arm64: dts: meson-gx: Fix the SCPI DVFS node name and unit address arm64: dts: msm8992-bullhead: add memory hole region arm64: dts: qcom: msm8992-bullhead: Fix cont_splash_mem size arm64: dts: qcom: msm8992-bullhead: Disable dfps_data_mem arm64: dts: qcom: ipq8074: correct USB3 QMP PHY-s clock output names arm64: dts: qcom: Fix IPQ8074 PCIe PHY nodes arm64: dts: qcom: ipq8074: fix PCIe PHY serdes size arm64: dts: qcom: ipq8074: fix Gen3 PCIe QMP PHY arm64: dts: qcom: ipq8074: correct Gen2 PCIe ranges arm64: dts: qcom: ipq8074: fix Gen3 PCIe node arm64: dts: qcom: ipq8074: correct PCIe QMP PHY output clock names arm64: dts: meson: remove CPU opps below 1GHz for G12A boards ARM: OMAP1: call platform_device_put() in error case in omap1_dm_timer_init() ARM: bcm2835_defconfig: Enable the framebuffer ARM: s3c: fix s3c64xx_set_timer_source prototype arm64: dts: ti: k3-j7200: Fix wakeup pinmux range ARM: dts: exynos: correct wr-active property in Exynos3250 Rinato ARM: imx: Call ida_simple_remove() for ida_simple_get arm64: dts: amlogic: meson-gx: fix SCPI clock dvfs node name arm64: dts: amlogic: meson-axg: fix SCPI clock dvfs node name arm64: dts: amlogic: meson-gx: add missing SCPI sensors compatible arm64: dts: amlogic: meson-gxl-s905d-sml5442tw: drop invalid clock-names property arm64: dts: amlogic: meson-gx: add missing unit address to rng node name arm64: dts: amlogic: meson-gxl: add missing unit address to eth-phy-mux node name arm64: dts: amlogic: meson-gx-libretech-pc: fix update button name arm64: dts: amlogic: meson-sm1-bananapi-m5: fix adc keys node names arm64: dts: amlogic: meson-gxl-s905d-phicomm-n1: fix led node name arm64: dts: amlogic: meson-gxbb-kii-pro: fix led node name arm64: dts: amlogic: meson-sm1-odroid-hc4: fix active fan thermal trip locking/rwsem: Optimize down_read_trylock() under highly contended case locking/rwsem: Disable preemption in all down_read*() and up_read() code paths arm64: dts: renesas: beacon-renesom: Fix gpio expander reference arm64: dts: meson: bananapi-m5: switch VDDIO_C pin to OPEN_DRAIN ARM: dts: sun8i: nanopi-duo2: Fix regulator GPIO reference ARM: dts: imx7s: correct iomuxc gpr mux controller cells arm64: dts: mt8192: Fix CPU map for single-cluster SoC arm64: dts: mediatek: mt7622: Add missing pwm-cells to pwm node blk-mq: avoid sleep in blk_mq_alloc_request_hctx blk-mq: remove stale comment for blk_mq_sched_mark_restart_hctx blk-mq: correct stale comment of .get_budget arm64: dts: qcom: msm8992-lg-bullhead: Correct memory overlaps with the SMEM and MPSS memory regions s390/dasd: Fix potential memleak in dasd_eckd_init() sched/deadline,rt: Remove unused parameter from pick_next_[rt|dl]_entity() sched/rt: pick_next_rt_entity(): check list_entry x86/perf/zhaoxin: Add stepping check for ZXC KEYS: asymmetric: Fix ECDSA use via keyctl uapi arm64: dts: qcom: pmk8350: Specify PBS register for PON arm64: dts: qcom: pmk8350: Use the correct PON compatible block: bio-integrity: Copy flags when bio_integrity_payload is cloned wifi: rsi: Fix memory leak in rsi_coex_attach() wifi: rtlwifi: rtl8821ae: don't call kfree_skb() under spin_lock_irqsave() wifi: rtlwifi: rtl8188ee: don't call kfree_skb() under spin_lock_irqsave() wifi: rtlwifi: rtl8723be: don't call kfree_skb() under spin_lock_irqsave() wifi: iwlegacy: common: don't call dev_kfree_skb() under spin_lock_irqsave() wifi: libertas: fix memory leak in lbs_init_adapter() wifi: rtl8xxxu: don't call dev_kfree_skb() under spin_lock_irqsave() wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit() libbpf: Fix btf__align_of() by taking into account field offsets wifi: ipw2x00: don't call dev_kfree_skb() under spin_lock_irqsave() wifi: ipw2200: fix memory leak in ipw_wdev_init() wifi: wilc1000: fix potential memory leak in wilc_mac_xmit() wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit() wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid() wifi: libertas_tf: don't call kfree_skb() under spin_lock_irqsave() wifi: libertas: if_usb: don't call kfree_skb() under spin_lock_irqsave() wifi: libertas: main: don't call kfree_skb() under spin_lock_irqsave() wifi: libertas: cmdresp: don't call kfree_skb() under spin_lock_irqsave() wifi: wl3501_cs: don't call kfree_skb() under spin_lock_irqsave() crypto: x86/ghash - fix unaligned access in ghash_setkey() ACPICA: Drop port I/O validation for some regions genirq: Fix the return type of kstat_cpu_irqs_sum() rcu-tasks: Improve comments explaining tasks_rcu_exit_srcu purpose rcu-tasks: Remove preemption disablement around srcu_read_[un]lock() calls rcu-tasks: Fix synchronize_rcu_tasks() VS zap_pid_ns_processes() lib/mpi: Fix buffer overrun when SG is too long crypto: ccp - Avoid page allocation failure warning for SEV_GET_ID2 ACPICA: nsrepair: handle cases without a return value correctly thermal/drivers/tsens: Drop msm8976-specific defines thermal/drivers/tsens: Add compat string for the qcom,msm8960 thermal/drivers/tsens: Sort out msm8976 vs msm8956 data thermal/drivers/tsens: fix slope values for msm8939 thermal/drivers/tsens: limit num_sensors to 9 for msm8939 wifi: rtl8xxxu: Fix memory leaks with RTL8723BU, RTL8192EU wifi: orinoco: check return value of hermes_write_wordrec() wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no callback function ath9k: hif_usb: simplify if-if to if-else ath9k: htc: clean up statistics macros wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback() wifi: ath11k: Fix memory leak in ath11k_peer_rx_frag_setup wifi: cfg80211: Fix extended KCK key length check in nl80211_set_rekey_data() ACPI: battery: Fix missing NUL-termination with large strings crypto: ccp - Failure on re-initialization due to duplicate sysfs filename crypto: essiv - Handle EBUSY correctly crypto: seqiv - Handle EBUSY correctly powercap: fix possible name leak in powercap_register_zone() x86: Mark stop_this_cpu() __noreturn x86/microcode: Rip out the OLD_INTERFACE x86/microcode: Default-disable late loading x86/microcode: Print previous version of microcode after reload x86/microcode: Add a parameter to microcode_check() to store CPU capabilities x86/microcode: Check CPU capabilities after late microcode update correctly x86/microcode: Adjust late loading result reporting message crypto: xts - Handle EBUSY correctly leds: led-class: Add missing put_device() to led_put() crypto: ccp - Refactor out sev_fw_alloc() crypto: ccp - Flush the SEV-ES TMR memory before giving it to firmware bpftool: profile online CPUs instead of possible mt76: mt7915: fix polling firmware-own status net/mlx5: Enhance debug print in page allocation failure irqchip: Fix refcount leak in platform_irqchip_probe irqchip/alpine-msi: Fix refcount leak in alpine_msix_init_domains irqchip/irq-mvebu-gicp: Fix refcount leak in mvebu_gicp_probe irqchip/ti-sci: Fix refcount leak in ti_sci_intr_irq_domain_probe s390/mem_detect: fix detect_memory() error handling s390/vmem: fix empty page tables cleanup under KASAN net: add sock_init_data_uid() tun: tun_chr_open(): correctly initialize socket uid tap: tap_open(): correctly initialize socket uid OPP: fix error checking in opp_migrate_dentry() Bluetooth: L2CAP: Fix potential user-after-free Bluetooth: hci_qca: get wakeup status from serdev device handle s390/ap: fix status returned by ap_aqic() s390/ap: fix status returned by ap_qact() libbpf: Fix alen calculation in libbpf_nla_dump_errormsg() rds: rds_rm_zerocopy_callback() correct order for list_add_tail() crypto: rsa-pkcs1pad - Use akcipher_request_complete m68k: /proc/hardware should depend on PROC_FS RISC-V: time: initialize hrtimer based broadcast clock event device wifi: iwl3945: Add missing check for create_singlethread_workqueue wifi: iwl4965: Add missing check for create_singlethread_workqueue() wifi: mwifiex: fix loop iterator in mwifiex_update_ampdu_txwinsize() selftests/bpf: Fix out-of-srctree build ACPI: resource: Add IRQ overrides for MAINGEAR Vector Pro 2 models ACPI: resource: Do IRQ override on all TongFang GMxRGxx crypto: crypto4xx - Call dma_unmap_page when done wifi: mac80211: make rate u32 in sta_set_rate_info_rx() thermal/drivers/hisi: Drop second sensor hi3660 can: esd_usb: Move mislocated storage of SJA1000_ECC_SEG bits in case of a bus error bpf: Fix global subprog context argument resolution logic irqchip/irq-brcmstb-l2: Set IRQ_LEVEL for level triggered interrupts irqchip/irq-bcm7120-l2: Set IRQ_LEVEL for level triggered interrupts selftests/net: Interpret UDP_GRO cmsg data as an int value l2tp: Avoid possible recursive deadlock in l2tp_tunnel_register() net: bcmgenet: fix MoCA LED control selftest: fib_tests: Always cleanup before exit sefltests: netdevsim: wait for devlink instance after netns removal drm: Fix potential null-ptr-deref due to drmm_mode_config_init() drm/fourcc: Add missing big-endian XRGB1555 and RGB565 formats drm/bridge: ti-sn65dsi83: Fix delay after reset deassert to match spec drm: mxsfb: DRM_MXSFB should depend on ARCH_MXS || ARCH_MXC drm/bridge: megachips: Fix error handling in i2c_register_driver() drm/vkms: Fix memory leak in vkms_init() drm/vkms: Fix null-ptr-deref in vkms_release() drm/vc4: dpi: Add option for inverting pixel clock and output enable drm/vc4: dpi: Fix format mapping for RGB565 drm: tidss: Fix pixel format definition gpu: ipu-v3: common: Add of_node_put() for reference returned by of_graph_get_port_by_id() hwmon: (ftsteutates) Fix scaling of measurements drm/msm/hdmi: Add missing check for alloc_ordered_workqueue pinctrl: qcom: pinctrl-msm8976: Correct function names for wcss pins pinctrl: stm32: Fix refcount leak in stm32_pctrl_get_irq_domain pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups drm/vc4: hvs: Set AXI panic modes drm/vc4: hvs: Fix colour order for xRGB1555 on HVS5 drm/vc4: hdmi: Correct interlaced timings again drm/msm: clean event_thread->worker in case of an error scsi: qla2xxx: edif: Fix I/O timeout due to over-subscription scsi: qla2xxx: Fix exchange oversubscription scsi: qla2xxx: Fix exchange oversubscription for management commands ASoC: fsl_sai: Update to modern clocking terminology ASoC: fsl_sai: initialize is_dsp_mode flag drm/msm/adreno: Fix null ptr access in adreno_gpu_cleanup() ALSA: hda/ca0132: minor fix for allocation size drm/msm/gem: Add check for kmalloc drm/msm/dpu: Disallow unallocated resources to be returned drm/bridge: lt9611: fix sleep mode setup drm/bridge: lt9611: fix HPD reenablement drm/bridge: lt9611: fix polarity programming drm/bridge: lt9611: fix programming of video modes drm/bridge: lt9611: fix clock calculation drm/bridge: lt9611: pass a pointer to the of node drm/mipi-dsi: Fix byte order of 16-bit DCS set/get brightness drm: exynos: dsi: Fix MIPI_DSI*_NO_* mode flags drm/msm/dsi: Allow 2 CTRLs on v2.5.0 drm/msm: use strscpy instead of strncpy drm/msm/dpu: Add check for cstate drm/msm/dpu: Add check for pstates drm/msm/mdp5: Add check for kzalloc pinctrl: bcm2835: Remove of_node_put() in bcm2835_of_gpio_ranges_fallback() pinctrl: mediatek: fix coding style pinctrl: mediatek: Initialize variable pullen and pullup to zero pinctrl: mediatek: Initialize variable *buf to zero gpu: host1x: Don't skip assigning syncpoints to channels drm/tegra: firewall: Check for is_addr_reg existence in IMM check drm/msm/dpu: set pdpu->is_rt_pipe early in dpu_plane_sspp_atomic_update() drm/mediatek: dsi: Reduce the time of dsi from LP11 to sending cmd drm/mediatek: Use NULL instead of 0 for NULL pointer drm/mediatek: Drop unbalanced obj unref drm/mediatek: mtk_drm_crtc: Add checks for devm_kcalloc drm/mediatek: Clean dangling pointer on bind error path ASoC: soc-compress.c: fixup private_data on snd_soc_new_compress() gpio: vf610: connect GPIO label to dev name spi: dw_bt1: fix MUX_MMIO dependencies ASoC: mchp-spdifrx: fix controls which rely on rsr register ASoC: mchp-spdifrx: fix return value in case completion times out ASoC: mchp-spdifrx: fix controls that works with completion mechanism ASoC: mchp-spdifrx: disable all interrupts in mchp_spdifrx_dai_remove() ASoC: rsnd: fixup #endif position ASoC: mchp-spdifrx: Fix uninitialized use of mr in mchp_spdifrx_hw_params() ASoC: dt-bindings: meson: fix gx-card codec node regex hwmon: (ltc2945) Handle error case in ltc2945_value_store drm/amdgpu: fix enum odm_combine_mode mismatch scsi: mpt3sas: Fix a memory leak scsi: aic94xx: Add missing check for dma_map_single() HID: multitouch: Add quirks for flipped axes HID: retain initial quirks set up when creating HID devices ASoC: codecs: Change bulk clock voting to optional voting in digital codecs ASoC: codecs: rx-macro: move clk provider to managed variants ASoC: codecs: tx-macro: move clk provider to managed variants ASoC: codecs: rx-macro: move to individual clks from bulk ASoC: codecs: tx-macro: move to individual clks from bulk ASoC: codecs: lpass: fix incorrect mclk rate spi: bcm63xx-hsspi: Fix multi-bit mode setting hwmon: (mlxreg-fan) Return zero speed for broken fan ASoC: tlv320adcx140: fix 'ti,gpio-config' DT property init dm: remove flush_scheduled_work() during local_exit() NFSv4: keep state manager thread active if swap is enabled nfs4trace: fix state manager flag printing NFS: fix disabling of swap spi: synquacer: Fix timeout handling in synquacer_spi_transfer_one() ASoC: soc-dapm.h: fixup warning struct snd_pcm_substream not declared HID: bigben: use spinlock to protect concurrent accesses HID: bigben_worker() remove unneeded check on report_field HID: bigben: use spinlock to safely schedule workers hid: bigben_probe(): validate report count drm/shmem-helper: Fix locking for drm_gem_shmem_get_pages_sgt() nfsd: fix race to check ls_layouts cifs: Fix lost destroy smbd connection when MR allocate failed cifs: Fix warning and UAF when destroy the MR list gfs2: jdata writepage fix perf llvm: Fix inadvertent file creation leds: led-core: Fix refcount leak in of_led_get() perf inject: Use perf_data__read() for auxtrace perf intel-pt: Add documentation for Event Trace and TNT disable perf intel-pt: Add link to the perf wiki's Intel PT page perf intel-pt: Add support for emulated ptwrite perf intel-pt: Do not try to queue auxtrace data on pipe perf tools: Fix auto-complete on aarch64 sparc: allow PM configs for sparc32 COMPILE_TEST selftests/ftrace: Fix bash specific "==" operator printf: fix errname.c list objtool: add UACCESS exceptions for __tsan_volatile_read/write mfd: cs5535: Don't build on UML mfd: pcf50633-adc: Fix potential memleak in pcf50633_adc_async_read() dmaengine: idxd: Set traffic class values in GRPCFG on DSA 2.0 dmaengine: HISI_DMA should depend on ARCH_HISI iio: light: tsl2563: Do not hardcode interrupt trigger type usb: gadget: fusb300_udc: free irq on the error path in fusb300_probe() i2c: designware: fix i2c_dw_clk_rate() return size to be u32 soundwire: cadence: Don't overflow the command FIFOs driver core: fix potential null-ptr-deref in device_add() kobject: modify kobject_get_path() to take a const * kobject: Fix slab-out-of-bounds in fill_kobj_path() alpha/boot/tools/objstrip: fix the check for ELF header media: uvcvideo: Do not check for V4L2_CTRL_WHICH_DEF_VAL media: uvcvideo: Remove s_ctrl and g_ctrl media: uvcvideo: refactor __uvc_ctrl_add_mapping media: uvcvideo: Add support for V4L2_CTRL_TYPE_CTRL_CLASS media: uvcvideo: Use control names from framework media: uvcvideo: Check controls flags before accessing them media: uvcvideo: Check for INACTIVE in uvc_ctrl_is_accessible() coresight: etm4x: Fix accesses to TRCSEQRSTEVR and TRCSEQSTR coresight: cti: Prevent negative values of enable count coresight: cti: Add PM runtime call in enable_store ACPI: resource: Add helper function acpi_dev_get_memory_resources() usb: typec: intel_pmc_mux: Use the helper acpi_dev_get_memory_resources() usb: typec: intel_pmc_mux: Don't leak the ACPI device reference count PCI/IOV: Enlarge virtfn sysfs name buffer PCI: switchtec: Return -EFAULT for copy_to_user() errors tty: serial: fsl_lpuart: disable Rx/Tx DMA in lpuart32_shutdown() tty: serial: fsl_lpuart: clear LPUART Status Register in lpuart32_shutdown() serial: tegra: Add missing clk_disable_unprepare() in tegra_uart_hw_init() Revert "char: pcmcia: cm4000_cs: Replace mdelay with usleep_range in set_protocol" eeprom: idt_89hpesx: Fix error handling in idt_init() applicom: Fix PCI device refcount leak in applicom_init() firmware: stratix10-svc: add missing gen_pool_destroy() in stratix10_svc_drv_probe() VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF misc/mei/hdcp: Use correct macros to initialize uuid_le driver core: fix resource leak in device_add() drivers: base: transport_class: fix possible memory leak drivers: base: transport_class: fix resource leak when transport_add_device() fails firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle fotg210-udc: Add missing completion handler dmaengine: dw-edma: Fix missing src/dst address of interleaved xfers usb: early: xhci-dbc: Fix a potential out-of-bound memory access tty: serial: fsl_lpuart: Fix the wrong RXWATER setting for rx dma case RDMA/cxgb4: add null-ptr-check after ip_dev_find() usb: musb: mediatek: don't unregister something that wasn't registered usb: gadget: configfs: use to_config_usb_cfg() in os_desc_link() usb: gadget: configfs: use to_usb_function_instance() in cfg (un)link func usb: gadget: configfs: remove using list iterator after loop body as a ptr usb: gadget: configfs: Restrict symlink creation is UDC already binded iommu/vt-d: Set No Execute Enable bit in PASID table entry power: supply: remove faulty cooling logic RDMA/cxgb4: Fix potential null-ptr-deref in pass_establish() usb: max-3421: Fix setting of I/O pins RDMA/irdma: Cap MSIX used to online CPUs + 1 serial: fsl_lpuart: fix RS485 RTS polariy inverse issue tty: serial: imx: Handle RS485 DE signal active high tty: serial: imx: disable Ageing Timer interrupt request irq dmaengine: dw-edma: Fix readq_ch() return value truncation phy: rockchip-typec: fix tcphy_get_mode error case iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry() iommu: Fix error unwind in iommu_group_alloc() dmaengine: sf-pdma: pdma_desc memory leak fix dmaengine: dw-axi-dmac: Do not dereference NULL structure iommu/vt-d: Fix error handling in sva enable/disable paths iommu/vt-d: Remove duplicate identity domain flag iommu/vt-d: Check FL and SL capability sanity in scalable mode iommu/vt-d: Use second level for GPA->HPA translation iommu/vt-d: Allow to use flush-queue when first level is default IB/hfi1: Fix math bugs in hfi1_can_pin_pages() IB/hfi1: Fix sdma.h tx->num_descs off-by-one errors remoteproc: qcom_q6v5_mss: Use a carveout to authenticate modem headers media: ti: cal: fix possible memory leak in cal_ctx_create() media: platform: ti: Add missing check for devm_regulator_get powerpc: Remove linker flag from KBUILD_AFLAGS s390/vdso: remove -nostdlib compiler flag s390/vdso: Drop '-shared' from KBUILD_CFLAGS_64 builddeb: clean generated package content media: max9286: Fix memleak in max9286_v4l2_register() media: ov2740: Fix memleak in ov2740_init_controls() media: ov5675: Fix memleak in ov5675_init_controls() media: i2c: ov772x: Fix memleak in ov772x_probe() media: i2c: imx219: Split common registers from mode tables media: i2c: imx219: Fix binning for RAW8 capture media: v4l2-jpeg: correct the skip count in jpeg_parse_app14_data media: v4l2-jpeg: ignore the unknown APP14 marker media: imx-jpeg: Apply clk_bulk api instead of operating specific clk media: rc: Fix use-after-free bugs caused by ene_tx_irqsim() media: i2c: ov7670: 0 instead of -EINVAL was returned media: usb: siano: Fix use after free bugs caused by do_submit_urb media: saa7134: Use video_unregister_device for radio_dev rpmsg: glink: Avoid infinite loop on intent for missing channel udf: Define EFSCORRUPTED error code ARM: dts: exynos: Use Exynos5420 compatible for the MIPI video phy blk-iocost: fix divide by 0 error in calc_lcoefs() trace/blktrace: fix memory leak with using debugfs_lookup() wifi: ath9k: Fix use-after-free in ath9k_hif_usb_disconnect() wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() rcu: Make RCU_LOCKDEP_WARN() avoid early lockdep checks rcu: Suppress smp_processor_id() complaint in synchronize_rcu_expedited_wait() rcu-tasks: Make rude RCU-Tasks work well with CPU hotplug wifi: ath11k: debugfs: fix to work with multiple PCI devices thermal: intel: Fix unsigned comparison with less than zero timers: Prevent union confusion from unexpected restart_syscall() x86/bugs: Reset speculation control settings on init wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds wifi: mt7601u: fix an integer underflow inet: fix fast path in __inet_hash_connect() ice: restrict PTP HW clock freq adjustments to 100, 000, 000 PPB ice: add missing checks for PF vsi type ACPI: Don't build ACPICA with '-Os' thermal: intel: intel_pch: Add support for Wellsburg PCH clocksource: Suspend the watchdog temporarily when high read latency detected crypto: hisilicon: Wipe entire pool on error net: bcmgenet: Add a check for oversized packets m68k: Check syscall_trace_enter() return code netfilter: nf_tables: NULL pointer dereference in nf_tables_updobj() tools/power/x86/intel-speed-select: Add Emerald Rapid quirk wifi: mt76: dma: free rx_head in mt76_dma_rx_cleanup ACPI: video: Fix Lenovo Ideapad Z570 DMI match net/mlx5: fw_tracer: Fix debug print coda: Avoid partial allocation of sig_inputArgs uaccess: Add minimum bounds check on kernel buffer size s390/idle: mark arch_cpu_idle() noinstr time/debug: Fix memory leak with using debugfs_lookup() PM: domains: fix memory leak with using debugfs_lookup() PM: EM: fix memory leak with using debugfs_lookup() Bluetooth: btusb: Add VID:PID 13d3:3529 for Realtek RTL8821CE hv_netvsc: Check status in SEND_RNDIS_PKT completion message scm: add user copy checks to put_cmsg() drm/amd/display: Revert Reduce delay when sink device not able to ACK 00340h write drm/amd/display: Fix potential null-deref in dm_resume drm/omap: dsi: Fix excessive stack usage HID: Add Mapping for System Microphone Mute drm/tiny: ili9486: Do not assume 8-bit only SPI controllers drm/radeon: free iio for atombios when driver shutdown scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write Revert "fbcon: don't lose the console font across generic->chip driver switch" drm: amd: display: Fix memory leakage drm/msm/dsi: Add missing check for alloc_ordered_workqueue docs/scripts/gdb: add necessary make scripts_gdb step ASoC: soc-compress: Reposition and add pcm_mutex ASoC: kirkwood: Iterate over array indexes instead of using pointer math regulator: max77802: Bounds check regulator id against opmode regulator: s5m8767: Bounds check id indexing into arrays gfs2: Improve gfs2_make_fs_rw error handling hwmon: (coretemp) Simplify platform device handling pinctrl: at91: use devm_kasprintf() to avoid potential leaks scsi: snic: Fix memory leak with using debugfs_lookup() HID: logitech-hidpp: Don't restart communication if not necessary drm: panel-orientation-quirks: Add quirk for Lenovo IdeaPad Duet 3 10IGL5 dm thin: add cond_resched() to various workqueue loops dm cache: add cond_resched() to various workqueue loops nfsd: zero out pointers after putting nfsd_files on COPY setup error drm/shmem-helper: Revert accidental non-GPL export wifi: rtl8xxxu: fixing transmisison failure for rtl8192eu firmware: coreboot: framebuffer: Ignore reserved pixel color bits block: don't allow multiple bios for IOCB_NOWAIT issue rtc: pm8xxx: fix set-alarm race ipmi:ssif: resend_msg() cannot fail ipmi_ssif: Rename idle state and check s390/extmem: return correct segment type in __segment_load() s390: discard .interp section s390/kprobes: fix irq mask clobbering on kprobe reenter from post_handler s390/kprobes: fix current_kprobe never cleared after kprobes reenter cifs: Fix uninitialized memory read in smb3_qfs_tcon() btrfs: hold block group refcount during async discard locking/rwsem: Prevent non-first waiter from spinning in down_write() slowpath ksmbd: fix wrong data area length for smb2 lock request ksmbd: do not allow the actual frame length to be smaller than the rfc1002 length ARM: dts: exynos: correct HDMI phy compatible in Exynos4 hfs: fix missing hfs_bnode_get() in __hfs_bnode_create fs: hfsplus: fix UAF issue in hfsplus_put_super exfat: fix reporting fs error when reading dir beyond EOF exfat: fix unexpected EOF while reading dir exfat: redefine DIR_DELETED as the bad cluster number exfat: fix inode->i_blocks for non-512 byte sector size device fs: dlm: don't set stop rx flag after node reset fs: dlm: move sending fin message into state change handling fs: dlm: send FIN ack back in right cases f2fs: fix information leak in f2fs_move_inline_dirents() f2fs: fix cgroup writeback accounting with fs-layer encryption ocfs2: fix defrag path triggering jbd2 ASSERT ocfs2: fix non-auto defrag path not working issue selftests/landlock: Skip overlayfs tests when not supported selftests/landlock: Test ptrace as much as possible with Yama udf: Truncate added extents on failed expansion udf: Do not bother merging very long extents udf: Do not update file length for failed writes to inline files udf: Preserve link count of system files udf: Detect system inodes linked into directory hierarchy udf: Fix file corruption when appending just after end of preallocated extent RDMA/siw: Fix user page pinning accounting KVM: Destroy target device if coalesced MMIO unregistration fails KVM: x86: Inject #GP if WRMSR sets reserved bits in APIC Self-IPI KVM: SVM: Fix potential overflow in SEV's send|receive_update_data() KVM: SVM: hyper-v: placate modpost section mismatch error KVM: s390: disable migration mode when dirty tracking is disabled x86/virt: Force GIF=1 prior to disabling SVM (for reboot flows) x86/crash: Disable virt in core NMI crash handler to avoid double shootdown x86/reboot: Disable virtualization in an emergency if SVM is supported x86/reboot: Disable SVM, not just VMX, when stopping CPUs x86/kprobes: Fix __recover_optprobed_insn check optimizing logic x86/kprobes: Fix arch_check_optimized_kprobe check within optimized_kprobe range x86/microcode/amd: Remove load_microcode_amd()'s bsp parameter x86/microcode/AMD: Add a @cpu parameter to the reloading functions x86/microcode/AMD: Fix mixed steppings support x86/speculation: Allow enabling STIBP with legacy IBRS Documentation/hw-vuln: Document the interaction between IBRS and STIBP brd: return 0/-error from brd_insert_page() ima: Align ima_file_mmap() parameters with mmap_file LSM hook irqdomain: Fix association race irqdomain: Fix disassociation race irqdomain: Look for existing mapping only once irqdomain: Drop bogus fwspec-mapping error handling irqdomain: Fix domain registration race crypto: qat - fix out-of-bounds read io_uring: handle TIF_NOTIFY_RESUME when checking for task_work io_uring: mark task TASK_RUNNING before handling resume/task work io_uring: add a conditional reschedule to the IOPOLL cancelation loop io_uring/rsrc: disallow multi-source reg buffers io_uring: remove MSG_NOSIGNAL from recvmsg io_uring/poll: allow some retries for poll triggering spuriously ALSA: ice1712: Do not left ice->gpio_mutex locked in aureon_add_controls() ALSA: hda/realtek: Add quirk for HP EliteDesk 800 G6 Tower PC jbd2: fix data missing when reusing bh which is ready to be checkpointed ext4: optimize ea_inode block expansion ext4: refuse to create ea block when umounted mtd: spi-nor: sfdp: Fix index value for SCCR dwords mtd: spi-nor: spansion: Consider reserved bits in CFR5 register mtd: spi-nor: Fix shift-out-of-bounds in spi_nor_set_erase_type dm: send just one event on resize, not two dm: add cond_resched() to dm_wq_work() wifi: rtl8xxxu: Use a longer retry limit of 48 wifi: ath11k: allow system suspend to survive ath11k wifi: cfg80211: Fix use after free for wext qede: fix interrupt coalescing configuration thermal: intel: powerclamp: Fix cur_state for multi package system dm flakey: fix logic when corrupting a bio dm flakey: don't corrupt the zero page dm flakey: fix a bug with 32-bit highmem systems ARM: dts: qcom: sdx55: Add Qcom SMMU-500 as the fallback for IOMMU node ARM: dts: exynos: correct TMU phandle in Exynos4210 ARM: dts: exynos: correct TMU phandle in Exynos4 ARM: dts: exynos: correct TMU phandle in Odroid XU3 family ARM: dts: exynos: correct TMU phandle in Exynos5250 ARM: dts: exynos: correct TMU phandle in Odroid XU ARM: dts: exynos: correct TMU phandle in Odroid HC1 fuse: add inode/permission checks to fileattr_get/fileattr_set rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails ceph: update the time stamps and try to drop the suid/sgid alpha: fix FEN fault handling dax/kmem: Fix leak of memory-hotplug resources mips: fix syscall_get_nr media: ipu3-cio2: Fix PM runtime usage_count in driver unbind remoteproc/mtk_scp: Move clk ops outside send_lock docs: gdbmacros: print newest record mm: memcontrol: deprecate charge moving mm/thp: check and bail out if page in deferred queue already ktest.pl: Give back console on Ctrt^C on monitor ktest.pl: Fix missing "end_monitor" when machine check fails ktest.pl: Add RUN_TIMEOUT option with default unlimited ring-buffer: Handle race between rb_move_tail and rb_check_pages tools/bootconfig: fix single & used for logical condition scsi: qla2xxx: Fix link failure in NPIV environment scsi: qla2xxx: Check if port is online before sending ELS scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests scsi: qla2xxx: Remove unintended flag clearing scsi: qla2xxx: Fix erroneous link down scsi: qla2xxx: Remove increment of interface err cnt scsi: ses: Don't attach if enclosure has no components scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process() scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses scsi: ses: Fix possible desc_ptr out-of-bounds accesses scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() RISC-V: add a spin_shadow_stack declaration riscv: mm: fix regression due to update_mmu_cache change riscv: jump_label: Fixup unaligned arch_static_branch function riscv, mm: Perform BPF exhandler fixup on page fault riscv: ftrace: Remove wasted nops for !RISCV_ISA_C riscv: ftrace: Reduce the detour code size to half MIPS: DTS: CI20: fix otg power gpio PCI/PM: Observe reset delay irrespective of bridge_d3 PCI: hotplug: Allow marking devices as disconnected during bind/unbind PCI: Avoid FLR for AMD FCH AHCI adapters iommu/vt-d: Avoid superfluous IOTLB tracking in lazy mode vfio/type1: prevent underflow of locked_vm via exec() vfio/type1: track locked_vm per dma vfio/type1: restore locked_vm drm/i915/quirks: Add inverted backlight quirk for HP 14-r206nv drm/radeon: Fix eDP for single-display iMac11,2 drm/i915: Don't use BAR mappings for ring buffers with LLC drm/edid: fix AVI infoframe aspect ratio handling perf intel-pt: pkt-decoder: Add CFE and EVD packets qede: avoid uninitialized entries in coal_entry array media: uvcvideo: Fix memory leak of object map on error exit path iommu/vt-d: Fix an unbalanced rcu_read_lock/rcu_read_unlock() arm64: dts: qcom: ipq8074: fix Gen2 PCIe QMP PHY wifi: ath9k: use proper statements in conditionals kbuild: Port silent mode detection to future gnu make. Linux 5.15.99 Change-Id: I52781008c0a83946c09698b9b5625a5f7ee2e545 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-03-17 13:35:31 +00:00
Wang Hai	89a0079049	kobject: Fix slab-out-of-bounds in fill_kobj_path() ... [ Upstream commit 3bb2a01caa ] In kobject_get_path(), if kobj->name is changed between calls get_kobj_path_length() and fill_kobj_path() and the length becomes longer, then fill_kobj_path() will have an out-of-bounds bug. The actual current problem occurs when the ixgbe probe. In ixgbe_mii_bus_init(), if the length of netdev->dev.kobj.name length becomes longer, out-of-bounds will occur. cpu0 cpu1 ixgbe_probe register_netdev(netdev) netdev_register_kobject device_add kobject_uevent // Sending ADD events systemd-udevd // rename netdev dev_change_name device_rename kobject_rename ixgbe_mii_bus_init | mdiobus_register | __mdiobus_register | device_register | device_add | kobject_uevent | kobject_get_path | len = get_kobj_path_length // old name | path = kzalloc(len, gfp_mask); | kobj->name = name; /* name length becomes * longer */ fill_kobj_path /* kobj path length is * longer than path, * resulting in out of * bounds when filling path */ This is the kasan report: ================================================================== BUG: KASAN: slab-out-of-bounds in fill_kobj_path+0x50/0xc0 Write of size 7 at addr ff1100090573d1fd by task kworker/28:1/673 Workqueue: events work_for_cpu_fn Call Trace: <TASK> dump_stack_lvl+0x34/0x48 print_address_description.constprop.0+0x86/0x1e7 print_report+0x36/0x4f kasan_report+0xad/0x130 kasan_check_range+0x35/0x1c0 memcpy+0x39/0x60 fill_kobj_path+0x50/0xc0 kobject_get_path+0x5a/0xc0 kobject_uevent_env+0x140/0x460 device_add+0x5c7/0x910 __mdiobus_register+0x14e/0x490 ixgbe_probe.cold+0x441/0x574 [ixgbe] local_pci_probe+0x78/0xc0 work_for_cpu_fn+0x26/0x40 process_one_work+0x3b6/0x6a0 worker_thread+0x368/0x520 kthread+0x165/0x1a0 ret_from_fork+0x1f/0x30 This reproducer triggers that bug: while: do rmmod ixgbe sleep 0.5 modprobe ixgbe sleep 0.5 When calling fill_kobj_path() to fill path, if the name length of kobj becomes longer, return failure and retry. This fixes the problem. Fixes: 1da177e4c3 ("Linux-2.6.12-rc2") Signed-off-by: Wang Hai <wanghai38@huawei.com> Link: https://lore.kernel.org/r/20221220012143.52141-1-wanghai38@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-03-10 09:39:35 +01:00
Greg Kroah-Hartman	e8bfba508c	kobject: modify kobject_get_path() to take a const * ... [ Upstream commit 33a0a1e3b3 ] kobject_get_path() does not modify the kobject passed to it, so make the pointer constant. Cc: "Rafael J. Wysocki" <rafael@kernel.org> Link: https://lore.kernel.org/r/20221001165315.2690141-1-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Stable-dep-of: 3bb2a01caa ("kobject: Fix slab-out-of-bounds in fill_kobj_path()") Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-03-10 09:39:35 +01:00
Arnd Bergmann	1ca4adf2e0	printf: fix errname.c list ... [ Upstream commit 0c2baf6509 ] On most architectures, gcc -Wextra warns about the list of error numbers containing both EDEADLK and EDEADLOCK: lib/errname.c:15:67: warning: initialized field overwritten [-Woverride-init] 15 | #define E(err) [err + BUILD_BUG_ON_ZERO(err <= 0 || err > 300)] = "-" #err | ^~~ lib/errname.c:172:2: note: in expansion of macro 'E' 172 | E(EDEADLK), /* EDEADLOCK */ | ^ On parisc, a similar error happens with -ECANCELLED, which is an alias for ECANCELED. Make the EDEADLK printing conditional on the number being distinct from EDEADLOCK, and remove the -ECANCELLED bit completely as it can never be hit. To ensure these are correct, add static_assert lines that verify all the remaining aliases are in fact identical to the canonical name. Fixes: 57f5677e53 ("printf: add support for printing symbolic error names") Cc: Petr Mladek <pmladek@suse.com> Suggested-by: Rasmus Villemoes <linux@rasmusvillemoes.dk> Acked-by: Uwe Kleine-König <uwe@kleine-koenig.org> Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com> Link: https://lore.kernel.org/all/20210514213456.745039-1-arnd@kernel.org/ Link: https://lore.kernel.org/all/20210927123409.1109737-1-arnd@kernel.org/ Signed-off-by: Arnd Bergmann <arnd@arndb.de> Reviewed-by: Sergey Senozhatsky <senozhatsky@chromium.org> Acked-by: Rasmus Villemoes <linux@rasmusvillemoes.dk> Reviewed-by: Petr Mladek <pmladek@suse.com> Signed-off-by: Petr Mladek <pmladek@suse.com> Link: https://lore.kernel.org/r/20230206194126.380350-1-arnd@kernel.org Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-03-10 09:39:33 +01:00
Herbert Xu	9ae0f82aa7	lib/mpi: Fix buffer overrun when SG is too long ... [ Upstream commit 7361d1bc30 ] The helper mpi_read_raw_from_sgl sets the number of entries in the SG list according to nbytes. However, if the last entry in the SG list contains more data than nbytes, then it may overrun the buffer because it only allocates enough memory for nbytes. Fixes: 2d4d1eea54 ("lib/mpi: Add mpi sgl helpers") Reported-by: Roberto Sassu <roberto.sassu@huaweicloud.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Reviewed-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-03-10 09:39:09 +01:00
Greg Kroah-Hartman	cec20c29af	Merge 5.15.96 into android14-5.15 ... Changes in 5.15.96 drm/etnaviv: don't truncate physical page address wifi: rtl8xxxu: gen2: Turn on the rate control drm/edid: Fix minimum bpc supported with DSC1.2 for HDMI sink clk: mxl: Switch from direct readl/writel based IO to regmap based IO clk: mxl: Remove redundant spinlocks clk: mxl: Add option to override gate clks clk: mxl: Fix a clk entry by adding relevant flags powerpc: dts: t208x: Mark MAC1 and MAC2 as 10G clk: mxl: syscon_node_to_regmap() returns error pointers random: always mix cycle counter in add_latent_entropy() KVM: x86: Fail emulation during EMULTYPE_SKIP on any exception KVM: SVM: Skip WRMSR fastpath on VM-Exit if next RIP isn't valid KVM: VMX: Execute IBPB on emulated VM-exit when guest has IBRS can: kvaser_usb: hydra: help gcc-13 to figure out cmd_len powerpc: dts: t208x: Disable 10G on MAC1 and MAC2 powerpc: use generic version of arch_is_kernel_initmem_freed() powerpc/vmlinux.lds: Ensure STRICT_ALIGN_SIZE is at least page aligned powerpc/vmlinux.lds: Add an explicit symbol for the SRWX boundary powerpc/64s/radix: Fix crash with unaligned relocated kernel powerpc/64s/radix: Fix RWX mapping with relocated kernel drm/i915/gvt: fix double free bug in split_2MB_gtt_entry uaccess: Add speculation barrier to copy_from_user() binder: read pre-translated fds from sender buffer binder: defer copies of pre-patched txn data binder: fix pointer cast warning binder: Address corner cases in deferred copy and fixup binder: Gracefully handle BINDER_TYPE_FDA objects with num_fds=0 nbd: fix possible overflow on 'first_minor' in nbd_dev_add() wifi: mwifiex: Add missing compatible string for SD8787 audit: update the mailing list in MAINTAINERS ext4: Fix function prototype mismatch for ext4_feat_ktype kbuild: Add CONFIG_PAHOLE_VERSION scripts/pahole-flags.sh: Use pahole-version.sh lib/Kconfig.debug: Use CONFIG_PAHOLE_VERSION lib/Kconfig.debug: Allow BTF + DWARF5 with pahole 1.21+ Revert "net/sched: taprio: make qdisc_leaf() see the per-netdev-queue pfifo child qdiscs" bpf: add missing header file include Linux 5.15.96 Change-Id: Ifd0d066cee65d011049ee351d1307317d65135ea Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-02-25 15:44:31 +00:00
Nathan Chancellor	0c168d7f36	lib/Kconfig.debug: Allow BTF + DWARF5 with pahole 1.21+ ... commit 42d9b379e3 upstream. Commit 98cd6f521f ("Kconfig: allow explicit opt in to DWARF v5") prevented CONFIG_DEBUG_INFO_DWARF5 from being selected when CONFIG_DEBUG_INFO_BTF is enabled because pahole had issues with clang's DWARF5 info. This was resolved by [1], which is in pahole v1.21. Allow DEBUG_INFO_DWARF5 to be selected with DEBUG_INFO_BTF when using pahole v1.21 or newer. [1]: https://git.kernel.org/pub/scm/devel/pahole/pahole.git/commit/?id=7d8e829f636f47aba2e1b6eda57e74d8e31f733c Signed-off-by: Nathan Chancellor <nathan@kernel.org> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Andrii Nakryiko <andrii@kernel.org> Link: https://lore.kernel.org/bpf/20220201205624.652313-6-nathan@kernel.org Signed-off-by: Matthias Maennich <maennich@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-02-25 12:06:46 +01:00
Nathan Chancellor	6ba3de5a8a	lib/Kconfig.debug: Use CONFIG_PAHOLE_VERSION ... commit 6323c81350 upstream. Now that CONFIG_PAHOLE_VERSION exists, use it in the definition of CONFIG_PAHOLE_HAS_SPLIT_BTF and CONFIG_PAHOLE_HAS_BTF_TAG to reduce the amount of duplication across the tree. Signed-off-by: Nathan Chancellor <nathan@kernel.org> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Andrii Nakryiko <andrii@kernel.org> Link: https://lore.kernel.org/bpf/20220201205624.652313-5-nathan@kernel.org [maennich: omitted patching non-existing config PAHOLE_HAS_BTF_TAG] Signed-off-by: Matthias Maennich <maennich@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-02-25 12:06:46 +01:00
Dave Hansen	41d8b591d7	uaccess: Add speculation barrier to copy_from_user() ... commit 74e19ef0ff upstream. The results of "access_ok()" can be mis-speculated. The result is that you can end speculatively: if (access_ok(from, size)) // Right here even for bad from/size combinations. On first glance, it would be ideal to just add a speculation barrier to "access_ok()" so that its results can never be mis-speculated. But there are lots of system calls just doing access_ok() via "copy_to_user()" and friends (example: fstat() and friends). Those are generally not problematic because they do not _consume_ data from userspace other than the pointer. They are also very quick and common system calls that should not be needlessly slowed down. "copy_from_user()" on the other hand uses a user-controller pointer and is frequently followed up with code that might affect caches. Take something like this: if (!copy_from_user(&kernelvar, uptr, size)) do_something_with(kernelvar); If userspace passes in an evil 'uptr' that *actually* points to a kernel addresses, and then do_something_with() has cache (or other) side-effects, it could allow userspace to infer kernel data values. Add a barrier to the common copy_from_user() code to prevent mis-speculated values which happen after the copy. Also add a stub for architectures that do not define barrier_nospec(). This makes the macro usable in generic code. Since the barrier is now usable in generic code, the x86 #ifdef in the BPF code can also go away. Reported-by: Jordy Zomer <jordyzomer@google.com> Suggested-by: Linus Torvalds <torvalds@linuxfoundation.org> Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com> Reviewed-by: Thomas Gleixner <tglx@linutronix.de> Acked-by: Daniel Borkmann <daniel@iogearbox.net> # BPF bits Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-02-25 12:06:44 +01:00
Greg Kroah-Hartman	e3d8fe0993	Merge 5.15.91 into android14-5.15 ... Changes in 5.15.91 memory: tegra: Remove clients SID override programming memory: atmel-sdramc: Fix missing clk_disable_unprepare in atmel_ramc_probe() memory: mvebu-devbus: Fix missing clk_disable_unprepare in mvebu_devbus_probe() dmaengine: ti: k3-udma: Do conditional decrement of UDMA_CHAN_RT_PEER_BCNT_REG arm64: dts: imx8mp-phycore-som: Remove invalid PMIC property ARM: dts: imx6ul-pico-dwarf: Use 'clock-frequency' ARM: dts: imx7d-pico: Use 'clock-frequency' ARM: dts: imx6qdl-gw560x: Remove incorrect 'uart-has-rtscts' arm64: dts: imx8mm-beacon: Fix ecspi2 pinmux ARM: imx: add missing of_node_put() HID: intel_ish-hid: Add check for ishtp_dma_tx_map arm64: dts: imx8mm-venice-gw7901: fix USB2 controller OC polarity soc: imx8m: Fix incorrect check for of_clk_get_by_name() reset: uniphier-glue: Use reset_control_bulk API reset: uniphier-glue: Fix possible null-ptr-deref EDAC/highbank: Fix memory leak in highbank_mc_probe() firmware: arm_scmi: Harden shared memory access in fetch_response firmware: arm_scmi: Harden shared memory access in fetch_notification tomoyo: fix broken dependency on *.conf.default RDMA/core: Fix ib block iterator counter overflow IB/hfi1: Reject a zero-length user expected buffer IB/hfi1: Reserve user expected TIDs IB/hfi1: Fix expected receive setup error exit issues IB/hfi1: Immediately remove invalid memory from hardware IB/hfi1: Remove user expected buffer invalidate race affs: initialize fsdata in affs_truncate() PM: AVS: qcom-cpr: Fix an error handling path in cpr_probe() arm64: dts: qcom: msm8992: Don't use sfpb mutex arm64: dts: qcom: msm8992-libra: Add CPU regulators arm64: dts: qcom: msm8992-libra: Fix the memory map phy: ti: fix Kconfig warning and operator precedence NFSD: fix use-after-free in nfsd4_ssc_setup_dul() ARM: dts: at91: sam9x60: fix the ddr clock for sam9x60 amd-xgbe: TX Flow Ctrl Registers are h/w ver dependent amd-xgbe: Delay AN timeout during KR training bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation phy: rockchip-inno-usb2: Fix missing clk_disable_unprepare() in rockchip_usb2phy_power_on() net: nfc: Fix use-after-free in local_cleanup() net: wan: Add checks for NULL for utdm in undo_uhdlc_init and unmap_si_regs net: enetc: avoid deadlock in enetc_tx_onestep_tstamp() sch_htb: Avoid grafting on htb_destroy_class_offload when destroying htb gpio: use raw spinlock for gpio chip shadowed data gpio: mxc: Protect GPIO irqchip RMW with bgpio spinlock gpio: mxc: Always set GPIOs used as interrupt source to INPUT mode wifi: rndis_wlan: Prevent buffer overflow in rndis_query_oid pinctrl/rockchip: Use temporary variable for struct device pinctrl/rockchip: add error handling for pull/drive register getters pinctrl: rockchip: fix reading pull type on rk3568 net: stmmac: Fix queue statistics reading net/sched: sch_taprio: fix possible use-after-free l2tp: Serialize access to sk_user_data with sk_callback_lock l2tp: Don't sleep and disable BH under writer-side sk_callback_lock l2tp: convert l2tp_tunnel_list to idr l2tp: close all race conditions in l2tp_tunnel_register() octeontx2-pf: Avoid use of GFP_KERNEL in atomic context net: usb: sr9700: Handle negative len net: mdio: validate parameter addr in mdiobus_get_phy() HID: check empty report_list in hid_validate_values() HID: check empty report_list in bigben_probe() net: stmmac: fix invalid call to mdiobus_get_phy() pinctrl: rockchip: fix mux route data for rk3568 HID: revert CHERRY_MOUSE_000C quirk usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait usb: gadget: f_fs: Ensure ep0req is dequeued before free_request Bluetooth: Fix possible deadlock in rfcomm_sk_state_change net: ipa: disable ipa interrupt during suspend net/mlx5: E-switch, Fix setting of reserved fields on MODIFY_SCHEDULING_ELEMENT net: mlx5: eliminate anonymous module_init & module_exit drm/panfrost: fix GENERIC_ATOMIC64 dependency dmaengine: Fix double increment of client_count in dma_chan_get() net: macb: fix PTP TX timestamp failure due to packet padding virtio-net: correctly enable callback during start_xmit l2tp: prevent lockdep issue in l2tp_tunnel_register() HID: betop: check shape of output reports cifs: fix potential deadlock in cache_refresh_path() dmaengine: xilinx_dma: call of_node_put() when breaking out of for_each_child_of_node() phy: phy-can-transceiver: Skip warning if no "max-bitrate" drm/amd/display: fix issues with driver unload nvme-pci: fix timeout request state check tcp: avoid the lookup process failing to get sk in ehash table octeontx2-pf: Fix the use of GFP_KERNEL in atomic context on rt ptdma: pt_core_execute_cmd() should use spinlock device property: fix of node refcount leak in fwnode_graph_get_next_endpoint() w1: fix deadloop in __w1_remove_master_device() w1: fix WARNING after calling w1_process() driver core: Fix test_async_probe_init saves device in wrong array selftests/net: toeplitz: fix race on tpacket_v3 block close net: dsa: microchip: ksz9477: port map correction in ALU table entry register thermal/core: Remove duplicate information when an error occurs thermal/core: Rename 'trips' to 'num_trips' thermal: Validate new state in cur_state_store() thermal/core: fix error code in __thermal_cooling_device_register() thermal: core: call put_device() only after device_register() fails net: stmmac: enable all safety features by default tcp: fix rate_app_limited to default to 1 scsi: iscsi: Fix multiple iSCSI session unbind events sent to userspace cpufreq: Add Tegra234 to cpufreq-dt-platdev blocklist kcsan: test: don't put the expect array on the stack cpufreq: Add SM6375 to cpufreq-dt-platdev blocklist ASoC: fsl_micfil: Correct the number of steps on SX controls net: usb: cdc_ether: add support for Thales Cinterion PLS62-W modem drm: Add orientation quirk for Lenovo ideapad D330-10IGL s390/debug: add _ASM_S390_ prefix to header guard s390: expicitly align _edata and _end symbols on page boundary perf/x86/msr: Add Emerald Rapids perf/x86/intel/uncore: Add Emerald Rapids cpufreq: armada-37xx: stop using 0 as NULL pointer ASoC: fsl_ssi: Rename AC'97 streams to avoid collisions with AC'97 CODEC ASoC: fsl-asoc-card: Fix naming of AC'97 CODEC widgets spi: spidev: remove debug messages that access spidev->spi without locking KVM: s390: interrupt: use READ_ONCE() before cmpxchg() scsi: hisi_sas: Set a port invalid only if there are no devices attached when refreshing port id r8152: add vendor/device ID pair for Microsoft Devkit platform/x86: touchscreen_dmi: Add info for the CSL Panther Tab HD platform/x86: asus-nb-wmi: Add alternate mapping for KEY_SCREENLOCK lockref: stop doing cpu_relax in the cmpxchg loop firmware: coreboot: Check size of table entry and use flex-array drm/i915: Allow switching away via vga-switcheroo if uninitialized Revert "selftests/bpf: check null propagation only neither reg is PTR_TO_BTF_ID" drm/i915: Remove unused variable x86: ACPI: cstate: Optimize C3 entry on AMD CPUs fs: reiserfs: remove useless new_opts in reiserfs_remount sysctl: add a new register_sysctl_init() interface kernel/panic: move panic sysctls to its own file panic: unset panic_on_warn inside panic() ubsan: no need to unset panic_on_warn in ubsan_epilogue() kasan: no need to unset panic_on_warn in end_report() exit: Add and use make_task_dead. objtool: Add a missing comma to avoid string concatenation hexagon: Fix function name in die() h8300: Fix build errors from do_exit() to make_task_dead() transition csky: Fix function name in csky_alignment() and die() ia64: make IA64_MCA_RECOVERY bool instead of tristate panic: Separate sysctl logic from CONFIG_SMP exit: Put an upper limit on how often we can oops exit: Expose "oops_count" to sysfs exit: Allow oops_limit to be disabled panic: Consolidate open-coded panic_on_warn checks panic: Introduce warn_limit panic: Expose "warn_count" to sysfs docs: Fix path paste-o for /sys/kernel/warn_count exit: Use READ_ONCE() for all oops/warn limit reads Bluetooth: hci_sync: cancel cmd_timer if hci_open failed drm/amdgpu: complete gfxoff allow signal during suspend without delay scsi: hpsa: Fix allocation size for scsi_host_alloc() KVM: SVM: fix tsc scaling cache logic module: Don't wait for GOING modules tracing: Make sure trace_printk() can output as soon as it can be used trace_events_hist: add check for return value of 'create_hist_field' ftrace/scripts: Update the instructions for ftrace-bisect.sh cifs: Fix oops due to uncleared server->smbd_conn in reconnect i2c: mv64xxx: Remove shutdown method from driver i2c: mv64xxx: Add atomic_xfer method to driver ksmbd: add smbd max io size parameter ksmbd: add max connections parameter ksmbd: do not sign response to session request for guest login ksmbd: downgrade ndr version error message to debug ksmbd: limit pdu length size according to connection status ovl: fail on invalid uid/gid mapping at copy up KVM: x86/vmx: Do not skip segment attributes if unusable bit is set KVM: arm64: GICv4.1: Fix race with doorbell on VPE activation/deactivation thermal: intel: int340x: Protect trip temperature from concurrent updates ipv6: fix reachability confirmation with proxy_ndp ARM: 9280/1: mm: fix warning on phys_addr_t to void pointer assignment EDAC/device: Respect any driver-supplied workqueue polling value EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info's pvt_info net: mana: Fix IRQ name - add PCI and queue number scsi: ufs: core: Fix devfreq deadlocks i2c: designware: use casting of u64 in clock multiplication to avoid overflow netlink: prevent potential spectre v1 gadgets net: fix UaF in netns ops registration error path drm/i915/selftest: fix intel_selftest_modify_policy argument types netfilter: nft_set_rbtree: Switch to node list walk for overlap detection netfilter: nft_set_rbtree: skip elements in transaction from garbage collection netlink: annotate data races around nlk->portid netlink: annotate data races around dst_portid and dst_group netlink: annotate data races around sk_state ipv4: prevent potential spectre v1 gadget in ip_metrics_convert() ipv4: prevent potential spectre v1 gadget in fib_metrics_match() netfilter: conntrack: fix vtag checks for ABORT/SHUTDOWN_COMPLETE netrom: Fix use-after-free of a listening socket. net/sched: sch_taprio: do not schedule in taprio_reset() sctp: fail if no bound addresses can be used for a given scope riscv/kprobe: Fix instruction simulation of JALR nvme: fix passthrough csi check gpio: mxc: Unlock on error path in mxc_flip_edge() ravb: Rename "no_ptp_cfg_active" and "ptp_cfg_active" variables net: ravb: Fix lack of register setting after system resumed for Gen3 net: ravb: Fix possible hang if RIS2_QFF1 happen net: mctp: mark socks as dead on unhash, prevent re-add thermal: intel: int340x: Add locking to int340x_thermal_get_trip_type() net/tg3: resolve deadlock in tg3_reset_task() during EEH net: mdio-mux-meson-g12a: force internal PHY off on mux switch treewide: fix up files incorrectly marked executable tools: gpio: fix -c option of gpio-event-mon Revert "Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode" cpufreq: Move to_gov_attr_set() to cpufreq.h cpufreq: governor: Use kobject release() method to free dbs_data kbuild: Allow kernel installation packaging to override pkg-config block: fix and cleanup bio_check_ro x86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL netfilter: conntrack: unify established states for SCTP paths perf/x86/amd: fix potential integer overflow on shift of a int Linux 5.15.91 Change-Id: I3349d802533097ac86e5c680fbd40c00c9719ec7 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-02-01 09:38:19 +00:00
Eric Dumazet	41b74e95f2	netlink: prevent potential spectre v1 gadgets ... [ Upstream commit f0950402e8 ] Most netlink attributes are parsed and validated from __nla_validate_parse() or validate_nla() u16 type = nla_type(nla); if (type == 0 || type > maxtype) { /* error or continue */ } @type is then used as an array index and can be used as a Spectre v1 gadget. array_index_nospec() can be used to prevent leaking content of kernel memory to malicious users. This should take care of vast majority of netlink uses, but an audit is needed to take care of others where validation is not yet centralized in core netlink functions. Fixes: bfa83a9e03 ("[NETLINK]: Type-safe netlink messages/attributes interface") Signed-off-by: Eric Dumazet <edumazet@google.com> Link: https://lore.kernel.org/r/20230119110150.2678537-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-02-01 08:27:26 +01:00
Kees Cook	7b98914a6c	panic: Consolidate open-coded panic_on_warn checks ... commit 79cc1ba7ba upstream. Several run-time checkers (KASAN, UBSAN, KFENCE, KCSAN, sched) roll their own warnings, and each check "panic_on_warn". Consolidate this into a single function so that future instrumentation can be added in a single location. Cc: Marco Elver <elver@google.com> Cc: Dmitry Vyukov <dvyukov@google.com> Cc: Ingo Molnar <mingo@redhat.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Juri Lelli <juri.lelli@redhat.com> Cc: Vincent Guittot <vincent.guittot@linaro.org> Cc: Dietmar Eggemann <dietmar.eggemann@arm.com> Cc: Steven Rostedt <rostedt@goodmis.org> Cc: Ben Segall <bsegall@google.com> Cc: Mel Gorman <mgorman@suse.de> Cc: Daniel Bristot de Oliveira <bristot@redhat.com> Cc: Valentin Schneider <vschneid@redhat.com> Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com> Cc: Alexander Potapenko <glider@google.com> Cc: Andrey Konovalov <andreyknvl@gmail.com> Cc: Vincenzo Frascino <vincenzo.frascino@arm.com> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: David Gow <davidgow@google.com> Cc: tangmeng <tangmeng@uniontech.com> Cc: Jann Horn <jannh@google.com> Cc: Shuah Khan <skhan@linuxfoundation.org> Cc: Petr Mladek <pmladek@suse.com> Cc: "Paul E. McKenney" <paulmck@kernel.org> Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Cc: "Guilherme G. Piccoli" <gpiccoli@igalia.com> Cc: Tiezhu Yang <yangtiezhu@loongson.cn> Cc: kasan-dev@googlegroups.com Cc: linux-mm@kvack.org Reviewed-by: Luis Chamberlain <mcgrof@kernel.org> Signed-off-by: Kees Cook <keescook@chromium.org> Reviewed-by: Marco Elver <elver@google.com> Reviewed-by: Andrey Konovalov <andreyknvl@gmail.com> Link: https://lore.kernel.org/r/20221117234328.594699-4-keescook@chromium.org Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-02-01 08:27:22 +01:00
Tiezhu Yang	b5c967dc68	ubsan: no need to unset panic_on_warn in ubsan_epilogue() ... commit d83ce027a5 upstream. panic_on_warn is unset inside panic(), so no need to unset it before calling panic() in ubsan_epilogue(). Link: https://lkml.kernel.org/r/1644324666-15947-5-git-send-email-yangtiezhu@loongson.cn Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn> Reviewed-by: Marco Elver <elver@google.com> Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com> Cc: Baoquan He <bhe@redhat.com> Cc: Jonathan Corbet <corbet@lwn.net> Cc: Xuefeng Li <lixuefeng@loongson.cn> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-02-01 08:27:20 +01:00
Mateusz Guzik	a4e70bcf2e	lockref: stop doing cpu_relax in the cmpxchg loop ... [ Upstream commit f5fe24ef17 ] On the x86-64 architecture even a failing cmpxchg grants exclusive access to the cacheline, making it preferable to retry the failed op immediately instead of stalling with the pause instruction. To illustrate the impact, below are benchmark results obtained by running various will-it-scale tests on top of the 6.2-rc3 kernel and Cascade Lake (2 sockets * 24 cores * 2 threads) CPU. All results in ops/s. Note there is some variance in re-runs, but the code is consistently faster when contention is present. open3 ("Same file open/close"): proc stock no-pause 1 805603 814942 (+%1) 2 1054980 1054781 (-0%) 8 1544802 1822858 (+18%) 24 1191064 2199665 (+84%) 48 851582 1469860 (+72%) 96 609481 1427170 (+134%) fstat2 ("Same file fstat"): proc stock no-pause 1 3013872 3047636 (+1%) 2 4284687 4400421 (+2%) 8 3257721 5530156 (+69%) 24 2239819 5466127 (+144%) 48 1701072 5256609 (+209%) 96 1269157 6649326 (+423%) Additionally, a kernel with a private patch to help access() scalability: access2 ("Same file access"): proc stock patched patched +nopause 24 2378041 2005501 5370335 (-15% / +125%) That is, fixing the problems in access itself *reduces* scalability after the cacheline ping-pong only happens in lockref with the pause instruction. Note that fstat and access benchmarks are not currently integrated into will-it-scale, but interested parties can find them in pull requests to said project. Code at hand has a rather tortured history. First modification showed up in commit d472d9d98b ("lockref: Relax in cmpxchg loop"), written with Itanium in mind. Later it got patched up to use an arch-dependent macro to stop doing it on s390 where it caused a significant regression. Said macro had undergone revisions and was ultimately eliminated later, going back to cpu_relax. While I intended to only remove cpu_relax for x86-64, I got the following comment from Linus: I would actually prefer just removing it entirely and see if somebody else hollers. You have the numbers to prove it hurts on real hardware, and I don't think we have any numbers to the contrary. So I think it's better to trust the numbers and remove it as a failure, than say "let's just remove it on x86-64 and leave everybody else with the potentially broken code" Additionally, Will Deacon (maintainer of the arm64 port, one of the architectures previously benchmarked): So, from the arm64 side of the fence, I'm perfectly happy just removing the cpu_relax() calls from lockref. As such, come back full circle in history and whack it altogether. Signed-off-by: Mateusz Guzik <mjguzik@gmail.com> Link: https://lore.kernel.org/all/CAGudoHHx0Nqg6DE70zAVA75eV-HXfWyhVMWZ-aSeOofkA_=WdA@mail.gmail.com/ Acked-by: Tony Luck <tony.luck@intel.com> # ia64 Acked-by: Nicholas Piggin <npiggin@gmail.com> # powerpc Acked-by: Will Deacon <will@kernel.org> # arm64 Acked-by: Peter Zijlstra <peterz@infradead.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-02-01 08:27:19 +01:00
Greg Kroah-Hartman	962d1816e1	Merge 5.15.86 into android14-5.15 ... Changes in 5.15.86 drm/amd/display: Manually adjust strobe for DCN303 usb: musb: remove extra check in musb_gadget_vbus_draw arm64: dts: qcom: ipq6018-cp01-c1: use BLSPI1 pins arm64: dts: qcom: sm8250-sony-xperia-edo: fix touchscreen bias-disable arm64: dts: qcom: msm8996: Add MSM8996 Pro support arm64: dts: qcom: msm8996: fix supported-hw in cpufreq OPP tables arm64: dts: qcom: msm8996: fix GPU OPP table ARM: dts: qcom: apq8064: fix coresight compatible arm64: dts: qcom: sdm630: fix UART1 pin bias arm64: dts: qcom: sdm845-cheza: fix AP suspend pin bias arm64: dts: qcom: msm8916: Drop MSS fallback compatible objtool, kcsan: Add volatile read/write instrumentation to whitelist ARM: dts: stm32: Drop stm32mp15xc.dtsi from Avenger96 ARM: dts: stm32: Fix AV96 WLAN regulator gpio property drivers: soc: ti: knav_qmss_queue: Mark knav_acc_firmwares as static arm64: dts: qcom: pm660: Use unique ADC5_VCOIN address in node name arm64: dts: qcom: sm8250: correct LPASS pin pull down soc: qcom: llcc: make irq truly optional arm64: dts: qcom: Correct QMP PHY child node name arm64: dts: qcom: sm8150: fix UFS PHY registers arm64: dts: qcom: sm8250: fix UFS PHY registers arm64: dts: qcom: sm8350: fix UFS PHY registers arm64: dts: qcom: sm8250: drop bogus DP PHY clock soc: qcom: apr: make code more reuseable soc: qcom: apr: Add check for idr_alloc and of_property_read_string_index arm64: dts: qcom: sm6125: fix SDHCI CQE reg names arm: dts: spear600: Fix clcd interrupt soc: ti: knav_qmss_queue: Use pm_runtime_resume_and_get instead of pm_runtime_get_sync soc: ti: knav_qmss_queue: Fix PM disable depth imbalance in knav_queue_probe soc: ti: smartreflex: Fix PM disable depth imbalance in omap_sr_probe arm64: Treat ESR_ELx as a 64-bit register arm64: mm: kfence: only handle translation faults perf: arm_dsu: Fix hotplug callback leak in dsu_pmu_init() perf/arm_dmc620: Fix hotplug callback leak in dmc620_pmu_init() perf/smmuv3: Fix hotplug callback leak in arm_smmu_pmu_init() arm64: dts: ti: k3-am65-main: Drop dma-coherent in crypto node arm64: dts: ti: k3-j721e-main: Drop dma-coherent in crypto node ARM: dts: nuvoton: Remove bogus unit addresses from fixed-partition nodes arm64: dts: mt6779: Fix devicetree build warnings arm64: dts: mt2712e: Fix unit_address_vs_reg warning for oscillators arm64: dts: mt2712e: Fix unit address for pinctrl node arm64: dts: mt2712-evb: Fix vproc fixed regulators unit names arm64: dts: mt2712-evb: Fix usb vbus regulators unit names arm64: dts: mediatek: pumpkin-common: Fix devicetree warnings arm64: dts: mediatek: mt6797: Fix 26M oscillator unit name ARM: dts: dove: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-370: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-xp: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-375: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-38x: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-39x: Fix assigned-addresses for every PCIe Root Port ARM: dts: turris-omnia: Add ethernet aliases ARM: dts: turris-omnia: Add switch port 6 node arm64: dts: armada-3720-turris-mox: Add missing interrupt for RTC seccomp: Move copy_seccomp() to no failure path. pstore/ram: Fix error return code in ramoops_probe() ARM: mmp: fix timer_read delay pstore: Avoid kcore oops by vmap()ing with VM_IOREMAP tpm/tpm_ftpm_tee: Fix error handling in ftpm_mod_init() tpm/tpm_crb: Fix error message in __crb_relinquish_locality() ovl: store lower path in ovl_inode ovl: use ovl_copy_{real,upper}attr() wrappers ovl: remove privs in ovl_copyfile() ovl: remove privs in ovl_fallocate() sched/fair: Cleanup task_util and capacity type sched/uclamp: Fix relationship between uclamp and migration margin sched/uclamp: Make task_fits_capacity() use util_fits_cpu() sched/uclamp: Make select_idle_capacity() use util_fits_cpu() sched/fair: Removed useless update of p->recent_used_cpu sched/core: Introduce sched_asym_cpucap_active() sched/uclamp: Make asym_fits_capacity() use util_fits_cpu() cpuidle: dt: Return the correct numbers of parsed idle states alpha: fix TIF_NOTIFY_SIGNAL handling alpha: fix syscall entry in !AUDUT_SYSCALL case x86/sgx: Reduce delay and interference of enclave release PM: hibernate: Fix mistake in kerneldoc comment fs: don't audit the capability check in simple_xattr_list() cpufreq: qcom-hw: Fix memory leak in qcom_cpufreq_hw_read_lut() selftests/ftrace: event_triggers: wait longer for test_event_enable perf: Fix possible memleak in pmu_dev_alloc() lib/debugobjects: fix stat count and optimize debug_objects_mem_init platform/x86: huawei-wmi: fix return value calculation timerqueue: Use rb_entry_safe() in timerqueue_getnext() proc: fixup uptime selftest lib/fonts: fix undefined behavior in bit shift for get_default_font ocfs2: fix memory leak in ocfs2_stack_glue_init() MIPS: vpe-mt: fix possible memory leak while module exiting MIPS: vpe-cmp: fix possible memory leak while module exiting selftests/efivarfs: Add checking of the test return value PNP: fix name memory leak in pnp_alloc_dev() perf/x86/intel/uncore: Fix reference count leak in sad_cfg_iio_topology() perf/x86/intel/uncore: Fix reference count leak in hswep_has_limit_sbox() perf/x86/intel/uncore: Fix reference count leak in snr_uncore_mmio_map() perf/x86/intel/uncore: Fix reference count leak in __uncore_imc_init_box() platform/chrome: cros_usbpd_notify: Fix error handling in cros_usbpd_notify_init() thermal: core: fix some possible name leaks in error paths irqchip: gic-pm: Use pm_runtime_resume_and_get() in gic_probe() irqchip/wpcm450: Fix memory leak in wpcm450_aic_of_init() EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper() SUNRPC: Return true/false (not 1/0) from bool functions NFSD: Finish converting the NFSv2 GETACL result encoder nfsd: don't call nfsd_file_put from client states seqfile display genirq/irqdesc: Don't try to remove non-existing sysfs files cpufreq: amd_freq_sensitivity: Add missing pci_dev_put() libfs: add DEFINE_SIMPLE_ATTRIBUTE_SIGNED for signed value lib/notifier-error-inject: fix error when writing -errno to debugfs file debugfs: fix error when writing negative value to atomic_t debugfs file rapidio: fix possible name leaks when rio_add_device() fails rapidio: rio: fix possible name leak in rio_register_mport() clocksource/drivers/sh_cmt: Access registers according to spec mips: ralink: mt7621: define MT7621_SYSC_BASE with __iomem mips: ralink: mt7621: soc queries and tests as functions mips: ralink: mt7621: do not use kzalloc too early futex: Move to kernel/futex/ futex: Resend potentially swallowed owner death notification cpu/hotplug: Make target_store() a nop when target == state cpu/hotplug: Do not bail-out in DYING/STARTING sections clocksource/drivers/timer-ti-dm: Fix missing clk_disable_unprepare in dmtimer_systimer_init_clock() ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() uprobes/x86: Allow to probe a NOP instruction with 0x66 prefix x86/xen: Fix memory leak in xen_smp_intr_init{_pv}() x86/xen: Fix memory leak in xen_init_lock_cpu() xen/privcmd: Fix a possible warning in privcmd_ioctl_mmap_resource() PM: runtime: Do not call __rpm_callback() from rpm_idle() platform/chrome: cros_ec_typec: Cleanup switch handle return paths platform/chrome: cros_ec_typec: zero out stale pointers platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]() platform/x86: intel_scu_ipc: fix possible name leak in __intel_scu_ipc_register() MIPS: BCM63xx: Add check for NULL for clk in clk_enable MIPS: OCTEON: warn only once if deprecated link status is being used lockd: set other missing fields when unlocking files fs: sysv: Fix sysv_nblocks() returns wrong value rapidio: fix possible UAF when kfifo_alloc() fails eventfd: change int to __u64 in eventfd_signal() ifndef CONFIG_EVENTFD relay: fix type mismatch when allocating memory in relay_create_buf() hfs: Fix OOB Write in hfs_asc2mac rapidio: devices: fix missing put_device in mport_cdev_open platform/mellanox: mlxbf-pmc: Fix event typo wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs() wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb() wifi: rtl8xxxu: Fix reading the vendor of combo chips drm/bridge: adv7533: remove dynamic lane switching from adv7533 bridge libbpf: Fix use-after-free in btf_dump_name_dups libbpf: Fix null-pointer dereference in find_prog_by_sec_insn() ata: libata: move ata_{port,link,dev}_dbg to standard pr_XXX() macros ata: add/use ata_taskfile::{error|status} fields ata: libata: fix NCQ autosense logic ipmi: kcs: Poll OBF briefly to reduce OBE latency drm/amdgpu/powerplay/psm: Fix memory leak in power state init media: v4l2-ctrls: Fix off-by-one error in integer menu control check media: coda: jpeg: Add check for kmalloc media: adv748x: afe: Select input port when initializing AFE media: i2c: ad5820: Fix error path venus: pm_helpers: Fix error check in vcodec_domains_get() soreuseport: Fix socket selection for SO_INCOMING_CPU. media: exynos4-is: don't rely on the v4l2_async_subdev internals libbpf: Btf dedup identical struct test needs check for nested structs/arrays can: kvaser_usb: do not increase tx statistics when sending error message frames can: kvaser_usb: kvaser_usb_leaf: Get capabilities from device can: kvaser_usb: kvaser_usb_leaf: Rename {leaf,usbcan}_cmd_error_event to {leaf,usbcan}_cmd_can_error_event can: kvaser_usb: kvaser_usb_leaf: Handle CMD_ERROR_EVENT can: kvaser_usb_leaf: Set Warning state even without bus errors can: kvaser_usb: make use of units.h in assignment of frequency can: kvaser_usb_leaf: Fix improved state not being reported can: kvaser_usb_leaf: Fix wrong CAN state after stopping can: kvaser_usb_leaf: Fix bogus restart events can: kvaser_usb: Add struct kvaser_usb_busparams can: kvaser_usb: Compare requested bittiming parameters with actual parameters in do_set_{,data}_bittiming drm/rockchip: lvds: fix PM usage counter unbalance in poweron clk: renesas: r9a06g032: Repair grave increment error spi: Update reference to struct spi_controller drm/panel/panel-sitronix-st7701: Remove panel on DSI attach failure ima: Handle -ESTALE returned by ima_filter_rule_match() drm/msm/hdmi: drop unused GPIO support drm/msm/hdmi: use devres helper for runtime PM management bpf: Fix slot type check in check_stack_write_var_off media: vivid: fix compose size exceed boundary media: platform: exynos4-is: fix return value check in fimc_md_probe() bpf: propagate precision in ALU/ALU64 operations bpf: Check the other end of slot_type for STACK_SPILL bpf: propagate precision across all frames, not just the last one clk: qcom: gcc-sm8250: Use retention mode for USB GDSCs mtd: Fix device name leak when register device failed in add_mtd_device() Input: joystick - fix Kconfig warning for JOYSTICK_ADC wifi: rsi: Fix handling of 802.3 EAPOL frames sent via control port media: camss: Clean up received buffers on failed start of streaming net, proc: Provide PROC_FS=n fallback for proc_create_net_single_write() rxrpc: Fix ack.bufferSize to be 0 when generating an ack bfq: fix waker_bfqq inconsistency crash drm/radeon: Add the missed acpi_put_table() to fix memory leak drm/mediatek: Modify dpi power on/off sequence. ASoC: pxa: fix null-pointer dereference in filter() libbpf: Fix uninitialized warning in btf_dump_dump_type_data nvmet: only allocate a single slab for bvecs regulator: core: fix unbalanced of node refcount in regulator_dev_lookup() amdgpu/pm: prevent array underflow in vega20_odn_edit_dpm_table() nvme: return err on nvme_init_non_mdts_limits fail regulator: qcom-rpmh: Fix PMR735a S3 regulator spec drm/fourcc: Add packed 10bit YUV 4:2:0 format drm/fourcc: Fix vsub/hsub for Q410 and Q401 integrity: Fix memory leakage in keyring allocation error path ima: Fix misuse of dereference of pointer in template_desc_init_fields() block: clear ->slave_dir when dropping the main slave_dir reference wifi: ath10k: Fix return value in ath10k_pci_init() drm/msm/a6xx: Fix speed-bin detection vs probe-defer mtd: lpddr2_nvm: Fix possible null-ptr-deref Input: elants_i2c - properly handle the reset GPIO when power is off media: vidtv: Fix use-after-free in vidtv_bridge_dvb_init() media: solo6x10: fix possible memory leak in solo_sysfs_init() media: platform: exynos4-is: Fix error handling in fimc_md_init() media: videobuf-dma-contig: use dma_mmap_coherent inet: add READ_ONCE(sk->sk_bound_dev_if) in inet_csk_bind_conflict() mtd: spi-nor: hide jedec_id sysfs attribute if not present mtd: spi-nor: Fix the number of bytes for the dummy cycles bpf: Move skb->len == 0 checks into __bpf_redirect HID: hid-sensor-custom: set fixed size for custom attributes pinctrl: k210: call of_node_put() ALSA: pcm: fix undefined behavior in bit shift for SNDRV_PCM_RATE_KNOT ALSA: seq: fix undefined behavior in bit shift for SNDRV_SEQ_FILTER_USE_EVENT regulator: core: use kfree_const() to free space conditionally clk: rockchip: Fix memory leak in rockchip_clk_register_pll() drm/amdgpu: fix pci device refcount leak bonding: fix link recovery in mode 2 when updelay is nonzero mtd: maps: pxa2xx-flash: fix memory leak in probe drbd: remove call to memset before free device/resource/connection drbd: destroy workqueue when drbd device was freed ASoC: qcom: Add checks for devm_kcalloc media: vimc: Fix wrong function called when vimc_init() fails media: imon: fix a race condition in send_packet() clk: imx8mn: rename vpu_pll to m7_alt_pll clk: imx: replace osc_hdmi with dummy clk: imx8mn: fix imx8mn_sai2_sels clocks list clk: imx8mn: fix imx8mn_enet_phy_sels clocks list pinctrl: pinconf-generic: add missing of_node_put() media: dvb-core: Fix ignored return value in dvb_register_frontend() media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer() media: s5p-mfc: Add variant data for MFC v7 hardware for Exynos 3250 SoC drm/tegra: Add missing clk_disable_unprepare() in tegra_dc_probe() ASoC: dt-bindings: wcd9335: fix reset line polarity in example ASoC: mediatek: mtk-btcvsd: Add checks for write and read of mtk_btcvsd_snd NFSv4.2: Clear FATTR4_WORD2_SECURITY_LABEL when done decoding NFSv4.2: Fix a memory stomp in decode_attr_security_label NFSv4.2: Fix initialisation of struct nfs4_label NFSv4: Fix a credential leak in _nfs4_discover_trunking() NFSv4: Fix a deadlock between nfs4_open_recover_helper() and delegreturn NFS: Fix an Oops in nfs_d_automount() ALSA: asihpi: fix missing pci_disable_device() wifi: iwlwifi: mvm: fix double free on tx path. ASoC: mediatek: mt8173: Fix debugfs registration for components ASoC: mediatek: mt8173: Enable IRQ when pdata is ready drm/amd/pm/smu11: BACO is supported when it's in BACO state drm/radeon: Fix PCI device refcount leak in radeon_atrm_get_bios() drm/amdgpu: Fix PCI device refcount leak in amdgpu_atrm_get_bios() drm/amdkfd: Fix memory leakage ASoC: pcm512x: Fix PM disable depth imbalance in pcm512x_probe netfilter: conntrack: set icmpv6 redirects as RELATED Input: wistron_btns - disable on UML bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data bpf, sockmap: Fix missing BPF_F_INGRESS flag when using apply_bytes bpf, sockmap: Fix data loss caused by using apply_bytes on ingress redirect bonding: uninitialized variable in bond_miimon_inspect() spi: spidev: mask SPI_CS_HIGH in SPI_IOC_RD_MODE wifi: mac80211: fix memory leak in ieee80211_if_add() wifi: cfg80211: Fix not unregister reg_pdev when load_builtin_regdb_keys() fails mt76: stop the radar detector after leaving dfs channel wifi: mt76: mt7921: fix reporting of TX AGGR histogram wifi: mt76: fix coverity overrun-call in mt76_get_txpower() regulator: core: fix module refcount leak in set_supply() clk: qcom: lpass-sc7180: Fix pm_runtime usage clk: qcom: clk-krait: fix wrong div2 functions hsr: Add a rcu-read lock to hsr_forward_skb(). hsr: Avoid double remove of a node. hsr: Disable netpoll. hsr: Synchronize sending frames to have always incremented outgoing seq nr. hsr: Synchronize sequence number updates. configfs: fix possible memory leak in configfs_create_dir() regulator: core: fix resource leak in regulator_register() hwmon: (jc42) Convert register access and caching to regmap/regcache hwmon: (jc42) Restore the min/max/critical temperatures on resume bpf, sockmap: fix race in sock_map_free() ALSA: pcm: Set missing stop_operating flag at undoing trigger start media: saa7164: fix missing pci_disable_device() ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt xprtrdma: Fix regbuf data not freed in rpcrdma_req_create() SUNRPC: Fix missing release socket in rpc_sockname() NFSv4.x: Fail client initialisation if state manager thread can't run riscv, bpf: Emit fixed-length instructions for BPF_PSEUDO_FUNC mmc: alcor: fix return value check of mmc_add_host() mmc: moxart: fix return value check of mmc_add_host() mmc: mxcmmc: fix return value check of mmc_add_host() mmc: pxamci: fix return value check of mmc_add_host() mmc: rtsx_pci: fix return value check of mmc_add_host() mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host() mmc: toshsd: fix return value check of mmc_add_host() mmc: vub300: fix return value check of mmc_add_host() mmc: wmt-sdmmc: fix return value check of mmc_add_host() mmc: atmel-mci: fix return value check of mmc_add_host() mmc: omap_hsmmc: fix return value check of mmc_add_host() mmc: meson-gx: fix return value check of mmc_add_host() mmc: via-sdmmc: fix return value check of mmc_add_host() mmc: wbsd: fix return value check of mmc_add_host() mmc: mmci: fix return value check of mmc_add_host() mmc: renesas_sdhi: alway populate SCC pointer memstick: ms_block: Add error handling support for add_disk() memstick/ms_block: Add check for alloc_ordered_workqueue mmc: core: Normalize the error handling branch in sd_read_ext_regs() regulator: qcom-labibb: Fix missing of_node_put() in qcom_labibb_regulator_probe() media: c8sectpfe: Add of_node_put() when breaking out of loop media: coda: Add check for dcoda_iram_alloc media: coda: Add check for kmalloc clk: samsung: Fix memory leak in _samsung_clk_register_pll() spi: spi-gpio: Don't set MOSI as an input if not 3WIRE mode wifi: rtl8xxxu: Add __packed to struct rtl8723bu_c2h wifi: rtl8xxxu: Fix the channel width reporting wifi: brcmfmac: Fix error return code in brcmf_sdio_download_firmware() blktrace: Fix output non-blktrace event when blk_classic option enabled bpf: Do not zero-extend kfunc return values clk: socfpga: Fix memory leak in socfpga_gate_init() net: vmw_vsock: vmci: Check memcpy_from_msg() net: defxx: Fix missing err handling in dfx_init() net: stmmac: selftests: fix potential memleak in stmmac_test_arpoffload() net: stmmac: fix possible memory leak in stmmac_dvr_probe() drivers: net: qlcnic: Fix potential memory leak in qlcnic_sriov_init() of: overlay: fix null pointer dereferencing in find_dup_cset_node_entry() and find_dup_cset_prop() ethernet: s2io: don't call dev_kfree_skb() under spin_lock_irqsave() net: farsync: Fix kmemleak when rmmods farsync net/tunnel: wait until all sk_user_data reader finish before releasing the sock net: apple: mace: don't call dev_kfree_skb() under spin_lock_irqsave() net: apple: bmac: don't call dev_kfree_skb() under spin_lock_irqsave() net: emaclite: don't call dev_kfree_skb() under spin_lock_irqsave() net: ethernet: dnet: don't call dev_kfree_skb() under spin_lock_irqsave() hamradio: don't call dev_kfree_skb() under spin_lock_irqsave() net: amd: lance: don't call dev_kfree_skb() under spin_lock_irqsave() af_unix: call proto_unregister() in the error path in af_unix_init() net: amd-xgbe: Fix logic around active and passive cables net: amd-xgbe: Check only the minimum speed for active/passive cables can: tcan4x5x: Remove invalid write in clear_interrupts can: m_can: Call the RAM init directly from m_can_chip_config can: tcan4x5x: Fix use of register error status mask net: lan9303: Fix read error execution path ntb_netdev: Use dev_kfree_skb_any() in interrupt context sctp: sysctl: make extra pointers netns aware Bluetooth: MGMT: Fix error report for ADD_EXT_ADV_PARAMS Bluetooth: btintel: Fix missing free skb in btintel_setup_combined() Bluetooth: btusb: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_qca: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_ll: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_h5: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_bcsp: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_core: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: RFCOMM: don't call kfree_skb() under spin_lock_irqsave() stmmac: fix potential division by 0 i40e: Fix the inability to attach XDP program on downed interface net: dsa: tag_8021q: avoid leaking ctx on dsa_tag_8021q_register() error path apparmor: fix a memleak in multi_transaction_new() apparmor: fix lockdep warning when removing a namespace apparmor: Fix abi check to include v8 abi crypto: hisilicon/qm - fix missing destroy qp_idr crypto: sun8i-ss - use dma_addr instead u32 crypto: nitrox - avoid double free on error path in nitrox_sriov_init() scsi: core: Fix a race between scsi_done() and scsi_timeout() apparmor: Use pointer to struct aa_label for lbs_cred PCI: dwc: Fix n_fts[] array overrun RDMA/core: Fix order of nldev_exit call PCI: pci-epf-test: Register notifier if only core_init_notifier is enabled f2fs: Fix the race condition of resize flag between resizefs crypto: rockchip - do not do custom power management crypto: rockchip - do not store mode globally crypto: rockchip - add fallback for cipher crypto: rockchip - add fallback for ahash crypto: rockchip - better handle cipher key crypto: rockchip - remove non-aligned handling crypto: rockchip - rework by using crypto_engine apparmor: Fix memleak in alloc_ns() f2fs: fix to invalidate dcc->f2fs_issue_discard in error path f2fs: fix normal discard process f2fs: fix to destroy sbi->post_read_wq in error path of f2fs_fill_super() RDMA/irdma: Report the correct link speed scsi: qla2xxx: Fix set-but-not-used variable warnings RDMA/siw: Fix immediate work request flush to completion queue IB/mad: Don't call to function that might sleep while in atomic context PCI: vmd: Disable MSI remapping after suspend RDMA/restrack: Release MR restrack when delete RDMA/core: Make sure "ib_port" is valid when access sysfs node RDMA/nldev: Return "-EAGAIN" if the cm_id isn't from expected port RDMA/siw: Set defined status for work completion with undefined status scsi: scsi_debug: Fix a warning in resp_write_scat() crypto: ccree - Remove debugfs when platform_driver_register failed crypto: cryptd - Use request context instead of stack for sub-request crypto: hisilicon/qm - add missing pci_dev_put() in q_num_set() RDMA/hns: Repacing 'dseg_len' by macros in fill_ext_sge_inl_data() RDMA/hns: Fix ext_sge num error when post send PCI: Check for alloc failure in pci_request_irq() RDMA/hfi: Decrease PCI device reference count in error path crypto: ccree - Make cc_debugfs_global_fini() available for module init function RDMA/hns: fix memory leak in hns_roce_alloc_mr() RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed dt-bindings: imx6q-pcie: Fix clock names for imx6sx and imx8mq dt-bindings: visconti-pcie: Fix interrupts array max constraints scsi: hpsa: Fix possible memory leak in hpsa_init_one() crypto: tcrypt - Fix multibuffer skcipher speed test mem leak padata: Always leave BHs disabled when running ->parallel() padata: Fix list iterator in padata_do_serial() scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add() scsi: hpsa: Fix error handling in hpsa_add_sas_host() scsi: hpsa: Fix possible memory leak in hpsa_add_sas_device() scsi: efct: Fix possible memleak in efct_device_init() scsi: scsi_debug: Fix a warning in resp_verify() scsi: scsi_debug: Fix a warning in resp_report_zones() scsi: fcoe: Fix possible name leak when device_register() fails scsi: scsi_debug: Fix possible name leak in sdebug_add_host_helper() scsi: ipr: Fix WARNING in ipr_init() scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails scsi: snic: Fix possible UAF in snic_tgt_create() RDMA/nldev: Add checks for nla_nest_start() in fill_stat_counter_qps() f2fs: avoid victim selection from previous victim section RDMA/nldev: Fix failure to send large messages crypto: amlogic - Remove kcalloc without check crypto: omap-sham - Use pm_runtime_resume_and_get() in omap_sham_probe() riscv/mm: add arch hook arch_clear_hugepage_flags RDMA/hfi1: Fix error return code in parse_platform_config() RDMA/srp: Fix error return code in srp_parse_options() PCI: mt7621: Rename mt7621_pci_ to mt7621_pcie_ PCI: mt7621: Add sentinel to quirks table orangefs: Fix sysfs not cleanup when dev init failed RDMA/hns: Fix AH attr queried by query_qp RDMA/hns: Fix PBL page MTR find RDMA/hns: Fix page size cap from firmware RDMA/hns: Fix error code of CMD crypto: img-hash - Fix variable dereferenced before check 'hdev->req' hwrng: amd - Fix PCI device refcount leak hwrng: geode - Fix PCI device refcount leak IB/IPoIB: Fix queue count inconsistency for PKEY child interfaces RISC-V: Align the shadow stack drivers: dio: fix possible memory leak in dio_init() serial: tegra: Read DMA status before terminating serial: 8250_bcm7271: Fix error handling in brcmuart_init() class: fix possible memory leak in __class_register() vfio: platform: Do not pass return buffer to ACPI _RST method uio: uio_dmem_genirq: Fix missing unlock in irq configuration uio: uio_dmem_genirq: Fix deadlock between irq config and handling usb: fotg210-udc: Fix ages old endianness issues staging: vme_user: Fix possible UAF in tsi148_dma_list_add usb: typec: Check for ops->exit instead of ops->enter in altmode_exit usb: typec: tcpci: fix of node refcount leak in tcpci_register_port() usb: typec: tipd: Cleanup resources if devm_tps6598_psy_register fails usb: typec: tipd: Fix spurious fwnode_handle_put in error path extcon: usbc-tusb320: Add support for mode setting and reset extcon: usbc-tusb320: Add support for TUSB320L usb: typec: Factor out non-PD fwnode properties extcon: usbc-tusb320: Factor out extcon into dedicated functions extcon: usbc-tusb320: Add USB TYPE-C support extcon: usbc-tusb320: Update state on probe even if no IRQ pending serial: amba-pl011: avoid SBSA UART accessing DMACR register serial: pl011: Do not clear RX FIFO & RX interrupt in unthrottle. serial: stm32: move dma_request_chan() before clk_prepare_enable() serial: pch: Fix PCI device refcount leak in pch_request_dma() tty: serial: clean up stop-tx part in altera_uart_tx_chars() tty: serial: altera_uart_{r,t}x_chars() need only uart_port serial: altera_uart: fix locking in polling mode serial: sunsab: Fix error handling in sunsab_init() test_firmware: fix memory leak in test_firmware_init() misc: ocxl: fix possible name leak in ocxl_file_register_afu() ocxl: fix pci device refcount leak when calling get_function_0() misc: tifm: fix possible memory leak in tifm_7xx1_switch_media() misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os firmware: raspberrypi: fix possible memory leak in rpi_firmware_probe() cxl: fix possible null-ptr-deref in cxl_guest_init_afu|adapter() cxl: fix possible null-ptr-deref in cxl_pci_init_afu|adapter() iio: temperature: ltc2983: make bulk write buffer DMA-safe iio: adis: handle devices that cannot unmask the drdy pin iio: adis: stylistic changes iio:imu:adis: Move exports into IIO_ADISLIB namespace iio: adis: add '__adis_enable_irq()' implementation counter: stm32-lptimer-cnt: fix the check on arr and cmp registers update coresight: trbe: remove cpuhp instance node before remove cpuhp state usb: roles: fix of node refcount leak in usb_role_switch_is_parent() usb: gadget: f_hid: fix f_hidg lifetime vs cdev usb: gadget: f_hid: fix refcount leak on error path drivers: mcb: fix resource leak in mcb_probe() mcb: mcb-parse: fix error handing in chameleon_parse_gdd() chardev: fix error handling in cdev_device_add() i2c: pxa-pci: fix missing pci_disable_device() on error in ce4100_i2c_probe staging: rtl8192u: Fix use after free in ieee80211_rx() staging: rtl8192e: Fix potential use-after-free in rtllib_rx_Monitor() vme: Fix error not catched in fake_init() gpiolib: Get rid of redundant 'else' gpiolib: cdev: fix NULL-pointer dereferences gpiolib: make struct comments into real kernel docs gpiolib: protect the GPIO device against being dropped while in use by user-space i2c: mux: reg: check return value after calling platform_get_resource() i2c: ismt: Fix an out-of-bounds bug in ismt_access() usb: storage: Add check for kcalloc tracing/hist: Fix issue of losting command info in error_log ksmbd: Fix resource leak in ksmbd_session_rpc_open() samples: vfio-mdev: Fix missing pci_disable_device() in mdpy_fb_probe() thermal/drivers/imx8mm_thermal: Validate temperature range thermal/drivers/qcom/temp-alarm: Fix inaccurate warning for gen2 thermal/drivers/qcom/lmh: Fix irq handler return value fbdev: ssd1307fb: Drop optional dependency fbdev: pm2fb: fix missing pci_disable_device() fbdev: via: Fix error in via_core_init() fbdev: vermilion: decrease reference count in error path fbdev: ep93xx-fb: Add missing clk_disable_unprepare in ep93xxfb_probe() fbdev: geode: don't build on UML fbdev: uvesafb: don't build on UML fbdev: uvesafb: Fixes an error handling path in uvesafb_probe() HSI: omap_ssi_core: fix unbalanced pm_runtime_disable() HSI: omap_ssi_core: fix possible memory leak in ssi_probe() power: supply: fix residue sysfs file in error handle route of __power_supply_register() perf trace: Return error if a system call doesn't exist perf trace: Use macro RAW_SYSCALL_ARGS_NUM to replace number perf trace: Handle failure when trace point folder is missed perf symbol: correction while adjusting symbol power: supply: z2_battery: Fix possible memleak in z2_batt_probe() HSI: omap_ssi_core: Fix error handling in ssi_init() power: supply: ab8500: Fix error handling in ab8500_charger_init() power: supply: fix null pointer dereferencing in power_supply_get_battery_info perf stat: Refactor __run_perf_stat() common code perf stat: Do not delay the workload with --delay RDMA/siw: Fix pointer cast warning fs/ntfs3: Avoid UBSAN error on true_sectors_per_clst() overflow: Implement size_t saturating arithmetic helpers fs/ntfs3: Harden against integer overflows iommu/sun50i: Fix reset release iommu/sun50i: Consider all fault sources for reset iommu/sun50i: Fix R/W permission check iommu/sun50i: Fix flush size iommu/rockchip: fix permission bits in page table entries v2 phy: usb: s2 WoL wakeup_count not incremented for USB->Eth devices include/uapi/linux/swab: Fix potentially missing __always_inline pwm: tegra: Improve required rate calculation fs/ntfs3: Fix slab-out-of-bounds read in ntfs_trim_fs dmaengine: idxd: Fix crc_val field for completion record rtc: rtc-cmos: Do not check ACPI_FADT_LOW_POWER_S0 rtc: cmos: Fix event handler registration ordering issue rtc: cmos: Fix wake alarm breakage rtc: cmos: fix build on non-ACPI platforms rtc: cmos: Call cmos_wake_setup() from cmos_do_probe() rtc: cmos: Call rtc_wake_setup() from cmos_do_probe() rtc: cmos: Eliminate forward declarations of some functions rtc: cmos: Rename ACPI-related functions rtc: cmos: Disable ACPI RTC event on removal rtc: snvs: Allow a time difference on clock register read rtc: pcf85063: Fix reading alarm iommu/amd: Fix pci device refcount leak in ppr_notifier() iommu/fsl_pamu: Fix resource leak in fsl_pamu_probe() macintosh: fix possible memory leak in macio_add_one_device() macintosh/macio-adb: check the return value of ioremap() powerpc/52xx: Fix a resource leak in an error handling path cxl: Fix refcount leak in cxl_calc_capp_routing powerpc/xmon: Fix -Wswitch-unreachable warning in bpt_cmds powerpc/xive: add missing iounmap() in error path in xive_spapr_populate_irq_data() powerpc/perf: callchain validate kernel stack pointer bounds powerpc/83xx/mpc832x_rdb: call platform_device_put() in error case in of_fsl_spi_probe() powerpc/hv-gpci: Fix hv_gpci event list selftests/powerpc: Fix resource leaks iommu/sun50i: Remove IOMMU_DOMAIN_IDENTITY pwm: sifive: Call pwm_sifive_update_clock() while mutex is held pwm: mtk-disp: Fix the parameters calculated by the enabled flag of disp_pwm pwm: mediatek: always use bus clock for PWM on MT7622 remoteproc: sysmon: fix memory leak in qcom_add_sysmon_subdev() remoteproc: qcom: q6v5: Fix potential null-ptr-deref in q6v5_wcss_init_mmio() remoteproc: qcom_q6v5_pas: disable wakeup on probe fail or remove remoteproc: qcom_q6v5_pas: detach power domains on remove remoteproc: qcom_q6v5_pas: Fix missing of_node_put() in adsp_alloc_memory_region() remoteproc: qcom: q6v5: Fix missing clk_disable_unprepare() in q6v5_wcss_qcs404_power_on() powerpc/eeh: Drop redundant spinlock initialization powerpc/pseries/eeh: use correct API for error log size mfd: bd957x: Fix Kconfig dependency on REGMAP_IRQ mfd: qcom_rpm: Fix an error handling path in qcom_rpm_probe() mfd: pm8008: Remove driver data structure pm8008_data mfd: pm8008: Fix return value check in pm8008_probe() netfilter: flowtable: really fix NAT IPv6 offload rtc: st-lpc: Add missing clk_disable_unprepare in st_rtc_probe() rtc: pic32: Move devm_rtc_allocate_device earlier in pic32_rtc_probe() rtc: pcf85063: fix pcf85063_clkout_control nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure net: macsec: fix net device access prior to holding a lock mISDN: hfcsusb: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() mISDN: hfcpci: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() mISDN: hfcmulti: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() block, bfq: fix possible uaf for 'bfqq->bic' selftests/bpf: Add test for unstable CT lookup API net: enetc: avoid buffer leaks on xdp_do_redirect() failure nfc: pn533: Clear nfc_target before being used unix: Fix race in SOCK_SEQPACKET's unix_dgram_sendmsg() r6040: Fix kmemleak in probe and remove igc: Enhance Qbv scheduling by using first flag bit igc: Use strict cycles for Qbv scheduling igc: Add checking for basetime less than zero igc: allow BaseTime 0 enrollment for Qbv igc: recalculate Qbv end_time by considering cycle time igc: Lift TAPRIO schedule restriction igc: Set Qbv start_time and end_time to end_time if not being configured in GCL rtc: mxc_v2: Add missing clk_disable_unprepare() selftests: devlink: fix the fd redirect in dummy_reporter_test openvswitch: Fix flow lookup to use unmasked key soc: mediatek: pm-domains: Fix the power glitch issue arm64: dts: mt8183: Fix Mali GPU clock skbuff: Account for tail adjustment during pull operations mailbox: mpfs: read the system controller's status mailbox: arm_mhuv2: Fix return value check in mhuv2_probe() mailbox: zynq-ipi: fix error handling while device_register() fails net_sched: reject TCF_EM_SIMPLE case for complex ematch module rxrpc: Fix missing unlock in rxrpc_do_sendmsg() myri10ge: Fix an error handling path in myri10ge_probe() net: stream: purge sk_error_queue in sk_stream_kill_queues() HID: amd_sfh: Add missing check for dma_alloc_coherent rcu: Fix __this_cpu_read() lockdep warning in rcu_force_quiescent_state() arm64: make is_ttbrX_addr() noinstr-safe video: hyperv_fb: Avoid taking busy spinlock on panic path x86/hyperv: Remove unregister syscore call from Hyper-V cleanup binfmt_misc: fix shift-out-of-bounds in check_special_flags fs: jfs: fix shift-out-of-bounds in dbAllocAG udf: Avoid double brelse() in udf_rename() jfs: Fix fortify moan in symlink fs: jfs: fix shift-out-of-bounds in dbDiscardAG ACPICA: Fix error code path in acpi_ds_call_control_method() nilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset() nilfs2: fix shift-out-of-bounds due to too large exponent of block size acct: fix potential integer overflow in encode_comp_t() hfs: fix OOB Read in __hfs_brec_find drm/etnaviv: add missing quirks for GC300 media: imx-jpeg: Disable useless interrupt to avoid kernel panic brcmfmac: return error when getting invalid max_flowrings from dongle wifi: ath9k: verify the expected usb_endpoints are present wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out ASoC: codecs: rt298: Add quirk for KBL-R RVP platform ipmi: fix memleak when unload ipmi driver drm/amd/display: prevent memory leak Revert "drm/amd/display: Limit max DSC target bpp for specific monitors" qed (gcc13): use u16 for fid to be big enough bpf: make sure skb->len != 0 when redirecting to a tunneling device net: ethernet: ti: Fix return type of netcp_ndo_start_xmit() hamradio: baycom_epp: Fix return type of baycom_send_packet() wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request() igb: Do not free q_vector unless new one was allocated drm/amdgpu: Fix type of second parameter in trans_msg() callback drm/amdgpu: Fix type of second parameter in odn_edit_dpm_table() callback s390/ctcm: Fix return type of ctc{mp,}m_tx() s390/netiucv: Fix return type of netiucv_tx() s390/lcs: Fix return type of lcs_start_xmit() drm/msm: Use drm_mode_copy() drm/rockchip: Use drm_mode_copy() drm/sti: Use drm_mode_copy() drm/mediatek: Fix return type of mtk_hdmi_bridge_mode_valid() drivers/md/md-bitmap: check the return value of md_bitmap_get_counter() md/raid1: stop mdx_raid1 thread when raid1 array run failed drm/amd/display: fix array index out of bound error in bios parser net: add atomic_long_t to net_device_stats fields ipv6/sit: use DEV_STATS_INC() to avoid data-races mrp: introduce active flags to prevent UAF when applicant uninit ppp: associate skb with a device at tx bpf: Prevent decl_tag from being referenced in func_proto arg ethtool: avoiding integer overflow in ethtool_phys_id() media: dvb-frontends: fix leak of memory fw media: dvbdev: adopts refcnt to avoid UAF media: dvb-usb: fix memory leak in dvb_usb_adapter_init() blk-mq: fix possible memleak when register 'hctx' failed drm/amd/display: Use the largest vready_offset in pipe group libbpf: Avoid enum forward-declarations in public API in C++ mode regulator: core: fix use_count leakage when handling boot-on wifi: mt76: do not run mt76u_status_worker if the device is not running mmc: f-sdh30: Add quirks for broken timeout clock capability mmc: renesas_sdhi: better reset from HS400 mode media: si470x: Fix use-after-free in si470x_int_in_callback() clk: st: Fix memory leak in st_of_quadfs_setup() crypto: hisilicon/hpre - fix resource leak in remove process scsi: lpfc: Fix hard lockup when reading the rx_monitor from debugfs scsi: ufs: Reduce the START STOP UNIT timeout scsi: elx: libefc: Fix second parameter type in state callbacks hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param() drm/fsl-dcu: Fix return type of fsl_dcu_drm_connector_mode_valid() drm/sti: Fix return type of sti_{dvo,hda,hdmi}_connector_mode_valid() orangefs: Fix kmemleak in orangefs_prepare_debugfs_help_string() orangefs: Fix kmemleak in orangefs_{kernel,client}_debug_init() tools/include: Add _RET_IP_ and math definitions to kernel.h KVM: selftests: Fix build regression by using accessor function hwmon: (jc42) Fix missing unlock on error in jc42_write() ALSA/ASoC: hda: move/rename snd_hdac_ext_stop_streams to hdac_stream.c ALSA: hda: add snd_hdac_stop_streams() helper ASoC: Intel: Skylake: Fix driver hang during shutdown ASoC: mediatek: mt8173-rt5650-rt5514: fix refcount leak in mt8173_rt5650_rt5514_dev_probe() ASoC: audio-graph-card: fix refcount leak of cpu_ep in __graph_for_each_link() ASoC: rockchip: pdm: Add missing clk_disable_unprepare() in rockchip_pdm_runtime_resume() ASoC: mediatek: mt8183: fix refcount leak in mt8183_mt6358_ts3a227_max98357_dev_probe() ASoC: wm8994: Fix potential deadlock ASoC: rockchip: spdif: Add missing clk_disable_unprepare() in rk_spdif_runtime_resume() ASoC: rt5670: Remove unbalanced pm_runtime_put() drm/i915/display: Don't disable DDI/Transcoder when setting phy test pattern LoadPin: Ignore the "contents" argument of the LSM hooks pstore: Switch pmsg_lock to an rt_mutex to avoid priority inversion perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() afs: Fix lost servers_outstanding count pstore: Make sure CONFIG_PSTORE_PMSG selects CONFIG_RT_MUTEXES ima: Simplify ima_lsm_copy_rule ALSA: usb-audio: add the quirk for KT0206 device ALSA: hda/realtek: Add quirk for Lenovo TianYi510Pro-14IOB ALSA: hda/hdmi: Add HP Device 0x8711 to force connect list usb: cdnsp: fix lack of ZLP for ep0 usb: xhci-mtk: fix leakage of shared hcd when fail to set wakeup irq arm64: dts: qcom: sm8250: fix USB-DP PHY registers usb: dwc3: Fix race between dwc3_set_mode and __dwc3_set_mode usb: dwc3: core: defer probe on ulpi_read_id timeout xhci: Prevent infinite loop in transaction errors recovery for streams HID: wacom: Ensure bootloader PID is usable in hidraw mode HID: mcp2221: don't connect hidraw loop: Fix the max_loop commandline argument treatment when it is set to 0 9p: set req refcount to zero to avoid uninitialized usage security: Restrict CONFIG_ZERO_CALL_USED_REGS to gcc or clang > 15.0.6 reiserfs: Add missing calls to reiserfs_security_free() iio: fix memory leak in iio_device_register_eventset() iio: adc: ad_sigma_delta: do not use internal iio_dev lock iio: adc128s052: add proper .data members in adc128_of_match table regulator: core: fix deadlock on regulator enable floppy: Fix memory leak in do_floppy_init() gcov: add support for checksum field fbdev: fbcon: release buffer when fbcon_do_set_font() failed ovl: fix use inode directly in rcu-walk mode btrfs: do not BUG_ON() on ENOMEM when dropping extent items for a range scsi: qla2xxx: Fix crash when I/O abort times out net: stmmac: fix errno when create_singlethread_workqueue() fails media: dvbdev: fix build warning due to comments media: dvbdev: fix refcnt bug extcon: usbc-tusb320: Call the Type-C IRQ handler only if a port is registered mfd: qcom_rpm: Use devm_of_platform_populate() to simplify code pwm: tegra: Fix 32 bit build Linux 5.15.86 Change-Id: Ic157edd6a65abf4a3167b5d227edeb0564f1be4e Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-01-18 12:52:16 +00:00
Eric Biggers	d4966a8203	ANDROID: fips140: remove CONFIG_CRYPTO_FIPS140 option ... There is no good reason for the CRYPTO_FIPS140 kconfig option to exist separately from CRYPTO_FIPS140_MOD. It existed mainly to guard some code in the module loader that was needed only for loading the fips140 module. However, that code has been removed, since an alternate solution that doesn't require changes to the module loader was found. The remaining references to CRYPTO_FIPS140 are in: - scripts/module.lds.S. But the guarded code only affects building the fips140 module, so CRYPTO_FIPS140_MOD should be used here instead. - lib/crypto/, for guarding the Android vendor hooks required by the fips140 module. However, Android vendor hooks are already guarded by ANDROID_VENDOR_HOOKS. The extra guard by CRYPTO_FIPS140 isn't useful, especially since CRYPTO_FIPS140 was effectively hardcoded to y anyway. It did have the side effect of making the hooks be guarded by arm64, which excluded them from builds of arch/x86/purgatory/. However, a cleaner way to accomplish that is to check for __DISABLE_EXPORTS, which handles both arch/x86/purgatory/ and fips140.ko itself. Bug: 188620248 Change-Id: Ic6141cd2a553540c2bf95774e71de7310926e3ce Signed-off-by: Eric Biggers <ebiggers@google.com>	2023-01-09 21:19:29 +00:00
Kees Cook	30f20ceb87	overflow: Implement size_t saturating arithmetic helpers ... [ Upstream commit e1be43d9b5 ] In order to perform more open-coded replacements of common allocation size arithmetic, the kernel needs saturating (SIZE_MAX) helpers for multiplication, addition, and subtraction. For example, it is common in allocators, especially on realloc, to add to an existing size: p = krealloc(map->patch, sizeof(struct reg_sequence) * (map->patch_regs + num_regs), GFP_KERNEL); There is no existing saturating replacement for this calculation, and just leaving the addition open coded inside array_size() could potentially overflow as well. For example, an overflow in an expression for a size_t argument might wrap to zero: array_size(anything, something_at_size_max + 1) == 0 Introduce size_mul(), size_add(), and size_sub() helpers that implicitly promote arguments to size_t and saturated calculations for use in allocations. With these helpers it is also possible to redefine array_size(), array3_size(), flex_array_size(), and struct_size() in terms of the new helpers. As with the check_*_overflow() helpers, the new helpers use __must_check, though what is really desired is a way to make sure that assignment is only to a size_t lvalue. Without this, it's still possible to introduce overflow/underflow via type conversion (i.e. from size_t to int). Enforcing this will currently need to be left to static analysis or future use of -Wconversion. Additionally update the overflow unit tests to force runtime evaluation for the pathological cases. Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk> Cc: Gustavo A. R. Silva <gustavoars@kernel.org> Cc: Nathan Chancellor <nathan@kernel.org> Cc: Jason Gunthorpe <jgg@ziepe.ca> Cc: Nick Desaulniers <ndesaulniers@google.com> Cc: Leon Romanovsky <leon@kernel.org> Cc: Keith Busch <kbusch@kernel.org> Cc: Len Baker <len.baker@gmx.com> Signed-off-by: Kees Cook <keescook@chromium.org> Stable-dep-of: e001e60869 ("fs/ntfs3: Harden against integer overflows") Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-12-31 13:14:33 +01:00
Zhengchao Shao	357379d504	test_firmware: fix memory leak in test_firmware_init() ... [ Upstream commit 7610615e8c ] When misc_register() failed in test_firmware_init(), the memory pointed by test_fw_config->name is not released. The memory leak information is as follows: unreferenced object 0xffff88810a34cb00 (size 32): comm "insmod", pid 7952, jiffies 4294948236 (age 49.060s) hex dump (first 32 bytes): 74 65 73 74 2d 66 69 72 6d 77 61 72 65 2e 62 69 test-firmware.bi 6e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 n............... backtrace: [<ffffffff81b21fcb>] __kmalloc_node_track_caller+0x4b/0xc0 [<ffffffff81affb96>] kstrndup+0x46/0xc0 [<ffffffffa0403a49>] __test_firmware_config_init+0x29/0x380 [test_firmware] [<ffffffffa040f068>] 0xffffffffa040f068 [<ffffffff81002c41>] do_one_initcall+0x141/0x780 [<ffffffff816a72c3>] do_init_module+0x1c3/0x630 [<ffffffff816adb9e>] load_module+0x623e/0x76a0 [<ffffffff816af471>] __do_sys_finit_module+0x181/0x240 [<ffffffff89978f99>] do_syscall_64+0x39/0xb0 [<ffffffff89a0008b>] entry_SYSCALL_64_after_hwframe+0x63/0xcd Fixes: c92316bf8e ("test_firmware: add batched firmware tests") Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com> Acked-by: Luis Chamberlain <mcgrof@kernel.org> Link: https://lore.kernel.org/r/20221119035721.18268-1-shaozhengchao@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-12-31 13:14:29 +01:00
Akinobu Mita	7e8e8cc136	lib/notifier-error-inject: fix error when writing -errno to debugfs file ... [ Upstream commit f883c3edd2 ] The simple attribute files do not accept a negative value since the commit 488dac0c92 ("libfs: fix error cast of negative value in simple_attr_write()"). This restores the previous behaviour by using newly introduced DEFINE_SIMPLE_ATTRIBUTE_SIGNED instead of DEFINE_SIMPLE_ATTRIBUTE. Link: https://lkml.kernel.org/r/20220919172418.45257-3-akinobu.mita@gmail.com Fixes: 488dac0c92 ("libfs: fix error cast of negative value in simple_attr_write()") Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com> Reported-by: Zhao Gongyi <zhaogongyi@huawei.com> Reviewed-by: David Hildenbrand <david@redhat.com> Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Alexander Viro <viro@zeniv.linux.org.uk> Cc: Jonathan Corbet <corbet@lwn.net> Cc: Oscar Salvador <osalvador@suse.de> Cc: Rafael J. Wysocki <rafael@kernel.org> Cc: Shuah Khan <shuah@kernel.org> Cc: Wei Yongjun <weiyongjun1@huawei.com> Cc: Yicong Yang <yangyicong@hisilicon.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-12-31 13:14:03 +01:00
Gaosheng Cui	e83b47580a	lib/fonts: fix undefined behavior in bit shift for get_default_font ... [ Upstream commit 6fe888c4d2 ] Shifting signed 32-bit value by 31 bits is undefined, so changing significant bit to unsigned. The UBSAN warning calltrace like below: UBSAN: shift-out-of-bounds in lib/fonts/fonts.c:139:20 left shift of 1 by 31 places cannot be represented in type 'int' <TASK> dump_stack_lvl+0x7d/0xa5 dump_stack+0x15/0x1b ubsan_epilogue+0xe/0x4e __ubsan_handle_shift_out_of_bounds+0x1e7/0x20c get_default_font+0x1c7/0x1f0 fbcon_startup+0x347/0x3a0 do_take_over_console+0xce/0x270 do_fbcon_takeover+0xa1/0x170 do_fb_registered+0x2a8/0x340 fbcon_fb_registered+0x47/0xe0 register_framebuffer+0x294/0x4a0 __drm_fb_helper_initial_config_and_unlock+0x43c/0x880 [drm_kms_helper] drm_fb_helper_initial_config+0x52/0x80 [drm_kms_helper] drm_fbdev_client_hotplug+0x156/0x1b0 [drm_kms_helper] drm_fbdev_generic_setup+0xfc/0x290 [drm_kms_helper] bochs_pci_probe+0x6ca/0x772 [bochs] local_pci_probe+0x4d/0xb0 pci_device_probe+0x119/0x320 really_probe+0x181/0x550 __driver_probe_device+0xc6/0x220 driver_probe_device+0x32/0x100 __driver_attach+0x195/0x200 bus_for_each_dev+0xbb/0x120 driver_attach+0x27/0x30 bus_add_driver+0x22e/0x2f0 driver_register+0xa9/0x190 __pci_register_driver+0x90/0xa0 bochs_pci_driver_init+0x52/0x1000 [bochs] do_one_initcall+0x76/0x430 do_init_module+0x61/0x28a load_module+0x1f82/0x2e50 __do_sys_finit_module+0xf8/0x190 __x64_sys_finit_module+0x23/0x30 do_syscall_64+0x58/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd </TASK> Link: https://lkml.kernel.org/r/20221031113829.4183153-1-cuigaosheng1@huawei.com Fixes: c81f717cb9 ("fbcon: Fix typo and bogus logic in get_default_font") Signed-off-by: Gaosheng Cui <cuigaosheng1@huawei.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-12-31 13:14:02 +01:00
wuchi	4b46932283	lib/debugobjects: fix stat count and optimize debug_objects_mem_init ... [ Upstream commit eabb7f1ace ] 1. Var debug_objects_allocated tracks valid kmem_cache_alloc calls, so track it in debug_objects_replace_static_objects. Do similar things in object_cpu_offline. 2. In debug_objects_mem_init, there is no need to call function cpuhp_setup_state_nocalls when debug_objects_enabled = 0 (out of memory). Link: https://lkml.kernel.org/r/20220611130634.99741-1-wuchi.zero@gmail.com Fixes: 634d61f45d ("debugobjects: Percpu pool lookahead freeing/allocation") Fixes: c4b73aabd0 ("debugobjects: Track number of kmem_cache_alloc/kmem_cache_free done") Signed-off-by: wuchi <wuchi.zero@gmail.com> Reviewed-by: Waiman Long <longman@redhat.com> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Christoph Hellwig <hch@lst.de> Cc: Kees Cook <keescook@chromium.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-12-31 13:14:01 +01:00
Andrey Konovalov	5839854929	UPSTREAM: kasan: move tests to mm/kasan/ ... Move KASAN tests to mm/kasan/ to keep the test code alongside the implementation. Link: https://lkml.kernel.org/r/676398f0aeecd47d2f8e3369ea0e95563f641a36.1662416260.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov <andreyknvl@google.com> Reviewed-by: Marco Elver <elver@google.com> Cc: Alexander Potapenko <glider@google.com> Cc: Andrey Konovalov <andreyknvl@gmail.com> Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com> Cc: Dmitry Vyukov <dvyukov@google.com> Cc: Marco Elver <elver@google.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Bug: 254721825 (cherry picked from commit f7e01ab828) Change-Id: I5f140a9b4decb076ca2a3be3587f9d187d05c435 Signed-off-by: Andrey Konovalov <andreyknvl@google.com>	2022-12-20 23:11:43 +00:00
Andrey Konovalov	99f245a12c	UPSTREAM: kasan: add another use-after-free test ... Add a new use-after-free test that checks that KASAN detects use-after-free when another object was allocated in the same slot. This test is mainly relevant for the tag-based modes, which do not use quarantine. Once [1] is resolved, this test can be extended to check that the stack traces in the report point to the proper kmalloc/kfree calls. [1] https://bugzilla.kernel.org/show_bug.cgi?id=212203 Link: https://lkml.kernel.org/r/0659cfa15809dd38faa02bc0a59d0b5dbbd81211.1662411800.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov <andreyknvl@google.com> Acked-by: Marco Elver <elver@google.com> Cc: Alexander Potapenko <glider@google.com> Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com> Cc: Dmitry Vyukov <dvyukov@google.com> Cc: Evgenii Stepanov <eugenis@google.com> Cc: Peter Collingbourne <pcc@google.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Bug: 254721825 (cherry picked from commit 34b592ce5c) Change-Id: I30ea708890166efde2782ff41b42ae0909dcea50 Signed-off-by: Andrey Konovalov <andreyknvl@google.com>	2022-12-20 23:11:43 +00:00
Andrey Konovalov	4c6a34f440	BACKPORT: kasan: drop CONFIG_KASAN_TAGS_IDENTIFY ... (Backport: minor conflicts due folio pathset not backported.) Drop CONFIG_KASAN_TAGS_IDENTIFY and related code to simplify making changes to the reporting code. The dropped functionality will be restored in the following patches in this series. Link: https://lkml.kernel.org/r/4c66ba98eb237e9ed9312c19d423bbcf4ecf88f8.1662411799.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov <andreyknvl@google.com> Reviewed-by: Marco Elver <elver@google.com> Cc: Alexander Potapenko <glider@google.com> Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com> Cc: Dmitry Vyukov <dvyukov@google.com> Cc: Evgenii Stepanov <eugenis@google.com> Cc: Peter Collingbourne <pcc@google.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Bug: 254721825 (cherry picked from commit 687c85afa6) Change-Id: If4df8435ee4447e772b2bef24b58aa7737359bda Signed-off-by: Andrey Konovalov <andreyknvl@google.com>	2022-12-20 23:11:41 +00:00
Andrey Konovalov	25f6112738	UPSTREAM: kasan: clean-up kconfig options descriptions ... Various readability clean-ups of KASAN Kconfig options. No functional changes. Link: https://lkml.kernel.org/r/c160840dd9e4b1ad5529ecfdb0bba35d9a14d826.1652203271.git.andreyknvl@google.com Link: https://lkml.kernel.org/r/47afaecec29221347bee49f58c258ac1ced3b429.1652123204.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov <andreyknvl@google.com> Reviewed-by: Marco Elver <elver@google.com> Cc: Alexander Potapenko <glider@google.com> Cc: Dmitry Vyukov <dvyukov@google.com> Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Bug: 254721825 (cherry picked from commit fe30ddca9f) Change-Id: Ie7813a0711bc8e6e8d47f030cbf226d2a6da3e4a Signed-off-by: Andrey Konovalov <andreyknvl@google.com>	2022-12-20 21:21:26 +00:00
Peter Collingbourne	d7045d5644	UPSTREAM: kasan: update function name in comments ... The function kasan_global_oob was renamed to kasan_global_oob_right, but the comments referring to it were not updated. Do so. Link: https://linux-review.googlesource.com/id/I20faa90126937bbee77d9d44709556c3dd4b40be Link: https://lkml.kernel.org/r/20220219012433.890941-1-pcc@google.com Signed-off-by: Peter Collingbourne <pcc@google.com> Reviewed-by: Miaohe Lin <linmiaohe@huawei.com> Reviewed-by: Marco Elver <elver@google.com> Reviewed-by: Andrey Konovalov <andreyknvl@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Bug: 254721825 (cherry picked from commit 2dfd1bd992) Change-Id: I024557d0b724abb8473e18319ea8267fa038fe7f Signed-off-by: Andrey Konovalov <andreyknvl@google.com>	2022-12-20 21:21:26 +00:00
Imran Khan	e9aa144c45	UPSTREAM: lib, stackdepot: add helper to print stack entries ... To print a stack entries, users of stackdepot, first use stack_depot_fetch to get a list of stack entries and then use stack_trace_print to print this list. Provide a helper in stackdepot to print stack entries based on stackdepot handle. Also change above mentioned users to use this helper. Link: https://lkml.kernel.org/r/20210915014806.3206938-3-imran.f.khan@oracle.com Signed-off-by: Imran Khan <imran.f.khan@oracle.com> Suggested-by: Vlastimil Babka <vbabka@suse.cz> Acked-by: Vlastimil Babka <vbabka@suse.cz> Reviewed-by: Alexander Potapenko <glider@google.com> Cc: Andrey Konovalov <andreyknvl@gmail.com> Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com> Cc: Daniel Vetter <daniel@ffwll.ch> Cc: David Airlie <airlied@linux.ie> Cc: Dmitry Vyukov <dvyukov@google.com> Cc: Geert Uytterhoeven <geert@linux-m68k.org> Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Cc: Maxime Ripard <mripard@kernel.org> Cc: Thomas Zimmermann <tzimmermann@suse.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Bug: 254721825 (cherry picked from commit 505be48165) Signed-off-by: Andrey Konovalov <andreyknvl@google.com> Change-Id: I70e12b6381a908b8c8fd1cffde9d908b6f7691eb	2022-12-20 21:21:26 +00:00