41525 Commits

Author	SHA1	Message	Date
Greg Kroah-Hartman	a0f3313ef9	Merge 6.1.23 into android14-6.1 ... Changes in 6.1.23 thunderbolt: Limit USB3 bandwidth of certain Intel USB4 host routers cifs: update ip_addr for ses only for primary chan setup cifs: prevent data race in cifs_reconnect_tcon() cifs: avoid race conditions with parallel reconnects zonefs: Reorganize code zonefs: Simplify IO error handling zonefs: Reduce struct zonefs_inode_info size zonefs: Separate zone information from inode information zonefs: Fix error message in zonefs_file_dio_append() fsverity: don't drop pagecache at end of FS_IOC_ENABLE_VERITY kernel: kcsan: kcsan_test: build without structleak plugin kcsan: avoid passing -g for test btrfs: rename BTRFS_FS_NO_OVERCOMMIT to BTRFS_FS_ACTIVE_ZONE_TRACKING btrfs: zoned: count fresh BG region as zone unusable net: ethernet: ti: am65-cpsw/cpts: Fix CPTS release action riscv: ftrace: Fixup panic by disabling preemption ARM: dts: aspeed: p10bmc: Update battery node name drm/msm/dpu: Refactor sc7280_pp location drm/msm/dpu: correct sm8250 and sm8350 scaler drm/msm/disp/dpu: fix sc7280_pp base offset tty: serial: fsl_lpuart: switch to new dmaengine_terminate_* API tty: serial: fsl_lpuart: fix race on RX DMA shutdown tracing: Add .percent suffix option to histogram values tracing: Add .graph suffix option to histogram value tracing: Do not let histogram values have some modifiers net: mscc: ocelot: fix stats region batching arm64: efi: Set NX compat flag in PE/COFF header cifs: fix missing unload_nls() in smb2_reconnect() xfrm: Zero padding when dumping algos and encap ASoC: codecs: tx-macro: Fix for KASAN: slab-out-of-bounds ASoC: Intel: avs: max98357a: Explicitly define codec format ASoC: Intel: avs: da7219: Explicitly define codec format ASoC: Intel: avs: ssm4567: Remove nau8825 bits ASoC: Intel: avs: nau8825: Adjust clock control zstd: Fix definition of assert() ACPI: video: Add backlight=native DMI quirk for Dell Vostro 15 3535 ASoC: SOF: ipc3: Check for upper size limit for the received message ASoC: SOF: ipc4-topology: Fix incorrect sample rate print unit ASoC: SOF: Intel: pci-tng: revert invalid bar size setting ASoC: SOF: IPC4: update gain ipc msg definition to align with fw md: avoid signed overflow in slot_store() x86/PVH: obtain VGA console info in Dom0 drm/amdkfd: Fix BO offset for multi-VMA page migration drm/amdkfd: fix a potential double free in pqm_create_queue drm/amdkfd: fix potential kgd_mem UAFs net: hsr: Don't log netdev_err message on unknown prp dst node ALSA: asihpi: check pao in control_message() ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set() fbdev: tgafb: Fix potential divide by zero ACPI: tools: pfrut: Check if the input of level and type is in the right numeric range sched_getaffinity: don't assume 'cpumask_size()' is fully initialized nvme-pci: add NVME_QUIRK_BOGUS_NID for Lexar NM620 drm/amdkfd: Fixed kfd_process cleanup on module exit. net/mlx5e: Lower maximum allowed MTU in XSK to match XDP prerequisites fbdev: nvidia: Fix potential divide by zero fbdev: intelfb: Fix potential divide by zero fbdev: lxfb: Fix potential divide by zero fbdev: au1200fb: Fix potential divide by zero tools/power turbostat: Fix /dev/cpu_dma_latency warnings tools/power turbostat: fix decoding of HWP_STATUS tracing: Fix wrong return in kprobe_event_gen_test.c btrfs: fix uninitialized variable warning in btrfs_update_block_group btrfs: use temporary variable for space_info in btrfs_update_block_group mtd: rawnand: meson: initialize struct with zeroes mtd: nand: mxic-ecc: Fix mxic_ecc_data_xfer_wait_for_completion() when irq is used ca8210: Fix unsigned mac_len comparison with zero in ca8210_skb_tx() riscv/kvm: Fix VM hang in case of timer delta being zero. mips: bmips: BCM6358: disable RAC flush for TP1 ALSA: usb-audio: Fix recursive locking at XRUN during syncing PCI: dwc: Fix PORT_LINK_CONTROL update when CDM check enabled platform/x86: think-lmi: add missing type attribute platform/x86: think-lmi: use correct possible_values delimiters platform/x86: think-lmi: only display possible_values if available platform/x86: think-lmi: Add possible_values for ThinkStation platform/surface: aggregator: Add missing fwnode_handle_put() mtd: rawnand: meson: invalidate cache on polling ECC bit SUNRPC: fix shutdown of NFS TCP client socket sfc: ef10: don't overwrite offload features at NIC reset scsi: megaraid_sas: Fix crash after a double completion scsi: mpt3sas: Don't print sense pool info twice net: dsa: realtek: fix out-of-bounds access ptp_qoriq: fix memory leak in probe() net: dsa: microchip: ksz8: fix ksz8_fdb_dump() net: dsa: microchip: ksz8: fix ksz8_fdb_dump() to extract all 1024 entries net: dsa: microchip: ksz8: fix offset for the timestamp filed net: dsa: microchip: ksz8: ksz8_fdb_dump: avoid extracting ghost entry from empty dynamic MAC table. net: dsa: microchip: ksz8863_smi: fix bulk access net: dsa: microchip: ksz8: fix MDB configuration with non-zero VID r8169: fix RTL8168H and RTL8107E rx crc error regulator: Handle deferred clk net/net_failover: fix txq exceeding warning net: stmmac: don't reject VLANs when IFF_PROMISC is set drm/i915/tc: Fix the ICL PHY ownership check in TC-cold state platform/x86/intel/pmc: Alder Lake PCH slp_s0_residency fix can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write s390/vfio-ap: fix memory leak in vfio_ap device driver ACPI: bus: Rework system-level device notification handling loop: LOOP_CONFIGURE: send uevents for partitions net: mvpp2: classifier flow fix fragmentation flags net: mvpp2: parser fix QinQ net: mvpp2: parser fix PPPoE smsc911x: avoid PHY being resumed when interface is not up ice: Fix ice_cfg_rdma_fltr() to only update relevant fields ice: add profile conflict check for AVF FDIR ice: fix invalid check for empty list in ice_sched_assoc_vsi_to_agg() ALSA: ymfpci: Create card with device-managed snd_devm_card_new() ALSA: ymfpci: Fix BUG_ON in probe function net: ipa: compute DMA pool size properly i40e: fix registers dump after run ethtool adapter self test bnxt_en: Fix reporting of test result in ethtool selftest bnxt_en: Fix typo in PCI id to device description string mapping bnxt_en: Add missing 200G link speed reporting net: dsa: mv88e6xxx: Enable IGMP snooping on user ports only net: ethernet: mtk_eth_soc: fix flow block refcounting logic net: ethernet: mtk_eth_soc: add missing ppe cache flush when deleting a flow pinctrl: ocelot: Fix alt mode for ocelot Input: xpad - fix incorrectly applied patch for MAP_PROFILE_BUTTON iommu/vt-d: Allow zero SAGAW if second-stage not supported Input: i8042 - add TUXEDO devices to i8042 quirk tables for partial fix Input: alps - fix compatibility with -funsigned-char Input: focaltech - use explicitly signed char type cifs: prevent infinite recursion in CIFSGetDFSRefer() cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL Input: i8042 - add quirk for Fujitsu Lifebook A574/H Input: goodix - add Lenovo Yoga Book X90F to nine_bytes_report DMI table btrfs: fix deadlock when aborting transaction during relocation with scrub btrfs: fix race between quota disable and quota assign ioctls btrfs: scan device in non-exclusive mode zonefs: Do not propagate iomap_dio_rw() ENOTBLK error to user space block/io_uring: pass in issue_flags for uring_cmd task_work handling io_uring/poll: clear single/double poll flags on poll arming io_uring/rsrc: fix rogue rsrc node grabbing io_uring: fix poll/netmsg alloc caches vmxnet3: use gro callback when UPT is enabled zonefs: Always invalidate last cached page on append write dm: fix __send_duplicate_bios() to always allow for splitting IO can: j1939: prevent deadlock by moving j1939_sk_errqueue() xen/netback: don't do grant copy across page boundary net: phy: dp83869: fix default value for tx-/rx-internal-delay modpost: Fix processing of CRCs on 32-bit build machines pinctrl: amd: Disable and mask interrupts on resume pinctrl: at91-pio4: fix domain name assignment platform/x86: ideapad-laptop: Stop sending KEY_TOUCHPAD_TOGGLE powerpc: Don't try to copy PPR for task with NULL pt_regs powerpc/pseries/vas: Ignore VAS update for DLPAR if copy/paste is not enabled powerpc/64s: Fix __pte_needs_flush() false positive warning NFSv4: Fix hangs when recovering open state after a server reboot ALSA: hda/conexant: Partial revert of a quirk for Lenovo ALSA: usb-audio: Fix regression on detection of Roland VS-100 ALSA: hda/realtek: Add quirks for some Clevo laptops ALSA: hda/realtek: Add quirk for Lenovo ZhaoYang CF4620Z xtensa: fix KASAN report for show_stack rcu: Fix rcu_torture_read ftrace event dt-bindings: mtd: jedec,spi-nor: Document CPOL/CPHA support s390/uaccess: add missing earlyclobber annotations to __clear_user() s390: reintroduce expoline dependence to scripts drm/etnaviv: fix reference leak when mmaping imported buffer drm/amdgpu: allow more APUs to do mode2 reset when go to S4 drm/amd/display: Add DSC Support for Synaptics Cascaded MST Hub drm/amd/display: Take FEC Overhead into Timeslot Calculation drm/i915/gem: Flush lmem contents after construction drm/i915/dpt: Treat the DPT BO as a framebuffer drm/i915: Disable DC states for all commits drm/i915: Move CSC load back into .color_commit_arm() when PSR is enabled on skl/glk KVM: arm64: PMU: Fix GET_ONE_REG for vPMC regs to return the current value KVM: arm64: Disable interrupts while walking userspace PTs net: dsa: mv88e6xxx: read FID when handling ATU violations net: dsa: mv88e6xxx: replace ATU violation prints with trace points net: dsa: mv88e6xxx: replace VTU violation prints with trace points selftests/bpf: Test btf dump for struct with padding only fields libbpf: Fix BTF-to-C converter's padding logic selftests/bpf: Add few corner cases to test padding handling of btf_dump libbpf: Fix btf_dump's packed struct determination usb: ucsi: Fix ucsi->connector race drm/amdkfd: Get prange->offset after svm_range_vram_node_new hsr: ratelimit only when errors are printed x86/PVH: avoid 32-bit build warning when obtaining VGA console info Revert "cpuidle, intel_idle: Fix CPUIDLE_FLAG_IRQ_ENABLE *again*" Linux 6.1.23 Change-Id: I15af3697170567c4678bcc9c2380d80e7cef5bc9 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-04-06 14:14:07 +00:00
Anton Gusev	089d656992	tracing: Fix wrong return in kprobe_event_gen_test.c ... [ Upstream commit bc4f359b3b ] Overwriting the error code with the deletion result may cause the function to return 0 despite encountering an error. Commit b111545d26 ("tracing: Remove the useless value assignment in test_create_synth_event()") solves a similar issue by returning the original error code, so this patch does the same. Found by Linux Verification Center (linuxtesting.org) with SVACE. Link: https://lore.kernel.org/linux-trace-kernel/20230131075818.5322-1-aagusev@ispras.ru Signed-off-by: Anton Gusev <aagusev@ispras.ru> Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org> Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-04-06 12:10:41 +02:00
Linus Torvalds	c8943cf3ab	sched_getaffinity: don't assume 'cpumask_size()' is fully initialized ... [ Upstream commit 6015b1aca1 ] The getaffinity() system call uses 'cpumask_size()' to decide how big the CPU mask is - so far so good. It is indeed the allocation size of a cpumask. But the code also assumes that the whole allocation is initialized without actually doing so itself. That's wrong, because we might have fixed-size allocations (making copying and clearing more efficient), but not all of it is then necessarily used if 'nr_cpu_ids' is smaller. Having checked other users of 'cpumask_size()', they all seem to be ok, either using it purely for the allocation size, or explicitly zeroing the cpumask before using the size in bytes to copy it. See for example the ublk_ctrl_get_queue_affinity() function that uses the proper 'zalloc_cpumask_var()' to make sure that the whole mask is cleared, whether the storage is on the stack or if it was an external allocation. Fix this by just zeroing the allocation before using it. Do the same for the compat version of sched_getaffinity(), which had the same logic. Also, for consistency, make sched_getaffinity() use 'cpumask_bits()' to access the bits. For a cpumask_var_t, it ends up being a pointer to the same data either way, but it's just a good idea to treat it like you would a 'cpumask_t'. The compat case already did that. Reported-by: Ryan Roberts <ryan.roberts@arm.com> Link: https://lore.kernel.org/lkml/7d026744-6bd6-6827-0471-b5e8eae0be3f@arm.com/ Cc: Yury Norov <yury.norov@gmail.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-04-06 12:10:40 +02:00
Steven Rostedt (Google)	39cd75f2f3	tracing: Do not let histogram values have some modifiers ... [ Upstream commit e0213434fe ] Histogram values can not be strings, stacktraces, graphs, symbols, syscalls, or grouped in buckets or log. Give an error if a value is set to do so. Note, the histogram code was not prepared to handle these modifiers for histograms and caused a bug. Mark Rutland reported: # echo 'p:copy_to_user __arch_copy_to_user n=$arg2' >> /sys/kernel/tracing/kprobe_events # echo 'hist:keys=n:vals=hitcount.buckets=8:sort=hitcount' > /sys/kernel/tracing/events/kprobes/copy_to_user/trigger # cat /sys/kernel/tracing/events/kprobes/copy_to_user/hist [ 143.694628] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 143.695190] Mem abort info: [ 143.695362] ESR = 0x0000000096000004 [ 143.695604] EC = 0x25: DABT (current EL), IL = 32 bits [ 143.695889] SET = 0, FnV = 0 [ 143.696077] EA = 0, S1PTW = 0 [ 143.696302] FSC = 0x04: level 0 translation fault [ 143.702381] Data abort info: [ 143.702614] ISV = 0, ISS = 0x00000004 [ 143.702832] CM = 0, WnR = 0 [ 143.703087] user pgtable: 4k pages, 48-bit VAs, pgdp=00000000448f9000 [ 143.703407] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 [ 143.704137] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP [ 143.704714] Modules linked in: [ 143.705273] CPU: 0 PID: 133 Comm: cat Not tainted 6.2.0-00003-g6fc512c10a7c #3 [ 143.706138] Hardware name: linux,dummy-virt (DT) [ 143.706723] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 143.707120] pc : hist_field_name.part.0+0x14/0x140 [ 143.707504] lr : hist_field_name.part.0+0x104/0x140 [ 143.707774] sp : ffff800008333a30 [ 143.707952] x29: ffff800008333a30 x28: 0000000000000001 x27: 0000000000400cc0 [ 143.708429] x26: ffffd7a653b20260 x25: 0000000000000000 x24: ffff10d303ee5800 [ 143.708776] x23: ffffd7a6539b27b0 x22: ffff10d303fb8c00 x21: 0000000000000001 [ 143.709127] x20: ffff10d303ec2000 x19: 0000000000000000 x18: 0000000000000000 [ 143.709478] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 [ 143.709824] x14: 0000000000000000 x13: 203a6f666e692072 x12: 6567676972742023 [ 143.710179] x11: 0a230a6d6172676f x10: 000000000000002c x9 : ffffd7a6521e018c [ 143.710584] x8 : 000000000000002c x7 : 7f7f7f7f7f7f7f7f x6 : 000000000000002c [ 143.710915] x5 : ffff10d303b0103e x4 : ffffd7a653b20261 x3 : 000000000000003d [ 143.711239] x2 : 0000000000020001 x1 : 0000000000000001 x0 : 0000000000000000 [ 143.711746] Call trace: [ 143.712115] hist_field_name.part.0+0x14/0x140 [ 143.712642] hist_field_name.part.0+0x104/0x140 [ 143.712925] hist_field_print+0x28/0x140 [ 143.713125] event_hist_trigger_print+0x174/0x4d0 [ 143.713348] hist_show+0xf8/0x980 [ 143.713521] seq_read_iter+0x1bc/0x4b0 [ 143.713711] seq_read+0x8c/0xc4 [ 143.713876] vfs_read+0xc8/0x2a4 [ 143.714043] ksys_read+0x70/0xfc [ 143.714218] __arm64_sys_read+0x24/0x30 [ 143.714400] invoke_syscall+0x50/0x120 [ 143.714587] el0_svc_common.constprop.0+0x4c/0x100 [ 143.714807] do_el0_svc+0x44/0xd0 [ 143.714970] el0_svc+0x2c/0x84 [ 143.715134] el0t_64_sync_handler+0xbc/0x140 [ 143.715334] el0t_64_sync+0x190/0x194 [ 143.715742] Code: a9bd7bfd 910003fd a90153f3 aa0003f3 (f9400000) [ 143.716510] ---[ end trace 0000000000000000 ]--- Segmentation fault Link: https://lkml.kernel.org/r/20230302020810.559462599@goodmis.org Cc: stable@vger.kernel.org Cc: Masami Hiramatsu <mhiramat@kernel.org> Cc: Andrew Morton <akpm@linux-foundation.org> Fixes: c6afad49d1 ("tracing: Add hist trigger 'sym' and 'sym-offset' modifiers") Reported-by: Mark Rutland <mark.rutland@arm.com> Tested-by: Mark Rutland <mark.rutland@arm.com> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-04-06 12:10:36 +02:00
Masami Hiramatsu (Google)	8ebeea1052	tracing: Add .graph suffix option to histogram value ... [ Upstream commit a2c54256de ] Add the .graph suffix which shows the bar graph of the histogram value. For example, the below example shows that the bar graph of the histogram of the runtime for each tasks. ------ # cd /sys/kernel/debug/tracing/ # echo hist:keys=pid:vals=runtime.graph:sort=pid > \ events/sched/sched_stat_runtime/trigger # sleep 10 # cat events/sched/sched_stat_runtime/hist # event histogram # # trigger info: hist:keys=pid:vals=hitcount,runtime.graph:sort=pid:size=2048 [active] # { pid: 14 } hitcount: 2 runtime: { pid: 16 } hitcount: 8 runtime: { pid: 26 } hitcount: 1 runtime: { pid: 57 } hitcount: 3 runtime: { pid: 61 } hitcount: 20 runtime: ### { pid: 66 } hitcount: 2 runtime: { pid: 70 } hitcount: 3 runtime: { pid: 72 } hitcount: 2 runtime: { pid: 145 } hitcount: 14 runtime: #################### { pid: 152 } hitcount: 5 runtime: ####### { pid: 153 } hitcount: 2 runtime: #### Totals: Hits: 62 Entries: 11 Dropped: 0 ------- Link: https://lore.kernel.org/linux-trace-kernel/166610813953.56030.10944148382315789485.stgit@devnote2 Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Reviewed-by: Tom Zanussi <zanussi@kernel.org> Tested-by: Tom Zanussi <zanussi@kernel.org> Stable-dep-of: e0213434fe ("tracing: Do not let histogram values have some modifiers") Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-04-06 12:10:36 +02:00
Masami Hiramatsu (Google)	93454d1a30	tracing: Add .percent suffix option to histogram values ... [ Upstream commit abaa5258ce ] Add .percent suffix option to show the histogram values in percentage. This feature is useful when we need yo undersntand the overall trend for the histograms of large values. E.g. this shows the runtime percentage for each tasks. ------ # cd /sys/kernel/debug/tracing/ # echo hist:keys=pid:vals=hitcount,runtime.percent:sort=pid > \ events/sched/sched_stat_runtime/trigger # sleep 10 # cat events/sched/sched_stat_runtime/hist # event histogram # # trigger info: hist:keys=pid:vals=hitcount,runtime.percent:sort=pid:size=2048 [active] # { pid: 8 } hitcount: 7 runtime (%): 4.14 { pid: 14 } hitcount: 5 runtime (%): 3.69 { pid: 16 } hitcount: 11 runtime (%): 3.41 { pid: 61 } hitcount: 41 runtime (%): 19.75 { pid: 65 } hitcount: 4 runtime (%): 1.48 { pid: 70 } hitcount: 6 runtime (%): 3.60 { pid: 72 } hitcount: 2 runtime (%): 1.10 { pid: 144 } hitcount: 10 runtime (%): 32.01 { pid: 151 } hitcount: 8 runtime (%): 22.66 { pid: 152 } hitcount: 2 runtime (%): 8.10 Totals: Hits: 96 Entries: 10 Dropped: 0 ----- Link: https://lore.kernel.org/linux-trace-kernel/166610813077.56030.4238090506973562347.stgit@devnote2 Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Reviewed-by: Tom Zanussi <zanussi@kernel.org> Tested-by: Tom Zanussi <zanussi@kernel.org> Stable-dep-of: e0213434fe ("tracing: Do not let histogram values have some modifiers") Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-04-06 12:10:36 +02:00
Marco Elver	bae092f587	kcsan: avoid passing -g for test ... [ Upstream commit 5eb39cde1e ] Nathan reported that when building with GNU as and a version of clang that defaults to DWARF5, the assembler will complain with: Error: non-constant .uleb128 is not supported This is because `-g` defaults to the compiler debug info default. If the assembler does not support some of the directives used, the above errors occur. To fix, remove the explicit passing of `-g`. All the test wants is that stack traces print valid function names, and debug info is not required for that. (I currently cannot recall why I added the explicit `-g`.) Link: https://lkml.kernel.org/r/20230316224705.709984-2-elver@google.com Fixes: 1fe84fd4a4 ("kcsan: Add test suite") Signed-off-by: Marco Elver <elver@google.com> Reported-by: Nathan Chancellor <nathan@kernel.org> Cc: Alexander Potapenko <glider@google.com> Cc: Dmitry Vyukov <dvyukov@google.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-04-06 12:10:35 +02:00
Anders Roxell	01f3150cc7	kernel: kcsan: kcsan_test: build without structleak plugin ... [ Upstream commit 6fcd4267a8 ] Building kcsan_test with structleak plugin enabled makes the stack frame size to grow. kernel/kcsan/kcsan_test.c:704:1: error: the frame size of 3296 bytes is larger than 2048 bytes [-Werror=frame-larger-than=] Turn off the structleak plugin checks for kcsan_test. Link: https://lkml.kernel.org/r/20221128104358.2660634-1-anders.roxell@linaro.org Signed-off-by: Anders Roxell <anders.roxell@linaro.org> Suggested-by: Arnd Bergmann <arnd@arndb.de> Acked-by: Marco Elver <elver@google.com> Cc: Arnd Bergmann <arnd@arndb.de> Cc: David Gow <davidgow@google.com> Cc: Jason A. Donenfeld <Jason@zx2c4.com> Cc: Kees Cook <keescook@chromium.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Stable-dep-of: 5eb39cde1e ("kcsan: avoid passing -g for test") Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-04-06 12:10:34 +02:00
Greg Kroah-Hartman	7f4246b044	Revert "ANDROID: kernel: Add restricted vendor hook in creds" ... This reverts commit 1abc68878a. The hooks added in that commit: android_rvh_commit_creds android_rvh_exit_creds android_rvh_override_creds android_rvh_revert_creds are not used by anyone, so remove them. If they are needed in the future, they can be resubmitted for review. Bug: 181639260 Cc: Kuan-Ying Lee <Kuan-Ying.Lee@mediatek.com> Change-Id: I1b371d6b0be827e39c5163e2ed2134307d81730a Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-03-31 18:25:45 +00:00
Greg Kroah-Hartman	db50ac4d0a	Merge 6.1.22 into android14-6.1 ... Changes in 6.1.22 interconnect: qcom: osm-l3: fix icc_onecell_data allocation interconnect: qcom: sm8450: switch to qcom_icc_rpmh_* function interconnect: qcom: qcm2290: Fix MASTER_SNOC_BIMC_NRT perf/core: Fix perf_output_begin parameter is incorrectly invoked in perf_event_bpf_output perf: fix perf_event_context->time tracing/hwlat: Replace sched_setaffinity with set_cpus_allowed_ptr drm/amd/display: Include virtual signal to set k1 and k2 values drm/amd/display: fix k1 k2 divider programming for phantom streams drm/amd/display: Remove OTG DIV register write for Virtual signals. mptcp: refactor passive socket initialization mptcp: use the workqueue to destroy unaccepted sockets mptcp: fix UaF in listener shutdown drm/amd/display: Fix DP MST sinks removal issue arm64: dts: qcom: sm8450: Mark UFS controller as cache coherent power: supply: bq24190: Fix use after free bug in bq24190_remove due to race condition power: supply: da9150: Fix use after free bug in da9150_charger_remove due to race condition arm64: dts: imx8dxl-evk: Disable hibernation mode of AR8031 for EQOS arm64: dts: imx8dxl-evk: Fix eqos phy reset gpio ARM: dts: imx6sll: e70k02: fix usbotg1 pinctrl ARM: dts: imx6sll: e60k02: fix usbotg1 pinctrl ARM: dts: imx6sl: tolino-shine2hd: fix usbotg1 pinctrl arm64: dts: imx8mn: specify #sound-dai-cells for SAI nodes arm64: dts: imx93: add missing #address-cells and #size-cells to i2c nodes NFS: Fix /proc/PID/io read_bytes for buffered reads xsk: Add missing overflow check in xdp_umem_reg iavf: fix inverted Rx hash condition leading to disabled hash iavf: fix non-tunneled IPv6 UDP packet type and hashing iavf: do not track VLAN 0 filters intel/igbvf: free irq on the error path in igbvf_request_msix() igbvf: Regard vf reset nack as success igc: fix the validation logic for taprio's gate list i2c: imx-lpi2c: check only for enabled interrupt flags i2c: mxs: ensure that DMA buffers are safe for DMA i2c: hisi: Only use the completion interrupt to finish the transfer scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate() nfsd: don't replace page in rq_pages if it's a continuation of last page net: dsa: b53: mmap: fix device tree support net: usb: smsc95xx: Limit packet length to skb->len efi/libstub: smbios: Use length member instead of record struct size qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info xirc2ps_cs: Fix use after free bug in xirc2ps_detach net: phy: Ensure state transitions are processed from phy_stop() net: mdio: fix owner field for mdio buses registered using device-tree net: mdio: fix owner field for mdio buses registered using ACPI net: stmmac: Fix for mismatched host/device DMA address width thermal/drivers/mellanox: Use generic thermal_zone_get_trip() function mlxsw: core_thermal: Fix fan speed in maximum cooling state drm/i915: Print return value on error drm/i915/fbdev: lock the fbdev obj before vma pin drm/i915/guc: Rename GuC register state capture node to be more obvious drm/i915/guc: Fix missing ecodes drm/i915/gt: perform uc late init after probe error injection net: qcom/emac: Fix use after free bug in emac_remove due to race condition net: usb: lan78xx: Limit packet length to skb->len net/ps3_gelic_net: Fix RX sk_buff length net/ps3_gelic_net: Use dma_mapping_error octeontx2-vf: Add missing free for alloc_percpu bootconfig: Fix testcase to increase max node keys: Do not cache key in task struct if key is requested from kernel thread ice: check if VF exists before mode check iavf: fix hang on reboot with ice i40e: fix flow director packet filter programming bpf: Adjust insufficient default bpf_jit_limit net/mlx5e: Set uplink rep as NETNS_LOCAL net/mlx5e: Block entering switchdev mode with ns inconsistency net/mlx5: Fix steering rules cleanup net/mlx5e: Overcome slow response for first macsec ASO WQE net/mlx5: Read the TC mapping of all priorities on ETS query net/mlx5: E-Switch, Fix an Oops in error handling code net: dsa: tag_brcm: legacy: fix daisy-chained switches atm: idt77252: fix kmemleak when rmmod idt77252 erspan: do not use skb_mac_header() in ndo_start_xmit() net/sonic: use dma_mapping_error() for error check nvme-tcp: fix nvme_tcp_term_pdu to match spec mlxsw: spectrum_fid: Fix incorrect local port type hvc/xen: prevent concurrent accesses to the shared ring ksmbd: add low bound validation to FSCTL_SET_ZERO_DATA ksmbd: add low bound validation to FSCTL_QUERY_ALLOCATED_RANGES ksmbd: fix possible refcount leak in smb2_open() Bluetooth: hci_sync: Resume adv with no RPA when active scan Bluetooth: hci_core: Detect if an ACL packet is in fact an ISO packet Bluetooth: btusb: Remove detection of ISO packets over bulk Bluetooth: ISO: fix timestamped HCI ISO data packet parsing Bluetooth: Remove "Power-on" check from Mesh feature gve: Cache link_speed value from device net: asix: fix modprobe "sysfs: cannot create duplicate filename" net: dsa: mt7530: move enabling disabling core clock to mt7530_pll_setup() net: dsa: mt7530: move lowering TRGMII driving to mt7530_setup() net: dsa: mt7530: move setting ssc_delta to PHY_INTERFACE_MODE_TRGMII case net: mdio: thunder: Add missing fwnode_handle_put() drm/amd/display: Set dcn32 caps.seamless_odm Bluetooth: btqcomsmd: Fix command timeout after setting BD address Bluetooth: L2CAP: Fix responding with wrong PDU type Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work Bluetooth: mgmt: Fix MGMT add advmon with RSSI command Bluetooth: HCI: Fix global-out-of-bounds platform/chrome: cros_ec_chardev: fix kernel data leak from ioctl entry: Fix noinstr warning in __enter_from_user_mode() perf/x86/amd/core: Always clear status for idx entry/rcu: Check TIF_RESCHED _after_ delayed RCU wake-up hwmon: fix potential sensor registration fail if of_node is missing hwmon (it87): Fix voltage scaling for chips with 10.9mV ADCs scsi: qla2xxx: Synchronize the IOCB count to be in order scsi: qla2xxx: Perform lockless command completion in abort path smb3: lower default deferred close timeout to address perf regression smb3: fix unusable share after force unmount failure uas: Add US_FL_NO_REPORT_OPCODES for JMicron JMS583Gen 2 thunderbolt: Use scale field when allocating USB3 bandwidth thunderbolt: Call tb_check_quirks() after initializing adapters thunderbolt: Add quirk to disable CLx thunderbolt: Fix memory leak in margining thunderbolt: Disable interrupt auto clear for rings thunderbolt: Add missing UNSET_INBOUND_SBTX for retimer access thunderbolt: Use const qualifier for `ring_interrupt_index` thunderbolt: Rename shadowed variables bit to interrupt_bit and auto_clear_bit ASoC: amd: yp: Add OMEN by HP Gaming Laptop 16z-n000 to quirks ASoC: amd: yc: Add DMI entries to support HP OMEN 16-n0xxx (8A43) ACPI: x86: Drop quirk for HP Elitebook ACPI: x86: utils: Add Cezanne to the list for forcing StorageD3Enable riscv: Bump COMMAND_LINE_SIZE value to 1024 drm/cirrus: NULL-check pipe->plane.state->fb in cirrus_pipe_update() HID: cp2112: Fix driver not registering GPIO IRQ chip as threaded ca8210: fix mac_len negative array access HID: logitech-hidpp: Add support for Logitech MX Master 3S mouse HID: intel-ish-hid: ipc: Fix potential use-after-free in work function m68k: mm: Fix systems with memory at end of 32-bit address space m68k: Only force 030 bus error if PC not in exception table selftests/bpf: check that modifier resolves after pointer scsi: target: iscsi: Fix an error message in iscsi_check_key() scsi: qla2xxx: Add option to disable FC2 Target support scsi: hisi_sas: Check devm_add_action() return value scsi: ufs: core: Add soft dependency on governor_simpleondemand scsi: lpfc: Check kzalloc() in lpfc_sli4_cgn_params_read() scsi: lpfc: Avoid usage of list iterator variable after loop scsi: mpi3mr: Driver unload crashes host when enhanced logging is enabled scsi: mpi3mr: Wait for diagnostic save during controller init scsi: mpi3mr: NVMe command size greater than 8K fails scsi: mpi3mr: Bad drive in topology results kernel crash scsi: storvsc: Handle BlockSize change in Hyper-V VHD/VHDX file platform/x86: int3472: Add GPIOs to Surface Go 3 Board data net: usb: cdc_mbim: avoid altsetting toggling for Telit FE990 net: usb: qmi_wwan: add Telit 0x1080 composition drm/amd/display: Update clock table to include highest clock setting sh: sanitize the flags on sigreturn drm/amdgpu: Fix call trace warning and hang when removing amdgpu device drm/amd: Fix initialization mistake for NBIO 7.3.0 net/sched: act_mirred: better wording on protection against excessive stack growth act_mirred: use the backlog for nested calls to mirred ingress cifs: lock chan_lock outside match_session cifs: append path to open_enter trace event cifs: do not poll server interfaces too regularly cifs: empty interface list when server doesn't support query interfaces cifs: dump pending mids for all channels in DebugData cifs: print session id while listing open files cifs: fix dentry lookups in directory handle cache x86/fpu/xstate: Prevent false-positive warning in __copy_xstate_uabi_buf() selftests/x86/amx: Add a ptrace test scsi: core: Add BLIST_SKIP_VPD_PAGES for SKhynix H28U74301AMR usb: misc: onboard-hub: add support for Microchip USB2517 USB 2.0 hub usb: dwc2: drd: fix inconsistent mode if role-switch-default-mode="host" usb: dwc2: fix a devres leak in hw_enable upon suspend resume usb: gadget: u_audio: don't let userspace block driver unbind btrfs: zoned: fix btrfs_can_activate_zone() to support DUP profile Bluetooth: Fix race condition in hci_cmd_sync_clear efi: sysfb_efi: Fix DMI quirks not working for simpledrm mm/slab: Fix undefined init_cache_node_node() for NUMA and !SMP fscrypt: destroy keyring after security_sb_delete() fsverity: Remove WQ_UNBOUND from fsverity read workqueue lockd: set file_lock start and end when decoding nlm4 testargs arm64: dts: imx8mm-nitrogen-r2: fix WM8960 clock name igb: revert rtnl_lock() that causes deadlock dm thin: fix deadlock when swapping to thin device usb: typec: tcpm: fix create duplicate source-capabilities file usb: typec: tcpm: fix warning when handle discover_identity message usb: cdns3: Fix issue with using incorrect PCI device function usb: cdnsp: Fixes issue with redundant Status Stage usb: cdnsp: changes PCI Device ID to fix conflict with CNDS3 driver usb: chipdea: core: fix return -EINVAL if request role is the same with current role usb: chipidea: core: fix possible concurrent when switch role usb: dwc3: gadget: Add 1ms delay after end transfer command without IOC usb: ucsi: Fix NULL pointer deref in ucsi_connector_change() usb: ucsi_acpi: Increase the command completion timeout mm: kfence: fix using kfence_metadata without initialization in show_object() kfence: avoid passing -g for test io_uring/net: avoid sending -ECONNABORTED on repeated connection requests io_uring/rsrc: fix null-ptr-deref in io_file_bitmap_get() Revert "kasan: drop skip_kasan_poison variable in free_pages_prepare" test_maple_tree: add more testing for mas_empty_area() maple_tree: fix mas_skip_node() end slot detection ksmbd: fix wrong signingkey creation when encryption is AES256 ksmbd: set FILE_NAMED_STREAMS attribute in FS_ATTRIBUTE_INFORMATION ksmbd: don't terminate inactive sessions after a few seconds ksmbd: return STATUS_NOT_SUPPORTED on unsupported smb2.0 dialect ksmbd: return unsupported error on smb1 mount wifi: mac80211: fix qos on mesh interfaces nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy() drm/bridge: lt8912b: return EPROBE_DEFER if bridge is not found drm/amd/display: fix wrong index used in dccg32_set_dpstreamclk drm/meson: fix missing component unbind on bind errors drm/amdgpu/nv: Apply ASPM quirk on Intel ADL + AMD Navi drm/i915/active: Fix missing debug object activation drm/i915: Preserve crtc_state->inherited during state clearing drm/amdgpu: skip ASIC reset for APUs when go to S4 drm/amdgpu: reposition the gpu reset checking for reuse riscv: mm: Fix incorrect ASID argument when flushing TLB riscv: Handle zicsr/zifencei issues between clang and binutils tee: amdtee: fix race condition in amdtee_open_session firmware: arm_scmi: Fix device node validation for mailbox transport arm64: dts: qcom: sc7280: Mark PCIe controller as cache coherent arm64: dts: qcom: sm8150: Fix the iommu mask used for PCIe controllers soc: qcom: llcc: Fix slice configuration values for SC8280XP mm/ksm: fix race with VMA iteration and mm_struct teardown bus: imx-weim: fix branch condition evaluates to a garbage value i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer() dm stats: check for and propagate alloc_percpu failure dm crypt: add cond_resched() to dmcrypt_write() dm crypt: avoid accessing uninitialized tasklet sched/fair: sanitize vruntime of entity being placed sched/fair: Sanitize vruntime of entity being migrated drm/amdkfd: introduce dummy cache info for property asic drm/amdkfd: Fix the warning of array-index-out-of-bounds drm/amdkfd: add GC 11.0.4 KFD support drm/amdkfd: Fix the memory overrun Linux 6.1.22 Change-Id: Id13b4655dbfb59c29a0b8953e5e0cda3703f1879 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-03-31 08:15:39 +00:00
Vincent Guittot	388c4c1d12	sched/fair: Sanitize vruntime of entity being migrated ... commit a53ce18cac upstream. Commit 829c1651e9 ("sched/fair: sanitize vruntime of entity being placed") fixes an overflowing bug, but ignore a case that se->exec_start is reset after a migration. For fixing this case, we delay the reset of se->exec_start after placing the entity which se->exec_start to detect long sleeping task. In order to take into account a possible divergence between the clock_task of 2 rqs, we increase the threshold to around 104 days. Fixes: 829c1651e9 ("sched/fair: sanitize vruntime of entity being placed") Originally-by: Zhang Qiao <zhangqiao22@huawei.com> Signed-off-by: Vincent Guittot <vincent.guittot@linaro.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Tested-by: Zhang Qiao <zhangqiao22@huawei.com> Link: https://lore.kernel.org/r/20230317160810.107988-1-vincent.guittot@linaro.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-03-30 12:49:30 +02:00
Zhang Qiao	e427be6889	sched/fair: sanitize vruntime of entity being placed ... commit 829c1651e9 upstream. When a scheduling entity is placed onto cfs_rq, its vruntime is pulled to the base level (around cfs_rq->min_vruntime), so that the entity doesn't gain extra boost when placed backwards. However, if the entity being placed wasn't executed for a long time, its vruntime may get too far behind (e.g. while cfs_rq was executing a low-weight hog), which can inverse the vruntime comparison due to s64 overflow. This results in the entity being placed with its original vruntime way forwards, so that it will effectively never get to the cpu. To prevent that, ignore the vruntime of the entity being placed if it didn't execute for much longer than the characteristic sheduler time scale. [rkagan: formatted, adjusted commit log, comments, cutoff value] Signed-off-by: Zhang Qiao <zhangqiao22@huawei.com> Co-developed-by: Roman Kagan <rkagan@amazon.de> Signed-off-by: Roman Kagan <rkagan@amazon.de> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://lkml.kernel.org/r/20230130122216.3555094-1-rkagan@amazon.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-03-30 12:49:30 +02:00
Frederic Weisbecker	d716ea059c	entry/rcu: Check TIF_RESCHED _after_ delayed RCU wake-up ... [ Upstream commit b416514054 ] RCU sometimes needs to perform a delayed wake up for specific kthreads handling offloaded callbacks (RCU_NOCB). These wakeups are performed by timers and upon entry to idle (also to guest and to user on nohz_full). However the delayed wake-up on kernel exit is actually performed after the thread flags are fetched towards the fast path check for work to do on exit to user. As a result, and if there is no other pending work to do upon that kernel exit, the current task will resume to userspace with TIF_RESCHED set and the pending wake up ignored. Fix this with fetching the thread flags _after_ the delayed RCU-nocb kthread wake-up. Fixes: 47b8ff194c ("entry: Explicitly flush pending rcuog wakeup before last rescheduling point") Signed-off-by: Frederic Weisbecker <frederic@kernel.org> Signed-off-by: Paul E. McKenney <paulmck@kernel.org> Signed-off-by: Joel Fernandes (Google) <joel@joelfernandes.org> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Link: https://lore.kernel.org/r/20230315194349.10798-3-joel@joelfernandes.org Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-03-30 12:49:13 +02:00
Josh Poimboeuf	adfc7aaa0d	entry: Fix noinstr warning in __enter_from_user_mode() ... [ Upstream commit f87d28673b ] __enter_from_user_mode() is triggering noinstr warnings with CONFIG_DEBUG_PREEMPT due to its call of preempt_count_add() via ct_state(). The preemption disable isn't needed as interrupts are already disabled. And the context_tracking_enabled() check in ct_state() also isn't needed as that's already being done by the CT_WARN_ON(). Just use __ct_state() instead. Fixes the following warnings: vmlinux.o: warning: objtool: enter_from_user_mode+0xba: call to preempt_count_add() leaves .noinstr.text section vmlinux.o: warning: objtool: syscall_enter_from_user_mode+0xf9: call to preempt_count_add() leaves .noinstr.text section vmlinux.o: warning: objtool: syscall_enter_from_user_mode_prepare+0xc7: call to preempt_count_add() leaves .noinstr.text section vmlinux.o: warning: objtool: irqentry_enter_from_user_mode+0xba: call to preempt_count_add() leaves .noinstr.text section Fixes: 171476775d ("context_tracking: Convert state to atomic_t") Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Link: https://lore.kernel.org/r/d8955fa6d68dc955dda19baf13ae014ae27926f5.1677369694.git.jpoimboe@kernel.org Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-03-30 12:49:13 +02:00
Daniel Borkmann	9cda812c76	bpf: Adjust insufficient default bpf_jit_limit ... [ Upstream commit 10ec8ca8ec ] We've seen recent AWS EKS (Kubernetes) user reports like the following: After upgrading EKS nodes from v20230203 to v20230217 on our 1.24 EKS clusters after a few days a number of the nodes have containers stuck in ContainerCreating state or liveness/readiness probes reporting the following error: Readiness probe errored: rpc error: code = Unknown desc = failed to exec in container: failed to start exec "4a11039f730203ffc003b7[...]": OCI runtime exec failed: exec failed: unable to start container process: unable to init seccomp: error loading seccomp filter into kernel: error loading seccomp filter: errno 524: unknown However, we had not been seeing this issue on previous AMIs and it only started to occur on v20230217 (following the upgrade from kernel 5.4 to 5.10) with no other changes to the underlying cluster or workloads. We tried the suggestions from that issue (sysctl net.core.bpf_jit_limit=452534528) which helped to immediately allow containers to be created and probes to execute but after approximately a day the issue returned and the value returned by cat /proc/vmallocinfo | grep bpf_jit | awk '{s+=$2} END {print s}' was steadily increasing. I tested bpf tree to observe bpf_jit_charge_modmem, bpf_jit_uncharge_modmem their sizes passed in as well as bpf_jit_current under tcpdump BPF filter, seccomp BPF and native (e)BPF programs, and the behavior all looks sane and expected, that is nothing "leaking" from an upstream perspective. The bpf_jit_limit knob was originally added in order to avoid a situation where unprivileged applications loading BPF programs (e.g. seccomp BPF policies) consuming all the module memory space via BPF JIT such that loading of kernel modules would be prevented. The default limit was defined back in 2018 and while good enough back then, we are generally seeing far more BPF consumers today. Adjust the limit for the BPF JIT pool from originally 1/4 to now 1/2 of the module memory space to better reflect today's needs and avoid more users running into potentially hard to debug issues. Fixes: fdadd04931 ("bpf: fix bpf_jit_limit knob for PAGE_SIZE >= 64K") Reported-by: Stephen Haynes <sh@synk.net> Reported-by: Lefteris Alexakis <lefteris.alexakis@kpn.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://github.com/awslabs/amazon-eks-ami/issues/1179 Link: https://github.com/awslabs/amazon-eks-ami/issues/1219 Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com> Link: https://lore.kernel.org/r/20230320143725.8394-1-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-03-30 12:49:08 +02:00
Costa Shulyupin	a1f4880655	tracing/hwlat: Replace sched_setaffinity with set_cpus_allowed_ptr ... [ Upstream commit 71c7a30442 ] There is a problem with the behavior of hwlat in a container, resulting in incorrect output. A warning message is generated: "cpumask changed while in round-robin mode, switching to mode none", and the tracing_cpumask is ignored. This issue arises because the kernel thread, hwlatd, is not a part of the container, and the function sched_setaffinity is unable to locate it using its PID. Additionally, the task_struct of hwlatd is already known. Ultimately, the function set_cpus_allowed_ptr achieves the same outcome as sched_setaffinity, but employs task_struct instead of PID. Test case: # cd /sys/kernel/tracing # echo 0 > tracing_on # echo round-robin > hwlat_detector/mode # echo hwlat > current_tracer # unshare --fork --pid bash -c 'echo 1 > tracing_on' # dmesg -c Actual behavior: [573502.809060] hwlat_detector: cpumask changed while in round-robin mode, switching to mode none Link: https://lore.kernel.org/linux-trace-kernel/20230316144535.1004952-1-costa.shul@redhat.com Cc: Masami Hiramatsu <mhiramat@kernel.org> Fixes: 0330f7aa8e ("tracing: Have hwlat trace migrate across tracing_cpumask CPUs") Signed-off-by: Costa Shulyupin <costa.shul@redhat.com> Acked-by: Daniel Bristot de Oliveira <bristot@kernel.org> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-03-30 12:48:59 +02:00
Song Liu	d496185c25	perf: fix perf_event_context->time ... [ Upstream commit baf1b12a67 ] Time readers rely on perf_event_context->[time|timestamp|timeoffset] to get accurate time_enabled and time_running for an event. The difference between ctx->timestamp and ctx->time is the among of time when the context is not enabled. __update_context_time(ctx, false) is used to increase timestamp, but not time. Therefore, it should only be called in ctx_sched_in() when EVENT_TIME was not enabled. Fixes: 09f5e7dc7a ("perf: Fix perf_event_read_local() time") Signed-off-by: Song Liu <song@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Acked-by: Namhyung Kim <namhyung@kernel.org> Link: https://lkml.kernel.org/r/20230313171608.298734-1-song@kernel.org Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-03-30 12:48:59 +02:00
Yang Jihong	ff8137727a	perf/core: Fix perf_output_begin parameter is incorrectly invoked in perf_event_bpf_output ... [ Upstream commit eb81a2ed4f ] syzkaller reportes a KASAN issue with stack-out-of-bounds. The call trace is as follows: dump_stack+0x9c/0xd3 print_address_description.constprop.0+0x19/0x170 __kasan_report.cold+0x6c/0x84 kasan_report+0x3a/0x50 __perf_event_header__init_id+0x34/0x290 perf_event_header__init_id+0x48/0x60 perf_output_begin+0x4a4/0x560 perf_event_bpf_output+0x161/0x1e0 perf_iterate_sb_cpu+0x29e/0x340 perf_iterate_sb+0x4c/0xc0 perf_event_bpf_event+0x194/0x2c0 __bpf_prog_put.constprop.0+0x55/0xf0 __cls_bpf_delete_prog+0xea/0x120 [cls_bpf] cls_bpf_delete_prog_work+0x1c/0x30 [cls_bpf] process_one_work+0x3c2/0x730 worker_thread+0x93/0x650 kthread+0x1b8/0x210 ret_from_fork+0x1f/0x30 commit 267fb27352 ("perf: Reduce stack usage of perf_output_begin()") use on-stack struct perf_sample_data of the caller function. However, perf_event_bpf_output uses incorrect parameter to convert small-sized data (struct perf_bpf_event) into large-sized data (struct perf_sample_data), which causes memory overwriting occurs in __perf_event_header__init_id. Fixes: 267fb27352 ("perf: Reduce stack usage of perf_output_begin()") Signed-off-by: Yang Jihong <yangjihong1@huawei.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://lkml.kernel.org/r/20230314044735.56551-1-yangjihong1@huawei.com Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-03-30 12:48:59 +02:00
Greg Kroah-Hartman	345103eb06	Revert "Revert "wait: Return number of exclusive waiters awaken"" ... This reverts commit 2b47e2bee0. It was perserving the ABI, but that is not needed anymore at this point in time. Change-Id: I7efd4dd7abde9f5baa37cb3731aa40b7ff94d2bb Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-03-30 10:37:08 +00:00
Ramji Jiyani	0d5b95acb6	ANDROID: GKI: Multi arch exports protection support ... ABI is being implemented for x86_64, making it necessary to support protected exports header file generation for the GKI modules for multiple architecture. Enable support to select required inputs based on the ARCH to generate gki_module_protected_exports.h during kernel build. Inputs for generating gki_module_protected_exports.h are: ARCH = arm64: ABI Protected exports list: abi_gki_protected_exports_aarch64 Protected GKI modules list: gki_aarch64_protected_modules ARCH = x86_64: ABI Protected exports list: abi_gki_protected_exports_x86_64 Protected GKI modules list: gki_x86_64_protected_modules Test: TH Test: Manual verification of the generated header file Test: bazel run //common:kernel_aarch64_abi_update_protected_exports Bug: 151893768 Change-Id: Ic4bcb2732199b71a7973b5ce4c852bcd95d37131 Signed-off-by: Ramji Jiyani <ramjiyani@google.com>	2023-03-29 23:11:03 +00:00
Greg Kroah-Hartman	88df355018	Revert "ANDROID: module: Add vendor hooks" ... This reverts commit 60e6687899. The hooks added in it, android_rvh_set_module_core_rw_nx, android_rvh_set_module_init_rw_nx, android_rvh_set_module_permit_before_init, and android_rvh_set_module_permit_after_init, are not used by any vendor symbol list, so remove them as they are unused. Bug: 248994334 Cc: Kuan-Ying Lee <Kuan-Ying.Lee@mediatek.com> Change-Id: I39d02510916e2a645526f7d3bfaa3e4066901a3e Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-03-29 08:05:07 +00:00
Greg Kroah-Hartman	d14ac9ddc6	Merge 6.1.21 into android14-6.1 ... Changes in 6.1.21 xfrm: Allow transport-mode states with AF_UNSPEC selector drm/virtio: Pass correct device to dma_sync_sgtable_for_device() drm/msm/gem: Prevent blocking within shrinker loop drm/panfrost: Don't sync rpm suspension after mmu flushing fbdev: chipsfb: Fix error codes in chipsfb_pci_init() cifs: Move the in_send statistic to __smb_send_rqst() drm/meson: fix 1px pink line on GXM when scaling video overlay clk: HI655X: select REGMAP instead of depending on it ASoC: SOF: Intel: MTL: Fix the device description ASoC: SOF: Intel: HDA: Fix device description ASoC: SOF: Intel: SKL: Fix device description ASOC: SOF: Intel: pci-tgl: Fix device description ASoC: SOF: ipc4-topology: set dmic dai index from copier docs: Correct missing "d_" prefix for dentry_operations member d_weak_revalidate scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add() scsi: mpi3mr: Fix throttle_groups memory leak scsi: mpi3mr: Fix config page DMA memory leak scsi: mpi3mr: Fix mpi3mr_hba_port memory leak in mpi3mr_remove() scsi: mpi3mr: Fix sas_hba.phy memory leak in mpi3mr_remove() scsi: mpi3mr: Return proper values for failures in firmware init path scsi: mpi3mr: Fix memory leaks in mpi3mr_init_ioc() scsi: mpi3mr: ioctl timeout when disabling/enabling interrupt scsi: mpi3mr: Fix expander node leak in mpi3mr_remove() ALSA: hda: Match only Intel devices with CONTROLLER_IN_GPU() netfilter: nft_nat: correct length for loading protocol registers netfilter: nft_masq: correct length for loading protocol registers netfilter: nft_redir: correct length for loading protocol registers netfilter: nft_redir: correct value of inet type `.maxattrs` scsi: core: Add BLIST_NO_VPD_SIZE for some VDASD scsi: core: Fix a procfs host directory removal regression ftrace,kcfi: Define ftrace_stub_graph conditionally tcp: tcp_make_synack() can be called from process context vdpa/mlx5: should not activate virtq object when suspended wifi: nl80211: fix NULL-ptr deref in offchan check wifi: cfg80211: fix MLO connection ownership selftests: fix LLVM build for i386 and x86_64 nfc: pn533: initialize struct pn533_out_arg properly ipvlan: Make skb->skb_iif track skb->dev for l3s mode i40e: Fix kernel crash during reboot when adapter is in recovery mode vhost-vdpa: free iommu domain after last use during cleanup vdpa_sim: not reset state in vdpasim_queue_ready vdpa_sim: set last_used_idx as last_avail_idx in vdpasim_queue_ready PCI: s390: Fix use-after-free of PCI resources with per-function hotplug drm/i915/psr: Use calculated io and fast wake lines drm/i915/sseu: fix max_subslices array-index-out-of-bounds access net/smc: fix NULL sndbuf_desc in smc_cdc_tx_handler() qed/qed_dev: guard against a possible division by zero net: dsa: mt7530: remove now incorrect comment regarding port 5 net: dsa: mt7530: set PLL frequency and trgmii only when trgmii is used block: do not reverse request order when flushing plug list loop: Fix use-after-free issues net: tunnels: annotate lockless accesses to dev->needed_headroom net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails tcp: Fix bind() conflict check for dual-stack wildcard address. nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition mlxsw: spectrum: Fix incorrect parsing depth after reload net/smc: fix deadlock triggered by cancel_delayed_work_syn() net: usb: smsc75xx: Limit packet length to skb->len drm/bridge: Fix returned array size name for atomic_get_input_bus_fmts kdoc powerpc/mm: Fix false detection of read faults block: null_blk: Fix handling of fake timeout request nvme: fix handling single range discard request nvmet: avoid potential UAF in nvmet_req_complete() block: sunvdc: add check for mdesc_grab() returning NULL net/mlx5e: Fix macsec ASO context alignment net/mlx5e: Don't cache tunnel offloads capability net/mlx5: Fix setting ec_function bit in MANAGE_PAGES net/mlx5: Disable eswitch before waiting for VF pages net/mlx5e: Support Geneve and GRE with VF tunnel offload net/mlx5: E-switch, Fix wrong usage of source port rewrite in split rules net/mlx5: E-switch, Fix missing set of split_count when forward to ovs internal port net/mlx5e: Fix cleanup null-ptr deref on encap lock net/mlx5: Set BREAK_FW_WAIT flag first when removing driver veth: Fix use after free in XDP_REDIRECT ice: xsk: disable txq irq before flushing hw net: dsa: don't error out when drivers return ETH_DATA_LEN in .port_max_mtu() net: dsa: mv88e6xxx: fix max_mtu of 1492 on 6165, 6191, 6220, 6250, 6290 ravb: avoid PHY being resumed when interface is not up sh_eth: avoid PHY being resumed when interface is not up ipv4: Fix incorrect table ID in IOCTL path net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull net: atlantic: Fix crash when XDP is enabled but no program is loaded net/iucv: Fix size of interrupt data i825xx: sni_82596: use eth_hw_addr_set() selftests: net: devlink_port_split.py: skip test if no suitable device available qed/qed_mng_tlv: correctly zero out ->min instead of ->hour net: dsa: microchip: fix RGMII delay configuration on KSZ8765/KSZ8794/KSZ8795 ethernet: sun: add check for the mdesc_grab() bonding: restore IFF_MASTER/SLAVE flags on bond enslave ether type change bonding: restore bond's IFF_SLAVE flag if a non-eth dev enslave fails hwmon: (adt7475) Display smoothing attributes in correct order hwmon: (adt7475) Fix masking of hysteresis registers hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition hwmon: (ina3221) return prober error code hwmon: (ucd90320) Add minimum delay between bus accesses hwmon: tmp512: drop of_match_ptr for ID table kconfig: Update config changed flag before calling callback hwmon: (adm1266) Set `can_sleep` flag for GPIO chip hwmon: (ltc2992) Set `can_sleep` flag for GPIO chip media: m5mols: fix off-by-one loop termination error mmc: atmel-mci: fix race between stop command and start of next command soc: mediatek: mtk-svs: keep svs alive if CONFIG_DEBUG_FS not supported jffs2: correct logic when creating a hole in jffs2_write_begin rust: arch/um: Disable FP/SIMD instruction to match x86 ext4: fail ext4_iget if special inode unallocated ext4: update s_journal_inum if it changes after journal replay ext4: fix task hung in ext4_xattr_delete_inode drm/amdkfd: Fix an illegal memory access net/9p: fix bug in client create for .L LoongArch: Only call get_timer_irq() once in constant_clockevent_init() sh: intc: Avoid spurious sizeof-pointer-div warning drm/amdgpu: fix ttm_bo calltrace warning in psp_hw_fini drm/amd/display: fix shift-out-of-bounds in CalculateVMAndRowBytes ext4: fix possible double unlock when moving a directory Revert "tty: serial: fsl_lpuart: adjust SERIAL_FSL_LPUART_CONSOLE config dependency" tty: serial: fsl_lpuart: skip waiting for transmission complete when UARTCTRL_SBK is asserted serial: 8250_em: Fix UART port type serial: 8250_fsl: fix handle_irq locking serial: 8250: ASPEED_VUART: select REGMAP instead of depending on it firmware: xilinx: don't make a sleepable memory allocation from an atomic context memory: tegra: fix interconnect registration race memory: tegra20-emc: fix interconnect registration race memory: tegra124-emc: fix interconnect registration race memory: tegra30-emc: fix interconnect registration race drm/ttm: Fix a NULL pointer dereference s390/ipl: add missing intersection check to ipl_report handling interconnect: fix icc_provider_del() error handling interconnect: fix provider registration API interconnect: imx: fix registration race interconnect: fix mem leak when freeing nodes interconnect: qcom: osm-l3: fix registration race interconnect: qcom: rpm: fix probe child-node error handling interconnect: qcom: rpm: fix registration race interconnect: qcom: rpmh: fix probe child-node error handling interconnect: qcom: rpmh: fix registration race interconnect: qcom: msm8974: fix registration race interconnect: exynos: fix node leak in probe PM QoS error path interconnect: exynos: fix registration race md: select BLOCK_LEGACY_AUTOLOAD cifs: generate signkey for the channel that's reconnecting tracing: Make splice_read available again tracing: Check field value in hist_field_name() tracing: Make tracepoint lockdep check actually test something cifs: Fix smb2_set_path_size() KVM: SVM: Fix a benign off-by-one bug in AVIC physical table mask KVM: SVM: Modify AVIC GATag to support max number of 512 vCPUs KVM: nVMX: add missing consistency checks for CR0 and CR4 ALSA: hda: intel-dsp-config: add MTL PCI id ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book2 Pro ALSA: hda/realtek: fix speaker, mute/micmute LEDs not work on a HP platform Revert "riscv: mm: notify remote harts about mmu cache updates" riscv: asid: Fixup stale TLB entry cause application crash drm/shmem-helper: Remove another errant put in error path drm/sun4i: fix missing component unbind on bind errors drm/i915/active: Fix misuse of non-idle barriers as fence trackers drm/i915/dg2: Add HDMI pixel clock frequencies 267.30 and 319.89 MHz drm/amdgpu: Don't resume IOMMU after incomplete init drm/amd/pm: Fix sienna cichlid incorrect OD volage after resume drm/amd/pm: bump SMU 13.0.4 driver_if header version drm/amd/display: Do not set DRR on pipe Commit drm/amd/display: disconnect MPCC only on OTG change mptcp: fix possible deadlock in subflow_error_report mptcp: add ro_after_init for tcp{,v6}_prot_override mptcp: avoid setting TCP_CLOSE state twice mptcp: fix lockdep false positive in mptcp_pm_nl_create_listen_socket() ftrace: Fix invalid address access in lookup_rec() when index is 0 ocfs2: fix data corruption after failed write nvme-pci: add NVME_QUIRK_BOGUS_NID for Netac NV3000 ice: avoid bonding causing auxiliary plug/unplug under RTNL lock vp_vdpa: fix the crash in hot unplug with vp_vdpa mm/userfaultfd: propagate uffd-wp bit when PTE-mapping the huge zeropage mm: teach mincore_hugetlb about pte markers powerpc/64: Set default CPU in Kconfig powerpc/boot: Don't always pass -mcpu=powerpc when building 32-bit uImage mmc: sdhci_am654: lower power-on failed message severity fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks trace/hwlat: Do not wipe the contents of per-cpu thread data trace/hwlat: Do not start per-cpu thread if it is already running ACPI: PPTT: Fix to avoid sleep in the atomic context when PPTT is absent net: phy: nxp-c45-tja11xx: fix MII_BASIC_CONFIG_REV bit fbdev: Fix incorrect page mapping clearance at fb_deferred_io_release() cpuidle: psci: Iterate backwards over list in psci_pd_remove() ASoC: Intel: soc-acpi: fix copy-paste issue in topology names ASoC: qcom: q6prm: fix incorrect clk_root passed to ADSP x86/mce: Make sure logged MCEs are processed after sysfs update x86/mm: Fix use of uninitialized buffer in sme_enable() x86/resctrl: Clear staged_config[] before and after it is used powerpc: Pass correct CPU reference to assembler virt/coco/sev-guest: Check SEV_SNP attribute at probe time virt/coco/sev-guest: Simplify extended guest request handling virt/coco/sev-guest: Remove the disable_vmpck label in handle_guest_request() virt/coco/sev-guest: Carve out the request issuing logic into a helper virt/coco/sev-guest: Do some code style cleanups virt/coco/sev-guest: Convert the sw_exit_info_2 checking to a switch-case virt/coco/sev-guest: Add throttling awareness io_uring/msg_ring: let target know allocated index perf: Fix check before add_event_to_groups() in perf_group_detach() powerpc: Disable CPU unknown by CLANG when CC_IS_CLANG powerpc/64: Replace -mcpu=e500mc64 by -mcpu=e5500 Linux 6.1.21 Change-Id: I4b7f6e01381c0c121c9e89e51071ea60f1f7e29a Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-03-24 08:47:17 +00:00
Greg Kroah-Hartman	a22c3a8790	Merge 6.1.20 into android14-6.1 ... Changes in 6.1.20 fs: prevent out-of-bounds array speculation when closing a file descriptor btrfs: fix unnecessary increment of read error stat on write error btrfs: fix percent calculation for bg reclaim message io_uring/uring_cmd: ensure that device supports IOPOLL erofs: fix wrong kunmap when using LZMA on HIGHMEM platforms perf inject: Fix --buildid-all not to eat up MMAP2 fork: allow CLONE_NEWTIME in clone3 flags RISC-V: Stop emitting attributes x86/CPU/AMD: Disable XSAVES on AMD family 0x17 drm/amdgpu: fix error checking in amdgpu_read_mm_registers for soc15 drm/amdgpu: fix error checking in amdgpu_read_mm_registers for soc21 drm/amdgpu: fix error checking in amdgpu_read_mm_registers for nv drm/display: Don't block HDR_OUTPUT_METADATA on unknown EOTF drm/connector: print max_requested_bpc in state debugfs staging: rtl8723bs: Fix key-store index handling staging: rtl8723bs: Pass correct parameters to cfg80211_get_bss() ext4: fix cgroup writeback accounting with fs-layer encryption ext4: fix RENAME_WHITEOUT handling for inline directories ext4: fix another off-by-one fsmap error on 1k block filesystems ext4: move where set the MAY_INLINE_DATA flag is set ext4: fix WARNING in ext4_update_inline_data ext4: zero i_disksize when initializing the bootloader inode HID: core: Provide new max_buffer_size attribute to over-ride the default HID: uhid: Over-ride the default maximum data buffer value with our own nfc: change order inside nfc_se_io error path KVM: VMX: Reset eVMCS controls in VP assist page during hardware disabling KVM: VMX: Don't bother disabling eVMCS static key on module exit KVM: x86: Move guts of kvm_arch_init() to standalone helper KVM: VMX: Do _all_ initialization before exposing /dev/kvm to userspace fs: dlm: fix log of lowcomms vs midcomms fs: dlm: add midcomms init/start functions fs: dlm: start midcomms before scand fs: dlm: remove send repeat remove handling fs: dlm: use packet in dlm_mhandle fd: dlm: trace send/recv of dlm message and rcom fs: dlm: fix use after free in midcomms commit fs: dlm: use WARN_ON_ONCE() instead of WARN_ON() fs: dlm: be sure to call dlm_send_queue_flush() fs: dlm: fix race setting stop tx flag udf: Fix off-by-one error when discarding preallocation bus: mhi: ep: Power up/down MHI stack during MHI RESET bus: mhi: ep: Change state_lock to mutex Input: exc3000 - properly stop timer on shutdown ipmi:ssif: Remove rtc_us_timer ipmi:ssif: Increase the message retry time ipmi:ssif: Add a timer between request retries spi: intel: Check number of chip selects after reading the descriptor drm/i915: Introduce intel_panel_init_alloc() drm/i915: Do panel VBT init early if the VBT declares an explicit panel type drm/i915: Populate encoder->devdata for DSI on icl+ block: Revert "block: Do not reread partition table on exclusively open device" block: fix scan partition for exclusively open device again riscv: Add header include guards to insn.h scsi: core: Remove the /proc/scsi/${proc_name} directory earlier ext4: Fix possible corruption when moving a directory cifs: improve checking of DFS links over STATUS_OBJECT_NAME_INVALID drm/nouveau/kms/nv50: fix nv50_wndw_new_ prototype drm/msm: Fix potential invalid ptr free drm/msm/a5xx: fix setting of the CP_PREEMPT_ENABLE_LOCAL register drm/msm/a5xx: fix highest bank bit for a530 drm/msm/a5xx: fix the emptyness check in the preempt code drm/msm/a5xx: fix context faults during ring switch bgmac: fix *initial* chip reset to support BCM5358 nfc: fdp: add null check of devm_kmalloc_array in fdp_nci_i2c_read_device_properties powerpc: dts: t1040rdb: fix compatible string for Rev A boards tls: rx: fix return value for async crypto drm/msm/dpu: disable features unsupported by QCM2290 ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping() net: lan966x: Fix port police support using tc-matchall selftests: nft_nat: ensuring the listening side is up before starting the client netfilter: nft_last: copy content when cloning expression netfilter: nft_quota: copy content when cloning expression net: tls: fix possible race condition between do_tls_getsockopt_conf() and do_tls_setsockopt_conf() net: use indirect calls helpers for sk_exit_memory_pressure() perf stat: Fix counting when initial delay configured net: lan78xx: fix accessing the LAN7800's internal phy specific registers from the MAC driver net: caif: Fix use-after-free in cfusbl_device_notify() ice: copy last block omitted in ice_get_module_eeprom() bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser() drm/msm/dpu: fix len of sc7180 ctl blocks drm/msm/dpu: drop DPU_DIM_LAYER from MIXER_MSM8998_MASK drm/msm/dpu: fix clocks settings for msm8998 SSPP blocks drm/msm/dpu: clear DSPP reservations in rm release net: stmmac: add to set device wake up flag when stmmac init phy net: phylib: get rid of unnecessary locking bnxt_en: Avoid order-5 memory allocation for TPA data netfilter: ctnetlink: revert to dumping mark regardless of event type netfilter: tproxy: fix deadlock due to missing BH disable m68k: mm: Move initrd phys_to_virt handling after paging_init() btrfs: fix extent map logging bit not cleared for split maps after dropping range bpf, test_run: fix &xdp_frame misplacement for LIVE_FRAMES btf: fix resolving BTF_KIND_VAR after ARRAY, STRUCT, UNION, PTR net: phy: smsc: fix link up detection in forced irq mode net: ethernet: mtk_eth_soc: fix RX data corruption issue net: tls: fix device-offloaded sendpage straddling records scsi: megaraid_sas: Update max supported LD IDs to 240 scsi: sd: Fix wrong zone_write_granularity value during revalidate netfilter: conntrack: adopt safer max chain length platform: mellanox: select REGMAP instead of depending on it platform: x86: MLX_PLATFORM: select REGMAP instead of depending on it block: fix wrong mode for blkdev_put() from disk_scan_partitions() NFSD: Protect against filesystem freezing ice: Fix DSCP PFC TLV creation ethernet: ice: avoid gcc-9 integer overflow warning net/smc: fix fallback failed while sendmsg with fastopen octeontx2-af: Unlock contexts in the queue context cache in case of fault detection SUNRPC: Fix a server shutdown leak net: dsa: mt7530: permit port 5 to work without port 6 on MT7621 SoC af_unix: fix struct pid leaks in OOB support erofs: Revert "erofs: fix kvcalloc() misuse with __GFP_NOFAIL" riscv: Use READ_ONCE_NOCHECK in imprecise unwinding stack mode RISC-V: Don't check text_mutex during stop_machine drm/amdgpu: fix return value check in kfd ext4: Fix deadlock during directory rename drm/amdgpu/soc21: don't expose AV1 if VCN0 is harvested drm/amdgpu/soc21: Add video cap query support for VCN_4_0_4 adreno: Shutdown the GPU properly drm/msm/adreno: fix runtime PM imbalance at unbind watch_queue: fix IOC_WATCH_QUEUE_SET_SIZE alloc error paths tpm/eventlog: Don't abort tpm_read_log on faulty ACPI address MIPS: Fix a compilation issue powerpc/64: Don't recurse irq replay powerpc/iommu: fix memory leak with using debugfs_lookup() clk: renesas: rcar-gen3: Disable R-Car H3 ES1.* powerpc/bpf/32: Only set a stack frame when necessary powerpc/64: Fix task_cpu in early boot when booting non-zero cpuid powerpc/64: Move paca allocation to early_setup() powerpc/kcsan: Exclude udelay to prevent recursive instrumentation alpha: fix R_ALPHA_LITERAL reloc for large modules macintosh: windfarm: Use unsigned type for 1-bit bitfields PCI: Add SolidRun vendor ID scripts: handle BrokenPipeError for python scripts media: ov5640: Fix analogue gain control media: rc: gpio-ir-recv: add remove function drm/amd/display: Allow subvp on vactive pipes that are 2560x1440@60 drm/amd/display: adjust MALL size available for DCN32 and DCN321 filelocks: use mount idmapping for setlease permission check Revert "bpf, test_run: fix &xdp_frame misplacement for LIVE_FRAMES" UML: define RUNTIME_DISCARD_EXIT Linux 6.1.20 Change-Id: I2f92629ce02bc07295fea17b16f9bb567916a285 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-03-23 08:23:43 +00:00
Budimir Markovic	529546ea28	perf: Fix check before add_event_to_groups() in perf_group_detach() ... commit fd0815f632 upstream. Events should only be added to a groups rb tree if they have not been removed from their context by list_del_event(). Since remove_on_exec made it possible to call list_del_event() on individual events before they are detached from their group, perf_group_detach() should check each sibling's attach_state before calling add_event_to_groups() on it. Fixes: 2e498d0a74 ("perf: Add support for event removal on exec") Signed-off-by: Budimir Markovic <markovicbudimir@gmail.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://lkml.kernel.org/r/ZBFzvQV9tEqoHEtH@gentoo Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-03-22 13:34:06 +01:00
Tero Kristo	ac1d15d58d	trace/hwlat: Do not start per-cpu thread if it is already running ... commit 08697bca9b upstream. The hwlatd tracer will end up starting multiple per-cpu threads with the following script: #!/bin/sh cd /sys/kernel/debug/tracing echo 0 > tracing_on echo hwlat > current_tracer echo per-cpu > hwlat_detector/mode echo 100000 > hwlat_detector/width echo 200000 > hwlat_detector/window echo 1 > tracing_on To fix the issue, check if the hwlatd thread for the cpu is already running, before starting a new one. Along with the previous patch, this avoids running multiple instances of the same CPU thread on the system. Link: https://lore.kernel.org/all/20230302113654.2984709-1-tero.kristo@linux.intel.com/ Link: https://lkml.kernel.org/r/20230310100451.3948583-3-tero.kristo@linux.intel.com Cc: stable@vger.kernel.org Fixes: f46b16520a ("trace/hwlat: Implement the per-cpu mode") Signed-off-by: Tero Kristo <tero.kristo@linux.intel.com> Acked-by: Daniel Bristot de Oliveira <bristot@kernel.org> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-03-22 13:34:04 +01:00
Tero Kristo	a78eab86e2	trace/hwlat: Do not wipe the contents of per-cpu thread data ... commit 4c42f5f0d1 upstream. Do not wipe the contents of the per-cpu kthread data when starting the tracer, as this will completely forget about already running instances and can later start new additional per-cpu threads. Link: https://lore.kernel.org/all/20230302113654.2984709-1-tero.kristo@linux.intel.com/ Link: https://lkml.kernel.org/r/20230310100451.3948583-2-tero.kristo@linux.intel.com Cc: stable@vger.kernel.org Fixes: f46b16520a ("trace/hwlat: Implement the per-cpu mode") Signed-off-by: Tero Kristo <tero.kristo@linux.intel.com> Acked-by: Daniel Bristot de Oliveira <bristot@kernel.org> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-03-22 13:34:04 +01:00
Chen Zhongjin	4f84f31f63	ftrace: Fix invalid address access in lookup_rec() when index is 0 ... commit ee92fa4433 upstream. KASAN reported follow problem: BUG: KASAN: use-after-free in lookup_rec Read of size 8 at addr ffff000199270ff0 by task modprobe CPU: 2 Comm: modprobe Call trace: kasan_report __asan_load8 lookup_rec ftrace_location arch_check_ftrace_location check_kprobe_address_safe register_kprobe When checking pg->records[pg->index - 1].ip in lookup_rec(), it can get a pg which is newly added to ftrace_pages_start in ftrace_process_locs(). Before the first pg->index++, index is 0 and accessing pg->records[-1].ip will cause this problem. Don't check the ip when pg->index is 0. Link: https://lore.kernel.org/linux-trace-kernel/20230309080230.36064-1-chenzhongjin@huawei.com Cc: stable@vger.kernel.org Fixes: 9644302e33 ("ftrace: Speed up search by skipping pages by address") Suggested-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-03-22 13:34:02 +01:00
Steven Rostedt (Google)	3968bb946a	tracing: Check field value in hist_field_name() ... commit 9f116f76fa upstream. The function hist_field_name() cannot handle being passed a NULL field parameter. It should never be NULL, but due to a previous bug, NULL was passed to the function and the kernel crashed due to a NULL dereference. Mark Rutland reported this to me on IRC. The bug was fixed, but to prevent future bugs from crashing the kernel, check the field and add a WARN_ON() if it is NULL. Link: https://lkml.kernel.org/r/20230302020810.762384440@goodmis.org Cc: stable@vger.kernel.org Cc: Masami Hiramatsu <mhiramat@kernel.org> Cc: Andrew Morton <akpm@linux-foundation.org> Reported-by: Mark Rutland <mark.rutland@arm.com> Fixes: c6afad49d1 ("tracing: Add hist trigger 'sym' and 'sym-offset' modifiers") Tested-by: Mark Rutland <mark.rutland@arm.com> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-03-22 13:33:59 +01:00
Sung-hun Kim	192dcbf573	tracing: Make splice_read available again ... commit e400be674a upstream. Since the commit 36e2c7421f ("fs: don't allow splice read/write without explicit ops") is applied to the kernel, splice() and sendfile() calls on the trace file (/sys/kernel/debug/tracing /trace) return EINVAL. This patch restores these system calls by initializing splice_read in file_operations of the trace file. This patch only enables such functionalities for the read case. Link: https://lore.kernel.org/linux-trace-kernel/20230314013707.28814-1-sfoon.kim@samsung.com Cc: stable@vger.kernel.org Fixes: 36e2c7421f ("fs: don't allow splice read/write without explicit ops") Signed-off-by: Sung-hun Kim <sfoon.kim@samsung.com> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-03-22 13:33:59 +01:00
Matthias Männich	a58297e0d2	Merge "Merge 6.1.18 into android14-6.1" into android14-6.1	2023-03-22 10:14:03 +00:00
Greg Kroah-Hartman	d956976040	Merge 6.1.18 into android14-6.1 ... Changes in 6.1.18 net/sched: Retire tcindex classifier auxdisplay: hd44780: Fix potential memory leak in hd44780_remove() fs/jfs: fix shift exponent db_agl2size negative driver: soc: xilinx: fix memory leak in xlnx_add_cb_for_notify_event() f2fs: don't rely on F2FS_MAP_* in f2fs_iomap_begin f2fs: fix to avoid potential deadlock objtool: Fix memory leak in create_static_call_sections() soc: mediatek: mtk-pm-domains: Allow mt8186 ADSP default power on memory: renesas-rpc-if: Split-off private data from struct rpcif memory: renesas-rpc-if: Move resource acquisition to .probe() soc: mediatek: mtk-svs: Enable the IRQ later pwm: sifive: Always let the first pwm_apply_state succeed pwm: stm32-lp: fix the check on arr and cmp registers update f2fs: introduce trace_f2fs_replace_atomic_write_block f2fs: correct i_size change for atomic writes f2fs: clear atomic_write_task in f2fs_abort_atomic_write() soc: mediatek: mtk-svs: restore default voltages when svs_init02() fail soc: mediatek: mtk-svs: reset svs when svs_resume() fail soc: mediatek: mtk-svs: Use pm_runtime_resume_and_get() in svs_init01() fs: f2fs: initialize fsdata in pagecache_write() f2fs: allow set compression option of files without blocks f2fs: fix to abort atomic write only during do_exist() um: vector: Fix memory leak in vector_config ubi: ensure that VID header offset + VID header size <= alloc, size ubifs: Fix build errors as symbol undefined ubifs: Fix memory leak in ubifs_sysfs_init() ubifs: Rectify space budget for ubifs_symlink() if symlink is encrypted ubifs: Rectify space budget for ubifs_xrename() ubifs: Fix wrong dirty space budget for dirty inode ubifs: do_rename: Fix wrong space budget when target inode's nlink > 1 ubifs: Reserve one leb for each journal head while doing budget ubi: Fix use-after-free when volume resizing failed ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume() ubifs: Fix memory leak in alloc_wbufs() ubi: Fix possible null-ptr-deref in ubi_free_volume() ubifs: Re-statistic cleaned znode count if commit failed ubifs: dirty_cow_znode: Fix memleak in error handling path ubifs: ubifs_writepage: Mark page dirty after writing inode failed ubifs: ubifs_releasepage: Remove ubifs_assert(0) to valid this process ubi: fastmap: Fix missed fm_anchor PEB in wear-leveling after disabling fastmap ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show() ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed f2fs: fix to avoid potential memory corruption in __update_iostat_latency() soc: qcom: stats: Populate all subsystem debugfs files ext4: use ext4_fc_tl_mem in fast-commit replay path ext4: don't show commit interval if it is zero netfilter: nf_tables: allow to fetch set elements when table has an owner x86: um: vdso: Add '%rcx' and '%r11' to the syscall clobber list um: virtio_uml: free command if adding to virtqueue failed um: virtio_uml: mark device as unregistered when breaking it um: virtio_uml: move device breaking into workqueue um: virt-pci: properly remove PCI device from bus f2fs: synchronize atomic write aborts watchdog: rzg2l_wdt: Issue a reset before we put the PM clocks watchdog: rzg2l_wdt: Handle TYPE-B reset for RZ/V2M watchdog: at91sam9_wdt: use devm_request_irq to avoid missing free_irq() in error path watchdog: Fix kmemleak in watchdog_cdev_register watchdog: pcwd_usb: Fix attempting to access uninitialized memory watchdog: sbsa_wdog: Make sure the timeout programming is within the limits netfilter: ctnetlink: fix possible refcount leak in ctnetlink_create_conntrack() netfilter: conntrack: fix rmmod double-free race netfilter: ip6t_rpfilter: Fix regression with VRF interfaces netfilter: ebtables: fix table blob use-after-free netfilter: xt_length: use skb len to match in length_mt6 netfilter: ctnetlink: make event listener tracking global netfilter: x_tables: fix percpu counter block leak on error path when creating new netns ptp: vclock: use mutex to fix "sleep on atomic" bug drm/i915: move a Kconfig symbol to unbreak the menu presentation ipv6: Add lwtunnel encap size of all siblings in nexthop calculation octeontx2-pf: Recalculate UDP checksum for ptp 1-step sync packet net: sunhme: Fix region request sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop octeontx2-pf: Use correct struct reference in test condition net: fix __dev_kfree_skb_any() vs drop monitor 9p/xen: fix version parsing 9p/xen: fix connection sequence 9p/rdma: unmap receive dma buffer in rdma_request()/post_recv() spi: tegra210-quad: Fix validate combined sequence mlx5: fix skb leak while fifo resync and push mlx5: fix possible ptp queue fifo use-after-free net/mlx5: ECPF, wait for VF pages only after disabling host PFs net/mlx5e: Verify flow_source cap before using it net/mlx5: Geneve, Fix handling of Geneve object id as error code ext4: fix incorrect options show of original mount_opt and extend mount_opt2 nfc: fix memory leak of se_io context in nfc_genl_se_io net/sched: transition act_pedit to rcu and percpu stats net/sched: act_pedit: fix action bind logic net/sched: act_mpls: fix action bind logic net/sched: act_sample: fix action bind logic net: dsa: seville: ignore mscc-miim read errors from Lynx PCS net: dsa: felix: fix internal MDIO controller resource length ARM: dts: spear320-hmi: correct STMPE GPIO compatible tcp: tcp_check_req() can be called from process context vc_screen: modify vcs_size() handling in vcs_read() spi: tegra210-quad: Fix iterator outside loop rtc: sun6i: Always export the internal oscillator genirq/ipi: Fix NULL pointer deref in irq_data_get_affinity_mask() scsi: ipr: Work around fortify-string warning scsi: mpi3mr: Fix an issue found by KASAN scsi: mpi3mr: Use number of bits to manage bitmap sizes rtc: allow rtc_read_alarm without read_alarm callback io_uring: fix size calculation when registering buf ring loop: loop_set_status_from_info() check before assignment ASoC: adau7118: don't disable regulators on device unbind ASoC: apple: mca: Fix final status read on SERDES reset ASoC: apple: mca: Fix SERDES reset sequence ASoC: apple: mca: Improve handling of unavailable DMA channels nvme: bring back auto-removal of deleted namespaces during sequential scan nvme-tcp: don't access released socket during error recovery nvme-fabrics: show well known discovery name ASoC: zl38060 add gpiolib dependency ASoC: mediatek: mt8195: add missing initialization thermal: intel: quark_dts: fix error pointer dereference thermal: intel: BXT_PMIC: select REGMAP instead of depending on it tracing: Add NULL checks for buffer in ring_buffer_free_read_page() kernel/printk/index.c: fix memory leak with using debugfs_lookup() firmware/efi sysfb_efi: Add quirk for Lenovo IdeaPad Duet 3 bootconfig: Increase max nodes of bootconfig from 1024 to 8192 for DCC support mfd: arizona: Use pm_runtime_resume_and_get() to prevent refcnt leak IB/hfi1: Update RMT size calculation iommu/amd: Fix error handling for pdev_pri_ats_enable() PCI/ACPI: Account for _S0W of the target bridge in acpi_pci_bridge_d3() media: uvcvideo: Remove format descriptions media: uvcvideo: Handle cameras with invalid descriptors media: uvcvideo: Handle errors from calls to usb_string media: uvcvideo: Quirk for autosuspend in Logitech B910 and C910 media: uvcvideo: Silence memcpy() run-time false positive warnings USB: fix memory leak with using debugfs_lookup() cacheinfo: Fix shared_cpu_map to handle shared caches at different levels staging: emxx_udc: Add checks for dma_alloc_coherent() tty: fix out-of-bounds access in tty_driver_lookup_tty() tty: serial: fsl_lpuart: disable the CTS when send break signal serial: sc16is7xx: setup GPIO controller later in probe mei: bus-fixup:upon error print return values of send and receive tools/iio/iio_utils:fix memory leak bus: mhi: ep: Fix the debug message for MHI_PKT_TYPE_RESET_CHAN_CMD cmd iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_status_word() iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_config_word() media: uvcvideo: Add GUID for BGRA/X 8:8:8:8 soundwire: bus_type: Avoid lockdep assert in sdw_drv_probe() PCI: loongson: Prevent LS7A MRRS increases staging: pi433: fix memory leak with using debugfs_lookup() USB: dwc3: fix memory leak with using debugfs_lookup() USB: chipidea: fix memory leak with using debugfs_lookup() USB: ULPI: fix memory leak with using debugfs_lookup() USB: uhci: fix memory leak with using debugfs_lookup() USB: sl811: fix memory leak with using debugfs_lookup() USB: fotg210: fix memory leak with using debugfs_lookup() USB: isp116x: fix memory leak with using debugfs_lookup() USB: isp1362: fix memory leak with using debugfs_lookup() USB: gadget: gr_udc: fix memory leak with using debugfs_lookup() USB: gadget: bcm63xx_udc: fix memory leak with using debugfs_lookup() USB: gadget: lpc32xx_udc: fix memory leak with using debugfs_lookup() USB: gadget: pxa25x_udc: fix memory leak with using debugfs_lookup() USB: gadget: pxa27x_udc: fix memory leak with using debugfs_lookup() usb: host: xhci: mvebu: Iterate over array indexes instead of using pointer math USB: ene_usb6250: Allocate enough memory for full object usb: uvc: Enumerate valid values for color matching usb: gadget: uvc: Make bSourceID read/write PCI: Align extra resources for hotplug bridges properly PCI: Take other bus devices into account when distributing resources PCI: Distribute available resources for root buses, too tty: pcn_uart: fix memory leak with using debugfs_lookup() misc: vmw_balloon: fix memory leak with using debugfs_lookup() drivers: base: component: fix memory leak with using debugfs_lookup() drivers: base: dd: fix memory leak with using debugfs_lookup() kernel/fail_function: fix memory leak with using debugfs_lookup() PCI: loongson: Add more devices that need MRRS quirk PCI: Add ACS quirk for Wangxun NICs PCI: pciehp: Add Qualcomm quirk for Command Completed erratum phy: rockchip-typec: Fix unsigned comparison with less than zero RDMA/cma: Distinguish between sockaddr_in and sockaddr_in6 by size iommu: Attach device group to old domain in error path soundwire: cadence: Remove wasted space in response_buf soundwire: cadence: Drain the RX FIFO after an IO timeout net: tls: avoid hanging tasks on the tx_lock x86/resctl: fix scheduler confusion with 'current' vDPA/ifcvf: decouple hw features manipulators from the adapter vDPA/ifcvf: decouple config space ops from the adapter vDPA/ifcvf: alloc the mgmt_dev before the adapter vDPA/ifcvf: decouple vq IRQ releasers from the adapter vDPA/ifcvf: decouple config IRQ releaser from the adapter vDPA/ifcvf: decouple vq irq requester from the adapter vDPA/ifcvf: decouple config/dev IRQ requester and vectors allocator from the adapter vDPA/ifcvf: ifcvf_request_irq works on ifcvf_hw vDPA/ifcvf: manage ifcvf_hw in the mgmt_dev vDPA/ifcvf: allocate the adapter in dev_add() drm/display/dp_mst: Add drm_atomic_get_old_mst_topology_state() drm/display/dp_mst: Fix down/up message handling after sink disconnect drm/display/dp_mst: Fix down message handling after a packet reception error drm/display/dp_mst: Fix payload addition on a disconnected sink drm/i915/dp_mst: Add the MST topology state for modesetted CRTCs drm/i915: Fix system suspend without fbdev being initialized media: uvcvideo: Fix race condition with usb_kill_urb io_uring: fix two assignments in if conditions io_uring/poll: allow some retries for poll triggering spuriously arm64: efi: Make efi_rt_lock a raw_spinlock arm64: mte: Fix/clarify the PG_mte_tagged semantics arm64: Reset KASAN tag in copy_highpage with HW tags only usb: gadget: uvc: fix missing mutex_unlock() if kstrtou8() fails Linux 6.1.18 Change-Id: Icb8e56528d481a17780bdd517c69efa9e76b94c0 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-03-21 08:22:15 +00:00
Suren Baghdasaryan	ac86382170	ANDROID: Revert "psi: allow unprivileged users with CAP_SYS_RESOURCE to write psi files" ... This reverts commit 6db12ee045. In Android, system_server registers psi trigger to detect memory pressure. This commit requires processes registering new triggers to have CAP_SYS_RESOURCE capability, which system_server does not have. Reverting this change until a solution can be found to fix the breakage of functionality in Android T using 5.15 kernels. Bug: 243781242 Bug: 244148051 Reported-by: liuhailong <liuhailong@oppo.com> Signed-off-by: Suren Baghdasaryan <surenb@google.com> Change-Id: If6c8580af8734f3b765d48c782a536aad357e6f0	2023-03-20 20:20:07 +00:00
David Disseldorp	587a6fda90	watch_queue: fix IOC_WATCH_QUEUE_SET_SIZE alloc error paths ... [ Upstream commit 03e1d60e17 ] The watch_queue_set_size() allocation error paths return the ret value set via the prior pipe_resize_ring() call, which will always be zero. As a result, IOC_WATCH_QUEUE_SET_SIZE callers such as "keyctl watch" fail to detect kernel wqueue->notes allocation failures and proceed to KEYCTL_WATCH_KEY, with any notifications subsequently lost. Fixes: c73be61ced ("pipe: Add general notification queue support") Signed-off-by: David Disseldorp <ddiss@suse.de> Signed-off-by: Christian Brauner (Microsoft) <brauner@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-03-17 08:50:30 +01:00
Lorenz Bauer	f0c8306c1a	btf: fix resolving BTF_KIND_VAR after ARRAY, STRUCT, UNION, PTR ... [ Upstream commit 9b459804ff ] btf_datasec_resolve contains a bug that causes the following BTF to fail loading: [1] DATASEC a size=2 vlen=2 type_id=4 offset=0 size=1 type_id=7 offset=1 size=1 [2] INT (anon) size=1 bits_offset=0 nr_bits=8 encoding=(none) [3] PTR (anon) type_id=2 [4] VAR a type_id=3 linkage=0 [5] INT (anon) size=1 bits_offset=0 nr_bits=8 encoding=(none) [6] TYPEDEF td type_id=5 [7] VAR b type_id=6 linkage=0 This error message is printed during btf_check_all_types: [1] DATASEC a size=2 vlen=2 type_id=7 offset=1 size=1 Invalid type By tracing btf_*_resolve we can pinpoint the problem: btf_datasec_resolve(depth: 1, type_id: 1, mode: RESOLVE_TBD) = 0 btf_var_resolve(depth: 2, type_id: 4, mode: RESOLVE_TBD) = 0 btf_ptr_resolve(depth: 3, type_id: 3, mode: RESOLVE_PTR) = 0 btf_var_resolve(depth: 2, type_id: 4, mode: RESOLVE_PTR) = 0 btf_datasec_resolve(depth: 1, type_id: 1, mode: RESOLVE_PTR) = -22 The last invocation of btf_datasec_resolve should invoke btf_var_resolve by means of env_stack_push, instead it returns EINVAL. The reason is that env_stack_push is never executed for the second VAR. if (!env_type_is_resolve_sink(env, var_type) && !env_type_is_resolved(env, var_type_id)) { env_stack_set_next_member(env, i + 1); return env_stack_push(env, var_type, var_type_id); } env_type_is_resolve_sink() changes its behaviour based on resolve_mode. For RESOLVE_PTR, we can simplify the if condition to the following: (btf_type_is_modifier() || btf_type_is_ptr) && !env_type_is_resolved() Since we're dealing with a VAR the clause evaluates to false. This is not sufficient to trigger the bug however. The log output and EINVAL are only generated if btf_type_id_size() fails. if (!btf_type_id_size(btf, &type_id, &type_size)) { btf_verifier_log_vsi(env, v->t, vsi, "Invalid type"); return -EINVAL; } Most types are sized, so for example a VAR referring to an INT is not a problem. The bug is only triggered if a VAR points at a modifier. Since we skipped btf_var_resolve that modifier was also never resolved, which means that btf_resolved_type_id returns 0 aka VOID for the modifier. This in turn causes btf_type_id_size to return NULL, triggering EINVAL. To summarise, the following conditions are necessary: - VAR pointing at PTR, STRUCT, UNION or ARRAY - Followed by a VAR pointing at TYPEDEF, VOLATILE, CONST, RESTRICT or TYPE_TAG The fix is to reset resolve_mode to RESOLVE_TBD before attempting to resolve a VAR from a DATASEC. Fixes: 1dc9285184 ("bpf: kernel side support for BTF Var and DataSec") Signed-off-by: Lorenz Bauer <lmb@isovalent.com> Link: https://lore.kernel.org/r/20230306112138.155352-2-lmb@isovalent.com Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-03-17 08:50:26 +01:00
Tobias Klauser	120f7a9287	fork: allow CLONE_NEWTIME in clone3 flags ... commit a402f1e353 upstream. Currently, calling clone3() with CLONE_NEWTIME in clone_args->flags fails with -EINVAL. This is because CLONE_NEWTIME intersects with CSIGNAL. However, CSIGNAL was deprecated when clone3 was introduced in commit 7f192e3cd3 ("fork: add clone3"), allowing re-use of that part of clone flags. Fix this by explicitly allowing CLONE_NEWTIME in clone3_args_valid. This is also in line with the respective check in check_unshare_flags which allow CLONE_NEWTIME for unshare(). Fixes: 769071ac9f ("ns: Introduce Time Namespace") Cc: Andrey Vagin <avagin@openvz.org> Cc: Christian Brauner <brauner@kernel.org> Cc: stable@vger.kernel.org Signed-off-by: Tobias Klauser <tklauser@distanz.ch> Reviewed-by: Christian Brauner <brauner@kernel.org> Signed-off-by: Christian Brauner (Microsoft) <brauner@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-03-17 08:50:14 +01:00
Greg Kroah-Hartman	9154eb052f	Revert "Revert "sched/psi: Stop relying on timer_pending() for poll_work rescheduling"" ... This reverts commit 02bdd918e6. It was perserving the ABI, but that is not needed anymore at this point in time. Change-Id: I486cebed8ec0f91985d117eed3e1069d6160e267 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-03-15 16:41:08 +00:00
Greg Kroah-Hartman	5b483d8a04	Merge changes I95ce33fb,I03723a9f,I4b1cf7f1,I6e17c9b3,I446172f8, ... into android14-6.1 ... * changes: Merge 6.1.17 into android14-6.1 ANDROID: update abi definition due to io_uring changes. UPSTREAM: Revert "blk-cgroup: dropping parent refcount after pd_free_fn() is done" UPSTREAM: Revert "blk-cgroup: synchronize pd_free_fn() from blkg_free_workfn() and blkcg_deactivate_policy()" Revert "kobject: modify kobject_get_path() to take a const *" Revert "wait: Return number of exclusive waiters awaken" Revert "sbitmap: Use single per-bitmap counting to wake up queued tags" Revert "sbitmap: correct wake_batch recalculation to avoid potential IO hung" Revert "sbitmap: Advance the queue index before waking up a queue" Revert "sbitmap: Try each queue to wake up at least one waiter" Revert "HID: retain initial quirks set up when creating HID devices" Merge 6.1.16 into android14-6.1	2023-03-14 17:38:04 +00:00
Sangmoon Kim	c5ea4db533	ANDROID: power: add vendor hooks for try_to_freeze fail ... Add hooks to gather data of unfrozen tasks and summarize it with other information. Bug: 273189923 Signed-off-by: Sangmoon Kim <sangmoon.kim@samsung.com> Change-Id: I61da3d253bd9959c6f06e09c9a35c4b242cedafe (cherry picked from commit 2232e3fc85)	2023-03-13 20:34:25 +00:00
Sangmoon Kim	8635a09118	ANDROID: softlockup: add vendor hook for a softlockup task ... Add hook to gather data of softlockup and summarize it with other information. Bug: 273189923 Signed-off-by: Sangmoon Kim <sangmoon.kim@samsung.com> Change-Id: I5263bbd573c3fa4b4c981ac26c943721ce09506d (cherry picked from commit 5cc613a916)	2023-03-13 20:34:25 +00:00
Greg Kroah-Hartman	2b47e2bee0	Revert "wait: Return number of exclusive waiters awaken" ... This reverts commit d710b1e91b. It breaks the ABI right now, but will be brought back at the next ABI break as it will be needed for Android systems. Bug: 161946584 Change-Id: I1dcf1f311ce25059466d000543b020fb33d237b4 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-03-13 18:51:55 +00:00
Greg Kroah-Hartman	2cb73a87e4	Merge 6.1.16 into android14-6.1 ... Changes in 6.1.16 HID: asus: use spinlock to protect concurrent accesses HID: asus: use spinlock to safely schedule workers powerpc/mm: Rearrange if-else block to avoid clang warning ata: ahci: Revert "ata: ahci: Add Tiger Lake UP{3,4} AHCI controller" ARM: OMAP2+: Fix memory leak in realtime_counter_init() arm64: dts: qcom: qcs404: use symbol names for PCIe resets arm64: dts: qcom: msm8996-tone: Fix USB taking 6 minutes to wake up arm64: dts: qcom: sm8150-kumano: Panel framebuffer is 2.5k instead of 4k arm64: dts: qcom: sm6350: Fix up the ramoops node arm64: dts: qcom: sm6125: Reorder HSUSB PHY clocks to match bindings arm64: dts: qcom: sm6125-seine: Clean up gpio-keys (volume down) arm64: dts: imx8m: Align SoC unique ID node unit address ARM: zynq: Fix refcount leak in zynq_early_slcr_init arm64: dts: mediatek: mt8195: Add power domain to U3PHY1 T-PHY arm64: dts: mediatek: mt8183: Fix systimer 13 MHz clock description arm64: dts: mediatek: mt8192: Fix systimer 13 MHz clock description arm64: dts: mediatek: mt8195: Fix systimer 13 MHz clock description arm64: dts: mediatek: mt8186: Fix systimer 13 MHz clock description arm64: dts: qcom: sdm845-db845c: fix audio codec interrupt pin name x86/acpi/boot: Do not register processors that cannot be onlined for x2APIC arm64: dts: qcom: sc7180: correct SPMI bus address cells arm64: dts: qcom: sc7280: correct SPMI bus address cells arm64: dts: qcom: sc8280xp: correct SPMI bus address cells arm64: dts: qcom: sc8280xp: Vote for CX in USB controllers arm64: dts: meson-gxl: jethub-j80: Fix WiFi MAC address node arm64: dts: meson-gxl: jethub-j80: Fix Bluetooth MAC node name arm64: dts: meson-axg: jethub-j1xx: Fix MAC address node names arm64: dts: meson-gx: Fix Ethernet MAC address unit name arm64: dts: meson-g12a: Fix internal Ethernet PHY unit name arm64: dts: meson-gx: Fix the SCPI DVFS node name and unit address cpuidle, intel_idle: Fix CPUIDLE_FLAG_IRQ_ENABLE *again* arm64: dts: ti: k3-am62: Enable SPI nodes at the board level arm64: dts: ti: k3-am62-main: Fix clocks for McSPI arm64: tegra: Fix duplicate regulator on Jetson TX1 arm64: dts: msm8992-bullhead: add memory hole region arm64: dts: qcom: msm8992-bullhead: Fix cont_splash_mem size arm64: dts: qcom: msm8992-bullhead: Disable dfps_data_mem arm64: dts: qcom: ipq8074: correct USB3 QMP PHY-s clock output names arm64: dts: qcom: ipq8074: fix Gen2 PCIe QMP PHY arm64: dts: qcom: ipq8074: fix Gen3 PCIe QMP PHY arm64: dts: qcom: ipq8074: correct Gen2 PCIe ranges arm64: dts: qcom: ipq8074: fix Gen3 PCIe node arm64: dts: qcom: ipq8074: correct PCIe QMP PHY output clock names arm64: dts: meson: remove CPU opps below 1GHz for G12A boards ARM: OMAP1: call platform_device_put() in error case in omap1_dm_timer_init() arm64: dts: mediatek: mt8192: Mark scp_adsp clock as broken ARM: bcm2835_defconfig: Enable the framebuffer ARM: s3c: fix s3c64xx_set_timer_source prototype arm64: dts: ti: k3-j7200: Fix wakeup pinmux range ARM: dts: exynos: correct wr-active property in Exynos3250 Rinato ARM: imx: Call ida_simple_remove() for ida_simple_get arm64: dts: amlogic: meson-gx: fix SCPI clock dvfs node name arm64: dts: amlogic: meson-axg: fix SCPI clock dvfs node name arm64: dts: amlogic: meson-gx: add missing SCPI sensors compatible arm64: dts: amlogic: meson-axg-jethome-jethub-j1xx: fix supply name of USB controller node arm64: dts: amlogic: meson-gxl-s905d-sml5442tw: drop invalid clock-names property arm64: dts: amlogic: meson-gx: add missing unit address to rng node name arm64: dts: amlogic: meson-gxl-s905w-jethome-jethub-j80: fix invalid rtc node name arm64: dts: amlogic: meson-axg-jethome-jethub-j1xx: fix invalid rtc node name arm64: dts: amlogic: meson-gxl: add missing unit address to eth-phy-mux node name arm64: dts: amlogic: meson-gx-libretech-pc: fix update button name arm64: dts: amlogic: meson-sm1-bananapi-m5: fix adc keys node names arm64: dts: amlogic: meson-gxl-s905d-phicomm-n1: fix led node name arm64: dts: amlogic: meson-gxbb-kii-pro: fix led node name arm64: dts: amlogic: meson-sm1-odroid-hc4: fix active fan thermal trip locking/rwsem: Disable preemption in all down_read*() and up_read() code paths arm64: dts: renesas: beacon-renesom: Fix gpio expander reference arm64: dts: meson: radxa-zero: allow usb otg mode arm64: dts: meson: bananapi-m5: switch VDDIO_C pin to OPEN_DRAIN ARM: dts: sun8i: nanopi-duo2: Fix regulator GPIO reference ublk_drv: remove nr_aborted_queues from ublk_device ublk_drv: don't probe partitions if the ubq daemon isn't trusted ARM: dts: imx7s: correct iomuxc gpr mux controller cells sbitmap: remove redundant check in __sbitmap_queue_get_batch sbitmap: Use single per-bitmap counting to wake up queued tags sbitmap: correct wake_batch recalculation to avoid potential IO hung arm64: dts: mt8195: Fix CPU map for single-cluster SoC arm64: dts: mt8192: Fix CPU map for single-cluster SoC arm64: dts: mt8186: Fix CPU map for single-cluster SoC arm64: dts: mediatek: mt7622: Add missing pwm-cells to pwm node arm64: dts: mediatek: mt8186: Fix watchdog compatible arm64: dts: mediatek: mt8195: Fix watchdog compatible arm64: dts: mediatek: mt7986: Fix watchdog compatible ARM: dts: stm32: Update part number NVMEM description on stm32mp131 blk-mq: avoid sleep in blk_mq_alloc_request_hctx blk-mq: remove stale comment for blk_mq_sched_mark_restart_hctx blk-mq: wait on correct sbitmap_queue in blk_mq_mark_tag_wait blk-mq: Fix potential io hung for shared sbitmap per tagset blk-mq: correct stale comment of .get_budget arm64: dts: qcom: msm8996: support using GPLL0 as kryocc input arm64: dts: qcom: msm8996 switch from RPM_SMD_BB_CLK1 to RPM_SMD_XO_CLK_SRC arm64: dts: qcom: sm8350: drop incorrect cells from serial arm64: dts: qcom: sm8450: drop incorrect cells from serial arm64: dts: qcom: msm8992-lg-bullhead: Correct memory overlaps with the SMEM and MPSS memory regions arm64: dts: qcom: msm8953: correct TLMM gpio-ranges arm64: dts: qcom: msm8992-*: Fix up comments arm64: dts: qcom: msm8992-lg-bullhead: Enable regulators s390/dasd: Fix potential memleak in dasd_eckd_init() sched/rt: pick_next_rt_entity(): check list_entry perf/x86/intel/ds: Fix the conversion from TSC to perf time x86/perf/zhaoxin: Add stepping check for ZXC KEYS: asymmetric: Fix ECDSA use via keyctl uapi block: ublk: check IO buffer based on flag need_get_data arm64: dts: qcom: pmk8350: Specify PBS register for PON arm64: dts: qcom: pmk8350: Use the correct PON compatible erofs: relinquish volume with mutex held block: sync mixed merged request's failfast with 1st bio's block: Fix io statistics for cgroup in throttle path block: bio-integrity: Copy flags when bio_integrity_payload is cloned block: use proper return value from bio_failfast() wifi: mt76: mt7915: add missing of_node_put() wifi: mt76: mt7921s: fix slab-out-of-bounds access in sdio host wifi: mt76: mt7915: check return value before accessing free_block_num wifi: mt76: mt7915: drop always true condition of __mt7915_reg_addr() wifi: mt76: mt7915: fix unintended sign extension of mt7915_hw_queue_read() wifi: mt76: fix coverity uninit_use_in_call in mt76_connac2_reverse_frag0_hdr_trans() wifi: rsi: Fix memory leak in rsi_coex_attach() wifi: rtlwifi: rtl8821ae: don't call kfree_skb() under spin_lock_irqsave() wifi: rtlwifi: rtl8188ee: don't call kfree_skb() under spin_lock_irqsave() wifi: rtlwifi: rtl8723be: don't call kfree_skb() under spin_lock_irqsave() wifi: iwlegacy: common: don't call dev_kfree_skb() under spin_lock_irqsave() wifi: libertas: fix memory leak in lbs_init_adapter() wifi: rtl8xxxu: don't call dev_kfree_skb() under spin_lock_irqsave() wifi: rtw89: 8852c: rfk: correct DACK setting wifi: rtw89: 8852c: rfk: correct DPK settings wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit() libbpf: Fix btf__align_of() by taking into account field offsets wifi: ipw2x00: don't call dev_kfree_skb() under spin_lock_irqsave() wifi: ipw2200: fix memory leak in ipw_wdev_init() wifi: wilc1000: fix potential memory leak in wilc_mac_xmit() wifi: wilc1000: add missing unregister_netdev() in wilc_netdev_ifc_init() wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit() wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid() wifi: libertas_tf: don't call kfree_skb() under spin_lock_irqsave() wifi: libertas: if_usb: don't call kfree_skb() under spin_lock_irqsave() wifi: libertas: main: don't call kfree_skb() under spin_lock_irqsave() wifi: libertas: cmdresp: don't call kfree_skb() under spin_lock_irqsave() wifi: wl3501_cs: don't call kfree_skb() under spin_lock_irqsave() libbpf: Fix invalid return address register in s390 crypto: x86/ghash - fix unaligned access in ghash_setkey() ACPICA: Drop port I/O validation for some regions genirq: Fix the return type of kstat_cpu_irqs_sum() rcu-tasks: Improve comments explaining tasks_rcu_exit_srcu purpose rcu-tasks: Remove preemption disablement around srcu_read_[un]lock() calls rcu-tasks: Fix synchronize_rcu_tasks() VS zap_pid_ns_processes() lib/mpi: Fix buffer overrun when SG is too long crypto: ccp - Avoid page allocation failure warning for SEV_GET_ID2 platform/chrome: cros_ec_typec: Update port DP VDO ACPICA: nsrepair: handle cases without a return value correctly selftests/xsk: print correct payload for packet dump selftests/xsk: print correct error codes when exiting arm64/cpufeature: Fix field sign for DIT hwcap detection kselftest/arm64: Fix syscall-abi for systems without 128 bit SME workqueue: Protects wq_unbound_cpumask with wq_pool_attach_mutex s390/early: fix sclp_early_sccb variable lifetime s390/vfio-ap: fix an error handling path in vfio_ap_mdev_probe_queue() x86/signal: Fix the value returned by strict_sas_size() thermal/drivers/tsens: Drop msm8976-specific defines thermal/drivers/tsens: Sort out msm8976 vs msm8956 data thermal/drivers/tsens: fix slope values for msm8939 thermal/drivers/tsens: limit num_sensors to 9 for msm8939 wifi: rtw89: fix potential leak in rtw89_append_probe_req_ie() wifi: rtw89: Add missing check for alloc_workqueue wifi: rtl8xxxu: Fix memory leaks with RTL8723BU, RTL8192EU wifi: orinoco: check return value of hermes_write_wordrec() thermal/drivers/imx_sc_thermal: Drop empty platform remove function thermal/drivers/imx_sc_thermal: Fix the loop condition wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no callback function wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback() wifi: ath11k: Fix memory leak in ath11k_peer_rx_frag_setup wifi: cfg80211: Fix extended KCK key length check in nl80211_set_rekey_data() ACPI: battery: Fix missing NUL-termination with large strings selftests/bpf: Fix build errors if CONFIG_NF_CONNTRACK=m crypto: ccp - Failure on re-initialization due to duplicate sysfs filename crypto: essiv - Handle EBUSY correctly crypto: seqiv - Handle EBUSY correctly powercap: fix possible name leak in powercap_register_zone() x86/microcode: Add a parameter to microcode_check() to store CPU capabilities x86/microcode: Check CPU capabilities after late microcode update correctly x86/microcode: Adjust late loading result reporting message selftests/bpf: Use consistent build-id type for liburandom_read.so selftests/bpf: Fix vmtest static compilation error crypto: xts - Handle EBUSY correctly leds: led-class: Add missing put_device() to led_put() s390/bpf: Add expoline to tail calls wifi: iwlwifi: mei: fix compilation errors in rfkill() kselftest/arm64: Fix enumeration of systems without 128 bit SME can: rcar_canfd: Fix R-Car V3U GAFLCFG field accesses selftests/bpf: Initialize tc in xdp_synproxy crypto: ccp - Flush the SEV-ES TMR memory before giving it to firmware bpftool: profile online CPUs instead of possible wifi: mt76: mt7915: call mt7915_mcu_set_thermal_throttling() only after init_work wifi: mt76: mt7915: fix memory leak in mt7915_mcu_exit wifi: mt76: mt7915: fix WED TxS reporting wifi: mt76: add memory barrier to SDIO queue kick wifi: mt76: mt7921: fix error code of return in mt7921_acpi_read net/mlx5: Enhance debug print in page allocation failure irqchip: Fix refcount leak in platform_irqchip_probe irqchip/alpine-msi: Fix refcount leak in alpine_msix_init_domains irqchip/irq-mvebu-gicp: Fix refcount leak in mvebu_gicp_probe irqchip/ti-sci: Fix refcount leak in ti_sci_intr_irq_domain_probe s390/mem_detect: fix detect_memory() error handling s390/vmem: fix empty page tables cleanup under KASAN s390/boot: cleanup decompressor header files s390/mem_detect: rely on diag260() if sclp_early_get_memsize() fails s390/boot: fix mem_detect extended area allocation net: add sock_init_data_uid() tun: tun_chr_open(): correctly initialize socket uid tap: tap_open(): correctly initialize socket uid OPP: fix error checking in opp_migrate_dentry() cpufreq: davinci: Fix clk use after free Bluetooth: hci_conn: Refactor hci_bind_bis() since it always succeeds Bluetooth: L2CAP: Fix potential user-after-free Bluetooth: hci_qca: get wakeup status from serdev device handle net: ipa: generic command param fix s390: vfio-ap: tighten the NIB validity check s390/ap: fix status returned by ap_aqic() s390/ap: fix status returned by ap_qact() libbpf: Fix alen calculation in libbpf_nla_dump_errormsg() xen/grant-dma-iommu: Implement a dummy probe_device() callback rds: rds_rm_zerocopy_callback() correct order for list_add_tail() crypto: rsa-pkcs1pad - Use akcipher_request_complete m68k: /proc/hardware should depend on PROC_FS RISC-V: time: initialize hrtimer based broadcast clock event device clocksource/drivers/riscv: Patch riscv_clock_next_event() jump before first use wifi: iwl3945: Add missing check for create_singlethread_workqueue wifi: iwl4965: Add missing check for create_singlethread_workqueue() wifi: mwifiex: fix loop iterator in mwifiex_update_ampdu_txwinsize() selftests/bpf: Fix out-of-srctree build ACPI: resource: Add IRQ overrides for MAINGEAR Vector Pro 2 models ACPI: resource: Do IRQ override on all TongFang GMxRGxx crypto: octeontx2 - Fix objects shared between several modules crypto: crypto4xx - Call dma_unmap_page when done wifi: mac80211: move color collision detection report in a delayed work wifi: mac80211: make rate u32 in sta_set_rate_info_rx() wifi: mac80211: fix non-MLO station association wifi: mac80211: Don't translate MLD addresses for multicast wifi: mac80211: avoid u32_encode_bits() warning wifi: mac80211: fix off-by-one link setting tools/lib/thermal: Fix thermal_sampling_exit() thermal/drivers/hisi: Drop second sensor hi3660 selftests/bpf: Fix map_kptr test. wifi: mac80211: pass 'sta' to ieee80211_rx_data_set_sta() bpf: Zeroing allocated object from slab in bpf memory allocator selftests/bpf: Fix xdp_do_redirect on s390x can: esd_usb: Move mislocated storage of SJA1000_ECC_SEG bits in case of a bus error can: esd_usb: Make use of can_change_state() and relocate checking skb for NULL xsk: check IFF_UP earlier in Tx path LoongArch, bpf: Use 4 instructions for function address in JIT bpf: Fix global subprog context argument resolution logic irqchip/irq-brcmstb-l2: Set IRQ_LEVEL for level triggered interrupts irqchip/irq-bcm7120-l2: Set IRQ_LEVEL for level triggered interrupts net/smc: fix potential panic dues to unprotected smc_llc_srv_add_link() net/smc: fix application data exception selftests/net: Interpret UDP_GRO cmsg data as an int value l2tp: Avoid possible recursive deadlock in l2tp_tunnel_register() net: bcmgenet: fix MoCA LED control net: lan966x: Fix possible deadlock inside PTP net/mlx4_en: Introduce flexible array to silence overflow warning selftest: fib_tests: Always cleanup before exit sefltests: netdevsim: wait for devlink instance after netns removal drm: Fix potential null-ptr-deref due to drmm_mode_config_init() drm/fourcc: Add missing big-endian XRGB1555 and RGB565 formats drm/bridge: ti-sn65dsi83: Fix delay after reset deassert to match spec drm: mxsfb: DRM_IMX_LCDIF should depend on ARCH_MXC drm: mxsfb: DRM_MXSFB should depend on ARCH_MXS || ARCH_MXC drm/bridge: megachips: Fix error handling in i2c_register_driver() drm/vkms: Fix memory leak in vkms_init() drm/vkms: Fix null-ptr-deref in vkms_release() drm/vc4: dpi: Fix format mapping for RGB565 drm: tidss: Fix pixel format definition gpu: ipu-v3: common: Add of_node_put() for reference returned by of_graph_get_port_by_id() drm/vc4: drop all currently held locks if deadlock happens hwmon: (ftsteutates) Fix scaling of measurements drm/msm/dpu: check for null return of devm_kzalloc() in dpu_writeback_init() drm/msm/hdmi: Add missing check for alloc_ordered_workqueue pinctrl: qcom: pinctrl-msm8976: Correct function names for wcss pins pinctrl: stm32: Fix refcount leak in stm32_pctrl_get_irq_domain pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups drm/vc4: hvs: Set AXI panic modes drm/vc4: hvs: SCALER_DISPBKGND_AUTOHS is only valid on HVS4 drm/vc4: hvs: Correct interrupt masking bit assignment for HVS5 drm/vc4: hvs: Fix colour order for xRGB1555 on HVS5 drm/vc4: hdmi: Correct interlaced timings again drm/msm: clean event_thread->worker in case of an error drm/panel-edp: fix name for IVO product id 854b scsi: qla2xxx: Fix exchange oversubscription scsi: qla2xxx: Fix exchange oversubscription for management commands scsi: qla2xxx: edif: Fix clang warning ASoC: fsl_sai: initialize is_dsp_mode flag drm/bridge: tc358767: Set default CLRSIPO count drm/msm/adreno: Fix null ptr access in adreno_gpu_cleanup() ALSA: hda/ca0132: minor fix for allocation size drm/amdgpu: Use the sched from entity for amdgpu_cs trace drm/msm/gem: Add check for kmalloc drm/msm/dpu: Disallow unallocated resources to be returned drm/bridge: lt9611: fix sleep mode setup drm/bridge: lt9611: fix HPD reenablement drm/bridge: lt9611: fix polarity programming drm/bridge: lt9611: fix programming of video modes drm/bridge: lt9611: fix clock calculation drm/bridge: lt9611: pass a pointer to the of node regulator: tps65219: use IS_ERR() to detect an error pointer drm/mipi-dsi: Fix byte order of 16-bit DCS set/get brightness drm: exynos: dsi: Fix MIPI_DSI*_NO_* mode flags drm/msm/dsi: Allow 2 CTRLs on v2.5.0 scsi: ufs: exynos: Fix DMA alignment for PAGE_SIZE != 4096 drm/msm/dpu: sc7180: add missing WB2 clock control drm/msm: use strscpy instead of strncpy drm/msm/dpu: Add check for cstate drm/msm/dpu: Add check for pstates drm/msm/mdp5: Add check for kzalloc habanalabs: bugs fixes in timestamps buff alloc pinctrl: bcm2835: Remove of_node_put() in bcm2835_of_gpio_ranges_fallback() pinctrl: mediatek: Initialize variable pullen and pullup to zero pinctrl: mediatek: Initialize variable *buf to zero gpu: host1x: Fix mask for syncpoint increment register gpu: host1x: Don't skip assigning syncpoints to channels drm/tegra: firewall: Check for is_addr_reg existence in IMM check pinctrl: renesas: rzg2l: Fix configuring the GPIO pins as interrupts drm/msm/dpu: set pdpu->is_rt_pipe early in dpu_plane_sspp_atomic_update() drm/mediatek: dsi: Reduce the time of dsi from LP11 to sending cmd drm/mediatek: Use NULL instead of 0 for NULL pointer drm/mediatek: Drop unbalanced obj unref drm/mediatek: mtk_drm_crtc: Add checks for devm_kcalloc drm/mediatek: Clean dangling pointer on bind error path ASoC: soc-compress.c: fixup private_data on snd_soc_new_compress() dt-bindings: display: mediatek: Fix the fallback for mediatek,mt8186-disp-ccorr gpio: vf610: connect GPIO label to dev name ASoC: topology: Properly access value coming from topology file spi: dw_bt1: fix MUX_MMIO dependencies ASoC: mchp-spdifrx: fix controls which rely on rsr register ASoC: mchp-spdifrx: fix return value in case completion times out ASoC: mchp-spdifrx: fix controls that works with completion mechanism ASoC: mchp-spdifrx: disable all interrupts in mchp_spdifrx_dai_remove() dm: improve shrinker debug names regmap: apply reg_base and reg_downshift for single register ops ASoC: rsnd: fixup #endif position ASoC: mchp-spdifrx: Fix uninitialized use of mr in mchp_spdifrx_hw_params() ASoC: dt-bindings: meson: fix gx-card codec node regex regulator: tps65219: use generic set_bypass() hwmon: (asus-ec-sensors) add missing mutex path hwmon: (ltc2945) Handle error case in ltc2945_value_store ALSA: hda: Fix the control element identification for multiple codecs drm/amdgpu: fix enum odm_combine_mode mismatch scsi: mpt3sas: Fix a memory leak scsi: aic94xx: Add missing check for dma_map_single() HID: multitouch: Add quirks for flipped axes HID: retain initial quirks set up when creating HID devices ASoC: qcom: q6apm-lpass-dai: unprepare stream if its already prepared ASoC: qcom: q6apm-dai: fix race condition while updating the position pointer ASoC: qcom: q6apm-dai: Add SNDRV_PCM_INFO_BATCH flag ASoC: codecs: lpass: register mclk after runtime pm ASoC: codecs: lpass: fix incorrect mclk rate drm/amd/display: don't call dc_interrupt_set() for disabled crtcs HID: logitech-hidpp: Hard-code HID++ 1.0 fast scroll support spi: bcm63xx-hsspi: Fix multi-bit mode setting hwmon: (mlxreg-fan) Return zero speed for broken fan ASoC: tlv320adcx140: fix 'ti,gpio-config' DT property init dm: remove flush_scheduled_work() during local_exit() nfs4trace: fix state manager flag printing NFS: fix disabling of swap spi: synquacer: Fix timeout handling in synquacer_spi_transfer_one() ASoC: soc-dapm.h: fixup warning struct snd_pcm_substream not declared HID: bigben: use spinlock to protect concurrent accesses HID: bigben_worker() remove unneeded check on report_field HID: bigben: use spinlock to safely schedule workers hid: bigben_probe(): validate report count ALSA: hda/hdmi: Register with vga_switcheroo on Dual GPU Macbooks drm/shmem-helper: Fix locking for drm_gem_shmem_get_pages_sgt() NFSD: enhance inter-server copy cleanup NFSD: fix leaked reference count of nfsd4_ssc_umount_item nfsd: fix race to check ls_layouts nfsd: clean up potential nfsd_file refcount leaks in COPY codepath NFSD: fix problems with cleanup on errors in nfsd4_copy nfsd: fix courtesy client with deny mode handling in nfs4_upgrade_open nfsd: don't fsync nfsd_files on last close NFSD: copy the whole verifier in nfsd_copy_write_verifier cifs: Fix lost destroy smbd connection when MR allocate failed cifs: Fix warning and UAF when destroy the MR list cifs: use tcon allocation functions even for dummy tcon gfs2: jdata writepage fix perf llvm: Fix inadvertent file creation leds: led-core: Fix refcount leak in of_led_get() leds: is31fl319x: Wrap mutex_destroy() for devm_add_action_or_rest() leds: simatic-ipc-leds-gpio: Make sure we have the GPIO providing driver tools/tracing/rtla: osnoise_hist: use total duration for average calculation perf inject: Use perf_data__read() for auxtrace perf intel-pt: Do not try to queue auxtrace data on pipe perf test bpf: Skip test if kernel-debuginfo is not present perf tools: Fix auto-complete on aarch64 sparc: allow PM configs for sparc32 COMPILE_TEST selftests: find echo binary to use -ne options selftests/ftrace: Fix bash specific "==" operator selftests: use printf instead of echo -ne perf record: Fix segfault with --overwrite and --max-size printf: fix errname.c list perf tests stat_all_metrics: Change true workload to sleep workload for system wide check objtool: add UACCESS exceptions for __tsan_volatile_read/write mfd: cs5535: Don't build on UML mfd: pcf50633-adc: Fix potential memleak in pcf50633_adc_async_read() dmaengine: idxd: Set traffic class values in GRPCFG on DSA 2.0 RDMA/erdma: Fix refcount leak in erdma_mmap dmaengine: HISI_DMA should depend on ARCH_HISI RDMA/hns: Fix refcount leak in hns_roce_mmap iio: light: tsl2563: Do not hardcode interrupt trigger type usb: gadget: fusb300_udc: free irq on the error path in fusb300_probe() i2c: designware: fix i2c_dw_clk_rate() return size to be u32 soundwire: cadence: Don't overflow the command FIFOs driver core: fix potential null-ptr-deref in device_add() kobject: modify kobject_get_path() to take a const * kobject: Fix slab-out-of-bounds in fill_kobj_path() alpha/boot/tools/objstrip: fix the check for ELF header media: uvcvideo: Check for INACTIVE in uvc_ctrl_is_accessible() media: uvcvideo: Implement mask for V4L2_CTRL_TYPE_MENU media: uvcvideo: Refactor uvc_ctrl_mappings_uvcXX media: uvcvideo: Refactor power_line_frequency_controls_limited coresight: etm4x: Fix accesses to TRCSEQRSTEVR and TRCSEQSTR coresight: cti: Prevent negative values of enable count coresight: cti: Add PM runtime call in enable_store usb: typec: intel_pmc_mux: Don't leak the ACPI device reference count PCI/IOV: Enlarge virtfn sysfs name buffer PCI: switchtec: Return -EFAULT for copy_to_user() errors PCI: endpoint: pci-epf-vntb: Clean up kernel_doc warning PCI: endpoint: pci-epf-vntb: Add epf_ntb_mw_bar_clear() num_mws kernel-doc hwtracing: hisi_ptt: Only add the supported devices to the filters list tty: serial: fsl_lpuart: disable Rx/Tx DMA in lpuart32_shutdown() tty: serial: fsl_lpuart: clear LPUART Status Register in lpuart32_shutdown() serial: tegra: Add missing clk_disable_unprepare() in tegra_uart_hw_init() Revert "char: pcmcia: cm4000_cs: Replace mdelay with usleep_range in set_protocol" eeprom: idt_89hpesx: Fix error handling in idt_init() applicom: Fix PCI device refcount leak in applicom_init() firmware: stratix10-svc: add missing gen_pool_destroy() in stratix10_svc_drv_probe() firmware: stratix10-svc: fix error handle while alloc/add device failed VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF mei: pxp: Use correct macros to initialize uuid_le misc/mei/hdcp: Use correct macros to initialize uuid_le misc: fastrpc: Fix an error handling path in fastrpc_rpmsg_probe() driver core: fix resource leak in device_add() driver core: location: Free struct acpi_pld_info *pld before return false drivers: base: transport_class: fix possible memory leak drivers: base: transport_class: fix resource leak when transport_add_device() fails firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle fotg210-udc: Add missing completion handler dmaengine: dw-edma: Fix missing src/dst address of interleaved xfers fpga: microchip-spi: move SPI I/O buffers out of stack fpga: microchip-spi: rewrite status polling in a time measurable way usb: early: xhci-dbc: Fix a potential out-of-bound memory access tty: serial: fsl_lpuart: Fix the wrong RXWATER setting for rx dma case RDMA/cxgb4: add null-ptr-check after ip_dev_find() usb: musb: mediatek: don't unregister something that wasn't registered usb: gadget: configfs: Restrict symlink creation is UDC already binded phy: mediatek: remove temporary variable @mask_ PCI: mt7621: Delay phy ports initialization iommu: dart: Add suspend/resume support iommu: dart: Support >64 stream IDs iommu/dart: Fix apple_dart_device_group for PCI groups iommu/vt-d: Set No Execute Enable bit in PASID table entry power: supply: remove faulty cooling logic RDMA/cxgb4: Fix potential null-ptr-deref in pass_establish() usb: max-3421: Fix setting of I/O pins RDMA/irdma: Cap MSIX used to online CPUs + 1 serial: fsl_lpuart: fix RS485 RTS polariy inverse issue tty: serial: imx: Handle RS485 DE signal active high tty: serial: imx: disable Ageing Timer interrupt request irq driver core: fw_devlink: Add DL_FLAG_CYCLE support to device links driver core: fw_devlink: Don't purge child fwnode's consumer links driver core: fw_devlink: Allow marking a fwnode link as being part of a cycle driver core: fw_devlink: Consolidate device link flag computation driver core: fw_devlink: Improve check for fwnode with no device/driver driver core: fw_devlink: Make cycle detection more robust mtd: mtdpart: Don't create platform device that'll never probe usb: host: fsl-mph-dr-of: reuse device_set_of_node_from_dev dmaengine: dw-edma: Fix readq_ch() return value truncation PCI: Fix dropping valid root bus resources with .end = zero phy: rockchip-typec: fix tcphy_get_mode error case PCI: qcom: Fix host-init error handling iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry() iommu: Fix error unwind in iommu_group_alloc() iommu/amd: Do not identity map v2 capable device when snp is enabled dmaengine: sf-pdma: pdma_desc memory leak fix dmaengine: dw-axi-dmac: Do not dereference NULL structure dmaengine: ptdma: check for null desc before calling pt_cmd_callback iommu/vt-d: Fix error handling in sva enable/disable paths iommu/vt-d: Allow to use flush-queue when first level is default RDMA/rxe: cleanup some error handling in rxe_verbs.c RDMA/rxe: Fix missing memory barriers in rxe_queue.h IB/hfi1: Fix math bugs in hfi1_can_pin_pages() IB/hfi1: Fix sdma.h tx->num_descs off-by-one errors Revert "remoteproc: qcom_q6v5_mss: map/unmap metadata region before/after use" remoteproc: qcom_q6v5_mss: Use a carveout to authenticate modem headers media: ti: cal: fix possible memory leak in cal_ctx_create() media: platform: ti: Add missing check for devm_regulator_get media: imx: imx7-media-csi: fix missing clk_disable_unprepare() in imx7_csi_init() powerpc: Remove linker flag from KBUILD_AFLAGS s390/vdso: Drop '-shared' from KBUILD_CFLAGS_64 builddeb: clean generated package content media: max9286: Fix memleak in max9286_v4l2_register() media: ov2740: Fix memleak in ov2740_init_controls() media: ov5675: Fix memleak in ov5675_init_controls() media: ov5640: Fix soft reset sequence and timings media: ov5640: Handle delays when no reset_gpio set media: mc: Get media_device directly from pad media: i2c: ov772x: Fix memleak in ov772x_probe() media: i2c: imx219: Split common registers from mode tables media: i2c: imx219: Fix binning for RAW8 capture media: platform: mtk-mdp3: Fix return value check in mdp_probe() media: camss: csiphy-3ph: avoid undefined behavior media: platform: mtk-mdp3: remove unused VIDEO_MEDIATEK_VPU config media: platform: mtk-mdp3: fix Kconfig dependencies media: v4l2-jpeg: correct the skip count in jpeg_parse_app14_data media: v4l2-jpeg: ignore the unknown APP14 marker media: hantro: Fix JPEG encoder ENUM_FRMSIZE on RK3399 media: imx-jpeg: Apply clk_bulk api instead of operating specific clk media: amphion: correct the unspecified color space media: drivers/media/v4l2-core/v4l2-h264 : add detection of null pointers media: rc: Fix use-after-free bugs caused by ene_tx_irqsim() media: atomisp: Only set default_run_mode on first open of a stream/asd media: i2c: ov7670: 0 instead of -EINVAL was returned media: usb: siano: Fix use after free bugs caused by do_submit_urb media: saa7134: Use video_unregister_device for radio_dev rpmsg: glink: Avoid infinite loop on intent for missing channel rpmsg: glink: Release driver_override ARM: OMAP2+: omap4-common: Fix refcount leak bug arm64: dts: qcom: msm8996: Add additional A2NoC clocks udf: Define EFSCORRUPTED error code context_tracking: Fix noinstr vs KASAN exit: Detect and fix irq disabled state in oops ARM: dts: exynos: Use Exynos5420 compatible for the MIPI video phy fs: Use CHECK_DATA_CORRUPTION() when kernel bugs are detected blk-iocost: fix divide by 0 error in calc_lcoefs() blk-cgroup: dropping parent refcount after pd_free_fn() is done blk-cgroup: synchronize pd_free_fn() from blkg_free_workfn() and blkcg_deactivate_policy() trace/blktrace: fix memory leak with using debugfs_lookup() btrfs: scrub: improve tree block error reporting arm64: zynqmp: Enable hs termination flag for USB dwc3 controller cpuidle, intel_idle: Fix CPUIDLE_FLAG_INIT_XSTATE x86/fpu: Don't set TIF_NEED_FPU_LOAD for PF_IO_WORKER threads cpuidle: drivers: firmware: psci: Dont instrument suspend code cpuidle: lib/bug: Disable rcu_is_watching() during WARN/BUG perf/x86/intel/uncore: Add Meteor Lake support wifi: ath9k: Fix use-after-free in ath9k_hif_usb_disconnect() wifi: ath11k: fix monitor mode bringup crash wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() rcu: Make RCU_LOCKDEP_WARN() avoid early lockdep checks rcu: Suppress smp_processor_id() complaint in synchronize_rcu_expedited_wait() srcu: Delegate work to the boot cpu if using SRCU_SIZE_SMALL rcu-tasks: Make rude RCU-Tasks work well with CPU hotplug rcu-tasks: Handle queue-shrink/callback-enqueue race condition wifi: ath11k: debugfs: fix to work with multiple PCI devices thermal: intel: Fix unsigned comparison with less than zero timers: Prevent union confusion from unexpected restart_syscall() x86/bugs: Reset speculation control settings on init bpftool: Always disable stack protection for BPF objects wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds wifi: mt7601u: fix an integer underflow inet: fix fast path in __inet_hash_connect() ice: restrict PTP HW clock freq adjustments to 100, 000, 000 PPB ice: add missing checks for PF vsi type ACPI: Don't build ACPICA with '-Os' bpf, docs: Fix modulo zero, division by zero, overflow, and underflow thermal: intel: intel_pch: Add support for Wellsburg PCH clocksource: Suspend the watchdog temporarily when high read latency detected crypto: hisilicon: Wipe entire pool on error net: bcmgenet: Add a check for oversized packets m68k: Check syscall_trace_enter() return code s390/mm,ptdump: avoid Kasan vs Memcpy Real markers swapping netfilter: nf_tables: NULL pointer dereference in nf_tables_updobj() can: isotp: check CAN address family in isotp_bind() gcc-plugins: drop -std=gnu++11 to fix GCC 13 build tools/power/x86/intel-speed-select: Add Emerald Rapid quirk wifi: mt76: dma: free rx_head in mt76_dma_rx_cleanup ACPI: video: Fix Lenovo Ideapad Z570 DMI match net/mlx5: fw_tracer: Fix debug print coda: Avoid partial allocation of sig_inputArgs uaccess: Add minimum bounds check on kernel buffer size s390/idle: mark arch_cpu_idle() noinstr time/debug: Fix memory leak with using debugfs_lookup() PM: domains: fix memory leak with using debugfs_lookup() PM: EM: fix memory leak with using debugfs_lookup() Bluetooth: Fix issue with Actions Semi ATS2851 based devices Bluetooth: btusb: Add new PID/VID 0489:e0f2 for MT7921 Bluetooth: btusb: Add VID:PID 13d3:3529 for Realtek RTL8821CE wifi: rtw89: debug: avoid invalid access on RTW89_DBG_SEL_MAC_30 hv_netvsc: Check status in SEND_RNDIS_PKT completion message s390/kfence: fix page fault reporting devlink: Fix TP_STRUCT_entry in trace of devlink health report scm: add user copy checks to put_cmsg() drm: panel-orientation-quirks: Add quirk for Lenovo Yoga Tab 3 X90F drm: panel-orientation-quirks: Add quirk for DynaBook K50 drm/amd/display: Reduce expected sdp bandwidth for dcn321 drm/amd/display: Revert Reduce delay when sink device not able to ACK 00340h write drm/amd/display: Fix potential null-deref in dm_resume drm/omap: dsi: Fix excessive stack usage HID: Add Mapping for System Microphone Mute drm/tiny: ili9486: Do not assume 8-bit only SPI controllers drm/amd/display: Defer DIG FIFO disable after VID stream enable drm/radeon: free iio for atombios when driver shutdown drm/amd: Avoid BUG() for case of SRIOV missing IP version drm/amdkfd: Page aligned memory reserve size scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write Revert "fbcon: don't lose the console font across generic->chip driver switch" drm/amd: Avoid ASSERT for some message failures drm: amd: display: Fix memory leakage drm/amd/display: fix mapping to non-allocated address HID: uclogic: Add frame type quirk HID: uclogic: Add battery quirk HID: uclogic: Add support for XP-PEN Deco Pro SW HID: uclogic: Add support for XP-PEN Deco Pro MW drm/msm/dsi: Add missing check for alloc_ordered_workqueue drm: rcar-du: Add quirk for H3 ES1.x pclk workaround drm: rcar-du: Fix setting a reserved bit in DPLLCR drm/drm_print: correct format problem drm/amd/display: Set hvm_enabled flag for S/G mode habanalabs: extend fatal messages to contain PCI info habanalabs: fix bug in timestamps registration code docs/scripts/gdb: add necessary make scripts_gdb step drm/msm/dpu: Add DSC hardware blocks to register snapshot ASoC: soc-compress: Reposition and add pcm_mutex ASoC: kirkwood: Iterate over array indexes instead of using pointer math regulator: max77802: Bounds check regulator id against opmode regulator: s5m8767: Bounds check id indexing into arrays Revert "drm/amdgpu: TA unload messages are not actually sent to psp when amdgpu is uninstalled" drm/amd/display: fix FCLK pstate change underflow gfs2: Improve gfs2_make_fs_rw error handling hwmon: (coretemp) Simplify platform device handling hwmon: (nct6775) Directly call ASUS ACPI WMI method hwmon: (nct6775) B650/B660/X670 ASUS boards support pinctrl: at91: use devm_kasprintf() to avoid potential leaks drm/amd/display: Do not commit pipe when updating DRR scsi: snic: Fix memory leak with using debugfs_lookup() scsi: ufs: core: Fix device management cmd timeout flow HID: logitech-hidpp: Don't restart communication if not necessary drm/amd/display: Enable P-state validation checks for DCN314 drm: panel-orientation-quirks: Add quirk for Lenovo IdeaPad Duet 3 10IGL5 drm/amd/display: Disable HUBP/DPP PG on DCN314 for now dm thin: add cond_resched() to various workqueue loops dm cache: add cond_resched() to various workqueue loops nfsd: zero out pointers after putting nfsd_files on COPY setup error nfsd: don't hand out delegation on setuid files being opened for write cifs: prevent data race in smb2_reconnect() drm/shmem-helper: Revert accidental non-GPL export driver core: fw_devlink: Avoid spurious error message wifi: rtl8xxxu: fixing transmisison failure for rtl8192eu scsi: mpt3sas: Remove usage of dma_get_required_mask() API firmware: coreboot: framebuffer: Ignore reserved pixel color bits block: don't allow multiple bios for IOCB_NOWAIT issue block: clear bio->bi_bdev when putting a bio back in the cache block: be a bit more careful in checking for NULL bdev while polling rtc: pm8xxx: fix set-alarm race ipmi: ipmb: Fix the MODULE_PARM_DESC associated to 'retry_time_ms' ipmi:ssif: resend_msg() cannot fail ipmi_ssif: Rename idle state and check io_uring: Replace 0-length array with flexible array io_uring: use user visible tail in io_uring_poll() io_uring: handle TIF_NOTIFY_RESUME when checking for task_work io_uring: add a conditional reschedule to the IOPOLL cancelation loop io_uring: add reschedule point to handle_tw_list() io_uring/rsrc: disallow multi-source reg buffers io_uring: remove MSG_NOSIGNAL from recvmsg io_uring: fix fget leak when fs don't support nowait buffered read s390/extmem: return correct segment type in __segment_load() s390: discard .interp section s390/kprobes: fix irq mask clobbering on kprobe reenter from post_handler s390/kprobes: fix current_kprobe never cleared after kprobes reenter KVM: s390: disable migration mode when dirty tracking is disabled cifs: Fix uninitialized memory read in smb3_qfs_tcon() cifs: Fix uninitialized memory reads for oparms.mode cifs: fix mount on old smb servers cifs: introduce cifs_io_parms in smb2_async_writev() cifs: split out smb3_use_rdma_offload() helper cifs: don't try to use rdma offload on encrypted connections cifs: Check the lease context if we actually got a lease cifs: return a single-use cfid if we did not get a lease scsi: mpi3mr: Fix missing mrioc->evtack_cmds initialization scsi: mpi3mr: Fix issues in mpi3mr_get_all_tgt_info() scsi: mpi3mr: Remove unnecessary memcpy() to alltgt_info->dmi btrfs: hold block group refcount during async discard locking/rwsem: Prevent non-first waiter from spinning in down_write() slowpath ksmbd: fix wrong data area length for smb2 lock request ksmbd: do not allow the actual frame length to be smaller than the rfc1002 length ksmbd: fix possible memory leak in smb2_lock() torture: Fix hang during kthread shutdown phase ARM: dts: exynos: correct HDMI phy compatible in Exynos4 io_uring: mark task TASK_RUNNING before handling resume/task work hfs: fix missing hfs_bnode_get() in __hfs_bnode_create fs: hfsplus: fix UAF issue in hfsplus_put_super exfat: fix reporting fs error when reading dir beyond EOF exfat: fix unexpected EOF while reading dir exfat: redefine DIR_DELETED as the bad cluster number exfat: fix inode->i_blocks for non-512 byte sector size device fs: dlm: don't set stop rx flag after node reset fs: dlm: move sending fin message into state change handling fs: dlm: send FIN ack back in right cases f2fs: fix information leak in f2fs_move_inline_dirents() f2fs: retry to update the inode page given data corruption f2fs: fix cgroup writeback accounting with fs-layer encryption f2fs: fix kernel crash due to null io->bio ocfs2: fix defrag path triggering jbd2 ASSERT ocfs2: fix non-auto defrag path not working issue fs/cramfs/inode.c: initialize file_ra_state selftests/landlock: Skip overlayfs tests when not supported selftests/landlock: Test ptrace as much as possible with Yama udf: Truncate added extents on failed expansion udf: Do not bother merging very long extents udf: Do not update file length for failed writes to inline files udf: Preserve link count of system files udf: Detect system inodes linked into directory hierarchy udf: Fix file corruption when appending just after end of preallocated extent md: don't update recovery_cp when curr_resync is ACTIVE RDMA/siw: Fix user page pinning accounting KVM: Destroy target device if coalesced MMIO unregistration fails KVM: VMX: Fix crash due to uninitialized current_vmcs KVM: Register /dev/kvm as the _very_ last thing during initialization KVM: x86: Purge "highest ISR" cache when updating APICv state KVM: x86: Blindly get current x2APIC reg value on "nodecode write" traps KVM: x86: Don't inhibit APICv/AVIC on xAPIC ID "change" if APIC is disabled KVM: x86: Don't inhibit APICv/AVIC if xAPIC ID mismatch is due to 32-bit ID KVM: SVM: Flush the "current" TLB when activating AVIC KVM: SVM: Process ICR on AVIC IPI delivery failure due to invalid target KVM: SVM: Don't put/load AVIC when setting virtual APIC mode KVM: x86: Inject #GP if WRMSR sets reserved bits in APIC Self-IPI KVM: x86: Inject #GP on x2APIC WRMSR that sets reserved bits 63:32 KVM: SVM: Fix potential overflow in SEV's send|receive_update_data() KVM: SVM: hyper-v: placate modpost section mismatch error selftests: x86: Fix incorrect kernel headers search path x86/virt: Force GIF=1 prior to disabling SVM (for reboot flows) x86/crash: Disable virt in core NMI crash handler to avoid double shootdown x86/reboot: Disable virtualization in an emergency if SVM is supported x86/reboot: Disable SVM, not just VMX, when stopping CPUs x86/kprobes: Fix __recover_optprobed_insn check optimizing logic x86/kprobes: Fix arch_check_optimized_kprobe check within optimized_kprobe range x86/microcode/amd: Remove load_microcode_amd()'s bsp parameter x86/microcode/AMD: Add a @cpu parameter to the reloading functions x86/microcode/AMD: Fix mixed steppings support x86/speculation: Allow enabling STIBP with legacy IBRS Documentation/hw-vuln: Document the interaction between IBRS and STIBP virt/sev-guest: Return -EIO if certificate buffer is not large enough brd: mark as nowait compatible brd: return 0/-error from brd_insert_page() brd: check for REQ_NOWAIT and set correct page allocation mask ima: fix error handling logic when file measurement failed ima: Align ima_file_mmap() parameters with mmap_file LSM hook selftests/powerpc: Fix incorrect kernel headers search path selftests/ftrace: Fix eprobe syntax test case to check filter support selftests: sched: Fix incorrect kernel headers search path selftests: core: Fix incorrect kernel headers search path selftests: pid_namespace: Fix incorrect kernel headers search path selftests: arm64: Fix incorrect kernel headers search path selftests: clone3: Fix incorrect kernel headers search path selftests: pidfd: Fix incorrect kernel headers search path selftests: membarrier: Fix incorrect kernel headers search path selftests: kcmp: Fix incorrect kernel headers search path selftests: media_tests: Fix incorrect kernel headers search path selftests: gpio: Fix incorrect kernel headers search path selftests: filesystems: Fix incorrect kernel headers search path selftests: user_events: Fix incorrect kernel headers search path selftests: ptp: Fix incorrect kernel headers search path selftests: sync: Fix incorrect kernel headers search path selftests: rseq: Fix incorrect kernel headers search path selftests: move_mount_set_group: Fix incorrect kernel headers search path selftests: mount_setattr: Fix incorrect kernel headers search path selftests: perf_events: Fix incorrect kernel headers search path selftests: ipc: Fix incorrect kernel headers search path selftests: futex: Fix incorrect kernel headers search path selftests: drivers: Fix incorrect kernel headers search path selftests: dmabuf-heaps: Fix incorrect kernel headers search path selftests: vm: Fix incorrect kernel headers search path selftests: seccomp: Fix incorrect kernel headers search path irqdomain: Fix association race irqdomain: Fix disassociation race irqdomain: Look for existing mapping only once irqdomain: Drop bogus fwspec-mapping error handling irqdomain: Refactor __irq_domain_alloc_irqs() irqdomain: Fix mapping-creation race irqdomain: Fix domain registration race crypto: qat - fix out-of-bounds read mm/damon/paddr: fix missing folio_put() ALSA: ice1712: Do not left ice->gpio_mutex locked in aureon_add_controls() ALSA: hda/realtek: Add quirk for HP EliteDesk 800 G6 Tower PC jbd2: fix data missing when reusing bh which is ready to be checkpointed ext4: optimize ea_inode block expansion ext4: refuse to create ea block when umounted cxl/pmem: Fix nvdimm registration races mtd: spi-nor: sfdp: Fix index value for SCCR dwords mtd: spi-nor: spansion: Consider reserved bits in CFR5 register mtd: spi-nor: Fix shift-out-of-bounds in spi_nor_set_erase_type dm: send just one event on resize, not two dm: add cond_resched() to dm_wq_work() dm: add cond_resched() to dm_wq_requeue_work() wifi: rtw88: use RTW_FLAG_POWERON flag to prevent to power on/off twice wifi: rtl8xxxu: Use a longer retry limit of 48 wifi: ath11k: allow system suspend to survive ath11k wifi: cfg80211: Fix use after free for wext wifi: cfg80211: Set SSID if it is not already set cpuidle: add ARCH_SUSPEND_POSSIBLE dependencies qede: fix interrupt coalescing configuration thermal: intel: powerclamp: Fix cur_state for multi package system dm flakey: fix logic when corrupting a bio dm cache: free background tracker's queued work in btracker_destroy dm flakey: don't corrupt the zero page dm flakey: fix a bug with 32-bit highmem systems hwmon: (peci/cputemp) Fix off-by-one in coretemp_label allocation hwmon: (nct6775) Fix incorrect parenthesization in nct6775_write_fan_div() ARM: dts: qcom: sdx65: Add Qcom SMMU-500 as the fallback for IOMMU node ARM: dts: qcom: sdx55: Add Qcom SMMU-500 as the fallback for IOMMU node ARM: dts: exynos: correct TMU phandle in Exynos4210 ARM: dts: exynos: correct TMU phandle in Exynos4 ARM: dts: exynos: correct TMU phandle in Odroid XU3 family ARM: dts: exynos: correct TMU phandle in Exynos5250 ARM: dts: exynos: correct TMU phandle in Odroid XU ARM: dts: exynos: correct TMU phandle in Odroid HC1 arm64: mm: hugetlb: Disable HUGETLB_PAGE_OPTIMIZE_VMEMMAP fuse: add inode/permission checks to fileattr_get/fileattr_set rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails ceph: update the time stamps and try to drop the suid/sgid regulator: core: Use ktime_get_boottime() to determine how long a regulator was off panic: fix the panic_print NMI backtrace setting mm/hwpoison: convert TTU_IGNORE_HWPOISON to TTU_HWPOISON alpha: fix FEN fault handling dax/kmem: Fix leak of memory-hotplug resources mips: fix syscall_get_nr media: ipu3-cio2: Fix PM runtime usage_count in driver unbind remoteproc/mtk_scp: Move clk ops outside send_lock docs: gdbmacros: print newest record mm: memcontrol: deprecate charge moving mm/thp: check and bail out if page in deferred queue already ktest.pl: Give back console on Ctrt^C on monitor kprobes: Fix to handle forcibly unoptimized kprobes on freeing_list ktest.pl: Fix missing "end_monitor" when machine check fails ktest.pl: Add RUN_TIMEOUT option with default unlimited memory tier: release the new_memtier in find_create_memory_tier() ring-buffer: Handle race between rb_move_tail and rb_check_pages tools/bootconfig: fix single & used for logical condition tracing/eprobe: Fix to add filter on eprobe description in README file iommu/amd: Add a length limitation for the ivrs_acpihid command-line parameter iommu/amd: Improve page fault error reporting scsi: aacraid: Allocate cmd_priv with scsicmd scsi: qla2xxx: Fix link failure in NPIV environment scsi: qla2xxx: Check if port is online before sending ELS scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests scsi: qla2xxx: Remove unintended flag clearing scsi: qla2xxx: Fix erroneous link down scsi: qla2xxx: Remove increment of interface err cnt scsi: ses: Don't attach if enclosure has no components scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process() scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses scsi: ses: Fix possible desc_ptr out-of-bounds accesses scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() RISC-V: add a spin_shadow_stack declaration riscv: Avoid enabling interrupts in die() riscv: mm: fix regression due to update_mmu_cache change riscv: jump_label: Fixup unaligned arch_static_branch function riscv, mm: Perform BPF exhandler fixup on page fault riscv: ftrace: Remove wasted nops for !RISCV_ISA_C riscv: ftrace: Reduce the detour code size to half MIPS: DTS: CI20: fix otg power gpio PCI/PM: Observe reset delay irrespective of bridge_d3 PCI: Unify delay handling for reset and resume PCI: hotplug: Allow marking devices as disconnected during bind/unbind PCI: Avoid FLR for AMD FCH AHCI adapters PCI/DPC: Await readiness of secondary bus after reset bus: mhi: ep: Only send -ENOTCONN status if client driver is available bus: mhi: ep: Move chan->lock to the start of processing queued ch ring bus: mhi: ep: Save channel state locally during suspend and resume iommu/vt-d: Avoid superfluous IOTLB tracking in lazy mode iommu/vt-d: Fix PASID directory pointer coherency vfio/type1: exclude mdevs from VFIO_UPDATE_VADDR vfio/type1: prevent underflow of locked_vm via exec() vfio/type1: track locked_vm per dma vfio/type1: restore locked_vm drm/amd: Fix initialization for nbio 7.5.1 drm/i915/quirks: Add inverted backlight quirk for HP 14-r206nv drm/radeon: Fix eDP for single-display iMac11,2 drm/i915: Don't use stolen memory for ring buffers with LLC drm/i915: Don't use BAR mappings for ring buffers with LLC drm/gud: Fix UBSAN warning drm/edid: fix AVI infoframe aspect ratio handling drm/edid: fix parsing of 3D modes from HDMI VSDB qede: avoid uninitialized entries in coal_entry array brd: use radix_tree_maybe_preload instead of radix_tree_preload sbitmap: Advance the queue index before waking up a queue wait: Return number of exclusive waiters awaken sbitmap: Try each queue to wake up at least one waiter kbuild: Port silent mode detection to future gnu make. net: avoid double iput when sock_alloc_file fails Linux 6.1.16 Change-Id: I705caf70ee547e6d55f38d133bdcd50713aed745 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-03-13 15:45:34 +00:00
Vincent Donnefort	34411786c7	ANDROID: ring-buffer: Fix ring_buffer_read_page for external writers ... No shortcut is possible for reading a page without removing it from the ring-buffer. The reader needs to be moved and its timestamp updated. Bug: 249050813 Change-Id: I80fbc1e265500e419278346e2973df2488b7e8b3 Signed-off-by: Vincent Donnefort <vdonnefort@google.com>	2023-03-13 13:36:34 +00:00
Greg Kroah-Hartman	29d53c4c5a	kernel/fail_function: fix memory leak with using debugfs_lookup() ... [ Upstream commit 2bb3669f57 ] When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simpler, just call debugfs_lookup_and_remove() instead which handles all of the logic at once. Cc: Andrew Morton <akpm@linux-foundation.org> Reviewed-by: Yang Yingliang <yangyingliang@huawei.com> Link: https://lore.kernel.org/r/20230202151633.2310897-1-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-03-11 13:55:39 +01:00
Greg Kroah-Hartman	c578a68ffc	kernel/printk/index.c: fix memory leak with using debugfs_lookup() ... [ Upstream commit 55bf243c51 ] When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simpler, just call debugfs_lookup_and_remove() instead which handles all of the logic at once. Cc: Chris Down <chris@chrisdown.name> Cc: Petr Mladek <pmladek@suse.com> Cc: Sergey Senozhatsky <senozhatsky@chromium.org> Cc: Steven Rostedt <rostedt@goodmis.org> Cc: John Ogness <john.ogness@linutronix.de> Cc: linux-kernel@vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Reviewed-by: Sergey Senozhatsky <senozhatsky@chromium.org> Reviewed-by: John Ogness <john.ogness@linutronix.de> Reviewed-by: Petr Mladek <pmladek@suse.com> Signed-off-by: Petr Mladek <pmladek@suse.com> Link: https://lore.kernel.org/r/20230202151411.2308576-1-gregkh@linuxfoundation.org Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-03-11 13:55:32 +01:00
Jia-Ju Bai	2072332c04	tracing: Add NULL checks for buffer in ring_buffer_free_read_page() ... [ Upstream commit 3e4272b995 ] In a previous commit 7433632c9f, buffer, buffer->buffers and buffer->buffers[cpu] in ring_buffer_wake_waiters() can be NULL, and thus the related checks are added. However, in the same call stack, these variables are also used in ring_buffer_free_read_page(): tracing_buffers_release() ring_buffer_wake_waiters(iter->array_buffer->buffer) cpu_buffer = buffer->buffers[cpu] -> Add checks by previous commit ring_buffer_free_read_page(iter->array_buffer->buffer) cpu_buffer = buffer->buffers[cpu] -> No check Thus, to avod possible null-pointer derefernces, the related checks should be added. These results are reported by a static tool designed by myself. Link: https://lkml.kernel.org/r/20230113125501.760324-1-baijiaju1990@gmail.com Reported-by: TOTE Robot <oslab@tsinghua.edu.cn> Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-03-11 13:55:32 +01:00
Sergey Shtylyov	926aef60ea	genirq/ipi: Fix NULL pointer deref in irq_data_get_affinity_mask() ... [ Upstream commit feabecaff5 ] If ipi_send_{mask|single}() is called with an invalid interrupt number, all the local variables there will be NULL. ipi_send_verify() which is invoked from these functions does verify its 'data' parameter, resulting in a kernel oops in irq_data_get_affinity_mask() as the passed NULL pointer gets dereferenced. Add a missing NULL pointer check in ipi_send_verify()... Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool. Fixes: 3b8e29a82d ("genirq: Implement ipi_send_mask/single()") Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Link: https://lore.kernel.org/r/b541232d-c2b6-1fe9-79b4-a7129459e4d0@omp.ru Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-03-11 13:55:29 +01:00
Sangmoon Kim	1e6d82d241	ANDROID: Re-apply vendor hooks for information of blocked tasks ... This reverts commit 66330b896c (Revert "ANDROID: vendor_hooks: add waiting information for blocked tasks") The original patch has been reverted to resolve merge issues with 5.18-rc1. This patch adds again the vendor hooks for the original purpose. Bug: 271799327 Signed-off-by: Sangmoon Kim <sangmoon.kim@samsung.com> Change-Id: I86b9b7dd553b7b6a5930ace6280ecd66dc5dc4df	2023-03-10 18:16:02 +00:00
Gabriel Krisman Bertazi	d710b1e91b	wait: Return number of exclusive waiters awaken ... commit ee7dc86b6d upstream. Sbitmap code will need to know how many waiters were actually woken for its batched wakeups implementation. Return the number of woken exclusive waiters from __wake_up() to facilitate that. Suggested-by: Jan Kara <jack@suse.cz> Signed-off-by: Gabriel Krisman Bertazi <krisman@suse.de> Reviewed-by: Jan Kara <jack@suse.cz> Link: https://lore.kernel.org/r/20221115224553.23594-3-krisman@suse.de Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-03-10 09:34:34 +01:00
Masami Hiramatsu (Google)	4aa7389400	tracing/eprobe: Fix to add filter on eprobe description in README file ... commit 133921530c upstream. Fix to add a description of the filter on eprobe in README file. This is required to identify the kernel supports the filter on eprobe or not. Link: https://lore.kernel.org/all/167309833728.640500.12232259238201433587.stgit@devnote3/ Fixes: 752be5c5c9 ("tracing/eprobe: Add eprobe filter support") Cc: stable@vger.kernel.org Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-03-10 09:34:27 +01:00
Mukesh Ojha	9674390ac5	ring-buffer: Handle race between rb_move_tail and rb_check_pages ... commit 8843e06f67 upstream. It seems a data race between ring_buffer writing and integrity check. That is, RB_FLAG of head_page is been updating, while at same time RB_FLAG was cleared when doing integrity check rb_check_pages(): rb_check_pages() rb_handle_head_page(): -------- -------- rb_head_page_deactivate() rb_head_page_set_normal() rb_head_page_activate() We do intergrity test of the list to check if the list is corrupted and it is still worth doing it. So, let's refactor rb_check_pages() such that we no longer clear and set flag during the list sanity checking. [1] and [2] are the test to reproduce and the crash report respectively. 1: ``` read_trace.sh while true; do # the "trace" file is closed after read head -1 /sys/kernel/tracing/trace > /dev/null done ``` ``` repro.sh sysctl -w kernel.panic_on_warn=1 # function tracer will writing enough data into ring_buffer echo function > /sys/kernel/tracing/current_tracer ./read_trace.sh & ./read_trace.sh & ./read_trace.sh & ./read_trace.sh & ./read_trace.sh & ./read_trace.sh & ./read_trace.sh & ./read_trace.sh & ``` 2: ------------[ cut here ]------------ WARNING: CPU: 9 PID: 62 at kernel/trace/ring_buffer.c:2653 rb_move_tail+0x450/0x470 Modules linked in: CPU: 9 PID: 62 Comm: ksoftirqd/9 Tainted: G W 6.2.0-rc6+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 RIP: 0010:rb_move_tail+0x450/0x470 Code: ff ff 4c 89 c8 f0 4d 0f b1 02 48 89 c2 48 83 e2 fc 49 39 d0 75 24 83 e0 03 83 f8 02 0f 84 e1 fb ff ff 48 8b 57 10 f0 ff 42 08 <0f> 0b 83 f8 02 0f 84 ce fb ff ff e9 db RSP: 0018:ffffb5564089bd00 EFLAGS: 00000203 RAX: 0000000000000000 RBX: ffff9db385a2bf81 RCX: ffffb5564089bd18 RDX: ffff9db281110100 RSI: 0000000000000fe4 RDI: ffff9db380145400 RBP: ffff9db385a2bf80 R08: ffff9db385a2bfc0 R09: ffff9db385a2bfc2 R10: ffff9db385a6c000 R11: ffff9db385a2bf80 R12: 0000000000000000 R13: 00000000000003e8 R14: ffff9db281110100 R15: ffffffffbb006108 FS: 0000000000000000(0000) GS:ffff9db3bdcc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005602323024c8 CR3: 0000000022e0c000 CR4: 00000000000006e0 Call Trace: <TASK> ring_buffer_lock_reserve+0x136/0x360 ? __do_softirq+0x287/0x2df ? __pfx_rcu_softirq_qs+0x10/0x10 trace_function+0x21/0x110 ? __pfx_rcu_softirq_qs+0x10/0x10 ? __do_softirq+0x287/0x2df function_trace_call+0xf6/0x120 0xffffffffc038f097 ? rcu_softirq_qs+0x5/0x140 rcu_softirq_qs+0x5/0x140 __do_softirq+0x287/0x2df run_ksoftirqd+0x2a/0x30 smpboot_thread_fn+0x188/0x220 ? __pfx_smpboot_thread_fn+0x10/0x10 kthread+0xe7/0x110 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2c/0x50 </TASK> ---[ end trace 0000000000000000 ]--- [ crash report and test reproducer credit goes to Zheng Yejian] Link: https://lore.kernel.org/linux-trace-kernel/1676376403-16462-1-git-send-email-quic_mojha@quicinc.com Cc: <mhiramat@kernel.org> Cc: stable@vger.kernel.org Fixes: 1039221cc2 ("ring-buffer: Do not disable recording when there is an iterator") Reported-by: Zheng Yejian <zhengyejian1@huawei.com> Signed-off-by: Mukesh Ojha <quic_mojha@quicinc.com> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-03-10 09:34:27 +01:00