Steps on the way to 6.1.129
Resolves merge conflicts in:
kernel/sched/fair.c
Change-Id: I875e1c0846dd439a019d0d5b81f09cdac4a5c74e
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Catch the lts branch up with changes made in the normal one. Commits
include in here are:
* a624f97c9a Merge tag 'android14-6.1.128_r00' into android14-6.1
* 52a41f0bf1 ANDROID: usb: typec: tcpci: Combine the parameters of set_auto_vbus_discharge_threshold
* f84d5a5fad FROMGIT: usb: typec: tcpci: Prevent Sink disconnection before vPpsShutdown in SPR PPS
* a5f88b6529 UPSTREAM: f2fs: Optimize f2fs_truncate_data_blocks_range()
* 8171ecc314 BACKPORT: f2fs: add parameter @len to f2fs_invalidate_blocks()
* 2e7c1f7a45 UPSTREAM: f2fs: update_sit_entry_for_release() supports consecutive blocks.
* 80b35f89f0 BACKPORT: f2fs: introduce update_sit_entry_for_release/alloc()
* 600d7eac27 BACKPORT: f2fs: add parameter @len to f2fs_invalidate_internal_cache()
* 187a48cb98 UPSTREAM: f2fs: expand f2fs_invalidate_compress_page() to f2fs_invalidate_compress_pages_range()
* edcfc793f8 UPSTREAM: f2fs: fix to truncate meta inode pages forcely
* 3812bc69b2 BACKPORT: f2fs: introduce f2fs_invalidate_internal_cache() for cleanup
* ccc9157843 ANDROID: cma: Add restrict_cma_redirect boot parameter
* 34a86330cc FROMLIST: KVM: arm64: Fix alignment of kvm_hyp_memcache allocations
* c93dcf3b53 UPSTREAM: binder: log transaction code on failure
* 4e534b8a58 ANDROID: GKI: Galaxy android14-6.1 update symbol for alsa audio device
* 1ac09f5c05 ANDROID: GKI: Update symbol list for arg
* e5f309b277 ANDROID: dm-bow: Protect Ranges fetched and erased from the RB tree
* 09717ac61c ANDROID: Update the ABI symbol list
* 3031fa1817 ANDROID: Adding an Android vendor LMK event
* 7658169f5f BACKPORT: usb: xhci: Fix NULL pointer dereference on certain command aborts
* 4033df202b ANDROID: OPP: Fix incorrectly backported logic in _set_opp_level()
* 1cf6be7092 UPSTREAM: io_uring: fix waiters missing wake ups
* 2055772ead UPSTREAM: f2fs: avoid trying to get invalid block address
* 554eb9d61a ANDROID: KABI macros to release excess KABI fields for use with backports
* 773ad7ab13 ANDROID: GKI: Add new symbol list for arg
Change-Id: I71e368853a486e3893c0cc5b964b8fc3c390a4e9
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
The change Ifdb1ba19f7147da286ea5e044e84dfb679050a94 ("FROMGIT: usb:
typec: tcpci: Prevent Sink disconnection before vPpsShutdown in SPR
PPS") breaks the KMI. Prevent the breakage by combining the parameters
"requested_vbus_voltage" and "pps_apdo_min_voltage" to a single u32
variable whose value is selected according to the values of parameter
"mode" and parameter "pps_active".
Bug: 388029777
Change-Id: I85872b9490561d248169bc8e008f3d907cc6c3c0
Signed-off-by: Kyle Tso <kyletso@google.com>
The Source can drop its output voltage to the minimum of the requested
PPS APDO voltage range when it is in Current Limit Mode. If this voltage
falls within the range of vPpsShutdown, the Source initiates a Hard
Reset and discharges Vbus. However, currently the Sink may disconnect
before the voltage reaches vPpsShutdown, leading to unexpected behavior.
Prevent premature disconnection by setting the Sink's disconnect
threshold to the minimum vPpsShutdown value. Additionally, consider the
voltage drop due to IR drop when calculating the appropriate threshold.
This ensures a robust and reliable interaction between the Source and
Sink during SPR PPS Current Limit Mode operation.
Fixes: 4288debeaa ("usb: typec: tcpci: Fix up sink disconnect thresholds for PD")
Cc: stable <stable@kernel.org>
Signed-off-by: Kyle Tso <kyletso@google.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Reviewed-by: Badhri Jagan Sridharan <badhri@google.com>
Link: https://lore.kernel.org/r/20250114142435.2093857-1-kyletso@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 388029777
(cherry picked from commit 4d27afbf256028a1f54363367f30efc8854433c3
https: //git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git/
usb-next)
Change-Id: Ifdb1ba19f7147da286ea5e044e84dfb679050a94
Signed-off-by: Kyle Tso <kyletso@google.com>
[ Upstream commit 0ca953ac226eaffbe1a795f5e517095a8d494921 ]
Every layer of vop2 should bind a window, and we also need to make
sure that this window is not used by other layer.
0x5 is a reserved layer sel value on rk3568, but it will select
Cluster3 on rk3588, configure unused layers to 0x5 will lead
alpha blending error on rk3588.
When we bind a window from layerM to layerN, we move the old window
on layerN to layerM.
Fixes: 604be85547 ("drm/rockchip: Add VOP2 driver")
Tested-by: Derek Foreman <derek.foreman@collabora.com>
Signed-off-by: Andy Yan <andy.yan@rock-chips.com>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20241214081719.3330518-3-andyshrk@163.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 075a5b3969becb1ebc2f1d4fa1a1fe9163679273 ]
We need to setup background delay cycle and prescan
delay cycle when a mode is enable to avoid trigger
POST_BUF_EMPTY irq on rk3588.
Note: RK356x has no such requirement.
Signed-off-by: Andy Yan <andy.yan@rock-chips.com>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20231211115815.1785131-1-andyshrk@163.com
Stable-dep-of: 0ca953ac226e ("drm/rockchip: vop2: Fix the windows switch between different layers")
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 357445e28ff004d7f10967aa93ddb4bffa5c3688 ]
The function atomctrl_get_smc_sclk_range_table() does not check the return
value of smu_atom_get_data_table(). If smu_atom_get_data_table() fails to
retrieve SMU_Info table, it returns NULL which is later dereferenced.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
In practice this should never happen as this code only gets called
on polaris chips and the vbios data table will always be present on
those chips.
Fixes: a23eefa2f4 ("drm/amd/powerplay: enable dpm for baffin.")
Signed-off-by: Ivan Stepchenko <sid@itb.spb.ru>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
commit 64f2657b579343cf923aa933f08074e6258eb07b upstream.
A report in 2019 by the syzbot fuzzer was found to be connected to two
errors in the HID core associated with Resolution Multipliers. One of
the errors was fixed by commit ea427a222d ("HID: core: Fix deadloop
in hid_apply_multiplier."), but the other has not been fixed.
This error arises because hid_apply_multipler() assumes that every
Resolution Multiplier control is contained in a Logical Collection,
i.e., there's no way the routine can ever set multiplier_collection to
NULL. This is in spite of the fact that the function starts with a
big comment saying:
* "The Resolution Multiplier control must be contained in the same
* Logical Collection as the control(s) to which it is to be applied.
...
* If no Logical Collection is
* defined, the Resolution Multiplier is associated with all
* controls in the report."
* HID Usage Table, v1.12, Section 4.3.1, p30
*
* Thus, search from the current collection upwards until we find a
* logical collection...
The comment and the code overlook the possibility that none of the
collections found may be a Logical Collection.
The fix is to set the multiplier_collection pointer to NULL if the
collection found isn't a Logical Collection.
Reported-by: syzbot+ec5f884c4a135aa0dbb9@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/000000000000109c040597dc5843@google.com/
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Cc: Peter Hutterer <peter.hutterer@who-t.net>
Fixes: 5a4abb36f3 ("HID: core: process the Resolution Multiplier")
Cc: stable@vger.kernel.org
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Upstream commit 834f304192834d6f0941954f3277ae0ba11a9a86 ]
In the etnaviv_gem_vmap_impl() function, the driver vmap whatever buffers
with write combine(WC) page property, this is incorrect. Cached buffers
should be mapped with the cached page property and uncached buffers should
be mapped with the uncached page property.
Fixes: a0a5ab3e99 ("drm/etnaviv: call correct function when trying to vmap a DMABUF")
Signed-off-by: Sui Jingfeng <sui.jingfeng@linux.dev>
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit a430d99e349026d53e2557b7b22bd2ebd61fe12a ]
In /proc/schedstat, lb_hot_gained reports the number hot tasks pulled
during load balance. This value is incremented in can_migrate_task()
if the task is migratable and hot. After incrementing the value,
load balancer can still decide not to migrate this task leading to wrong
accounting. Fix this by incrementing stats when hot tasks are detached.
This issue only exists in detach_tasks() where we can decide to not
migrate hot task even if it is migratable. However, in detach_one_task(),
we migrate it unconditionally.
[Swapnil: Handled the case where nr_failed_migrations_hot was not accounted properly and wrote commit log]
Fixes: d31980846f ("sched: Move up affinity check to mitigate useless redoing overhead")
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reported-by: "Gautham R. Shenoy" <gautham.shenoy@amd.com>
Not-yet-signed-off-by: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Swapnil Sapkal <swapnil.sapkal@amd.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lore.kernel.org/r/20241220063224.17767-2-swapnil.sapkal@amd.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 52b33d87b9 ]
The commit d583d360a6 ("psi: Fix psi state corruption when schedule()
races with cgroup move") fixed a race problem by making cgroup_move_task()
use task->psi_flags instead of looking at the scheduler state.
We can extend task->psi_flags usage to CPU migration, which should be
a minor optimization for performance and code simplicity.
Signed-off-by: Chengming Zhou <zhouchengming@bytedance.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Link: https://lore.kernel.org/r/20220926081931.45420-1-zhouchengming@bytedance.com
Stable-dep-of: a430d99e3490 ("sched/fair: Fix value reported by hot tasks pulled in /proc/schedstat")
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit e30458d690f35abb01de8b3cbc09285deb725d00 ]
Fix a pair of bugs in the fallback handling for the YFS.RemoveFile2 RPC
call:
(1) Fix the abort code check to also look for RXGEN_OPCODE. The lack of
this masks the second bug.
(2) call->server is now not used for ordinary filesystem RPC calls that
have an operation descriptor. Fix to use call->op->server instead.
Fixes: e49c7b2f6d ("afs: Build an abstraction around an "operation" concept")
Signed-off-by: David Howells <dhowells@redhat.com>
Link: https://lore.kernel.org/r/109541.1736865963@warthog.procyon.org.uk
cc: Marc Dionne <marc.dionne@auristor.com>
cc: linux-afs@lists.infradead.org
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 344af27715ddbf357cf76978d674428b88f8e92d ]
While working on implementing user access validation on powerpc
I got the following warnings on a pmac32_defconfig build:
CC fs/select.o
fs/select.o: warning: objtool: sys_pselect6+0x1bc: redundant UACCESS disable
fs/select.o: warning: objtool: sys_pselect6_time32+0x1bc: redundant UACCESS disable
On powerpc/32s, user_read_access_begin/end() are no-ops, but the
failure path has a user_access_end() instead of user_read_access_end()
which means an access end without any prior access begin.
Replace that user_access_end() by user_read_access_end().
Fixes: 7e71609f64 ("pselect6() and friends: take handling the combined 6th/7th args into helper")
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Link: https://lore.kernel.org/r/a7139e28d767a13e667ee3c79599a8047222ef36.1736751221.git.christophe.leroy@csgroup.eu
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 2bf66e66d2e6feece6175ec09ec590a0a8563bdd ]
Commit c814bf9589 ("powerpc/selftests: Use timersub() for
gettimeofday()"), got the order of arguments to timersub() wrong,
leading to a negative time delta being reported, eg:
test: gettimeofday
tags: git_version:v6.12-rc5-409-gdddf291c3030
time = -3.297781
success: gettimeofday
The correct order is minuend, subtrahend, which in this case is end,
start. Which gives:
test: gettimeofday
tags: git_version:v6.12-rc5-409-gdddf291c3030-dirty
time = 3.300650
success: gettimeofday
Fixes: c814bf9589 ("powerpc/selftests: Use timersub() for gettimeofday()")
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20241218114347.428108-1-mpe@ellerman.id.au
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit ac32057acc7f3d7a238dafaa9b2aa2bc9750080e ]
The xa_store() may fail due to memory allocation failure because there
is no guarantee that the index csi is already used. This fix adds an
error check of the return value of xa_store() in nvme_get_effects_log().
Fixes: 1cf7a12e09 ("nvme: use an xarray to lookup the Commands Supported and Effects log")
Signed-off-by: Keisuke Nishimura <keisuke.nishimura@inria.fr>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 844b8cdc681612ff24df62cdefddeab5772fadf1 ]
Following process can cause nbd_config UAF:
1) grab nbd_config temporarily;
2) nbd_genl_disconnect() flush all recv_work() and release the
initial reference:
nbd_genl_disconnect
nbd_disconnect_and_put
nbd_disconnect
flush_workqueue(nbd->recv_workq)
if (test_and_clear_bit(NBD_RT_HAS_CONFIG_REF, ...))
nbd_config_put
-> due to step 1), reference is still not zero
3) nbd_genl_reconfigure() queue recv_work() again;
nbd_genl_reconfigure
config = nbd_get_config_unlocked(nbd)
if (!config)
-> succeed
if (!test_bit(NBD_RT_BOUND, ...))
-> succeed
nbd_reconnect_socket
queue_work(nbd->recv_workq, &args->work)
4) step 1) release the reference;
5) Finially, recv_work() will trigger UAF:
recv_work
nbd_config_put(nbd)
-> nbd_config is freed
atomic_dec(&config->recv_threads)
-> UAF
Fix the problem by clearing NBD_RT_BOUND in nbd_genl_disconnect(), so
that nbd_genl_reconfigure() will fail.
Fixes: b7aa3d3938 ("nbd: add a reconfigure netlink command")
Reported-by: syzbot+6b0df248918b92c33e6a@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/675bfb65.050a0220.1a2d0d.0006.GAE@google.com/
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://lore.kernel.org/r/20250103092859.3574648-1-yukuai1@huaweicloud.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 457ef47c08d2979f3e59ce66267485c3faed70c8 ]
Set kernel config:
CONFIG_BLK_DEV_LOOP=m
CONFIG_BLK_DEV_LOOP_MIN_COUNT=0
Do latter:
mknod loop0 b 7 0
exec 4<> loop0
Before commit e418de3abc ("block: switch gendisk lookup to a simple
xarray"), lookup_gendisk will first use base_probe to load module loop,
and then the retry will call loop_probe to prepare the loop disk. Finally
open for this disk will success. However, after this commit, we lose the
retry logic, and open will fail with ENXIO. Block device autoloading is
deprecated and will be removed soon, but maybe we should keep open success
until we really remove it. So, give a retry to fix it.
Fixes: e418de3abc ("block: switch gendisk lookup to a simple xarray")
Suggested-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Yang Erkun <yangerkun@huawei.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://lore.kernel.org/r/20241209110435.3670985-1-yangerkun@huaweicloud.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 07a10767853adcbdbf436dc91393b729b52c4e81 ]
The AFS directory format structure, union afs_xdr_dir_block::meta, has too
many alloc counter slots declared and so pushes the hash table along and
over the data. This doesn't cause a problem at the moment because I'm
currently ignoring the hash table and only using the correct number of
alloc_ctrs in the code anyway. In future, however, I should start using
the hash table to try and speed up afs_lookup().
Fix this by using the correct constant to declare the counter array.
Fixes: 4ea219a839 ("afs: Split the directory content defs into a header")
Signed-off-by: David Howells <dhowells@redhat.com>
Link: https://lore.kernel.org/r/20241216204124.3752367-14-dhowells@redhat.com
cc: Marc Dionne <marc.dionne@auristor.com>
cc: linux-afs@lists.infradead.org
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit b49194da2aff2c879dec9c59ef8dec0f2b0809ef ]
AFS servers pass back a code indicating EEXIST when they're asked to remove
a directory that is not empty rather than ENOTEMPTY because not all the
systems that an AFS server can run on have the latter error available and
AFS preexisted the addition of that error in general.
Fix afs_rmdir() to translate EEXIST to ENOTEMPTY.
Fixes: 260a980317 ("[AFS]: Add "directory write" support.")
Signed-off-by: David Howells <dhowells@redhat.com>
Link: https://lore.kernel.org/r/20241216204124.3752367-13-dhowells@redhat.com
cc: Marc Dionne <marc.dionne@auristor.com>
cc: linux-afs@lists.infradead.org
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit d629d7a8efc33d05d62f4805c0ffb44727e3d99f ]
Commit 8597538712 ("powerpc/fadump: Do not use hugepages when fadump
is active") disabled hugetlb support when fadump is active by returning
early from hugetlbpage_init():arch/powerpc/mm/hugetlbpage.c and not
populating hpage_shift/HPAGE_SHIFT.
Later, commit 2354ad252b ("powerpc/mm: Update default hugetlb size
early") moved the allocation of hpage_shift/HPAGE_SHIFT to early boot,
which inadvertently re-enabled hugetlb support when fadump is active.
Fix this by implementing hugepages_supported() on powerpc. This ensures
that disabling hugetlb for the fadump kernel is independent of
hpage_shift/HPAGE_SHIFT.
Fixes: 2354ad252b ("powerpc/mm: Update default hugetlb size early")
Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Signed-off-by: Sourabh Jain <sourabhjain@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20241217074640.1064510-1-sourabhjain@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
Function f2fs_invalidate_blocks() can process consecutive
blocks at a time, so f2fs_truncate_data_blocks_range() is
optimized to use the new functionality of
f2fs_invalidate_blocks().
Add two variables @blkstart and @blklen, @blkstart records
the first address of the consecutive blocks, and @blkstart
records the number of consecutive blocks.
Bug: 394006856
Change-Id: I219866b6c60a8f23f92aee64429064a04e7282d2
Signed-off-by: Yi Sun <yi.sun@unisoc.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
(cherry picked from commit 120ac1dc322f402544423582234f441d98ea4a6e)
New function can process some consecutive blocks at a time.
Function f2fs_invalidate_blocks()->down_write() and up_write()
are very time-consuming, so if f2fs_invalidate_blocks() can
process consecutive blocks at one time, it will save a lot of time.
Bug: 394006856
Change-Id: I6600c5be55f0261b142285fc45212921da8121fb
Signed-off-by: Yi Sun <yi.sun@unisoc.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
(cherry picked from commit e53c568f4603e997426712146dce0bc194c1db12)
This function can process some consecutive blocks at a time.
When using update_sit_entry() to release consecutive blocks,
ensure that the consecutive blocks belong to the same segment.
Because after update_sit_entry_for_realese(), @segno is still
in use in update_sit_entry().
Bug: 394006856
Change-Id: Ia6be213c3838351292d1000a52bd54a1090f1137
Signed-off-by: Yi Sun <yi.sun@unisoc.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
(cherry picked from commit 81ffbd224e5f926bf8df01d6107db9c8779f7d57)
No logical changes, just for cleanliness.
Bug: 394006856
Change-Id: I4dddab6be974476879af46cda814dee2223ed21d
Signed-off-by: Yi Sun <yi.sun@unisoc.com>
Reviewed-by: Chao Yu <chao@kernel.org>
[Dylan: Resolved minor conflict in fs/f2fs/segment.c ]
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
(cherry picked from commit 66baee2b886d72ab6be11a08d4c7897f9612e25b)
New function can process some consecutive blocks at a time.
Bug: 394006856
Change-Id: I6741915ec3fba137ae6295688b6c4f8474411177
Signed-off-by: Yi Sun <yi.sun@unisoc.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
(cherry picked from commit d217b5cea488c0f644c189f91b636aeefa12deb9)
New function f2fs_invalidate_compress_pages_range() adds the @len
parameter. So it can process some consecutive blocks at a time.
Bug: 394006856
Change-Id: I3b30396567771e1d3608395fa0b7e5e379ddc805
Signed-off-by: Yi Sun <yi.sun@unisoc.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
(cherry picked from commit 3d56fbb1f03f2abf8c806aee14df2f462350dfba)
Below race case can cause data corruption:
Thread A GC thread
- gc_data_segment
- ra_data_block
- locked meta_inode page
- f2fs_inplace_write_data
- invalidate_mapping_pages
: fail to invalidate meta_inode page
due to lock failure or dirty|writeback
status
- f2fs_submit_page_bio
: write last dirty data to old blkaddr
- move_data_block
- load old data from meta_inode page
- f2fs_submit_page_write
: write old data to new blkaddr
Because invalidate_mapping_pages() will skip invalidating page which
has unclear status including locked, dirty, writeback and so on, so
we need to use truncate_inode_pages_range() instead of
invalidate_mapping_pages() to make sure meta_inode page will be dropped.
Fixes: 6aa58d8ad2 ("f2fs: readahead encrypted block during GC")
Fixes: e3b49ea368 ("f2fs: invalidate META_MAPPING before IPU/DIO write")
Bug: 394006856
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
(cherry picked from commit 7bb861b0b15b42d58669a0a23ce0b7efb1b6c6e5)
Change-Id: I4ba1f509a7257dd5a6636d22a0908edd91318dd8
Commit "mm,page_alloc,cma: conditionally prefer cma pageblocks for
movable allocations" (1686766493) introduced balancing of movable
allocations between CMA and normal areas.
Commit "ANDROID: cma: redirect page allocation to CMA" (f60c5572d2)
removes it, making allocations go in CMA area first.
1. Reintroduce the condition, so that CMA and normal area are used
in a balanced way(as it used to be), so it prevents depleting of CMA
region;
2. Back-port a command line option(from 6.6), "restrict_cma_redirect",
that can be used if only MOVABLE allocations marked as __GFP_CMA are
eligible to be redirected to CMA region. By default it is true.
The purpose of this change is to keep using CMA for movable allocations,
but at the same time, to have enough free CMA pages for critical system
areas such as modem initialization, GPU initialization and so on.
Bug: 381168812
Signed-off-by: Sebastian Achim <sebastian.1.achim@sony.com>
Signed-off-by: Uladzislau Rezki <uladzislau.rezki@sony.com>
Signed-off-by: Oleksiy Avramchenko <oleksiy.avramchenko@sony.com>
Change-Id: I5fd6d022340715e27754c687189c5ea0e56d9ee6
When allocating guest stage-2 page-table pages at EL2, pKVM can consume
pages from the host-provided kvm_hyp_memcache. As pgtable.c expects
zeroed pages, guest_s2_zalloc_page() actively implements this zeroing
with a PAGE_SIZE memset. Unfortunately, we don't check the page
alignment of the host-provided address before doing so, which could
lead to the memset overrunning the page if the host was malicious.
Fix this by simply force-aligning all kvm_hyp_memcache allocations to
page boundaries.
Bug: 396116221
Fixes: 60dfe093ec ("KVM: arm64: Instantiate guest stage-2 page-tables at EL2")
Reported-by: Ben Simner <ben.simner@cl.cam.ac.uk>
Link: https://lore.kernel.org/r/20250213153615.3642515-1-qperret@google.com
Change-Id: Icd8c79495a28c014aa3b320ca44a03ee46ede2ce
Signed-off-by: Quentin Perret <qperret@google.com>
INFO: 1 function symbol(s) added
'int snd_ctl_remove_id(struct snd_card*, struct snd_ctl_elem_id*)'
snd_ctl_remove_id: remove the control of the given id and release it
audio amp driver need to remove kcontrol when reload dapm control.
Bug: 391517506
Change-Id: Ic8641be7a06d2dfcacd93e1c065f71704690a5bb
Signed-off-by: Injune Choi <injune.choi@samsung.com>
6.1.127 includes commit "hrtimers: Handle CPU state correctly on
hotplug". This commit is supposed to fix "hrtimers: Push pending
hrtimers away from outgoing CPU earlier". However commit "hrtimers:
Push pending hrtimers away from outgoing CPU earlier" was reverted
earlier on 6.1-lts. 6.1.127 incorrectly merged parts of "hrtimers:
Handle CPU state correctly on hotplug", which leads to random reboots.
Let´s revert those parts.
Fixes: 79f1b689da ("Merge 6.1.127 into android14-6.1-lts")
Change-Id: Ieb5e3910d631034eb8d4376c6f5a8e9751cae936
Signed-off-by: Micha Lechner <michalechner92@googlemail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
These symbols are missing from the symbol list and are not available at runtime for unsigned modules:
iio_get_channel_type
Bug: 386822958
Change-Id: I188d191a5a23451f155584e86d66ae56c235ad64
Signed-off-by: Rishi Sikka <rishisikka@google.com>
Adding the following symbols:
- __traceiter_android_trigger_vendor_lmk_kill
- __tracepoint_android_trigger_vendor_lmk_kill
Bug: 385050909
Change-Id: I82e202177d870fe0a55c69172817c260ece41ff6
Signed-off-by: Martin Liu <liumartin@google.com>
This change adds an android_trigger_vendor_lmk_kill() trace event
which can be used by vendor modules to send LMKD kill requests.
LMKD attaches a BPF program to this trace event if it exists and
expects it to be in a particular format. To provide a standardized
definition for this event, we define and export it inside the GKI
even though there are no users. Android vendors can use this event
to emit this trace event inside their modules and experiment with
different kill strategies before upstreaming them into LMKD.
Bug: 385050909
Test: build and check the ftrace event
Change-Id: Ida4d9202675a90d6cc891e242c0621c5386df8cc
Signed-off-by: Martin Liu <liumartin@google.com>
Changes in 6.1.128
ASoC: wm8994: Add depends on MFD core
ASoC: samsung: Add missing selects for MFD_WM8994
seccomp: Stub for !CONFIG_SECCOMP
scsi: iscsi: Fix redundant response for ISCSI_UEVENT_GET_HOST_STATS request
drm/amd/display: Use HW lock mgr for PSR1
irqchip/sunxi-nmi: Add missing SKIP_WAKE flag
ASoC: samsung: midas_wm1811: Map missing jack kcontrols
ASoC: samsung: Add missing depends on I2C
regmap: detach regmap from dev on regmap_exit
ipv6: Fix soft lockups in fib6_select_path under high next hop churn
softirq: Allow raising SCHED_SOFTIRQ from SMP-call-function on RT kernel
xfs: bump max fsgeom struct version
xfs: hoist freeing of rt data fork extent mappings
xfs: prevent rt growfs when quota is enabled
xfs: rt stubs should return negative errnos when rt disabled
xfs: fix units conversion error in xfs_bmap_del_extent_delay
xfs: make sure maxlen is still congruent with prod when rounding down
xfs: introduce protection for drop nlink
xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space
xfs: allow read IO and FICLONE to run concurrently
xfs: factor out xfs_defer_pending_abort
xfs: abort intent items when recovery intents fail
xfs: only remap the written blocks in xfs_reflink_end_cow_extent
xfs: up(ic_sema) if flushing data device fails
xfs: fix internal error from AGFL exhaustion
xfs: inode recovery does not validate the recovered inode
xfs: clean up dqblk extraction
xfs: dquot recovery does not validate the recovered dquot
xfs: clean up FS_XFLAG_REALTIME handling in xfs_ioctl_setattr_xflags
xfs: respect the stable writes flag on the RT device
gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag
io_uring: fix waiters missing wake ups
net: sched: fix ets qdisc OOB Indexing
block: fix integer overflow in BLKSECDISCARD
Revert "HID: multitouch: Add support for lenovo Y9000P Touchpad"
vfio/platform: check the bounds of read/write syscalls
ext4: fix access to uninitialised lock in fc replay path
ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find()
scsi: storvsc: Ratelimit warning logs to prevent VM denial of service
wifi: iwlwifi: add a few rate index validity checks
smb: client: fix UAF in async decryption
USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb()
Revert "usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null"
ALSA: usb-audio: Add delay quirk for USB Audio Device
Input: atkbd - map F23 key to support default copilot shortcut
Input: xpad - add unofficial Xbox 360 wireless receiver clone
Input: xpad - add support for wooting two he (arm)
smb: client: fix NULL ptr deref in crypto_aead_setkey()
ASoC: samsung: midas_wm1811: Fix 'Headphone Switch' control creation
drm/v3d: Assign job pointer to NULL before signaling the fence
Linux 6.1.128
Change-Id: Ia1ddc5824b498862a5eb730dd99bd3a76dd16015
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
This reverts commit bb00b1190b which is
commit 2b2fc0be98a828cf33a88a28e9745e8599fb05cf upstream.
It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.
Bug: 161946584
Change-Id: Ib6926beda39531de3e1a1025b981b560535347a4
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
This reverts commit 760f415e08 which is
commit fd4f101edbd9f99567ab2adb1f2169579ede7c13 upstream.
It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.
Bug: 161946584
Change-Id: I7cd575ae9e9d99f5181fdc297649d7e9f96d56fc
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
This reverts commit a3fdd5f3d6 which is
commit 6eedda01b2bfdcf427b37759e053dc27232f3af1 upstream.
It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.
Bug: 161946584
Change-Id: I6d0ce9375026632d6e27f9ec83c408fdee344963
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
