Commit Graph

1067738 Commits

Author SHA1 Message Date
Greg Kroah-Hartman
fcaf5d8a67 ANDROID: preserve CRC for xhci symbols
In release 5.15.107 a new .h file was included in the xhci code, which
caused the CRCs to change as some structures changed into "real"
structures instead of anonymous definitions.  So preserve the CRCs by
commenting out the #include if GENKSYMS is being calculated.

This will be removed the next KABI break, as it shouldn't be sticking
around long.

Bug: 161946584
Fixes: 83637720ea ("xhci: also avoid the XHCI_ZERO_64B_REGS quirk with a passthrough iommu")
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I59838b0af869d3e17fc73d72eb473190c50281fd
2023-04-18 08:09:53 +00:00
Greg Kroah-Hartman
82dadab157 Merge 5.15.107 into android14-5.15
Changes in 5.15.107
	ocfs2: ocfs2_mount_volume does cleanup job before return error
	ocfs2: rewrite error handling of ocfs2_fill_super
	ocfs2: fix memory leak in ocfs2_mount_volume()
	NFSD: Fix sparse warning
	NFSD: pass range end to vfs_fsync_range() instead of count
	RDMA/irdma: Do not request 2-level PBLEs for CQ alloc
	platform/x86: int3472: Split into 2 drivers
	platform/x86: int3472/discrete: Ensure the clk/power enable pins are in output mode
	iavf: return errno code instead of status code
	iavf/iavf_main: actually log ->src mask when talking about it
	serial: 8250_exar: derive nr_ports from PCI ID for Acces I/O cards
	serial: exar: Add support for Sealevel 7xxxC serial cards
	bpf: hash map, avoid deadlock with suitable hash mask
	gpio: GPIO_REGMAP: select REGMAP instead of depending on it
	Drivers: vmbus: Check for channel allocation before looking up relids
	pwm: cros-ec: Explicitly set .polarity in .get_state()
	pwm: sprd: Explicitly set .polarity in .get_state()
	KVM: s390: pv: fix external interruption loop not always detected
	wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta
	net: qrtr: combine nameservice into main module
	net: qrtr: Fix a refcount bug in qrtr_recvmsg()
	NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL
	icmp: guard against too small mtu
	net: don't let netpoll invoke NAPI if in xmit context
	net: dsa: mv88e6xxx: Reset mv88e6393x force WD event bit
	sctp: check send stream number after wait_for_sndbuf
	net: qrtr: Do not do DEL_SERVER broadcast after DEL_CLIENT
	ipv6: Fix an uninit variable access bug in __ip6_make_skb()
	platform/x86: think-lmi: Fix memory leak when showing current settings
	platform/x86: think-lmi: Fix memory leaks when parsing ThinkStation WMI strings
	platform/x86: think-lmi: Clean up display of current_value on Thinkstation
	gpio: davinci: Add irq chip flag to skip set wake
	net: ethernet: ti: am65-cpsw: Fix mdio cleanup in probe
	net: stmmac: fix up RX flow hash indirection table when setting channels
	sunrpc: only free unix grouplist after RCU settles
	NFSD: callback request does not use correct credential for AUTH_SYS
	ice: fix wrong fallback logic for FDIR
	ice: Reset FDIR counter in FDIR init stage
	ethtool: reset #lanes when lanes is omitted
	gve: Secure enough bytes in the first TX desc for all TCP pkts
	kbuild: refactor single builds of *.ko
	usb: xhci: tegra: fix sleep in atomic call
	xhci: also avoid the XHCI_ZERO_64B_REGS quirk with a passthrough iommu
	usb: cdnsp: Fixes error: uninitialized symbol 'len'
	usb: dwc3: pci: add support for the Intel Meteor Lake-S
	USB: serial: cp210x: add Silicon Labs IFS-USB-DATACABLE IDs
	usb: typec: altmodes/displayport: Fix configure initial pin assignment
	USB: serial: option: add Telit FE990 compositions
	USB: serial: option: add Quectel RM500U-CN modem
	iio: adis16480: select CONFIG_CRC32
	iio: adc: ti-ads7950: Set `can_sleep` flag for GPIO chip
	iio: dac: cio-dac: Fix max DAC write value check for 12-bit
	iio: light: cm32181: Unregister second I2C client if present
	tty: serial: sh-sci: Fix transmit end interrupt handler
	tty: serial: sh-sci: Fix Rx on RZ/G2L SCI
	tty: serial: fsl_lpuart: avoid checking for transfer complete when UARTCTRL_SBK is asserted in lpuart32_tx_empty
	nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread()
	nilfs2: fix sysfs interface lifetime
	dt-bindings: serial: renesas,scif: Fix 4th IRQ for 4-IRQ SCIFs
	ksmbd: do not call kvmalloc() with __GFP_NORETRY | __GFP_NO_WARN
	ALSA: hda/realtek: Add quirk for Clevo X370SNW
	coresight: etm4x: Do not access TRCIDR1 for identification
	coresight-etm4: Fix for() loop drvdata->nr_addr_cmp range bug
	iio: adc: ad7791: fix IRQ flags
	scsi: qla2xxx: Fix memory leak in qla2x00_probe_one()
	scsi: iscsi_tcp: Check that sock is valid before iscsi_set_param()
	smb3: allow deferred close timeout to be configurable
	smb3: lower default deferred close timeout to address perf regression
	cifs: sanitize paths in cifs_update_super_prepath.
	perf/core: Fix the same task check in perf_event_set_output
	ftrace: Mark get_lock_parent_ip() __always_inline
	ftrace: Fix issue that 'direct->addr' not restored in modify_ftrace_direct()
	fs: drop peer group ids under namespace lock
	can: j1939: j1939_tp_tx_dat_new(): fix out-of-bounds memory access
	can: isotp: isotp_ops: fix poll() to not report false EPOLLOUT events
	tracing: Free error logs of tracing instances
	ASoC: hdac_hdmi: use set_stream() instead of set_tdm_slots()
	mm: vmalloc: avoid warn_alloc noise caused by fatal signal
	drm/panfrost: Fix the panfrost_mmu_map_fault_addr() error path
	drm/nouveau/disp: Support more modes by checking with lower bpc
	ring-buffer: Fix race while reader and writer are on the same page
	mm/swap: fix swap_info_struct race between swapoff and get_swap_pages()
	drm/bridge: lt9611: Fix PLL being unable to lock
	mm: take a page reference when removing device exclusive entries
	kbuild: fix single directory build
	ocfs2: fix freeing uninitialized resource on ocfs2_dlm_shutdown
	bpftool: Print newline before '}' for struct with padding only fields
	Linux 5.15.107

Change-Id: I88efacf4aaf63d4b21429eef2350c78da7e2528e
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-04-17 11:31:12 +00:00
Arve Hjønnevåg
12d161b7ae FROMLIST: sched/wait: Fix a kthread_park race with wait_woken()
kthread_park and wait_woken have a similar race that kthread_stop and
wait_woken used to have before it was fixed in
cb6538e740. Extend that fix to also cover
kthread_park.

Bug: 274686101
Link: https://lore.kernel.org/lkml/20230406194053.876844-1-arve@android.com/
Change-Id: Iaec960d7e30862f4ccac5c98dd43d32bbcf9a72b
Signed-off-by: Arve Hjønnevåg <arve@android.com>
(cherry picked from commit 69eba53950444890063b1e0469a61b69f8301767)
2023-04-14 21:07:17 +00:00
Badhri Jagan Sridharan
3d9d54cf37 ANDROID: Update the ABI symbol list typec mux
2 function symbol(s) added
  'void* typec_mux_get_drvdata(struct typec_mux*)'
  'struct typec_mux* typec_mux_register(struct device*, const struct typec_mux_desc*)'

Bug: 260915739
Change-Id: Ic3113c5cb932002c55674a565d3db9539669238d
Signed-off-by: Badhri Jagan Sridharan <badhri@google.com>
2023-04-14 15:22:31 +00:00
Badhri Jagan Sridharan
0d708da1f5 ANDROID: Update the ABI symbol list typec port management
2 function symbol(s) added
  'void tcpm_port_clean(struct tcpm_port*)'
  'bool tcpm_port_is_toggling(struct tcpm_port*)'

Bug: 215766959
Change-Id: Iffaa5ac3a4af04d70d473d11de975c887450f702
Signed-off-by: Badhri Jagan Sridharan <badhri@google.com>
2023-04-13 21:26:14 +00:00
Qinglin Li
9d04dbf3ec ANDROID: GKI: Add usb and pcie ABI Symbol list for Amlogic SOC
Add usb and pcie ABI Symbol list for Amlogic SOC

31 function symbol(s) added
  'int __uio_register_device(struct module*, struct device*, struct uio_info*)'
  'void* devm_pci_remap_cfg_resource(struct device*, struct resource*)'
  'struct usb_phy* devm_usb_get_phy(struct device*, enum usb_phy_type)'
  'void dw_pcie_host_deinit(struct pcie_port*)'
  'int dw_pcie_wait_for_link(struct dw_pcie*)'
  'int generic_file_open(struct inode*, struct file*)'
  'ssize_t generic_file_splice_read(struct file*, loff_t*, struct pipe_inode_info*, size_t, unsigned int)'
  'void generic_fillattr(struct user_namespace*, struct inode*, struct kstat*)'
  'int get_tree_bdev(struct fs_context*, int(*)(struct super_block*, struct fs_context*))'
  'loff_t inode_get_bytes(struct inode*)'
  'void inode_set_bytes(struct inode*, loff_t)'
  'void invalidate_bdev(struct block_device*)'
  'ssize_t iter_file_splice_write(struct pipe_inode_info*, struct file*, loff_t*, size_t, unsigned int)'
  'void kill_block_super(struct super_block*)'
  'struct nls_table* load_nls_default()'
  'char* mangle_path(char*, const char*, const char*)'
  'struct pci_bus* pci_find_next_bus(const struct pci_bus*)'
  'void pci_lock_rescan_remove()'
  'void pci_stop_and_remove_bus_device_locked(struct pci_dev*)'
  'void pci_unlock_rescan_remove()'
  'int posix_acl_chmod(struct user_namespace*, struct inode*, umode_t)'
  'void* proc_get_parent_data(const struct inode*)'
  'int sb_set_blocksize(struct super_block*, int)'
  'int sync_blockdev(struct block_device*)'
  'int sync_filesystem(struct super_block*)'
  'void uio_unregister_device(struct uio_info*)'
  'void unload_nls(struct nls_table*)'
  'int usb_add_phy_dev(struct usb_phy*)'
  'int usb_gadget_probe_driver(struct usb_gadget_driver*)'
  'int usb_gadget_unregister_driver(struct usb_gadget_driver*)'
  'int vfs_fsync(struct file*, int)'

Bug: 276863283
Change-Id: I42d5006236004fade1b03772ee1151b3de491ab1
Signed-off-by: Qinglin Li <qinglin.li@amlogic.com>
2023-04-13 18:50:28 +00:00
Qinglin Li
f9bf714530 ANDROID: GKI: Add file system ABI Symbol list for Amlogic SOC
Add file system ABI Symbol list for Amlogic SOC

69 function symbol(s) added
  'int __fs_parse(struct p_log*, const struct fs_parameter_spec*, struct fs_parameter*, struct fs_parse_result*)'
  'struct buffer_head* __getblk_gfp(struct block_device*, sector_t, unsigned int, gfp_t)'
  'void __lock_buffer(struct buffer_head*)'
  'void __mark_inode_dirty(struct inode*, int)'
  'int __set_page_dirty_buffers(struct page*)'
  'void __wait_on_buffer(struct buffer_head*)'
  'struct dentry* d_find_alias(struct inode*)'
  'void d_instantiate(struct dentry*, struct inode*)'
  'struct dentry* d_make_root(struct inode*)'
  'struct dentry* d_obtain_alias(struct inode*)'
  'struct dentry* d_splice_alias(struct inode*, struct dentry*)'
  'char* dentry_path_raw(const struct dentry*, char*, int)'
  'void discard_new_inode(struct inode*)'
  'void dput(struct dentry*)'
  'void drop_nlink(struct inode*)'
  'void end_buffer_read_sync(struct buffer_head*, int)'
  'int fiemap_fill_next_extent(struct fiemap_extent_info*, u64, u64, u64, u32)'
  'int fiemap_prep(struct inode*, struct fiemap_extent_info*, u64, u64*, u32)'
  'int file_remove_privs(struct file*)'
  'int file_update_time(struct file*)'
  'int fs_param_is_string(struct p_log*, const struct fs_parameter_spec*, struct fs_parameter*, struct fs_parse_result*)'
  'int fs_param_is_u32(struct p_log*, const struct fs_parameter_spec*, struct fs_parameter*, struct fs_parse_result*)'
  'sector_t generic_block_bmap(struct address_space*, sector_t, get_block_t*)'
  'struct dentry* generic_fh_to_dentry(struct super_block*, struct fid*, int, int, struct inode*(*)(struct super_block*, u64, u32))'
  'struct dentry* generic_fh_to_parent(struct super_block*, struct fid*, int, int, struct inode*(*)(struct super_block*, u64, u32))'
  'int generic_file_fsync(struct file*, loff_t, loff_t, int)'
  'int generic_permission(struct user_namespace*, struct inode*, int)'
  'ssize_t generic_read_dir(struct file*, char*, size_t, loff_t*)'
  'int generic_write_end(struct file*, struct address_space*, loff_t, unsigned int, unsigned int, struct page*, void*)'
  'struct inode* iget5_locked(struct super_block*, unsigned long, int(*)(struct inode*, void*), int(*)(struct inode*, void*), void*)'
  'void iget_failed(struct inode*)'
  'void ihold(struct inode*)'
  'struct inode* ilookup(struct super_block*, unsigned long)'
  'void inc_nlink(struct inode*)'
  'void init_special_inode(struct inode*, umode_t, dev_t)'
  'void inode_dio_wait(struct inode*)'
  'void inode_init_once(struct inode*)'
  'void inode_init_owner(struct user_namespace*, struct inode*, const struct inode*, umode_t)'
  'int inode_needs_sync(struct inode*)'
  'int inode_newsize_ok(const struct inode*, loff_t)'
  'void inode_nohighmem(struct inode*)'
  'int insert_inode_locked(struct inode*)'
  'void invalidate_inode_buffers(struct inode*)'
  'bool is_bad_inode(struct inode*)'
  'void kfree_link(void*)'
  'void ll_rw_block(int, int, int, struct buffer_head**)'
  'struct nls_table* load_nls(char*)'
  'void logfc(struct fc_log*, const char*, char, const char*, ...)'
  'void make_bad_inode(struct inode*)'
  'void mark_buffer_dirty(struct buffer_head*)'
  'void mpage_readahead(struct readahead_control*, get_block_t*)'
  'int mpage_readpage(struct page*, get_block_t*)'
  'int mpage_writepages(struct address_space*, struct writeback_control*, get_block_t*)'
  'struct inode* new_inode(struct super_block*)'
  'int register_filesystem(struct file_system_type*)'
  'void set_bh_page(struct buffer_head*, struct page*, unsigned long)'
  'void set_nlink(struct inode*, unsigned int)'
  'void setattr_copy(struct user_namespace*, struct inode*, const struct iattr*)'
  'int setattr_prepare(struct user_namespace*, struct dentry*, struct iattr*)'
  'int submit_bh(int, int, struct buffer_head*)'
  'int sync_dirty_buffer(struct buffer_head*)'
  'int sync_inode_metadata(struct inode*, int)'
  'int sync_mapping_buffers(struct address_space*)'
  'void unlock_buffer(struct buffer_head*)'
  'void unlock_new_inode(struct inode*)'
  'int unregister_filesystem(struct file_system_type*)'
  'int utf16s_to_utf8s(const wchar_t*, int, enum utf16_endian, u8*, int)'
  'int utf8_to_utf32(const u8*, int, unicode_t*)'
  'int write_inode_now(struct inode*, int)'

1 variable symbol(s) added
  'struct kmem_cache* names_cachep'

Bug: 276863283
Change-Id: I5addeb8f83362c80e87a33726297d72bccc2f2ed
Signed-off-by: Qinglin Li <qinglin.li@amlogic.com>
2023-04-13 18:50:28 +00:00
Qinglin Li
42dd91524e ANDROID: GKI: Add kernel base and lib ABI Symbol list for Amlogic SOC
Add kernel base and lib ABI Symbol list for Amlogic SOC

62 function symbol(s) added
  'void __devm_release_region(struct device*, struct resource*, resource_size_t, resource_size_t)'
  'int __kfifo_from_user(struct __kfifo*, const void*, unsigned long, unsigned int*)'
  'unsigned int __kfifo_in_r(struct __kfifo*, const void*, unsigned int, size_t)'
  'unsigned int __kfifo_out_r(struct __kfifo*, void*, unsigned int, size_t)'
  'int __kfifo_to_user(struct __kfifo*, void*, unsigned long, unsigned int*)'
  'int __traceiter_android_vh_iommu_iovad_free_iova(void*, struct iova_domain*, dma_addr_t, size_t)'
  'int __traceiter_android_vh_sched_show_task(void*, struct task_struct*)'
  'unsigned long _find_last_bit(const unsigned long*, unsigned long)'
  'int default_wake_function(wait_queue_entry_t*, unsigned int, int, void*)'
  'int des_expand_key(struct des_ctx*, const u8*, unsigned int)'
  'void dev_pm_clear_wake_irq(struct device*)'
  'struct device* dev_pm_domain_attach_by_id(struct device*, unsigned int)'
  'int dev_pm_set_wake_irq(struct device*, int)'
  'int device_get_phy_mode(struct device*)'
  'char* devm_kvasprintf(struct device*, gfp_t, const char*, va_list)'
  'int down_timeout(struct semaphore*, long)'
  'size_t fault_in_iov_iter_readable(const struct iov_iter*, size_t)'
  'void flush_signals(struct task_struct*)'
  'bool fwnode_device_is_available(const struct fwnode_handle*)'
  'struct fwnode_handle* fwnode_graph_get_next_endpoint(const struct fwnode_handle*, struct fwnode_handle*)'
  'struct fwnode_handle* fwnode_graph_get_port_parent(const struct fwnode_handle*)'
  'struct fwnode_handle* fwnode_graph_get_remote_endpoint(const struct fwnode_handle*)'
  'struct fwnode_handle* fwnode_graph_get_remote_port_parent(const struct fwnode_handle*)'
  'int fwnode_graph_parse_endpoint(const struct fwnode_handle*, struct fwnode_endpoint*)'
  'struct fwnode_handle* fwnode_handle_get(struct fwnode_handle*)'
  'int fwnode_property_get_reference_args(const struct fwnode_handle*, const char*, const char*, unsigned int, unsigned int, struct fwnode_reference_args*)'
  'int fwnode_property_read_u64_array(const struct fwnode_handle*, const char*, u64*, size_t)'
  'phys_addr_t gen_pool_virt_to_phys(struct gen_pool*, unsigned long)'
  'int get_device_system_crosststamp(int(*)(ktime_t*, struct system_counterval_t*, void*), void*, struct system_time_snapshot*, struct system_device_crosststamp*)'
  'void* ioremap_cache(phys_addr_t, size_t)'
  'void iov_iter_init(struct iov_iter*, unsigned int, const struct iovec*, unsigned long, size_t)'
  'size_t iov_iter_zero(size_t, struct iov_iter*)'
  'unsigned int irq_create_fwspec_mapping(struct irq_fwspec*)'
  'void irq_domain_free_irqs_parent(struct irq_domain*, unsigned int, unsigned int)'
  'void kernel_sigaction(int, __sighandler_t)'
  'int kill_pid(struct pid*, int, int)'
  'void lockref_get(struct lockref*)'
  'char* next_arg(char*, char**, char**)'
  'int nla_append(struct sk_buff*, int, const void*)'
  'int param_get_charp(char*, const struct kernel_param*)'
  'int param_get_string(char*, const struct kernel_param*)'
  'int param_set_charp(const char*, const struct kernel_param*)'
  'int param_set_copystring(const char*, const struct kernel_param*)'
  'int platform_get_irq_byname_optional(struct platform_device*, const char*)'
  'struct rb_node* rb_last(const struct rb_root*)'
  'u64 read_sanitised_ftr_reg(u32)'
  'int register_module_notifier(struct notifier_block*)'
  'struct perf_event** register_wide_hw_breakpoint(struct perf_event_attr*, perf_overflow_handler_t, void*)'
  'int regmap_irq_chip_get_base(struct regmap_irq_chip_data*)'
  'int release_resource(struct resource*)'
  'size_t sg_copy_from_buffer(struct scatterlist*, unsigned int, const void*, size_t)'
  'size_t sg_copy_to_buffer(struct scatterlist*, unsigned int, void*, size_t)'
  'int sg_nents(struct scatterlist*)'
  'ssize_t show_class_attr_string(struct class*, struct class_attribute*, char*)'
  'void show_regs(struct pt_regs*)'
  'int smpboot_register_percpu_thread(struct smp_hotplug_thread*)'
  'void stack_trace_print(const unsigned long*, unsigned int, int)'
  'char* strchrnul(const char*, int)'
  'void symbol_put_addr(void*)'
  'int unregister_module_notifier(struct notifier_block*)'
  'void unregister_wide_hw_breakpoint(struct perf_event**)'
  'void yield()'

12 variable symbol(s) added
  'struct tracepoint __tracepoint_android_vh_iommu_iovad_free_iova'
  'struct tracepoint __tracepoint_android_vh_sched_show_task'
  'struct cma* dma_contiguous_default_area'
  'const char hex_asc[17]'
  'u64 jiffies_64'
  'int overflowgid'
  'int overflowuid'
  'const struct kernel_param_ops param_ops_short'
  'const struct kernel_param_ops param_ops_ullong'
  'const struct kernel_param_ops param_ops_ushort'
  'struct workqueue_struct* pm_wq'
  'const uuid_t uuid_null'

Bug: 276863283
Change-Id: I22fc86f1e769c06744948a8b60254b1172364e3f
Signed-off-by: Qinglin Li <qinglin.li@amlogic.com>
2023-04-13 18:50:28 +00:00
Qinglin Li
6c73bb759c ANDROID: GKI: Add mmc gpio pwm etc ABI Symbol list for Amlogic SOC
Add mmc gpio pwm etc ABI Symbol list for Amlogic SOC

71 function symbol(s) added
  'int __device_reset(struct device*, bool)'
  'int __mmc_claim_host(struct mmc_host*, struct mmc_ctx*, atomic_t*)'
  'void dev_pm_opp_free_cpufreq_table(struct device*, struct cpufreq_frequency_table**)'
  'struct opp_table* dev_pm_opp_get_opp_table(struct device*)'
  'int dev_pm_opp_init_cpufreq_table(struct device*, struct cpufreq_frequency_table**)'
  'int dev_pm_opp_of_add_table_indexed(struct device*, int)'
  'void dev_pm_opp_put_opp_table(struct opp_table*)'
  'int devm_clk_hw_register_clkdev(struct device*, struct clk_hw*, const char*, const char*)'
  'struct pwm_device* devm_of_pwm_get(struct device*, struct device_node*, const char*)'
  'struct pwm_device* devm_pwm_get(struct device*, const char*)'
  'int extcon_dev_register(struct extcon_dev*)'
  'int extcon_set_state(struct extcon_dev*, unsigned int, bool)'
  'struct gpio_desc* gpiod_get_index(struct device*, const char*, unsigned int, enum gpiod_flags)'
  'int hwspin_lock_register(struct hwspinlock_device*, struct device*, const struct hwspinlock_ops*, int, int)'
  'int hwspin_lock_unregister(struct hwspinlock_device*)'
  'void iio_buffer_init(struct iio_buffer*)'
  'void iio_buffer_put(struct iio_buffer*)'
  'int iio_device_attach_buffer(struct iio_dev*, struct iio_buffer*)'
  's64 iio_get_time_ns(const struct iio_dev*)'
  'int iio_push_to_buffers(struct iio_dev*, const void*)'
  'void led_trigger_blink_oneshot(struct led_trigger*, unsigned long*, unsigned long*, int)'
  'void led_trigger_event(struct led_trigger*, enum led_brightness)'
  'int led_trigger_register(struct led_trigger*)'
  'void led_trigger_register_simple(const char*, struct led_trigger**)'
  'void led_trigger_unregister(struct led_trigger*)'
  'void led_trigger_unregister_simple(struct led_trigger*)'
  'bool mmc_card_is_blockaddr(struct mmc_card*)'
  'void mmc_detect_change(struct mmc_host*, unsigned long)'
  'void mmc_release_host(struct mmc_host*)'
  'void mmc_set_data_timeout(struct mmc_data*, const struct mmc_card*)'
  'int mmc_sw_reset(struct mmc_host*)'
  'int mmc_switch(struct mmc_card*, u8, u8, u8, unsigned int)'
  'void mmc_wait_for_req(struct mmc_host*, struct mmc_request*)'
  'struct reset_control* of_reset_control_array_get(struct device_node*, bool, bool, bool)'
  'int pwm_adjust_config(struct pwm_device*)'
  'int pwm_apply_state(struct pwm_device*, const struct pwm_state*)'
  'int regulator_list_voltage(struct regulator*, unsigned int)'
  'int regulator_map_voltage_iterate(struct regulator_dev*, int, int)'
  'int rtc_add_group(struct rtc_device*, const struct attribute_group*)'
  'unsigned int sdio_align_size(struct sdio_func*, unsigned int)'
  'void sdio_claim_host(struct sdio_func*)'
  'int sdio_claim_irq(struct sdio_func*, sdio_irq_handler_t*)'
  'int sdio_disable_func(struct sdio_func*)'
  'int sdio_enable_func(struct sdio_func*)'
  'unsigned char sdio_f0_readb(struct sdio_func*, unsigned int, int*)'
  'void sdio_f0_writeb(struct sdio_func*, unsigned char, unsigned int, int*)'
  'mmc_pm_flag_t sdio_get_host_pm_caps(struct sdio_func*)'
  'u8 sdio_readb(struct sdio_func*, unsigned int, int*)'
  'u32 sdio_readl(struct sdio_func*, unsigned int, int*)'
  'int sdio_readsb(struct sdio_func*, void*, unsigned int, int)'
  'u16 sdio_readw(struct sdio_func*, unsigned int, int*)'
  'int sdio_register_driver(struct sdio_driver*)'
  'void sdio_release_host(struct sdio_func*)'
  'int sdio_release_irq(struct sdio_func*)'
  'void sdio_retune_crc_disable(struct sdio_func*)'
  'void sdio_retune_crc_enable(struct sdio_func*)'
  'void sdio_retune_hold_now(struct sdio_func*)'
  'void sdio_retune_release(struct sdio_func*)'
  'int sdio_set_host_pm_flags(struct sdio_func*, mmc_pm_flag_t)'
  'void sdio_unregister_driver(struct sdio_driver*)'
  'void sdio_writeb(struct sdio_func*, u8, unsigned int, int*)'
  'void sdio_writel(struct sdio_func*, u32, unsigned int, int*)'
  'int sdio_writesb(struct sdio_func*, unsigned int, void*, int)'
  'void sdio_writew(struct sdio_func*, u16, unsigned int, int*)'
  'struct spi_device* spi_alloc_device(struct spi_controller*)'
  'struct spi_controller* spi_busnum_to_master(u16)'
  'int spi_mem_adjust_op_size(struct spi_mem*, struct spi_mem_op*)'
  'bool spi_mem_default_supports_op(struct spi_mem*, const struct spi_mem_op*)'
  'bool spi_mem_supports_op(struct spi_mem*, const struct spi_mem_op*)'
  'struct spi_device* spi_new_device(struct spi_controller*, struct spi_board_info*)'
  'void uart_insert_char(struct uart_port*, unsigned int, unsigned int, unsigned int, unsigned int)'

Bug: 276863283
Change-Id: I1df1316a23a6dcaf69b6244cb9d63b5c64fcd37a
Signed-off-by: Qinglin Li <qinglin.li@amlogic.com>
2023-04-13 18:50:28 +00:00
Qinglin Li
77fd1bdf70 ANDROID: GKI: Add net and memory ABI Symbol list for Amlogic SOC
Add net and memory ABI Symbol list for Amlogic SOC

66 function symbol(s) added
  'struct net_device* __dev_get_by_name(struct net*, const char*)'
  'ssize_t __generic_file_write_iter(struct kiocb*, struct iov_iter*)'
  'int __ipv6_addr_type(const struct in6_addr*)'
  'struct sk_buff* __pskb_copy_fclone(struct sk_buff*, int, gfp_t, bool)'
  'struct net_device* devm_alloc_etherdev_mqs(struct device*, int, unsigned int, unsigned int)'
  'int eth_header(struct sk_buff*, struct net_device*, unsigned short, const void*, const void*, unsigned int)'
  'int eth_header_parse(const struct sk_buff*, unsigned char*)'
  'int filemap_fdatawait_range(struct address_space*, loff_t, loff_t)'
  'int filemap_fdatawrite(struct address_space*)'
  'int filemap_fdatawrite_range(struct address_space*, loff_t, loff_t)'
  'int filemap_flush(struct address_space*)'
  'int filemap_write_and_wait_range(struct address_space*, loff_t, loff_t)'
  'int flow_block_cb_setup_simple(struct flow_block_offload*, struct list_head*, flow_setup_cb_t*, void*, void*, bool)'
  'void flow_rule_match_basic(const struct flow_rule*, struct flow_match_basic*)'
  'void flow_rule_match_ipv4_addrs(const struct flow_rule*, struct flow_match_ipv4_addrs*)'
  'void flow_rule_match_ports(const struct flow_rule*, struct flow_match_ports*)'
  'void flow_rule_match_vlan(const struct flow_rule*, struct flow_match_vlan*)'
  'int generic_file_mmap(struct file*, struct vm_area_struct*)'
  'int get_kernel_pages(const struct kvec*, int, int, struct page**)'
  'unsigned long get_pfnblock_flags_mask(const struct page*, unsigned long, unsigned long)'
  'struct page* grab_cache_page_write_begin(struct address_space*, unsigned long, unsigned int)'
  'char* iwe_stream_add_event(struct iw_request_info*, char*, char*, struct iw_event*, int)'
  'char* iwe_stream_add_point(struct iw_request_info*, char*, char*, struct iw_event*, char*)'
  'char* iwe_stream_add_value(struct iw_request_info*, char*, char*, char*, struct iw_event*, int)'
  'void mod_node_page_state(struct pglist_data*, enum node_stat_item, long)'
  'void netdev_printk(const char*, const struct net_device*, const char*, ...)'
  'void netdev_rss_key_fill(void*, size_t)'
  'int of_get_phy_mode(struct device_node*, phy_interface_t*)'
  'struct page* page_pool_alloc_pages(struct page_pool*, gfp_t)'
  'struct page_pool* page_pool_create(const struct page_pool_params*)'
  'void page_pool_destroy(struct page_pool*)'
  'void page_pool_put_page(struct page_pool*, struct page*, unsigned int, bool)'
  'void page_pool_release_page(struct page_pool*, struct page*)'
  'struct page* pagecache_get_page(struct address_space*, unsigned long, int, gfp_t)'
  'int pagecache_write_begin(struct file*, struct address_space*, loff_t, unsigned int, unsigned int, struct page**, void**)'
  'int pagecache_write_end(struct file*, struct address_space*, loff_t, unsigned int, unsigned int, struct page*, void*)'
  'struct page* read_cache_page(struct address_space*, unsigned long, int(*)(void*, struct page*), void*)'
  'bool rfkill_set_sw_state(struct rfkill*, bool)'
  'void* skb_pull_rcsum(struct sk_buff*, unsigned int)'
  'void skb_scrub_packet(struct sk_buff*, bool)'
  'void truncate_inode_pages_final(struct address_space*)'
  'void truncate_pagecache(struct inode*, loff_t)'
  'void truncate_setsize(struct inode*, loff_t)'
  'void unpin_user_pages(struct page**, unsigned long)'
  'int vm_insert_page(struct vm_area_struct*, unsigned long, struct page*)'
  'void vm_unmap_aliases()'
  'unsigned long vmalloc_to_pfn(const void*)'
  'void wireless_send_event(struct net_device*, unsigned int, union iwreq_data*, const char*)'
  'bool xdp_rxq_info_is_reg(struct xdp_rxq_info*)'
  'void xdp_rxq_info_unreg_mem_model(struct xdp_rxq_info*)'
  'struct xdp_buff* xp_alloc(struct xsk_buff_pool*)'
  'int xp_dma_map(struct xsk_buff_pool*, struct device*, unsigned long, struct page**, u32)'
  'void xp_dma_sync_for_cpu_slow(struct xdp_buff_xsk*)'
  'void xp_dma_sync_for_device_slow(struct xsk_buff_pool*, dma_addr_t, size_t)'
  'void xp_dma_unmap(struct xsk_buff_pool*, unsigned long)'
  'void xp_free(struct xdp_buff_xsk*)'
  'dma_addr_t xp_raw_get_dma(struct xsk_buff_pool*, u64)'
  'void xp_set_rxq_info(struct xsk_buff_pool*, struct xdp_rxq_info*)'
  'void xsk_clear_rx_need_wakeup(struct xsk_buff_pool*)'
  'struct xsk_buff_pool* xsk_get_pool_from_qid(struct net_device*, u16)'
  'void xsk_set_rx_need_wakeup(struct xsk_buff_pool*)'
  'void xsk_set_tx_need_wakeup(struct xsk_buff_pool*)'
  'void xsk_tx_completed(struct xsk_buff_pool*, u32)'
  'bool xsk_tx_peek_desc(struct xsk_buff_pool*, struct xdp_desc*)'
  'void xsk_tx_release(struct xsk_buff_pool*)'
  'bool xsk_uses_need_wakeup(struct xsk_buff_pool*)'

2 variable symbol(s) added
  'void* high_memory'
  'struct backing_dev_info noop_backing_dev_info'

Bug: 276863283
Change-Id: I5fe6034fb0580e8c9cb81fa0128b6785069c3f3d
Signed-off-by: Qinglin Li <qinglin.li@amlogic.com>
2023-04-13 18:50:28 +00:00
Qinglin Li
2da1dda224 ANDROID: GKI: Add net ABI Symbol list for Amlogic SOC
Add net ABI Symbol list for Amlogic SOC

54 function symbol(s) added
  'int __of_mdiobus_register(struct mii_bus*, struct device_node*, struct module*)'
  'int genphy_aneg_done(struct phy_device*)'
  'int genphy_read_status(struct phy_device*)'
  'int genphy_restart_aneg(struct phy_device*)'
  'int genphy_resume(struct phy_device*)'
  'int genphy_soft_reset(struct phy_device*)'
  'int genphy_suspend(struct phy_device*)'
  'int genphy_update_link(struct phy_device*)'
  'struct mdio_device* mdio_device_create(struct mii_bus*, int)'
  'void mdio_device_free(struct mdio_device*)'
  'struct mii_bus* mdiobus_alloc_size(size_t)'
  'void mdiobus_free(struct mii_bus*)'
  'struct phy_device* mdiobus_get_phy(struct mii_bus*, int)'
  'int mdiobus_read(struct mii_bus*, int, u32)'
  'void mdiobus_unregister(struct mii_bus*)'
  'int mdiobus_write(struct mii_bus*, int, u32, u16)'
  'void netdev_alert(const struct net_device*, const char*, ...)'
  'struct mii_bus* of_mdio_find_bus(struct device_node*)'
  'bool of_phy_is_fixed_link(struct device_node*)'
  'void phy_attached_info(struct phy_device*)'
  'int phy_drivers_register(struct phy_driver*, int, struct module*)'
  'void phy_drivers_unregister(struct phy_driver*, int)'
  'void phy_error(struct phy_device*)'
  'int phy_init_eee(struct phy_device*, bool)'
  'void phy_print_status(struct phy_device*)'
  'void phy_trigger_machine(struct phy_device*)'
  'int phylink_connect_phy(struct phylink*, struct phy_device*)'
  'struct phylink* phylink_create(struct phylink_config*, struct fwnode_handle*, phy_interface_t, const struct phylink_mac_ops*)'
  'void phylink_destroy(struct phylink*)'
  'void phylink_disconnect_phy(struct phylink*)'
  'int phylink_ethtool_get_eee(struct phylink*, struct ethtool_eee*)'
  'void phylink_ethtool_get_pauseparam(struct phylink*, struct ethtool_pauseparam*)'
  'void phylink_ethtool_get_wol(struct phylink*, struct ethtool_wolinfo*)'
  'int phylink_ethtool_ksettings_get(struct phylink*, struct ethtool_link_ksettings*)'
  'int phylink_ethtool_ksettings_set(struct phylink*, const struct ethtool_link_ksettings*)'
  'int phylink_ethtool_nway_reset(struct phylink*)'
  'int phylink_ethtool_set_eee(struct phylink*, struct ethtool_eee*)'
  'int phylink_ethtool_set_pauseparam(struct phylink*, struct ethtool_pauseparam*)'
  'int phylink_ethtool_set_wol(struct phylink*, struct ethtool_wolinfo*)'
  'int phylink_get_eee_err(struct phylink*)'
  'int phylink_mii_ioctl(struct phylink*, struct ifreq*, int)'
  'int phylink_of_phy_connect(struct phylink*, struct device_node*, u32)'
  'void phylink_resume(struct phylink*)'
  'void phylink_set_pcs(struct phylink*, struct phylink_pcs*)'
  'void phylink_set_port_modes(unsigned long*)'
  'int phylink_speed_down(struct phylink*, bool)'
  'int phylink_speed_up(struct phylink*)'
  'void phylink_start(struct phylink*)'
  'void phylink_stop(struct phylink*)'
  'void phylink_suspend(struct phylink*, bool)'
  'void ptp_clock_event(struct ptp_clock*, struct ptp_clock_event*)'
  'int ptp_clock_index(struct ptp_clock*)'
  'struct ptp_clock* ptp_clock_register(struct ptp_clock_info*, struct device*)'
  'int ptp_clock_unregister(struct ptp_clock*)'

Bug: 276863283
Change-Id: I11ada9bfd5d7c7b97bd50aba19fc37d1f2eb3f02
Signed-off-by: Qinglin Li <qinglin.li@amlogic.com>
2023-04-13 18:50:28 +00:00
Qinglin Li
9ff310d286 ANDROID: GKI: Add media gpu and sound ABI Symbol list for Amlogic SOC
Add media gpu and sound ABI Symbol list for Amlogic SOC

49 function symbol(s) added
  'void __drm_atomic_helper_connector_reset(struct drm_connector*, struct drm_connector_state*)'
  'unsigned long _snd_pcm_stream_lock_irqsave(struct snd_pcm_substream*)'
  'void drm_atomic_helper_async_commit(struct drm_device*, struct drm_atomic_state*)'
  'void drm_atomic_helper_commit_tail_rpm(struct drm_atomic_state*)'
  'int drm_atomic_helper_resume(struct drm_device*, struct drm_atomic_state*)'
  'struct drm_atomic_state* drm_atomic_helper_suspend(struct drm_device*)'
  'int drm_atomic_set_mode_for_crtc(struct drm_crtc_state*, const struct drm_display_mode*)'
  'int drm_connector_attach_content_protection_property(struct drm_connector*, bool)'
  'int drm_connector_attach_content_type_property(struct drm_connector*)'
  'int drm_connector_attach_max_bpc_property(struct drm_connector*, int, int)'
  'int drm_connector_attach_vrr_capable_property(struct drm_connector*)'
  'void drm_connector_set_vrr_capable_property(struct drm_connector*, bool)'
  'struct drm_crtc* drm_crtc_from_index(struct drm_device*, int)'
  'struct drm_framebuffer* drm_framebuffer_lookup(struct drm_device*, struct drm_file*, uint32_t)'
  'int drm_gem_handle_delete(struct drm_file*, u32)'
  'void drm_hdcp_update_content_protection(struct drm_connector*, u64)'
  'struct drm_display_mode* drm_mode_create(struct drm_device*)'
  'void drm_mode_get_hv_timing(const struct drm_display_mode*, int*, int*)'
  'int drm_property_add_enum(struct drm_property*, uint64_t, const char*)'
  'void drm_property_destroy(struct drm_device*, struct drm_property*)'
  'void drm_self_refresh_helper_update_avg_times(struct drm_atomic_state*, unsigned int, unsigned int)'
  'void hdmi_avi_infoframe_init(struct hdmi_avi_infoframe*)'
  'int hdmi_drm_infoframe_init(struct hdmi_drm_infoframe*)'
  'ssize_t hdmi_drm_infoframe_pack(struct hdmi_drm_infoframe*, void*, size_t)'
  'int hdmi_infoframe_unpack(union hdmi_infoframe*, const void*, size_t)'
  'ssize_t hdmi_spd_infoframe_pack(struct hdmi_spd_infoframe*, void*, size_t)'
  'int hdmi_vendor_infoframe_init(struct hdmi_vendor_infoframe*)'
  'ssize_t hdmi_vendor_infoframe_pack(struct hdmi_vendor_infoframe*, void*, size_t)'
  'int snd_pcm_kernel_ioctl(struct snd_pcm_substream*, unsigned int, void*)'
  'int snd_pcm_lib_default_mmap(struct snd_pcm_substream*, struct vm_area_struct*)'
  'unsigned int snd_pcm_rate_to_rate_bit(unsigned int)'
  'int snd_pcm_stop(struct snd_pcm_substream*, snd_pcm_state_t)'
  'int snd_pcm_stop_xrun(struct snd_pcm_substream*)'
  'void snd_pcm_stream_unlock_irqrestore(struct snd_pcm_substream*, unsigned long)'
  'int snd_soc_add_card_controls(struct snd_soc_card*, const struct snd_kcontrol_new*, int)'
  'void snd_soc_jack_free_gpios(struct snd_soc_jack*, int, struct snd_soc_jack_gpio*)'
  'int snd_soc_of_get_slot_mask(struct device_node*, const char*, unsigned int*)'
  'int snd_soc_of_parse_audio_simple_widgets(struct snd_soc_card*, const char*)'
  'int snd_soc_of_parse_tdm_slot(struct device_node*, unsigned int*, unsigned int*, unsigned int*, unsigned int*)'
  'int v4l2_ctrl_subscribe_event(struct v4l2_fh*, const struct v4l2_event_subscription*)'
  'int v4l2_device_register_subdev(struct v4l2_device*, struct v4l2_subdev*)'
  'void v4l2_device_unregister_subdev(struct v4l2_subdev*)'
  'void v4l2_event_queue_fh(struct v4l2_fh*, const struct v4l2_event*)'
  'int v4l2_event_subscribe(struct v4l2_fh*, const struct v4l2_event_subscription*, unsigned int, const struct v4l2_subscribed_event_ops*)'
  'int v4l2_event_unsubscribe(struct v4l2_fh*, const struct v4l2_event_subscription*)'
  'void v4l2_i2c_subdev_init(struct v4l2_subdev*, struct i2c_client*, const struct v4l2_subdev_ops*)'
  'int v4l2_m2m_ioctl_create_bufs(struct file*, void*, struct v4l2_create_buffers*)'
  'int v4l2_m2m_ioctl_expbuf(struct file*, void*, struct v4l2_exportbuffer*)'
  'int v4l2_src_change_event_subscribe(struct v4l2_fh*, const struct v4l2_event_subscription*)'

2 variable symbol(s) added
  'const struct vm_operations_struct drm_gem_cma_vm_ops'
  'const struct vb2_mem_ops vb2_dma_contig_memops'

Bug: 276863283
Change-Id: I609bdb9c65d7db391550fd85507d8c961d1034e7
Signed-off-by: Qinglin Li <qinglin.li@amlogic.com>
2023-04-13 18:50:28 +00:00
Greg Kroah-Hartman
4fdad925aa Linux 5.15.107
Link: https://lore.kernel.org/r/20230412082823.045155996@linuxfoundation.org
Tested-by: Florian Fainelli <f.fainelli@gmail.com>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Bagas Sanjaya <bagasdotme@gmail.com>
Tested-by: Ron Economos <re@w6rz.net>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-04-13 16:48:27 +02:00
Eduard Zingerman
c862d7debe bpftool: Print newline before '}' for struct with padding only fields
[ Upstream commit 44a726c3f2 ]

btf_dump_emit_struct_def attempts to print empty structures at a
single line, e.g. `struct empty {}`. However, it has to account for a
case when there are no regular but some padding fields in the struct.
In such case `vlen` would be zero, but size would be non-zero.

E.g. here is struct bpf_timer from vmlinux.h before this patch:

 struct bpf_timer {
 	long: 64;
	long: 64;};

And after this patch:

 struct bpf_dynptr {
 	long: 64;
	long: 64;
 };

Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20221001104425.415768-1-eddyz87@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-04-13 16:48:27 +02:00
Heming Zhao
1585f3fc24 ocfs2: fix freeing uninitialized resource on ocfs2_dlm_shutdown
commit 550842cc60 upstream.

After commit 0737e01de9 ("ocfs2: ocfs2_mount_volume does cleanup job
before return error"), any procedure after ocfs2_dlm_init() fails will
trigger crash when calling ocfs2_dlm_shutdown().

ie: On local mount mode, no dlm resource is initialized.  If
ocfs2_mount_volume() fails in ocfs2_find_slot(), error handling will call
ocfs2_dlm_shutdown(), then does dlm resource cleanup job, which will
trigger kernel crash.

This solution should bypass uninitialized resources in
ocfs2_dlm_shutdown().

Link: https://lkml.kernel.org/r/20220815085754.20417-1-heming.zhao@suse.com
Fixes: 0737e01de9 ("ocfs2: ocfs2_mount_volume does cleanup job before return error")
Signed-off-by: Heming Zhao <heming.zhao@suse.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Gang He <ghe@suse.com>
Cc: Jun Piao <piaojun@huawei.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-04-13 16:48:26 +02:00
Masahiro Yamada
b97e4100be kbuild: fix single directory build
commit 3753af778d upstream.

Commit f110e5a250 ("kbuild: refactor single builds of *.ko") was wrong.

KBUILD_MODULES _is_ needed for single builds.

Otherwise, "make foo/bar/baz/" does not build module objects at all.

Fixes: f110e5a250 ("kbuild: refactor single builds of *.ko")
Reported-by: David Sterba <dsterba@suse.cz>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Tested-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-04-13 16:48:26 +02:00
Alistair Popple
326b80bd22 mm: take a page reference when removing device exclusive entries
commit 7c7b962938 upstream.

Device exclusive page table entries are used to prevent CPU access to a
page whilst it is being accessed from a device.  Typically this is used to
implement atomic operations when the underlying bus does not support
atomic access.  When a CPU thread encounters a device exclusive entry it
locks the page and restores the original entry after calling mmu notifiers
to signal drivers that exclusive access is no longer available.

The device exclusive entry holds a reference to the page making it safe to
access the struct page whilst the entry is present.  However the fault
handling code does not hold the PTL when taking the page lock.  This means
if there are multiple threads faulting concurrently on the device
exclusive entry one will remove the entry whilst others will wait on the
page lock without holding a reference.

This can lead to threads locking or waiting on a folio with a zero
refcount.  Whilst mmap_lock prevents the pages getting freed via munmap()
they may still be freed by a migration.  This leads to warnings such as
PAGE_FLAGS_CHECK_AT_FREE due to the page being locked when the refcount
drops to zero.

Fix this by trying to take a reference on the folio before locking it.
The code already checks the PTE under the PTL and aborts if the entry is
no longer there.  It is also possible the folio has been unmapped, freed
and re-allocated allowing a reference to be taken on an unrelated folio.
This case is also detected by the PTE check and the folio is unlocked
without further changes.

Link: https://lkml.kernel.org/r/20230330012519.804116-1-apopple@nvidia.com
Fixes: b756a3b5e7 ("mm: device exclusive memory access")
Signed-off-by: Alistair Popple <apopple@nvidia.com>
Reviewed-by: Ralph Campbell <rcampbell@nvidia.com>
Reviewed-by: John Hubbard <jhubbard@nvidia.com>
Acked-by: David Hildenbrand <david@redhat.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Christoph Hellwig <hch@infradead.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-04-13 16:48:26 +02:00
Robert Foss
1fc9263ad7 drm/bridge: lt9611: Fix PLL being unable to lock
commit 2a9df204be upstream.

This fixes PLL being unable to lock, and is derived from an equivalent
downstream commit.

Available LT9611 documentation does not list this register, neither does
LT9611UXC (which is a different chip).

This commit has been confirmed to fix HDMI output on DragonBoard 845c.

Suggested-by: Amit Pundir <amit.pundir@linaro.org>
Reviewed-by: Amit Pundir <amit.pundir@linaro.org>
Signed-off-by: Robert Foss <robert.foss@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20221213150304.4189760-1-robert.foss@linaro.org
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-04-13 16:48:26 +02:00
Rongwei Wang
4bdf1514b4 mm/swap: fix swap_info_struct race between swapoff and get_swap_pages()
commit 6fe7d6b992 upstream.

The si->lock must be held when deleting the si from the available list.
Otherwise, another thread can re-add the si to the available list, which
can lead to memory corruption.  The only place we have found where this
happens is in the swapoff path.  This case can be described as below:

core 0                       core 1
swapoff

del_from_avail_list(si)      waiting

try lock si->lock            acquire swap_avail_lock
                             and re-add si into
                             swap_avail_head

acquire si->lock but missing si already being added again, and continuing
to clear SWP_WRITEOK, etc.

It can be easily found that a massive warning messages can be triggered
inside get_swap_pages() by some special cases, for example, we call
madvise(MADV_PAGEOUT) on blocks of touched memory concurrently, meanwhile,
run much swapon-swapoff operations (e.g.  stress-ng-swap).

However, in the worst case, panic can be caused by the above scene.  In
swapoff(), the memory used by si could be kept in swap_info[] after
turning off a swap.  This means memory corruption will not be caused
immediately until allocated and reset for a new swap in the swapon path.
A panic message caused: (with CONFIG_PLIST_DEBUG enabled)

------------[ cut here ]------------
top: 00000000e58a3003, n: 0000000013e75cda, p: 000000008cd4451a
prev: 0000000035b1e58a, n: 000000008cd4451a, p: 000000002150ee8d
next: 000000008cd4451a, n: 000000008cd4451a, p: 000000008cd4451a
WARNING: CPU: 21 PID: 1843 at lib/plist.c:60 plist_check_prev_next_node+0x50/0x70
Modules linked in: rfkill(E) crct10dif_ce(E)...
CPU: 21 PID: 1843 Comm: stress-ng Kdump: ... 5.10.134+
Hardware name: Alibaba Cloud ECS, BIOS 0.0.0 02/06/2015
pstate: 60400005 (nZCv daif +PAN -UAO -TCO BTYPE=--)
pc : plist_check_prev_next_node+0x50/0x70
lr : plist_check_prev_next_node+0x50/0x70
sp : ffff0018009d3c30
x29: ffff0018009d3c40 x28: ffff800011b32a98
x27: 0000000000000000 x26: ffff001803908000
x25: ffff8000128ea088 x24: ffff800011b32a48
x23: 0000000000000028 x22: ffff001800875c00
x21: ffff800010f9e520 x20: ffff001800875c00
x19: ffff001800fdc6e0 x18: 0000000000000030
x17: 0000000000000000 x16: 0000000000000000
x15: 0736076307640766 x14: 0730073007380731
x13: 0736076307640766 x12: 0730073007380731
x11: 000000000004058d x10: 0000000085a85b76
x9 : ffff8000101436e4 x8 : ffff800011c8ce08
x7 : 0000000000000000 x6 : 0000000000000001
x5 : ffff0017df9ed338 x4 : 0000000000000001
x3 : ffff8017ce62a000 x2 : ffff0017df9ed340
x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
 plist_check_prev_next_node+0x50/0x70
 plist_check_head+0x80/0xf0
 plist_add+0x28/0x140
 add_to_avail_list+0x9c/0xf0
 _enable_swap_info+0x78/0xb4
 __do_sys_swapon+0x918/0xa10
 __arm64_sys_swapon+0x20/0x30
 el0_svc_common+0x8c/0x220
 do_el0_svc+0x2c/0x90
 el0_svc+0x1c/0x30
 el0_sync_handler+0xa8/0xb0
 el0_sync+0x148/0x180
irq event stamp: 2082270

Now, si->lock locked before calling 'del_from_avail_list()' to make sure
other thread see the si had been deleted and SWP_WRITEOK cleared together,
will not reinsert again.

This problem exists in versions after stable 5.10.y.

Link: https://lkml.kernel.org/r/20230404154716.23058-1-rongwei.wang@linux.alibaba.com
Fixes: a2468cc9bf ("swap: choose swap device according to numa node")
Tested-by: Yongchen Yin <wb-yyc939293@alibaba-inc.com>
Signed-off-by: Rongwei Wang <rongwei.wang@linux.alibaba.com>
Cc: Bagas Sanjaya <bagasdotme@gmail.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Aaron Lu <aaron.lu@intel.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-04-13 16:48:26 +02:00
Zheng Yejian
cbe5f7fed7 ring-buffer: Fix race while reader and writer are on the same page
commit 6455b6163d upstream.

When user reads file 'trace_pipe', kernel keeps printing following logs
that warn at "cpu_buffer->reader_page->read > rb_page_size(reader)" in
rb_get_reader_page(). It just looks like there's an infinite loop in
tracing_read_pipe(). This problem occurs several times on arm64 platform
when testing v5.10 and below.

  Call trace:
   rb_get_reader_page+0x248/0x1300
   rb_buffer_peek+0x34/0x160
   ring_buffer_peek+0xbc/0x224
   peek_next_entry+0x98/0xbc
   __find_next_entry+0xc4/0x1c0
   trace_find_next_entry_inc+0x30/0x94
   tracing_read_pipe+0x198/0x304
   vfs_read+0xb4/0x1e0
   ksys_read+0x74/0x100
   __arm64_sys_read+0x24/0x30
   el0_svc_common.constprop.0+0x7c/0x1bc
   do_el0_svc+0x2c/0x94
   el0_svc+0x20/0x30
   el0_sync_handler+0xb0/0xb4
   el0_sync+0x160/0x180

Then I dump the vmcore and look into the problematic per_cpu ring_buffer,
I found that tail_page/commit_page/reader_page are on the same page while
reader_page->read is obviously abnormal:
  tail_page == commit_page == reader_page == {
    .write = 0x100d20,
    .read = 0x8f9f4805,  // Far greater than 0xd20, obviously abnormal!!!
    .entries = 0x10004c,
    .real_end = 0x0,
    .page = {
      .time_stamp = 0x857257416af0,
      .commit = 0xd20,  // This page hasn't been full filled.
      // .data[0...0xd20] seems normal.
    }
 }

The root cause is most likely the race that reader and writer are on the
same page while reader saw an event that not fully committed by writer.

To fix this, add memory barriers to make sure the reader can see the
content of what is committed. Since commit a0fcaaed0c ("ring-buffer: Fix
race between reset page and reading page") has added the read barrier in
rb_get_reader_page(), here we just need to add the write barrier.

Link: https://lore.kernel.org/linux-trace-kernel/20230325021247.2923907-1-zhengyejian1@huawei.com

Cc: stable@vger.kernel.org
Fixes: 77ae365eca ("ring-buffer: make lockless")
Suggested-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Zheng Yejian <zhengyejian1@huawei.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-04-13 16:48:26 +02:00
Karol Herbst
23ed5af576 drm/nouveau/disp: Support more modes by checking with lower bpc
commit 7f67aa097e upstream.

This allows us to advertise more modes especially on HDR displays.

Fixes using 4K@60 modes on my TV and main display both using a HDMI to DP
adapter. Also fixes similar issues for users running into this.

Cc: stable@vger.kernel.org # 5.10+
Signed-off-by: Karol Herbst <kherbst@redhat.com>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230330223938.4025569-1-kherbst@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-04-13 16:48:26 +02:00
Boris Brezillon
6f2180c527 drm/panfrost: Fix the panfrost_mmu_map_fault_addr() error path
commit 764a2ab9eb upstream.

Make sure all bo->base.pages entries are either NULL or pointing to a
valid page before calling drm_gem_shmem_put_pages().

Reported-by: Tomeu Vizoso <tomeu.vizoso@collabora.com>
Cc: <stable@vger.kernel.org>
Fixes: 187d292920 ("drm/panfrost: Add support for GPU heap allocations")
Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
Reviewed-by: Steven Price <steven.price@arm.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20210521093811.1018992-1-boris.brezillon@collabora.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-04-13 16:48:25 +02:00
Yafang Shao
a184df0de1 mm: vmalloc: avoid warn_alloc noise caused by fatal signal
commit f349b15e18 upstream.

There're some suspicious warn_alloc on my test serer, for example,

[13366.518837] warn_alloc: 81 callbacks suppressed
[13366.518841] test_verifier: vmalloc error: size 4096, page order 0, failed to allocate pages, mode:0x500dc2(GFP_HIGHUSER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null),cpuset=/,mems_allowed=0-1
[13366.522240] CPU: 30 PID: 722463 Comm: test_verifier Kdump: loaded Tainted: G        W  O       6.2.0+ #638
[13366.524216] Call Trace:
[13366.524702]  <TASK>
[13366.525148]  dump_stack_lvl+0x6c/0x80
[13366.525712]  dump_stack+0x10/0x20
[13366.526239]  warn_alloc+0x119/0x190
[13366.526783]  ? alloc_pages_bulk_array_mempolicy+0x9e/0x2a0
[13366.527470]  __vmalloc_area_node+0x546/0x5b0
[13366.528066]  __vmalloc_node_range+0xc2/0x210
[13366.528660]  __vmalloc_node+0x42/0x50
[13366.529186]  ? bpf_prog_realloc+0x53/0xc0
[13366.529743]  __vmalloc+0x1e/0x30
[13366.530235]  bpf_prog_realloc+0x53/0xc0
[13366.530771]  bpf_patch_insn_single+0x80/0x1b0
[13366.531351]  bpf_jit_blind_constants+0xe9/0x1c0
[13366.531932]  ? __free_pages+0xee/0x100
[13366.532457]  ? free_large_kmalloc+0x58/0xb0
[13366.533002]  bpf_int_jit_compile+0x8c/0x5e0
[13366.533546]  bpf_prog_select_runtime+0xb4/0x100
[13366.534108]  bpf_prog_load+0x6b1/0xa50
[13366.534610]  ? perf_event_task_tick+0x96/0xb0
[13366.535151]  ? security_capable+0x3a/0x60
[13366.535663]  __sys_bpf+0xb38/0x2190
[13366.536120]  ? kvm_clock_get_cycles+0x9/0x10
[13366.536643]  __x64_sys_bpf+0x1c/0x30
[13366.537094]  do_syscall_64+0x38/0x90
[13366.537554]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
[13366.538107] RIP: 0033:0x7f78310f8e29
[13366.538561] Code: 01 00 48 81 c4 80 00 00 00 e9 f1 fe ff ff 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 17 e0 2c 00 f7 d8 64 89 01 48
[13366.540286] RSP: 002b:00007ffe2a61fff8 EFLAGS: 00000206 ORIG_RAX: 0000000000000141
[13366.541031] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f78310f8e29
[13366.541749] RDX: 0000000000000080 RSI: 00007ffe2a6200b0 RDI: 0000000000000005
[13366.542470] RBP: 00007ffe2a620010 R08: 00007ffe2a6202a0 R09: 00007ffe2a6200b0
[13366.543183] R10: 00000000000f423e R11: 0000000000000206 R12: 0000000000407800
[13366.543900] R13: 00007ffe2a620540 R14: 0000000000000000 R15: 0000000000000000
[13366.544623]  </TASK>
[13366.545260] Mem-Info:
[13366.546121] active_anon:81319 inactive_anon:20733 isolated_anon:0
 active_file:69450 inactive_file:5624 isolated_file:0
 unevictable:0 dirty:10 writeback:0
 slab_reclaimable:69649 slab_unreclaimable:48930
 mapped:27400 shmem:12868 pagetables:4929
 sec_pagetables:0 bounce:0
 kernel_misc_reclaimable:0
 free:15870308 free_pcp:142935 free_cma:0
[13366.551886] Node 0 active_anon:224836kB inactive_anon:33528kB active_file:175692kB inactive_file:13752kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:59248kB dirty:32kB writeback:0kB shmem:18252kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:4616kB pagetables:10664kB sec_pagetables:0kB all_unreclaimable? no
[13366.555184] Node 1 active_anon:100440kB inactive_anon:49404kB active_file:102108kB inactive_file:8744kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:50352kB dirty:8kB writeback:0kB shmem:33220kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:3896kB pagetables:9052kB sec_pagetables:0kB all_unreclaimable? no
[13366.558262] Node 0 DMA free:15360kB boost:0kB min:304kB low:380kB high:456kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
[13366.560821] lowmem_reserve[]: 0 2735 31873 31873 31873
[13366.561981] Node 0 DMA32 free:2790904kB boost:0kB min:56028kB low:70032kB high:84036kB reserved_highatomic:0KB active_anon:1936kB inactive_anon:20kB active_file:396kB inactive_file:344kB unevictable:0kB writepending:0kB present:3129200kB managed:2801520kB mlocked:0kB bounce:0kB free_pcp:5188kB local_pcp:0kB free_cma:0kB
[13366.565148] lowmem_reserve[]: 0 0 29137 29137 29137
[13366.566168] Node 0 Normal free:28533824kB boost:0kB min:596740kB low:745924kB high:895108kB reserved_highatomic:28672KB active_anon:222900kB inactive_anon:33508kB active_file:175296kB inactive_file:13408kB unevictable:0kB writepending:32kB present:30408704kB managed:29837172kB mlocked:0kB bounce:0kB free_pcp:295724kB local_pcp:0kB free_cma:0kB
[13366.569485] lowmem_reserve[]: 0 0 0 0 0
[13366.570416] Node 1 Normal free:32141144kB boost:0kB min:660504kB low:825628kB high:990752kB reserved_highatomic:69632KB active_anon:100440kB inactive_anon:49404kB active_file:102108kB inactive_file:8744kB unevictable:0kB writepending:8kB present:33554432kB managed:33025372kB mlocked:0kB bounce:0kB free_pcp:270880kB local_pcp:46860kB free_cma:0kB
[13366.573403] lowmem_reserve[]: 0 0 0 0 0
[13366.574015] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB
[13366.575474] Node 0 DMA32: 782*4kB (UME) 756*8kB (UME) 736*16kB (UME) 745*32kB (UME) 694*64kB (UME) 653*128kB (UME) 595*256kB (UME) 552*512kB (UME) 454*1024kB (UME) 347*2048kB (UME) 246*4096kB (UME) = 2790904kB
[13366.577442] Node 0 Normal: 33856*4kB (UMEH) 51815*8kB (UMEH) 42418*16kB (UMEH) 36272*32kB (UMEH) 22195*64kB (UMEH) 10296*128kB (UMEH) 7238*256kB (UMEH) 5638*512kB (UEH) 5337*1024kB (UMEH) 3506*2048kB (UMEH) 1470*4096kB (UME) = 28533784kB
[13366.580460] Node 1 Normal: 15776*4kB (UMEH) 37485*8kB (UMEH) 29509*16kB (UMEH) 21420*32kB (UMEH) 14818*64kB (UMEH) 13051*128kB (UMEH) 9918*256kB (UMEH) 7374*512kB (UMEH) 5397*1024kB (UMEH) 3887*2048kB (UMEH) 2002*4096kB (UME) = 32141240kB
[13366.583027] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB
[13366.584380] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB
[13366.585702] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB
[13366.587042] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB
[13366.588372] 87386 total pagecache pages
[13366.589266] 0 pages in swap cache
[13366.590327] Free swap  = 0kB
[13366.591227] Total swap = 0kB
[13366.592142] 16777082 pages RAM
[13366.593057] 0 pages HighMem/MovableOnly
[13366.594037] 357226 pages reserved
[13366.594979] 0 pages hwpoisoned

This failure really confuse me as there're still lots of available pages.
Finally I figured out it was caused by a fatal signal.  When a process is
allocating memory via vm_area_alloc_pages(), it will break directly even
if it hasn't allocated the requested pages when it receives a fatal
signal.  In that case, we shouldn't show this warn_alloc, as it is
useless.  We only need to show this warning when there're really no enough
pages.

Link: https://lkml.kernel.org/r/20230330162625.13604-1-laoar.shao@gmail.com
Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
Reviewed-by: Lorenzo Stoakes <lstoakes@gmail.com>
Cc: Christoph Hellwig <hch@infradead.org>
Cc: Uladzislau Rezki (Sony) <urezki@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-04-13 16:48:25 +02:00
Jason Montleon
d88d7a9fcf ASoC: hdac_hdmi: use set_stream() instead of set_tdm_slots()
commit f6887a71bd upstream.

hdac_hdmi was not updated to use set_stream() instead of set_tdm_slots()
in the original commit so HDMI no longer produces audio.

Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/regressions/CAJD_bPKQdtaExvVEKxhQ47G-ZXDA=k+gzhMJRHLBe=mysPnuKA@mail.gmail.com/
Fixes: 636110411c ("ASoC: Intel/SOF: use set_stream() instead of set_tdm_slots() for HDAudio")
Signed-off-by: Jason Montleon <jmontleo@redhat.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20230324170711.2526-1-jmontleo@redhat.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-04-13 16:48:25 +02:00
Steven Rostedt (Google)
33d5d4e67a tracing: Free error logs of tracing instances
commit 3357c6e429 upstream.

When a tracing instance is removed, the error messages that hold errors
that occurred in the instance needs to be freed. The following reports a
memory leak:

 # cd /sys/kernel/tracing
 # mkdir instances/foo
 # echo 'hist:keys=x' > instances/foo/events/sched/sched_switch/trigger
 # cat instances/foo/error_log
 [  117.404795] hist:sched:sched_switch: error: Couldn't find field
   Command: hist:keys=x
                      ^
 # rmdir instances/foo

Then check for memory leaks:

 # echo scan > /sys/kernel/debug/kmemleak
 # cat /sys/kernel/debug/kmemleak
unreferenced object 0xffff88810d8ec700 (size 192):
  comm "bash", pid 869, jiffies 4294950577 (age 215.752s)
  hex dump (first 32 bytes):
    60 dd 68 61 81 88 ff ff 60 dd 68 61 81 88 ff ff  `.ha....`.ha....
    a0 30 8c 83 ff ff ff ff 26 00 0a 00 00 00 00 00  .0......&.......
  backtrace:
    [<00000000dae26536>] kmalloc_trace+0x2a/0xa0
    [<00000000b2938940>] tracing_log_err+0x277/0x2e0
    [<000000004a0e1b07>] parse_atom+0x966/0xb40
    [<0000000023b24337>] parse_expr+0x5f3/0xdb0
    [<00000000594ad074>] event_hist_trigger_parse+0x27f8/0x3560
    [<00000000293a9645>] trigger_process_regex+0x135/0x1a0
    [<000000005c22b4f2>] event_trigger_write+0x87/0xf0
    [<000000002cadc509>] vfs_write+0x162/0x670
    [<0000000059c3b9be>] ksys_write+0xca/0x170
    [<00000000f1cddc00>] do_syscall_64+0x3e/0xc0
    [<00000000868ac68c>] entry_SYSCALL_64_after_hwframe+0x72/0xdc
unreferenced object 0xffff888170c35a00 (size 32):
  comm "bash", pid 869, jiffies 4294950577 (age 215.752s)
  hex dump (first 32 bytes):
    0a 20 20 43 6f 6d 6d 61 6e 64 3a 20 68 69 73 74  .  Command: hist
    3a 6b 65 79 73 3d 78 0a 00 00 00 00 00 00 00 00  :keys=x.........
  backtrace:
    [<000000006a747de5>] __kmalloc+0x4d/0x160
    [<000000000039df5f>] tracing_log_err+0x29b/0x2e0
    [<000000004a0e1b07>] parse_atom+0x966/0xb40
    [<0000000023b24337>] parse_expr+0x5f3/0xdb0
    [<00000000594ad074>] event_hist_trigger_parse+0x27f8/0x3560
    [<00000000293a9645>] trigger_process_regex+0x135/0x1a0
    [<000000005c22b4f2>] event_trigger_write+0x87/0xf0
    [<000000002cadc509>] vfs_write+0x162/0x670
    [<0000000059c3b9be>] ksys_write+0xca/0x170
    [<00000000f1cddc00>] do_syscall_64+0x3e/0xc0
    [<00000000868ac68c>] entry_SYSCALL_64_after_hwframe+0x72/0xdc

The problem is that the error log needs to be freed when the instance is
removed.

Link: https://lore.kernel.org/lkml/76134d9f-a5ba-6a0d-37b3-28310b4a1e91@alu.unizg.hr/
Link: https://lore.kernel.org/linux-trace-kernel/20230404194504.5790b95f@gandalf.local.home

Cc: stable@vger.kernel.org
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Thorsten Leemhuis <regressions@leemhuis.info>
Cc: Ulf Hansson <ulf.hansson@linaro.org>
Cc: Eric Biggers <ebiggers@kernel.org>
Fixes: 2f754e771b ("tracing: Have the error logs show up in the proper instances")
Reported-by: Mirsad Goran Todorovac <mirsad.todorovac@alu.unizg.hr>
Tested-by: Mirsad Todorovac <mirsad.todorovac@alu.unizg.hr>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-04-13 16:48:25 +02:00
Michal Sojka
c74065da69 can: isotp: isotp_ops: fix poll() to not report false EPOLLOUT events
commit 79e19fa79c upstream.

When using select()/poll()/epoll() with a non-blocking ISOTP socket to
wait for when non-blocking write is possible, a false EPOLLOUT event
is sometimes returned. This can happen at least after sending a
message which must be split to multiple CAN frames.

The reason is that isotp_sendmsg() returns -EAGAIN when tx.state is
not equal to ISOTP_IDLE and this behavior is not reflected in
datagram_poll(), which is used in isotp_ops.

This is fixed by introducing ISOTP-specific poll function, which
suppresses the EPOLLOUT events in that case.

v2: https://lore.kernel.org/all/20230302092812.320643-1-michal.sojka@cvut.cz
v1: https://lore.kernel.org/all/20230224010659.48420-1-michal.sojka@cvut.cz
    https://lore.kernel.org/all/b53a04a2-ba1f-3858-84c1-d3eb3301ae15@hartkopp.net

Signed-off-by: Michal Sojka <michal.sojka@cvut.cz>
Reported-by: Jakub Jira <jirajak2@fel.cvut.cz>
Tested-by: Oliver Hartkopp <socketcan@hartkopp.net>
Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
Fixes: e057dd3fc2 ("can: add ISO 15765-2:2016 transport protocol")
Link: https://lore.kernel.org/all/20230331125511.372783-1-michal.sojka@cvut.cz
Cc: stable@vger.kernel.org
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-04-13 16:48:25 +02:00
Oleksij Rempel
4fe1d9b623 can: j1939: j1939_tp_tx_dat_new(): fix out-of-bounds memory access
commit b45193cb4d upstream.

In the j1939_tp_tx_dat_new() function, an out-of-bounds memory access
could occur during the memcpy() operation if the size of skb->cb is
larger than the size of struct j1939_sk_buff_cb. This is because the
memcpy() operation uses the size of skb->cb, leading to a read beyond
the struct j1939_sk_buff_cb.

Updated the memcpy() operation to use the size of struct
j1939_sk_buff_cb instead of the size of skb->cb. This ensures that the
memcpy() operation only reads the memory within the bounds of struct
j1939_sk_buff_cb, preventing out-of-bounds memory access.

Additionally, add a BUILD_BUG_ON() to check that the size of skb->cb
is greater than or equal to the size of struct j1939_sk_buff_cb. This
ensures that the skb->cb buffer is large enough to hold the
j1939_sk_buff_cb structure.

Fixes: 9d71dd0c70 ("can: add support of SAE J1939 protocol")
Reported-by: Shuangpeng Bai <sjb7183@psu.edu>
Tested-by: Shuangpeng Bai <sjb7183@psu.edu>
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Link: https://groups.google.com/g/syzkaller/c/G_LL-C3plRs/m/-8xCi6dCAgAJ
Link: https://lore.kernel.org/all/20230404073128.3173900-1-o.rempel@pengutronix.de
Cc: stable@vger.kernel.org
[mkl: rephrase commit message]
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-04-13 16:48:25 +02:00
Christian Brauner
0af8fae81d fs: drop peer group ids under namespace lock
commit cb2239c198 upstream.

When cleaning up peer group ids in the failure path we need to make sure
to hold on to the namespace lock. Otherwise another thread might just
turn the mount from a shared into a non-shared mount concurrently.

Link: https://lore.kernel.org/lkml/00000000000088694505f8132d77@google.com
Fixes: 2a1867219c ("fs: add mount_setattr()")
Reported-by: syzbot+8ac3859139c685c4f597@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org # 5.12+
Message-Id: <20230330-vfs-mount_setattr-propagation-fix-v1-1-37548d91533b@kernel.org>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-04-13 16:48:25 +02:00
Zheng Yejian
33a503b7c3 ftrace: Fix issue that 'direct->addr' not restored in modify_ftrace_direct()
commit 2a2d8c51de upstream.

Syzkaller report a WARNING: "WARN_ON(!direct)" in modify_ftrace_direct().

Root cause is 'direct->addr' was changed from 'old_addr' to 'new_addr' but
not restored if error happened on calling ftrace_modify_direct_caller().
Then it can no longer find 'direct' by that 'old_addr'.

To fix it, restore 'direct->addr' to 'old_addr' explicitly in error path.

Link: https://lore.kernel.org/linux-trace-kernel/20230330025223.1046087-1-zhengyejian1@huawei.com

Cc: stable@vger.kernel.org
Cc: <mhiramat@kernel.org>
Cc: <mark.rutland@arm.com>
Cc: <ast@kernel.org>
Cc: <daniel@iogearbox.net>
Fixes: 8a141dd7f7 ("ftrace: Fix modify_ftrace_direct.")
Signed-off-by: Zheng Yejian <zhengyejian1@huawei.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-04-13 16:48:24 +02:00
John Keeping
20c5e10950 ftrace: Mark get_lock_parent_ip() __always_inline
commit ea65b41807 upstream.

If the compiler decides not to inline this function then preemption
tracing will always show an IP inside the preemption disabling path and
never the function actually calling preempt_{enable,disable}.

Link: https://lore.kernel.org/linux-trace-kernel/20230327173647.1690849-1-john@metanate.com

Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: stable@vger.kernel.org
Fixes: f904f58263 ("sched/debug: Fix preempt_disable_ip recording for preempt_disable()")
Signed-off-by: John Keeping <john@metanate.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-04-13 16:48:24 +02:00
Kan Liang
a007b7dc19 perf/core: Fix the same task check in perf_event_set_output
[ Upstream commit 24d3ae2f37 ]

The same task check in perf_event_set_output has some potential issues
for some usages.

For the current perf code, there is a problem if using of
perf_event_open() to have multiple samples getting into the same mmap’d
memory when they are both attached to the same process.
https://lore.kernel.org/all/92645262-D319-4068-9C44-2409EF44888E@gmail.com/
Because the event->ctx is not ready when the perf_event_set_output() is
invoked in the perf_event_open().

Besides the above issue, before the commit bd27568117 ("perf: Rewrite
core context handling"), perf record can errors out when sampling with
a hardware event and a software event as below.
 $ perf record -e cycles,dummy --per-thread ls
 failed to mmap with 22 (Invalid argument)
That's because that prior to the commit a hardware event and a software
event are from different task context.

The problem should be a long time issue since commit c3f00c7027
("perk: Separate find_get_context() from event initialization").

The task struct is stored in the event->hw.target for each per-thread
event. It is a more reliable way to determine whether two events are
attached to the same task.

The event->hw.target was also introduced several years ago by the
commit 50f16a8bf9 ("perf: Remove type specific target pointers"). It
can not only be used to fix the issue with the current code, but also
back port to fix the issues with an older kernel.

Note: The event->hw.target was introduced later than commit
c3f00c7027. The patch may cannot be applied between the commit
c3f00c7027 and commit 50f16a8bf9. Anybody that wants to back-port
this at that period may have to find other solutions.

Fixes: c3f00c7027 ("perf: Separate find_get_context() from event initialization")
Signed-off-by: Kan Liang <kan.liang@linux.intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Zhengjun Xing <zhengjun.xing@linux.intel.com>
Link: https://lkml.kernel.org/r/20230322202449.512091-1-kan.liang@linux.intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-04-13 16:48:24 +02:00
Thiago Rafael Becker
8417eb9aaf cifs: sanitize paths in cifs_update_super_prepath.
[ Upstream commit d19342c660 ]

After a server reboot, clients are failing to move files with ENOENT.
This is caused by DFS referrals containing multiple separators, which
the server move call doesn't recognize.

v1: Initial patch.
v2: Move prototype to header.

Link: https://bugzilla.redhat.com/show_bug.cgi?id=2182472
Fixes: a31080899d ("cifs: sanitize multiple delimiters in prepath")
Actually-Fixes: 24e0a1eff9 ("cifs: switch to new mount api")
Reviewed-by: Paulo Alcantara (SUSE) <pc@manguebit.com>
Signed-off-by: Thiago Rafael Becker <tbecker@redhat.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-04-13 16:48:24 +02:00
Steve French
df23c702d1 smb3: lower default deferred close timeout to address perf regression
[ Upstream commit 7e0e76d990 ]

Performance tests with large number of threads noted that the change
of the default closetimeo (deferred close timeout between when
close is done by application and when client has to send the close
to the server), to 5 seconds from 1 second, significantly degraded
perf in some cases like this (in the filebench example reported,
the stats show close requests on the wire taking twice as long,
and 50% regression in filebench perf). This is stil configurable
via mount parm closetimeo, but to be safe, decrease default back
to its previous value of 1 second.

Reported-by: Yin Fengwei <fengwei.yin@intel.com>
Reported-by: kernel test robot <yujie.liu@intel.com>
Link: https://lore.kernel.org/lkml/997614df-10d4-af53-9571-edec36b0e2f3@intel.com/
Fixes: 5efdd9122e ("smb3: allow deferred close timeout to be configurable")
Cc: stable@vger.kernel.org # 6.0+
Tested-by: Yin Fengwei <fengwei.yin@intel.com>
Reviewed-by: Paulo Alcantara (SUSE) <pc@manguebit.com>
Reviewed-by: Shyam Prasad N <sprasad@microsoft.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Stable-dep-of: d19342c660 ("cifs: sanitize paths in cifs_update_super_prepath.")
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-04-13 16:48:24 +02:00
Steve French
1d9cad9c58 smb3: allow deferred close timeout to be configurable
[ Upstream commit 5efdd9122e ]

Deferred close can be a very useful feature for allowing
caching data for read, and for minimizing the number of
reopens needed for a file that is repeatedly opened and
close but there are workloads where its default (1 second,
similar to actimeo/acregmax) is much too small.

Allow the user to configure the amount of time we can
defer sending the final smb3 close when we have a
handle lease on the file (rather than forcing it to depend
on value of actimeo which is often unrelated, and less safe).

Adds new mount parameter "closetimeo=" which is the maximum
number of seconds we can wait before sending an SMB3
close when we have a handle lease for it.  Default value
also is set to slightly larger at 5 seconds (although some
other clients use larger default this should still help).

Suggested-by: Bharath SM <bharathsm@microsoft.com>
Reviewed-by: Bharath SM <bharathsm@microsoft.com>
Reviewed-by: Shyam Prasad N <sprasad@microsoft.com>
Reviewed-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
Signed-off-by: Steve French <stfrench@microsoft.com>
Stable-dep-of: d19342c660 ("cifs: sanitize paths in cifs_update_super_prepath.")
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-04-13 16:48:24 +02:00
Zhong Jinghua
5e5c5f4729 scsi: iscsi_tcp: Check that sock is valid before iscsi_set_param()
[ Upstream commit 48b19b79cf ]

The validity of sock should be checked before assignment to avoid incorrect
values. Commit 57569c37f0 ("scsi: iscsi: iscsi_tcp: Fix null-ptr-deref
while calling getpeername()") introduced this change which may lead to
inconsistent values of tcp_sw_conn->sendpage and conn->datadgst_en.

Fix the issue by moving the position of the assignment.

Fixes: 57569c37f0 ("scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername()")
Signed-off-by: Zhong Jinghua <zhongjinghua@huawei.com>
Link: https://lore.kernel.org/r/20230329071739.2175268-1-zhongjinghua@huaweicloud.com
Reviewed-by: Mike Christie <michael.christie@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-04-13 16:48:24 +02:00
Li Zetao
ae73c4dd48 scsi: qla2xxx: Fix memory leak in qla2x00_probe_one()
[ Upstream commit 85ade4010e ]

There is a memory leak reported by kmemleak:

  unreferenced object 0xffffc900003f0000 (size 12288):
    comm "modprobe", pid 19117, jiffies 4299751452 (age 42490.264s)
    hex dump (first 32 bytes):
      00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
      00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    backtrace:
      [<00000000629261a8>] __vmalloc_node_range+0xe56/0x1110
      [<0000000001906886>] __vmalloc_node+0xbd/0x150
      [<000000005bb4dc34>] vmalloc+0x25/0x30
      [<00000000a2dc1194>] qla2x00_create_host+0x7a0/0xe30 [qla2xxx]
      [<0000000062b14b47>] qla2x00_probe_one+0x2eb8/0xd160 [qla2xxx]
      [<00000000641ccc04>] local_pci_probe+0xeb/0x1a0

The root cause is traced to an error-handling path in qla2x00_probe_one()
when the adapter "base_vha" initialize failed. The fab_scan_rp "scan.l" is
used to record the port information and it is allocated in
qla2x00_create_host(). However, it is not released in the error handling
path "probe_failed".

Fix this by freeing the memory of "scan.l" when an error occurs in the
adapter initialization process.

Fixes: a4239945b8 ("scsi: qla2xxx: Add switch command to simplify fabric discovery")
Signed-off-by: Li Zetao <lizetao1@huawei.com>
Link: https://lore.kernel.org/r/20230325110004.363898-1-lizetao1@huawei.com
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-04-13 16:48:23 +02:00
Nuno Sá
c8c17991da iio: adc: ad7791: fix IRQ flags
[ Upstream commit 0c6ef985a1 ]

The interrupt is triggered on the falling edge rather than being a level
low interrupt.

Fixes: da4d3d6bb9 ("iio: adc: ad-sigma-delta: Allow custom IRQ flags")
Signed-off-by: Nuno Sá <nuno.sa@analog.com>
Link: https://lore.kernel.org/r/20230120124645.819910-1-nuno.sa@analog.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-04-13 16:48:23 +02:00
Steve Clevenger
bc61cce6a6 coresight-etm4: Fix for() loop drvdata->nr_addr_cmp range bug
commit bf84937e88 upstream.

In etm4_enable_hw, fix for() loop range to represent address comparator pairs.

Fixes: 2e1cdfe184 ("coresight-etm4x: Adding CoreSight ETM4x driver")
Cc: stable@vger.kernel.org
Signed-off-by: Steve Clevenger <scclevenger@os.amperecomputing.com>
Reviewed-by: James Clark <james.clark@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Link: https://lore.kernel.org/r/4a4ee61ce8ef402615a4528b21a051de3444fb7b.1677540079.git.scclevenger@os.amperecomputing.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-04-13 16:48:23 +02:00
Suzuki K Poulose
97302eb6ca coresight: etm4x: Do not access TRCIDR1 for identification
commit 735e7b30a5 upstream.

CoreSight ETM4x architecture clearly provides ways to identify a device
via registers in the "Management" class, TRCDEVARCH and TRCDEVTYPE. These
registers can be accessed without the Trace domain being powered on.
We additionally added TRCIDR1 as fallback in order to cover for any
ETMs that may not have implemented TRCDEVARCH. So far, nobody has
reported hitting a WARNING we placed to catch such systems.

Also, more importantly it is problematic to access TRCIDR1, which is a
"Trace" register via MMIO access, without clearing the OSLK. But we cannot
mess with the OSLK until we know for sure that this is an ETMv4 device.
Thus, this kind of creates a chicken and egg problem unnecessarily for
systems "which are compliant" to the ETMv4 architecture.

Let us remove the TRCIDR1 fall back check and rely only on TRCDEVARCH.

Fixes: 8b94db1eda ("coresight: etm4x: Use TRCDEVARCH for component discovery")
Cc: stable@vger.kernel.org
Reported-by: Steve Clevenger <scclevenger@os.amperecomputing.com>
Link: https://lore.kernel.org/all/143540e5623d4c7393d24833f2b80600d8d745d2.1677881753.git.scclevenger@os.amperecomputing.com/
Cc: Mike Leach <mike.leach@linaro.org>
Cc: James Clark <james.clark@arm.com>
Reviewed-by: Mike Leach <mike.leach@linaro.org>
Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Link: https://lore.kernel.org/r/20230321104530.1547136-1-suzuki.poulose@arm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-04-13 16:48:23 +02:00
Jeremy Soller
fd23e9bbfc ALSA: hda/realtek: Add quirk for Clevo X370SNW
commit 36d4d213c6 upstream.

Fixes speaker output and headset detection on Clevo X370SNW.

Signed-off-by: Jeremy Soller <jeremy@system76.com>
Signed-off-by: Tim Crawford <tcrawford@system76.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20230331162317.14992-1-tcrawford@system76.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-04-13 16:48:23 +02:00
Marios Makassikis
f204f38212 ksmbd: do not call kvmalloc() with __GFP_NORETRY | __GFP_NO_WARN
commit e416ea62a9 upstream.

Commit 83dcedd554 ("ksmbd: fix infinite loop in ksmbd_conn_handler_loop()"),
changes GFP modifiers passed to kvmalloc(). This cause xfstests generic/551
test to fail. We limit pdu length size according to connection status and
maximum number of connections. In the rest, memory allocation of request
is limited by credit management. so these flags are no longer needed.

Fixes: 83dcedd554 ("ksmbd: fix infinite loop in ksmbd_conn_handler_loop()")
Cc: stable@vger.kernel.org
Signed-off-by: Marios Makassikis <mmakassikis@freebox.fr>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-04-13 16:48:23 +02:00
Geert Uytterhoeven
091b3e3127 dt-bindings: serial: renesas,scif: Fix 4th IRQ for 4-IRQ SCIFs
commit 7b21f329ae upstream.

The fourth interrupt on SCIF variants with four interrupts (RZ/A1) is
the Break interrupt, not the Transmit End interrupt (like on SCI(g)).
Update the description and interrupt name to fix this.

Fixes: 384d00fae8 ("dt-bindings: serial: sh-sci: Convert to json-schema")
Cc: stable <stable@kernel.org>
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/719d1582e0ebbe3d674e3a48fc26295e1475a4c3.1679046394.git.geert+renesas@glider.be
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-04-13 16:48:23 +02:00
Ryusuke Konishi
d540aea451 nilfs2: fix sysfs interface lifetime
commit 42560f9c92 upstream.

The current nilfs2 sysfs support has issues with the timing of creation
and deletion of sysfs entries, potentially leading to null pointer
dereferences, use-after-free, and lockdep warnings.

Some of the sysfs attributes for nilfs2 per-filesystem instance refer to
metadata file "cpfile", "sufile", or "dat", but
nilfs_sysfs_create_device_group that creates those attributes is executed
before the inodes for these metadata files are loaded, and
nilfs_sysfs_delete_device_group which deletes these sysfs entries is
called after releasing their metadata file inodes.

Therefore, access to some of these sysfs attributes may occur outside of
the lifetime of these metadata files, resulting in inode NULL pointer
dereferences or use-after-free.

In addition, the call to nilfs_sysfs_create_device_group() is made during
the locking period of the semaphore "ns_sem" of nilfs object, so the
shrinker call caused by the memory allocation for the sysfs entries, may
derive lock dependencies "ns_sem" -> (shrinker) -> "locks acquired in
nilfs_evict_inode()".

Since nilfs2 may acquire "ns_sem" deep in the call stack holding other
locks via its error handler __nilfs_error(), this causes lockdep to report
circular locking.  This is a false positive and no circular locking
actually occurs as no inodes exist yet when
nilfs_sysfs_create_device_group() is called.  Fortunately, the lockdep
warnings can be resolved by simply moving the call to
nilfs_sysfs_create_device_group() out of "ns_sem".

This fixes these sysfs issues by revising where the device's sysfs
interface is created/deleted and keeping its lifetime within the lifetime
of the metadata files above.

Link: https://lkml.kernel.org/r/20230330205515.6167-1-konishi.ryusuke@gmail.com
Fixes: dd70edbde2 ("nilfs2: integrate sysfs support into driver")
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Reported-by: syzbot+979fa7f9c0d086fdc282@syzkaller.appspotmail.com
  Link: https://lkml.kernel.org/r/0000000000003414b505f7885f7e@google.com
Reported-by: syzbot+5b7d542076d9bddc3c6a@syzkaller.appspotmail.com
  Link: https://lkml.kernel.org/r/0000000000006ac86605f5f44eb9@google.com
Cc: Viacheslav Dubeyko <slava@dubeyko.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-04-13 16:48:22 +02:00
Ryusuke Konishi
92684e0265 nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread()
commit 6be49d100c upstream.

The finalization of nilfs_segctor_thread() can race with
nilfs_segctor_kill_thread() which terminates that thread, potentially
causing a use-after-free BUG as KASAN detected.

At the end of nilfs_segctor_thread(), it assigns NULL to "sc_task" member
of "struct nilfs_sc_info" to indicate the thread has finished, and then
notifies nilfs_segctor_kill_thread() of this using waitqueue
"sc_wait_task" on the struct nilfs_sc_info.

However, here, immediately after the NULL assignment to "sc_task", it is
possible that nilfs_segctor_kill_thread() will detect it and return to
continue the deallocation, freeing the nilfs_sc_info structure before the
thread does the notification.

This fixes the issue by protecting the NULL assignment to "sc_task" and
its notification, with spinlock "sc_state_lock" of the struct
nilfs_sc_info.  Since nilfs_segctor_kill_thread() does a final check to
see if "sc_task" is NULL with "sc_state_lock" locked, this can eliminate
the race.

Link: https://lkml.kernel.org/r/20230327175318.8060-1-konishi.ryusuke@gmail.com
Reported-by: syzbot+b08ebcc22f8f3e6be43a@syzkaller.appspotmail.com
Link: https://lkml.kernel.org/r/00000000000000660d05f7dfa877@google.com
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-04-13 16:48:22 +02:00
Sherry Sun
ba3a88b444 tty: serial: fsl_lpuart: avoid checking for transfer complete when UARTCTRL_SBK is asserted in lpuart32_tx_empty
commit 9425914f3d upstream.

According to LPUART RM, Transmission Complete Flag becomes 0 if queuing
a break character by writing 1 to CTRL[SBK], so here need to avoid
checking for transmission complete when UARTCTRL_SBK is asserted,
otherwise the lpuart32_tx_empty may never get TIOCSER_TEMT.

Commit 2411fd94ceaa("tty: serial: fsl_lpuart: skip waiting for
transmission complete when UARTCTRL_SBK is asserted") only fix it in
lpuart32_set_termios(), here also fix it in lpuart32_tx_empty().

Fixes: 380c966c09 ("tty: serial: fsl_lpuart: add 32-bit register interface support")
Cc: stable <stable@kernel.org>
Signed-off-by: Sherry Sun <sherry.sun@nxp.com>
Link: https://lore.kernel.org/r/20230323054415.20363-1-sherry.sun@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-04-13 16:48:22 +02:00
Biju Das
ad142624cc tty: serial: sh-sci: Fix Rx on RZ/G2L SCI
commit f92ed0cd93 upstream.

SCI IP on RZ/G2L alike SoCs do not need regshift compared to other SCI
IPs on the SH platform. Currently, it does regshift and configuring Rx
wrongly. Drop adding regshift for RZ/G2L alike SoCs.

Fixes: dfc80387ae ("serial: sh-sci: Compute the regshift value for SCI ports")
Cc: stable@vger.kernel.org
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Link: https://lore.kernel.org/r/20230321114753.75038-3-biju.das.jz@bp.renesas.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-04-13 16:48:22 +02:00
Biju Das
1184bd5c5e tty: serial: sh-sci: Fix transmit end interrupt handler
commit b43a18647f upstream.

The fourth interrupt on SCI port is transmit end interrupt compared to
the break interrupt on other port types. So, shuffle the interrupts to fix
the transmit end interrupt handler.

Fixes: e1d0be6161 ("sh-sci: Add h8300 SCI")
Cc: stable <stable@kernel.org>
Suggested-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Link: https://lore.kernel.org/r/20230317150403.154094-1-biju.das.jz@bp.renesas.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-04-13 16:48:22 +02:00
Kai-Heng Feng
1f49173be3 iio: light: cm32181: Unregister second I2C client if present
commit 099cc90a5a upstream.

If a second dummy client that talks to the actual I2C address was
created in probe(), there should be a proper cleanup on driver and
device removal to avoid leakage.

So unregister the dummy client via another callback.

Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Suggested-by: Hans de Goede <hdegoede@redhat.com>
Fixes: c1e62062ff ("iio: light: cm32181: Handle CM3218 ACPI devices with 2 I2C resources")
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2152281
Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Link: https://lore.kernel.org/r/20230223020059.2013993-1-kai.heng.feng@canonical.com
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-04-13 16:48:22 +02:00
William Breathitt Gray
77593b4e96 iio: dac: cio-dac: Fix max DAC write value check for 12-bit
commit c3701185ee upstream.

The CIO-DAC series of devices only supports DAC values up to 12-bit
rather than 16-bit. Trying to write a 16-bit value results in only the
lower 12 bits affecting the DAC output which is not what the user
expects. Instead, adjust the DAC write value check to reject values
larger than 12-bit so that they fail explicitly as invalid for the user.

Fixes: 3b8df5fd52 ("iio: Add IIO support for the Measurement Computing CIO-DAC family")
Cc: stable@vger.kernel.org
Signed-off-by: William Breathitt Gray <william.gray@linaro.org>
Link: https://lore.kernel.org/r/20230311002248.8548-1-william.gray@linaro.org
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-04-13 16:48:22 +02:00
Lars-Peter Clausen
73742a446e iio: adc: ti-ads7950: Set can_sleep flag for GPIO chip
commit 363c7dc72f upstream.

The ads7950 uses a mutex as well as SPI transfers in its GPIO callbacks.
This means these callbacks can sleep and the `can_sleep` flag should be
set.

Having the flag set will make sure that warnings are generated when calling
any of the callbacks from a potentially non-sleeping context.

Fixes: c97dce792d ("iio: adc: ti-ads7950: add GPIO support")
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: David Lechner <david@lechnology.com>
Link: https://lore.kernel.org/r/20230312210933.2275376-1-lars@metafoo.de
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-04-13 16:48:21 +02:00