Use kill_anon_super() instead of generic_shutdown_super() since the
mount() in erofs fscache mode uses get_tree_nodev() and associated
anon bdev needs to be freed.

Fixes: 9c0cc9c7 ("erofs: add 'fsid' mount option")
Suggested-by: Jingbo Xu <jefflexu@linux.alibaba.com>
Signed-off-by: Jia Zhu <zhujia.zj@bytedance.com>
Reviewed-by: Jingbo Xu <jefflexu@linux.alibaba.com>
Link: https://lore.kernel.org/r/20220918043456.147-2-zhujia.zj@bytedance.comSigned-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>

As syzbot reported [1], the root cause is that i_size field is a
signed type, and negative i_size is also less than EROFS_BLKSIZ.
As a consequence, it's handled as fast symlink unexpectedly.

Let's fall back to the generic path to deal with such unusual i_size.

[1] https://lore.kernel.org/r/000000000000ac8efa05e7feaa1f@google.com

Reported-by: syzbot+f966c13b1b4fc0403b19@syzkaller.appspotmail.com
Fixes: 431339ba ("staging: erofs: add inode operations")
Reviewed-by: Yue Hu <huyue2@coolpad.com>
Link: https://lore.kernel.org/r/20220909023948.28925-1-hsiangkao@linux.alibaba.comSigned-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>

Merge tag 'kbuild-fixes-v6.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild

Pull Kbuild fixes from Masahiro Yamada:

 - Remove unused scripts/gcc-ld script

 - Add zstd support to scripts/extract-ikconfig

 - Check 'make headers' for UML

 - Fix scripts/mksysmap to ignore local symbols

* tag 'kbuild-fixes-v6.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild:
  mksysmap: Fix the mismatch of 'L0' symbols in System.map
  kbuild: disable header exports for UML in a straightforward way
  scripts/extract-ikconfig: add zstd compression support
  scripts: remove obsolete gcc-ld script

Pull arm64 fixes from Will Deacon:
 "Three small arm64 fixes, all related to optional architecture
  extensions: BTI, SME and 52-bit virtual addressing:

   - Disable in-kernel BTI when compiling with GCC, as it makes invalid
     assumptions about the distance between functions which has led to
     crashes when calling modules on a CPU with BTI support

   - Remove bogus TIF_SME flag management if memory allocation fails in
     the ptrace code

   - Fix the resume path when configured for 52-bit virtual addressing"

* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
  arm64: mm: fix resume for 52-bit enabled builds
  arm64/ptrace: Don't clear calling process' TIF_SME on OOM
  arm64/bti: Disable in kernel BTI when cross section thunks are broken

Pull i2c fixes from Wolfram Sang:
 "Only documentation and DT binding fixes and improvements"

* tag 'i2c-for-6.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
  dt-bindings: i2c: renesas,riic: Fix 'unevaluatedProperties' warnings
  docs: i2c: piix4: Fix typos, add markup, drop link
  docs: i2c: i2c-topology: reorder sections more logically
  docs: i2c: i2c-topology: fix incorrect heading
  docs: i2c: i2c-topology: fix typo

Pull iommu fixes from Joerg Roedel:

 - Intel VT-d fixes from Lu Baolu:
     - Boot kdump kernels with VT-d scalable mode on
     - Calculate the right page table levels
     - Fix two recursive locking issues
     - Fix a lockdep splat issue

 - AMD IOMMU fixes:
     - Fix for completion-wait command to use full 64 bits of data
     - Fix PASID related issue where GPU sound devices failed to
       initialize

 - Fix for Virtio-IOMMU to report correct caching behavior, needed for
   use with VFIO

* tag 'iommu-fixes-v6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu:
  iommu: Fix false ownership failure on AMD systems with PASID activated
  iommu/vt-d: Fix possible recursive locking in intel_iommu_init()
  iommu/virtio: Fix interaction with VFIO
  iommu/vt-d: Fix lockdep splat due to klist iteration in atomic context
  iommu/vt-d: Fix recursive lock issue in iommu_flush_dev_iotlb()
  iommu/vt-d: Correctly calculate sagaw value of IOMMU
  iommu/vt-d: Fix kdump kernels boot failure with scalable mode
  iommu/amd: use full 64-bit value in build_completion_wait()

Pull MIPS fixes from Thomas Bogendoerfer:

 - fix for loongson32 starup hang

 - fix for octeon irq setup problem

 - fix compiler warning for new CONFIG option

 - switch to SPARSEMEM_EXTREME for all platforms selecting SPARSEMEM

* tag 'mips-fixes_6.0_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux:
  mips: Select SPARSEMEM_EXTREME
  MIPS: OCTEON: irq: Fix octeon_irq_force_ciu_mapping()
  MIPS: octeon: Get rid of preprocessor directives around RESERVE32
  MIPS: loongson32: ls1c: Fix hang during startup

The AMD IOMMU driver cannot activate PASID mode on a RID without the RID's
translation being set to IDENTITY. Further it requires changing the RID's
page table layout from the normal v1 IOMMU_DOMAIN_IDENTITY layout to a
different v2 layout.

It does this by creating a new iommu_domain, configuring that domain for
v2 identity operation and then attaching it to the group, from within the
driver. This logic assumes the group is already set to the IDENTITY domain
and is being used by the DMA API.

However, since the ownership logic is based on the group's domain pointer
equaling the default domain to detect DMA API ownership, this causes it to
look like the group is not attached to the DMA API any more. This blocks
attaching drivers to any other devices in the group.

In a real system this manifests itself as the HD-audio devices on some AMD
platforms losing their device drivers.

Work around this unique behavior of the AMD driver by checking for
equality of IDENTITY domains based on their type, not their pointer
value. This allows the AMD driver to have two IDENTITY domains for
internal purposes without breaking the check.

Have the AMD driver properly declare that the special domain it created is
actually an IDENTITY domain.

Cc: Robin Murphy <robin.murphy@arm.com>
Cc: stable@vger.kernel.org
Fixes: 512881ea ("bus: platform,amba,fsl-mc,PCI: Add device DMA ownership management")
Reported-by: Takashi Iwai <tiwai@suse.de>
Tested-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Reviewed-by: Robin Murphy <robin.murphy@arm.com>
Link: https://lore.kernel.org/r/0-v1-ea566e16b06b+811-amd_owner_jgg@nvidia.comSigned-off-by: Joerg Roedel <jroedel@suse.de>

The global rwsem dmar_global_lock was introduced by commit 3a5670e8
("iommu/vt-d: Introduce a rwsem to protect global data structures"). It
is used to protect DMAR related global data from DMAR hotplug operations.

The dmar_global_lock used in the intel_iommu_init() might cause recursive
locking issue, for example, intel_iommu_get_resv_regions() is taking the
dmar_global_lock from within a section where intel_iommu_init() already
holds it via probe_acpi_namespace_devices().

Using dmar_global_lock in intel_iommu_init() could be relaxed since it is
unlikely that any IO board must be hot added before the IOMMU subsystem is
initialized. This eliminates the possible recursive locking issue by moving
down DMAR hotplug support after the IOMMU is initialized and removing the
uses of dmar_global_lock in intel_iommu_init().

Fixes: d5692d4a ("iommu/vt-d: Fix suspicious RCU usage in probe_acpi_namespace_devices()")
Reported-by: Robin Murphy <robin.murphy@arm.com>
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Link: https://lore.kernel.org/r/894db0ccae854b35c73814485569b634237b5538.1657034828.git.robin.murphy@arm.com
Link: https://lore.kernel.org/r/20220718235325.3952426-1-baolu.lu@linux.intel.comSigned-off-by: Joerg Roedel <jroedel@suse.de>

Pull s390 fixes from Vasily Gorbik:

 - Fix absolute zero lowcore corruption on kdump when CPU0 is offline

 - Fix lowcore protection setup for offline CPU restart

* tag 's390-6.0-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
  s390/smp: enforce lowcore protection on CPU restart
  s390/boot: fix absolute zero lowcore corruption on boot

Merge tag 'hwmon-for-v6.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging

Pull hwmon fixes from Guenter Roeck:

 - Fix severe regression in asus-ec-sensors driver
   which resulted in EC driver failures

 - Fix various bugs in mr75203 driver

 - Fix byte order bug in tps23861 driver

* tag 'hwmon-for-v6.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
  hwmon: (asus-ec-sensors) autoload module via DMI data
  hwmon: (mr75203) enable polling for all VM channels
  hwmon: (mr75203) fix multi-channel voltage reading
  hwmon: (mr75203) fix voltage equation for negative source input
  hwmon: (mr75203) update pvt->v_num and vm_num to the actual number of used sensors
  hwmon: (mr75203) fix VM sensor allocation when "intel,vm-map" not defined
  dt-bindings: hwmon: (mr75203) fix "intel,vm-map" property to be optional
  hwmon: (tps23861) fix byte order in resistance register

Pull dma-mapping fixes from Christoph Hellwig:

 - revert a panic on swiotlb initialization failure (Yu Zhao)

 - fix the lookup for partial syncs in dma-debug (Robin Murphy)

 - fix a shift overflow in swiotlb (Chao Gao)

 - fix a comment typo in swiotlb (Chao Gao)

 - mark a function static now that all abusers are gone (Christoph
   Hellwig)

* tag 'dma-mapping-6.0-2022-09-10' of git://git.infradead.org/users/hch/dma-mapping:
  dma-mapping: mark dma_supported static
  swiotlb: fix a typo
  swiotlb: avoid potential left shift overflow
  dma-debug: improve search for partial syncs
  Revert "swiotlb: panic if nslabs is too small"

__cpu_setup() was changed to take the actual number of VA bits in x0,
however the resume path was not updated at the same time.

Load `vabits_actual` in the resume path, to ensure that the correct
number of VA bits is used.

This fixes booting v6.0-rc kernels on my Juno.
Signed-off-by: Joey Gouly <joey.gouly@arm.com>
Fixes: 0aaa6853 ("arm64: mm: fix booting with 52-bit address space")
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Will Deacon <will@kernel.org>
Cc: Ard Biesheuvel <ardb@kernel.org>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Link: https://lore.kernel.org/r/20220909124311.38489-1-joey.gouly@arm.comSigned-off-by: Will Deacon <will@kernel.org>

Pull SCSI fixes from James Bottomley:
 "Eight patches which looks like quite a large core change, but most of
  the diffstat is reverting the attempt to rejig reference counting
  introduced in the last merge window which caused issues with device
  and module removal.

  Of the remaining four patches, only the fix use-after-free is
  substantial"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: mpt3sas: Fix use-after-free warning
  scsi: core: Fix a use-after-free
  scsi: core: Revert "Make sure that targets outlive devices"
  scsi: core: Revert "Make sure that hosts outlive targets"
  scsi: core: Revert "Simplify LLD module reference counting"
  scsi: core: Revert "Call blk_mq_free_tag_set() earlier"
  scsi: lpfc: Add missing destroy_workqueue() in error path
  scsi: lpfc: Return DID_TRANSPORT_DISRUPTED instead of DID_REQUEUE

When System.map was generated, the kernel used mksysmap to filter the
kernel symbols, we need to filter "L0" symbols in LoongArch architecture.

$ cat System.map | grep L0
9000000000221540 t L0

The L0 symbol exists in System.map, but not in .tmp_System.map. When
"cmp -s System.map .tmp_System.map" will show "Inconsistent kallsyms
data" error message in link-vmlinux.sh script.
Signed-off-by: Youling Tang <tangyouling@loongson.cn>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>

Pull driver core fixes from Greg KH:
 "Here are some small driver core and debugfs fixes for 6.0-rc5.

  Included in here are:

   - multiple attempts to get the arch_topology code to work properly on
     non-cluster SMT systems. First attempt caused build breakages in
     linux-next and 0-day, second try worked.

   - debugfs fixes for a long-suffering memory leak. The pattern of
     debugfs_remove(debugfs_lookup(...)) turns out to leak dentries, so
     add debugfs_lookup_and_remove() to fix this problem. Also fix up
     the scheduler debug code that highlighted this problem. Fixes for
     other subsystems will be trickling in over the next few months for
     this same issue once the debugfs function is merged.

  All of these have been in linux-next since Wednesday with no reported
  problems"

* tag 'driver-core-6.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core:
  arch_topology: Make cluster topology span at least SMT CPUs
  sched/debug: fix dentry leak in update_sched_domain_debugfs
  debugfs: add debugfs_lookup_and_remove()
  driver core: fix driver_set_override() issue with empty strings
  Revert "arch_topology: Make cluster topology span at least SMT CPUs"
  arch_topology: Make cluster topology span at least SMT CPUs

Pull block fixes from Jens Axboe:

 - NVMe pull via Christoph:
      - fix a use after free in nvmet (Bart Van Assche)
      - fix a use after free when detecting digest errors
        (Sagi Grimberg)
      - fix regression that causes sporadic TCP requests to time out
        (Sagi Grimberg)
      - fix two off by ones errors in the nvmet ZNS support
        (Dennis Maisenbacher)
      - requeue aen after firmware activation (Keith Busch)

 - Fix missing request flags in debugfs code (me)

 - Partition scan fix (Ming)

* tag 'block-6.0-2022-09-09' of git://git.kernel.dk/linux-block:
  block: add missing request flags to debugfs code
  nvme: requeue aen after firmware activation
  nvmet: fix mar and mor off-by-one errors
  nvme-tcp: fix regression that causes sporadic requests to time out
  nvme-tcp: fix UAF when detecting digest errors
  nvmet: fix a use-after-free
  block: don't add partitions if GD_SUPPRESS_PART_SCAN is set

Pull io_uring fixes from Jens Axboe:

 - Removed function that became unused after last week's merge (Jiapeng)

 - Two small fixes for kbuf recycling (Pavel)

 - Include address copy for zc send for POLLFIRST (Pavel)

 - Fix for short IO handling in the normal read/write path (Pavel)

* tag 'io_uring-6.0-2022-09-09' of git://git.kernel.dk/linux-block:
  io_uring/rw: fix short rw error handling
  io_uring/net: copy addr for zc on POLL_FIRST
  io_uring: recycle kbuf recycle on tw requeue
  io_uring/kbuf: fix not advancing READV kbuf ring
  io_uring/notif: Remove the unused function io_notif_complete()

Pull rdma fixes from Jason Gunthorpe:
 "Many bug fixes in several drivers:

   - Fix misuse of the DMA API in rtrs

   - Several irdma issues: hung task due to SQ flushing, incorrect
     capability reporting to userspace, improper error handling for MW
     corners, touching an uninitialized SGL for during invalidation.

   - hns was using the wrong page size limits for the HW, an incorrect
     calculation of wqe_shift causing WQE corruption, and mis computed a
     timer id.

   - Fix a crash in SRP triggered by blktests

   - Fix compiler errors by calling virt_to_page() with the proper type
     in siw

   - Userspace triggerable deadlock in ODP

   - mlx5 could use the wrong profile due to some driver loading races,
     counters were not working in some device configurations, and a
     crash on error unwind"

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
  RDMA/irdma: Report RNR NAK generation in device caps
  RDMA/irdma: Use s/g array in post send only when its valid
  RDMA/irdma: Return correct WC error for bind operation failure
  RDMA/irdma: Return error on MR deregister CQP failure
  RDMA/irdma: Report the correct max cqes from query device
  MAINTAINERS: Update maintainers of HiSilicon RoCE
  RDMA/mlx5: Fix UMR cleanup on error flow of driver init
  RDMA/mlx5: Set local port to one when accessing counters
  RDMA/mlx5: Rely on RoCE fw cap instead of devlink when setting profile
  IB/core: Fix a nested dead lock as part of ODP flow
  RDMA/siw: Pass a pointer to virt_to_page()
  RDMA/srp: Set scmnd->result only when scmnd is not NULL
  RDMA/hns: Remove the num_qpc_timer variable
  RDMA/hns: Fix wrong fixed value of qp->rq.wqe_shift
  RDMA/hns: Fix supported page size
  RDMA/cma: Fix arguments order in net device validation
  RDMA/irdma: Fix drain SQ hang with no completion
  RDMA/rtrs-srv: Pass the correct number of entries for dma mapped SGL
  RDMA/rtrs-clt: Use the right sg_cnt after ib_dma_map_sg

Pull drm fixes from Dave Airlie:
 "From a train in the Irish countryside, regular drm fixes for 6.0-rc5.

  This is mostly amdgpu/amdkfd and i915 fixes, then one panfrost, one
  ttm and one edid fix. Nothing too major going on. Hopefully a quiet
  week next week for LPC.

  edid:
   - Fix EDID 1.4 range-descriptor parsing

  ttm:
   - Fix ghost-object bulk moves

  i915:
   - Fix MIPI sequence block copy from BIOS' table
   - Fix PCODE min freq setup when GuC's SLPC is in use
   - Implement Workaround for eDP
   - Fix has_flat_ccs selection for DG1

  amdgpu:
   - Firmware header fix
   - SMU 13.x fix
   - Debugfs memory leak fix
   - NBIO 7.7 fix
   - Firmware memory leak fix

  amdkfd:
   - Debug output fix

  panfrost:
   - Fix devfreq OPP"

* tag 'drm-fixes-2022-09-10' of git://anongit.freedesktop.org/drm/drm:
  drm/panfrost: devfreq: set opp to the recommended one to configure regulator
  drm/ttm: cleanup the resource of ghost objects after locking them
  drm/amdgpu: prevent toc firmware memory leak
  drm/amdgpu: correct doorbell range/size value for CSDMA_DOORBELL_RANGE
  drm/amdkfd: print address in hex format rather than decimal
  drm/amd/display: fix memory leak when using debugfs_lookup()
  drm/amd/pm: add missing SetMGpuFanBoostLimitRpm mapping for SMU 13.0.7
  drm/amd/amdgpu: add rlc_firmware_header_v2_4 to amdgpu_firmware_header
  drm/i915: consider HAS_FLAT_CCS() in needs_ccs_pages
  drm/i915: Implement WaEdpLinkRateDataReload
  drm/i915/slpc: Let's fix the PCODE min freq table setup for SLPC
  drm/i915/bios: Copy the whole MIPI sequence block
  drm/ttm: update bulk move object of ghost BO
  drm/edid: Handle EDID 1.4 range descriptor h/vfreq offsets

Merge tag 'linux-kselftest-kunit-fixes-6.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest

Pull KUnit fixes from Shuah Khan:
 "Two fixes to test build and a fix for incorrect taint reason reporting"

* tag 'linux-kselftest-kunit-fixes-6.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest:
  tools: Add new "test" taint to kernel-chktaint
  kunit: fix Kconfig for build-in tests USB4 and Nitro Enclaves
  kunit: fix assert_type for comparison macros

Pull RISC-V fixes from Palmer Dabbelt:

 - A pair of device tree fixes for the Polarfire SOC

 - A fix to avoid overflowing the PMU counter array when firmware
   incorrectly reports the number of supported counters, which manifests
   on OpenSBI versions prior to 1.1

* tag 'riscv-for-linus-6.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
  perf: RISC-V: fix access beyond allocated array
  riscv: dts: microchip: use an mpfs specific l2 compatible
  dt-bindings: riscv: sifive-l2: add a PolarFire SoC compatible

Pull powerpc fix from Michael Ellerman:

 - Fix crashes on bare metal due to the new plkps driver trying to probe
   and call the hypervisor on non-pseries machines.

Thanks to Nathan Chancellor and Dan Horák.

* tag 'powerpc-6.0-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
  powerpc/pseries: Fix plpks crash on non-pseries

Replace autoloading data based on the ACPI EC device with the DMI
records for motherboards models. The ACPI method created a bug that when
this driver returns error from the probe function because of the
unsupported motherboard model, the ACPI subsystem concludes
that the EC device does not work properly.

Fixes: 5cd29012 ("hwmon: (asus-ec-sensors) introduce ec_board_info struct for board data")
Bug: https://bugzilla.kernel.org/show_bug.cgi?id=216412
Bug: https://bugzilla.redhat.com/show_bug.cgi?id=2121844Signed-off-by: Eugene Shalygin <eugene.shalygin@gmail.com>
Link: https://lore.kernel.org/r/20220909155654.123398-2-eugene.shalygin@gmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Guenter Roeck <linux@roeck-us.net>

Merge tag 'drm-intel-fixes-2022-09-08' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes

- Fix MIPI sequence block copy from BIOS' table. (Ville)
- Fix PCODE min freq setup when GuC's SLPC is in use. (Rodrigo)
- Implement Workaround for eDP. (Ville)
- Fix has_flat_ccs selection for DG1. (Matt)
Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Rodrigo Vivi <rodrigo.vivi@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/Yxn1WpmUJnJpqq23@intel.com

Commit c4617318 ("MIPS: Add NUMA support for Loongson-3") has increased
.bss size of the Octeon kernel from 16k to 16M. Providing the conditions
for SPARSEMEM_EXTREME avoids the waste of memory.

Thomas has tested the loogsoon64 kernel, where .bss is being reduced by
this patch from 16.5M to 515k.

Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Alexander Sverdlin <alexander.sverdlin@nokia.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>

Short summary of fixes pull:

 * edid: Fix EDID 1.4 range-descriptor parsing
 * panfrost: Fix devfreq OPP
 * ttm: Fix ghost-object bulk moves
Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patchwork.freedesktop.org/patch/msgid/YxniKN4rK4qPp+J9@linux-uq9g

We have a couple of problems, first reports of unexpected link breakage
for reads when cqe->res indicates that the IO was done in full. The
reason here is partial IO with retries.

TL;DR; we compare the result in __io_complete_rw_common() against
req->cqe.res, but req->cqe.res doesn't store the full length but rather
the length left to be done. So, when we pass the full corrected result
via kiocb_done() -> __io_complete_rw_common(), it fails.

The second problem is that we don't try to correct res in
io_complete_rw(), which, for instance, might be a problem for O_DIRECT
but when a prefix of data was cached in the page cache. We also
definitely don't want to pass a corrected result into io_rw_done().

The fix here is to leave __io_complete_rw_common() alone, always pass
not corrected result into it and fix it up as the last step just before
actually finishing the I/O.

Cc: stable@vger.kernel.org
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://github.com/axboe/liburing/issues/643Reported-by: Beld Zhang <beldzhang@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

We're missing TIMED_OUT and RESV. Particularly the former is handy
for debugging, let's get them added.
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

Pull btrfs fixes from David Sterba:
 "A few more fixes to zoned mode and one regression fix for chunk limit:

    - Zoned mode fixes:
        - fix how wait/wake up is done when finishing zone
        - fix zone append limit in emulated mode
        - fix mount on devices with conventional zones

   - fix regression, user settable data chunk limit got accidentally
     lowered and causes allocation problems on some profiles (raid0,
     raid1)"

* tag 'for-6.0-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
  btrfs: fix the max chunk size and stripe length calculation
  btrfs: zoned: fix mounting with conventional zones
  btrfs: zoned: set pseudo max append zone limit in zone emulation mode
  btrfs: zoned: fix API misuse of zone finish waiting

Pull VFIO fix from Alex Williamson:

 - Fix zero page refcount leak (Alex Williamson)

* tag 'vfio-v6.0-rc5' of https://github.com/awilliam/linux-vfio:
  vfio/type1: Unpin zero pages

Pull sound fixes from Takashi Iwai:
 "Lots of small fixes for various drivers at this time, hopefully it
  will be the last big bump before 6.0 release.

  The significant changes are regression fixes for (yet again) HD-audio
  memory allocations and USB-audio PCM parameter handling, while there
  are many small ASoC device-specific fixes as well as a few
  out-of-bounds and race issues spotted by fuzzers"

* tag 'sound-6.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (29 commits)
  ALSA: usb-audio: Clear fixed clock rate at closing EP
  ALSA: emu10k1: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc()
  ALSA: hda: Once again fix regression of page allocations with IOMMU
  ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface()
  ALSA: hda/tegra: Align BDL entry to 4KB boundary
  ALSA: hda/sigmatel: Fix unused variable warning for beep power change
  ALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC
  ALSA: hda/sigmatel: Keep power up while beep is enabled
  ALSA: aloop: Fix random zeros in capture data when using jiffies timer
  ALSA: usb-audio: Split endpoint setups for hw_params and prepare
  ALSA: usb-audio: Register card again for iface over delayed_register option
  ALSA: usb-audio: Inform the delayed registration more properly
  ASoC: fsl_aud2htx: Add error handler for pm_runtime_enable
  ASoC: fsl_aud2htx: register platform component before registering cpu dai
  ASoC: SOF: ipc4-topology: fix alh_group_ida max value
  ASoC: mchp-spdiftx: Fix clang -Wbitfield-constant-conversion
  ASoC: SOF: Kconfig: Make IPC_MESSAGE_INJECTOR depend on SND_SOC_SOF
  ASoC: SOF: Kconfig: Make IPC_FLOOD_TEST depend on SND_SOC_SOF
  ASoC: fsl_mqs: Fix supported clock DAI format
  ASoC: nau8540: Implement hw constraint for rates
  ...

Merge tag 'perf-tools-fixes-for-v6.0-2022-09-08' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux

Pull perf tools fixes from Arnaldo Carvalho de Melo:

 - Fix per-thread mmaps for multi-threaded targets, noticed with
   'perf top --pid' with multithreaded targets

 - Fix synthesis failure warnings in 'perf record'

 - Fix L2 Topdown metrics disappearance for raw events in 'perf stat'

 - Fix out of bound access in some CPU masks

 - Fix segfault if there is no CPU PMU table and a metric is sought,
   noticed when building with NO_JEVENTS=1

 - Skip dummy event attr check in 'perf script' fixing nonsensical
   warning about UREGS attribute not set, as 'dummy' events have no
   samples

 - Fix 'iregs' field handling with dummy events on hybrid systems in
   'perf script'

 - Prevent potential memory leak in c2c_he_zalloc() in 'perf c2c'

 - Don't install data files with x permissions

 - Fix types for print format in dlfilter-show-cycles

 - Switch deprecated openssl MD5_* functions to new EVP API in 'genelf'

 - Remove redundant word 'contention' in 'perf lock' help message

* tag 'perf-tools-fixes-for-v6.0-2022-09-08' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux:
  perf record: Fix synthesis failure warnings
  perf tools: Don't install data files with x permissions
  perf script: Fix Cannot print 'iregs' field for hybrid systems
  perf lock: Remove redundant word 'contention' in help message
  perf dlfilter dlfilter-show-cycles: Fix types for print format
  libperf evlist: Fix per-thread mmaps for multi-threaded targets
  perf c2c: Prevent potential memory leak in c2c_he_zalloc()
  perf genelf: Switch deprecated openssl MD5_* functions to new EVP API
  tools/perf: Fix out of bound access to cpu mask array
  perf affinity: Fix out of bound access to "sched_cpus" mask
  perf stat: Fix L2 Topdown metrics disappear for raw events
  perf script: Skip dummy event attr check
  perf metric: Return early if no CPU PMU table exists

Pull tracing fixes from Steven Rostedt:

 - Do not stop trace events in modules if TAINT_TEST is set

 - Do not clobber mount options when tracefs is mounted a second time

 - Prevent crash of kprobes in gate area

 - Add static annotation to some non global functions

 - Add some entries into the MAINTAINERS file

 - Fix check of event_mutex held when accessing trigger list

 - Add some __init/__exit annotations

 - Fix reporting of what called hardirq_{enable,disable}_ip function

* tag 'trace-v6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
  tracefs: Only clobber mode/uid/gid on remount if asked
  kprobes: Prohibit probes in gate area
  rv/reactor: add __init/__exit annotations to module init/exit funcs
  tracing: Fix to check event_mutex is held while accessing trigger list
  tracing: hold caller_addr to hardirq_{enable,disable}_ip
  tracepoint: Allow trace events in modules with TAINT_TEST
  MAINTAINERS: add scripts/tracing/ to TRACING
  MAINTAINERS: Add Runtime Verification (RV) entry
  rv/monitors: Make monitor's automata definition static

Merge tag 'asm-generic-fixes-6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic

Pull SOFTIRQ_ON_OWN_STACK rework from Arnd Bergmann:
 "Just one fixup patch, reworking the softirq_on_own_stack logic for
  preempt-rt kernels as discussed in

    https://lore.kernel.org/all/CAHk-=wgZSD3W2y6yczad2Am=EfHYyiPzTn3CfXxrriJf9i5W5w@mail.gmail.com/"

* tag 'asm-generic-fixes-6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic:
  asm-generic: Conditionally enable do_softirq_own_stack() via Kconfig.

Users may have explicitly configured their tracefs permissions; we
shouldn't overwrite those just because a second mount appeared.

Only clobber if the options were provided at mount time.

Note: the previous behavior was especially surprising in the presence of
automounted /sys/kernel/debug/tracing/.

Existing behavior:

  ## Pre-existing status: tracefs is 0755.
  # stat -c '%A' /sys/kernel/tracing/
  drwxr-xr-x

  ## (Re)trigger the automount.
  # umount /sys/kernel/debug/tracing
  # stat -c '%A' /sys/kernel/debug/tracing/.
  drwx------

  ## Unexpected: the automount changed mode for other mount instances.
  # stat -c '%A' /sys/kernel/tracing/
  drwx------

New behavior (after this change):

  ## Pre-existing status: tracefs is 0755.
  # stat -c '%A' /sys/kernel/tracing/
  drwxr-xr-x

  ## (Re)trigger the automount.
  # umount /sys/kernel/debug/tracing
  # stat -c '%A' /sys/kernel/debug/tracing/.
  drwxr-xr-x

  ## Expected: the automount does not change other mount instances.
  # stat -c '%A' /sys/kernel/tracing/
  drwxr-xr-x

Link: https://lkml.kernel.org/r/20220826174353.2.Iab6e5ea57963d6deca5311b27fb7226790d44406@changeid

Cc: stable@vger.kernel.org
Fixes: 4282d606 ("tracefs: Add new tracefs file system")
Signed-off-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>

The system call gate area counts as kernel text but trying
to install a kprobe in this area fails with an Oops later on.
To fix this explicitly disallow the gate area for kprobes.

Found by syzkaller with the following reproducer:
perf_event_open$cgroup(&(0x7f00000001c0)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x80ffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0xffffffffff600000}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)

Sample report:
BUG: unable to handle page fault for address: fffffbfff3ac6000
PGD 6dfcb067 P4D 6dfcb067 PUD 6df8f067 PMD 6de4d067 PTE 0
Oops: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 0 PID: 21978 Comm: syz-executor.2 Not tainted 6.0.0-rc3-00363-g7726d4c3-dirty #6
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
RIP: 0010:__insn_get_emulate_prefix arch/x86/lib/insn.c:91 [inline]
RIP: 0010:insn_get_emulate_prefix arch/x86/lib/insn.c:106 [inline]
RIP: 0010:insn_get_prefixes.part.0+0xa8/0x1110 arch/x86/lib/insn.c:134
Code: 49 be 00 00 00 00 00 fc ff df 48 8b 40 60 48 89 44 24 08 e9 81 00 00 00 e8 e5 4b 39 ff 4c 89 fa 4c 89 f9 48 c1 ea 03 83 e1 07 <42> 0f b6 14 32 38 ca 7f 08 84 d2 0f 85 06 10 00 00 48 89 d8 48 89
RSP: 0018:ffffc900088bf860 EFLAGS: 00010246
RAX: 0000000000040000 RBX: ffffffff9b9bebc0 RCX: 0000000000000000
RDX: 1ffffffff3ac6000 RSI: ffffc90002d82000 RDI: ffffc900088bf9e8
RBP: ffffffff9d630001 R08: 0000000000000000 R09: ffffc900088bf9e8
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001
R13: ffffffff9d630000 R14: dffffc0000000000 R15: ffffffff9d630000
FS:  00007f63eef63640(0000) GS:ffff88806d000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffbfff3ac6000 CR3: 0000000029d90005 CR4: 0000000000770ef0
PKRU: 55555554
Call Trace:
 <TASK>
 insn_get_prefixes arch/x86/lib/insn.c:131 [inline]
 insn_get_opcode arch/x86/lib/insn.c:272 [inline]
 insn_get_modrm+0x64a/0x7b0 arch/x86/lib/insn.c:343
 insn_get_sib+0x29a/0x330 arch/x86/lib/insn.c:421
 insn_get_displacement+0x350/0x6b0 arch/x86/lib/insn.c:464
 insn_get_immediate arch/x86/lib/insn.c:632 [inline]
 insn_get_length arch/x86/lib/insn.c:707 [inline]
 insn_decode+0x43a/0x490 arch/x86/lib/insn.c:747
 can_probe+0xfc/0x1d0 arch/x86/kernel/kprobes/core.c:282
 arch_prepare_kprobe+0x79/0x1c0 arch/x86/kernel/kprobes/core.c:739
 prepare_kprobe kernel/kprobes.c:1160 [inline]
 register_kprobe kernel/kprobes.c:1641 [inline]
 register_kprobe+0xb6e/0x1690 kernel/kprobes.c:1603
 __register_trace_kprobe kernel/trace/trace_kprobe.c:509 [inline]
 __register_trace_kprobe+0x26a/0x2d0 kernel/trace/trace_kprobe.c:477
 create_local_trace_kprobe+0x1f7/0x350 kernel/trace/trace_kprobe.c:1833
 perf_kprobe_init+0x18c/0x280 kernel/trace/trace_event_perf.c:271
 perf_kprobe_event_init+0xf8/0x1c0 kernel/events/core.c:9888
 perf_try_init_event+0x12d/0x570 kernel/events/core.c:11261
 perf_init_event kernel/events/core.c:11325 [inline]
 perf_event_alloc.part.0+0xf7f/0x36a0 kernel/events/core.c:11619
 perf_event_alloc kernel/events/core.c:12059 [inline]
 __do_sys_perf_event_open+0x4a8/0x2a00 kernel/events/core.c:12157
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f63ef7efaed
Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f63eef63028 EFLAGS: 00000246 ORIG_RAX: 000000000000012a
RAX: ffffffffffffffda RBX: 00007f63ef90ff80 RCX: 00007f63ef7efaed
RDX: 0000000000000000 RSI: ffffffffffffffff RDI: 00000000200001c0
RBP: 00007f63ef86019c R08: 0000000000000000 R09: 0000000000000000
R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000002 R14: 00007f63ef90ff80 R15: 00007f63eef43000
 </TASK>
Modules linked in:
CR2: fffffbfff3ac6000
---[ end trace 0000000000000000 ]---
RIP: 0010:__insn_get_emulate_prefix arch/x86/lib/insn.c:91 [inline]
RIP: 0010:insn_get_emulate_prefix arch/x86/lib/insn.c:106 [inline]
RIP: 0010:insn_get_prefixes.part.0+0xa8/0x1110 arch/x86/lib/insn.c:134
Code: 49 be 00 00 00 00 00 fc ff df 48 8b 40 60 48 89 44 24 08 e9 81 00 00 00 e8 e5 4b 39 ff 4c 89 fa 4c 89 f9 48 c1 ea 03 83 e1 07 <42> 0f b6 14 32 38 ca 7f 08 84 d2 0f 85 06 10 00 00 48 89 d8 48 89
RSP: 0018:ffffc900088bf860 EFLAGS: 00010246
RAX: 0000000000040000 RBX: ffffffff9b9bebc0 RCX: 0000000000000000
RDX: 1ffffffff3ac6000 RSI: ffffc90002d82000 RDI: ffffc900088bf9e8
RBP: ffffffff9d630001 R08: 0000000000000000 R09: ffffc900088bf9e8
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001
R13: ffffffff9d630000 R14: dffffc0000000000 R15: ffffffff9d630000
FS:  00007f63eef63640(0000) GS:ffff88806d000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffbfff3ac6000 CR3: 0000000029d90005 CR4: 0000000000770ef0
PKRU: 55555554
==================================================================

Link: https://lkml.kernel.org/r/20220907200917.654103-1-lk@c--e.de

cc: "Naveen N. Rao" <naveen.n.rao@linux.ibm.com>
cc: Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com>
cc: "David S. Miller" <davem@davemloft.net>
Cc: stable@vger.kernel.org
Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Christian A. Ehrhardt <lk@c--e.de>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>

SBI firmware should report total number of firmware and hardware counters
including unused ones or special ones. In this case the kernel doesn't need
to make any assumptions about gaps in reported counters, e.g. excluded timer
counter. That was fixed in OpenSBI v1.1 by commit 3f66465fb6bf ("lib: pmu:
allow to use the highest available counter"). This kernel patch has no effect
if SBI firmware behaves correctly. However it eliminates access beyond the
allocated pmu_ctr_list if the kernel is used with OpenSBI older than v1.1.

Fixes: e9991434 ("RISC-V: Add perf platform driver based on SBI PMU extension")
Signed-off-by: Sergey Matyukevich <sergey.matyukevich@syntacore.com>
Reviewed-by: Atish Patra <atishp@rivosinc.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20220830155306.301714-2-geomatsi@gmail.comSigned-off-by: Palmer Dabbelt <palmer@rivosinc.com>

Some calls to synthesis functions set err < 0 but only warn about the
failure and continue.  However they do not set err back to zero, relying
on subsequent code to do that.

That changed with the introduction of option --synth. When --synth=no
subsequent functions that set err back to zero are not called.

Fix by setting err = 0 in those cases.

Example:

 Before:

   $ perf record --no-bpf-event --synth=all -o /tmp/huh uname
   Couldn't synthesize bpf events.
   Linux
   [ perf record: Woken up 1 times to write data ]
   [ perf record: Captured and wrote 0.014 MB /tmp/huh (7 samples) ]
   $ perf record --no-bpf-event --synth=no -o /tmp/huh uname
   Couldn't synthesize bpf events.

 After:

   $ perf record --no-bpf-event --synth=no -o /tmp/huh uname
   Couldn't synthesize bpf events.
   Linux
   [ perf record: Woken up 1 times to write data ]
   [ perf record: Captured and wrote 0.014 MB /tmp/huh (7 samples) ]

Fixes: 41b740b6 ("perf record: Add --synth option")
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Acked-by: Namhyung Kim <namhyung@kernel.org>
Cc: Ian Rogers <irogers@google.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Link: https://lore.kernel.org/r/20220907162458.72817-1-adrian.hunter@intel.comSigned-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>