1. 11 Jul, 2022 11 commits
  2. 10 Jul, 2022 12 commits
    • Linus Torvalds's avatar
      Linux 5.19-rc6 · 32346491
      Linus Torvalds authored
      32346491
    • Linus Torvalds's avatar
      Merge branch 'hot-fixes' (fixes for rc6) · 24f4b40e
      Linus Torvalds authored
      This is a collection of three fixes for small annoyances.
      
      Two of these are already pending in other trees, but I really don't want
      to release another -rc with these issues pending, so I picked up the
      patches for these things directly.  We'll end up with duplicate commits
      eventually, I prefer that over having these issues pending.
      
      The third one is just me getting rid of another BUG_ON() just because it
      was reported and I dislike those things so much.
      
      * merge 'hot-fixes' branch:
        ida: don't use BUG_ON() for debugging
        drm/aperture: Run fbdev removal before internal helpers
        ptrace: fix clearing of JOBCTL_TRACED in ptrace_unfreeze_traced()
      24f4b40e
    • Linus Torvalds's avatar
      ida: don't use BUG_ON() for debugging · fc82bbf4
      Linus Torvalds authored
      This is another old BUG_ON() that just shouldn't exist (see also commit
      a382f8fe: "signal handling: don't use BUG_ON() for debugging").
      
      In fact, as Matthew Wilcox points out, this condition shouldn't really
      even result in a warning, since a negative id allocation result is just
      a normal allocation failure:
      
        "I wonder if we should even warn here -- sure, the caller is trying to
         free something that wasn't allocated, but we don't warn for
         kfree(NULL)"
      
      and goes on to point out how that current error check is only causing
      people to unnecessarily do their own index range checking before freeing
      it.
      
      This was noted by Itay Iellin, because the bluetooth HCI socket cookie
      code does *not* do that range checking, and ends up just freeing the
      error case too, triggering the BUG_ON().
      
      The HCI code requires CAP_NET_RAW, and seems to just result in an ugly
      splat, but there really is no reason to BUG_ON() here, and we have
      generally striven for allocation models where it's always ok to just do
      
          free(alloc());
      
      even if the allocation were to fail for some random reason (usually
      obviously that "random" reason being some resource limit).
      
      Fixes: 88eca020 ("ida: simplified functions for id allocation")
      Reported-by: default avatarItay Iellin <ieitayie@gmail.com>
      Suggested-by: default avatarMatthew Wilcox <willy@infradead.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      fc82bbf4
    • Linus Torvalds's avatar
      Merge tag 'dmaengine-fix-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine · 952c53cd
      Linus Torvalds authored
      Pull dmaengine fixes from Vinod Koul:
       "One core fix for DMA_INTERRUPT and rest driver fixes.
      
        Core:
      
         - Revert verification of DMA_INTERRUPT capability as that was
           incorrect
      
        Bunch of driver fixes for:
      
         - ti: refcount and put_device leak
      
         - qcom_bam: runtime pm overflow
      
         - idxd: force wq context cleanup and call idxd_enable_system_pasid()
           on success
      
         - dw-axi-dmac: RMW on channel suspend register
      
         - imx-sdma: restart cyclic channel when enabled
      
         - at_xdma: error handling for at_xdmac_alloc_desc
      
         - pl330: lockdep warning
      
         - lgm: error handling path in probe
      
         - allwinner: Fix min/max typo in binding"
      
      * tag 'dmaengine-fix-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine:
        dt-bindings: dma: allwinner,sun50i-a64-dma: Fix min/max typo
        dmaengine: lgm: Fix an error handling path in intel_ldma_probe()
        dmaengine: pl330: Fix lockdep warning about non-static key
        dmaengine: idxd: Only call idxd_enable_system_pasid() if succeeded in enabling SVA feature
        dmaengine: at_xdma: handle errors of at_xdmac_alloc_desc() correctly
        dmaengine: imx-sdma: only restart cyclic channel when enabled
        dmaengine: dw-axi-dmac: Fix RMW on channel suspend register
        dmaengine: idxd: force wq context cleanup on device disable path
        dmaengine: qcom: bam_dma: fix runtime PM underflow
        dmaengine: imx-sdma: Allow imx8m for imx7 FW revs
        dmaengine: Revert "dmaengine: add verification of DMA_INTERRUPT capability for dmatest"
        dmaengine: ti: Add missing put_device in ti_dra7_xbar_route_allocate
        dmaengine: ti: Fix refcount leak in ti_dra7_xbar_route_allocate
      952c53cd
    • Linus Torvalds's avatar
      Merge tag 'staging-5.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging · 5867f3b8
      Linus Torvalds authored
      Pull staging driver fix from Greg KH:
       "Here is a single staging driver fix for a reported problem that showed
        up in 5.19-rc1 in the wlan-ng driver. It has been in linux-next for a
        week with no reported problems"
      
      * tag 'staging-5.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
        staging/wlan-ng: get the correct struct hfa384x in work callback
      5867f3b8
    • Linus Torvalds's avatar
      Merge tag 'char-misc-5.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc · b41362fd
      Linus Torvalds authored
      Pull char/misc driver fixes from Greg KH:
       "Here are four small char/misc driver fixes for 5.19-rc6 to resolve
        some reported issues. They only affect two drivers:
      
         - rtsx_usb: fix for of-reported DMA warning error, the driver was
           handling memory buffers in odd ways, it has now been fixed up to be
           much simpler and correct by Shuah.
      
         - at25 eeprom driver bugfix for reported problem
      
        All of these have been in linux-next for a week with no reported
        problems"
      
      * tag 'char-misc-5.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
        misc: rtsx_usb: set return value in rsp_buf alloc err path
        misc: rtsx_usb: use separate command and response buffers
        misc: rtsx_usb: fix use of dma mapped buffer for usb bulk transfer
        eeprom: at25: Rework buggy read splitting
      b41362fd
    • Linus Torvalds's avatar
      Merge tag 'io_uring-5.19-2022-07-09' of git://git.kernel.dk/linux-block · d9919d43
      Linus Torvalds authored
      Pull io_uring fix from Jens Axboe:
       "A single fix for an issue that came up yesterday that we should plug
        for -rc6.
      
        This is a regression introduced in this cycle"
      
      * tag 'io_uring-5.19-2022-07-09' of git://git.kernel.dk/linux-block:
        io_uring: check that we have a file table when allocating update slots
      d9919d43
    • Linus Torvalds's avatar
      Merge tag 'kbuild-fixes-v5.19-3' of... · 2fbd36df
      Linus Torvalds authored
      Merge tag 'kbuild-fixes-v5.19-3' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild
      
      Pull Kbuild fixes from Masahiro Yamada:
      
       - Adjust gen_compile_commands.py to the format change of *.mod files
      
       - Remove unused macro in scripts/Makefile.modinst
      
      * tag 'kbuild-fixes-v5.19-3' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild:
        kbuild: remove unused cmd_none in scripts/Makefile.modinst
        gen_compile_commands: handle multiple lines per .mod file
      2fbd36df
    • Linus Torvalds's avatar
      Merge tag 'irq_urgent_for_v5.19_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 2b9b31ce
      Linus Torvalds authored
      Pull irq fixes from Borislav Petkov:
      
       - Gracefully handle failure to request MMIO resources in the GICv3
         driver
      
       - Make a static key static in the Apple AIC driver
      
       - Fix the Xilinx intc driver dependency on OF_ADDRESS
      
      * tag 'irq_urgent_for_v5.19_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        irqchip/apple-aic: Make symbol 'use_fast_ipi' static
        irqchip/xilinx: Add explicit dependency on OF_ADDRESS
        irqchip/gicv3: Handle resource request failure consistently
      2b9b31ce
    • Linus Torvalds's avatar
      Merge tag 'x86_urgent_for_v5.19_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 74a0032b
      Linus Torvalds authored
      Pull x86 fixes from Borislav Petkov:
      
       - Prepare for and clear .brk early in order to address XenPV guests
         failures where the hypervisor verifies page tables and uninitialized
         data in that range leads to bogus failures in those checks
      
       - Add any potential setup_data entries supplied at boot to the identity
         pagetable mappings to prevent kexec kernel boot failures. Usually,
         this is not a problem for the normal kernel as those mappings are
         part of the initially mapped 2M pages but if kexec gets to allocate
         the second kernel somewhere else, those setup_data entries need to be
         mapped there too.
      
       - Fix objtool not to discard text references from the __tracepoints
         section so that ENDBR validation still works
      
       - Correct the setup_data types limit as it is user-visible, before 5.19
         releases
      
      * tag 'x86_urgent_for_v5.19_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/boot: Fix the setup data types max limit
        x86/ibt, objtool: Don't discard text references from tracepoint section
        x86/compressed/64: Add identity mappings for setup_data entries
        x86: Fix .brk attribute in linker script
        x86: Clear .brk area at early boot
        x86/xen: Use clear_bss() for Xen PV guests
      74a0032b
    • Masahiro Yamada's avatar
      kbuild: remove unused cmd_none in scripts/Makefile.modinst · f5a46185
      Masahiro Yamada authored
      Commit 65ce9c38 ("kbuild: move module strip/compression code into
      scripts/Makefile.modinst") added this unused code.
      
      Perhaps, I thought cmd_none was useful for CONFIG_MODULE_COMPRESS_NONE,
      but I did not use it after all.
      Signed-off-by: default avatarMasahiro Yamada <masahiroy@kernel.org>
      Reviewed-by: default avatarNick Desaulniers <ndesaulniers@google.com>
      f5a46185
    • Borislav Petkov's avatar
      x86/boot: Fix the setup data types max limit · cb8a4bea
      Borislav Petkov authored
      Commit in Fixes forgot to change the SETUP_TYPE_MAX definition which
      contains the highest valid setup data type.
      
      Correct that.
      
      Fixes: 5ea98e01 ("x86/boot: Add Confidential Computing type to setup_data")
      Signed-off-by: default avatarBorislav Petkov <bp@suse.de>
      Link: https://lore.kernel.org/r/ddba81dd-cc92-699c-5274-785396a17fb5@zytor.com
      cb8a4bea
  3. 09 Jul, 2022 5 commits
    • Linus Torvalds's avatar
      Merge tag 'i2c-for-5.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux · b1c428b6
      Linus Torvalds authored
      Pull i2c fixes from Wolfram Sang:
       "Two I2C driver bugfixes preventing resource leaks"
      
      * tag 'i2c-for-5.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
        i2c: cadence: Unregister the clk notifier in error path
        i2c: piix4: Fix a memory leak in the EFCH MMIO support
      b1c428b6
    • Thomas Zimmermann's avatar
      drm/aperture: Run fbdev removal before internal helpers · 84499c5d
      Thomas Zimmermann authored
      Always run fbdev removal first to remove simpledrm via sysfb_disable().
      This clears the internal state.
      
      The later call to drm_aperture_detach_drivers() then does nothing.
      Otherwise, with drm_aperture_detach_drivers() running first, the call to
      sysfb_disable() uses inconsistent state.
      
      Example backtrace show below:
      
        BUG: KASAN: use-after-free in device_del+0x79/0x5f0
        Read of size 8 at addr ffff888108185050 by task systemd-udevd/311
        CPU: 0 PID: 311 Comm: systemd-udevd Tainted: G            E     5.19.0-rc2-1-default+ #1689
        Hardware name: HP ProLiant DL120 G7, BIOS J01 04/21/2011
        Call Trace:
          device_del+0x79/0x5f0
          platform_device_del.part.0+0x19/0xe0
          platform_device_unregister+0x1c/0x30
          sysfb_disable+0x2d/0x70
          remove_conflicting_framebuffers+0x1c/0xf0
          remove_conflicting_pci_framebuffers+0x130/0x1a0
          drm_aperture_remove_conflicting_pci_framebuffers+0x86/0xb0
          mgag200_pci_probe+0x2d/0x140 [mgag200]
      Signed-off-by: default avatarThomas Zimmermann <tzimmermann@suse.de>
      Fixes: 873eb3b1 ("fbdev: Disable sysfb device registration when removing conflicting FBs")
      Cc: Javier Martinez Canillas <javierm@redhat.com>
      Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
      Cc: Daniel Vetter <daniel@ffwll.ch>
      Cc: Sam Ravnborg <sam@ravnborg.org>
      Cc: Helge Deller <deller@gmx.de>
      Cc: Thomas Zimmermann <tzimmermann@suse.de>
      Cc: Alex Deucher <alexander.deucher@amd.com>
      Cc: Zhen Lei <thunder.leizhen@huawei.com>
      Cc: Changcheng Deng <deng.changcheng@zte.com.cn>
      Reviewed-by: default avatarZack Rusin <zackr@vmware.com>
      Reviewed-by: default avatarJavier Martinez Canillas <javierm@redhat.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      84499c5d
    • Sven Schnelle's avatar
      ptrace: fix clearing of JOBCTL_TRACED in ptrace_unfreeze_traced() · de2a3477
      Sven Schnelle authored
      CI reported the following splat while running the strace testsuite:
      
        WARNING: CPU: 1 PID: 3570031 at kernel/ptrace.c:272 ptrace_check_attach+0x12e/0x178
        CPU: 1 PID: 3570031 Comm: strace Tainted: G           OE     5.19.0-20220624.rc3.git0.ee819a77d4e7.300.fc36.s390x #1
        Hardware name: IBM 3906 M04 704 (z/VM 7.1.0)
        Call Trace:
         [<00000000ab4b645a>] ptrace_check_attach+0x132/0x178
        ([<00000000ab4b6450>] ptrace_check_attach+0x128/0x178)
         [<00000000ab4b6cde>] __s390x_sys_ptrace+0x86/0x160
         [<00000000ac03fcec>] __do_syscall+0x1d4/0x200
         [<00000000ac04e312>] system_call+0x82/0xb0
        Last Breaking-Event-Address:
         [<00000000ab4ea3c8>] wait_task_inactive+0x98/0x190
      
      This is because JOBCTL_TRACED is set, but the task is not in TASK_TRACED
      state. Caused by ptrace_unfreeze_traced() which does:
      
      	task->jobctl &= ~TASK_TRACED
      
      but it should be:
      
      	task->jobctl &= ~JOBCTL_TRACED
      
      Fixes: 31cae1ea ("sched,signal,ptrace: Rework TASK_TRACED, TASK_STOPPED state")
      Signed-off-by: default avatarSven Schnelle <svens@linux.ibm.com>
      Tested-by: default avatarAlexander Gordeev <agordeev@linux.ibm.com>
      Acked-by: default avatarOleg Nesterov <oleg@redhat.com>
      Acked-by: default avatarPeter Zijlstra <peterz@infradead.org>
      Cc: Eric Biederman <ebiederm@xmission.com>
      Cc: Steven Rostedt <rostedt@goodmis.org>
      Cc: Kees Cook <keescook@chromium.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      de2a3477
    • Linus Torvalds's avatar
      Merge tag 'powerpc-5.19-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux · d9cdc3b1
      Linus Torvalds authored
      Pull powerpc fix from Michael Ellerman:
      
       - On Power8 bare metal, fix creation of RNG platform devices, which are
         needed for the /dev/hwrng driver to probe correctly.
      
      Thanks to Jason A. Donenfeld, and Sachin Sant.
      
      * tag 'powerpc-5.19-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
        powerpc/powernv: delay rng platform device creation until later in boot
      d9cdc3b1
    • Jens Axboe's avatar
      io_uring: check that we have a file table when allocating update slots · d785a773
      Jens Axboe authored
      If IORING_FILE_INDEX_ALLOC is set asking for an allocated slot, the
      helper doesn't check if we actually have a file table or not. The non
      alloc path does do that correctly, and returns -ENXIO if we haven't set
      one up.
      
      Do the same for the allocated path, avoiding a NULL pointer dereference
      when trying to find a free bit.
      
      Fixes: a7c41b46 ("io_uring: let IORING_OP_FILES_UPDATE support choosing fixed file slots")
      Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      d785a773
  4. 08 Jul, 2022 12 commits