Allow to save stacktraces into a histogram variable. This will be used by
synthetic events to allow a stacktrace from one event to be passed and
displayed by another event.

The special keyword "stacktrace" is to be used to trigger a stack
trace for the event that the histogram trigger is attached to.

  echo 'hist:keys=pid:st=stacktrace" > events/sched/sched_waking/trigger

Currently nothing can get access to the "$st" variable above that contains
the stack trace, but that will soon change.

Link: https://lkml.kernel.org/r/20230117152235.856323729@goodmis.org

Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Tom Zanussi <zanussi@kernel.org>
Cc: Ross Zwisler <zwisler@google.com>
Cc: Ching-lin Yu <chinglinyu@google.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>

When tracing a dynamic string field for a synthetic event, the offset
calculation for where to write the next event can use struct_size() to
find what the current size of the structure is.

This simplifies the code and makes it less error prone.

Link: https://lkml.kernel.org/r/20230117152235.698632147@goodmis.org

Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Tom Zanussi <zanussi@kernel.org>
Cc: Ross Zwisler <zwisler@google.com>
Cc: Ching-lin Yu <chinglinyu@google.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>

In a previous commit 7433632c, buffer, buffer->buffers and
buffer->buffers[cpu] in ring_buffer_wake_waiters() can be NULL,
and thus the related checks are added.

However, in the same call stack, these variables are also used in
ring_buffer_free_read_page():

tracing_buffers_release()
  ring_buffer_wake_waiters(iter->array_buffer->buffer)
    cpu_buffer = buffer->buffers[cpu] -> Add checks by previous commit
  ring_buffer_free_read_page(iter->array_buffer->buffer)
    cpu_buffer = buffer->buffers[cpu] -> No check

Thus, to avod possible null-pointer derefernces, the related checks
should be added.

These results are reported by a static tool designed by myself.

Link: https://lkml.kernel.org/r/20230113125501.760324-1-baijiaju1990@gmail.comReported-by: TOTE Robot <oslab@tsinghua.edu.cn>
Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>

When reworking core ftrace code or architectural ftrace code, it's often
necessary to test/analyse/benchmark a number of ftrace_ops
configurations. This patch adds a module which can be used to explore
some of those configurations.

I'm using this to benchmark various options for changing the way
trampolines and handling of ftrace_ops work on arm64, and ensuring other
architectures aren't adversely affected.

For example, in a QEMU+KVM VM running on a 2GHz Xeon E5-2660
workstation, loading the module in various configurations produces:

| # insmod ftrace-ops.ko
| ftrace_ops: registering:
|   relevant ops: 1
|     tracee: tracee_relevant [ftrace_ops]
|     tracer: ops_func_nop [ftrace_ops]
|   irrelevant ops: 0
|     tracee: tracee_irrelevant [ftrace_ops]
|     tracer: ops_func_nop [ftrace_ops]
|   saving registers: NO
|   assist recursion: NO
|   assist RCU: NO
| ftrace_ops: Attempted 100000 calls to tracee_relevant [ftrace_ops] in 1681558ns (16ns / call)

| # insmod ftrace-ops.ko nr_ops_irrelevant=5
| ftrace_ops: registering:
|   relevant ops: 1
|     tracee: tracee_relevant [ftrace_ops]
|     tracer: ops_func_nop [ftrace_ops]
|   irrelevant ops: 5
|     tracee: tracee_irrelevant [ftrace_ops]
|     tracer: ops_func_nop [ftrace_ops]
|   saving registers: NO
|   assist recursion: NO
|   assist RCU: NO
| ftrace_ops: Attempted 100000 calls to tracee_relevant [ftrace_ops] in 1693042ns (16ns / call)

| # insmod ftrace-ops.ko nr_ops_relevant=2
| ftrace_ops: registering:
|   relevant ops: 2
|     tracee: tracee_relevant [ftrace_ops]
|     tracer: ops_func_nop [ftrace_ops]
|   irrelevant ops: 0
|     tracee: tracee_irrelevant [ftrace_ops]
|     tracer: ops_func_nop [ftrace_ops]
|   saving registers: NO
|   assist recursion: NO
|   assist RCU: NO
| ftrace_ops: Attempted 100000 calls to tracee_relevant [ftrace_ops] in 11965582ns (119ns / call)

| # insmod ftrace-ops.ko save_regs=true
| ftrace_ops: registering:
|   relevant ops: 1
|     tracee: tracee_relevant [ftrace_ops]
|     tracer: ops_func_nop [ftrace_ops]
|   irrelevant ops: 0
|     tracee: tracee_irrelevant [ftrace_ops]
|     tracer: ops_func_nop [ftrace_ops]
|   saving registers: YES
|   assist recursion: NO
|   assist RCU: NO
| ftrace_ops: Attempted 100000 calls to tracee_relevant [ftrace_ops] in 4459624ns (44ns / call)

Link: https://lkml.kernel.org/r/20230103124912.2948963-4-mark.rutland@arm.com

Cc: Florent Revest <revest@chromium.org>
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>

With the new filter logic of passing in the name of a function to match an
instruction pointer (or the address of the function), add a test to make
sure that it is functional.

This is also the first test to test plain filtering. The filtering has
been tested via the trigger logic, which uses the same code, but there was
nothing to test just the event filter, so this test is the first to add
such a case.

Link: https://lkml.kernel.org/r/20221219183214.075559302@goodmis.org

Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Tom Zanussi <zanussi@kernel.org>
Cc: Zheng Yejian <zhengyejian1@huawei.com>
Cc: linux-kselftest@vger.kernel.org
Suggested-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Reviewed-by: Ross Zwisler <zwisler@google.com>
Acked-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>

There's been several times where an event records a function address in
its field and I needed to filter on that address for a specific function
name. It required looking up the function in kallsyms, finding its size,
and doing a compare of "field >= function_start && field < function_end".

But this would change from boot to boot and is unreliable in scripts.
Also, it is useful to have this at boot up, where the addresses will not
be known. For example, on the boot command line:

  trace_trigger="initcall_finish.traceoff if func.function == acpi_init"

To implement this, add a ".function" prefix, that will check that the
field is of size long, and the only operations allowed (so far) are "=="
and "!=".

Link: https://lkml.kernel.org/r/20221219183213.916833763@goodmis.org

Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Tom Zanussi <zanussi@kernel.org>
Cc: Zheng Yejian <zhengyejian1@huawei.com>
Reviewed-by: Ross Zwisler <zwisler@google.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>

The pointer ptr is being initialized with a value that is never read,
it is being updated later on a call to strim. Remove the extraneous
initialization.

Link: https://lkml.kernel.org/r/20230116161612.77192-1-colin.i.king@gmail.com

Cc: Daniel Bristot de Oliveira <bristot@kernel.org>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>

There's no entry in MAINTAINERS for samples/ftrace. Add one so that the
FTRACE maintainers are kept in the loop.

Link: https://lkml.kernel.org/r/20230103124912.2948963-2-mark.rutland@arm.comAcked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>

Use the 'struct' keyword for a struct's kernel-doc notation and
use the correct function parameter name to eliminate kernel-doc
warnings:

kernel/trace/trace_events_filter.c:136: warning: cannot understand function prototype: 'struct prog_entry '
kerne/trace/trace_events_filter.c:155: warning: Excess function parameter 'when_to_branch' description in 'update_preds'

Also correct some trivial punctuation problems.

Link: https://lkml.kernel.org/r/20230108021238.16398-1-rdunlap@infradead.orgSigned-off-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>

Fix spelling in lib/ Kconfig files.
(reported by codespell)

Link: https://lkml.kernel.org/r/20230124181655.16269-1-rdunlap@infradead.org

Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Marco Elver <elver@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: kasan-dev@googlegroups.com
Reviewed-by: Marco Elver <elver@google.com>
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>

Function 'create_hist_field' is called recursively at
trace_events_hist.c:1954 and can return NULL-value that's why we have
to check it to avoid null pointer dereference.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Link: https://lkml.kernel.org/r/20230111120409.4111-1-n.petrova@fintech.ru

Cc: stable@vger.kernel.org
Fixes: 30350d65 ("tracing: Add variable support to hist triggers")
Signed-off-by: Natalia Petrova <n.petrova@fintech.ru>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>

list_for_each_entry_rcu() has built-in RCU and lock checking.

Pass cond argument to list_for_each_entry_rcu() to silence false lockdep
warning when CONFIG_PROVE_RCU_LIST is enabled.

Execute as follow:

 [tracing]# echo osnoise > current_tracer
 [tracing]# echo 1 > tracing_on
 [tracing]# echo 0 > tracing_on

The trace_types_lock is held when osnoise_tracer_stop() or
timerlat_tracer_stop() are called in the non-RCU read side section.
So, pass lockdep_is_held(&trace_types_lock) to silence false lockdep
warning.

Link: https://lkml.kernel.org/r/20221227023036.784337-1-nashuiliang@gmail.com

Cc: Masami Hiramatsu <mhiramat@kernel.org>
Fixes: dae18134 ("tracing/osnoise: Support a list of trace_array *tr")
Acked-by: Daniel Bristot de Oliveira <bristot@kernel.org>
Signed-off-by: Chuang Wang <nashuiliang@gmail.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>

Fix some editorial nits in trace Kconfig.

Link: https://lkml.kernel.org/r/20230124181647.15902-1-rdunlap@infradead.orgSigned-off-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>

The instructions for the ftrace-bisect.sh script, which is used to find
what function is being traced that is causing a kernel crash, and possibly
a triple fault reboot, uses the old method. In 5.1, a new feature was
added that let the user write in the index into available_filter_functions
that maps to the function a user wants to set in set_ftrace_filter (or
set_ftrace_notrace). This takes O(1) to set, as suppose to writing a
function name, which takes O(n) (where n is the number of functions in
available_filter_functions).

The ftrace-bisect.sh requires setting half of the functions in
available_filter_functions, which is O(n^2) using the name method to enable
and can take several minutes to complete. The number method is O(n) which
takes less than a second to complete. Using the number method for any
kernel 5.1 and after is the proper way to do the bisect.

Update the usage to reflect the new change, as well as using the
/sys/kernel/tracing path instead of the obsolete debugfs path.

Link: https://lkml.kernel.org/r/20230123112252.022003dd@gandalf.local.home

Cc: stable@vger.kernel.org
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Acked-by: Mark Rutland <mark.rutland@arm.com>
Fixes: f79b3f33 ("ftrace: Allow enabling of filters via index of available_filter_functions")
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>

Currently trace_printk() can be used as soon as early_trace_init() is
called from start_kernel(). But if a crash happens, and
"ftrace_dump_on_oops" is set on the kernel command line, all you get will
be:

  [    0.456075]   <idle>-0         0dN.2. 347519us : Unknown type 6
  [    0.456075]   <idle>-0         0dN.2. 353141us : Unknown type 6
  [    0.456075]   <idle>-0         0dN.2. 358684us : Unknown type 6

This is because the trace_printk() event (type 6) hasn't been registered
yet. That gets done via an early_initcall(), which may be early, but not
early enough.

Instead of registering the trace_printk() event (and other ftrace events,
which are not trace events) via an early_initcall(), have them registered at
the same time that trace_printk() can be used. This way, if there is a
crash before early_initcall(), then the trace_printk()s will actually be
useful.

Link: https://lkml.kernel.org/r/20230104161412.019f6c55@gandalf.local.home

Cc: stable@vger.kernel.org
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Fixes: e725c731 ("tracing: Split tracing initialization into two for early initialization")
Reported-by: "Joel Fernandes (Google)" <joel@joelfernandes.org>
Tested-by: Joel Fernandes (Google) <joel@joelfernandes.org>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>

Setting filters on an ftrace ops results in some memory being allocated
for the filter hashes, which must be freed before the ops can be freed.
This can be done by removing every individual element of the hash by
calling ftrace_set_filter_ip() or ftrace_set_filter_ips() with `remove`
set, but this is somewhat error prone as it's easy to forget to remove
an element.

Make it easier to clean this up by exporting ftrace_free_filter(), which
can be used to clean up all of the filter hashes after an ftrace_ops has
been unregistered.

Using this, fix the ftrace-direct* samples to free hashes prior to being
unloaded. All other code either removes individual filters explicitly or
is built-in and already calls ftrace_free_filter().

Link: https://lkml.kernel.org/r/20230103124912.2948963-3-mark.rutland@arm.com

Cc: stable@vger.kernel.org
Cc: Florent Revest <revest@chromium.org>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Fixes: e1067a07 ("ftrace/samples: Add module to test multi direct modify interface")
Fixes: 5fae941b ("ftrace/samples: Add multi direct interface test module")
Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>

Pull another io_uring fix from Jens Axboe:
 "Just a single fix for a regression that happened in this release due
  to a poll change. Normally I would've just deferred it to next week,
  but since the original fix got picked up by stable, I think it's
  better to just send this one off separately.

  The issue is around the poll race fix, and how it mistakenly also got
  applied to multishot polling. Those don't need the race fix, and we
  should not be doing any reissues for that case. Exhaustive test cases
  were written and committed to the liburing regression suite for the
  reported issue, and additions for similar issues"

* tag 'io_uring-6.2-2023-01-21' of git://git.kernel.dk/linux:
  io_uring/poll: don't reissue in case of poll race on multishot request

Pull char/misc driver fixes from Greg KH:
 "Here are some small char/misc and other subsystem driver fixes for
  6.2-rc5 to resolve a few reported issues. They include:

   - long time pending fastrpc fixes (should have gone into 6.1, my
     fault)

   - mei driver/bus fixes and new device ids

   - interconnect driver fixes for reported problems

   - vmci bugfix

   - w1 driver bugfixes for reported problems

  Almost all of these have been in linux-next with no reported problems,
  the rest have all passed 0-day bot testing in my tree and on the
  mailing lists where they have sat too long due to me taking a long
  time to catch up on my pending patch queue"

* tag 'char-misc-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
  VMCI: Use threaded irqs instead of tasklets
  misc: fastrpc: Pass bitfield into qcom_scm_assign_mem
  gsmi: fix null-deref in gsmi_get_variable
  misc: fastrpc: Fix use-after-free race condition for maps
  misc: fastrpc: Don't remove map on creater_process and device_release
  misc: fastrpc: Fix use-after-free and race in fastrpc_map_find
  misc: fastrpc: fix error code in fastrpc_req_mmap()
  mei: me: add meteor lake point M DID
  mei: bus: fix unlink on bus in error path
  w1: fix WARNING after calling w1_process()
  w1: fix deadloop in __w1_remove_master_device()
  comedi: adv_pci1760: Fix PWM instruction handling
  interconnect: qcom: rpm: Use _optional func for provider clocks
  interconnect: qcom: msm8996: Fix regmap max_register values
  interconnect: qcom: msm8996: Provide UFS clocks to A2NoC
  dt-bindings: interconnect: Add UFS clocks to MSM8996 A2NoC

Pull driver core fixes from Greg KH:
 "Here are three small driver and kernel core fixes for 6.2-rc5. They
  include:

   - potential gadget fixup in do_prlimit

   - device property refcount leak fix

   - test_async_probe bugfix for reported problem"

* tag 'driver-core-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core:
  prlimit: do_prlimit needs to have a speculation check
  driver core: Fix test_async_probe_init saves device in wrong array
  device property: fix of node refcount leak in fwnode_graph_get_next_endpoint()

Pull staging driver fix from Greg KH:
 "Here is a single staging driver fix for 6.2-rc5. It resolves a build
  issue reported and Fixed by Arnd in the vc04_services driver. It's
  been in linux-next this week with no reported problems"

* tag 'staging-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
  staging: vchiq_arm: fix enum vchiq_status return types

Pull tty/serial driver fixes from Greg KH:
 "Here are some small tty and serial driver fixes for 6.2-rc5 that
  resolve a number of tiny reported issues and some new device ids. They
  include:

   - new device id for the exar serial driver

   - speakup tty driver bugfix

   - atmel serial driver baudrate fixup

   - stm32 serial driver bugfix and then revert as the bugfix broke the
     build. That will come back in a later pull request once it is all
     worked out properly.

   - amba-pl011 serial driver rs486 mode bugfix

   - qcom_geni serial driver bugfix

  Most of these have been in linux-next with no reported problems (well,
  other than the build breakage which generated the revert), the new
  device id passed 0-day testing"

* tag 'tty-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
  serial: exar: Add support for Sealevel 7xxxC serial cards
  Revert "serial: stm32: Merge hard IRQ and threaded IRQ handling into single IRQ handler"
  tty: serial: qcom_geni: avoid duplicate struct member init
  serial: atmel: fix incorrect baudrate setup
  tty: fix possible null-ptr-defer in spk_ttyio_release
  serial: stm32: Merge hard IRQ and threaded IRQ handling into single IRQ handler
  serial: amba-pl011: fix high priority character transmission in rs486 mode
  serial: pch_uart: Pass correct sg to dma_unmap_sg()
  tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer

Pull USB / Thunderbolt fixes from Greg KH:
 "Here are a number of small USB and Thunderbolt driver fixes and new
  device id changes for 6.2-rc5. Included in here are:

   - thunderbolt bugfixes for reported problems

   - new usb-serial driver ids added

   - onboard_hub usb driver fixes for much-reported problems

   - xhci bugfixes

   - typec bugfixes

   - ehci-fsl driver module alias fix

   - iowarrior header size fix

   - usb gadget driver fixes

  All of these, except for the iowarrior fix, have been in linux-next
  with no reported issues. The iowarrior fix passed the 0-day testing
  and is a one digit change based on a reported problem in the driver
  (which was written to a spec, not the real device that is now
  available)"

* tag 'usb-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (40 commits)
  USB: misc: iowarrior: fix up header size for USB_DEVICE_ID_CODEMERCS_IOW100
  usb: host: ehci-fsl: Fix module alias
  usb: dwc3: fix extcon dependency
  usb: core: hub: disable autosuspend for TI TUSB8041
  USB: fix misleading usb_set_intfdata() kernel doc
  usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate()
  USB: gadget: Add ID numbers to configfs-gadget driver names
  usb: typec: tcpm: Fix altmode re-registration causes sysfs create fail
  usb: gadget: g_webcam: Send color matching descriptor per frame
  usb: typec: altmodes/displayport: Use proper macro for pin assignment check
  usb: typec: altmodes/displayport: Fix pin assignment calculation
  usb: typec: altmodes/displayport: Add pin assignment helper
  usb: gadget: f_fs: Ensure ep0req is dequeued before free_request
  usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait
  usb: misc: onboard_hub: Move 'attach' work to the driver
  usb: misc: onboard_hub: Invert driver registration order
  usb: ucsi: Ensure connector delayed work items are flushed
  usb: musb: fix error return code in omap2430_probe()
  usb: chipidea: core: fix possible constant 0 if use IS_ERR(ci->role_switch)
  xhci: Detect lpm incapable xHC USB3 roothub ports from ACPI tables
  ...

Merge tag 'kbuild-fixes-v6.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild

Pull Kbuild fixes from Masahiro Yamada:

 - Hide LDFLAGS_vmlinux from decompressor Makefiles to fix error
   messages when GNU Make 4.4 is used.

 - Fix 'make modules' build error when CONFIG_DEBUG_INFO_BTF_MODULES=y.

 - Fix warnings emitted by GNU Make 4.4 in scripts/kconfig/Makefile.

 - Support GNU Make 4.4 for scripts/jobserver-exec.

 - Show clearer error message when kernel/gen_kheaders.sh fails due to
   missing cpio.

* tag 'kbuild-fixes-v6.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild:
  kheaders: explicitly validate existence of cpio command
  scripts: support GNU make 4.4 in jobserver-exec
  kconfig: Update all declared targets
  scripts: rpm: make clear that mkspec script contains 4.13 feature
  init/Kconfig: fix LOCALVERSION_AUTO help text
  kbuild: fix 'make modules' error when CONFIG_DEBUG_INFO_BTF_MODULES=y
  kbuild: export top-level LDFLAGS_vmlinux only to scripts/Makefile.vmlinux
  init/version-timestamp.c: remove unneeded #include <linux/version.h>
  docs: kbuild: remove mention to dropped $(objtree) feature

We potentially have old hashes of the xattr names generated on systems
with signed 'char' types.  Now that everybody uses '-funsigned-char',
those hashes will no longer match.

This only happens if you use xattrs names that have the high bit set,
which probably doesn't happen in practice, but the xfstest generic/454
shows it.

Instead of adding a new "signed xattr hash filesystem" bit and having to
deal with all the possible combinations, just calculate the hash both
ways if the first one fails, and always generate new hashes with the
proper unsigned char version.
Reported-by: kernel test robot <oliver.sang@intel.com>
Link: https://lore.kernel.org/oe-lkp/202212291509.704a11c9-oliver.sang@intel.com
Link: https://lore.kernel.org/all/CAHk-=whUNjwqZXa-MH9KMmc_CpQpoFKFjAB9ZKHuu=TbsouT4A@mail.gmail.com/
Exposed-by: 3bc753c0 ("kbuild: treat char as always unsigned")
Cc: Eric Biggers <ebiggers@kernel.org>
Cc: Andreas Dilger <adilger@dilger.ca>
Cc: Theodore Ts'o <tytso@mit.edu>,
Cc: Jason Donenfeld <Jason@zx2c4.com>
Cc: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

do_prlimit() adds the user-controlled resource value to a pointer that
will subsequently be dereferenced.  In order to help prevent this
codepath from being used as a spectre "gadget" a barrier needs to be
added after checking the range.
Reported-by: Jordy Zomer <jordyzomer@google.com>
Tested-by: Jordy Zomer <jordyzomer@google.com>
Suggested-by: Linus Torvalds <torvalds@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Pull gpio fixes from Bartosz Golaszewski:

 - fix a potential race condition and always set GPIOs used as interrupt
   source to input in gpio-mxc

 - fix a GPIO ACPI-related issue with system suspend on Clevo NL5xRU

* tag 'gpio-fixes-for-v6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
  gpiolib: acpi: Add a ignore wakeup quirk for Clevo NL5xRU
  gpiolib: acpi: Allow ignoring wake capability on pins that aren't in _AEI
  gpio: mxc: Always set GPIOs used as interrupt source to INPUT mode
  gpio: mxc: Protect GPIO irqchip RMW with bgpio spinlock

Pull cifs fixes from Steve French:

 - important fix for packet signature calculation error

 - three fixes to correct DFS deadlock, and DFS refresh problem

 - remove an unused DFS function, and duplicate tcon refresh code

 - DFS cache lookup fix

 - uninitialized rc fix

* tag '6.2-rc4-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6:
  cifs: remove unused function
  cifs: do not include page data when checking signature
  cifs: fix return of uninitialized rc in dfs_cache_update_tgthint()
  cifs: handle cache lookup errors different than -ENOENT
  cifs: remove duplicate code in __refresh_tcon()
  cifs: don't take exclusive lock for updating target hints
  cifs: avoid re-lookups in dfs_cache_find()
  cifs: fix potential deadlock in cache_refresh_path()

Pull pin control fixes from Linus Walleij:

 - Compilation fix for Sunplus sp7021

 - Add some missing headers after a cleanup to the Nomadik driver

 - Fix pull type and mux routes on Rockchip RK3568

* tag 'pinctrl-v6.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
  pinctrl: rockchip: fix mux route data for rk3568
  pinctrl: rockchip: fix reading pull type on rk3568
  pinctrl: nomadik: Add missing header(s)
  pinctrl: sp7021: fix unused function warning

Pull rdma fixes from Jason Gunthorpe:

 - Several hfi1 patches fixing some long standing driver bugs

 - Overflow when working with sg lists with elements greater than 4G

 - An rxe regression with object numbering after the mrs reach their
   limit

 - A theoretical problem with the scatterlist merging code

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
  lib/scatterlist: Fix to calculate the last_pg properly
  IB/hfi1: Remove user expected buffer invalidate race
  IB/hfi1: Immediately remove invalid memory from hardware
  IB/hfi1: Fix expected receive setup error exit issues
  IB/hfi1: Reserve user expected TIDs
  IB/hfi1: Reject a zero-length user expected buffer
  RDMA/core: Fix ib block iterator counter overflow
  RDMA/rxe: Prevent faulty rkey generation
  RDMA/rxe: Fix inaccurate constants in rxe_type_info

A previous commit fixed a poll race that can occur, but it's only
applicable for multishot requests. For a multishot request, we can safely
ignore a spurious wakeup, as we never leave the waitqueue to begin with.

A blunt reissue of a multishot armed request can cause us to leak a
buffer, if they are ring provided. While this seems like a bug in itself,
it's not really defined behavior to reissue a multishot request directly.
It's less efficient to do so as well, and not required to rearm anything
like it is for singleshot poll requests.

Cc: stable@vger.kernel.org
Fixes: 6e5aedb9 ("io_uring/poll: attempt request issue after racy poll wakeup")
Reported-and-tested-by: Olivier Langlois <olivier@trillion01.com>
Link: https://github.com/axboe/liburing/issues/778Signed-off-by: Jens Axboe <axboe@kernel.dk>

Pull block fixes from Jens Axboe:
 "Various little tweaks all over the place:

   - NVMe pull request via Christoph:
       - fix controller shutdown regression in nvme-apple (Janne Grunau)
       - fix a polling on timeout regression in nvme-pci (Keith Busch)

   - Fix a bug in the read request side request allocation caching
     (Pavel)

   - pktcdvd was brought back after we configured a NULL return on bio
     splits, make it consistent with the others (me)

   - BFQ refcount fix (Yu)

   - Block cgroup policy activation fix (Yu)

   - Fix for an md regression introduced in the 6.2 cycle (Adrian)"

* tag 'block-6.2-2023-01-20' of git://git.kernel.dk/linux:
  nvme-pci: fix timeout request state check
  nvme-apple: only reset the controller when RTKit is running
  nvme-apple: reset controller during shutdown
  block: fix hctx checks for batch allocation
  block/rnbd-clt: fix wrong max ID in ida_alloc_max
  blk-cgroup: fix missing pd_online_fn() while activating policy
  pktcdvd: check for NULL returna fter calling bio_split_to_limits()
  block, bfq: switch 'bfqg->ref' to use atomic refcount apis
  md: fix incorrect declaration about claim_rdev in md_import_device

Pull io_uring fixes from Jens Axboe:
 "Fixes for the MSG_RING opcode. Nothing really major:

   - Fix an overflow missing serialization around posting CQEs to the
     target ring (me)

   - Disable MSG_RING on a ring that isn't enabled yet. There's nothing
     really wrong with allowing it, but 1) it's somewhat odd as nobody
     can receive them yet, and 2) it means that using the right delivery
     mechanism might change. As nobody should be sending CQEs to a ring
     that isn't enabled yet, let's just disable it (Pavel)

   - Tweak to when we decide to post remotely or not for MSG_RING
     (Pavel)"

* tag 'io_uring-6.2-2023-01-20' of git://git.kernel.dk/linux:
  io_uring/msg_ring: fix remote queue to disabled ring
  io_uring/msg_ring: fix flagging remote execution
  io_uring/msg_ring: fix missing lock on overflow for IOPOLL
  io_uring/msg_ring: move double lock/unlock helpers higher up

Pull btrfs fixes from David Sterba:

 - fix potential out-of-bounds access to leaf data when seeking in an
   inline file

 - fix potential crash in quota when rescan races with disable

 - reimplement super block signature scratching by marking page/folio
   dirty and syncing block device, allow removing write_one_page

* tag 'for-6.2-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
  btrfs: fix race between quota rescan and disable leading to NULL pointer deref
  btrfs: fix invalid leaf access due to inline extent during lseek
  btrfs: stop using write_one_page in btrfs_scratch_superblock
  btrfs: factor out scratching of one regular super block

Merge tag 'linux-kselftest-fixes-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest

Pull Kselftest fix from Shuah Khan:
 "Fix an error seen during unconfigured LLVM builds"

* tag 'linux-kselftest-fixes-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest:
  kselftest: Fix error message for unconfigured LLVM builds

Pull thermal control fix from Rafael Wysocki:
 "Modify __thermal_cooling_device_register() to make it call
  put_device() after invoking device_register() and fix up a few error
  paths calling thermal_cooling_device_destroy_sysfs() unnecessarily
  (Viresh Kumar)"

* tag 'thermal-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  thermal: core: call put_device() only after device_register() fails

Pull ACPI fixes from Rafael Wysocki:
 "These update the ACPICA entry in MAINTAINERS, add a backlight handling
  quirk and fix the ACPI PRM (platform runtime) mechanism support.

  Specifics:

   - Update the ACPICA development list address in MAINTAINERS to the
     new one that does not bounce (Rafael Wysocki)

   - Check whether EFI runtime is available when registering the ACPI
     PRM address space handler and when running it (Ard Biesheuvel)

   - Add backlight=native DMI quirk for Acer Aspire 4810T to the ACPI
     video driver (Hans de Goede)"

* tag 'acpi-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  ACPI: PRM: Check whether EFI runtime is available
  ACPI: video: Add backlight=native DMI quirk for Acer Aspire 4810T
  MAINTAINERS: Update the ACPICA development list address

Pull MMC fixes from Ulf Hansson:

 - sunxi-mmc: Fix clock refcount imbalance during unbind

 - sdhci-esdhc-imx: Fix some tuning settings

* tag 'mmc-v6.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
  mmc: sunxi-mmc: Fix clock refcount imbalance during unbind
  mmc: sdhci-esdhc-imx: correct the tuning start tap and step setting

Pull ARM SoC DT and driver fixes from Arnd Bergmann:
 "Lots of dts fixes for Qualcomm Snapdragon and NXP i.MX platforms,
  including:

   - A regression fix for SDHCI controllers on Inforce 6540, and another
     SDHCI fix on SM8350

   - Reenable cluster idle on sm8250 after the the code fix is upstream

   - multiple fixes for the QMP PHY binding, needing an incompatible dt
     change

   - The reserved memory map is updated on Xiaomi Mi 4C and Huawei Nexus
     6P, to avoid instabilities caused by use of protected memory
     regions

   - Fix i.MX8MP DT for missing GPC Interrupt, power-domain typo and USB
     clock error

   - A couple of verdin-imx8mm DT fixes for audio playback support

   - Fix pca9547 i2c-mux node name for i.MX and Vybrid device trees

   - Fix an imx93-11x11-evk uSDHC pad setting problem that causes Micron
     eMMC CMD8 CRC error in HS400ES/HS400 mode

  The remaining ARM and RISC-V platforms only have very few smaller dts
  bugfixes this time:

   - A fix for the SiFive unmatched board's PCI memory space

   - A revert to fix a regression with GPIO on Marvell Armada

   - A fix for the UART address on Marvell AC5

   - Missing chip-select phandles for stm32 boards

   - Selecting the correct clock for the sam9x60 memory controller

   - Amlogic based Odroid-HC4 needs a revert to restore USB
     functionality.

  And finally, there are some minor code fixes:

   - Build fixes for OMAP1, pxa, riscpc, raspberry pi firmware, and zynq
     firmware

   - memory controller driver fixes for an OMAP regression and older
     bugs on tegra, atmel and mvebu

   - reset controller fixes for ti-sci and uniphier platforms

   - ARM SCMI firmware fixes for a couple of rare corner cases

   - Qualcomm platform driver fixes for incorrect error handling and a
     backwards compatibility fix for the apr driver using older dtb

   - NXP i.MX SoC driver fixes for HDMI output, error handling in the
     imx8 soc-id and missing reference counting on older cpuid code"

* tag 'soc-fixes-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (60 commits)
  firmware: zynqmp: fix declarations for gcc-13
  ARM: dts: stm32: Fix qspi pinctrl phandle for stm32mp151a-prtt1l
  ARM: dts: stm32: Fix qspi pinctrl phandle for stm32mp157c-emstamp-argon
  ARM: dts: stm32: Fix qspi pinctrl phandle for stm32mp15xx-dhcom-som
  ARM: dts: stm32: Fix qspi pinctrl phandle for stm32mp15xx-dhcor-som
  ARM: dts: at91: sam9x60: fix the ddr clock for sam9x60
  ARM: omap1: fix building gpio15xx
  ARM: omap1: fix !ARCH_OMAP1_ANY link failures
  firmware: raspberrypi: Fix type assignment
  arm64: dts: qcom: msm8992-libra: Fix the memory map
  arm64: dts: qcom: msm8992: Don't use sfpb mutex
  PM: AVS: qcom-cpr: Fix an error handling path in cpr_probe()
  arm64: dts: msm8994-angler: fix the memory map
  arm64: dts: marvell: AC5/AC5X: Fix address for UART1
  ARM: footbridge: drop unnecessary inclusion
  Revert "ARM: dts: armada-39x: Fix compatible string for gpios"
  Revert "ARM: dts: armada-38x: Fix compatible string for gpios"
  ARM: pxa: enable PXA310/PXA320 for DT-only build
  riscv: dts: sifive: fu740: fix size of pcie 32bit memory
  soc: qcom: apr: Make qcom,protection-domain optional again
  ...

Pull drm fixes from Dave Airlie:
 "Just a pretty regular week for this stage of things, amdgpu and i915,
  along with some msm and misc others.

  fb-helper:
   - switcheroo fix

  msm:
   - kexec shutdown fix
   - fix potential double free

  i915:
   - Reject display plane with height == 0
   - re-disable RC6p on Sandy Bridge
   - Fix hugepages' selftest
   - DG2 hw workarounds
   - switcheroo fix

  vc4:
   - fix a memory leak

  panfrost:
   - Kconfig fix

  amdgpu:
   - Fix display scaling
   - Fix RN/CZN power reporting on some firmware versions
   - Colorspace fixes
   - Fix resource freeing in error case in CS IOCTL
   - Fix warning on driver unload
   - GC11 fixes
   - DCN 3.1.4/5 S/G display workarounds"

* tag 'drm-fixes-2023-01-20' of git://anongit.freedesktop.org/drm/drm: (24 commits)
  drm/amd/display: disable S/G display on DCN 3.1.4
  drm/amd/display: disable S/G display on DCN 3.1.5
  drm/amdgpu: allow multipipe policy on ASICs with one MEC
  drm/amdgpu: correct MEC number for gfx11 APUs
  drm/amd/display: fix issues with driver unload
  drm/amdgpu: fix amdgpu_job_free_resources v2
  drm/amd/display: Fix COLOR_SPACE_YCBCR2020_TYPE matrix
  drm/amd/display: Calculate output_color_space after pixel encoding adjustment
  drm/amdgpu: fix cleaning up reserved VMID on release
  drm/amdgpu: Correct the power calcultion for Renior/Cezanne.
  drm/amd/display: Fix set scaling doesn's work
  drm/i915: Remove unused variable
  drm/i915/dg2: Introduce Wa_18019271663
  drm/i915/dg2: Introduce Wa_18018764978
  drm/fb-helper: Set framebuffer for vga-switcheroo clients
  drm/i915: Allow switching away via vga-switcheroo if uninitialized
  drm/i915/selftests: Unwind hugepages to drop wakeref on error
  drm/i915: re-disable RC6p on Sandy Bridge
  drm/panfrost: fix GENERIC_ATOMIC64 dependency
  drm/i915/display: Check source height is > 0
  ...