1. 02 Feb, 2023 11 commits
    • Zhihao Cheng's avatar
      ubifs: Reserve one leb for each journal head while doing budget · e874dcde
      Zhihao Cheng authored
      UBIFS calculates available space by c->main_bytes - c->lst.total_used
      (which means non-index lebs' free and dirty space is accounted into
      total available), then index lebs and four lebs (one for gc_lnum, one
      for deletions, two for journal heads) are deducted.
      In following situation, ubifs may get -ENOSPC from make_reservation():
       LEB 84: DATAHD   free 122880 used 1920  dirty 2176  dark 6144
       LEB 110:DELETION free 126976 used 0     dirty 0     dark 6144 (empty)
       LEB 201:gc_lnum  free 126976 used 0     dirty 0     dark 6144
       LEB 272:GCHD     free 77824  used 47672 dirty 1480  dark 6144
       LEB 356:BASEHD   free 0      used 39776 dirty 87200 dark 6144
       OTHERS: index lebs, zero-available non-index lebs
      
      UBIFS calculates the available bytes is 6888 (How to calculate it:
      126976 * 5[remain main bytes] - 1920[used] - 47672[used] - 39776[used] -
      126976 * 1[deletions] - 126976 * 1[gc_lnum] - 126976 * 2[journal heads]
      - 6144 * 5[dark] = 6888) after doing budget, however UBIFS cannot use
      BASEHD's dirty space(87200), because UBIFS cannot find next BASEHD to
      reclaim current BASEHD. (c->bi.min_idx_lebs equals to c->lst.idx_lebs,
      the empty leb won't be found by ubifs_find_free_space(), and dirty index
      lebs won't be picked as gced lebs. All non-index lebs has dirty space
      less then c->dead_wm, non-index lebs won't be picked as gced lebs
      either. So new free lebs won't be produced.). See more details in Link.
      
      To fix it, reserve one leb for each journal head while doing budget.
      
      Link: https://bugzilla.kernel.org/show_bug.cgi?id=216562
      Fixes: 1e51764a ("UBIFS: add new flash file system")
      Signed-off-by: default avatarZhihao Cheng <chengzhihao1@huawei.com>
      Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
      e874dcde
    • Zhihao Cheng's avatar
      ubifs: do_rename: Fix wrong space budget when target inode's nlink > 1 · 25fce616
      Zhihao Cheng authored
      If target inode is a special file (eg. block/char device) with nlink
      count greater than 1, the inode with ui->data will be re-written on
      disk. However, UBIFS losts target inode's data_len while doing space
      budget. Bad space budget may let make_reservation() return with -ENOSPC,
      which could turn ubifs to read-only mode in do_writepage() process.
      
      Fetch a reproducer in [Link].
      
      Link: https://bugzilla.kernel.org/show_bug.cgi?id=216494
      Fixes: 1e51764a ("UBIFS: add new flash file system")
      Signed-off-by: default avatarZhihao Cheng <chengzhihao1@huawei.com>
      Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
      25fce616
    • Zhihao Cheng's avatar
      ubifs: Fix wrong dirty space budget for dirty inode · b248eaf0
      Zhihao Cheng authored
      Each dirty inode should reserve 'c->bi.inode_budget' bytes in space
      budget calculation. Currently, space budget for dirty inode reports
      more space than what UBIFS actually needs to write.
      
      Fixes: 1e51764a ("UBIFS: add new flash file system")
      Signed-off-by: default avatarZhihao Cheng <chengzhihao1@huawei.com>
      Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
      b248eaf0
    • Zhihao Cheng's avatar
      ubifs: Add comments and debug info for ubifs_xrename() · c04cc68d
      Zhihao Cheng authored
      Just like other operations (eg. ubifs_create, do_rename), add comments
      and debug information for ubifs_xrename().
      Signed-off-by: default avatarZhihao Cheng <chengzhihao1@huawei.com>
      Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
      c04cc68d
    • Zhihao Cheng's avatar
      ubifs: Rectify space budget for ubifs_xrename() · 1b2ba090
      Zhihao Cheng authored
      There is no space budget for ubifs_xrename(). It may let
      make_reservation() return with -ENOSPC, which could turn
      ubifs to read-only mode in do_writepage() process.
      Fix it by adding space budget for ubifs_xrename().
      
      Fetch a reproducer in [Link].
      
      Link: https://bugzilla.kernel.org/show_bug.cgi?id=216569
      Fixes: 9ec64962 ("ubifs: Implement RENAME_EXCHANGE")
      Signed-off-by: default avatarZhihao Cheng <chengzhihao1@huawei.com>
      Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
      1b2ba090
    • Zhihao Cheng's avatar
      ubifs: Rectify space budget for ubifs_symlink() if symlink is encrypted · c2c36cc6
      Zhihao Cheng authored
      Fix bad space budget when symlink file is encrypted. Bad space budget
      may let make_reservation() return with -ENOSPC, which could turn ubifs
      to read-only mode in do_writepage() process.
      
      Fetch a reproducer in [Link].
      
      Link: https://bugzilla.kernel.org/show_bug.cgi?id=216490
      Fixes: ca7f85be ("ubifs: Add support for encrypted symlinks")
      Signed-off-by: default avatarZhihao Cheng <chengzhihao1@huawei.com>
      Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
      c2c36cc6
    • Mårten Lindahl's avatar
      ubi: block: Reduce warning print to info for static volumes · 6addbe91
      Mårten Lindahl authored
      If volume size is not multiple of the sector size 512 a warning is
      printed saying that the last non-sector aligned bytes will be ignored.
      
      This should be valid for resizable volumes, but when creating static
      volumes which are read only this will always be printed even if the
      unaligned data is deliberate.
      
      The message is still valid but the severity should be lowered for static
      volumes.
      Signed-off-by: default avatarMårten Lindahl <marten.lindahl@axis.com>
      Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
      6addbe91
    • Liu Shixin's avatar
      ubifs: Fix memory leak in ubifs_sysfs_init() · 203a55f0
      Liu Shixin authored
      When insmod ubifs.ko, a kmemleak reported as below:
      
       unreferenced object 0xffff88817fb1a780 (size 8):
         comm "insmod", pid 25265, jiffies 4295239702 (age 100.130s)
         hex dump (first 8 bytes):
           75 62 69 66 73 00 ff ff                          ubifs...
         backtrace:
           [<ffffffff81b3fc4c>] slab_post_alloc_hook+0x9c/0x3c0
           [<ffffffff81b44bf3>] __kmalloc_track_caller+0x183/0x410
           [<ffffffff8198d3da>] kstrdup+0x3a/0x80
           [<ffffffff8198d486>] kstrdup_const+0x66/0x80
           [<ffffffff83989325>] kvasprintf_const+0x155/0x190
           [<ffffffff83bf55bb>] kobject_set_name_vargs+0x5b/0x150
           [<ffffffff83bf576b>] kobject_set_name+0xbb/0xf0
           [<ffffffff8100204c>] do_one_initcall+0x14c/0x5a0
           [<ffffffff8157e380>] do_init_module+0x1f0/0x660
           [<ffffffff815857be>] load_module+0x6d7e/0x7590
           [<ffffffff8158644f>] __do_sys_finit_module+0x19f/0x230
           [<ffffffff815866b3>] __x64_sys_finit_module+0x73/0xb0
           [<ffffffff88c98e85>] do_syscall_64+0x35/0x80
           [<ffffffff88e00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
      
      When kset_register() failed, we should call kset_put to cleanup it.
      
      Fixes: 2e3cbf42 ("ubifs: Export filesystem error counters")
      Signed-off-by: default avatarLiu Shixin <liushixin2@huawei.com>
      Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
      203a55f0
    • Li Hua's avatar
      ubifs: Fix build errors as symbol undefined · aa6d148e
      Li Hua authored
      With CONFIG_UBIFS_FS_AUTHENTICATION not set, the compiler can assume that
      ubifs_node_check_hash() is never true and drops the call to ubifs_bad_hash().
      Is CONFIG_CC_OPTIMIZE_FOR_SIZE enabled this optimization does not happen anymore.
      
      So When CONFIG_UBIFS_FS and CONFIG_CC_OPTIMIZE_FOR_SIZE is enabled but
      CONFIG_UBIFS_FS_AUTHENTICATION is not set, the build errors is as followd:
          ERROR: modpost: "ubifs_bad_hash" [fs/ubifs/ubifs.ko] undefined!
      
      Fix it by add no-op ubifs_bad_hash() for the CONFIG_UBIFS_FS_AUTHENTICATION=n case.
      
      Fixes: 16a26b20 ("ubifs: authentication: Add hashes to index nodes")
      Signed-off-by: default avatarLi Hua <hucool.lihua@huawei.com>
      Reviewed-by: default avatarSascha Hauer <s.hauer@pengutronix.de>
      Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
      aa6d148e
    • George Kennedy's avatar
      ubi: ensure that VID header offset + VID header size <= alloc, size · 1b42b1a3
      George Kennedy authored
      Ensure that the VID header offset + VID header size does not exceed
      the allocated area to avoid slab OOB.
      
      BUG: KASAN: slab-out-of-bounds in crc32_body lib/crc32.c:111 [inline]
      BUG: KASAN: slab-out-of-bounds in crc32_le_generic lib/crc32.c:179 [inline]
      BUG: KASAN: slab-out-of-bounds in crc32_le_base+0x58c/0x626 lib/crc32.c:197
      Read of size 4 at addr ffff88802bb36f00 by task syz-executor136/1555
      
      CPU: 2 PID: 1555 Comm: syz-executor136 Tainted: G        W
      6.0.0-1868 #1
      Hardware name: Red Hat KVM, BIOS 1.13.0-2.module+el8.3.0+7860+a7792d29
      04/01/2014
      Call Trace:
        <TASK>
        __dump_stack lib/dump_stack.c:88 [inline]
        dump_stack_lvl+0x85/0xad lib/dump_stack.c:106
        print_address_description mm/kasan/report.c:317 [inline]
        print_report.cold.13+0xb6/0x6bb mm/kasan/report.c:433
        kasan_report+0xa7/0x11b mm/kasan/report.c:495
        crc32_body lib/crc32.c:111 [inline]
        crc32_le_generic lib/crc32.c:179 [inline]
        crc32_le_base+0x58c/0x626 lib/crc32.c:197
        ubi_io_write_vid_hdr+0x1b7/0x472 drivers/mtd/ubi/io.c:1067
        create_vtbl+0x4d5/0x9c4 drivers/mtd/ubi/vtbl.c:317
        create_empty_lvol drivers/mtd/ubi/vtbl.c:500 [inline]
        ubi_read_volume_table+0x67b/0x288a drivers/mtd/ubi/vtbl.c:812
        ubi_attach+0xf34/0x1603 drivers/mtd/ubi/attach.c:1601
        ubi_attach_mtd_dev+0x6f3/0x185e drivers/mtd/ubi/build.c:965
        ctrl_cdev_ioctl+0x2db/0x347 drivers/mtd/ubi/cdev.c:1043
        vfs_ioctl fs/ioctl.c:51 [inline]
        __do_sys_ioctl fs/ioctl.c:870 [inline]
        __se_sys_ioctl fs/ioctl.c:856 [inline]
        __x64_sys_ioctl+0x193/0x213 fs/ioctl.c:856
        do_syscall_x64 arch/x86/entry/common.c:50 [inline]
        do_syscall_64+0x3e/0x86 arch/x86/entry/common.c:80
        entry_SYSCALL_64_after_hwframe+0x63/0x0
      RIP: 0033:0x7f96d5cf753d
      Code:
      RSP: 002b:00007fffd72206f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
      RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f96d5cf753d
      RDX: 0000000020000080 RSI: 0000000040186f40 RDI: 0000000000000003
      RBP: 0000000000400cd0 R08: 0000000000000000 R09: 0000000000000000
      R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000400be0
      R13: 00007fffd72207e0 R14: 0000000000000000 R15: 0000000000000000
        </TASK>
      
      Allocated by task 1555:
        kasan_save_stack+0x20/0x3d mm/kasan/common.c:38
        kasan_set_track mm/kasan/common.c:45 [inline]
        set_alloc_info mm/kasan/common.c:437 [inline]
        ____kasan_kmalloc mm/kasan/common.c:516 [inline]
        __kasan_kmalloc+0x88/0xa3 mm/kasan/common.c:525
        kasan_kmalloc include/linux/kasan.h:234 [inline]
        __kmalloc+0x138/0x257 mm/slub.c:4429
        kmalloc include/linux/slab.h:605 [inline]
        ubi_alloc_vid_buf drivers/mtd/ubi/ubi.h:1093 [inline]
        create_vtbl+0xcc/0x9c4 drivers/mtd/ubi/vtbl.c:295
        create_empty_lvol drivers/mtd/ubi/vtbl.c:500 [inline]
        ubi_read_volume_table+0x67b/0x288a drivers/mtd/ubi/vtbl.c:812
        ubi_attach+0xf34/0x1603 drivers/mtd/ubi/attach.c:1601
        ubi_attach_mtd_dev+0x6f3/0x185e drivers/mtd/ubi/build.c:965
        ctrl_cdev_ioctl+0x2db/0x347 drivers/mtd/ubi/cdev.c:1043
        vfs_ioctl fs/ioctl.c:51 [inline]
        __do_sys_ioctl fs/ioctl.c:870 [inline]
        __se_sys_ioctl fs/ioctl.c:856 [inline]
        __x64_sys_ioctl+0x193/0x213 fs/ioctl.c:856
        do_syscall_x64 arch/x86/entry/common.c:50 [inline]
        do_syscall_64+0x3e/0x86 arch/x86/entry/common.c:80
        entry_SYSCALL_64_after_hwframe+0x63/0x0
      
      The buggy address belongs to the object at ffff88802bb36e00
        which belongs to the cache kmalloc-256 of size 256
      The buggy address is located 0 bytes to the right of
        256-byte region [ffff88802bb36e00, ffff88802bb36f00)
      
      The buggy address belongs to the physical page:
      page:00000000ea4d1263 refcount:1 mapcount:0 mapping:0000000000000000
      index:0x0 pfn:0x2bb36
      head:00000000ea4d1263 order:1 compound_mapcount:0 compound_pincount:0
      flags: 0xfffffc0010200(slab|head|node=0|zone=1|lastcpupid=0x1fffff)
      raw: 000fffffc0010200 ffffea000066c300 dead000000000003 ffff888100042b40
      raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
      page dumped because: kasan: bad access detected
      
      Memory state around the buggy address:
        ffff88802bb36e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        ffff88802bb36e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      >ffff88802bb36f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                          ^
        ffff88802bb36f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
        ffff88802bb37000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
      ==================================================================
      
      Fixes: 801c135c ("UBI: Unsorted Block Images")
      Reported-by: default avatarsyzkaller <syzkaller@googlegroups.com>
      Signed-off-by: default avatarGeorge Kennedy <george.kennedy@oracle.com>
      Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
      1b42b1a3
    • Yifei Liu's avatar
      jffs2: correct logic when creating a hole in jffs2_write_begin · 23892d38
      Yifei Liu authored
      Bug description and fix:
      
      1. Write data to a file, say all 1s from offset 0 to 16.
      
      2. Truncate the file to a smaller size, say 8 bytes.
      
      3. Write new bytes (say 2s) from an offset past the original size of the
      file, say at offset 20, for 4 bytes.  This is supposed to create a "hole"
      in the file, meaning that the bytes from offset 8 (where it was truncated
      above) up to the new write at offset 20, should all be 0s (zeros).
      
      4. Flush all caches using "echo 3 > /proc/sys/vm/drop_caches" (or unmount
      and remount) the f/s.
      
      5. Check the content of the file.  It is wrong.  The 1s that used to be
      between bytes 9 and 16, before the truncation, have REAPPEARED (they should
      be 0s).
      
      We wrote a script and helper C program to reproduce the bug
      (reproduce_jffs2_write_begin_issue.sh, write_file.c, and Makefile).  We can
      make them available to anyone.
      
      The above example is shown when writing a small file within the same first
      page.  But the bug happens for larger files, as long as steps 1, 2, and 3
      above all happen within the same page.
      
      The problem was traced to the jffs2_write_begin code, where it goes into an
      'if' statement intended to handle writes past the current EOF (i.e., writes
      that may create a hole).  The code computes a 'pageofs' that is the floor
      of the write position (pos), aligned to the page size boundary.  In other
      words, 'pageofs' will never be larger than 'pos'.  The code then sets the
      internal jffs2_raw_inode->isize to the size of max(current inode size,
      pageofs) but that is wrong: the new file size should be the 'pos', which is
      larger than both the current inode size and pageofs.
      
      Similarly, the code incorrectly sets the internal jffs2_raw_inode->dsize to
      the difference between the pageofs minus current inode size; instead it
      should be the current pos minus the current inode size.  Finally,
      inode->i_size was also set incorrectly.
      
      The patch below fixes this bug.  The bug was discovered using a new tool
      for finding f/s bugs using model checking, called MCFS (Model Checking File
      Systems).
      Signed-off-by: default avatarYifei Liu <yifeliu@cs.stonybrook.edu>
      Signed-off-by: default avatarErez Zadok <ezk@cs.stonybrook.edu>
      Signed-off-by: default avatarManish Adkar <madkar@cs.stonybrook.edu>
      Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
      23892d38
  2. 22 Jan, 2023 2 commits
    • Linus Torvalds's avatar
      Linux 6.2-rc5 · 2241ab53
      Linus Torvalds authored
      2241ab53
    • Linus Torvalds's avatar
      Merge tag 'io_uring-6.2-2023-01-21' of git://git.kernel.dk/linux · 95f184d0
      Linus Torvalds authored
      Pull another io_uring fix from Jens Axboe:
       "Just a single fix for a regression that happened in this release due
        to a poll change. Normally I would've just deferred it to next week,
        but since the original fix got picked up by stable, I think it's
        better to just send this one off separately.
      
        The issue is around the poll race fix, and how it mistakenly also got
        applied to multishot polling. Those don't need the race fix, and we
        should not be doing any reissues for that case. Exhaustive test cases
        were written and committed to the liburing regression suite for the
        reported issue, and additions for similar issues"
      
      * tag 'io_uring-6.2-2023-01-21' of git://git.kernel.dk/linux:
        io_uring/poll: don't reissue in case of poll race on multishot request
      95f184d0
  3. 21 Jan, 2023 9 commits
    • Linus Torvalds's avatar
      Merge tag 'char-misc-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc · f6714402
      Linus Torvalds authored
      Pull char/misc driver fixes from Greg KH:
       "Here are some small char/misc and other subsystem driver fixes for
        6.2-rc5 to resolve a few reported issues. They include:
      
         - long time pending fastrpc fixes (should have gone into 6.1, my
           fault)
      
         - mei driver/bus fixes and new device ids
      
         - interconnect driver fixes for reported problems
      
         - vmci bugfix
      
         - w1 driver bugfixes for reported problems
      
        Almost all of these have been in linux-next with no reported problems,
        the rest have all passed 0-day bot testing in my tree and on the
        mailing lists where they have sat too long due to me taking a long
        time to catch up on my pending patch queue"
      
      * tag 'char-misc-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
        VMCI: Use threaded irqs instead of tasklets
        misc: fastrpc: Pass bitfield into qcom_scm_assign_mem
        gsmi: fix null-deref in gsmi_get_variable
        misc: fastrpc: Fix use-after-free race condition for maps
        misc: fastrpc: Don't remove map on creater_process and device_release
        misc: fastrpc: Fix use-after-free and race in fastrpc_map_find
        misc: fastrpc: fix error code in fastrpc_req_mmap()
        mei: me: add meteor lake point M DID
        mei: bus: fix unlink on bus in error path
        w1: fix WARNING after calling w1_process()
        w1: fix deadloop in __w1_remove_master_device()
        comedi: adv_pci1760: Fix PWM instruction handling
        interconnect: qcom: rpm: Use _optional func for provider clocks
        interconnect: qcom: msm8996: Fix regmap max_register values
        interconnect: qcom: msm8996: Provide UFS clocks to A2NoC
        dt-bindings: interconnect: Add UFS clocks to MSM8996 A2NoC
      f6714402
    • Linus Torvalds's avatar
      Merge tag 'driver-core-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core · c88a3114
      Linus Torvalds authored
      Pull driver core fixes from Greg KH:
       "Here are three small driver and kernel core fixes for 6.2-rc5. They
        include:
      
         - potential gadget fixup in do_prlimit
      
         - device property refcount leak fix
      
         - test_async_probe bugfix for reported problem"
      
      * tag 'driver-core-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core:
        prlimit: do_prlimit needs to have a speculation check
        driver core: Fix test_async_probe_init saves device in wrong array
        device property: fix of node refcount leak in fwnode_graph_get_next_endpoint()
      c88a3114
    • Linus Torvalds's avatar
      Merge tag 'staging-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging · bb86d657
      Linus Torvalds authored
      Pull staging driver fix from Greg KH:
       "Here is a single staging driver fix for 6.2-rc5. It resolves a build
        issue reported and Fixed by Arnd in the vc04_services driver. It's
        been in linux-next this week with no reported problems"
      
      * tag 'staging-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
        staging: vchiq_arm: fix enum vchiq_status return types
      bb86d657
    • Linus Torvalds's avatar
      Merge tag 'tty-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty · bd5cc6ee
      Linus Torvalds authored
      Pull tty/serial driver fixes from Greg KH:
       "Here are some small tty and serial driver fixes for 6.2-rc5 that
        resolve a number of tiny reported issues and some new device ids. They
        include:
      
         - new device id for the exar serial driver
      
         - speakup tty driver bugfix
      
         - atmel serial driver baudrate fixup
      
         - stm32 serial driver bugfix and then revert as the bugfix broke the
           build. That will come back in a later pull request once it is all
           worked out properly.
      
         - amba-pl011 serial driver rs486 mode bugfix
      
         - qcom_geni serial driver bugfix
      
        Most of these have been in linux-next with no reported problems (well,
        other than the build breakage which generated the revert), the new
        device id passed 0-day testing"
      
      * tag 'tty-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
        serial: exar: Add support for Sealevel 7xxxC serial cards
        Revert "serial: stm32: Merge hard IRQ and threaded IRQ handling into single IRQ handler"
        tty: serial: qcom_geni: avoid duplicate struct member init
        serial: atmel: fix incorrect baudrate setup
        tty: fix possible null-ptr-defer in spk_ttyio_release
        serial: stm32: Merge hard IRQ and threaded IRQ handling into single IRQ handler
        serial: amba-pl011: fix high priority character transmission in rs486 mode
        serial: pch_uart: Pass correct sg to dma_unmap_sg()
        tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer
      bd5cc6ee
    • Linus Torvalds's avatar
      Merge tag 'usb-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb · e67da288
      Linus Torvalds authored
      Pull USB / Thunderbolt fixes from Greg KH:
       "Here are a number of small USB and Thunderbolt driver fixes and new
        device id changes for 6.2-rc5. Included in here are:
      
         - thunderbolt bugfixes for reported problems
      
         - new usb-serial driver ids added
      
         - onboard_hub usb driver fixes for much-reported problems
      
         - xhci bugfixes
      
         - typec bugfixes
      
         - ehci-fsl driver module alias fix
      
         - iowarrior header size fix
      
         - usb gadget driver fixes
      
        All of these, except for the iowarrior fix, have been in linux-next
        with no reported issues. The iowarrior fix passed the 0-day testing
        and is a one digit change based on a reported problem in the driver
        (which was written to a spec, not the real device that is now
        available)"
      
      * tag 'usb-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (40 commits)
        USB: misc: iowarrior: fix up header size for USB_DEVICE_ID_CODEMERCS_IOW100
        usb: host: ehci-fsl: Fix module alias
        usb: dwc3: fix extcon dependency
        usb: core: hub: disable autosuspend for TI TUSB8041
        USB: fix misleading usb_set_intfdata() kernel doc
        usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate()
        USB: gadget: Add ID numbers to configfs-gadget driver names
        usb: typec: tcpm: Fix altmode re-registration causes sysfs create fail
        usb: gadget: g_webcam: Send color matching descriptor per frame
        usb: typec: altmodes/displayport: Use proper macro for pin assignment check
        usb: typec: altmodes/displayport: Fix pin assignment calculation
        usb: typec: altmodes/displayport: Add pin assignment helper
        usb: gadget: f_fs: Ensure ep0req is dequeued before free_request
        usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait
        usb: misc: onboard_hub: Move 'attach' work to the driver
        usb: misc: onboard_hub: Invert driver registration order
        usb: ucsi: Ensure connector delayed work items are flushed
        usb: musb: fix error return code in omap2430_probe()
        usb: chipidea: core: fix possible constant 0 if use IS_ERR(ci->role_switch)
        xhci: Detect lpm incapable xHC USB3 roothub ports from ACPI tables
        ...
      e67da288
    • Linus Torvalds's avatar
      Merge tag 'kbuild-fixes-v6.2-3' of... · 83cd5fd0
      Linus Torvalds authored
      Merge tag 'kbuild-fixes-v6.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild
      
      Pull Kbuild fixes from Masahiro Yamada:
      
       - Hide LDFLAGS_vmlinux from decompressor Makefiles to fix error
         messages when GNU Make 4.4 is used.
      
       - Fix 'make modules' build error when CONFIG_DEBUG_INFO_BTF_MODULES=y.
      
       - Fix warnings emitted by GNU Make 4.4 in scripts/kconfig/Makefile.
      
       - Support GNU Make 4.4 for scripts/jobserver-exec.
      
       - Show clearer error message when kernel/gen_kheaders.sh fails due to
         missing cpio.
      
      * tag 'kbuild-fixes-v6.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild:
        kheaders: explicitly validate existence of cpio command
        scripts: support GNU make 4.4 in jobserver-exec
        kconfig: Update all declared targets
        scripts: rpm: make clear that mkspec script contains 4.13 feature
        init/Kconfig: fix LOCALVERSION_AUTO help text
        kbuild: fix 'make modules' error when CONFIG_DEBUG_INFO_BTF_MODULES=y
        kbuild: export top-level LDFLAGS_vmlinux only to scripts/Makefile.vmlinux
        init/version-timestamp.c: remove unneeded #include <linux/version.h>
        docs: kbuild: remove mention to dropped $(objtree) feature
      83cd5fd0
    • Linus Torvalds's avatar
      ext4: deal with legacy signed xattr name hash values · f3bbac32
      Linus Torvalds authored
      We potentially have old hashes of the xattr names generated on systems
      with signed 'char' types.  Now that everybody uses '-funsigned-char',
      those hashes will no longer match.
      
      This only happens if you use xattrs names that have the high bit set,
      which probably doesn't happen in practice, but the xfstest generic/454
      shows it.
      
      Instead of adding a new "signed xattr hash filesystem" bit and having to
      deal with all the possible combinations, just calculate the hash both
      ways if the first one fails, and always generate new hashes with the
      proper unsigned char version.
      Reported-by: default avatarkernel test robot <oliver.sang@intel.com>
      Link: https://lore.kernel.org/oe-lkp/202212291509.704a11c9-oliver.sang@intel.com
      Link: https://lore.kernel.org/all/CAHk-=whUNjwqZXa-MH9KMmc_CpQpoFKFjAB9ZKHuu=TbsouT4A@mail.gmail.com/
      Exposed-by: 3bc753c0 ("kbuild: treat char as always unsigned")
      Cc: Eric Biggers <ebiggers@kernel.org>
      Cc: Andreas Dilger <adilger@dilger.ca>
      Cc: Theodore Ts'o <tytso@mit.edu>,
      Cc: Jason Donenfeld <Jason@zx2c4.com>
      Cc: Masahiro Yamada <masahiroy@kernel.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      f3bbac32
    • Greg Kroah-Hartman's avatar
      prlimit: do_prlimit needs to have a speculation check · 73979060
      Greg Kroah-Hartman authored
      do_prlimit() adds the user-controlled resource value to a pointer that
      will subsequently be dereferenced.  In order to help prevent this
      codepath from being used as a spectre "gadget" a barrier needs to be
      added after checking the range.
      Reported-by: default avatarJordy Zomer <jordyzomer@google.com>
      Tested-by: default avatarJordy Zomer <jordyzomer@google.com>
      Suggested-by: default avatarLinus Torvalds <torvalds@linuxfoundation.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      73979060
    • Linus Torvalds's avatar
      Merge tag 'gpio-fixes-for-v6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux · f883675b
      Linus Torvalds authored
      Pull gpio fixes from Bartosz Golaszewski:
      
       - fix a potential race condition and always set GPIOs used as interrupt
         source to input in gpio-mxc
      
       - fix a GPIO ACPI-related issue with system suspend on Clevo NL5xRU
      
      * tag 'gpio-fixes-for-v6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
        gpiolib: acpi: Add a ignore wakeup quirk for Clevo NL5xRU
        gpiolib: acpi: Allow ignoring wake capability on pins that aren't in _AEI
        gpio: mxc: Always set GPIOs used as interrupt source to INPUT mode
        gpio: mxc: Protect GPIO irqchip RMW with bgpio spinlock
      f883675b
  4. 20 Jan, 2023 18 commits
    • Linus Torvalds's avatar
      Merge tag '6.2-rc4-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 · 4e31bada
      Linus Torvalds authored
      Pull cifs fixes from Steve French:
      
       - important fix for packet signature calculation error
      
       - three fixes to correct DFS deadlock, and DFS refresh problem
      
       - remove an unused DFS function, and duplicate tcon refresh code
      
       - DFS cache lookup fix
      
       - uninitialized rc fix
      
      * tag '6.2-rc4-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6:
        cifs: remove unused function
        cifs: do not include page data when checking signature
        cifs: fix return of uninitialized rc in dfs_cache_update_tgthint()
        cifs: handle cache lookup errors different than -ENOENT
        cifs: remove duplicate code in __refresh_tcon()
        cifs: don't take exclusive lock for updating target hints
        cifs: avoid re-lookups in dfs_cache_find()
        cifs: fix potential deadlock in cache_refresh_path()
      4e31bada
    • Linus Torvalds's avatar
      Merge tag 'pinctrl-v6.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl · 8440ffcd
      Linus Torvalds authored
      Pull pin control fixes from Linus Walleij:
      
       - Compilation fix for Sunplus sp7021
      
       - Add some missing headers after a cleanup to the Nomadik driver
      
       - Fix pull type and mux routes on Rockchip RK3568
      
      * tag 'pinctrl-v6.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
        pinctrl: rockchip: fix mux route data for rk3568
        pinctrl: rockchip: fix reading pull type on rk3568
        pinctrl: nomadik: Add missing header(s)
        pinctrl: sp7021: fix unused function warning
      8440ffcd
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma · 8974efaa
      Linus Torvalds authored
      Pull rdma fixes from Jason Gunthorpe:
      
       - Several hfi1 patches fixing some long standing driver bugs
      
       - Overflow when working with sg lists with elements greater than 4G
      
       - An rxe regression with object numbering after the mrs reach their
         limit
      
       - A theoretical problem with the scatterlist merging code
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
        lib/scatterlist: Fix to calculate the last_pg properly
        IB/hfi1: Remove user expected buffer invalidate race
        IB/hfi1: Immediately remove invalid memory from hardware
        IB/hfi1: Fix expected receive setup error exit issues
        IB/hfi1: Reserve user expected TIDs
        IB/hfi1: Reject a zero-length user expected buffer
        RDMA/core: Fix ib block iterator counter overflow
        RDMA/rxe: Prevent faulty rkey generation
        RDMA/rxe: Fix inaccurate constants in rxe_type_info
      8974efaa
    • Jens Axboe's avatar
      io_uring/poll: don't reissue in case of poll race on multishot request · 8caa03f1
      Jens Axboe authored
      A previous commit fixed a poll race that can occur, but it's only
      applicable for multishot requests. For a multishot request, we can safely
      ignore a spurious wakeup, as we never leave the waitqueue to begin with.
      
      A blunt reissue of a multishot armed request can cause us to leak a
      buffer, if they are ring provided. While this seems like a bug in itself,
      it's not really defined behavior to reissue a multishot request directly.
      It's less efficient to do so as well, and not required to rearm anything
      like it is for singleshot poll requests.
      
      Cc: stable@vger.kernel.org
      Fixes: 6e5aedb9 ("io_uring/poll: attempt request issue after racy poll wakeup")
      Reported-and-tested-by: default avatarOlivier Langlois <olivier@trillion01.com>
      Link: https://github.com/axboe/liburing/issues/778Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      8caa03f1
    • Linus Torvalds's avatar
      Merge tag 'block-6.2-2023-01-20' of git://git.kernel.dk/linux · edc00350
      Linus Torvalds authored
      Pull block fixes from Jens Axboe:
       "Various little tweaks all over the place:
      
         - NVMe pull request via Christoph:
             - fix controller shutdown regression in nvme-apple (Janne Grunau)
             - fix a polling on timeout regression in nvme-pci (Keith Busch)
      
         - Fix a bug in the read request side request allocation caching
           (Pavel)
      
         - pktcdvd was brought back after we configured a NULL return on bio
           splits, make it consistent with the others (me)
      
         - BFQ refcount fix (Yu)
      
         - Block cgroup policy activation fix (Yu)
      
         - Fix for an md regression introduced in the 6.2 cycle (Adrian)"
      
      * tag 'block-6.2-2023-01-20' of git://git.kernel.dk/linux:
        nvme-pci: fix timeout request state check
        nvme-apple: only reset the controller when RTKit is running
        nvme-apple: reset controller during shutdown
        block: fix hctx checks for batch allocation
        block/rnbd-clt: fix wrong max ID in ida_alloc_max
        blk-cgroup: fix missing pd_online_fn() while activating policy
        pktcdvd: check for NULL returna fter calling bio_split_to_limits()
        block, bfq: switch 'bfqg->ref' to use atomic refcount apis
        md: fix incorrect declaration about claim_rdev in md_import_device
      edc00350
    • Linus Torvalds's avatar
      Merge tag 'io_uring-6.2-2023-01-20' of git://git.kernel.dk/linux · 9c38747f
      Linus Torvalds authored
      Pull io_uring fixes from Jens Axboe:
       "Fixes for the MSG_RING opcode. Nothing really major:
      
         - Fix an overflow missing serialization around posting CQEs to the
           target ring (me)
      
         - Disable MSG_RING on a ring that isn't enabled yet. There's nothing
           really wrong with allowing it, but 1) it's somewhat odd as nobody
           can receive them yet, and 2) it means that using the right delivery
           mechanism might change. As nobody should be sending CQEs to a ring
           that isn't enabled yet, let's just disable it (Pavel)
      
         - Tweak to when we decide to post remotely or not for MSG_RING
           (Pavel)"
      
      * tag 'io_uring-6.2-2023-01-20' of git://git.kernel.dk/linux:
        io_uring/msg_ring: fix remote queue to disabled ring
        io_uring/msg_ring: fix flagging remote execution
        io_uring/msg_ring: fix missing lock on overflow for IOPOLL
        io_uring/msg_ring: move double lock/unlock helpers higher up
      9c38747f
    • Linus Torvalds's avatar
      Merge tag 'for-6.2-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux · 26e57507
      Linus Torvalds authored
      Pull btrfs fixes from David Sterba:
      
       - fix potential out-of-bounds access to leaf data when seeking in an
         inline file
      
       - fix potential crash in quota when rescan races with disable
      
       - reimplement super block signature scratching by marking page/folio
         dirty and syncing block device, allow removing write_one_page
      
      * tag 'for-6.2-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
        btrfs: fix race between quota rescan and disable leading to NULL pointer deref
        btrfs: fix invalid leaf access due to inline extent during lseek
        btrfs: stop using write_one_page in btrfs_scratch_superblock
        btrfs: factor out scratching of one regular super block
      26e57507
    • Linus Torvalds's avatar
      Merge tag 'linux-kselftest-fixes-6.2-rc5' of... · d9166cb3
      Linus Torvalds authored
      Merge tag 'linux-kselftest-fixes-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest
      
      Pull Kselftest fix from Shuah Khan:
       "Fix an error seen during unconfigured LLVM builds"
      
      * tag 'linux-kselftest-fixes-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest:
        kselftest: Fix error message for unconfigured LLVM builds
      d9166cb3
    • Linus Torvalds's avatar
      Merge tag 'thermal-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · dc181759
      Linus Torvalds authored
      Pull thermal control fix from Rafael Wysocki:
       "Modify __thermal_cooling_device_register() to make it call
        put_device() after invoking device_register() and fix up a few error
        paths calling thermal_cooling_device_destroy_sysfs() unnecessarily
        (Viresh Kumar)"
      
      * tag 'thermal-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        thermal: core: call put_device() only after device_register() fails
      dc181759
    • Linus Torvalds's avatar
      Merge tag 'acpi-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · fe563a2c
      Linus Torvalds authored
      Pull ACPI fixes from Rafael Wysocki:
       "These update the ACPICA entry in MAINTAINERS, add a backlight handling
        quirk and fix the ACPI PRM (platform runtime) mechanism support.
      
        Specifics:
      
         - Update the ACPICA development list address in MAINTAINERS to the
           new one that does not bounce (Rafael Wysocki)
      
         - Check whether EFI runtime is available when registering the ACPI
           PRM address space handler and when running it (Ard Biesheuvel)
      
         - Add backlight=native DMI quirk for Acer Aspire 4810T to the ACPI
           video driver (Hans de Goede)"
      
      * tag 'acpi-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        ACPI: PRM: Check whether EFI runtime is available
        ACPI: video: Add backlight=native DMI quirk for Acer Aspire 4810T
        MAINTAINERS: Update the ACPICA development list address
      fe563a2c
    • Linus Torvalds's avatar
      Merge tag 'mmc-v6.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc · 1670d7e6
      Linus Torvalds authored
      Pull MMC fixes from Ulf Hansson:
      
       - sunxi-mmc: Fix clock refcount imbalance during unbind
      
       - sdhci-esdhc-imx: Fix some tuning settings
      
      * tag 'mmc-v6.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
        mmc: sunxi-mmc: Fix clock refcount imbalance during unbind
        mmc: sdhci-esdhc-imx: correct the tuning start tap and step setting
      1670d7e6
    • Linus Torvalds's avatar
      Merge tag 'soc-fixes-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc · 1ed46384
      Linus Torvalds authored
      Pull ARM SoC DT and driver fixes from Arnd Bergmann:
       "Lots of dts fixes for Qualcomm Snapdragon and NXP i.MX platforms,
        including:
      
         - A regression fix for SDHCI controllers on Inforce 6540, and another
           SDHCI fix on SM8350
      
         - Reenable cluster idle on sm8250 after the the code fix is upstream
      
         - multiple fixes for the QMP PHY binding, needing an incompatible dt
           change
      
         - The reserved memory map is updated on Xiaomi Mi 4C and Huawei Nexus
           6P, to avoid instabilities caused by use of protected memory
           regions
      
         - Fix i.MX8MP DT for missing GPC Interrupt, power-domain typo and USB
           clock error
      
         - A couple of verdin-imx8mm DT fixes for audio playback support
      
         - Fix pca9547 i2c-mux node name for i.MX and Vybrid device trees
      
         - Fix an imx93-11x11-evk uSDHC pad setting problem that causes Micron
           eMMC CMD8 CRC error in HS400ES/HS400 mode
      
        The remaining ARM and RISC-V platforms only have very few smaller dts
        bugfixes this time:
      
         - A fix for the SiFive unmatched board's PCI memory space
      
         - A revert to fix a regression with GPIO on Marvell Armada
      
         - A fix for the UART address on Marvell AC5
      
         - Missing chip-select phandles for stm32 boards
      
         - Selecting the correct clock for the sam9x60 memory controller
      
         - Amlogic based Odroid-HC4 needs a revert to restore USB
           functionality.
      
        And finally, there are some minor code fixes:
      
         - Build fixes for OMAP1, pxa, riscpc, raspberry pi firmware, and zynq
           firmware
      
         - memory controller driver fixes for an OMAP regression and older
           bugs on tegra, atmel and mvebu
      
         - reset controller fixes for ti-sci and uniphier platforms
      
         - ARM SCMI firmware fixes for a couple of rare corner cases
      
         - Qualcomm platform driver fixes for incorrect error handling and a
           backwards compatibility fix for the apr driver using older dtb
      
         - NXP i.MX SoC driver fixes for HDMI output, error handling in the
           imx8 soc-id and missing reference counting on older cpuid code"
      
      * tag 'soc-fixes-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (60 commits)
        firmware: zynqmp: fix declarations for gcc-13
        ARM: dts: stm32: Fix qspi pinctrl phandle for stm32mp151a-prtt1l
        ARM: dts: stm32: Fix qspi pinctrl phandle for stm32mp157c-emstamp-argon
        ARM: dts: stm32: Fix qspi pinctrl phandle for stm32mp15xx-dhcom-som
        ARM: dts: stm32: Fix qspi pinctrl phandle for stm32mp15xx-dhcor-som
        ARM: dts: at91: sam9x60: fix the ddr clock for sam9x60
        ARM: omap1: fix building gpio15xx
        ARM: omap1: fix !ARCH_OMAP1_ANY link failures
        firmware: raspberrypi: Fix type assignment
        arm64: dts: qcom: msm8992-libra: Fix the memory map
        arm64: dts: qcom: msm8992: Don't use sfpb mutex
        PM: AVS: qcom-cpr: Fix an error handling path in cpr_probe()
        arm64: dts: msm8994-angler: fix the memory map
        arm64: dts: marvell: AC5/AC5X: Fix address for UART1
        ARM: footbridge: drop unnecessary inclusion
        Revert "ARM: dts: armada-39x: Fix compatible string for gpios"
        Revert "ARM: dts: armada-38x: Fix compatible string for gpios"
        ARM: pxa: enable PXA310/PXA320 for DT-only build
        riscv: dts: sifive: fu740: fix size of pcie 32bit memory
        soc: qcom: apr: Make qcom,protection-domain optional again
        ...
      1ed46384
    • Linus Torvalds's avatar
      Merge tag 'drm-fixes-2023-01-20' of git://anongit.freedesktop.org/drm/drm · ff83fec8
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "Just a pretty regular week for this stage of things, amdgpu and i915,
        along with some msm and misc others.
      
        fb-helper:
         - switcheroo fix
      
        msm:
         - kexec shutdown fix
         - fix potential double free
      
        i915:
         - Reject display plane with height == 0
         - re-disable RC6p on Sandy Bridge
         - Fix hugepages' selftest
         - DG2 hw workarounds
         - switcheroo fix
      
        vc4:
         - fix a memory leak
      
        panfrost:
         - Kconfig fix
      
        amdgpu:
         - Fix display scaling
         - Fix RN/CZN power reporting on some firmware versions
         - Colorspace fixes
         - Fix resource freeing in error case in CS IOCTL
         - Fix warning on driver unload
         - GC11 fixes
         - DCN 3.1.4/5 S/G display workarounds"
      
      * tag 'drm-fixes-2023-01-20' of git://anongit.freedesktop.org/drm/drm: (24 commits)
        drm/amd/display: disable S/G display on DCN 3.1.4
        drm/amd/display: disable S/G display on DCN 3.1.5
        drm/amdgpu: allow multipipe policy on ASICs with one MEC
        drm/amdgpu: correct MEC number for gfx11 APUs
        drm/amd/display: fix issues with driver unload
        drm/amdgpu: fix amdgpu_job_free_resources v2
        drm/amd/display: Fix COLOR_SPACE_YCBCR2020_TYPE matrix
        drm/amd/display: Calculate output_color_space after pixel encoding adjustment
        drm/amdgpu: fix cleaning up reserved VMID on release
        drm/amdgpu: Correct the power calcultion for Renior/Cezanne.
        drm/amd/display: Fix set scaling doesn's work
        drm/i915: Remove unused variable
        drm/i915/dg2: Introduce Wa_18019271663
        drm/i915/dg2: Introduce Wa_18018764978
        drm/fb-helper: Set framebuffer for vga-switcheroo clients
        drm/i915: Allow switching away via vga-switcheroo if uninitialized
        drm/i915/selftests: Unwind hugepages to drop wakeref on error
        drm/i915: re-disable RC6p on Sandy Bridge
        drm/panfrost: fix GENERIC_ATOMIC64 dependency
        drm/i915/display: Check source height is > 0
        ...
      ff83fec8
    • Linus Torvalds's avatar
      Merge tag 'dmaengine-fix-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine · 35929dae
      Linus Torvalds authored
      Pull dmaengine fixes from Vinod Koul:
      
       - email address Update for Jie Hai
      
       - fix double increment of client_count in dma_chan_get()
      
       - idxd driver fixes: use after free, probe error handling and callback
         on wq disable
      
       - fix for qcom gpi driver GO tre
      
       - ptdma locking fix
      
       - tegra & imx-sdma mem leak fix
      
      * tag 'dmaengine-fix-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine:
        ptdma: pt_core_execute_cmd() should use spinlock
        dmaengine: tegra: Fix memory leak in terminate_all()
        dmaengine: xilinx_dma: call of_node_put() when breaking out of for_each_child_of_node()
        dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
        dmaengine: Fix double increment of client_count in dma_chan_get()
        dmaengine: tegra210-adma: fix global intr clear
        Add exception protection processing for vd in axi_chan_handle_err function
        dmaengine: lgm: Move DT parsing after initialization
        MAINTAINERS: update Jie Hai's email address
        dmaengine: ti: k3-udma: Do conditional decrement of UDMA_CHAN_RT_PEER_BCNT_REG
        dmaengine: idxd: Do not call DMX TX callbacks during workqueue disable
        dmaengine: idxd: Prevent use after free on completion memory
        dmaengine: idxd: Let probe fail when workqueue cannot be enabled
        dmaengine: qcom: gpi: Set link_rx bit on GO TRE for rx operation
      35929dae
    • Linus Torvalds's avatar
      Merge tag 'phy-fixes-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy · aaaf919c
      Linus Torvalds authored
      Pull phy fixes from Vinod Koul:
      
       - binding fix for g12a phys
      
       - Kconfig operator precedence for TI driver
      
       - renesas: register setting
      
       - sunplus: null deref fix
      
       - rockchip-inno fix for clk_disable_unprepare()
      
       - MDM9607 init sequence revert due to regression
      
      * tag 'phy-fixes-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy:
        phy: phy-can-transceiver: Skip warning if no "max-bitrate"
        dt-bindings: phy: g12a-usb2-phy: fix compatible string documentation
        dt-bindings: phy: g12a-usb3-pcie-phy: fix compatible string documentation
        phy: freescale: imx8m-pcie: Add one missing error return
        phy: Revert "phy: qualcomm: usb28nm: Add MDM9607 init sequence"
        phy: rockchip-inno-usb2: Fix missing clk_disable_unprepare() in rockchip_usb2phy_power_on()
        phy: renesas: r8a779f0-eth-serdes: Fix register setting
        phy: usb: sunplus: Fix potential null-ptr-deref in sp_usb_phy_probe()
        phy: ti: fix Kconfig warning and operator precedence
      aaaf919c
    • Linus Torvalds's avatar
      Merge tag 'net-6.2-rc5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net · 5deaa985
      Linus Torvalds authored
      Pull networking fixes from Jakub Kicinski:
       "Including fixes from wireless, bluetooth, bpf and netfilter.
      
        Current release - regressions:
      
         - Revert "net: team: use IFF_NO_ADDRCONF flag to prevent ipv6
           addrconf", fix nsna_ping mode of team
      
         - wifi: mt76: fix bugs in Rx queue handling and DMA mapping
      
         - eth: mlx5:
            - add missing mutex_unlock in error reporter
            - protect global IPsec ASO with a lock
      
        Current release - new code bugs:
      
         - rxrpc: fix wrong error return in rxrpc_connect_call()
      
        Previous releases - regressions:
      
         - bluetooth: hci_sync: fix use of HCI_OP_LE_READ_BUFFER_SIZE_V2
      
         - wifi:
            - mac80211: fix crashes on Rx due to incorrect initialization of
              rx->link and rx->link_sta
            - mac80211: fix bugs in iTXQ conversion - Tx stalls, incorrect
              aggregation handling, crashes
            - brcmfmac: fix regression for Broadcom PCIe wifi devices
            - rndis_wlan: prevent buffer overflow in rndis_query_oid
      
         - netfilter: conntrack: handle tcp challenge acks during connection
           reuse
      
         - sched: avoid grafting on htb_destroy_class_offload when destroying
      
         - virtio-net: correctly enable callback during start_xmit, fix stalls
      
         - tcp: avoid the lookup process failing to get sk in ehash table
      
         - ipa: disable ipa interrupt during suspend
      
         - eth: stmmac: enable all safety features by default
      
        Previous releases - always broken:
      
         - bpf:
            - fix pointer-leak due to insufficient speculative store bypass
              mitigation (Spectre v4)
            - skip task with pid=1 in send_signal_common() to avoid a splat
            - fix BPF program ID information in BPF_AUDIT_UNLOAD as well as
              PERF_BPF_EVENT_PROG_UNLOAD events
            - fix potential deadlock in htab_lock_bucket from same bucket
              index but different map_locked index
      
         - bluetooth:
            - fix a buffer overflow in mgmt_mesh_add()
            - hci_qca: fix driver shutdown on closed serdev
            - ISO: fix possible circular locking dependency
            - CIS: hci_event: fix invalid wait context
      
         - wifi: brcmfmac: fixes for survey dump handling
      
         - mptcp: explicitly specify sock family at subflow creation time
      
         - netfilter: nft_payload: incorrect arithmetics when fetching VLAN
           header bits
      
         - tcp: fix rate_app_limited to default to 1
      
         - l2tp: close all race conditions in l2tp_tunnel_register()
      
         - eth: mlx5: fixes for QoS config and eswitch configuration
      
         - eth: enetc: avoid deadlock in enetc_tx_onestep_tstamp()
      
         - eth: stmmac: fix invalid call to mdiobus_get_phy()
      
        Misc:
      
         - ethtool: add netlink attr in rss get reply only if the value is not
           empty"
      
      * tag 'net-6.2-rc5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (88 commits)
        Revert "Merge branch 'octeontx2-af-CPT'"
        tcp: fix rate_app_limited to default to 1
        bnxt: Do not read past the end of test names
        net: stmmac: enable all safety features by default
        octeontx2-af: add mbox to return CPT_AF_FLT_INT info
        octeontx2-af: update cpt lf alloc mailbox
        octeontx2-af: restore rxc conf after teardown sequence
        octeontx2-af: optimize cpt pf identification
        octeontx2-af: modify FLR sequence for CPT
        octeontx2-af: add mbox for CPT LF reset
        octeontx2-af: recover CPT engine when it gets fault
        net: dsa: microchip: ksz9477: port map correction in ALU table entry register
        selftests/net: toeplitz: fix race on tpacket_v3 block close
        net/ulp: use consistent error code when blocking ULP
        octeontx2-pf: Fix the use of GFP_KERNEL in atomic context on rt
        tcp: avoid the lookup process failing to get sk in ehash table
        Revert "net: team: use IFF_NO_ADDRCONF flag to prevent ipv6 addrconf"
        MAINTAINERS: add networking entries for Willem
        net: sched: gred: prevent races when adding offloads to stats
        l2tp: prevent lockdep issue in l2tp_tunnel_register()
        ...
      5deaa985
    • Rafael J. Wysocki's avatar
      Merge branches 'acpi-prm' and 'acpi-video' · 3bdd346e
      Rafael J. Wysocki authored
      Merge an ACPI PRM (platform runtime) support fix and an ACPI backlight
      quirk for 6.2-rc5:
      
       - Check whether EFI runtime is available when registering the ACPI PRM
         address space handler and when running it (Ard Biesheuvel).
      
       - Add backlight=native DMI quirk for Acer Aspire 4810T to the ACPI
         video driver (Hans de Goede).
      
      * acpi-prm:
        ACPI: PRM: Check whether EFI runtime is available
      
      * acpi-video:
        ACPI: video: Add backlight=native DMI quirk for Acer Aspire 4810T
      3bdd346e
    • Pavel Begunkov's avatar
      io_uring/msg_ring: fix remote queue to disabled ring · 8579538c
      Pavel Begunkov authored
      IORING_SETUP_R_DISABLED rings don't have the submitter task set, so
      it's not always safe to use ->submitter_task. Disallow posting msg_ring
      messaged to disabled rings. Also add task NULL check for loosy sync
      around testing for IORING_SETUP_R_DISABLED.
      
      Cc: stable@vger.kernel.org
      Fixes: 6d043ee1 ("io_uring: do msg_ring in target task via tw")
      Signed-off-by: default avatarPavel Begunkov <asml.silence@gmail.com>
      Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      8579538c