1. 25 Nov, 2022 10 commits
    • Linus Torvalds's avatar
      Merge tag 'regulator-fix-v6.1-rc6' of... · f10b4396
      Linus Torvalds authored
      Merge tag 'regulator-fix-v6.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator
      
      Pull regulator fixes from Mark Brown:
       "This is more changes than I'd like this late although the diffstat is
        still fairly small, I kept on holding off as new fixes came in to give
        things time to soak in -next but should probably have tagged and sent
        an additional pull request earlier.
      
        There's some relatively large fixes to the twl6030 driver to fix
        issues with the TWL6032 variant which resulted from some work on the
        core TWL6030 driver, a couple of fixes for error handling paths
        (mostly in the core), and a nice stability fix for the sgl51000 driver
        that's been pulled out of a BSP"
      
      * tag 'regulator-fix-v6.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
        regulator: twl6030: fix get status of twl6032 regulators
        regulator: twl6030: re-add TWL6032_SUBCLASS
        regulator: slg51000: Wait after asserting CS pin
        regulator: core: fix UAF in destroy_regulator()
        regulator: rt5759: fix OOB in validate_desc()
        regulator: core: fix kobject release warning and memory leak in regulator_register()
      f10b4396
    • Linus Torvalds's avatar
      Merge tag 'for-6.1-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux · 3eaea0db
      Linus Torvalds authored
      Pull btrfs fixes from David Sterba:
      
       - fix a regression in nowait + buffered write
      
       - in zoned mode fix endianness when comparing super block generation
      
       - locking and lockdep fixes:
           - fix potential sleeping under spinlock when setting qgroup limit
           - lockdep warning fixes when btrfs_path is freed after copy_to_user
           - do not modify log tree while holding a leaf from fs tree locked
      
       - fix freeing of sysfs files of static features on error
      
       - use kv.alloc for zone map allocation as a fallback to avoid warnings
         due to high order allocation
      
       - send, avoid unaligned encoded writes when attempting to clone range
      
      * tag 'for-6.1-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
        btrfs: sysfs: normalize the error handling branch in btrfs_init_sysfs()
        btrfs: do not modify log tree while holding a leaf from fs tree locked
        btrfs: use kvcalloc in btrfs_get_dev_zone_info
        btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit()
        btrfs: send: avoid unaligned encoded writes when attempting to clone range
        btrfs: zoned: fix missing endianness conversion in sb_write_pointer
        btrfs: free btrfs_path before copying subvol info to userspace
        btrfs: free btrfs_path before copying fspath to userspace
        btrfs: free btrfs_path before copying inodes to userspace
        btrfs: free btrfs_path before copying root refs to userspace
        btrfs: fix assertion failure and blocking during nowait buffered write
      3eaea0db
    • Linus Torvalds's avatar
      Merge tag 'pm-6.1-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · 88817acb
      Linus Torvalds authored
      Pull power management fixes from Rafael Wysocki:
       "These revert a recent change in the schedutil cpufreq governor that
        had not been expected to make any functional difference, but turned
        out to introduce a performance regression, fix an initialization issue
        in the amd-pstate driver and make it actually replace the venerable
        ACPI cpufreq driver on the supported systems by default.
      
        Specifics:
      
         - Revert a recent schedutil cpufreq governor change that introduced a
           performace regression on Pixel 6 (Sam Wu)
      
         - Fix amd-pstate driver initialization after running the kernel via
           kexec (Wyes Karny)
      
         - Turn amd-pstate into a built-in driver which allows it to take
           precedence over acpi-cpufreq by default on supported systems and
           amend it with a mechanism to disable this behavior (Perry Yuan)
      
         - Update amd-pstate documentation in accordance with the other
           changes made to it (Perry Yuan)"
      
      * tag 'pm-6.1-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        Documentation: add amd-pstate kernel command line options
        Documentation: amd-pstate: add driver working mode introduction
        cpufreq: amd-pstate: add amd-pstate driver parameter for mode selection
        cpufreq: amd-pstate: change amd-pstate driver to be built-in type
        cpufreq: amd-pstate: cpufreq: amd-pstate: reset MSR_AMD_PERF_CTL register at init
        Revert "cpufreq: schedutil: Move max CPU capacity to sugov_policy"
      88817acb
    • Linus Torvalds's avatar
      Merge tag 's390-6.1-6' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux · e3ebac80
      Linus Torvalds authored
      Pull s390 updates from Alexander Gordeev:
      
       - Fix size of incorrectly increased from four to eight bytes TOD field
         of crash dump save area. As result in case of kdump NT_S390_TODPREG
         ELF notes section contains correct value and "detected read beyond
         size of field" compiler warning goes away.
      
       - Fix memory leak in cryptographic Adjunct Processors (AP) module on
         initialization failure path.
      
       - Add Gerald Schaefer <gerald.schaefer@linux.ibm.com> and Alexander
         Gordeev <agordeev@linux.ibm.com> as S390 memory management
         maintainers. Also rename the S390 section to S390 ARCHITECTURE to be
         a bit more precise.
      
      * tag 's390-6.1-6' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
        MAINTAINERS: add S390 MM section
        s390/crashdump: fix TOD programmable field size
        s390/ap: fix memory leak in ap_init_qci_info()
      e3ebac80
    • Linus Torvalds's avatar
      Merge tag 'hyperv-fixes-signed-20221125' of... · 081f359e
      Linus Torvalds authored
      Merge tag 'hyperv-fixes-signed-20221125' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux
      
      Pull hyperv fixes from Wei Liu:
      
       - Fix IRTE allocation in Hyper-V PCI controller (Dexuan Cui)
      
       - Fix handling of SCSI srb_status and capacity change events (Michael
         Kelley)
      
       - Restore VP assist page after CPU offlining and onlining (Vitaly
         Kuznetsov)
      
       - Fix some memory leak issues in VMBus (Yang Yingliang)
      
      * tag 'hyperv-fixes-signed-20221125' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux:
        Drivers: hv: vmbus: fix possible memory leak in vmbus_device_register()
        Drivers: hv: vmbus: fix double free in the error path of vmbus_add_channel_work()
        PCI: hv: Only reuse existing IRTE allocation for Multi-MSI
        scsi: storvsc: Fix handling of srb_status and capacity change events
        x86/hyperv: Restore VP assist page after cpu offlining/onlining
      081f359e
    • Linus Torvalds's avatar
      Merge tag 'mm-hotfixes-stable-2022-11-24' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm · 0b1dcc2c
      Linus Torvalds authored
      Pull hotfixes from Andrew Morton:
       "24 MM and non-MM hotfixes. 8 marked cc:stable and 16 for post-6.0
        issues.
      
        There have been a lot of hotfixes this cycle, and this is quite a
        large batch given how far we are into the -rc cycle. Presumably a
        reflection of the unusually large amount of MM material which went
        into 6.1-rc1"
      
      * tag 'mm-hotfixes-stable-2022-11-24' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (24 commits)
        test_kprobes: fix implicit declaration error of test_kprobes
        nilfs2: fix nilfs_sufile_mark_dirty() not set segment usage as dirty
        mm/cgroup/reclaim: fix dirty pages throttling on cgroup v1
        mm: fix unexpected changes to {failslab|fail_page_alloc}.attr
        swapfile: fix soft lockup in scan_swap_map_slots
        hugetlb: fix __prep_compound_gigantic_page page flag setting
        kfence: fix stack trace pruning
        proc/meminfo: fix spacing in SecPageTables
        mm: multi-gen LRU: retry folios written back while isolated
        mailmap: update email address for Satya Priya
        mm/migrate_device: return number of migrating pages in args->cpages
        kbuild: fix -Wimplicit-function-declaration in license_is_gpl_compatible
        MAINTAINERS: update Alex Hung's email address
        mailmap: update Alex Hung's email address
        mm: mmap: fix documentation for vma_mas_szero
        mm/damon/sysfs-schemes: skip stats update if the scheme directory is removed
        mm/memory: return vm_fault_t result from migrate_to_ram() callback
        mm: correctly charge compressed memory to its memcg
        ipc/shm: call underlying open/close vm_ops
        gcov: clang: fix the buffer overflow issue
        ...
      0b1dcc2c
    • Linus Torvalds's avatar
      Merge tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · b3085709
      Linus Torvalds authored
      Pull vfs fixes from Al Viro:
       "A couple of fixes, one of them for this cycle regression..."
      
      * tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        vfs: vfs_tmpfile: ensure O_EXCL flag is enforced
        fs: use acquire ordering in __fget_light()
      b3085709
    • Linus Torvalds's avatar
      Merge tag 'sound-6.1-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · ca66e580
      Linus Torvalds authored
      Pull sound fixes from Takashi Iwai:
       "A few more last-minute fixes for 6.1 that have been gathered in the
        last week; nothing looks too worrisome, mostly device-specific small
        fixes, including the ABI fix for ASoC SOF"
      
      * tag 'sound-6.1-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
        ASoC: soc-pcm: Add NULL check in BE reparenting
        ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event
        ASoC: SOF: dai: move AMD_HS to end of list to restore backwards-compatibility
        ASoC: max98373: Add checks for devm_kcalloc
        ASoC: rt711-sdca: fix the latency time of clock stop prepare state machine transitions
        ASoC: soc-pcm: Don't zero TDM masks in __soc_pcm_open()
        ASoC: sgtl5000: Reset the CHIP_CLK_CTRL reg on remove
        ASoC: hdac_hda: fix hda pcm buffer overflow issue
        ASoC: stm32: i2s: remove irqf_oneshot flag
        ASoC: wm8962: Wait for updated value of WM8962_CLOCKING1 register
      ca66e580
    • Linus Torvalds's avatar
      Merge tag 'drm-fixes-2022-11-25' of git://anongit.freedesktop.org/drm/drm · 6fe0e074
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "Weekly fixes, amdgpu has not quite settled down.
      
        Most of the changes are small, and the non-amdgpu ones are all fine.
        There are a bunch of DP MST DSC fixes that fix some issues introduced
        in a previous larger MST rework.
      
        The biggest one is mainly propagating some error values properly
        instead of bool returns, and I think it just looks large but doesn't
        really change anything too much, except propagating errors that are
        required to avoid deadlocks. I've gone over it and a few others and
        they've had some decent testing over the last few weeks.
      
        Summary:
      
        amdgpu:
         - amdgpu gang submit fix
         - DCN 3.1.4 fixes
         - DP MST DSC deadlock fixes
         - HMM userptr fixes
         - Fix Aldebaran CU occupancy reporting
         - GFX11 fixes
         - PSP suspend/resume fix
         - DCE12 KASAN fix
         - DCN 3.2.x fixes
         - Rotated cursor fix
         - SMU 13.x fix
         - DELL platform suspend/resume fixes
         - VCN4 SR-IOV fix
         - Display regression fix for polled connectors
      
        i915:
         - Fix GVT KVM reference count handling
         - Never purge busy TTM objects
         - Fix warn in intel_display_power_*_domain() functions
      
        dma-buf:
         - Use dma_fence_unwrap_for_each when importing sync files
         - Fix race in dma_heap_add()
      
        fbcon:
         - Fix use of uninitialized memory in logo"
      
      * tag 'drm-fixes-2022-11-25' of git://anongit.freedesktop.org/drm/drm: (30 commits)
        drm/amdgpu/vcn: re-use original vcn0 doorbell value
        drm/amdgpu: Partially revert "drm/amdgpu: update drm_display_info correctly when the edid is read"
        drm/amd/display: No display after resume from WB/CB
        drm/amdgpu: fix use-after-free during gpu recovery
        drm/amd/pm: update driver if header for smu_13_0_7
        drm/amd/display: Fix rotated cursor offset calculation
        drm/amd/display: Use new num clk levels struct for max mclk index
        drm/amd/display: Avoid setting pixel rate divider to N/A
        drm/amd/display: Use viewport height for subvp mall allocation size
        drm/amd/display: Update soc bounding box for dcn32/dcn321
        drm/amd/dc/dce120: Fix audio register mapping, stop triggering KASAN
        drm/amdgpu/psp: don't free PSP buffers on suspend
        fbcon: Use kzalloc() in fbcon_prepare_logo()
        dma-buf: fix racing conflict of dma_heap_add()
        drm/amd/amdgpu: reserve vm invalidation engine for firmware
        drm/amdgpu: Enable Aldebaran devices to report CU Occupancy
        drm/amdgpu: fix userptr HMM range handling v2
        drm/amdgpu: always register an MMU notifier for userptr
        drm/amdgpu/dm/mst: Fix uninitialized var in pre_compute_mst_dsc_configs_for_state()
        drm/amdgpu/dm/dp_mst: Don't grab mst_mgr->lock when computing DSC state
        ...
      6fe0e074
    • Dave Airlie's avatar
      Merge tag 'amd-drm-fixes-6.1-2022-11-23' of... · e5770206
      Dave Airlie authored
      Merge tag 'amd-drm-fixes-6.1-2022-11-23' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes
      
      amd-drm-fixes-6.1-2022-11-23:
      
      amdgpu:
      - DCN 3.1.4 fixes
      - DP MST DSC deadlock fixes
      - HMM userptr fixes
      - Fix Aldebaran CU occupancy reporting
      - GFX11 fixes
      - PSP suspend/resume fix
      - DCE12 KASAN fix
      - DCN 3.2.x fixes
      - Rotated cursor fix
      - SMU 13.x fix
      - DELL platform suspend/resume fixes
      - VCN4 SR-IOV fix
      - Display regression fix for polled connectors
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      From: Alex Deucher <alexander.deucher@amd.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20221123143453.8977-1-alexander.deucher@amd.com
      e5770206
  2. 24 Nov, 2022 25 commits
  3. 23 Nov, 2022 5 commits
    • Linus Torvalds's avatar
      Merge tag 'pci-v6.1-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci · c3eb11fb
      Linus Torvalds authored
      Pull pci fixes from Bjorn Helgaas:
      
       - Update MAINTAINERS to add Manivannan Sadhasivam as Qcom PCIe RC
         maintainer (replacing Stanimir Varbanov) and include DT PCI bindings
         in the "PCI native host bridge and endpoint drivers" entry.
      
      * tag 'pci-v6.1-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci:
        MAINTAINERS: Include PCI bindings in host bridge entry
        MAINTAINERS: Add Manivannan Sadhasivam as Qcom PCIe RC maintainer
      c3eb11fb
    • Linus Torvalds's avatar
      Merge tag 'spi-fix-v6.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi · 4312098b
      Linus Torvalds authored
      Pull spi fixes from Mark Brown:
       "A few fixes, all device specific.
      
        The most important ones are for the i.MX driver which had a couple of
        nasty data corruption inducing errors appear after the change to
        support PIO mode in the last merge window (one introduced by the
        change and one latent one which the PIO changes exposed).
      
        Thanks to Frieder, Fabio, Marc and Marek for jumping on that and
        resolving the issues quickly once they were found"
      
      * tag 'spi-fix-v6.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
        spi: spi-imx: spi_imx_transfer_one(): check for DMA transfer first
        spi: tegra210-quad: Fix duplicate resource error
        spi: dw-dma: decrease reference count in dw_spi_dma_init_mfld()
        spi: spi-imx: Fix spi_bus_clk if requested clock is higher than input clock
        spi: mediatek: Fix DEVAPC Violation at KO Remove
      4312098b
    • Linus Torvalds's avatar
      Merge tag '9p-for-6.1-rc7' of https://github.com/martinetd/linux · fd64898d
      Linus Torvalds authored
      Pull 9p fixes from Dominique Martinet:
      
       - 9p now uses a variable size for its recv buffer, but every place
         hadn't been updated properly to use it and some buffer overflows have
         been found and needed fixing.
      
         There's still one place where msize is incorrectly used in a safety
         check (p9_check_errors), but all paths leading to it should already
         be avoiding overflows and that patch took a bit more time to get
         right for zero-copy requests so I'll send it for 6.2
      
       - yet another race condition in p9_conn_cancel introduced by a fix for
         a syzbot report in the same place. Maybe at some point we'll get it
         right without burning it all down...
      
      * tag '9p-for-6.1-rc7' of https://github.com/martinetd/linux:
        9p/xen: check logical size for buffer size
        9p/fd: Use P9_HDRSZ for header size
        9p/fd: Fix write overflow in p9_read_work
        9p/fd: fix issue of list_del corruption in p9_fd_cancel()
      fd64898d
    • David Howells's avatar
      fscache: fix OOB Read in __fscache_acquire_volume · 9f0933ac
      David Howells authored
      The type of a->key[0] is char in fscache_volume_same().  If the length
      of cache volume key is greater than 127, the value of a->key[0] is less
      than 0.  In this case, klen becomes much larger than 255 after type
      conversion, because the type of klen is size_t.  As a result, memcmp()
      is read out of bounds.
      
      This causes a slab-out-of-bounds Read in __fscache_acquire_volume(), as
      reported by Syzbot.
      
      Fix this by changing the type of the stored key to "u8 *" rather than
      "char *" (it isn't a simple string anyway).  Also put in a check that
      the volume name doesn't exceed NAME_MAX.
      
        BUG: KASAN: slab-out-of-bounds in memcmp+0x16f/0x1c0 lib/string.c:757
        Read of size 8 at addr ffff888016f3aa90 by task syz-executor344/3613
        Call Trace:
         memcmp+0x16f/0x1c0 lib/string.c:757
         memcmp include/linux/fortify-string.h:420 [inline]
         fscache_volume_same fs/fscache/volume.c:133 [inline]
         fscache_hash_volume fs/fscache/volume.c:171 [inline]
         __fscache_acquire_volume+0x76c/0x1080 fs/fscache/volume.c:328
         fscache_acquire_volume include/linux/fscache.h:204 [inline]
         v9fs_cache_session_get_cookie+0x143/0x240 fs/9p/cache.c:34
         v9fs_session_init+0x1166/0x1810 fs/9p/v9fs.c:473
         v9fs_mount+0xba/0xc90 fs/9p/vfs_super.c:126
         legacy_get_tree+0x105/0x220 fs/fs_context.c:610
         vfs_get_tree+0x89/0x2f0 fs/super.c:1530
         do_new_mount fs/namespace.c:3040 [inline]
         path_mount+0x1326/0x1e20 fs/namespace.c:3370
         do_mount fs/namespace.c:3383 [inline]
         __do_sys_mount fs/namespace.c:3591 [inline]
         __se_sys_mount fs/namespace.c:3568 [inline]
         __x64_sys_mount+0x27f/0x300 fs/namespace.c:3568
      
      Fixes: 62ab6335 ("fscache: Implement volume registration")
      Reported-by: syzbot+a76f6a6e524cf2080aa3@syzkaller.appspotmail.com
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      Reviewed-by: default avatarZhang Peng <zhangpeng362@huawei.com>
      Reviewed-by: default avatarJingbo Xu <jefflexu@linux.alibaba.com>
      cc: Dominique Martinet <asmadeus@codewreck.org>
      cc: Jeff Layton <jlayton@kernel.org>
      cc: v9fs-developer@lists.sourceforge.net
      cc: linux-cachefs@redhat.com
      Link: https://lore.kernel.org/r/Y3OH+Dmi0QIOK18n@codewreck.org/ # Zhang Peng's v1 fix
      Link: https://lore.kernel.org/r/20221115140447.2971680-1-zhangpeng362@huawei.com/ # Zhang Peng's v2 fix
      Link: https://lore.kernel.org/r/166869954095.3793579.8500020902371015443.stgit@warthog.procyon.org.uk/ # v1
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      9f0933ac
    • Takashi Iwai's avatar
      Merge tag 'asoc-fix-v6.1-rc6' of... · ecae4c89
      Takashi Iwai authored
      Merge tag 'asoc-fix-v6.1-rc6' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus
      
      ASoC: Fixes for v6.1
      
      A clutch of small fixes that have come in in the past week, people seem
      to have been unusually active for this late in the release cycle.  The
      most critical one here is the fix to renumber the SOF DAI types in order
      to restore ABI compatibility which was broken by the addition of AMD
      support.
      ecae4c89