1. 11 Mar, 2020 4 commits
  2. 09 Mar, 2020 4 commits
    • Greg Kroah-Hartman's avatar
      Merge 5.6-rc5 into driver-core-next · 9a2dd570
      Greg Kroah-Hartman authored
      We need the driver core and debugfs changes in here as well.
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      9a2dd570
    • Linus Torvalds's avatar
      Linux 5.6-rc5 · 2c523b34
      Linus Torvalds authored
      2c523b34
    • Linus Torvalds's avatar
      Merge tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc · 62790268
      Linus Torvalds authored
      Pull ARM SoC fixes from Olof Johansson:
       "We've been accruing these for a couple of weeks, so the batch is a bit
        bigger than usual.
      
        Largest delta is due to a led-bl driver that is added -- there was a
        miscommunication before the merge window and the driver didn't make it
        in. Due to this, the platforms needing it regressed. At this point, it
        seemed easier to add the new driver than unwind the changes.
      
        Besides that, there are a handful of various fixes:
      
         - AMD tee memory leak fix
      
         - A handful of fixlets for i.MX SCU communication
      
         - A few maintainers woke up and realized DEBUG_FS had been missing
           for a while, so a few updates of that.
      
        ... and the usual collection of smaller fixes to various platforms"
      
      * tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (37 commits)
        ARM: socfpga_defconfig: Add back DEBUG_FS
        arm64: dts: socfpga: agilex: Fix gmac compatible
        ARM: bcm2835_defconfig: Explicitly restore CONFIG_DEBUG_FS
        arm64: dts: meson: fix gxm-khadas-vim2 wifi
        arm64: dts: meson-sm1-sei610: add missing interrupt-names
        ARM: meson: Drop unneeded select of COMMON_CLK
        ARM: dts: bcm2711: Add pcie0 alias
        ARM: dts: bcm283x: Add missing properties to the PWR LED
        tee: amdtee: fix memory leak in amdtee_open_session()
        ARM: OMAP2+: Fix compile if CONFIG_HAVE_ARM_SMCCC is not set
        arm: dts: dra76x: Fix mmc3 max-frequency
        ARM: dts: dra7: Add "dma-ranges" property to PCIe RC DT nodes
        bus: ti-sysc: Fix 1-wire reset quirk
        ARM: dts: r8a7779: Remove deprecated "renesas, rcar-sata" compatible value
        soc: imx-scu: Align imx sc msg structs to 4
        firmware: imx: Align imx_sc_msg_req_cpu_start to 4
        firmware: imx: scu-pd: Align imx sc msg structs to 4
        firmware: imx: misc: Align imx sc msg structs to 4
        firmware: imx: scu: Ensure sequential TX
        ARM: dts: imx7-colibri: Fix frequency for sd/mmc
        ...
      62790268
    • Linus Torvalds's avatar
      Merge tag 'edac_urgent-2020-03-08' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras · efe582a1
      Linus Torvalds authored
      Pull EDAC fix from Borislav Petkov:
       "Error reporting fix for synopsys_edac: do not overwrite partial
        decoded error message (Sherry Sun)"
      
      * tag 'edac_urgent-2020-03-08' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras:
        EDAC/synopsys: Do not print an error with back-to-back snprintf() calls
      efe582a1
  3. 08 Mar, 2020 5 commits
    • Linus Torvalds's avatar
      Merge tag 'char-misc-5.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc · 378fee2e
      Linus Torvalds authored
      Pull char/misc fixes from Greg KH:
       "Here are four small char/misc driver fixes for reported issues for
        5.6-rc5.
      
        These fixes are:
      
         - binder fix for a potential use-after-free problem found (took two
           tries to get it right)
      
         - interconnect core fix
      
         - altera-stapl driver fix
      
        All four of these have been in linux-next for a while with no reported
        issues"
      
      * tag 'char-misc-5.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
        binder: prevent UAF for binderfs devices II
        interconnect: Handle memory allocation errors
        altera-stapl: altera_get_note: prevent write beyond end of 'key'
        binder: prevent UAF for binderfs devices
      378fee2e
    • Linus Torvalds's avatar
      Merge tag 'driver-core-5.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core · b34e5c13
      Linus Torvalds authored
      Pull driver core and debugfs fixes from Greg KH:
       "Here are four small driver core / debugfs patches for 5.6-rc3:
      
         - debugfs api cleanup now that all debugfs_create_regset32() callers
           have been fixed up. This was waiting until after the -rc1 merge as
           these fixes came in through different trees
      
         - driver core sync state fixes based on reports of minor issues found
           in the feature
      
        All of these have been in linux-next with no reported issues"
      
      * tag 'driver-core-5.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core:
        driver core: Skip unnecessary work when device doesn't have sync_state()
        driver core: Add dev_has_sync_state()
        driver core: Call sync_state() even if supplier has no consumers
        debugfs: remove return value of debugfs_create_regset32()
      b34e5c13
    • Linus Torvalds's avatar
      Merge tag 'tty-5.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty · cc432aee
      Linus Torvalds authored
      Pull tty/serial fixes from Greg KH:
       "Here are some small tty/serial fixes for 5.6-rc5
      
        Just some small serial driver fixes, and a vt core fixup, full details
        are:
      
         - vt fixes for issues found by syzbot
      
         - serdev fix for Apple boxes
      
         - fsl_lpuart serial driver fixes
      
         - MAINTAINER update for incorrect serial files
      
         - new device ids for 8250_exar driver
      
         - mvebu-uart fix
      
        All of these have been in linux-next with no reported issues"
      
      * tag 'tty-5.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
        tty: serial: fsl_lpuart: free IDs allocated by IDA
        Revert "tty: serial: fsl_lpuart: drop EARLYCON_DECLARE"
        serdev: Fix detection of UART devices on Apple machines.
        MAINTAINERS: Add missed files related to Synopsys DesignWare UART
        serial: 8250_exar: add support for ACCES cards
        tty:serial:mvebu-uart:fix a wrong return
        vt: selection, push sel_lock up
        vt: selection, push console lock down
      cc432aee
    • Linus Torvalds's avatar
      Merge tag 'usb-5.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb · fd3f6cc9
      Linus Torvalds authored
      Pull USB/PHY fixes from Greg KH:
       "Here are some small USB and PHY driver fixes for reported issues for
        5.6-rc5.
      
        Included in here are:
      
         - phy driver fixes
      
         - new USB quirks
      
         - USB cdns3 gadget driver fixes
      
         - USB hub core fixes
      
        All of these have been in linux-next with no reported issues"
      
      * tag 'usb-5.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
        usb: dwc3: gadget: Update chain bit correctly when using sg list
        usb: core: port: do error out if usb_autopm_get_interface() fails
        usb: core: hub: do error out if usb_autopm_get_interface() fails
        usb: core: hub: fix unhandled return by employing a void function
        usb: storage: Add quirk for Samsung Fit flash
        usb: quirks: add NO_LPM quirk for Logitech Screen Share
        usb: usb251xb: fix regulator probe and error handling
        phy: allwinner: Fix GENMASK misuse
        usb: cdns3: gadget: toggle cycle bit before reset endpoint
        usb: cdns3: gadget: link trb should point to next request
        phy: mapphone-mdm6600: Fix timeouts by adding wake-up handling
        phy: brcm-sata: Correct MDIO operations for 40nm platforms
        phy: ti: gmii-sel: do not fail in case of gmii
        phy: ti: gmii-sel: fix set of copy-paste errors
        phy: core: Fix phy_get() to not return error on link creation failure
        phy: mapphone-mdm6600: Fix write timeouts with shorter GPIO toggle interval
      fd3f6cc9
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma · 61a09258
      Linus Torvalds authored
      Pull rdma fixes from Jason Gunthorpe:
       "Nothing particularly exciting, some small ODP regressions from the mmu
        notifier rework, another bunch of syzkaller fixes, and a bug fix for a
        botched syzkaller fix in the first rc pull request.
      
         - Fix busted syzkaller fix in 'get_new_pps' - this turned out to
           crash on certain HW configurations
      
         - Bug fixes for various missed things in error unwinds
      
         - Add a missing rcu_read_lock annotation in hfi/qib
      
         - Fix two ODP related regressions from the recent mmu notifier
           changes
      
         - Several more syzkaller bugs in siw, RDMA netlink, verbs and iwcm
      
         - Revert an old patch in CMA as it is now shown to not be allocating
           port numbers properly"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
        RDMA/iwcm: Fix iwcm work deallocation
        RDMA/siw: Fix failure handling during device creation
        RDMA/nldev: Fix crash when set a QP to a new counter but QPN is missing
        RDMA/odp: Ensure the mm is still alive before creating an implicit child
        RDMA/core: Fix protection fault in ib_mr_pool_destroy
        IB/mlx5: Fix implicit ODP race
        IB/hfi1, qib: Ensure RCU is locked when accessing list
        RDMA/core: Fix pkey and port assignment in get_new_pps
        RMDA/cm: Fix missing ib_cm_destroy_id() in ib_cm_insert_listen()
        RDMA/rw: Fix error flow during RDMA context initialization
        RDMA/core: Fix use of logical OR in get_new_pps
        Revert "RDMA/cma: Simplify rdma_resolve_addr() error flow"
      61a09258
  4. 07 Mar, 2020 10 commits
    • Linus Torvalds's avatar
      Merge tag 'io_uring-5.6-2020-03-07' of git://git.kernel.dk/linux-block · c2003765
      Linus Torvalds authored
      Pull io_uring fixes from Jens Axboe:
       "Here are a few io_uring fixes that should go into this release. This
        contains:
      
         - Removal of (now) unused io_wq_flush() and associated flag (Pavel)
      
         - Fix cancelation lockup with linked timeouts (Pavel)
      
         - Fix for potential use-after-free when freeing percpu ref for fixed
           file sets
      
         - io-wq cancelation fixups (Pavel)"
      
      * tag 'io_uring-5.6-2020-03-07' of git://git.kernel.dk/linux-block:
        io_uring: fix lockup with timeouts
        io_uring: free fixed_file_data after RCU grace period
        io-wq: remove io_wq_flush and IO_WQ_WORK_INTERNAL
        io-wq: fix IO_WQ_WORK_NO_CANCEL cancellation
      c2003765
    • Linus Torvalds's avatar
      Merge tag 'block-5.6-2020-03-07' of git://git.kernel.dk/linux-block · 5dfcc139
      Linus Torvalds authored
      Pull block fixes from Jens Axboe:
       "Here are a few fixes that should go into this release. This contains:
      
         - Revert of a bad bcache patch from this merge window
      
         - Removed unused function (Daniel)
      
         - Fixup for the blktrace fix from Jan from this release (Cengiz)
      
         - Fix of deeper level bfqq overwrite in BFQ (Carlo)"
      
      * tag 'block-5.6-2020-03-07' of git://git.kernel.dk/linux-block:
        block, bfq: fix overwrite of bfq_group pointer in bfq_find_set_group()
        blktrace: fix dereference after null check
        Revert "bcache: ignore pending signals when creating gc and allocator thread"
        block: Remove used kblockd_schedule_work_on()
      5dfcc139
    • Linus Torvalds's avatar
      Merge tag 'media/v5.6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media · 6f784a31
      Linus Torvalds authored
      Pull media fixes from Mauro Carvalho Chehab:
      
       - a fix for the media controller links in both hantro driver and in
         v4l2-mem2mem core
      
       - some fixes for the pulse8-cec driver
      
       - vicodec: handle alpha channel for RGB32 formats, as it may be used
      
       - mc-entity.c: fix handling of pad flags
      
      * tag 'media/v5.6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
        media: hantro: Fix broken media controller links
        media: mc-entity.c: use & to check pad flags, not ==
        media: v4l2-mem2mem.c: fix broken links
        media: vicodec: process all 4 components for RGB32 formats
        media: pulse8-cec: close serio in disconnect, not adap_free
        media: pulse8-cec: INIT_DELAYED_WORK was called too late
      6f784a31
    • Pavel Begunkov's avatar
      io_uring: fix lockup with timeouts · f0e20b89
      Pavel Begunkov authored
      There is a recipe to deadlock the kernel: submit a timeout sqe with a
      linked_timeout (e.g.  test_single_link_timeout_ception() from liburing),
      and SIGKILL the process.
      
      Then, io_kill_timeouts() takes @ctx->completion_lock, but the timeout
      isn't flagged with REQ_F_COMP_LOCKED, and will try to double grab it
      during io_put_free() to cancel the linked timeout. Probably, the same
      can happen with another io_kill_timeout() call site, that is
      io_commit_cqring().
      Signed-off-by: default avatarPavel Begunkov <asml.silence@gmail.com>
      Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      f0e20b89
    • Linus Torvalds's avatar
      Merge tag 's390-5.6-5' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux · 9d588f63
      Linus Torvalds authored
      Pull s390 fixes from Vasily Gorbik:
      
       - Fix panic in gup_fast on large pud by providing an implementation of
         pud_write. This has been overlooked during migration to common gup
         code.
      
       - Fix unexpected write combining on PCI stores.
      
      * tag 's390-5.6-5' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
        s390/pci: Fix unexpected write combine on resource
        s390/mm: fix panic in gup_fast on large pud
      9d588f63
    • Linus Torvalds's avatar
      Merge tag 'powerpc-5.6-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux · 5236647a
      Linus Torvalds authored
      Pull powerpc fixes from Michael Ellerman:
       "Some more powerpc fixes for 5.6:
      
         - One fix for a recent regression to our breakpoint/watchpoint code.
      
         - Another fix for our KUAP support, this time a missing annotation in
           a rarely used path in signal handling.
      
         - A fix for our handling of a CPU feature that effects the PMU, when
           booting guests in some configurations.
      
         - A minor fix to our linker script to explicitly include the .BTF
           section.
      
        Thanks to: Christophe Leroy, Desnes A. Nunes do Rosario, Leonardo
        Bras, Naveen N. Rao, Ravi Bangoria, Stefan Berger"
      
      * tag 'powerpc-5.6-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
        powerpc/mm: Fix missing KUAP disable in flush_coherent_icache()
        powerpc: fix hardware PMU exception bug on PowerVM compatibility mode systems
        powerpc: Include .BTF section
        powerpc/watchpoint: Don't call dar_within_range() for Book3S
      5236647a
    • Linus Torvalds's avatar
      Merge tag 'for-linus-5.6b-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip · cbee7c8b
      Linus Torvalds authored
      Pull xen fixes from Juergen Gross:
       "Four fixes and a small cleanup patch:
      
         - two fixes by Dongli Zhang fixing races in the xenbus driver
      
         - two fixes by me fixing issues introduced in 5.6
      
         - a small cleanup by Gustavo Silva replacing a zero-length array with
           a flexible-array"
      
      * tag 'for-linus-5.6b-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
        xen/blkfront: fix ring info addressing
        xen/xenbus: fix locking
        xenbus: req->err should be updated before req->state
        xenbus: req->body should be updated before req->state
        xen: Replace zero-length array with flexible-array member
      cbee7c8b
    • Linus Torvalds's avatar
      Merge tag 'for-linus-2020-03-07' of gitolite.kernel.org:pub/scm/linux/kernel/git/brauner/linux · fa883d6a
      Linus Torvalds authored
      Pull thread fixes from Christian Brauner:
       "Here are a few hopefully uncontroversial fixes:
      
         - Use RCU_INIT_POINTER() when initializing rcu protected members in
           task_struct to fix sparse warnings.
      
         - Add pidfd_fdinfo_test binary to .gitignore file"
      
      * tag 'for-linus-2020-03-07' of gitolite.kernel.org:pub/scm/linux/kernel/git/brauner/linux:
        selftests: pidfd: Add pidfd_fdinfo_test in .gitignore
        exit: Fix Sparse errors and warnings
        fork: Use RCU_INIT_POINTER() instead of rcu_access_pointer()
      fa883d6a
    • Linus Torvalds's avatar
      Merge tag 'sound-5.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · 676fc8de
      Linus Torvalds authored
      Pull sound fixes from Takashi Iwai:
       "The regular "bump-in-the-middle" updates, containing mostly ASoC-
        related fixes at this time. All changes are reasonably small.
      
        A few entries are for ASoC and ALSA core parts (DAPM, PCM, topology)
        for followups of the recent changes and potential buffer overflow by
        snprintf(), while the rest are (both new and old) device-specific
        fixes for Intel, meson, tas2562, rt1015, as well as the usual HD-audio
        quirks"
      
      * tag 'sound-5.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (25 commits)
        ALSA: sgio2audio: Remove usage of dropped hw_params/hw_free functions
        ALSA: hda/realtek - Enable the headset of ASUS B9450FA with ALC294
        ALSA: hda/realtek - Fix silent output on Gigabyte X570 Aorus Master
        ALSA: hda/realtek - Add Headset Button supported for ThinkPad X1
        ALSA: hda/realtek - Add Headset Mic supported
        ASoC: wm8741: Fix typo in Kconfig prompt
        ASoC: stm32: sai: manage rebind issue
        ASoC: SOF: Fix snd_sof_ipc_stream_posn()
        ASoC: rt1015: modify pre-divider for sysclk
        ASoC: rt1015: add operation callback function for rt1015_dai[]
        ASoC: soc-component: tidyup snd_soc_pcm_component_sync_stop()
        ASoC: dapm: Correct DAPM handling of active widgets during shutdown
        ASoC: tas2562: Fix sample rate error message
        ASoC: Intel: Skylake: Fix available clock counter incrementation
        ASoC: soc-pcm/soc-compress: don't use snd_soc_dapm_stream_stop()
        ASoC: meson: g12a: add tohdmitx reset
        ASoC: pcm512x: Fix unbalanced regulator enable call in probe error path
        ASoC: soc-core: fix for_rtd_codec_dai_rollback() macro
        ASoC: topology: Fix memleak in soc_tplg_manifest_load()
        ASoC: topology: Fix memleak in soc_tplg_link_elems_load()
        ...
      676fc8de
    • Takashi Iwai's avatar
      Merge tag 'asoc-fix-v5.6-rc4' of... · 5a56996b
      Takashi Iwai authored
      Merge tag 'asoc-fix-v5.6-rc4' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus
      
      ASoC: Fixes for v5.6
      
      More fixes that have arrived since the merge window, spread out all
      over.  There's a few things like the operation callback addition for
      rt1015 and the meson reset addition which add small new bits of
      functionality to fix non-working systems, they're all very small and for
      parts of newly added functionality.
      5a56996b
  5. 06 Mar, 2020 17 commits
    • Linus Torvalds's avatar
      Merge tag 'linux-kselftest-5.6-rc5' of... · 63849c8f
      Linus Torvalds authored
      Merge tag 'linux-kselftest-5.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest
      
      Pull kselftest update from Shuah Khan:
       "This consists of a cleanup patch to undo changes to global .gitignore
        that added selftests/lkdtm objects and add them to a local
        selftests/lkdtm/.gitignore.
      
        Summary of Linus's comments on local vs. global gitignore scope:
      
         - Keep local gitignore patterns in local files.
      
         - Put only global gitignore patterns in the top-level gitignore file.
      
        Local scope keeps things much better separated. It also incidentally
        means that if a directory gets renamed, the gitignore file continues
        to work unless in the case of renaming the actual files themselves
        that are named in the gitignore"
      
      * tag 'linux-kselftest-5.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest:
        selftest/lkdtm: Use local .gitignore
      63849c8f
    • Linus Torvalds's avatar
      Merge tag 'riscv-for-linus-5.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux · 7e6582ef
      Linus Torvalds authored
      Pull RISC-V fixes from Palmer Dabbelt:
       "This contains a handful of fixes that I would like to target for 5.6:
      
         - A pair of fixes to module loading, which we hope solve the last of
           the issues with module text being loaded too sparsely for our call
           relocations.
      
         - A Kconfig fix that disallows selecting memory models not supported
           by NOMMU.
      
         - A series of Kconfig updates to ease selecting the drivers necessary
           to run on QEMU's virt platform.
      
         - DTS updates for SiFive's HiFive Unleashed.
      
         - A fix to our seccomp support that avoids mangling restartable
           syscalls"
      
      * tag 'riscv-for-linus-5.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
        riscv: fix seccomp reject syscall code path
        riscv: dts: Add GPIO reboot method to HiFive Unleashed DTS file
        RISC-V: Select Goldfish RTC driver for QEMU virt machine
        RISC-V: Select SYSCON Reboot and Poweroff for QEMU virt machine
        RISC-V: Enable QEMU virt machine support in defconfigs
        RISC-V: Add kconfig option for QEMU virt machine
        riscv: Fix range looking for kernel image memblock
        riscv: Force flat memory model with no-mmu
        riscv: Change code model of module to medany to improve data accessing
        riscv: avoid the PIC offset of static percpu data in module beyond 2G limits
      7e6582ef
    • Jonathan Neuschäfer's avatar
      parse-maintainers: Mark as executable · 611d61f9
      Jonathan Neuschäfer authored
      This makes the script more convenient to run.
      Signed-off-by: default avatarJonathan Neuschäfer <j.neuschaefer@gmx.net>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      611d61f9
    • Linus Torvalds's avatar
      Merge tag 'devicetree-fixes-for-5.6-3' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux · bdf1ea7c
      Linus Torvalds authored
      Pull devicetree fixes from Rob Herring:
       "Another batch of DT fixes. I think this should be the last of it, but
        sending pull requests seems to cause people to send more fixes.
      
        Summary:
      
         - Fixes for warnings introduced by hierarchical PSCI binding changes
      
         - Fixes for broken doc references due to DT schema conversions
      
         - Several grammar and typo fixes
      
         - Fix a bunch of dtc warnings in examples"
      
      * tag 'devicetree-fixes-for-5.6-3' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux:
        dt-bindings: arm: Fixup the DT bindings for hierarchical PSCI states
        dt-bindings: power: Extend nodename pattern for power-domain providers
        MAINTAINERS: update ALLWINNER CPUFREQ DRIVER entry
        dt-bindings: bus: Drop empty compatible string in example
        dt-bindings: power: Convert domain-idle-states bindings to json-schema
        dt-bindings: arm: Fix cpu compatibles in the hierarchical example for PSCI
        dt-bindings: arm: Correct links to idle states definitions
        dt-bindings: mfd: Fix typo in file name of twl-familly.txt
        dt-bindings: mfd: tps65910: Improve grammar
        dt-bindings: mfd: zii,rave-sp: Fix a typo ("onborad")
        dt-bindings: arm: fsl: fix APF6Dev compatible
        dt-bindings: Fix dtc warnings in examples
        docs: dt: fix several broken doc references
        docs: dt: fix several broken references due to renames
        MAINTAINERS: clean up PCIE DRIVER FOR CAVIUM THUNDERX
      bdf1ea7c
    • Linus Torvalds's avatar
      Merge tag 'drm-fixes-2020-03-06-1' of git://anongit.freedesktop.org/drm/drm · 2f501bb1
      Linus Torvalds authored
      Pull vgacon fix from Daniel Vetter:
       "One vgacon input check for stable"
      
      * tag 'drm-fixes-2020-03-06-1' of git://anongit.freedesktop.org/drm/drm:
        vgacon: Fix a UAF in vgacon_invert_region
      2f501bb1
    • Linus Torvalds's avatar
      Merge tag 'for-5.6-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux · 30fe0d07
      Linus Torvalds authored
      Pull btrfs fix from David Sterba:
       "One fixup for DIO when in use with the new checksums, a missed case
        where the checksum size was still assuming u32"
      
      * tag 'for-5.6-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
        btrfs: fix RAID direct I/O reads with alternate csums
      30fe0d07
    • Linus Torvalds's avatar
      Merge tag 'filelock-v5.6-1' of git://git.kernel.org/pub/scm/linux/kernel/git/jlayton/linux · 0b25d458
      Linus Torvalds authored
      Pull file locking fixes from Jeff Layton:
       "Just a couple of late-breaking patches for the file locking code. The
        second patch (from yangerkun) fixes a rather nasty looking potential
        use-after-free that should go to stable.
      
        The other patch could technically wait for 5.7, but it's fairly
        innocuous so I figured we might as well take it"
      
      * tag 'filelock-v5.6-1' of git://git.kernel.org/pub/scm/linux/kernel/git/jlayton/linux:
        locks: fix a potential use-after-free problem when wakeup a waiter
        fcntl: Distribute switch variables for initialization
      0b25d458
    • Linus Torvalds's avatar
      Merge tag 'spi-fix-v5.6-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi · ae24a21b
      Linus Torvalds authored
      Pull spi fixes from Mark Brown:
       "A selection of small fixes, mostly for drivers, that have arrived
        since the merge window. None of them are earth shattering in
        themselves but all useful for affected systems"
      
      * tag 'spi-fix-v5.6-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
        spi: spi_register_controller(): free bus id on error paths
        spi: bcm63xx-hsspi: Really keep pll clk enabled
        spi: atmel-quadspi: fix possible MMIO window size overrun
        spi/zynqmp: remove entry that causes a cs glitch
        spi: pxa2xx: Add CS control clock quirk
        spi: spidev: Fix CS polarity if GPIO descriptors are used
        spi: qup: call spi_qup_pm_resume_runtime before suspending
        spi: spi-omap2-mcspi: Support probe deferral for DMA channels
        spi: spi-omap2-mcspi: Handle DMA size restriction on AM65x
      ae24a21b
    • Linus Torvalds's avatar
      Merge tag 'regulator-fix-v5.6-rc4' of... · 43c63729
      Linus Torvalds authored
      Merge tag 'regulator-fix-v5.6-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator
      
      Pull regulator fixes from Mark Brown:
       "A couple of small fixes, one for a minor issue in the stm32-vrefbuf
        driver and a documentation fix in the Qualcomm code"
      
      * tag 'regulator-fix-v5.6-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
        regulator: stm32-vrefbuf: fix a possible overshoot when re-enabling
        regulator: qcom_spmi: Fix docs for PM8004
      43c63729
    • Linus Torvalds's avatar
      Merge tag 'hwmon-for-v5.6-rc5' of... · 08e39fcb
      Linus Torvalds authored
      Merge tag 'hwmon-for-v5.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging
      
      Pull hwmon fixes from Guenter Roeck:
       "Fix an error return in the adt7462 driver, bad voltage limits reported
        by the xdpe12284 driver, and a broken documentation reference in the
        adm1177 driver documentation"
      
      * tag 'hwmon-for-v5.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
        hwmon: (adt7462) Fix an error return in ADT7462_REG_VOLT()
        hwmon: (pmbus/xdpe12284) Add callback for vout limits conversion
        docs: adm1177: fix a broken reference
      08e39fcb
    • Linus Torvalds's avatar
      Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux · c20c4a08
      Linus Torvalds authored
      Pull arm64 fixes from Will Deacon:
       "Here are another three arm64 fixes for 5.6, all pretty minor. Main
        thing is fixing a silly bug in the fsl_imx8_ddr PMU driver where we
        would zero the counters when disabling them.
      
         - Fix misreporting of ASID limit when KPTI is enabled
      
         - Fix busted NULL pointer checks for GICC structure in ACPI PMU code
      
         - Avoid nobbling the "fsl_imx8_ddr" PMU counters when disabling them"
      
      * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
        arm64: context: Fix ASID limit in boot messages
        drivers/perf: arm_pmu_acpi: Fix incorrect checking of gicc pointer
        drivers/perf: fsl_imx8_ddr: Correct the CLEAR bit definition
      c20c4a08
    • Zhang Xiaoxu's avatar
      vgacon: Fix a UAF in vgacon_invert_region · 513dc792
      Zhang Xiaoxu authored
      When syzkaller tests, there is a UAF:
        BUG: KASan: use after free in vgacon_invert_region+0x9d/0x110 at addr
          ffff880000100000
        Read of size 2 by task syz-executor.1/16489
        page:ffffea0000004000 count:0 mapcount:-127 mapping:          (null)
        index:0x0
        page flags: 0xfffff00000000()
        page dumped because: kasan: bad access detected
        CPU: 1 PID: 16489 Comm: syz-executor.1 Not tainted
        Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
        rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org 04/01/2014
        Call Trace:
          [<ffffffffb119f309>] dump_stack+0x1e/0x20
          [<ffffffffb04af957>] kasan_report+0x577/0x950
          [<ffffffffb04ae652>] __asan_load2+0x62/0x80
          [<ffffffffb090f26d>] vgacon_invert_region+0x9d/0x110
          [<ffffffffb0a39d95>] invert_screen+0xe5/0x470
          [<ffffffffb0a21dcb>] set_selection+0x44b/0x12f0
          [<ffffffffb0a3bfae>] tioclinux+0xee/0x490
          [<ffffffffb0a1d114>] vt_ioctl+0xff4/0x2670
          [<ffffffffb0a0089a>] tty_ioctl+0x46a/0x1a10
          [<ffffffffb052db3d>] do_vfs_ioctl+0x5bd/0xc40
          [<ffffffffb052e2f2>] SyS_ioctl+0x132/0x170
          [<ffffffffb11c9b1b>] system_call_fastpath+0x22/0x27
          Memory state around the buggy address:
           ffff8800000fff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00
           00 00
           ffff8800000fff80: 00 00 00 00 00 00 00 00 00 00 00 00 00
           00 00 00
          >ffff880000100000: ff ff ff ff ff ff ff ff ff ff ff ff ff
           ff ff ff
      
      It can be reproduce in the linux mainline by the program:
        #include <stdio.h>
        #include <stdlib.h>
        #include <unistd.h>
        #include <fcntl.h>
        #include <sys/types.h>
        #include <sys/stat.h>
        #include <sys/ioctl.h>
        #include <linux/vt.h>
      
        struct tiocl_selection {
          unsigned short xs;      /* X start */
          unsigned short ys;      /* Y start */
          unsigned short xe;      /* X end */
          unsigned short ye;      /* Y end */
          unsigned short sel_mode; /* selection mode */
        };
      
        #define TIOCL_SETSEL    2
        struct tiocl {
          unsigned char type;
          unsigned char pad;
          struct tiocl_selection sel;
        };
      
        int main()
        {
          int fd = 0;
          const char *dev = "/dev/char/4:1";
      
          struct vt_consize v = {0};
          struct tiocl tioc = {0};
      
          fd = open(dev, O_RDWR, 0);
      
          v.v_rows = 3346;
          ioctl(fd, VT_RESIZEX, &v);
      
          tioc.type = TIOCL_SETSEL;
          ioctl(fd, TIOCLINUX, &tioc);
      
          return 0;
        }
      
      When resize the screen, update the 'vc->vc_size_row' to the new_row_size,
      but when 'set_origin' in 'vgacon_set_origin', vgacon use 'vga_vram_base'
      for 'vc_origin' and 'vc_visible_origin', not 'vc_screenbuf'. It maybe
      smaller than 'vc_screenbuf'. When TIOCLINUX, use the new_row_size to calc
      the offset, it maybe larger than the vga_vram_size in vgacon driver, then
      bad access.
      Also, if set an larger screenbuf firstly, then set an more larger
      screenbuf, when copy old_origin to new_origin, a bad access may happen.
      
      So, If the screen size larger than vga_vram, resize screen should be
      failed. This alse fix CVE-2020-8649 and CVE-2020-8647.
      
      Linus pointed out that overflow checking seems absent. We're saved by
      the existing bounds checks in vc_do_resize() with rather strict
      limits:
      
      	if (cols > VC_RESIZE_MAXCOL || lines > VC_RESIZE_MAXROW)
      		return -EINVAL;
      
      Fixes: 0aec4867 ("[PATCH] SVGATextMode fix")
      Reference: CVE-2020-8647 and CVE-2020-8649
      Reported-by: default avatarHulk Robot <hulkci@huawei.com>
      Signed-off-by: default avatarZhang Xiaoxu <zhangxiaoxu5@huawei.com>
      [danvet: augment commit message to point out overflow safety]
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
      Link: https://patchwork.freedesktop.org/patch/msgid/20200304022429.37738-1-zhangxiaoxu5@huawei.com
      513dc792
    • Ulf Hansson's avatar
      dt-bindings: arm: Fixup the DT bindings for hierarchical PSCI states · d2334a91
      Ulf Hansson authored
      The hierarchical topology with power-domain should be described through
      child nodes, rather than as currently described in the PSCI root node. Fix
      this by adding a patternProperties with a corresponding reference to the
      power-domain DT binding.
      
      Additionally, update the example to conform to the new pattern, but also to
      the adjusted domain-idle-state DT binding.
      
      Fixes: a3f048b5 ("dt: psci: Update DT bindings to support hierarchical PSCI states")
      Signed-off-by: default avatarUlf Hansson <ulf.hansson@linaro.org>
      [robh: Add missing allOf, tweak power-domain node name]
      Signed-off-by: default avatarRob Herring <robh@kernel.org>
      d2334a91
    • Ulf Hansson's avatar
      dt-bindings: power: Extend nodename pattern for power-domain providers · 14ee09a0
      Ulf Hansson authored
      The existing binding requires the nodename to have a '@', which is a bit
      limiting for the wider use case. Therefore, let's extend the pattern to
      allow either '@' or '-'.
      
      Fixes: a3f048b5 ("dt: psci: Update DT bindings to support hierarchical PSCI states")
      Signed-off-by: default avatarUlf Hansson <ulf.hansson@linaro.org>
      [robh: drop example change]
      Signed-off-by: default avatarRob Herring <robh@kernel.org>
      14ee09a0
    • Jens Axboe's avatar
      io_uring: free fixed_file_data after RCU grace period · c1e2148f
      Jens Axboe authored
      The percpu refcount protects this structure, and we can have an atomic
      switch in progress when exiting. This makes it unsafe to just free the
      struct normally, and can trigger the following KASAN warning:
      
      BUG: KASAN: use-after-free in percpu_ref_switch_to_atomic_rcu+0xfa/0x1b0
      Read of size 1 at addr ffff888181a19a30 by task swapper/0/0
      
      CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.6.0-rc4+ #5747
      Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
      Call Trace:
       <IRQ>
       dump_stack+0x76/0xa0
       print_address_description.constprop.0+0x3b/0x60
       ? percpu_ref_switch_to_atomic_rcu+0xfa/0x1b0
       ? percpu_ref_switch_to_atomic_rcu+0xfa/0x1b0
       __kasan_report.cold+0x1a/0x3d
       ? percpu_ref_switch_to_atomic_rcu+0xfa/0x1b0
       percpu_ref_switch_to_atomic_rcu+0xfa/0x1b0
       rcu_core+0x370/0x830
       ? percpu_ref_exit+0x50/0x50
       ? rcu_note_context_switch+0x7b0/0x7b0
       ? run_rebalance_domains+0x11d/0x140
       __do_softirq+0x10a/0x3e9
       irq_exit+0xd5/0xe0
       smp_apic_timer_interrupt+0x86/0x200
       apic_timer_interrupt+0xf/0x20
       </IRQ>
      RIP: 0010:default_idle+0x26/0x1f0
      
      Fix this by punting the final exit and free of the struct to RCU, then
      we know that it's safe to do so. Jann suggested the approach of using a
      double rcu callback to achieve this. It's important that we do a nested
      call_rcu() callback, as otherwise the free could be ordered before the
      atomic switch, even if the latter was already queued.
      
      Reported-by: syzbot+e017e49c39ab484ac87a@syzkaller.appspotmail.com
      Suggested-by: default avatarJann Horn <jannh@google.com>
      Reviewed-by: default avatarPaul E. McKenney <paulmck@kernel.org>
      Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      c1e2148f
    • yangerkun's avatar
      locks: fix a potential use-after-free problem when wakeup a waiter · 6d390e4b
      yangerkun authored
      '16306a61 ("fs/locks: always delete_block after waiting.")' add the
      logic to check waiter->fl_blocker without blocked_lock_lock. And it will
      trigger a UAF when we try to wakeup some waiter:
      
      Thread 1 has create a write flock a on file, and now thread 2 try to
      unlock and delete flock a, thread 3 try to add flock b on the same file.
      
      Thread2                         Thread3
                                      flock syscall(create flock b)
      	                        ...flock_lock_inode_wait
      				    flock_lock_inode(will insert
      				    our fl_blocked_member list
      				    to flock a's fl_blocked_requests)
      				   sleep
      flock syscall(unlock)
      ...flock_lock_inode_wait
          locks_delete_lock_ctx
          ...__locks_wake_up_blocks
              __locks_delete_blocks(
      	b->fl_blocker = NULL)
      	...
                                         break by a signal
      				   locks_delete_block
      				    b->fl_blocker == NULL &&
      				    list_empty(&b->fl_blocked_requests)
      	                            success, return directly
      				 locks_free_lock b
      	wake_up(&b->fl_waiter)
      	trigger UAF
      
      Fix it by remove this logic, and this patch may also fix CVE-2019-19769.
      
      Cc: stable@vger.kernel.org
      Fixes: 16306a61 ("fs/locks: always delete_block after waiting.")
      Signed-off-by: default avataryangerkun <yangerkun@huawei.com>
      Signed-off-by: default avatarJeff Layton <jlayton@kernel.org>
      6d390e4b
    • Carlo Nonato's avatar
      block, bfq: fix overwrite of bfq_group pointer in bfq_find_set_group() · 14afc593
      Carlo Nonato authored
      The bfq_find_set_group() function takes as input a blkcg (which represents
      a cgroup) and retrieves the corresponding bfq_group, then it updates the
      bfq internal group hierarchy (see comments inside the function for why
      this is needed) and finally it returns the bfq_group.
      In the hierarchy update cycle, the pointer holding the correct bfq_group
      that has to be returned is mistakenly used to traverse the hierarchy
      bottom to top, meaning that in each iteration it gets overwritten with the
      parent of the current group. Since the update cycle stops at root's
      children (depth = 2), the overwrite becomes a problem only if the blkcg
      describes a cgroup at a hierarchy level deeper than that (depth > 2). In
      this case the root's child that happens to be also an ancestor of the
      correct bfq_group is returned. The main consequence is that processes
      contained in a cgroup at depth greater than 2 are wrongly placed in the
      group described above by BFQ.
      
      This commits fixes this problem by using a different bfq_group pointer in
      the update cycle in order to avoid the overwrite of the variable holding
      the original group reference.
      Reported-by: default avatarKwon Je Oh <kwonje.oh2@gmail.com>
      Signed-off-by: default avatarCarlo Nonato <carlo.nonato95@gmail.com>
      Signed-off-by: default avatarPaolo Valente <paolo.valente@linaro.org>
      Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      14afc593