Commit Graph

1217195 Commits

Author SHA1 Message Date
Johannes Berg
c434b2be2d wifi: cfg80211: fix assoc response warning on failed links
The warning here shouldn't be done before we even set the
bss field (or should've used the input data). Move the
assignment before the warning to fix it.

We noticed this now because of Wen's bugfix, where the bug
fixed there had previously hidden this other bug.

Fixes: 53ad07e982 ("wifi: cfg80211: support reporting failed links")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-10-23 13:25:30 +02:00
Ben Greear
3e3929ef88 wifi: cfg80211: pass correct pointer to rdev_inform_bss()
Confusing struct member names here resulted in passing
the wrong pointer, causing crashes. Pass the correct one.

Fixes: eb142608e2 ("wifi: cfg80211: use a struct for inform_single_bss data")
Signed-off-by: Ben Greear <greearb@candelatech.com>
Link: https://lore.kernel.org/r/20231021154827.1142734-1-greearb@candelatech.com
[rewrite commit message, add fixes]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2023-10-23 13:24:51 +02:00
Kunwu Chan
13454e6e0d isdn: mISDN: hfcsusb: Spelling fix in comment
protocoll -> protocol

Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
Signed-off-by: David S. Miller <davem@davemloft.net>
2023-10-23 09:39:46 +01:00
Linus Torvalds
05d3ef8bba Linux 6.6-rc7 2023-10-22 12:11:21 -10:00
Linus Torvalds
fe3cfe869d phy fixes for 6.6
- Driver fixes for
    - mapphone-mdm6600 runtime pm & pinctrl handling fixes
    - Qualcomm qmp usb pcs register fixes, qmp pcie register size warning
      fix, m31 fixes for wrong pointer in PTR_ERR and dropping wrong vreg
      check, qmp combo fix for 8550 power config register
    - realtek usb fix for debugfs_create_dir() and kconfig dependency
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEE+vs47OPLdNbVcHzyfBQHDyUjg0cFAmU1VYIACgkQfBQHDyUj
 g0fhAw/+I2F51l+SJ5Y2UKnr4BE2aaVjd1CisnoGKFZ2QCMt76mWHRaZZ1YEYAYR
 NK77rBuR80LXUj9mMoHVdIWleH/tlvDJ8LFpA9H+fvDoKkjjK4g66fCG9GU0V3qv
 oWerSiwaAVGb/yLokJ4KwEaumcMukCsGf6P3SWk/XeFwaxySixcD4nwFzpAalX0z
 ZXot62Xq1cLEriH6yJslU3iySWGfpAL12ygYOFVuaW02tUEmIH+zM7L4jNDgldHD
 gr45T8wbh5M2r8uE9x7thMafk7mcKEjiyV5Er2SLgTwh9fRXa3gOw1I+NHcGM8sM
 YnIXlB+hDZ4SuJKWDxsQn+Y3N/+byvHrYMiKvuN32ysZRA8aIvkqdUMPJyZBYk3j
 ecp4TH8YJ3iEVVDbUsv5v/uBH/drlBdJNLEdc71RiJfppsxI+97okdOGXQBT04Lu
 alifV/ehLaZamJrVzpD1wFlYaZnAc0DnwqxZlepOMghzfiA7qQgV70wlMAkL81DX
 R4da2kgmVWlXcjEmOfDUSFsEaLHiZ9ArZabru0kdq1TYOt8/oVnl9t9T/qqB6qs3
 JioLTLXUry5hFpaGjuGTJeRhkJRnOjSAYuCLiyJGd0tcgA05dHXNHOwIIrJTVi4K
 ksz/x2G+lwQP8EnKpctEkY4v5KKGmJPspymzHTXsAcUFdZr7F4w=
 =ugiS
 -----END PGP SIGNATURE-----

Merge tag 'phy-fixes-6.6' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy

Pull phy fixes from Vinod Koul:

 - mapphone-mdm6600 runtime pm & pinctrl handling fixes

 - Qualcomm qmp usb pcs register fixes, qmp pcie register size warning
   fix, m31 fixes for wrong pointer in PTR_ERR and dropping wrong vreg
   check, qmp combo fix for 8550 power config register

 - realtek usb fix for debugfs_create_dir() and kconfig dependency

* tag 'phy-fixes-6.6' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy:
  phy: realtek: Realtek PHYs should depend on ARCH_REALTEK
  phy: qualcomm: Fix typos in comments
  phy: qcom-qmp-combo: initialize PCS_USB registers
  phy: qcom-qmp-combo: Square out 8550 POWER_STATE_CONFIG1
  phy: qcom: m31: Remove unwanted qphy->vreg is NULL check
  phy: realtek: usb: Drop unnecessary error check for debugfs_create_dir()
  phy: qcom: phy-qcom-m31: change m31_ipq5332_regs to static
  phy: qcom: phy-qcom-m31: fix wrong pointer pass to PTR_ERR()
  dt-bindings: phy: qcom,ipq8074-qmp-pcie: fix warning regarding reg size
  phy: qcom-qmp-usb: split PCS_USB init table for sc8280xp and sa8775p
  phy: qcom-qmp-usb: initialize PCS_USB registers
  phy: mapphone-mdm6600: Fix pinctrl_pm handling for sleep pins
  phy: mapphone-mdm6600: Fix runtime PM for remove
  phy: mapphone-mdm6600: Fix runtime disable on probe
2023-10-22 07:11:10 -10:00
Linus Torvalds
70e65afc23 Final set of EFI tweaks for v6.6:
- don't try to print warnings to the console when it is no longer
   available
 - fix theoretical memory leak in SSDT override handling
 - make sure that the boot_params global variable is set before the KASLR
   code attempts to hash it for 'randomness'
 - avoid soft lockups in the memory acceptance code
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQQQm/3uucuRGn1Dmh0wbglWLn0tXAUCZTKmyAAKCRAwbglWLn0t
 XOvWAQCz+MYqhf3HbmsyuzEV/HWxEw9gf+KGqSN9wmCrOI5nRAEA7pIWUpZ2e6Jt
 eW/6DiyPZ+o7xLMX6J01vLROmQt1ogo=
 =iVui
 -----END PGP SIGNATURE-----

Merge tag 'efi-fixes-for-v6.6-3' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi

Pull EFI fixes from Ard Biesheuvel:
 "The boot_params pointer fix uses a somewhat ugly extern struct
  declaration but this will be cleaned up the next cycle.

   - don't try to print warnings to the console when it is no longer
     available

   - fix theoretical memory leak in SSDT override handling

   - make sure that the boot_params global variable is set before the
     KASLR code attempts to hash it for 'randomness'

   - avoid soft lockups in the memory acceptance code"

* tag 'efi-fixes-for-v6.6-3' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi:
  efi/unaccepted: Fix soft lockups caused by parallel memory acceptance
  x86/boot: efistub: Assign global boot_params variable
  efi: fix memory leak in krealloc failure handling
  x86/efistub: Don't try to print after ExitBootService()
2023-10-22 07:05:28 -10:00
Fred Chen
d2a0fc372a tcp: fix wrong RTO timeout when received SACK reneging
This commit fix wrong RTO timeout when received SACK reneging.

When an ACK arrived pointing to a SACK reneging, tcp_check_sack_reneging()
will rearm the RTO timer for min(1/2*srtt, 10ms) into to the future.

But since the commit 62d9f1a694 ("tcp: fix TLP timer not set when
CA_STATE changes from DISORDER to OPEN") merged, the tcp_set_xmit_timer()
is moved after tcp_fastretrans_alert()(which do the SACK reneging check),
so the RTO timeout will be overwrited by tcp_set_xmit_timer() with
icsk_rto instead of 1/2*srtt.

Here is a packetdrill script to check this bug:
0     socket(..., SOCK_STREAM, IPPROTO_TCP) = 3
+0    bind(3, ..., ...) = 0
+0    listen(3, 1) = 0

// simulate srtt to 100ms
+0    < S 0:0(0) win 32792 <mss 1000, sackOK,nop,nop,nop,wscale 7>
+0    > S. 0:0(0) ack 1 <mss 1460,nop,nop,sackOK,nop,wscale 7>
+.1    < . 1:1(0) ack 1 win 1024

+0    accept(3, ..., ...) = 4

+0    write(4, ..., 10000) = 10000
+0    > P. 1:10001(10000) ack 1

// inject sack
+.1    < . 1:1(0) ack 1 win 257 <sack 1001:10001,nop,nop>
+0    > . 1:1001(1000) ack 1

// inject sack reneging
+.1    < . 1:1(0) ack 1001 win 257 <sack 9001:10001,nop,nop>

// we expect rto fired in 1/2*srtt (50ms)
+.05    > . 1001:2001(1000) ack 1

This fix remove the FLAG_SET_XMIT_TIMER from ack_flag when
tcp_check_sack_reneging() set RTO timer with 1/2*srtt to avoid
being overwrited later.

Fixes: 62d9f1a694 ("tcp: fix TLP timer not set when CA_STATE changes from DISORDER to OPEN")
Signed-off-by: Fred Chen <fred.chenchen03@gmail.com>
Reviewed-by: Neal Cardwell <ncardwell@google.com>
Tested-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2023-10-22 11:47:44 +01:00
Xiang Chen
9b311b7313 ACPI: NFIT: Install Notify() handler before getting NFIT table
If there is no NFIT at startup, it will return 0 immediately in function
acpi_nfit_add() and will not install Notify() handler. If hotplugging
a nvdimm device later, it will not be identified as there is no Notify()
handler.

Install the handler before getting NFI table in function acpi_nfit_add()
to avoid above issue.

Fixes: dcca12ab62 ("ACPI: NFIT: Install Notify() handler directly")
Signed-off-by: Xiang Chen <chenxiang66@hisilicon.com>
[ rjw: Subject and changelog edits ]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2023-10-22 12:47:43 +02:00
David S. Miller
a40614fe88 Merge branch 'r8152-reg-garbage'
Douglas Anderson says:

====================
r8152: Avoid writing garbage to the adapter's registers

This series is the result of a cooperative debug effort between
Realtek and the ChromeOS team. On ChromeOS, we've noticed that Realtek
Ethernet adapters can sometimes get so wedged that even a reboot of
the host can't get them to enumerate again, assuming that the adapter
was on a powered hub and din't lose power when the host rebooted. This
is sometimes seen in the ChromeOS automated testing lab. The only way
to recover adapters in this state is to manually power cycle them.

I managed to reproduce one instance of this wedging (unknown if this
is truly related to what the test lab sees) by doing this:
1. Start a flood ping from a host to the device.
2. Drop the device into kdb.
3. Wait 90 seconds.
4. Resume from kdb (the "g" command).
5. Wait another 45 seconds.

Upon analysis, Realtek realized this was happening:

1. The Linux driver was getting a "Tx timeout" after resuming from kdb
   and then trying to reset itself.
2. As part of the reset, the Linux driver was attempting to do a
   read-modify-write of the adapter's registers.
3. The read would fail (due to a timeout) and the driver pretended
   that the register contained all 0xFFs. See commit f53a7ad189
   ("r8152: Set memory to all 0xFFs on failed reg reads")
4. The driver would take this value of all 0xFFs, modify it, and
   attempt to write it back to the adapter.
5. By this time the USB channel seemed to recover and thus we'd
   successfully write a value that was mostly 0xFFs to the adpater.
6. The adapter didn't like this and would wedge itself.

Another Engineer also managed to reproduce wedging of the Realtek
Ethernet adpater during a reboot test on an AMD Chromebook. In that
case he was sometimes seeing -EPIPE returned from the control
transfers.

This patch series fixes both issues.

Changes in v5:
- ("Run the unload routine if we have errors during probe") new for v5.
- ("Cancel hw_phy_work if we have an error in probe") new for v5.
- ("Release firmware if we have an error in probe") new for v5.
- Removed extra mutex_unlock() left over in v4.
- Fixed minor typos.
- Don't do queue an unbind/bind reset if probe fails; just retry probe.

Changes in v4:
- Took out some unnecessary locks/unlocks of the control mutex.
- Added comment about reading version causing probe fail if 3 fails.
- Added text to commit msg about the potential unbind/bind loop.

Changes in v3:
- Fixed v2 changelog ending up in the commit message.
- farmework -> framework in comments.

Changes in v2:
- ("Check for unplug in rtl_phy_patch_request()") new for v2.
- ("Check for unplug in r8153b_ups_en() / r8153c_ups_en()") new for v2.
- ("Rename RTL8152_UNPLUG to RTL8152_INACCESSIBLE") new for v2.
- Reset patch no longer based on retry patch, since that was dropped.
- Reset patch should be robust even if failures happen in probe.
- Switched booleans to bits in the "flags" variable.
- Check for -ENODEV instead of "udev->state == USB_STATE_NOTATTACHED"
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2023-10-22 11:46:18 +01:00
Douglas Anderson
d9962b0d42 r8152: Block future register access if register access fails
Even though the functions to read/write registers can fail, most of
the places in the r8152 driver that read/write register values don't
check error codes. The lack of error code checking is problematic in
at least two ways.

The first problem is that the r8152 driver often uses code patterns
similar to this:
  x = read_register()
  x = x | SOME_BIT;
  write_register(x);

...with the above pattern, if the read_register() fails and returns
garbage then we'll end up trying to write modified garbage back to the
Realtek adapter. If the write_register() succeeds that's bad. Note
that as of commit f53a7ad189 ("r8152: Set memory to all 0xFFs on
failed reg reads") the "garbage" returned by read_register() will at
least be consistent garbage, but it is still garbage.

It turns out that this problem is very serious. Writing garbage to
some of the hardware registers on the Ethernet adapter can put the
adapter in such a bad state that it needs to be power cycled (fully
unplugged and plugged in again) before it can enumerate again.

The second problem is that the r8152 driver generally has functions
that are long sequences of register writes. Assuming everything will
be OK if a random register write fails in the middle isn't a great
assumption.

One might wonder if the above two problems are real. You could ask if
we would really have a successful write after a failed read. It turns
out that the answer appears to be "yes, this can happen". In fact,
we've seen at least two distinct failure modes where this happens.

On a sc7180-trogdor Chromebook if you drop into kdb for a while and
then resume, you can see:
1. We get a "Tx timeout"
2. The "Tx timeout" queues up a USB reset.
3. In rtl8152_pre_reset() we try to reinit the hardware.
4. The first several (2-9) register accesses fail with a timeout, then
   things recover.

The above test case was actually fixed by the patch ("r8152: Increase
USB control msg timeout to 5000ms as per spec") but at least shows
that we really can see successful calls after failed ones.

On a different (AMD) based Chromebook with a particular adapter, we
found that during reboot tests we'd also sometimes get a transitory
failure. In this case we saw -EPIPE being returned sometimes. Retrying
worked, but retrying is not always safe for all register accesses
since reading/writing some registers might have side effects (like
registers that clear on read).

Let's fully lock out all register access if a register access fails.
When we do this, we'll try to queue up a USB reset and try to unlock
register access after the reset. This is slightly tricker than it
sounds since the r8152 driver has an optimized reset sequence that
only works reliably after probe happens. In order to handle this, we
avoid the optimized reset if probe didn't finish. Instead, we simply
retry the probe routine in this case.

When locking out access, we'll use the existing infrastructure that
the driver was using when it detected we were unplugged. This keeps us
from getting stuck in delay loops in some parts of the driver.

Signed-off-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Grant Grundler <grundler@chromium.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2023-10-22 11:46:18 +01:00
Douglas Anderson
715f67f33a r8152: Rename RTL8152_UNPLUG to RTL8152_INACCESSIBLE
Whenever the RTL8152_UNPLUG is set that just tells the driver that all
accesses will fail and we should just immediately bail. A future patch
will use this same concept at a time when the driver hasn't actually
been unplugged but is about to be reset. Rename the flag in
preparation for the future patch.

This is a no-op change and just a search and replace.

Signed-off-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Grant Grundler <grundler@chromium.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2023-10-22 11:46:18 +01:00
Douglas Anderson
bc65cc42af r8152: Check for unplug in r8153b_ups_en() / r8153c_ups_en()
If the adapter is unplugged while we're looping in r8153b_ups_en() /
r8153c_ups_en() we could end up looping for 10 seconds (20 ms * 500
loops). Add code similar to what's done in other places in the driver
to check for unplug and bail.

Signed-off-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Grant Grundler <grundler@chromium.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2023-10-22 11:46:18 +01:00
Douglas Anderson
dc90ba37a8 r8152: Check for unplug in rtl_phy_patch_request()
If the adapter is unplugged while we're looping in
rtl_phy_patch_request() we could end up looping for 10 seconds (2 ms *
5000 loops). Add code similar to what's done in other places in the
driver to check for unplug and bail.

Signed-off-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Grant Grundler <grundler@chromium.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2023-10-22 11:46:18 +01:00
Douglas Anderson
b8d35024d4 r8152: Release firmware if we have an error in probe
The error handling in rtl8152_probe() is missing a call to release
firmware. Add it in to match what's in the cleanup code in
rtl8152_disconnect().

Fixes: 9370f2d05a ("r8152: support request_firmware for RTL8153")
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Grant Grundler <grundler@chromium.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2023-10-22 11:46:18 +01:00
Douglas Anderson
bb8adff912 r8152: Cancel hw_phy_work if we have an error in probe
The error handling in rtl8152_probe() is missing a call to cancel the
hw_phy_work. Add it in to match what's in the cleanup code in
rtl8152_disconnect().

Fixes: a028a9e003 ("r8152: move the settings of PHY to a work queue")
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Grant Grundler <grundler@chromium.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2023-10-22 11:46:17 +01:00
Douglas Anderson
5dd1768952 r8152: Run the unload routine if we have errors during probe
The rtl8152_probe() function lacks a call to the chip-specific
unload() routine when it sees an error in probe. Add it in to match
the cleanup code in rtl8152_disconnect().

Fixes: ac718b6930 ("net/usb: new driver for RTL8152")
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Grant Grundler <grundler@chromium.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2023-10-22 11:46:17 +01:00
Douglas Anderson
a5feba71ec r8152: Increase USB control msg timeout to 5000ms as per spec
According to the comment next to USB_CTRL_GET_TIMEOUT and
USB_CTRL_SET_TIMEOUT, although sending/receiving control messages is
usually quite fast, the spec allows them to take up to 5 seconds.
Let's increase the timeout in the Realtek driver from 500ms to 5000ms
(using the #defines) to account for this.

This is not just a theoretical change. The need for the longer timeout
was seen in testing. Specifically, if you drop a sc7180-trogdor based
Chromebook into the kdb debugger and then "go" again after sitting in
the debugger for a while, the next USB control message takes a long
time. Out of ~40 tests the slowest USB control message was 4.5
seconds.

While dropping into kdb is not exactly an end-user scenario, the above
is similar to what could happen due to an temporary interrupt storm,
what could happen if there was a host controller (HW or SW) issue, or
what could happen if the Realtek device got into a confused state and
needed time to recover.

This change is fairly critical since the r8152 driver in Linux doesn't
expect register reads/writes (which are backed by USB control
messages) to fail.

Fixes: ac718b6930 ("net/usb: new driver for RTL8152")
Suggested-by: Hayes Wang <hayeswang@realtek.com>
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Grant Grundler <grundler@chromium.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2023-10-22 11:46:17 +01:00
Shigeru Yoshida
51a32e8281 net: usb: smsc95xx: Fix uninit-value access in smsc95xx_read_reg
syzbot reported the following uninit-value access issue [1]:

smsc95xx 1-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32
smsc95xx 1-1:0.0 (unnamed net_device) (uninitialized): Error reading E2P_CMD
=====================================================
BUG: KMSAN: uninit-value in smsc95xx_reset+0x409/0x25f0 drivers/net/usb/smsc95xx.c:896
 smsc95xx_reset+0x409/0x25f0 drivers/net/usb/smsc95xx.c:896
 smsc95xx_bind+0x9bc/0x22e0 drivers/net/usb/smsc95xx.c:1131
 usbnet_probe+0x100b/0x4060 drivers/net/usb/usbnet.c:1750
 usb_probe_interface+0xc75/0x1210 drivers/usb/core/driver.c:396
 really_probe+0x506/0xf40 drivers/base/dd.c:658
 __driver_probe_device+0x2a7/0x5d0 drivers/base/dd.c:800
 driver_probe_device+0x72/0x7b0 drivers/base/dd.c:830
 __device_attach_driver+0x55a/0x8f0 drivers/base/dd.c:958
 bus_for_each_drv+0x3ff/0x620 drivers/base/bus.c:457
 __device_attach+0x3bd/0x640 drivers/base/dd.c:1030
 device_initial_probe+0x32/0x40 drivers/base/dd.c:1079
 bus_probe_device+0x3d8/0x5a0 drivers/base/bus.c:532
 device_add+0x16ae/0x1f20 drivers/base/core.c:3622
 usb_set_configuration+0x31c9/0x38c0 drivers/usb/core/message.c:2207
 usb_generic_driver_probe+0x109/0x2a0 drivers/usb/core/generic.c:238
 usb_probe_device+0x290/0x4a0 drivers/usb/core/driver.c:293
 really_probe+0x506/0xf40 drivers/base/dd.c:658
 __driver_probe_device+0x2a7/0x5d0 drivers/base/dd.c:800
 driver_probe_device+0x72/0x7b0 drivers/base/dd.c:830
 __device_attach_driver+0x55a/0x8f0 drivers/base/dd.c:958
 bus_for_each_drv+0x3ff/0x620 drivers/base/bus.c:457
 __device_attach+0x3bd/0x640 drivers/base/dd.c:1030
 device_initial_probe+0x32/0x40 drivers/base/dd.c:1079
 bus_probe_device+0x3d8/0x5a0 drivers/base/bus.c:532
 device_add+0x16ae/0x1f20 drivers/base/core.c:3622
 usb_new_device+0x15f6/0x22f0 drivers/usb/core/hub.c:2589
 hub_port_connect drivers/usb/core/hub.c:5440 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5580 [inline]
 port_event drivers/usb/core/hub.c:5740 [inline]
 hub_event+0x53bc/0x7290 drivers/usb/core/hub.c:5822
 process_one_work kernel/workqueue.c:2630 [inline]
 process_scheduled_works+0x104e/0x1e70 kernel/workqueue.c:2703
 worker_thread+0xf45/0x1490 kernel/workqueue.c:2784
 kthread+0x3e8/0x540 kernel/kthread.c:388
 ret_from_fork+0x66/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304

Local variable buf.i225 created at:
 smsc95xx_read_reg drivers/net/usb/smsc95xx.c:90 [inline]
 smsc95xx_reset+0x203/0x25f0 drivers/net/usb/smsc95xx.c:892
 smsc95xx_bind+0x9bc/0x22e0 drivers/net/usb/smsc95xx.c:1131

CPU: 1 PID: 773 Comm: kworker/1:2 Not tainted 6.6.0-rc1-syzkaller-00125-ge42bebf6db29 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023
Workqueue: usb_hub_wq hub_event
=====================================================

Similar to e9c6598992 ("net: usb: smsc75xx: Fix uninit-value access in
__smsc75xx_read_reg"), this issue is caused because usbnet_read_cmd() reads
less bytes than requested (zero byte in the reproducer). In this case,
'buf' is not properly filled.

This patch fixes the issue by returning -ENODATA if usbnet_read_cmd() reads
less bytes than requested.

sysbot reported similar uninit-value access issue [2]. The root cause is
the same as mentioned above, and this patch addresses it as well.

Fixes: 2f7ca802bd ("net: Add SMSC LAN9500 USB2.0 10/100 ethernet adapter driver")
Reported-and-tested-by: syzbot+c74c24b43c9ae534f0e0@syzkaller.appspotmail.com
Reported-and-tested-by: syzbot+2c97a98a5ba9ea9c23bd@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=c74c24b43c9ae534f0e0 [1]
Closes: https://syzkaller.appspot.com/bug?extid=2c97a98a5ba9ea9c23bd [2]
Signed-off-by: Shigeru Yoshida <syoshida@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2023-10-22 11:39:26 +01:00
Su Hui
9f771493da net: chelsio: cxgb4: add an error code check in t4_load_phy_fw
t4_set_params_timeout() can return -EINVAL if failed, add check
for this.

Signed-off-by: Su Hui <suhui@nfschina.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2023-10-22 11:36:30 +01:00
Christophe JAILLET
ca082f019d net: ieee802154: adf7242: Fix some potential buffer overflow in adf7242_stats_show()
strncat() usage in adf7242_debugfs_init() is wrong.
The size given to strncat() is the maximum number of bytes that can be
written, excluding the trailing NULL.

Here, the size that is passed, DNAME_INLINE_LEN, does not take into account
the size of "adf7242-" that is already in the array.

In order to fix it, use snprintf() instead.

Fixes: 7302b9d901 ("ieee802154/adf7242: Driver for ADF7242 MAC IEEE802154")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
2023-10-22 11:28:43 +01:00
Linus Torvalds
1acfd2bd3f powerpc fixes for 6.6 #5
- Fix stale propagated yield_cpu in qspinlocks leading to lockups.
 
  - Fix broken hugepages on some configs due to ARCH_FORCE_MAX_ORDER.
 
  - Fix a spurious warning when copros are in use at exit time.
 
 Thanks to: Nicholas Piggin, Christophe Leroy, Nysal Jan K.A Sachin Sant,
 Shrikanth Hegde.
 -----BEGIN PGP SIGNATURE-----
 
 iQJHBAABCAAxFiEEJFGtCPCthwEv2Y/bUevqPMjhpYAFAmU0euMTHG1wZUBlbGxl
 cm1hbi5pZC5hdQAKCRBR6+o8yOGlgBXVD/0YS6hK5K4apWUAuZC0EGUnqOvWdCfM
 WPa5EdZP8NV7l/3Zv21dW6TBz7M00Bp2+HLUWxseuMmN8TnU2w4lnA5b3qfm8BW8
 sA0Ssz3jW2hC0oeWOu4o4gXmjDOIamb42Q0GEkU6wQNWbUBBLQV20+9XyVI+gN88
 65zkPy83zhduKXxxRZj4Ur20djgps5YwA5U6VzDnFBxh71xlNH5sgP7OuBiVwM0/
 gSYSSfYxHCGYjs48TA9EhmUE+bsFckxL9dCSqGeMHEZkVUG9gGejWAZAsHc/HPoI
 ngGRZYXJX9k6k6s0zg37IgQ3kyFn4/m1utb5zt+PJLnMjNA/lvFPnIwHWWk8B6ch
 PPp+XWyzV9Z9KeQ4q3hnxgZfto8P9Ngo8Z0D7MtMGnR0140x3UooIgU2QnpZwGbh
 asNPMzTPrCAzWUjzMiS9ncwOCEUfuwoGiZS3n54hVfJNQ2Q61VD9fv7N0CKbdxks
 0E7FmVAuRF0rPBeES9me08JCGsHk+CDyVot+jdHlOyY8y+d5ZM2h7zBsDNUK18Ec
 rWiH9pGEr/y7/rfIVv3dD29Qp8le1h9Y6F/VLG+ShBTg1EY9csNT8Ag+Y9dtcyRe
 4CTiuKdk+2XGCGwhR1QPhTXYCrmaCO3KHJYGx4jactd0lBlRZOB+fCQ1THCKhGiV
 UBc81daAZ5vk1A==
 =2Sx6
 -----END PGP SIGNATURE-----

Merge tag 'powerpc-6.6-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux

Pull powerpc fixes from Michael Ellerman:

 - Fix stale propagated yield_cpu in qspinlocks leading to lockups

 - Fix broken hugepages on some configs due to ARCH_FORCE_MAX_ORDER

 - Fix a spurious warning when copros are in use at exit time

Thanks to Nicholas Piggin, Christophe Leroy, Nysal Jan K.A Sachin Sant,
and Shrikanth Hegde.

* tag 'powerpc-6.6-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
  powerpc/qspinlock: Fix stale propagated yield_cpu
  powerpc/64s/radix: Don't warn on copros in radix__tlb_flush()
  powerpc/mm: Allow ARCH_FORCE_MAX_ORDER up to 12
2023-10-21 18:46:47 -07:00
Luben Tuikov
d3df66fd98 drm/amdgpu: Remove redundant call to priority_is_valid()
Remove a redundant call to amdgpu_ctx_priority_is_valid() from
amdgpu_ctx_priority_permit(), which is called from amdgpu_ctx_init() which is
called from amdgpu_ctx_alloc() which is called from amdgpu_ctx_ioctl(), where
we've called amdgpu_ctx_priority_is_valid() already first thing in the
function.

Cc: Alex Deucher <Alexander.Deucher@amd.com>
Cc: Christian König <christian.koenig@amd.com>
Signed-off-by: Luben Tuikov <luben.tuikov@amd.com>
Acked-by: Christian König <christian.koenig@amd.com>
Link: https://lore.kernel.org/r/20231018010359.30393-1-luben.tuikov@amd.com
2023-10-21 20:27:15 -04:00
Linus Torvalds
d537ae43f8 gpio fixes for v6.6-rc7
- fix interrupt handling in suspend and wakeup in gpio-vf610
 - fix a bug on setting direction to output in gpio-vf610
 - add a missing memset() in gpio ACPI code
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEFp3rbAvDxGAT0sefEacuoBRx13IFAmU0E+IACgkQEacuoBRx
 13IQfQ/6AnJo31+gcxJaXRZnIzm5VC35uP1gVBy9lvuJDd2UscUoOR8DnFcnQg9J
 B6ytiMU8KK4MPV+gjtw/66gln6IeaiUcHoym4tWSw+mNybr2uAyECuxayyLpl0ou
 UglOIP5gyiflUBddNWa+GDdAV1NoPb0BuwIE/rjgViGV9OiB2PpNztWZjAWFONEQ
 zSRZBXzKncNcG+p+Pr7s+i+9bK52DeplxSe6Nxx4aYzbqSa3jneduTgAXqWBcHfz
 RL3y9LSn1+nGbZ9+WmmT4bLPke1bJ0a8E7hiE7Dl7XX0UrdxlkXlhWu3N3jHfM2v
 bxvWbfAUT9zNdAqSteSdPenwhfO9GT7n+BduA6yreT5+zGkU6Ear5Hbn4MMnE5Xa
 0RGVJQcpv2eZ20zUVzYKfHqjha98g9hm3QrmNoO34nSXCfDJ1qam9Nlwg2oQOYvM
 HJt52chsMeSq2bm8VX2Kqj7001P5FjynmIKsWbbUbyLHR03kNgCZXUJf/NO6IykB
 rCjFWm59xansrEjVr/oob6xwPmzw2GWzRLUoSKY1QgdXdS5YtjQMPKrUcopFU/pB
 /WNgtCmBgJeZ4YUCtKp0iEb5KA4bRVn5zEzfvpk6iqFndCXH5OUKNme1qtCsM20D
 Y3lhih2ld/4dREgycopSuUOHWP29wDPixLraxhD34OGvMzYdu3g=
 =atb6
 -----END PGP SIGNATURE-----

Merge tag 'gpio-fixes-for-v6.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux

Pull gpio fixes from Bartosz Golaszewski:

 - fix interrupt handling in suspend and wakeup in gpio-vf610

 - fix a bug on setting direction to output in gpio-vf610

 - add a missing memset() in gpio ACPI code

* tag 'gpio-fixes-for-v6.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
  gpiolib: acpi: Add missing memset(0) to acpi_get_gpiod_from_data()
  gpio: vf610: set value before the direction to avoid a glitch
  gpio: vf610: mask the gpio irq in system suspend and support wakeup
2023-10-21 12:59:18 -07:00
Linus Torvalds
03027aa3a5 Rust fixes for 6.6
- GCC build: fix bindgen build error with '-fstrict-flex-arrays'.
 
  - Error module: fix the description for 'ECHILD' and fix Markdown
    style nit.
 
  - Code docs: fix logo replacement.
 
  - Docs: update docs output path.
 
  - Kbuild: remove old docs output path in 'cleandocs' target.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEPjU5OPd5QIZ9jqqOGXyLc2htIW0FAmU0EIwACgkQGXyLc2ht
 IW2UcQ/+I560lj6STKHwnSbrRUZ7d+ansQK4TfzNEjepgxynZKzB6P2SmOgAp3Sf
 abtl5noBr6GWNbG2+W6+mV0qhGJFqPZWRxEUxqYUFqGhZKXKjO3odCg6nFp4ZmeS
 lMA08rJVZS6wJ6N7SWvZBjJ+QLJXBurpA1W7fqwu1RUYApgqG95QhkKHvuOBiUQx
 2lUI1Dz2YQY1rTJ3MHQzqzwQigGtKcLl6DD3NxPk9AD+P7IGmMdBDx2Ieer++ozc
 TGjWmrzC0YFg+m+8Tfr9DelcfHv+62GrH4GyK4Ywq5HktGjAK2rYZV/glx70UEaw
 ooO+q050MVPFtW8Q4qbMPRsgK3qjrm1joklZZTGz8K6Lokgunwt4ALbgL/eVdG46
 X5Kx9CCzD2aFHKi1vSSApqXOHGkMZfkOL4Vg+vcYy/kDSxqMbs60lr+H032QKonn
 vMjqc0PKKcrdHvgpjqtAqdkEpxCYBpz5u4VJL/hJF8Tv+US4ZOLmdPgepNravH9p
 TGEICjjfpEY3WM572xkkL09hltus56blHPMpUqsTpNzEuX5JOyBAa+pdWgTQ88LX
 DzWctKJDmPMZGt/wLnNrN8JXVgiO8I88cGeByYlKn0aJRxZ8wqUK/Ka5Z49Wnmb8
 F6WAX6hb9xY1F+AHMWs75bS2ZfQPP3YaAJ8MfRSmeaY4s4wzfAY=
 =+1Dk
 -----END PGP SIGNATURE-----

Merge tag 'rust-fixes-6.6' of https://github.com/Rust-for-Linux/linux

Pull rust fixes from Miguel Ojeda:

 - GCC build: fix bindgen build error with '-fstrict-flex-arrays'

 - Error module: fix the description for 'ECHILD' and fix Markdown
   style nit

 - Code docs: fix logo replacement

 - Docs: update docs output path

 - Kbuild: remove old docs output path in 'cleandocs' target

* tag 'rust-fixes-6.6' of https://github.com/Rust-for-Linux/linux:
  rust: docs: fix logo replacement
  kbuild: remove old Rust docs output path
  docs: rust: update Rust docs output path
  rust: fix bindgen build error with fstrict-flex-arrays
  rust: error: Markdown style nit
  rust: error: fix the description for `ECHILD`
2023-10-21 12:54:58 -07:00
Linus Torvalds
45d3291c52 Fix a recently introduced use-after-free bug.
Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmUz7ZgRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1ikdg/9E9WIoxGMimkA7IdG6izFvEpqXDbC1nci
 qrm7b3eJMO9dbihCTtiNV5bpe35GhlQZER2honE3oyxOuglPZ3iUckCu5aa82/C1
 iHltu9zGvk1JVaFeMWereGduwVitG19hxiVU4t0nMJkIoJltab3uJPHchyWfpdNO
 n2x6f+FJ+28IKg3mlyuAWCRztW0tpBIk9nkGErKozszXAQQyYZVe/3sEo1ZYiLNT
 7RFjJK2KyWcvi78SN0Ins6Cqh6x3k1ZA60O4rmYswAcGr584IJ22NPnI0VBYbIC0
 QehMZBOAqyji1tQJIHJFAx3Yx4cPxo8jS2n7CaxvZsBGhE+AkKfNzFyRWTXaY51V
 eTesPkWqr9SjK1GKdpY2a9q8Mo7e6maQPgKPREo4TMzXgN9abZhJKVeRnUGCZlHx
 jTa9h1FzFlN2OSaG4P48iTyaN0udYq11tPQAs7DRJoSUteaPDGK8X1JrXGqar00k
 sfmKcN0CkwXlhtniGq1BWy/B32UgelBj9U0on7TnS5omKByUrar+sProJO0EuWNi
 VAuHJRsDL7Jt2TGNmCXAWQK6ZB8yDNnZZH8I0evkBn0MVD4GVXd0J6Uu1TA1dSRP
 wdgxK0hZQLt9gCbtlELHJ+uJw+HEJ/Qkq/LSWNYGNg0b5OnrgV055VQfMlSKVGDw
 tibMZCmnKMM=
 =IKgN
 -----END PGP SIGNATURE-----

Merge tag 'sched-urgent-2023-10-21' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull scheduler fix from Ingo Molnar:
 "Fix a recently introduced use-after-free bug"

* tag 'sched-urgent-2023-10-21' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  sched/eevdf: Fix heap corruption more
2023-10-21 11:19:07 -07:00
Linus Torvalds
94be133fb2 Fix group event semantics.
Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmUz7FURHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1hUMA/+IrkxzylYcir2z1Jv1PKNvCDuPdvz8yMS
 k0p5FMimGMSN+IPS8XwAEvG9YdFxyjQNbFfFvx0wp1PMPb5+NQYT6rTbOzziwpBn
 8EIx/Ebjt1HraaAhGholF5c4UVzmAPzNJO/x2VX5mtqJY8EekbGWtUVuXsVyO1hA
 E/0C4FWVQ6Y0ig60naZnm2b/Z1nCbIBw9fmIXqrnkdSrQnFb4uRW6owu1JGI0x1H
 a7i7X7GgUytoZR4z4PLkR+UwtCc/Hza6S/8zkEVUiYUAp1JbzKQn6+3vA58xoOtU
 zuoJimWA3ofntwiTAtL2qHRSLoPPRqPZRuBceYa5TtZjLHqe8dKgcj2YaqleTFqZ
 3NelYg1QMKjs35k2M+vAU5I5fZSU/cgyMK2Z4MFKm+XleDO575vffOSDXgyIs272
 7iCLx7VNmT8ubijhFjNCi0xz6HBk/wml41XlzgLg2rzcVmwVjXqp+IfTP7QF4UW8
 wmIWV/JZE4DOIuJp/dwQDicVEkr5XxUd39tlyGWD0GqXEQJDIe9Cb8cW+nBesIT7
 j2lwHaxxxQB9AhJE3jfK7fBn/+LxqNAsPt6SEvdf1BqHWMSGmdTT3NKw3gwquqru
 3OO6utMWPgJ/mGa7exbl/9gB4wIiCVTH1dsDRMBcnxgDg0e3d8UM/PdRys18q7YU
 g4zAKSFkzCw=
 =xyU0
 -----END PGP SIGNATURE-----

Merge tag 'perf-urgent-2023-10-21' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull perf events fix from Ingo Molnar:
 "Fix group event semantics"

* tag 'perf-urgent-2023-10-21' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  perf: Disallow mis-matched inherited group reads
2023-10-21 11:09:29 -07:00
Linus Torvalds
023cc83605 Probes fixes for v6.6-rc6.2:
- kprobe-events: Fix kprobe events to reject if the attached symbol
   is not unique name because it may not the function which the user
   want to attach to. (User can attach a probe to such symbol using
   the nearest unique symbol + offset.)
 
 - selftest: Add a testcase to ensure the kprobe event rejects non
   unique symbol correctly.
 -----BEGIN PGP SIGNATURE-----
 
 iQFPBAABCgA5FiEEh7BulGwFlgAOi5DV2/sHvwUrPxsFAmUzdQobHG1hc2FtaS5o
 aXJhbWF0c3VAZ21haWwuY29tAAoJENv7B78FKz8bMNAH/inFWv8e+rMm8F5Po6ZI
 CmBxuZbxy2l+KfYDjXqSHu7TLKngVd6Bhdb5H2K7fgdwiZxrS0i6qvdppo+Cxgop
 Yod06peDTM80IKavioCcOJOwLPGXXpZkMlK5fdC48HN6vrf9km4vws5ZAagfc1ng
 YhnYm1HHeXcIYwtLkE2dCr6HkwkaOebWTLdZ8c70d1OPw0L9rzxH+edjhKCq8uIw
 6WUg9ERxJYPUuCkQxOxVJrTdzNMRXsgf28FHc0LyYRm8kDpECT2BP6e/Y+TBbsX5
 2pN5cUY5qfI6t3Pc1HDs2KX8ui2QCmj0mCvT0VixhdjThdHpRf0VjIFFAANf3LNO
 XVA=
 =O1Aa
 -----END PGP SIGNATURE-----

Merge tag 'probes-fixes-v6.6-rc6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace

Pull probes fixes from Masami Hiramatsu:

 - kprobe-events: Fix kprobe events to reject if the attached symbol is
   not unique name because it may not the function which the user want
   to attach to. (User can attach a probe to such symbol using the
   nearest unique symbol + offset.)

 - selftest: Add a testcase to ensure the kprobe event rejects non
   unique symbol correctly.

* tag 'probes-fixes-v6.6-rc6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  selftests/ftrace: Add new test case which checks non unique symbol
  tracing/kprobes: Return EADDRNOTAVAIL when func matches several symbols
2023-10-21 11:00:36 -07:00
Linus Torvalds
4d7b04c0cd s390 updates for 6.6-rc7
- Fix IOMMU bitmap allocation in s390 PCI to avoid out of bounds access
   when IOMMU pages aren't a multiple of 64.
 
 - Fix kasan crashes when accessing DCSS mapping in memory holes by adding
   corresponding kasan zero shadow mappings.
 
 - Fix a memory leak in css_alloc_subchannel in case dma_set_coherent_mask
   fails.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCAAdFiEE3QHqV+H2a8xAv27vjYWKoQLXFBgFAmUzm4wACgkQjYWKoQLX
 FBhLVAgAkgucCi+fUdQbmvU80cshWz0+eMG/fKLT5Xkg1sOxRhmy3qkmNtkb9471
 WcrplvSP0QjGvoBtKSC0Qme7oZlYTUjUss1jLxzV3y/KAR4G8WAdoMbpKB6bIOzn
 S0Sy0WelU9+bUBimxz+ZbdcQKbah/1uFdXqOJueX5YJQZko6hGE9VP+KQ7rKeE/E
 ie5h4UjLY64xwXTn4BxkYd0iTqrHYhZ2RaDO+c6yoqTZ+RSH7v71Q3RYxx4jgSTW
 uMyHnRknjMia8ms696EDqzAH2FZy15vhOCSc64zeccujE3o0ETB3ZVPBg9fr9s+F
 Yc3KFKqrJehSgxFeCCXHG8wQJyzLgQ==
 =3nJs
 -----END PGP SIGNATURE-----

Merge tag 's390-6.6-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux

Pull s390 fixes from Vasily Gorbik:

 - Fix IOMMU bitmap allocation in s390 PCI to avoid out of bounds access
   when IOMMU pages aren't a multiple of 64

 - Fix kasan crashes when accessing DCSS mapping in memory holes by
   adding corresponding kasan zero shadow mappings

 - Fix a memory leak in css_alloc_subchannel in case
   dma_set_coherent_mask fails

* tag 's390-6.6-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
  s390/pci: fix iommu bitmap allocation
  s390/kasan: handle DCSS mapping in memory holes
  s390/cio: fix a memleak in css_alloc_subchannel
2023-10-21 10:11:11 -07:00
Linus Torvalds
f51de61ce7 platform-drivers-x86 for v6.6-5
Highlights:
  -  Fix spurious brightness down presses on newer Asus laptop models
  -  Fix backlight control not working on T2 Mac Pro all-in-ones
  -  Add Armin Wolf as new maintainer for the WMI bus driver and
     change its status from orphaned to maintained
  -  A few other small fixes
 
 The following is an automated git shortlog grouped by driver:
 
 Merge tag 'platform-drivers-x86-mellanox-init-v6.6' into fixes:
  -  Merge tag 'platform-drivers-x86-mellanox-init-v6.6' into fixes
 
 apple-gmux:
  -  Hard Code max brightness for MMIO gmux
 
 asus-wmi:
  -  Map 0x2a code, Ignore 0x2b and 0x2c events
  -  Only map brightness codes when using asus-wmi backlight control
  -  Change ASUS_WMI_BRN_DOWN code from 0x20 to 0x2e
 
 intel-uncore-freq:
  -  Conditionally create attribute for read frequency
 
 msi-ec:
  -  Fix the 3rd config
 
 platform:
  -  mellanox: Fix a resource leak in an error handling path in probing flow
 
 platform/mellanox:
  -  mlxbf-tmfifo: Fix a warning message
 
 platform/surface:
  -  platform_profile: Propagate error if profile registration fails
 
 wmi:
  -  Update MAINTAINERS entry
 -----BEGIN PGP SIGNATURE-----
 
 iQFIBAABCAAyFiEEuvA7XScYQRpenhd+kuxHeUQDJ9wFAmUzmu4UHGhkZWdvZWRl
 QHJlZGhhdC5jb20ACgkQkuxHeUQDJ9zJgAf+OgB6pmTQ02l39zQFcCXKIkpIitVU
 ibtA1whUU57BFAyK7ZOnq2YfoPoh3yqFNTISdeCUDmtqKJxeh0RdKOXvtcKkCvz9
 kQXesZ10Sn+/OsqwJRZjJR96F+NW7FVKyxxnlYqE6r+ipuadEvFF9TkswzM4WYWM
 9yJJ4SwBLNV9x3vtt5RR6iqpon4FVl2O4X58cHu09zK4Wv3saaUYOCQpad+WLPbm
 C+XnhSVqHLbedmMos8Odo0mMcWLceH92BX2v9hhNgYX37w+UBjNTTs/4Me1IXpXb
 /JVrExv9SkzzCPT2q21/Mmj+iUHhq1Qyd0uF6PVuqXqHs0utV95W9kv6PQ==
 =bvMu
 -----END PGP SIGNATURE-----

Merge tag 'platform-drivers-x86-v6.6-5' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86

Pull x86 platform driver fixes from Hans de Goede:

 -  Fix spurious brightness down presses on newer Asus laptop models

 -  Fix backlight control not working on T2 Mac Pro all-in-ones

 -  Add Armin Wolf as new maintainer for the WMI bus driver and change
    its status from orphaned to maintained

 -  A few other small fixes

* tag 'platform-drivers-x86-v6.6-5' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86:
  platform/mellanox: mlxbf-tmfifo: Fix a warning message
  apple-gmux: Hard Code max brightness for MMIO gmux
  platform/surface: platform_profile: Propagate error if profile registration fails
  platform/x86: asus-wmi: Map 0x2a code, Ignore 0x2b and 0x2c events
  platform/x86: asus-wmi: Only map brightness codes when using asus-wmi backlight control
  platform/x86: asus-wmi: Change ASUS_WMI_BRN_DOWN code from 0x20 to 0x2e
  platform/x86: wmi: Update MAINTAINERS entry
  platform/x86: msi-ec: Fix the 3rd config
  platform/x86: intel-uncore-freq: Conditionally create attribute for read frequency
  platform: mellanox: Fix a resource leak in an error handling path in probing flow
2023-10-21 10:02:46 -07:00
Linus Torvalds
bfd4704c82 USB/Thunderbolt fixes and ids for 6.6-rc7
Here are 4 small patches for USB and Thunderbolt for 6.6-rc7 that do the
 following:
   - new usb-serial device ids
   - thunderbolt driver fix for reported issue
 
 All of these have been in linux-next with no reported problems.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCZTOpWQ8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+ykQmgCgr897IJtADpUZ1NZxCux1ZzLpC44AnRSSO631
 QpGIWfzTNifxfUAqnGlD
 =25K6
 -----END PGP SIGNATURE-----

Merge tag 'usb-6.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

Pull USB / Thunderbolt fixes and ids from Greg KH:
 "Here are four small patches for USB and Thunderbolt for 6.6-rc7 that
  do the following:

   - new usb-serial device ids

   - thunderbolt driver fix for reported issue

  All of these have been in linux-next with no reported problems"

* tag 'usb-6.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
  USB: serial: option: add Fibocom to DELL custom modem FM101R-GL
  USB: serial: option: add entry for Sierra EM9191 with new firmware
  USB: serial: option: add Telit LE910C4-WWX 0x1035 composition
  thunderbolt: Call tb_switch_put() once DisplayPort bandwidth request is finished
2023-10-21 09:57:34 -07:00
Linus Torvalds
f1de9aced8 This push fixes a 6.5 regression in crypto/asymmetric_keys.
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEn51F/lCuNhUwmDeSxycdCkmxi6cFAmUvXwwACgkQxycdCkmx
 i6fX1hAAg+c2XOHo6sZcTGVK4JwIvTqNNnUL+8azLOYGfk+/I0f9RkMKSnDjZEfY
 LnIRHBpiuLhveNuYJsQBxab870dqMgVfxxQpVmCY7BkjTT5E3elUA5t82G9NBwcW
 I+Am2YLQAlbKumDtzGUnYxKmW2Q5p+XDY38rZWfH1quwqQFMnbQP4bprURJQ2ALb
 IYTbYo9s1PdRCO0cKpxNGlsJLXyhEDGOnR4+tt68N5NR8nKFfXL1BT6/sQHk10Px
 KTDD5gbkK82QmWmyH0sinXGFIECuee5hhkyh8Zt+mtnYPILBIPr5qNJ3QVmOhc/H
 xvsIBgrkdvb0Hiv3+t2RS38i6cjTYurOmdSviNCJhirh5C2A/ph7eMQWSq/h5blJ
 mUfM/wGa6aB8DnD+UfMyf5BvqNEj6UskicDWen3X9DqG7VGf2JHSapPKEjdCipfV
 4xJ6RFVI7/3K+KMLDvTKUFO7oIpM/BQLlW35I3B9Se2WaYwHM2nZ7aV7c1SMf7dn
 6D6O2WDh1og8dMG5+EImf4dK+RbCU39ynKYIffS7VI6qjUULGpdqjmN9qmhJJSYf
 ufAxNZRs5XNRZRjgUxA0FIjOQlJgPWBy7QNoqz1jAfeVCX59FhzXTxFEC+P/j0CO
 GxUl1lOeJE9Ye9QQ87/QdmyGd2qYez5hx9NSs03s2KUsobUStAE=
 =v00R
 -----END PGP SIGNATURE-----

Merge tag 'v6.6-p5' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6

Pull crypto fix from Herbert Xu:
 "Fix a 6.5 regression in crypto/asymmetric_keys"

* tag 'v6.6-p5' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
  KEYS: asymmetric: Fix sign/verify on pkcs1pad without a hash
2023-10-21 09:49:13 -07:00
Linus Torvalds
5722119f67 Bug fixes for 6.6-rc6:
* Fix a bug where a writev consisting of a bunch of sub-fsblock writes
   where the last buffer address is invalid could lead to an infinite
   loop.
 
 Signed-off-by: Darrick J. Wong <djwong@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQQ2qTKExjcn+O1o2YRKO3ySh0YRpgUCZTFcYAAKCRBKO3ySh0YR
 pg6NAP4zKkrjdzOKyhu+NJDu4lnB4+8eq0PPnW5r5fw4155wTwEA1PKWp5vtKYRk
 A3QLraLNS0HxpsguHpfD8KFrPN6LPA8=
 =93ew
 -----END PGP SIGNATURE-----

Merge tag 'iomap-6.6-fixes-5' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux

Pull iomap fix from Darrick Wong:

 - Fix a bug where a writev consisting of a bunch of sub-fsblock writes
   where the last buffer address is invalid could lead to an infinite
   loop

* tag 'iomap-6.6-fixes-5' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
  iomap: fix short copy in iomap_write_iter()
2023-10-21 09:43:09 -07:00
Dell Jin
965f9b8c0c net: ethernet: adi: adin1110: Fix uninitialized variable
The spi_transfer struct has to have all it's fields initialized to 0 in
this case, since not all of them are set before starting the transfer.
Otherwise, spi_sync_transfer() will sometimes return an error.

Fixes: a526a3cc9c ("net: ethernet: adi: adin1110: Fix SPI transfers")
Signed-off-by: Dell Jin <dell.jin.code@outlook.com>
Signed-off-by: Ciprian Regus <ciprian.regus@analog.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2023-10-21 11:54:42 +01:00
Michael Sit Wei Hong
95201f36f3 net: stmmac: update MAC capabilities when tx queues are updated
Upon boot up, the driver will configure the MAC capabilities based on
the maximum number of tx and rx queues. When the user changes the
tx queues to single queue, the MAC should be capable of supporting Half
Duplex, but the driver does not update the MAC capabilities when it is
configured so.

Using the stmmac_reinit_queues() to check the number of tx queues
and set the MAC capabilities accordingly.

Fixes: 0366f7e06a ("net: stmmac: add ethtool support for get/set channels")
Cc: <stable@vger.kernel.org> # 5.17+
Signed-off-by: Michael Sit Wei Hong <michael.wei.hong.sit@intel.com>
Signed-off-by: Gan, Yi Fang <yi.fang.gan@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2023-10-21 11:53:32 +01:00
Rob Herring
d2ca43f306 net: xgene: Fix unused xgene_enet_of_match warning for !CONFIG_OF
Commit b0377116de ("net: ethernet: Use device_get_match_data()") dropped
the unconditional use of xgene_enet_of_match resulting in this warning:

drivers/net/ethernet/apm/xgene/xgene_enet_main.c:2004:34: warning: unused variable 'xgene_enet_of_match' [-Wunused-const-variable]

The fix is to drop of_match_ptr() which is not necessary because DT is
always used for this driver (well, it could in theory support ACPI only,
but CONFIG_OF is always enabled for arm64).

Fixes: b0377116de ("net: ethernet: Use device_get_match_data()")
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202310170627.2Kvf6ZHY-lkp@intel.com/
Signed-off-by: Rob Herring <robh@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2023-10-21 11:49:31 +01:00
Tirthendu Sarkar
068d8b75c1 i40e: sync next_to_clean and next_to_process for programming status desc
When a programming status desc is encountered on the rx_ring,
next_to_process is bumped along with cleaned_count but next_to_clean is
not. This causes I40E_DESC_UNUSED() macro to misbehave resulting in
overwriting whole ring with new buffers.

Update next_to_clean to point to next_to_process on seeing a programming
status desc if not in the middle of handling a multi-frag packet. Also,
bump cleaned_count only for such case as otherwise next_to_clean buffer
may be returned to hardware on reaching clean_threshold.

Fixes: e9031f2da1 ("i40e: introduce next_to_process to i40e_ring")
Suggested-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
Reported-by: hq.dev+kernel@msdfc.xyz
Reported by: Solomon Peachy <pizza@shaftnet.org>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217678
Tested-by: hq.dev+kernel@msdfc.xyz
Tested by: Indrek Järve <incx@dustbite.net>
Signed-off-by: Tirthendu Sarkar <tirthendu.sarkar@intel.com>
Tested-by: Arpana Arland <arpanax.arland@intel.com> (A Contingent worker at Intel)
Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
Acked-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
Link: https://lore.kernel.org/r/20231019203852.3663665-1-jacob.e.keller@intel.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2023-10-20 18:17:11 -07:00
Sasha Neftin
e7684d29ef igc: Fix ambiguity in the ethtool advertising
The 'ethtool_convert_link_mode_to_legacy_u32' method does not allow us to
advertise 2500M speed support and TP (twisted pair) properly. Convert to
'ethtool_link_ksettings_test_link_mode' to advertise supported speed and
eliminate ambiguity.

Fixes: 8c5ad0dae9 ("igc: Add ethtool support")
Suggested-by: Dima Ruinskiy <dima.ruinskiy@intel.com>
Suggested-by: Vitaly Lifshits <vitaly.lifshits@intel.com>
Signed-off-by: Sasha Neftin <sasha.neftin@intel.com>
Tested-by: Naama Meir <naamax.meir@linux.intel.com>
Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
Link: https://lore.kernel.org/r/20231019203641.3661960-1-jacob.e.keller@intel.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2023-10-20 18:15:38 -07:00
Eric Dumazet
a9beb7e81b neighbour: fix various data-races
1) tbl->gc_thresh1, tbl->gc_thresh2, tbl->gc_thresh3 and tbl->gc_interval
   can be written from sysfs.

2) tbl->last_flush is read locklessly from neigh_alloc()

3) tbl->proxy_queue.qlen is read locklessly from neightbl_fill_info()

4) neightbl_fill_info() reads cpu stats that can be changed concurrently.

Fixes: c7fb64db00 ("[NETLINK]: Neighbour table configuration and statistics via rtnetlink")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/20231019122104.1448310-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2023-10-20 17:41:29 -07:00
Eric Dumazet
72bf4f1767 net: do not leave an empty skb in write queue
Under memory stress conditions, tcp_sendmsg_locked()
might call sk_stream_wait_memory(), thus releasing the socket lock.

If a fresh skb has been allocated prior to this,
we should not leave it in the write queue otherwise
tcp_write_xmit() could panic.

This apparently does not happen often, but a future change
in __sk_mem_raise_allocated() that Shakeel and others are
considering would increase chances of being hurt.

Under discussion is to remove this controversial part:

    /* Fail only if socket is _under_ its sndbuf.
     * In this case we cannot block, so that we have to fail.
     */
    if (sk->sk_wmem_queued + size >= sk->sk_sndbuf) {
        /* Force charge with __GFP_NOFAIL */
        if (memcg_charge && !charged) {
            mem_cgroup_charge_skmem(sk->sk_memcg, amt,
                gfp_memcg_charge() | __GFP_NOFAIL);
        }
        return 1;
    }

Fixes: fdfc5c8594 ("tcp: remove empty skb from write queue in error cases")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Shakeel Butt <shakeelb@google.com>
Link: https://lore.kernel.org/r/20231019112457.1190114-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2023-10-20 17:40:10 -07:00
Linus Torvalds
9c5d00cb7b perf tools fixes for v6.6: 2nd batch
- Fix regression in reading scale and unit files from sysfs for PMU
   events, so that we can use that info to pretty print instead of
   printing raw numbers:
 
   # perf stat -e power/energy-ram/,power/energy-gpu/ sleep 2
 
    Performance counter stats for 'system wide':
 
               1.64 Joules power/energy-ram/
               0.20 Joules power/energy-gpu/
 
        2.001228914 seconds time elapsed
   #
   # grep -m1 "model name" /proc/cpuinfo
   model name	: Intel(R) Core(TM) i7-8650U CPU @ 1.90GHz
   #
 
 - The small llvm.cpp file used to check if the llvm devel files are present was
   incorrectly deleted when removing the BPF event in 'perf trace', put it back
   as it is also used by tools/bpf/bpftool, that uses llvm routines to do
   disassembly of BPF object files.
 
 - Fix use of addr_location__exit() in dlfilter__object_code(), making sure that
   it is only used to pair a previous addr_location__init() call.
 
 Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQR2GiIUctdOfX2qHhGyPKLppCJ+JwUCZTKh5AAKCRCyPKLppCJ+
 J/g/AP0f6SNyHJz21JzDTzyjXAeSdMzKwic0LXv+kATQy31HJAD+Kf7UKQieUeZB
 fxvp60aKyFN8IVIgpYiAjZMS3k9XPAY=
 =N7Gv
 -----END PGP SIGNATURE-----

Merge tag 'perf-tools-fixes-for-v6.6-2-2023-10-20' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools

Pull perf tools fixes from Arnaldo Carvalho de Melo:

 - Fix regression in reading scale and unit files from sysfs for PMU
   events, so that we can use that info to pretty print instead of
   printing raw numbers:

     # perf stat -e power/energy-ram/,power/energy-gpu/ sleep 2

      Performance counter stats for 'system wide':

                 1.64 Joules power/energy-ram/
                 0.20 Joules power/energy-gpu/

          2.001228914 seconds time elapsed
     #
     # grep -m1 "model name" /proc/cpuinfo
     model name	: Intel(R) Core(TM) i7-8650U CPU @ 1.90GHz
     #

 - The small llvm.cpp file used to check if the llvm devel files are
   present was incorrectly deleted when removing the BPF event in 'perf
   trace', put it back as it is also used by tools/bpf/bpftool, that
   uses llvm routines to do disassembly of BPF object files.

 - Fix use of addr_location__exit() in dlfilter__object_code(), making
   sure that it is only used to pair a previous addr_location__init()
   call.

* tag 'perf-tools-fixes-for-v6.6-2-2023-10-20' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools:
  tools build: Fix llvm feature detection, still used by bpftool
  perf dlfilter: Add a test for object_code()
  perf dlfilter: Fix use of addr_location__exit() in dlfilter__object_code()
  perf pmu: Fix perf stat output with correct scale and unit
2023-10-20 14:49:24 -07:00
Linus Torvalds
444ccf1b11 linux_kselftest_active-fixes-6.6-rc7
This Kselftest update for Linux 6.6-rc7 consists of one single fix
 to assert check in user_events abi_test to properly check bit value
 on Big Endian architectures. The current code treats the bit values
 as Little Endian and the check fails on Big Endian.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEPZKym/RZuOCGeA/kCwJExA0NQxwFAmUytR4ACgkQCwJExA0N
 QxzjoQ/+MWgtyggLZo/dP+qJ7AU+tG08YXWWuh99lkSxVs3xHvwl2EGaYf1PXN9c
 ZUXb/KGfls8G4tv20KU2+/uSRSirkf+CFLN6HaBBG+2cun8o0KpHlVKGfmvRjb13
 ZUX8UQJ5u9kTSTqV7gCxVbemV5iOhTazuwVQ1Aq7wFL6e/0oL4eolbgNP0ub76vy
 UsZl9j/8pFhtVfdqRJqorKQ9H5RgvW7CCmobkUruGJoXg7jFuFdeqXtS4U1ziyJT
 g42LtXuC053KrEnEmhj1EadZC4E1eXadffssanfyWolAXjRD3N+2vLYasJOiGDAO
 mT111kQLaRNvZLJBULlrnWITkbVOhfE9Cxu14idxvdLShQiUO8kRCjoN2TbLZ2ET
 n7u/4anHBu99ljO6uZVNe7JY5ZrwaM1o7Myvk9eOVRe4WKkgOXJKUM3lfwvfMK8Q
 sEWvfBY04gL5y697DDiQvJ4g0fRwwnoadpHFvJTJX977H5C8/c750YZw/Emuip9D
 zxyHGEVtncM6awbHP8bGBgg2f6XISWKs5qvzrwLmdXx42oi0VjU4z+cEVOUSx/rY
 K+B+LVzcdYc/6UhjQzmylNBUs5CO7K6D05/tes07QaZ1MCCyw3b+DAR+LJn2U2+C
 Y3+x/kQT16abMIIpTM8qVWqxswvaFSyZ+5hCkVrAsYwkM1fpB4c=
 =PJhV
 -----END PGP SIGNATURE-----

Merge tag 'linux_kselftest_active-fixes-6.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest

Pull Kselftest fix from Shuah Khan:
 "One single fix to assert check in user_events abi_test to properly
  check bit value on Big Endian architectures. The code treated the bit
  values as Little Endian and the check failed on Big Endian"

* tag 'linux_kselftest_active-fixes-6.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest:
  selftests/user_events: Fix abi_test for BE archs
2023-10-20 14:45:41 -07:00
Linus Torvalds
f74e3ea3ba A few more NFS Client Bugfixes for Linux 6.6-rc
Stable Fix:
   * Fix a pNFS hang in nfs4_evict_inode()
 
 Bugfixes:
   * Force update of suid/sgid bits after an NFS v4.2 ALLOCATE op
   * Fix a potential oops in nfs_inode_remove_request()
   * Check the validity of the layout pointer in ff_layout_mirror_prepare_stats()
   * Fix incorrectly marking the pNFS MDS with USE_PNFS_DS in some cases
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEnZ5MQTpR7cLU7KEp18tUv7ClQOsFAmUy4cAACgkQ18tUv7Cl
 QOstABAAtK5pXSbzXXQY1IIVIxgIT9tGRMPwd+IVUwL0qRIhTqGkiax6UuZVH9id
 NxrTQFrrxC4np2X4atYdC4LggOqx6wcdNLQ9oJ56zULHUtycgjqCSjFrKbA3nFa6
 tn4EccPvKzjsmsbJW1rCq97XIRqZY1XotjDA3MR72YSnsOncdoLr6ng6virjOxWe
 t8K8WS4tScD0kwvclQLpsEDSFEEdjTYORdS3RVXVz4crM45gikmTI7bSyZ4vc0lT
 TafhFYMjcHUNyKF8MP0DguYSGTtHxCHuM/0yYZw0ZiqLdZeT7Pk/GVecV6qmMD9W
 REkidcFLV53RR4qjUvL0HuM71/cX+yfwGaj6e8nZg5b7s1pJB46IG58ZmQaPwyzP
 n9/zxZHIRrNSkj6e+cwFpgpz7v7wjTOsXVUqBLE9q0Rsm71L8TuzW0G/lghY8tE+
 TZ4rMVlZnypFybELmEgoRXRZa0G41SeQmKYNMv+wJIwpNyxbKkI3FgpAx0A4RuyP
 prYK4S55GxqKiOrP22USHRpvkhxdzeIkmnPGuy/A04VYaVJwANjUI0w0SAgg1/Oj
 iNLjvO80wIL7d3fRLpjcjiQ2DtVt63WcnMgR0dV138959vh9CKAF7u7xVdW4Zsk7
 cO5/WAFR5cUh2veswsi69+oivXweP57pi0XWmiJamKKckS/PPuQ=
 =Z3lY
 -----END PGP SIGNATURE-----

Merge tag 'nfs-for-6.6-4' of git://git.linux-nfs.org/projects/anna/linux-nfs

Pull NFS client fixes from Anna Schumaker:
 "Stable Fix:
   - Fix a pNFS hang in nfs4_evict_inode()

  Fixes:
   - Force update of suid/sgid bits after an NFS v4.2 ALLOCATE op
   - Fix a potential oops in nfs_inode_remove_request()
   - Check the validity of the layout pointer in ff_layout_mirror_prepare_stats()
   - Fix incorrectly marking the pNFS MDS with USE_PNFS_DS in some cases"

* tag 'nfs-for-6.6-4' of git://git.linux-nfs.org/projects/anna/linux-nfs:
  NFSv4.1: fixup use EXCHGID4_FLAG_USE_PNFS_DS for DS server
  pNFS/flexfiles: Check the layout validity in ff_layout_mirror_prepare_stats
  pNFS: Fix a hang in nfs4_evict_inode()
  NFS: Fix potential oops in nfs_inode_remove_request()
  nfs42: client needs to strip file mode's suid/sgid bit after ALLOCATE op
2023-10-20 14:04:53 -07:00
Linus Torvalds
0e97fd2910 \n
-----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCAAdFiEEq1nRK9aeMoq1VSgcnJ2qBz9kQNkFAmUyw0wACgkQnJ2qBz9k
 QNknFgf/TMbqrnLyro0JUY6w4b9mgXTGFqqnaSuopOGK31vlpfiNR6mYw+vGv82E
 FcN4CSQFBIK8v7DU4pgCzbD1OxGIdJuWz7tjnI4ntr/jMM+3pqqKYhu+VkKInrBB
 HEIMe/WjM0/LbX/wid6xdT3Bcz6lbAySXJFVtxU45umkuv8RGODCAr6Gf1jX3q7m
 LsIv8ESCmau5hyesp1Te4N8bv7dK8x3FPpaX12BB8DkuRlaqmzwHXc0ExpMRhII8
 LBllG2rUIu2GNx8AqWULw9LyBsNaZSeAF2iUl5taXaDXw8Js8eQzH/Y+wS5KaJNa
 M7kszLlAByav/MSuUWWJHOqwgMhhDQ==
 =bOXL
 -----END PGP SIGNATURE-----

Merge tag 'fsnotify_for_v6.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs

Pull fanotify fix from Jan Kara:
 "Disable superblock / mount marks for filesystems that can encode file
  handles but not open them (currently only overlayfs).

  It is not clear the functionality is useful in any way so let's better
  disable it before someone comes up with some creative misuse"

* tag 'fsnotify_for_v6.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
  fanotify: limit reporting of event with non-decodeable file handles
2023-10-20 14:00:05 -07:00
Linus Torvalds
f20f29cbcb ACPI fixes for 6.6-rc7
- Fix ACPI initialization ordering on ARM that was changed incorrectly
    during the 6.5 development cycle (Hanjun Guo).
 
  - Make acpi_register_gsi() return an error code as appropriate when
    irq_create_fwspec_mapping() returns 0 on failure (Sunil V L).
 -----BEGIN PGP SIGNATURE-----
 
 iQJGBAABCAAwFiEE4fcc61cGeeHD/fCwgsRv/nhiVHEFAmUyn4wSHHJqd0Byand5
 c29ja2kubmV0AAoJEILEb/54YlRxALAQAKMk/F3980W2zItc7KmNXRBXMYvMoQTe
 FGZxRbL1QLo3f3eNVblDWDVB4/YgDFG9w9Kz77/a9R3hpOdIbpuXDYcClAnv2jVA
 axZk8mviJIPM2hYu4KuhAgl5gqiJtqE+DqVOf3ebuPj8TGKVYgS6liffaMewodbP
 zqEknwIEvhnNdBkq8rHJ3nHjpdKWVn8MNaHU5tHUNabCKAqQMtH3QuBE0a9LWODu
 h4rMUVidkm7cBEfPaCmPsAc533qonDwNd7VTXsgSAhLhoWlBd+oaXRnMtyxs7Mxx
 8h2T/i4nuu7RG1NBjw4TpEgZyu/2+VKacrhrFt/hD4plMzQo273uhQPPjPvzjroS
 3s2PiuQyoxwYwulbXEPjuU/soG8HCbg6IFyeXcigru2bDF3DpD3RpKRpCFpFGEeo
 /YqGppJC7K1eRgvB5c5qhfFxBEThjAd49jYm93NpMs4w7fFNbQchjToLCTkgiLFs
 o+TmtRQ5eLJXjchRrNBYZ974XutV9ewaM98uC7QgZfp2bcGeP8OgOpoNwRmpVI+V
 MCWZy+RI+x0caEnUVg4V35otMj5gBwJFmm34mAojkEc+Yuu2sqI1VO7FUMcKpfTz
 xIu1RASlZUlKwa+3ykjUG5oNKatUXOm33RxcAaOOfYw0yWIkqdIUCCVFqJDGo+vF
 Q/GxZEHwy7UO
 =VCpn
 -----END PGP SIGNATURE-----

Merge tag 'acpi-6.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

Pull ACPI fixes from Rafael Wysocki:
 "These fix the ACPI initialization ordering on ARM and ACPI IRQ
  management in the cases when irq_create_fwspec_mapping() fails.

  Specifics:

   - Fix ACPI initialization ordering on ARM that was changed
     incorrectly during the 6.5 development cycle (Hanjun Guo)

   - Make acpi_register_gsi() return an error code as appropriate when
     irq_create_fwspec_mapping() returns 0 on failure (Sunil V L)"

* tag 'acpi-6.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  ACPI: bus: Move acpi_arm_init() to the place of after acpi_ghes_init()
  ACPI: irq: Fix incorrect return value in acpi_register_gsi()
2023-10-20 13:47:05 -07:00
Linus Torvalds
75e167c2f6 SCSI fixes on 20231020
Two small fixes, both in drivers.  The mptsas one is really fixing an
 error path issue where it can leave the misc driver loaded even though
 the sas driver fails to initialize.
 
 Signed-off-by: James E.J. Bottomley <jejb@linux.ibm.com>
 -----BEGIN PGP SIGNATURE-----
 
 iJwEABMIAEQWIQTnYEDbdso9F2cI+arnQslM7pishQUCZTLCuiYcamFtZXMuYm90
 dG9tbGV5QGhhbnNlbnBhcnRuZXJzaGlwLmNvbQAKCRDnQslM7pishU6oAP45oLIr
 P3d4AXt2XGBwsaqyWaQx2OOe8fGps0+jyF3OdQEAzFXKXp7lNmHlA573JVMjH6Sz
 JqAdi+dYksRssC0GMZk=
 =iXXi
 -----END PGP SIGNATURE-----

Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

Pull SCSI fixes from James Bottomley:
 "Two small fixes, both in drivers.

  The mptsas one is really fixing an error path issue where it can leave
  the misc driver loaded even though the sas driver fails to initialize"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: qla2xxx: Fix double free of dsd_list during driver load
  scsi: mpt3sas: Fix in error path
2023-10-20 13:24:50 -07:00
Linus Torvalds
659eaa0015 Late pin control fixes for the v6.6 kernel cycle:
- Concurrent register updates in the Qualcomm LPASS pin
   controller gets a proper lock.
 
 - We revert a mutex fix that was causing problems: contention
   on the mutex or something of the sort lead to probe
   reordering and MMC block devices start to register in
   a different order, which unsuspecting userspace is not
   ready to handle.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEElDRnuGcz/wPCXQWMQRCzN7AZXXMFAmUy1N8ACgkQQRCzN7AZ
 XXM2RA/+IiRmsEc2zvyTRr2EYOe6oAxC9f515YYJnoRolt+FUbijWMvB8oB6zeJy
 dDByXxCercuX4y0nivRkL1G0B5QMi4OTfKPte26LxRFv6zm7brObHuK17HKnwIP7
 sfLK+FT3jatl8PwwsUwc9ildXhdQ+JCD5yHarqDCqVVCiiqxINPu3GRWoDQHlDts
 lwyOPE2s0l6m29ms3NFM2lX13j/C7vwX+QMDWF2BZ8S0WEC7l7TYugvnBmt4zJ/6
 +1h1E2nywBMd8YVCtMFRyoOhdxTxnuMSnotpHAqXH/NZ1f2c8SMilv6YLte9r6Yh
 BdjAFejRGF/L4uNgk65X4+3DTZbsiMWYkZXNO8zis4jAKCOo7giCvt5R45p0smul
 j1lAAJU5SwxUDP5Lm5IVdrSJtGj7ZcpsEJAyBRsbS1Yepqfb4S+J3F6xwz4TEp0K
 TCB4epS/G1Y2100PYzTdVZCrq/mbJCEYLtdmy8dFlIMh/EjZmPVNZw3VofdLgoyv
 VwpOtK0R8NMfxeuAQLrLs4WjxWEzf2DhbIBo8MmTI8SzdqbKHL8EwsXR5Cis09hB
 G2nnPpIJzTl8fKA9oGwiCCDpgxpXnmr5qh2VslCu9GpC3x2znbFxzFt8/1QU0QtT
 V7LnsJ3Xuy28bKscAHFNM1zPjBf8YZXLNyWVEHLUK4i///0JoFY=
 =CPHT
 -----END PGP SIGNATURE-----

Merge tag 'pinctrl-v6.6-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl

Pull pin control fixes from Linus Walleij:

 - Concurrent register updates in the Qualcomm LPASS pin controller gets
   a proper lock.

 - revert a mutex fix that was causing problems: contention on the mutex
   or something of the sort lead to probe reordering and MMC block
   devices start to register in a different order, which unsuspecting
   userspace is not ready to handle

* tag 'pinctrl-v6.6-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
  Revert "pinctrl: avoid unsafe code pattern in find_pinctrl()"
  pinctrl: qcom: lpass-lpi: fix concurrent register updates
2023-10-20 13:21:46 -07:00
Linus Torvalds
f617647154 In the raw NAND subsystem, the major fix prevents using cached reads
with devices not supporting it. There was two bug reports about
 this. Aside, 3 drivers (pl353, arasan and marvell) could sometimes hide
 page program failures due to their their own program page helper not
 being fully compliant with the specification (many drivers use the
 default helpers shared by the core). Adding a missing check prevents
 these situation. Finally, the Qualcomm driver had a broken error path.
 
 In the SPI-NAND subsystem one Micron device used a wrong bitmak
 reporting possibly corrupted ECC status.
 
 Finally, the physmap-core got stripped from its map_rom fallback by
 mistake, this feature is added back.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEE9HuaYnbmDhq/XIDIJWrqGEe9VoQFAmUyvxcACgkQJWrqGEe9
 VoStmwf9HjOY3kNB37ip0NpG5viRWeLNC8hMxJOJaGZlyX6x9b/88xsBjVFc7z3s
 hoCBGfOnUSDXk4KfxNiYps5YqfMgb+yLeIGdsDsLhNht6Mh/YOEFzXgcD8+iudKH
 OpjjJnRzQHxNM3zA3Vauh1XD/j+6uvQ3BHlJpQfA+Ukv4+34Irin4/gKhZCoUedo
 IJNVU5hurJexCkjGk2yO+B34qD8ZXGKWeXzwsKKYB/FE55iO69GrHNdLBMnFfxu+
 uU6GcV+YKroPLDs5mKH2oojKhyAhrh3gQyrNJFnCqh/sVnNCAbD75N+YC6enHeBe
 ovlc82AWmLUJVktsih27OsU58RnCxA==
 =7Xq1
 -----END PGP SIGNATURE-----

Merge tag 'mtd/fixes-for-6.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux

Pull MTD fixes from Miquel Raynal:
 "In the raw NAND subsystem, the major fix prevents using cached reads
  with devices not supporting it. There was two bug reports about this.

  Apart from that, three drivers (pl353, arasan and marvell) could
  sometimes hide page program failures due to their their own program
  page helper not being fully compliant with the specification (many
  drivers use the default helpers shared by the core). Adding a missing
  check prevents these situation.

  Finally, the Qualcomm driver had a broken error path.

  In the SPI-NAND subsystem one Micron device used a wrong bitmak
  reporting possibly corrupted ECC status.

  Finally, the physmap-core got stripped from its map_rom fallback by
  mistake, this feature is added back"

* tag 'mtd/fixes-for-6.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux:
  mtd: rawnand: Ensure the nand chip supports cached reads
  mtd: rawnand: qcom: Unmap the right resource upon probe failure
  mtd: rawnand: pl353: Ensure program page operations are successful
  mtd: rawnand: arasan: Ensure program page operations are successful
  mtd: spinand: micron: correct bitmask for ecc status
  mtd: physmap-core: Restore map_rom fallback
  mtd: rawnand: marvell: Ensure program page operations are successful
2023-10-20 13:12:34 -07:00
Linus Torvalds
7da6c042ca MMC core:
- Capture correct oemid-bits for eMMC cards
  - Fix error propagation for some ioctl commands
  - Hold retuning if SDIO is in 1-bit mode
 
 MMC host:
  - mtk-sd: Use readl_poll_timeout_atomic to not "schedule while atomic"
  - sdhci-msm: Correct minimum number of clocks
  - sdhci-pci-gli: Fix LPM negotiation so x86/S0ix SoCs can suspend
  - sdhci-sprd: Fix error code in sdhci_sprd_tuning()
 -----BEGIN PGP SIGNATURE-----
 
 iQJLBAABCgA1FiEEugLDXPmKSktSkQsV/iaEJXNYjCkFAmUyaoIXHHVsZi5oYW5z
 c29uQGxpbmFyby5vcmcACgkQ/iaEJXNYjCkrIRAAz8j+NQPEtyysuujKWnr+XRAW
 7FgFQvFij1oOoiXY+8gj2Ept8zDYTDQ+C5oeWo4Y9x7zoq+1Zn06z2SDNA6L8Vex
 lOBiVUhMp08SgdkXnKmJvK/56lOHN0NzHzQws4zCD3YvnGivlV9buqwyoKqu+E3k
 kMkspjK1EUV+uy0HsQXdeHLr6YBvA2h3xJGp9PnVbBxZUqcOr7/DnX/IsXLb7tDE
 2kHzhVnf1pca3gIzysZgdKv9BkkV1JEtBnXiUJawctHMY3ghTRkhQ9XmXqhioSLc
 AvIO+EFcRFRgg1fZjPjP8FMvRNHmfSRnWyyLKhvA+K/fCyk5W7irfDNi3GIfwJ9X
 LB5KYauqKY36COA1vTub10nGC8C1unUbQxdOwPEAhPXRoHLHuH92U65nuZONFGVS
 +Rs+hUAuuBlliK3x9gMzlYk78JFUylIEs8Hv8x6lu8recllnoHOoQG/CNWnFoq+P
 PKUh6T/VHhapot5q4mzJM8l82592BSfJH4zqEManntEBxGIvNUNCxGTUqV/T9XL6
 m4LgybbjLhPkFOhPKY8WV3o6gaFKukEScuSBWhTQ+pTUUkyENVpJz0/3rS/ft998
 KG/U4DSUzAVPRjWoC2Y+H3Oh4ArbVuSaiu8101/1yvuCo/p0tVBoDPCfZpQSequz
 piL8ZPo3QCEQ3htht7Q=
 =psEX
 -----END PGP SIGNATURE-----

Merge tag 'mmc-v6.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc

Pull MMC fixes from Ulf Hansson:
 "MMC core:
   - Capture correct oemid-bits for eMMC cards
   - Fix error propagation for some ioctl commands
   - Hold retuning if SDIO is in 1-bit mode

  MMC host:
   - mtk-sd: Use readl_poll_timeout_atomic to not "schedule while atomic"
   - sdhci-msm: Correct minimum number of clocks
   - sdhci-pci-gli: Fix LPM negotiation so x86/S0ix SoCs can suspend
   - sdhci-sprd: Fix error code in sdhci_sprd_tuning()"

* tag 'mmc-v6.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
  mmc: core: Capture correct oemid-bits for eMMC cards
  mmc: mtk-sd: Use readl_poll_timeout_atomic in msdc_reset_hw
  mmc: core: Fix error propagation for some ioctl commands
  mmc: sdhci-sprd: Fix error code in sdhci_sprd_tuning()
  mmc: sdhci-pci-gli: fix LPM negotiation so x86/S0ix SoCs can suspend
  mmc: core: sdio: hold retuning if sdio in 1-bit mode
  dt-bindings: mmc: sdhci-msm: correct minimum number of clocks
2023-10-20 13:09:19 -07:00
Linus Torvalds
c320008102 block-6.6-2023-10-20
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmUyYnAQHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgpuidEADVVSUmBSEqEfHtOe0CYqTnXuBvdiBoIgTM
 uHlhdGRdRdUIO4vDiMMJYdNC2LjJTu1aLf6xJ7WK5wRcb5lxdu/TkcKZ36wD42pw
 FcgCG77VJm2hzhD/4tsP1o5UGYU+O/J344AHQcdAcVVUwA18ddwO9vgYw73AJWQn
 e5qXSKqcO724WNyeXv8AMqmfowzwYBMTWFO1i345uiXYQYAHDvLK/PTgLjUTkV/t
 sNCSH+7+Mxg6ucgsOQbA2LU4GLet34sJy6+JhynpHEpE4mqaWQYTzzDPv5PJuhpg
 MYqVTkJ/UQNPAv8h+aDNUDzAWGxqcsKvLkmMFmwFUpyZZeM/pAsulCy1C0S1oa75
 +OAsqlVfevP7G00HLko0g5iphDHAKJP1+jzEt1Qcf4OGYzHfTXhquI/EyEDL4w84
 EVmW54KjR4VplXW0EQAAam4KNwhwIgLFDhPT0nzmpvIZgtJLAjcKBxxflVJo/iSJ
 76Zb0gBjvHIB3iUlTKgWkmWraAGpiP469l9Sj5ncZfkLkCprRmRo9gjJW99AET18
 J/aDBrr/7dMnGSMwyHWDe983Zel2j20XacEo+zmQS+MECy29UHKgzIL9FG8zmrl+
 5gLEjsVUrfkZnZpUUTa57/Lp4t2B03JThoYIpiLPwGw53/iWmXeZZ1K6giJ6Is7A
 wiD2QfI00Q==
 =S5V+
 -----END PGP SIGNATURE-----

Merge tag 'block-6.6-2023-10-20' of git://git.kernel.dk/linux

Pull block fixes from Jens Axboe:
 "A fix for a regression with sed-opal and saved keys, and outside of
  that an NVMe pull request fixing a few minor issues on that front"

* tag 'block-6.6-2023-10-20' of git://git.kernel.dk/linux:
  nvme-pci: add BOGUS_NID for Intel 0a54 device
  nvmet-auth: complete a request only after freeing the dhchap pointers
  nvme: sanitize metadata bounce buffer for reads
  block: Fix regression in sed-opal for a saved key.
  nvme-auth: use chap->s2 to indicate bidirectional authentication
  nvmet-tcp: Fix a possible UAF in queue intialization setup
  nvme-rdma: do not try to stop unallocated queues
2023-10-20 10:31:06 -07:00
Linus Torvalds
747b7628ca io_uring-6.6-2023-10-20
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmUyYoUQHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgputgD/9RFagHCnHElhccvNL3E5VwUmfru/8fdNA7
 Y+otcV24OPHSAVdVkPwyKt4IhhUUsXG/TO4RIb6W9JII1Y4dUT9XBanrWbJUCf08
 2LHHuCJo+dvkeSrqW2u755giQGqavj0XQJntAdqA4hOFRXOhGFn+zn272lZdrNb2
 HuU9NQNyhsh46e4h21On2Wlv0TqYsiAR/ScqhyofWhah92mzzJRImqls0Q1m5laM
 ibVjjspThPVfaxeW/9ktRL6Co+JAscQRHzYiN8dSDfeKcJmy3kiNFyps4cjtVCWw
 IY8m+UF3i/gVFAd84ltBtngeU63YS060pAILbLGcBuH/8kQyyaR7OTBX5jHgIM1O
 1llWw3jT2v5UsBo++a0AOp5ZQ6C2pSP9cOj6gM+vGq+fkVyvJPOXs1nXxiSkywHq
 Fd6/Abk15YkXSBdPAl9U5Hj5zZ3LEN1pQ+BVNYgWAF69WybW0h1HUc+Yh+r87M29
 Nw/FBHbWrK5tOxRiETlEU6/hlYfrjhCNHYwV5YWeHJ8OZNUO2JodSlgyZ1rahO46
 S8UbGjnDr2XYX98DpS/MyOzQsalFbFCTSSYGhYJevoX/ToQcVsnYW6jjBqypYqMt
 L9q6k7JtDOhFwMzv/aedCMrkA1sDg8CBkPEoonwHYXBHFhhlLXm40cGcVP7OyUAn
 pKvWCN6iUQ==
 =+aok
 -----END PGP SIGNATURE-----

Merge tag 'io_uring-6.6-2023-10-20' of git://git.kernel.dk/linux

Pull io_uring fix from Jens Axboe:
 "Just a single fix for a bug report that came in, fixing a case where
  failure to init a ring with IORING_SETUP_NO_MMAP can trigger a NULL
  pointer dereference"

* tag 'io_uring-6.6-2023-10-20' of git://git.kernel.dk/linux:
  io_uring: fix crash with IORING_SETUP_NO_MMAP and invalid SQ ring address
2023-10-20 10:28:46 -07:00