Commit Graph

1281275 Commits

Author SHA1 Message Date
Luiz Augusto von Dentz
ac65ecccae Bluetooth: hci_event: Fix setting of unicast qos interval
qos->ucast interval reffers to the SDU interval, and should not
be set to the interval value reported by the LE CIS Established
event since the latter reffers to the ISO interval. These two
interval are not the same thing:

BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 6, Part G

Isochronous interval:
The time between two consecutive BIS or CIS events (designated
ISO_Interval in the Link Layer)

SDU interval:
The nominal time between two consecutive SDUs that are sent or
received by the upper layer.

So this instead uses the following formula from the spec to calculate
the resulting SDU interface:

BLUETOOTH CORE SPECIFICATION Version 5.4 | Vol 6, Part G
page 3075:

Transport_Latency_C_To_P = CIG_Sync_Delay + (FT_C_To_P) ×
ISO_Interval + SDU_Interval_C_To_P
Transport_Latency_P_To_C = CIG_Sync_Delay + (FT_P_To_C) ×
ISO_Interval + SDU_Interval_P_To_C

Link: https://github.com/bluez/bluez/issues/823
Fixes: 2be22f1941 ("Bluetooth: hci_event: Fix parsing of CIS Established Event")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2024-06-28 14:30:28 -04:00
Vijay Satija
3f35d9b3e9 Bluetooth: btintel_pcie: Fix REVERSE_INULL issue reported by coverity
check pdata return of skb_pull_data, instead of data.

Fixes: c2b636b3f7 ("Bluetooth: btintel_pcie: Add support for PCIe transport")
Signed-off-by: Vijay Satija <vijay.satija@intel.com>
Signed-off-by: Kiran K <kiran.k@intel.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2024-06-28 14:30:25 -04:00
Hector Martin
897e612056 Bluetooth: hci_bcm4377: Fix msgid release
We are releasing a single msgid, so the order argument to
bitmap_release_region must be zero.

Fixes: 8a06127602 ("Bluetooth: hci_bcm4377: Add new driver for BCM4377 PCIe boards")
Cc: stable@vger.kernel.org
Signed-off-by: Hector Martin <marcan@marcan.st>
Reviewed-by: Sven Peter <sven@svenpeter.dev>
Reviewed-by: Neal Gompa <neal@gompa.dev>
Signed-off-by: Sven Peter <sven@svenpeter.dev>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2024-06-28 14:30:22 -04:00
Sven Peter
ed2a2ef16a Bluetooth: Add quirk to ignore reserved PHY bits in LE Extended Adv Report
Some Broadcom controllers found on Apple Silicon machines abuse the
reserved bits inside the PHY fields of LE Extended Advertising Report
events for additional flags. Add a quirk to drop these and correctly
extract the Primary/Secondary_PHY field.

The following excerpt from a btmon trace shows a report received with
"Reserved" for "Primary PHY" on a 4388 controller:

> HCI Event: LE Meta Event (0x3e) plen 26
      LE Extended Advertising Report (0x0d)
        Num reports: 1
        Entry 0
          Event type: 0x2515
            Props: 0x0015
              Connectable
              Directed
              Use legacy advertising PDUs
            Data status: Complete
            Reserved (0x2500)
         Legacy PDU Type: Reserved (0x2515)
          Address type: Random (0x01)
          Address: 00:00:00:00:00:00 (Static)
          Primary PHY: Reserved
          Secondary PHY: No packets
          SID: no ADI field (0xff)
          TX power: 127 dBm
          RSSI: -60 dBm (0xc4)
          Periodic advertising interval: 0.00 msec (0x0000)
          Direct address type: Public (0x00)
          Direct address: 00:00:00:00:00:00 (Apple, Inc.)
          Data length: 0x00

Cc: stable@vger.kernel.org
Fixes: 2e7ed5f5e6 ("Bluetooth: hci_sync: Use advertised PHYs on hci_le_ext_create_conn_sync")
Reported-by: Janne Grunau <j@jannau.net>
Closes: https://lore.kernel.org/all/Zjz0atzRhFykROM9@robin
Tested-by: Janne Grunau <j@jannau.net>
Signed-off-by: Sven Peter <sven@svenpeter.dev>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2024-06-28 14:30:20 -04:00
Ma Ke
80bec6825b drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes
In nouveau_connector_get_modes(), the return value of drm_mode_duplicate()
is assigned to mode, which will lead to a possible NULL pointer
dereference on failure of drm_mode_duplicate(). Add a check to avoid npd.

Cc: stable@vger.kernel.org
Fixes: 6ee738610f ("drm/nouveau: Add DRM driver for NVIDIA GPUs")
Signed-off-by: Ma Ke <make24@iscas.ac.cn>
Signed-off-by: Lyude Paul <lyude@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20240627074204.3023776-1-make24@iscas.ac.cn
2024-06-28 14:00:10 -04:00
Linus Torvalds
6c0483dbfe nfsd-6.10 fixes:
- Due to a late review, revert and re-fix a recent crasher fix
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEKLLlsBKG3yQ88j7+M2qzM29mf5cFAmZ+zksACgkQM2qzM29m
 f5ey0Q/+O8Z//rVg8L8V1EI44gZ1LRTiJEeDFoJU1Hktn0dOwTvGQJNzNbfpTBbT
 zTvvDBd9+cbHQ7Jl2r73+wkqgZbGXsRhMRUCmlA5ur0O7ujkYDo3rpOgQhP4V3LV
 1G6o2uOJT9d9UykUF74Demlg97kNrc8CY1QNujXjKrj8jYpQY4KcRCDb91KdYgc9
 GSque9zMD2jTJkTkSVRUyfWGEDvYtDxs7/4rdErjixaY30dgkPHae6euRzoQd2sC
 v3aoKHSt5Y/pvOX+3/c2QzDqOiKPOnm3dLazB+rK6lYrnt4iUeP3CiPcFmqNJZk2
 kZ3hpCPN8Le3oQFlMe450EljB8wLj2DqLix+Y/iOGyA732GLxNW6Hu8PkwRVFFwx
 cGGp6KryrcwO/BNHgxceErfhBG4IPKSgnY6C8Io+mPYKwSRAOKA4su02RoJDWJkA
 PTf67JgZiKv+bn3EGojeTo9YAvb04EYstttK2yBFUR9xylyew9vaZ9X8mYkqfyHN
 pZEWf/SI8SExZteo3Ymx9HLcX5FYsBjgvigpow33kUCn2hMhuhfBXEtmLNsxOSYC
 aEICcAYqnBovFJ+3vbz11IDS04ERIFdprlLQuExtJ21pujIlIM9pOxrIGvgu5pPl
 ++rsDP31Kh6imuZbSaJ5TFTdtDqcpah587m+mQtlaXAjOQL1qfw=
 =gwat
 -----END PGP SIGNATURE-----

Merge tag 'nfsd-6.10-3' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux

Pull nfsd fixes from Chuck Lever:

 - Due to a late review, revert and re-fix a recent crasher fix

* tag 'nfsd-6.10-3' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux:
  Revert "nfsd: fix oops when reading pool_stats before server is started"
  nfsd: initialise nfsd_info.mutex early.
2024-06-28 09:32:33 -07:00
Linus Torvalds
cd63a278ac bcachefs fixes for 6.10-rc6
simple stuff:
 - null ptr/err ptr deref fixes
 - fix for getting wedged on shutdown after journal error
 
 - fix missing recalc_capacity() call, capacity now changes correctly
   after a device goes read only
 
   however: our capacity calculation still doesn't take into account when
   we have mixed ro/rw devices and the ro devices have data on them,
   that's going to be a more involved fix to separate accounting for
   "capacity used on ro devices" and "capacity used on rw devices"
 
 - boring syzbot stuff
 
 slightly more involved:
 - discard, invalidate workers are now per device
   this has the effect of simplifying how we take device refs in these
   paths, and the device ref cleanup fixes a longstanding race between
   the device removal path and the discard path
 
 - fixes for how the debugfs code takes refs on btree_trans objects
   we have debugfs code that prints in use btree_trans objects. It uses
   closure_get() on trans->ref, which is mainly for the cycle detector,
   but the debugfs code was using it on a closure that may have hit 0,
   which is not allowed; for performance reasons we cannot avoid having
   not-in-use transactions on the global list.
 
   introduce some new primitives to fix this and make the synchronization
   here a whole lot saner
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEKnAFLkS8Qha+jvQrE6szbY3KbnYFAmZ+ye4ACgkQE6szbY3K
 bnb4shAAqkKdgB2abIaD1t8+KjUiXwt7seRY4EmzwrEaWniW5bDUYMBvV+tew93j
 uvGmSKMs4ML/r24hcg0zGPJ9GoWrFb3MWhPYizzRS8QspsUjsECJuehNPCe3RPaf
 QBgQtKahTge1e41y1frzkiGKqaOGOTtUVLOfPIebe+oJAhRCYRnrGY2dkZTms7Ue
 aXNtBmnlX3Fkmlm0GiKYrTHpAZz3d0kzdX11Pc2vTXvqo/znuJTTVGnjJkdrHzyv
 6cz6YnMKFdxLVbYO1KlB/3Hu9y9qt815g1rjvaqym8pDk9ltsGHNM3LcCCCyp7Of
 btnbLQ6TdfggK5Kf2hNYuJRY2pnjNyfcNxupQF3RNaw/D/4G5EU16zfFElORC6Mw
 eGwXLvDIGqOSSIvevoRZrgJKAvVptXNg9EtCI5Z5ujQ4ExW8ti1lPHp/r5SVOhyz
 x0Am14H2ERuz7Vt5jUas3k74+tAck6JWc5OemMQawA5waeH1inMT7QZuBt+Bmrhx
 Av0zbhaq4aTsHXmm+Xi6ofj3UBaOQ2rNzT7Au0kxdvJgDPe/USjw4tejV5DmjmHA
 SyRsTG7Zn5xJBi7jc47fcwUgUzlxlffVQGFCVjRUU1vF6u/Ldn7K0zfYbkwSCiKp
 iWSEyg3j5z5N69Vrgdadma4xTDjL/C5+XsMWh8G8ohf+crhUeSo=
 =svIi
 -----END PGP SIGNATURE-----

Merge tag 'bcachefs-2024-06-28' of https://evilpiepirate.org/git/bcachefs

Pull bcachefs fixes from Kent Overstreet:
 "Simple stuff:

   - NULL ptr/err ptr deref fixes

   - fix for getting wedged on shutdown after journal error

   - fix missing recalc_capacity() call, capacity now changes correctly
     after a device goes read only

     however: our capacity calculation still doesn't take into account
     when we have mixed ro/rw devices and the ro devices have data on
     them, that's going to be a more involved fix to separate accounting
     for "capacity used on ro devices" and "capacity used on rw devices"

   - boring syzbot stuff

  Slightly more involved:

   - discard, invalidate workers are now per device

     this has the effect of simplifying how we take device refs in these
     paths, and the device ref cleanup fixes a longstanding race between
     the device removal path and the discard path

   - fixes for how the debugfs code takes refs on btree_trans objects we
     have debugfs code that prints in use btree_trans objects.

     It uses closure_get() on trans->ref, which is mainly for the cycle
     detector, but the debugfs code was using it on a closure that may
     have hit 0, which is not allowed; for performance reasons we cannot
     avoid having not-in-use transactions on the global list.

     Introduce some new primitives to fix this and make the
     synchronization here a whole lot saner"

* tag 'bcachefs-2024-06-28' of https://evilpiepirate.org/git/bcachefs:
  bcachefs: Fix kmalloc bug in __snapshot_t_mut
  bcachefs: Discard, invalidate workers are now per device
  bcachefs: Fix shift-out-of-bounds in bch2_blacklist_entries_gc
  bcachefs: slab-use-after-free Read in bch2_sb_errors_from_cpu
  bcachefs: Add missing bch2_journal_do_writes() call
  bcachefs: Fix null ptr deref in journal_pins_to_text()
  bcachefs: Add missing recalc_capacity() call
  bcachefs: Fix btree_trans list ordering
  bcachefs: Fix race between trans_put() and btree_transactions_read()
  closures: closure_get_not_zero(), closure_return_sync()
  bcachefs: Make btree_deadlock_to_text() clearer
  bcachefs: fix seqmutex_relock()
  bcachefs: Fix freeing of error pointers
2024-06-28 09:25:21 -07:00
Linus Torvalds
cd17613f46 block-6.10-20240628
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmZ+0ScQHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgpqIAEADTcv8PohwiigfCGSGd9ExHgpGzZfLK3KO4
 9Mx+AuDEjCrSqIjzPJZcRgZDEeAN6V+aJ9Vz6DVJfljl9UIGz9BliYvb07aqhHsG
 4Bo1N2QQOLxoa+VqfRViPz8UB/Ofpd2oTWnHPPGxfT9l7gA/vLq7HoQQhkY+HCoC
 3A7DaNwHCR7PH0NQJBDo50ljAAhl2ALG6ubZ7BltcyZng9TK9K4oH7DXLn5SKSG4
 orsiiqL5X74y9Wl+vLDFjtyE49XVziRKIvCwTlsF8w1EAGXL0r38mRI6LRwU18Qu
 cS8963qDhm2KQ/XJD4sabHjBm3kXlQD4ZXKO/sY/omVk4NdRlXb1AGe/mlROIF67
 FrQpLejszTgx4jOskZL4SiNLuC5XbB31AnoVlcVo7s26YmZ6xfSRIfH5whEP51aW
 bwKZ16/9YvSiUUeUjAIjf0AAzeQNZOtb67jKsGhyPkmVFn64wDhApSyHbcS07NAo
 lsswZCbOia7mS0dKu/pznFmpY9qXvTx2amDxBOGWGL7U+7iDlTu9nW9QJevLbOKm
 q1v6ZFQi61UYyh3+500TPB7OdK+gSiLUUIqWL5R24TdcVF+HXgJzSzEValFtl2jR
 lgwrJCbwOQ7bGyyPF0h78zTkci3870tj/Q25srOL3wv2ubUrvA+k/Iokuul0BFKP
 pO6gQbNZgw==
 =y1pk
 -----END PGP SIGNATURE-----

Merge tag 'block-6.10-20240628' of git://git.kernel.dk/linux

Pull block fixes from Jens Axboe:
 "NVMe fixes via Keith:

   - Fabrics fixes (Hannes)

   - Missing module description (Jeff)

   - Clang warning fix (Nathan)"

* tag 'block-6.10-20240628' of git://git.kernel.dk/linux:
  nvmet-fc: Remove __counted_by from nvmet_fc_tgt_queue.fod[]
  nvmet: make 'tsas' attribute idempotent for RDMA
  nvme: fixup comment for nvme RDMA Provider Type
  nvme-apple: add missing MODULE_DESCRIPTION()
  nvmet: do not return 'reserved' for empty TSAS values
  nvme: fix NVME_NS_DEAC may incorrectly identifying the disk as EXT_LBA.
2024-06-28 09:21:27 -07:00
Linus Torvalds
a2316dda07 IOMMU Fixes for Linux v6.10-rc5
Including:
 
 	- Two cache flushing fixes for Intel and AMD drivers
 	- AMD guest translation enabling fix
 	- Update IOMMU tree location in MAINTAINERS file
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEr9jSbILcajRFYWYyK/BELZcBGuMFAmZ+rksACgkQK/BELZcB
 GuNDBg/+P3yCBVceEUsKpe584bUQpTs2X3M58X9ZKUEosEyjyLd24WnpW1yzdJqz
 6kbxDNCIVsde2eSVtw7fNkW7wBdj4nZ4KB8y9jfrGjpDiQczNp2zG3+z53uFfWR+
 rt2WnTD/Q+a59AgLBz2v8/tdczttNAgwQZu+H/rdQg4/Q55mtJoeCwU5DT5a5Ab4
 VfQSnOPHRm21GIewP9cbZoeTdOjRhE08/eszFpMQxApi20/MC67SYoUJBdUCjjLl
 kIqogI9CvB6vjiPuziWpnoFoRj0YDZKwzXKlJvZthHbFdSglEpCprNs2JlnW6kA7
 P9PIJrMCOAILNX9Cgmw2GVklTdLPUpRQw4chSdkZo8PVxECLozLQyBwmkI6Ic1AL
 BkTPfRWbYkcja0n+y24xogeETTwnl/g6RWiori3B3aMyRzOfvfnGg9jqbtBG0s54
 fRNGyr+dg8Iu27uvwkx4tk6LfO5mIp8YTrpXeRsbEOoD0NwwgBhxAMg9y/nivBh2
 y7o3uDYC/N9xsYJb+WHDa1sqF8fC9IB8b87VG3KxgWHd63g4WzEvMN/mRcmltRjL
 XkyNDYXOZE1oY+/Dh+H/TNUR9C7ErrIg17c7wRTRN8bxNENTjkFN5wUgxdZAcLIA
 c6SNvwMMwMO79ymvuI1USRYeOAWd8McS82AwOHU8qVdupol0xQo=
 =iidU
 -----END PGP SIGNATURE-----

Merge tag 'iommu-fixes-v6.10-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux

Pull iommu fixes from Joerg Roedel:

 - Two cache flushing fixes for Intel and AMD drivers

 - AMD guest translation enabling fix

 - Update IOMMU tree location in MAINTAINERS file

* tag 'iommu-fixes-v6.10-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux:
  MAINTAINERS: Update IOMMU tree location
  iommu/amd: Fix GT feature enablement again
  iommu/vt-d: Fix missed device TLB cache tag
  iommu/amd: Invalidate cache before removing device from domain list
2024-06-28 09:18:01 -07:00
Linus Torvalds
1cf0668466 gpio fixes for v6.10-rc6
- fix a race condition in i2c transfers by adding a missing i2c lock
   section in gpio-pca953x
 - validate the number of obtained interrupts in gpio-davinci
 - add missing raw_spinlock_init() in gpio-graniterapids
 - fix bad character device behavior: disallow GPIO line reconfiguration
   without set direction both in v1 and v2 uAPI
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEFp3rbAvDxGAT0sefEacuoBRx13IFAmZ+hfEACgkQEacuoBRx
 13Kl9Q//TM5RjkPzeWeVCau5zvQSpEc7CvIbrfszjl/5o/RE6+j7tD/WAFCt3EUo
 qQQuPggNCzFPCcIiHh57GakhQi2v2VFzhIFrzy78eYpYOBaQ2w5C/ceodpx1xFbb
 w3ig005hJI2uM0CsdFNoC9FFMa8XgS3c3TbfYFtMk7smNgx1LFRD3s5x8GGC1lLX
 8P2ipLeLEE4CFJsJQ/dSeK9ssM9/+owmrF4bCcFtjZZ+iZPjDZCIKl6LB3H5sK5c
 x48PllI/EglXdTOFGZ2BqQ+svFUoNAuDna0+KQMns3CiHbQ8t0KZc6oItSOyDTX8
 h1uw1GbxXShxQldrsjASs1Y9erVIoVXbC3XW/rkSD2/WYU/1V3AtsqNNuhWgY1bL
 b+WUYyoK03uS9ocpHkm64g3nhStI24POhUsDiWhD1ZYBjqRyrbOZuEbt+Efmi7dL
 yF8qz86/QubsuvRbUDbUcvYtFsSwqNAYmV8tNgtubDara7dy4UCN3Z0kp8khANeF
 q5cgJMujePGkVKMOwH3mJPWV6y4MoFiayf/BrfZgP2BxU+1Wd8f4Evuq1RCLmbV3
 aq3uwUhwXbHmL0/PCeQ1pJ6uYUvz2saC5bFJKslTqgh5VgvqrXMIUertASBXZFEW
 cIXjdyIG4rCGRZTdENmXsitQvlKI3dSTI5+FGSqL4QEMXmlfOuY=
 =+2t8
 -----END PGP SIGNATURE-----

Merge tag 'gpio-fixes-for-v6.10-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux

Pull gpio fixes from Bartosz Golaszewski:
 "An assortment of driver fixes and two commits addressing a bad
  behavior of the GPIO uAPI when reconfiguring requested lines.

   - fix a race condition in i2c transfers by adding a missing i2c lock
     section in gpio-pca953x

   - validate the number of obtained interrupts in gpio-davinci

   - add missing raw_spinlock_init() in gpio-graniterapids

   - fix bad character device behavior: disallow GPIO line
     reconfiguration without set direction both in v1 and v2 uAPI"

* tag 'gpio-fixes-for-v6.10-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
  gpiolib: cdev: Ignore reconfiguration without direction
  gpiolib: cdev: Disallow reconfiguration without direction (uAPI v1)
  gpio: graniterapids: Add missing raw_spinlock_init()
  gpio: davinci: Validate the obtained number of IRQs
  gpio: pca953x: fix pca953x_irq_bus_sync_unlock race
2024-06-28 09:15:13 -07:00
Linus Torvalds
9038455948 arm64 fixes for -rc6
- Fix spurious page-table warning when clearing PTE_UFFD_WP in a live
   pte
 
 - Fix clearing of the idmap pgd when using large addressing modes
 -----BEGIN PGP SIGNATURE-----
 
 iQFEBAABCgAuFiEEPxTL6PPUbjXGY88ct6xw3ITBYzQFAmZ9gJgQHHdpbGxAa2Vy
 bmVsLm9yZwAKCRC3rHDchMFjNKEdB/9wDzyoyo+tMp2csPFk66ufbytbsSV2LWys
 kvUZdTYLAV4YlI6jTxXJ/3I3rXggc5SsXE/WosDQ1zfb1KsE/3sWaexIURHxeT73
 PUUqREUfvA7Ormv65A4zlKbVzfsPlM8VWT7mmSj3k6rV5TvNBkjm53x5t4QEPHxO
 VwHRd/JRm+8+JvhXUhPiECFWCalBvJKXxOsCK9Plj1uIOY+eFw3nYp59H2hE30be
 VDmdgBQ6u1mZvqgSv8P6jDV9r69qBxRbig5fo9C89E8ptS9u3piHvcBEtg6FAztA
 SYyrfxBbYvejM5cN4aEWc035kWW0o1K1MimQgZYpyYlqKNHywTw0
 =JzVF
 -----END PGP SIGNATURE-----

Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux

Pull arm64 fixes from Will Deacon:
 "A pair of small arm64 fixes for -rc6.

  One is a fix for the recently merged uffd-wp support (which was
  triggering a spurious warning) and the other is a fix to the clearing
  of the initial idmap pgd in some configurations

  Summary:

   - Fix spurious page-table warning when clearing PTE_UFFD_WP in a live
     pte

   - Fix clearing of the idmap pgd when using large addressing modes"

* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
  arm64: Clear the initial ID map correctly before remapping
  arm64: mm: Permit PTE SW bits to change in live mappings
2024-06-28 09:10:01 -07:00
Linus Torvalds
234458d049 Fix three recent minor turbostat regressions.
-----BEGIN PGP SIGNATURE-----
 
 iQJIBAABCgAyFiEE67dNfPFP+XUaA73mB9BFOha3NhcFAmZ+PUEUHGxlbi5icm93
 bkBpbnRlbC5jb20ACgkQB9BFOha3Nhcq4hAAiGPxoZMkTZLVbipLJFo8AZRvG0Wh
 BGhWJ76L4gfKtYIFnR1nBItPIvrD//5gXvRE48wI2dsylHjDyCPqktEpYivv5ESA
 SA7oqb47FroXXO4b5u0A5lG+Nzbt3SJK28z0t6GWy9NjQz6HHGT09UAP6X35/ZJH
 mc2lwLmDH60f2zdaKIJfAYfhUWdOk8VyctnZVeu8LFYnZf6lP9hD54gqhtd1eYB0
 1upAWeH4h8oYcr153zuRECAuz2kZMjjgy+mskHBMRLGcGTojtKwROBeVtXiSJo+N
 81ds2QsCAG5YtH3Er3eoLCyWTI+pNeraKuZbnVKfgnR943vh+J89CpCA56hSACGT
 9DBA6sjngYE6HKB+NxeAxrBHDC3kE0orsfArpaPsWyWeSYj9lxqjP1raH96w5uwS
 +t0KOgKlfOOxrUyUpfXqor4Z/J7JvpRF2ymvzsDWnhQVTnGIsBhmpyyW+FVn/QYm
 K38HkMK9eippA0t0wShsg2qF79vVMNhlPMwYhuA9kamTKh0jkOmtn8g9LNP3LBup
 qLjq5GT+r2dAO1FPZhk88I0OjhHTjAQkzbCeKM+C0++TVi+HQ9Npcv8hkfebb8rw
 ZP6owRfAho6cniYxJNQSsghUcus51zUs4jVQaKwetQxp3awgMUsuOHu5eUy8V7GL
 eqjfchtqgWHzxK0=
 =if6M
 -----END PGP SIGNATURE-----

Merge tag 'v6.10-rc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux

Pull turbostat fixes from Len Brown:
 "Fix three recent minor turbostat regressions"

* tag 'v6.10-rc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux:
  tools/power turbostat: Add local build_bug.h header for snapshot target
  tools/power turbostat: Fix unc freq columns not showing with '-q' or '-l'
  tools/power turbostat: option '-n' is ambiguous
2024-06-28 09:04:33 -07:00
Nathan Chancellor
1c07c9be87 tty: mxser: Remove __counted_by from mxser_board.ports[]
Work for __counted_by on generic pointers in structures (not just
flexible array members) has started landing in Clang 19 (current tip of
tree). During the development of this feature, a restriction was added
to __counted_by to prevent the flexible array member's element type from
including a flexible array member itself such as:

  struct foo {
    int count;
    char buf[];
  };

  struct bar {
    int count;
    struct foo data[] __counted_by(count);
  };

because the size of data cannot be calculated with the standard array
size formula:

  sizeof(struct foo) * count

This restriction was downgraded to a warning but due to CONFIG_WERROR,
it can still break the build. The application of __counted_by on the
ports member of 'struct mxser_board' triggers this restriction,
resulting in:

  drivers/tty/mxser.c:291:2: error: 'counted_by' should not be applied to an array with element of unknown size because 'struct mxser_port' is a struct type with a flexible array member. This will be an error in a future compiler version [-Werror,-Wbounds-safety-counted-by-elt-type-unknown-size]
    291 |         struct mxser_port ports[] __counted_by(nports);
        |         ^~~~~~~~~~~~~~~~~~~~~~~~~
  1 error generated.

Remove this use of __counted_by to fix the warning/error. However,
rather than remove it altogether, leave it commented, as it may be
possible to support this in future compiler releases.

Cc:  <stable@vger.kernel.org>
Closes: https://github.com/ClangBuiltLinux/linux/issues/2026
Fixes: f34907ecca ("mxser: Annotate struct mxser_board with __counted_by")
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Link: https://lore.kernel.org/r/20240529-drop-counted-by-ports-mxser-board-v1-1-0ab217f4da6d@kernel.org
Signed-off-by: Kees Cook <kees@kernel.org>
2024-06-28 08:54:56 -07:00
Kees Cook
6db1208bf9 randomize_kstack: Remove non-functional per-arch entropy filtering
An unintended consequence of commit 9c573cd313 ("randomize_kstack:
Improve entropy diffusion") was that the per-architecture entropy size
filtering reduced how many bits were being added to the mix, rather than
how many bits were being used during the offsetting. All architectures
fell back to the existing default of 0x3FF (10 bits), which will consume
at most 1KiB of stack space. It seems that this is working just fine,
so let's avoid the confusion and update everything to use the default.

The prior intent of the per-architecture limits were:

  arm64: capped at 0x1FF (9 bits), 5 bits effective
  powerpc: uncapped (10 bits), 6 or 7 bits effective
  riscv: uncapped (10 bits), 6 bits effective
  x86: capped at 0xFF (8 bits), 5 (x86_64) or 6 (ia32) bits effective
  s390: capped at 0xFF (8 bits), undocumented effective entropy

Current discussion has led to just dropping the original per-architecture
filters. The additional entropy appears to be safe for arm64, x86,
and s390. Quoting Arnd, "There is no point pretending that 15.75KB is
somehow safe to use while 15.00KB is not."

Co-developed-by: Yuntao Liu <liuyuntao12@huawei.com>
Signed-off-by: Yuntao Liu <liuyuntao12@huawei.com>
Fixes: 9c573cd313 ("randomize_kstack: Improve entropy diffusion")
Link: https://lore.kernel.org/r/20240617133721.377540-1-liuyuntao12@huawei.com
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Mark Rutland <mark.rutland@arm.com>
Acked-by: Heiko Carstens <hca@linux.ibm.com> # s390
Link: https://lore.kernel.org/r/20240619214711.work.953-kees@kernel.org
Signed-off-by: Kees Cook <kees@kernel.org>
2024-06-28 08:54:56 -07:00
Jeff Johnson
6a4805b2f5 string: kunit: add missing MODULE_DESCRIPTION() macros
make allmodconfig && make W=1 C=1 reports:
WARNING: modpost: missing MODULE_DESCRIPTION() in lib/string_kunit.o
WARNING: modpost: missing MODULE_DESCRIPTION() in lib/string_helpers_kunit.o

Add the missing invocation of the MODULE_DESCRIPTION() macro.

Signed-off-by: Jeff Johnson <quic_jjohnson@quicinc.com>
Link: https://lore.kernel.org/r/20240531-md-lib-string-v1-1-2738cf057d94@quicinc.com
Signed-off-by: Kees Cook <kees@kernel.org>
2024-06-28 08:54:55 -07:00
Niklas Cassel
1066fe8259 ata: libata-core: Add ATA_HORKAGE_NOLPM for all Crucial BX SSD1 models
We got another report that CT1000BX500SSD1 does not work with LPM.

If you look in libata-core.c, we have six different Crucial devices that
are marked with ATA_HORKAGE_NOLPM. This model would have been the seventh.
(This quirk is used on Crucial models starting with both CT* and
Crucial_CT*)

It is obvious that this vendor does not have a great history of supporting
LPM properly, therefore, add the ATA_HORKAGE_NOLPM quirk for all Crucial
BX SSD1 models.

Fixes: 7627a0edef ("ata: ahci: Drop low power policy board type")
Cc: stable@vger.kernel.org
Reported-by: Alessandro Maggio <alex.tkd.alex@gmail.com>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218832
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Link: https://lore.kernel.org/r/20240627105551.4159447-2-cassel@kernel.org
Signed-off-by: Niklas Cassel <cassel@kernel.org>
2024-06-28 16:33:50 +02:00
Mickaël Salaün
130e428067
selftests/harness: Fix tests timeout and race condition
We cannot use CLONE_VFORK because we also need to wait for the timeout
signal.

Restore tests timeout by using the original fork() call in __run_test()
but also in __TEST_F_IMPL().  Also fix a race condition when waiting for
the test child process.

Because test metadata are shared between test processes, only the
parent process must set the test PID (child).  Otherwise, t->pid may be
set to zero, leading to inconsistent error cases:

  #  RUN           layout1.rule_on_mountpoint ...
  # rule_on_mountpoint: Test ended in some other way [127]
  #            OK  layout1.rule_on_mountpoint
  ok 20 layout1.rule_on_mountpoint

As safeguards, initialize the "status" variable with a valid exit code,
and handle unknown test exits as errors.

The use of fork() introduces a new race condition in landlock/fs_test.c
which seems to be specific to hostfs bind mounts, but I haven't found
the root cause and it's difficult to trigger.  I'll try to fix it with
another patch.

Cc: Christian Brauner <brauner@kernel.org>
Cc: Günther Noack <gnoack@google.com>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Kees Cook <keescook@chromium.org>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Will Drewry <wad@chromium.org>
Cc: stable@vger.kernel.org
Closes: https://lore.kernel.org/r/9341d4db-5e21-418c-bf9e-9ae2da7877e1@sirena.org.uk
Fixes: a86f18903d ("selftests/harness: Fix interleaved scheduling leading to race conditions")
Fixes: 24cf65a622 ("selftests/harness: Share _metadata between forked processes")
Link: https://lore.kernel.org/r/20240621180605.834676-1-mic@digikod.net
Tested-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Mickaël Salaün <mic@digikod.net>
2024-06-28 16:06:03 +02:00
Joerg Roedel
09aaa2d064 MAINTAINERS: Update IOMMU tree location
Update the maintainers entries to the new location of the
IOMMU tree.

Signed-off-by: Joerg Roedel <jroedel@suse.de>
2024-06-28 14:31:50 +02:00
David S. Miller
dc6be0b73f Merge tag 'ieee802154-for-net-2024-06-27' of git://git.kernel.org/pub/scm/linux/kernel/git/wpan/wpan into main 2024-06-28 13:10:12 +01:00
Nicholas Piggin
21a741eb75 powerpc/pseries: Fix scv instruction crash with kexec
kexec on pseries disables AIL (reloc_on_exc), required for scv
instruction support, before other CPUs have been shut down. This means
they can execute scv instructions after AIL is disabled, which causes an
interrupt at an unexpected entry location that crashes the kernel.

Change the kexec sequence to disable AIL after other CPUs have been
brought down.

As a refresher, the real-mode scv interrupt vector is 0x17000, and the
fixed-location head code probably couldn't easily deal with implementing
such high addresses so it was just decided not to support that interrupt
at all.

Fixes: 7fa95f9ada ("powerpc/64s: system call support for scv/rfscv instructions")
Cc: stable@vger.kernel.org # v5.9+
Reported-by: Sourabh Jain <sourabhjain@linux.ibm.com>
Closes: https://lore.kernel.org/3b4b2943-49ad-4619-b195-bc416f1d1409@linux.ibm.com
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Tested-by: Gautam Menghani <gautam@linux.ibm.com>
Tested-by: Sourabh Jain <sourabhjain@linux.ibm.com>
Link: https://msgid.link/20240625134047.298759-1-npiggin@gmail.com
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2024-06-28 22:05:44 +10:00
David S. Miller
109e2f5b98 Merge branch 'mlx5-fixes' into main
Tariq Toukan says:

====================
mlx5 fixes 2024-06-27

This patchset provides fixes from the team to the mlx5 core and EN
drivers.

The first 3 patches by Daniel replace a buggy cap field with a newly
introduced one.

Patch 4 by Chris de-couples ingress ACL creation from a specific flow,
so it's invoked by other flows if needed.

Patch 5 by Jianbo fixes a possible missing cleanup of QoS objects.

Patches 6 and 7 by Leon fixes IPsec stats logic to better reflect the
traffic.

Series generated against:
commit 02ea312055 ("octeontx2-pf: Fix coverity and klockwork issues in octeon PF driver")

V2:
Fixed wrong cited SHA in patch 6.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2024-06-28 12:58:12 +01:00
Leon Romanovsky
e562f2d46d net/mlx5e: Approximate IPsec per-SA payload data bytes count
ConnectX devices lack ability to count payload data byte size which is
needed for SA to return to libreswan for rekeying.

As a solution let's approximate that by decreasing headers size from
total size counted by flow steering. The calculation doesn't take into
account any other headers which can be in the packet (e.g. IP extensions).

Fixes: 5a6cddb89b ("net/mlx5e: Update IPsec per SA packets/bytes count")
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2024-06-28 12:58:12 +01:00
Leon Romanovsky
2d9dac5559 net/mlx5e: Present succeeded IPsec SA bytes and packet
IPsec SA statistics presents successfully decrypted and encrypted
packet and bytes, and not total handled by this SA. So update the
calculation logic to take into account failures.

Fixes: 6fb7f94087 ("net/mlx5e: Connect mlx5 IPsec statistics with XFRM core")
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2024-06-28 12:58:11 +01:00
Jianbo Liu
1da839eab6 net/mlx5e: Add mqprio_rl cleanup and free in mlx5e_priv_cleanup()
In the cited commit, mqprio_rl cleanup and free are mistakenly removed
in mlx5e_priv_cleanup(), and it causes the leakage of host memory and
firmware SCHEDULING_ELEMENT objects while changing eswitch mode. So,
add them back.

Fixes: 0bb7228f70 ("net/mlx5e: Fix mqprio_rl handling on devlink reload")
Signed-off-by: Jianbo Liu <jianbol@nvidia.com>
Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2024-06-28 12:58:11 +01:00
Chris Mi
b20c2fb454 net/mlx5: E-switch, Create ingress ACL when needed
Currently, ingress acl is used for three features. It is created only
when vport metadata match and prio tag are enabled. But active-backup
lag mode also uses it. It is independent of vport metadata match and
prio tag. And vport metadata match can be disabled using the
following devlink command:

 # devlink dev param set pci/0000:08:00.0 name esw_port_metadata \
	value false cmode runtime

If ingress acl is not created, will hit panic when creating drop rule
for active-backup lag mode. If always create it, there will be about
5% performance degradation.

Fix it by creating ingress acl when needed. If esw_port_metadata is
true, ingress acl exists, then create drop rule using existing
ingress acl. If esw_port_metadata is false, create ingress acl and
then create drop rule.

Fixes: 1749c4c51c ("net/mlx5: E-switch, add drop rule support to ingress ACL")
Signed-off-by: Chris Mi <cmi@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2024-06-28 12:58:11 +01:00
Daniel Jurgens
5dbf647367 net/mlx5: Use max_num_eqs_24b when setting max_io_eqs
Due a bug in the device max_num_eqs doesn't always reflect a written
value. As a result, setting max_io_eqs may not work but appear
successful. Instead write max_num_eqs_24b, which reflects correct
value.

Fixes: 93197c7c50 ("mlx5/core: Support max_io_eqs for a function")
Signed-off-by: Daniel Jurgens <danielj@nvidia.com>
Reviewed-by: Parav Pandit <parav@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2024-06-28 12:58:11 +01:00
Daniel Jurgens
29c6a562bf net/mlx5: Use max_num_eqs_24b capability if set
A new capability with more bits is added. If it's set use that value as
the maximum number of EQs available.

This cap is also writable by the vhca_resource_manager to allow limiting
the number of EQs available to SFs and VFs.

Fixes: 93197c7c50 ("mlx5/core: Support max_io_eqs for a function")
Signed-off-by: Daniel Jurgens <danielj@nvidia.com>
Reviewed-by: Parav Pandit <parav@nvidia.com>
Reviewed-by: William Tu <witu@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2024-06-28 12:58:11 +01:00
Daniel Jurgens
048a403648 net/mlx5: IFC updates for changing max EQs
Expose new capability to support changing the number of EQs available
to other functions.

Fixes: 93197c7c50 ("mlx5/core: Support max_io_eqs for a function")
Signed-off-by: Daniel Jurgens <danielj@nvidia.com>
Reviewed-by: Parav Pandit <parav@nvidia.com>
Reviewed-by: William Tu <witu@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2024-06-28 12:58:10 +01:00
Neal Cardwell
a6458ab7fd UPSTREAM: tcp: fix DSACK undo in fast recovery to call tcp_try_to_open()
In some production workloads we noticed that connections could
sometimes close extremely prematurely with ETIMEDOUT after
transmitting only 1 TLP and RTO retransmission (when we would normally
expect roughly tcp_retries2 = TCP_RETR2 = 15 RTOs before a connection
closes with ETIMEDOUT).

From tracing we determined that these workloads can suffer from a
scenario where in fast recovery, after some retransmits, a DSACK undo
can happen at a point where the scoreboard is totally clear (we have
retrans_out == sacked_out == lost_out == 0). In such cases, calling
tcp_try_keep_open() means that we do not execute any code path that
clears tp->retrans_stamp to 0. That means that tp->retrans_stamp can
remain erroneously set to the start time of the undone fast recovery,
even after the fast recovery is undone. If minutes or hours elapse,
and then a TLP/RTO/RTO sequence occurs, then the start_ts value in
retransmits_timed_out() (which is from tp->retrans_stamp) will be
erroneously ancient (left over from the fast recovery undone via
DSACKs). Thus this ancient tp->retrans_stamp value can cause the
connection to die very prematurely with ETIMEDOUT via
tcp_write_err().

The fix: we change DSACK undo in fast recovery (TCP_CA_Recovery) to
call tcp_try_to_open() instead of tcp_try_keep_open(). This ensures
that if no retransmits are in flight at the time of DSACK undo in fast
recovery then we properly zero retrans_stamp. Note that calling
tcp_try_to_open() is more consistent with other loss recovery
behavior, since normal fast recovery (CA_Recovery) and RTO recovery
(CA_Loss) both normally end when tp->snd_una meets or exceeds
tp->high_seq and then in tcp_fastretrans_alert() the "default" switch
case executes tcp_try_to_open(). Also note that by inspection this
change to call tcp_try_to_open() implies at least one other nice bug
fix, where now an ECE-marked DSACK that causes an undo will properly
invoke tcp_enter_cwr() rather than ignoring the ECE mark.

Fixes: c7d9d6a185 ("tcp: undo on DSACK during recovery")
Signed-off-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2024-06-28 10:28:14 +01:00
Johannes Berg
816c6bec09 wifi: mac80211: fix BSS_CHANGED_UNSOL_BCAST_PROBE_RESP
Fix the definition of BSS_CHANGED_UNSOL_BCAST_PROBE_RESP so that
not all higher bits get set, 1<<31 is a signed variable, so when
we do

  u64 changed = BSS_CHANGED_UNSOL_BCAST_PROBE_RESP;

we get sign expansion, so the value is 0xffff'ffff'8000'0000 and
that's clearly not desired. Use BIT_ULL() to make it unsigned as
well as the right type for the change flags.

Fixes: 178e9d6adc ("wifi: mac80211: fix unsolicited broadcast probe config")
Reviewed-by: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20240627104257.06174d291db2.Iba0d642916eb78a61f8ab2cc5ca9280783d9c1db@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2024-06-28 10:26:32 +02:00
Thomas Zimmermann
3285d8f0a2 firmware: sysfb: Fix reference count of sysfb parent device
Retrieving the system framebuffer's parent device in sysfb_init()
increments the parent device's reference count. Hence release the
reference before leaving the init function.

Adding the sysfb platform device acquires and additional reference
for the parent. This keeps the parent device around while the system
framebuffer is in use.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Fixes: 9eac534db0 ("firmware/sysfb: Set firmware-framebuffer parent device")
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Javier Martinez Canillas <javierm@redhat.com>
Cc: Helge Deller <deller@gmx.de>
Cc: Jani Nikula <jani.nikula@intel.com>
Cc: Dan Carpenter <dan.carpenter@linaro.org>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Sui Jingfeng <suijingfeng@loongson.cn>
Cc: <stable@vger.kernel.org> # v6.9+
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20240625081818.15696-1-tzimmermann@suse.de
2024-06-28 08:50:33 +02:00
Patryk Wlazlyn
b15943c4b3 tools/power turbostat: Add local build_bug.h header for snapshot target
Fixes compilation errors for Makefile snapshot target described in:
commit 231ce08b66 ("tools/power turbostat: Add "snapshot:" Makefile target")

Signed-off-by: Patryk Wlazlyn <patryk.wlazlyn@linux.intel.com>
Signed-off-by: Len Brown <len.brown@intel.com>
2024-06-27 23:53:27 -04:00
Adam Hawley
c5120a3356 tools/power turbostat: Fix unc freq columns not showing with '-q' or '-l'
Commit 78464d7681 ("tools/power turbostat: Add columns for clustered
uncore frequency") introduced 'probe_intel_uncore_frequency_cluster()'
in a way which prevents printing uncore frequency columns if either of
the '-q' or '-l' options are used. Systems which do not have multiple
uncore frequencies per package are unaffected by this regression.

Fix the function so that uncore frequency columns are shown when either
the '-l' or '-q' option is used by checking if 'quiet' is true after
adding counters for the uncore frequency columns.

Fixes: 78464d7681 ("tools/power turbostat: Add columns for clustered uncore frequency")

Signed-off-by: Adam Hawley <adam.james.hawley@intel.com>
Signed-off-by: Len Brown <len.brown@intel.com>
2024-06-27 23:53:27 -04:00
David Arcari
ebb5b260af tools/power turbostat: option '-n' is ambiguous
In some cases specifying the '-n' command line argument will cause
turbostat to fail.  For instance 'turbostat -n 1' works fine; however,
'turbostat -n 1 -d' will fail.  This is the result of the first call
to getopt_long_only() where "MP" is specified as the optstring.  This can
be easily fixed by changing the optstring from "MP" to "MPn:" to remove
ambiguity between the arguments.

tools/power turbostat: option '-n' is ambiguous; possibilities: '-num_iterations' '-no-msr' '-no-perf'

Fixes: a0e86c90b8 ("tools/power turbostat: Add --no-perf option")

Signed-off-by: David Arcari <darcari@redhat.com>
Signed-off-by: Len Brown <len.brown@intel.com>
2024-06-27 23:53:27 -04:00
Linus Torvalds
5bbd9b2498 This push fixes a build failure in qat.
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEn51F/lCuNhUwmDeSxycdCkmxi6cFAmZ1aqQACgkQxycdCkmx
 i6eg4BAAtAbtNbBqBUlAHeVxii4Y3Mhf1JZhc7Gu0q83dNMifW61qSG9azEi4Bom
 0QQ4B+B8iMEKACAOLkCEvFI7ciKXCV4qPTII0+oLrjYssBzW6kqt9oRhpFcNoLC4
 ZK61gZl+Yz5xOkxRs9vgq+Hp3xfpG/HuvN3Fom/MAUCFHpDlTBuh0HmIjGE19naC
 kyP6xUyb0IfBQ3LYi0ouA/u8q9dAnZviiTJO5JYSoKLFi5SLFLMY+0vT1izaUFVO
 Q81U2rrsSzY7EMt7CIV2l8drBwUK/km3EgsBrGv8OKZj8L13QPCdrSdCnDuvuaz6
 CXkeO3jQIUXoQ6X3e1iKyBvhUC5HDwqxodKd6UMNjtgw2kHAgsd3axH5e+Uq15RT
 rNrHar83zGn+Kx2aMqn2wbxj3MRxzt1Vf23NZqkqYVg5cneWZmle1geLpJZ9vvdw
 zEJwnozDPjp99Rym5gzRACI/NNAaXYQlQTVCsxdiIifMGyXuOPRjxGtroRHUY9WD
 mVy2VMddTlVcSkRxl1lSpnaduieI58JpekqSWbMzJvCu+mKY4ZJlhKqhAx3xpRik
 WvF767zktxjlzxuMm0gIVZ4/q8Yg4irX7Xa176GwIKKzyh51EQAuWOSED7XJgjHh
 PNClQRr8cqtil4+dqU3YnXTHKK4T46q8sukCz1Ath7QoNmISPco=
 =fcdu
 -----END PGP SIGNATURE-----

Merge tag 'v6.10-p4' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6

Pyll crypto fix from Herbert Xu:
 "Fix a build failure in qat"

* tag 'v6.10-p4' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
  crypto: qat - fix linking errors when PCI_IOV is disabled
2024-06-27 17:43:15 -07:00
Linus Torvalds
1c52cf5e79 drm fixes for 6.10-rc6
core:
 - fix refcounting race on pid handover
 
 fbdev:
 - Fix fb_info when vmalloc is used, regression from
   CONFIG_DRM_FBDEV_LEAK_PHYS_SMEM.
 
 amdgpu:
 - SMU 14.x fix
 - vram info parsing fix
 - mode1 reset fix
 - LTTPR fix
 - Virtual display fix
 - Avoid spurious error in PSP init
 
 i915:
 - Fix potential UAF due to race on fence register revocation
 
 nouveau
 - nouveau tv mode fixes.
 
 panel:
 - Add KOE TX26D202VM0BWA timings.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmZ9+dUACgkQDHTzWXnE
 hr4wKQ/+Irl7gSP6pjQaxX8+vQEztbOAMcugQPilJwOE2VOShkA9BBJsdRGOYtcP
 5yCEXIC/iYQj3kIg0b4SbJDbn9BZBjJeGMChQpmb5YEKi5nxoOri30UvH8PWb3xP
 9MpO9xACQz5i9iA6FPmSDkRx76Dy5o8GF5GASsuZrXF/Hd5YFRFxw9NtYwomcZ2b
 ghn0v7MCIzeC2Z+snqjkh9TTSMzPGMQJdn8uZ5lHiqS3SGIh9cnrmysxqL+f4OVa
 xJX0pElE0pEA2O08trghasog4g/VnE5TOwYsNEqQVfX4fW69vas0ZL3S63IX/UUG
 05kSd75iy+rZsDQHWblaTsVtOuaBhyqDNt/KOgMDg0fWICN8Y7y37dF4fPn5zJjt
 RE+axCz1mlVZ7rwPv0I43cEt0dbKe82Qfgcc9aoiJ8imT+ElI/bRkjmjs662Ihfc
 hlIHdYTbLlUMb1MyM6c9gt8uprd643LcI9hOvJqoYQDUsbR0nZewu9/ElYSb2thl
 R2YH7Ytc8y6zAXC1TjO6TBifQbtELzrVJkqFtECreiDOI3DlH1M1x10iCxJT9y2L
 p7MD1VahIdnViLtXm9i6AwEGQAaPGbcJZhsC5QhQ/ev022uMAo8OVbu/3BknDjaO
 MFKV26POWmmy7RFRU2xNZkEX3YZjUpDiN+DGqLA1JzKBoTUaJSU=
 =0isZ
 -----END PGP SIGNATURE-----

Merge tag 'drm-fixes-2024-06-28' of https://gitlab.freedesktop.org/drm/kernel

Pull drm fixes from Dave Airlie:
 "Regular fixes, mostly amdgpu with some minor fixes in other places,
  along with a fix for a very narrow UAF race in the pid handover code.

  core:
   - fix refcounting race on pid handover

  fbdev:
   - Fix fb_info when vmalloc is used, regression from
     CONFIG_DRM_FBDEV_LEAK_PHYS_SMEM.

  amdgpu:
   - SMU 14.x fix
   - vram info parsing fix
   - mode1 reset fix
   - LTTPR fix
   - Virtual display fix
   - Avoid spurious error in PSP init

  i915:
   - Fix potential UAF due to race on fence register revocation

  nouveau
   - nouveau tv mode fixes

  panel:
   - Add KOE TX26D202VM0BWA timings"

* tag 'drm-fixes-2024-06-28' of https://gitlab.freedesktop.org/drm/kernel:
  drm/drm_file: Fix pid refcounting race
  drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes
  drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_hd_modes
  drm/amdgpu: Don't show false warning for reg list
  drm/amdgpu: avoid using null object of framebuffer
  drm/amd/display: Send DP_TOTAL_LTTPR_CNT during detection if LTTPR is present
  drm/amdgpu: Fix pci state save during mode-1 reset
  drm/amdgpu/atomfirmware: fix parsing of vram_info
  drm/amd/swsmu: add MALL init support workaround for smu_v14_0_1
  drm/i915/gt: Fix potential UAF by revoke of fence registers
  drm/panel: simple: Add missing display timing flags for KOE TX26D202VM0BWA
  drm/fbdev-dma: Only set smem_start is enable per module option
2024-06-27 17:24:34 -07:00
Marek Vasut
d3dcb084c7 net: phy: phy_device: Fix PHY LED blinking code comment
Fix copy-paste error in the code comment. The code refers to
LED blinking configuration, not brightness configuration. It
was likely copied from comment above this one which does
refer to brightness configuration.

Fixes: 4e90101843 ("net: phy: phy_device: Call into the PHY driver to set LED blinking")
Signed-off-by: Marek Vasut <marex@denx.de>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://patch.msgid.link/20240626030638.512069-1-marex@denx.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2024-06-27 16:33:26 -07:00
Jann Horn
4f2a129b33 drm/drm_file: Fix pid refcounting race
<maarten.lankhorst@linux.intel.com>, Maxime Ripard
<mripard@kernel.org>, Thomas Zimmermann <tzimmermann@suse.de>

filp->pid is supposed to be a refcounted pointer; however, before this
patch, drm_file_update_pid() only increments the refcount of a struct
pid after storing a pointer to it in filp->pid and dropping the
dev->filelist_mutex, making the following race possible:

process A               process B
=========               =========
                        begin drm_file_update_pid
                        mutex_lock(&dev->filelist_mutex)
                        rcu_replace_pointer(filp->pid, <pid B>, 1)
                        mutex_unlock(&dev->filelist_mutex)
begin drm_file_update_pid
mutex_lock(&dev->filelist_mutex)
rcu_replace_pointer(filp->pid, <pid A>, 1)
mutex_unlock(&dev->filelist_mutex)
get_pid(<pid A>)
synchronize_rcu()
put_pid(<pid B>)   *** pid B reaches refcount 0 and is freed here ***
                        get_pid(<pid B>)   *** UAF ***
                        synchronize_rcu()
                        put_pid(<pid A>)

As far as I know, this race can only occur with CONFIG_PREEMPT_RCU=y
because it requires RCU to detect a quiescent state in code that is not
explicitly calling into the scheduler.

This race leads to use-after-free of a "struct pid".
It is probably somewhat hard to hit because process A has to pass
through a synchronize_rcu() operation while process B is between
mutex_unlock() and get_pid().

Fix it by ensuring that by the time a pointer to the current task's pid
is stored in the file, an extra reference to the pid has been taken.

This fix also removes the condition for synchronize_rcu(); I think
that optimization is unnecessary complexity, since in that case we
would usually have bailed out on the lockless check above.

Fixes: 1c7a387ffe ("drm: Update file owner during use")
Cc: <stable@vger.kernel.org>
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2024-06-28 08:56:26 +10:00
Dave Airlie
3e6d5e1199 Merge tag 'drm-intel-fixes-2024-06-27' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes
drm/i915 fixes for v6.10-rc6:
- Fix potential UAF due to race on fence register revocation

Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Jani Nikula <jani.nikula@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/87ikxudcpd.fsf@intel.com
2024-06-28 07:27:16 +10:00
Linus Torvalds
ef8abe9668 Power management fix for 6.10-rc6
Modify the intel_pstate driver to use HWP to initialize the ITMT
 scheduler extension if ACPI CPPC cannot be used for that, which is
 the case on some hybrid x86 systems (Rafael Wysocki).
 -----BEGIN PGP SIGNATURE-----
 
 iQJGBAABCAAwFiEE4fcc61cGeeHD/fCwgsRv/nhiVHEFAmZ9uBgSHHJqd0Byand5
 c29ja2kubmV0AAoJEILEb/54YlRxsiMQALZXnIJLm5UiXLMc5n6+cHK1ukyworLb
 /gPARziPJdkv1MaG+IhuljSeglkMRhxO333jbtYxsVmPMx/+CqaiXCXhOQ/qZW79
 WhDfd7gRDqQykvlRKYNaijQRfFyGOulkDOGBnhkhjKY1smtDEPjafx/zjChgSTWH
 /qmnW6DJGBq7O9bjljjaEq3QcOX1RSAXojBqSN02co/lS2mV6rcven4tGcQDeML1
 ulZPUVDfqA6PTH92WECWDUOwmHmCwHukOwhwv+wu6bPhqdiVKTSCcpBdzY5Q8o5Z
 hMqrV+ncg2LiXweuHdN5jGKiDiD5NmZWTvu/xm5GI6vaTasw5WcEF/SxBhy/Tfoj
 FoQ11HnI1DsERn1PMvT0OfeF5OpK973dS+Lz/WKno0y8P4xKwchf6vxTLfd2wBgl
 Ik3Hau99GF+VuwaBEgNInzhdCvp/LrphhwnHJCinWDpIJqqZUSmbvjclUpQfgFKW
 QR89eToKu/rzkDPA6kcxuDt1f7UVesl35dlSiNu0Y3m2fGqsU1rk9q9gzp89QzZu
 D/PU4MbXO5wcvuAQC3YkovIVlJU4jJvCC2+mCQRofB+tSVgsw7kHAQynN1r8pu/1
 yY8NNONszHvGqLFgzFOm++pR5DmLM9G2brX0ERHiW3UyETOPTmxFrdcPyq926YY+
 3ZzlnCUSu2Uv
 =/Q0F
 -----END PGP SIGNATURE-----

Merge tag 'pm-6.10-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

Pull power management fix from Rafael Wysocki:
 "Modify the intel_pstate driver to use HWP to initialize the ITMT
  scheduler extension if ACPI CPPC cannot be used for that, which is the
  case on some hybrid x86 systems (Rafael Wysocki)"

* tag 'pm-6.10-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  cpufreq: intel_pstate: Use HWP to initialize ITMT if CPPC is missing
2024-06-27 12:35:30 -07:00
Linus Torvalds
92572d2c08 Thermal control fix for 6.10-rc6
Replace an earlier fix for a recent regression in the Step-Wise thermal
 governor that was not effective in all of the relevant cases (Rafael
 Wysocki).
 -----BEGIN PGP SIGNATURE-----
 
 iQJGBAABCAAwFiEE4fcc61cGeeHD/fCwgsRv/nhiVHEFAmZ9uGMSHHJqd0Byand5
 c29ja2kubmV0AAoJEILEb/54YlRxA1sP/2P0PACGXLzhlnKNvTaDL6DieqI310sH
 u/wkuVBWY84xcNnfRwn+xlh0vWLczDX5VDBh9LUtOYfl+jaJSt6mtRT53Nd2V7Ko
 2HqdsYkBjAPemXu5Vy2fwm24KtdgkZBldDDgk6vM3u4eqNw1YOMOT+Ayv+LdS9FP
 ZeEwHwciEb6r/I9+/Ll9V4tOOGl4JH5+Q9DT5PoWB0COtqbpHPaVogVf3QathMqY
 HZyS4DfJogz17rdTMN8e/9kigVGxaUFXyahFK0J25XnWzHxve2di6NGKqmnP246V
 u9iZIELkfD6x0KkijZUf1FueQFXjFq0zHyd1CrtZMIP5doLJlaRUy+fjsc1nLxdd
 5FC5HoDn5Dr51WhaE9JbUAyVxhaE5cW+npH7AkgCTYwY4/Zr3IZvRbuvXNEfCZ+1
 6dJKLSEKnXbZEC43IrTt5o0kvqSXSwZEp8wLiO1rphtvZULgJkLu87RB93VpkqiL
 LfXw9Y7MofYItsuIe/hCD8eqe2WAw7WaXJk+YnZptvF9+B5HoOGWWNjvLL7iXZ8w
 qAjEDemzvIpjMLCDsiSVtfOoMwh/GQghwpJ9QISnjIES8qUQI3oV2ZGgtGpfUaSU
 z35uDDsQ4tajUNzNsp9WbUXzDJp+32iZOfHmH4c6ozbEu/3VNd8/plU2NqMTAGEC
 AgAoTJbnSega
 =FcvI
 -----END PGP SIGNATURE-----

Merge tag 'thermal-6.10-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

Pull thermal control fix from Rafael Wysocki:
 "Replace an earlier fix for a recent regression in the Step-Wise
  thermal governor that was not effective in all of the relevant cases
  (Rafael Wysocki)"

* tag 'thermal-6.10-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  thermal: gov_step_wise: Go straight to instance->lower when mitigation is over
2024-06-27 12:32:56 -07:00
Linus Torvalds
0f47788b33 io_uring-6.10-20240627
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmZ9pr0QHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgprYAEACpxC5G9SjARxEvDOFlqu+SjvLWfjBHDOWv
 cWCzjn/wBu2A/vjJ8nMlLTyNk3XMogv58hs3iOJrtY+hZnRcFbUd21fEeh98j9Dj
 PICdwF3NtMy+f1klvTBaxcDAO1IWuVNp1fn4eNwrnxdaFvAaOVeMlv64G160U74k
 HpAJ8zfmEjgfX9Wyy/ezSa9cptUPcj77U0GAkrlCFVaCTYge6Wly+gD6n1FMArGx
 lEMeUfcv9da86Th5mlBM2G4Lzk7tie3RMvHanZ+kQILl3nLyNpVBdyQvvlGPKG0G
 9g/u5/gUpdKkKOlhivcy7ydx/QW8qVELr/mKpaAtic1uJxuYnx26JyW0rVrFzSKf
 rasMNg37VMZd5wAlXcyxwrODtO5jH+xcJvHfhiK3Aw8YgAfcYePJ3EMBDN4hA/0W
 rseVKQgQr3zFqDROu0HPkC+/1WO5EDJ5ESxSVhNA1CK5gaWTY7aTfC1rijF4NwVf
 5U92kZWG/uXKR/il2D3WTBo4Q3LPyGQahuu97FxvDeb8BWfdSxS+krs34SCc8IZx
 8Qoq1nDoff2GcC5c4EcbB0o7Jfj/U92qKBvwrit/54ZBvFcko3FB7z95W2d8cK2V
 Kg995JkYL8SkHTV/3Gx3m4zk+BPvzi8njijwCFLy5sk30z3lGG02TV3dQ/+9GXOK
 rLWFzYN1eA==
 =ZQ+K
 -----END PGP SIGNATURE-----

Merge tag 'io_uring-6.10-20240627' of git://git.kernel.dk/linux

Pull io_uring fixes from Jens Axboe:
 "Removal of a struct member that's unused since the 6.10 merge window,
  and a fix for a regression in SQPOLL wakeups, bringing it back to how
  it worked before the SQPOLL local task_work"

* tag 'io_uring-6.10-20240627' of git://git.kernel.dk/linux:
  io_uring: signal SQPOLL task_work with TWA_SIGNAL_NO_IPI
  io_uring: remove dead struct io_submit_state member
2024-06-27 12:23:52 -07:00
Jakub Kicinski
ffb7aa9fed Just a few changes:
- maintainers: Larry Finger sadly passed away
  - maintainers: ath trees are in their group now
  - TXQ FQ quantum configuration fix
  - TI wl driver: work around stuck FW in AP mode
  - mac80211: disable softirqs in some new code
    needing that
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEpeA8sTs3M8SN2hR410qiO8sPaAAFAmZ9Iz4ACgkQ10qiO8sP
 aADG+hAAl4kOGUfU2URi7zd4iod0NCXo9Hqrn7tGkkj1szcO2GvRc69Mja4AKo3L
 eeUJe/YuGGAGS7myH6+ZF6yymMdLyq8qrcPKN7YeZATcaO/n6K90Go3Wsaz7jXWC
 xZcnbGV3qvYrAmraA6fxOJ42Z7bt3+h+VVqUU7h/a1iWvuKB+u5f0zn78LLNwwYq
 HOw/kbe8oAadUOb1Sj7QHdG0ZBvXNwr3q0oTFMW06Z/TxAITovsHQtQcjmi9uJQV
 ILXitLCo/Xe+skSnAeyC4wNSJYFGWO5TurgW1d7y9ZR5/xQtM95VIciQSLWoD/tR
 cbQLbNjML17yxvU7G6U7WYxgMFghhUA476GFIsis3s3/KxvQ5nIzQc403yltVpl3
 I4E6mF63M37jvY+O3UyDWhWeYbR1/BBh6MQ2fKz57UZqvgLkzVohRwsK4G0jhF+S
 HmBALZmVOZFJGYDn/mxZIYwdG1iZoKSE/KMNrjNE/mX7IuE8ax5vvFqJ5yqYF6tq
 IpBoh/NOh9sa0Jq8gfb6VikM424hZ9tkzf5/+C7mhyW3Dl/pzcEojAjeoG5jMnrN
 6r+nwypEt2byOE2GrIAKTcH4XhjQSXeedbC7vZ31Cm2ynT1K1H+cysMKl2wa18xz
 luweG0L4m9FQDBkT8UUPMlcZKNszye1cp+2F4tbZOKRKbMillXU=
 =TLwj
 -----END PGP SIGNATURE-----

Merge tag 'wireless-2024-06-27' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless

Johannes Berg says:

====================
Just a few changes:
 - maintainers: Larry Finger sadly passed away
 - maintainers: ath trees are in their group now
 - TXQ FQ quantum configuration fix
 - TI wl driver: work around stuck FW in AP mode
 - mac80211: disable softirqs in some new code
   needing that

* tag 'wireless-2024-06-27' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless:
  MAINTAINERS: wifi: update ath.git location
  MAINTAINERS: Remembering Larry Finger
  wifi: mac80211: disable softirqs for queued frame handling
  wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values
  wifi: wlcore: fix wlcore AP mode
====================

Link: https://patch.msgid.link/20240627083627.15312-3-johannes@sipsolutions.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2024-06-27 11:57:40 -07:00
Jens Axboe
cab598bcef nvme fixes for Linux 6.10
- Fabrics fixes (Hannes)
  - Missing module description (Jeff)
  - Clang warning fix (Nathan)
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEE3Fbyvv+648XNRdHTPe3zGtjzRgkFAmZ9qRAACgkQPe3zGtjz
 Rgnm2hAA391pE4keP85MN2GI+fdgNrngjDGc1Kit/wpjOtj+AWcl0OenMcCWbwRE
 1gcS5k+9M/j+BASpQaOFLzHsSxOPuyfj/J9O1/eqUzWdZe1NJY9f9zkwYgmgvCca
 S3MX/rIMVCM61KzPCCv2Wcohs8dawGFCkrcXWhDmGZKUtU6TxIFzR1dIOyUsY4/H
 r42bDLD9MfbKF53rpuaftC+HCDUNB60QwbQf1m+NGo1pdbhZDVNaEPmAXX4LBypL
 GmABRTekbmQqsD2Un3lOmw6n4y3y5OcgZ96QB1MZq5/VLKUo5RdNRQsqNqzEZOQa
 8koTLnvI0Lz6g8fpLELjbs91DlZ1YbE827nugZ5YDzYWAVlqdnZSqU9lZdeJs1An
 YG+FrL/bQBGYEaQ3WWv8JagQpWtviLHbe9v3aHnM8wgaOCPsSTzVBBoERkZbUW/+
 yzWVMzft86MlReFLz5AtBTiJST+BwallqG9ss6nBWHr9MzhgqjmXde1+/dQhEhik
 grtMFwbW9opLfRNBGoO/GmXxv3FpYv//YgY7yLd33mwP8DtW6/TdCp2bT81+WUeM
 rfaAcSOxSw3iUC6RhKGF8wLWBZI6kyXlFtEXgjbJi8weRuQqTQOJNHj8uTiJQkfD
 JcrHmb/rNZMKLKM7ySDAG+BL5U8zpFgCGhR5VIp1rML0Y7YwPIA=
 =oWqS
 -----END PGP SIGNATURE-----

Merge tag 'nvme-6.10-2024-06-27' of git://git.infradead.org/nvme into block-6.10

Pull NVMe fixes from Keith:

"nvme fixes for Linux 6.10

 - Fabrics fixes (Hannes)
 - Missing module description (Jeff)
 - Clang warning fix (Nathan)"

* tag 'nvme-6.10-2024-06-27' of git://git.infradead.org/nvme:
  nvmet-fc: Remove __counted_by from nvmet_fc_tgt_queue.fod[]
  nvmet: make 'tsas' attribute idempotent for RDMA
  nvme: fixup comment for nvme RDMA Provider Type
  nvme-apple: add missing MODULE_DESCRIPTION()
  nvmet: do not return 'reserved' for empty TSAS values
  nvme: fix NVME_NS_DEAC may incorrectly identifying the disk as EXT_LBA.
2024-06-27 12:15:16 -06:00
Linus Torvalds
6d6444ba82 s390 updates for 6.10-rc6
- Add missing virt_to_phys() conversion for directed interrupt
   bit vectors
 
 - Fix broken configuration change notifications for virtio-ccw
 
 - Fix sclp_init() cleanup path on failure and as result - fix
   a list double add warning
 
 - Fix unconditional adjusting of GOT entries containing undefined
   weak symbols that resolve to zero
 -----BEGIN PGP SIGNATURE-----
 
 iI0EABYIADUWIQQrtrZiYVkVzKQcYivNdxKlNrRb8AUCZn2IjRccYWdvcmRlZXZA
 bGludXguaWJtLmNvbQAKCRDNdxKlNrRb8L9aAP9i2mtON605nVDo15gEt3QKFuAp
 CMgWgo+cECfEaSs9HwD8D7HSSEiV0RTRCNiU+dULc+Uvx/XwoQBhrhsavYF8Ggc=
 =F2KW
 -----END PGP SIGNATURE-----

Merge tag 's390-6.10-7' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux

Pull s390 updates from Alexander Gordeev:

 - Add missing virt_to_phys() conversion for directed interrupt bit
   vectors

 - Fix broken configuration change notifications for virtio-ccw

 - Fix sclp_init() cleanup path on failure and as result - fix a list
   double add warning

 - Fix unconditional adjusting of GOT entries containing undefined weak
   symbols that resolve to zero

* tag 's390-6.10-7' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
  s390/boot: Do not adjust GOT entries for undef weak sym
  s390/sclp: Fix sclp_init() cleanup on failure
  s390/virtio_ccw: Fix config change notifications
  s390/pci: Add missing virt_to_phys() for directed DIBV
2024-06-27 11:09:03 -07:00
Linus Torvalds
adfbe3640b asm-generic fixes for 6.10
These are some bugfixes for system call ABI issues I found while
 working on a cleanup series. None of these are urgent since these
 bugs have gone unnoticed for many years, but I think we probably
 want to backport them all to stable kernels, so it makes sense
 to have the fixes included as early as possible.
 
 One more fix addresses a compile-time warning in kallsyms that was
 uncovered by a patch I did to enable additional warnings in 6.10. I had
 mistakenly thought that this fix was already merged through the module
 tree, but as Geert pointed out it was still missing.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEiK/NIGsWEZVxh/FrYKtH/8kJUicFAmZ9iRQACgkQYKtH/8kJ
 UicHIxAA0ej8dMJ3znHovc/CQYkZMpb88bxLlqLotOYuOItEzvR6wd7vnu4cPeZf
 nHguBiP9RAnzCZhL3F7AS3p8NNJ+P1OZo+sj6tZOANO955mzj1VQ5p2fbSRw+WI3
 4Oc1HKvP6UMhHGjU3wHY0+Odd5bpoepN9/fnoiQcHPzq0LbUFM8e4D9KGr51I7fV
 r7tuDMy9xykEfs6umuDu9wOXih3JkpV9eSmefmjvzgxG3hKLdsvTbWVsVmnKXhZm
 xdFiTROOmiNvttfkQh0ruBd0drBl8aVhzCKPqIe0vQqS9rBmcf9WTkcJzpihq/fI
 BA3QjVQFvmHeXs+viaLZf4r/y0qabaTPRBMQxZyEFE0QgtwfxT4/ZnNEbH2s3pIC
 Pcm0JltLlHLbZs7V63drL6txCoFVndiPXdEBTBsqBwnuDHXCj/tvDcO3tuVTfYoz
 9G8TTOsYNEDLYmn8AmzzhJOh75gp6O6A2ui3TtcD9KFNaoTQqqzPJWp8IoxBfxcb
 3+rzRWQvXAhfSRBIaejv1quo2ZxoZk3KO3i+ysRITTUF1MLz7b0/Yy/8r74CqmOu
 8Iw2Q0BaFPtj1x+VjneQnL++iYWYPEh+ZBEg7AD/z6QHwMLz33SyHlD+/RgRkthV
 J/L9xUBs5HagWJxRYkVc+l0LOVclTqVJieKD2AWONZ5OFRB+CCI=
 =ieQy
 -----END PGP SIGNATURE-----

Merge tag 'asm-generic-fixes-6.10' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic

Pull asm-generic fixes from Arnd Bergmann:
 "These are some bugfixes for system call ABI issues I found while
  working on a cleanup series. None of these are urgent since these bugs
  have gone unnoticed for many years, but I think we probably want to
  backport them all to stable kernels, so it makes sense to have the
  fixes included as early as possible.

  One more fix addresses a compile-time warning in kallsyms that was
  uncovered by a patch I did to enable additional warnings in 6.10. I
  had mistakenly thought that this fix was already merged through the
  module tree, but as Geert pointed out it was still missing"

* tag 'asm-generic-fixes-6.10' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic:
  kallsyms: rework symbol lookup return codes
  linux/syscalls.h: add missing __user annotations
  syscalls: mmap(): use unsigned offset type consistently
  s390: remove native mmap2() syscall
  hexagon: fix fadvise64_64 calling conventions
  csky, hexagon: fix broken sys_sync_file_range
  sh: rework sync_file_range ABI
  powerpc: restore some missing spu syscalls
  parisc: use generic sys_fanotify_mark implementation
  parisc: use correct compat recv/recvfrom syscalls
  sparc: fix compat recv/recvfrom syscalls
  sparc: fix old compat_sys_select()
  syscalls: fix compat_sys_io_pgetevents_time64 usage
  ftruncate: pass a signed offset
2024-06-27 10:53:52 -07:00
Linus Torvalds
66e55ff12e for-6.10-rc5-tag
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE8rQSAMVO+zA4DBdWxWXV+ddtWDsFAmZ9gV0ACgkQxWXV+ddt
 WDsK2hAAmbOArbK5QHprawdOqqvJL46yoGCMba798EjYo53+hO1F8/lb531+zCUI
 GDhdIC2mHdRIkARJ8Cde5POUjID1Kv3Rlc0rdHy3nOw38WZmA/+HdkcKzQhsDFSR
 /FX9RKSWiu0xl6JdCLh4KkIWE+2m1v1kybhvRHCKb+70iBua1e+OSoM33BeiIhrP
 yoFwMwIbzG2CoZOHoobDxUjs9ZMUHm4wH0csJYG9R59Vv7uLBOgpWuQB46iqpoj4
 EYR8Sg8PscI7YXa0y8VTP3pdrNMW48IC6jerIAKHUeWRWRoTCh9He+3/E4xjNHxz
 3Pm+Aat5QYdsqmE68IbeN5c7QB1YAdUCgoJJJwAFjwe9WtTn8RS9RiMjWIr+VHYm
 E3REibQI151p0yHwAl8xPHDiTecmlNisof0eg6gzHdvODm/NYFuFapD+aDxWribX
 G63dOa8Fy0h4pwDoF73Rd2YYbtO6tDVSNVIG3bWpPep3r+SI/oC4JMHbmn1aqmqF
 c0/ZYVbsx/Hm066l4LCrpgi7kJ8en2zQ8MmcZHHt+2gXe1AyAON7kvRHaEizUCaA
 fnLVhQvaOofC4g7DJc1JkwyLc9VF5hMTYUhldoJvqj1wm2qsT/siJgKVvllRGoMs
 FU2qlWYaN/fPRylyEySyZPq/sWKHOAZZSOhyWM8SB2nYoBXNkO0=
 =qpEp
 -----END PGP SIGNATURE-----

Merge tag 'for-6.10-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux

Pull btrfs fixes from David Sterba:

 - fix quota root leak after quota disable failure

 - fix condition when checking if a zone can be added as free

 - allocate inode in NOFS context during logging or tree-log replay

 - handle raid-stripe-tree lookup correctly during scrub

* tag 'for-6.10-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
  btrfs: qgroup: fix quota root leak after quota disable failure
  btrfs: scrub: handle RST lookup error correctly
  btrfs: zoned: fix initial free space detection
  btrfs: use NOFS context when getting inodes during logging and log replay
2024-06-27 10:26:16 -07:00
Linus Torvalds
fd19d4a492 Including fixes from can, bpf and netfilter.
Current release - regressions:
 
   - core: add softirq safety to netdev_rename_lock
 
   - tcp: fix tcp_rcv_fastopen_synack() to enter TCP_CA_Loss for failed TFO
 
   - batman-adv: fix RCU race at module unload time
 
 Current release - new code bugs:
 
 Previous releases - regressions:
 
   - openvswitch: get related ct labels from its master if it is not confirmed
 
   - eth: bonding: fix incorrect software timestamping report
 
   - eth: mlxsw: fix memory corruptions on spectrum-4 systems
 
   - eth: ionic: use dev_consume_skb_any outside of napi
 
 Previous releases - always broken:
 
   - netfilter: fully validate NFT_DATA_VALUE on store to data registers
 
   - unix: several fixes for OoB data
 
   - tcp: fix race for duplicate reqsk on identical SYN
 
   - bpf:
     - fix may_goto with negative offset.
     - fix the corner case with may_goto and jump to the 1st insn.
     - fix overrunning reservations in ringbuf
 
   - can:
     - j1939: recover socket queue on CAN bus error during BAM transmission
     - mcp251xfd: fix infinite loop when xmit fails
 
   - dsa: microchip: monitor potential faults in half-duplex mode
 
   - eth: vxlan: pull inner IP header in vxlan_xmit_one()
 
   - eth: ionic: fix kernel panic due to multi-buffer handling
 
 Misc:
 
   - selftest: unix tests refactor and a lot of new cases added
 
 Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 -----BEGIN PGP SIGNATURE-----
 
 iQJGBAABCAAwFiEEg1AjqC77wbdLX2LbKSR5jcyPE6QFAmZ9ZlQSHHBhYmVuaUBy
 ZWRoYXQuY29tAAoJECkkeY3MjxOkawoQAKLTWHswqM790uaAAgqP6jGuC4/waRS8
 MowEt5rHlwdMXcHhLrDSrLQoDJAZRsWmjniIgbsaeX+HtY4HXfF0tfDMPKiws3vx
 Z51qVj7zYjdT7IoZ7Yc8Zlwmt2kVgO4ba6gSigQSORQO9Qq/WNSb0q8BM6cDaYXT
 cXC7ikPeMlLnxKxsFRpZ3CUD06dI/aJFp/pefPEm7/X/EbROlSs5y+2GshPdp5t7
 tzOUsLHs6ORVq/6jg2nRHH+0D+LMuQG0Z0yCMmYerJMJNtRIxyW6tTYeAsWXeyn3
 UN3gaoQ/SIURDrNRZvHsaVDNO/u4rbYtFLoK7S5uPffPWqsGJY59FcH+xYFukFCD
 P5Lca4kKBr8xOahsRfSiO0uFbwQfQAauzNiz9Ue39n1hj+ZhZ/CliBLhUeoBl6Y6
 jSsxq+/8CZCQ7beek96cyLx83skAcWAU5BEC9xOVlOTuTL91Gxr9UzSx/FqLI34h
 Smgw9ZUPzJgvFLgB/OBQ/WYne9LfJ5RYQHZoAXObiozO3TX7NgBUfa0e1T9dLE3F
 TalysSO3/goiZNK5a/UNJcj3fAcSEs4M2z9UIK790i3P3GuRigs1sJEtTUqyowWk
 aaTFmWCXE0wdoshJjux3syh3Vk6phJWpOlMLYjy0v5s0BF/ZOfDaKQT/dGsvV1HE
 AFGpKpybizNV
 =BYgZ
 -----END PGP SIGNATURE-----

Merge tag 'net-6.10-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull networking fixes from Paolo Abeni:
 "Including fixes from can, bpf and netfilter.

  There are a bunch of regressions addressed here, but hopefully nothing
  spectacular. We are still waiting the driver fix from Intel, mentioned
  by Jakub in the previous networking pull.

  Current release - regressions:

   - core: add softirq safety to netdev_rename_lock

   - tcp: fix tcp_rcv_fastopen_synack() to enter TCP_CA_Loss for failed
     TFO

   - batman-adv: fix RCU race at module unload time

  Previous releases - regressions:

   - openvswitch: get related ct labels from its master if it is not
     confirmed

   - eth: bonding: fix incorrect software timestamping report

   - eth: mlxsw: fix memory corruptions on spectrum-4 systems

   - eth: ionic: use dev_consume_skb_any outside of napi

  Previous releases - always broken:

   - netfilter: fully validate NFT_DATA_VALUE on store to data registers

   - unix: several fixes for OoB data

   - tcp: fix race for duplicate reqsk on identical SYN

   - bpf:
       - fix may_goto with negative offset
       - fix the corner case with may_goto and jump to the 1st insn
       - fix overrunning reservations in ringbuf

   - can:
       - j1939: recover socket queue on CAN bus error during BAM
         transmission
       - mcp251xfd: fix infinite loop when xmit fails

   - dsa: microchip: monitor potential faults in half-duplex mode

   - eth: vxlan: pull inner IP header in vxlan_xmit_one()

   - eth: ionic: fix kernel panic due to multi-buffer handling

  Misc:

   - selftest: unix tests refactor and a lot of new cases added"

* tag 'net-6.10-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (61 commits)
  net: mana: Fix possible double free in error handling path
  selftest: af_unix: Check SIOCATMARK after every send()/recv() in msg_oob.c.
  af_unix: Fix wrong ioctl(SIOCATMARK) when consumed OOB skb is at the head.
  selftest: af_unix: Check EPOLLPRI after every send()/recv() in msg_oob.c
  selftest: af_unix: Check SIGURG after every send() in msg_oob.c
  selftest: af_unix: Add SO_OOBINLINE test cases in msg_oob.c
  af_unix: Don't stop recv() at consumed ex-OOB skb.
  selftest: af_unix: Add non-TCP-compliant test cases in msg_oob.c.
  af_unix: Don't stop recv(MSG_DONTWAIT) if consumed OOB skb is at the head.
  af_unix: Stop recv(MSG_PEEK) at consumed OOB skb.
  selftest: af_unix: Add msg_oob.c.
  selftest: af_unix: Remove test_unix_oob.c.
  tracing/net_sched: NULL pointer dereference in perf_trace_qdisc_reset()
  netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers
  net: usb: qmi_wwan: add Telit FN912 compositions
  tcp: fix tcp_rcv_fastopen_synack() to enter TCP_CA_Loss for failed TFO
  ionic: use dev_consume_skb_any outside of napi
  net: dsa: microchip: fix wrong register write when masking interrupt
  Fix race for duplicate reqsk on identical SYN
  ibmvnic: Add tx check to prevent skb leak
  ...
2024-06-27 10:05:35 -07:00
Linus Torvalds
3c1d29e53d sound fixes for 6.10-rc6
This became bigger than usual, as it receives a pile of pending
 ASoC fixes.  Most of changes are for device-specific issues while
 there are a few core fixes that are all rather trivial.
 
 - DMA-engine sync fixes
 - Continued MIDI2 conversion fixes
 - Various ASoC Intel SOF fixes
 - A series of ASoC topology fixes for memory handling
 - AMD ACP fix, curing a recent regression, too
 - Platform / codec-specific fixes for mediatek, atmel, realtek, etc
 -----BEGIN PGP SIGNATURE-----
 
 iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAmZ9GsAOHHRpd2FpQHN1
 c2UuZGUACgkQLtJE4w1nLE+cwRAArq5kCXG5J2t8BjD46aI8t62VaDwjQe3E75+X
 zvZCOWP9APHb1wkvJNxPLCwoHnkSiFCBqtsz9SndemTryTz8N5GpLPpPQM7/Zaim
 PLGca0NYkwwEh/rNewUBmLq9oD1K++tTI6bPB5sQ0bqM97lXSudqUnDcPdaoRku/
 +oV5Z+9AOyhhSEpcBQFl8hwYyvwOacAnMynW0Bpt7wHJqvl05+dftvdBaRw6QnkZ
 8XuPJgRWJcNHUHJ3+7NcV97W916CisXzmjfqpzQhAl4IJvJQ7GF+ajI0cy9DH9V+
 osJkCdE5i9evPlwpI5bkYHHrvzbkrsoL2U+/WW0LqZVarSvi3AQDJ2PSYeBSY6pF
 v543xTwjxvdYhy2kzMZ7JHu9PEtgze3j74i85qaDqU//wRk/n5k7jQvjxbAnvgN2
 4IbN1EUSWMn3hfmYVw45q7LGj+IU9y64vCGqkjGYdqUfQeT+XUsizRHin+kJFMb/
 M5Ucn7fCXnTcHo1Hty8u6qicNMwU8i/JVmpjIPoiOvStw4ffu5nj+qxUEeFiT3jd
 y27fCOsUNVfAhAuZ493Ob/4A+xweL7rYt5J4F04lPgUKz/nySghi+CUm9I7CLeSw
 r7f5lcw0Ste6GLdbqE1zSK9yMz3neT5olNCqcFVsWEnOMDtsgaAzONZH5CiGqEHw
 S7LFyXI=
 =E+m/
 -----END PGP SIGNATURE-----

Merge tag 'sound-6.10-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound fixes from Takashi Iwai:
 "This became bigger than usual, as it receives a pile of pending ASoC
  fixes. Most of changes are for device-specific issues while there are
  a few core fixes that are all rather trivial:

   - DMA-engine sync fixes

   - Continued MIDI2 conversion fixes

   - Various ASoC Intel SOF fixes

   - A series of ASoC topology fixes for memory handling

   - AMD ACP fix, curing a recent regression, too

   - Platform / codec-specific fixes for mediatek, atmel, realtek, etc"

* tag 'sound-6.10-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (40 commits)
  ASoC: rt5645: fix issue of random interrupt from push-button
  ALSA: seq: Fix missing MSB in MIDI2 SPP conversion
  ASoC: amd: yc: Fix non-functional mic on ASUS M5602RA
  ALSA: hda/realtek: fix mute/micmute LEDs don't work for EliteBook 645/665 G11.
  ALSA: hda/realtek: Fix conflicting quirk for PCI SSID 17aa:3820
  ALSA: dmaengine_pcm: terminate dmaengine before synchronize
  ALSA: hda/relatek: Enable Mute LED on HP Laptop 15-gw0xxx
  ALSA: PCM: Allow resume only for suspended streams
  ALSA: seq: Fix missing channel at encoding RPN/NRPN MIDI2 messages
  ASoC: mediatek: mt8195: Add platform entry for ETDM1_OUT_BE dai link
  ASoC: fsl-asoc-card: set priv->pdev before using it
  ASoC: amd: acp: move chip->flag variable assignment
  ASoC: amd: acp: remove i2s configuration check in acp_i2s_probe()
  ASoC: amd: acp: add a null check for chip_pdev structure
  ASoC: Intel: soc-acpi: mtl: fix speaker no sound on Dell SKU 0C64
  ASoC: q6apm-lpass-dai: close graph on prepare errors
  ASoC: cs35l56: Disconnect ASP1 TX sources when ASP1 DAI is hooked up
  ASoC: topology: Fix route memory corruption
  ASoC: rt722-sdca-sdw: add debounce time for type detection
  ASoC: SOF: sof-audio: Skip unprepare for in-use widgets on error rollback
  ...
2024-06-27 09:34:09 -07:00
Arnd Bergmann
7e1f4eb9a6 kallsyms: rework symbol lookup return codes
Building with W=1 in some configurations produces a false positive
warning for kallsyms:

kernel/kallsyms.c: In function '__sprint_symbol.isra':
kernel/kallsyms.c:503:17: error: 'strcpy' source argument is the same as destination [-Werror=restrict]
  503 |                 strcpy(buffer, name);
      |                 ^~~~~~~~~~~~~~~~~~~~

This originally showed up while building with -O3, but later started
happening in other configurations as well, depending on inlining
decisions. The underlying issue is that the local 'name' variable is
always initialized to the be the same as 'buffer' in the called functions
that fill the buffer, which gcc notices while inlining, though it could
see that the address check always skips the copy.

The calling conventions here are rather unusual, as all of the internal
lookup functions (bpf_address_lookup, ftrace_mod_address_lookup,
ftrace_func_address_lookup, module_address_lookup and
kallsyms_lookup_buildid) already use the provided buffer and either return
the address of that buffer to indicate success, or NULL for failure,
but the callers are written to also expect an arbitrary other buffer
to be returned.

Rework the calling conventions to return the length of the filled buffer
instead of its address, which is simpler and easier to follow as well
as avoiding the warning. Leave only the kallsyms_lookup() calling conventions
unchanged, since that is called from 16 different functions and
adapting this would be a much bigger change.

Link: https://lore.kernel.org/lkml/20200107214042.855757-1-arnd@arndb.de/
Link: https://lore.kernel.org/lkml/20240326130647.7bfb1d92@gandalf.local.home/
Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Luis Chamberlain <mcgrof@kernel.org>
Acked-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2024-06-27 17:43:40 +02:00