aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2023-07-05mptcp: do not rely on implicit state check in mptcp_listen()Paolo Abeni1-0/+5
Since the blamed commit, closing the first subflow resets the first subflow socket state to SS_UNCONNECTED. The current mptcp listen implementation relies only on such state to prevent touching not-fully-disconnected sockets. Incoming mptcp fastclose (or paired endpoint removal) unconditionally closes the first subflow. All the above allows an incoming fastclose followed by a listen() call to successfully race with a blocking recvmsg(), potentially causing the latter to hit a divide by zero bug in cleanup_rbuf/__tcp_select_window(). Address the issue explicitly checking the msk socket state in mptcp_listen(). An alternative solution would be moving the first subflow socket state update into mptcp_disconnect(), but in the long term the first subflow socket should be removed: better avoid relaying on it for internal consistency check. Fixes: b29fcfb54cd7 ("mptcp: full disconnect implementation") Cc: [email protected] Reported-by: Christoph Paasch <[email protected]> Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/414 Signed-off-by: Paolo Abeni <[email protected]> Reviewed-by: Matthieu Baerts <[email protected]> Signed-off-by: Matthieu Baerts <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2023-07-05mptcp: ensure subflow is unhashed before cleaning the backlogPaolo Abeni1-1/+1
While tacking care of the mptcp-level listener I unintentionally moved the subflow level unhash after the subflow listener backlog cleanup. That could cause some nasty race and makes the code harder to read. Address the issue restoring the proper order of operations. Fixes: 57fc0f1ceaa4 ("mptcp: ensure listener is unhashed before updating the sk status") Cc: [email protected] Signed-off-by: Paolo Abeni <[email protected]> Reviewed-by: Matthieu Baerts <[email protected]> Signed-off-by: Matthieu Baerts <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2023-07-05s390/qeth: Fix vipa deletionThorsten Winkler1-1/+1
Change boolean parameter of function "qeth_l3_vipa_store" inside the "qeth_l3_dev_vipa_del4_store" function from "true" to "false" because "true" is used for adding a virtual ip address and "false" for deleting. Fixes: 2390166a6b45 ("s390/qeth: clean up L3 sysfs code") Reviewed-by: Alexandra Winter <[email protected]> Reviewed-by: Wenjia Zhang <[email protected]> Signed-off-by: Thorsten Winkler <[email protected]> Signed-off-by: Alexandra Winter <[email protected]> Reviewed-by: Simon Horman <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2023-07-04Revert ".gitignore: ignore *.cover and *.mbx"Linus Torvalds1-2/+0
This reverts commit 534066a983df0935847061c844eb178f8a53a9e7. It's actively detrimental in that it hides files that shouldn't be hidden. If I have some b4 mbx file in my git directory, it either was already applied with "git am" and is now stale, or maybe it's waiting for that to happen. In neither case is "ignore it" the right option. Signed-off-by: Linus Torvalds <[email protected]>
2023-07-04Merge tag 'core_guards_for_6.5_rc1' of ↵Linus Torvalds20-17/+282
git://git.kernel.org/pub/scm/linux/kernel/git/peterz/queue Pull scope-based resource management infrastructure from Peter Zijlstra: "These are the first few patches in the Scope-based Resource Management series that introduce the infrastructure but not any conversions as of yet. Adding the infrastructure now allows multiple people to start using them. Of note is that Sparse will need some work since it doesn't yet understand this attribute and might have decl-after-stmt issues" * tag 'core_guards_for_6.5_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/peterz/queue: kbuild: Drop -Wdeclaration-after-statement locking: Introduce __cleanup() based infrastructure apparmor: Free up __cleanup() name dmaengine: ioat: Free up __cleanup() name
2023-07-04afs: Fix accidental truncation when storing dataDavid Howells1-3/+5
When an AFS FS.StoreData RPC call is made, amongst other things it is given the resultant file size to be. On the server, this is processed by truncating the file to new size and then writing the data. Now, kafs has a lock (vnode->io_lock) that serves to serialise operations against a specific vnode (ie. inode), but the parameters for the op are set before the lock is taken. This allows two writebacks (say sync and kswapd) to race - and if writes are ongoing the writeback for a later write could occur before the writeback for an earlier one if the latter gets interrupted. Note that afs_writepages() cannot take i_mutex and only takes a shared lock on vnode->validate_lock. Also note that the server does the truncation and the write inside a lock, so there's no problem at that end. Fix this by moving the calculation for the proposed new i_size inside the vnode->io_lock. Also reset the iterator (which we might have read from) and update the mtime setting there. Fixes: bd80d8a80e12 ("afs: Use ITER_XARRAY for writing") Reported-by: Marc Dionne <[email protected]> Signed-off-by: David Howells <[email protected]> Reviewed-by: Jeffrey Altman <[email protected]> Reviewed-by: Marc Dionne <[email protected]> cc: [email protected] cc: [email protected] Link: https://lore.kernel.org/r/[email protected]/ Signed-off-by: Linus Torvalds <[email protected]>
2023-07-04octeontx-af: fix hardware timestamp configurationHariprasad Kelam1-1/+1
MAC block on CN10K (RPM) supports hardware timestamp configuration. The previous patch which added timestamp configuration support has a bug. Though the netdev driver requests to disable timestamp configuration, the driver is always enabling it. This patch fixes the same. Fixes: d1489208681d ("octeontx2-af: cn10k: RPM hardware timestamp configuration") Signed-off-by: Hariprasad Kelam <[email protected]> Signed-off-by: Sunil Goutham <[email protected]> Reviewed-by: Simon Horman <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2023-07-04Merge tag 'ovl-update-6.5-2' of ↵Linus Torvalds4-564/+581
git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs Pull more overlayfs updates from Amir Goldstein: "This is a small 'move code around' followup by Christian to his work on porting overlayfs to the new mount api for 6.5. It makes things a bit cleaner and simpler for the next development cycle when I hand overlayfs back over to Miklos" * tag 'ovl-update-6.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs: ovl: move all parameter handling into params.{c,h}
2023-07-04Merge tag 'gfs2-v6.4-rc5-fixes' of ↵Linus Torvalds19-237/+277
git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2 Pull gfs2 updates from Andreas Gruenbacher: - Move the freeze/thaw logic from glock callback context to process / worker thread context to prevent deadlocks - Fix a quota reference couting bug in do_qc() - Carry on deallocating inodes even when gfs2_rindex_update() fails - Retry filesystem-internal reads when they are interruped by a signal - Eliminate kmap_atomic() in favor of kmap_local_page() / memcpy_{from,to}_page() - Get rid of noop_direct_IO - And a few more minor fixes and cleanups * tag 'gfs2-v6.4-rc5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2: (23 commits) gfs2: Add quota_change type gfs2: Use memcpy_{from,to}_page where appropriate gfs2: Convert remaining kmap_atomic calls to kmap_local_page gfs2: Replace deprecated kmap_atomic with kmap_local_page gfs: Get rid of unnucessary locking in inode_go_dump gfs2: gfs2_freeze_lock_shared cleanup gfs2: Replace sd_freeze_state with SDF_FROZEN flag gfs2: Rework freeze / thaw logic gfs2: Rename SDF_{FS_FROZEN => FREEZE_INITIATOR} gfs2: Reconfiguring frozen filesystem already rejected gfs2: Rename gfs2_freeze_lock{ => _shared } gfs2: Rename the {freeze,thaw}_super callbacks gfs2: Rename remaining "transaction" glock references gfs2: retry interrupted internal reads gfs2: Fix possible data races in gfs2_show_options() gfs2: Fix duplicate should_fault_in_pages() call gfs2: set FMODE_CAN_ODIRECT instead of a dummy direct_IO method gfs2: Don't remember delete unless it's successful gfs2: Update rl_unlinked before releasing rgrp lock gfs2: Fix gfs2_qa_get imbalance in gfs2_quota_hold ...
2023-07-04Merge branch 'dsa-ll-fixes'David S. Miller5-99/+9
Vladimir Oltean says: ==================== dsa: Fix mangled link-local MAC DAs with SJA1105 DSA The SJA1105 hardware tagging protocol is weird and will put DSA information (source port, switch ID) in the MAC DA of the packets sent to the CPU, and then send some additional (meta) packets which contain the original bytes from the previous packet's MAC DA. The tagging protocol driver contains logic to handle this, but the meta frames are optional functionality, and there are configurations when they aren't received (no PTP RX timestamping). Thus, the MAC DA from packets sent to the stack is not correct in all cases. Also, during testing it was found that the MAC DA patching procedure was incorrect. The investigation comes as a result of this discussion with Paolo: https://lore.kernel.org/netdev/[email protected]/ ==================== Signed-off-by: David S. Miller <[email protected]>
2023-07-04net: dsa: sja1105: always enable the send_meta optionsVladimir Oltean5-97/+7
incl_srcpt has the limitation, mentioned in commit b4638af8885a ("net: dsa: sja1105: always enable the INCL_SRCPT option"), that frames with a MAC DA of 01:80:c2:xx:yy:zz will be received as 01:80:c2:00:00:zz unless PTP RX timestamping is enabled. The incl_srcpt option was initially unconditionally enabled, then that changed with commit 42824463d38d ("net: dsa: sja1105: Limit use of incl_srcpt to bridge+vlan mode"), then again with b4638af8885a ("net: dsa: sja1105: always enable the INCL_SRCPT option"). Bottom line is that it now needs to be always enabled, otherwise the driver does not have a reliable source of information regarding source_port and switch_id for link-local traffic (tag_8021q VLANs may be imprecise since now they identify an entire bridging domain when ports are not standalone). If we accept that PTP RX timestamping (and therefore, meta frame generation) is always enabled in hardware, then that limitation could be avoided and packets with any MAC DA can be properly received, because meta frames do contain the original bytes from the MAC DA of their associated link-local packet. This change enables meta frame generation unconditionally, which also has the nice side effects of simplifying the switch control path (a switch reset is no longer required on hwtstamping settings change) and the tagger data path (it no longer needs to be informed whether to expect meta frames or not - it always does). Fixes: 227d07a07ef1 ("net: dsa: sja1105: Add support for traffic through standalone ports") Signed-off-by: Vladimir Oltean <[email protected]> Reviewed-by: Simon Horman <[email protected]> Reviewed-by: Florian Fainelli <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2023-07-04net: dsa: tag_sja1105: fix MAC DA patching from meta framesVladimir Oltean1-2/+2
The SJA1105 manual says that at offset 4 into the meta frame payload we have "MAC destination byte 2" and at offset 5 we have "MAC destination byte 1". These are counted from the LSB, so byte 1 is h_dest[ETH_HLEN-2] aka h_dest[4] and byte 2 is h_dest[ETH_HLEN-3] aka h_dest[3]. The sja1105_meta_unpack() function decodes these the other way around, so a frame with MAC DA 01:80:c2:11:22:33 is received by the network stack as having 01:80:c2:22:11:33. Fixes: e53e18a6fe4d ("net: dsa: sja1105: Receive and decode meta frames") Signed-off-by: Vladimir Oltean <[email protected]> Reviewed-by: Simon Horman <[email protected]> Reviewed-by: Florian Fainelli <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2023-07-04net: Replace strlcpy with strscpyAzeem Shaikh2-2/+2
strlcpy() reads the entire source buffer first. This read may exceed the destination size limit. This is both inefficient and can lead to linear read overflows if a source string is not NUL-terminated [1]. In an effort to remove strlcpy() completely [2], replace strlcpy() here with strscpy(). No return values were used, so direct replacement is safe. [1] https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy [2] https://github.com/KSPP/linux/issues/89 Signed-off-by: Azeem Shaikh <[email protected]> Reviewed-by: Simon Horman <[email protected]> Reviewed-by: David Ahern <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2023-07-04pptp: Fix fib lookup calls.Guillaume Nault1-11/+20
PPTP uses pppox sockets (struct pppox_sock). These sockets don't embed an inet_sock structure, so it's invalid to call inet_sk() on them. Therefore, the ip_route_output_ports() call in pptp_connect() has two problems: * The tos variable is set with RT_CONN_FLAGS(sk), which calls inet_sk() on the pppox socket. * ip_route_output_ports() tries to retrieve routing flags using inet_sk_flowi_flags(), which is also going to call inet_sk() on the pppox socket. While PPTP doesn't use inet sockets, it's actually really layered on top of IP and therefore needs a proper way to do fib lookups. So let's define pptp_route_output() to get a struct rtable from a pptp socket. Let's also replace the ip_route_output_ports() call of pptp_xmit() for consistency. In practice, this means that: * pptp_connect() sets ->flowi4_tos and ->flowi4_flags to zero instead of using bits of unrelated struct pppox_sock fields. * pptp_xmit() now respects ->sk_mark and ->sk_uid. * pptp_xmit() now calls the security_sk_classify_flow() security hook, thus allowing to set ->flowic_secid. * pptp_xmit() now passes the pppox socket to xfrm_lookup_route(). Found by code inspection. Fixes: 00959ade36ac ("PPTP: PPP over IPv4 (Point-to-Point Tunneling Protocol)") Signed-off-by: Guillaume Nault <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2023-07-04mlxsw: spectrum_router: Fix an IS_ERR() vs NULL checkDan Carpenter1-2/+2
The mlxsw_sp_crif_alloc() function returns NULL on error. It doesn't return error pointers. Fix the check. Fixes: 78126cfd5dc9 ("mlxsw: spectrum_router: Maintain CRIF for fallback loopback RIF") Signed-off-by: Dan Carpenter <[email protected]> Reviewed-by: Alexander Lobakin <[email protected]> Reviewed-by: Ido Schimmel <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2023-07-04Merge tag 'pm-6.5-rc1-2' of ↵Linus Torvalds17-164/+180
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull more power management updates from Rafael Wysocki: "These add support for new hardware (ap807 and AM62A7), fix several issues in cpufreq drivers and in the operating performance points (OPP) framework, fix up intel_idle after recent changes and add documentation. Specifics: - Add missing __init annotation to one function in the intel_idle drvier (Rafael Wysocki) - Make intel_pstate use a correct scaling factor when mapping HWP performance levels to frequency values on hybrid-capable systems with disabled E-cores (Srinivas Pandruvada) - Fix Kconfig dependencies of the cpufreq-dt-platform driver (Viresh Kumar) - Add support to build cpufreq-dt-platdev as a module (Zhipeng Wang) - Don't allocate Sparc's cpufreq_driver dynamically (Viresh Kumar) - Add support for TI's AM62A7 platform (Vibhore Vardhan) - Add support for Armada's ap807 platform (Russell King (Oracle)) - Add support for StarFive JH7110 SoC (Mason Huo) - Fix voltage selection for Mediatek Socs (Daniel Golle) - Fix error handling in Tegra's cpufreq driver (Christophe JAILLET) - Document Qualcomm's IPQ8074 in DT bindings (Robert Marko) - Don't warn for disabling a non-existing frequency for imx6q cpufreq driver (Christoph Niedermaier) - Use dev_err_probe() in Qualcomm's cpufreq driver (Andrew Halaney) - Simplify performance state related logic in the OPP core (Viresh Kumar) - Fix use-after-free and improve locking around lazy_opp_tables (Viresh Kumar, Stephan Gerhold) - Minor cleanups - using dev_err_probe() and rate-limiting debug messages (Andrew Halaney, Adrián Larumbe)" * tag 'pm-6.5-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (23 commits) cpufreq: intel_pstate: Fix scaling for hybrid-capable systems with disabled E-cores cpufreq: Make CONFIG_CPUFREQ_DT_PLATDEV depend on OF intel_idle: Add __init annotation to matchup_vm_state_with_baremetal() OPP: Properly propagate error along when failing to get icc_path OPP: Use dev_err_probe() when failing to get icc_path cpufreq: qcom-cpufreq-hw: Use dev_err_probe() when failing to get icc paths cpufreq: mediatek: correct voltages for MT7622 and MT7623 cpufreq: armada-8k: add ap807 support OPP: Simplify the over-designed pstate <-> level dance OPP: pstate is only valid for genpd OPP tables OPP: don't drop performance constraint on OPP table removal OPP: Protect `lazy_opp_tables` list with `opp_table_lock` OPP: Staticize `lazy_opp_tables` in of.c cpufreq: dt-platdev: Support building as module opp: Fix use-after-free in lazy_opp_tables after probe deferral dt-bindings: cpufreq: qcom-cpufreq-nvmem: document IPQ8074 cpufreq: dt-platdev: Blacklist ti,am62a7 SoC cpufreq: ti-cpufreq: Add support for AM62A7 OPP: rate-limit debug messages when no change in OPP is required cpufreq: imx6q: don't warn for disabling a non-existing frequency ...
2023-07-04Merge tag 'clk-for-linus' of ↵Linus Torvalds69-877/+7630
git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull more clk updates from Stephen Boyd: "Another set of clk driver updates and fixes for the merge window. The driver updates needed more time to bake in linux-next. Updates: - Support for more clk controllers in Qualcomm SoCs such as SM8350, SM8450, SDX75, SC8280XP, and IPQ9574 - Runtime PM enablement of some more Qualcomm clk controllers - Various fixes to Qualcomm clk driver data to use correct clk_ops and to check halt bits properly - AT91 updates to modernize with clk_parent_data structures Fixes: - Remove 'syscon' from dt binding fix for ti,j721e-system-controller - Fix determine rate in the Tegra driver that got wrecked by the refactorting of muxes this merge window" * tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: (69 commits) clk: tegra: Avoid calling an uninitialized function dt-bindings: mfd: ti,j721e-system-controller: Remove syscon from example clk: at91: sama7g5: s/ep_chg_chg_id/ep_chg_id clk: at91: sama7g5: switch to parent_hw and parent_data clk: at91: sckc: switch to parent_data/parent_hw clk: at91: clk-sam9x60-pll: add support for parent_hw clk: at91: clk-utmi: add support for parent_hw clk: at91: clk-system: add support for parent_hw clk: at91: clk-programmable: add support for parent_hw clk: at91: clk-peripheral: add support for parent_hw clk: at91: clk-master: add support for parent_hw clk: at91: clk-generated: add support for parent_hw clk: at91: clk-main: add support for parent_data/parent_hw clk: qcom: gcc-sc8280xp: Add runtime PM clk: qcom: gpucc-sc8280xp: Add runtime PM clk: qcom: mmcc-msm8974: fix MDSS_GDSC power flags clk: qcom: gpucc-sm6375: Enable runtime pm dt-bindings: clock: sm6375-gpucc: Add VDD_GX clk: qcom: gcc-sm6115: Add missing PLL config properties clk: qcom: clk-alpha-pll: Add a way to update some bits of test_ctl(_hi) ...
2023-07-04Merge tag 'firewire-6.5-rc1' of ↵Linus Torvalds13-231/+694
git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394 Pull firewire updates from Takashi Sakamoto: "This consist of three parts; UAPI update, OHCI driver update, and several bug fixes. Firstly, the 1394 OHCI specification defines method to retrieve hardware time stamps for asynchronous communication, which was previously unavailable in user space. This adds new events to the UAPI, allowing applications to retrieve the time when asynchronous packet are received and sent. The new events are tested in the bleeding edge of libhinawa and look to work well. The new version of libhinawa will be released after current merge window is closed: https://git.kernel.org/pub/scm/libs/ieee1394/libhinawa.git/ Secondly, the FireWire stack includes a PCM device driver for 1394 OHCI hardware, This change modernizes the driver by managed resource (devres) framework. Lastly, bug fixes for firewire-net and firewire-core" * tag 'firewire-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394: (25 commits) firewire: net: fix use after free in fwnet_finish_incoming_packet() firewire: core: obsolete usage of GFP_ATOMIC at building node tree firewire: ohci: release buffer for AR req/resp contexts when managed resource is released firewire: ohci: use devres for content of configuration ROM firewire: ohci: use devres for IT, IR, AT/receive, and AT/request contexts firewire: ohci: use devres for list of isochronous contexts firewire: ohci: use devres for requested IRQ firewire: ohci: use devres for misc DMA buffer firewire: ohci: use devres for MMIO region mapping firewire: ohci: use devres for PCI-related resources firewire: ohci: use devres for memory object of ohci structure firewire: fix warnings to generate UAPI documentation firewire: fix build failure due to missing module license firewire: cdev: implement new event relevant to phy packet with time stamp firewire: cdev: add new event to notify phy packet with time stamp firewire: cdev: code refactoring to dispatch event for phy packet firewire: cdev: implement new event to notify response subaction with time stamp firewire: cdev: add new event to notify response subaction with time stamp firewire: cdev: code refactoring to operate event of response firewire: core: implement variations to send request and wait for response with time stamp ...
2023-07-04ACPI: scan: Use the acpi_match_acpi_device() helperAndy Shevchenko1-9/+12
Instead of doing two pass parsing of the table, replace acpi_match_device_ids() with acpi_match_acpi_device(). Signed-off-by: Andy Shevchenko <[email protected]> Signed-off-by: Rafael J. Wysocki <[email protected]>
2023-07-04ACPI: platform: Move SMB0001 HID to the header and reuseAndy Shevchenko3-4/+3
There are at least two places in the kernel that are using the SMB0001 HID. Make it to be available via acpi_drivers.h header file. While at it, replace hard coded one with a definition. Reviewed-by: Andi Shyti <[email protected]> Acked-by: Wolfram Sang <[email protected]> # for I2C Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Andy Shevchenko <[email protected]> Signed-off-by: Rafael J. Wysocki <[email protected]>
2023-07-04ACPI: platform: Ignore SMB0001 only when it has resourcesAndy Shevchenko1-3/+28
After switching i2c-scmi driver to be a platform one, it stopped being enumerated on number of Kontron platforms, because it's listed in the forbidden_id_list. To resolve the situation, add a flag to driver data to allow devices with no resources in _CRS to be enumerated via platform bus. Fixes: 03d4287add6e ("i2c: scmi: Convert to be a platform driver") Closes: https://lore.kernel.org/r/[email protected] Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Andy Shevchenko <[email protected]> Reviewed-by: Andi Shyti <[email protected]> [ rjw: Move has_resource definition to the block in which it is used and initialize it to 'false' ] Signed-off-by: Rafael J. Wysocki <[email protected]>
2023-07-04ACPI: bus: Introduce acpi_match_acpi_device() helperAndy Shevchenko2-4/+30
Match the ACPI device against a given list of ACPI IDs. Subsequent changes will make use of this. Signed-off-by: Andy Shevchenko <[email protected]> [ rjw: Changelog edit ] Signed-off-by: Rafael J. Wysocki <[email protected]>
2023-07-04module: fix init_module_from_file() error handlingLinus Torvalds1-16/+23
Vegard Nossum pointed out two different problems with the error handling in init_module_from_file(): (a) the idempotent loading code didn't clean up properly in some error cases, leaving the on-stack 'struct idempotent' element still in the hash table (b) failure to read the module file would nonsensically update the 'invalid_kread_bytes' stat counter with the error value The first error is quite nasty, in that it can then cause subsequent idempotent loads of that same file to access stale stack contents of the previous failure. The case may not happen in any normal situation (explaining all the "Tested-by's on the original change), and requires admin privileges, but syzkaller triggers random bad behavior as a result: BUG: soft lockup in sys_finit_module BUG: unable to handle kernel paging request in init_module_from_file general protection fault in init_module_from_file INFO: task hung in init_module_from_file KASAN: out-of-bounds Read in init_module_from_file KASAN: slab-out-of-bounds Read in init_module_from_file ... The second error is fairly benign and just leads to nonsensical stats (and has been around since the debug stats were added). Vegard also provided a patch for the idempotent loading issue, but I'd rather re-organize the code and make it more legible using another level of helper functions than add the usual "goto out" error handling. Link: https://lore.kernel.org/lkml/[email protected]/ Fixes: 9b9879fc0327 ("modules: catch concurrent module loads, treat them as idempotent") Reported-by: Vegard Nossum <[email protected]> Reported-by: Harshit Mogalapalli <[email protected]> Reported-by: [email protected] Signed-off-by: Linus Torvalds <[email protected]>
2023-07-04ACPI: scan: fix undeclared variable warnings by including sleep.hBen Dooks1-0/+1
There are two pieces of data being exported from drivers/acpi/scan.c (acpi_device_lock and acpi_wakeup_device_list) that don't have their definitions declared in anything scan.c is including. Fix the following sparse warnings by including sleep.h to add the declarations of acpi_device_lock and acpi_wakeup_device_list to fix the followng sparse warnings: drivers/acpi/scan.c:42:1: warning: symbol 'acpi_device_lock' was not declared. Should it be static? drivers/acpi/scan.c:43:1: warning: symbol 'acpi_wakeup_device_list' was not declared. Should it be static? Signed-off-by: Ben Dooks <[email protected]> Signed-off-by: Rafael J. Wysocki <[email protected]>
2023-07-04Merge branches 'pm-cpufreq' and 'pm-cpuidle'Rafael J. Wysocki13-121/+132
Merge CPU power management updates for 6.5-rc1: - Add missing __init annotation to one function in the intel_idle drvier (Rafael Wysocki). - Make intel_pstate use a correct scaling factor when mapping HWP performance levels to frequency values on hybrid-capable systems with disabled E-cores (Srinivas Pandruvada). - Fix Kconfig dependencies of the cpufreq-dt-platform driver (Viresh Kumar). - Add support to build cpufreq-dt-platdev as a module (Zhipeng Wang). - Don't allocate Sparc's cpufreq_driver dynamically (Viresh Kumar). - Add support for TI's AM62A7 platform (Vibhore Vardhan). - Add support for Armada's ap807 platform (Russell King (Oracle)). - Add support for StarFive JH7110 SoC (Mason Huo). - Fix voltage selection for Mediatek Socs (Daniel Golle). - Fix error handling in Tegra's cpufreq driver (Christophe JAILLET). - Document Qualcomm's IPQ8074 in DT bindings (Robert Marko). - Don't warn for disabling a non-existing frequency for imx6q cpufreq driver (Christoph Niedermaier). - Use dev_err_probe() in Qualcomm's cpufreq driver (Andrew Halaney). * pm-cpufreq: cpufreq: intel_pstate: Fix scaling for hybrid-capable systems with disabled E-cores cpufreq: Make CONFIG_CPUFREQ_DT_PLATDEV depend on OF cpufreq: qcom-cpufreq-hw: Use dev_err_probe() when failing to get icc paths cpufreq: mediatek: correct voltages for MT7622 and MT7623 cpufreq: armada-8k: add ap807 support cpufreq: dt-platdev: Support building as module dt-bindings: cpufreq: qcom-cpufreq-nvmem: document IPQ8074 cpufreq: dt-platdev: Blacklist ti,am62a7 SoC cpufreq: ti-cpufreq: Add support for AM62A7 cpufreq: imx6q: don't warn for disabling a non-existing frequency cpufreq: sparc: Don't allocate cpufreq_driver dynamically cpufreq: tegra194: Fix an error handling path in tegra194_cpufreq_probe() cpufreq: dt-platdev: Add JH7110 SOC to the allowlist * pm-cpuidle: intel_idle: Add __init annotation to matchup_vm_state_with_baremetal()
2023-07-04clk: tegra: Avoid calling an uninitialized functionThierry Reding1-3/+12
Commit 493ffb046cf5 ("clk: tegra: super: Switch to determine_rate") replaced clk_super_round_rate() by clk_super_determine_rate(), but didn't update one callsite that was explicitly calling the old tegra_clk_super_ops.round_rate() function, which was now NULL. This resulted in a crash on Tegra30 systems during early boot. Switch this callsite over to the clk_super_determine_rate() equivalent to avoid the crash. Fixes: 493ffb046cf5 ("clk: tegra: super: Switch to determine_rate") Tested-by: Dmitry Osipenko <[email protected]> Signed-off-by: Thierry Reding <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Stephen Boyd <[email protected]>
2023-07-04scripts: kernel-doc: support private / public marking for enumsJakub Kicinski1-0/+3
Enums benefit from private markings, too. For netlink attribute name enums always end with a pair of __$n_MAX and $n_MAX members. Documenting them feels a bit tedious. Signed-off-by: Jakub Kicinski <[email protected]> Reviewed-by: Randy Dunlap <[email protected]> Tested-by: Randy Dunlap <[email protected]> Signed-off-by: Jonathan Corbet <[email protected]> Message-ID: <[email protected]>
2023-07-04Documentation: KVM: SEV: add a missing backtickChangyuan Lyu1-1/+1
``ENOTTY` -> ``ENOTTY``. Signed-off-by: Changyuan Lyu <[email protected]> Signed-off-by: Jonathan Corbet <[email protected]> Message-ID: <[email protected]>
2023-07-04Documentation: ACPI: fix typo in ssdt-overlays.rstDavid Heidelberg1-1/+1
Signed-off-by: David Heidelberg <[email protected]> Signed-off-by: Jonathan Corbet <[email protected]> Message-ID: <[email protected]>
2023-07-04Fix documentation of panic_on_warnOlaf Hering2-2/+2
The kernel cmdline option panic_on_warn expects an integer, it is not a plain option as documented. A number of uses in the tree figured this already, and use panic_on_warn=1 for their purpose. Adjust a comment which otherwise may mislead people in the future. Fixes: 9e3961a09798 ("kernel: add panic_on_warn") Signed-off-by: Olaf Hering <[email protected]> Reviewed-by: Randy Dunlap <[email protected]> Signed-off-by: Jonathan Corbet <[email protected]>
2023-07-04mm: don't do validate_mm() unnecessarily and without mmap lockingLinus Torvalds1-4/+2
This is an addition to commit ae80b4041984 ("mm: validate the mm before dropping the mmap lock"), because it turns out there were two problems, but lockdep just stopped complaining after finding the first one. The do_vmi_align_munmap() function now drops the mmap lock after doing the validate_mm() call, but it turns out that one of the callers then immediately calls validate_mm() again. That's both a bit silly, and now (again) happens without the mmap lock held. So just remove that validate_mm() call from the caller, but make sure to not lose any coverage by doing that mm sanity checking in the error path of do_vmi_align_munmap() too. Reported-and-tested-by: kernel test robot <[email protected]> Link: https://lore.kernel.org/lkml/ZKN6CdkKyxBShPHi@xsang-OptiPlex-9020/ Fixes: 408579cd627a ("mm: Update do_vmi_align_munmap() return semantics") Signed-off-by: Linus Torvalds <[email protected]>
2023-07-04spi: bcm{63xx,bca}-hsspi: update my email addressJonas Gorski2-2/+2
Update my email address to a working one, as the openwrt.org one is broken since ages. Signed-off-by: Jonas Gorski <[email protected]> Acked-by: William Zhang <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Mark Brown <[email protected]>
2023-07-04net/sched: act_pedit: Add size check for TCA_PEDIT_PARMS_EXLin Ma1-0/+1
The attribute TCA_PEDIT_PARMS_EX is not be included in pedit_policy and one malicious user could fake a TCA_PEDIT_PARMS_EX whose length is smaller than the intended sizeof(struct tc_pedit). Hence, the dereference in tcf_pedit_init() could access dirty heap data. static int tcf_pedit_init(...) { // ... pattr = tb[TCA_PEDIT_PARMS]; // TCA_PEDIT_PARMS is included if (!pattr) pattr = tb[TCA_PEDIT_PARMS_EX]; // but this is not // ... parm = nla_data(pattr); index = parm->index; // parm is able to be smaller than 4 bytes // and this dereference gets dirty skb_buff // data created in netlink_sendmsg } This commit adds TCA_PEDIT_PARMS_EX length in pedit_policy which avoid the above case, just like the TCA_PEDIT_PARMS. Fixes: 71d0ed7079df ("net/act_pedit: Support using offset relative to the conventional network headers") Signed-off-by: Lin Ma <[email protected]> Reviewed-by: Pedro Tammela <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Paolo Abeni <[email protected]>
2023-07-04fs: don't assume arguments are non-NULLChristian Brauner1-2/+4
The helper is explicitly documented as locking zero, one, or two arguments. While all current callers do pass non-NULL arguments there's no need or requirement for them to do so according to the code and the unlock_two_nondirectories() helper is pretty clear about it as well. So only call WARN_ON_ONCE() if the checked inode is valid. Fixes: 2454ad83b90a ("fs: Restrict lock_two_nondirectories() to non-directory inodes") Reviewed-by: Jan Kara <[email protected]> Cc: Jan Kara <[email protected]> Message-Id: <[email protected]> Signed-off-by: Christian Brauner <[email protected]>
2023-07-04fs: no need to check sourceJan Kara1-2/+1
The @source inode must be valid. It is even checked via IS_SWAPFILE() above making it pretty clear. So no need to check it when we unlock. What doesn't need to exist is the @target inode. The lock_two_inodes() helper currently swaps the @inode1 and @inode2 arguments if @inode1 is NULL to have consistent lock class usage. However, we know that at least for vfs_rename() that @inode1 is @source and thus is never NULL as per above. We also know that @source is a different inode than @target as that is checked right at the beginning of vfs_rename(). So we know that @source is valid and locked and that @target is locked. So drop the check whether @source is non-NULL. Fixes: 28eceeda130f ("fs: Lock moved directories") Reported-by: kernel test robot <[email protected]> Reported-by: Dan Carpenter <[email protected]> Closes: https://lore.kernel.org/r/[email protected] Message-Id: <[email protected]> [brauner: use commit message from patch I sent concurrently] Signed-off-by: Christian Brauner <[email protected]>
2023-07-04xsk: Honor SO_BINDTODEVICE on bindIlya Maximets2-0/+14
Initial creation of an AF_XDP socket requires CAP_NET_RAW capability. A privileged process might create the socket and pass it to a non-privileged process for later use. However, that process will be able to bind the socket to any network interface. Even though it will not be able to receive any traffic without modification of the BPF map, the situation is not ideal. Sockets already have a mechanism that can be used to restrict what interface they can be attached to. That is SO_BINDTODEVICE. To change the SO_BINDTODEVICE binding the process will need CAP_NET_RAW. Make xsk_bind() honor the SO_BINDTODEVICE in order to allow safer workflow when non-privileged process is using AF_XDP. The intended workflow is following: 1. First process creates a bare socket with socket(AF_XDP, ...). 2. First process loads the XSK program to the interface. 3. First process adds the socket fd to a BPF map. 4. First process ties socket fd to a particular interface using SO_BINDTODEVICE. 5. First process sends socket fd to a second process. 6. Second process allocates UMEM. 7. Second process binds socket to the interface with bind(...). 8. Second process sends/receives the traffic. All the steps above are possible today if the first process is privileged and the second one has sufficient RLIMIT_MEMLOCK and no capabilities. However, the second process will be able to bind the socket to any interface it wants on step 7 and send traffic from it. With the proposed change, the second process will be able to bind the socket only to a specific interface chosen by the first process at step 4. Fixes: 965a99098443 ("xsk: add support for bind for Rx") Signed-off-by: Ilya Maximets <[email protected]> Signed-off-by: Daniel Borkmann <[email protected]> Acked-by: Magnus Karlsson <[email protected]> Acked-by: John Fastabend <[email protected]> Acked-by: Jason Wang <[email protected]> Link: https://lore.kernel.org/bpf/[email protected]
2023-07-04Revert "s390/mm: get rid of VMEM_MAX_PHYS macro"Alexander Gordeev5-5/+8
This reverts commit 456be42aa713e7f83b467db66ceae779431c7d9d. The assumption VMEM_MAX_PHYS should match ident_map_size is wrong. At least discontiguous saved segments (DCSS) could be loaded at addresses beyond ident_map_size and dcssblk device driver might fail as result. Reported-by: Gerald Schaefer <[email protected]> Signed-off-by: Alexander Gordeev <[email protected]>
2023-07-04s390/cpum_sf: remove check on CPU being onlineThomas Richter1-4/+0
During sampling event initialization, a check is done if that particular CPU the event is to be installed on is actually online. This check is not necessary, as it is also performed in the system call entry point. Therefore remove this check. No functional change. Signed-off-by: Thomas Richter <[email protected]> Acked-by: Heiko Carstens <[email protected]> Signed-off-by: Alexander Gordeev <[email protected]>
2023-07-04s390/cpum_sf: handle casts consistentlyThomas Richter1-13/+13
The casts are written in two different notations: (cast) expression and (cast)expression Convert statements with the first notation to the second notation. No functional change. Signed-off-by: Thomas Richter <[email protected]> Acked-by: Heiko Carstens <[email protected]> Signed-off-by: Alexander Gordeev <[email protected]>
2023-07-04s390/cpum_sf: remove unnecessary debug statementThomas Richter1-3/+0
Remove debug_sprint_event() statement right after an pr_err() statement. No additional debug information is generated. No functional change. Signed-off-by: Thomas Richter <[email protected]> Acked-by: Heiko Carstens <[email protected]> Signed-off-by: Alexander Gordeev <[email protected]>
2023-07-04s390/cpum_sf: remove parameter in call to pr_errThomas Richter1-4/+2
The op argument is hardcoded in the parameter list of function pr_err. Make the op code part of the text printed by pr_err. No functional change. Signed-off-by: Thomas Richter <[email protected]> Acked-by: Heiko Carstens <[email protected]> Signed-off-by: Alexander Gordeev <[email protected]>
2023-07-04s390/cpum_sf: simplify function setup_pmu_cpuThomas Richter1-10/+5
Print the error message when the FAILURE flag is set. This saves on pr_err statement as the text of the error message is identical in both failures. Also observe reverse Xmas tree variable declarations in this function. No functional change. Signed-off-by: Thomas Richter <[email protected]> Acked-by: Heiko Carstens <[email protected]> Signed-off-by: Alexander Gordeev <[email protected]>
2023-07-04s390/cpum_cf: remove unneeded debug statementsThomas Richter1-30/+2
Remove most debug statements which are not needed anymore from the CPU Measurement counter facility device driver. Signed-off-by: Thomas Richter <[email protected]> Acked-by: Heiko Carstens <[email protected]> Signed-off-by: Alexander Gordeev <[email protected]>
2023-07-03arch/arm64/mm/fault: Fix undeclared variable error in do_page_fault()SeongJae Park1-2/+0
Commit ae870a68b5d1 ("arm64/mm: Convert to using lock_mm_and_find_vma()") made do_page_fault() to use 'vma' even if CONFIG_PER_VMA_LOCK is not defined, but the declaration is still in the ifdef. As a result, building kernel without the config fails with undeclared variable error as below: arch/arm64/mm/fault.c: In function 'do_page_fault': arch/arm64/mm/fault.c:624:2: error: 'vma' undeclared (first use in this function); did you mean 'vmap'? 624 | vma = lock_mm_and_find_vma(mm, addr, regs); | ^~~ | vmap Fix it by moving the declaration out of the ifdef. Fixes: ae870a68b5d1 ("arm64/mm: Convert to using lock_mm_and_find_vma()") Signed-off-by: SeongJae Park <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2023-07-03Merge tag 'block-6.5-2023-07-03' of git://git.kernel.dk/linuxLinus Torvalds25-304/+341
Pull more block updates from Jens Axboe: "Mostly items that came in a bit late for the initial pull request, wanted to make sure they had the appropriate amount of linux-next soak before going upstream. Outside of stragglers, just generic fixes for either merge window items, or longer standing bugs" * tag 'block-6.5-2023-07-03' of git://git.kernel.dk/linux: (25 commits) md/raid0: add discard support for the 'original' layout nvme: disable controller on reset state failure nvme: sync timeout work on failed reset nvme: ensure unquiesce on teardown cdrom/gdrom: Fix build error nvme: improved uring polling block: add request polling helper nvme-mpath: fix I/O failure with EAGAIN when failing over I/O nvme: host: fix command name spelling blk-sysfs: add a new attr_group for blk_mq blk-iocost: move wbt_enable/disable_default() out of spinlock blk-wbt: cleanup rwb_enabled() and wbt_disabled() blk-wbt: remove dead code to handle wbt enable/disable with io inflight blk-wbt: don't create wbt sysfs entry if CONFIG_BLK_WBT is disabled blk-mq: fix two misuses on RQF_USE_SCHED blk-throttle: Fix io statistics for cgroup v1 bcache: Fix bcache device claiming bcache: Alloc holder object before async registration raid10: avoid spin_lock from fastpath from raid10_unplug() md: fix 'delete_mutex' deadlock ...
2023-07-03Merge tag 'io_uring-6.5-2023-07-03' of git://git.kernel.dk/linuxLinus Torvalds2-21/+36
Pull io_uring fixes from Jens Axboe: "The fix for the msghdr->msg_inq assigned value being wrong, using -1 instead of -1U for the signed type. Also a fix for ensuring when we're trying to run task_work on an exiting task, that we wait for it. This is not really a correctness thing as the work is being canceled, but it does help with ensuring file descriptors are closed when the task has exited." * tag 'io_uring-6.5-2023-07-03' of git://git.kernel.dk/linux: io_uring: flush offloaded and delayed task_work on exit io_uring: remove io_fallback_tw() forward declaration io_uring/net: use proper value for msg_inq
2023-07-03Merge tag 'hsi-for-6.5' of ↵Linus Torvalds4-14/+4
git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-hsi Pull HSI updates from Sebastian Reichel: - fix build warning with W=1 - drop error handling for debugfs * tag 'hsi-for-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-hsi: HSI: omap_ssi_port: Drop error checking for debugfs_create_dir HSI: fix ssi_waketest() declaration
2023-07-03Merge tag 'for-v6.5' of ↵Linus Torvalds54-343/+1699
git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply Pull power supply and reset updates from Sebastian Reichel: - Add new Qualcomm PMI8998/PM660 SMB2 charger - bq256xx: support systems without thermistors - cros_pchg: fix peripheral device status after system resume - axp20x_usb_power: add support for AXP192 - qcom-pon: add support for pm8941 - at91-reset: prepare to expose reset reason to sysfs - switch all I2C drivers back to use .probe instead of .probe_new - convert some more DT bindings to YAML - misc cleanups * tag 'for-v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply: (28 commits) MAINTAINERS: add documentation file for Microchip SAMA5D2 shutdown controller dt-bindings: power: reset: atmel,sama5d2-shdwc: convert to yaml dt-bindings: power: reset: atmel,at91sam9260-shdwc: convert to yaml power: reset: at91-reset: change the power on reason prototype power: reset: qcom-pon: add support for pm8941-pon dt-bindings: power: reset: qcom-pon: define pm8941-pon power: supply: add Qualcomm PMI8998 SMB2 Charger driver dt-bindings: power: supply: qcom,pmi8998-charger: add bindings for smb2 driver power: supply: rt9467: Make charger-enable control as logic level power: supply: Switch i2c drivers back to use .probe() power: reset: add HAS_IOPORT dependencies dt-bindings: power: supply: axp20x: Add AXP192 compatible power: supply: axp20x_usb_power: Add support for AXP192 power: supply: axp20x_usb_power: Remove variant IDs from VBUS polling check power: supply: axp20x_usb_power: Use regmap field for VBUS disabling power: supply: axp20x_usb_power: Use regmap fields for USB BC feature power: supply: axp20x_usb_power: Use regmap fields for VBUS monitor feature power: supply: axp20x_usb_power: Simplify USB current limit handling power: supply: hwmon: constify pointers to hwmon_channel_info power: supply: twl4030_madc_battery: Refactor twl4030_madc_bat_ext_changed() ...
2023-07-03Merge tag 'rproc-v6.5' of ↵Linus Torvalds19-105/+136
git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux Pull remoteproc updates from Bjorn Andersson: "The bulk of these patches relates to the moving to a void-returning remove callback. The i.MX HiFi remoteproc driver gets its pm_ops helpers updated to resolve build warnings about 'defined but not used' variables in certain configurations. The ST STM32 remoteproc driver is extended to allow using a SCMI reset controller to hold boot, and has an error message corrected. The Qualcomm Q6V5 PAS driver gains a missing 'static' qualifier on adsp_segment_dump()" * tag 'rproc-v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: (23 commits) remoteproc: qcom_q6v5_pas: staticize adsp_segment_dump() remoteproc: stm32: Fix error code in stm32_rproc_parse_dt() remoteproc: stm32: Allow hold boot management by the SCMI reset controller dt-bindings: remoteproc: st,stm32-rproc: Rework reset declarations remoteproc: imx_dsp_rproc: use modern pm_ops remoteproc: wkup_m3: Convert to platform remove callback returning void remoteproc: stm32: Convert to platform remove callback returning void remoteproc: st: Convert to platform remove callback returning void remoteproc: virtio: Convert to platform remove callback returning void remoteproc: rcar: Convert to platform remove callback returning void remoteproc: qcom_wcnss: Convert to platform remove callback returning void remoteproc: qcom_q6v5_wcss: Convert to platform remove callback returning void remoteproc: qcom_q6v5_pas: Convert to platform remove callback returning void remoteproc: qcom_q6v5_mss: Convert to platform remove callback returning void remoteproc: qcom_q6v5_adsp: Convert to platform remove callback returning void remoteproc: pru: Convert to platform remove callback returning void remoteproc: omap: Convert to platform remove callback returning void remoteproc: mtk_scp: Convert to platform remove callback returning void remoteproc: meson_mx_ao_arc: Convert to platform remove callback returning void remoteproc: keystone: Convert to platform remove callback returning void ...
2023-07-03Merge tag 'hwlock-v6.5' of ↵Linus Torvalds1-1/+1
git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux Pull hwspinlock update from Bjorn Andersson: "This drops the last of_match_ptr() from the hwspinlock drivers, solving the resulting 'defined but not used' warning/error" * tag 'hwlock-v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: hwspinlock: omap: drop of_match_ptr for ID table