aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2022-04-08tools/testing/nvdimm: Fix security_init() symbol collisionDan Williams1-2/+2
Starting with the new perf-event support in the nvdimm core, the nfit_test mock module stops compiling. Rename its security_init() to nfit_security_init(). tools/testing/nvdimm/test/nfit.c:1845:13: error: conflicting types for ‘security_init’; have ‘void(struct nfit_test *)’ 1845 | static void security_init(struct nfit_test *t) | ^~~~~~~~~~~~~ In file included from ./include/linux/perf_event.h:61, from ./include/linux/nd.h:11, from ./drivers/nvdimm/nd-core.h:11, from tools/testing/nvdimm/test/nfit.c:19: Fixes: 9a61d0838cd0 ("drivers/nvdimm: Add nvdimm pmu structure") Cc: Kajol Jain <[email protected]> Reviewed-by: Kajol Jain <[email protected]> Reviewed-by: Vishal Verma <[email protected]> Link: https://lore.kernel.org/r/164904238610.1330275.1889212115373993727.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Dan Williams <[email protected]>
2022-04-08RDMA/hfi1: Fix use-after-free bug for mm structDouglas Miller1-0/+6
Under certain conditions, such as MPI_Abort, the hfi1 cleanup code may represent the last reference held on the task mm. hfi1_mmu_rb_unregister() then drops the last reference and the mm is freed before the final use in hfi1_release_user_pages(). A new task may allocate the mm structure while it is still being used, resulting in problems. One manifestation is corruption of the mmap_sem counter leading to a hang in down_write(). Another is corruption of an mm struct that is in use by another task. Fixes: 3d2a9d642512 ("IB/hfi1: Ensure correct mm is used at all times") Link: https://lore.kernel.org/r/[email protected] Cc: <[email protected]> Signed-off-by: Douglas Miller <[email protected]> Signed-off-by: Dennis Dalessandro <[email protected]> Signed-off-by: Jason Gunthorpe <[email protected]>
2022-04-08Merge branch 'acpi-bus'Rafael J. Wysocki3-15/+2
* acpi-bus: ACPI: bus: Eliminate acpi_bus_get_device()
2022-04-08Merge tag 'nfs-for-5.18-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfsLinus Torvalds18-61/+99
Pull NFS client fixes from Trond Myklebust: "Stable fixes: - SUNRPC: Ensure we flush any closed sockets before xs_xprt_free() Bugfixes: - Fix an Oopsable condition due to SLAB_ACCOUNT setting in the NFSv4.2 xattr code. - Fix for open() using an file open mode of '3' in NFSv4 - Replace readdir's use of xxhash() with hash_64() - Several patches to handle malloc() failure in SUNRPC" * tag 'nfs-for-5.18-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfs: SUNRPC: Move the call to xprt_send_pagedata() out of xprt_sock_sendmsg() SUNRPC: svc_tcp_sendmsg() should handle errors from xdr_alloc_bvec() SUNRPC: Handle allocation failure in rpc_new_task() NFS: Ensure rpc_run_task() cannot fail in nfs_async_rename() NFSv4/pnfs: Handle RPC allocation errors in nfs4_proc_layoutget SUNRPC: Handle low memory situations in call_status() SUNRPC: Handle ENOMEM in call_transmit_status() NFSv4.2: Fix missing removal of SLAB_ACCOUNT on kmem_cache allocation SUNRPC: Ensure we flush any closed sockets before xs_xprt_free() NFS: Replace readdir's use of xxhash() with hash_64() SUNRPC: handle malloc failure in ->request_prepare NFSv4: fix open failure with O_ACCMODE flag Revert "NFSv4: Handle the special Linux file open access mode"
2022-04-08Merge tag 'arm64-fixes' of ↵Linus Torvalds15-41/+53
git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: "The two main things to note are: (1) The bulk of the diffstat is us reverting a horrible bodge we had in place to ease the merging of maple tree during the merge window (which turned out not to be needed, but anyway) (2) The TLB invalidation fix is done in core code, as suggested by (and Acked-by) Peter. Summary: - Revert temporary bodge in MTE coredumping to ease maple tree integration - Fix stack frame size warning reported with 64k pages - Fix stop_machine() race with instruction text patching - Ensure alternatives patching routines are not instrumented - Enable Spectre-BHB mitigation for Cortex-A78AE - Fix hugetlb TLB invalidation when contiguous hint is used - Minor perf driver fixes - Fix some typos" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: perf/imx_ddr: Fix undefined behavior due to shift overflowing the constant arm64: Add part number for Arm Cortex-A78AE arm64: patch_text: Fixup last cpu should be master tlb: hugetlb: Add more sizes to tlb_remove_huge_tlb_entry arm64: alternatives: mark patch_alternative() as `noinstr` perf: MARVELL_CN10K_DDR_PMU should depend on ARCH_THUNDER perf: qcom_l2_pmu: fix an incorrect NULL check on list iterator arm64: Fix comments in macro __init_el2_gicv3 arm64: fix typos in comments arch/arm64: Fix topology initialization for core scheduling arm64: mte: Fix the stack frame size warning in mte_dump_tag_range() Revert "arm64: Change elfcore for_each_mte_vma() to use VMA iterator"
2022-04-08Merge tag 'folio-5.18e' of git://git.infradead.org/users/willy/pagecacheLinus Torvalds5-79/+64
Pull folio fixes from Matthew Wilcox: "Fewer bug reports than I was expecting from enabling large folios. One that doesn't show up on x86 but does on arm64, one that shows up with hugetlbfs memory failure testing and one that shows up with page migration, which it turns out I wasn't testing because my last NUMA machine died. Need to set up a qemu fake NUMA machine so I don't skip testing that in future. Summary: - Remove the migration code's assumptions about large pages being PMD sized - Don't call pmd_page() on a non-leaf PMD - Fix handling of hugetlbfs pages in page_vma_mapped_walk" * tag 'folio-5.18e' of git://git.infradead.org/users/willy/pagecache: mm/rmap: Fix handling of hugetlbfs pages in page_vma_mapped_walk mm/mempolicy: Use vma_alloc_folio() in new_page() mm: Add vma_alloc_folio() mm/migrate: Use a folio in migrate_misplaced_transhuge_page() mm/migrate: Use a folio in alloc_migration_target() mm/huge_memory: Avoid calling pmd_page() on a non-leaf PMD
2022-04-08Merge tag 'spi-fix-v5.18-rc1' of ↵Linus Torvalds5-38/+25
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A small collection of fixes that have arrived since the merge window, the most noticable one is a fix for unmapping messages when the mapping was done with the struct device supplied to do the mapping overridden" * tag 'spi-fix-v5.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: bcm-qspi: fix MSPI only access with bcm_qspi_exec_mem_op() spi: cadence-quadspi: fix protocol setup for non-1-1-X operations spi: core: add dma_map_dev for __spi_unmap_msg() spi: mxic: Fix an error handling path in mxic_spi_probe() spi: rpc-if: Fix RPM imbalance in probe error path
2022-04-08Merge tag 'regulator-fix-v5.18-rc1' of ↵Linus Torvalds4-10/+46
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "A few small driver specific fixes for v5.18, plus an update to the MAINTAINERS file" * tag 'regulator-fix-v5.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: MAINTAINERS: Fix reviewer info for a few ROHM ICs regulator: atc260x: Fix missing active_discharge_on setting regulator: rtq2134: Fix missing active_discharge_on setting regulator: wm8994: Add an off-on delay for WM8994 variant
2022-04-08Merge tag 'mmc-v5.18-rc1' of ↵Linus Torvalds11-31/+59
git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC updates from Ulf Hansson: "MMC core: - Improve API to make it clear that mmc_hw_reset() is for cards - Fixup support for writeback-cache for eMMC and SD - Check for errors after writes on SPI MMC host: - renesas_sdhi: A couple of fixes of TAP settings for eMMC HS400 mode - mmci_stm32: Fixup check of all elements in sg list - sdhci-xenon: Revert unnecessary fix for annoying 1.8V regulator warning" * tag 'mmc-v5.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: core: improve API to make clear mmc_hw_reset is for cards mmc: renesas_sdhi: don't overwrite TAP settings when HS400 tuning is complete mmc: renesas_sdhi: special 4tap settings only apply to HS400 mmc: core: Fixup support for writeback-cache for eMMC and SD mmc: block: Check for errors after write on SPI mmc: mmci: stm32: correctly check all elements of sg list Revert "mmc: sdhci-xenon: fix annoying 1.8V regulator warning"
2022-04-08Merge tag 'kvmarm-fixes-5.18-1' of ↵Paolo Bonzini14-68/+285
git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 fixes for 5.18, take #1 - Some PSCI fixes after introducing PSCIv1.1 and SYSTEM_RESET2 - Fix the MMU write-lock not being taken on THP split - Fix mixed-width VM handling - Fix potential UAF when debugfs registration fails - Various selftest updates for all of the above
2022-04-08Merge tag 'iommu-fix-v5.18-rc1' of ↵Linus Torvalds1-1/+1
git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull iommu fix from Joerg Roedel: - Fix boot regression due to a NULL-ptr dereference on OMAP machines * tag 'iommu-fix-v5.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: iommu/omap: Fix regression in probe for NULL pointer dereference
2022-04-08Revert "iavf: Fix deadlock occurrence during resetting VF interface"Mateusz Palczewski1-5/+2
This change caused a regression with resetting while changing network namespaces. By clearing the IFF_UP flag, the kernel now thinks it has fully closed the device. This reverts commit 0cc318d2e8408bc0ffb4662a0c3e5e57005ac6ff. Fixes: 0cc318d2e840 ("iavf: Fix deadlock occurrence during resetting VF interface") Signed-off-by: Mateusz Palczewski <[email protected]> Tested-by: Konrad Jankowski <[email protected]> Signed-off-by: Tony Nguyen <[email protected]>
2022-04-08ice: arfs: fix use-after-free when freeing @rx_cpu_rmapAlexander Lobakin3-18/+14
The CI testing bots triggered the following splat: [ 718.203054] BUG: KASAN: use-after-free in free_irq_cpu_rmap+0x53/0x80 [ 718.206349] Read of size 4 at addr ffff8881bd127e00 by task sh/20834 [ 718.212852] CPU: 28 PID: 20834 Comm: sh Kdump: loaded Tainted: G S W IOE 5.17.0-rc8_nextqueue-devqueue-02643-g23f3121aca93 #1 [ 718.219695] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0012.070720200218 07/07/2020 [ 718.223418] Call Trace: [ 718.227139] [ 718.230783] dump_stack_lvl+0x33/0x42 [ 718.234431] print_address_description.constprop.9+0x21/0x170 [ 718.238177] ? free_irq_cpu_rmap+0x53/0x80 [ 718.241885] ? free_irq_cpu_rmap+0x53/0x80 [ 718.245539] kasan_report.cold.18+0x7f/0x11b [ 718.249197] ? free_irq_cpu_rmap+0x53/0x80 [ 718.252852] free_irq_cpu_rmap+0x53/0x80 [ 718.256471] ice_free_cpu_rx_rmap.part.11+0x37/0x50 [ice] [ 718.260174] ice_remove_arfs+0x5f/0x70 [ice] [ 718.263810] ice_rebuild_arfs+0x3b/0x70 [ice] [ 718.267419] ice_rebuild+0x39c/0xb60 [ice] [ 718.270974] ? asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 718.274472] ? ice_init_phy_user_cfg+0x360/0x360 [ice] [ 718.278033] ? delay_tsc+0x4a/0xb0 [ 718.281513] ? preempt_count_sub+0x14/0xc0 [ 718.284984] ? delay_tsc+0x8f/0xb0 [ 718.288463] ice_do_reset+0x92/0xf0 [ice] [ 718.292014] ice_pci_err_resume+0x91/0xf0 [ice] [ 718.295561] pci_reset_function+0x53/0x80 <...> [ 718.393035] Allocated by task 690: [ 718.433497] Freed by task 20834: [ 718.495688] Last potentially related work creation: [ 718.568966] The buggy address belongs to the object at ffff8881bd127e00 which belongs to the cache kmalloc-96 of size 96 [ 718.574085] The buggy address is located 0 bytes inside of 96-byte region [ffff8881bd127e00, ffff8881bd127e60) [ 718.579265] The buggy address belongs to the page: [ 718.598905] Memory state around the buggy address: [ 718.601809] ffff8881bd127d00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 718.604796] ffff8881bd127d80: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc [ 718.607794] >ffff8881bd127e00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 718.610811] ^ [ 718.613819] ffff8881bd127e80: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 718.617107] ffff8881bd127f00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc This is due to that free_irq_cpu_rmap() is always being called *after* (devm_)free_irq() and thus it tries to work with IRQ descs already freed. For example, on device reset the driver frees the rmap right before allocating a new one (the splat above). Make rmap creation and freeing function symmetrical with {request,free}_irq() calls i.e. do that on ifup/ifdown instead of device probe/remove/resume. These operations can be performed independently from the actual device aRFS configuration. Also, make sure ice_vsi_free_irq() clears IRQ affinity notifiers only when aRFS is disabled -- otherwise, CPU rmap sets and clears its own and they must not be touched manually. Fixes: 28bf26724fdb0 ("ice: Implement aRFS") Co-developed-by: Ivan Vecera <[email protected]> Signed-off-by: Ivan Vecera <[email protected]> Signed-off-by: Alexander Lobakin <[email protected]> Tested-by: Ivan Vecera <[email protected]> Signed-off-by: Tony Nguyen <[email protected]>
2022-04-08perf/imx_ddr: Fix undefined behavior due to shift overflowing the constantBorislav Petkov1-1/+1
Fix: In file included from <command-line>:0:0: In function ‘ddr_perf_counter_enable’, inlined from ‘ddr_perf_irq_handler’ at drivers/perf/fsl_imx8_ddr_perf.c:651:2: ././include/linux/compiler_types.h:352:38: error: call to ‘__compiletime_assert_729’ \ declared with attribute error: FIELD_PREP: mask is not constant _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) ... See https://lore.kernel.org/r/YkwQ6%[email protected] for the gory details as to why it triggers with older gccs only. Signed-off-by: Borislav Petkov <[email protected]> Cc: Frank Li <[email protected]> Cc: Will Deacon <[email protected]> Cc: Mark Rutland <[email protected]> Cc: Shawn Guo <[email protected]> Cc: Sascha Hauer <[email protected]> Cc: Pengutronix Kernel Team <[email protected]> Cc: Fabio Estevam <[email protected]> Cc: NXP Linux Team <[email protected]> Cc: [email protected] Acked-by: Will Deacon <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Will Deacon <[email protected]>
2022-04-08ALSA: usb-audio: Increase max buffer sizeTakashi Iwai1-1/+1
The current limit of max buffer size 1MB seems too small for modern devices with lots of channels and high sample rates. Let's make bigger, 4MB. Reviewed-by: Jaroslav Kysela <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Takashi Iwai <[email protected]>
2022-04-08ALSA: usb-audio: Cap upper limits of buffer/period bytes for implicit fbTakashi Iwai1-2/+87
In the implicit feedback mode, some parameters are tied between both playback and capture streams. One of the tied parameters is the period size, and this can be a problem if the device has different number of channels to both streams. Assume that an application opens a playback stream that has an implicit feedback from a capture stream, and it allocates up to the max period and buffer size as much as possible. When the capture device supports only more channels than the playback, the minimum period and buffer sizes become larger than the sizes the playback stream took. That is, the minimum size will be over the max size the driver limits, and PCM core sees as if no available configuration is found, returning -EINVAL mercilessly. For avoiding this problem, we have to look through the counter part of audioformat list for each sync ep, and checks the channels. If more channels are found there, we reduce the max period and buffer sizes accordingly. You may wonder that the patch adds only the evaluation of channels between streams, and what about other parameters? Both the format and the rate are tied in the implicit fb mode, hence they are always identical. BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=215792 Fixes: 5a6c3e11c9c9 ("ALSA: usb-audio: Add hw constraint for implicit fb sync") Cc: <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Takashi Iwai <[email protected]>
2022-04-08vxlan: fix error return code in vxlan_fdb_appendHongbin Wang1-2/+2
When kmalloc and dst_cache_init failed, should return ENOMEM rather than ENOBUFS. Signed-off-by: Hongbin Wang <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2022-04-08flow_dissector: fix false-positive __read_overflow2_field() warningJakub Kicinski1-1/+1
Bounds checking is unhappy that we try to copy both Ethernet addresses but pass pointer to the first one. Luckily destination address is the first field so pass the pointer to the entire header, whatever. Signed-off-by: Jakub Kicinski <[email protected]> Reviewed-by: Kees Cook <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2022-04-08veth: Ensure eth header is in skb's linear partGuillaume Nault1-1/+1
After feeding a decapsulated packet to a veth device with act_mirred, skb_headlen() may be 0. But veth_xmit() calls __dev_forward_skb(), which expects at least ETH_HLEN byte of linear data (as __dev_forward_skb2() calls eth_type_trans(), which pulls ETH_HLEN bytes unconditionally). Use pskb_may_pull() to ensure veth_xmit() respects this constraint. kernel BUG at include/linux/skbuff.h:2328! RIP: 0010:eth_type_trans+0xcf/0x140 Call Trace: <IRQ> __dev_forward_skb2+0xe3/0x160 veth_xmit+0x6e/0x250 [veth] dev_hard_start_xmit+0xc7/0x200 __dev_queue_xmit+0x47f/0x520 ? skb_ensure_writable+0x85/0xa0 ? skb_mpls_pop+0x98/0x1c0 tcf_mirred_act+0x442/0x47e [act_mirred] tcf_action_exec+0x86/0x140 fl_classify+0x1d8/0x1e0 [cls_flower] ? dma_pte_clear_level+0x129/0x1a0 ? dma_pte_clear_level+0x129/0x1a0 ? prb_fill_curr_block+0x2f/0xc0 ? skb_copy_bits+0x11a/0x220 __tcf_classify+0x58/0x110 tcf_classify_ingress+0x6b/0x140 __netif_receive_skb_core.constprop.0+0x47d/0xfd0 ? __iommu_dma_unmap_swiotlb+0x44/0x90 __netif_receive_skb_one_core+0x3d/0xa0 netif_receive_skb+0x116/0x170 be_process_rx+0x22f/0x330 [be2net] be_poll+0x13c/0x370 [be2net] __napi_poll+0x2a/0x170 net_rx_action+0x22f/0x2f0 __do_softirq+0xca/0x2a8 __irq_exit_rcu+0xc1/0xe0 common_interrupt+0x83/0xa0 Fixes: e314dbdc1c0d ("[NET]: Virtual ethernet device driver.") Signed-off-by: Guillaume Nault <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2022-04-08bonding: Update layer2 and layer2+3 hash formula documentationGal Pressman1-2/+2
When using layer2 or layer2+3 hash, only the 5th byte of the MAC addresses is used. Signed-off-by: Gal Pressman <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2022-04-08MAINTAINERS: Fix reviewer info for a few ROHM ICsMatti Vaittinen1-7/+5
The email backend used by ROHM keeps labeling patches as spam. Additionally, there have been reports of some emails been completely dropped. Finally also the email list (or shared inbox) [email protected] inadvertly stopped working and has not been reviwed during the past few weeks. Remove no longer working list 'linux-power' list-entry and switch my email to use the personal gmail account instead of the company account. Signed-off-by: Matti Vaittinen <[email protected]> Link: https://lore.kernel.org/r/Yk/[email protected] Signed-off-by: Mark Brown <[email protected]>
2022-04-08net/sched: flower: fix parsing of ethertype following VLAN headerVlad Buslov3-5/+16
A tc flower filter matching TCA_FLOWER_KEY_VLAN_ETH_TYPE is expected to match the L2 ethertype following the first VLAN header, as confirmed by linked discussion with the maintainer. However, such rule also matches packets that have additional second VLAN header, even though filter has both eth_type and vlan_ethtype set to "ipv4". Looking at the code this seems to be mostly an artifact of the way flower uses flow dissector. First, even though looking at the uAPI eth_type and vlan_ethtype appear like a distinct fields, in flower they are all mapped to the same key->basic.n_proto. Second, flow dissector skips following VLAN header as no keys for FLOW_DISSECTOR_KEY_CVLAN are set and eventually assigns the value of n_proto to last parsed header. With these, such filters ignore any headers present between first VLAN header and first "non magic" header (ipv4 in this case) that doesn't result FLOW_DISSECT_RET_PROTO_AGAIN. Fix the issue by extending flow dissector VLAN key structure with new 'vlan_eth_type' field that matches first ethertype following previously parsed VLAN header. Modify flower classifier to set the new flow_dissector_key_vlan->vlan_eth_type with value obtained from TCA_FLOWER_KEY_VLAN_ETH_TYPE/TCA_FLOWER_KEY_CVLAN_ETH_TYPE uAPIs. Link: https://lore.kernel.org/all/Yjhgi48BpTGh6dig@nanopsycho/ Fixes: 9399ae9a6cb2 ("net_sched: flower: Add vlan support") Fixes: d64efd0926ba ("net/sched: flower: Add supprt for matching on QinQ vlan headers") Signed-off-by: Vlad Buslov <[email protected]> Reviewed-by: Jiri Pirko <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2022-04-08dt-bindings: net: ave: Use unevaluatedPropertiesKunihiko Hayashi1-1/+1
This refers common bindings, so this is preferred for unevaluatedProperties instead of additionalProperties. Signed-off-by: Kunihiko Hayashi <[email protected]> Acked-by: Rob Herring <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2022-04-08dt-bindings: net: ave: Clean up clocks, resets, and their names using ↵Kunihiko Hayashi1-17/+38
compatible string Instead of "oneOf:" choices, use "allOf:" and "if:" to define clocks, resets, and their names that can be taken by the compatible string. The order of clock-names and reset-names doesn't change here. Signed-off-by: Kunihiko Hayashi <[email protected]> Reviewed-by: Rob Herring <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2022-04-08arm64: Add part number for Arm Cortex-A78AEChanho Park2-0/+3
Add the MIDR part number info for the Arm Cortex-A78AE[1] and add it to spectre-BHB affected list[2]. [1]: https://developer.arm.com/Processors/Cortex-A78AE [2]: https://developer.arm.com/Arm%20Security%20Center/Spectre-BHB Cc: Catalin Marinas <[email protected]> Cc: Mark Rutland <[email protected]> Cc: Will Deacon <[email protected]> Cc: James Morse <[email protected]> Signed-off-by: Chanho Park <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Will Deacon <[email protected]>
2022-04-08arm64: patch_text: Fixup last cpu should be masterGuo Ren1-2/+2
These patch_text implementations are using stop_machine_cpuslocked infrastructure with atomic cpu_count. The original idea: When the master CPU patch_text, the others should wait for it. But current implementation is using the first CPU as master, which couldn't guarantee the remaining CPUs are waiting. This patch changes the last CPU as the master to solve the potential risk. Fixes: ae16480785de ("arm64: introduce interfaces to hotpatch kernel and module code") Signed-off-by: Guo Ren <[email protected]> Signed-off-by: Guo Ren <[email protected]> Reviewed-by: Catalin Marinas <[email protected]> Reviewed-by: Masami Hiramatsu <[email protected]> Cc: <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Will Deacon <[email protected]>
2022-04-08iommu/omap: Fix regression in probe for NULL pointer dereferenceTony Lindgren1-1/+1
Commit 3f6634d997db ("iommu: Use right way to retrieve iommu_ops") started triggering a NULL pointer dereference for some omap variants: __iommu_probe_device from probe_iommu_group+0x2c/0x38 probe_iommu_group from bus_for_each_dev+0x74/0xbc bus_for_each_dev from bus_iommu_probe+0x34/0x2e8 bus_iommu_probe from bus_set_iommu+0x80/0xc8 bus_set_iommu from omap_iommu_init+0x88/0xcc omap_iommu_init from do_one_initcall+0x44/0x24 This is caused by omap iommu probe returning 0 instead of ERR_PTR(-ENODEV) as noted by Jason Gunthorpe <[email protected]>. Looks like the regression already happened with an earlier commit 6785eb9105e3 ("iommu/omap: Convert to probe/release_device() call-backs") that changed the function return type and missed converting one place. Cc: Drew Fustini <[email protected]> Cc: Lu Baolu <[email protected]> Cc: Suman Anna <[email protected]> Suggested-by: Jason Gunthorpe <[email protected]> Fixes: 6785eb9105e3 ("iommu/omap: Convert to probe/release_device() call-backs") Fixes: 3f6634d997db ("iommu: Use right way to retrieve iommu_ops") Signed-off-by: Tony Lindgren <[email protected]> Tested-by: Drew Fustini <[email protected]> Reviewed-by: Jason Gunthorpe <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Joerg Roedel <[email protected]>
2022-04-08mmc: core: improve API to make clear mmc_hw_reset is for cardsWolfram Sang8-10/+10
To make it unambiguous that mmc_hw_reset() is for cards and not for controllers, we make the function argument mmc_card instead of mmc_host. Also, all users are converted. Suggested-by: Ulf Hansson <[email protected]> Signed-off-by: Wolfram Sang <[email protected]> Acked-by: Kalle Valo <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Ulf Hansson <[email protected]>
2022-04-07Merge tag 'drm-fixes-2022-04-08' of git://anongit.freedesktop.org/drm/drmLinus Torvalds72-252/+1031
Pull drm fixes from Dave Airlie: "Main set of fixes for rc2, mostly amdgpu, but some dma-fence fixups as well, along with some other misc ones. dma-fence: - fix warning about fence containers - fix logic error in new fence merge code - handle empty dma_fence_arrays gracefully bridge: - Try all possible cases for bridge/panel detection. bindings: - Don't require input port for MIPI-DSI, and make width/height mandatory. fbdev: - Fix unregistering of framebuffers without device. nouveau: - Fix a crash when booting with nouveau on tegra. amdgpu: - GFX 10.3.7 fixes - noretry updates - VCN fixes - TMDS fix - zstate fix for freesync video - DCN 3.1.5 fix - Display stack size fix - Audio fix - DCN 3.1 pstate fix - TMZ VCN fix - APU passthrough fix - Misc other fixes - VCN 3.0 fixes - Misc display fixes - GC 10.3 golden register fix - Suspend fix - SMU 10 fix amdkfd: - Error handling fix - xgmi p2p fix - HWS VMIDs fix - Event fix panel: - ili9341: Fix optional regulator handling imx: - Catch an EDID allocation failure in imx-ldb - fix a leaked drm display mode on DT parsing error in parallel-display - properly remove the dw_hdmi bridge in case the component_add fails in dw_hdmi-imx - fix the IPU clock frequency debug printout in ipu-di" * tag 'drm-fixes-2022-04-08' of git://anongit.freedesktop.org/drm/drm: (61 commits) dt-bindings: display: panel: mipi-dbi-spi: Make width-mm/height-mm mandatory fbdev: Fix unregistering of framebuffers without device drm/amdgpu/smu10: fix SoC/fclk units in auto mode drm/amd/display: update dcn315 clock table read drm/amdgpu/display: change pipe policy for DCN 2.1 drm/amd/display: Add configuration options for AUX wake work around. drm/amd/display: remove assert for odm transition case drm/amdgpu: don't use BACO for reset in S3 drm/amd/display: Fix by adding FPU protection for dcn30_internal_validate_bw drm/amdkfd: Create file descriptor after client is added to smi_clients list drm/amdgpu: Sync up header and implementation to use the same parameter names drm/amdgpu: fix incorrect GCR_GENERAL_CNTL address amd/display: set backlight only if required drm/amd/display: Fix allocate_mst_payload assert on resume drm/amd/display: Revert FEC check in validation drm/amd/display: Add work around for AUX failure on wake. drm/amd/display: Clear optc false state when disable otg drm/amd/display: Enable power gating before init_pipes drm/amd/display: Remove redundant dsc power gating from init_hw drm/amd/display: Correct Slice reset calculation ...
2022-04-07Merge tag '5.18-rc1-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6Linus Torvalds4-12/+17
Pull cifs client fixes from Steve French: - reconnect fixes: one for DFS and one to avoid a reconnect race - small change to deal with upcoming behavior change of list iterators * tag '5.18-rc1-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: update internal module number cifs: force new session setup and tcon for dfs cifs: remove check of list iterator against head past the loop body cifs: fix potential race with cifsd thread
2022-04-07Merge tag 'net-5.18-rc2' of ↵Linus Torvalds65-388/+712
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from bpf and netfilter. Current release - new code bugs: - mctp: correct mctp_i2c_header_create result - eth: fungible: fix reference to __udivdi3 on 32b builds - eth: micrel: remove latencies support lan8814 Previous releases - regressions: - bpf: resolve to prog->aux->dst_prog->type only for BPF_PROG_TYPE_EXT - vrf: fix packet sniffing for traffic originating from ip tunnels - rxrpc: fix a race in rxrpc_exit_net() - dsa: revert "net: dsa: stop updating master MTU from master.c" - eth: ice: fix MAC address setting Previous releases - always broken: - tls: fix slab-out-of-bounds bug in decrypt_internal - bpf: support dual-stack sockets in bpf_tcp_check_syncookie - xdp: fix coalescing for page_pool fragment recycling - ovs: fix leak of nested actions - eth: sfc: - add missing xdp queue reinitialization - fix using uninitialized xdp tx_queue - eth: ice: - clear default forwarding VSI during VSI release - fix broken IFF_ALLMULTI handling - synchronize_rcu() when terminating rings - eth: qede: confirm skb is allocated before using - eth: aqc111: fix out-of-bounds accesses in RX fixup - eth: slip: fix NPD bug in sl_tx_timeout()" * tag 'net-5.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (61 commits) drivers: net: slip: fix NPD bug in sl_tx_timeout() bpf: Adjust bpf_tcp_check_syncookie selftest to test dual-stack sockets bpf: Support dual-stack sockets in bpf_tcp_check_syncookie myri10ge: fix an incorrect free for skb in myri10ge_sw_tso net: usb: aqc111: Fix out-of-bounds accesses in RX fixup qede: confirm skb is allocated before using net: ipv6mr: fix unused variable warning with CONFIG_IPV6_PIMSM_V2=n net: phy: mscc-miim: reject clause 45 register accesses net: axiemac: use a phandle to reference pcs_phy dt-bindings: net: add pcs-handle attribute net: axienet: factor out phy_node in struct axienet_local net: axienet: setup mdio unconditionally net: sfc: fix using uninitialized xdp tx_queue rxrpc: fix a race in rxrpc_exit_net() net: openvswitch: fix leak of nested actions net: ethernet: mv643xx: Fix over zealous checking of_get_mac_address() net: openvswitch: don't send internal clone attribute to the userspace. net: micrel: Fix KS8851 Kconfig ice: clear cmd_type_offset_bsz for TX rings ice: xsk: fix VSI state check in ice_xsk_wakeup() ...
2022-04-08Merge tag 'drm-misc-fixes-2022-04-07' of ↵Dave Airlie8-4/+14
git://anongit.freedesktop.org/drm/drm-misc into drm-fixes drm-misc-fixes for v5.18-rc2: - Fix a crash when booting with nouveau on tegra. - Don't require input port for MIPI-DSI, and make width/height mandatory. - Fix unregistering of framebuffers without device. Signed-off-by: Dave Airlie <[email protected]> From: Maarten Lankhorst <[email protected]> Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]
2022-04-08Merge tag 'drm-misc-next-fixes-2022-04-07' of ↵Dave Airlie10-117/+540
git://anongit.freedesktop.org/drm/drm-misc into drm-fixes drm-misc-next-fixes for v5.18-rc2: - fix warning about fence containers - fix logic error in new fence merge code - handle empty dma_fence_arrays gracefully - Try all possible cases for bridge/panel detection. Signed-off-by: Dave Airlie <[email protected]> From: Maarten Lankhorst <[email protected]> Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]
2022-04-07SUNRPC: Move the call to xprt_send_pagedata() out of xprt_sock_sendmsg()Trond Myklebust3-11/+19
The client and server have different requirements for their memory allocation, so move the allocation of the send buffer out of the socket send code that is common to both. Reported-by: NeilBrown <[email protected]> Fixes: b2648015d452 ("SUNRPC: Make the rpciod and xprtiod slab allocation modes consistent") Signed-off-by: Trond Myklebust <[email protected]>
2022-04-07SUNRPC: svc_tcp_sendmsg() should handle errors from xdr_alloc_bvec()Trond Myklebust1-1/+3
The allocation is done with GFP_KERNEL, but it could still fail in a low memory situation. Fixes: 4a85a6a3320b ("SUNRPC: Handle TCP socket sends with kernel_sendpage() again") Signed-off-by: Trond Myklebust <[email protected]>
2022-04-07SUNRPC: Handle allocation failure in rpc_new_task()Trond Myklebust2-0/+12
If the call to rpc_alloc_task() fails, then ensure that the calldata is released, and that rpc_run_task() and rpc_run_bc_task() bail out early. Reported-by: NeilBrown <[email protected]> Fixes: 910ad38697d9 ("NFS: Fix memory allocation in rpc_alloc_task()") Signed-off-by: Trond Myklebust <[email protected]>
2022-04-07NFS: Ensure rpc_run_task() cannot fail in nfs_async_rename()Trond Myklebust2-0/+2
Ensure the call to rpc_run_task() cannot fail by preallocating the rpc_task. Fixes: 910ad38697d9 ("NFS: Fix memory allocation in rpc_alloc_task()") Signed-off-by: Trond Myklebust <[email protected]>
2022-04-07NFSv4/pnfs: Handle RPC allocation errors in nfs4_proc_layoutgetTrond Myklebust1-0/+2
If rpc_run_task() fails due to an allocation error, then bail out early. Fixes: 910ad38697d9 ("NFS: Fix memory allocation in rpc_alloc_task()") Signed-off-by: Trond Myklebust <[email protected]>
2022-04-07SUNRPC: Handle low memory situations in call_status()Trond Myklebust1-0/+5
We need to handle ENFILE, ENOBUFS, and ENOMEM, because xprt_wake_pending_tasks() can be called with any one of these due to socket creation failures. Fixes: b61d59fffd3e ("SUNRPC: xs_tcp_connect_worker{4,6}: merge common code") Signed-off-by: Trond Myklebust <[email protected]>
2022-04-07SUNRPC: Handle ENOMEM in call_transmit_status()Trond Myklebust1-0/+2
Both call_transmit() and call_bc_transmit() can now return ENOMEM, so let's make sure that we handle the errors gracefully. Fixes: 0472e4766049 ("SUNRPC: Convert socket page send code to use iov_iter()") Signed-off-by: Trond Myklebust <[email protected]>
2022-04-07NFSv4.2: Fix missing removal of SLAB_ACCOUNT on kmem_cache allocationMuchun Song1-1/+1
The commit 5c60e89e71f8 ("NFSv4.2: Fix up an invalid combination of memory allocation flags") has stripped GFP_KERNEL_ACCOUNT down to GFP_KERNEL, however, it forgot to remove SLAB_ACCOUNT from kmem_cache allocation. It means that memory is still limited by kmemcg. This patch also fix a NULL pointer reference issue [1] reported by NeilBrown. Link: https://lore.kernel.org/all/[email protected]/ [1] Fixes: 5c60e89e71f8 ("NFSv4.2: Fix up an invalid combination of memory allocation flags") Fixes: 5abc1e37afa0 ("mm: list_lru: allocate list_lru_one only when needed") Reported-by: NeilBrown <[email protected]> Signed-off-by: Muchun Song <[email protected]> Signed-off-by: Trond Myklebust <[email protected]>
2022-04-07SUNRPC: Ensure we flush any closed sockets before xs_xprt_free()Trond Myklebust4-10/+15
We must ensure that all sockets are closed before we call xprt_free() and release the reference to the net namespace. The problem is that calling fput() will defer closing the socket until delayed_fput() gets called. Let's fix the situation by allowing rpciod and the transport teardown code (which runs on the system wq) to call __fput_sync(), and directly close the socket. Reported-by: Felix Fu <[email protected]> Acked-by: Al Viro <[email protected]> Fixes: a73881c96d73 ("SUNRPC: Fix an Oops in udp_poll()") Cc: [email protected] # 5.1.x: 3be232f11a3c: SUNRPC: Prevent immediate close+reconnect Cc: [email protected] # 5.1.x: 89f42494f92f: SUNRPC: Don't call connect() more than once on a TCP socket Cc: [email protected] # 5.1.x Signed-off-by: Trond Myklebust <[email protected]>
2022-04-07NFS: Replace readdir's use of xxhash() with hash_64()Trond Myklebust2-10/+3
Both xxhash() and hash_64() appear to give similarly low collision rates with a standard linearly increasing readdir offset. They both give similarly higher collision rates when applied to ext4's offsets. So switch to using the standard hash_64(). Signed-off-by: Trond Myklebust <[email protected]>
2022-04-07io_uring: use nospec annotation for more indexesPavel Begunkov1-6/+5
There are still several places that using pre array_index_nospec() indexes, fix them up. Signed-off-by: Pavel Begunkov <[email protected]> Link: https://lore.kernel.org/r/b01ef5ee83f72ed35ad525912370b729f5d145f4.1649336342.git.asml.silence@gmail.com Signed-off-by: Jens Axboe <[email protected]>
2022-04-07io_uring: zero tag on rsrc removalPavel Begunkov1-1/+3
Automatically default rsrc tag in io_queue_rsrc_removal(), it's safer than leaving it there and relying on the rest of the code to behave and not use it. Signed-off-by: Pavel Begunkov <[email protected]> Link: https://lore.kernel.org/r/1cf262a50df17478ea25b22494dcc19f3a80301f.1649336342.git.asml.silence@gmail.com Signed-off-by: Jens Axboe <[email protected]>
2022-04-07io_uring: don't touch scm_fp_list after queueing skbPavel Begunkov1-2/+6
It's safer to not touch scm_fp_list after we queued an skb to which it was assigned, there might be races lurking if we screw subtle sync guarantees on the io_uring side. Fixes: 6b06314c47e14 ("io_uring: add file set registration") Signed-off-by: Pavel Begunkov <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2022-04-07io_uring: nospec index for tags on files updatePavel Begunkov1-1/+1
Don't forget to array_index_nospec() for indexes before updating rsrc tags in __io_sqe_files_update(), just use already safe and precalculated index @i. Fixes: c3bdad0271834 ("io_uring: add generic rsrc update with tags") Signed-off-by: Pavel Begunkov <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2022-04-07io_uring: implement compat handling for IORING_REGISTER_IOWQ_AFFEugene Syromiatnikov1-1/+9
Similarly to the way it is done im mbind syscall. Cc: [email protected] # 5.14 Fixes: fe76421d1da1dcdb ("io_uring: allow user configurable IO thread CPU affinity") Signed-off-by: Eugene Syromiatnikov <[email protected]> Signed-off-by: Jens Axboe <[email protected]>
2022-04-07Revert "io_uring: Add support for napi_busy_poll"Jens Axboe1-231/+1
This reverts commit adc8682ec69012b68d5ab7123e246d2ad9a6f94b. There's some discussion on the API not being as good as it can be. Rather than ship something and be stuck with it forever, let's revert the NAPI support for now and work on getting something sorted out for the next kernel release instead. Link: https://lore.kernel.org/io-uring/[email protected]/ Signed-off-by: Jens Axboe <[email protected]>
2022-04-07io_uring: drop the old style inflight file trackingJens Axboe1-58/+27
io_uring tracks requests that are referencing an io_uring descriptor to be able to cancel without worrying about loops in the references. Since we now assign the file at execution time, the easier approach is to drop a potentially problematic reference before we punt the request. This eliminates the need to special case these types of files beyond just marking them as such, and simplifies cancelation quite a bit. This also fixes a recent issue where an async punted tee operation would with the io_uring descriptor as the output file would crash when attempting to get a reference to the file from the io-wq worker. We could have worked around that, but this is the much cleaner fix. Fixes: 6bf9c47a3989 ("io_uring: defer file assignment") Reported-by: [email protected] Signed-off-by: Jens Axboe <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.