--- /dev/null
+From fd58f7df2415ef747782e01f94880fefad1247cf Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Thu, 26 May 2022 13:24:05 +0300
+Subject: bpf: Use safer kvmalloc_array() where possible
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit fd58f7df2415ef747782e01f94880fefad1247cf upstream.
+
+The kvmalloc_array() function is safer because it has a check for
+integer overflows. These sizes come from the user and I was not
+able to see any bounds checking so an integer overflow seems like a
+realistic concern.
+
+Fixes: 0dcac2725406 ("bpf: Add multi kprobe link")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/Yo9VRVMeHbALyjUH@kili
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/trace/bpf_trace.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/kernel/trace/bpf_trace.c
++++ b/kernel/trace/bpf_trace.c
+@@ -2433,7 +2433,7 @@ int bpf_kprobe_multi_link_attach(const u
+ return -EINVAL;
+
+ size = cnt * sizeof(*addrs);
+- addrs = kvmalloc(size, GFP_KERNEL);
++ addrs = kvmalloc_array(cnt, sizeof(*addrs), GFP_KERNEL);
+ if (!addrs)
+ return -ENOMEM;
+
+@@ -2450,7 +2450,7 @@ int bpf_kprobe_multi_link_attach(const u
+
+ ucookies = u64_to_user_ptr(attr->link_create.kprobe_multi.cookies);
+ if (ucookies) {
+- cookies = kvmalloc(size, GFP_KERNEL);
++ cookies = kvmalloc_array(cnt, sizeof(*addrs), GFP_KERNEL);
+ if (!cookies) {
+ err = -ENOMEM;
+ goto error;
--- /dev/null
+From 29dec90a0f1d961b93f34f910e9319d8cb23edbd Mon Sep 17 00:00:00 2001
+From: Christoph Hellwig <hch@lst.de>
+Date: Wed, 8 Jun 2022 08:34:06 +0200
+Subject: dm: fix bio_set allocation
+
+From: Christoph Hellwig <hch@lst.de>
+
+commit 29dec90a0f1d961b93f34f910e9319d8cb23edbd upstream.
+
+The use of bioset_init_from_src mean that the pre-allocated pools weren't
+used for anything except parameter passing, and the integrity pool
+creation got completely lost for the actual live mapped_device. Fix that
+by assigning the actual preallocated dm_md_mempools to the mapped_device
+and using that for I/O instead of creating new mempools.
+
+Fixes: 2a2a4c510b76 ("dm: use bioset_init_from_src() to copy bio_set")
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Mike Snitzer <snitzer@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/dm-core.h | 11 +++++-
+ drivers/md/dm-rq.c | 2 -
+ drivers/md/dm-table.c | 11 ------
+ drivers/md/dm.c | 83 ++++++++++++++------------------------------------
+ drivers/md/dm.h | 2 -
+ 5 files changed, 34 insertions(+), 75 deletions(-)
+
+--- a/drivers/md/dm-core.h
++++ b/drivers/md/dm-core.h
+@@ -32,6 +32,14 @@ struct dm_kobject_holder {
+ * access their members!
+ */
+
++/*
++ * For mempools pre-allocation at the table loading time.
++ */
++struct dm_md_mempools {
++ struct bio_set bs;
++ struct bio_set io_bs;
++};
++
+ struct mapped_device {
+ struct mutex suspend_lock;
+
+@@ -109,8 +117,7 @@ struct mapped_device {
+ /*
+ * io objects are allocated from here.
+ */
+- struct bio_set io_bs;
+- struct bio_set bs;
++ struct dm_md_mempools *mempools;
+
+ /* kobject and completion */
+ struct dm_kobject_holder kobj_holder;
+--- a/drivers/md/dm-rq.c
++++ b/drivers/md/dm-rq.c
+@@ -319,7 +319,7 @@ static int setup_clone(struct request *c
+ {
+ int r;
+
+- r = blk_rq_prep_clone(clone, rq, &tio->md->bs, gfp_mask,
++ r = blk_rq_prep_clone(clone, rq, &tio->md->mempools->bs, gfp_mask,
+ dm_rq_bio_constructor, tio);
+ if (r)
+ return r;
+--- a/drivers/md/dm-table.c
++++ b/drivers/md/dm-table.c
+@@ -1030,17 +1030,6 @@ static int dm_table_alloc_md_mempools(st
+ return 0;
+ }
+
+-void dm_table_free_md_mempools(struct dm_table *t)
+-{
+- dm_free_md_mempools(t->mempools);
+- t->mempools = NULL;
+-}
+-
+-struct dm_md_mempools *dm_table_get_md_mempools(struct dm_table *t)
+-{
+- return t->mempools;
+-}
+-
+ static int setup_indexes(struct dm_table *t)
+ {
+ int i;
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -131,14 +131,6 @@ static int get_swap_bios(void)
+ return latch;
+ }
+
+-/*
+- * For mempools pre-allocation at the table loading time.
+- */
+-struct dm_md_mempools {
+- struct bio_set bs;
+- struct bio_set io_bs;
+-};
+-
+ struct table_device {
+ struct list_head list;
+ refcount_t count;
+@@ -573,7 +565,7 @@ static struct dm_io *alloc_io(struct map
+ struct dm_target_io *tio;
+ struct bio *clone;
+
+- clone = bio_alloc_clone(bio->bi_bdev, bio, GFP_NOIO, &md->io_bs);
++ clone = bio_alloc_clone(bio->bi_bdev, bio, GFP_NOIO, &md->mempools->io_bs);
+
+ tio = clone_to_tio(clone);
+ tio->flags = 0;
+@@ -615,7 +607,7 @@ static struct bio *alloc_tio(struct clon
+ clone = &tio->clone;
+ } else {
+ clone = bio_alloc_clone(ci->bio->bi_bdev, ci->bio,
+- gfp_mask, &ci->io->md->bs);
++ gfp_mask, &ci->io->md->mempools->bs);
+ if (!clone)
+ return NULL;
+
+@@ -1775,8 +1767,7 @@ static void cleanup_mapped_device(struct
+ {
+ if (md->wq)
+ destroy_workqueue(md->wq);
+- bioset_exit(&md->bs);
+- bioset_exit(&md->io_bs);
++ dm_free_md_mempools(md->mempools);
+
+ if (md->dax_dev) {
+ dax_remove_host(md->disk);
+@@ -1948,48 +1939,6 @@ static void free_dev(struct mapped_devic
+ kvfree(md);
+ }
+
+-static int __bind_mempools(struct mapped_device *md, struct dm_table *t)
+-{
+- struct dm_md_mempools *p = dm_table_get_md_mempools(t);
+- int ret = 0;
+-
+- if (dm_table_bio_based(t)) {
+- /*
+- * The md may already have mempools that need changing.
+- * If so, reload bioset because front_pad may have changed
+- * because a different table was loaded.
+- */
+- bioset_exit(&md->bs);
+- bioset_exit(&md->io_bs);
+-
+- } else if (bioset_initialized(&md->bs)) {
+- /*
+- * There's no need to reload with request-based dm
+- * because the size of front_pad doesn't change.
+- * Note for future: If you are to reload bioset,
+- * prep-ed requests in the queue may refer
+- * to bio from the old bioset, so you must walk
+- * through the queue to unprep.
+- */
+- goto out;
+- }
+-
+- BUG_ON(!p ||
+- bioset_initialized(&md->bs) ||
+- bioset_initialized(&md->io_bs));
+-
+- ret = bioset_init_from_src(&md->bs, &p->bs);
+- if (ret)
+- goto out;
+- ret = bioset_init_from_src(&md->io_bs, &p->io_bs);
+- if (ret)
+- bioset_exit(&md->bs);
+-out:
+- /* mempool bind completed, no longer need any mempools in the table */
+- dm_table_free_md_mempools(t);
+- return ret;
+-}
+-
+ /*
+ * Bind a table to the device.
+ */
+@@ -2043,12 +1992,28 @@ static struct dm_table *__bind(struct ma
+ * immutable singletons - used to optimize dm_mq_queue_rq.
+ */
+ md->immutable_target = dm_table_get_immutable_target(t);
+- }
+
+- ret = __bind_mempools(md, t);
+- if (ret) {
+- old_map = ERR_PTR(ret);
+- goto out;
++ /*
++ * There is no need to reload with request-based dm because the
++ * size of front_pad doesn't change.
++ *
++ * Note for future: If you are to reload bioset, prep-ed
++ * requests in the queue may refer to bio from the old bioset,
++ * so you must walk through the queue to unprep.
++ */
++ if (!md->mempools) {
++ md->mempools = t->mempools;
++ t->mempools = NULL;
++ }
++ } else {
++ /*
++ * The md may already have mempools that need changing.
++ * If so, reload bioset because front_pad may have changed
++ * because a different table was loaded.
++ */
++ dm_free_md_mempools(md->mempools);
++ md->mempools = t->mempools;
++ t->mempools = NULL;
+ }
+
+ ret = dm_table_set_restrictions(t, md->queue, limits);
+--- a/drivers/md/dm.h
++++ b/drivers/md/dm.h
+@@ -71,8 +71,6 @@ struct dm_target *dm_table_get_immutable
+ struct dm_target *dm_table_get_wildcard_target(struct dm_table *t);
+ bool dm_table_bio_based(struct dm_table *t);
+ bool dm_table_request_based(struct dm_table *t);
+-void dm_table_free_md_mempools(struct dm_table *t);
+-struct dm_md_mempools *dm_table_get_md_mempools(struct dm_table *t);
+
+ void dm_lock_md_type(struct mapped_device *md);
+ void dm_unlock_md_type(struct mapped_device *md);
--- /dev/null
+From 2636e008112465ca54559ac4898da5a2515e118a Mon Sep 17 00:00:00 2001
+From: Jani Nikula <jani.nikula@intel.com>
+Date: Wed, 11 May 2022 12:46:19 +0300
+Subject: drm/i915/uc: remove accidental static from a local variable
+
+From: Jani Nikula <jani.nikula@intel.com>
+
+commit 2636e008112465ca54559ac4898da5a2515e118a upstream.
+
+The arrays are static const, but the pointer shouldn't be static.
+
+Fixes: 3d832f370d16 ("drm/i915/uc: Allow platforms to have GuC but not HuC")
+Cc: John Harrison <John.C.Harrison@Intel.com>
+Cc: Lucas De Marchi <lucas.demarchi@intel.com>
+Cc: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20220511094619.27889-1-jani.nikula@intel.com
+(cherry picked from commit 5821a0bbb4c39960975d29d6b58ae290088db0ed)
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/gt/uc/intel_uc_fw.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/gt/uc/intel_uc_fw.c
++++ b/drivers/gpu/drm/i915/gt/uc/intel_uc_fw.c
+@@ -154,7 +154,7 @@ __uc_fw_auto_select(struct drm_i915_priv
+ [INTEL_UC_FW_TYPE_GUC] = { blobs_guc, ARRAY_SIZE(blobs_guc) },
+ [INTEL_UC_FW_TYPE_HUC] = { blobs_huc, ARRAY_SIZE(blobs_huc) },
+ };
+- static const struct uc_fw_platform_requirement *fw_blobs;
++ const struct uc_fw_platform_requirement *fw_blobs;
+ enum intel_platform p = INTEL_INFO(i915)->platform;
+ u32 fw_count;
+ u8 rev = INTEL_REVID(i915);
--- /dev/null
+From 7e40381d8a33e41e347cea5bdd000091653000c6 Mon Sep 17 00:00:00 2001
+From: Mauro Carvalho Chehab <mchehab@kernel.org>
+Date: Mon, 6 Jun 2022 16:25:24 +0100
+Subject: dt-bindings: interrupt-controller: update brcm,l2-intc.yaml reference
+
+From: Mauro Carvalho Chehab <mchehab@kernel.org>
+
+commit 7e40381d8a33e41e347cea5bdd000091653000c6 upstream.
+
+Changeset 539d25b21fe8 ("dt-bindings: interrupt-controller: Convert Broadcom STB L2 to YAML")
+renamed: Documentation/devicetree/bindings/interrupt-controller/brcm,l2-intc.txt
+to: Documentation/devicetree/bindings/interrupt-controller/brcm,l2-intc.yaml.
+
+Update its cross-reference accordingly.
+
+Fixes: 539d25b21fe8 ("dt-bindings: interrupt-controller: Convert Broadcom STB L2 to YAML")
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Link: https://lore.kernel.org/r/a40c02a7aaea91ea7b6ce24b6bc574ae5bcf4cf6.1654529011.git.mchehab@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/devicetree/bindings/cpufreq/brcm,stb-avs-cpu-freq.txt | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/Documentation/devicetree/bindings/cpufreq/brcm,stb-avs-cpu-freq.txt
++++ b/Documentation/devicetree/bindings/cpufreq/brcm,stb-avs-cpu-freq.txt
+@@ -16,7 +16,7 @@ has been processed. See [2] for more inf
+ firmware. On some SoCs, this firmware supports DFS and DVFS in addition to
+ Adaptive Voltage Scaling.
+
+-[2] Documentation/devicetree/bindings/interrupt-controller/brcm,l2-intc.txt
++[2] Documentation/devicetree/bindings/interrupt-controller/brcm,l2-intc.yaml
+
+
+ Node brcm,avs-cpu-data-mem
--- /dev/null
+From e0b5c5984d4810733b7c24a3d16c904fffc086d2 Mon Sep 17 00:00:00 2001
+From: Mauro Carvalho Chehab <mchehab@kernel.org>
+Date: Mon, 6 Jun 2022 16:25:23 +0100
+Subject: dt-bindings: mfd: bd9571mwv: update rohm,bd9571mwv.yaml reference
+
+From: Mauro Carvalho Chehab <mchehab@kernel.org>
+
+commit e0b5c5984d4810733b7c24a3d16c904fffc086d2 upstream.
+
+Changeset 983b62975e90 ("dt-bindings: mfd: bd9571mwv: Convert to json-schema")
+renamed: Documentation/devicetree/bindings/mfd/bd9571mwv.txt
+to: Documentation/devicetree/bindings/mfd/rohm,bd9571mwv.yaml.
+
+Update its cross-reference accordingly.
+
+Fixes: 983b62975e90 ("dt-bindings: mfd: bd9571mwv: Convert to json-schema")
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Link: https://lore.kernel.org/r/1906a4d935eab57c10ce09358eae02175ce4abb7.1654529011.git.mchehab@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/ABI/testing/sysfs-driver-bd9571mwv-regulator | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Documentation/ABI/testing/sysfs-driver-bd9571mwv-regulator b/Documentation/ABI/testing/sysfs-driver-bd9571mwv-regulator
+index 42214b4ff14a..90596d8bb51c 100644
+--- a/Documentation/ABI/testing/sysfs-driver-bd9571mwv-regulator
++++ b/Documentation/ABI/testing/sysfs-driver-bd9571mwv-regulator
+@@ -26,6 +26,6 @@ Description: Read/write the current state of DDR Backup Mode, which controls
+ DDR Backup Mode must be explicitly enabled by the user,
+ to invoke step 1.
+
+- See also Documentation/devicetree/bindings/mfd/bd9571mwv.txt.
++ See also Documentation/devicetree/bindings/mfd/rohm,bd9571mwv.yaml.
+ Users: User space applications for embedded boards equipped with a
+ BD9571MWV PMIC.
+--
+2.36.1
+
--- /dev/null
+From 7ad4bd887d27c6b6ffbef216f19c19f8fe2b8f52 Mon Sep 17 00:00:00 2001
+From: Masahiro Yamada <masahiroy@kernel.org>
+Date: Sat, 4 Jun 2022 17:50:50 +0900
+Subject: powerpc/book3e: get rid of #include <generated/compile.h>
+
+From: Masahiro Yamada <masahiroy@kernel.org>
+
+commit 7ad4bd887d27c6b6ffbef216f19c19f8fe2b8f52 upstream.
+
+You cannot include <generated/compile.h> here because it is generated
+in init/Makefile but there is no guarantee that it happens before
+arch/powerpc/mm/nohash/kaslr_booke.c is compiled for parallel builds.
+
+The places where you can reliably include <generated/compile.h> are:
+
+ - init/ (because init/Makefile can specify the dependency)
+ - arch/*/boot/ (because it is compiled after vmlinux)
+
+Commit f231e4333312 ("hexagon: get rid of #include <generated/compile.h>")
+fixed the last breakage at that time, but powerpc re-added this.
+
+<generated/compile.h> was unneeded because 'build_str' is almost the
+same as 'linux_banner' defined in init/version.c
+
+Let's copy the solution from MIPS.
+(get_random_boot() in arch/mips/kernel/relocate.c)
+
+Fixes: 6a38ea1d7b94 ("powerpc/fsl_booke/32: randomize the kernel image offset")
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Acked-by: Scott Wood <oss@buserror.net>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20220604085050.4078927-1-masahiroy@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/mm/nohash/kaslr_booke.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+--- a/arch/powerpc/mm/nohash/kaslr_booke.c
++++ b/arch/powerpc/mm/nohash/kaslr_booke.c
+@@ -18,7 +18,6 @@
+ #include <asm/prom.h>
+ #include <asm/kdump.h>
+ #include <mm/mmu_decl.h>
+-#include <generated/compile.h>
+ #include <generated/utsrelease.h>
+
+ struct regions {
+@@ -36,10 +35,6 @@ struct regions {
+ int reserved_mem_size_cells;
+ };
+
+-/* Simplified build-specific string for starting entropy. */
+-static const char build_str[] = UTS_RELEASE " (" LINUX_COMPILE_BY "@"
+- LINUX_COMPILE_HOST ") (" LINUX_COMPILER ") " UTS_VERSION;
+-
+ struct regions __initdata regions;
+
+ static __init void kaslr_get_cmdline(void *fdt)
+@@ -70,7 +65,8 @@ static unsigned long __init get_boot_see
+ {
+ unsigned long hash = 0;
+
+- hash = rotate_xor(hash, build_str, sizeof(build_str));
++ /* build-specific string for starting entropy. */
++ hash = rotate_xor(hash, linux_banner, strlen(linux_banner));
+ hash = rotate_xor(hash, fdt, fdt_totalsize(fdt));
+
+ return hash;
kvm-arm64-don-t-read-a-hw-interrupt-pending-state-in-user-context.patch
virtio-pci-remove-wrong-address-verification-in-vp_del_vqs.patch
netfs-fix-gcc-12-warning-by-embedding-vfs-inode-in-netfs_i_context.patch
+drm-i915-uc-remove-accidental-static-from-a-local-variable.patch
+bpf-use-safer-kvmalloc_array-where-possible.patch
+powerpc-book3e-get-rid-of-include-generated-compile.h.patch
+dt-bindings-mfd-bd9571mwv-update-rohm-bd9571mwv.yaml-reference.patch
+dt-bindings-interrupt-controller-update-brcm-l2-intc.yaml-reference.patch
+dm-fix-bio_set-allocation.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
