5.15-stable patches

added patches:
	irqchip-gic-v3-its-fix-potential-race-condition-in-its_vlpi_prop_update.patch
	null_blk-print-correct-max-open-zones-limit-in-null_init_zoned_dev.patch
	tracing-selftests-fix-kprobe-event-name-test-for-.isra.-functions.patch

diff --git a/queue-5.15/irqchip-gic-v3-its-fix-potential-race-condition-in-its_vlpi_prop_update.patch b/queue-5.15/irqchip-gic-v3-its-fix-potential-race-condition-in-its_vlpi_prop_update.patch
new file mode 100644 (file)
index 0000000..ba46958
--- /dev/null
+++ b/queue-5.15/irqchip-gic-v3-its-fix-potential-race-condition-in-its_vlpi_prop_update.patch
@@ -0,0 +1,141 @@
+From b97e8a2f7130a4b30d1502003095833d16c028b3 Mon Sep 17 00:00:00 2001
+From: Hagar Hemdan <hagarhem@amazon.com>
+Date: Fri, 31 May 2024 16:21:44 +0000
+Subject: irqchip/gic-v3-its: Fix potential race condition in its_vlpi_prop_update()
+
+From: Hagar Hemdan <hagarhem@amazon.com>
+
+commit b97e8a2f7130a4b30d1502003095833d16c028b3 upstream.
+
+its_vlpi_prop_update() calls lpi_write_config() which obtains the
+mapping information for a VLPI without lock held. So it could race
+with its_vlpi_unmap().
+
+Since all calls from its_irq_set_vcpu_affinity() require the same
+lock to be held, hoist the locking there instead of sprinkling the
+locking all over the place.
+
+This bug was discovered using Coverity Static Analysis Security Testing
+(SAST) by Synopsys, Inc.
+
+[ tglx: Use guard() instead of goto ]
+
+Fixes: 015ec0386ab6 ("irqchip/gic-v3-its: Add VLPI configuration handling")
+Suggested-by: Marc Zyngier <maz@kernel.org>
+Signed-off-by: Hagar Hemdan <hagarhem@amazon.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: stable@vger.kernel.org
+Reviewed-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20240531162144.28650-1-hagarhem@amazon.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/irqchip/irq-gic-v3-its.c |   44 ++++++++++-----------------------------
+ 1 file changed, 12 insertions(+), 32 deletions(-)
+
+--- a/drivers/irqchip/irq-gic-v3-its.c
++++ b/drivers/irqchip/irq-gic-v3-its.c
+@@ -1831,28 +1831,22 @@ static int its_vlpi_map(struct irq_data
+ {
+       struct its_device *its_dev = irq_data_get_irq_chip_data(d);
+       u32 event = its_get_event_id(d);
+-      int ret = 0;
+ 
+       if (!info->map)
+               return -EINVAL;
+ 
+-      raw_spin_lock(&its_dev->event_map.vlpi_lock);
+-
+       if (!its_dev->event_map.vm) {
+               struct its_vlpi_map *maps;
+ 
+               maps = kcalloc(its_dev->event_map.nr_lpis, sizeof(*maps),
+                              GFP_ATOMIC);
+-              if (!maps) {
+-                      ret = -ENOMEM;
+-                      goto out;
+-              }
++              if (!maps)
++                      return -ENOMEM;
+ 
+               its_dev->event_map.vm = info->map->vm;
+               its_dev->event_map.vlpi_maps = maps;
+       } else if (its_dev->event_map.vm != info->map->vm) {
+-              ret = -EINVAL;
+-              goto out;
++              return -EINVAL;
+       }
+ 
+       /* Get our private copy of the mapping information */
+@@ -1884,46 +1878,32 @@ static int its_vlpi_map(struct irq_data
+               its_dev->event_map.nr_vlpis++;
+       }
+ 
+-out:
+-      raw_spin_unlock(&its_dev->event_map.vlpi_lock);
+-      return ret;
++      return 0;
+ }
+ 
+ static int its_vlpi_get(struct irq_data *d, struct its_cmd_info *info)
+ {
+       struct its_device *its_dev = irq_data_get_irq_chip_data(d);
+       struct its_vlpi_map *map;
+-      int ret = 0;
+-
+-      raw_spin_lock(&its_dev->event_map.vlpi_lock);
+ 
+       map = get_vlpi_map(d);
+ 
+-      if (!its_dev->event_map.vm || !map) {
+-              ret = -EINVAL;
+-              goto out;
+-      }
++      if (!its_dev->event_map.vm || !map)
++              return -EINVAL;
+ 
+       /* Copy our mapping information to the incoming request */
+       *info->map = *map;
+ 
+-out:
+-      raw_spin_unlock(&its_dev->event_map.vlpi_lock);
+-      return ret;
++      return 0;
+ }
+ 
+ static int its_vlpi_unmap(struct irq_data *d)
+ {
+       struct its_device *its_dev = irq_data_get_irq_chip_data(d);
+       u32 event = its_get_event_id(d);
+-      int ret = 0;
+ 
+-      raw_spin_lock(&its_dev->event_map.vlpi_lock);
+-
+-      if (!its_dev->event_map.vm || !irqd_is_forwarded_to_vcpu(d)) {
+-              ret = -EINVAL;
+-              goto out;
+-      }
++      if (!its_dev->event_map.vm || !irqd_is_forwarded_to_vcpu(d))
++              return -EINVAL;
+ 
+       /* Drop the virtual mapping */
+       its_send_discard(its_dev, event);
+@@ -1947,9 +1927,7 @@ static int its_vlpi_unmap(struct irq_dat
+               kfree(its_dev->event_map.vlpi_maps);
+       }
+ 
+-out:
+-      raw_spin_unlock(&its_dev->event_map.vlpi_lock);
+-      return ret;
++      return 0;
+ }
+ 
+ static int its_vlpi_prop_update(struct irq_data *d, struct its_cmd_info *info)
+@@ -1977,6 +1955,8 @@ static int its_irq_set_vcpu_affinity(str
+       if (!is_v4(its_dev->its))
+               return -EINVAL;
+ 
++      guard(raw_spinlock_irq)(&its_dev->event_map.vlpi_lock);
++
+       /* Unmap request? */
+       if (!info)
+               return its_vlpi_unmap(d);

diff --git a/queue-5.15/null_blk-print-correct-max-open-zones-limit-in-null_init_zoned_dev.patch b/queue-5.15/null_blk-print-correct-max-open-zones-limit-in-null_init_zoned_dev.patch
new file mode 100644 (file)
index 0000000..ea9c53f
--- /dev/null
+++ b/queue-5.15/null_blk-print-correct-max-open-zones-limit-in-null_init_zoned_dev.patch
@@ -0,0 +1,34 @@
+From 233e27b4d21c3e44eb863f03e566d3a22e81a7ae Mon Sep 17 00:00:00 2001
+From: Damien Le Moal <dlemoal@kernel.org>
+Date: Tue, 28 May 2024 15:28:52 +0900
+Subject: null_blk: Print correct max open zones limit in null_init_zoned_dev()
+
+From: Damien Le Moal <dlemoal@kernel.org>
+
+commit 233e27b4d21c3e44eb863f03e566d3a22e81a7ae upstream.
+
+When changing the maximum number of open zones, print that number
+instead of the total number of zones.
+
+Fixes: dc4d137ee3b7 ("null_blk: add support for max open/active zone limit for zoned devices")
+Cc: stable@vger.kernel.org
+Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
+Reviewed-by: Niklas Cassel <cassel@kernel.org>
+Link: https://lore.kernel.org/r/20240528062852.437599-1-dlemoal@kernel.org
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/block/null_blk/zoned.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/block/null_blk/zoned.c
++++ b/drivers/block/null_blk/zoned.c
+@@ -109,7 +109,7 @@ int null_init_zoned_dev(struct nullb_dev
+       if (dev->zone_max_active && dev->zone_max_open > dev->zone_max_active) {
+               dev->zone_max_open = dev->zone_max_active;
+               pr_info("changed the maximum number of open zones to %u\n",
+-                      dev->nr_zones);
++                      dev->zone_max_open);
+       } else if (dev->zone_max_open >= dev->nr_zones - dev->zone_nr_conv) {
+               dev->zone_max_open = 0;
+               pr_info("zone_max_open limit disabled, limit >= zone count\n");

diff --git a/queue-5.15/series b/queue-5.15/series
index cce32c8f8c47e2d8633c7531f6540a84baeadc6d..883230c43e885e79e4ec9aa55446c5e7fcf615ce 100644 (file)
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@ -142,3 +142,6 @@ x86-mm-numa-use-numa_no_node-when-calling-memblock_set_node.patch
 drm-exynos-vidi-fix-memory-leak-in-.get_modes.patch
 drm-exynos-hdmi-report-safe-640x480-mode-as-a-fallback-when-no-edid-found.patch
 mptcp-ensure-snd_una-is-properly-initialized-on-connect.patch
+irqchip-gic-v3-its-fix-potential-race-condition-in-its_vlpi_prop_update.patch
+tracing-selftests-fix-kprobe-event-name-test-for-.isra.-functions.patch
+null_blk-print-correct-max-open-zones-limit-in-null_init_zoned_dev.patch

diff --git a/queue-5.15/tracing-selftests-fix-kprobe-event-name-test-for-.isra.-functions.patch b/queue-5.15/tracing-selftests-fix-kprobe-event-name-test-for-.isra.-functions.patch
new file mode 100644 (file)
index 0000000..18c3db0
--- /dev/null
+++ b/queue-5.15/tracing-selftests-fix-kprobe-event-name-test-for-.isra.-functions.patch
@@ -0,0 +1,50 @@
+From 23a4b108accc29a6125ed14de4a044689ffeda78 Mon Sep 17 00:00:00 2001
+From: "Steven Rostedt (Google)" <rostedt@goodmis.org>
+Date: Mon, 20 May 2024 20:57:37 -0400
+Subject: tracing/selftests: Fix kprobe event name test for .isra. functions
+
+From: Steven Rostedt (Google) <rostedt@goodmis.org>
+
+commit 23a4b108accc29a6125ed14de4a044689ffeda78 upstream.
+
+The kprobe_eventname.tc test checks if a function with .isra. can have a
+kprobe attached to it. It loops through the kallsyms file for all the
+functions that have the .isra. name, and checks if it exists in the
+available_filter_functions file, and if it does, it uses it to attach a
+kprobe to it.
+
+The issue is that kprobes can not attach to functions that are listed more
+than once in available_filter_functions. With the latest kernel, the
+function that is found is: rapl_event_update.isra.0
+
+  # grep rapl_event_update.isra.0 /sys/kernel/tracing/available_filter_functions
+  rapl_event_update.isra.0
+  rapl_event_update.isra.0
+
+It is listed twice. This causes the attached kprobe to it to fail which in
+turn fails the test. Instead of just picking the function function that is
+found in available_filter_functions, pick the first one that is listed
+only once in available_filter_functions.
+
+Cc: stable@vger.kernel.org
+Fixes: 604e3548236d ("selftests/ftrace: Select an existing function in kprobe_eventname test")
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/ftrace/test.d/kprobe/kprobe_eventname.tc |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_eventname.tc
++++ b/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_eventname.tc
+@@ -30,7 +30,8 @@ find_dot_func() {
+       fi
+ 
+       grep " [tT] .*\.isra\..*" /proc/kallsyms | cut -f 3 -d " " | while read f; do
+-              if grep -s $f available_filter_functions; then
++              cnt=`grep -s $f available_filter_functions | wc -l`;
++              if [ $cnt -eq 1 ]; then
+                       echo $f
+                       break
+               fi