]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
Fixes for 4.14
authorSasha Levin <sashal@kernel.org>
Thu, 27 Oct 2022 01:36:34 +0000 (21:36 -0400)
committerSasha Levin <sashal@kernel.org>
Thu, 27 Oct 2022 01:36:34 +0000 (21:36 -0400)
Signed-off-by: Sasha Levin <sashal@kernel.org>
queue-4.14/acpi-extlog-handle-multiple-records.patch [new file with mode: 0644]
queue-4.14/btrfs-fix-processing-of-delayed-data-refs-during-bac.patch [new file with mode: 0644]
queue-4.14/hid-magicmouse-do-not-set-btn_mouse-on-double-report.patch [new file with mode: 0644]
queue-4.14/iommu-vt-d-clean-up-si_domain-in-the-init_dmars-erro.patch [new file with mode: 0644]
queue-4.14/net-atm-fix-proc_mpc_write-incorrect-return-value.patch [new file with mode: 0644]
queue-4.14/net-hns-fix-possible-memory-leak-in-hnae_ae_register.patch [new file with mode: 0644]
queue-4.14/series

diff --git a/queue-4.14/acpi-extlog-handle-multiple-records.patch b/queue-4.14/acpi-extlog-handle-multiple-records.patch
new file mode 100644 (file)
index 0000000..39f7384
--- /dev/null
@@ -0,0 +1,93 @@
+From 4cb56b89e9d9c62bdc21c16b6bb59befd216d298 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Oct 2022 13:34:23 -0700
+Subject: ACPI: extlog: Handle multiple records
+
+From: Tony Luck <tony.luck@intel.com>
+
+[ Upstream commit f6ec01da40e4139b41179f046044ee7c4f6370dc ]
+
+If there is no user space consumer of extlog_mem trace records, then
+Linux properly handles multiple error records in an ELOG block
+
+       extlog_print()
+         print_extlog_rcd()
+           __print_extlog_rcd()
+             cper_estatus_print()
+               apei_estatus_for_each_section()
+
+But the other code path hard codes looking for a single record to
+output a trace record.
+
+Fix by using the same apei_estatus_for_each_section() iterator
+to step over all records.
+
+Fixes: 2dfb7d51a61d ("trace, RAS: Add eMCA trace event interface")
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpi_extlog.c | 33 ++++++++++++++++++++-------------
+ 1 file changed, 20 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/acpi/acpi_extlog.c b/drivers/acpi/acpi_extlog.c
+index 943b1dc2d0b3..e05309bc41cc 100644
+--- a/drivers/acpi/acpi_extlog.c
++++ b/drivers/acpi/acpi_extlog.c
+@@ -13,6 +13,7 @@
+ #include <linux/ratelimit.h>
+ #include <linux/edac.h>
+ #include <linux/ras.h>
++#include <acpi/ghes.h>
+ #include <asm/cpu.h>
+ #include <asm/mce.h>
+@@ -141,8 +142,8 @@ static int extlog_print(struct notifier_block *nb, unsigned long val,
+       int     cpu = mce->extcpu;
+       struct acpi_hest_generic_status *estatus, *tmp;
+       struct acpi_hest_generic_data *gdata;
+-      const guid_t *fru_id = &guid_null;
+-      char *fru_text = "";
++      const guid_t *fru_id;
++      char *fru_text;
+       guid_t *sec_type;
+       static u32 err_seq;
+@@ -163,17 +164,23 @@ static int extlog_print(struct notifier_block *nb, unsigned long val,
+       /* log event via trace */
+       err_seq++;
+-      gdata = (struct acpi_hest_generic_data *)(tmp + 1);
+-      if (gdata->validation_bits & CPER_SEC_VALID_FRU_ID)
+-              fru_id = (guid_t *)gdata->fru_id;
+-      if (gdata->validation_bits & CPER_SEC_VALID_FRU_TEXT)
+-              fru_text = gdata->fru_text;
+-      sec_type = (guid_t *)gdata->section_type;
+-      if (guid_equal(sec_type, &CPER_SEC_PLATFORM_MEM)) {
+-              struct cper_sec_mem_err *mem = (void *)(gdata + 1);
+-              if (gdata->error_data_length >= sizeof(*mem))
+-                      trace_extlog_mem_event(mem, err_seq, fru_id, fru_text,
+-                                             (u8)gdata->error_severity);
++      apei_estatus_for_each_section(tmp, gdata) {
++              if (gdata->validation_bits & CPER_SEC_VALID_FRU_ID)
++                      fru_id = (guid_t *)gdata->fru_id;
++              else
++                      fru_id = &guid_null;
++              if (gdata->validation_bits & CPER_SEC_VALID_FRU_TEXT)
++                      fru_text = gdata->fru_text;
++              else
++                      fru_text = "";
++              sec_type = (guid_t *)gdata->section_type;
++              if (guid_equal(sec_type, &CPER_SEC_PLATFORM_MEM)) {
++                      struct cper_sec_mem_err *mem = (void *)(gdata + 1);
++
++                      if (gdata->error_data_length >= sizeof(*mem))
++                              trace_extlog_mem_event(mem, err_seq, fru_id, fru_text,
++                                                     (u8)gdata->error_severity);
++              }
+       }
+ out:
+-- 
+2.35.1
+
diff --git a/queue-4.14/btrfs-fix-processing-of-delayed-data-refs-during-bac.patch b/queue-4.14/btrfs-fix-processing-of-delayed-data-refs-during-bac.patch
new file mode 100644 (file)
index 0000000..ec580d5
--- /dev/null
@@ -0,0 +1,249 @@
+From a202cf47343a478105f3879ceb507e5e3e0b1f78 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Oct 2022 13:16:51 +0100
+Subject: btrfs: fix processing of delayed data refs during backref walking
+
+From: Filipe Manana <fdmanana@suse.com>
+
+[ Upstream commit 4fc7b57228243d09c0d878873bf24fa64a90fa01 ]
+
+When processing delayed data references during backref walking and we are
+using a share context (we are being called through fiemap), whenever we
+find a delayed data reference for an inode different from the one we are
+interested in, then we immediately exit and consider the data extent as
+shared. This is wrong, because:
+
+1) This might be a DROP reference that will cancel out a reference in the
+   extent tree;
+
+2) Even if it's an ADD reference, it may be followed by a DROP reference
+   that cancels it out.
+
+In either case we should not exit immediately.
+
+Fix this by never exiting when we find a delayed data reference for
+another inode - instead add the reference and if it does not cancel out
+other delayed reference, we will exit early when we call
+extent_is_shared() after processing all delayed references. If we find
+a drop reference, then signal the code that processes references from
+the extent tree (add_inline_refs() and add_keyed_refs()) to not exit
+immediately if it finds there a reference for another inode, since we
+have delayed drop references that may cancel it out. In this later case
+we exit once we don't have references in the rb trees that cancel out
+each other and have two references for different inodes.
+
+Example reproducer for case 1):
+
+   $ cat test-1.sh
+   #!/bin/bash
+
+   DEV=/dev/sdj
+   MNT=/mnt/sdj
+
+   mkfs.btrfs -f $DEV
+   mount $DEV $MNT
+
+   xfs_io -f -c "pwrite 0 64K" $MNT/foo
+   cp --reflink=always $MNT/foo $MNT/bar
+
+   echo
+   echo "fiemap after cloning:"
+   xfs_io -c "fiemap -v" $MNT/foo
+
+   rm -f $MNT/bar
+   echo
+   echo "fiemap after removing file bar:"
+   xfs_io -c "fiemap -v" $MNT/foo
+
+   umount $MNT
+
+Running it before this patch, the extent is still listed as shared, it has
+the flag 0x2000 (FIEMAP_EXTENT_SHARED) set:
+
+   $ ./test-1.sh
+   fiemap after cloning:
+   /mnt/sdj/foo:
+    EXT: FILE-OFFSET      BLOCK-RANGE      TOTAL FLAGS
+      0: [0..127]:        26624..26751       128 0x2001
+
+   fiemap after removing file bar:
+   /mnt/sdj/foo:
+    EXT: FILE-OFFSET      BLOCK-RANGE      TOTAL FLAGS
+      0: [0..127]:        26624..26751       128 0x2001
+
+Example reproducer for case 2):
+
+   $ cat test-2.sh
+   #!/bin/bash
+
+   DEV=/dev/sdj
+   MNT=/mnt/sdj
+
+   mkfs.btrfs -f $DEV
+   mount $DEV $MNT
+
+   xfs_io -f -c "pwrite 0 64K" $MNT/foo
+   cp --reflink=always $MNT/foo $MNT/bar
+
+   # Flush delayed references to the extent tree and commit current
+   # transaction.
+   sync
+
+   echo
+   echo "fiemap after cloning:"
+   xfs_io -c "fiemap -v" $MNT/foo
+
+   rm -f $MNT/bar
+   echo
+   echo "fiemap after removing file bar:"
+   xfs_io -c "fiemap -v" $MNT/foo
+
+   umount $MNT
+
+Running it before this patch, the extent is still listed as shared, it has
+the flag 0x2000 (FIEMAP_EXTENT_SHARED) set:
+
+   $ ./test-2.sh
+   fiemap after cloning:
+   /mnt/sdj/foo:
+    EXT: FILE-OFFSET      BLOCK-RANGE      TOTAL FLAGS
+      0: [0..127]:        26624..26751       128 0x2001
+
+   fiemap after removing file bar:
+   /mnt/sdj/foo:
+    EXT: FILE-OFFSET      BLOCK-RANGE      TOTAL FLAGS
+      0: [0..127]:        26624..26751       128 0x2001
+
+After this patch, after deleting bar in both tests, the extent is not
+reported with the 0x2000 flag anymore, it gets only the flag 0x1
+(which is FIEMAP_EXTENT_LAST):
+
+   $ ./test-1.sh
+   fiemap after cloning:
+   /mnt/sdj/foo:
+    EXT: FILE-OFFSET      BLOCK-RANGE      TOTAL FLAGS
+      0: [0..127]:        26624..26751       128 0x2001
+
+   fiemap after removing file bar:
+   /mnt/sdj/foo:
+    EXT: FILE-OFFSET      BLOCK-RANGE      TOTAL FLAGS
+      0: [0..127]:        26624..26751       128   0x1
+
+   $ ./test-2.sh
+   fiemap after cloning:
+   /mnt/sdj/foo:
+    EXT: FILE-OFFSET      BLOCK-RANGE      TOTAL FLAGS
+      0: [0..127]:        26624..26751       128 0x2001
+
+   fiemap after removing file bar:
+   /mnt/sdj/foo:
+    EXT: FILE-OFFSET      BLOCK-RANGE      TOTAL FLAGS
+      0: [0..127]:        26624..26751       128   0x1
+
+These tests will later be converted to a test case for fstests.
+
+Fixes: dc046b10c8b7d4 ("Btrfs: make fiemap not blow when you have lots of snapshots")
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/backref.c | 33 ++++++++++++++++++++++++---------
+ 1 file changed, 24 insertions(+), 9 deletions(-)
+
+diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
+index 58dc96d7ecaf..93cfbdada40f 100644
+--- a/fs/btrfs/backref.c
++++ b/fs/btrfs/backref.c
+@@ -146,6 +146,7 @@ struct share_check {
+       u64 root_objectid;
+       u64 inum;
+       int share_count;
++      bool have_delayed_delete_refs;
+ };
+ static inline int extent_is_shared(struct share_check *sc)
+@@ -832,13 +833,22 @@ static int add_delayed_refs(const struct btrfs_fs_info *fs_info,
+                       key.offset = ref->offset;
+                       /*
+-                       * Found a inum that doesn't match our known inum, we
+-                       * know it's shared.
++                       * If we have a share check context and a reference for
++                       * another inode, we can't exit immediately. This is
++                       * because even if this is a BTRFS_ADD_DELAYED_REF
++                       * reference we may find next a BTRFS_DROP_DELAYED_REF
++                       * which cancels out this ADD reference.
++                       *
++                       * If this is a DROP reference and there was no previous
++                       * ADD reference, then we need to signal that when we
++                       * process references from the extent tree (through
++                       * add_inline_refs() and add_keyed_refs()), we should
++                       * not exit early if we find a reference for another
++                       * inode, because one of the delayed DROP references
++                       * may cancel that reference in the extent tree.
+                        */
+-                      if (sc && sc->inum && ref->objectid != sc->inum) {
+-                              ret = BACKREF_FOUND_SHARED;
+-                              goto out;
+-                      }
++                      if (sc && count < 0)
++                              sc->have_delayed_delete_refs = true;
+                       ret = add_indirect_ref(fs_info, preftrees, ref->root,
+                                              &key, 0, node->bytenr, count, sc,
+@@ -868,7 +878,7 @@ static int add_delayed_refs(const struct btrfs_fs_info *fs_info,
+       }
+       if (!ret)
+               ret = extent_is_shared(sc);
+-out:
++
+       spin_unlock(&head->lock);
+       return ret;
+ }
+@@ -972,7 +982,8 @@ static int add_inline_refs(const struct btrfs_fs_info *fs_info,
+                       key.type = BTRFS_EXTENT_DATA_KEY;
+                       key.offset = btrfs_extent_data_ref_offset(leaf, dref);
+-                      if (sc && sc->inum && key.objectid != sc->inum) {
++                      if (sc && sc->inum && key.objectid != sc->inum &&
++                          !sc->have_delayed_delete_refs) {
+                               ret = BACKREF_FOUND_SHARED;
+                               break;
+                       }
+@@ -982,6 +993,7 @@ static int add_inline_refs(const struct btrfs_fs_info *fs_info,
+                       ret = add_indirect_ref(fs_info, preftrees, root,
+                                              &key, 0, bytenr, count,
+                                              sc, GFP_NOFS);
++
+                       break;
+               }
+               default:
+@@ -1071,7 +1083,8 @@ static int add_keyed_refs(struct btrfs_fs_info *fs_info,
+                       key.type = BTRFS_EXTENT_DATA_KEY;
+                       key.offset = btrfs_extent_data_ref_offset(leaf, dref);
+-                      if (sc && sc->inum && key.objectid != sc->inum) {
++                      if (sc && sc->inum && key.objectid != sc->inum &&
++                          !sc->have_delayed_delete_refs) {
+                               ret = BACKREF_FOUND_SHARED;
+                               break;
+                       }
+@@ -1490,6 +1503,7 @@ int btrfs_check_shared(struct btrfs_root *root, u64 inum, u64 bytenr)
+               .root_objectid = root->objectid,
+               .inum = inum,
+               .share_count = 0,
++              .have_delayed_delete_refs = false,
+       };
+       tmp = ulist_alloc(GFP_NOFS);
+@@ -1528,6 +1542,7 @@ int btrfs_check_shared(struct btrfs_root *root, u64 inum, u64 bytenr)
+                       break;
+               bytenr = node->val;
+               shared.share_count = 0;
++              shared.have_delayed_delete_refs = false;
+               cond_resched();
+       }
+-- 
+2.35.1
+
diff --git a/queue-4.14/hid-magicmouse-do-not-set-btn_mouse-on-double-report.patch b/queue-4.14/hid-magicmouse-do-not-set-btn_mouse-on-double-report.patch
new file mode 100644 (file)
index 0000000..12a27af
--- /dev/null
@@ -0,0 +1,48 @@
+From 72117331aa82f5d15fdf7b00f45ca0956355e288 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 9 Oct 2022 20:27:47 +0200
+Subject: HID: magicmouse: Do not set BTN_MOUSE on double report
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: José Expósito <jose.exposito89@gmail.com>
+
+[ Upstream commit bb5f0c855dcfc893ae5ed90e4c646bde9e4498bf ]
+
+Under certain conditions the Magic Trackpad can group 2 reports in a
+single packet. The packet is split and the raw event function is
+invoked recursively for each part.
+
+However, after processing each part, the BTN_MOUSE status is updated,
+sending multiple click events. [1]
+
+Return after processing double reports to avoid this issue.
+
+Link: https://gitlab.freedesktop.org/libinput/libinput/-/issues/811  # [1]
+Fixes: a462230e16ac ("HID: magicmouse: enable Magic Trackpad support")
+Reported-by: Nulo <git@nulo.in>
+Signed-off-by: José Expósito <jose.exposito89@gmail.com>
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Link: https://lore.kernel.org/r/20221009182747.90730-1-jose.exposito89@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-magicmouse.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c
+index 8c993f95e3ba..396a3c720b51 100644
+--- a/drivers/hid/hid-magicmouse.c
++++ b/drivers/hid/hid-magicmouse.c
+@@ -342,7 +342,7 @@ static int magicmouse_raw_event(struct hid_device *hdev,
+               magicmouse_raw_event(hdev, report, data + 2, data[1]);
+               magicmouse_raw_event(hdev, report, data + 2 + data[1],
+                       size - 2 - data[1]);
+-              break;
++              return 0;
+       default:
+               return 0;
+       }
+-- 
+2.35.1
+
diff --git a/queue-4.14/iommu-vt-d-clean-up-si_domain-in-the-init_dmars-erro.patch b/queue-4.14/iommu-vt-d-clean-up-si_domain-in-the-init_dmars-erro.patch
new file mode 100644 (file)
index 0000000..9dc562b
--- /dev/null
@@ -0,0 +1,56 @@
+From efdbf926df02036619010dfc5f370728c59f651d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Oct 2022 08:44:47 +0800
+Subject: iommu/vt-d: Clean up si_domain in the init_dmars() error path
+
+From: Jerry Snitselaar <jsnitsel@redhat.com>
+
+[ Upstream commit 620bf9f981365c18cc2766c53d92bf8131c63f32 ]
+
+A splat from kmem_cache_destroy() was seen with a kernel prior to
+commit ee2653bbe89d ("iommu/vt-d: Remove domain and devinfo mempool")
+when there was a failure in init_dmars(), because the iommu_domain
+cache still had objects. While the mempool code is now gone, there
+still is a leak of the si_domain memory if init_dmars() fails. So
+clean up si_domain in the init_dmars() error path.
+
+Cc: Lu Baolu <baolu.lu@linux.intel.com>
+Cc: Joerg Roedel <joro@8bytes.org>
+Cc: Will Deacon <will@kernel.org>
+Cc: Robin Murphy <robin.murphy@arm.com>
+Fixes: 86080ccc223a ("iommu/vt-d: Allocate si_domain in init_dmars()")
+Signed-off-by: Jerry Snitselaar <jsnitsel@redhat.com>
+Link: https://lore.kernel.org/r/20221010144842.308890-1-jsnitsel@redhat.com
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel-iommu.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index 74bfd7d29338..a04d4664edb4 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -2785,6 +2785,7 @@ static int __init si_domain_init(int hw)
+       if (md_domain_init(si_domain, DEFAULT_DOMAIN_ADDRESS_WIDTH)) {
+               domain_exit(si_domain);
++              si_domain = NULL;
+               return -EFAULT;
+       }
+@@ -3475,6 +3476,10 @@ static int __init init_dmars(void)
+               disable_dmar_iommu(iommu);
+               free_dmar_iommu(iommu);
+       }
++      if (si_domain) {
++              domain_exit(si_domain);
++              si_domain = NULL;
++      }
+       kfree(g_iommus);
+-- 
+2.35.1
+
diff --git a/queue-4.14/net-atm-fix-proc_mpc_write-incorrect-return-value.patch b/queue-4.14/net-atm-fix-proc_mpc_write-incorrect-return-value.patch
new file mode 100644 (file)
index 0000000..f04a6ae
--- /dev/null
@@ -0,0 +1,41 @@
+From 250d42f30b0d00edfba8d006684860f3573661b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Oct 2022 10:05:40 +0800
+Subject: net/atm: fix proc_mpc_write incorrect return value
+
+From: Xiaobo Liu <cppcoffee@gmail.com>
+
+[ Upstream commit d8bde3bf7f82dac5fc68a62c2816793a12cafa2a ]
+
+Then the input contains '\0' or '\n', proc_mpc_write has read them,
+so the return value needs +1.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Xiaobo Liu <cppcoffee@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/atm/mpoa_proc.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/atm/mpoa_proc.c b/net/atm/mpoa_proc.c
+index 8a0c17e1c203..4d5f8690e914 100644
+--- a/net/atm/mpoa_proc.c
++++ b/net/atm/mpoa_proc.c
+@@ -220,11 +220,12 @@ static ssize_t proc_mpc_write(struct file *file, const char __user *buff,
+       if (!page)
+               return -ENOMEM;
+-      for (p = page, len = 0; len < nbytes; p++, len++) {
++      for (p = page, len = 0; len < nbytes; p++) {
+               if (get_user(*p, buff++)) {
+                       free_page((unsigned long)page);
+                       return -EFAULT;
+               }
++              len += 1;
+               if (*p == '\0' || *p == '\n')
+                       break;
+       }
+-- 
+2.35.1
+
diff --git a/queue-4.14/net-hns-fix-possible-memory-leak-in-hnae_ae_register.patch b/queue-4.14/net-hns-fix-possible-memory-leak-in-hnae_ae_register.patch
new file mode 100644 (file)
index 0000000..44d0787
--- /dev/null
@@ -0,0 +1,61 @@
+From eef7d954dcb95956a55709d6d83fcfd8d51700af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Oct 2022 20:24:51 +0800
+Subject: net: hns: fix possible memory leak in hnae_ae_register()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit ff2f5ec5d009844ec28f171123f9e58750cef4bf ]
+
+Inject fault while probing module, if device_register() fails,
+but the refcount of kobject is not decreased to 0, the name
+allocated in dev_set_name() is leaked. Fix this by calling
+put_device(), so that name can be freed in callback function
+kobject_cleanup().
+
+unreferenced object 0xffff00c01aba2100 (size 128):
+  comm "systemd-udevd", pid 1259, jiffies 4294903284 (age 294.152s)
+  hex dump (first 32 bytes):
+    68 6e 61 65 30 00 00 00 18 21 ba 1a c0 00 ff ff  hnae0....!......
+    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
+  backtrace:
+    [<0000000034783f26>] slab_post_alloc_hook+0xa0/0x3e0
+    [<00000000748188f2>] __kmem_cache_alloc_node+0x164/0x2b0
+    [<00000000ab0743e8>] __kmalloc_node_track_caller+0x6c/0x390
+    [<000000006c0ffb13>] kvasprintf+0x8c/0x118
+    [<00000000fa27bfe1>] kvasprintf_const+0x60/0xc8
+    [<0000000083e10ed7>] kobject_set_name_vargs+0x3c/0xc0
+    [<000000000b87affc>] dev_set_name+0x7c/0xa0
+    [<000000003fd8fe26>] hnae_ae_register+0xcc/0x190 [hnae]
+    [<00000000fe97edc9>] hns_dsaf_ae_init+0x9c/0x108 [hns_dsaf]
+    [<00000000c36ff1eb>] hns_dsaf_probe+0x548/0x748 [hns_dsaf]
+
+Fixes: 6fe6611ff275 ("net: add Hisilicon Network Subsystem hnae framework support")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Link: https://lore.kernel.org/r/20221018122451.1749171-1-yangyingliang@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns/hnae.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns/hnae.c b/drivers/net/ethernet/hisilicon/hns/hnae.c
+index c7fa97a7e1f4..b591b05b956b 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hnae.c
++++ b/drivers/net/ethernet/hisilicon/hns/hnae.c
+@@ -424,8 +424,10 @@ int hnae_ae_register(struct hnae_ae_dev *hdev, struct module *owner)
+       hdev->cls_dev.release = hnae_release;
+       (void)dev_set_name(&hdev->cls_dev, "hnae%d", hdev->id);
+       ret = device_register(&hdev->cls_dev);
+-      if (ret)
++      if (ret) {
++              put_device(&hdev->cls_dev);
+               return ret;
++      }
+       __module_get(THIS_MODULE);
+-- 
+2.35.1
+
index c1521a1ae026811ac22c55c467aed1a5effa4913..25c1371a5e8e2e12b8d70c89e6ebb2e313b5f51e 100644 (file)
@@ -6,3 +6,9 @@ ata-ahci-match-em_max_slots-with-sata_pmp_max_ports.patch
 kvm-arm64-vgic-fix-exit-condition-in-scan_its_table.patch
 arm64-errata-remove-aes-hwcap-for-compat-tasks.patch
 r8152-add-pid-for-the-lenovo-onelink-dock.patch
+btrfs-fix-processing-of-delayed-data-refs-during-bac.patch
+acpi-extlog-handle-multiple-records.patch
+hid-magicmouse-do-not-set-btn_mouse-on-double-report.patch
+net-atm-fix-proc_mpc_write-incorrect-return-value.patch
+net-hns-fix-possible-memory-leak-in-hnae_ae_register.patch
+iommu-vt-d-clean-up-si_domain-in-the-init_dmars-erro.patch