+++ /dev/null
-From d8db160044ccbf0e0d909e98f0882eeded21fb2b Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 6 May 2022 17:25:22 +0100
-Subject: clocksource/drivers/sp804: Avoid error on multiple instances
-
-From: Andre Przywara <andre.przywara@arm.com>
-
-[ Upstream commit a98399cbc1e05f7b977419f03905501d566cf54e ]
-
-When a machine sports more than one SP804 timer instance, we only bring
-up the first one, since multiple timers of the same kind are not useful
-to Linux. As this is intentional behaviour, we should not return an
-error message, as we do today:
-===============
-[ 0.000800] Failed to initialize '/bus@8000000/motherboard-bus@8000000/iofpga-bus@300000000/timer@120000': -22
-===============
-
-Replace the -EINVAL return with a debug message and return 0 instead.
-
-Also we do not reach the init function anymore if the DT node is
-disabled (as this is now handled by OF_DECLARE), so remove the explicit
-check for that case.
-
-This fixes a long standing bogus error when booting ARM's fastmodels.
-
-Signed-off-by: Andre Przywara <andre.przywara@arm.com>
-Reviewed-by: Robin Murphy <robin.murphy@arm.com>
-Link: https://lore.kernel.org/r/20220506162522.3675399-1-andre.przywara@arm.com
-Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/clocksource/timer-sp804.c | 10 +++++-----
- 1 file changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/drivers/clocksource/timer-sp804.c b/drivers/clocksource/timer-sp804.c
-index 3ac9dec9a038..42cac9262630 100644
---- a/drivers/clocksource/timer-sp804.c
-+++ b/drivers/clocksource/timer-sp804.c
-@@ -227,6 +227,11 @@ static int __init sp804_of_init(struct device_node *np)
- struct clk *clk1, *clk2;
- const char *name = of_get_property(np, "compatible", NULL);
-
-+ if (initialized) {
-+ pr_debug("%pOF: skipping further SP804 timer device\n", np);
-+ return 0;
-+ }
-+
- base = of_iomap(np, 0);
- if (!base)
- return -ENXIO;
-@@ -235,11 +240,6 @@ static int __init sp804_of_init(struct device_node *np)
- writel(0, base + TIMER_CTRL);
- writel(0, base + TIMER_2_BASE + TIMER_CTRL);
-
-- if (initialized || !of_device_is_available(np)) {
-- ret = -EINVAL;
-- goto err;
-- }
--
- clk1 = of_clk_get(np, 0);
- if (IS_ERR(clk1))
- clk1 = NULL;
---
-2.35.1
-
+++ /dev/null
-From f00f8769e02c36adc1582c00bb07eaeacb535405 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 17 Apr 2022 22:16:41 +0800
-Subject: drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop()
-
-From: Duoming Zhou <duoming@zju.edu.cn>
-
-[ Upstream commit 9b6bdbd9337de3917945847bde262a34a87a6303 ]
-
-There is a deadlock in rtllib_beacons_stop(), which is shown
-below:
-
- (Thread 1) | (Thread 2)
- | rtllib_send_beacon()
-rtllib_beacons_stop() | mod_timer()
- spin_lock_irqsave() //(1) | (wait a time)
- ... | rtllib_send_beacon_cb()
- del_timer_sync() | spin_lock_irqsave() //(2)
- (wait timer to stop) | ...
-
-We hold ieee->beacon_lock in position (1) of thread 1 and
-use del_timer_sync() to wait timer to stop, but timer handler
-also need ieee->beacon_lock in position (2) of thread 2.
-As a result, rtllib_beacons_stop() will block forever.
-
-This patch extracts del_timer_sync() from the protection of
-spin_lock_irqsave(), which could let timer handler to obtain
-the needed lock.
-
-Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
-Link: https://lore.kernel.org/r/20220417141641.124388-1-duoming@zju.edu.cn
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/staging/rtl8192e/rtllib_softmac.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/staging/rtl8192e/rtllib_softmac.c b/drivers/staging/rtl8192e/rtllib_softmac.c
-index e4be85af31e7..1edece694fff 100644
---- a/drivers/staging/rtl8192e/rtllib_softmac.c
-+++ b/drivers/staging/rtl8192e/rtllib_softmac.c
-@@ -654,9 +654,9 @@ static void rtllib_beacons_stop(struct rtllib_device *ieee)
- spin_lock_irqsave(&ieee->beacon_lock, flags);
-
- ieee->beacon_txing = 0;
-- del_timer_sync(&ieee->beacon_timer);
-
- spin_unlock_irqrestore(&ieee->beacon_lock, flags);
-+ del_timer_sync(&ieee->beacon_timer);
-
- }
-
---
-2.35.1
-
+++ /dev/null
-From a4a111bd72e63017e08eb14127d936960fe16ec5 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 17 Apr 2022 19:16:26 +0800
-Subject: drivers: tty: serial: Fix deadlock in sa1100_set_termios()
-
-From: Duoming Zhou <duoming@zju.edu.cn>
-
-[ Upstream commit 62b2caef400c1738b6d22f636c628d9f85cd4c4c ]
-
-There is a deadlock in sa1100_set_termios(), which is shown
-below:
-
- (Thread 1) | (Thread 2)
- | sa1100_enable_ms()
-sa1100_set_termios() | mod_timer()
- spin_lock_irqsave() //(1) | (wait a time)
- ... | sa1100_timeout()
- del_timer_sync() | spin_lock_irqsave() //(2)
- (wait timer to stop) | ...
-
-We hold sport->port.lock in position (1) of thread 1 and
-use del_timer_sync() to wait timer to stop, but timer handler
-also need sport->port.lock in position (2) of thread 2. As a result,
-sa1100_set_termios() will block forever.
-
-This patch moves del_timer_sync() before spin_lock_irqsave()
-in order to prevent the deadlock.
-
-Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
-Link: https://lore.kernel.org/r/20220417111626.7802-1-duoming@zju.edu.cn
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/tty/serial/sa1100.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/tty/serial/sa1100.c b/drivers/tty/serial/sa1100.c
-index fd3d1329d48c..68eb1c9faa29 100644
---- a/drivers/tty/serial/sa1100.c
-+++ b/drivers/tty/serial/sa1100.c
-@@ -452,6 +452,8 @@ sa1100_set_termios(struct uart_port *port, struct ktermios *termios,
- baud = uart_get_baud_rate(port, termios, old, 0, port->uartclk/16);
- quot = uart_get_divisor(port, baud);
-
-+ del_timer_sync(&sport->timer);
-+
- spin_lock_irqsave(&sport->port.lock, flags);
-
- sport->port.read_status_mask &= UTSR0_TO_SM(UTSR0_TFS);
-@@ -482,8 +484,6 @@ sa1100_set_termios(struct uart_port *port, struct ktermios *termios,
- UTSR1_TO_SM(UTSR1_ROR);
- }
-
-- del_timer_sync(&sport->timer);
--
- /*
- * Update the per-port timeout.
- */
---
-2.35.1
-
+++ /dev/null
-From cf65ea64df8de2031cf3200eecbd91a2a473754f Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 17 Apr 2022 20:03:05 +0800
-Subject: drivers: usb: host: Fix deadlock in oxu_bus_suspend()
-
-From: Duoming Zhou <duoming@zju.edu.cn>
-
-[ Upstream commit 4d378f2ae58138d4c55684e1d274e7dd94aa6524 ]
-
-There is a deadlock in oxu_bus_suspend(), which is shown below:
-
- (Thread 1) | (Thread 2)
- | timer_action()
-oxu_bus_suspend() | mod_timer()
- spin_lock_irq() //(1) | (wait a time)
- ... | oxu_watchdog()
- del_timer_sync() | spin_lock_irq() //(2)
- (wait timer to stop) | ...
-
-We hold oxu->lock in position (1) of thread 1, and use
-del_timer_sync() to wait timer to stop, but timer handler
-also need oxu->lock in position (2) of thread 2. As a result,
-oxu_bus_suspend() will block forever.
-
-This patch extracts del_timer_sync() from the protection of
-spin_lock_irq(), which could let timer handler to obtain
-the needed lock.
-
-Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
-Link: https://lore.kernel.org/r/20220417120305.64577-1-duoming@zju.edu.cn
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/host/oxu210hp-hcd.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/drivers/usb/host/oxu210hp-hcd.c b/drivers/usb/host/oxu210hp-hcd.c
-index 1d3a79c2eba2..c986dcb7a87c 100644
---- a/drivers/usb/host/oxu210hp-hcd.c
-+++ b/drivers/usb/host/oxu210hp-hcd.c
-@@ -3489,8 +3489,10 @@ static int oxu_bus_suspend(struct usb_hcd *hcd)
- }
- }
-
-+ spin_unlock_irq(&oxu->lock);
- /* turn off now-idle HC */
- del_timer_sync(&oxu->watchdog);
-+ spin_lock_irq(&oxu->lock);
- ehci_halt(oxu);
- hcd->state = HC_STATE_SUSPENDED;
-
---
-2.35.1
-
+++ /dev/null
-From fc6d4ad4cd841dac369321f29939a64a58c2de5f Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 17 May 2022 17:57:00 +0800
-Subject: drm/radeon: fix a possible null pointer dereference
-
-From: Gong Yuanjun <ruc_gongyuanjun@163.com>
-
-[ Upstream commit a2b28708b645c5632dc93669ab06e97874c8244f ]
-
-In radeon_fp_native_mode(), the return value of drm_mode_duplicate()
-is assigned to mode, which will lead to a NULL pointer dereference
-on failure of drm_mode_duplicate(). Add a check to avoid npd.
-
-The failure status of drm_cvt_mode() on the other path is checked too.
-
-Signed-off-by: Gong Yuanjun <ruc_gongyuanjun@163.com>
-Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/radeon/radeon_connectors.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
-index fc021b8e4077..dd7d771d13b5 100644
---- a/drivers/gpu/drm/radeon/radeon_connectors.c
-+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
-@@ -489,6 +489,8 @@ static struct drm_display_mode *radeon_fp_native_mode(struct drm_encoder *encode
- native_mode->vdisplay != 0 &&
- native_mode->clock != 0) {
- mode = drm_mode_duplicate(dev, native_mode);
-+ if (!mode)
-+ return NULL;
- mode->type = DRM_MODE_TYPE_PREFERRED | DRM_MODE_TYPE_DRIVER;
- drm_mode_set_name(mode);
-
-@@ -503,6 +505,8 @@ static struct drm_display_mode *radeon_fp_native_mode(struct drm_encoder *encode
- * simpler.
- */
- mode = drm_cvt_mode(dev, native_mode->hdisplay, native_mode->vdisplay, 60, true, false, false);
-+ if (!mode)
-+ return NULL;
- mode->type = DRM_MODE_TYPE_PREFERRED | DRM_MODE_TYPE_DRIVER;
- DRM_DEBUG_KMS("Adding cvt approximation of native panel mode %s\n", mode->name);
- }
---
-2.35.1
-
+++ /dev/null
-From c1a0aeb6341564246b7423c9790fb000f810999f Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 27 Apr 2022 12:00:05 +0900
-Subject: extcon: Modify extcon device to be created after driver data is set
-
-From: bumwoo lee <bw365.lee@samsung.com>
-
-[ Upstream commit 5dcc2afe716d69f5112ce035cb14f007461ff189 ]
-
-Currently, someone can invoke the sysfs such as state_show()
-intermittently before dev_set_drvdata() is done.
-And it can be a cause of kernel Oops because of edev is Null at that time.
-So modified the driver registration to after setting drviver data.
-
-- Oops's backtrace.
-
-Backtrace:
-[<c067865c>] (state_show) from [<c05222e8>] (dev_attr_show)
-[<c05222c0>] (dev_attr_show) from [<c02c66e0>] (sysfs_kf_seq_show)
-[<c02c6648>] (sysfs_kf_seq_show) from [<c02c496c>] (kernfs_seq_show)
-[<c02c4938>] (kernfs_seq_show) from [<c025e2a0>] (seq_read)
-[<c025e11c>] (seq_read) from [<c02c50a0>] (kernfs_fop_read)
-[<c02c5064>] (kernfs_fop_read) from [<c0231cac>] (__vfs_read)
-[<c0231c5c>] (__vfs_read) from [<c0231ee0>] (vfs_read)
-[<c0231e34>] (vfs_read) from [<c0232464>] (ksys_read)
-[<c02323f0>] (ksys_read) from [<c02324fc>] (sys_read)
-[<c02324e4>] (sys_read) from [<c00091d0>] (__sys_trace_return)
-
-Signed-off-by: bumwoo lee <bw365.lee@samsung.com>
-Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/extcon/extcon.c | 29 +++++++++++++++++------------
- 1 file changed, 17 insertions(+), 12 deletions(-)
-
-diff --git a/drivers/extcon/extcon.c b/drivers/extcon/extcon.c
-index e9fe3e3bac2b..81a552654cc7 100644
---- a/drivers/extcon/extcon.c
-+++ b/drivers/extcon/extcon.c
-@@ -1241,19 +1241,14 @@ int extcon_dev_register(struct extcon_dev *edev)
- edev->dev.type = &edev->extcon_dev_type;
- }
-
-- ret = device_register(&edev->dev);
-- if (ret) {
-- put_device(&edev->dev);
-- goto err_dev;
-- }
--
- spin_lock_init(&edev->lock);
-- edev->nh = devm_kcalloc(&edev->dev, edev->max_supported,
-- sizeof(*edev->nh), GFP_KERNEL);
-- if (!edev->nh) {
-- ret = -ENOMEM;
-- device_unregister(&edev->dev);
-- goto err_dev;
-+ if (edev->max_supported) {
-+ edev->nh = kcalloc(edev->max_supported, sizeof(*edev->nh),
-+ GFP_KERNEL);
-+ if (!edev->nh) {
-+ ret = -ENOMEM;
-+ goto err_alloc_nh;
-+ }
- }
-
- for (index = 0; index < edev->max_supported; index++)
-@@ -1264,6 +1259,12 @@ int extcon_dev_register(struct extcon_dev *edev)
- dev_set_drvdata(&edev->dev, edev);
- edev->state = 0;
-
-+ ret = device_register(&edev->dev);
-+ if (ret) {
-+ put_device(&edev->dev);
-+ goto err_dev;
-+ }
-+
- mutex_lock(&extcon_dev_list_lock);
- list_add(&edev->entry, &extcon_dev_list);
- mutex_unlock(&extcon_dev_list_lock);
-@@ -1271,6 +1272,9 @@ int extcon_dev_register(struct extcon_dev *edev)
- return 0;
-
- err_dev:
-+ if (edev->max_supported)
-+ kfree(edev->nh);
-+err_alloc_nh:
- if (edev->max_supported)
- kfree(edev->extcon_dev_type.groups);
- err_alloc_groups:
-@@ -1331,6 +1335,7 @@ void extcon_dev_unregister(struct extcon_dev *edev)
- if (edev->max_supported) {
- kfree(edev->extcon_dev_type.groups);
- kfree(edev->cables);
-+ kfree(edev->nh);
- }
-
- put_device(&edev->dev);
---
-2.35.1
-
+++ /dev/null
-From 4c174484bde598f16de27062fdca77add7fa6050 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 5 Mar 2022 11:14:05 +0800
-Subject: iio: dummy: iio_simple_dummy: check the return value of kstrdup()
-
-From: Xiaoke Wang <xkernel.wang@foxmail.com>
-
-[ Upstream commit ba93642188a6fed754bf7447f638bc410e05a929 ]
-
-kstrdup() is also a memory allocation-related function, it returns NULL
-when some memory errors happen. So it is better to check the return
-value of it so to catch the memory error in time. Besides, there should
-have a kfree() to clear up the allocation if we get a failure later in
-this function to prevent memory leak.
-
-Signed-off-by: Xiaoke Wang <xkernel.wang@foxmail.com>
-Link: https://lore.kernel.org/r/tencent_C920CFCC33B9CC1C63141FE1334A39FF8508@qq.com
-Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/iio/dummy/iio_simple_dummy.c | 20 ++++++++++++--------
- 1 file changed, 12 insertions(+), 8 deletions(-)
-
-diff --git a/drivers/iio/dummy/iio_simple_dummy.c b/drivers/iio/dummy/iio_simple_dummy.c
-index ad3410e528b6..7fef76f0b5c7 100644
---- a/drivers/iio/dummy/iio_simple_dummy.c
-+++ b/drivers/iio/dummy/iio_simple_dummy.c
-@@ -572,10 +572,9 @@ static struct iio_sw_device *iio_dummy_probe(const char *name)
- struct iio_sw_device *swd;
-
- swd = kzalloc(sizeof(*swd), GFP_KERNEL);
-- if (!swd) {
-- ret = -ENOMEM;
-- goto error_kzalloc;
-- }
-+ if (!swd)
-+ return ERR_PTR(-ENOMEM);
-+
- /*
- * Allocate an IIO device.
- *
-@@ -587,7 +586,7 @@ static struct iio_sw_device *iio_dummy_probe(const char *name)
- indio_dev = iio_device_alloc(sizeof(*st));
- if (!indio_dev) {
- ret = -ENOMEM;
-- goto error_ret;
-+ goto error_free_swd;
- }
-
- st = iio_priv(indio_dev);
-@@ -618,6 +617,10 @@ static struct iio_sw_device *iio_dummy_probe(const char *name)
- * indio_dev->name = spi_get_device_id(spi)->name;
- */
- indio_dev->name = kstrdup(name, GFP_KERNEL);
-+ if (!indio_dev->name) {
-+ ret = -ENOMEM;
-+ goto error_free_device;
-+ }
-
- /* Provide description of available channels */
- indio_dev->channels = iio_dummy_channels;
-@@ -634,7 +637,7 @@ static struct iio_sw_device *iio_dummy_probe(const char *name)
-
- ret = iio_simple_dummy_events_register(indio_dev);
- if (ret < 0)
-- goto error_free_device;
-+ goto error_free_name;
-
- ret = iio_simple_dummy_configure_buffer(indio_dev);
- if (ret < 0)
-@@ -651,11 +654,12 @@ static struct iio_sw_device *iio_dummy_probe(const char *name)
- iio_simple_dummy_unconfigure_buffer(indio_dev);
- error_unregister_events:
- iio_simple_dummy_events_unregister(indio_dev);
-+error_free_name:
-+ kfree(indio_dev->name);
- error_free_device:
- iio_device_free(indio_dev);
--error_ret:
-+error_free_swd:
- kfree(swd);
--error_kzalloc:
- return ERR_PTR(ret);
- }
-
---
-2.35.1
-
+++ /dev/null
-From d981fb5210ab5f81f00bec608cf7ab46d391c1c9 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 16 May 2022 12:09:51 -0700
-Subject: kernfs: Separate kernfs_pr_cont_buf and rename_lock.
-
-From: Hao Luo <haoluo@google.com>
-
-[ Upstream commit 1a702dc88e150487c9c173a249b3d236498b9183 ]
-
-Previously the protection of kernfs_pr_cont_buf was piggy backed by
-rename_lock, which means that pr_cont() needs to be protected under
-rename_lock. This can cause potential circular lock dependencies.
-
-If there is an OOM, we have the following call hierarchy:
-
- -> cpuset_print_current_mems_allowed()
- -> pr_cont_cgroup_name()
- -> pr_cont_kernfs_name()
-
-pr_cont_kernfs_name() will grab rename_lock and call printk. So we have
-the following lock dependencies:
-
- kernfs_rename_lock -> console_sem
-
-Sometimes, printk does a wakeup before releasing console_sem, which has
-the dependence chain:
-
- console_sem -> p->pi_lock -> rq->lock
-
-Now, imagine one wants to read cgroup_name under rq->lock, for example,
-printing cgroup_name in a tracepoint in the scheduler code. They will
-be holding rq->lock and take rename_lock:
-
- rq->lock -> kernfs_rename_lock
-
-Now they will deadlock.
-
-A prevention to this circular lock dependency is to separate the
-protection of pr_cont_buf from rename_lock. In principle, rename_lock
-is to protect the integrity of cgroup name when copying to buf. Once
-pr_cont_buf has got its content, rename_lock can be dropped. So it's
-safe to drop rename_lock after kernfs_name_locked (and
-kernfs_path_from_node_locked) and rely on a dedicated pr_cont_lock
-to protect pr_cont_buf.
-
-Acked-by: Tejun Heo <tj@kernel.org>
-Signed-off-by: Hao Luo <haoluo@google.com>
-Link: https://lore.kernel.org/r/20220516190951.3144144-1-haoluo@google.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/kernfs/dir.c | 31 +++++++++++++++++++------------
- 1 file changed, 19 insertions(+), 12 deletions(-)
-
-diff --git a/fs/kernfs/dir.c b/fs/kernfs/dir.c
-index 8697b750b1c9..fa2dee322ee9 100644
---- a/fs/kernfs/dir.c
-+++ b/fs/kernfs/dir.c
-@@ -20,7 +20,15 @@
-
- DEFINE_MUTEX(kernfs_mutex);
- static DEFINE_SPINLOCK(kernfs_rename_lock); /* kn->parent and ->name */
--static char kernfs_pr_cont_buf[PATH_MAX]; /* protected by rename_lock */
-+/*
-+ * Don't use rename_lock to piggy back on pr_cont_buf. We don't want to
-+ * call pr_cont() while holding rename_lock. Because sometimes pr_cont()
-+ * will perform wakeups when releasing console_sem. Holding rename_lock
-+ * will introduce deadlock if the scheduler reads the kernfs_name in the
-+ * wakeup path.
-+ */
-+static DEFINE_SPINLOCK(kernfs_pr_cont_lock);
-+static char kernfs_pr_cont_buf[PATH_MAX]; /* protected by pr_cont_lock */
- static DEFINE_SPINLOCK(kernfs_idr_lock); /* root->ino_idr */
-
- #define rb_to_kn(X) rb_entry((X), struct kernfs_node, rb)
-@@ -229,12 +237,12 @@ void pr_cont_kernfs_name(struct kernfs_node *kn)
- {
- unsigned long flags;
-
-- spin_lock_irqsave(&kernfs_rename_lock, flags);
-+ spin_lock_irqsave(&kernfs_pr_cont_lock, flags);
-
-- kernfs_name_locked(kn, kernfs_pr_cont_buf, sizeof(kernfs_pr_cont_buf));
-+ kernfs_name(kn, kernfs_pr_cont_buf, sizeof(kernfs_pr_cont_buf));
- pr_cont("%s", kernfs_pr_cont_buf);
-
-- spin_unlock_irqrestore(&kernfs_rename_lock, flags);
-+ spin_unlock_irqrestore(&kernfs_pr_cont_lock, flags);
- }
-
- /**
-@@ -248,10 +256,10 @@ void pr_cont_kernfs_path(struct kernfs_node *kn)
- unsigned long flags;
- int sz;
-
-- spin_lock_irqsave(&kernfs_rename_lock, flags);
-+ spin_lock_irqsave(&kernfs_pr_cont_lock, flags);
-
-- sz = kernfs_path_from_node_locked(kn, NULL, kernfs_pr_cont_buf,
-- sizeof(kernfs_pr_cont_buf));
-+ sz = kernfs_path_from_node(kn, NULL, kernfs_pr_cont_buf,
-+ sizeof(kernfs_pr_cont_buf));
- if (sz < 0) {
- pr_cont("(error)");
- goto out;
-@@ -265,7 +273,7 @@ void pr_cont_kernfs_path(struct kernfs_node *kn)
- pr_cont("%s", kernfs_pr_cont_buf);
-
- out:
-- spin_unlock_irqrestore(&kernfs_rename_lock, flags);
-+ spin_unlock_irqrestore(&kernfs_pr_cont_lock, flags);
- }
-
- /**
-@@ -850,13 +858,12 @@ static struct kernfs_node *kernfs_walk_ns(struct kernfs_node *parent,
-
- lockdep_assert_held(&kernfs_mutex);
-
-- /* grab kernfs_rename_lock to piggy back on kernfs_pr_cont_buf */
-- spin_lock_irq(&kernfs_rename_lock);
-+ spin_lock_irq(&kernfs_pr_cont_lock);
-
- len = strlcpy(kernfs_pr_cont_buf, path, sizeof(kernfs_pr_cont_buf));
-
- if (len >= sizeof(kernfs_pr_cont_buf)) {
-- spin_unlock_irq(&kernfs_rename_lock);
-+ spin_unlock_irq(&kernfs_pr_cont_lock);
- return NULL;
- }
-
-@@ -868,7 +875,7 @@ static struct kernfs_node *kernfs_walk_ns(struct kernfs_node *parent,
- parent = kernfs_find_ns(parent, name, ns);
- }
-
-- spin_unlock_irq(&kernfs_rename_lock);
-+ spin_unlock_irq(&kernfs_pr_cont_lock);
-
- return parent;
- }
---
-2.35.1
-
+++ /dev/null
-From 52c598669ad3a9a1f75b5f9db54a8fd385fd63af Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 16 Feb 2022 12:15:03 -0800
-Subject: lkdtm/usercopy: Expand size of "out of frame" object
-
-From: Kees Cook <keescook@chromium.org>
-
-[ Upstream commit f387e86d3a74407bdd9c5815820ac9d060962840 ]
-
-To be sufficiently out of range for the usercopy test to see the lifetime
-mismatch, expand the size of the "bad" buffer, which will let it be
-beyond current_stack_pointer regardless of stack growth direction.
-Paired with the recent addition of stack depth checking under
-CONFIG_HARDENED_USERCOPY=y, this will correctly start tripping again.
-
-Reported-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
-Cc: Arnd Bergmann <arnd@arndb.de>
-Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Reviewed-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
-Link: https://lore.kernel.org/lkml/762faf1b-0443-5ddf-4430-44a20cf2ec4d@collabora.com/
-Signed-off-by: Kees Cook <keescook@chromium.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/misc/lkdtm_usercopy.c | 17 ++++++++++++++---
- 1 file changed, 14 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/misc/lkdtm_usercopy.c b/drivers/misc/lkdtm_usercopy.c
-index a64372cc148d..178b55141772 100644
---- a/drivers/misc/lkdtm_usercopy.c
-+++ b/drivers/misc/lkdtm_usercopy.c
-@@ -30,12 +30,12 @@ static const unsigned char test_text[] = "This is a test.\n";
- */
- static noinline unsigned char *trick_compiler(unsigned char *stack)
- {
-- return stack + 0;
-+ return stack + unconst;
- }
-
- static noinline unsigned char *do_usercopy_stack_callee(int value)
- {
-- unsigned char buf[32];
-+ unsigned char buf[128];
- int i;
-
- /* Exercise stack to avoid everything living in registers. */
-@@ -43,7 +43,12 @@ static noinline unsigned char *do_usercopy_stack_callee(int value)
- buf[i] = value & 0xff;
- }
-
-- return trick_compiler(buf);
-+ /*
-+ * Put the target buffer in the middle of stack allocation
-+ * so that we don't step on future stack users regardless
-+ * of stack growth direction.
-+ */
-+ return trick_compiler(&buf[(128/2)-32]);
- }
-
- static noinline void do_usercopy_stack(bool to_user, bool bad_frame)
-@@ -66,6 +71,12 @@ static noinline void do_usercopy_stack(bool to_user, bool bad_frame)
- bad_stack -= sizeof(unsigned long);
- }
-
-+#ifdef ARCH_HAS_CURRENT_STACK_POINTER
-+ pr_info("stack : %px\n", (void *)current_stack_pointer);
-+#endif
-+ pr_info("good_stack: %px-%px\n", good_stack, good_stack + sizeof(good_stack));
-+ pr_info("bad_stack : %px-%px\n", bad_stack, bad_stack + sizeof(good_stack));
-+
- user_addr = vm_mmap(NULL, 0, PAGE_SIZE,
- PROT_READ | PROT_WRITE | PROT_EXEC,
- MAP_ANONYMOUS | MAP_PRIVATE, 0);
---
-2.35.1
-
+++ /dev/null
-From 73ddaa4b9cd7e1b7a7060eb04395364e54fa0251 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 29 Apr 2022 16:49:09 +0800
-Subject: md: protect md_unregister_thread from reentrancy
-
-From: Guoqing Jiang <guoqing.jiang@cloud.ionos.com>
-
-[ Upstream commit 1e267742283a4b5a8ca65755c44166be27e9aa0f ]
-
-Generally, the md_unregister_thread is called with reconfig_mutex, but
-raid_message in dm-raid doesn't hold reconfig_mutex to unregister thread,
-so md_unregister_thread can be called simulitaneously from two call sites
-in theory.
-
-Then after previous commit which remove the protection of reconfig_mutex
-for md_unregister_thread completely, the potential issue could be worse
-than before.
-
-Let's take pers_lock at the beginning of function to ensure reentrancy.
-
-Reported-by: Donald Buczek <buczek@molgen.mpg.de>
-Signed-off-by: Guoqing Jiang <guoqing.jiang@linux.dev>
-Signed-off-by: Song Liu <song@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/md/md.c | 15 ++++++++++-----
- 1 file changed, 10 insertions(+), 5 deletions(-)
-
-diff --git a/drivers/md/md.c b/drivers/md/md.c
-index 9b0270dc37f4..36d4cc1d7429 100644
---- a/drivers/md/md.c
-+++ b/drivers/md/md.c
-@@ -7590,17 +7590,22 @@ EXPORT_SYMBOL(md_register_thread);
-
- void md_unregister_thread(struct md_thread **threadp)
- {
-- struct md_thread *thread = *threadp;
-- if (!thread)
-- return;
-- pr_debug("interrupting MD-thread pid %d\n", task_pid_nr(thread->tsk));
-- /* Locking ensures that mddev_unlock does not wake_up a
-+ struct md_thread *thread;
-+
-+ /*
-+ * Locking ensures that mddev_unlock does not wake_up a
- * non-existent thread
- */
- spin_lock(&pers_lock);
-+ thread = *threadp;
-+ if (!thread) {
-+ spin_unlock(&pers_lock);
-+ return;
-+ }
- *threadp = NULL;
- spin_unlock(&pers_lock);
-
-+ pr_debug("interrupting MD-thread pid %d\n", task_pid_nr(thread->tsk));
- kthread_stop(thread->tsk);
- kfree(thread);
- }
---
-2.35.1
-
+++ /dev/null
-From 686ebed0fa5db536ce8f9427d7ef36ca1d58fc2a Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 29 Apr 2022 15:09:13 -0600
-Subject: misc: rtsx: set NULL intfdata when probe fails
-
-From: Shuah Khan <skhan@linuxfoundation.org>
-
-[ Upstream commit f861d36e021e1ac4a0a2a1f6411d623809975d63 ]
-
-rtsx_usb_probe() doesn't call usb_set_intfdata() to null out the
-interface pointer when probe fails. This leaves a stale pointer.
-Noticed the missing usb_set_intfdata() while debugging an unrelated
-invalid DMA mapping problem.
-
-Fix it with a call to usb_set_intfdata(..., NULL).
-
-Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
-Link: https://lore.kernel.org/r/20220429210913.46804-1-skhan@linuxfoundation.org
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/mfd/rtsx_usb.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/drivers/mfd/rtsx_usb.c b/drivers/mfd/rtsx_usb.c
-index 691dab791f7a..e94f855eac15 100644
---- a/drivers/mfd/rtsx_usb.c
-+++ b/drivers/mfd/rtsx_usb.c
-@@ -678,6 +678,7 @@ static int rtsx_usb_probe(struct usb_interface *intf,
- return 0;
-
- out_init_fail:
-+ usb_set_intfdata(ucr->pusb_intf, NULL);
- usb_free_coherent(ucr->pusb_dev, IOBUF_SIZE, ucr->iobuf,
- ucr->iobuf_dma);
- return ret;
---
-2.35.1
-
+++ /dev/null
-From 16a7c84b32278c1d115c1935ac0cc0046f9de13e Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 24 May 2022 01:46:22 +0900
-Subject: modpost: fix undefined behavior of is_arm_mapping_symbol()
-
-From: Masahiro Yamada <masahiroy@kernel.org>
-
-[ Upstream commit d6b732666a1bae0df3c3ae06925043bba34502b1 ]
-
-The return value of is_arm_mapping_symbol() is unpredictable when "$"
-is passed in.
-
-strchr(3) says:
- The strchr() and strrchr() functions return a pointer to the matched
- character or NULL if the character is not found. The terminating null
- byte is considered part of the string, so that if c is specified as
- '\0', these functions return a pointer to the terminator.
-
-When str[1] is '\0', strchr("axtd", str[1]) is not NULL, and str[2] is
-referenced (i.e. buffer overrun).
-
-Test code
----------
-
- char str1[] = "abc";
- char str2[] = "ab";
-
- strcpy(str1, "$");
- strcpy(str2, "$");
-
- printf("test1: %d\n", is_arm_mapping_symbol(str1));
- printf("test2: %d\n", is_arm_mapping_symbol(str2));
-
-Result
-------
-
- test1: 0
- test2: 1
-
-Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
-Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- scripts/mod/modpost.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
-index bc2c860f88ef..f35fb7fcd98c 100644
---- a/scripts/mod/modpost.c
-+++ b/scripts/mod/modpost.c
-@@ -1229,7 +1229,8 @@ static int secref_whitelist(const struct sectioncheck *mismatch,
-
- static inline int is_arm_mapping_symbol(const char *str)
- {
-- return str[0] == '$' && strchr("axtd", str[1])
-+ return str[0] == '$' &&
-+ (str[1] == 'a' || str[1] == 'd' || str[1] == 't' || str[1] == 'x')
- && (str[2] == '\0' || str[2] == '.');
- }
-
---
-2.35.1
-
+++ /dev/null
-From 5452b0a276d39708e34ab5057b10ffa1bd229716 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 21 May 2022 15:37:44 +0800
-Subject: nbd: call genl_unregister_family() first in nbd_cleanup()
-
-From: Yu Kuai <yukuai3@huawei.com>
-
-[ Upstream commit 06c4da89c24e7023ea448cadf8e9daf06a0aae6e ]
-
-Otherwise there may be race between module removal and the handling of
-netlink command, which can lead to the oops as shown below:
-
- BUG: kernel NULL pointer dereference, address: 0000000000000098
- Oops: 0002 [#1] SMP PTI
- CPU: 1 PID: 31299 Comm: nbd-client Tainted: G E 5.14.0-rc4
- Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
- RIP: 0010:down_write+0x1a/0x50
- Call Trace:
- start_creating+0x89/0x130
- debugfs_create_dir+0x1b/0x130
- nbd_start_device+0x13d/0x390 [nbd]
- nbd_genl_connect+0x42f/0x748 [nbd]
- genl_family_rcv_msg_doit.isra.0+0xec/0x150
- genl_rcv_msg+0xe5/0x1e0
- netlink_rcv_skb+0x55/0x100
- genl_rcv+0x29/0x40
- netlink_unicast+0x1a8/0x250
- netlink_sendmsg+0x21b/0x430
- ____sys_sendmsg+0x2a4/0x2d0
- ___sys_sendmsg+0x81/0xc0
- __sys_sendmsg+0x62/0xb0
- __x64_sys_sendmsg+0x1f/0x30
- do_syscall_64+0x3b/0xc0
- entry_SYSCALL_64_after_hwframe+0x44/0xae
- Modules linked in: nbd(E-)
-
-Signed-off-by: Hou Tao <houtao1@huawei.com>
-Signed-off-by: Yu Kuai <yukuai3@huawei.com>
-Reviewed-by: Josef Bacik <josef@toxicpanda.com>
-Link: https://lore.kernel.org/r/20220521073749.3146892-2-yukuai3@huawei.com
-Signed-off-by: Jens Axboe <axboe@kernel.dk>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/block/nbd.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
-index 826b3877a157..1c9f866d9338 100644
---- a/drivers/block/nbd.c
-+++ b/drivers/block/nbd.c
-@@ -2319,6 +2319,12 @@ static void __exit nbd_cleanup(void)
- struct nbd_device *nbd;
- LIST_HEAD(del_list);
-
-+ /*
-+ * Unregister netlink interface prior to waiting
-+ * for the completion of netlink commands.
-+ */
-+ genl_unregister_family(&nbd_genl_family);
-+
- nbd_dbg_close();
-
- mutex_lock(&nbd_index_mutex);
-@@ -2334,7 +2340,6 @@ static void __exit nbd_cleanup(void)
- }
-
- idr_destroy(&nbd_index_idr);
-- genl_unregister_family(&nbd_genl_family);
- unregister_blkdev(NBD_MAJOR, "nbd");
- }
-
---
-2.35.1
-
+++ /dev/null
-From 432cedd086bf81c24a8feafda40bacef3b33b24e Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 21 May 2022 15:37:47 +0800
-Subject: nbd: fix io hung while disconnecting device
-
-From: Yu Kuai <yukuai3@huawei.com>
-
-[ Upstream commit 09dadb5985023e27d4740ebd17e6fea4640110e5 ]
-
-In our tests, "qemu-nbd" triggers a io hung:
-
-INFO: task qemu-nbd:11445 blocked for more than 368 seconds.
- Not tainted 5.18.0-rc3-next-20220422-00003-g2176915513ca #884
-"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
-task:qemu-nbd state:D stack: 0 pid:11445 ppid: 1 flags:0x00000000
-Call Trace:
- <TASK>
- __schedule+0x480/0x1050
- ? _raw_spin_lock_irqsave+0x3e/0xb0
- schedule+0x9c/0x1b0
- blk_mq_freeze_queue_wait+0x9d/0xf0
- ? ipi_rseq+0x70/0x70
- blk_mq_freeze_queue+0x2b/0x40
- nbd_add_socket+0x6b/0x270 [nbd]
- nbd_ioctl+0x383/0x510 [nbd]
- blkdev_ioctl+0x18e/0x3e0
- __x64_sys_ioctl+0xac/0x120
- do_syscall_64+0x35/0x80
- entry_SYSCALL_64_after_hwframe+0x44/0xae
-RIP: 0033:0x7fd8ff706577
-RSP: 002b:00007fd8fcdfebf8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
-RAX: ffffffffffffffda RBX: 0000000040000000 RCX: 00007fd8ff706577
-RDX: 000000000000000d RSI: 000000000000ab00 RDI: 000000000000000f
-RBP: 000000000000000f R08: 000000000000fbe8 R09: 000055fe497c62b0
-R10: 00000002aff20000 R11: 0000000000000246 R12: 000000000000006d
-R13: 0000000000000000 R14: 00007ffe82dc5e70 R15: 00007fd8fcdff9c0
-
-"qemu-ndb -d" will call ioctl 'NBD_DISCONNECT' first, however, following
-message was found:
-
-block nbd0: Send disconnect failed -32
-
-Which indicate that something is wrong with the server. Then,
-"qemu-nbd -d" will call ioctl 'NBD_CLEAR_SOCK', however ioctl can't clear
-requests after commit 2516ab1543fd("nbd: only clear the queue on device
-teardown"). And in the meantime, request can't complete through timeout
-because nbd_xmit_timeout() will always return 'BLK_EH_RESET_TIMER', which
-means such request will never be completed in this situation.
-
-Now that the flag 'NBD_CMD_INFLIGHT' can make sure requests won't
-complete multiple times, switch back to call nbd_clear_sock() in
-nbd_clear_sock_ioctl(), so that inflight requests can be cleared.
-
-Signed-off-by: Yu Kuai <yukuai3@huawei.com>
-Reviewed-by: Josef Bacik <josef@toxicpanda.com>
-Link: https://lore.kernel.org/r/20220521073749.3146892-5-yukuai3@huawei.com
-Signed-off-by: Jens Axboe <axboe@kernel.dk>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/block/nbd.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
-index 9596f93d98b2..338d02a67afb 100644
---- a/drivers/block/nbd.c
-+++ b/drivers/block/nbd.c
-@@ -1275,7 +1275,7 @@ static int nbd_start_device_ioctl(struct nbd_device *nbd, struct block_device *b
- static void nbd_clear_sock_ioctl(struct nbd_device *nbd,
- struct block_device *bdev)
- {
-- sock_shutdown(nbd);
-+ nbd_clear_sock(nbd);
- __invalidate_device(bdev, true);
- nbd_bdev_reset(bdev);
- if (test_and_clear_bit(NBD_HAS_CONFIG_REF,
---
-2.35.1
-
+++ /dev/null
-From 38b62b1d936ede3d83be2608d2f7180b4e30db4c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 21 May 2022 15:37:45 +0800
-Subject: nbd: fix race between nbd_alloc_config() and module removal
-
-From: Yu Kuai <yukuai3@huawei.com>
-
-[ Upstream commit c55b2b983b0fa012942c3eb16384b2b722caa810 ]
-
-When nbd module is being removing, nbd_alloc_config() may be
-called concurrently by nbd_genl_connect(), although try_module_get()
-will return false, but nbd_alloc_config() doesn't handle it.
-
-The race may lead to the leak of nbd_config and its related
-resources (e.g, recv_workq) and oops in nbd_read_stat() due
-to the unload of nbd module as shown below:
-
- BUG: kernel NULL pointer dereference, address: 0000000000000040
- Oops: 0000 [#1] SMP PTI
- CPU: 5 PID: 13840 Comm: kworker/u17:33 Not tainted 5.14.0+ #1
- Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
- Workqueue: knbd16-recv recv_work [nbd]
- RIP: 0010:nbd_read_stat.cold+0x130/0x1a4 [nbd]
- Call Trace:
- recv_work+0x3b/0xb0 [nbd]
- process_one_work+0x1ed/0x390
- worker_thread+0x4a/0x3d0
- kthread+0x12a/0x150
- ret_from_fork+0x22/0x30
-
-Fixing it by checking the return value of try_module_get()
-in nbd_alloc_config(). As nbd_alloc_config() may return ERR_PTR(-ENODEV),
-assign nbd->config only when nbd_alloc_config() succeeds to ensure
-the value of nbd->config is binary (valid or NULL).
-
-Also adding a debug message to check the reference counter
-of nbd_config during module removal.
-
-Signed-off-by: Hou Tao <houtao1@huawei.com>
-Signed-off-by: Yu Kuai <yukuai3@huawei.com>
-Reviewed-by: Josef Bacik <josef@toxicpanda.com>
-Link: https://lore.kernel.org/r/20220521073749.3146892-3-yukuai3@huawei.com
-Signed-off-by: Jens Axboe <axboe@kernel.dk>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/block/nbd.c | 28 +++++++++++++++++++---------
- 1 file changed, 19 insertions(+), 9 deletions(-)
-
-diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
-index 1c9f866d9338..9596f93d98b2 100644
---- a/drivers/block/nbd.c
-+++ b/drivers/block/nbd.c
-@@ -1382,15 +1382,20 @@ static struct nbd_config *nbd_alloc_config(void)
- {
- struct nbd_config *config;
-
-+ if (!try_module_get(THIS_MODULE))
-+ return ERR_PTR(-ENODEV);
-+
- config = kzalloc(sizeof(struct nbd_config), GFP_NOFS);
-- if (!config)
-- return NULL;
-+ if (!config) {
-+ module_put(THIS_MODULE);
-+ return ERR_PTR(-ENOMEM);
-+ }
-+
- atomic_set(&config->recv_threads, 0);
- init_waitqueue_head(&config->recv_wq);
- init_waitqueue_head(&config->conn_wait);
- config->blksize = NBD_DEF_BLKSIZE;
- atomic_set(&config->live_connections, 0);
-- try_module_get(THIS_MODULE);
- return config;
- }
-
-@@ -1417,12 +1422,13 @@ static int nbd_open(struct block_device *bdev, fmode_t mode)
- mutex_unlock(&nbd->config_lock);
- goto out;
- }
-- config = nbd->config = nbd_alloc_config();
-- if (!config) {
-- ret = -ENOMEM;
-+ config = nbd_alloc_config();
-+ if (IS_ERR(config)) {
-+ ret = PTR_ERR(config);
- mutex_unlock(&nbd->config_lock);
- goto out;
- }
-+ nbd->config = config;
- refcount_set(&nbd->config_refs, 1);
- refcount_inc(&nbd->refs);
- mutex_unlock(&nbd->config_lock);
-@@ -1803,13 +1809,14 @@ static int nbd_genl_connect(struct sk_buff *skb, struct genl_info *info)
- nbd_put(nbd);
- return -EINVAL;
- }
-- config = nbd->config = nbd_alloc_config();
-- if (!nbd->config) {
-+ config = nbd_alloc_config();
-+ if (IS_ERR(config)) {
- mutex_unlock(&nbd->config_lock);
- nbd_put(nbd);
- printk(KERN_ERR "nbd: couldn't allocate config\n");
-- return -ENOMEM;
-+ return PTR_ERR(config);
- }
-+ nbd->config = config;
- refcount_set(&nbd->config_refs, 1);
- set_bit(NBD_BOUND, &config->runtime_flags);
-
-@@ -2334,6 +2341,9 @@ static void __exit nbd_cleanup(void)
- while (!list_empty(&del_list)) {
- nbd = list_first_entry(&del_list, struct nbd_device, list);
- list_del_init(&nbd->list);
-+ if (refcount_read(&nbd->config_refs))
-+ printk(KERN_ERR "nbd: possibly leaking nbd_config (ref %d)\n",
-+ refcount_read(&nbd->config_refs));
- if (refcount_read(&nbd->refs) != 1)
- printk(KERN_ERR "nbd: possibly leaking a device\n");
- nbd_put(nbd);
---
-2.35.1
-
+++ /dev/null
-From bcb1a10940646ec0a5256d728a32bcf597f7163d Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 18 May 2022 13:52:23 -0700
-Subject: nodemask: Fix return values to be unsigned
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Kees Cook <keescook@chromium.org>
-
-[ Upstream commit 0dfe54071d7c828a02917b595456bfde1afdddc9 ]
-
-The nodemask routines had mixed return values that provided potentially
-signed return values that could never happen. This was leading to the
-compiler getting confusing about the range of possible return values
-(it was thinking things could be negative where they could not be). Fix
-all the nodemask routines that should be returning unsigned
-(or bool) values. Silences:
-
- mm/swapfile.c: In function ‘setup_swap_info’:
- mm/swapfile.c:2291:47: error: array subscript -1 is below array bounds of ‘struct plist_node[]’ [-Werror=array-bounds]
- 2291 | p->avail_lists[i].prio = 1;
- | ~~~~~~~~~~~~~~^~~
- In file included from mm/swapfile.c:16:
- ./include/linux/swap.h:292:27: note: while referencing ‘avail_lists’
- 292 | struct plist_node avail_lists[]; /*
- | ^~~~~~~~~~~
-
-Reported-by: Christophe de Dinechin <dinechin@redhat.com>
-Link: https://lore.kernel.org/lkml/20220414150855.2407137-3-dinechin@redhat.com/
-Cc: Alexey Dobriyan <adobriyan@gmail.com>
-Cc: Yury Norov <yury.norov@gmail.com>
-Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
-Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
-Cc: Andrew Morton <akpm@linux-foundation.org>
-Cc: Zhen Lei <thunder.leizhen@huawei.com>
-Signed-off-by: Kees Cook <keescook@chromium.org>
-Signed-off-by: Yury Norov <yury.norov@gmail.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- include/linux/nodemask.h | 38 +++++++++++++++++++-------------------
- lib/nodemask.c | 4 ++--
- 2 files changed, 21 insertions(+), 21 deletions(-)
-
-diff --git a/include/linux/nodemask.h b/include/linux/nodemask.h
-index da9f53586932..13f6248151b9 100644
---- a/include/linux/nodemask.h
-+++ b/include/linux/nodemask.h
-@@ -42,11 +42,11 @@
- * void nodes_shift_right(dst, src, n) Shift right
- * void nodes_shift_left(dst, src, n) Shift left
- *
-- * int first_node(mask) Number lowest set bit, or MAX_NUMNODES
-- * int next_node(node, mask) Next node past 'node', or MAX_NUMNODES
-- * int next_node_in(node, mask) Next node past 'node', or wrap to first,
-+ * unsigned int first_node(mask) Number lowest set bit, or MAX_NUMNODES
-+ * unsigend int next_node(node, mask) Next node past 'node', or MAX_NUMNODES
-+ * unsigned int next_node_in(node, mask) Next node past 'node', or wrap to first,
- * or MAX_NUMNODES
-- * int first_unset_node(mask) First node not set in mask, or
-+ * unsigned int first_unset_node(mask) First node not set in mask, or
- * MAX_NUMNODES
- *
- * nodemask_t nodemask_of_node(node) Return nodemask with bit 'node' set
-@@ -144,7 +144,7 @@ static inline void __nodes_clear(nodemask_t *dstp, unsigned int nbits)
-
- #define node_test_and_set(node, nodemask) \
- __node_test_and_set((node), &(nodemask))
--static inline int __node_test_and_set(int node, nodemask_t *addr)
-+static inline bool __node_test_and_set(int node, nodemask_t *addr)
- {
- return test_and_set_bit(node, addr->bits);
- }
-@@ -191,7 +191,7 @@ static inline void __nodes_complement(nodemask_t *dstp,
-
- #define nodes_equal(src1, src2) \
- __nodes_equal(&(src1), &(src2), MAX_NUMNODES)
--static inline int __nodes_equal(const nodemask_t *src1p,
-+static inline bool __nodes_equal(const nodemask_t *src1p,
- const nodemask_t *src2p, unsigned int nbits)
- {
- return bitmap_equal(src1p->bits, src2p->bits, nbits);
-@@ -199,7 +199,7 @@ static inline int __nodes_equal(const nodemask_t *src1p,
-
- #define nodes_intersects(src1, src2) \
- __nodes_intersects(&(src1), &(src2), MAX_NUMNODES)
--static inline int __nodes_intersects(const nodemask_t *src1p,
-+static inline bool __nodes_intersects(const nodemask_t *src1p,
- const nodemask_t *src2p, unsigned int nbits)
- {
- return bitmap_intersects(src1p->bits, src2p->bits, nbits);
-@@ -207,20 +207,20 @@ static inline int __nodes_intersects(const nodemask_t *src1p,
-
- #define nodes_subset(src1, src2) \
- __nodes_subset(&(src1), &(src2), MAX_NUMNODES)
--static inline int __nodes_subset(const nodemask_t *src1p,
-+static inline bool __nodes_subset(const nodemask_t *src1p,
- const nodemask_t *src2p, unsigned int nbits)
- {
- return bitmap_subset(src1p->bits, src2p->bits, nbits);
- }
-
- #define nodes_empty(src) __nodes_empty(&(src), MAX_NUMNODES)
--static inline int __nodes_empty(const nodemask_t *srcp, unsigned int nbits)
-+static inline bool __nodes_empty(const nodemask_t *srcp, unsigned int nbits)
- {
- return bitmap_empty(srcp->bits, nbits);
- }
-
- #define nodes_full(nodemask) __nodes_full(&(nodemask), MAX_NUMNODES)
--static inline int __nodes_full(const nodemask_t *srcp, unsigned int nbits)
-+static inline bool __nodes_full(const nodemask_t *srcp, unsigned int nbits)
- {
- return bitmap_full(srcp->bits, nbits);
- }
-@@ -251,15 +251,15 @@ static inline void __nodes_shift_left(nodemask_t *dstp,
- > MAX_NUMNODES, then the silly min_ts could be dropped. */
-
- #define first_node(src) __first_node(&(src))
--static inline int __first_node(const nodemask_t *srcp)
-+static inline unsigned int __first_node(const nodemask_t *srcp)
- {
-- return min_t(int, MAX_NUMNODES, find_first_bit(srcp->bits, MAX_NUMNODES));
-+ return min_t(unsigned int, MAX_NUMNODES, find_first_bit(srcp->bits, MAX_NUMNODES));
- }
-
- #define next_node(n, src) __next_node((n), &(src))
--static inline int __next_node(int n, const nodemask_t *srcp)
-+static inline unsigned int __next_node(int n, const nodemask_t *srcp)
- {
-- return min_t(int,MAX_NUMNODES,find_next_bit(srcp->bits, MAX_NUMNODES, n+1));
-+ return min_t(unsigned int, MAX_NUMNODES, find_next_bit(srcp->bits, MAX_NUMNODES, n+1));
- }
-
- /*
-@@ -267,7 +267,7 @@ static inline int __next_node(int n, const nodemask_t *srcp)
- * the first node in src if needed. Returns MAX_NUMNODES if src is empty.
- */
- #define next_node_in(n, src) __next_node_in((n), &(src))
--int __next_node_in(int node, const nodemask_t *srcp);
-+unsigned int __next_node_in(int node, const nodemask_t *srcp);
-
- static inline void init_nodemask_of_node(nodemask_t *mask, int node)
- {
-@@ -287,9 +287,9 @@ static inline void init_nodemask_of_node(nodemask_t *mask, int node)
- })
-
- #define first_unset_node(mask) __first_unset_node(&(mask))
--static inline int __first_unset_node(const nodemask_t *maskp)
-+static inline unsigned int __first_unset_node(const nodemask_t *maskp)
- {
-- return min_t(int,MAX_NUMNODES,
-+ return min_t(unsigned int, MAX_NUMNODES,
- find_first_zero_bit(maskp->bits, MAX_NUMNODES));
- }
-
-@@ -425,11 +425,11 @@ static inline int num_node_state(enum node_states state)
-
- #define first_online_node first_node(node_states[N_ONLINE])
- #define first_memory_node first_node(node_states[N_MEMORY])
--static inline int next_online_node(int nid)
-+static inline unsigned int next_online_node(int nid)
- {
- return next_node(nid, node_states[N_ONLINE]);
- }
--static inline int next_memory_node(int nid)
-+static inline unsigned int next_memory_node(int nid)
- {
- return next_node(nid, node_states[N_MEMORY]);
- }
-diff --git a/lib/nodemask.c b/lib/nodemask.c
-index 3aa454c54c0d..e22647f5181b 100644
---- a/lib/nodemask.c
-+++ b/lib/nodemask.c
-@@ -3,9 +3,9 @@
- #include <linux/module.h>
- #include <linux/random.h>
-
--int __next_node_in(int node, const nodemask_t *srcp)
-+unsigned int __next_node_in(int node, const nodemask_t *srcp)
- {
-- int ret = __next_node(node, srcp);
-+ unsigned int ret = __next_node(node, srcp);
-
- if (ret == MAX_NUMNODES)
- ret = __first_node(srcp);
---
-2.35.1
-
+++ /dev/null
-From d95bd245fc174220177b14ff357967c15df5c00d Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 23 May 2022 22:05:24 +0200
-Subject: Revert "net: af_key: add check for pfkey_broadcast in function
- pfkey_process"
-
-From: Michal Kubecek <mkubecek@suse.cz>
-
-[ Upstream commit 9c90c9b3e50e16d03c7f87d63e9db373974781e0 ]
-
-This reverts commit 4dc2a5a8f6754492180741facf2a8787f2c415d7.
-
-A non-zero return value from pfkey_broadcast() does not necessarily mean
-an error occurred as this function returns -ESRCH when no registered
-listener received the message. In particular, a call with
-BROADCAST_PROMISC_ONLY flag and null one_sk argument can never return
-zero so that this commit in fact prevents processing any PF_KEY message.
-One visible effect is that racoon daemon fails to find encryption
-algorithms like aes and refuses to start.
-
-Excluding -ESRCH return value would fix this but it's not obvious that
-we really want to bail out here and most other callers of
-pfkey_broadcast() also ignore the return value. Also, as pointed out by
-Steffen Klassert, PF_KEY is kind of deprecated and newer userspace code
-should use netlink instead so that we should only disturb the code for
-really important fixes.
-
-v2: add a comment explaining why is the return value ignored
-
-Signed-off-by: Michal Kubecek <mkubecek@suse.cz>
-Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/key/af_key.c | 10 ++++++----
- 1 file changed, 6 insertions(+), 4 deletions(-)
-
-diff --git a/net/key/af_key.c b/net/key/af_key.c
-index 990de0702b79..035123bf7259 100644
---- a/net/key/af_key.c
-+++ b/net/key/af_key.c
-@@ -2834,10 +2834,12 @@ static int pfkey_process(struct sock *sk, struct sk_buff *skb, const struct sadb
- void *ext_hdrs[SADB_EXT_MAX];
- int err;
-
-- err = pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL,
-- BROADCAST_PROMISC_ONLY, NULL, sock_net(sk));
-- if (err)
-- return err;
-+ /* Non-zero return value of pfkey_broadcast() does not always signal
-+ * an error and even on an actual error we may still want to process
-+ * the message so rather ignore the return value.
-+ */
-+ pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL,
-+ BROADCAST_PROMISC_ONLY, NULL, sock_net(sk));
-
- memset(ext_hdrs, 0, sizeof(ext_hdrs));
- err = parse_exthdrs(skb, hdr, ext_hdrs);
---
-2.35.1
-
+++ /dev/null
-From ee043580c98b5fc139c8b5dee0545cc26fc3137f Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 6 May 2022 23:39:24 +0206
-Subject: serial: msm_serial: disable interrupts in __msm_console_write()
-
-From: John Ogness <john.ogness@linutronix.de>
-
-[ Upstream commit aabdbb1b7a5819e18c403334a31fb0cc2c06ad41 ]
-
-__msm_console_write() assumes that interrupts are disabled, but
-with threaded console printers it is possible that the write()
-callback of the console is called with interrupts enabled.
-
-Explicitly disable interrupts using local_irq_save() to preserve
-the assumed context.
-
-Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
-Reviewed-by: Petr Mladek <pmladek@suse.com>
-Signed-off-by: John Ogness <john.ogness@linutronix.de>
-Link: https://lore.kernel.org/r/20220506213324.470461-1-john.ogness@linutronix.de
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/tty/serial/msm_serial.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/drivers/tty/serial/msm_serial.c b/drivers/tty/serial/msm_serial.c
-index 7848e9455950..3df3716caa56 100644
---- a/drivers/tty/serial/msm_serial.c
-+++ b/drivers/tty/serial/msm_serial.c
-@@ -1587,6 +1587,7 @@ static inline struct uart_port *msm_get_port_from_line(unsigned int line)
- static void __msm_console_write(struct uart_port *port, const char *s,
- unsigned int count, bool is_uartdm)
- {
-+ unsigned long flags;
- int i;
- int num_newlines = 0;
- bool replaced = false;
-@@ -1604,6 +1605,8 @@ static void __msm_console_write(struct uart_port *port, const char *s,
- num_newlines++;
- count += num_newlines;
-
-+ local_irq_save(flags);
-+
- if (port->sysrq)
- locked = 0;
- else if (oops_in_progress)
-@@ -1649,6 +1652,8 @@ static void __msm_console_write(struct uart_port *port, const char *s,
-
- if (locked)
- spin_unlock(&port->lock);
-+
-+ local_irq_restore(flags);
- }
-
- static void msm_console_write(struct console *co, const char *s,
---
-2.35.1
-
net-ipv6-unexport-__init-annotated-seg6_hmac_init.patch
net-altera-fix-refcount-leak-in-altera_tse_mdio_crea.patch
drm-imx-fix-compiler-warning-with-gcc-12.patch
-iio-dummy-iio_simple_dummy-check-the-return-value-of.patch
-lkdtm-usercopy-expand-size-of-out-of-frame-object.patch
-tty-synclink_gt-fix-null-pointer-dereference-in-slgt.patch
-tty-fix-a-possible-resource-leak-in-icom_probe.patch
-drivers-staging-rtl8192e-fix-deadlock-in-rtllib_beac.patch
-usb-host-isp116x-check-return-value-after-calling-pl.patch
-drivers-tty-serial-fix-deadlock-in-sa1100_set_termio.patch
-drivers-usb-host-fix-deadlock-in-oxu_bus_suspend.patch
-usb-hcd-pci-fully-suspend-across-freeze-thaw-cycle.patch
-usb-dwc2-gadget-don-t-reset-gadget-s-driver-bus.patch
-misc-rtsx-set-null-intfdata-when-probe-fails.patch
-extcon-modify-extcon-device-to-be-created-after-driv.patch
-clocksource-drivers-sp804-avoid-error-on-multiple-in.patch
-staging-rtl8712-fix-uninit-value-in-r871xu_drv_init.patch
-serial-msm_serial-disable-interrupts-in-__msm_consol.patch
-kernfs-separate-kernfs_pr_cont_buf-and-rename_lock.patch
-md-protect-md_unregister_thread-from-reentrancy.patch
-revert-net-af_key-add-check-for-pfkey_broadcast-in-f.patch
-drm-radeon-fix-a-possible-null-pointer-dereference.patch
-modpost-fix-undefined-behavior-of-is_arm_mapping_sym.patch
-nbd-call-genl_unregister_family-first-in-nbd_cleanup.patch
-nbd-fix-race-between-nbd_alloc_config-and-module-rem.patch
-nbd-fix-io-hung-while-disconnecting-device.patch
-nodemask-fix-return-values-to-be-unsigned.patch
-iio-dummy-iio_simple_dummy-check-the-return-value-of.patch-2294
-lkdtm-usercopy-expand-size-of-out-of-frame-object.patch-21637
-tty-synclink_gt-fix-null-pointer-dereference-in-slgt.patch-11127
-tty-fix-a-possible-resource-leak-in-icom_probe.patch-15832
-drivers-staging-rtl8192e-fix-deadlock-in-rtllib_beac.patch-27667
-usb-host-isp116x-check-return-value-after-calling-pl.patch-16910
-drivers-tty-serial-fix-deadlock-in-sa1100_set_termio.patch-1994
-drivers-usb-host-fix-deadlock-in-oxu_bus_suspend.patch-6358
-usb-hcd-pci-fully-suspend-across-freeze-thaw-cycle.patch-28138
-usb-dwc2-gadget-don-t-reset-gadget-s-driver-bus.patch-25185
-misc-rtsx-set-null-intfdata-when-probe-fails.patch-14171
-extcon-modify-extcon-device-to-be-created-after-driv.patch-9552
-clocksource-drivers-sp804-avoid-error-on-multiple-in.patch-29639
-staging-rtl8712-fix-uninit-value-in-r871xu_drv_init.patch-22812
-serial-msm_serial-disable-interrupts-in-__msm_consol.patch-32587
-kernfs-separate-kernfs_pr_cont_buf-and-rename_lock.patch-9187
-md-protect-md_unregister_thread-from-reentrancy.patch-3153
-revert-net-af_key-add-check-for-pfkey_broadcast-in-f.patch-8464
-drm-radeon-fix-a-possible-null-pointer-dereference.patch-21070
-modpost-fix-undefined-behavior-of-is_arm_mapping_sym.patch-25557
-nbd-call-genl_unregister_family-first-in-nbd_cleanup.patch-20567
-nbd-fix-race-between-nbd_alloc_config-and-module-rem.patch-24376
-nbd-fix-io-hung-while-disconnecting-device.patch-29843
-nodemask-fix-return-values-to-be-unsigned.patch-29413
-iio-dummy-iio_simple_dummy-check-the-return-value-of.patch-27365
-lkdtm-usercopy-expand-size-of-out-of-frame-object.patch-16982
-tty-synclink_gt-fix-null-pointer-dereference-in-slgt.patch-18352
-tty-fix-a-possible-resource-leak-in-icom_probe.patch-27680
-drivers-staging-rtl8192e-fix-deadlock-in-rtllib_beac.patch-17195
-usb-host-isp116x-check-return-value-after-calling-pl.patch-17824
-drivers-tty-serial-fix-deadlock-in-sa1100_set_termio.patch-18821
-drivers-usb-host-fix-deadlock-in-oxu_bus_suspend.patch-1678
-usb-hcd-pci-fully-suspend-across-freeze-thaw-cycle.patch-17904
-usb-dwc2-gadget-don-t-reset-gadget-s-driver-bus.patch-3513
-misc-rtsx-set-null-intfdata-when-probe-fails.patch-995
-extcon-modify-extcon-device-to-be-created-after-driv.patch-24531
-clocksource-drivers-sp804-avoid-error-on-multiple-in.patch-11976
-staging-rtl8712-fix-uninit-value-in-r871xu_drv_init.patch-28512
-serial-msm_serial-disable-interrupts-in-__msm_consol.patch-29321
-kernfs-separate-kernfs_pr_cont_buf-and-rename_lock.patch-27977
-md-protect-md_unregister_thread-from-reentrancy.patch-16041
-revert-net-af_key-add-check-for-pfkey_broadcast-in-f.patch-16871
-drm-radeon-fix-a-possible-null-pointer-dereference.patch-16535
-modpost-fix-undefined-behavior-of-is_arm_mapping_sym.patch-15924
-nbd-call-genl_unregister_family-first-in-nbd_cleanup.patch-23844
-nbd-fix-race-between-nbd_alloc_config-and-module-rem.patch-3389
-nbd-fix-io-hung-while-disconnecting-device.patch-5217
-nodemask-fix-return-values-to-be-unsigned.patch-27598
+++ /dev/null
-From 9691e2d2dae9f93c3ca7901c6a58e4dbaf987b09 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 16 May 2022 17:22:41 +0800
-Subject: staging: rtl8712: fix uninit-value in r871xu_drv_init()
-
-From: Wang Cheng <wanngchenng@gmail.com>
-
-[ Upstream commit 0458e5428e5e959d201a40ffe71d762a79ecedc4 ]
-
-When 'tmpU1b' returns from r8712_read8(padapter, EE_9346CR) is 0,
-'mac[6]' will not be initialized.
-
-BUG: KMSAN: uninit-value in r871xu_drv_init+0x2d54/0x3070 drivers/staging/rtl8712/usb_intf.c:541
- r871xu_drv_init+0x2d54/0x3070 drivers/staging/rtl8712/usb_intf.c:541
- usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396
- really_probe+0x653/0x14b0 drivers/base/dd.c:596
- __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752
- driver_probe_device drivers/base/dd.c:782 [inline]
- __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899
- bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427
- __device_attach+0x593/0x8e0 drivers/base/dd.c:970
- device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017
- bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487
- device_add+0x1fff/0x26e0 drivers/base/core.c:3405
- usb_set_configuration+0x37e9/0x3ed0 drivers/usb/core/message.c:2170
- usb_generic_driver_probe+0x13c/0x300 drivers/usb/core/generic.c:238
- usb_probe_device+0x309/0x570 drivers/usb/core/driver.c:293
- really_probe+0x653/0x14b0 drivers/base/dd.c:596
- __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752
- driver_probe_device drivers/base/dd.c:782 [inline]
- __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899
- bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427
- __device_attach+0x593/0x8e0 drivers/base/dd.c:970
- device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017
- bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487
- device_add+0x1fff/0x26e0 drivers/base/core.c:3405
- usb_new_device+0x1b8e/0x2950 drivers/usb/core/hub.c:2566
- hub_port_connect drivers/usb/core/hub.c:5358 [inline]
- hub_port_connect_change drivers/usb/core/hub.c:5502 [inline]
- port_event drivers/usb/core/hub.c:5660 [inline]
- hub_event+0x58e3/0x89e0 drivers/usb/core/hub.c:5742
- process_one_work+0xdb6/0x1820 kernel/workqueue.c:2307
- worker_thread+0x10b3/0x21e0 kernel/workqueue.c:2454
- kthread+0x3c7/0x500 kernel/kthread.c:377
- ret_from_fork+0x1f/0x30
-
-Local variable mac created at:
- r871xu_drv_init+0x1771/0x3070 drivers/staging/rtl8712/usb_intf.c:394
- usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396
-
-KMSAN: uninit-value in r871xu_drv_init
-https://syzkaller.appspot.com/bug?id=3cd92b1d85428b128503bfa7a250294c9ae00bd8
-
-Reported-by: <syzbot+6f5ecd144854c0d8580b@syzkaller.appspotmail.com>
-Tested-by: <syzbot+6f5ecd144854c0d8580b@syzkaller.appspotmail.com>
-Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
-Signed-off-by: Wang Cheng <wanngchenng@gmail.com>
-Link: https://lore.kernel.org/r/14c3886173dfa4597f0704547c414cfdbcd11d16.1652618244.git.wanngchenng@gmail.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/staging/rtl8712/usb_intf.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/staging/rtl8712/usb_intf.c b/drivers/staging/rtl8712/usb_intf.c
-index 8be4fcc54ad6..b7bd37b62861 100644
---- a/drivers/staging/rtl8712/usb_intf.c
-+++ b/drivers/staging/rtl8712/usb_intf.c
-@@ -569,13 +569,13 @@ static int r871xu_drv_init(struct usb_interface *pusb_intf,
- } else {
- AutoloadFail = false;
- }
-- if (((mac[0] == 0xff) && (mac[1] == 0xff) &&
-+ if ((!AutoloadFail) ||
-+ ((mac[0] == 0xff) && (mac[1] == 0xff) &&
- (mac[2] == 0xff) && (mac[3] == 0xff) &&
- (mac[4] == 0xff) && (mac[5] == 0xff)) ||
- ((mac[0] == 0x00) && (mac[1] == 0x00) &&
- (mac[2] == 0x00) && (mac[3] == 0x00) &&
-- (mac[4] == 0x00) && (mac[5] == 0x00)) ||
-- (!AutoloadFail)) {
-+ (mac[4] == 0x00) && (mac[5] == 0x00))) {
- mac[0] = 0x00;
- mac[1] = 0xe0;
- mac[2] = 0x4c;
---
-2.35.1
-
+++ /dev/null
-From c132b64a9d0ec2698db9c3b9d11ccf21ebb08be3 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 31 Mar 2022 17:10:05 +0800
-Subject: tty: Fix a possible resource leak in icom_probe
-
-From: Huang Guobin <huangguobin4@huawei.com>
-
-[ Upstream commit ee157a79e7c82b01ae4c25de0ac75899801f322c ]
-
-When pci_read_config_dword failed, call pci_release_regions() and
-pci_disable_device() to recycle the resource previously allocated.
-
-Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
-Signed-off-by: Huang Guobin <huangguobin4@huawei.com>
-Link: https://lore.kernel.org/r/20220331091005.3290753-1-huangguobin4@huawei.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/tty/serial/icom.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/tty/serial/icom.c b/drivers/tty/serial/icom.c
-index fe92d74f4ea5..4711b3ec2c56 100644
---- a/drivers/tty/serial/icom.c
-+++ b/drivers/tty/serial/icom.c
-@@ -1515,7 +1515,7 @@ static int icom_probe(struct pci_dev *dev,
- retval = pci_read_config_dword(dev, PCI_COMMAND, &command_reg);
- if (retval) {
- dev_err(&dev->dev, "PCI Config read FAILED\n");
-- return retval;
-+ goto probe_exit0;
- }
-
- pci_write_config_dword(dev, PCI_COMMAND,
---
-2.35.1
-
+++ /dev/null
-From a87ee6aa276bd44454e1c40f0a3bc640e44cbf76 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 10 Apr 2022 19:48:14 +0800
-Subject: tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
-
-From: Zheyu Ma <zheyuma97@gmail.com>
-
-[ Upstream commit 689ca31c542687709ba21ec2195c1fbce34fd029 ]
-
-When the driver fails at alloc_hdlcdev(), and then we remove the driver
-module, we will get the following splat:
-
-[ 25.065966] general protection fault, probably for non-canonical address 0xdffffc0000000182: 0000 [#1] PREEMPT SMP KASAN PTI
-[ 25.066914] KASAN: null-ptr-deref in range [0x0000000000000c10-0x0000000000000c17]
-[ 25.069262] RIP: 0010:detach_hdlc_protocol+0x2a/0x3e0
-[ 25.077709] Call Trace:
-[ 25.077924] <TASK>
-[ 25.078108] unregister_hdlc_device+0x16/0x30
-[ 25.078481] slgt_cleanup+0x157/0x9f0 [synclink_gt]
-
-Fix this by checking whether the 'info->netdev' is a null pointer first.
-
-Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
-Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
-Link: https://lore.kernel.org/r/20220410114814.3920474-1-zheyuma97@gmail.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/tty/synclink_gt.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/drivers/tty/synclink_gt.c b/drivers/tty/synclink_gt.c
-index 9d68f89a2bf8..4b5ff6e173bd 100644
---- a/drivers/tty/synclink_gt.c
-+++ b/drivers/tty/synclink_gt.c
-@@ -1822,6 +1822,8 @@ static int hdlcdev_init(struct slgt_info *info)
- */
- static void hdlcdev_exit(struct slgt_info *info)
- {
-+ if (!info->netdev)
-+ return;
- unregister_hdlc_device(info->netdev);
- free_netdev(info->netdev);
- info->netdev = NULL;
---
-2.35.1
-
+++ /dev/null
-From 5f02601eed365676f83f4bd736c176ee41d9e502 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 5 May 2022 12:46:18 +0200
-Subject: usb: dwc2: gadget: don't reset gadget's driver->bus
-
-From: Marek Szyprowski <m.szyprowski@samsung.com>
-
-[ Upstream commit 3120aac6d0ecd9accf56894aeac0e265f74d3d5a ]
-
-UDC driver should not touch gadget's driver internals, especially it
-should not reset driver->bus. This wasn't harmful so far, but since
-commit fc274c1e9973 ("USB: gadget: Add a new bus for gadgets") gadget
-subsystem got it's own bus and messing with ->bus triggers the
-following NULL pointer dereference:
-
-dwc2 12480000.hsotg: bound driver g_ether
-8<--- cut here ---
-Unable to handle kernel NULL pointer dereference at virtual address 00000000
-[00000000] *pgd=00000000
-Internal error: Oops: 5 [#1] SMP ARM
-Modules linked in: ...
-CPU: 0 PID: 620 Comm: modprobe Not tainted 5.18.0-rc5-next-20220504 #11862
-Hardware name: Samsung Exynos (Flattened Device Tree)
-PC is at module_add_driver+0x44/0xe8
-LR is at sysfs_do_create_link_sd+0x84/0xe0
-...
-Process modprobe (pid: 620, stack limit = 0x(ptrval))
-...
- module_add_driver from bus_add_driver+0xf4/0x1e4
- bus_add_driver from driver_register+0x78/0x10c
- driver_register from usb_gadget_register_driver_owner+0x40/0xb4
- usb_gadget_register_driver_owner from do_one_initcall+0x44/0x1e0
- do_one_initcall from do_init_module+0x44/0x1c8
- do_init_module from load_module+0x19b8/0x1b9c
- load_module from sys_finit_module+0xdc/0xfc
- sys_finit_module from ret_fast_syscall+0x0/0x54
-Exception stack(0xf1771fa8 to 0xf1771ff0)
-...
-dwc2 12480000.hsotg: new device is high-speed
----[ end trace 0000000000000000 ]---
-
-Fix this by removing driver->bus entry reset.
-
-Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
-Link: https://lore.kernel.org/r/20220505104618.22729-1-m.szyprowski@samsung.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/dwc2/gadget.c | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
-index dddc5d02b552..14f907cf71a3 100644
---- a/drivers/usb/dwc2/gadget.c
-+++ b/drivers/usb/dwc2/gadget.c
-@@ -4302,7 +4302,6 @@ static int dwc2_hsotg_udc_start(struct usb_gadget *gadget,
-
- WARN_ON(hsotg->driver);
-
-- driver->driver.bus = NULL;
- hsotg->driver = driver;
- hsotg->gadget.dev.of_node = hsotg->dev->of_node;
- hsotg->gadget.speed = USB_SPEED_UNKNOWN;
---
-2.35.1
-
+++ /dev/null
-From d235020a4f44037b634c5ea6c20d9221d9d60150 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 21 Apr 2022 10:39:27 -0700
-Subject: USB: hcd-pci: Fully suspend across freeze/thaw cycle
-
-From: Evan Green <evgreen@chromium.org>
-
-[ Upstream commit 63acaa8e9c65dc34dc249440216f8e977f5d2748 ]
-
-The documentation for the freeze() method says that it "should quiesce
-the device so that it doesn't generate IRQs or DMA". The unspoken
-consequence of not doing this is that MSIs aimed at non-boot CPUs may
-get fully lost if they're sent during the period where the target CPU is
-offline.
-
-The current callbacks for USB HCD do not fully quiesce interrupts,
-specifically on XHCI. Change to use the full suspend/resume flow for
-freeze/thaw to ensure interrupts are fully quiesced. This fixes issues
-where USB devices fail to thaw during hibernation because XHCI misses
-its interrupt and cannot recover.
-
-Acked-by: Alan Stern <stern@rowland.harvard.edu>
-Signed-off-by: Evan Green <evgreen@chromium.org>
-Link: https://lore.kernel.org/r/20220421103751.v3.2.I8226c7fdae88329ef70957b96a39b346c69a914e@changeid
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/core/hcd-pci.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c
-index 5340d433cdf0..18b3a5e518cd 100644
---- a/drivers/usb/core/hcd-pci.c
-+++ b/drivers/usb/core/hcd-pci.c
-@@ -632,10 +632,10 @@ const struct dev_pm_ops usb_hcd_pci_pm_ops = {
- .suspend_noirq = hcd_pci_suspend_noirq,
- .resume_noirq = hcd_pci_resume_noirq,
- .resume = hcd_pci_resume,
-- .freeze = check_root_hub_suspended,
-+ .freeze = hcd_pci_suspend,
- .freeze_noirq = check_root_hub_suspended,
- .thaw_noirq = NULL,
-- .thaw = NULL,
-+ .thaw = hcd_pci_resume,
- .poweroff = hcd_pci_suspend,
- .poweroff_noirq = hcd_pci_suspend_noirq,
- .restore_noirq = hcd_pci_resume_noirq,
---
-2.35.1
-
+++ /dev/null
-From 9e0f336d5ccefbcffa64bf8eae9709092e97c916 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 2 Mar 2022 11:37:16 +0800
-Subject: USB: host: isp116x: check return value after calling
- platform_get_resource()
-
-From: Zhen Ni <nizhen@uniontech.com>
-
-[ Upstream commit 134a3408c2d3f7e23eb0e4556e0a2d9f36c2614e ]
-
-It will cause null-ptr-deref if platform_get_resource() returns NULL,
-we need check the return value.
-
-Signed-off-by: Zhen Ni <nizhen@uniontech.com>
-Link: https://lore.kernel.org/r/20220302033716.31272-1-nizhen@uniontech.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/host/isp116x-hcd.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/usb/host/isp116x-hcd.c b/drivers/usb/host/isp116x-hcd.c
-index 73fec38754f9..83eb62001679 100644
---- a/drivers/usb/host/isp116x-hcd.c
-+++ b/drivers/usb/host/isp116x-hcd.c
-@@ -1551,10 +1551,12 @@ static int isp116x_remove(struct platform_device *pdev)
-
- iounmap(isp116x->data_reg);
- res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
-- release_mem_region(res->start, 2);
-+ if (res)
-+ release_mem_region(res->start, 2);
- iounmap(isp116x->addr_reg);
- res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-- release_mem_region(res->start, 2);
-+ if (res)
-+ release_mem_region(res->start, 2);
-
- usb_put_hcd(hcd);
- return 0;
---
-2.35.1
-
+++ /dev/null
-From ecbb78383d867be9bf8c2e9ecffd49497512bb36 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 10 Mar 2022 09:34:19 -0500
-Subject: ceph: allow ceph.dir.rctime xattr to be updatable
-
-From: Venky Shankar <vshankar@redhat.com>
-
-[ Upstream commit d7a2dc523085f8b8c60548ceedc696934aefeb0e ]
-
-`rctime' has been a pain point in cephfs due to its buggy
-nature - inconsistent values reported and those sorts.
-Fixing rctime is non-trivial needing an overall redesign
-of the entire nested statistics infrastructure.
-
-As a workaround, PR
-
- http://github.com/ceph/ceph/pull/37938
-
-allows this extended attribute to be manually set. This allows
-users to "fixup" inconsistent rctime values. While this sounds
-messy, its probably the wisest approach allowing users/scripts
-to workaround buggy rctime values.
-
-The above PR enables Ceph MDS to allow manually setting
-rctime extended attribute with the corresponding user-land
-changes. We may as well allow the same to be done via kclient
-for parity.
-
-Signed-off-by: Venky Shankar <vshankar@redhat.com>
-Reviewed-by: Xiubo Li <xiubli@redhat.com>
-Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/ceph/xattr.c | 10 +++++++++-
- 1 file changed, 9 insertions(+), 1 deletion(-)
-
-diff --git a/fs/ceph/xattr.c b/fs/ceph/xattr.c
-index a09ce27ab220..6fa9a784676b 100644
---- a/fs/ceph/xattr.c
-+++ b/fs/ceph/xattr.c
-@@ -273,6 +273,14 @@ static size_t ceph_vxattrcb_quota_max_files(struct ceph_inode_info *ci,
- }
- #define XATTR_RSTAT_FIELD(_type, _name) \
- XATTR_NAME_CEPH(_type, _name, VXATTR_FLAG_RSTAT)
-+#define XATTR_RSTAT_FIELD_UPDATABLE(_type, _name) \
-+ { \
-+ .name = CEPH_XATTR_NAME(_type, _name), \
-+ .name_size = sizeof (CEPH_XATTR_NAME(_type, _name)), \
-+ .getxattr_cb = ceph_vxattrcb_ ## _type ## _ ## _name, \
-+ .exists_cb = NULL, \
-+ .flags = VXATTR_FLAG_RSTAT, \
-+ }
- #define XATTR_LAYOUT_FIELD(_type, _name, _field) \
- { \
- .name = CEPH_XATTR_NAME2(_type, _name, _field), \
-@@ -310,7 +318,7 @@ static struct ceph_vxattr ceph_dir_vxattrs[] = {
- XATTR_RSTAT_FIELD(dir, rfiles),
- XATTR_RSTAT_FIELD(dir, rsubdirs),
- XATTR_RSTAT_FIELD(dir, rbytes),
-- XATTR_RSTAT_FIELD(dir, rctime),
-+ XATTR_RSTAT_FIELD_UPDATABLE(dir, rctime),
- {
- .name = "ceph.quota",
- .name_size = sizeof("ceph.quota"),
---
-2.35.1
-
+++ /dev/null
-From a734503e2b418dd3377bcbc467ea8797abaa5313 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 6 May 2022 17:25:22 +0100
-Subject: clocksource/drivers/sp804: Avoid error on multiple instances
-
-From: Andre Przywara <andre.przywara@arm.com>
-
-[ Upstream commit a98399cbc1e05f7b977419f03905501d566cf54e ]
-
-When a machine sports more than one SP804 timer instance, we only bring
-up the first one, since multiple timers of the same kind are not useful
-to Linux. As this is intentional behaviour, we should not return an
-error message, as we do today:
-===============
-[ 0.000800] Failed to initialize '/bus@8000000/motherboard-bus@8000000/iofpga-bus@300000000/timer@120000': -22
-===============
-
-Replace the -EINVAL return with a debug message and return 0 instead.
-
-Also we do not reach the init function anymore if the DT node is
-disabled (as this is now handled by OF_DECLARE), so remove the explicit
-check for that case.
-
-This fixes a long standing bogus error when booting ARM's fastmodels.
-
-Signed-off-by: Andre Przywara <andre.przywara@arm.com>
-Reviewed-by: Robin Murphy <robin.murphy@arm.com>
-Link: https://lore.kernel.org/r/20220506162522.3675399-1-andre.przywara@arm.com
-Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/clocksource/timer-sp804.c | 10 +++++-----
- 1 file changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/drivers/clocksource/timer-sp804.c b/drivers/clocksource/timer-sp804.c
-index e01222ea888f..738c50e916f7 100644
---- a/drivers/clocksource/timer-sp804.c
-+++ b/drivers/clocksource/timer-sp804.c
-@@ -228,6 +228,11 @@ static int __init sp804_of_init(struct device_node *np)
- struct clk *clk1, *clk2;
- const char *name = of_get_property(np, "compatible", NULL);
-
-+ if (initialized) {
-+ pr_debug("%pOF: skipping further SP804 timer device\n", np);
-+ return 0;
-+ }
-+
- base = of_iomap(np, 0);
- if (!base)
- return -ENXIO;
-@@ -236,11 +241,6 @@ static int __init sp804_of_init(struct device_node *np)
- writel(0, base + TIMER_CTRL);
- writel(0, base + TIMER_2_BASE + TIMER_CTRL);
-
-- if (initialized || !of_device_is_available(np)) {
-- ret = -EINVAL;
-- goto err;
-- }
--
- clk1 = of_clk_get(np, 0);
- if (IS_ERR(clk1))
- clk1 = NULL;
---
-2.35.1
-
+++ /dev/null
-From 8c99d25bbc64a1cd6099460c57866839a057be1e Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 17 Apr 2022 22:16:41 +0800
-Subject: drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop()
-
-From: Duoming Zhou <duoming@zju.edu.cn>
-
-[ Upstream commit 9b6bdbd9337de3917945847bde262a34a87a6303 ]
-
-There is a deadlock in rtllib_beacons_stop(), which is shown
-below:
-
- (Thread 1) | (Thread 2)
- | rtllib_send_beacon()
-rtllib_beacons_stop() | mod_timer()
- spin_lock_irqsave() //(1) | (wait a time)
- ... | rtllib_send_beacon_cb()
- del_timer_sync() | spin_lock_irqsave() //(2)
- (wait timer to stop) | ...
-
-We hold ieee->beacon_lock in position (1) of thread 1 and
-use del_timer_sync() to wait timer to stop, but timer handler
-also need ieee->beacon_lock in position (2) of thread 2.
-As a result, rtllib_beacons_stop() will block forever.
-
-This patch extracts del_timer_sync() from the protection of
-spin_lock_irqsave(), which could let timer handler to obtain
-the needed lock.
-
-Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
-Link: https://lore.kernel.org/r/20220417141641.124388-1-duoming@zju.edu.cn
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/staging/rtl8192e/rtllib_softmac.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/staging/rtl8192e/rtllib_softmac.c b/drivers/staging/rtl8192e/rtllib_softmac.c
-index 919231fec09c..5f1dd4e2d12e 100644
---- a/drivers/staging/rtl8192e/rtllib_softmac.c
-+++ b/drivers/staging/rtl8192e/rtllib_softmac.c
-@@ -654,9 +654,9 @@ static void rtllib_beacons_stop(struct rtllib_device *ieee)
- spin_lock_irqsave(&ieee->beacon_lock, flags);
-
- ieee->beacon_txing = 0;
-- del_timer_sync(&ieee->beacon_timer);
-
- spin_unlock_irqrestore(&ieee->beacon_lock, flags);
-+ del_timer_sync(&ieee->beacon_timer);
-
- }
-
---
-2.35.1
-
+++ /dev/null
-From 674d87c6f95d234b0bb3d003a48112a26b3ef5dd Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 17 Apr 2022 21:54:07 +0800
-Subject: drivers: staging: rtl8192u: Fix deadlock in ieee80211_beacons_stop()
-
-From: Duoming Zhou <duoming@zju.edu.cn>
-
-[ Upstream commit 806c7b53414934ba2a39449b31fd1a038e500273 ]
-
-There is a deadlock in ieee80211_beacons_stop(), which is shown below:
-
- (Thread 1) | (Thread 2)
- | ieee80211_send_beacon()
-ieee80211_beacons_stop() | mod_timer()
- spin_lock_irqsave() //(1) | (wait a time)
- ... | ieee80211_send_beacon_cb()
- del_timer_sync() | spin_lock_irqsave() //(2)
- (wait timer to stop) | ...
-
-We hold ieee->beacon_lock in position (1) of thread 1 and use
-del_timer_sync() to wait timer to stop, but timer handler
-also need ieee->beacon_lock in position (2) of thread 2.
-As a result, ieee80211_beacons_stop() will block forever.
-
-This patch extracts del_timer_sync() from the protection of
-spin_lock_irqsave(), which could let timer handler to obtain
-the needed lock.
-
-Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
-Link: https://lore.kernel.org/r/20220417135407.109536-1-duoming@zju.edu.cn
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c b/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c
-index 212cc9ccbb96..426966a29d31 100644
---- a/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c
-+++ b/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c
-@@ -529,9 +529,9 @@ static void ieee80211_beacons_stop(struct ieee80211_device *ieee)
- spin_lock_irqsave(&ieee->beacon_lock, flags);
-
- ieee->beacon_txing = 0;
-- del_timer_sync(&ieee->beacon_timer);
-
- spin_unlock_irqrestore(&ieee->beacon_lock, flags);
-+ del_timer_sync(&ieee->beacon_timer);
- }
-
- void ieee80211_stop_send_beacons(struct ieee80211_device *ieee)
---
-2.35.1
-
+++ /dev/null
-From 814ad366b9ad388768b5131d74d01d486de9071e Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 17 Apr 2022 19:16:26 +0800
-Subject: drivers: tty: serial: Fix deadlock in sa1100_set_termios()
-
-From: Duoming Zhou <duoming@zju.edu.cn>
-
-[ Upstream commit 62b2caef400c1738b6d22f636c628d9f85cd4c4c ]
-
-There is a deadlock in sa1100_set_termios(), which is shown
-below:
-
- (Thread 1) | (Thread 2)
- | sa1100_enable_ms()
-sa1100_set_termios() | mod_timer()
- spin_lock_irqsave() //(1) | (wait a time)
- ... | sa1100_timeout()
- del_timer_sync() | spin_lock_irqsave() //(2)
- (wait timer to stop) | ...
-
-We hold sport->port.lock in position (1) of thread 1 and
-use del_timer_sync() to wait timer to stop, but timer handler
-also need sport->port.lock in position (2) of thread 2. As a result,
-sa1100_set_termios() will block forever.
-
-This patch moves del_timer_sync() before spin_lock_irqsave()
-in order to prevent the deadlock.
-
-Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
-Link: https://lore.kernel.org/r/20220417111626.7802-1-duoming@zju.edu.cn
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/tty/serial/sa1100.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/tty/serial/sa1100.c b/drivers/tty/serial/sa1100.c
-index a399772be3fc..8a65fb1ce568 100644
---- a/drivers/tty/serial/sa1100.c
-+++ b/drivers/tty/serial/sa1100.c
-@@ -439,6 +439,8 @@ sa1100_set_termios(struct uart_port *port, struct ktermios *termios,
- baud = uart_get_baud_rate(port, termios, old, 0, port->uartclk/16);
- quot = uart_get_divisor(port, baud);
-
-+ del_timer_sync(&sport->timer);
-+
- spin_lock_irqsave(&sport->port.lock, flags);
-
- sport->port.read_status_mask &= UTSR0_TO_SM(UTSR0_TFS);
-@@ -469,8 +471,6 @@ sa1100_set_termios(struct uart_port *port, struct ktermios *termios,
- UTSR1_TO_SM(UTSR1_ROR);
- }
-
-- del_timer_sync(&sport->timer);
--
- /*
- * Update the per-port timeout.
- */
---
-2.35.1
-
+++ /dev/null
-From 74684d78d523e3f39cba4d2f4630f7d2471b2219 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 17 Apr 2022 20:03:05 +0800
-Subject: drivers: usb: host: Fix deadlock in oxu_bus_suspend()
-
-From: Duoming Zhou <duoming@zju.edu.cn>
-
-[ Upstream commit 4d378f2ae58138d4c55684e1d274e7dd94aa6524 ]
-
-There is a deadlock in oxu_bus_suspend(), which is shown below:
-
- (Thread 1) | (Thread 2)
- | timer_action()
-oxu_bus_suspend() | mod_timer()
- spin_lock_irq() //(1) | (wait a time)
- ... | oxu_watchdog()
- del_timer_sync() | spin_lock_irq() //(2)
- (wait timer to stop) | ...
-
-We hold oxu->lock in position (1) of thread 1, and use
-del_timer_sync() to wait timer to stop, but timer handler
-also need oxu->lock in position (2) of thread 2. As a result,
-oxu_bus_suspend() will block forever.
-
-This patch extracts del_timer_sync() from the protection of
-spin_lock_irq(), which could let timer handler to obtain
-the needed lock.
-
-Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
-Link: https://lore.kernel.org/r/20220417120305.64577-1-duoming@zju.edu.cn
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/host/oxu210hp-hcd.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/drivers/usb/host/oxu210hp-hcd.c b/drivers/usb/host/oxu210hp-hcd.c
-index 10d97261b433..48533eb707e6 100644
---- a/drivers/usb/host/oxu210hp-hcd.c
-+++ b/drivers/usb/host/oxu210hp-hcd.c
-@@ -3476,8 +3476,10 @@ static int oxu_bus_suspend(struct usb_hcd *hcd)
- }
- }
-
-+ spin_unlock_irq(&oxu->lock);
- /* turn off now-idle HC */
- del_timer_sync(&oxu->watchdog);
-+ spin_lock_irq(&oxu->lock);
- ehci_halt(oxu);
- hcd->state = HC_STATE_SUSPENDED;
-
---
-2.35.1
-
+++ /dev/null
-From f06d2175d5a7b519ad7616f1cf12bac92b9593a9 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 17 May 2022 17:57:00 +0800
-Subject: drm/radeon: fix a possible null pointer dereference
-
-From: Gong Yuanjun <ruc_gongyuanjun@163.com>
-
-[ Upstream commit a2b28708b645c5632dc93669ab06e97874c8244f ]
-
-In radeon_fp_native_mode(), the return value of drm_mode_duplicate()
-is assigned to mode, which will lead to a NULL pointer dereference
-on failure of drm_mode_duplicate(). Add a check to avoid npd.
-
-The failure status of drm_cvt_mode() on the other path is checked too.
-
-Signed-off-by: Gong Yuanjun <ruc_gongyuanjun@163.com>
-Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/radeon/radeon_connectors.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
-index b9927101e845..47240983f360 100644
---- a/drivers/gpu/drm/radeon/radeon_connectors.c
-+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
-@@ -476,6 +476,8 @@ static struct drm_display_mode *radeon_fp_native_mode(struct drm_encoder *encode
- native_mode->vdisplay != 0 &&
- native_mode->clock != 0) {
- mode = drm_mode_duplicate(dev, native_mode);
-+ if (!mode)
-+ return NULL;
- mode->type = DRM_MODE_TYPE_PREFERRED | DRM_MODE_TYPE_DRIVER;
- drm_mode_set_name(mode);
-
-@@ -490,6 +492,8 @@ static struct drm_display_mode *radeon_fp_native_mode(struct drm_encoder *encode
- * simpler.
- */
- mode = drm_cvt_mode(dev, native_mode->hdisplay, native_mode->vdisplay, 60, true, false, false);
-+ if (!mode)
-+ return NULL;
- mode->type = DRM_MODE_TYPE_PREFERRED | DRM_MODE_TYPE_DRIVER;
- DRM_DEBUG_KMS("Adding cvt approximation of native panel mode %s\n", mode->name);
- }
---
-2.35.1
-
+++ /dev/null
-From f3640bc5bebb3e8149a0bdb781229bec48add801 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 27 Apr 2022 12:00:05 +0900
-Subject: extcon: Modify extcon device to be created after driver data is set
-
-From: bumwoo lee <bw365.lee@samsung.com>
-
-[ Upstream commit 5dcc2afe716d69f5112ce035cb14f007461ff189 ]
-
-Currently, someone can invoke the sysfs such as state_show()
-intermittently before dev_set_drvdata() is done.
-And it can be a cause of kernel Oops because of edev is Null at that time.
-So modified the driver registration to after setting drviver data.
-
-- Oops's backtrace.
-
-Backtrace:
-[<c067865c>] (state_show) from [<c05222e8>] (dev_attr_show)
-[<c05222c0>] (dev_attr_show) from [<c02c66e0>] (sysfs_kf_seq_show)
-[<c02c6648>] (sysfs_kf_seq_show) from [<c02c496c>] (kernfs_seq_show)
-[<c02c4938>] (kernfs_seq_show) from [<c025e2a0>] (seq_read)
-[<c025e11c>] (seq_read) from [<c02c50a0>] (kernfs_fop_read)
-[<c02c5064>] (kernfs_fop_read) from [<c0231cac>] (__vfs_read)
-[<c0231c5c>] (__vfs_read) from [<c0231ee0>] (vfs_read)
-[<c0231e34>] (vfs_read) from [<c0232464>] (ksys_read)
-[<c02323f0>] (ksys_read) from [<c02324fc>] (sys_read)
-[<c02324e4>] (sys_read) from [<c00091d0>] (__sys_trace_return)
-
-Signed-off-by: bumwoo lee <bw365.lee@samsung.com>
-Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/extcon/extcon.c | 29 +++++++++++++++++------------
- 1 file changed, 17 insertions(+), 12 deletions(-)
-
-diff --git a/drivers/extcon/extcon.c b/drivers/extcon/extcon.c
-index e70f21ae85ff..4c70136c7aa3 100644
---- a/drivers/extcon/extcon.c
-+++ b/drivers/extcon/extcon.c
-@@ -1245,19 +1245,14 @@ int extcon_dev_register(struct extcon_dev *edev)
- edev->dev.type = &edev->extcon_dev_type;
- }
-
-- ret = device_register(&edev->dev);
-- if (ret) {
-- put_device(&edev->dev);
-- goto err_dev;
-- }
--
- spin_lock_init(&edev->lock);
-- edev->nh = devm_kcalloc(&edev->dev, edev->max_supported,
-- sizeof(*edev->nh), GFP_KERNEL);
-- if (!edev->nh) {
-- ret = -ENOMEM;
-- device_unregister(&edev->dev);
-- goto err_dev;
-+ if (edev->max_supported) {
-+ edev->nh = kcalloc(edev->max_supported, sizeof(*edev->nh),
-+ GFP_KERNEL);
-+ if (!edev->nh) {
-+ ret = -ENOMEM;
-+ goto err_alloc_nh;
-+ }
- }
-
- for (index = 0; index < edev->max_supported; index++)
-@@ -1268,6 +1263,12 @@ int extcon_dev_register(struct extcon_dev *edev)
- dev_set_drvdata(&edev->dev, edev);
- edev->state = 0;
-
-+ ret = device_register(&edev->dev);
-+ if (ret) {
-+ put_device(&edev->dev);
-+ goto err_dev;
-+ }
-+
- mutex_lock(&extcon_dev_list_lock);
- list_add(&edev->entry, &extcon_dev_list);
- mutex_unlock(&extcon_dev_list_lock);
-@@ -1275,6 +1276,9 @@ int extcon_dev_register(struct extcon_dev *edev)
- return 0;
-
- err_dev:
-+ if (edev->max_supported)
-+ kfree(edev->nh);
-+err_alloc_nh:
- if (edev->max_supported)
- kfree(edev->extcon_dev_type.groups);
- err_alloc_groups:
-@@ -1335,6 +1339,7 @@ void extcon_dev_unregister(struct extcon_dev *edev)
- if (edev->max_supported) {
- kfree(edev->extcon_dev_type.groups);
- kfree(edev->cables);
-+ kfree(edev->nh);
- }
-
- put_device(&edev->dev);
---
-2.35.1
-
+++ /dev/null
-From 181abadb9f4e5b7b3e419a84502a4468383f3123 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 5 Mar 2022 11:14:05 +0800
-Subject: iio: dummy: iio_simple_dummy: check the return value of kstrdup()
-
-From: Xiaoke Wang <xkernel.wang@foxmail.com>
-
-[ Upstream commit ba93642188a6fed754bf7447f638bc410e05a929 ]
-
-kstrdup() is also a memory allocation-related function, it returns NULL
-when some memory errors happen. So it is better to check the return
-value of it so to catch the memory error in time. Besides, there should
-have a kfree() to clear up the allocation if we get a failure later in
-this function to prevent memory leak.
-
-Signed-off-by: Xiaoke Wang <xkernel.wang@foxmail.com>
-Link: https://lore.kernel.org/r/tencent_C920CFCC33B9CC1C63141FE1334A39FF8508@qq.com
-Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/iio/dummy/iio_simple_dummy.c | 20 ++++++++++++--------
- 1 file changed, 12 insertions(+), 8 deletions(-)
-
-diff --git a/drivers/iio/dummy/iio_simple_dummy.c b/drivers/iio/dummy/iio_simple_dummy.c
-index 62052479c349..f970b4388dda 100644
---- a/drivers/iio/dummy/iio_simple_dummy.c
-+++ b/drivers/iio/dummy/iio_simple_dummy.c
-@@ -571,10 +571,9 @@ static struct iio_sw_device *iio_dummy_probe(const char *name)
- struct iio_sw_device *swd;
-
- swd = kzalloc(sizeof(*swd), GFP_KERNEL);
-- if (!swd) {
-- ret = -ENOMEM;
-- goto error_kzalloc;
-- }
-+ if (!swd)
-+ return ERR_PTR(-ENOMEM);
-+
- /*
- * Allocate an IIO device.
- *
-@@ -586,7 +585,7 @@ static struct iio_sw_device *iio_dummy_probe(const char *name)
- indio_dev = iio_device_alloc(sizeof(*st));
- if (!indio_dev) {
- ret = -ENOMEM;
-- goto error_ret;
-+ goto error_free_swd;
- }
-
- st = iio_priv(indio_dev);
-@@ -617,6 +616,10 @@ static struct iio_sw_device *iio_dummy_probe(const char *name)
- * indio_dev->name = spi_get_device_id(spi)->name;
- */
- indio_dev->name = kstrdup(name, GFP_KERNEL);
-+ if (!indio_dev->name) {
-+ ret = -ENOMEM;
-+ goto error_free_device;
-+ }
-
- /* Provide description of available channels */
- indio_dev->channels = iio_dummy_channels;
-@@ -633,7 +636,7 @@ static struct iio_sw_device *iio_dummy_probe(const char *name)
-
- ret = iio_simple_dummy_events_register(indio_dev);
- if (ret < 0)
-- goto error_free_device;
-+ goto error_free_name;
-
- ret = iio_simple_dummy_configure_buffer(indio_dev);
- if (ret < 0)
-@@ -650,11 +653,12 @@ static struct iio_sw_device *iio_dummy_probe(const char *name)
- iio_simple_dummy_unconfigure_buffer(indio_dev);
- error_unregister_events:
- iio_simple_dummy_events_unregister(indio_dev);
-+error_free_name:
-+ kfree(indio_dev->name);
- error_free_device:
- iio_device_free(indio_dev);
--error_ret:
-+error_free_swd:
- kfree(swd);
--error_kzalloc:
- return ERR_PTR(ret);
- }
-
---
-2.35.1
-
+++ /dev/null
-From ed789c07bf19390831f9f1f8b58f1e59e31abf48 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 16 May 2022 12:09:51 -0700
-Subject: kernfs: Separate kernfs_pr_cont_buf and rename_lock.
-
-From: Hao Luo <haoluo@google.com>
-
-[ Upstream commit 1a702dc88e150487c9c173a249b3d236498b9183 ]
-
-Previously the protection of kernfs_pr_cont_buf was piggy backed by
-rename_lock, which means that pr_cont() needs to be protected under
-rename_lock. This can cause potential circular lock dependencies.
-
-If there is an OOM, we have the following call hierarchy:
-
- -> cpuset_print_current_mems_allowed()
- -> pr_cont_cgroup_name()
- -> pr_cont_kernfs_name()
-
-pr_cont_kernfs_name() will grab rename_lock and call printk. So we have
-the following lock dependencies:
-
- kernfs_rename_lock -> console_sem
-
-Sometimes, printk does a wakeup before releasing console_sem, which has
-the dependence chain:
-
- console_sem -> p->pi_lock -> rq->lock
-
-Now, imagine one wants to read cgroup_name under rq->lock, for example,
-printing cgroup_name in a tracepoint in the scheduler code. They will
-be holding rq->lock and take rename_lock:
-
- rq->lock -> kernfs_rename_lock
-
-Now they will deadlock.
-
-A prevention to this circular lock dependency is to separate the
-protection of pr_cont_buf from rename_lock. In principle, rename_lock
-is to protect the integrity of cgroup name when copying to buf. Once
-pr_cont_buf has got its content, rename_lock can be dropped. So it's
-safe to drop rename_lock after kernfs_name_locked (and
-kernfs_path_from_node_locked) and rely on a dedicated pr_cont_lock
-to protect pr_cont_buf.
-
-Acked-by: Tejun Heo <tj@kernel.org>
-Signed-off-by: Hao Luo <haoluo@google.com>
-Link: https://lore.kernel.org/r/20220516190951.3144144-1-haoluo@google.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/kernfs/dir.c | 31 +++++++++++++++++++------------
- 1 file changed, 19 insertions(+), 12 deletions(-)
-
-diff --git a/fs/kernfs/dir.c b/fs/kernfs/dir.c
-index a4a538abcaf9..99627d3438e5 100644
---- a/fs/kernfs/dir.c
-+++ b/fs/kernfs/dir.c
-@@ -20,7 +20,15 @@
-
- DEFINE_MUTEX(kernfs_mutex);
- static DEFINE_SPINLOCK(kernfs_rename_lock); /* kn->parent and ->name */
--static char kernfs_pr_cont_buf[PATH_MAX]; /* protected by rename_lock */
-+/*
-+ * Don't use rename_lock to piggy back on pr_cont_buf. We don't want to
-+ * call pr_cont() while holding rename_lock. Because sometimes pr_cont()
-+ * will perform wakeups when releasing console_sem. Holding rename_lock
-+ * will introduce deadlock if the scheduler reads the kernfs_name in the
-+ * wakeup path.
-+ */
-+static DEFINE_SPINLOCK(kernfs_pr_cont_lock);
-+static char kernfs_pr_cont_buf[PATH_MAX]; /* protected by pr_cont_lock */
- static DEFINE_SPINLOCK(kernfs_idr_lock); /* root->ino_idr */
-
- #define rb_to_kn(X) rb_entry((X), struct kernfs_node, rb)
-@@ -229,12 +237,12 @@ void pr_cont_kernfs_name(struct kernfs_node *kn)
- {
- unsigned long flags;
-
-- spin_lock_irqsave(&kernfs_rename_lock, flags);
-+ spin_lock_irqsave(&kernfs_pr_cont_lock, flags);
-
-- kernfs_name_locked(kn, kernfs_pr_cont_buf, sizeof(kernfs_pr_cont_buf));
-+ kernfs_name(kn, kernfs_pr_cont_buf, sizeof(kernfs_pr_cont_buf));
- pr_cont("%s", kernfs_pr_cont_buf);
-
-- spin_unlock_irqrestore(&kernfs_rename_lock, flags);
-+ spin_unlock_irqrestore(&kernfs_pr_cont_lock, flags);
- }
-
- /**
-@@ -248,10 +256,10 @@ void pr_cont_kernfs_path(struct kernfs_node *kn)
- unsigned long flags;
- int sz;
-
-- spin_lock_irqsave(&kernfs_rename_lock, flags);
-+ spin_lock_irqsave(&kernfs_pr_cont_lock, flags);
-
-- sz = kernfs_path_from_node_locked(kn, NULL, kernfs_pr_cont_buf,
-- sizeof(kernfs_pr_cont_buf));
-+ sz = kernfs_path_from_node(kn, NULL, kernfs_pr_cont_buf,
-+ sizeof(kernfs_pr_cont_buf));
- if (sz < 0) {
- pr_cont("(error)");
- goto out;
-@@ -265,7 +273,7 @@ void pr_cont_kernfs_path(struct kernfs_node *kn)
- pr_cont("%s", kernfs_pr_cont_buf);
-
- out:
-- spin_unlock_irqrestore(&kernfs_rename_lock, flags);
-+ spin_unlock_irqrestore(&kernfs_pr_cont_lock, flags);
- }
-
- /**
-@@ -867,13 +875,12 @@ static struct kernfs_node *kernfs_walk_ns(struct kernfs_node *parent,
-
- lockdep_assert_held(&kernfs_mutex);
-
-- /* grab kernfs_rename_lock to piggy back on kernfs_pr_cont_buf */
-- spin_lock_irq(&kernfs_rename_lock);
-+ spin_lock_irq(&kernfs_pr_cont_lock);
-
- len = strlcpy(kernfs_pr_cont_buf, path, sizeof(kernfs_pr_cont_buf));
-
- if (len >= sizeof(kernfs_pr_cont_buf)) {
-- spin_unlock_irq(&kernfs_rename_lock);
-+ spin_unlock_irq(&kernfs_pr_cont_lock);
- return NULL;
- }
-
-@@ -885,7 +892,7 @@ static struct kernfs_node *kernfs_walk_ns(struct kernfs_node *parent,
- parent = kernfs_find_ns(parent, name, ns);
- }
-
-- spin_unlock_irq(&kernfs_rename_lock);
-+ spin_unlock_irq(&kernfs_pr_cont_lock);
-
- return parent;
- }
---
-2.35.1
-
+++ /dev/null
-From 63def3c0a2f630daebfd206fc04e5d6b56fd874e Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 16 Feb 2022 12:15:03 -0800
-Subject: lkdtm/usercopy: Expand size of "out of frame" object
-
-From: Kees Cook <keescook@chromium.org>
-
-[ Upstream commit f387e86d3a74407bdd9c5815820ac9d060962840 ]
-
-To be sufficiently out of range for the usercopy test to see the lifetime
-mismatch, expand the size of the "bad" buffer, which will let it be
-beyond current_stack_pointer regardless of stack growth direction.
-Paired with the recent addition of stack depth checking under
-CONFIG_HARDENED_USERCOPY=y, this will correctly start tripping again.
-
-Reported-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
-Cc: Arnd Bergmann <arnd@arndb.de>
-Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Reviewed-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
-Link: https://lore.kernel.org/lkml/762faf1b-0443-5ddf-4430-44a20cf2ec4d@collabora.com/
-Signed-off-by: Kees Cook <keescook@chromium.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/misc/lkdtm/usercopy.c | 17 ++++++++++++++---
- 1 file changed, 14 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/misc/lkdtm/usercopy.c b/drivers/misc/lkdtm/usercopy.c
-index 9725aed305bb..b0e020372d11 100644
---- a/drivers/misc/lkdtm/usercopy.c
-+++ b/drivers/misc/lkdtm/usercopy.c
-@@ -30,12 +30,12 @@ static const unsigned char test_text[] = "This is a test.\n";
- */
- static noinline unsigned char *trick_compiler(unsigned char *stack)
- {
-- return stack + 0;
-+ return stack + unconst;
- }
-
- static noinline unsigned char *do_usercopy_stack_callee(int value)
- {
-- unsigned char buf[32];
-+ unsigned char buf[128];
- int i;
-
- /* Exercise stack to avoid everything living in registers. */
-@@ -43,7 +43,12 @@ static noinline unsigned char *do_usercopy_stack_callee(int value)
- buf[i] = value & 0xff;
- }
-
-- return trick_compiler(buf);
-+ /*
-+ * Put the target buffer in the middle of stack allocation
-+ * so that we don't step on future stack users regardless
-+ * of stack growth direction.
-+ */
-+ return trick_compiler(&buf[(128/2)-32]);
- }
-
- static noinline void do_usercopy_stack(bool to_user, bool bad_frame)
-@@ -66,6 +71,12 @@ static noinline void do_usercopy_stack(bool to_user, bool bad_frame)
- bad_stack -= sizeof(unsigned long);
- }
-
-+#ifdef ARCH_HAS_CURRENT_STACK_POINTER
-+ pr_info("stack : %px\n", (void *)current_stack_pointer);
-+#endif
-+ pr_info("good_stack: %px-%px\n", good_stack, good_stack + sizeof(good_stack));
-+ pr_info("bad_stack : %px-%px\n", bad_stack, bad_stack + sizeof(good_stack));
-+
- user_addr = vm_mmap(NULL, 0, PAGE_SIZE,
- PROT_READ | PROT_WRITE | PROT_EXEC,
- MAP_ANONYMOUS | MAP_PRIVATE, 0);
---
-2.35.1
-
+++ /dev/null
-From c4e43a3cfb6ddb37d395fd4b001c8c8210d9246c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 29 Apr 2022 16:49:09 +0800
-Subject: md: protect md_unregister_thread from reentrancy
-
-From: Guoqing Jiang <guoqing.jiang@cloud.ionos.com>
-
-[ Upstream commit 1e267742283a4b5a8ca65755c44166be27e9aa0f ]
-
-Generally, the md_unregister_thread is called with reconfig_mutex, but
-raid_message in dm-raid doesn't hold reconfig_mutex to unregister thread,
-so md_unregister_thread can be called simulitaneously from two call sites
-in theory.
-
-Then after previous commit which remove the protection of reconfig_mutex
-for md_unregister_thread completely, the potential issue could be worse
-than before.
-
-Let's take pers_lock at the beginning of function to ensure reentrancy.
-
-Reported-by: Donald Buczek <buczek@molgen.mpg.de>
-Signed-off-by: Guoqing Jiang <guoqing.jiang@linux.dev>
-Signed-off-by: Song Liu <song@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/md/md.c | 15 ++++++++++-----
- 1 file changed, 10 insertions(+), 5 deletions(-)
-
-diff --git a/drivers/md/md.c b/drivers/md/md.c
-index 502556345570..4594a1ee88b9 100644
---- a/drivers/md/md.c
-+++ b/drivers/md/md.c
-@@ -7620,17 +7620,22 @@ EXPORT_SYMBOL(md_register_thread);
-
- void md_unregister_thread(struct md_thread **threadp)
- {
-- struct md_thread *thread = *threadp;
-- if (!thread)
-- return;
-- pr_debug("interrupting MD-thread pid %d\n", task_pid_nr(thread->tsk));
-- /* Locking ensures that mddev_unlock does not wake_up a
-+ struct md_thread *thread;
-+
-+ /*
-+ * Locking ensures that mddev_unlock does not wake_up a
- * non-existent thread
- */
- spin_lock(&pers_lock);
-+ thread = *threadp;
-+ if (!thread) {
-+ spin_unlock(&pers_lock);
-+ return;
-+ }
- *threadp = NULL;
- spin_unlock(&pers_lock);
-
-+ pr_debug("interrupting MD-thread pid %d\n", task_pid_nr(thread->tsk));
- kthread_stop(thread->tsk);
- kfree(thread);
- }
---
-2.35.1
-
+++ /dev/null
-From 31d0b8837b9b64c6c304a317439a7490d072cd59 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 29 Apr 2022 15:09:13 -0600
-Subject: misc: rtsx: set NULL intfdata when probe fails
-
-From: Shuah Khan <skhan@linuxfoundation.org>
-
-[ Upstream commit f861d36e021e1ac4a0a2a1f6411d623809975d63 ]
-
-rtsx_usb_probe() doesn't call usb_set_intfdata() to null out the
-interface pointer when probe fails. This leaves a stale pointer.
-Noticed the missing usb_set_intfdata() while debugging an unrelated
-invalid DMA mapping problem.
-
-Fix it with a call to usb_set_intfdata(..., NULL).
-
-Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
-Link: https://lore.kernel.org/r/20220429210913.46804-1-skhan@linuxfoundation.org
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/misc/cardreader/rtsx_usb.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/drivers/misc/cardreader/rtsx_usb.c b/drivers/misc/cardreader/rtsx_usb.c
-index b97903ff1a72..869c176d48cc 100644
---- a/drivers/misc/cardreader/rtsx_usb.c
-+++ b/drivers/misc/cardreader/rtsx_usb.c
-@@ -678,6 +678,7 @@ static int rtsx_usb_probe(struct usb_interface *intf,
- return 0;
-
- out_init_fail:
-+ usb_set_intfdata(ucr->pusb_intf, NULL);
- usb_free_coherent(ucr->pusb_dev, IOBUF_SIZE, ucr->iobuf,
- ucr->iobuf_dma);
- return ret;
---
-2.35.1
-
+++ /dev/null
-From 0c62e4eecbf2e3f495eeb9076534220fdd0c4705 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 24 May 2022 01:46:22 +0900
-Subject: modpost: fix undefined behavior of is_arm_mapping_symbol()
-
-From: Masahiro Yamada <masahiroy@kernel.org>
-
-[ Upstream commit d6b732666a1bae0df3c3ae06925043bba34502b1 ]
-
-The return value of is_arm_mapping_symbol() is unpredictable when "$"
-is passed in.
-
-strchr(3) says:
- The strchr() and strrchr() functions return a pointer to the matched
- character or NULL if the character is not found. The terminating null
- byte is considered part of the string, so that if c is specified as
- '\0', these functions return a pointer to the terminator.
-
-When str[1] is '\0', strchr("axtd", str[1]) is not NULL, and str[2] is
-referenced (i.e. buffer overrun).
-
-Test code
----------
-
- char str1[] = "abc";
- char str2[] = "ab";
-
- strcpy(str1, "$");
- strcpy(str2, "$");
-
- printf("test1: %d\n", is_arm_mapping_symbol(str1));
- printf("test2: %d\n", is_arm_mapping_symbol(str2));
-
-Result
-------
-
- test1: 0
- test2: 1
-
-Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
-Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- scripts/mod/modpost.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
-index c42da4a35142..e294b6cff9fd 100644
---- a/scripts/mod/modpost.c
-+++ b/scripts/mod/modpost.c
-@@ -1218,7 +1218,8 @@ static int secref_whitelist(const struct sectioncheck *mismatch,
-
- static inline int is_arm_mapping_symbol(const char *str)
- {
-- return str[0] == '$' && strchr("axtd", str[1])
-+ return str[0] == '$' &&
-+ (str[1] == 'a' || str[1] == 'd' || str[1] == 't' || str[1] == 'x')
- && (str[2] == '\0' || str[2] == '.');
- }
-
---
-2.35.1
-
+++ /dev/null
-From c3764717308f11a02ac159f2fcd162ad453c156e Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 21 May 2022 15:37:44 +0800
-Subject: nbd: call genl_unregister_family() first in nbd_cleanup()
-
-From: Yu Kuai <yukuai3@huawei.com>
-
-[ Upstream commit 06c4da89c24e7023ea448cadf8e9daf06a0aae6e ]
-
-Otherwise there may be race between module removal and the handling of
-netlink command, which can lead to the oops as shown below:
-
- BUG: kernel NULL pointer dereference, address: 0000000000000098
- Oops: 0002 [#1] SMP PTI
- CPU: 1 PID: 31299 Comm: nbd-client Tainted: G E 5.14.0-rc4
- Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
- RIP: 0010:down_write+0x1a/0x50
- Call Trace:
- start_creating+0x89/0x130
- debugfs_create_dir+0x1b/0x130
- nbd_start_device+0x13d/0x390 [nbd]
- nbd_genl_connect+0x42f/0x748 [nbd]
- genl_family_rcv_msg_doit.isra.0+0xec/0x150
- genl_rcv_msg+0xe5/0x1e0
- netlink_rcv_skb+0x55/0x100
- genl_rcv+0x29/0x40
- netlink_unicast+0x1a8/0x250
- netlink_sendmsg+0x21b/0x430
- ____sys_sendmsg+0x2a4/0x2d0
- ___sys_sendmsg+0x81/0xc0
- __sys_sendmsg+0x62/0xb0
- __x64_sys_sendmsg+0x1f/0x30
- do_syscall_64+0x3b/0xc0
- entry_SYSCALL_64_after_hwframe+0x44/0xae
- Modules linked in: nbd(E-)
-
-Signed-off-by: Hou Tao <houtao1@huawei.com>
-Signed-off-by: Yu Kuai <yukuai3@huawei.com>
-Reviewed-by: Josef Bacik <josef@toxicpanda.com>
-Link: https://lore.kernel.org/r/20220521073749.3146892-2-yukuai3@huawei.com
-Signed-off-by: Jens Axboe <axboe@kernel.dk>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/block/nbd.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
-index 81b955670b12..29bed6397173 100644
---- a/drivers/block/nbd.c
-+++ b/drivers/block/nbd.c
-@@ -2337,6 +2337,12 @@ static void __exit nbd_cleanup(void)
- struct nbd_device *nbd;
- LIST_HEAD(del_list);
-
-+ /*
-+ * Unregister netlink interface prior to waiting
-+ * for the completion of netlink commands.
-+ */
-+ genl_unregister_family(&nbd_genl_family);
-+
- nbd_dbg_close();
-
- mutex_lock(&nbd_index_mutex);
-@@ -2352,7 +2358,6 @@ static void __exit nbd_cleanup(void)
- }
-
- idr_destroy(&nbd_index_idr);
-- genl_unregister_family(&nbd_genl_family);
- unregister_blkdev(NBD_MAJOR, "nbd");
- }
-
---
-2.35.1
-
+++ /dev/null
-From e47ccd0254f651efd946b9ce4b3bb6fc419f58e9 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 21 May 2022 15:37:47 +0800
-Subject: nbd: fix io hung while disconnecting device
-
-From: Yu Kuai <yukuai3@huawei.com>
-
-[ Upstream commit 09dadb5985023e27d4740ebd17e6fea4640110e5 ]
-
-In our tests, "qemu-nbd" triggers a io hung:
-
-INFO: task qemu-nbd:11445 blocked for more than 368 seconds.
- Not tainted 5.18.0-rc3-next-20220422-00003-g2176915513ca #884
-"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
-task:qemu-nbd state:D stack: 0 pid:11445 ppid: 1 flags:0x00000000
-Call Trace:
- <TASK>
- __schedule+0x480/0x1050
- ? _raw_spin_lock_irqsave+0x3e/0xb0
- schedule+0x9c/0x1b0
- blk_mq_freeze_queue_wait+0x9d/0xf0
- ? ipi_rseq+0x70/0x70
- blk_mq_freeze_queue+0x2b/0x40
- nbd_add_socket+0x6b/0x270 [nbd]
- nbd_ioctl+0x383/0x510 [nbd]
- blkdev_ioctl+0x18e/0x3e0
- __x64_sys_ioctl+0xac/0x120
- do_syscall_64+0x35/0x80
- entry_SYSCALL_64_after_hwframe+0x44/0xae
-RIP: 0033:0x7fd8ff706577
-RSP: 002b:00007fd8fcdfebf8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
-RAX: ffffffffffffffda RBX: 0000000040000000 RCX: 00007fd8ff706577
-RDX: 000000000000000d RSI: 000000000000ab00 RDI: 000000000000000f
-RBP: 000000000000000f R08: 000000000000fbe8 R09: 000055fe497c62b0
-R10: 00000002aff20000 R11: 0000000000000246 R12: 000000000000006d
-R13: 0000000000000000 R14: 00007ffe82dc5e70 R15: 00007fd8fcdff9c0
-
-"qemu-ndb -d" will call ioctl 'NBD_DISCONNECT' first, however, following
-message was found:
-
-block nbd0: Send disconnect failed -32
-
-Which indicate that something is wrong with the server. Then,
-"qemu-nbd -d" will call ioctl 'NBD_CLEAR_SOCK', however ioctl can't clear
-requests after commit 2516ab1543fd("nbd: only clear the queue on device
-teardown"). And in the meantime, request can't complete through timeout
-because nbd_xmit_timeout() will always return 'BLK_EH_RESET_TIMER', which
-means such request will never be completed in this situation.
-
-Now that the flag 'NBD_CMD_INFLIGHT' can make sure requests won't
-complete multiple times, switch back to call nbd_clear_sock() in
-nbd_clear_sock_ioctl(), so that inflight requests can be cleared.
-
-Signed-off-by: Yu Kuai <yukuai3@huawei.com>
-Reviewed-by: Josef Bacik <josef@toxicpanda.com>
-Link: https://lore.kernel.org/r/20220521073749.3146892-5-yukuai3@huawei.com
-Signed-off-by: Jens Axboe <axboe@kernel.dk>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/block/nbd.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
-index f48553979b85..2ef7eec6461c 100644
---- a/drivers/block/nbd.c
-+++ b/drivers/block/nbd.c
-@@ -1288,7 +1288,7 @@ static int nbd_start_device_ioctl(struct nbd_device *nbd, struct block_device *b
- static void nbd_clear_sock_ioctl(struct nbd_device *nbd,
- struct block_device *bdev)
- {
-- sock_shutdown(nbd);
-+ nbd_clear_sock(nbd);
- __invalidate_device(bdev, true);
- nbd_bdev_reset(bdev);
- if (test_and_clear_bit(NBD_HAS_CONFIG_REF,
---
-2.35.1
-
+++ /dev/null
-From f178a3f22b9530d0fbb9050264ec64fada3b9ac0 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 21 May 2022 15:37:45 +0800
-Subject: nbd: fix race between nbd_alloc_config() and module removal
-
-From: Yu Kuai <yukuai3@huawei.com>
-
-[ Upstream commit c55b2b983b0fa012942c3eb16384b2b722caa810 ]
-
-When nbd module is being removing, nbd_alloc_config() may be
-called concurrently by nbd_genl_connect(), although try_module_get()
-will return false, but nbd_alloc_config() doesn't handle it.
-
-The race may lead to the leak of nbd_config and its related
-resources (e.g, recv_workq) and oops in nbd_read_stat() due
-to the unload of nbd module as shown below:
-
- BUG: kernel NULL pointer dereference, address: 0000000000000040
- Oops: 0000 [#1] SMP PTI
- CPU: 5 PID: 13840 Comm: kworker/u17:33 Not tainted 5.14.0+ #1
- Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
- Workqueue: knbd16-recv recv_work [nbd]
- RIP: 0010:nbd_read_stat.cold+0x130/0x1a4 [nbd]
- Call Trace:
- recv_work+0x3b/0xb0 [nbd]
- process_one_work+0x1ed/0x390
- worker_thread+0x4a/0x3d0
- kthread+0x12a/0x150
- ret_from_fork+0x22/0x30
-
-Fixing it by checking the return value of try_module_get()
-in nbd_alloc_config(). As nbd_alloc_config() may return ERR_PTR(-ENODEV),
-assign nbd->config only when nbd_alloc_config() succeeds to ensure
-the value of nbd->config is binary (valid or NULL).
-
-Also adding a debug message to check the reference counter
-of nbd_config during module removal.
-
-Signed-off-by: Hou Tao <houtao1@huawei.com>
-Signed-off-by: Yu Kuai <yukuai3@huawei.com>
-Reviewed-by: Josef Bacik <josef@toxicpanda.com>
-Link: https://lore.kernel.org/r/20220521073749.3146892-3-yukuai3@huawei.com
-Signed-off-by: Jens Axboe <axboe@kernel.dk>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/block/nbd.c | 28 +++++++++++++++++++---------
- 1 file changed, 19 insertions(+), 9 deletions(-)
-
-diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
-index 29bed6397173..f48553979b85 100644
---- a/drivers/block/nbd.c
-+++ b/drivers/block/nbd.c
-@@ -1395,15 +1395,20 @@ static struct nbd_config *nbd_alloc_config(void)
- {
- struct nbd_config *config;
-
-+ if (!try_module_get(THIS_MODULE))
-+ return ERR_PTR(-ENODEV);
-+
- config = kzalloc(sizeof(struct nbd_config), GFP_NOFS);
-- if (!config)
-- return NULL;
-+ if (!config) {
-+ module_put(THIS_MODULE);
-+ return ERR_PTR(-ENOMEM);
-+ }
-+
- atomic_set(&config->recv_threads, 0);
- init_waitqueue_head(&config->recv_wq);
- init_waitqueue_head(&config->conn_wait);
- config->blksize = NBD_DEF_BLKSIZE;
- atomic_set(&config->live_connections, 0);
-- try_module_get(THIS_MODULE);
- return config;
- }
-
-@@ -1430,12 +1435,13 @@ static int nbd_open(struct block_device *bdev, fmode_t mode)
- mutex_unlock(&nbd->config_lock);
- goto out;
- }
-- config = nbd->config = nbd_alloc_config();
-- if (!config) {
-- ret = -ENOMEM;
-+ config = nbd_alloc_config();
-+ if (IS_ERR(config)) {
-+ ret = PTR_ERR(config);
- mutex_unlock(&nbd->config_lock);
- goto out;
- }
-+ nbd->config = config;
- refcount_set(&nbd->config_refs, 1);
- refcount_inc(&nbd->refs);
- mutex_unlock(&nbd->config_lock);
-@@ -1820,13 +1826,14 @@ static int nbd_genl_connect(struct sk_buff *skb, struct genl_info *info)
- nbd_put(nbd);
- return -EINVAL;
- }
-- config = nbd->config = nbd_alloc_config();
-- if (!nbd->config) {
-+ config = nbd_alloc_config();
-+ if (IS_ERR(config)) {
- mutex_unlock(&nbd->config_lock);
- nbd_put(nbd);
- printk(KERN_ERR "nbd: couldn't allocate config\n");
-- return -ENOMEM;
-+ return PTR_ERR(config);
- }
-+ nbd->config = config;
- refcount_set(&nbd->config_refs, 1);
- set_bit(NBD_BOUND, &config->runtime_flags);
-
-@@ -2352,6 +2359,9 @@ static void __exit nbd_cleanup(void)
- while (!list_empty(&del_list)) {
- nbd = list_first_entry(&del_list, struct nbd_device, list);
- list_del_init(&nbd->list);
-+ if (refcount_read(&nbd->config_refs))
-+ printk(KERN_ERR "nbd: possibly leaking nbd_config (ref %d)\n",
-+ refcount_read(&nbd->config_refs));
- if (refcount_read(&nbd->refs) != 1)
- printk(KERN_ERR "nbd: possibly leaking a device\n");
- nbd_put(nbd);
---
-2.35.1
-
+++ /dev/null
-From b3c9fefcfd08ce45a1255a42aface6a724a9c7c0 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 18 May 2022 13:52:23 -0700
-Subject: nodemask: Fix return values to be unsigned
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Kees Cook <keescook@chromium.org>
-
-[ Upstream commit 0dfe54071d7c828a02917b595456bfde1afdddc9 ]
-
-The nodemask routines had mixed return values that provided potentially
-signed return values that could never happen. This was leading to the
-compiler getting confusing about the range of possible return values
-(it was thinking things could be negative where they could not be). Fix
-all the nodemask routines that should be returning unsigned
-(or bool) values. Silences:
-
- mm/swapfile.c: In function ‘setup_swap_info’:
- mm/swapfile.c:2291:47: error: array subscript -1 is below array bounds of ‘struct plist_node[]’ [-Werror=array-bounds]
- 2291 | p->avail_lists[i].prio = 1;
- | ~~~~~~~~~~~~~~^~~
- In file included from mm/swapfile.c:16:
- ./include/linux/swap.h:292:27: note: while referencing ‘avail_lists’
- 292 | struct plist_node avail_lists[]; /*
- | ^~~~~~~~~~~
-
-Reported-by: Christophe de Dinechin <dinechin@redhat.com>
-Link: https://lore.kernel.org/lkml/20220414150855.2407137-3-dinechin@redhat.com/
-Cc: Alexey Dobriyan <adobriyan@gmail.com>
-Cc: Yury Norov <yury.norov@gmail.com>
-Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
-Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
-Cc: Andrew Morton <akpm@linux-foundation.org>
-Cc: Zhen Lei <thunder.leizhen@huawei.com>
-Signed-off-by: Kees Cook <keescook@chromium.org>
-Signed-off-by: Yury Norov <yury.norov@gmail.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- include/linux/nodemask.h | 38 +++++++++++++++++++-------------------
- lib/nodemask.c | 4 ++--
- 2 files changed, 21 insertions(+), 21 deletions(-)
-
-diff --git a/include/linux/nodemask.h b/include/linux/nodemask.h
-index ef903b072fce..326744b7d15e 100644
---- a/include/linux/nodemask.h
-+++ b/include/linux/nodemask.h
-@@ -42,11 +42,11 @@
- * void nodes_shift_right(dst, src, n) Shift right
- * void nodes_shift_left(dst, src, n) Shift left
- *
-- * int first_node(mask) Number lowest set bit, or MAX_NUMNODES
-- * int next_node(node, mask) Next node past 'node', or MAX_NUMNODES
-- * int next_node_in(node, mask) Next node past 'node', or wrap to first,
-+ * unsigned int first_node(mask) Number lowest set bit, or MAX_NUMNODES
-+ * unsigend int next_node(node, mask) Next node past 'node', or MAX_NUMNODES
-+ * unsigned int next_node_in(node, mask) Next node past 'node', or wrap to first,
- * or MAX_NUMNODES
-- * int first_unset_node(mask) First node not set in mask, or
-+ * unsigned int first_unset_node(mask) First node not set in mask, or
- * MAX_NUMNODES
- *
- * nodemask_t nodemask_of_node(node) Return nodemask with bit 'node' set
-@@ -153,7 +153,7 @@ static inline void __nodes_clear(nodemask_t *dstp, unsigned int nbits)
-
- #define node_test_and_set(node, nodemask) \
- __node_test_and_set((node), &(nodemask))
--static inline int __node_test_and_set(int node, nodemask_t *addr)
-+static inline bool __node_test_and_set(int node, nodemask_t *addr)
- {
- return test_and_set_bit(node, addr->bits);
- }
-@@ -200,7 +200,7 @@ static inline void __nodes_complement(nodemask_t *dstp,
-
- #define nodes_equal(src1, src2) \
- __nodes_equal(&(src1), &(src2), MAX_NUMNODES)
--static inline int __nodes_equal(const nodemask_t *src1p,
-+static inline bool __nodes_equal(const nodemask_t *src1p,
- const nodemask_t *src2p, unsigned int nbits)
- {
- return bitmap_equal(src1p->bits, src2p->bits, nbits);
-@@ -208,7 +208,7 @@ static inline int __nodes_equal(const nodemask_t *src1p,
-
- #define nodes_intersects(src1, src2) \
- __nodes_intersects(&(src1), &(src2), MAX_NUMNODES)
--static inline int __nodes_intersects(const nodemask_t *src1p,
-+static inline bool __nodes_intersects(const nodemask_t *src1p,
- const nodemask_t *src2p, unsigned int nbits)
- {
- return bitmap_intersects(src1p->bits, src2p->bits, nbits);
-@@ -216,20 +216,20 @@ static inline int __nodes_intersects(const nodemask_t *src1p,
-
- #define nodes_subset(src1, src2) \
- __nodes_subset(&(src1), &(src2), MAX_NUMNODES)
--static inline int __nodes_subset(const nodemask_t *src1p,
-+static inline bool __nodes_subset(const nodemask_t *src1p,
- const nodemask_t *src2p, unsigned int nbits)
- {
- return bitmap_subset(src1p->bits, src2p->bits, nbits);
- }
-
- #define nodes_empty(src) __nodes_empty(&(src), MAX_NUMNODES)
--static inline int __nodes_empty(const nodemask_t *srcp, unsigned int nbits)
-+static inline bool __nodes_empty(const nodemask_t *srcp, unsigned int nbits)
- {
- return bitmap_empty(srcp->bits, nbits);
- }
-
- #define nodes_full(nodemask) __nodes_full(&(nodemask), MAX_NUMNODES)
--static inline int __nodes_full(const nodemask_t *srcp, unsigned int nbits)
-+static inline bool __nodes_full(const nodemask_t *srcp, unsigned int nbits)
- {
- return bitmap_full(srcp->bits, nbits);
- }
-@@ -260,15 +260,15 @@ static inline void __nodes_shift_left(nodemask_t *dstp,
- > MAX_NUMNODES, then the silly min_ts could be dropped. */
-
- #define first_node(src) __first_node(&(src))
--static inline int __first_node(const nodemask_t *srcp)
-+static inline unsigned int __first_node(const nodemask_t *srcp)
- {
-- return min_t(int, MAX_NUMNODES, find_first_bit(srcp->bits, MAX_NUMNODES));
-+ return min_t(unsigned int, MAX_NUMNODES, find_first_bit(srcp->bits, MAX_NUMNODES));
- }
-
- #define next_node(n, src) __next_node((n), &(src))
--static inline int __next_node(int n, const nodemask_t *srcp)
-+static inline unsigned int __next_node(int n, const nodemask_t *srcp)
- {
-- return min_t(int,MAX_NUMNODES,find_next_bit(srcp->bits, MAX_NUMNODES, n+1));
-+ return min_t(unsigned int, MAX_NUMNODES, find_next_bit(srcp->bits, MAX_NUMNODES, n+1));
- }
-
- /*
-@@ -276,7 +276,7 @@ static inline int __next_node(int n, const nodemask_t *srcp)
- * the first node in src if needed. Returns MAX_NUMNODES if src is empty.
- */
- #define next_node_in(n, src) __next_node_in((n), &(src))
--int __next_node_in(int node, const nodemask_t *srcp);
-+unsigned int __next_node_in(int node, const nodemask_t *srcp);
-
- static inline void init_nodemask_of_node(nodemask_t *mask, int node)
- {
-@@ -296,9 +296,9 @@ static inline void init_nodemask_of_node(nodemask_t *mask, int node)
- })
-
- #define first_unset_node(mask) __first_unset_node(&(mask))
--static inline int __first_unset_node(const nodemask_t *maskp)
-+static inline unsigned int __first_unset_node(const nodemask_t *maskp)
- {
-- return min_t(int,MAX_NUMNODES,
-+ return min_t(unsigned int, MAX_NUMNODES,
- find_first_zero_bit(maskp->bits, MAX_NUMNODES));
- }
-
-@@ -434,11 +434,11 @@ static inline int num_node_state(enum node_states state)
-
- #define first_online_node first_node(node_states[N_ONLINE])
- #define first_memory_node first_node(node_states[N_MEMORY])
--static inline int next_online_node(int nid)
-+static inline unsigned int next_online_node(int nid)
- {
- return next_node(nid, node_states[N_ONLINE]);
- }
--static inline int next_memory_node(int nid)
-+static inline unsigned int next_memory_node(int nid)
- {
- return next_node(nid, node_states[N_MEMORY]);
- }
-diff --git a/lib/nodemask.c b/lib/nodemask.c
-index 3aa454c54c0d..e22647f5181b 100644
---- a/lib/nodemask.c
-+++ b/lib/nodemask.c
-@@ -3,9 +3,9 @@
- #include <linux/module.h>
- #include <linux/random.h>
-
--int __next_node_in(int node, const nodemask_t *srcp)
-+unsigned int __next_node_in(int node, const nodemask_t *srcp)
- {
-- int ret = __next_node(node, srcp);
-+ unsigned int ret = __next_node(node, srcp);
-
- if (ret == MAX_NUMNODES)
- ret = __first_node(srcp);
---
-2.35.1
-
+++ /dev/null
-From 3721159ea5ed633738d071ae51ccf9b76219cc4a Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 23 May 2022 22:05:24 +0200
-Subject: Revert "net: af_key: add check for pfkey_broadcast in function
- pfkey_process"
-
-From: Michal Kubecek <mkubecek@suse.cz>
-
-[ Upstream commit 9c90c9b3e50e16d03c7f87d63e9db373974781e0 ]
-
-This reverts commit 4dc2a5a8f6754492180741facf2a8787f2c415d7.
-
-A non-zero return value from pfkey_broadcast() does not necessarily mean
-an error occurred as this function returns -ESRCH when no registered
-listener received the message. In particular, a call with
-BROADCAST_PROMISC_ONLY flag and null one_sk argument can never return
-zero so that this commit in fact prevents processing any PF_KEY message.
-One visible effect is that racoon daemon fails to find encryption
-algorithms like aes and refuses to start.
-
-Excluding -ESRCH return value would fix this but it's not obvious that
-we really want to bail out here and most other callers of
-pfkey_broadcast() also ignore the return value. Also, as pointed out by
-Steffen Klassert, PF_KEY is kind of deprecated and newer userspace code
-should use netlink instead so that we should only disturb the code for
-really important fixes.
-
-v2: add a comment explaining why is the return value ignored
-
-Signed-off-by: Michal Kubecek <mkubecek@suse.cz>
-Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/key/af_key.c | 10 ++++++----
- 1 file changed, 6 insertions(+), 4 deletions(-)
-
-diff --git a/net/key/af_key.c b/net/key/af_key.c
-index 1bbb6ec89ff3..af67e0d265c0 100644
---- a/net/key/af_key.c
-+++ b/net/key/af_key.c
-@@ -2836,10 +2836,12 @@ static int pfkey_process(struct sock *sk, struct sk_buff *skb, const struct sadb
- void *ext_hdrs[SADB_EXT_MAX];
- int err;
-
-- err = pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL,
-- BROADCAST_PROMISC_ONLY, NULL, sock_net(sk));
-- if (err)
-- return err;
-+ /* Non-zero return value of pfkey_broadcast() does not always signal
-+ * an error and even on an actual error we may still want to process
-+ * the message so rather ignore the return value.
-+ */
-+ pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL,
-+ BROADCAST_PROMISC_ONLY, NULL, sock_net(sk));
-
- memset(ext_hdrs, 0, sizeof(ext_hdrs));
- err = parse_exthdrs(skb, hdr, ext_hdrs);
---
-2.35.1
-
+++ /dev/null
-From 88345bcd96cbe7e565b7ebf76ce6c130e7663dab Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 6 May 2022 23:39:24 +0206
-Subject: serial: msm_serial: disable interrupts in __msm_console_write()
-
-From: John Ogness <john.ogness@linutronix.de>
-
-[ Upstream commit aabdbb1b7a5819e18c403334a31fb0cc2c06ad41 ]
-
-__msm_console_write() assumes that interrupts are disabled, but
-with threaded console printers it is possible that the write()
-callback of the console is called with interrupts enabled.
-
-Explicitly disable interrupts using local_irq_save() to preserve
-the assumed context.
-
-Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
-Reviewed-by: Petr Mladek <pmladek@suse.com>
-Signed-off-by: John Ogness <john.ogness@linutronix.de>
-Link: https://lore.kernel.org/r/20220506213324.470461-1-john.ogness@linutronix.de
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/tty/serial/msm_serial.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/drivers/tty/serial/msm_serial.c b/drivers/tty/serial/msm_serial.c
-index a40827956bd1..d248c43db36a 100644
---- a/drivers/tty/serial/msm_serial.c
-+++ b/drivers/tty/serial/msm_serial.c
-@@ -1579,6 +1579,7 @@ static inline struct uart_port *msm_get_port_from_line(unsigned int line)
- static void __msm_console_write(struct uart_port *port, const char *s,
- unsigned int count, bool is_uartdm)
- {
-+ unsigned long flags;
- int i;
- int num_newlines = 0;
- bool replaced = false;
-@@ -1596,6 +1597,8 @@ static void __msm_console_write(struct uart_port *port, const char *s,
- num_newlines++;
- count += num_newlines;
-
-+ local_irq_save(flags);
-+
- if (port->sysrq)
- locked = 0;
- else if (oops_in_progress)
-@@ -1641,6 +1644,8 @@ static void __msm_console_write(struct uart_port *port, const char *s,
-
- if (locked)
- spin_unlock(&port->lock);
-+
-+ local_irq_restore(flags);
- }
-
- static void msm_console_write(struct console *co, const char *s,
---
-2.35.1
-
ip_gre-test-csum_start-instead-of-transport-header.patch
net-altera-fix-refcount-leak-in-altera_tse_mdio_crea.patch
drm-imx-fix-compiler-warning-with-gcc-12.patch
-iio-dummy-iio_simple_dummy-check-the-return-value-of.patch
-lkdtm-usercopy-expand-size-of-out-of-frame-object.patch
-tty-synclink_gt-fix-null-pointer-dereference-in-slgt.patch
-tty-fix-a-possible-resource-leak-in-icom_probe.patch
-drivers-staging-rtl8192u-fix-deadlock-in-ieee80211_b.patch
-drivers-staging-rtl8192e-fix-deadlock-in-rtllib_beac.patch
-usb-host-isp116x-check-return-value-after-calling-pl.patch
-drivers-tty-serial-fix-deadlock-in-sa1100_set_termio.patch
-drivers-usb-host-fix-deadlock-in-oxu_bus_suspend.patch
-usb-hcd-pci-fully-suspend-across-freeze-thaw-cycle.patch
-usb-dwc2-gadget-don-t-reset-gadget-s-driver-bus.patch
-misc-rtsx-set-null-intfdata-when-probe-fails.patch
-extcon-modify-extcon-device-to-be-created-after-driv.patch
-clocksource-drivers-sp804-avoid-error-on-multiple-in.patch
-staging-rtl8712-fix-uninit-value-in-r871xu_drv_init.patch
-serial-msm_serial-disable-interrupts-in-__msm_consol.patch
-kernfs-separate-kernfs_pr_cont_buf-and-rename_lock.patch
-md-protect-md_unregister_thread-from-reentrancy.patch
-revert-net-af_key-add-check-for-pfkey_broadcast-in-f.patch
-ceph-allow-ceph.dir.rctime-xattr-to-be-updatable.patch
-drm-radeon-fix-a-possible-null-pointer-dereference.patch
-modpost-fix-undefined-behavior-of-is_arm_mapping_sym.patch
-nbd-call-genl_unregister_family-first-in-nbd_cleanup.patch
-nbd-fix-race-between-nbd_alloc_config-and-module-rem.patch
-nbd-fix-io-hung-while-disconnecting-device.patch
-nodemask-fix-return-values-to-be-unsigned.patch
-iio-dummy-iio_simple_dummy-check-the-return-value-of.patch-193
-lkdtm-usercopy-expand-size-of-out-of-frame-object.patch-19786
-tty-synclink_gt-fix-null-pointer-dereference-in-slgt.patch-7469
-tty-fix-a-possible-resource-leak-in-icom_probe.patch-11463
-drivers-staging-rtl8192u-fix-deadlock-in-ieee80211_b.patch-26698
-drivers-staging-rtl8192e-fix-deadlock-in-rtllib_beac.patch-22761
-usb-host-isp116x-check-return-value-after-calling-pl.patch-19266
-drivers-tty-serial-fix-deadlock-in-sa1100_set_termio.patch-24881
-drivers-usb-host-fix-deadlock-in-oxu_bus_suspend.patch-13773
-usb-hcd-pci-fully-suspend-across-freeze-thaw-cycle.patch-5045
-usb-dwc2-gadget-don-t-reset-gadget-s-driver-bus.patch-658
-misc-rtsx-set-null-intfdata-when-probe-fails.patch-8707
-extcon-modify-extcon-device-to-be-created-after-driv.patch-22090
-clocksource-drivers-sp804-avoid-error-on-multiple-in.patch-13085
-staging-rtl8712-fix-uninit-value-in-r871xu_drv_init.patch-1226
-serial-msm_serial-disable-interrupts-in-__msm_consol.patch-17060
-kernfs-separate-kernfs_pr_cont_buf-and-rename_lock.patch-23112
-md-protect-md_unregister_thread-from-reentrancy.patch-9726
-revert-net-af_key-add-check-for-pfkey_broadcast-in-f.patch-3907
-ceph-allow-ceph.dir.rctime-xattr-to-be-updatable.patch-5266
-drm-radeon-fix-a-possible-null-pointer-dereference.patch-18738
-modpost-fix-undefined-behavior-of-is_arm_mapping_sym.patch-32246
-nbd-call-genl_unregister_family-first-in-nbd_cleanup.patch-25602
-nbd-fix-race-between-nbd_alloc_config-and-module-rem.patch-24566
-nbd-fix-io-hung-while-disconnecting-device.patch-21333
-nodemask-fix-return-values-to-be-unsigned.patch-30519
-iio-dummy-iio_simple_dummy-check-the-return-value-of.patch-14092
-lkdtm-usercopy-expand-size-of-out-of-frame-object.patch-26299
-tty-synclink_gt-fix-null-pointer-dereference-in-slgt.patch-32698
-tty-fix-a-possible-resource-leak-in-icom_probe.patch-10311
-drivers-staging-rtl8192u-fix-deadlock-in-ieee80211_b.patch-25264
-drivers-staging-rtl8192e-fix-deadlock-in-rtllib_beac.patch-31412
-usb-host-isp116x-check-return-value-after-calling-pl.patch-23534
-drivers-tty-serial-fix-deadlock-in-sa1100_set_termio.patch-11347
-drivers-usb-host-fix-deadlock-in-oxu_bus_suspend.patch-23012
-usb-hcd-pci-fully-suspend-across-freeze-thaw-cycle.patch-10013
-usb-dwc2-gadget-don-t-reset-gadget-s-driver-bus.patch-2175
-misc-rtsx-set-null-intfdata-when-probe-fails.patch-32427
-extcon-modify-extcon-device-to-be-created-after-driv.patch-27776
-clocksource-drivers-sp804-avoid-error-on-multiple-in.patch-15468
-staging-rtl8712-fix-uninit-value-in-r871xu_drv_init.patch-15740
-serial-msm_serial-disable-interrupts-in-__msm_consol.patch-19691
-kernfs-separate-kernfs_pr_cont_buf-and-rename_lock.patch-1687
-md-protect-md_unregister_thread-from-reentrancy.patch-23226
-revert-net-af_key-add-check-for-pfkey_broadcast-in-f.patch-11878
-ceph-allow-ceph.dir.rctime-xattr-to-be-updatable.patch-26891
-drm-radeon-fix-a-possible-null-pointer-dereference.patch-6700
-modpost-fix-undefined-behavior-of-is_arm_mapping_sym.patch-18620
-nbd-call-genl_unregister_family-first-in-nbd_cleanup.patch-19100
-nbd-fix-race-between-nbd_alloc_config-and-module-rem.patch-14677
-nbd-fix-io-hung-while-disconnecting-device.patch-30631
-nodemask-fix-return-values-to-be-unsigned.patch-6667
+++ /dev/null
-From 948a4152d95d44d3a06110dcc4394187bc0b38a3 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 16 May 2022 17:22:41 +0800
-Subject: staging: rtl8712: fix uninit-value in r871xu_drv_init()
-
-From: Wang Cheng <wanngchenng@gmail.com>
-
-[ Upstream commit 0458e5428e5e959d201a40ffe71d762a79ecedc4 ]
-
-When 'tmpU1b' returns from r8712_read8(padapter, EE_9346CR) is 0,
-'mac[6]' will not be initialized.
-
-BUG: KMSAN: uninit-value in r871xu_drv_init+0x2d54/0x3070 drivers/staging/rtl8712/usb_intf.c:541
- r871xu_drv_init+0x2d54/0x3070 drivers/staging/rtl8712/usb_intf.c:541
- usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396
- really_probe+0x653/0x14b0 drivers/base/dd.c:596
- __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752
- driver_probe_device drivers/base/dd.c:782 [inline]
- __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899
- bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427
- __device_attach+0x593/0x8e0 drivers/base/dd.c:970
- device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017
- bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487
- device_add+0x1fff/0x26e0 drivers/base/core.c:3405
- usb_set_configuration+0x37e9/0x3ed0 drivers/usb/core/message.c:2170
- usb_generic_driver_probe+0x13c/0x300 drivers/usb/core/generic.c:238
- usb_probe_device+0x309/0x570 drivers/usb/core/driver.c:293
- really_probe+0x653/0x14b0 drivers/base/dd.c:596
- __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752
- driver_probe_device drivers/base/dd.c:782 [inline]
- __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899
- bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427
- __device_attach+0x593/0x8e0 drivers/base/dd.c:970
- device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017
- bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487
- device_add+0x1fff/0x26e0 drivers/base/core.c:3405
- usb_new_device+0x1b8e/0x2950 drivers/usb/core/hub.c:2566
- hub_port_connect drivers/usb/core/hub.c:5358 [inline]
- hub_port_connect_change drivers/usb/core/hub.c:5502 [inline]
- port_event drivers/usb/core/hub.c:5660 [inline]
- hub_event+0x58e3/0x89e0 drivers/usb/core/hub.c:5742
- process_one_work+0xdb6/0x1820 kernel/workqueue.c:2307
- worker_thread+0x10b3/0x21e0 kernel/workqueue.c:2454
- kthread+0x3c7/0x500 kernel/kthread.c:377
- ret_from_fork+0x1f/0x30
-
-Local variable mac created at:
- r871xu_drv_init+0x1771/0x3070 drivers/staging/rtl8712/usb_intf.c:394
- usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396
-
-KMSAN: uninit-value in r871xu_drv_init
-https://syzkaller.appspot.com/bug?id=3cd92b1d85428b128503bfa7a250294c9ae00bd8
-
-Reported-by: <syzbot+6f5ecd144854c0d8580b@syzkaller.appspotmail.com>
-Tested-by: <syzbot+6f5ecd144854c0d8580b@syzkaller.appspotmail.com>
-Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
-Signed-off-by: Wang Cheng <wanngchenng@gmail.com>
-Link: https://lore.kernel.org/r/14c3886173dfa4597f0704547c414cfdbcd11d16.1652618244.git.wanngchenng@gmail.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/staging/rtl8712/usb_intf.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/staging/rtl8712/usb_intf.c b/drivers/staging/rtl8712/usb_intf.c
-index 5e2cdc25401b..2b1ff63913af 100644
---- a/drivers/staging/rtl8712/usb_intf.c
-+++ b/drivers/staging/rtl8712/usb_intf.c
-@@ -569,13 +569,13 @@ static int r871xu_drv_init(struct usb_interface *pusb_intf,
- } else {
- AutoloadFail = false;
- }
-- if (((mac[0] == 0xff) && (mac[1] == 0xff) &&
-+ if ((!AutoloadFail) ||
-+ ((mac[0] == 0xff) && (mac[1] == 0xff) &&
- (mac[2] == 0xff) && (mac[3] == 0xff) &&
- (mac[4] == 0xff) && (mac[5] == 0xff)) ||
- ((mac[0] == 0x00) && (mac[1] == 0x00) &&
- (mac[2] == 0x00) && (mac[3] == 0x00) &&
-- (mac[4] == 0x00) && (mac[5] == 0x00)) ||
-- (!AutoloadFail)) {
-+ (mac[4] == 0x00) && (mac[5] == 0x00))) {
- mac[0] = 0x00;
- mac[1] = 0xe0;
- mac[2] = 0x4c;
---
-2.35.1
-
+++ /dev/null
-From bf903152f82411e30e3444279b265042276636df Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 31 Mar 2022 17:10:05 +0800
-Subject: tty: Fix a possible resource leak in icom_probe
-
-From: Huang Guobin <huangguobin4@huawei.com>
-
-[ Upstream commit ee157a79e7c82b01ae4c25de0ac75899801f322c ]
-
-When pci_read_config_dword failed, call pci_release_regions() and
-pci_disable_device() to recycle the resource previously allocated.
-
-Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
-Signed-off-by: Huang Guobin <huangguobin4@huawei.com>
-Link: https://lore.kernel.org/r/20220331091005.3290753-1-huangguobin4@huawei.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/tty/serial/icom.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/tty/serial/icom.c b/drivers/tty/serial/icom.c
-index ad374f7c476d..cb950c78d66d 100644
---- a/drivers/tty/serial/icom.c
-+++ b/drivers/tty/serial/icom.c
-@@ -1501,7 +1501,7 @@ static int icom_probe(struct pci_dev *dev,
- retval = pci_read_config_dword(dev, PCI_COMMAND, &command_reg);
- if (retval) {
- dev_err(&dev->dev, "PCI Config read FAILED\n");
-- return retval;
-+ goto probe_exit0;
- }
-
- pci_write_config_dword(dev, PCI_COMMAND,
---
-2.35.1
-
+++ /dev/null
-From 21a27a234747216dbcfb9c8e20d373dab6621c82 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 10 Apr 2022 19:48:14 +0800
-Subject: tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
-
-From: Zheyu Ma <zheyuma97@gmail.com>
-
-[ Upstream commit 689ca31c542687709ba21ec2195c1fbce34fd029 ]
-
-When the driver fails at alloc_hdlcdev(), and then we remove the driver
-module, we will get the following splat:
-
-[ 25.065966] general protection fault, probably for non-canonical address 0xdffffc0000000182: 0000 [#1] PREEMPT SMP KASAN PTI
-[ 25.066914] KASAN: null-ptr-deref in range [0x0000000000000c10-0x0000000000000c17]
-[ 25.069262] RIP: 0010:detach_hdlc_protocol+0x2a/0x3e0
-[ 25.077709] Call Trace:
-[ 25.077924] <TASK>
-[ 25.078108] unregister_hdlc_device+0x16/0x30
-[ 25.078481] slgt_cleanup+0x157/0x9f0 [synclink_gt]
-
-Fix this by checking whether the 'info->netdev' is a null pointer first.
-
-Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
-Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
-Link: https://lore.kernel.org/r/20220410114814.3920474-1-zheyuma97@gmail.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/tty/synclink_gt.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/drivers/tty/synclink_gt.c b/drivers/tty/synclink_gt.c
-index afe34beec720..11c62fcd67f2 100644
---- a/drivers/tty/synclink_gt.c
-+++ b/drivers/tty/synclink_gt.c
-@@ -1753,6 +1753,8 @@ static int hdlcdev_init(struct slgt_info *info)
- */
- static void hdlcdev_exit(struct slgt_info *info)
- {
-+ if (!info->netdev)
-+ return;
- unregister_hdlc_device(info->netdev);
- free_netdev(info->netdev);
- info->netdev = NULL;
---
-2.35.1
-
+++ /dev/null
-From fc7e37a48b64e89fd552c1e68b33085534eac04b Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 5 May 2022 12:46:18 +0200
-Subject: usb: dwc2: gadget: don't reset gadget's driver->bus
-
-From: Marek Szyprowski <m.szyprowski@samsung.com>
-
-[ Upstream commit 3120aac6d0ecd9accf56894aeac0e265f74d3d5a ]
-
-UDC driver should not touch gadget's driver internals, especially it
-should not reset driver->bus. This wasn't harmful so far, but since
-commit fc274c1e9973 ("USB: gadget: Add a new bus for gadgets") gadget
-subsystem got it's own bus and messing with ->bus triggers the
-following NULL pointer dereference:
-
-dwc2 12480000.hsotg: bound driver g_ether
-8<--- cut here ---
-Unable to handle kernel NULL pointer dereference at virtual address 00000000
-[00000000] *pgd=00000000
-Internal error: Oops: 5 [#1] SMP ARM
-Modules linked in: ...
-CPU: 0 PID: 620 Comm: modprobe Not tainted 5.18.0-rc5-next-20220504 #11862
-Hardware name: Samsung Exynos (Flattened Device Tree)
-PC is at module_add_driver+0x44/0xe8
-LR is at sysfs_do_create_link_sd+0x84/0xe0
-...
-Process modprobe (pid: 620, stack limit = 0x(ptrval))
-...
- module_add_driver from bus_add_driver+0xf4/0x1e4
- bus_add_driver from driver_register+0x78/0x10c
- driver_register from usb_gadget_register_driver_owner+0x40/0xb4
- usb_gadget_register_driver_owner from do_one_initcall+0x44/0x1e0
- do_one_initcall from do_init_module+0x44/0x1c8
- do_init_module from load_module+0x19b8/0x1b9c
- load_module from sys_finit_module+0xdc/0xfc
- sys_finit_module from ret_fast_syscall+0x0/0x54
-Exception stack(0xf1771fa8 to 0xf1771ff0)
-...
-dwc2 12480000.hsotg: new device is high-speed
----[ end trace 0000000000000000 ]---
-
-Fix this by removing driver->bus entry reset.
-
-Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
-Link: https://lore.kernel.org/r/20220505104618.22729-1-m.szyprowski@samsung.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/dwc2/gadget.c | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
-index 1e46005929e4..85d25f7e9c27 100644
---- a/drivers/usb/dwc2/gadget.c
-+++ b/drivers/usb/dwc2/gadget.c
-@@ -4326,7 +4326,6 @@ static int dwc2_hsotg_udc_start(struct usb_gadget *gadget,
-
- WARN_ON(hsotg->driver);
-
-- driver->driver.bus = NULL;
- hsotg->driver = driver;
- hsotg->gadget.dev.of_node = hsotg->dev->of_node;
- hsotg->gadget.speed = USB_SPEED_UNKNOWN;
---
-2.35.1
-
+++ /dev/null
-From 2138ae9a42337fec453b210efb95ebd8651a61da Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 21 Apr 2022 10:39:27 -0700
-Subject: USB: hcd-pci: Fully suspend across freeze/thaw cycle
-
-From: Evan Green <evgreen@chromium.org>
-
-[ Upstream commit 63acaa8e9c65dc34dc249440216f8e977f5d2748 ]
-
-The documentation for the freeze() method says that it "should quiesce
-the device so that it doesn't generate IRQs or DMA". The unspoken
-consequence of not doing this is that MSIs aimed at non-boot CPUs may
-get fully lost if they're sent during the period where the target CPU is
-offline.
-
-The current callbacks for USB HCD do not fully quiesce interrupts,
-specifically on XHCI. Change to use the full suspend/resume flow for
-freeze/thaw to ensure interrupts are fully quiesced. This fixes issues
-where USB devices fail to thaw during hibernation because XHCI misses
-its interrupt and cannot recover.
-
-Acked-by: Alan Stern <stern@rowland.harvard.edu>
-Signed-off-by: Evan Green <evgreen@chromium.org>
-Link: https://lore.kernel.org/r/20220421103751.v3.2.I8226c7fdae88329ef70957b96a39b346c69a914e@changeid
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/core/hcd-pci.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c
-index 7537681355f6..fed331d786e2 100644
---- a/drivers/usb/core/hcd-pci.c
-+++ b/drivers/usb/core/hcd-pci.c
-@@ -605,10 +605,10 @@ const struct dev_pm_ops usb_hcd_pci_pm_ops = {
- .suspend_noirq = hcd_pci_suspend_noirq,
- .resume_noirq = hcd_pci_resume_noirq,
- .resume = hcd_pci_resume,
-- .freeze = check_root_hub_suspended,
-+ .freeze = hcd_pci_suspend,
- .freeze_noirq = check_root_hub_suspended,
- .thaw_noirq = NULL,
-- .thaw = NULL,
-+ .thaw = hcd_pci_resume,
- .poweroff = hcd_pci_suspend,
- .poweroff_noirq = hcd_pci_suspend_noirq,
- .restore_noirq = hcd_pci_resume_noirq,
---
-2.35.1
-
+++ /dev/null
-From 5d6ec0b52a6f2838e010de87d8943d003bef39f1 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 2 Mar 2022 11:37:16 +0800
-Subject: USB: host: isp116x: check return value after calling
- platform_get_resource()
-
-From: Zhen Ni <nizhen@uniontech.com>
-
-[ Upstream commit 134a3408c2d3f7e23eb0e4556e0a2d9f36c2614e ]
-
-It will cause null-ptr-deref if platform_get_resource() returns NULL,
-we need check the return value.
-
-Signed-off-by: Zhen Ni <nizhen@uniontech.com>
-Link: https://lore.kernel.org/r/20220302033716.31272-1-nizhen@uniontech.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/host/isp116x-hcd.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/usb/host/isp116x-hcd.c b/drivers/usb/host/isp116x-hcd.c
-index 74da136d322a..361327012c78 100644
---- a/drivers/usb/host/isp116x-hcd.c
-+++ b/drivers/usb/host/isp116x-hcd.c
-@@ -1541,10 +1541,12 @@ static int isp116x_remove(struct platform_device *pdev)
-
- iounmap(isp116x->data_reg);
- res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
-- release_mem_region(res->start, 2);
-+ if (res)
-+ release_mem_region(res->start, 2);
- iounmap(isp116x->addr_reg);
- res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-- release_mem_region(res->start, 2);
-+ if (res)
-+ release_mem_region(res->start, 2);
-
- usb_put_hcd(hcd);
- return 0;
---
-2.35.1
-
+++ /dev/null
-From 0981eb4e8bdb0f053c5813b3f4d5e494c9d81094 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 6 May 2022 17:25:22 +0100
-Subject: clocksource/drivers/sp804: Avoid error on multiple instances
-
-From: Andre Przywara <andre.przywara@arm.com>
-
-[ Upstream commit a98399cbc1e05f7b977419f03905501d566cf54e ]
-
-When a machine sports more than one SP804 timer instance, we only bring
-up the first one, since multiple timers of the same kind are not useful
-to Linux. As this is intentional behaviour, we should not return an
-error message, as we do today:
-===============
-[ 0.000800] Failed to initialize '/bus@8000000/motherboard-bus@8000000/iofpga-bus@300000000/timer@120000': -22
-===============
-
-Replace the -EINVAL return with a debug message and return 0 instead.
-
-Also we do not reach the init function anymore if the DT node is
-disabled (as this is now handled by OF_DECLARE), so remove the explicit
-check for that case.
-
-This fixes a long standing bogus error when booting ARM's fastmodels.
-
-Signed-off-by: Andre Przywara <andre.przywara@arm.com>
-Reviewed-by: Robin Murphy <robin.murphy@arm.com>
-Link: https://lore.kernel.org/r/20220506162522.3675399-1-andre.przywara@arm.com
-Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/clocksource/timer-sp804.c | 10 +++++-----
- 1 file changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/drivers/clocksource/timer-sp804.c b/drivers/clocksource/timer-sp804.c
-index d07863388e05..780699e4d120 100644
---- a/drivers/clocksource/timer-sp804.c
-+++ b/drivers/clocksource/timer-sp804.c
-@@ -227,6 +227,11 @@ static int __init sp804_of_init(struct device_node *np)
- struct clk *clk1, *clk2;
- const char *name = of_get_property(np, "compatible", NULL);
-
-+ if (initialized) {
-+ pr_debug("%pOF: skipping further SP804 timer device\n", np);
-+ return 0;
-+ }
-+
- base = of_iomap(np, 0);
- if (!base)
- return -ENXIO;
-@@ -235,11 +240,6 @@ static int __init sp804_of_init(struct device_node *np)
- writel(0, base + TIMER_CTRL);
- writel(0, base + TIMER_2_BASE + TIMER_CTRL);
-
-- if (initialized || !of_device_is_available(np)) {
-- ret = -EINVAL;
-- goto err;
-- }
--
- clk1 = of_clk_get(np, 0);
- if (IS_ERR(clk1))
- clk1 = NULL;
---
-2.35.1
-
+++ /dev/null
-From d8d5f0f9995d54b8e6fe337b46d8daba238971b8 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 17 Apr 2022 22:16:41 +0800
-Subject: drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop()
-
-From: Duoming Zhou <duoming@zju.edu.cn>
-
-[ Upstream commit 9b6bdbd9337de3917945847bde262a34a87a6303 ]
-
-There is a deadlock in rtllib_beacons_stop(), which is shown
-below:
-
- (Thread 1) | (Thread 2)
- | rtllib_send_beacon()
-rtllib_beacons_stop() | mod_timer()
- spin_lock_irqsave() //(1) | (wait a time)
- ... | rtllib_send_beacon_cb()
- del_timer_sync() | spin_lock_irqsave() //(2)
- (wait timer to stop) | ...
-
-We hold ieee->beacon_lock in position (1) of thread 1 and
-use del_timer_sync() to wait timer to stop, but timer handler
-also need ieee->beacon_lock in position (2) of thread 2.
-As a result, rtllib_beacons_stop() will block forever.
-
-This patch extracts del_timer_sync() from the protection of
-spin_lock_irqsave(), which could let timer handler to obtain
-the needed lock.
-
-Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
-Link: https://lore.kernel.org/r/20220417141641.124388-1-duoming@zju.edu.cn
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/staging/rtl8192e/rtllib_softmac.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/staging/rtl8192e/rtllib_softmac.c b/drivers/staging/rtl8192e/rtllib_softmac.c
-index da74dc49b95e..f46def63967b 100644
---- a/drivers/staging/rtl8192e/rtllib_softmac.c
-+++ b/drivers/staging/rtl8192e/rtllib_softmac.c
-@@ -655,9 +655,9 @@ static void rtllib_beacons_stop(struct rtllib_device *ieee)
- spin_lock_irqsave(&ieee->beacon_lock, flags);
-
- ieee->beacon_txing = 0;
-- del_timer_sync(&ieee->beacon_timer);
-
- spin_unlock_irqrestore(&ieee->beacon_lock, flags);
-+ del_timer_sync(&ieee->beacon_timer);
-
- }
-
---
-2.35.1
-
+++ /dev/null
-From db47410ed6c0dd13b17bb2415a921ac432c3c1f9 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 17 Apr 2022 19:16:26 +0800
-Subject: drivers: tty: serial: Fix deadlock in sa1100_set_termios()
-
-From: Duoming Zhou <duoming@zju.edu.cn>
-
-[ Upstream commit 62b2caef400c1738b6d22f636c628d9f85cd4c4c ]
-
-There is a deadlock in sa1100_set_termios(), which is shown
-below:
-
- (Thread 1) | (Thread 2)
- | sa1100_enable_ms()
-sa1100_set_termios() | mod_timer()
- spin_lock_irqsave() //(1) | (wait a time)
- ... | sa1100_timeout()
- del_timer_sync() | spin_lock_irqsave() //(2)
- (wait timer to stop) | ...
-
-We hold sport->port.lock in position (1) of thread 1 and
-use del_timer_sync() to wait timer to stop, but timer handler
-also need sport->port.lock in position (2) of thread 2. As a result,
-sa1100_set_termios() will block forever.
-
-This patch moves del_timer_sync() before spin_lock_irqsave()
-in order to prevent the deadlock.
-
-Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
-Link: https://lore.kernel.org/r/20220417111626.7802-1-duoming@zju.edu.cn
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/tty/serial/sa1100.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/tty/serial/sa1100.c b/drivers/tty/serial/sa1100.c
-index fd3d1329d48c..68eb1c9faa29 100644
---- a/drivers/tty/serial/sa1100.c
-+++ b/drivers/tty/serial/sa1100.c
-@@ -452,6 +452,8 @@ sa1100_set_termios(struct uart_port *port, struct ktermios *termios,
- baud = uart_get_baud_rate(port, termios, old, 0, port->uartclk/16);
- quot = uart_get_divisor(port, baud);
-
-+ del_timer_sync(&sport->timer);
-+
- spin_lock_irqsave(&sport->port.lock, flags);
-
- sport->port.read_status_mask &= UTSR0_TO_SM(UTSR0_TFS);
-@@ -482,8 +484,6 @@ sa1100_set_termios(struct uart_port *port, struct ktermios *termios,
- UTSR1_TO_SM(UTSR1_ROR);
- }
-
-- del_timer_sync(&sport->timer);
--
- /*
- * Update the per-port timeout.
- */
---
-2.35.1
-
+++ /dev/null
-From cc91bd07de1133da46dcc8f50625890b6bf1db78 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 17 Apr 2022 20:03:05 +0800
-Subject: drivers: usb: host: Fix deadlock in oxu_bus_suspend()
-
-From: Duoming Zhou <duoming@zju.edu.cn>
-
-[ Upstream commit 4d378f2ae58138d4c55684e1d274e7dd94aa6524 ]
-
-There is a deadlock in oxu_bus_suspend(), which is shown below:
-
- (Thread 1) | (Thread 2)
- | timer_action()
-oxu_bus_suspend() | mod_timer()
- spin_lock_irq() //(1) | (wait a time)
- ... | oxu_watchdog()
- del_timer_sync() | spin_lock_irq() //(2)
- (wait timer to stop) | ...
-
-We hold oxu->lock in position (1) of thread 1, and use
-del_timer_sync() to wait timer to stop, but timer handler
-also need oxu->lock in position (2) of thread 2. As a result,
-oxu_bus_suspend() will block forever.
-
-This patch extracts del_timer_sync() from the protection of
-spin_lock_irq(), which could let timer handler to obtain
-the needed lock.
-
-Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
-Link: https://lore.kernel.org/r/20220417120305.64577-1-duoming@zju.edu.cn
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/host/oxu210hp-hcd.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/drivers/usb/host/oxu210hp-hcd.c b/drivers/usb/host/oxu210hp-hcd.c
-index 2f48da0c0bb3..af5248f62c59 100644
---- a/drivers/usb/host/oxu210hp-hcd.c
-+++ b/drivers/usb/host/oxu210hp-hcd.c
-@@ -3491,8 +3491,10 @@ static int oxu_bus_suspend(struct usb_hcd *hcd)
- }
- }
-
-+ spin_unlock_irq(&oxu->lock);
- /* turn off now-idle HC */
- del_timer_sync(&oxu->watchdog);
-+ spin_lock_irq(&oxu->lock);
- ehci_halt(oxu);
- hcd->state = HC_STATE_SUSPENDED;
-
---
-2.35.1
-
+++ /dev/null
-From d107ce35f5df68fd284e16aed6cf9380dbb98fd6 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 17 May 2022 17:57:00 +0800
-Subject: drm/radeon: fix a possible null pointer dereference
-
-From: Gong Yuanjun <ruc_gongyuanjun@163.com>
-
-[ Upstream commit a2b28708b645c5632dc93669ab06e97874c8244f ]
-
-In radeon_fp_native_mode(), the return value of drm_mode_duplicate()
-is assigned to mode, which will lead to a NULL pointer dereference
-on failure of drm_mode_duplicate(). Add a check to avoid npd.
-
-The failure status of drm_cvt_mode() on the other path is checked too.
-
-Signed-off-by: Gong Yuanjun <ruc_gongyuanjun@163.com>
-Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/radeon/radeon_connectors.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
-index 9e6c2be0cc7d..a759955e3797 100644
---- a/drivers/gpu/drm/radeon/radeon_connectors.c
-+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
-@@ -489,6 +489,8 @@ static struct drm_display_mode *radeon_fp_native_mode(struct drm_encoder *encode
- native_mode->vdisplay != 0 &&
- native_mode->clock != 0) {
- mode = drm_mode_duplicate(dev, native_mode);
-+ if (!mode)
-+ return NULL;
- mode->type = DRM_MODE_TYPE_PREFERRED | DRM_MODE_TYPE_DRIVER;
- drm_mode_set_name(mode);
-
-@@ -503,6 +505,8 @@ static struct drm_display_mode *radeon_fp_native_mode(struct drm_encoder *encode
- * simpler.
- */
- mode = drm_cvt_mode(dev, native_mode->hdisplay, native_mode->vdisplay, 60, true, false, false);
-+ if (!mode)
-+ return NULL;
- mode->type = DRM_MODE_TYPE_PREFERRED | DRM_MODE_TYPE_DRIVER;
- DRM_DEBUG_KMS("Adding cvt approximation of native panel mode %s\n", mode->name);
- }
---
-2.35.1
-
+++ /dev/null
-From d7d3007f8c5eb24d655a2039afa27c1800ad93a6 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 5 Mar 2022 11:14:05 +0800
-Subject: iio: dummy: iio_simple_dummy: check the return value of kstrdup()
-
-From: Xiaoke Wang <xkernel.wang@foxmail.com>
-
-[ Upstream commit ba93642188a6fed754bf7447f638bc410e05a929 ]
-
-kstrdup() is also a memory allocation-related function, it returns NULL
-when some memory errors happen. So it is better to check the return
-value of it so to catch the memory error in time. Besides, there should
-have a kfree() to clear up the allocation if we get a failure later in
-this function to prevent memory leak.
-
-Signed-off-by: Xiaoke Wang <xkernel.wang@foxmail.com>
-Link: https://lore.kernel.org/r/tencent_C920CFCC33B9CC1C63141FE1334A39FF8508@qq.com
-Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/iio/dummy/iio_simple_dummy.c | 20 ++++++++++++--------
- 1 file changed, 12 insertions(+), 8 deletions(-)
-
-diff --git a/drivers/iio/dummy/iio_simple_dummy.c b/drivers/iio/dummy/iio_simple_dummy.c
-index ad3410e528b6..7fef76f0b5c7 100644
---- a/drivers/iio/dummy/iio_simple_dummy.c
-+++ b/drivers/iio/dummy/iio_simple_dummy.c
-@@ -572,10 +572,9 @@ static struct iio_sw_device *iio_dummy_probe(const char *name)
- struct iio_sw_device *swd;
-
- swd = kzalloc(sizeof(*swd), GFP_KERNEL);
-- if (!swd) {
-- ret = -ENOMEM;
-- goto error_kzalloc;
-- }
-+ if (!swd)
-+ return ERR_PTR(-ENOMEM);
-+
- /*
- * Allocate an IIO device.
- *
-@@ -587,7 +586,7 @@ static struct iio_sw_device *iio_dummy_probe(const char *name)
- indio_dev = iio_device_alloc(sizeof(*st));
- if (!indio_dev) {
- ret = -ENOMEM;
-- goto error_ret;
-+ goto error_free_swd;
- }
-
- st = iio_priv(indio_dev);
-@@ -618,6 +617,10 @@ static struct iio_sw_device *iio_dummy_probe(const char *name)
- * indio_dev->name = spi_get_device_id(spi)->name;
- */
- indio_dev->name = kstrdup(name, GFP_KERNEL);
-+ if (!indio_dev->name) {
-+ ret = -ENOMEM;
-+ goto error_free_device;
-+ }
-
- /* Provide description of available channels */
- indio_dev->channels = iio_dummy_channels;
-@@ -634,7 +637,7 @@ static struct iio_sw_device *iio_dummy_probe(const char *name)
-
- ret = iio_simple_dummy_events_register(indio_dev);
- if (ret < 0)
-- goto error_free_device;
-+ goto error_free_name;
-
- ret = iio_simple_dummy_configure_buffer(indio_dev);
- if (ret < 0)
-@@ -651,11 +654,12 @@ static struct iio_sw_device *iio_dummy_probe(const char *name)
- iio_simple_dummy_unconfigure_buffer(indio_dev);
- error_unregister_events:
- iio_simple_dummy_events_unregister(indio_dev);
-+error_free_name:
-+ kfree(indio_dev->name);
- error_free_device:
- iio_device_free(indio_dev);
--error_ret:
-+error_free_swd:
- kfree(swd);
--error_kzalloc:
- return ERR_PTR(ret);
- }
-
---
-2.35.1
-
+++ /dev/null
-From 5754a57b4a9e125864d1fab869fd1da936ac4970 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 16 Feb 2022 12:15:03 -0800
-Subject: lkdtm/usercopy: Expand size of "out of frame" object
-
-From: Kees Cook <keescook@chromium.org>
-
-[ Upstream commit f387e86d3a74407bdd9c5815820ac9d060962840 ]
-
-To be sufficiently out of range for the usercopy test to see the lifetime
-mismatch, expand the size of the "bad" buffer, which will let it be
-beyond current_stack_pointer regardless of stack growth direction.
-Paired with the recent addition of stack depth checking under
-CONFIG_HARDENED_USERCOPY=y, this will correctly start tripping again.
-
-Reported-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
-Cc: Arnd Bergmann <arnd@arndb.de>
-Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Reviewed-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
-Link: https://lore.kernel.org/lkml/762faf1b-0443-5ddf-4430-44a20cf2ec4d@collabora.com/
-Signed-off-by: Kees Cook <keescook@chromium.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/misc/lkdtm_usercopy.c | 17 ++++++++++++++---
- 1 file changed, 14 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/misc/lkdtm_usercopy.c b/drivers/misc/lkdtm_usercopy.c
-index 1dd611423d8b..36438947244d 100644
---- a/drivers/misc/lkdtm_usercopy.c
-+++ b/drivers/misc/lkdtm_usercopy.c
-@@ -28,12 +28,12 @@ static const unsigned char test_text[] = "This is a test.\n";
- */
- static noinline unsigned char *trick_compiler(unsigned char *stack)
- {
-- return stack + 0;
-+ return stack + unconst;
- }
-
- static noinline unsigned char *do_usercopy_stack_callee(int value)
- {
-- unsigned char buf[32];
-+ unsigned char buf[128];
- int i;
-
- /* Exercise stack to avoid everything living in registers. */
-@@ -41,7 +41,12 @@ static noinline unsigned char *do_usercopy_stack_callee(int value)
- buf[i] = value & 0xff;
- }
-
-- return trick_compiler(buf);
-+ /*
-+ * Put the target buffer in the middle of stack allocation
-+ * so that we don't step on future stack users regardless
-+ * of stack growth direction.
-+ */
-+ return trick_compiler(&buf[(128/2)-32]);
- }
-
- static noinline void do_usercopy_stack(bool to_user, bool bad_frame)
-@@ -64,6 +69,12 @@ static noinline void do_usercopy_stack(bool to_user, bool bad_frame)
- bad_stack -= sizeof(unsigned long);
- }
-
-+#ifdef ARCH_HAS_CURRENT_STACK_POINTER
-+ pr_info("stack : %px\n", (void *)current_stack_pointer);
-+#endif
-+ pr_info("good_stack: %px-%px\n", good_stack, good_stack + sizeof(good_stack));
-+ pr_info("bad_stack : %px-%px\n", bad_stack, bad_stack + sizeof(good_stack));
-+
- user_addr = vm_mmap(NULL, 0, PAGE_SIZE,
- PROT_READ | PROT_WRITE | PROT_EXEC,
- MAP_ANONYMOUS | MAP_PRIVATE, 0);
---
-2.35.1
-
+++ /dev/null
-From 0e45c9ffc82ef1fd41dc2e5b2857109607e6b228 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 29 Apr 2022 16:49:09 +0800
-Subject: md: protect md_unregister_thread from reentrancy
-
-From: Guoqing Jiang <guoqing.jiang@cloud.ionos.com>
-
-[ Upstream commit 1e267742283a4b5a8ca65755c44166be27e9aa0f ]
-
-Generally, the md_unregister_thread is called with reconfig_mutex, but
-raid_message in dm-raid doesn't hold reconfig_mutex to unregister thread,
-so md_unregister_thread can be called simulitaneously from two call sites
-in theory.
-
-Then after previous commit which remove the protection of reconfig_mutex
-for md_unregister_thread completely, the potential issue could be worse
-than before.
-
-Let's take pers_lock at the beginning of function to ensure reentrancy.
-
-Reported-by: Donald Buczek <buczek@molgen.mpg.de>
-Signed-off-by: Guoqing Jiang <guoqing.jiang@linux.dev>
-Signed-off-by: Song Liu <song@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/md/md.c | 15 ++++++++++-----
- 1 file changed, 10 insertions(+), 5 deletions(-)
-
-diff --git a/drivers/md/md.c b/drivers/md/md.c
-index 0197d18b5407..9e8373e7e287 100644
---- a/drivers/md/md.c
-+++ b/drivers/md/md.c
-@@ -7254,17 +7254,22 @@ EXPORT_SYMBOL(md_register_thread);
-
- void md_unregister_thread(struct md_thread **threadp)
- {
-- struct md_thread *thread = *threadp;
-- if (!thread)
-- return;
-- pr_debug("interrupting MD-thread pid %d\n", task_pid_nr(thread->tsk));
-- /* Locking ensures that mddev_unlock does not wake_up a
-+ struct md_thread *thread;
-+
-+ /*
-+ * Locking ensures that mddev_unlock does not wake_up a
- * non-existent thread
- */
- spin_lock(&pers_lock);
-+ thread = *threadp;
-+ if (!thread) {
-+ spin_unlock(&pers_lock);
-+ return;
-+ }
- *threadp = NULL;
- spin_unlock(&pers_lock);
-
-+ pr_debug("interrupting MD-thread pid %d\n", task_pid_nr(thread->tsk));
- kthread_stop(thread->tsk);
- kfree(thread);
- }
---
-2.35.1
-
+++ /dev/null
-From 8fc659a8fbfc68ca1a3f6e48ca3ab7a92ccd4dbc Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 29 Apr 2022 15:09:13 -0600
-Subject: misc: rtsx: set NULL intfdata when probe fails
-
-From: Shuah Khan <skhan@linuxfoundation.org>
-
-[ Upstream commit f861d36e021e1ac4a0a2a1f6411d623809975d63 ]
-
-rtsx_usb_probe() doesn't call usb_set_intfdata() to null out the
-interface pointer when probe fails. This leaves a stale pointer.
-Noticed the missing usb_set_intfdata() while debugging an unrelated
-invalid DMA mapping problem.
-
-Fix it with a call to usb_set_intfdata(..., NULL).
-
-Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
-Link: https://lore.kernel.org/r/20220429210913.46804-1-skhan@linuxfoundation.org
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/mfd/rtsx_usb.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/drivers/mfd/rtsx_usb.c b/drivers/mfd/rtsx_usb.c
-index 691dab791f7a..e94f855eac15 100644
---- a/drivers/mfd/rtsx_usb.c
-+++ b/drivers/mfd/rtsx_usb.c
-@@ -678,6 +678,7 @@ static int rtsx_usb_probe(struct usb_interface *intf,
- return 0;
-
- out_init_fail:
-+ usb_set_intfdata(ucr->pusb_intf, NULL);
- usb_free_coherent(ucr->pusb_dev, IOBUF_SIZE, ucr->iobuf,
- ucr->iobuf_dma);
- return ret;
---
-2.35.1
-
+++ /dev/null
-From acbb53b02c4c3d15b925fd6ce446ba7e72422175 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 24 May 2022 01:46:22 +0900
-Subject: modpost: fix undefined behavior of is_arm_mapping_symbol()
-
-From: Masahiro Yamada <masahiroy@kernel.org>
-
-[ Upstream commit d6b732666a1bae0df3c3ae06925043bba34502b1 ]
-
-The return value of is_arm_mapping_symbol() is unpredictable when "$"
-is passed in.
-
-strchr(3) says:
- The strchr() and strrchr() functions return a pointer to the matched
- character or NULL if the character is not found. The terminating null
- byte is considered part of the string, so that if c is specified as
- '\0', these functions return a pointer to the terminator.
-
-When str[1] is '\0', strchr("axtd", str[1]) is not NULL, and str[2] is
-referenced (i.e. buffer overrun).
-
-Test code
----------
-
- char str1[] = "abc";
- char str2[] = "ab";
-
- strcpy(str1, "$");
- strcpy(str2, "$");
-
- printf("test1: %d\n", is_arm_mapping_symbol(str1));
- printf("test2: %d\n", is_arm_mapping_symbol(str2));
-
-Result
-------
-
- test1: 0
- test2: 1
-
-Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
-Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- scripts/mod/modpost.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
-index 29c3e4d6fc06..c5f3267aa08a 100644
---- a/scripts/mod/modpost.c
-+++ b/scripts/mod/modpost.c
-@@ -1212,7 +1212,8 @@ static int secref_whitelist(const struct sectioncheck *mismatch,
-
- static inline int is_arm_mapping_symbol(const char *str)
- {
-- return str[0] == '$' && strchr("axtd", str[1])
-+ return str[0] == '$' &&
-+ (str[1] == 'a' || str[1] == 'd' || str[1] == 't' || str[1] == 'x')
- && (str[2] == '\0' || str[2] == '.');
- }
-
---
-2.35.1
-
+++ /dev/null
-From 95b333efef95cf584c26ae6666192b1b1f9d407c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 18 May 2022 13:52:23 -0700
-Subject: nodemask: Fix return values to be unsigned
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Kees Cook <keescook@chromium.org>
-
-[ Upstream commit 0dfe54071d7c828a02917b595456bfde1afdddc9 ]
-
-The nodemask routines had mixed return values that provided potentially
-signed return values that could never happen. This was leading to the
-compiler getting confusing about the range of possible return values
-(it was thinking things could be negative where they could not be). Fix
-all the nodemask routines that should be returning unsigned
-(or bool) values. Silences:
-
- mm/swapfile.c: In function ‘setup_swap_info’:
- mm/swapfile.c:2291:47: error: array subscript -1 is below array bounds of ‘struct plist_node[]’ [-Werror=array-bounds]
- 2291 | p->avail_lists[i].prio = 1;
- | ~~~~~~~~~~~~~~^~~
- In file included from mm/swapfile.c:16:
- ./include/linux/swap.h:292:27: note: while referencing ‘avail_lists’
- 292 | struct plist_node avail_lists[]; /*
- | ^~~~~~~~~~~
-
-Reported-by: Christophe de Dinechin <dinechin@redhat.com>
-Link: https://lore.kernel.org/lkml/20220414150855.2407137-3-dinechin@redhat.com/
-Cc: Alexey Dobriyan <adobriyan@gmail.com>
-Cc: Yury Norov <yury.norov@gmail.com>
-Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
-Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
-Cc: Andrew Morton <akpm@linux-foundation.org>
-Cc: Zhen Lei <thunder.leizhen@huawei.com>
-Signed-off-by: Kees Cook <keescook@chromium.org>
-Signed-off-by: Yury Norov <yury.norov@gmail.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- include/linux/nodemask.h | 38 +++++++++++++++++++-------------------
- lib/nodemask.c | 4 ++--
- 2 files changed, 21 insertions(+), 21 deletions(-)
-
-diff --git a/include/linux/nodemask.h b/include/linux/nodemask.h
-index 7b7155a6c984..3cc98ded3373 100644
---- a/include/linux/nodemask.h
-+++ b/include/linux/nodemask.h
-@@ -41,11 +41,11 @@
- * void nodes_shift_right(dst, src, n) Shift right
- * void nodes_shift_left(dst, src, n) Shift left
- *
-- * int first_node(mask) Number lowest set bit, or MAX_NUMNODES
-- * int next_node(node, mask) Next node past 'node', or MAX_NUMNODES
-- * int next_node_in(node, mask) Next node past 'node', or wrap to first,
-+ * unsigned int first_node(mask) Number lowest set bit, or MAX_NUMNODES
-+ * unsigend int next_node(node, mask) Next node past 'node', or MAX_NUMNODES
-+ * unsigned int next_node_in(node, mask) Next node past 'node', or wrap to first,
- * or MAX_NUMNODES
-- * int first_unset_node(mask) First node not set in mask, or
-+ * unsigned int first_unset_node(mask) First node not set in mask, or
- * MAX_NUMNODES
- *
- * nodemask_t nodemask_of_node(node) Return nodemask with bit 'node' set
-@@ -143,7 +143,7 @@ static inline void __nodes_clear(nodemask_t *dstp, unsigned int nbits)
-
- #define node_test_and_set(node, nodemask) \
- __node_test_and_set((node), &(nodemask))
--static inline int __node_test_and_set(int node, nodemask_t *addr)
-+static inline bool __node_test_and_set(int node, nodemask_t *addr)
- {
- return test_and_set_bit(node, addr->bits);
- }
-@@ -190,7 +190,7 @@ static inline void __nodes_complement(nodemask_t *dstp,
-
- #define nodes_equal(src1, src2) \
- __nodes_equal(&(src1), &(src2), MAX_NUMNODES)
--static inline int __nodes_equal(const nodemask_t *src1p,
-+static inline bool __nodes_equal(const nodemask_t *src1p,
- const nodemask_t *src2p, unsigned int nbits)
- {
- return bitmap_equal(src1p->bits, src2p->bits, nbits);
-@@ -198,7 +198,7 @@ static inline int __nodes_equal(const nodemask_t *src1p,
-
- #define nodes_intersects(src1, src2) \
- __nodes_intersects(&(src1), &(src2), MAX_NUMNODES)
--static inline int __nodes_intersects(const nodemask_t *src1p,
-+static inline bool __nodes_intersects(const nodemask_t *src1p,
- const nodemask_t *src2p, unsigned int nbits)
- {
- return bitmap_intersects(src1p->bits, src2p->bits, nbits);
-@@ -206,20 +206,20 @@ static inline int __nodes_intersects(const nodemask_t *src1p,
-
- #define nodes_subset(src1, src2) \
- __nodes_subset(&(src1), &(src2), MAX_NUMNODES)
--static inline int __nodes_subset(const nodemask_t *src1p,
-+static inline bool __nodes_subset(const nodemask_t *src1p,
- const nodemask_t *src2p, unsigned int nbits)
- {
- return bitmap_subset(src1p->bits, src2p->bits, nbits);
- }
-
- #define nodes_empty(src) __nodes_empty(&(src), MAX_NUMNODES)
--static inline int __nodes_empty(const nodemask_t *srcp, unsigned int nbits)
-+static inline bool __nodes_empty(const nodemask_t *srcp, unsigned int nbits)
- {
- return bitmap_empty(srcp->bits, nbits);
- }
-
- #define nodes_full(nodemask) __nodes_full(&(nodemask), MAX_NUMNODES)
--static inline int __nodes_full(const nodemask_t *srcp, unsigned int nbits)
-+static inline bool __nodes_full(const nodemask_t *srcp, unsigned int nbits)
- {
- return bitmap_full(srcp->bits, nbits);
- }
-@@ -250,15 +250,15 @@ static inline void __nodes_shift_left(nodemask_t *dstp,
- > MAX_NUMNODES, then the silly min_ts could be dropped. */
-
- #define first_node(src) __first_node(&(src))
--static inline int __first_node(const nodemask_t *srcp)
-+static inline unsigned int __first_node(const nodemask_t *srcp)
- {
-- return min_t(int, MAX_NUMNODES, find_first_bit(srcp->bits, MAX_NUMNODES));
-+ return min_t(unsigned int, MAX_NUMNODES, find_first_bit(srcp->bits, MAX_NUMNODES));
- }
-
- #define next_node(n, src) __next_node((n), &(src))
--static inline int __next_node(int n, const nodemask_t *srcp)
-+static inline unsigned int __next_node(int n, const nodemask_t *srcp)
- {
-- return min_t(int,MAX_NUMNODES,find_next_bit(srcp->bits, MAX_NUMNODES, n+1));
-+ return min_t(unsigned int, MAX_NUMNODES, find_next_bit(srcp->bits, MAX_NUMNODES, n+1));
- }
-
- /*
-@@ -266,7 +266,7 @@ static inline int __next_node(int n, const nodemask_t *srcp)
- * the first node in src if needed. Returns MAX_NUMNODES if src is empty.
- */
- #define next_node_in(n, src) __next_node_in((n), &(src))
--int __next_node_in(int node, const nodemask_t *srcp);
-+unsigned int __next_node_in(int node, const nodemask_t *srcp);
-
- static inline void init_nodemask_of_node(nodemask_t *mask, int node)
- {
-@@ -286,9 +286,9 @@ static inline void init_nodemask_of_node(nodemask_t *mask, int node)
- })
-
- #define first_unset_node(mask) __first_unset_node(&(mask))
--static inline int __first_unset_node(const nodemask_t *maskp)
-+static inline unsigned int __first_unset_node(const nodemask_t *maskp)
- {
-- return min_t(int,MAX_NUMNODES,
-+ return min_t(unsigned int, MAX_NUMNODES,
- find_first_zero_bit(maskp->bits, MAX_NUMNODES));
- }
-
-@@ -428,11 +428,11 @@ static inline int num_node_state(enum node_states state)
-
- #define first_online_node first_node(node_states[N_ONLINE])
- #define first_memory_node first_node(node_states[N_MEMORY])
--static inline int next_online_node(int nid)
-+static inline unsigned int next_online_node(int nid)
- {
- return next_node(nid, node_states[N_ONLINE]);
- }
--static inline int next_memory_node(int nid)
-+static inline unsigned int next_memory_node(int nid)
- {
- return next_node(nid, node_states[N_MEMORY]);
- }
-diff --git a/lib/nodemask.c b/lib/nodemask.c
-index e42a5bf44d33..f6ad9c2775a8 100644
---- a/lib/nodemask.c
-+++ b/lib/nodemask.c
-@@ -2,9 +2,9 @@
- #include <linux/module.h>
- #include <linux/random.h>
-
--int __next_node_in(int node, const nodemask_t *srcp)
-+unsigned int __next_node_in(int node, const nodemask_t *srcp)
- {
-- int ret = __next_node(node, srcp);
-+ unsigned int ret = __next_node(node, srcp);
-
- if (ret == MAX_NUMNODES)
- ret = __first_node(srcp);
---
-2.35.1
-
+++ /dev/null
-From ba7df6b9f13f43a1f7f3d50681dd7fefa08e113c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 23 May 2022 22:05:24 +0200
-Subject: Revert "net: af_key: add check for pfkey_broadcast in function
- pfkey_process"
-
-From: Michal Kubecek <mkubecek@suse.cz>
-
-[ Upstream commit 9c90c9b3e50e16d03c7f87d63e9db373974781e0 ]
-
-This reverts commit 4dc2a5a8f6754492180741facf2a8787f2c415d7.
-
-A non-zero return value from pfkey_broadcast() does not necessarily mean
-an error occurred as this function returns -ESRCH when no registered
-listener received the message. In particular, a call with
-BROADCAST_PROMISC_ONLY flag and null one_sk argument can never return
-zero so that this commit in fact prevents processing any PF_KEY message.
-One visible effect is that racoon daemon fails to find encryption
-algorithms like aes and refuses to start.
-
-Excluding -ESRCH return value would fix this but it's not obvious that
-we really want to bail out here and most other callers of
-pfkey_broadcast() also ignore the return value. Also, as pointed out by
-Steffen Klassert, PF_KEY is kind of deprecated and newer userspace code
-should use netlink instead so that we should only disturb the code for
-really important fixes.
-
-v2: add a comment explaining why is the return value ignored
-
-Signed-off-by: Michal Kubecek <mkubecek@suse.cz>
-Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/key/af_key.c | 10 ++++++----
- 1 file changed, 6 insertions(+), 4 deletions(-)
-
-diff --git a/net/key/af_key.c b/net/key/af_key.c
-index d5dc614af2f9..0737fc7b7ebd 100644
---- a/net/key/af_key.c
-+++ b/net/key/af_key.c
-@@ -2861,10 +2861,12 @@ static int pfkey_process(struct sock *sk, struct sk_buff *skb, const struct sadb
- void *ext_hdrs[SADB_EXT_MAX];
- int err;
-
-- err = pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL,
-- BROADCAST_PROMISC_ONLY, NULL, sock_net(sk));
-- if (err)
-- return err;
-+ /* Non-zero return value of pfkey_broadcast() does not always signal
-+ * an error and even on an actual error we may still want to process
-+ * the message so rather ignore the return value.
-+ */
-+ pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL,
-+ BROADCAST_PROMISC_ONLY, NULL, sock_net(sk));
-
- memset(ext_hdrs, 0, sizeof(ext_hdrs));
- err = parse_exthdrs(skb, hdr, ext_hdrs);
---
-2.35.1
-
+++ /dev/null
-From abd65e0782e247b072d9efae00862de06be8c579 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 6 May 2022 23:39:24 +0206
-Subject: serial: msm_serial: disable interrupts in __msm_console_write()
-
-From: John Ogness <john.ogness@linutronix.de>
-
-[ Upstream commit aabdbb1b7a5819e18c403334a31fb0cc2c06ad41 ]
-
-__msm_console_write() assumes that interrupts are disabled, but
-with threaded console printers it is possible that the write()
-callback of the console is called with interrupts enabled.
-
-Explicitly disable interrupts using local_irq_save() to preserve
-the assumed context.
-
-Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
-Reviewed-by: Petr Mladek <pmladek@suse.com>
-Signed-off-by: John Ogness <john.ogness@linutronix.de>
-Link: https://lore.kernel.org/r/20220506213324.470461-1-john.ogness@linutronix.de
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/tty/serial/msm_serial.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/drivers/tty/serial/msm_serial.c b/drivers/tty/serial/msm_serial.c
-index c284e61ed4fc..33d035f9fded 100644
---- a/drivers/tty/serial/msm_serial.c
-+++ b/drivers/tty/serial/msm_serial.c
-@@ -1578,6 +1578,7 @@ static inline struct uart_port *msm_get_port_from_line(unsigned int line)
- static void __msm_console_write(struct uart_port *port, const char *s,
- unsigned int count, bool is_uartdm)
- {
-+ unsigned long flags;
- int i;
- int num_newlines = 0;
- bool replaced = false;
-@@ -1595,6 +1596,8 @@ static void __msm_console_write(struct uart_port *port, const char *s,
- num_newlines++;
- count += num_newlines;
-
-+ local_irq_save(flags);
-+
- if (port->sysrq)
- locked = 0;
- else if (oops_in_progress)
-@@ -1640,6 +1643,8 @@ static void __msm_console_write(struct uart_port *port, const char *s,
-
- if (locked)
- spin_unlock(&port->lock);
-+
-+ local_irq_restore(flags);
- }
-
- static void msm_console_write(struct console *co, const char *s,
---
-2.35.1
-
sunrpc-fix-the-calculation-of-xdr-end-in-xdr_get_nex.patch
net-xfrm-unexport-__init-annotated-xfrm4_protocol_in.patch
net-altera-fix-refcount-leak-in-altera_tse_mdio_crea.patch
-iio-dummy-iio_simple_dummy-check-the-return-value-of.patch
-lkdtm-usercopy-expand-size-of-out-of-frame-object.patch
-tty-synclink_gt-fix-null-pointer-dereference-in-slgt.patch
-tty-fix-a-possible-resource-leak-in-icom_probe.patch
-drivers-staging-rtl8192e-fix-deadlock-in-rtllib_beac.patch
-usb-host-isp116x-check-return-value-after-calling-pl.patch
-drivers-tty-serial-fix-deadlock-in-sa1100_set_termio.patch
-drivers-usb-host-fix-deadlock-in-oxu_bus_suspend.patch
-usb-hcd-pci-fully-suspend-across-freeze-thaw-cycle.patch
-usb-dwc2-gadget-don-t-reset-gadget-s-driver-bus.patch
-misc-rtsx-set-null-intfdata-when-probe-fails.patch
-clocksource-drivers-sp804-avoid-error-on-multiple-in.patch
-staging-rtl8712-fix-uninit-value-in-r871xu_drv_init.patch
-serial-msm_serial-disable-interrupts-in-__msm_consol.patch
-md-protect-md_unregister_thread-from-reentrancy.patch
-revert-net-af_key-add-check-for-pfkey_broadcast-in-f.patch
-drm-radeon-fix-a-possible-null-pointer-dereference.patch
-modpost-fix-undefined-behavior-of-is_arm_mapping_sym.patch
-nodemask-fix-return-values-to-be-unsigned.patch
-iio-dummy-iio_simple_dummy-check-the-return-value-of.patch-23524
-lkdtm-usercopy-expand-size-of-out-of-frame-object.patch-13206
-tty-synclink_gt-fix-null-pointer-dereference-in-slgt.patch-15162
-tty-fix-a-possible-resource-leak-in-icom_probe.patch-19297
-drivers-staging-rtl8192e-fix-deadlock-in-rtllib_beac.patch-31603
-usb-host-isp116x-check-return-value-after-calling-pl.patch-19356
-drivers-tty-serial-fix-deadlock-in-sa1100_set_termio.patch-18887
-drivers-usb-host-fix-deadlock-in-oxu_bus_suspend.patch-27031
-usb-hcd-pci-fully-suspend-across-freeze-thaw-cycle.patch-8845
-usb-dwc2-gadget-don-t-reset-gadget-s-driver-bus.patch-31688
-misc-rtsx-set-null-intfdata-when-probe-fails.patch-6529
-clocksource-drivers-sp804-avoid-error-on-multiple-in.patch-30578
-staging-rtl8712-fix-uninit-value-in-r871xu_drv_init.patch-20657
-serial-msm_serial-disable-interrupts-in-__msm_consol.patch-13437
-md-protect-md_unregister_thread-from-reentrancy.patch-19029
-revert-net-af_key-add-check-for-pfkey_broadcast-in-f.patch-7473
-drm-radeon-fix-a-possible-null-pointer-dereference.patch-1583
-modpost-fix-undefined-behavior-of-is_arm_mapping_sym.patch-9755
-nodemask-fix-return-values-to-be-unsigned.patch-13329
-iio-dummy-iio_simple_dummy-check-the-return-value-of.patch-3507
-lkdtm-usercopy-expand-size-of-out-of-frame-object.patch-21612
-tty-synclink_gt-fix-null-pointer-dereference-in-slgt.patch-3819
-tty-fix-a-possible-resource-leak-in-icom_probe.patch-21551
-drivers-staging-rtl8192e-fix-deadlock-in-rtllib_beac.patch-5623
-usb-host-isp116x-check-return-value-after-calling-pl.patch-5502
-drivers-tty-serial-fix-deadlock-in-sa1100_set_termio.patch-29741
-drivers-usb-host-fix-deadlock-in-oxu_bus_suspend.patch-7308
-usb-hcd-pci-fully-suspend-across-freeze-thaw-cycle.patch-10130
-usb-dwc2-gadget-don-t-reset-gadget-s-driver-bus.patch-31123
-misc-rtsx-set-null-intfdata-when-probe-fails.patch-2601
-clocksource-drivers-sp804-avoid-error-on-multiple-in.patch-20726
-staging-rtl8712-fix-uninit-value-in-r871xu_drv_init.patch-16645
-serial-msm_serial-disable-interrupts-in-__msm_consol.patch-9319
-md-protect-md_unregister_thread-from-reentrancy.patch-2164
-revert-net-af_key-add-check-for-pfkey_broadcast-in-f.patch-18188
-drm-radeon-fix-a-possible-null-pointer-dereference.patch-13071
-modpost-fix-undefined-behavior-of-is_arm_mapping_sym.patch-21303
-nodemask-fix-return-values-to-be-unsigned.patch-31283
+++ /dev/null
-From 064b71054b67abbe1dce95a888e416ba23a3a43f Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 16 May 2022 17:22:41 +0800
-Subject: staging: rtl8712: fix uninit-value in r871xu_drv_init()
-
-From: Wang Cheng <wanngchenng@gmail.com>
-
-[ Upstream commit 0458e5428e5e959d201a40ffe71d762a79ecedc4 ]
-
-When 'tmpU1b' returns from r8712_read8(padapter, EE_9346CR) is 0,
-'mac[6]' will not be initialized.
-
-BUG: KMSAN: uninit-value in r871xu_drv_init+0x2d54/0x3070 drivers/staging/rtl8712/usb_intf.c:541
- r871xu_drv_init+0x2d54/0x3070 drivers/staging/rtl8712/usb_intf.c:541
- usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396
- really_probe+0x653/0x14b0 drivers/base/dd.c:596
- __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752
- driver_probe_device drivers/base/dd.c:782 [inline]
- __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899
- bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427
- __device_attach+0x593/0x8e0 drivers/base/dd.c:970
- device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017
- bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487
- device_add+0x1fff/0x26e0 drivers/base/core.c:3405
- usb_set_configuration+0x37e9/0x3ed0 drivers/usb/core/message.c:2170
- usb_generic_driver_probe+0x13c/0x300 drivers/usb/core/generic.c:238
- usb_probe_device+0x309/0x570 drivers/usb/core/driver.c:293
- really_probe+0x653/0x14b0 drivers/base/dd.c:596
- __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752
- driver_probe_device drivers/base/dd.c:782 [inline]
- __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899
- bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427
- __device_attach+0x593/0x8e0 drivers/base/dd.c:970
- device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017
- bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487
- device_add+0x1fff/0x26e0 drivers/base/core.c:3405
- usb_new_device+0x1b8e/0x2950 drivers/usb/core/hub.c:2566
- hub_port_connect drivers/usb/core/hub.c:5358 [inline]
- hub_port_connect_change drivers/usb/core/hub.c:5502 [inline]
- port_event drivers/usb/core/hub.c:5660 [inline]
- hub_event+0x58e3/0x89e0 drivers/usb/core/hub.c:5742
- process_one_work+0xdb6/0x1820 kernel/workqueue.c:2307
- worker_thread+0x10b3/0x21e0 kernel/workqueue.c:2454
- kthread+0x3c7/0x500 kernel/kthread.c:377
- ret_from_fork+0x1f/0x30
-
-Local variable mac created at:
- r871xu_drv_init+0x1771/0x3070 drivers/staging/rtl8712/usb_intf.c:394
- usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396
-
-KMSAN: uninit-value in r871xu_drv_init
-https://syzkaller.appspot.com/bug?id=3cd92b1d85428b128503bfa7a250294c9ae00bd8
-
-Reported-by: <syzbot+6f5ecd144854c0d8580b@syzkaller.appspotmail.com>
-Tested-by: <syzbot+6f5ecd144854c0d8580b@syzkaller.appspotmail.com>
-Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
-Signed-off-by: Wang Cheng <wanngchenng@gmail.com>
-Link: https://lore.kernel.org/r/14c3886173dfa4597f0704547c414cfdbcd11d16.1652618244.git.wanngchenng@gmail.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/staging/rtl8712/usb_intf.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/staging/rtl8712/usb_intf.c b/drivers/staging/rtl8712/usb_intf.c
-index d0ba42dfafeb..7b7cb2a7db60 100644
---- a/drivers/staging/rtl8712/usb_intf.c
-+++ b/drivers/staging/rtl8712/usb_intf.c
-@@ -569,13 +569,13 @@ static int r871xu_drv_init(struct usb_interface *pusb_intf,
- } else {
- AutoloadFail = false;
- }
-- if (((mac[0] == 0xff) && (mac[1] == 0xff) &&
-+ if ((!AutoloadFail) ||
-+ ((mac[0] == 0xff) && (mac[1] == 0xff) &&
- (mac[2] == 0xff) && (mac[3] == 0xff) &&
- (mac[4] == 0xff) && (mac[5] == 0xff)) ||
- ((mac[0] == 0x00) && (mac[1] == 0x00) &&
- (mac[2] == 0x00) && (mac[3] == 0x00) &&
-- (mac[4] == 0x00) && (mac[5] == 0x00)) ||
-- (!AutoloadFail)) {
-+ (mac[4] == 0x00) && (mac[5] == 0x00))) {
- mac[0] = 0x00;
- mac[1] = 0xe0;
- mac[2] = 0x4c;
---
-2.35.1
-
+++ /dev/null
-From 23d7af1b7abcdd650b2fb4b7f49c9c9e8c82e56a Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 31 Mar 2022 17:10:05 +0800
-Subject: tty: Fix a possible resource leak in icom_probe
-
-From: Huang Guobin <huangguobin4@huawei.com>
-
-[ Upstream commit ee157a79e7c82b01ae4c25de0ac75899801f322c ]
-
-When pci_read_config_dword failed, call pci_release_regions() and
-pci_disable_device() to recycle the resource previously allocated.
-
-Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
-Signed-off-by: Huang Guobin <huangguobin4@huawei.com>
-Link: https://lore.kernel.org/r/20220331091005.3290753-1-huangguobin4@huawei.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/tty/serial/icom.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/tty/serial/icom.c b/drivers/tty/serial/icom.c
-index c60a8d5e4020..a3e420669674 100644
---- a/drivers/tty/serial/icom.c
-+++ b/drivers/tty/serial/icom.c
-@@ -1515,7 +1515,7 @@ static int icom_probe(struct pci_dev *dev,
- retval = pci_read_config_dword(dev, PCI_COMMAND, &command_reg);
- if (retval) {
- dev_err(&dev->dev, "PCI Config read FAILED\n");
-- return retval;
-+ goto probe_exit0;
- }
-
- pci_write_config_dword(dev, PCI_COMMAND,
---
-2.35.1
-
+++ /dev/null
-From 47326fe2bad4f3113add6e00cc99630afeaa976e Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 10 Apr 2022 19:48:14 +0800
-Subject: tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
-
-From: Zheyu Ma <zheyuma97@gmail.com>
-
-[ Upstream commit 689ca31c542687709ba21ec2195c1fbce34fd029 ]
-
-When the driver fails at alloc_hdlcdev(), and then we remove the driver
-module, we will get the following splat:
-
-[ 25.065966] general protection fault, probably for non-canonical address 0xdffffc0000000182: 0000 [#1] PREEMPT SMP KASAN PTI
-[ 25.066914] KASAN: null-ptr-deref in range [0x0000000000000c10-0x0000000000000c17]
-[ 25.069262] RIP: 0010:detach_hdlc_protocol+0x2a/0x3e0
-[ 25.077709] Call Trace:
-[ 25.077924] <TASK>
-[ 25.078108] unregister_hdlc_device+0x16/0x30
-[ 25.078481] slgt_cleanup+0x157/0x9f0 [synclink_gt]
-
-Fix this by checking whether the 'info->netdev' is a null pointer first.
-
-Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
-Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
-Link: https://lore.kernel.org/r/20220410114814.3920474-1-zheyuma97@gmail.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/tty/synclink_gt.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/drivers/tty/synclink_gt.c b/drivers/tty/synclink_gt.c
-index 7446ce29f677..b5d053763263 100644
---- a/drivers/tty/synclink_gt.c
-+++ b/drivers/tty/synclink_gt.c
-@@ -1823,6 +1823,8 @@ static int hdlcdev_init(struct slgt_info *info)
- */
- static void hdlcdev_exit(struct slgt_info *info)
- {
-+ if (!info->netdev)
-+ return;
- unregister_hdlc_device(info->netdev);
- free_netdev(info->netdev);
- info->netdev = NULL;
---
-2.35.1
-
+++ /dev/null
-From 92f28b067a760dc213c00a470c42edfc790d8dd6 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 5 May 2022 12:46:18 +0200
-Subject: usb: dwc2: gadget: don't reset gadget's driver->bus
-
-From: Marek Szyprowski <m.szyprowski@samsung.com>
-
-[ Upstream commit 3120aac6d0ecd9accf56894aeac0e265f74d3d5a ]
-
-UDC driver should not touch gadget's driver internals, especially it
-should not reset driver->bus. This wasn't harmful so far, but since
-commit fc274c1e9973 ("USB: gadget: Add a new bus for gadgets") gadget
-subsystem got it's own bus and messing with ->bus triggers the
-following NULL pointer dereference:
-
-dwc2 12480000.hsotg: bound driver g_ether
-8<--- cut here ---
-Unable to handle kernel NULL pointer dereference at virtual address 00000000
-[00000000] *pgd=00000000
-Internal error: Oops: 5 [#1] SMP ARM
-Modules linked in: ...
-CPU: 0 PID: 620 Comm: modprobe Not tainted 5.18.0-rc5-next-20220504 #11862
-Hardware name: Samsung Exynos (Flattened Device Tree)
-PC is at module_add_driver+0x44/0xe8
-LR is at sysfs_do_create_link_sd+0x84/0xe0
-...
-Process modprobe (pid: 620, stack limit = 0x(ptrval))
-...
- module_add_driver from bus_add_driver+0xf4/0x1e4
- bus_add_driver from driver_register+0x78/0x10c
- driver_register from usb_gadget_register_driver_owner+0x40/0xb4
- usb_gadget_register_driver_owner from do_one_initcall+0x44/0x1e0
- do_one_initcall from do_init_module+0x44/0x1c8
- do_init_module from load_module+0x19b8/0x1b9c
- load_module from sys_finit_module+0xdc/0xfc
- sys_finit_module from ret_fast_syscall+0x0/0x54
-Exception stack(0xf1771fa8 to 0xf1771ff0)
-...
-dwc2 12480000.hsotg: new device is high-speed
----[ end trace 0000000000000000 ]---
-
-Fix this by removing driver->bus entry reset.
-
-Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
-Link: https://lore.kernel.org/r/20220505104618.22729-1-m.szyprowski@samsung.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/dwc2/gadget.c | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
-index 65bcbbad6d54..44bab6727b43 100644
---- a/drivers/usb/dwc2/gadget.c
-+++ b/drivers/usb/dwc2/gadget.c
-@@ -3445,7 +3445,6 @@ static int dwc2_hsotg_udc_start(struct usb_gadget *gadget,
-
- WARN_ON(hsotg->driver);
-
-- driver->driver.bus = NULL;
- hsotg->driver = driver;
- hsotg->gadget.dev.of_node = hsotg->dev->of_node;
- hsotg->gadget.speed = USB_SPEED_UNKNOWN;
---
-2.35.1
-
+++ /dev/null
-From efe56fa1ee86383cc45a1290de0c3773d6023caf Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 21 Apr 2022 10:39:27 -0700
-Subject: USB: hcd-pci: Fully suspend across freeze/thaw cycle
-
-From: Evan Green <evgreen@chromium.org>
-
-[ Upstream commit 63acaa8e9c65dc34dc249440216f8e977f5d2748 ]
-
-The documentation for the freeze() method says that it "should quiesce
-the device so that it doesn't generate IRQs or DMA". The unspoken
-consequence of not doing this is that MSIs aimed at non-boot CPUs may
-get fully lost if they're sent during the period where the target CPU is
-offline.
-
-The current callbacks for USB HCD do not fully quiesce interrupts,
-specifically on XHCI. Change to use the full suspend/resume flow for
-freeze/thaw to ensure interrupts are fully quiesced. This fixes issues
-where USB devices fail to thaw during hibernation because XHCI misses
-its interrupt and cannot recover.
-
-Acked-by: Alan Stern <stern@rowland.harvard.edu>
-Signed-off-by: Evan Green <evgreen@chromium.org>
-Link: https://lore.kernel.org/r/20220421103751.v3.2.I8226c7fdae88329ef70957b96a39b346c69a914e@changeid
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/core/hcd-pci.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c
-index 7af23b215254..a416eea9a366 100644
---- a/drivers/usb/core/hcd-pci.c
-+++ b/drivers/usb/core/hcd-pci.c
-@@ -637,10 +637,10 @@ const struct dev_pm_ops usb_hcd_pci_pm_ops = {
- .suspend_noirq = hcd_pci_suspend_noirq,
- .resume_noirq = hcd_pci_resume_noirq,
- .resume = hcd_pci_resume,
-- .freeze = check_root_hub_suspended,
-+ .freeze = hcd_pci_suspend,
- .freeze_noirq = check_root_hub_suspended,
- .thaw_noirq = NULL,
-- .thaw = NULL,
-+ .thaw = hcd_pci_resume,
- .poweroff = hcd_pci_suspend,
- .poweroff_noirq = hcd_pci_suspend_noirq,
- .restore_noirq = hcd_pci_resume_noirq,
---
-2.35.1
-
+++ /dev/null
-From 3b40746f665aeabf7dc878d67a70ec55cda39f19 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 2 Mar 2022 11:37:16 +0800
-Subject: USB: host: isp116x: check return value after calling
- platform_get_resource()
-
-From: Zhen Ni <nizhen@uniontech.com>
-
-[ Upstream commit 134a3408c2d3f7e23eb0e4556e0a2d9f36c2614e ]
-
-It will cause null-ptr-deref if platform_get_resource() returns NULL,
-we need check the return value.
-
-Signed-off-by: Zhen Ni <nizhen@uniontech.com>
-Link: https://lore.kernel.org/r/20220302033716.31272-1-nizhen@uniontech.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/host/isp116x-hcd.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/usb/host/isp116x-hcd.c b/drivers/usb/host/isp116x-hcd.c
-index d089b3fb7a13..c32145e63aea 100644
---- a/drivers/usb/host/isp116x-hcd.c
-+++ b/drivers/usb/host/isp116x-hcd.c
-@@ -1551,10 +1551,12 @@ static int isp116x_remove(struct platform_device *pdev)
-
- iounmap(isp116x->data_reg);
- res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
-- release_mem_region(res->start, 2);
-+ if (res)
-+ release_mem_region(res->start, 2);
- iounmap(isp116x->addr_reg);
- res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-- release_mem_region(res->start, 2);
-+ if (res)
-+ release_mem_region(res->start, 2);
-
- usb_put_hcd(hcd);
- return 0;
---
-2.35.1
-
+++ /dev/null
-From e302d24f0ada102fe3fc387638d62e4d3b304fd0 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 10 Mar 2022 09:34:19 -0500
-Subject: ceph: allow ceph.dir.rctime xattr to be updatable
-
-From: Venky Shankar <vshankar@redhat.com>
-
-[ Upstream commit d7a2dc523085f8b8c60548ceedc696934aefeb0e ]
-
-`rctime' has been a pain point in cephfs due to its buggy
-nature - inconsistent values reported and those sorts.
-Fixing rctime is non-trivial needing an overall redesign
-of the entire nested statistics infrastructure.
-
-As a workaround, PR
-
- http://github.com/ceph/ceph/pull/37938
-
-allows this extended attribute to be manually set. This allows
-users to "fixup" inconsistent rctime values. While this sounds
-messy, its probably the wisest approach allowing users/scripts
-to workaround buggy rctime values.
-
-The above PR enables Ceph MDS to allow manually setting
-rctime extended attribute with the corresponding user-land
-changes. We may as well allow the same to be done via kclient
-for parity.
-
-Signed-off-by: Venky Shankar <vshankar@redhat.com>
-Reviewed-by: Xiubo Li <xiubli@redhat.com>
-Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/ceph/xattr.c | 10 +++++++++-
- 1 file changed, 9 insertions(+), 1 deletion(-)
-
-diff --git a/fs/ceph/xattr.c b/fs/ceph/xattr.c
-index 197cb1234341..76322c0f6e5f 100644
---- a/fs/ceph/xattr.c
-+++ b/fs/ceph/xattr.c
-@@ -317,6 +317,14 @@ static ssize_t ceph_vxattrcb_snap_btime(struct ceph_inode_info *ci, char *val,
- }
- #define XATTR_RSTAT_FIELD(_type, _name) \
- XATTR_NAME_CEPH(_type, _name, VXATTR_FLAG_RSTAT)
-+#define XATTR_RSTAT_FIELD_UPDATABLE(_type, _name) \
-+ { \
-+ .name = CEPH_XATTR_NAME(_type, _name), \
-+ .name_size = sizeof (CEPH_XATTR_NAME(_type, _name)), \
-+ .getxattr_cb = ceph_vxattrcb_ ## _type ## _ ## _name, \
-+ .exists_cb = NULL, \
-+ .flags = VXATTR_FLAG_RSTAT, \
-+ }
- #define XATTR_LAYOUT_FIELD(_type, _name, _field) \
- { \
- .name = CEPH_XATTR_NAME2(_type, _name, _field), \
-@@ -354,7 +362,7 @@ static struct ceph_vxattr ceph_dir_vxattrs[] = {
- XATTR_RSTAT_FIELD(dir, rfiles),
- XATTR_RSTAT_FIELD(dir, rsubdirs),
- XATTR_RSTAT_FIELD(dir, rbytes),
-- XATTR_RSTAT_FIELD(dir, rctime),
-+ XATTR_RSTAT_FIELD_UPDATABLE(dir, rctime),
- {
- .name = "ceph.dir.pin",
- .name_size = sizeof("ceph.dir.pin"),
---
-2.35.1
-
+++ /dev/null
-From 2a06fcd9fb269e22c3c81f9d3b54fdfc161dc35a Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 1 Jun 2022 22:08:46 -0500
-Subject: cifs: version operations for smb20 unneeded when legacy support
- disabled
-
-From: Steve French <stfrench@microsoft.com>
-
-[ Upstream commit 7ef93ffccd55fb0ba000ed16ef6a81cd7dee07b5 ]
-
-We should not be including unused smb20 specific code when legacy
-support is disabled (CONFIG_CIFS_ALLOW_INSECURE_LEGACY turned
-off). For example smb2_operations and smb2_values aren't used
-in that case. Over time we can move more and more SMB1/CIFS and SMB2.0
-code into the insecure legacy ifdefs
-
-Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com>
-Signed-off-by: Steve French <stfrench@microsoft.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/cifs/cifsglob.h | 4 +++-
- fs/cifs/smb2ops.c | 7 ++++++-
- 2 files changed, 9 insertions(+), 2 deletions(-)
-
-diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
-index 6599069be690..196285b0fe46 100644
---- a/fs/cifs/cifsglob.h
-+++ b/fs/cifs/cifsglob.h
-@@ -1982,11 +1982,13 @@ extern mempool_t *cifs_mid_poolp;
-
- /* Operations for different SMB versions */
- #define SMB1_VERSION_STRING "1.0"
-+#define SMB20_VERSION_STRING "2.0"
-+#ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
- extern struct smb_version_operations smb1_operations;
- extern struct smb_version_values smb1_values;
--#define SMB20_VERSION_STRING "2.0"
- extern struct smb_version_operations smb20_operations;
- extern struct smb_version_values smb20_values;
-+#endif /* CIFS_ALLOW_INSECURE_LEGACY */
- #define SMB21_VERSION_STRING "2.1"
- extern struct smb_version_operations smb21_operations;
- extern struct smb_version_values smb21_values;
-diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
-index 7fea94ebda57..b855abfaaf87 100644
---- a/fs/cifs/smb2ops.c
-+++ b/fs/cifs/smb2ops.c
-@@ -4032,11 +4032,13 @@ smb3_set_oplock_level(struct cifsInodeInfo *cinode, __u32 oplock,
- }
- }
-
-+#ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
- static bool
- smb2_is_read_op(__u32 oplock)
- {
- return oplock == SMB2_OPLOCK_LEVEL_II;
- }
-+#endif /* CIFS_ALLOW_INSECURE_LEGACY */
-
- static bool
- smb21_is_read_op(__u32 oplock)
-@@ -5122,7 +5124,7 @@ smb2_make_node(unsigned int xid, struct inode *inode,
- return rc;
- }
-
--
-+#ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
- struct smb_version_operations smb20_operations = {
- .compare_fids = smb2_compare_fids,
- .setup_request = smb2_setup_request,
-@@ -5220,6 +5222,7 @@ struct smb_version_operations smb20_operations = {
- .llseek = smb3_llseek,
- .is_status_io_timeout = smb2_is_status_io_timeout,
- };
-+#endif /* CIFS_ALLOW_INSECURE_LEGACY */
-
- struct smb_version_operations smb21_operations = {
- .compare_fids = smb2_compare_fids,
-@@ -5548,6 +5551,7 @@ struct smb_version_operations smb311_operations = {
- .is_status_io_timeout = smb2_is_status_io_timeout,
- };
-
-+#ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
- struct smb_version_values smb20_values = {
- .version_string = SMB20_VERSION_STRING,
- .protocol_id = SMB20_PROT_ID,
-@@ -5568,6 +5572,7 @@ struct smb_version_values smb20_values = {
- .signing_required = SMB2_NEGOTIATE_SIGNING_REQUIRED,
- .create_lease_size = sizeof(struct create_lease),
- };
-+#endif /* ALLOW_INSECURE_LEGACY */
-
- struct smb_version_values smb21_values = {
- .version_string = SMB21_VERSION_STRING,
---
-2.35.1
-
+++ /dev/null
-From bae02a6eef1793947e7965f3219cd4345f6bf778 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 6 May 2022 17:25:22 +0100
-Subject: clocksource/drivers/sp804: Avoid error on multiple instances
-
-From: Andre Przywara <andre.przywara@arm.com>
-
-[ Upstream commit a98399cbc1e05f7b977419f03905501d566cf54e ]
-
-When a machine sports more than one SP804 timer instance, we only bring
-up the first one, since multiple timers of the same kind are not useful
-to Linux. As this is intentional behaviour, we should not return an
-error message, as we do today:
-===============
-[ 0.000800] Failed to initialize '/bus@8000000/motherboard-bus@8000000/iofpga-bus@300000000/timer@120000': -22
-===============
-
-Replace the -EINVAL return with a debug message and return 0 instead.
-
-Also we do not reach the init function anymore if the DT node is
-disabled (as this is now handled by OF_DECLARE), so remove the explicit
-check for that case.
-
-This fixes a long standing bogus error when booting ARM's fastmodels.
-
-Signed-off-by: Andre Przywara <andre.przywara@arm.com>
-Reviewed-by: Robin Murphy <robin.murphy@arm.com>
-Link: https://lore.kernel.org/r/20220506162522.3675399-1-andre.przywara@arm.com
-Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/clocksource/timer-sp804.c | 10 +++++-----
- 1 file changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/drivers/clocksource/timer-sp804.c b/drivers/clocksource/timer-sp804.c
-index 6e8ad4a4ea3c..bedd3570474b 100644
---- a/drivers/clocksource/timer-sp804.c
-+++ b/drivers/clocksource/timer-sp804.c
-@@ -274,6 +274,11 @@ static int __init sp804_of_init(struct device_node *np, struct sp804_timer *time
- struct clk *clk1, *clk2;
- const char *name = of_get_property(np, "compatible", NULL);
-
-+ if (initialized) {
-+ pr_debug("%pOF: skipping further SP804 timer device\n", np);
-+ return 0;
-+ }
-+
- base = of_iomap(np, 0);
- if (!base)
- return -ENXIO;
-@@ -285,11 +290,6 @@ static int __init sp804_of_init(struct device_node *np, struct sp804_timer *time
- writel(0, timer1_base + timer->ctrl);
- writel(0, timer2_base + timer->ctrl);
-
-- if (initialized || !of_device_is_available(np)) {
-- ret = -EINVAL;
-- goto err;
-- }
--
- clk1 = of_clk_get(np, 0);
- if (IS_ERR(clk1))
- clk1 = NULL;
---
-2.35.1
-
+++ /dev/null
-From 2705bde1781e8e909321831265ac574ea476326f Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 17 Apr 2022 22:16:41 +0800
-Subject: drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop()
-
-From: Duoming Zhou <duoming@zju.edu.cn>
-
-[ Upstream commit 9b6bdbd9337de3917945847bde262a34a87a6303 ]
-
-There is a deadlock in rtllib_beacons_stop(), which is shown
-below:
-
- (Thread 1) | (Thread 2)
- | rtllib_send_beacon()
-rtllib_beacons_stop() | mod_timer()
- spin_lock_irqsave() //(1) | (wait a time)
- ... | rtllib_send_beacon_cb()
- del_timer_sync() | spin_lock_irqsave() //(2)
- (wait timer to stop) | ...
-
-We hold ieee->beacon_lock in position (1) of thread 1 and
-use del_timer_sync() to wait timer to stop, but timer handler
-also need ieee->beacon_lock in position (2) of thread 2.
-As a result, rtllib_beacons_stop() will block forever.
-
-This patch extracts del_timer_sync() from the protection of
-spin_lock_irqsave(), which could let timer handler to obtain
-the needed lock.
-
-Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
-Link: https://lore.kernel.org/r/20220417141641.124388-1-duoming@zju.edu.cn
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/staging/rtl8192e/rtllib_softmac.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/staging/rtl8192e/rtllib_softmac.c b/drivers/staging/rtl8192e/rtllib_softmac.c
-index e8e72f79ca00..aeb6f015fdda 100644
---- a/drivers/staging/rtl8192e/rtllib_softmac.c
-+++ b/drivers/staging/rtl8192e/rtllib_softmac.c
-@@ -651,9 +651,9 @@ static void rtllib_beacons_stop(struct rtllib_device *ieee)
- spin_lock_irqsave(&ieee->beacon_lock, flags);
-
- ieee->beacon_txing = 0;
-- del_timer_sync(&ieee->beacon_timer);
-
- spin_unlock_irqrestore(&ieee->beacon_lock, flags);
-+ del_timer_sync(&ieee->beacon_timer);
-
- }
-
---
-2.35.1
-
+++ /dev/null
-From c02c5591b9fe58e05f752c48964e2f036f9c7b76 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 17 Apr 2022 21:54:07 +0800
-Subject: drivers: staging: rtl8192u: Fix deadlock in ieee80211_beacons_stop()
-
-From: Duoming Zhou <duoming@zju.edu.cn>
-
-[ Upstream commit 806c7b53414934ba2a39449b31fd1a038e500273 ]
-
-There is a deadlock in ieee80211_beacons_stop(), which is shown below:
-
- (Thread 1) | (Thread 2)
- | ieee80211_send_beacon()
-ieee80211_beacons_stop() | mod_timer()
- spin_lock_irqsave() //(1) | (wait a time)
- ... | ieee80211_send_beacon_cb()
- del_timer_sync() | spin_lock_irqsave() //(2)
- (wait timer to stop) | ...
-
-We hold ieee->beacon_lock in position (1) of thread 1 and use
-del_timer_sync() to wait timer to stop, but timer handler
-also need ieee->beacon_lock in position (2) of thread 2.
-As a result, ieee80211_beacons_stop() will block forever.
-
-This patch extracts del_timer_sync() from the protection of
-spin_lock_irqsave(), which could let timer handler to obtain
-the needed lock.
-
-Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
-Link: https://lore.kernel.org/r/20220417135407.109536-1-duoming@zju.edu.cn
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c b/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c
-index 690b664df8fa..56a447651644 100644
---- a/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c
-+++ b/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c
-@@ -528,9 +528,9 @@ static void ieee80211_beacons_stop(struct ieee80211_device *ieee)
- spin_lock_irqsave(&ieee->beacon_lock, flags);
-
- ieee->beacon_txing = 0;
-- del_timer_sync(&ieee->beacon_timer);
-
- spin_unlock_irqrestore(&ieee->beacon_lock, flags);
-+ del_timer_sync(&ieee->beacon_timer);
- }
-
- void ieee80211_stop_send_beacons(struct ieee80211_device *ieee)
---
-2.35.1
-
+++ /dev/null
-From 5d7a02c9635ec7ddfcf2fc59692627ceafb2790b Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 17 Apr 2022 19:16:26 +0800
-Subject: drivers: tty: serial: Fix deadlock in sa1100_set_termios()
-
-From: Duoming Zhou <duoming@zju.edu.cn>
-
-[ Upstream commit 62b2caef400c1738b6d22f636c628d9f85cd4c4c ]
-
-There is a deadlock in sa1100_set_termios(), which is shown
-below:
-
- (Thread 1) | (Thread 2)
- | sa1100_enable_ms()
-sa1100_set_termios() | mod_timer()
- spin_lock_irqsave() //(1) | (wait a time)
- ... | sa1100_timeout()
- del_timer_sync() | spin_lock_irqsave() //(2)
- (wait timer to stop) | ...
-
-We hold sport->port.lock in position (1) of thread 1 and
-use del_timer_sync() to wait timer to stop, but timer handler
-also need sport->port.lock in position (2) of thread 2. As a result,
-sa1100_set_termios() will block forever.
-
-This patch moves del_timer_sync() before spin_lock_irqsave()
-in order to prevent the deadlock.
-
-Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
-Link: https://lore.kernel.org/r/20220417111626.7802-1-duoming@zju.edu.cn
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/tty/serial/sa1100.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/tty/serial/sa1100.c b/drivers/tty/serial/sa1100.c
-index f5fab1dd96bc..aa1cf2ae17a9 100644
---- a/drivers/tty/serial/sa1100.c
-+++ b/drivers/tty/serial/sa1100.c
-@@ -448,6 +448,8 @@ sa1100_set_termios(struct uart_port *port, struct ktermios *termios,
- baud = uart_get_baud_rate(port, termios, old, 0, port->uartclk/16);
- quot = uart_get_divisor(port, baud);
-
-+ del_timer_sync(&sport->timer);
-+
- spin_lock_irqsave(&sport->port.lock, flags);
-
- sport->port.read_status_mask &= UTSR0_TO_SM(UTSR0_TFS);
-@@ -478,8 +480,6 @@ sa1100_set_termios(struct uart_port *port, struct ktermios *termios,
- UTSR1_TO_SM(UTSR1_ROR);
- }
-
-- del_timer_sync(&sport->timer);
--
- /*
- * Update the per-port timeout.
- */
---
-2.35.1
-
+++ /dev/null
-From 400eedd6cbbe2ab8210b5063719d50fb1a4e8743 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 17 Apr 2022 20:03:05 +0800
-Subject: drivers: usb: host: Fix deadlock in oxu_bus_suspend()
-
-From: Duoming Zhou <duoming@zju.edu.cn>
-
-[ Upstream commit 4d378f2ae58138d4c55684e1d274e7dd94aa6524 ]
-
-There is a deadlock in oxu_bus_suspend(), which is shown below:
-
- (Thread 1) | (Thread 2)
- | timer_action()
-oxu_bus_suspend() | mod_timer()
- spin_lock_irq() //(1) | (wait a time)
- ... | oxu_watchdog()
- del_timer_sync() | spin_lock_irq() //(2)
- (wait timer to stop) | ...
-
-We hold oxu->lock in position (1) of thread 1, and use
-del_timer_sync() to wait timer to stop, but timer handler
-also need oxu->lock in position (2) of thread 2. As a result,
-oxu_bus_suspend() will block forever.
-
-This patch extracts del_timer_sync() from the protection of
-spin_lock_irq(), which could let timer handler to obtain
-the needed lock.
-
-Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
-Link: https://lore.kernel.org/r/20220417120305.64577-1-duoming@zju.edu.cn
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/host/oxu210hp-hcd.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/drivers/usb/host/oxu210hp-hcd.c b/drivers/usb/host/oxu210hp-hcd.c
-index e832909a924f..6df2881cd7b9 100644
---- a/drivers/usb/host/oxu210hp-hcd.c
-+++ b/drivers/usb/host/oxu210hp-hcd.c
-@@ -3908,8 +3908,10 @@ static int oxu_bus_suspend(struct usb_hcd *hcd)
- }
- }
-
-+ spin_unlock_irq(&oxu->lock);
- /* turn off now-idle HC */
- del_timer_sync(&oxu->watchdog);
-+ spin_lock_irq(&oxu->lock);
- ehci_halt(oxu);
- hcd->state = HC_STATE_SUSPENDED;
-
---
-2.35.1
-
+++ /dev/null
-From 129f8909239b623bdb6ea9a54144217412a48fc7 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 17 May 2022 17:57:00 +0800
-Subject: drm/radeon: fix a possible null pointer dereference
-
-From: Gong Yuanjun <ruc_gongyuanjun@163.com>
-
-[ Upstream commit a2b28708b645c5632dc93669ab06e97874c8244f ]
-
-In radeon_fp_native_mode(), the return value of drm_mode_duplicate()
-is assigned to mode, which will lead to a NULL pointer dereference
-on failure of drm_mode_duplicate(). Add a check to avoid npd.
-
-The failure status of drm_cvt_mode() on the other path is checked too.
-
-Signed-off-by: Gong Yuanjun <ruc_gongyuanjun@163.com>
-Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/radeon/radeon_connectors.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
-index e30834434442..ef111d460be2 100644
---- a/drivers/gpu/drm/radeon/radeon_connectors.c
-+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
-@@ -473,6 +473,8 @@ static struct drm_display_mode *radeon_fp_native_mode(struct drm_encoder *encode
- native_mode->vdisplay != 0 &&
- native_mode->clock != 0) {
- mode = drm_mode_duplicate(dev, native_mode);
-+ if (!mode)
-+ return NULL;
- mode->type = DRM_MODE_TYPE_PREFERRED | DRM_MODE_TYPE_DRIVER;
- drm_mode_set_name(mode);
-
-@@ -487,6 +489,8 @@ static struct drm_display_mode *radeon_fp_native_mode(struct drm_encoder *encode
- * simpler.
- */
- mode = drm_cvt_mode(dev, native_mode->hdisplay, native_mode->vdisplay, 60, true, false, false);
-+ if (!mode)
-+ return NULL;
- mode->type = DRM_MODE_TYPE_PREFERRED | DRM_MODE_TYPE_DRIVER;
- DRM_DEBUG_KMS("Adding cvt approximation of native panel mode %s\n", mode->name);
- }
---
-2.35.1
-
+++ /dev/null
-From 4eed5dd4537571a5b0d82ed8eb89d18c40f979ce Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 27 Apr 2022 12:00:05 +0900
-Subject: extcon: Modify extcon device to be created after driver data is set
-
-From: bumwoo lee <bw365.lee@samsung.com>
-
-[ Upstream commit 5dcc2afe716d69f5112ce035cb14f007461ff189 ]
-
-Currently, someone can invoke the sysfs such as state_show()
-intermittently before dev_set_drvdata() is done.
-And it can be a cause of kernel Oops because of edev is Null at that time.
-So modified the driver registration to after setting drviver data.
-
-- Oops's backtrace.
-
-Backtrace:
-[<c067865c>] (state_show) from [<c05222e8>] (dev_attr_show)
-[<c05222c0>] (dev_attr_show) from [<c02c66e0>] (sysfs_kf_seq_show)
-[<c02c6648>] (sysfs_kf_seq_show) from [<c02c496c>] (kernfs_seq_show)
-[<c02c4938>] (kernfs_seq_show) from [<c025e2a0>] (seq_read)
-[<c025e11c>] (seq_read) from [<c02c50a0>] (kernfs_fop_read)
-[<c02c5064>] (kernfs_fop_read) from [<c0231cac>] (__vfs_read)
-[<c0231c5c>] (__vfs_read) from [<c0231ee0>] (vfs_read)
-[<c0231e34>] (vfs_read) from [<c0232464>] (ksys_read)
-[<c02323f0>] (ksys_read) from [<c02324fc>] (sys_read)
-[<c02324e4>] (sys_read) from [<c00091d0>] (__sys_trace_return)
-
-Signed-off-by: bumwoo lee <bw365.lee@samsung.com>
-Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/extcon/extcon.c | 29 +++++++++++++++++------------
- 1 file changed, 17 insertions(+), 12 deletions(-)
-
-diff --git a/drivers/extcon/extcon.c b/drivers/extcon/extcon.c
-index e7a9561a826d..356610404bb4 100644
---- a/drivers/extcon/extcon.c
-+++ b/drivers/extcon/extcon.c
-@@ -1230,19 +1230,14 @@ int extcon_dev_register(struct extcon_dev *edev)
- edev->dev.type = &edev->extcon_dev_type;
- }
-
-- ret = device_register(&edev->dev);
-- if (ret) {
-- put_device(&edev->dev);
-- goto err_dev;
-- }
--
- spin_lock_init(&edev->lock);
-- edev->nh = devm_kcalloc(&edev->dev, edev->max_supported,
-- sizeof(*edev->nh), GFP_KERNEL);
-- if (!edev->nh) {
-- ret = -ENOMEM;
-- device_unregister(&edev->dev);
-- goto err_dev;
-+ if (edev->max_supported) {
-+ edev->nh = kcalloc(edev->max_supported, sizeof(*edev->nh),
-+ GFP_KERNEL);
-+ if (!edev->nh) {
-+ ret = -ENOMEM;
-+ goto err_alloc_nh;
-+ }
- }
-
- for (index = 0; index < edev->max_supported; index++)
-@@ -1253,6 +1248,12 @@ int extcon_dev_register(struct extcon_dev *edev)
- dev_set_drvdata(&edev->dev, edev);
- edev->state = 0;
-
-+ ret = device_register(&edev->dev);
-+ if (ret) {
-+ put_device(&edev->dev);
-+ goto err_dev;
-+ }
-+
- mutex_lock(&extcon_dev_list_lock);
- list_add(&edev->entry, &extcon_dev_list);
- mutex_unlock(&extcon_dev_list_lock);
-@@ -1260,6 +1261,9 @@ int extcon_dev_register(struct extcon_dev *edev)
- return 0;
-
- err_dev:
-+ if (edev->max_supported)
-+ kfree(edev->nh);
-+err_alloc_nh:
- if (edev->max_supported)
- kfree(edev->extcon_dev_type.groups);
- err_alloc_groups:
-@@ -1320,6 +1324,7 @@ void extcon_dev_unregister(struct extcon_dev *edev)
- if (edev->max_supported) {
- kfree(edev->extcon_dev_type.groups);
- kfree(edev->cables);
-+ kfree(edev->nh);
- }
-
- put_device(&edev->dev);
---
-2.35.1
-
+++ /dev/null
-From d012df3771a4f2956be904ec24896c1eb66d5a38 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 5 Mar 2022 11:14:05 +0800
-Subject: iio: dummy: iio_simple_dummy: check the return value of kstrdup()
-
-From: Xiaoke Wang <xkernel.wang@foxmail.com>
-
-[ Upstream commit ba93642188a6fed754bf7447f638bc410e05a929 ]
-
-kstrdup() is also a memory allocation-related function, it returns NULL
-when some memory errors happen. So it is better to check the return
-value of it so to catch the memory error in time. Besides, there should
-have a kfree() to clear up the allocation if we get a failure later in
-this function to prevent memory leak.
-
-Signed-off-by: Xiaoke Wang <xkernel.wang@foxmail.com>
-Link: https://lore.kernel.org/r/tencent_C920CFCC33B9CC1C63141FE1334A39FF8508@qq.com
-Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/iio/dummy/iio_simple_dummy.c | 20 ++++++++++++--------
- 1 file changed, 12 insertions(+), 8 deletions(-)
-
-diff --git a/drivers/iio/dummy/iio_simple_dummy.c b/drivers/iio/dummy/iio_simple_dummy.c
-index c0b7ef900735..c24f609c2ade 100644
---- a/drivers/iio/dummy/iio_simple_dummy.c
-+++ b/drivers/iio/dummy/iio_simple_dummy.c
-@@ -575,10 +575,9 @@ static struct iio_sw_device *iio_dummy_probe(const char *name)
- */
-
- swd = kzalloc(sizeof(*swd), GFP_KERNEL);
-- if (!swd) {
-- ret = -ENOMEM;
-- goto error_kzalloc;
-- }
-+ if (!swd)
-+ return ERR_PTR(-ENOMEM);
-+
- /*
- * Allocate an IIO device.
- *
-@@ -590,7 +589,7 @@ static struct iio_sw_device *iio_dummy_probe(const char *name)
- indio_dev = iio_device_alloc(parent, sizeof(*st));
- if (!indio_dev) {
- ret = -ENOMEM;
-- goto error_ret;
-+ goto error_free_swd;
- }
-
- st = iio_priv(indio_dev);
-@@ -616,6 +615,10 @@ static struct iio_sw_device *iio_dummy_probe(const char *name)
- * indio_dev->name = spi_get_device_id(spi)->name;
- */
- indio_dev->name = kstrdup(name, GFP_KERNEL);
-+ if (!indio_dev->name) {
-+ ret = -ENOMEM;
-+ goto error_free_device;
-+ }
-
- /* Provide description of available channels */
- indio_dev->channels = iio_dummy_channels;
-@@ -632,7 +635,7 @@ static struct iio_sw_device *iio_dummy_probe(const char *name)
-
- ret = iio_simple_dummy_events_register(indio_dev);
- if (ret < 0)
-- goto error_free_device;
-+ goto error_free_name;
-
- ret = iio_simple_dummy_configure_buffer(indio_dev);
- if (ret < 0)
-@@ -649,11 +652,12 @@ static struct iio_sw_device *iio_dummy_probe(const char *name)
- iio_simple_dummy_unconfigure_buffer(indio_dev);
- error_unregister_events:
- iio_simple_dummy_events_unregister(indio_dev);
-+error_free_name:
-+ kfree(indio_dev->name);
- error_free_device:
- iio_device_free(indio_dev);
--error_ret:
-+error_free_swd:
- kfree(swd);
--error_kzalloc:
- return ERR_PTR(ret);
- }
-
---
-2.35.1
-
+++ /dev/null
-From e6990fe7ee0cd995ee35c5d261a920e7701a48c9 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 7 Feb 2022 15:38:33 +0100
-Subject: iio: st_sensors: Add a local lock for protecting odr
-
-From: Miquel Raynal <miquel.raynal@bootlin.com>
-
-[ Upstream commit 474010127e2505fc463236470908e1ff5ddb3578 ]
-
-Right now the (framework) mlock lock is (ab)used for multiple purposes:
-1- protecting concurrent accesses over the odr local cache
-2- avoid changing samplig frequency whilst buffer is running
-
-Let's start by handling situation #1 with a local lock.
-
-Suggested-by: Jonathan Cameron <jic23@kernel.org>
-Cc: Denis Ciocca <denis.ciocca@st.com>
-Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
-Link: https://lore.kernel.org/r/20220207143840.707510-7-miquel.raynal@bootlin.com
-Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- .../iio/common/st_sensors/st_sensors_core.c | 24 ++++++++++++++-----
- include/linux/iio/common/st_sensors.h | 3 +++
- 2 files changed, 21 insertions(+), 6 deletions(-)
-
-diff --git a/drivers/iio/common/st_sensors/st_sensors_core.c b/drivers/iio/common/st_sensors/st_sensors_core.c
-index 7a69c1be7393..56206fdbceb9 100644
---- a/drivers/iio/common/st_sensors/st_sensors_core.c
-+++ b/drivers/iio/common/st_sensors/st_sensors_core.c
-@@ -70,16 +70,18 @@ static int st_sensors_match_odr(struct st_sensor_settings *sensor_settings,
-
- int st_sensors_set_odr(struct iio_dev *indio_dev, unsigned int odr)
- {
-- int err;
-+ int err = 0;
- struct st_sensor_odr_avl odr_out = {0, 0};
- struct st_sensor_data *sdata = iio_priv(indio_dev);
-
-+ mutex_lock(&sdata->odr_lock);
-+
- if (!sdata->sensor_settings->odr.mask)
-- return 0;
-+ goto unlock_mutex;
-
- err = st_sensors_match_odr(sdata->sensor_settings, odr, &odr_out);
- if (err < 0)
-- goto st_sensors_match_odr_error;
-+ goto unlock_mutex;
-
- if ((sdata->sensor_settings->odr.addr ==
- sdata->sensor_settings->pw.addr) &&
-@@ -102,7 +104,9 @@ int st_sensors_set_odr(struct iio_dev *indio_dev, unsigned int odr)
- if (err >= 0)
- sdata->odr = odr_out.hz;
-
--st_sensors_match_odr_error:
-+unlock_mutex:
-+ mutex_unlock(&sdata->odr_lock);
-+
- return err;
- }
- EXPORT_SYMBOL(st_sensors_set_odr);
-@@ -364,6 +368,8 @@ int st_sensors_init_sensor(struct iio_dev *indio_dev,
- struct st_sensors_platform_data *of_pdata;
- int err = 0;
-
-+ mutex_init(&sdata->odr_lock);
-+
- /* If OF/DT pdata exists, it will take precedence of anything else */
- of_pdata = st_sensors_dev_probe(indio_dev->dev.parent, pdata);
- if (IS_ERR(of_pdata))
-@@ -557,18 +563,24 @@ int st_sensors_read_info_raw(struct iio_dev *indio_dev,
- err = -EBUSY;
- goto out;
- } else {
-+ mutex_lock(&sdata->odr_lock);
- err = st_sensors_set_enable(indio_dev, true);
-- if (err < 0)
-+ if (err < 0) {
-+ mutex_unlock(&sdata->odr_lock);
- goto out;
-+ }
-
- msleep((sdata->sensor_settings->bootime * 1000) / sdata->odr);
- err = st_sensors_read_axis_data(indio_dev, ch, val);
-- if (err < 0)
-+ if (err < 0) {
-+ mutex_unlock(&sdata->odr_lock);
- goto out;
-+ }
-
- *val = *val >> ch->scan_type.shift;
-
- err = st_sensors_set_enable(indio_dev, false);
-+ mutex_unlock(&sdata->odr_lock);
- }
- out:
- mutex_unlock(&indio_dev->mlock);
-diff --git a/include/linux/iio/common/st_sensors.h b/include/linux/iio/common/st_sensors.h
-index 33e939977444..c16a9dda3ad5 100644
---- a/include/linux/iio/common/st_sensors.h
-+++ b/include/linux/iio/common/st_sensors.h
-@@ -228,6 +228,7 @@ struct st_sensor_settings {
- * @hw_irq_trigger: if we're using the hardware interrupt on the sensor.
- * @hw_timestamp: Latest timestamp from the interrupt handler, when in use.
- * @buffer_data: Data used by buffer part.
-+ * @odr_lock: Local lock for preventing concurrent ODR accesses/changes
- */
- struct st_sensor_data {
- struct device *dev;
-@@ -253,6 +254,8 @@ struct st_sensor_data {
- s64 hw_timestamp;
-
- char buffer_data[ST_SENSORS_MAX_BUFFER_SIZE] ____cacheline_aligned;
-+
-+ struct mutex odr_lock;
- };
-
- #ifdef CONFIG_IIO_BUFFER
---
-2.35.1
-
+++ /dev/null
-From 5bfa6e6e24a20dd875007dd0ea4d0e442a18cc37 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 2 May 2022 12:30:20 +0200
-Subject: jump_label,noinstr: Avoid instrumentation for JUMP_LABEL=n builds
-
-From: Peter Zijlstra <peterz@infradead.org>
-
-[ Upstream commit 656d054e0a15ec327bd82801ccd58201e59f6896 ]
-
-When building x86_64 with JUMP_LABEL=n it's possible for
-instrumentation to sneak into noinstr:
-
-vmlinux.o: warning: objtool: exit_to_user_mode+0x14: call to static_key_count.constprop.0() leaves .noinstr.text section
-vmlinux.o: warning: objtool: syscall_exit_to_user_mode+0x2d: call to static_key_count.constprop.0() leaves .noinstr.text section
-vmlinux.o: warning: objtool: irqentry_exit_to_user_mode+0x1b: call to static_key_count.constprop.0() leaves .noinstr.text section
-
-Switch to arch_ prefixed atomic to avoid the explicit instrumentation.
-
-Reported-by: kernel test robot <lkp@intel.com>
-Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- include/linux/jump_label.h | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/include/linux/jump_label.h b/include/linux/jump_label.h
-index 32809624d422..e67ee4d7318f 100644
---- a/include/linux/jump_label.h
-+++ b/include/linux/jump_label.h
-@@ -249,9 +249,9 @@ extern void static_key_disable_cpuslocked(struct static_key *key);
- #include <linux/atomic.h>
- #include <linux/bug.h>
-
--static inline int static_key_count(struct static_key *key)
-+static __always_inline int static_key_count(struct static_key *key)
- {
-- return atomic_read(&key->enabled);
-+ return arch_atomic_read(&key->enabled);
- }
-
- static __always_inline void jump_label_init(void)
---
-2.35.1
-
+++ /dev/null
-From 7f480157a495e089b6f214370d752c949fa1e692 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 16 May 2022 12:09:51 -0700
-Subject: kernfs: Separate kernfs_pr_cont_buf and rename_lock.
-
-From: Hao Luo <haoluo@google.com>
-
-[ Upstream commit 1a702dc88e150487c9c173a249b3d236498b9183 ]
-
-Previously the protection of kernfs_pr_cont_buf was piggy backed by
-rename_lock, which means that pr_cont() needs to be protected under
-rename_lock. This can cause potential circular lock dependencies.
-
-If there is an OOM, we have the following call hierarchy:
-
- -> cpuset_print_current_mems_allowed()
- -> pr_cont_cgroup_name()
- -> pr_cont_kernfs_name()
-
-pr_cont_kernfs_name() will grab rename_lock and call printk. So we have
-the following lock dependencies:
-
- kernfs_rename_lock -> console_sem
-
-Sometimes, printk does a wakeup before releasing console_sem, which has
-the dependence chain:
-
- console_sem -> p->pi_lock -> rq->lock
-
-Now, imagine one wants to read cgroup_name under rq->lock, for example,
-printing cgroup_name in a tracepoint in the scheduler code. They will
-be holding rq->lock and take rename_lock:
-
- rq->lock -> kernfs_rename_lock
-
-Now they will deadlock.
-
-A prevention to this circular lock dependency is to separate the
-protection of pr_cont_buf from rename_lock. In principle, rename_lock
-is to protect the integrity of cgroup name when copying to buf. Once
-pr_cont_buf has got its content, rename_lock can be dropped. So it's
-safe to drop rename_lock after kernfs_name_locked (and
-kernfs_path_from_node_locked) and rely on a dedicated pr_cont_lock
-to protect pr_cont_buf.
-
-Acked-by: Tejun Heo <tj@kernel.org>
-Signed-off-by: Hao Luo <haoluo@google.com>
-Link: https://lore.kernel.org/r/20220516190951.3144144-1-haoluo@google.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/kernfs/dir.c | 31 +++++++++++++++++++------------
- 1 file changed, 19 insertions(+), 12 deletions(-)
-
-diff --git a/fs/kernfs/dir.c b/fs/kernfs/dir.c
-index 9aec80b9d7c6..afb39e1bbe3b 100644
---- a/fs/kernfs/dir.c
-+++ b/fs/kernfs/dir.c
-@@ -19,7 +19,15 @@
-
- DEFINE_MUTEX(kernfs_mutex);
- static DEFINE_SPINLOCK(kernfs_rename_lock); /* kn->parent and ->name */
--static char kernfs_pr_cont_buf[PATH_MAX]; /* protected by rename_lock */
-+/*
-+ * Don't use rename_lock to piggy back on pr_cont_buf. We don't want to
-+ * call pr_cont() while holding rename_lock. Because sometimes pr_cont()
-+ * will perform wakeups when releasing console_sem. Holding rename_lock
-+ * will introduce deadlock if the scheduler reads the kernfs_name in the
-+ * wakeup path.
-+ */
-+static DEFINE_SPINLOCK(kernfs_pr_cont_lock);
-+static char kernfs_pr_cont_buf[PATH_MAX]; /* protected by pr_cont_lock */
- static DEFINE_SPINLOCK(kernfs_idr_lock); /* root->ino_idr */
-
- #define rb_to_kn(X) rb_entry((X), struct kernfs_node, rb)
-@@ -230,12 +238,12 @@ void pr_cont_kernfs_name(struct kernfs_node *kn)
- {
- unsigned long flags;
-
-- spin_lock_irqsave(&kernfs_rename_lock, flags);
-+ spin_lock_irqsave(&kernfs_pr_cont_lock, flags);
-
-- kernfs_name_locked(kn, kernfs_pr_cont_buf, sizeof(kernfs_pr_cont_buf));
-+ kernfs_name(kn, kernfs_pr_cont_buf, sizeof(kernfs_pr_cont_buf));
- pr_cont("%s", kernfs_pr_cont_buf);
-
-- spin_unlock_irqrestore(&kernfs_rename_lock, flags);
-+ spin_unlock_irqrestore(&kernfs_pr_cont_lock, flags);
- }
-
- /**
-@@ -249,10 +257,10 @@ void pr_cont_kernfs_path(struct kernfs_node *kn)
- unsigned long flags;
- int sz;
-
-- spin_lock_irqsave(&kernfs_rename_lock, flags);
-+ spin_lock_irqsave(&kernfs_pr_cont_lock, flags);
-
-- sz = kernfs_path_from_node_locked(kn, NULL, kernfs_pr_cont_buf,
-- sizeof(kernfs_pr_cont_buf));
-+ sz = kernfs_path_from_node(kn, NULL, kernfs_pr_cont_buf,
-+ sizeof(kernfs_pr_cont_buf));
- if (sz < 0) {
- pr_cont("(error)");
- goto out;
-@@ -266,7 +274,7 @@ void pr_cont_kernfs_path(struct kernfs_node *kn)
- pr_cont("%s", kernfs_pr_cont_buf);
-
- out:
-- spin_unlock_irqrestore(&kernfs_rename_lock, flags);
-+ spin_unlock_irqrestore(&kernfs_pr_cont_lock, flags);
- }
-
- /**
-@@ -864,13 +872,12 @@ static struct kernfs_node *kernfs_walk_ns(struct kernfs_node *parent,
-
- lockdep_assert_held(&kernfs_mutex);
-
-- /* grab kernfs_rename_lock to piggy back on kernfs_pr_cont_buf */
-- spin_lock_irq(&kernfs_rename_lock);
-+ spin_lock_irq(&kernfs_pr_cont_lock);
-
- len = strlcpy(kernfs_pr_cont_buf, path, sizeof(kernfs_pr_cont_buf));
-
- if (len >= sizeof(kernfs_pr_cont_buf)) {
-- spin_unlock_irq(&kernfs_rename_lock);
-+ spin_unlock_irq(&kernfs_pr_cont_lock);
- return NULL;
- }
-
-@@ -882,7 +889,7 @@ static struct kernfs_node *kernfs_walk_ns(struct kernfs_node *parent,
- parent = kernfs_find_ns(parent, name, ns);
- }
-
-- spin_unlock_irq(&kernfs_rename_lock);
-+ spin_unlock_irq(&kernfs_pr_cont_lock);
-
- return parent;
- }
---
-2.35.1
-
+++ /dev/null
-From 50967b1ce8a831f8a3a242102a427821657cf551 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 16 Feb 2022 12:15:03 -0800
-Subject: lkdtm/usercopy: Expand size of "out of frame" object
-
-From: Kees Cook <keescook@chromium.org>
-
-[ Upstream commit f387e86d3a74407bdd9c5815820ac9d060962840 ]
-
-To be sufficiently out of range for the usercopy test to see the lifetime
-mismatch, expand the size of the "bad" buffer, which will let it be
-beyond current_stack_pointer regardless of stack growth direction.
-Paired with the recent addition of stack depth checking under
-CONFIG_HARDENED_USERCOPY=y, this will correctly start tripping again.
-
-Reported-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
-Cc: Arnd Bergmann <arnd@arndb.de>
-Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Reviewed-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
-Link: https://lore.kernel.org/lkml/762faf1b-0443-5ddf-4430-44a20cf2ec4d@collabora.com/
-Signed-off-by: Kees Cook <keescook@chromium.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/misc/lkdtm/usercopy.c | 17 ++++++++++++++---
- 1 file changed, 14 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/misc/lkdtm/usercopy.c b/drivers/misc/lkdtm/usercopy.c
-index 109e8d4302c1..cde2655487ff 100644
---- a/drivers/misc/lkdtm/usercopy.c
-+++ b/drivers/misc/lkdtm/usercopy.c
-@@ -30,12 +30,12 @@ static const unsigned char test_text[] = "This is a test.\n";
- */
- static noinline unsigned char *trick_compiler(unsigned char *stack)
- {
-- return stack + 0;
-+ return stack + unconst;
- }
-
- static noinline unsigned char *do_usercopy_stack_callee(int value)
- {
-- unsigned char buf[32];
-+ unsigned char buf[128];
- int i;
-
- /* Exercise stack to avoid everything living in registers. */
-@@ -43,7 +43,12 @@ static noinline unsigned char *do_usercopy_stack_callee(int value)
- buf[i] = value & 0xff;
- }
-
-- return trick_compiler(buf);
-+ /*
-+ * Put the target buffer in the middle of stack allocation
-+ * so that we don't step on future stack users regardless
-+ * of stack growth direction.
-+ */
-+ return trick_compiler(&buf[(128/2)-32]);
- }
-
- static noinline void do_usercopy_stack(bool to_user, bool bad_frame)
-@@ -66,6 +71,12 @@ static noinline void do_usercopy_stack(bool to_user, bool bad_frame)
- bad_stack -= sizeof(unsigned long);
- }
-
-+#ifdef ARCH_HAS_CURRENT_STACK_POINTER
-+ pr_info("stack : %px\n", (void *)current_stack_pointer);
-+#endif
-+ pr_info("good_stack: %px-%px\n", good_stack, good_stack + sizeof(good_stack));
-+ pr_info("bad_stack : %px-%px\n", bad_stack, bad_stack + sizeof(good_stack));
-+
- user_addr = vm_mmap(NULL, 0, PAGE_SIZE,
- PROT_READ | PROT_WRITE | PROT_EXEC,
- MAP_ANONYMOUS | MAP_PRIVATE, 0);
---
-2.35.1
-
+++ /dev/null
-From 6901145d6a3ae03df8a285d7e0a40b28ea5c845b Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 29 Apr 2022 16:49:09 +0800
-Subject: md: protect md_unregister_thread from reentrancy
-
-From: Guoqing Jiang <guoqing.jiang@cloud.ionos.com>
-
-[ Upstream commit 1e267742283a4b5a8ca65755c44166be27e9aa0f ]
-
-Generally, the md_unregister_thread is called with reconfig_mutex, but
-raid_message in dm-raid doesn't hold reconfig_mutex to unregister thread,
-so md_unregister_thread can be called simulitaneously from two call sites
-in theory.
-
-Then after previous commit which remove the protection of reconfig_mutex
-for md_unregister_thread completely, the potential issue could be worse
-than before.
-
-Let's take pers_lock at the beginning of function to ensure reentrancy.
-
-Reported-by: Donald Buczek <buczek@molgen.mpg.de>
-Signed-off-by: Guoqing Jiang <guoqing.jiang@linux.dev>
-Signed-off-by: Song Liu <song@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/md/md.c | 15 ++++++++++-----
- 1 file changed, 10 insertions(+), 5 deletions(-)
-
-diff --git a/drivers/md/md.c b/drivers/md/md.c
-index 7a9701adee73..5bd1edbb415b 100644
---- a/drivers/md/md.c
-+++ b/drivers/md/md.c
-@@ -7970,17 +7970,22 @@ EXPORT_SYMBOL(md_register_thread);
-
- void md_unregister_thread(struct md_thread **threadp)
- {
-- struct md_thread *thread = *threadp;
-- if (!thread)
-- return;
-- pr_debug("interrupting MD-thread pid %d\n", task_pid_nr(thread->tsk));
-- /* Locking ensures that mddev_unlock does not wake_up a
-+ struct md_thread *thread;
-+
-+ /*
-+ * Locking ensures that mddev_unlock does not wake_up a
- * non-existent thread
- */
- spin_lock(&pers_lock);
-+ thread = *threadp;
-+ if (!thread) {
-+ spin_unlock(&pers_lock);
-+ return;
-+ }
- *threadp = NULL;
- spin_unlock(&pers_lock);
-
-+ pr_debug("interrupting MD-thread pid %d\n", task_pid_nr(thread->tsk));
- kthread_stop(thread->tsk);
- kfree(thread);
- }
---
-2.35.1
-
+++ /dev/null
-From 4846d1a58aff422aa70bdb7abe67ed3786d4563d Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 29 Apr 2022 15:09:13 -0600
-Subject: misc: rtsx: set NULL intfdata when probe fails
-
-From: Shuah Khan <skhan@linuxfoundation.org>
-
-[ Upstream commit f861d36e021e1ac4a0a2a1f6411d623809975d63 ]
-
-rtsx_usb_probe() doesn't call usb_set_intfdata() to null out the
-interface pointer when probe fails. This leaves a stale pointer.
-Noticed the missing usb_set_intfdata() while debugging an unrelated
-invalid DMA mapping problem.
-
-Fix it with a call to usb_set_intfdata(..., NULL).
-
-Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
-Link: https://lore.kernel.org/r/20220429210913.46804-1-skhan@linuxfoundation.org
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/misc/cardreader/rtsx_usb.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/drivers/misc/cardreader/rtsx_usb.c b/drivers/misc/cardreader/rtsx_usb.c
-index 59eda55d92a3..1ef9b61077c4 100644
---- a/drivers/misc/cardreader/rtsx_usb.c
-+++ b/drivers/misc/cardreader/rtsx_usb.c
-@@ -667,6 +667,7 @@ static int rtsx_usb_probe(struct usb_interface *intf,
- return 0;
-
- out_init_fail:
-+ usb_set_intfdata(ucr->pusb_intf, NULL);
- usb_free_coherent(ucr->pusb_dev, IOBUF_SIZE, ucr->iobuf,
- ucr->iobuf_dma);
- return ret;
---
-2.35.1
-
+++ /dev/null
-From ddfbe07eb337e4435ca4cc218b2e45ecc01fcc5b Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 24 May 2022 01:46:22 +0900
-Subject: modpost: fix undefined behavior of is_arm_mapping_symbol()
-
-From: Masahiro Yamada <masahiroy@kernel.org>
-
-[ Upstream commit d6b732666a1bae0df3c3ae06925043bba34502b1 ]
-
-The return value of is_arm_mapping_symbol() is unpredictable when "$"
-is passed in.
-
-strchr(3) says:
- The strchr() and strrchr() functions return a pointer to the matched
- character or NULL if the character is not found. The terminating null
- byte is considered part of the string, so that if c is specified as
- '\0', these functions return a pointer to the terminator.
-
-When str[1] is '\0', strchr("axtd", str[1]) is not NULL, and str[2] is
-referenced (i.e. buffer overrun).
-
-Test code
----------
-
- char str1[] = "abc";
- char str2[] = "ab";
-
- strcpy(str1, "$");
- strcpy(str2, "$");
-
- printf("test1: %d\n", is_arm_mapping_symbol(str1));
- printf("test2: %d\n", is_arm_mapping_symbol(str2));
-
-Result
-------
-
- test1: 0
- test2: 1
-
-Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
-Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- scripts/mod/modpost.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
-index a21aa74b4948..79aef50ede17 100644
---- a/scripts/mod/modpost.c
-+++ b/scripts/mod/modpost.c
-@@ -1271,7 +1271,8 @@ static int secref_whitelist(const struct sectioncheck *mismatch,
-
- static inline int is_arm_mapping_symbol(const char *str)
- {
-- return str[0] == '$' && strchr("axtd", str[1])
-+ return str[0] == '$' &&
-+ (str[1] == 'a' || str[1] == 'd' || str[1] == 't' || str[1] == 'x')
- && (str[2] == '\0' || str[2] == '.');
- }
-
---
-2.35.1
-
+++ /dev/null
-From dc5f8424295cf0b8bf398a5dd33cf328ef1ba795 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 21 May 2022 15:37:44 +0800
-Subject: nbd: call genl_unregister_family() first in nbd_cleanup()
-
-From: Yu Kuai <yukuai3@huawei.com>
-
-[ Upstream commit 06c4da89c24e7023ea448cadf8e9daf06a0aae6e ]
-
-Otherwise there may be race between module removal and the handling of
-netlink command, which can lead to the oops as shown below:
-
- BUG: kernel NULL pointer dereference, address: 0000000000000098
- Oops: 0002 [#1] SMP PTI
- CPU: 1 PID: 31299 Comm: nbd-client Tainted: G E 5.14.0-rc4
- Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
- RIP: 0010:down_write+0x1a/0x50
- Call Trace:
- start_creating+0x89/0x130
- debugfs_create_dir+0x1b/0x130
- nbd_start_device+0x13d/0x390 [nbd]
- nbd_genl_connect+0x42f/0x748 [nbd]
- genl_family_rcv_msg_doit.isra.0+0xec/0x150
- genl_rcv_msg+0xe5/0x1e0
- netlink_rcv_skb+0x55/0x100
- genl_rcv+0x29/0x40
- netlink_unicast+0x1a8/0x250
- netlink_sendmsg+0x21b/0x430
- ____sys_sendmsg+0x2a4/0x2d0
- ___sys_sendmsg+0x81/0xc0
- __sys_sendmsg+0x62/0xb0
- __x64_sys_sendmsg+0x1f/0x30
- do_syscall_64+0x3b/0xc0
- entry_SYSCALL_64_after_hwframe+0x44/0xae
- Modules linked in: nbd(E-)
-
-Signed-off-by: Hou Tao <houtao1@huawei.com>
-Signed-off-by: Yu Kuai <yukuai3@huawei.com>
-Reviewed-by: Josef Bacik <josef@toxicpanda.com>
-Link: https://lore.kernel.org/r/20220521073749.3146892-2-yukuai3@huawei.com
-Signed-off-by: Jens Axboe <axboe@kernel.dk>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/block/nbd.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
-index ecde800ba210..1ca326c66521 100644
---- a/drivers/block/nbd.c
-+++ b/drivers/block/nbd.c
-@@ -2461,6 +2461,12 @@ static void __exit nbd_cleanup(void)
- struct nbd_device *nbd;
- LIST_HEAD(del_list);
-
-+ /*
-+ * Unregister netlink interface prior to waiting
-+ * for the completion of netlink commands.
-+ */
-+ genl_unregister_family(&nbd_genl_family);
-+
- nbd_dbg_close();
-
- mutex_lock(&nbd_index_mutex);
-@@ -2476,7 +2482,6 @@ static void __exit nbd_cleanup(void)
- }
-
- idr_destroy(&nbd_index_idr);
-- genl_unregister_family(&nbd_genl_family);
- unregister_blkdev(NBD_MAJOR, "nbd");
- }
-
---
-2.35.1
-
+++ /dev/null
-From 4b02e5f6cce268d6412f22c16cb8650bf04d2b22 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 21 May 2022 15:37:47 +0800
-Subject: nbd: fix io hung while disconnecting device
-
-From: Yu Kuai <yukuai3@huawei.com>
-
-[ Upstream commit 09dadb5985023e27d4740ebd17e6fea4640110e5 ]
-
-In our tests, "qemu-nbd" triggers a io hung:
-
-INFO: task qemu-nbd:11445 blocked for more than 368 seconds.
- Not tainted 5.18.0-rc3-next-20220422-00003-g2176915513ca #884
-"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
-task:qemu-nbd state:D stack: 0 pid:11445 ppid: 1 flags:0x00000000
-Call Trace:
- <TASK>
- __schedule+0x480/0x1050
- ? _raw_spin_lock_irqsave+0x3e/0xb0
- schedule+0x9c/0x1b0
- blk_mq_freeze_queue_wait+0x9d/0xf0
- ? ipi_rseq+0x70/0x70
- blk_mq_freeze_queue+0x2b/0x40
- nbd_add_socket+0x6b/0x270 [nbd]
- nbd_ioctl+0x383/0x510 [nbd]
- blkdev_ioctl+0x18e/0x3e0
- __x64_sys_ioctl+0xac/0x120
- do_syscall_64+0x35/0x80
- entry_SYSCALL_64_after_hwframe+0x44/0xae
-RIP: 0033:0x7fd8ff706577
-RSP: 002b:00007fd8fcdfebf8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
-RAX: ffffffffffffffda RBX: 0000000040000000 RCX: 00007fd8ff706577
-RDX: 000000000000000d RSI: 000000000000ab00 RDI: 000000000000000f
-RBP: 000000000000000f R08: 000000000000fbe8 R09: 000055fe497c62b0
-R10: 00000002aff20000 R11: 0000000000000246 R12: 000000000000006d
-R13: 0000000000000000 R14: 00007ffe82dc5e70 R15: 00007fd8fcdff9c0
-
-"qemu-ndb -d" will call ioctl 'NBD_DISCONNECT' first, however, following
-message was found:
-
-block nbd0: Send disconnect failed -32
-
-Which indicate that something is wrong with the server. Then,
-"qemu-nbd -d" will call ioctl 'NBD_CLEAR_SOCK', however ioctl can't clear
-requests after commit 2516ab1543fd("nbd: only clear the queue on device
-teardown"). And in the meantime, request can't complete through timeout
-because nbd_xmit_timeout() will always return 'BLK_EH_RESET_TIMER', which
-means such request will never be completed in this situation.
-
-Now that the flag 'NBD_CMD_INFLIGHT' can make sure requests won't
-complete multiple times, switch back to call nbd_clear_sock() in
-nbd_clear_sock_ioctl(), so that inflight requests can be cleared.
-
-Signed-off-by: Yu Kuai <yukuai3@huawei.com>
-Reviewed-by: Josef Bacik <josef@toxicpanda.com>
-Link: https://lore.kernel.org/r/20220521073749.3146892-5-yukuai3@huawei.com
-Signed-off-by: Jens Axboe <axboe@kernel.dk>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/block/nbd.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
-index 74afa50c7864..4a6b82d434ee 100644
---- a/drivers/block/nbd.c
-+++ b/drivers/block/nbd.c
-@@ -1359,7 +1359,7 @@ static int nbd_start_device_ioctl(struct nbd_device *nbd, struct block_device *b
- static void nbd_clear_sock_ioctl(struct nbd_device *nbd,
- struct block_device *bdev)
- {
-- sock_shutdown(nbd);
-+ nbd_clear_sock(nbd);
- __invalidate_device(bdev, true);
- nbd_bdev_reset(bdev);
- if (test_and_clear_bit(NBD_RT_HAS_CONFIG_REF,
---
-2.35.1
-
+++ /dev/null
-From fce2955f201d5856c3addce14d2dfd47a25de055 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 21 May 2022 15:37:45 +0800
-Subject: nbd: fix race between nbd_alloc_config() and module removal
-
-From: Yu Kuai <yukuai3@huawei.com>
-
-[ Upstream commit c55b2b983b0fa012942c3eb16384b2b722caa810 ]
-
-When nbd module is being removing, nbd_alloc_config() may be
-called concurrently by nbd_genl_connect(), although try_module_get()
-will return false, but nbd_alloc_config() doesn't handle it.
-
-The race may lead to the leak of nbd_config and its related
-resources (e.g, recv_workq) and oops in nbd_read_stat() due
-to the unload of nbd module as shown below:
-
- BUG: kernel NULL pointer dereference, address: 0000000000000040
- Oops: 0000 [#1] SMP PTI
- CPU: 5 PID: 13840 Comm: kworker/u17:33 Not tainted 5.14.0+ #1
- Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
- Workqueue: knbd16-recv recv_work [nbd]
- RIP: 0010:nbd_read_stat.cold+0x130/0x1a4 [nbd]
- Call Trace:
- recv_work+0x3b/0xb0 [nbd]
- process_one_work+0x1ed/0x390
- worker_thread+0x4a/0x3d0
- kthread+0x12a/0x150
- ret_from_fork+0x22/0x30
-
-Fixing it by checking the return value of try_module_get()
-in nbd_alloc_config(). As nbd_alloc_config() may return ERR_PTR(-ENODEV),
-assign nbd->config only when nbd_alloc_config() succeeds to ensure
-the value of nbd->config is binary (valid or NULL).
-
-Also adding a debug message to check the reference counter
-of nbd_config during module removal.
-
-Signed-off-by: Hou Tao <houtao1@huawei.com>
-Signed-off-by: Yu Kuai <yukuai3@huawei.com>
-Reviewed-by: Josef Bacik <josef@toxicpanda.com>
-Link: https://lore.kernel.org/r/20220521073749.3146892-3-yukuai3@huawei.com
-Signed-off-by: Jens Axboe <axboe@kernel.dk>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/block/nbd.c | 28 +++++++++++++++++++---------
- 1 file changed, 19 insertions(+), 9 deletions(-)
-
-diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
-index 1ca326c66521..74afa50c7864 100644
---- a/drivers/block/nbd.c
-+++ b/drivers/block/nbd.c
-@@ -1472,15 +1472,20 @@ static struct nbd_config *nbd_alloc_config(void)
- {
- struct nbd_config *config;
-
-+ if (!try_module_get(THIS_MODULE))
-+ return ERR_PTR(-ENODEV);
-+
- config = kzalloc(sizeof(struct nbd_config), GFP_NOFS);
-- if (!config)
-- return NULL;
-+ if (!config) {
-+ module_put(THIS_MODULE);
-+ return ERR_PTR(-ENOMEM);
-+ }
-+
- atomic_set(&config->recv_threads, 0);
- init_waitqueue_head(&config->recv_wq);
- init_waitqueue_head(&config->conn_wait);
- config->blksize = NBD_DEF_BLKSIZE;
- atomic_set(&config->live_connections, 0);
-- try_module_get(THIS_MODULE);
- return config;
- }
-
-@@ -1507,12 +1512,13 @@ static int nbd_open(struct block_device *bdev, fmode_t mode)
- mutex_unlock(&nbd->config_lock);
- goto out;
- }
-- config = nbd->config = nbd_alloc_config();
-- if (!config) {
-- ret = -ENOMEM;
-+ config = nbd_alloc_config();
-+ if (IS_ERR(config)) {
-+ ret = PTR_ERR(config);
- mutex_unlock(&nbd->config_lock);
- goto out;
- }
-+ nbd->config = config;
- refcount_set(&nbd->config_refs, 1);
- refcount_inc(&nbd->refs);
- mutex_unlock(&nbd->config_lock);
-@@ -1934,13 +1940,14 @@ static int nbd_genl_connect(struct sk_buff *skb, struct genl_info *info)
- nbd_put(nbd);
- return -EINVAL;
- }
-- config = nbd->config = nbd_alloc_config();
-- if (!nbd->config) {
-+ config = nbd_alloc_config();
-+ if (IS_ERR(config)) {
- mutex_unlock(&nbd->config_lock);
- nbd_put(nbd);
- printk(KERN_ERR "nbd: couldn't allocate config\n");
-- return -ENOMEM;
-+ return PTR_ERR(config);
- }
-+ nbd->config = config;
- refcount_set(&nbd->config_refs, 1);
- set_bit(NBD_RT_BOUND, &config->runtime_flags);
-
-@@ -2476,6 +2483,9 @@ static void __exit nbd_cleanup(void)
- while (!list_empty(&del_list)) {
- nbd = list_first_entry(&del_list, struct nbd_device, list);
- list_del_init(&nbd->list);
-+ if (refcount_read(&nbd->config_refs))
-+ printk(KERN_ERR "nbd: possibly leaking nbd_config (ref %d)\n",
-+ refcount_read(&nbd->config_refs));
- if (refcount_read(&nbd->refs) != 1)
- printk(KERN_ERR "nbd: possibly leaking a device\n");
- nbd_put(nbd);
---
-2.35.1
-
+++ /dev/null
-From d5eb9e49bd4d98e2e805e145479d630131a5042e Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 18 May 2022 13:52:23 -0700
-Subject: nodemask: Fix return values to be unsigned
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Kees Cook <keescook@chromium.org>
-
-[ Upstream commit 0dfe54071d7c828a02917b595456bfde1afdddc9 ]
-
-The nodemask routines had mixed return values that provided potentially
-signed return values that could never happen. This was leading to the
-compiler getting confusing about the range of possible return values
-(it was thinking things could be negative where they could not be). Fix
-all the nodemask routines that should be returning unsigned
-(or bool) values. Silences:
-
- mm/swapfile.c: In function ‘setup_swap_info’:
- mm/swapfile.c:2291:47: error: array subscript -1 is below array bounds of ‘struct plist_node[]’ [-Werror=array-bounds]
- 2291 | p->avail_lists[i].prio = 1;
- | ~~~~~~~~~~~~~~^~~
- In file included from mm/swapfile.c:16:
- ./include/linux/swap.h:292:27: note: while referencing ‘avail_lists’
- 292 | struct plist_node avail_lists[]; /*
- | ^~~~~~~~~~~
-
-Reported-by: Christophe de Dinechin <dinechin@redhat.com>
-Link: https://lore.kernel.org/lkml/20220414150855.2407137-3-dinechin@redhat.com/
-Cc: Alexey Dobriyan <adobriyan@gmail.com>
-Cc: Yury Norov <yury.norov@gmail.com>
-Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
-Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
-Cc: Andrew Morton <akpm@linux-foundation.org>
-Cc: Zhen Lei <thunder.leizhen@huawei.com>
-Signed-off-by: Kees Cook <keescook@chromium.org>
-Signed-off-by: Yury Norov <yury.norov@gmail.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- include/linux/nodemask.h | 38 +++++++++++++++++++-------------------
- lib/nodemask.c | 4 ++--
- 2 files changed, 21 insertions(+), 21 deletions(-)
-
-diff --git a/include/linux/nodemask.h b/include/linux/nodemask.h
-index 843678bfc364..2a63ef05a6cc 100644
---- a/include/linux/nodemask.h
-+++ b/include/linux/nodemask.h
-@@ -42,11 +42,11 @@
- * void nodes_shift_right(dst, src, n) Shift right
- * void nodes_shift_left(dst, src, n) Shift left
- *
-- * int first_node(mask) Number lowest set bit, or MAX_NUMNODES
-- * int next_node(node, mask) Next node past 'node', or MAX_NUMNODES
-- * int next_node_in(node, mask) Next node past 'node', or wrap to first,
-+ * unsigned int first_node(mask) Number lowest set bit, or MAX_NUMNODES
-+ * unsigend int next_node(node, mask) Next node past 'node', or MAX_NUMNODES
-+ * unsigned int next_node_in(node, mask) Next node past 'node', or wrap to first,
- * or MAX_NUMNODES
-- * int first_unset_node(mask) First node not set in mask, or
-+ * unsigned int first_unset_node(mask) First node not set in mask, or
- * MAX_NUMNODES
- *
- * nodemask_t nodemask_of_node(node) Return nodemask with bit 'node' set
-@@ -153,7 +153,7 @@ static inline void __nodes_clear(nodemask_t *dstp, unsigned int nbits)
-
- #define node_test_and_set(node, nodemask) \
- __node_test_and_set((node), &(nodemask))
--static inline int __node_test_and_set(int node, nodemask_t *addr)
-+static inline bool __node_test_and_set(int node, nodemask_t *addr)
- {
- return test_and_set_bit(node, addr->bits);
- }
-@@ -200,7 +200,7 @@ static inline void __nodes_complement(nodemask_t *dstp,
-
- #define nodes_equal(src1, src2) \
- __nodes_equal(&(src1), &(src2), MAX_NUMNODES)
--static inline int __nodes_equal(const nodemask_t *src1p,
-+static inline bool __nodes_equal(const nodemask_t *src1p,
- const nodemask_t *src2p, unsigned int nbits)
- {
- return bitmap_equal(src1p->bits, src2p->bits, nbits);
-@@ -208,7 +208,7 @@ static inline int __nodes_equal(const nodemask_t *src1p,
-
- #define nodes_intersects(src1, src2) \
- __nodes_intersects(&(src1), &(src2), MAX_NUMNODES)
--static inline int __nodes_intersects(const nodemask_t *src1p,
-+static inline bool __nodes_intersects(const nodemask_t *src1p,
- const nodemask_t *src2p, unsigned int nbits)
- {
- return bitmap_intersects(src1p->bits, src2p->bits, nbits);
-@@ -216,20 +216,20 @@ static inline int __nodes_intersects(const nodemask_t *src1p,
-
- #define nodes_subset(src1, src2) \
- __nodes_subset(&(src1), &(src2), MAX_NUMNODES)
--static inline int __nodes_subset(const nodemask_t *src1p,
-+static inline bool __nodes_subset(const nodemask_t *src1p,
- const nodemask_t *src2p, unsigned int nbits)
- {
- return bitmap_subset(src1p->bits, src2p->bits, nbits);
- }
-
- #define nodes_empty(src) __nodes_empty(&(src), MAX_NUMNODES)
--static inline int __nodes_empty(const nodemask_t *srcp, unsigned int nbits)
-+static inline bool __nodes_empty(const nodemask_t *srcp, unsigned int nbits)
- {
- return bitmap_empty(srcp->bits, nbits);
- }
-
- #define nodes_full(nodemask) __nodes_full(&(nodemask), MAX_NUMNODES)
--static inline int __nodes_full(const nodemask_t *srcp, unsigned int nbits)
-+static inline bool __nodes_full(const nodemask_t *srcp, unsigned int nbits)
- {
- return bitmap_full(srcp->bits, nbits);
- }
-@@ -260,15 +260,15 @@ static inline void __nodes_shift_left(nodemask_t *dstp,
- > MAX_NUMNODES, then the silly min_ts could be dropped. */
-
- #define first_node(src) __first_node(&(src))
--static inline int __first_node(const nodemask_t *srcp)
-+static inline unsigned int __first_node(const nodemask_t *srcp)
- {
-- return min_t(int, MAX_NUMNODES, find_first_bit(srcp->bits, MAX_NUMNODES));
-+ return min_t(unsigned int, MAX_NUMNODES, find_first_bit(srcp->bits, MAX_NUMNODES));
- }
-
- #define next_node(n, src) __next_node((n), &(src))
--static inline int __next_node(int n, const nodemask_t *srcp)
-+static inline unsigned int __next_node(int n, const nodemask_t *srcp)
- {
-- return min_t(int,MAX_NUMNODES,find_next_bit(srcp->bits, MAX_NUMNODES, n+1));
-+ return min_t(unsigned int, MAX_NUMNODES, find_next_bit(srcp->bits, MAX_NUMNODES, n+1));
- }
-
- /*
-@@ -276,7 +276,7 @@ static inline int __next_node(int n, const nodemask_t *srcp)
- * the first node in src if needed. Returns MAX_NUMNODES if src is empty.
- */
- #define next_node_in(n, src) __next_node_in((n), &(src))
--int __next_node_in(int node, const nodemask_t *srcp);
-+unsigned int __next_node_in(int node, const nodemask_t *srcp);
-
- static inline void init_nodemask_of_node(nodemask_t *mask, int node)
- {
-@@ -296,9 +296,9 @@ static inline void init_nodemask_of_node(nodemask_t *mask, int node)
- })
-
- #define first_unset_node(mask) __first_unset_node(&(mask))
--static inline int __first_unset_node(const nodemask_t *maskp)
-+static inline unsigned int __first_unset_node(const nodemask_t *maskp)
- {
-- return min_t(int,MAX_NUMNODES,
-+ return min_t(unsigned int, MAX_NUMNODES,
- find_first_zero_bit(maskp->bits, MAX_NUMNODES));
- }
-
-@@ -435,11 +435,11 @@ static inline int num_node_state(enum node_states state)
-
- #define first_online_node first_node(node_states[N_ONLINE])
- #define first_memory_node first_node(node_states[N_MEMORY])
--static inline int next_online_node(int nid)
-+static inline unsigned int next_online_node(int nid)
- {
- return next_node(nid, node_states[N_ONLINE]);
- }
--static inline int next_memory_node(int nid)
-+static inline unsigned int next_memory_node(int nid)
- {
- return next_node(nid, node_states[N_MEMORY]);
- }
-diff --git a/lib/nodemask.c b/lib/nodemask.c
-index 3aa454c54c0d..e22647f5181b 100644
---- a/lib/nodemask.c
-+++ b/lib/nodemask.c
-@@ -3,9 +3,9 @@
- #include <linux/module.h>
- #include <linux/random.h>
-
--int __next_node_in(int node, const nodemask_t *srcp)
-+unsigned int __next_node_in(int node, const nodemask_t *srcp)
- {
-- int ret = __next_node(node, srcp);
-+ unsigned int ret = __next_node(node, srcp);
-
- if (ret == MAX_NUMNODES)
- ret = __first_node(srcp);
---
-2.35.1
-
+++ /dev/null
-From f0fc8e752b1736a0c9fbb1ebc9f2c7458c7d69ae Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 23 May 2022 22:05:24 +0200
-Subject: Revert "net: af_key: add check for pfkey_broadcast in function
- pfkey_process"
-
-From: Michal Kubecek <mkubecek@suse.cz>
-
-[ Upstream commit 9c90c9b3e50e16d03c7f87d63e9db373974781e0 ]
-
-This reverts commit 4dc2a5a8f6754492180741facf2a8787f2c415d7.
-
-A non-zero return value from pfkey_broadcast() does not necessarily mean
-an error occurred as this function returns -ESRCH when no registered
-listener received the message. In particular, a call with
-BROADCAST_PROMISC_ONLY flag and null one_sk argument can never return
-zero so that this commit in fact prevents processing any PF_KEY message.
-One visible effect is that racoon daemon fails to find encryption
-algorithms like aes and refuses to start.
-
-Excluding -ESRCH return value would fix this but it's not obvious that
-we really want to bail out here and most other callers of
-pfkey_broadcast() also ignore the return value. Also, as pointed out by
-Steffen Klassert, PF_KEY is kind of deprecated and newer userspace code
-should use netlink instead so that we should only disturb the code for
-really important fixes.
-
-v2: add a comment explaining why is the return value ignored
-
-Signed-off-by: Michal Kubecek <mkubecek@suse.cz>
-Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/key/af_key.c | 10 ++++++----
- 1 file changed, 6 insertions(+), 4 deletions(-)
-
-diff --git a/net/key/af_key.c b/net/key/af_key.c
-index 6b7ed5568c09..2aa16a171285 100644
---- a/net/key/af_key.c
-+++ b/net/key/af_key.c
-@@ -2830,10 +2830,12 @@ static int pfkey_process(struct sock *sk, struct sk_buff *skb, const struct sadb
- void *ext_hdrs[SADB_EXT_MAX];
- int err;
-
-- err = pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL,
-- BROADCAST_PROMISC_ONLY, NULL, sock_net(sk));
-- if (err)
-- return err;
-+ /* Non-zero return value of pfkey_broadcast() does not always signal
-+ * an error and even on an actual error we may still want to process
-+ * the message so rather ignore the return value.
-+ */
-+ pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL,
-+ BROADCAST_PROMISC_ONLY, NULL, sock_net(sk));
-
- memset(ext_hdrs, 0, sizeof(ext_hdrs));
- err = parse_exthdrs(skb, hdr, ext_hdrs);
---
-2.35.1
-
+++ /dev/null
-From 5f41a8881fabd106ed54e7e12770afc1f796154e Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 30 May 2022 11:27:05 +0200
-Subject: s390/gmap: voluntarily schedule during key setting
-
-From: Christian Borntraeger <borntraeger@linux.ibm.com>
-
-[ Upstream commit 6d5946274df1fff539a7eece458a43be733d1db8 ]
-
-With large and many guest with storage keys it is possible to create
-large latencies or stalls during initial key setting:
-
-rcu: INFO: rcu_sched self-detected stall on CPU
-rcu: 18-....: (2099 ticks this GP) idle=54e/1/0x4000000000000002 softirq=35598716/35598716 fqs=998
- (t=2100 jiffies g=155867385 q=20879)
-Task dump for CPU 18:
-CPU 1/KVM R running task 0 1030947 256019 0x06000004
-Call Trace:
-sched_show_task
-rcu_dump_cpu_stacks
-rcu_sched_clock_irq
-update_process_times
-tick_sched_handle
-tick_sched_timer
-__hrtimer_run_queues
-hrtimer_interrupt
-do_IRQ
-ext_int_handler
-ptep_zap_key
-
-The mmap lock is held during the page walking but since this is a
-semaphore scheduling is still possible. Same for the kvm srcu.
-To minimize overhead do this on every segment table entry or large page.
-
-Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
-Reviewed-by: Alexander Gordeev <agordeev@linux.ibm.com>
-Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
-Link: https://lore.kernel.org/r/20220530092706.11637-2-borntraeger@linux.ibm.com
-Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
-Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/s390/mm/gmap.c | 14 ++++++++++++++
- 1 file changed, 14 insertions(+)
-
-diff --git a/arch/s390/mm/gmap.c b/arch/s390/mm/gmap.c
-index f2d19d40272c..2db097c14cec 100644
---- a/arch/s390/mm/gmap.c
-+++ b/arch/s390/mm/gmap.c
-@@ -2596,6 +2596,18 @@ static int __s390_enable_skey_pte(pte_t *pte, unsigned long addr,
- return 0;
- }
-
-+/*
-+ * Give a chance to schedule after setting a key to 256 pages.
-+ * We only hold the mm lock, which is a rwsem and the kvm srcu.
-+ * Both can sleep.
-+ */
-+static int __s390_enable_skey_pmd(pmd_t *pmd, unsigned long addr,
-+ unsigned long next, struct mm_walk *walk)
-+{
-+ cond_resched();
-+ return 0;
-+}
-+
- static int __s390_enable_skey_hugetlb(pte_t *pte, unsigned long addr,
- unsigned long hmask, unsigned long next,
- struct mm_walk *walk)
-@@ -2618,12 +2630,14 @@ static int __s390_enable_skey_hugetlb(pte_t *pte, unsigned long addr,
- end = start + HPAGE_SIZE - 1;
- __storage_key_init_range(start, end);
- set_bit(PG_arch_1, &page->flags);
-+ cond_resched();
- return 0;
- }
-
- static const struct mm_walk_ops enable_skey_walk_ops = {
- .hugetlb_entry = __s390_enable_skey_hugetlb,
- .pte_entry = __s390_enable_skey_pte,
-+ .pmd_entry = __s390_enable_skey_pmd,
- };
-
- int s390_enable_skey(void)
---
-2.35.1
-
+++ /dev/null
-From a1511d33ffd95d75438b29c30690abc95b5acf1e Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 23 May 2022 14:02:44 +0200
-Subject: scsi: myrb: Fix up null pointer access on myrb_cleanup()
-
-From: Hannes Reinecke <hare@suse.de>
-
-[ Upstream commit f9f0a46141e2e39bedb4779c88380d1b5f018c14 ]
-
-When myrb_probe() fails the callback might not be set, so we need to
-validate the 'disable_intr' callback in myrb_cleanup() to not cause a null
-pointer exception. And while at it do not call myrb_cleanup() if we cannot
-enable the PCI device at all.
-
-Link: https://lore.kernel.org/r/20220523120244.99515-1-hare@suse.de
-Reported-by: Zheyu Ma <zheyuma97@gmail.com>
-Tested-by: Zheyu Ma <zheyuma97@gmail.com>
-Signed-off-by: Hannes Reinecke <hare@suse.de>
-Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/scsi/myrb.c | 11 ++++++++---
- 1 file changed, 8 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/scsi/myrb.c b/drivers/scsi/myrb.c
-index 5fa0f4ed6565..ad17c2beaaca 100644
---- a/drivers/scsi/myrb.c
-+++ b/drivers/scsi/myrb.c
-@@ -1241,7 +1241,8 @@ static void myrb_cleanup(struct myrb_hba *cb)
- myrb_unmap(cb);
-
- if (cb->mmio_base) {
-- cb->disable_intr(cb->io_base);
-+ if (cb->disable_intr)
-+ cb->disable_intr(cb->io_base);
- iounmap(cb->mmio_base);
- }
- if (cb->irq)
-@@ -3515,9 +3516,13 @@ static struct myrb_hba *myrb_detect(struct pci_dev *pdev,
- mutex_init(&cb->dcmd_mutex);
- mutex_init(&cb->dma_mutex);
- cb->pdev = pdev;
-+ cb->host = shost;
-
-- if (pci_enable_device(pdev))
-- goto failure;
-+ if (pci_enable_device(pdev)) {
-+ dev_err(&pdev->dev, "Failed to enable PCI device\n");
-+ scsi_host_put(shost);
-+ return NULL;
-+ }
-
- if (privdata->hw_init == DAC960_PD_hw_init ||
- privdata->hw_init == DAC960_P_hw_init) {
---
-2.35.1
-
+++ /dev/null
-From 23b93c40678a8368da5defbbc92b014578ed0143 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 6 May 2022 23:39:24 +0206
-Subject: serial: msm_serial: disable interrupts in __msm_console_write()
-
-From: John Ogness <john.ogness@linutronix.de>
-
-[ Upstream commit aabdbb1b7a5819e18c403334a31fb0cc2c06ad41 ]
-
-__msm_console_write() assumes that interrupts are disabled, but
-with threaded console printers it is possible that the write()
-callback of the console is called with interrupts enabled.
-
-Explicitly disable interrupts using local_irq_save() to preserve
-the assumed context.
-
-Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
-Reviewed-by: Petr Mladek <pmladek@suse.com>
-Signed-off-by: John Ogness <john.ogness@linutronix.de>
-Link: https://lore.kernel.org/r/20220506213324.470461-1-john.ogness@linutronix.de
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/tty/serial/msm_serial.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/drivers/tty/serial/msm_serial.c b/drivers/tty/serial/msm_serial.c
-index 26bcbec5422e..27023a56f3ac 100644
---- a/drivers/tty/serial/msm_serial.c
-+++ b/drivers/tty/serial/msm_serial.c
-@@ -1593,6 +1593,7 @@ static inline struct uart_port *msm_get_port_from_line(unsigned int line)
- static void __msm_console_write(struct uart_port *port, const char *s,
- unsigned int count, bool is_uartdm)
- {
-+ unsigned long flags;
- int i;
- int num_newlines = 0;
- bool replaced = false;
-@@ -1610,6 +1611,8 @@ static void __msm_console_write(struct uart_port *port, const char *s,
- num_newlines++;
- count += num_newlines;
-
-+ local_irq_save(flags);
-+
- if (port->sysrq)
- locked = 0;
- else if (oops_in_progress)
-@@ -1655,6 +1658,8 @@ static void __msm_console_write(struct uart_port *port, const char *s,
-
- if (locked)
- spin_unlock(&port->lock);
-+
-+ local_irq_restore(flags);
- }
-
- static void msm_console_write(struct console *co, const char *s,
---
-2.35.1
-
ip_gre-test-csum_start-instead-of-transport-header.patch
net-altera-fix-refcount-leak-in-altera_tse_mdio_crea.patch
drm-imx-fix-compiler-warning-with-gcc-12.patch
-iio-dummy-iio_simple_dummy-check-the-return-value-of.patch
-staging-rtl8712-fix-a-potential-memory-leak-in-r871x.patch
-iio-st_sensors-add-a-local-lock-for-protecting-odr.patch
-lkdtm-usercopy-expand-size-of-out-of-frame-object.patch
-tty-synclink_gt-fix-null-pointer-dereference-in-slgt.patch
-tty-fix-a-possible-resource-leak-in-icom_probe.patch
-drivers-staging-rtl8192u-fix-deadlock-in-ieee80211_b.patch
-drivers-staging-rtl8192e-fix-deadlock-in-rtllib_beac.patch
-usb-host-isp116x-check-return-value-after-calling-pl.patch
-drivers-tty-serial-fix-deadlock-in-sa1100_set_termio.patch
-drivers-usb-host-fix-deadlock-in-oxu_bus_suspend.patch
-usb-hcd-pci-fully-suspend-across-freeze-thaw-cycle.patch
-sysrq-do-not-omit-current-cpu-when-showing-backtrace.patch
-usb-dwc2-gadget-don-t-reset-gadget-s-driver-bus.patch
-misc-rtsx-set-null-intfdata-when-probe-fails.patch
-extcon-modify-extcon-device-to-be-created-after-driv.patch
-clocksource-drivers-sp804-avoid-error-on-multiple-in.patch
-staging-rtl8712-fix-uninit-value-in-usb_read8-and-fr.patch
-staging-rtl8712-fix-uninit-value-in-r871xu_drv_init.patch
-serial-msm_serial-disable-interrupts-in-__msm_consol.patch
-kernfs-separate-kernfs_pr_cont_buf-and-rename_lock.patch
-watchdog-wdat_wdt-stop-watchdog-when-rebooting-the-s.patch
-md-protect-md_unregister_thread-from-reentrancy.patch
-scsi-myrb-fix-up-null-pointer-access-on-myrb_cleanup.patch
-revert-net-af_key-add-check-for-pfkey_broadcast-in-f.patch
-ceph-allow-ceph.dir.rctime-xattr-to-be-updatable.patch
-drm-radeon-fix-a-possible-null-pointer-dereference.patch
-modpost-fix-undefined-behavior-of-is_arm_mapping_sym.patch
-x86-cpu-elide-kcsan-for-cpu_has-and-friends.patch
-jump_label-noinstr-avoid-instrumentation-for-jump_la.patch
-nbd-call-genl_unregister_family-first-in-nbd_cleanup.patch
-nbd-fix-race-between-nbd_alloc_config-and-module-rem.patch
-nbd-fix-io-hung-while-disconnecting-device.patch
-s390-gmap-voluntarily-schedule-during-key-setting.patch
-cifs-version-operations-for-smb20-unneeded-when-lega.patch
-nodemask-fix-return-values-to-be-unsigned.patch
-iio-dummy-iio_simple_dummy-check-the-return-value-of.patch-16521
-staging-rtl8712-fix-a-potential-memory-leak-in-r871x.patch-20463
-iio-st_sensors-add-a-local-lock-for-protecting-odr.patch-11569
-lkdtm-usercopy-expand-size-of-out-of-frame-object.patch-24349
-tty-synclink_gt-fix-null-pointer-dereference-in-slgt.patch-16563
-tty-fix-a-possible-resource-leak-in-icom_probe.patch-15428
-drivers-staging-rtl8192u-fix-deadlock-in-ieee80211_b.patch-23959
-drivers-staging-rtl8192e-fix-deadlock-in-rtllib_beac.patch-9683
-usb-host-isp116x-check-return-value-after-calling-pl.patch-14563
-drivers-tty-serial-fix-deadlock-in-sa1100_set_termio.patch-29525
-drivers-usb-host-fix-deadlock-in-oxu_bus_suspend.patch-15433
-usb-hcd-pci-fully-suspend-across-freeze-thaw-cycle.patch-10581
-sysrq-do-not-omit-current-cpu-when-showing-backtrace.patch-27183
-usb-dwc2-gadget-don-t-reset-gadget-s-driver-bus.patch-16108
-misc-rtsx-set-null-intfdata-when-probe-fails.patch-21544
-extcon-modify-extcon-device-to-be-created-after-driv.patch-16488
-clocksource-drivers-sp804-avoid-error-on-multiple-in.patch-6528
-staging-rtl8712-fix-uninit-value-in-usb_read8-and-fr.patch-2136
-staging-rtl8712-fix-uninit-value-in-r871xu_drv_init.patch-28995
-serial-msm_serial-disable-interrupts-in-__msm_consol.patch-2470
-kernfs-separate-kernfs_pr_cont_buf-and-rename_lock.patch-27001
-watchdog-wdat_wdt-stop-watchdog-when-rebooting-the-s.patch-7365
-md-protect-md_unregister_thread-from-reentrancy.patch-18044
-scsi-myrb-fix-up-null-pointer-access-on-myrb_cleanup.patch-20253
-revert-net-af_key-add-check-for-pfkey_broadcast-in-f.patch-8483
-ceph-allow-ceph.dir.rctime-xattr-to-be-updatable.patch-32443
-drm-radeon-fix-a-possible-null-pointer-dereference.patch-29704
-modpost-fix-undefined-behavior-of-is_arm_mapping_sym.patch-2294
-x86-cpu-elide-kcsan-for-cpu_has-and-friends.patch-31253
-jump_label-noinstr-avoid-instrumentation-for-jump_la.patch-9808
-nbd-call-genl_unregister_family-first-in-nbd_cleanup.patch-5487
-nbd-fix-race-between-nbd_alloc_config-and-module-rem.patch-12090
-nbd-fix-io-hung-while-disconnecting-device.patch-5544
-s390-gmap-voluntarily-schedule-during-key-setting.patch-11322
-cifs-version-operations-for-smb20-unneeded-when-lega.patch-21431
-nodemask-fix-return-values-to-be-unsigned.patch-27058
-iio-dummy-iio_simple_dummy-check-the-return-value-of.patch-26829
-staging-rtl8712-fix-a-potential-memory-leak-in-r871x.patch-16376
-iio-st_sensors-add-a-local-lock-for-protecting-odr.patch-29552
-lkdtm-usercopy-expand-size-of-out-of-frame-object.patch-18499
-tty-synclink_gt-fix-null-pointer-dereference-in-slgt.patch-16288
-tty-fix-a-possible-resource-leak-in-icom_probe.patch-21804
-drivers-staging-rtl8192u-fix-deadlock-in-ieee80211_b.patch-17013
-drivers-staging-rtl8192e-fix-deadlock-in-rtllib_beac.patch-27076
-usb-host-isp116x-check-return-value-after-calling-pl.patch-226
-drivers-tty-serial-fix-deadlock-in-sa1100_set_termio.patch-14283
-drivers-usb-host-fix-deadlock-in-oxu_bus_suspend.patch-6734
-usb-hcd-pci-fully-suspend-across-freeze-thaw-cycle.patch-9437
-sysrq-do-not-omit-current-cpu-when-showing-backtrace.patch-29291
-usb-dwc2-gadget-don-t-reset-gadget-s-driver-bus.patch-30811
-misc-rtsx-set-null-intfdata-when-probe-fails.patch-1526
-extcon-modify-extcon-device-to-be-created-after-driv.patch-22062
-clocksource-drivers-sp804-avoid-error-on-multiple-in.patch-19066
-staging-rtl8712-fix-uninit-value-in-usb_read8-and-fr.patch-18919
-staging-rtl8712-fix-uninit-value-in-r871xu_drv_init.patch-24043
-serial-msm_serial-disable-interrupts-in-__msm_consol.patch-14348
-kernfs-separate-kernfs_pr_cont_buf-and-rename_lock.patch-27813
-watchdog-wdat_wdt-stop-watchdog-when-rebooting-the-s.patch-17227
-md-protect-md_unregister_thread-from-reentrancy.patch-28068
-scsi-myrb-fix-up-null-pointer-access-on-myrb_cleanup.patch-30371
-revert-net-af_key-add-check-for-pfkey_broadcast-in-f.patch-16084
-ceph-allow-ceph.dir.rctime-xattr-to-be-updatable.patch-27466
-drm-radeon-fix-a-possible-null-pointer-dereference.patch-17377
-modpost-fix-undefined-behavior-of-is_arm_mapping_sym.patch-18554
-x86-cpu-elide-kcsan-for-cpu_has-and-friends.patch-267
-jump_label-noinstr-avoid-instrumentation-for-jump_la.patch-9176
-nbd-call-genl_unregister_family-first-in-nbd_cleanup.patch-5010
-nbd-fix-race-between-nbd_alloc_config-and-module-rem.patch-30620
-nbd-fix-io-hung-while-disconnecting-device.patch-1884
-s390-gmap-voluntarily-schedule-during-key-setting.patch-23608
-cifs-version-operations-for-smb20-unneeded-when-lega.patch-7858
-nodemask-fix-return-values-to-be-unsigned.patch-29989
+++ /dev/null
-From c3a444378ba379bdb090fc4efe354062b2e6c306 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 5 Apr 2022 12:43:07 +0800
-Subject: staging: rtl8712: fix a potential memory leak in r871xu_drv_init()
-
-From: Xiaoke Wang <xkernel.wang@foxmail.com>
-
-[ Upstream commit 7288ff561de650d4139fab80e9cb0da9b5b32434 ]
-
-In r871xu_drv_init(), if r8712_init_drv_sw() fails, then the memory
-allocated by r8712_alloc_io_queue() in r8712_usb_dvobj_init() is not
-properly released as there is no action will be performed by
-r8712_usb_dvobj_deinit().
-To properly release it, we should call r8712_free_io_queue() in
-r8712_usb_dvobj_deinit().
-
-Besides, in r871xu_dev_remove(), r8712_usb_dvobj_deinit() will be called
-by r871x_dev_unload() under condition `padapter->bup` and
-r8712_free_io_queue() is called by r8712_free_drv_sw().
-However, r8712_usb_dvobj_deinit() does not rely on `padapter->bup` and
-calling r8712_free_io_queue() in r8712_free_drv_sw() is negative for
-better understading the code.
-So I move r8712_usb_dvobj_deinit() into r871xu_dev_remove(), and remove
-r8712_free_io_queue() from r8712_free_drv_sw().
-
-Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
-Signed-off-by: Xiaoke Wang <xkernel.wang@foxmail.com>
-Link: https://lore.kernel.org/r/tencent_B8048C592777830380A23A7C4409F9DF1305@qq.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/staging/rtl8712/os_intfs.c | 1 -
- drivers/staging/rtl8712/usb_intf.c | 6 +++---
- 2 files changed, 3 insertions(+), 4 deletions(-)
-
-diff --git a/drivers/staging/rtl8712/os_intfs.c b/drivers/staging/rtl8712/os_intfs.c
-index 2214aca09730..daa3180dfde3 100644
---- a/drivers/staging/rtl8712/os_intfs.c
-+++ b/drivers/staging/rtl8712/os_intfs.c
-@@ -332,7 +332,6 @@ void r8712_free_drv_sw(struct _adapter *padapter)
- r8712_free_evt_priv(&padapter->evtpriv);
- r8712_DeInitSwLeds(padapter);
- r8712_free_mlme_priv(&padapter->mlmepriv);
-- r8712_free_io_queue(padapter);
- _free_xmit_priv(&padapter->xmitpriv);
- _r8712_free_sta_priv(&padapter->stapriv);
- _r8712_free_recv_priv(&padapter->recvpriv);
-diff --git a/drivers/staging/rtl8712/usb_intf.c b/drivers/staging/rtl8712/usb_intf.c
-index fed96d4251bf..77f090bdd36e 100644
---- a/drivers/staging/rtl8712/usb_intf.c
-+++ b/drivers/staging/rtl8712/usb_intf.c
-@@ -266,6 +266,7 @@ static uint r8712_usb_dvobj_init(struct _adapter *padapter)
-
- static void r8712_usb_dvobj_deinit(struct _adapter *padapter)
- {
-+ r8712_free_io_queue(padapter);
- }
-
- void rtl871x_intf_stop(struct _adapter *padapter)
-@@ -303,9 +304,6 @@ void r871x_dev_unload(struct _adapter *padapter)
- rtl8712_hal_deinit(padapter);
- }
-
-- /*s6.*/
-- if (padapter->dvobj_deinit)
-- padapter->dvobj_deinit(padapter);
- padapter->bup = false;
- }
- }
-@@ -610,6 +608,8 @@ static void r871xu_dev_remove(struct usb_interface *pusb_intf)
- /* Stop driver mlme relation timer */
- r8712_stop_drv_timers(padapter);
- r871x_dev_unload(padapter);
-+ if (padapter->dvobj_deinit)
-+ padapter->dvobj_deinit(padapter);
- r8712_free_drv_sw(padapter);
- free_netdev(pnetdev);
-
---
-2.35.1
-
+++ /dev/null
-From 0f38b6b75c53587b85faf16a69de31290c6e3c11 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 16 May 2022 17:22:41 +0800
-Subject: staging: rtl8712: fix uninit-value in r871xu_drv_init()
-
-From: Wang Cheng <wanngchenng@gmail.com>
-
-[ Upstream commit 0458e5428e5e959d201a40ffe71d762a79ecedc4 ]
-
-When 'tmpU1b' returns from r8712_read8(padapter, EE_9346CR) is 0,
-'mac[6]' will not be initialized.
-
-BUG: KMSAN: uninit-value in r871xu_drv_init+0x2d54/0x3070 drivers/staging/rtl8712/usb_intf.c:541
- r871xu_drv_init+0x2d54/0x3070 drivers/staging/rtl8712/usb_intf.c:541
- usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396
- really_probe+0x653/0x14b0 drivers/base/dd.c:596
- __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752
- driver_probe_device drivers/base/dd.c:782 [inline]
- __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899
- bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427
- __device_attach+0x593/0x8e0 drivers/base/dd.c:970
- device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017
- bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487
- device_add+0x1fff/0x26e0 drivers/base/core.c:3405
- usb_set_configuration+0x37e9/0x3ed0 drivers/usb/core/message.c:2170
- usb_generic_driver_probe+0x13c/0x300 drivers/usb/core/generic.c:238
- usb_probe_device+0x309/0x570 drivers/usb/core/driver.c:293
- really_probe+0x653/0x14b0 drivers/base/dd.c:596
- __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752
- driver_probe_device drivers/base/dd.c:782 [inline]
- __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899
- bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427
- __device_attach+0x593/0x8e0 drivers/base/dd.c:970
- device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017
- bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487
- device_add+0x1fff/0x26e0 drivers/base/core.c:3405
- usb_new_device+0x1b8e/0x2950 drivers/usb/core/hub.c:2566
- hub_port_connect drivers/usb/core/hub.c:5358 [inline]
- hub_port_connect_change drivers/usb/core/hub.c:5502 [inline]
- port_event drivers/usb/core/hub.c:5660 [inline]
- hub_event+0x58e3/0x89e0 drivers/usb/core/hub.c:5742
- process_one_work+0xdb6/0x1820 kernel/workqueue.c:2307
- worker_thread+0x10b3/0x21e0 kernel/workqueue.c:2454
- kthread+0x3c7/0x500 kernel/kthread.c:377
- ret_from_fork+0x1f/0x30
-
-Local variable mac created at:
- r871xu_drv_init+0x1771/0x3070 drivers/staging/rtl8712/usb_intf.c:394
- usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396
-
-KMSAN: uninit-value in r871xu_drv_init
-https://syzkaller.appspot.com/bug?id=3cd92b1d85428b128503bfa7a250294c9ae00bd8
-
-Reported-by: <syzbot+6f5ecd144854c0d8580b@syzkaller.appspotmail.com>
-Tested-by: <syzbot+6f5ecd144854c0d8580b@syzkaller.appspotmail.com>
-Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
-Signed-off-by: Wang Cheng <wanngchenng@gmail.com>
-Link: https://lore.kernel.org/r/14c3886173dfa4597f0704547c414cfdbcd11d16.1652618244.git.wanngchenng@gmail.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/staging/rtl8712/usb_intf.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/staging/rtl8712/usb_intf.c b/drivers/staging/rtl8712/usb_intf.c
-index 77f090bdd36e..68d66c3ce2c8 100644
---- a/drivers/staging/rtl8712/usb_intf.c
-+++ b/drivers/staging/rtl8712/usb_intf.c
-@@ -539,13 +539,13 @@ static int r871xu_drv_init(struct usb_interface *pusb_intf,
- } else {
- AutoloadFail = false;
- }
-- if (((mac[0] == 0xff) && (mac[1] == 0xff) &&
-+ if ((!AutoloadFail) ||
-+ ((mac[0] == 0xff) && (mac[1] == 0xff) &&
- (mac[2] == 0xff) && (mac[3] == 0xff) &&
- (mac[4] == 0xff) && (mac[5] == 0xff)) ||
- ((mac[0] == 0x00) && (mac[1] == 0x00) &&
- (mac[2] == 0x00) && (mac[3] == 0x00) &&
-- (mac[4] == 0x00) && (mac[5] == 0x00)) ||
-- (!AutoloadFail)) {
-+ (mac[4] == 0x00) && (mac[5] == 0x00))) {
- mac[0] = 0x00;
- mac[1] = 0xe0;
- mac[2] = 0x4c;
---
-2.35.1
-
+++ /dev/null
-From eb82638fc758a456a46369c09e3033cc02ca001d Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 16 May 2022 17:22:23 +0800
-Subject: staging: rtl8712: fix uninit-value in usb_read8() and friends
-
-From: Wang Cheng <wanngchenng@gmail.com>
-
-[ Upstream commit d1b57669732d09da7e13ef86d058dab0cd57f6e0 ]
-
-When r8712_usbctrl_vendorreq() returns negative, 'data' in
-usb_read{8,16,32} will not be initialized.
-
-BUG: KMSAN: uninit-value in string_nocheck lib/vsprintf.c:643 [inline]
-BUG: KMSAN: uninit-value in string+0x4ec/0x6f0 lib/vsprintf.c:725
- string_nocheck lib/vsprintf.c:643 [inline]
- string+0x4ec/0x6f0 lib/vsprintf.c:725
- vsnprintf+0x2222/0x3650 lib/vsprintf.c:2806
- va_format lib/vsprintf.c:1704 [inline]
- pointer+0x18e6/0x1f70 lib/vsprintf.c:2443
- vsnprintf+0x1a9b/0x3650 lib/vsprintf.c:2810
- vprintk_store+0x537/0x2150 kernel/printk/printk.c:2158
- vprintk_emit+0x28b/0xab0 kernel/printk/printk.c:2256
- dev_vprintk_emit+0x5ef/0x6d0 drivers/base/core.c:4604
- dev_printk_emit+0x1dd/0x21f drivers/base/core.c:4615
- __dev_printk+0x3be/0x440 drivers/base/core.c:4627
- _dev_info+0x1ea/0x22f drivers/base/core.c:4673
- r871xu_drv_init+0x1929/0x3070 drivers/staging/rtl8712/usb_intf.c:401
- usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396
- really_probe+0x6c7/0x1350 drivers/base/dd.c:621
- __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752
- driver_probe_device drivers/base/dd.c:782 [inline]
- __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899
- bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427
- __device_attach+0x593/0x8e0 drivers/base/dd.c:970
- device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017
- bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487
- device_add+0x1fff/0x26e0 drivers/base/core.c:3405
- usb_set_configuration+0x37e9/0x3ed0 drivers/usb/core/message.c:2170
- usb_generic_driver_probe+0x13c/0x300 drivers/usb/core/generic.c:238
- usb_probe_device+0x309/0x570 drivers/usb/core/driver.c:293
- really_probe+0x6c7/0x1350 drivers/base/dd.c:621
- __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752
- driver_probe_device drivers/base/dd.c:782 [inline]
- __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899
- bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427
- __device_attach+0x593/0x8e0 drivers/base/dd.c:970
- device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017
- bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487
- device_add+0x1fff/0x26e0 drivers/base/core.c:3405
- usb_new_device+0x1b91/0x2950 drivers/usb/core/hub.c:2566
- hub_port_connect drivers/usb/core/hub.c:5363 [inline]
- hub_port_connect_change drivers/usb/core/hub.c:5507 [inline]
- port_event drivers/usb/core/hub.c:5665 [inline]
- hub_event+0x58e3/0x89e0 drivers/usb/core/hub.c:5747
- process_one_work+0xdb6/0x1820 kernel/workqueue.c:2289
- worker_thread+0x10d0/0x2240 kernel/workqueue.c:2436
- kthread+0x3c7/0x500 kernel/kthread.c:376
- ret_from_fork+0x1f/0x30
-
-Local variable data created at:
- usb_read8+0x5d/0x130 drivers/staging/rtl8712/usb_ops.c:33
- r8712_read8+0xa5/0xd0 drivers/staging/rtl8712/rtl8712_io.c:29
-
-KMSAN: uninit-value in r871xu_drv_init
-https://syzkaller.appspot.com/bug?id=3cd92b1d85428b128503bfa7a250294c9ae00bd8
-
-Reported-by: <syzbot+6f5ecd144854c0d8580b@syzkaller.appspotmail.com>
-Tested-by: <syzbot+6f5ecd144854c0d8580b@syzkaller.appspotmail.com>
-Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
-Signed-off-by: Wang Cheng <wanngchenng@gmail.com>
-Link: https://lore.kernel.org/r/b9b7a6ee02c02aa28054f5cf16129977775f3cd9.1652618244.git.wanngchenng@gmail.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/staging/rtl8712/usb_ops.c | 27 ++++++++++++++++++---------
- 1 file changed, 18 insertions(+), 9 deletions(-)
-
-diff --git a/drivers/staging/rtl8712/usb_ops.c b/drivers/staging/rtl8712/usb_ops.c
-index e64845e6adf3..af9966d03979 100644
---- a/drivers/staging/rtl8712/usb_ops.c
-+++ b/drivers/staging/rtl8712/usb_ops.c
-@@ -29,7 +29,8 @@ static u8 usb_read8(struct intf_hdl *intfhdl, u32 addr)
- u16 wvalue;
- u16 index;
- u16 len;
-- __le32 data;
-+ int status;
-+ __le32 data = 0;
- struct intf_priv *intfpriv = intfhdl->pintfpriv;
-
- request = 0x05;
-@@ -37,8 +38,10 @@ static u8 usb_read8(struct intf_hdl *intfhdl, u32 addr)
- index = 0;
- wvalue = (u16)(addr & 0x0000ffff);
- len = 1;
-- r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index, &data, len,
-- requesttype);
-+ status = r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index,
-+ &data, len, requesttype);
-+ if (status < 0)
-+ return 0;
- return (u8)(le32_to_cpu(data) & 0x0ff);
- }
-
-@@ -49,7 +52,8 @@ static u16 usb_read16(struct intf_hdl *intfhdl, u32 addr)
- u16 wvalue;
- u16 index;
- u16 len;
-- __le32 data;
-+ int status;
-+ __le32 data = 0;
- struct intf_priv *intfpriv = intfhdl->pintfpriv;
-
- request = 0x05;
-@@ -57,8 +61,10 @@ static u16 usb_read16(struct intf_hdl *intfhdl, u32 addr)
- index = 0;
- wvalue = (u16)(addr & 0x0000ffff);
- len = 2;
-- r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index, &data, len,
-- requesttype);
-+ status = r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index,
-+ &data, len, requesttype);
-+ if (status < 0)
-+ return 0;
- return (u16)(le32_to_cpu(data) & 0xffff);
- }
-
-@@ -69,7 +75,8 @@ static u32 usb_read32(struct intf_hdl *intfhdl, u32 addr)
- u16 wvalue;
- u16 index;
- u16 len;
-- __le32 data;
-+ int status;
-+ __le32 data = 0;
- struct intf_priv *intfpriv = intfhdl->pintfpriv;
-
- request = 0x05;
-@@ -77,8 +84,10 @@ static u32 usb_read32(struct intf_hdl *intfhdl, u32 addr)
- index = 0;
- wvalue = (u16)(addr & 0x0000ffff);
- len = 4;
-- r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index, &data, len,
-- requesttype);
-+ status = r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index,
-+ &data, len, requesttype);
-+ if (status < 0)
-+ return 0;
- return le32_to_cpu(data);
- }
-
---
-2.35.1
-
+++ /dev/null
-From 49ce3de182e75033abc33f12fc01295a77e47b4f Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 17 Jan 2022 23:43:00 +0800
-Subject: sysrq: do not omit current cpu when showing backtrace of all active
- CPUs
-
-From: Changbin Du <changbin.du@gmail.com>
-
-[ Upstream commit 5390e7f46b9d5546d45a83e6463bc656678b1d0e ]
-
-The backtrace of current CPU also should be printed as it is active. This
-change add stack trace for current CPU and print a hint for idle CPU for
-the generic workqueue based printing. (x86 already does this)
-
-Now it looks like below:
-[ 279.401567] sysrq: Show backtrace of all active CPUs
-[ 279.407234] sysrq: CPU5:
-[ 279.407505] Call Trace:
-[ 279.408789] [<ffffffff8000606c>] dump_backtrace+0x2c/0x3a
-[ 279.411698] [<ffffffff800060ac>] show_stack+0x32/0x3e
-[ 279.411809] [<ffffffff80542258>] sysrq_handle_showallcpus+0x4c/0xc6
-[ 279.411929] [<ffffffff80542f16>] __handle_sysrq+0x106/0x26c
-[ 279.412034] [<ffffffff805436a8>] write_sysrq_trigger+0x64/0x74
-[ 279.412139] [<ffffffff8029cd48>] proc_reg_write+0x8e/0xe2
-[ 279.412252] [<ffffffff8021a8f8>] vfs_write+0x90/0x2be
-[ 279.412362] [<ffffffff8021acd2>] ksys_write+0xa6/0xce
-[ 279.412467] [<ffffffff8021ad24>] sys_write+0x2a/0x38
-[ 279.412689] [<ffffffff80003ff8>] ret_from_syscall+0x0/0x2
-[ 279.417173] sysrq: CPU6: backtrace skipped as idling
-[ 279.417185] sysrq: CPU4: backtrace skipped as idling
-[ 279.417187] sysrq: CPU0: backtrace skipped as idling
-[ 279.417181] sysrq: CPU7: backtrace skipped as idling
-[ 279.417190] sysrq: CPU1: backtrace skipped as idling
-[ 279.417193] sysrq: CPU3: backtrace skipped as idling
-[ 279.417219] sysrq: CPU2:
-[ 279.419179] Call Trace:
-[ 279.419440] [<ffffffff8000606c>] dump_backtrace+0x2c/0x3a
-[ 279.419782] [<ffffffff800060ac>] show_stack+0x32/0x3e
-[ 279.420015] [<ffffffff80542b30>] showacpu+0x5c/0x96
-[ 279.420317] [<ffffffff800ba71c>] flush_smp_call_function_queue+0xd6/0x218
-[ 279.420569] [<ffffffff800bb438>] generic_smp_call_function_single_interrupt+0x14/0x1c
-[ 279.420798] [<ffffffff800079ae>] handle_IPI+0xaa/0x13a
-[ 279.421024] [<ffffffff804dcb92>] riscv_intc_irq+0x56/0x70
-[ 279.421274] [<ffffffff80a05b70>] generic_handle_arch_irq+0x6a/0xfa
-[ 279.421518] [<ffffffff80004006>] ret_from_exception+0x0/0x10
-[ 279.421750] [<ffffffff80096492>] rcu_idle_enter+0x16/0x1e
-
-Signed-off-by: Changbin Du <changbin.du@gmail.com>
-Link: https://lore.kernel.org/r/20220117154300.2808-1-changbin.du@gmail.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/tty/sysrq.c | 13 +++++++++----
- 1 file changed, 9 insertions(+), 4 deletions(-)
-
-diff --git a/drivers/tty/sysrq.c b/drivers/tty/sysrq.c
-index 959f9e121cc6..7ca209d4e088 100644
---- a/drivers/tty/sysrq.c
-+++ b/drivers/tty/sysrq.c
-@@ -231,8 +231,10 @@ static void showacpu(void *dummy)
- unsigned long flags;
-
- /* Idle CPUs have no interesting backtrace. */
-- if (idle_cpu(smp_processor_id()))
-+ if (idle_cpu(smp_processor_id())) {
-+ pr_info("CPU%d: backtrace skipped as idling\n", smp_processor_id());
- return;
-+ }
-
- raw_spin_lock_irqsave(&show_lock, flags);
- pr_info("CPU%d:\n", smp_processor_id());
-@@ -259,10 +261,13 @@ static void sysrq_handle_showallcpus(int key)
-
- if (in_irq())
- regs = get_irq_regs();
-- if (regs) {
-- pr_info("CPU%d:\n", smp_processor_id());
-+
-+ pr_info("CPU%d:\n", smp_processor_id());
-+ if (regs)
- show_regs(regs);
-- }
-+ else
-+ show_stack(NULL, NULL, KERN_INFO);
-+
- schedule_work(&sysrq_showallcpus);
- }
- }
---
-2.35.1
-
+++ /dev/null
-From ed5c688524357ad4181628a7bac37b7d6382a238 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 31 Mar 2022 17:10:05 +0800
-Subject: tty: Fix a possible resource leak in icom_probe
-
-From: Huang Guobin <huangguobin4@huawei.com>
-
-[ Upstream commit ee157a79e7c82b01ae4c25de0ac75899801f322c ]
-
-When pci_read_config_dword failed, call pci_release_regions() and
-pci_disable_device() to recycle the resource previously allocated.
-
-Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
-Signed-off-by: Huang Guobin <huangguobin4@huawei.com>
-Link: https://lore.kernel.org/r/20220331091005.3290753-1-huangguobin4@huawei.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/tty/serial/icom.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/tty/serial/icom.c b/drivers/tty/serial/icom.c
-index 94c8281ddb5f..74b325c344da 100644
---- a/drivers/tty/serial/icom.c
-+++ b/drivers/tty/serial/icom.c
-@@ -1503,7 +1503,7 @@ static int icom_probe(struct pci_dev *dev,
- retval = pci_read_config_dword(dev, PCI_COMMAND, &command_reg);
- if (retval) {
- dev_err(&dev->dev, "PCI Config read FAILED\n");
-- return retval;
-+ goto probe_exit0;
- }
-
- pci_write_config_dword(dev, PCI_COMMAND,
---
-2.35.1
-
+++ /dev/null
-From 1a119772a45cd66eb916fc6ac087b0a26e24185f Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 10 Apr 2022 19:48:14 +0800
-Subject: tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
-
-From: Zheyu Ma <zheyuma97@gmail.com>
-
-[ Upstream commit 689ca31c542687709ba21ec2195c1fbce34fd029 ]
-
-When the driver fails at alloc_hdlcdev(), and then we remove the driver
-module, we will get the following splat:
-
-[ 25.065966] general protection fault, probably for non-canonical address 0xdffffc0000000182: 0000 [#1] PREEMPT SMP KASAN PTI
-[ 25.066914] KASAN: null-ptr-deref in range [0x0000000000000c10-0x0000000000000c17]
-[ 25.069262] RIP: 0010:detach_hdlc_protocol+0x2a/0x3e0
-[ 25.077709] Call Trace:
-[ 25.077924] <TASK>
-[ 25.078108] unregister_hdlc_device+0x16/0x30
-[ 25.078481] slgt_cleanup+0x157/0x9f0 [synclink_gt]
-
-Fix this by checking whether the 'info->netdev' is a null pointer first.
-
-Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
-Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
-Link: https://lore.kernel.org/r/20220410114814.3920474-1-zheyuma97@gmail.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/tty/synclink_gt.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/drivers/tty/synclink_gt.c b/drivers/tty/synclink_gt.c
-index 1a0c7beec101..0569d5949133 100644
---- a/drivers/tty/synclink_gt.c
-+++ b/drivers/tty/synclink_gt.c
-@@ -1749,6 +1749,8 @@ static int hdlcdev_init(struct slgt_info *info)
- */
- static void hdlcdev_exit(struct slgt_info *info)
- {
-+ if (!info->netdev)
-+ return;
- unregister_hdlc_device(info->netdev);
- free_netdev(info->netdev);
- info->netdev = NULL;
---
-2.35.1
-
+++ /dev/null
-From e49352ab0634992b5a5a844c7eccbac28e447d71 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 5 May 2022 12:46:18 +0200
-Subject: usb: dwc2: gadget: don't reset gadget's driver->bus
-
-From: Marek Szyprowski <m.szyprowski@samsung.com>
-
-[ Upstream commit 3120aac6d0ecd9accf56894aeac0e265f74d3d5a ]
-
-UDC driver should not touch gadget's driver internals, especially it
-should not reset driver->bus. This wasn't harmful so far, but since
-commit fc274c1e9973 ("USB: gadget: Add a new bus for gadgets") gadget
-subsystem got it's own bus and messing with ->bus triggers the
-following NULL pointer dereference:
-
-dwc2 12480000.hsotg: bound driver g_ether
-8<--- cut here ---
-Unable to handle kernel NULL pointer dereference at virtual address 00000000
-[00000000] *pgd=00000000
-Internal error: Oops: 5 [#1] SMP ARM
-Modules linked in: ...
-CPU: 0 PID: 620 Comm: modprobe Not tainted 5.18.0-rc5-next-20220504 #11862
-Hardware name: Samsung Exynos (Flattened Device Tree)
-PC is at module_add_driver+0x44/0xe8
-LR is at sysfs_do_create_link_sd+0x84/0xe0
-...
-Process modprobe (pid: 620, stack limit = 0x(ptrval))
-...
- module_add_driver from bus_add_driver+0xf4/0x1e4
- bus_add_driver from driver_register+0x78/0x10c
- driver_register from usb_gadget_register_driver_owner+0x40/0xb4
- usb_gadget_register_driver_owner from do_one_initcall+0x44/0x1e0
- do_one_initcall from do_init_module+0x44/0x1c8
- do_init_module from load_module+0x19b8/0x1b9c
- load_module from sys_finit_module+0xdc/0xfc
- sys_finit_module from ret_fast_syscall+0x0/0x54
-Exception stack(0xf1771fa8 to 0xf1771ff0)
-...
-dwc2 12480000.hsotg: new device is high-speed
----[ end trace 0000000000000000 ]---
-
-Fix this by removing driver->bus entry reset.
-
-Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
-Link: https://lore.kernel.org/r/20220505104618.22729-1-m.szyprowski@samsung.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/dwc2/gadget.c | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
-index ec54971063f8..64485f82dc5b 100644
---- a/drivers/usb/dwc2/gadget.c
-+++ b/drivers/usb/dwc2/gadget.c
-@@ -4518,7 +4518,6 @@ static int dwc2_hsotg_udc_start(struct usb_gadget *gadget,
-
- WARN_ON(hsotg->driver);
-
-- driver->driver.bus = NULL;
- hsotg->driver = driver;
- hsotg->gadget.dev.of_node = hsotg->dev->of_node;
- hsotg->gadget.speed = USB_SPEED_UNKNOWN;
---
-2.35.1
-
+++ /dev/null
-From 155fe6fbacde4bf10c864e4dd00bd071bba954ba Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 21 Apr 2022 10:39:27 -0700
-Subject: USB: hcd-pci: Fully suspend across freeze/thaw cycle
-
-From: Evan Green <evgreen@chromium.org>
-
-[ Upstream commit 63acaa8e9c65dc34dc249440216f8e977f5d2748 ]
-
-The documentation for the freeze() method says that it "should quiesce
-the device so that it doesn't generate IRQs or DMA". The unspoken
-consequence of not doing this is that MSIs aimed at non-boot CPUs may
-get fully lost if they're sent during the period where the target CPU is
-offline.
-
-The current callbacks for USB HCD do not fully quiesce interrupts,
-specifically on XHCI. Change to use the full suspend/resume flow for
-freeze/thaw to ensure interrupts are fully quiesced. This fixes issues
-where USB devices fail to thaw during hibernation because XHCI misses
-its interrupt and cannot recover.
-
-Acked-by: Alan Stern <stern@rowland.harvard.edu>
-Signed-off-by: Evan Green <evgreen@chromium.org>
-Link: https://lore.kernel.org/r/20220421103751.v3.2.I8226c7fdae88329ef70957b96a39b346c69a914e@changeid
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/core/hcd-pci.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c
-index ec0d6c50610c..eee78cbfaa72 100644
---- a/drivers/usb/core/hcd-pci.c
-+++ b/drivers/usb/core/hcd-pci.c
-@@ -614,10 +614,10 @@ const struct dev_pm_ops usb_hcd_pci_pm_ops = {
- .suspend_noirq = hcd_pci_suspend_noirq,
- .resume_noirq = hcd_pci_resume_noirq,
- .resume = hcd_pci_resume,
-- .freeze = check_root_hub_suspended,
-+ .freeze = hcd_pci_suspend,
- .freeze_noirq = check_root_hub_suspended,
- .thaw_noirq = NULL,
-- .thaw = NULL,
-+ .thaw = hcd_pci_resume,
- .poweroff = hcd_pci_suspend,
- .poweroff_noirq = hcd_pci_suspend_noirq,
- .restore_noirq = hcd_pci_resume_noirq,
---
-2.35.1
-
+++ /dev/null
-From e0cfdd5247858a62c4348408d6ca5a122e9c5e29 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 2 Mar 2022 11:37:16 +0800
-Subject: USB: host: isp116x: check return value after calling
- platform_get_resource()
-
-From: Zhen Ni <nizhen@uniontech.com>
-
-[ Upstream commit 134a3408c2d3f7e23eb0e4556e0a2d9f36c2614e ]
-
-It will cause null-ptr-deref if platform_get_resource() returns NULL,
-we need check the return value.
-
-Signed-off-by: Zhen Ni <nizhen@uniontech.com>
-Link: https://lore.kernel.org/r/20220302033716.31272-1-nizhen@uniontech.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/host/isp116x-hcd.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/usb/host/isp116x-hcd.c b/drivers/usb/host/isp116x-hcd.c
-index 3055d9abfec3..3e5c54742bef 100644
---- a/drivers/usb/host/isp116x-hcd.c
-+++ b/drivers/usb/host/isp116x-hcd.c
-@@ -1541,10 +1541,12 @@ static int isp116x_remove(struct platform_device *pdev)
-
- iounmap(isp116x->data_reg);
- res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
-- release_mem_region(res->start, 2);
-+ if (res)
-+ release_mem_region(res->start, 2);
- iounmap(isp116x->addr_reg);
- res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-- release_mem_region(res->start, 2);
-+ if (res)
-+ release_mem_region(res->start, 2);
-
- usb_put_hcd(hcd);
- return 0;
---
-2.35.1
-
+++ /dev/null
-From 0888967fd0ee62103398895cb9db0a7b1902d09a Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 26 Apr 2022 22:53:29 +0800
-Subject: watchdog: wdat_wdt: Stop watchdog when rebooting the system
-
-From: Liu Xinpeng <liuxp11@chinatelecom.cn>
-
-[ Upstream commit 27fdf84510a1374748904db43f6755f912736d92 ]
-
-Executing reboot command several times on the machine "Dell
-PowerEdge R740", UEFI security detection stopped machine
-with the following prompt:
-
-UEFI0082: The system was reset due to a timeout from the watchdog
-timer. Check the System Event Log (SEL) or crash dumps from
-Operating Sysstem to identify the source that triggered the
-watchdog timer reset. Update the firmware or driver for the
-identified device.
-
-iDRAC has warning event: "The watchdog timer reset the system".
-
-This patch fixes this issue by adding the reboot notifier.
-
-Signed-off-by: Liu Xinpeng <liuxp11@chinatelecom.cn>
-Reviewed-by: Guenter Roeck <linux@roeck-us.net>
-Link: https://lore.kernel.org/r/1650984810-6247-3-git-send-email-liuxp11@chinatelecom.cn
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
-Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/watchdog/wdat_wdt.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/drivers/watchdog/wdat_wdt.c b/drivers/watchdog/wdat_wdt.c
-index 3065dd670a18..c60723f5ed99 100644
---- a/drivers/watchdog/wdat_wdt.c
-+++ b/drivers/watchdog/wdat_wdt.c
-@@ -462,6 +462,7 @@ static int wdat_wdt_probe(struct platform_device *pdev)
- return ret;
-
- watchdog_set_nowayout(&wdat->wdd, nowayout);
-+ watchdog_stop_on_reboot(&wdat->wdd);
- return devm_watchdog_register_device(dev, &wdat->wdd);
- }
-
---
-2.35.1
-
+++ /dev/null
-From 28354886cec736051e31d26890e68f3058c53e12 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 2 May 2022 12:15:23 +0200
-Subject: x86/cpu: Elide KCSAN for cpu_has() and friends
-
-From: Peter Zijlstra <peterz@infradead.org>
-
-[ Upstream commit a6a5eb269f6f3a2fe392f725a8d9052190c731e2 ]
-
-As x86 uses the <asm-generic/bitops/instrumented-*.h> headers, the
-regular forms of all bitops are instrumented with explicit calls to
-KASAN and KCSAN checks. As these are explicit calls, these are not
-suppressed by the noinstr function attribute.
-
-This can result in calls to those check functions in noinstr code, which
-objtool warns about:
-
-vmlinux.o: warning: objtool: enter_from_user_mode+0x24: call to __kcsan_check_access() leaves .noinstr.text section
-vmlinux.o: warning: objtool: syscall_enter_from_user_mode+0x28: call to __kcsan_check_access() leaves .noinstr.text section
-vmlinux.o: warning: objtool: syscall_enter_from_user_mode_prepare+0x24: call to __kcsan_check_access() leaves .noinstr.text section
-vmlinux.o: warning: objtool: irqentry_enter_from_user_mode+0x24: call to __kcsan_check_access() leaves .noinstr.text section
-
-Prevent this by using the arch_*() bitops, which are the underlying
-bitops without explciit instrumentation.
-
-[null: Changelog]
-Reported-by: kernel test robot <lkp@intel.com>
-Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
-Link: https://lkml.kernel.org/r/20220502111216.290518605@infradead.org
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/x86/include/asm/cpufeature.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h
-index 59bf91c57aa8..619c1f80a2ab 100644
---- a/arch/x86/include/asm/cpufeature.h
-+++ b/arch/x86/include/asm/cpufeature.h
-@@ -49,7 +49,7 @@ extern const char * const x86_power_flags[32];
- extern const char * const x86_bug_flags[NBUGINTS*32];
-
- #define test_cpu_cap(c, bit) \
-- test_bit(bit, (unsigned long *)((c)->x86_capability))
-+ arch_test_bit(bit, (unsigned long *)((c)->x86_capability))
-
- /*
- * There are 32 bits/features in each mask word. The high bits
---
-2.35.1
-
+++ /dev/null
-From 80ac2d2acfdd4c5094fce4d7f60b71d298a2f2d1 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 10 Mar 2022 09:34:19 -0500
-Subject: ceph: allow ceph.dir.rctime xattr to be updatable
-
-From: Venky Shankar <vshankar@redhat.com>
-
-[ Upstream commit d7a2dc523085f8b8c60548ceedc696934aefeb0e ]
-
-`rctime' has been a pain point in cephfs due to its buggy
-nature - inconsistent values reported and those sorts.
-Fixing rctime is non-trivial needing an overall redesign
-of the entire nested statistics infrastructure.
-
-As a workaround, PR
-
- http://github.com/ceph/ceph/pull/37938
-
-allows this extended attribute to be manually set. This allows
-users to "fixup" inconsistent rctime values. While this sounds
-messy, its probably the wisest approach allowing users/scripts
-to workaround buggy rctime values.
-
-The above PR enables Ceph MDS to allow manually setting
-rctime extended attribute with the corresponding user-land
-changes. We may as well allow the same to be done via kclient
-for parity.
-
-Signed-off-by: Venky Shankar <vshankar@redhat.com>
-Reviewed-by: Xiubo Li <xiubli@redhat.com>
-Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/ceph/xattr.c | 10 +++++++++-
- 1 file changed, 9 insertions(+), 1 deletion(-)
-
-diff --git a/fs/ceph/xattr.c b/fs/ceph/xattr.c
-index 159a1ffa4f4b..db288b4aee6d 100644
---- a/fs/ceph/xattr.c
-+++ b/fs/ceph/xattr.c
-@@ -366,6 +366,14 @@ static ssize_t ceph_vxattrcb_auth_mds(struct ceph_inode_info *ci,
- }
- #define XATTR_RSTAT_FIELD(_type, _name) \
- XATTR_NAME_CEPH(_type, _name, VXATTR_FLAG_RSTAT)
-+#define XATTR_RSTAT_FIELD_UPDATABLE(_type, _name) \
-+ { \
-+ .name = CEPH_XATTR_NAME(_type, _name), \
-+ .name_size = sizeof (CEPH_XATTR_NAME(_type, _name)), \
-+ .getxattr_cb = ceph_vxattrcb_ ## _type ## _ ## _name, \
-+ .exists_cb = NULL, \
-+ .flags = VXATTR_FLAG_RSTAT, \
-+ }
- #define XATTR_LAYOUT_FIELD(_type, _name, _field) \
- { \
- .name = CEPH_XATTR_NAME2(_type, _name, _field), \
-@@ -404,7 +412,7 @@ static struct ceph_vxattr ceph_dir_vxattrs[] = {
- XATTR_RSTAT_FIELD(dir, rsubdirs),
- XATTR_RSTAT_FIELD(dir, rsnaps),
- XATTR_RSTAT_FIELD(dir, rbytes),
-- XATTR_RSTAT_FIELD(dir, rctime),
-+ XATTR_RSTAT_FIELD_UPDATABLE(dir, rctime),
- {
- .name = "ceph.dir.pin",
- .name_size = sizeof("ceph.dir.pin"),
---
-2.35.1
-
+++ /dev/null
-From eee229e3b268c22d80a5d885bd2edd82f8fde789 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 19 Apr 2022 08:58:49 +0800
-Subject: ceph: flush the mdlog for filesystem sync
-
-From: Xiubo Li <xiubli@redhat.com>
-
-[ Upstream commit 1b2ba3c5616e17ff951359e25c658a1c3f146f1e ]
-
-Before waiting for a request's safe reply, we will send the mdlog flush
-request to the relevant MDS. And this will also flush the mdlog for all
-the other unsafe requests in the same session, so we can record the last
-session and no need to flush mdlog again in the next loop. But there
-still have cases that it may send the mdlog flush requst twice or more,
-but that should be not often.
-
-Rename wait_unsafe_requests() to
-flush_mdlog_and_wait_mdsc_unsafe_requests() to make it more
-descriptive.
-
-[xiubli: fold in MDS request refcount leak fix from Jeff]
-
-URL: https://tracker.ceph.com/issues/55284
-URL: https://tracker.ceph.com/issues/55411
-Signed-off-by: Xiubo Li <xiubli@redhat.com>
-Reviewed-by: Jeff Layton <jlayton@kernel.org>
-Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/ceph/mds_client.c | 33 +++++++++++++++++++++++++++------
- 1 file changed, 27 insertions(+), 6 deletions(-)
-
-diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
-index e9409c460acd..912903de4de4 100644
---- a/fs/ceph/mds_client.c
-+++ b/fs/ceph/mds_client.c
-@@ -4794,15 +4794,17 @@ void ceph_mdsc_pre_umount(struct ceph_mds_client *mdsc)
- }
-
- /*
-- * wait for all write mds requests to flush.
-+ * flush the mdlog and wait for all write mds requests to flush.
- */
--static void wait_unsafe_requests(struct ceph_mds_client *mdsc, u64 want_tid)
-+static void flush_mdlog_and_wait_mdsc_unsafe_requests(struct ceph_mds_client *mdsc,
-+ u64 want_tid)
- {
- struct ceph_mds_request *req = NULL, *nextreq;
-+ struct ceph_mds_session *last_session = NULL;
- struct rb_node *n;
-
- mutex_lock(&mdsc->mutex);
-- dout("wait_unsafe_requests want %lld\n", want_tid);
-+ dout("%s want %lld\n", __func__, want_tid);
- restart:
- req = __get_oldest_req(mdsc);
- while (req && req->r_tid <= want_tid) {
-@@ -4814,14 +4816,32 @@ static void wait_unsafe_requests(struct ceph_mds_client *mdsc, u64 want_tid)
- nextreq = NULL;
- if (req->r_op != CEPH_MDS_OP_SETFILELOCK &&
- (req->r_op & CEPH_MDS_OP_WRITE)) {
-+ struct ceph_mds_session *s = req->r_session;
-+
-+ if (!s) {
-+ req = nextreq;
-+ continue;
-+ }
-+
- /* write op */
- ceph_mdsc_get_request(req);
- if (nextreq)
- ceph_mdsc_get_request(nextreq);
-+ s = ceph_get_mds_session(s);
- mutex_unlock(&mdsc->mutex);
-- dout("wait_unsafe_requests wait on %llu (want %llu)\n",
-+
-+ /* send flush mdlog request to MDS */
-+ if (last_session != s) {
-+ send_flush_mdlog(s);
-+ ceph_put_mds_session(last_session);
-+ last_session = s;
-+ } else {
-+ ceph_put_mds_session(s);
-+ }
-+ dout("%s wait on %llu (want %llu)\n", __func__,
- req->r_tid, want_tid);
- wait_for_completion(&req->r_safe_completion);
-+
- mutex_lock(&mdsc->mutex);
- ceph_mdsc_put_request(req);
- if (!nextreq)
-@@ -4836,7 +4856,8 @@ static void wait_unsafe_requests(struct ceph_mds_client *mdsc, u64 want_tid)
- req = nextreq;
- }
- mutex_unlock(&mdsc->mutex);
-- dout("wait_unsafe_requests done\n");
-+ ceph_put_mds_session(last_session);
-+ dout("%s done\n", __func__);
- }
-
- void ceph_mdsc_sync(struct ceph_mds_client *mdsc)
-@@ -4865,7 +4886,7 @@ void ceph_mdsc_sync(struct ceph_mds_client *mdsc)
- dout("sync want tid %lld flush_seq %lld\n",
- want_tid, want_flush);
-
-- wait_unsafe_requests(mdsc, want_tid);
-+ flush_mdlog_and_wait_mdsc_unsafe_requests(mdsc, want_tid);
- wait_caps_flush(mdsc, want_flush);
- }
-
---
-2.35.1
-
+++ /dev/null
-From 30f2e463bf379bbbd9c42f1165959f4c74727aac Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 6 Apr 2022 15:57:03 +0800
-Subject: char: xillybus: fix a refcount leak in cleanup_dev()
-
-From: Hangyu Hua <hbh25y@gmail.com>
-
-[ Upstream commit b67d19662fdee275c479d21853bc1239600a798f ]
-
-usb_get_dev is called in xillyusb_probe. So it is better to call
-usb_put_dev before xdev is released.
-
-Acked-by: Eli Billauer <eli.billauer@gmail.com>
-Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
-Link: https://lore.kernel.org/r/20220406075703.23464-1-hbh25y@gmail.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/char/xillybus/xillyusb.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/drivers/char/xillybus/xillyusb.c b/drivers/char/xillybus/xillyusb.c
-index dc3551796e5e..39bcbfd908b4 100644
---- a/drivers/char/xillybus/xillyusb.c
-+++ b/drivers/char/xillybus/xillyusb.c
-@@ -549,6 +549,7 @@ static void cleanup_dev(struct kref *kref)
- if (xdev->workq)
- destroy_workqueue(xdev->workq);
-
-+ usb_put_dev(xdev->udev);
- kfree(xdev->channels); /* Argument may be NULL, and that's fine */
- kfree(xdev);
- }
---
-2.35.1
-
+++ /dev/null
-From c3f79fe2d353838bc614e64c08080058c004d72d Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 1 Jun 2022 22:08:46 -0500
-Subject: cifs: version operations for smb20 unneeded when legacy support
- disabled
-
-From: Steve French <stfrench@microsoft.com>
-
-[ Upstream commit 7ef93ffccd55fb0ba000ed16ef6a81cd7dee07b5 ]
-
-We should not be including unused smb20 specific code when legacy
-support is disabled (CONFIG_CIFS_ALLOW_INSECURE_LEGACY turned
-off). For example smb2_operations and smb2_values aren't used
-in that case. Over time we can move more and more SMB1/CIFS and SMB2.0
-code into the insecure legacy ifdefs
-
-Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com>
-Signed-off-by: Steve French <stfrench@microsoft.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/cifs/cifsglob.h | 4 +++-
- fs/cifs/smb2ops.c | 7 ++++++-
- 2 files changed, 9 insertions(+), 2 deletions(-)
-
-diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
-index b33835b2943e..a97ed30843cf 100644
---- a/fs/cifs/cifsglob.h
-+++ b/fs/cifs/cifsglob.h
-@@ -1890,11 +1890,13 @@ extern mempool_t *cifs_mid_poolp;
-
- /* Operations for different SMB versions */
- #define SMB1_VERSION_STRING "1.0"
-+#define SMB20_VERSION_STRING "2.0"
-+#ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
- extern struct smb_version_operations smb1_operations;
- extern struct smb_version_values smb1_values;
--#define SMB20_VERSION_STRING "2.0"
- extern struct smb_version_operations smb20_operations;
- extern struct smb_version_values smb20_values;
-+#endif /* CIFS_ALLOW_INSECURE_LEGACY */
- #define SMB21_VERSION_STRING "2.1"
- extern struct smb_version_operations smb21_operations;
- extern struct smb_version_values smb21_values;
-diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
-index 775296e4d3c8..735aafee63be 100644
---- a/fs/cifs/smb2ops.c
-+++ b/fs/cifs/smb2ops.c
-@@ -4271,11 +4271,13 @@ smb3_set_oplock_level(struct cifsInodeInfo *cinode, __u32 oplock,
- }
- }
-
-+#ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
- static bool
- smb2_is_read_op(__u32 oplock)
- {
- return oplock == SMB2_OPLOCK_LEVEL_II;
- }
-+#endif /* CIFS_ALLOW_INSECURE_LEGACY */
-
- static bool
- smb21_is_read_op(__u32 oplock)
-@@ -5371,7 +5373,7 @@ smb2_make_node(unsigned int xid, struct inode *inode,
- return rc;
- }
-
--
-+#ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
- struct smb_version_operations smb20_operations = {
- .compare_fids = smb2_compare_fids,
- .setup_request = smb2_setup_request,
-@@ -5470,6 +5472,7 @@ struct smb_version_operations smb20_operations = {
- .is_status_io_timeout = smb2_is_status_io_timeout,
- .is_network_name_deleted = smb2_is_network_name_deleted,
- };
-+#endif /* CIFS_ALLOW_INSECURE_LEGACY */
-
- struct smb_version_operations smb21_operations = {
- .compare_fids = smb2_compare_fids,
-@@ -5801,6 +5804,7 @@ struct smb_version_operations smb311_operations = {
- .is_network_name_deleted = smb2_is_network_name_deleted,
- };
-
-+#ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
- struct smb_version_values smb20_values = {
- .version_string = SMB20_VERSION_STRING,
- .protocol_id = SMB20_PROT_ID,
-@@ -5821,6 +5825,7 @@ struct smb_version_values smb20_values = {
- .signing_required = SMB2_NEGOTIATE_SIGNING_REQUIRED,
- .create_lease_size = sizeof(struct create_lease),
- };
-+#endif /* ALLOW_INSECURE_LEGACY */
-
- struct smb_version_values smb21_values = {
- .version_string = SMB21_VERSION_STRING,
---
-2.35.1
-
+++ /dev/null
-From 9b7df475afb64e0a1de4d23cba3b3e1a2d6b958c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 6 May 2022 17:25:22 +0100
-Subject: clocksource/drivers/sp804: Avoid error on multiple instances
-
-From: Andre Przywara <andre.przywara@arm.com>
-
-[ Upstream commit a98399cbc1e05f7b977419f03905501d566cf54e ]
-
-When a machine sports more than one SP804 timer instance, we only bring
-up the first one, since multiple timers of the same kind are not useful
-to Linux. As this is intentional behaviour, we should not return an
-error message, as we do today:
-===============
-[ 0.000800] Failed to initialize '/bus@8000000/motherboard-bus@8000000/iofpga-bus@300000000/timer@120000': -22
-===============
-
-Replace the -EINVAL return with a debug message and return 0 instead.
-
-Also we do not reach the init function anymore if the DT node is
-disabled (as this is now handled by OF_DECLARE), so remove the explicit
-check for that case.
-
-This fixes a long standing bogus error when booting ARM's fastmodels.
-
-Signed-off-by: Andre Przywara <andre.przywara@arm.com>
-Reviewed-by: Robin Murphy <robin.murphy@arm.com>
-Link: https://lore.kernel.org/r/20220506162522.3675399-1-andre.przywara@arm.com
-Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/clocksource/timer-sp804.c | 10 +++++-----
- 1 file changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/drivers/clocksource/timer-sp804.c b/drivers/clocksource/timer-sp804.c
-index 401d592e85f5..e6a87f4af2b5 100644
---- a/drivers/clocksource/timer-sp804.c
-+++ b/drivers/clocksource/timer-sp804.c
-@@ -259,6 +259,11 @@ static int __init sp804_of_init(struct device_node *np, struct sp804_timer *time
- struct clk *clk1, *clk2;
- const char *name = of_get_property(np, "compatible", NULL);
-
-+ if (initialized) {
-+ pr_debug("%pOF: skipping further SP804 timer device\n", np);
-+ return 0;
-+ }
-+
- base = of_iomap(np, 0);
- if (!base)
- return -ENXIO;
-@@ -270,11 +275,6 @@ static int __init sp804_of_init(struct device_node *np, struct sp804_timer *time
- writel(0, timer1_base + timer->ctrl);
- writel(0, timer2_base + timer->ctrl);
-
-- if (initialized || !of_device_is_available(np)) {
-- ret = -EINVAL;
-- goto err;
-- }
--
- clk1 = of_clk_get(np, 0);
- if (IS_ERR(clk1))
- clk1 = NULL;
---
-2.35.1
-
+++ /dev/null
-From 2dc05caf988435926a1f36de2f39d1a306821041 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 9 Apr 2022 14:49:53 +0800
-Subject: drivers: staging: rtl8192bs: Fix deadlock in
- rtw_joinbss_event_prehandle()
-
-From: Duoming Zhou <duoming@zju.edu.cn>
-
-[ Upstream commit 041879b12ddb0c6c83ed9c0bdd10dc82a056f2fc ]
-
-There is a deadlock in rtw_joinbss_event_prehandle(), which is shown
-below:
-
- (Thread 1) | (Thread 2)
- | _set_timer()
-rtw_joinbss_event_prehandle()| mod_timer()
- spin_lock_bh() //(1) | (wait a time)
- ... | _rtw_join_timeout_handler()
- del_timer_sync() | spin_lock_bh() //(2)
- (wait timer to stop) | ...
-
-We hold pmlmepriv->lock in position (1) of thread 1 and
-use del_timer_sync() to wait timer to stop, but timer handler
-also need pmlmepriv->lock in position (2) of thread 2.
-As a result, rtw_joinbss_event_prehandle() will block forever.
-
-This patch extracts del_timer_sync() from the protection of
-spin_lock_bh(), which could let timer handler to obtain
-the needed lock. What`s more, we change spin_lock_bh() to
-spin_lock_irq() in _rtw_join_timeout_handler() in order to
-prevent deadlock.
-
-Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
-Link: https://lore.kernel.org/r/20220409064953.67420-1-duoming@zju.edu.cn
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/staging/rtl8723bs/core/rtw_mlme.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/staging/rtl8723bs/core/rtw_mlme.c b/drivers/staging/rtl8723bs/core/rtw_mlme.c
-index 2c20bf26b10e..952c3e14d1b3 100644
---- a/drivers/staging/rtl8723bs/core/rtw_mlme.c
-+++ b/drivers/staging/rtl8723bs/core/rtw_mlme.c
-@@ -1238,8 +1238,10 @@ void rtw_joinbss_event_prehandle(struct adapter *adapter, u8 *pbuf)
-
- spin_unlock_bh(&pmlmepriv->scanned_queue.lock);
-
-+ spin_unlock_bh(&pmlmepriv->lock);
- /* s5. Cancel assoc_timer */
- del_timer_sync(&pmlmepriv->assoc_timer);
-+ spin_lock_bh(&pmlmepriv->lock);
- } else {
- spin_unlock_bh(&(pmlmepriv->scanned_queue.lock));
- }
-@@ -1545,7 +1547,7 @@ void _rtw_join_timeout_handler(struct timer_list *t)
- if (adapter->bDriverStopped || adapter->bSurpriseRemoved)
- return;
-
-- spin_lock_bh(&pmlmepriv->lock);
-+ spin_lock_irq(&pmlmepriv->lock);
-
- if (rtw_to_roam(adapter) > 0) { /* join timeout caused by roaming */
- while (1) {
-@@ -1573,7 +1575,7 @@ void _rtw_join_timeout_handler(struct timer_list *t)
-
- }
-
-- spin_unlock_bh(&pmlmepriv->lock);
-+ spin_unlock_irq(&pmlmepriv->lock);
- }
-
- /*
---
-2.35.1
-
+++ /dev/null
-From dff353e86616a4f298229d9fe4d6e9464ca48772 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 17 Apr 2022 22:16:41 +0800
-Subject: drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop()
-
-From: Duoming Zhou <duoming@zju.edu.cn>
-
-[ Upstream commit 9b6bdbd9337de3917945847bde262a34a87a6303 ]
-
-There is a deadlock in rtllib_beacons_stop(), which is shown
-below:
-
- (Thread 1) | (Thread 2)
- | rtllib_send_beacon()
-rtllib_beacons_stop() | mod_timer()
- spin_lock_irqsave() //(1) | (wait a time)
- ... | rtllib_send_beacon_cb()
- del_timer_sync() | spin_lock_irqsave() //(2)
- (wait timer to stop) | ...
-
-We hold ieee->beacon_lock in position (1) of thread 1 and
-use del_timer_sync() to wait timer to stop, but timer handler
-also need ieee->beacon_lock in position (2) of thread 2.
-As a result, rtllib_beacons_stop() will block forever.
-
-This patch extracts del_timer_sync() from the protection of
-spin_lock_irqsave(), which could let timer handler to obtain
-the needed lock.
-
-Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
-Link: https://lore.kernel.org/r/20220417141641.124388-1-duoming@zju.edu.cn
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/staging/rtl8192e/rtllib_softmac.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/staging/rtl8192e/rtllib_softmac.c b/drivers/staging/rtl8192e/rtllib_softmac.c
-index 503d33be71d9..ea8bc27fce49 100644
---- a/drivers/staging/rtl8192e/rtllib_softmac.c
-+++ b/drivers/staging/rtl8192e/rtllib_softmac.c
-@@ -651,9 +651,9 @@ static void rtllib_beacons_stop(struct rtllib_device *ieee)
- spin_lock_irqsave(&ieee->beacon_lock, flags);
-
- ieee->beacon_txing = 0;
-- del_timer_sync(&ieee->beacon_timer);
-
- spin_unlock_irqrestore(&ieee->beacon_lock, flags);
-+ del_timer_sync(&ieee->beacon_timer);
-
- }
-
---
-2.35.1
-
+++ /dev/null
-From add0550339251e4ce1fcb9e64345009d4a311745 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 17 Apr 2022 21:54:07 +0800
-Subject: drivers: staging: rtl8192u: Fix deadlock in ieee80211_beacons_stop()
-
-From: Duoming Zhou <duoming@zju.edu.cn>
-
-[ Upstream commit 806c7b53414934ba2a39449b31fd1a038e500273 ]
-
-There is a deadlock in ieee80211_beacons_stop(), which is shown below:
-
- (Thread 1) | (Thread 2)
- | ieee80211_send_beacon()
-ieee80211_beacons_stop() | mod_timer()
- spin_lock_irqsave() //(1) | (wait a time)
- ... | ieee80211_send_beacon_cb()
- del_timer_sync() | spin_lock_irqsave() //(2)
- (wait timer to stop) | ...
-
-We hold ieee->beacon_lock in position (1) of thread 1 and use
-del_timer_sync() to wait timer to stop, but timer handler
-also need ieee->beacon_lock in position (2) of thread 2.
-As a result, ieee80211_beacons_stop() will block forever.
-
-This patch extracts del_timer_sync() from the protection of
-spin_lock_irqsave(), which could let timer handler to obtain
-the needed lock.
-
-Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
-Link: https://lore.kernel.org/r/20220417135407.109536-1-duoming@zju.edu.cn
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c b/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c
-index 1a193f900779..2b06706a7071 100644
---- a/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c
-+++ b/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c
-@@ -528,9 +528,9 @@ static void ieee80211_beacons_stop(struct ieee80211_device *ieee)
- spin_lock_irqsave(&ieee->beacon_lock, flags);
-
- ieee->beacon_txing = 0;
-- del_timer_sync(&ieee->beacon_timer);
-
- spin_unlock_irqrestore(&ieee->beacon_lock, flags);
-+ del_timer_sync(&ieee->beacon_timer);
- }
-
- void ieee80211_stop_send_beacons(struct ieee80211_device *ieee)
---
-2.35.1
-
+++ /dev/null
-From 68db01f6f1b2212fc8b38d6cc72c0dce5bdcf622 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 9 Apr 2022 14:18:35 +0800
-Subject: drivers: staging: rtl8723bs: Fix deadlock in
- rtw_surveydone_event_callback()
-
-From: Duoming Zhou <duoming@zju.edu.cn>
-
-[ Upstream commit cc7ad0d77b51c872d629bcd98aea463a3c4109e7 ]
-
-There is a deadlock in rtw_surveydone_event_callback(),
-which is shown below:
-
- (Thread 1) | (Thread 2)
- | _set_timer()
-rtw_surveydone_event_callback()| mod_timer()
- spin_lock_bh() //(1) | (wait a time)
- ... | rtw_scan_timeout_handler()
- del_timer_sync() | spin_lock_bh() //(2)
- (wait timer to stop) | ...
-
-We hold pmlmepriv->lock in position (1) of thread 1 and use
-del_timer_sync() to wait timer to stop, but timer handler
-also need pmlmepriv->lock in position (2) of thread 2.
-As a result, rtw_surveydone_event_callback() will block forever.
-
-This patch extracts del_timer_sync() from the protection of
-spin_lock_bh(), which could let timer handler to obtain
-the needed lock. What`s more, we change spin_lock_bh() in
-rtw_scan_timeout_handler() to spin_lock_irq(). Otherwise,
-spin_lock_bh() will also cause deadlock() in timer handler.
-
-Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
-Link: https://lore.kernel.org/r/20220409061836.60529-1-duoming@zju.edu.cn
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/staging/rtl8723bs/core/rtw_mlme.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/staging/rtl8723bs/core/rtw_mlme.c b/drivers/staging/rtl8723bs/core/rtw_mlme.c
-index cf79bec916c5..2c20bf26b10e 100644
---- a/drivers/staging/rtl8723bs/core/rtw_mlme.c
-+++ b/drivers/staging/rtl8723bs/core/rtw_mlme.c
-@@ -749,7 +749,9 @@ void rtw_surveydone_event_callback(struct adapter *adapter, u8 *pbuf)
- }
-
- if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY)) {
-+ spin_unlock_bh(&pmlmepriv->lock);
- del_timer_sync(&pmlmepriv->scan_to_timer);
-+ spin_lock_bh(&pmlmepriv->lock);
- _clr_fwstate_(pmlmepriv, _FW_UNDER_SURVEY);
- }
-
-@@ -1584,11 +1586,11 @@ void rtw_scan_timeout_handler(struct timer_list *t)
- mlmepriv.scan_to_timer);
- struct mlme_priv *pmlmepriv = &adapter->mlmepriv;
-
-- spin_lock_bh(&pmlmepriv->lock);
-+ spin_lock_irq(&pmlmepriv->lock);
-
- _clr_fwstate_(pmlmepriv, _FW_UNDER_SURVEY);
-
-- spin_unlock_bh(&pmlmepriv->lock);
-+ spin_unlock_irq(&pmlmepriv->lock);
-
- rtw_indicate_scan_done(adapter, true);
- }
---
-2.35.1
-
+++ /dev/null
-From 2b3a49afc6a2ce5e01bdf6e9277819bb7be77b08 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 17 Apr 2022 19:16:26 +0800
-Subject: drivers: tty: serial: Fix deadlock in sa1100_set_termios()
-
-From: Duoming Zhou <duoming@zju.edu.cn>
-
-[ Upstream commit 62b2caef400c1738b6d22f636c628d9f85cd4c4c ]
-
-There is a deadlock in sa1100_set_termios(), which is shown
-below:
-
- (Thread 1) | (Thread 2)
- | sa1100_enable_ms()
-sa1100_set_termios() | mod_timer()
- spin_lock_irqsave() //(1) | (wait a time)
- ... | sa1100_timeout()
- del_timer_sync() | spin_lock_irqsave() //(2)
- (wait timer to stop) | ...
-
-We hold sport->port.lock in position (1) of thread 1 and
-use del_timer_sync() to wait timer to stop, but timer handler
-also need sport->port.lock in position (2) of thread 2. As a result,
-sa1100_set_termios() will block forever.
-
-This patch moves del_timer_sync() before spin_lock_irqsave()
-in order to prevent the deadlock.
-
-Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
-Link: https://lore.kernel.org/r/20220417111626.7802-1-duoming@zju.edu.cn
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/tty/serial/sa1100.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/tty/serial/sa1100.c b/drivers/tty/serial/sa1100.c
-index 697b6a002a16..4ddcc985621a 100644
---- a/drivers/tty/serial/sa1100.c
-+++ b/drivers/tty/serial/sa1100.c
-@@ -446,6 +446,8 @@ sa1100_set_termios(struct uart_port *port, struct ktermios *termios,
- baud = uart_get_baud_rate(port, termios, old, 0, port->uartclk/16);
- quot = uart_get_divisor(port, baud);
-
-+ del_timer_sync(&sport->timer);
-+
- spin_lock_irqsave(&sport->port.lock, flags);
-
- sport->port.read_status_mask &= UTSR0_TO_SM(UTSR0_TFS);
-@@ -476,8 +478,6 @@ sa1100_set_termios(struct uart_port *port, struct ktermios *termios,
- UTSR1_TO_SM(UTSR1_ROR);
- }
-
-- del_timer_sync(&sport->timer);
--
- /*
- * Update the per-port timeout.
- */
---
-2.35.1
-
+++ /dev/null
-From 9f8c795aec1e0fa5ea72dc552e25b3afe5114623 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 17 Apr 2022 20:03:05 +0800
-Subject: drivers: usb: host: Fix deadlock in oxu_bus_suspend()
-
-From: Duoming Zhou <duoming@zju.edu.cn>
-
-[ Upstream commit 4d378f2ae58138d4c55684e1d274e7dd94aa6524 ]
-
-There is a deadlock in oxu_bus_suspend(), which is shown below:
-
- (Thread 1) | (Thread 2)
- | timer_action()
-oxu_bus_suspend() | mod_timer()
- spin_lock_irq() //(1) | (wait a time)
- ... | oxu_watchdog()
- del_timer_sync() | spin_lock_irq() //(2)
- (wait timer to stop) | ...
-
-We hold oxu->lock in position (1) of thread 1, and use
-del_timer_sync() to wait timer to stop, but timer handler
-also need oxu->lock in position (2) of thread 2. As a result,
-oxu_bus_suspend() will block forever.
-
-This patch extracts del_timer_sync() from the protection of
-spin_lock_irq(), which could let timer handler to obtain
-the needed lock.
-
-Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
-Link: https://lore.kernel.org/r/20220417120305.64577-1-duoming@zju.edu.cn
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/host/oxu210hp-hcd.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/drivers/usb/host/oxu210hp-hcd.c b/drivers/usb/host/oxu210hp-hcd.c
-index 4300326b3730..6be6c5878d08 100644
---- a/drivers/usb/host/oxu210hp-hcd.c
-+++ b/drivers/usb/host/oxu210hp-hcd.c
-@@ -3909,8 +3909,10 @@ static int oxu_bus_suspend(struct usb_hcd *hcd)
- }
- }
-
-+ spin_unlock_irq(&oxu->lock);
- /* turn off now-idle HC */
- del_timer_sync(&oxu->watchdog);
-+ spin_lock_irq(&oxu->lock);
- ehci_halt(oxu);
- hcd->state = HC_STATE_SUSPENDED;
-
---
-2.35.1
-
+++ /dev/null
-From 738049e668a37cf47ca9f1d1146cfdc791dcf94b Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 3 May 2022 18:30:25 -0400
-Subject: drm/amd/display: Check if modulo is 0 before dividing.
-
-From: David Galiffi <David.Galiffi@amd.com>
-
-[ Upstream commit 49947b906a6bd9668eaf4f9cf691973c25c26955 ]
-
-[How & Why]
-If a value of 0 is read, then this will cause a divide-by-0 panic.
-
-Reviewed-by: Martin Leung <Martin.Leung@amd.com>
-Acked-by: Qingqing Zhuo <qingqing.zhuo@amd.com>
-Signed-off-by: David Galiffi <David.Galiffi@amd.com>
-Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
-Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c | 9 ++++++---
- 1 file changed, 6 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c b/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c
-index 2c7eb982eabc..054823d12403 100644
---- a/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c
-+++ b/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c
-@@ -1013,9 +1013,12 @@ static bool get_pixel_clk_frequency_100hz(
- * not be programmed equal to DPREFCLK
- */
- modulo_hz = REG_READ(MODULO[inst]);
-- *pixel_clk_khz = div_u64((uint64_t)clock_hz*
-- clock_source->ctx->dc->clk_mgr->dprefclk_khz*10,
-- modulo_hz);
-+ if (modulo_hz)
-+ *pixel_clk_khz = div_u64((uint64_t)clock_hz*
-+ clock_source->ctx->dc->clk_mgr->dprefclk_khz*10,
-+ modulo_hz);
-+ else
-+ *pixel_clk_khz = 0;
- } else {
- /* NOTE: There is agreement with VBIOS here that MODULO is
- * programmed equal to DPREFCLK, in which case PHASE will be
---
-2.35.1
-
+++ /dev/null
-From e563d4d67fa655e06a6bf35e457d3d4b02fc5e06 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 19 May 2022 10:50:25 +0530
-Subject: drm/amd/pm: Fix missing thermal throttler status
-
-From: Lijo Lazar <lijo.lazar@amd.com>
-
-[ Upstream commit b0f4d663fce6a4232d3c20ce820f919111b1c60b ]
-
-On aldebaran, when thermal throttling happens due to excessive GPU
-temperature, the reason for throttling event is missed in warning
-message. This patch fixes it.
-
-Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
-Reviewed-by: Yang Wang <kevinyang.wang@amd.com>
-Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c
-index c9cfeb094750..d0c6b864d00a 100644
---- a/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c
-+++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c
-@@ -1627,6 +1627,7 @@ static const struct throttling_logging_label {
- uint32_t feature_mask;
- const char *label;
- } logging_label[] = {
-+ {(1U << THROTTLER_TEMP_GPU_BIT), "GPU"},
- {(1U << THROTTLER_TEMP_MEM_BIT), "HBM"},
- {(1U << THROTTLER_TEMP_VR_GFX_BIT), "VR of GFX rail"},
- {(1U << THROTTLER_TEMP_VR_MEM_BIT), "VR of HBM rail"},
---
-2.35.1
-
+++ /dev/null
-From ebdf2a4546e7f105c460eb0753381ce09128a085 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 28 Apr 2022 13:51:16 -0700
-Subject: drm/amd/pm: use bitmap_{from,to}_arr32 where appropriate
-
-From: Yury Norov <yury.norov@gmail.com>
-
-[ Upstream commit 525d6515604eb1373ce5e6372a6b6640953b2d6a ]
-
-The smu_v1X_0_set_allowed_mask() uses bitmap_copy() to convert
-bitmap to 32-bit array. This may be wrong due to endiannes issues.
-Fix it by switching to bitmap_{from,to}_arr32.
-
-CC: Alexander Gordeev <agordeev@linux.ibm.com>
-CC: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
-CC: Christian Borntraeger <borntraeger@linux.ibm.com>
-CC: Claudio Imbrenda <imbrenda@linux.ibm.com>
-CC: David Hildenbrand <david@redhat.com>
-CC: Heiko Carstens <hca@linux.ibm.com>
-CC: Janosch Frank <frankja@linux.ibm.com>
-CC: Rasmus Villemoes <linux@rasmusvillemoes.dk>
-CC: Sven Schnelle <svens@linux.ibm.com>
-CC: Vasily Gorbik <gor@linux.ibm.com>
-Signed-off-by: Yury Norov <yury.norov@gmail.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c | 2 +-
- drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c
-index 87b055466a33..e6c93396434f 100644
---- a/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c
-+++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c
-@@ -772,7 +772,7 @@ int smu_v11_0_set_allowed_mask(struct smu_context *smu)
- goto failed;
- }
-
-- bitmap_copy((unsigned long *)feature_mask, feature->allowed, 64);
-+ bitmap_to_arr32(feature_mask, feature->allowed, 64);
-
- ret = smu_cmn_send_smc_msg_with_param(smu, SMU_MSG_SetAllowedFeaturesMaskHigh,
- feature_mask[1], NULL);
-diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
-index 8d4aa16b2ae7..6211570fb64f 100644
---- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
-+++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
-@@ -721,7 +721,7 @@ int smu_v13_0_set_allowed_mask(struct smu_context *smu)
- if (bitmap_empty(feature->allowed, SMU_FEATURE_MAX) || feature->feature_num < 64)
- goto failed;
-
-- bitmap_copy((unsigned long *)feature_mask, feature->allowed, 64);
-+ bitmap_to_arr32(feature_mask, feature->allowed, 64);
-
- ret = smu_cmn_send_smc_msg_with_param(smu, SMU_MSG_SetAllowedFeaturesMaskHigh,
- feature_mask[1], NULL);
---
-2.35.1
-
+++ /dev/null
-From a1085e6189161a9d468d2e13db449b497be27507 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 17 May 2022 17:57:00 +0800
-Subject: drm/radeon: fix a possible null pointer dereference
-
-From: Gong Yuanjun <ruc_gongyuanjun@163.com>
-
-[ Upstream commit a2b28708b645c5632dc93669ab06e97874c8244f ]
-
-In radeon_fp_native_mode(), the return value of drm_mode_duplicate()
-is assigned to mode, which will lead to a NULL pointer dereference
-on failure of drm_mode_duplicate(). Add a check to avoid npd.
-
-The failure status of drm_cvt_mode() on the other path is checked too.
-
-Signed-off-by: Gong Yuanjun <ruc_gongyuanjun@163.com>
-Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/radeon/radeon_connectors.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
-index 1546abcadacf..d157bb9072e8 100644
---- a/drivers/gpu/drm/radeon/radeon_connectors.c
-+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
-@@ -473,6 +473,8 @@ static struct drm_display_mode *radeon_fp_native_mode(struct drm_encoder *encode
- native_mode->vdisplay != 0 &&
- native_mode->clock != 0) {
- mode = drm_mode_duplicate(dev, native_mode);
-+ if (!mode)
-+ return NULL;
- mode->type = DRM_MODE_TYPE_PREFERRED | DRM_MODE_TYPE_DRIVER;
- drm_mode_set_name(mode);
-
-@@ -487,6 +489,8 @@ static struct drm_display_mode *radeon_fp_native_mode(struct drm_encoder *encode
- * simpler.
- */
- mode = drm_cvt_mode(dev, native_mode->hdisplay, native_mode->vdisplay, 60, true, false, false);
-+ if (!mode)
-+ return NULL;
- mode->type = DRM_MODE_TYPE_PREFERRED | DRM_MODE_TYPE_DRIVER;
- DRM_DEBUG_KMS("Adding cvt approximation of native panel mode %s\n", mode->name);
- }
---
-2.35.1
-
+++ /dev/null
-From 1809f75dcbdd83eee0426aaf43086d183ce8e26b Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 17 Dec 2021 09:28:46 +0300
-Subject: extcon: Fix extcon_get_extcon_dev() error handling
-
-From: Dan Carpenter <dan.carpenter@oracle.com>
-
-[ Upstream commit 58e4a2d27d3255e4e8c507fdc13734dccc9fc4c7 ]
-
-The extcon_get_extcon_dev() function returns error pointers on error,
-NULL when it's a -EPROBE_DEFER defer situation, and ERR_PTR(-ENODEV)
-when the CONFIG_EXTCON option is disabled. This is very complicated for
-the callers to handle and a number of them had bugs that would lead to
-an Oops.
-
-In real life, there are two things which prevented crashes. First,
-error pointers would only be returned if there was bug in the caller
-where they passed a NULL "extcon_name" and none of them do that.
-Second, only two out of the eight drivers will build when CONFIG_EXTCON
-is disabled.
-
-The normal way to write this would be to return -EPROBE_DEFER directly
-when appropriate and return NULL when CONFIG_EXTCON is disabled. Then
-the error handling is simple and just looks like:
-
- dev->edev = extcon_get_extcon_dev(acpi_dev_name(adev));
- if (IS_ERR(dev->edev))
- return PTR_ERR(dev->edev);
-
-For the two drivers which can build with CONFIG_EXTCON disabled, then
-extcon_get_extcon_dev() will now return NULL which is not treated as an
-error and the probe will continue successfully. Those two drivers are
-"typec_fusb302" and "max8997-battery". In the original code, the
-typec_fusb302 driver had an 800ms hang in tcpm_get_current_limit() but
-now that function is a no-op. For the max8997-battery driver everything
-should continue working as is.
-
-Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
-Reviewed-by: Hans de Goede <hdegoede@redhat.com>
-Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
-Reviewed-by: Guenter Roeck <linux@roeck-us.net>
-Acked-by: Sebastian Reichel <sebastian.reichel@collabora.com>
-Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/extcon/extcon-axp288.c | 4 ++--
- drivers/extcon/extcon.c | 4 +++-
- drivers/power/supply/axp288_charger.c | 17 ++++++++++-------
- drivers/power/supply/charger-manager.c | 7 ++-----
- drivers/power/supply/max8997_charger.c | 8 ++++----
- drivers/usb/dwc3/drd.c | 9 ++-------
- drivers/usb/phy/phy-omap-otg.c | 4 ++--
- drivers/usb/typec/tcpm/fusb302.c | 4 ++--
- include/linux/extcon.h | 2 +-
- 9 files changed, 28 insertions(+), 31 deletions(-)
-
-diff --git a/drivers/extcon/extcon-axp288.c b/drivers/extcon/extcon-axp288.c
-index fdb31954cf2b..8073bc7d3e61 100644
---- a/drivers/extcon/extcon-axp288.c
-+++ b/drivers/extcon/extcon-axp288.c
-@@ -375,8 +375,8 @@ static int axp288_extcon_probe(struct platform_device *pdev)
- if (adev) {
- info->id_extcon = extcon_get_extcon_dev(acpi_dev_name(adev));
- put_device(&adev->dev);
-- if (!info->id_extcon)
-- return -EPROBE_DEFER;
-+ if (IS_ERR(info->id_extcon))
-+ return PTR_ERR(info->id_extcon);
-
- dev_info(dev, "controlling USB role\n");
- } else {
-diff --git a/drivers/extcon/extcon.c b/drivers/extcon/extcon.c
-index e7a9561a826d..9eb92997f3ae 100644
---- a/drivers/extcon/extcon.c
-+++ b/drivers/extcon/extcon.c
-@@ -863,6 +863,8 @@ EXPORT_SYMBOL_GPL(extcon_set_property_capability);
- * @extcon_name: the extcon name provided with extcon_dev_register()
- *
- * Return the pointer of extcon device if success or ERR_PTR(err) if fail.
-+ * NOTE: This function returns -EPROBE_DEFER so it may only be called from
-+ * probe() functions.
- */
- struct extcon_dev *extcon_get_extcon_dev(const char *extcon_name)
- {
-@@ -876,7 +878,7 @@ struct extcon_dev *extcon_get_extcon_dev(const char *extcon_name)
- if (!strcmp(sd->name, extcon_name))
- goto out;
- }
-- sd = NULL;
-+ sd = ERR_PTR(-EPROBE_DEFER);
- out:
- mutex_unlock(&extcon_dev_list_lock);
- return sd;
-diff --git a/drivers/power/supply/axp288_charger.c b/drivers/power/supply/axp288_charger.c
-index fb9db7f43895..22378dad4d9f 100644
---- a/drivers/power/supply/axp288_charger.c
-+++ b/drivers/power/supply/axp288_charger.c
-@@ -832,17 +832,20 @@ static int axp288_charger_probe(struct platform_device *pdev)
- info->regmap_irqc = axp20x->regmap_irqc;
-
- info->cable.edev = extcon_get_extcon_dev(AXP288_EXTCON_DEV_NAME);
-- if (info->cable.edev == NULL) {
-- dev_dbg(dev, "%s is not ready, probe deferred\n",
-- AXP288_EXTCON_DEV_NAME);
-- return -EPROBE_DEFER;
-+ if (IS_ERR(info->cable.edev)) {
-+ dev_err_probe(dev, PTR_ERR(info->cable.edev),
-+ "extcon_get_extcon_dev(%s) failed\n",
-+ AXP288_EXTCON_DEV_NAME);
-+ return PTR_ERR(info->cable.edev);
- }
-
- if (acpi_dev_present(USB_HOST_EXTCON_HID, NULL, -1)) {
- info->otg.cable = extcon_get_extcon_dev(USB_HOST_EXTCON_NAME);
-- if (info->otg.cable == NULL) {
-- dev_dbg(dev, "EXTCON_USB_HOST is not ready, probe deferred\n");
-- return -EPROBE_DEFER;
-+ if (IS_ERR(info->otg.cable)) {
-+ dev_err_probe(dev, PTR_ERR(info->otg.cable),
-+ "extcon_get_extcon_dev(%s) failed\n",
-+ USB_HOST_EXTCON_NAME);
-+ return PTR_ERR(info->otg.cable);
- }
- dev_info(dev, "Using " USB_HOST_EXTCON_HID " extcon for usb-id\n");
- }
-diff --git a/drivers/power/supply/charger-manager.c b/drivers/power/supply/charger-manager.c
-index d67edb760c94..92db79400a6a 100644
---- a/drivers/power/supply/charger-manager.c
-+++ b/drivers/power/supply/charger-manager.c
-@@ -985,13 +985,10 @@ static int charger_extcon_init(struct charger_manager *cm,
- cable->nb.notifier_call = charger_extcon_notifier;
-
- cable->extcon_dev = extcon_get_extcon_dev(cable->extcon_name);
-- if (IS_ERR_OR_NULL(cable->extcon_dev)) {
-+ if (IS_ERR(cable->extcon_dev)) {
- pr_err("Cannot find extcon_dev for %s (cable: %s)\n",
- cable->extcon_name, cable->name);
-- if (cable->extcon_dev == NULL)
-- return -EPROBE_DEFER;
-- else
-- return PTR_ERR(cable->extcon_dev);
-+ return PTR_ERR(cable->extcon_dev);
- }
-
- for (i = 0; i < ARRAY_SIZE(extcon_mapping); i++) {
-diff --git a/drivers/power/supply/max8997_charger.c b/drivers/power/supply/max8997_charger.c
-index 25207fe2aa68..bfa7a576523d 100644
---- a/drivers/power/supply/max8997_charger.c
-+++ b/drivers/power/supply/max8997_charger.c
-@@ -248,10 +248,10 @@ static int max8997_battery_probe(struct platform_device *pdev)
- dev_info(&pdev->dev, "couldn't get charger regulator\n");
- }
- charger->edev = extcon_get_extcon_dev("max8997-muic");
-- if (IS_ERR_OR_NULL(charger->edev)) {
-- if (!charger->edev)
-- return -EPROBE_DEFER;
-- dev_info(charger->dev, "couldn't get extcon device\n");
-+ if (IS_ERR(charger->edev)) {
-+ dev_err_probe(charger->dev, PTR_ERR(charger->edev),
-+ "couldn't get extcon device: max8997-muic\n");
-+ return PTR_ERR(charger->edev);
- }
-
- if (!IS_ERR(charger->reg) && !IS_ERR_OR_NULL(charger->edev)) {
-diff --git a/drivers/usb/dwc3/drd.c b/drivers/usb/dwc3/drd.c
-index f148b0370f82..81ff21bd405a 100644
---- a/drivers/usb/dwc3/drd.c
-+++ b/drivers/usb/dwc3/drd.c
-@@ -454,13 +454,8 @@ static struct extcon_dev *dwc3_get_extcon(struct dwc3 *dwc)
- * This device property is for kernel internal use only and
- * is expected to be set by the glue code.
- */
-- if (device_property_read_string(dev, "linux,extcon-name", &name) == 0) {
-- edev = extcon_get_extcon_dev(name);
-- if (!edev)
-- return ERR_PTR(-EPROBE_DEFER);
--
-- return edev;
-- }
-+ if (device_property_read_string(dev, "linux,extcon-name", &name) == 0)
-+ return extcon_get_extcon_dev(name);
-
- /*
- * Try to get an extcon device from the USB PHY controller's "port"
-diff --git a/drivers/usb/phy/phy-omap-otg.c b/drivers/usb/phy/phy-omap-otg.c
-index ee0863c6553e..6e6ef8c0bc7e 100644
---- a/drivers/usb/phy/phy-omap-otg.c
-+++ b/drivers/usb/phy/phy-omap-otg.c
-@@ -95,8 +95,8 @@ static int omap_otg_probe(struct platform_device *pdev)
- return -ENODEV;
-
- extcon = extcon_get_extcon_dev(config->extcon);
-- if (!extcon)
-- return -EPROBE_DEFER;
-+ if (IS_ERR(extcon))
-+ return PTR_ERR(extcon);
-
- otg_dev = devm_kzalloc(&pdev->dev, sizeof(*otg_dev), GFP_KERNEL);
- if (!otg_dev)
-diff --git a/drivers/usb/typec/tcpm/fusb302.c b/drivers/usb/typec/tcpm/fusb302.c
-index 72f9001b0792..96c55eaf3f80 100644
---- a/drivers/usb/typec/tcpm/fusb302.c
-+++ b/drivers/usb/typec/tcpm/fusb302.c
-@@ -1708,8 +1708,8 @@ static int fusb302_probe(struct i2c_client *client,
- */
- if (device_property_read_string(dev, "linux,extcon-name", &name) == 0) {
- chip->extcon = extcon_get_extcon_dev(name);
-- if (!chip->extcon)
-- return -EPROBE_DEFER;
-+ if (IS_ERR(chip->extcon))
-+ return PTR_ERR(chip->extcon);
- }
-
- chip->vbus = devm_regulator_get(chip->dev, "vbus");
-diff --git a/include/linux/extcon.h b/include/linux/extcon.h
-index 0c19010da77f..685401d94d39 100644
---- a/include/linux/extcon.h
-+++ b/include/linux/extcon.h
-@@ -296,7 +296,7 @@ static inline void devm_extcon_unregister_notifier_all(struct device *dev,
-
- static inline struct extcon_dev *extcon_get_extcon_dev(const char *extcon_name)
- {
-- return ERR_PTR(-ENODEV);
-+ return NULL;
- }
-
- static inline struct extcon_dev *extcon_find_edev_by_node(struct device_node *node)
---
-2.35.1
-
+++ /dev/null
-From cef0d630f4a0e852cb4c1236889286c8a832902e Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 27 Apr 2022 12:00:05 +0900
-Subject: extcon: Modify extcon device to be created after driver data is set
-
-From: bumwoo lee <bw365.lee@samsung.com>
-
-[ Upstream commit 5dcc2afe716d69f5112ce035cb14f007461ff189 ]
-
-Currently, someone can invoke the sysfs such as state_show()
-intermittently before dev_set_drvdata() is done.
-And it can be a cause of kernel Oops because of edev is Null at that time.
-So modified the driver registration to after setting drviver data.
-
-- Oops's backtrace.
-
-Backtrace:
-[<c067865c>] (state_show) from [<c05222e8>] (dev_attr_show)
-[<c05222c0>] (dev_attr_show) from [<c02c66e0>] (sysfs_kf_seq_show)
-[<c02c6648>] (sysfs_kf_seq_show) from [<c02c496c>] (kernfs_seq_show)
-[<c02c4938>] (kernfs_seq_show) from [<c025e2a0>] (seq_read)
-[<c025e11c>] (seq_read) from [<c02c50a0>] (kernfs_fop_read)
-[<c02c5064>] (kernfs_fop_read) from [<c0231cac>] (__vfs_read)
-[<c0231c5c>] (__vfs_read) from [<c0231ee0>] (vfs_read)
-[<c0231e34>] (vfs_read) from [<c0232464>] (ksys_read)
-[<c02323f0>] (ksys_read) from [<c02324fc>] (sys_read)
-[<c02324e4>] (sys_read) from [<c00091d0>] (__sys_trace_return)
-
-Signed-off-by: bumwoo lee <bw365.lee@samsung.com>
-Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/extcon/extcon.c | 29 +++++++++++++++++------------
- 1 file changed, 17 insertions(+), 12 deletions(-)
-
-diff --git a/drivers/extcon/extcon.c b/drivers/extcon/extcon.c
-index 9eb92997f3ae..f305503ec27e 100644
---- a/drivers/extcon/extcon.c
-+++ b/drivers/extcon/extcon.c
-@@ -1232,19 +1232,14 @@ int extcon_dev_register(struct extcon_dev *edev)
- edev->dev.type = &edev->extcon_dev_type;
- }
-
-- ret = device_register(&edev->dev);
-- if (ret) {
-- put_device(&edev->dev);
-- goto err_dev;
-- }
--
- spin_lock_init(&edev->lock);
-- edev->nh = devm_kcalloc(&edev->dev, edev->max_supported,
-- sizeof(*edev->nh), GFP_KERNEL);
-- if (!edev->nh) {
-- ret = -ENOMEM;
-- device_unregister(&edev->dev);
-- goto err_dev;
-+ if (edev->max_supported) {
-+ edev->nh = kcalloc(edev->max_supported, sizeof(*edev->nh),
-+ GFP_KERNEL);
-+ if (!edev->nh) {
-+ ret = -ENOMEM;
-+ goto err_alloc_nh;
-+ }
- }
-
- for (index = 0; index < edev->max_supported; index++)
-@@ -1255,6 +1250,12 @@ int extcon_dev_register(struct extcon_dev *edev)
- dev_set_drvdata(&edev->dev, edev);
- edev->state = 0;
-
-+ ret = device_register(&edev->dev);
-+ if (ret) {
-+ put_device(&edev->dev);
-+ goto err_dev;
-+ }
-+
- mutex_lock(&extcon_dev_list_lock);
- list_add(&edev->entry, &extcon_dev_list);
- mutex_unlock(&extcon_dev_list_lock);
-@@ -1262,6 +1263,9 @@ int extcon_dev_register(struct extcon_dev *edev)
- return 0;
-
- err_dev:
-+ if (edev->max_supported)
-+ kfree(edev->nh);
-+err_alloc_nh:
- if (edev->max_supported)
- kfree(edev->extcon_dev_type.groups);
- err_alloc_groups:
-@@ -1322,6 +1326,7 @@ void extcon_dev_unregister(struct extcon_dev *edev)
- if (edev->max_supported) {
- kfree(edev->extcon_dev_type.groups);
- kfree(edev->cables);
-+ kfree(edev->nh);
- }
-
- put_device(&edev->dev);
---
-2.35.1
-
+++ /dev/null
-From a5a15f0c1772c73b64196d6fe5053375aa5e43ad Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 5 Mar 2022 11:14:05 +0800
-Subject: iio: dummy: iio_simple_dummy: check the return value of kstrdup()
-
-From: Xiaoke Wang <xkernel.wang@foxmail.com>
-
-[ Upstream commit ba93642188a6fed754bf7447f638bc410e05a929 ]
-
-kstrdup() is also a memory allocation-related function, it returns NULL
-when some memory errors happen. So it is better to check the return
-value of it so to catch the memory error in time. Besides, there should
-have a kfree() to clear up the allocation if we get a failure later in
-this function to prevent memory leak.
-
-Signed-off-by: Xiaoke Wang <xkernel.wang@foxmail.com>
-Link: https://lore.kernel.org/r/tencent_C920CFCC33B9CC1C63141FE1334A39FF8508@qq.com
-Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/iio/dummy/iio_simple_dummy.c | 20 ++++++++++++--------
- 1 file changed, 12 insertions(+), 8 deletions(-)
-
-diff --git a/drivers/iio/dummy/iio_simple_dummy.c b/drivers/iio/dummy/iio_simple_dummy.c
-index c0b7ef900735..c24f609c2ade 100644
---- a/drivers/iio/dummy/iio_simple_dummy.c
-+++ b/drivers/iio/dummy/iio_simple_dummy.c
-@@ -575,10 +575,9 @@ static struct iio_sw_device *iio_dummy_probe(const char *name)
- */
-
- swd = kzalloc(sizeof(*swd), GFP_KERNEL);
-- if (!swd) {
-- ret = -ENOMEM;
-- goto error_kzalloc;
-- }
-+ if (!swd)
-+ return ERR_PTR(-ENOMEM);
-+
- /*
- * Allocate an IIO device.
- *
-@@ -590,7 +589,7 @@ static struct iio_sw_device *iio_dummy_probe(const char *name)
- indio_dev = iio_device_alloc(parent, sizeof(*st));
- if (!indio_dev) {
- ret = -ENOMEM;
-- goto error_ret;
-+ goto error_free_swd;
- }
-
- st = iio_priv(indio_dev);
-@@ -616,6 +615,10 @@ static struct iio_sw_device *iio_dummy_probe(const char *name)
- * indio_dev->name = spi_get_device_id(spi)->name;
- */
- indio_dev->name = kstrdup(name, GFP_KERNEL);
-+ if (!indio_dev->name) {
-+ ret = -ENOMEM;
-+ goto error_free_device;
-+ }
-
- /* Provide description of available channels */
- indio_dev->channels = iio_dummy_channels;
-@@ -632,7 +635,7 @@ static struct iio_sw_device *iio_dummy_probe(const char *name)
-
- ret = iio_simple_dummy_events_register(indio_dev);
- if (ret < 0)
-- goto error_free_device;
-+ goto error_free_name;
-
- ret = iio_simple_dummy_configure_buffer(indio_dev);
- if (ret < 0)
-@@ -649,11 +652,12 @@ static struct iio_sw_device *iio_dummy_probe(const char *name)
- iio_simple_dummy_unconfigure_buffer(indio_dev);
- error_unregister_events:
- iio_simple_dummy_events_unregister(indio_dev);
-+error_free_name:
-+ kfree(indio_dev->name);
- error_free_device:
- iio_device_free(indio_dev);
--error_ret:
-+error_free_swd:
- kfree(swd);
--error_kzalloc:
- return ERR_PTR(ret);
- }
-
---
-2.35.1
-
+++ /dev/null
-From 573fb7fc90676ae96a66c82c6267ed53fefe44c7 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 7 Feb 2022 15:38:33 +0100
-Subject: iio: st_sensors: Add a local lock for protecting odr
-
-From: Miquel Raynal <miquel.raynal@bootlin.com>
-
-[ Upstream commit 474010127e2505fc463236470908e1ff5ddb3578 ]
-
-Right now the (framework) mlock lock is (ab)used for multiple purposes:
-1- protecting concurrent accesses over the odr local cache
-2- avoid changing samplig frequency whilst buffer is running
-
-Let's start by handling situation #1 with a local lock.
-
-Suggested-by: Jonathan Cameron <jic23@kernel.org>
-Cc: Denis Ciocca <denis.ciocca@st.com>
-Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
-Link: https://lore.kernel.org/r/20220207143840.707510-7-miquel.raynal@bootlin.com
-Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- .../iio/common/st_sensors/st_sensors_core.c | 24 ++++++++++++++-----
- include/linux/iio/common/st_sensors.h | 3 +++
- 2 files changed, 21 insertions(+), 6 deletions(-)
-
-diff --git a/drivers/iio/common/st_sensors/st_sensors_core.c b/drivers/iio/common/st_sensors/st_sensors_core.c
-index 0bbb090b108c..aff981551617 100644
---- a/drivers/iio/common/st_sensors/st_sensors_core.c
-+++ b/drivers/iio/common/st_sensors/st_sensors_core.c
-@@ -71,16 +71,18 @@ static int st_sensors_match_odr(struct st_sensor_settings *sensor_settings,
-
- int st_sensors_set_odr(struct iio_dev *indio_dev, unsigned int odr)
- {
-- int err;
-+ int err = 0;
- struct st_sensor_odr_avl odr_out = {0, 0};
- struct st_sensor_data *sdata = iio_priv(indio_dev);
-
-+ mutex_lock(&sdata->odr_lock);
-+
- if (!sdata->sensor_settings->odr.mask)
-- return 0;
-+ goto unlock_mutex;
-
- err = st_sensors_match_odr(sdata->sensor_settings, odr, &odr_out);
- if (err < 0)
-- goto st_sensors_match_odr_error;
-+ goto unlock_mutex;
-
- if ((sdata->sensor_settings->odr.addr ==
- sdata->sensor_settings->pw.addr) &&
-@@ -103,7 +105,9 @@ int st_sensors_set_odr(struct iio_dev *indio_dev, unsigned int odr)
- if (err >= 0)
- sdata->odr = odr_out.hz;
-
--st_sensors_match_odr_error:
-+unlock_mutex:
-+ mutex_unlock(&sdata->odr_lock);
-+
- return err;
- }
- EXPORT_SYMBOL(st_sensors_set_odr);
-@@ -365,6 +369,8 @@ int st_sensors_init_sensor(struct iio_dev *indio_dev,
- struct st_sensors_platform_data *of_pdata;
- int err = 0;
-
-+ mutex_init(&sdata->odr_lock);
-+
- /* If OF/DT pdata exists, it will take precedence of anything else */
- of_pdata = st_sensors_dev_probe(indio_dev->dev.parent, pdata);
- if (IS_ERR(of_pdata))
-@@ -558,18 +564,24 @@ int st_sensors_read_info_raw(struct iio_dev *indio_dev,
- err = -EBUSY;
- goto out;
- } else {
-+ mutex_lock(&sdata->odr_lock);
- err = st_sensors_set_enable(indio_dev, true);
-- if (err < 0)
-+ if (err < 0) {
-+ mutex_unlock(&sdata->odr_lock);
- goto out;
-+ }
-
- msleep((sdata->sensor_settings->bootime * 1000) / sdata->odr);
- err = st_sensors_read_axis_data(indio_dev, ch, val);
-- if (err < 0)
-+ if (err < 0) {
-+ mutex_unlock(&sdata->odr_lock);
- goto out;
-+ }
-
- *val = *val >> ch->scan_type.shift;
-
- err = st_sensors_set_enable(indio_dev, false);
-+ mutex_unlock(&sdata->odr_lock);
- }
- out:
- mutex_unlock(&indio_dev->mlock);
-diff --git a/include/linux/iio/common/st_sensors.h b/include/linux/iio/common/st_sensors.h
-index 8bdbaf3f3796..69f4a1f6b536 100644
---- a/include/linux/iio/common/st_sensors.h
-+++ b/include/linux/iio/common/st_sensors.h
-@@ -238,6 +238,7 @@ struct st_sensor_settings {
- * @hw_irq_trigger: if we're using the hardware interrupt on the sensor.
- * @hw_timestamp: Latest timestamp from the interrupt handler, when in use.
- * @buffer_data: Data used by buffer part.
-+ * @odr_lock: Local lock for preventing concurrent ODR accesses/changes
- */
- struct st_sensor_data {
- struct device *dev;
-@@ -263,6 +264,8 @@ struct st_sensor_data {
- s64 hw_timestamp;
-
- char buffer_data[ST_SENSORS_MAX_BUFFER_SIZE] ____cacheline_aligned;
-+
-+ struct mutex odr_lock;
- };
-
- #ifdef CONFIG_IIO_BUFFER
---
-2.35.1
-
+++ /dev/null
-From 8e080a8e0181d828e2aa1619fafbc4d7a8334b50 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 2 May 2022 12:30:20 +0200
-Subject: jump_label,noinstr: Avoid instrumentation for JUMP_LABEL=n builds
-
-From: Peter Zijlstra <peterz@infradead.org>
-
-[ Upstream commit 656d054e0a15ec327bd82801ccd58201e59f6896 ]
-
-When building x86_64 with JUMP_LABEL=n it's possible for
-instrumentation to sneak into noinstr:
-
-vmlinux.o: warning: objtool: exit_to_user_mode+0x14: call to static_key_count.constprop.0() leaves .noinstr.text section
-vmlinux.o: warning: objtool: syscall_exit_to_user_mode+0x2d: call to static_key_count.constprop.0() leaves .noinstr.text section
-vmlinux.o: warning: objtool: irqentry_exit_to_user_mode+0x1b: call to static_key_count.constprop.0() leaves .noinstr.text section
-
-Switch to arch_ prefixed atomic to avoid the explicit instrumentation.
-
-Reported-by: kernel test robot <lkp@intel.com>
-Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- include/linux/jump_label.h | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/include/linux/jump_label.h b/include/linux/jump_label.h
-index 48b9b2a82767..019e55c13248 100644
---- a/include/linux/jump_label.h
-+++ b/include/linux/jump_label.h
-@@ -261,9 +261,9 @@ extern void static_key_disable_cpuslocked(struct static_key *key);
- #include <linux/atomic.h>
- #include <linux/bug.h>
-
--static inline int static_key_count(struct static_key *key)
-+static __always_inline int static_key_count(struct static_key *key)
- {
-- return atomic_read(&key->enabled);
-+ return arch_atomic_read(&key->enabled);
- }
-
- static __always_inline void jump_label_init(void)
---
-2.35.1
-
+++ /dev/null
-From 9d57629e7392ea130a448ec0df076c9b7ac672a6 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 16 May 2022 12:09:51 -0700
-Subject: kernfs: Separate kernfs_pr_cont_buf and rename_lock.
-
-From: Hao Luo <haoluo@google.com>
-
-[ Upstream commit 1a702dc88e150487c9c173a249b3d236498b9183 ]
-
-Previously the protection of kernfs_pr_cont_buf was piggy backed by
-rename_lock, which means that pr_cont() needs to be protected under
-rename_lock. This can cause potential circular lock dependencies.
-
-If there is an OOM, we have the following call hierarchy:
-
- -> cpuset_print_current_mems_allowed()
- -> pr_cont_cgroup_name()
- -> pr_cont_kernfs_name()
-
-pr_cont_kernfs_name() will grab rename_lock and call printk. So we have
-the following lock dependencies:
-
- kernfs_rename_lock -> console_sem
-
-Sometimes, printk does a wakeup before releasing console_sem, which has
-the dependence chain:
-
- console_sem -> p->pi_lock -> rq->lock
-
-Now, imagine one wants to read cgroup_name under rq->lock, for example,
-printing cgroup_name in a tracepoint in the scheduler code. They will
-be holding rq->lock and take rename_lock:
-
- rq->lock -> kernfs_rename_lock
-
-Now they will deadlock.
-
-A prevention to this circular lock dependency is to separate the
-protection of pr_cont_buf from rename_lock. In principle, rename_lock
-is to protect the integrity of cgroup name when copying to buf. Once
-pr_cont_buf has got its content, rename_lock can be dropped. So it's
-safe to drop rename_lock after kernfs_name_locked (and
-kernfs_path_from_node_locked) and rely on a dedicated pr_cont_lock
-to protect pr_cont_buf.
-
-Acked-by: Tejun Heo <tj@kernel.org>
-Signed-off-by: Hao Luo <haoluo@google.com>
-Link: https://lore.kernel.org/r/20220516190951.3144144-1-haoluo@google.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/kernfs/dir.c | 31 +++++++++++++++++++------------
- 1 file changed, 19 insertions(+), 12 deletions(-)
-
-diff --git a/fs/kernfs/dir.c b/fs/kernfs/dir.c
-index 8e0a1378a4b1..7bf1d5fc2e9c 100644
---- a/fs/kernfs/dir.c
-+++ b/fs/kernfs/dir.c
-@@ -19,7 +19,15 @@
-
- DECLARE_RWSEM(kernfs_rwsem);
- static DEFINE_SPINLOCK(kernfs_rename_lock); /* kn->parent and ->name */
--static char kernfs_pr_cont_buf[PATH_MAX]; /* protected by rename_lock */
-+/*
-+ * Don't use rename_lock to piggy back on pr_cont_buf. We don't want to
-+ * call pr_cont() while holding rename_lock. Because sometimes pr_cont()
-+ * will perform wakeups when releasing console_sem. Holding rename_lock
-+ * will introduce deadlock if the scheduler reads the kernfs_name in the
-+ * wakeup path.
-+ */
-+static DEFINE_SPINLOCK(kernfs_pr_cont_lock);
-+static char kernfs_pr_cont_buf[PATH_MAX]; /* protected by pr_cont_lock */
- static DEFINE_SPINLOCK(kernfs_idr_lock); /* root->ino_idr */
-
- #define rb_to_kn(X) rb_entry((X), struct kernfs_node, rb)
-@@ -230,12 +238,12 @@ void pr_cont_kernfs_name(struct kernfs_node *kn)
- {
- unsigned long flags;
-
-- spin_lock_irqsave(&kernfs_rename_lock, flags);
-+ spin_lock_irqsave(&kernfs_pr_cont_lock, flags);
-
-- kernfs_name_locked(kn, kernfs_pr_cont_buf, sizeof(kernfs_pr_cont_buf));
-+ kernfs_name(kn, kernfs_pr_cont_buf, sizeof(kernfs_pr_cont_buf));
- pr_cont("%s", kernfs_pr_cont_buf);
-
-- spin_unlock_irqrestore(&kernfs_rename_lock, flags);
-+ spin_unlock_irqrestore(&kernfs_pr_cont_lock, flags);
- }
-
- /**
-@@ -249,10 +257,10 @@ void pr_cont_kernfs_path(struct kernfs_node *kn)
- unsigned long flags;
- int sz;
-
-- spin_lock_irqsave(&kernfs_rename_lock, flags);
-+ spin_lock_irqsave(&kernfs_pr_cont_lock, flags);
-
-- sz = kernfs_path_from_node_locked(kn, NULL, kernfs_pr_cont_buf,
-- sizeof(kernfs_pr_cont_buf));
-+ sz = kernfs_path_from_node(kn, NULL, kernfs_pr_cont_buf,
-+ sizeof(kernfs_pr_cont_buf));
- if (sz < 0) {
- pr_cont("(error)");
- goto out;
-@@ -266,7 +274,7 @@ void pr_cont_kernfs_path(struct kernfs_node *kn)
- pr_cont("%s", kernfs_pr_cont_buf);
-
- out:
-- spin_unlock_irqrestore(&kernfs_rename_lock, flags);
-+ spin_unlock_irqrestore(&kernfs_pr_cont_lock, flags);
- }
-
- /**
-@@ -822,13 +830,12 @@ static struct kernfs_node *kernfs_walk_ns(struct kernfs_node *parent,
-
- lockdep_assert_held_read(&kernfs_rwsem);
-
-- /* grab kernfs_rename_lock to piggy back on kernfs_pr_cont_buf */
-- spin_lock_irq(&kernfs_rename_lock);
-+ spin_lock_irq(&kernfs_pr_cont_lock);
-
- len = strlcpy(kernfs_pr_cont_buf, path, sizeof(kernfs_pr_cont_buf));
-
- if (len >= sizeof(kernfs_pr_cont_buf)) {
-- spin_unlock_irq(&kernfs_rename_lock);
-+ spin_unlock_irq(&kernfs_pr_cont_lock);
- return NULL;
- }
-
-@@ -840,7 +847,7 @@ static struct kernfs_node *kernfs_walk_ns(struct kernfs_node *parent,
- parent = kernfs_find_ns(parent, name, ns);
- }
-
-- spin_unlock_irq(&kernfs_rename_lock);
-+ spin_unlock_irq(&kernfs_pr_cont_lock);
-
- return parent;
- }
---
-2.35.1
-
+++ /dev/null
-From 9ccbb18bad388aa48583eea4aef66d3cdf8d1a0f Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 16 Feb 2022 12:15:03 -0800
-Subject: lkdtm/usercopy: Expand size of "out of frame" object
-
-From: Kees Cook <keescook@chromium.org>
-
-[ Upstream commit f387e86d3a74407bdd9c5815820ac9d060962840 ]
-
-To be sufficiently out of range for the usercopy test to see the lifetime
-mismatch, expand the size of the "bad" buffer, which will let it be
-beyond current_stack_pointer regardless of stack growth direction.
-Paired with the recent addition of stack depth checking under
-CONFIG_HARDENED_USERCOPY=y, this will correctly start tripping again.
-
-Reported-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
-Cc: Arnd Bergmann <arnd@arndb.de>
-Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Reviewed-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
-Link: https://lore.kernel.org/lkml/762faf1b-0443-5ddf-4430-44a20cf2ec4d@collabora.com/
-Signed-off-by: Kees Cook <keescook@chromium.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/misc/lkdtm/usercopy.c | 17 ++++++++++++++---
- 1 file changed, 14 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/misc/lkdtm/usercopy.c b/drivers/misc/lkdtm/usercopy.c
-index 9161ce7ed47a..3fead5efe523 100644
---- a/drivers/misc/lkdtm/usercopy.c
-+++ b/drivers/misc/lkdtm/usercopy.c
-@@ -30,12 +30,12 @@ static const unsigned char test_text[] = "This is a test.\n";
- */
- static noinline unsigned char *trick_compiler(unsigned char *stack)
- {
-- return stack + 0;
-+ return stack + unconst;
- }
-
- static noinline unsigned char *do_usercopy_stack_callee(int value)
- {
-- unsigned char buf[32];
-+ unsigned char buf[128];
- int i;
-
- /* Exercise stack to avoid everything living in registers. */
-@@ -43,7 +43,12 @@ static noinline unsigned char *do_usercopy_stack_callee(int value)
- buf[i] = value & 0xff;
- }
-
-- return trick_compiler(buf);
-+ /*
-+ * Put the target buffer in the middle of stack allocation
-+ * so that we don't step on future stack users regardless
-+ * of stack growth direction.
-+ */
-+ return trick_compiler(&buf[(128/2)-32]);
- }
-
- static noinline void do_usercopy_stack(bool to_user, bool bad_frame)
-@@ -66,6 +71,12 @@ static noinline void do_usercopy_stack(bool to_user, bool bad_frame)
- bad_stack -= sizeof(unsigned long);
- }
-
-+#ifdef ARCH_HAS_CURRENT_STACK_POINTER
-+ pr_info("stack : %px\n", (void *)current_stack_pointer);
-+#endif
-+ pr_info("good_stack: %px-%px\n", good_stack, good_stack + sizeof(good_stack));
-+ pr_info("bad_stack : %px-%px\n", bad_stack, bad_stack + sizeof(good_stack));
-+
- user_addr = vm_mmap(NULL, 0, PAGE_SIZE,
- PROT_READ | PROT_WRITE | PROT_EXEC,
- MAP_ANONYMOUS | MAP_PRIVATE, 0);
---
-2.35.1
-
+++ /dev/null
-From dfeb02059b33be809430ef98fdc17bac2f64f59d Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 29 Apr 2022 16:49:09 +0800
-Subject: md: protect md_unregister_thread from reentrancy
-
-From: Guoqing Jiang <guoqing.jiang@cloud.ionos.com>
-
-[ Upstream commit 1e267742283a4b5a8ca65755c44166be27e9aa0f ]
-
-Generally, the md_unregister_thread is called with reconfig_mutex, but
-raid_message in dm-raid doesn't hold reconfig_mutex to unregister thread,
-so md_unregister_thread can be called simulitaneously from two call sites
-in theory.
-
-Then after previous commit which remove the protection of reconfig_mutex
-for md_unregister_thread completely, the potential issue could be worse
-than before.
-
-Let's take pers_lock at the beginning of function to ensure reentrancy.
-
-Reported-by: Donald Buczek <buczek@molgen.mpg.de>
-Signed-off-by: Guoqing Jiang <guoqing.jiang@linux.dev>
-Signed-off-by: Song Liu <song@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/md/md.c | 15 ++++++++++-----
- 1 file changed, 10 insertions(+), 5 deletions(-)
-
-diff --git a/drivers/md/md.c b/drivers/md/md.c
-index b553654cbebc..bf1c5c0e472e 100644
---- a/drivers/md/md.c
-+++ b/drivers/md/md.c
-@@ -7942,17 +7942,22 @@ EXPORT_SYMBOL(md_register_thread);
-
- void md_unregister_thread(struct md_thread **threadp)
- {
-- struct md_thread *thread = *threadp;
-- if (!thread)
-- return;
-- pr_debug("interrupting MD-thread pid %d\n", task_pid_nr(thread->tsk));
-- /* Locking ensures that mddev_unlock does not wake_up a
-+ struct md_thread *thread;
-+
-+ /*
-+ * Locking ensures that mddev_unlock does not wake_up a
- * non-existent thread
- */
- spin_lock(&pers_lock);
-+ thread = *threadp;
-+ if (!thread) {
-+ spin_unlock(&pers_lock);
-+ return;
-+ }
- *threadp = NULL;
- spin_unlock(&pers_lock);
-
-+ pr_debug("interrupting MD-thread pid %d\n", task_pid_nr(thread->tsk));
- kthread_stop(thread->tsk);
- kfree(thread);
- }
---
-2.35.1
-
+++ /dev/null
-From 93132ffc754f9bc72c6c4ab91da0630c8e60195c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 29 Apr 2022 15:09:13 -0600
-Subject: misc: rtsx: set NULL intfdata when probe fails
-
-From: Shuah Khan <skhan@linuxfoundation.org>
-
-[ Upstream commit f861d36e021e1ac4a0a2a1f6411d623809975d63 ]
-
-rtsx_usb_probe() doesn't call usb_set_intfdata() to null out the
-interface pointer when probe fails. This leaves a stale pointer.
-Noticed the missing usb_set_intfdata() while debugging an unrelated
-invalid DMA mapping problem.
-
-Fix it with a call to usb_set_intfdata(..., NULL).
-
-Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
-Link: https://lore.kernel.org/r/20220429210913.46804-1-skhan@linuxfoundation.org
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/misc/cardreader/rtsx_usb.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/drivers/misc/cardreader/rtsx_usb.c b/drivers/misc/cardreader/rtsx_usb.c
-index 59eda55d92a3..1ef9b61077c4 100644
---- a/drivers/misc/cardreader/rtsx_usb.c
-+++ b/drivers/misc/cardreader/rtsx_usb.c
-@@ -667,6 +667,7 @@ static int rtsx_usb_probe(struct usb_interface *intf,
- return 0;
-
- out_init_fail:
-+ usb_set_intfdata(ucr->pusb_intf, NULL);
- usb_free_coherent(ucr->pusb_dev, IOBUF_SIZE, ucr->iobuf,
- ucr->iobuf_dma);
- return ret;
---
-2.35.1
-
+++ /dev/null
-From 29e4c0af15444360eb93711eaccd54ead2d30010 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 24 May 2022 01:46:22 +0900
-Subject: modpost: fix undefined behavior of is_arm_mapping_symbol()
-
-From: Masahiro Yamada <masahiroy@kernel.org>
-
-[ Upstream commit d6b732666a1bae0df3c3ae06925043bba34502b1 ]
-
-The return value of is_arm_mapping_symbol() is unpredictable when "$"
-is passed in.
-
-strchr(3) says:
- The strchr() and strrchr() functions return a pointer to the matched
- character or NULL if the character is not found. The terminating null
- byte is considered part of the string, so that if c is specified as
- '\0', these functions return a pointer to the terminator.
-
-When str[1] is '\0', strchr("axtd", str[1]) is not NULL, and str[2] is
-referenced (i.e. buffer overrun).
-
-Test code
----------
-
- char str1[] = "abc";
- char str2[] = "ab";
-
- strcpy(str1, "$");
- strcpy(str2, "$");
-
- printf("test1: %d\n", is_arm_mapping_symbol(str1));
- printf("test2: %d\n", is_arm_mapping_symbol(str2));
-
-Result
-------
-
- test1: 0
- test2: 1
-
-Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
-Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- scripts/mod/modpost.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
-index 7a5bddb8913e..94041ee32798 100644
---- a/scripts/mod/modpost.c
-+++ b/scripts/mod/modpost.c
-@@ -1260,7 +1260,8 @@ static int secref_whitelist(const struct sectioncheck *mismatch,
-
- static inline int is_arm_mapping_symbol(const char *str)
- {
-- return str[0] == '$' && strchr("axtd", str[1])
-+ return str[0] == '$' &&
-+ (str[1] == 'a' || str[1] == 'd' || str[1] == 't' || str[1] == 'x')
- && (str[2] == '\0' || str[2] == '.');
- }
-
---
-2.35.1
-
+++ /dev/null
-From beae87f193631df7597ca3378f60bb0344449a7c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 21 May 2022 15:37:44 +0800
-Subject: nbd: call genl_unregister_family() first in nbd_cleanup()
-
-From: Yu Kuai <yukuai3@huawei.com>
-
-[ Upstream commit 06c4da89c24e7023ea448cadf8e9daf06a0aae6e ]
-
-Otherwise there may be race between module removal and the handling of
-netlink command, which can lead to the oops as shown below:
-
- BUG: kernel NULL pointer dereference, address: 0000000000000098
- Oops: 0002 [#1] SMP PTI
- CPU: 1 PID: 31299 Comm: nbd-client Tainted: G E 5.14.0-rc4
- Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
- RIP: 0010:down_write+0x1a/0x50
- Call Trace:
- start_creating+0x89/0x130
- debugfs_create_dir+0x1b/0x130
- nbd_start_device+0x13d/0x390 [nbd]
- nbd_genl_connect+0x42f/0x748 [nbd]
- genl_family_rcv_msg_doit.isra.0+0xec/0x150
- genl_rcv_msg+0xe5/0x1e0
- netlink_rcv_skb+0x55/0x100
- genl_rcv+0x29/0x40
- netlink_unicast+0x1a8/0x250
- netlink_sendmsg+0x21b/0x430
- ____sys_sendmsg+0x2a4/0x2d0
- ___sys_sendmsg+0x81/0xc0
- __sys_sendmsg+0x62/0xb0
- __x64_sys_sendmsg+0x1f/0x30
- do_syscall_64+0x3b/0xc0
- entry_SYSCALL_64_after_hwframe+0x44/0xae
- Modules linked in: nbd(E-)
-
-Signed-off-by: Hou Tao <houtao1@huawei.com>
-Signed-off-by: Yu Kuai <yukuai3@huawei.com>
-Reviewed-by: Josef Bacik <josef@toxicpanda.com>
-Link: https://lore.kernel.org/r/20220521073749.3146892-2-yukuai3@huawei.com
-Signed-off-by: Jens Axboe <axboe@kernel.dk>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/block/nbd.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
-index 8704212482e5..4be8ae20d1da 100644
---- a/drivers/block/nbd.c
-+++ b/drivers/block/nbd.c
-@@ -2478,6 +2478,12 @@ static void __exit nbd_cleanup(void)
- struct nbd_device *nbd;
- LIST_HEAD(del_list);
-
-+ /*
-+ * Unregister netlink interface prior to waiting
-+ * for the completion of netlink commands.
-+ */
-+ genl_unregister_family(&nbd_genl_family);
-+
- nbd_dbg_close();
-
- mutex_lock(&nbd_index_mutex);
-@@ -2496,7 +2502,6 @@ static void __exit nbd_cleanup(void)
- destroy_workqueue(nbd_del_wq);
-
- idr_destroy(&nbd_index_idr);
-- genl_unregister_family(&nbd_genl_family);
- unregister_blkdev(NBD_MAJOR, "nbd");
- }
-
---
-2.35.1
-
+++ /dev/null
-From 5309d6fd8206d3685acb334e9ecf9b3fe8751b54 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 21 May 2022 15:37:47 +0800
-Subject: nbd: fix io hung while disconnecting device
-
-From: Yu Kuai <yukuai3@huawei.com>
-
-[ Upstream commit 09dadb5985023e27d4740ebd17e6fea4640110e5 ]
-
-In our tests, "qemu-nbd" triggers a io hung:
-
-INFO: task qemu-nbd:11445 blocked for more than 368 seconds.
- Not tainted 5.18.0-rc3-next-20220422-00003-g2176915513ca #884
-"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
-task:qemu-nbd state:D stack: 0 pid:11445 ppid: 1 flags:0x00000000
-Call Trace:
- <TASK>
- __schedule+0x480/0x1050
- ? _raw_spin_lock_irqsave+0x3e/0xb0
- schedule+0x9c/0x1b0
- blk_mq_freeze_queue_wait+0x9d/0xf0
- ? ipi_rseq+0x70/0x70
- blk_mq_freeze_queue+0x2b/0x40
- nbd_add_socket+0x6b/0x270 [nbd]
- nbd_ioctl+0x383/0x510 [nbd]
- blkdev_ioctl+0x18e/0x3e0
- __x64_sys_ioctl+0xac/0x120
- do_syscall_64+0x35/0x80
- entry_SYSCALL_64_after_hwframe+0x44/0xae
-RIP: 0033:0x7fd8ff706577
-RSP: 002b:00007fd8fcdfebf8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
-RAX: ffffffffffffffda RBX: 0000000040000000 RCX: 00007fd8ff706577
-RDX: 000000000000000d RSI: 000000000000ab00 RDI: 000000000000000f
-RBP: 000000000000000f R08: 000000000000fbe8 R09: 000055fe497c62b0
-R10: 00000002aff20000 R11: 0000000000000246 R12: 000000000000006d
-R13: 0000000000000000 R14: 00007ffe82dc5e70 R15: 00007fd8fcdff9c0
-
-"qemu-ndb -d" will call ioctl 'NBD_DISCONNECT' first, however, following
-message was found:
-
-block nbd0: Send disconnect failed -32
-
-Which indicate that something is wrong with the server. Then,
-"qemu-nbd -d" will call ioctl 'NBD_CLEAR_SOCK', however ioctl can't clear
-requests after commit 2516ab1543fd("nbd: only clear the queue on device
-teardown"). And in the meantime, request can't complete through timeout
-because nbd_xmit_timeout() will always return 'BLK_EH_RESET_TIMER', which
-means such request will never be completed in this situation.
-
-Now that the flag 'NBD_CMD_INFLIGHT' can make sure requests won't
-complete multiple times, switch back to call nbd_clear_sock() in
-nbd_clear_sock_ioctl(), so that inflight requests can be cleared.
-
-Signed-off-by: Yu Kuai <yukuai3@huawei.com>
-Reviewed-by: Josef Bacik <josef@toxicpanda.com>
-Link: https://lore.kernel.org/r/20220521073749.3146892-5-yukuai3@huawei.com
-Signed-off-by: Jens Axboe <axboe@kernel.dk>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/block/nbd.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
-index b31eb9c7f239..b391ca062add 100644
---- a/drivers/block/nbd.c
-+++ b/drivers/block/nbd.c
-@@ -1368,7 +1368,7 @@ static int nbd_start_device_ioctl(struct nbd_device *nbd, struct block_device *b
- static void nbd_clear_sock_ioctl(struct nbd_device *nbd,
- struct block_device *bdev)
- {
-- sock_shutdown(nbd);
-+ nbd_clear_sock(nbd);
- __invalidate_device(bdev, true);
- nbd_bdev_reset(bdev);
- if (test_and_clear_bit(NBD_RT_HAS_CONFIG_REF,
---
-2.35.1
-
+++ /dev/null
-From fc3e694643ddef333be9619c3ec44e1ee8ab6bdd Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 21 May 2022 15:37:45 +0800
-Subject: nbd: fix race between nbd_alloc_config() and module removal
-
-From: Yu Kuai <yukuai3@huawei.com>
-
-[ Upstream commit c55b2b983b0fa012942c3eb16384b2b722caa810 ]
-
-When nbd module is being removing, nbd_alloc_config() may be
-called concurrently by nbd_genl_connect(), although try_module_get()
-will return false, but nbd_alloc_config() doesn't handle it.
-
-The race may lead to the leak of nbd_config and its related
-resources (e.g, recv_workq) and oops in nbd_read_stat() due
-to the unload of nbd module as shown below:
-
- BUG: kernel NULL pointer dereference, address: 0000000000000040
- Oops: 0000 [#1] SMP PTI
- CPU: 5 PID: 13840 Comm: kworker/u17:33 Not tainted 5.14.0+ #1
- Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
- Workqueue: knbd16-recv recv_work [nbd]
- RIP: 0010:nbd_read_stat.cold+0x130/0x1a4 [nbd]
- Call Trace:
- recv_work+0x3b/0xb0 [nbd]
- process_one_work+0x1ed/0x390
- worker_thread+0x4a/0x3d0
- kthread+0x12a/0x150
- ret_from_fork+0x22/0x30
-
-Fixing it by checking the return value of try_module_get()
-in nbd_alloc_config(). As nbd_alloc_config() may return ERR_PTR(-ENODEV),
-assign nbd->config only when nbd_alloc_config() succeeds to ensure
-the value of nbd->config is binary (valid or NULL).
-
-Also adding a debug message to check the reference counter
-of nbd_config during module removal.
-
-Signed-off-by: Hou Tao <houtao1@huawei.com>
-Signed-off-by: Yu Kuai <yukuai3@huawei.com>
-Reviewed-by: Josef Bacik <josef@toxicpanda.com>
-Link: https://lore.kernel.org/r/20220521073749.3146892-3-yukuai3@huawei.com
-Signed-off-by: Jens Axboe <axboe@kernel.dk>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/block/nbd.c | 28 +++++++++++++++++++---------
- 1 file changed, 19 insertions(+), 9 deletions(-)
-
-diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
-index 4be8ae20d1da..b31eb9c7f239 100644
---- a/drivers/block/nbd.c
-+++ b/drivers/block/nbd.c
-@@ -1467,15 +1467,20 @@ static struct nbd_config *nbd_alloc_config(void)
- {
- struct nbd_config *config;
-
-+ if (!try_module_get(THIS_MODULE))
-+ return ERR_PTR(-ENODEV);
-+
- config = kzalloc(sizeof(struct nbd_config), GFP_NOFS);
-- if (!config)
-- return NULL;
-+ if (!config) {
-+ module_put(THIS_MODULE);
-+ return ERR_PTR(-ENOMEM);
-+ }
-+
- atomic_set(&config->recv_threads, 0);
- init_waitqueue_head(&config->recv_wq);
- init_waitqueue_head(&config->conn_wait);
- config->blksize_bits = NBD_DEF_BLKSIZE_BITS;
- atomic_set(&config->live_connections, 0);
-- try_module_get(THIS_MODULE);
- return config;
- }
-
-@@ -1502,12 +1507,13 @@ static int nbd_open(struct block_device *bdev, fmode_t mode)
- mutex_unlock(&nbd->config_lock);
- goto out;
- }
-- config = nbd->config = nbd_alloc_config();
-- if (!config) {
-- ret = -ENOMEM;
-+ config = nbd_alloc_config();
-+ if (IS_ERR(config)) {
-+ ret = PTR_ERR(config);
- mutex_unlock(&nbd->config_lock);
- goto out;
- }
-+ nbd->config = config;
- refcount_set(&nbd->config_refs, 1);
- refcount_inc(&nbd->refs);
- mutex_unlock(&nbd->config_lock);
-@@ -1914,13 +1920,14 @@ static int nbd_genl_connect(struct sk_buff *skb, struct genl_info *info)
- nbd_put(nbd);
- return -EINVAL;
- }
-- config = nbd->config = nbd_alloc_config();
-- if (!nbd->config) {
-+ config = nbd_alloc_config();
-+ if (IS_ERR(config)) {
- mutex_unlock(&nbd->config_lock);
- nbd_put(nbd);
- printk(KERN_ERR "nbd: couldn't allocate config\n");
-- return -ENOMEM;
-+ return PTR_ERR(config);
- }
-+ nbd->config = config;
- refcount_set(&nbd->config_refs, 1);
- set_bit(NBD_RT_BOUND, &config->runtime_flags);
-
-@@ -2493,6 +2500,9 @@ static void __exit nbd_cleanup(void)
- while (!list_empty(&del_list)) {
- nbd = list_first_entry(&del_list, struct nbd_device, list);
- list_del_init(&nbd->list);
-+ if (refcount_read(&nbd->config_refs))
-+ printk(KERN_ERR "nbd: possibly leaking nbd_config (ref %d)\n",
-+ refcount_read(&nbd->config_refs));
- if (refcount_read(&nbd->refs) != 1)
- printk(KERN_ERR "nbd: possibly leaking a device\n");
- nbd_put(nbd);
---
-2.35.1
-
+++ /dev/null
-From 48b946addb0f232dfbe439ceb5f11290718bd094 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 18 May 2022 13:52:23 -0700
-Subject: nodemask: Fix return values to be unsigned
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Kees Cook <keescook@chromium.org>
-
-[ Upstream commit 0dfe54071d7c828a02917b595456bfde1afdddc9 ]
-
-The nodemask routines had mixed return values that provided potentially
-signed return values that could never happen. This was leading to the
-compiler getting confusing about the range of possible return values
-(it was thinking things could be negative where they could not be). Fix
-all the nodemask routines that should be returning unsigned
-(or bool) values. Silences:
-
- mm/swapfile.c: In function ‘setup_swap_info’:
- mm/swapfile.c:2291:47: error: array subscript -1 is below array bounds of ‘struct plist_node[]’ [-Werror=array-bounds]
- 2291 | p->avail_lists[i].prio = 1;
- | ~~~~~~~~~~~~~~^~~
- In file included from mm/swapfile.c:16:
- ./include/linux/swap.h:292:27: note: while referencing ‘avail_lists’
- 292 | struct plist_node avail_lists[]; /*
- | ^~~~~~~~~~~
-
-Reported-by: Christophe de Dinechin <dinechin@redhat.com>
-Link: https://lore.kernel.org/lkml/20220414150855.2407137-3-dinechin@redhat.com/
-Cc: Alexey Dobriyan <adobriyan@gmail.com>
-Cc: Yury Norov <yury.norov@gmail.com>
-Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
-Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
-Cc: Andrew Morton <akpm@linux-foundation.org>
-Cc: Zhen Lei <thunder.leizhen@huawei.com>
-Signed-off-by: Kees Cook <keescook@chromium.org>
-Signed-off-by: Yury Norov <yury.norov@gmail.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- include/linux/nodemask.h | 38 +++++++++++++++++++-------------------
- lib/nodemask.c | 4 ++--
- 2 files changed, 21 insertions(+), 21 deletions(-)
-
-diff --git a/include/linux/nodemask.h b/include/linux/nodemask.h
-index c6199dbe2591..0f233b76c9ce 100644
---- a/include/linux/nodemask.h
-+++ b/include/linux/nodemask.h
-@@ -42,11 +42,11 @@
- * void nodes_shift_right(dst, src, n) Shift right
- * void nodes_shift_left(dst, src, n) Shift left
- *
-- * int first_node(mask) Number lowest set bit, or MAX_NUMNODES
-- * int next_node(node, mask) Next node past 'node', or MAX_NUMNODES
-- * int next_node_in(node, mask) Next node past 'node', or wrap to first,
-+ * unsigned int first_node(mask) Number lowest set bit, or MAX_NUMNODES
-+ * unsigend int next_node(node, mask) Next node past 'node', or MAX_NUMNODES
-+ * unsigned int next_node_in(node, mask) Next node past 'node', or wrap to first,
- * or MAX_NUMNODES
-- * int first_unset_node(mask) First node not set in mask, or
-+ * unsigned int first_unset_node(mask) First node not set in mask, or
- * MAX_NUMNODES
- *
- * nodemask_t nodemask_of_node(node) Return nodemask with bit 'node' set
-@@ -153,7 +153,7 @@ static inline void __nodes_clear(nodemask_t *dstp, unsigned int nbits)
-
- #define node_test_and_set(node, nodemask) \
- __node_test_and_set((node), &(nodemask))
--static inline int __node_test_and_set(int node, nodemask_t *addr)
-+static inline bool __node_test_and_set(int node, nodemask_t *addr)
- {
- return test_and_set_bit(node, addr->bits);
- }
-@@ -200,7 +200,7 @@ static inline void __nodes_complement(nodemask_t *dstp,
-
- #define nodes_equal(src1, src2) \
- __nodes_equal(&(src1), &(src2), MAX_NUMNODES)
--static inline int __nodes_equal(const nodemask_t *src1p,
-+static inline bool __nodes_equal(const nodemask_t *src1p,
- const nodemask_t *src2p, unsigned int nbits)
- {
- return bitmap_equal(src1p->bits, src2p->bits, nbits);
-@@ -208,7 +208,7 @@ static inline int __nodes_equal(const nodemask_t *src1p,
-
- #define nodes_intersects(src1, src2) \
- __nodes_intersects(&(src1), &(src2), MAX_NUMNODES)
--static inline int __nodes_intersects(const nodemask_t *src1p,
-+static inline bool __nodes_intersects(const nodemask_t *src1p,
- const nodemask_t *src2p, unsigned int nbits)
- {
- return bitmap_intersects(src1p->bits, src2p->bits, nbits);
-@@ -216,20 +216,20 @@ static inline int __nodes_intersects(const nodemask_t *src1p,
-
- #define nodes_subset(src1, src2) \
- __nodes_subset(&(src1), &(src2), MAX_NUMNODES)
--static inline int __nodes_subset(const nodemask_t *src1p,
-+static inline bool __nodes_subset(const nodemask_t *src1p,
- const nodemask_t *src2p, unsigned int nbits)
- {
- return bitmap_subset(src1p->bits, src2p->bits, nbits);
- }
-
- #define nodes_empty(src) __nodes_empty(&(src), MAX_NUMNODES)
--static inline int __nodes_empty(const nodemask_t *srcp, unsigned int nbits)
-+static inline bool __nodes_empty(const nodemask_t *srcp, unsigned int nbits)
- {
- return bitmap_empty(srcp->bits, nbits);
- }
-
- #define nodes_full(nodemask) __nodes_full(&(nodemask), MAX_NUMNODES)
--static inline int __nodes_full(const nodemask_t *srcp, unsigned int nbits)
-+static inline bool __nodes_full(const nodemask_t *srcp, unsigned int nbits)
- {
- return bitmap_full(srcp->bits, nbits);
- }
-@@ -260,15 +260,15 @@ static inline void __nodes_shift_left(nodemask_t *dstp,
- > MAX_NUMNODES, then the silly min_ts could be dropped. */
-
- #define first_node(src) __first_node(&(src))
--static inline int __first_node(const nodemask_t *srcp)
-+static inline unsigned int __first_node(const nodemask_t *srcp)
- {
-- return min_t(int, MAX_NUMNODES, find_first_bit(srcp->bits, MAX_NUMNODES));
-+ return min_t(unsigned int, MAX_NUMNODES, find_first_bit(srcp->bits, MAX_NUMNODES));
- }
-
- #define next_node(n, src) __next_node((n), &(src))
--static inline int __next_node(int n, const nodemask_t *srcp)
-+static inline unsigned int __next_node(int n, const nodemask_t *srcp)
- {
-- return min_t(int,MAX_NUMNODES,find_next_bit(srcp->bits, MAX_NUMNODES, n+1));
-+ return min_t(unsigned int, MAX_NUMNODES, find_next_bit(srcp->bits, MAX_NUMNODES, n+1));
- }
-
- /*
-@@ -276,7 +276,7 @@ static inline int __next_node(int n, const nodemask_t *srcp)
- * the first node in src if needed. Returns MAX_NUMNODES if src is empty.
- */
- #define next_node_in(n, src) __next_node_in((n), &(src))
--int __next_node_in(int node, const nodemask_t *srcp);
-+unsigned int __next_node_in(int node, const nodemask_t *srcp);
-
- static inline void init_nodemask_of_node(nodemask_t *mask, int node)
- {
-@@ -296,9 +296,9 @@ static inline void init_nodemask_of_node(nodemask_t *mask, int node)
- })
-
- #define first_unset_node(mask) __first_unset_node(&(mask))
--static inline int __first_unset_node(const nodemask_t *maskp)
-+static inline unsigned int __first_unset_node(const nodemask_t *maskp)
- {
-- return min_t(int,MAX_NUMNODES,
-+ return min_t(unsigned int, MAX_NUMNODES,
- find_first_zero_bit(maskp->bits, MAX_NUMNODES));
- }
-
-@@ -435,11 +435,11 @@ static inline int num_node_state(enum node_states state)
-
- #define first_online_node first_node(node_states[N_ONLINE])
- #define first_memory_node first_node(node_states[N_MEMORY])
--static inline int next_online_node(int nid)
-+static inline unsigned int next_online_node(int nid)
- {
- return next_node(nid, node_states[N_ONLINE]);
- }
--static inline int next_memory_node(int nid)
-+static inline unsigned int next_memory_node(int nid)
- {
- return next_node(nid, node_states[N_MEMORY]);
- }
-diff --git a/lib/nodemask.c b/lib/nodemask.c
-index 3aa454c54c0d..e22647f5181b 100644
---- a/lib/nodemask.c
-+++ b/lib/nodemask.c
-@@ -3,9 +3,9 @@
- #include <linux/module.h>
- #include <linux/random.h>
-
--int __next_node_in(int node, const nodemask_t *srcp)
-+unsigned int __next_node_in(int node, const nodemask_t *srcp)
- {
-- int ret = __next_node(node, srcp);
-+ unsigned int ret = __next_node(node, srcp);
-
- if (ret == MAX_NUMNODES)
- ret = __first_node(srcp);
---
-2.35.1
-
+++ /dev/null
-From f3a66afbac70d7461a0e78494aaee03f354f5e58 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 23 May 2022 22:05:24 +0200
-Subject: Revert "net: af_key: add check for pfkey_broadcast in function
- pfkey_process"
-
-From: Michal Kubecek <mkubecek@suse.cz>
-
-[ Upstream commit 9c90c9b3e50e16d03c7f87d63e9db373974781e0 ]
-
-This reverts commit 4dc2a5a8f6754492180741facf2a8787f2c415d7.
-
-A non-zero return value from pfkey_broadcast() does not necessarily mean
-an error occurred as this function returns -ESRCH when no registered
-listener received the message. In particular, a call with
-BROADCAST_PROMISC_ONLY flag and null one_sk argument can never return
-zero so that this commit in fact prevents processing any PF_KEY message.
-One visible effect is that racoon daemon fails to find encryption
-algorithms like aes and refuses to start.
-
-Excluding -ESRCH return value would fix this but it's not obvious that
-we really want to bail out here and most other callers of
-pfkey_broadcast() also ignore the return value. Also, as pointed out by
-Steffen Klassert, PF_KEY is kind of deprecated and newer userspace code
-should use netlink instead so that we should only disturb the code for
-really important fixes.
-
-v2: add a comment explaining why is the return value ignored
-
-Signed-off-by: Michal Kubecek <mkubecek@suse.cz>
-Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/key/af_key.c | 10 ++++++----
- 1 file changed, 6 insertions(+), 4 deletions(-)
-
-diff --git a/net/key/af_key.c b/net/key/af_key.c
-index 339d95df19d3..d93bde657359 100644
---- a/net/key/af_key.c
-+++ b/net/key/af_key.c
-@@ -2826,10 +2826,12 @@ static int pfkey_process(struct sock *sk, struct sk_buff *skb, const struct sadb
- void *ext_hdrs[SADB_EXT_MAX];
- int err;
-
-- err = pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL,
-- BROADCAST_PROMISC_ONLY, NULL, sock_net(sk));
-- if (err)
-- return err;
-+ /* Non-zero return value of pfkey_broadcast() does not always signal
-+ * an error and even on an actual error we may still want to process
-+ * the message so rather ignore the return value.
-+ */
-+ pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL,
-+ BROADCAST_PROMISC_ONLY, NULL, sock_net(sk));
-
- memset(ext_hdrs, 0, sizeof(ext_hdrs));
- err = parse_exthdrs(skb, hdr, ext_hdrs);
---
-2.35.1
-
+++ /dev/null
-From 400bc78544e22d092ceb4e551e91083bbf6a4f1b Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 30 May 2022 11:27:05 +0200
-Subject: s390/gmap: voluntarily schedule during key setting
-
-From: Christian Borntraeger <borntraeger@linux.ibm.com>
-
-[ Upstream commit 6d5946274df1fff539a7eece458a43be733d1db8 ]
-
-With large and many guest with storage keys it is possible to create
-large latencies or stalls during initial key setting:
-
-rcu: INFO: rcu_sched self-detected stall on CPU
-rcu: 18-....: (2099 ticks this GP) idle=54e/1/0x4000000000000002 softirq=35598716/35598716 fqs=998
- (t=2100 jiffies g=155867385 q=20879)
-Task dump for CPU 18:
-CPU 1/KVM R running task 0 1030947 256019 0x06000004
-Call Trace:
-sched_show_task
-rcu_dump_cpu_stacks
-rcu_sched_clock_irq
-update_process_times
-tick_sched_handle
-tick_sched_timer
-__hrtimer_run_queues
-hrtimer_interrupt
-do_IRQ
-ext_int_handler
-ptep_zap_key
-
-The mmap lock is held during the page walking but since this is a
-semaphore scheduling is still possible. Same for the kvm srcu.
-To minimize overhead do this on every segment table entry or large page.
-
-Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
-Reviewed-by: Alexander Gordeev <agordeev@linux.ibm.com>
-Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
-Link: https://lore.kernel.org/r/20220530092706.11637-2-borntraeger@linux.ibm.com
-Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
-Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/s390/mm/gmap.c | 14 ++++++++++++++
- 1 file changed, 14 insertions(+)
-
-diff --git a/arch/s390/mm/gmap.c b/arch/s390/mm/gmap.c
-index d63c0ccc5ccd..4ce3a2f01c91 100644
---- a/arch/s390/mm/gmap.c
-+++ b/arch/s390/mm/gmap.c
-@@ -2601,6 +2601,18 @@ static int __s390_enable_skey_pte(pte_t *pte, unsigned long addr,
- return 0;
- }
-
-+/*
-+ * Give a chance to schedule after setting a key to 256 pages.
-+ * We only hold the mm lock, which is a rwsem and the kvm srcu.
-+ * Both can sleep.
-+ */
-+static int __s390_enable_skey_pmd(pmd_t *pmd, unsigned long addr,
-+ unsigned long next, struct mm_walk *walk)
-+{
-+ cond_resched();
-+ return 0;
-+}
-+
- static int __s390_enable_skey_hugetlb(pte_t *pte, unsigned long addr,
- unsigned long hmask, unsigned long next,
- struct mm_walk *walk)
-@@ -2623,12 +2635,14 @@ static int __s390_enable_skey_hugetlb(pte_t *pte, unsigned long addr,
- end = start + HPAGE_SIZE - 1;
- __storage_key_init_range(start, end);
- set_bit(PG_arch_1, &page->flags);
-+ cond_resched();
- return 0;
- }
-
- static const struct mm_walk_ops enable_skey_walk_ops = {
- .hugetlb_entry = __s390_enable_skey_hugetlb,
- .pte_entry = __s390_enable_skey_pte,
-+ .pmd_entry = __s390_enable_skey_pmd,
- };
-
- int s390_enable_skey(void)
---
-2.35.1
-
+++ /dev/null
-From 1fca1cb9a8c23cb08253bfc586710c986a368f4a Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 23 May 2022 14:02:44 +0200
-Subject: scsi: myrb: Fix up null pointer access on myrb_cleanup()
-
-From: Hannes Reinecke <hare@suse.de>
-
-[ Upstream commit f9f0a46141e2e39bedb4779c88380d1b5f018c14 ]
-
-When myrb_probe() fails the callback might not be set, so we need to
-validate the 'disable_intr' callback in myrb_cleanup() to not cause a null
-pointer exception. And while at it do not call myrb_cleanup() if we cannot
-enable the PCI device at all.
-
-Link: https://lore.kernel.org/r/20220523120244.99515-1-hare@suse.de
-Reported-by: Zheyu Ma <zheyuma97@gmail.com>
-Tested-by: Zheyu Ma <zheyuma97@gmail.com>
-Signed-off-by: Hannes Reinecke <hare@suse.de>
-Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/scsi/myrb.c | 11 ++++++++---
- 1 file changed, 8 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/scsi/myrb.c b/drivers/scsi/myrb.c
-index a4a88323e020..386256369dfc 100644
---- a/drivers/scsi/myrb.c
-+++ b/drivers/scsi/myrb.c
-@@ -1239,7 +1239,8 @@ static void myrb_cleanup(struct myrb_hba *cb)
- myrb_unmap(cb);
-
- if (cb->mmio_base) {
-- cb->disable_intr(cb->io_base);
-+ if (cb->disable_intr)
-+ cb->disable_intr(cb->io_base);
- iounmap(cb->mmio_base);
- }
- if (cb->irq)
-@@ -3409,9 +3410,13 @@ static struct myrb_hba *myrb_detect(struct pci_dev *pdev,
- mutex_init(&cb->dcmd_mutex);
- mutex_init(&cb->dma_mutex);
- cb->pdev = pdev;
-+ cb->host = shost;
-
-- if (pci_enable_device(pdev))
-- goto failure;
-+ if (pci_enable_device(pdev)) {
-+ dev_err(&pdev->dev, "Failed to enable PCI device\n");
-+ scsi_host_put(shost);
-+ return NULL;
-+ }
-
- if (privdata->hw_init == DAC960_PD_hw_init ||
- privdata->hw_init == DAC960_P_hw_init) {
---
-2.35.1
-
+++ /dev/null
-From 4293d86578e44b173f68e595b8098f00158a74af Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 6 May 2022 23:39:24 +0206
-Subject: serial: msm_serial: disable interrupts in __msm_console_write()
-
-From: John Ogness <john.ogness@linutronix.de>
-
-[ Upstream commit aabdbb1b7a5819e18c403334a31fb0cc2c06ad41 ]
-
-__msm_console_write() assumes that interrupts are disabled, but
-with threaded console printers it is possible that the write()
-callback of the console is called with interrupts enabled.
-
-Explicitly disable interrupts using local_irq_save() to preserve
-the assumed context.
-
-Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
-Reviewed-by: Petr Mladek <pmladek@suse.com>
-Signed-off-by: John Ogness <john.ogness@linutronix.de>
-Link: https://lore.kernel.org/r/20220506213324.470461-1-john.ogness@linutronix.de
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/tty/serial/msm_serial.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/drivers/tty/serial/msm_serial.c b/drivers/tty/serial/msm_serial.c
-index 489d19274f9a..03ff63438e77 100644
---- a/drivers/tty/serial/msm_serial.c
-+++ b/drivers/tty/serial/msm_serial.c
-@@ -1588,6 +1588,7 @@ static inline struct uart_port *msm_get_port_from_line(unsigned int line)
- static void __msm_console_write(struct uart_port *port, const char *s,
- unsigned int count, bool is_uartdm)
- {
-+ unsigned long flags;
- int i;
- int num_newlines = 0;
- bool replaced = false;
-@@ -1605,6 +1606,8 @@ static void __msm_console_write(struct uart_port *port, const char *s,
- num_newlines++;
- count += num_newlines;
-
-+ local_irq_save(flags);
-+
- if (port->sysrq)
- locked = 0;
- else if (oops_in_progress)
-@@ -1650,6 +1653,8 @@ static void __msm_console_write(struct uart_port *port, const char *s,
-
- if (locked)
- spin_unlock(&port->lock);
-+
-+ local_irq_restore(flags);
- }
-
- static void msm_console_write(struct console *co, const char *s,
---
-2.35.1
-
drm-imx-fix-compiler-warning-with-gcc-12.patch
nfp-flower-restructure-flow-key-for-gre-vlan-combina.patch
iov_iter-fix-iter_xarray_get_pages-_alloc.patch
-iio-dummy-iio_simple_dummy-check-the-return-value-of.patch
-staging-rtl8712-fix-a-potential-memory-leak-in-r871x.patch
-iio-st_sensors-add-a-local-lock-for-protecting-odr.patch
-lkdtm-usercopy-expand-size-of-out-of-frame-object.patch
-drivers-staging-rtl8723bs-fix-deadlock-in-rtw_survey.patch
-drivers-staging-rtl8192bs-fix-deadlock-in-rtw_joinbs.patch
-tty-synclink_gt-fix-null-pointer-dereference-in-slgt.patch
-tty-fix-a-possible-resource-leak-in-icom_probe.patch
-thunderbolt-use-different-lane-for-second-displaypor.patch
-drivers-staging-rtl8192u-fix-deadlock-in-ieee80211_b.patch
-drivers-staging-rtl8192e-fix-deadlock-in-rtllib_beac.patch
-usb-host-isp116x-check-return-value-after-calling-pl.patch
-drivers-tty-serial-fix-deadlock-in-sa1100_set_termio.patch
-drivers-usb-host-fix-deadlock-in-oxu_bus_suspend.patch
-usb-hcd-pci-fully-suspend-across-freeze-thaw-cycle.patch
-char-xillybus-fix-a-refcount-leak-in-cleanup_dev.patch
-sysrq-do-not-omit-current-cpu-when-showing-backtrace.patch
-usb-dwc2-gadget-don-t-reset-gadget-s-driver-bus.patch
-soundwire-qcom-adjust-autoenumeration-timeout.patch
-misc-rtsx-set-null-intfdata-when-probe-fails.patch
-extcon-fix-extcon_get_extcon_dev-error-handling.patch
-extcon-modify-extcon-device-to-be-created-after-driv.patch
-clocksource-drivers-sp804-avoid-error-on-multiple-in.patch
-staging-rtl8712-fix-uninit-value-in-usb_read8-and-fr.patch
-staging-rtl8712-fix-uninit-value-in-r871xu_drv_init.patch
-serial-msm_serial-disable-interrupts-in-__msm_consol.patch
-kernfs-separate-kernfs_pr_cont_buf-and-rename_lock.patch
-watchdog-wdat_wdt-stop-watchdog-when-rebooting-the-s.patch
-md-protect-md_unregister_thread-from-reentrancy.patch
-scsi-myrb-fix-up-null-pointer-access-on-myrb_cleanup.patch
-revert-net-af_key-add-check-for-pfkey_broadcast-in-f.patch
-ceph-allow-ceph.dir.rctime-xattr-to-be-updatable.patch
-ceph-flush-the-mdlog-for-filesystem-sync.patch
-drm-amd-display-check-if-modulo-is-0-before-dividing.patch
-drm-radeon-fix-a-possible-null-pointer-dereference.patch
-drm-amd-pm-fix-missing-thermal-throttler-status.patch
-um-line-use-separate-irqs-per-line.patch
-modpost-fix-undefined-behavior-of-is_arm_mapping_sym.patch
-x86-cpu-elide-kcsan-for-cpu_has-and-friends.patch
-jump_label-noinstr-avoid-instrumentation-for-jump_la.patch
-nbd-call-genl_unregister_family-first-in-nbd_cleanup.patch
-nbd-fix-race-between-nbd_alloc_config-and-module-rem.patch
-nbd-fix-io-hung-while-disconnecting-device.patch
-s390-gmap-voluntarily-schedule-during-key-setting.patch
-cifs-version-operations-for-smb20-unneeded-when-lega.patch
-drm-amd-pm-use-bitmap_-from-to-_arr32-where-appropri.patch
-nodemask-fix-return-values-to-be-unsigned.patch
-iio-dummy-iio_simple_dummy-check-the-return-value-of.patch-24895
-staging-rtl8712-fix-a-potential-memory-leak-in-r871x.patch-25018
-iio-st_sensors-add-a-local-lock-for-protecting-odr.patch-18838
-lkdtm-usercopy-expand-size-of-out-of-frame-object.patch-7211
-drivers-staging-rtl8723bs-fix-deadlock-in-rtw_survey.patch-31465
-drivers-staging-rtl8192bs-fix-deadlock-in-rtw_joinbs.patch-22025
-tty-synclink_gt-fix-null-pointer-dereference-in-slgt.patch-19432
-tty-fix-a-possible-resource-leak-in-icom_probe.patch-30937
-thunderbolt-use-different-lane-for-second-displaypor.patch-15534
-drivers-staging-rtl8192u-fix-deadlock-in-ieee80211_b.patch-18732
-drivers-staging-rtl8192e-fix-deadlock-in-rtllib_beac.patch-16194
-usb-host-isp116x-check-return-value-after-calling-pl.patch-31308
-drivers-tty-serial-fix-deadlock-in-sa1100_set_termio.patch-18242
-drivers-usb-host-fix-deadlock-in-oxu_bus_suspend.patch-5520
-usb-hcd-pci-fully-suspend-across-freeze-thaw-cycle.patch-27502
-char-xillybus-fix-a-refcount-leak-in-cleanup_dev.patch-2530
-sysrq-do-not-omit-current-cpu-when-showing-backtrace.patch-17608
-usb-dwc2-gadget-don-t-reset-gadget-s-driver-bus.patch-29762
-soundwire-qcom-adjust-autoenumeration-timeout.patch-24099
-misc-rtsx-set-null-intfdata-when-probe-fails.patch-10195
-extcon-fix-extcon_get_extcon_dev-error-handling.patch-12300
-extcon-modify-extcon-device-to-be-created-after-driv.patch-17294
-clocksource-drivers-sp804-avoid-error-on-multiple-in.patch-7381
-staging-rtl8712-fix-uninit-value-in-usb_read8-and-fr.patch-8243
-staging-rtl8712-fix-uninit-value-in-r871xu_drv_init.patch-17162
-serial-msm_serial-disable-interrupts-in-__msm_consol.patch-27367
-kernfs-separate-kernfs_pr_cont_buf-and-rename_lock.patch-7900
-watchdog-wdat_wdt-stop-watchdog-when-rebooting-the-s.patch-28963
-md-protect-md_unregister_thread-from-reentrancy.patch-5047
-scsi-myrb-fix-up-null-pointer-access-on-myrb_cleanup.patch-14424
-revert-net-af_key-add-check-for-pfkey_broadcast-in-f.patch-18950
-ceph-allow-ceph.dir.rctime-xattr-to-be-updatable.patch-11743
-ceph-flush-the-mdlog-for-filesystem-sync.patch-7362
-drm-amd-display-check-if-modulo-is-0-before-dividing.patch-25207
-drm-radeon-fix-a-possible-null-pointer-dereference.patch-30982
-drm-amd-pm-fix-missing-thermal-throttler-status.patch-24102
-um-line-use-separate-irqs-per-line.patch-12639
-modpost-fix-undefined-behavior-of-is_arm_mapping_sym.patch-21788
-x86-cpu-elide-kcsan-for-cpu_has-and-friends.patch-31924
-jump_label-noinstr-avoid-instrumentation-for-jump_la.patch-22945
-nbd-call-genl_unregister_family-first-in-nbd_cleanup.patch-32656
-nbd-fix-race-between-nbd_alloc_config-and-module-rem.patch-26165
-nbd-fix-io-hung-while-disconnecting-device.patch-5525
-s390-gmap-voluntarily-schedule-during-key-setting.patch-29735
-cifs-version-operations-for-smb20-unneeded-when-lega.patch-7347
-drm-amd-pm-use-bitmap_-from-to-_arr32-where-appropri.patch-6683
-nodemask-fix-return-values-to-be-unsigned.patch-14192
-iio-dummy-iio_simple_dummy-check-the-return-value-of.patch-4161
-staging-rtl8712-fix-a-potential-memory-leak-in-r871x.patch-30288
-iio-st_sensors-add-a-local-lock-for-protecting-odr.patch-24617
-lkdtm-usercopy-expand-size-of-out-of-frame-object.patch-29094
-drivers-staging-rtl8723bs-fix-deadlock-in-rtw_survey.patch-22093
-drivers-staging-rtl8192bs-fix-deadlock-in-rtw_joinbs.patch-17800
-tty-synclink_gt-fix-null-pointer-dereference-in-slgt.patch-25077
-tty-fix-a-possible-resource-leak-in-icom_probe.patch-8636
-thunderbolt-use-different-lane-for-second-displaypor.patch-23449
-drivers-staging-rtl8192u-fix-deadlock-in-ieee80211_b.patch-26610
-drivers-staging-rtl8192e-fix-deadlock-in-rtllib_beac.patch-21932
-usb-host-isp116x-check-return-value-after-calling-pl.patch-16621
-drivers-tty-serial-fix-deadlock-in-sa1100_set_termio.patch-29326
-drivers-usb-host-fix-deadlock-in-oxu_bus_suspend.patch-19302
-usb-hcd-pci-fully-suspend-across-freeze-thaw-cycle.patch-23185
-char-xillybus-fix-a-refcount-leak-in-cleanup_dev.patch-17820
-sysrq-do-not-omit-current-cpu-when-showing-backtrace.patch-25539
-usb-dwc2-gadget-don-t-reset-gadget-s-driver-bus.patch-17403
-soundwire-qcom-adjust-autoenumeration-timeout.patch-22375
-misc-rtsx-set-null-intfdata-when-probe-fails.patch-8775
-extcon-fix-extcon_get_extcon_dev-error-handling.patch-28279
-extcon-modify-extcon-device-to-be-created-after-driv.patch-5865
-clocksource-drivers-sp804-avoid-error-on-multiple-in.patch-28408
-staging-rtl8712-fix-uninit-value-in-usb_read8-and-fr.patch-30658
-staging-rtl8712-fix-uninit-value-in-r871xu_drv_init.patch-4471
-serial-msm_serial-disable-interrupts-in-__msm_consol.patch-18130
-kernfs-separate-kernfs_pr_cont_buf-and-rename_lock.patch-28768
-watchdog-wdat_wdt-stop-watchdog-when-rebooting-the-s.patch-1029
-md-protect-md_unregister_thread-from-reentrancy.patch-27511
-scsi-myrb-fix-up-null-pointer-access-on-myrb_cleanup.patch-4447
-revert-net-af_key-add-check-for-pfkey_broadcast-in-f.patch-22075
-ceph-allow-ceph.dir.rctime-xattr-to-be-updatable.patch-2185
-ceph-flush-the-mdlog-for-filesystem-sync.patch-8289
-drm-amd-display-check-if-modulo-is-0-before-dividing.patch-11296
-drm-radeon-fix-a-possible-null-pointer-dereference.patch-9624
-drm-amd-pm-fix-missing-thermal-throttler-status.patch-32461
-um-line-use-separate-irqs-per-line.patch-13192
-modpost-fix-undefined-behavior-of-is_arm_mapping_sym.patch-6758
-x86-cpu-elide-kcsan-for-cpu_has-and-friends.patch-26688
-jump_label-noinstr-avoid-instrumentation-for-jump_la.patch-21845
-nbd-call-genl_unregister_family-first-in-nbd_cleanup.patch-7921
-nbd-fix-race-between-nbd_alloc_config-and-module-rem.patch-15991
-nbd-fix-io-hung-while-disconnecting-device.patch-20868
-s390-gmap-voluntarily-schedule-during-key-setting.patch-26653
-cifs-version-operations-for-smb20-unneeded-when-lega.patch-26096
-drm-amd-pm-use-bitmap_-from-to-_arr32-where-appropri.patch-15870
-nodemask-fix-return-values-to-be-unsigned.patch-5542
+++ /dev/null
-From 368311f57b4b91b2914235c2e90fbb4ee6ac94d2 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 6 May 2022 09:47:05 +0100
-Subject: soundwire: qcom: adjust autoenumeration timeout
-
-From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
-
-[ Upstream commit 74da272400b46f2e898f115d1b1cd60828766919 ]
-
-Currently timeout for autoenumeration during probe and bus reset is set to
-2 secs which is really a big value. This can have an adverse effect on
-boot time if the slave device is not ready/reset.
-This was the case with wcd938x which was not reset yet but we spent 2
-secs waiting in the soundwire controller probe. Reduce this time to
-1/10 of Hz which should be good enough time to finish autoenumeration
-if any slaves are available on the bus.
-
-Reported-by: Srinivasa Rao Mandadapu <quic_srivasam@quicinc.com>
-Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
-Link: https://lore.kernel.org/r/20220506084705.18525-1-srinivas.kandagatla@linaro.org
-Signed-off-by: Vinod Koul <vkoul@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/soundwire/qcom.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/soundwire/qcom.c b/drivers/soundwire/qcom.c
-index 0ef79d60e88e..f5955826b152 100644
---- a/drivers/soundwire/qcom.c
-+++ b/drivers/soundwire/qcom.c
-@@ -97,7 +97,7 @@
-
- #define SWRM_SPECIAL_CMD_ID 0xF
- #define MAX_FREQ_NUM 1
--#define TIMEOUT_MS (2 * HZ)
-+#define TIMEOUT_MS 100
- #define QCOM_SWRM_MAX_RD_LEN 0x1
- #define QCOM_SDW_MAX_PORTS 14
- #define DEFAULT_CLK_FREQ 9600000
---
-2.35.1
-
+++ /dev/null
-From 0bf09cac37e587fc7327051b186e65017675e809 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 5 Apr 2022 12:43:07 +0800
-Subject: staging: rtl8712: fix a potential memory leak in r871xu_drv_init()
-
-From: Xiaoke Wang <xkernel.wang@foxmail.com>
-
-[ Upstream commit 7288ff561de650d4139fab80e9cb0da9b5b32434 ]
-
-In r871xu_drv_init(), if r8712_init_drv_sw() fails, then the memory
-allocated by r8712_alloc_io_queue() in r8712_usb_dvobj_init() is not
-properly released as there is no action will be performed by
-r8712_usb_dvobj_deinit().
-To properly release it, we should call r8712_free_io_queue() in
-r8712_usb_dvobj_deinit().
-
-Besides, in r871xu_dev_remove(), r8712_usb_dvobj_deinit() will be called
-by r871x_dev_unload() under condition `padapter->bup` and
-r8712_free_io_queue() is called by r8712_free_drv_sw().
-However, r8712_usb_dvobj_deinit() does not rely on `padapter->bup` and
-calling r8712_free_io_queue() in r8712_free_drv_sw() is negative for
-better understading the code.
-So I move r8712_usb_dvobj_deinit() into r871xu_dev_remove(), and remove
-r8712_free_io_queue() from r8712_free_drv_sw().
-
-Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
-Signed-off-by: Xiaoke Wang <xkernel.wang@foxmail.com>
-Link: https://lore.kernel.org/r/tencent_B8048C592777830380A23A7C4409F9DF1305@qq.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/staging/rtl8712/os_intfs.c | 1 -
- drivers/staging/rtl8712/usb_intf.c | 6 +++---
- 2 files changed, 3 insertions(+), 4 deletions(-)
-
-diff --git a/drivers/staging/rtl8712/os_intfs.c b/drivers/staging/rtl8712/os_intfs.c
-index 9502f6aa5306..bc033849fcea 100644
---- a/drivers/staging/rtl8712/os_intfs.c
-+++ b/drivers/staging/rtl8712/os_intfs.c
-@@ -332,7 +332,6 @@ void r8712_free_drv_sw(struct _adapter *padapter)
- r8712_free_evt_priv(&padapter->evtpriv);
- r8712_DeInitSwLeds(padapter);
- r8712_free_mlme_priv(&padapter->mlmepriv);
-- r8712_free_io_queue(padapter);
- _free_xmit_priv(&padapter->xmitpriv);
- _r8712_free_sta_priv(&padapter->stapriv);
- _r8712_free_recv_priv(&padapter->recvpriv);
-diff --git a/drivers/staging/rtl8712/usb_intf.c b/drivers/staging/rtl8712/usb_intf.c
-index cae04272deff..a61dd96ab2a4 100644
---- a/drivers/staging/rtl8712/usb_intf.c
-+++ b/drivers/staging/rtl8712/usb_intf.c
-@@ -265,6 +265,7 @@ static uint r8712_usb_dvobj_init(struct _adapter *padapter)
-
- static void r8712_usb_dvobj_deinit(struct _adapter *padapter)
- {
-+ r8712_free_io_queue(padapter);
- }
-
- void rtl871x_intf_stop(struct _adapter *padapter)
-@@ -302,9 +303,6 @@ void r871x_dev_unload(struct _adapter *padapter)
- rtl8712_hal_deinit(padapter);
- }
-
-- /*s6.*/
-- if (padapter->dvobj_deinit)
-- padapter->dvobj_deinit(padapter);
- padapter->bup = false;
- }
- }
-@@ -607,6 +605,8 @@ static void r871xu_dev_remove(struct usb_interface *pusb_intf)
- /* Stop driver mlme relation timer */
- r8712_stop_drv_timers(padapter);
- r871x_dev_unload(padapter);
-+ if (padapter->dvobj_deinit)
-+ padapter->dvobj_deinit(padapter);
- r8712_free_drv_sw(padapter);
- free_netdev(pnetdev);
-
---
-2.35.1
-
+++ /dev/null
-From 0d69b9576e8068ba241541b2da7dfe057a6a4d3a Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 16 May 2022 17:22:41 +0800
-Subject: staging: rtl8712: fix uninit-value in r871xu_drv_init()
-
-From: Wang Cheng <wanngchenng@gmail.com>
-
-[ Upstream commit 0458e5428e5e959d201a40ffe71d762a79ecedc4 ]
-
-When 'tmpU1b' returns from r8712_read8(padapter, EE_9346CR) is 0,
-'mac[6]' will not be initialized.
-
-BUG: KMSAN: uninit-value in r871xu_drv_init+0x2d54/0x3070 drivers/staging/rtl8712/usb_intf.c:541
- r871xu_drv_init+0x2d54/0x3070 drivers/staging/rtl8712/usb_intf.c:541
- usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396
- really_probe+0x653/0x14b0 drivers/base/dd.c:596
- __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752
- driver_probe_device drivers/base/dd.c:782 [inline]
- __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899
- bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427
- __device_attach+0x593/0x8e0 drivers/base/dd.c:970
- device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017
- bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487
- device_add+0x1fff/0x26e0 drivers/base/core.c:3405
- usb_set_configuration+0x37e9/0x3ed0 drivers/usb/core/message.c:2170
- usb_generic_driver_probe+0x13c/0x300 drivers/usb/core/generic.c:238
- usb_probe_device+0x309/0x570 drivers/usb/core/driver.c:293
- really_probe+0x653/0x14b0 drivers/base/dd.c:596
- __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752
- driver_probe_device drivers/base/dd.c:782 [inline]
- __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899
- bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427
- __device_attach+0x593/0x8e0 drivers/base/dd.c:970
- device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017
- bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487
- device_add+0x1fff/0x26e0 drivers/base/core.c:3405
- usb_new_device+0x1b8e/0x2950 drivers/usb/core/hub.c:2566
- hub_port_connect drivers/usb/core/hub.c:5358 [inline]
- hub_port_connect_change drivers/usb/core/hub.c:5502 [inline]
- port_event drivers/usb/core/hub.c:5660 [inline]
- hub_event+0x58e3/0x89e0 drivers/usb/core/hub.c:5742
- process_one_work+0xdb6/0x1820 kernel/workqueue.c:2307
- worker_thread+0x10b3/0x21e0 kernel/workqueue.c:2454
- kthread+0x3c7/0x500 kernel/kthread.c:377
- ret_from_fork+0x1f/0x30
-
-Local variable mac created at:
- r871xu_drv_init+0x1771/0x3070 drivers/staging/rtl8712/usb_intf.c:394
- usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396
-
-KMSAN: uninit-value in r871xu_drv_init
-https://syzkaller.appspot.com/bug?id=3cd92b1d85428b128503bfa7a250294c9ae00bd8
-
-Reported-by: <syzbot+6f5ecd144854c0d8580b@syzkaller.appspotmail.com>
-Tested-by: <syzbot+6f5ecd144854c0d8580b@syzkaller.appspotmail.com>
-Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
-Signed-off-by: Wang Cheng <wanngchenng@gmail.com>
-Link: https://lore.kernel.org/r/14c3886173dfa4597f0704547c414cfdbcd11d16.1652618244.git.wanngchenng@gmail.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/staging/rtl8712/usb_intf.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/staging/rtl8712/usb_intf.c b/drivers/staging/rtl8712/usb_intf.c
-index a61dd96ab2a4..6db2493e6d3a 100644
---- a/drivers/staging/rtl8712/usb_intf.c
-+++ b/drivers/staging/rtl8712/usb_intf.c
-@@ -536,13 +536,13 @@ static int r871xu_drv_init(struct usb_interface *pusb_intf,
- } else {
- AutoloadFail = false;
- }
-- if (((mac[0] == 0xff) && (mac[1] == 0xff) &&
-+ if ((!AutoloadFail) ||
-+ ((mac[0] == 0xff) && (mac[1] == 0xff) &&
- (mac[2] == 0xff) && (mac[3] == 0xff) &&
- (mac[4] == 0xff) && (mac[5] == 0xff)) ||
- ((mac[0] == 0x00) && (mac[1] == 0x00) &&
- (mac[2] == 0x00) && (mac[3] == 0x00) &&
-- (mac[4] == 0x00) && (mac[5] == 0x00)) ||
-- (!AutoloadFail)) {
-+ (mac[4] == 0x00) && (mac[5] == 0x00))) {
- mac[0] = 0x00;
- mac[1] = 0xe0;
- mac[2] = 0x4c;
---
-2.35.1
-
+++ /dev/null
-From 21739d1e05f83f8f5e3fdaa179d782c74c47b587 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 16 May 2022 17:22:23 +0800
-Subject: staging: rtl8712: fix uninit-value in usb_read8() and friends
-
-From: Wang Cheng <wanngchenng@gmail.com>
-
-[ Upstream commit d1b57669732d09da7e13ef86d058dab0cd57f6e0 ]
-
-When r8712_usbctrl_vendorreq() returns negative, 'data' in
-usb_read{8,16,32} will not be initialized.
-
-BUG: KMSAN: uninit-value in string_nocheck lib/vsprintf.c:643 [inline]
-BUG: KMSAN: uninit-value in string+0x4ec/0x6f0 lib/vsprintf.c:725
- string_nocheck lib/vsprintf.c:643 [inline]
- string+0x4ec/0x6f0 lib/vsprintf.c:725
- vsnprintf+0x2222/0x3650 lib/vsprintf.c:2806
- va_format lib/vsprintf.c:1704 [inline]
- pointer+0x18e6/0x1f70 lib/vsprintf.c:2443
- vsnprintf+0x1a9b/0x3650 lib/vsprintf.c:2810
- vprintk_store+0x537/0x2150 kernel/printk/printk.c:2158
- vprintk_emit+0x28b/0xab0 kernel/printk/printk.c:2256
- dev_vprintk_emit+0x5ef/0x6d0 drivers/base/core.c:4604
- dev_printk_emit+0x1dd/0x21f drivers/base/core.c:4615
- __dev_printk+0x3be/0x440 drivers/base/core.c:4627
- _dev_info+0x1ea/0x22f drivers/base/core.c:4673
- r871xu_drv_init+0x1929/0x3070 drivers/staging/rtl8712/usb_intf.c:401
- usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396
- really_probe+0x6c7/0x1350 drivers/base/dd.c:621
- __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752
- driver_probe_device drivers/base/dd.c:782 [inline]
- __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899
- bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427
- __device_attach+0x593/0x8e0 drivers/base/dd.c:970
- device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017
- bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487
- device_add+0x1fff/0x26e0 drivers/base/core.c:3405
- usb_set_configuration+0x37e9/0x3ed0 drivers/usb/core/message.c:2170
- usb_generic_driver_probe+0x13c/0x300 drivers/usb/core/generic.c:238
- usb_probe_device+0x309/0x570 drivers/usb/core/driver.c:293
- really_probe+0x6c7/0x1350 drivers/base/dd.c:621
- __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752
- driver_probe_device drivers/base/dd.c:782 [inline]
- __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899
- bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427
- __device_attach+0x593/0x8e0 drivers/base/dd.c:970
- device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017
- bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487
- device_add+0x1fff/0x26e0 drivers/base/core.c:3405
- usb_new_device+0x1b91/0x2950 drivers/usb/core/hub.c:2566
- hub_port_connect drivers/usb/core/hub.c:5363 [inline]
- hub_port_connect_change drivers/usb/core/hub.c:5507 [inline]
- port_event drivers/usb/core/hub.c:5665 [inline]
- hub_event+0x58e3/0x89e0 drivers/usb/core/hub.c:5747
- process_one_work+0xdb6/0x1820 kernel/workqueue.c:2289
- worker_thread+0x10d0/0x2240 kernel/workqueue.c:2436
- kthread+0x3c7/0x500 kernel/kthread.c:376
- ret_from_fork+0x1f/0x30
-
-Local variable data created at:
- usb_read8+0x5d/0x130 drivers/staging/rtl8712/usb_ops.c:33
- r8712_read8+0xa5/0xd0 drivers/staging/rtl8712/rtl8712_io.c:29
-
-KMSAN: uninit-value in r871xu_drv_init
-https://syzkaller.appspot.com/bug?id=3cd92b1d85428b128503bfa7a250294c9ae00bd8
-
-Reported-by: <syzbot+6f5ecd144854c0d8580b@syzkaller.appspotmail.com>
-Tested-by: <syzbot+6f5ecd144854c0d8580b@syzkaller.appspotmail.com>
-Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
-Signed-off-by: Wang Cheng <wanngchenng@gmail.com>
-Link: https://lore.kernel.org/r/b9b7a6ee02c02aa28054f5cf16129977775f3cd9.1652618244.git.wanngchenng@gmail.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/staging/rtl8712/usb_ops.c | 27 ++++++++++++++++++---------
- 1 file changed, 18 insertions(+), 9 deletions(-)
-
-diff --git a/drivers/staging/rtl8712/usb_ops.c b/drivers/staging/rtl8712/usb_ops.c
-index e64845e6adf3..af9966d03979 100644
---- a/drivers/staging/rtl8712/usb_ops.c
-+++ b/drivers/staging/rtl8712/usb_ops.c
-@@ -29,7 +29,8 @@ static u8 usb_read8(struct intf_hdl *intfhdl, u32 addr)
- u16 wvalue;
- u16 index;
- u16 len;
-- __le32 data;
-+ int status;
-+ __le32 data = 0;
- struct intf_priv *intfpriv = intfhdl->pintfpriv;
-
- request = 0x05;
-@@ -37,8 +38,10 @@ static u8 usb_read8(struct intf_hdl *intfhdl, u32 addr)
- index = 0;
- wvalue = (u16)(addr & 0x0000ffff);
- len = 1;
-- r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index, &data, len,
-- requesttype);
-+ status = r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index,
-+ &data, len, requesttype);
-+ if (status < 0)
-+ return 0;
- return (u8)(le32_to_cpu(data) & 0x0ff);
- }
-
-@@ -49,7 +52,8 @@ static u16 usb_read16(struct intf_hdl *intfhdl, u32 addr)
- u16 wvalue;
- u16 index;
- u16 len;
-- __le32 data;
-+ int status;
-+ __le32 data = 0;
- struct intf_priv *intfpriv = intfhdl->pintfpriv;
-
- request = 0x05;
-@@ -57,8 +61,10 @@ static u16 usb_read16(struct intf_hdl *intfhdl, u32 addr)
- index = 0;
- wvalue = (u16)(addr & 0x0000ffff);
- len = 2;
-- r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index, &data, len,
-- requesttype);
-+ status = r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index,
-+ &data, len, requesttype);
-+ if (status < 0)
-+ return 0;
- return (u16)(le32_to_cpu(data) & 0xffff);
- }
-
-@@ -69,7 +75,8 @@ static u32 usb_read32(struct intf_hdl *intfhdl, u32 addr)
- u16 wvalue;
- u16 index;
- u16 len;
-- __le32 data;
-+ int status;
-+ __le32 data = 0;
- struct intf_priv *intfpriv = intfhdl->pintfpriv;
-
- request = 0x05;
-@@ -77,8 +84,10 @@ static u32 usb_read32(struct intf_hdl *intfhdl, u32 addr)
- index = 0;
- wvalue = (u16)(addr & 0x0000ffff);
- len = 4;
-- r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index, &data, len,
-- requesttype);
-+ status = r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index,
-+ &data, len, requesttype);
-+ if (status < 0)
-+ return 0;
- return le32_to_cpu(data);
- }
-
---
-2.35.1
-
+++ /dev/null
-From b3cc40d831759b937eb0a82911277d511e167952 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 17 Jan 2022 23:43:00 +0800
-Subject: sysrq: do not omit current cpu when showing backtrace of all active
- CPUs
-
-From: Changbin Du <changbin.du@gmail.com>
-
-[ Upstream commit 5390e7f46b9d5546d45a83e6463bc656678b1d0e ]
-
-The backtrace of current CPU also should be printed as it is active. This
-change add stack trace for current CPU and print a hint for idle CPU for
-the generic workqueue based printing. (x86 already does this)
-
-Now it looks like below:
-[ 279.401567] sysrq: Show backtrace of all active CPUs
-[ 279.407234] sysrq: CPU5:
-[ 279.407505] Call Trace:
-[ 279.408789] [<ffffffff8000606c>] dump_backtrace+0x2c/0x3a
-[ 279.411698] [<ffffffff800060ac>] show_stack+0x32/0x3e
-[ 279.411809] [<ffffffff80542258>] sysrq_handle_showallcpus+0x4c/0xc6
-[ 279.411929] [<ffffffff80542f16>] __handle_sysrq+0x106/0x26c
-[ 279.412034] [<ffffffff805436a8>] write_sysrq_trigger+0x64/0x74
-[ 279.412139] [<ffffffff8029cd48>] proc_reg_write+0x8e/0xe2
-[ 279.412252] [<ffffffff8021a8f8>] vfs_write+0x90/0x2be
-[ 279.412362] [<ffffffff8021acd2>] ksys_write+0xa6/0xce
-[ 279.412467] [<ffffffff8021ad24>] sys_write+0x2a/0x38
-[ 279.412689] [<ffffffff80003ff8>] ret_from_syscall+0x0/0x2
-[ 279.417173] sysrq: CPU6: backtrace skipped as idling
-[ 279.417185] sysrq: CPU4: backtrace skipped as idling
-[ 279.417187] sysrq: CPU0: backtrace skipped as idling
-[ 279.417181] sysrq: CPU7: backtrace skipped as idling
-[ 279.417190] sysrq: CPU1: backtrace skipped as idling
-[ 279.417193] sysrq: CPU3: backtrace skipped as idling
-[ 279.417219] sysrq: CPU2:
-[ 279.419179] Call Trace:
-[ 279.419440] [<ffffffff8000606c>] dump_backtrace+0x2c/0x3a
-[ 279.419782] [<ffffffff800060ac>] show_stack+0x32/0x3e
-[ 279.420015] [<ffffffff80542b30>] showacpu+0x5c/0x96
-[ 279.420317] [<ffffffff800ba71c>] flush_smp_call_function_queue+0xd6/0x218
-[ 279.420569] [<ffffffff800bb438>] generic_smp_call_function_single_interrupt+0x14/0x1c
-[ 279.420798] [<ffffffff800079ae>] handle_IPI+0xaa/0x13a
-[ 279.421024] [<ffffffff804dcb92>] riscv_intc_irq+0x56/0x70
-[ 279.421274] [<ffffffff80a05b70>] generic_handle_arch_irq+0x6a/0xfa
-[ 279.421518] [<ffffffff80004006>] ret_from_exception+0x0/0x10
-[ 279.421750] [<ffffffff80096492>] rcu_idle_enter+0x16/0x1e
-
-Signed-off-by: Changbin Du <changbin.du@gmail.com>
-Link: https://lore.kernel.org/r/20220117154300.2808-1-changbin.du@gmail.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/tty/sysrq.c | 13 +++++++++----
- 1 file changed, 9 insertions(+), 4 deletions(-)
-
-diff --git a/drivers/tty/sysrq.c b/drivers/tty/sysrq.c
-index c911196ac893..6b445ece8339 100644
---- a/drivers/tty/sysrq.c
-+++ b/drivers/tty/sysrq.c
-@@ -232,8 +232,10 @@ static void showacpu(void *dummy)
- unsigned long flags;
-
- /* Idle CPUs have no interesting backtrace. */
-- if (idle_cpu(smp_processor_id()))
-+ if (idle_cpu(smp_processor_id())) {
-+ pr_info("CPU%d: backtrace skipped as idling\n", smp_processor_id());
- return;
-+ }
-
- raw_spin_lock_irqsave(&show_lock, flags);
- pr_info("CPU%d:\n", smp_processor_id());
-@@ -260,10 +262,13 @@ static void sysrq_handle_showallcpus(int key)
-
- if (in_hardirq())
- regs = get_irq_regs();
-- if (regs) {
-- pr_info("CPU%d:\n", smp_processor_id());
-+
-+ pr_info("CPU%d:\n", smp_processor_id());
-+ if (regs)
- show_regs(regs);
-- }
-+ else
-+ show_stack(NULL, NULL, KERN_INFO);
-+
- schedule_work(&sysrq_showallcpus);
- }
- }
---
-2.35.1
-
+++ /dev/null
-From 5b96b03e999ae772b17be0961d72964faaaf6bae Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 1 Apr 2022 17:24:28 +0300
-Subject: thunderbolt: Use different lane for second DisplayPort tunnel
-
-From: Mika Westerberg <mika.westerberg@linux.intel.com>
-
-[ Upstream commit 9d2d0a5cf0ca063f417681cc33e767ce52615286 ]
-
-Brad reported that on Apple hardware with Light Ridge or Falcon Ridge
-controller, plugging in a chain of Thunderbolt displays (Light Ridge
-based controllers) causes all kinds of tearing and flickering. The
-reason for this is that on Thunderbolt 1 hardware there is no lane
-bonding so we have two independent 10 Gb/s lanes, and currently Linux
-tunnels both displays through the lane 1. This makes the displays to
-share the 10 Gb/s bandwidth which may not be enough for higher
-resolutions.
-
-For this reason make the second tunnel go through the lane 0 instead.
-This seems to match what the macOS connection manager is also doing.
-
-Reported-by: Brad Campbell <lists2009@fnarfbargle.com>
-Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
-Tested-by: Brad Campbell <lists2009@fnarfbargle.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/thunderbolt/tb.c | 19 +++++++++++++++++--
- drivers/thunderbolt/test.c | 16 ++++++++--------
- drivers/thunderbolt/tunnel.c | 11 ++++++-----
- drivers/thunderbolt/tunnel.h | 4 ++--
- 4 files changed, 33 insertions(+), 17 deletions(-)
-
-diff --git a/drivers/thunderbolt/tb.c b/drivers/thunderbolt/tb.c
-index 2897a77d44c3..b805b6939794 100644
---- a/drivers/thunderbolt/tb.c
-+++ b/drivers/thunderbolt/tb.c
-@@ -851,7 +851,7 @@ static struct tb_port *tb_find_dp_out(struct tb *tb, struct tb_port *in)
-
- static void tb_tunnel_dp(struct tb *tb)
- {
-- int available_up, available_down, ret;
-+ int available_up, available_down, ret, link_nr;
- struct tb_cm *tcm = tb_priv(tb);
- struct tb_port *port, *in, *out;
- struct tb_tunnel *tunnel;
-@@ -896,6 +896,20 @@ static void tb_tunnel_dp(struct tb *tb)
- return;
- }
-
-+ /*
-+ * This is only applicable to links that are not bonded (so
-+ * when Thunderbolt 1 hardware is involved somewhere in the
-+ * topology). For these try to share the DP bandwidth between
-+ * the two lanes.
-+ */
-+ link_nr = 1;
-+ list_for_each_entry(tunnel, &tcm->tunnel_list, list) {
-+ if (tb_tunnel_is_dp(tunnel)) {
-+ link_nr = 0;
-+ break;
-+ }
-+ }
-+
- /*
- * DP stream needs the domain to be active so runtime resume
- * both ends of the tunnel.
-@@ -927,7 +941,8 @@ static void tb_tunnel_dp(struct tb *tb)
- tb_dbg(tb, "available bandwidth for new DP tunnel %u/%u Mb/s\n",
- available_up, available_down);
-
-- tunnel = tb_tunnel_alloc_dp(tb, in, out, available_up, available_down);
-+ tunnel = tb_tunnel_alloc_dp(tb, in, out, link_nr, available_up,
-+ available_down);
- if (!tunnel) {
- tb_port_dbg(out, "could not allocate DP tunnel\n");
- goto err_reclaim;
-diff --git a/drivers/thunderbolt/test.c b/drivers/thunderbolt/test.c
-index 1f69bab236ee..66b6e665e96f 100644
---- a/drivers/thunderbolt/test.c
-+++ b/drivers/thunderbolt/test.c
-@@ -1348,7 +1348,7 @@ static void tb_test_tunnel_dp(struct kunit *test)
- in = &host->ports[5];
- out = &dev->ports[13];
-
-- tunnel = tb_tunnel_alloc_dp(NULL, in, out, 0, 0);
-+ tunnel = tb_tunnel_alloc_dp(NULL, in, out, 1, 0, 0);
- KUNIT_ASSERT_TRUE(test, tunnel != NULL);
- KUNIT_EXPECT_EQ(test, tunnel->type, TB_TUNNEL_DP);
- KUNIT_EXPECT_PTR_EQ(test, tunnel->src_port, in);
-@@ -1394,7 +1394,7 @@ static void tb_test_tunnel_dp_chain(struct kunit *test)
- in = &host->ports[5];
- out = &dev4->ports[14];
-
-- tunnel = tb_tunnel_alloc_dp(NULL, in, out, 0, 0);
-+ tunnel = tb_tunnel_alloc_dp(NULL, in, out, 1, 0, 0);
- KUNIT_ASSERT_TRUE(test, tunnel != NULL);
- KUNIT_EXPECT_EQ(test, tunnel->type, TB_TUNNEL_DP);
- KUNIT_EXPECT_PTR_EQ(test, tunnel->src_port, in);
-@@ -1444,7 +1444,7 @@ static void tb_test_tunnel_dp_tree(struct kunit *test)
- in = &dev2->ports[13];
- out = &dev5->ports[13];
-
-- tunnel = tb_tunnel_alloc_dp(NULL, in, out, 0, 0);
-+ tunnel = tb_tunnel_alloc_dp(NULL, in, out, 1, 0, 0);
- KUNIT_ASSERT_TRUE(test, tunnel != NULL);
- KUNIT_EXPECT_EQ(test, tunnel->type, TB_TUNNEL_DP);
- KUNIT_EXPECT_PTR_EQ(test, tunnel->src_port, in);
-@@ -1509,7 +1509,7 @@ static void tb_test_tunnel_dp_max_length(struct kunit *test)
- in = &dev6->ports[13];
- out = &dev12->ports[13];
-
-- tunnel = tb_tunnel_alloc_dp(NULL, in, out, 0, 0);
-+ tunnel = tb_tunnel_alloc_dp(NULL, in, out, 1, 0, 0);
- KUNIT_ASSERT_TRUE(test, tunnel != NULL);
- KUNIT_EXPECT_EQ(test, tunnel->type, TB_TUNNEL_DP);
- KUNIT_EXPECT_PTR_EQ(test, tunnel->src_port, in);
-@@ -1627,7 +1627,7 @@ static void tb_test_tunnel_port_on_path(struct kunit *test)
- in = &dev2->ports[13];
- out = &dev5->ports[13];
-
-- dp_tunnel = tb_tunnel_alloc_dp(NULL, in, out, 0, 0);
-+ dp_tunnel = tb_tunnel_alloc_dp(NULL, in, out, 1, 0, 0);
- KUNIT_ASSERT_TRUE(test, dp_tunnel != NULL);
-
- KUNIT_EXPECT_TRUE(test, tb_tunnel_port_on_path(dp_tunnel, in));
-@@ -2009,7 +2009,7 @@ static void tb_test_credit_alloc_dp(struct kunit *test)
- in = &host->ports[5];
- out = &dev->ports[14];
-
-- tunnel = tb_tunnel_alloc_dp(NULL, in, out, 0, 0);
-+ tunnel = tb_tunnel_alloc_dp(NULL, in, out, 1, 0, 0);
- KUNIT_ASSERT_TRUE(test, tunnel != NULL);
- KUNIT_ASSERT_EQ(test, tunnel->npaths, (size_t)3);
-
-@@ -2245,7 +2245,7 @@ static struct tb_tunnel *TB_TEST_DP_TUNNEL1(struct kunit *test,
-
- in = &host->ports[5];
- out = &dev->ports[13];
-- dp_tunnel1 = tb_tunnel_alloc_dp(NULL, in, out, 0, 0);
-+ dp_tunnel1 = tb_tunnel_alloc_dp(NULL, in, out, 1, 0, 0);
- KUNIT_ASSERT_TRUE(test, dp_tunnel1 != NULL);
- KUNIT_ASSERT_EQ(test, dp_tunnel1->npaths, (size_t)3);
-
-@@ -2282,7 +2282,7 @@ static struct tb_tunnel *TB_TEST_DP_TUNNEL2(struct kunit *test,
-
- in = &host->ports[6];
- out = &dev->ports[14];
-- dp_tunnel2 = tb_tunnel_alloc_dp(NULL, in, out, 0, 0);
-+ dp_tunnel2 = tb_tunnel_alloc_dp(NULL, in, out, 1, 0, 0);
- KUNIT_ASSERT_TRUE(test, dp_tunnel2 != NULL);
- KUNIT_ASSERT_EQ(test, dp_tunnel2->npaths, (size_t)3);
-
-diff --git a/drivers/thunderbolt/tunnel.c b/drivers/thunderbolt/tunnel.c
-index bb5cc480fc9a..bd98c719bf55 100644
---- a/drivers/thunderbolt/tunnel.c
-+++ b/drivers/thunderbolt/tunnel.c
-@@ -843,6 +843,7 @@ struct tb_tunnel *tb_tunnel_discover_dp(struct tb *tb, struct tb_port *in)
- * @tb: Pointer to the domain structure
- * @in: DP in adapter port
- * @out: DP out adapter port
-+ * @link_nr: Preferred lane adapter when the link is not bonded
- * @max_up: Maximum available upstream bandwidth for the DP tunnel (%0
- * if not limited)
- * @max_down: Maximum available downstream bandwidth for the DP tunnel
-@@ -854,8 +855,8 @@ struct tb_tunnel *tb_tunnel_discover_dp(struct tb *tb, struct tb_port *in)
- * Return: Returns a tb_tunnel on success or NULL on failure.
- */
- struct tb_tunnel *tb_tunnel_alloc_dp(struct tb *tb, struct tb_port *in,
-- struct tb_port *out, int max_up,
-- int max_down)
-+ struct tb_port *out, int link_nr,
-+ int max_up, int max_down)
- {
- struct tb_tunnel *tunnel;
- struct tb_path **paths;
-@@ -879,21 +880,21 @@ struct tb_tunnel *tb_tunnel_alloc_dp(struct tb *tb, struct tb_port *in,
- paths = tunnel->paths;
-
- path = tb_path_alloc(tb, in, TB_DP_VIDEO_HOPID, out, TB_DP_VIDEO_HOPID,
-- 1, "Video");
-+ link_nr, "Video");
- if (!path)
- goto err_free;
- tb_dp_init_video_path(path);
- paths[TB_DP_VIDEO_PATH_OUT] = path;
-
- path = tb_path_alloc(tb, in, TB_DP_AUX_TX_HOPID, out,
-- TB_DP_AUX_TX_HOPID, 1, "AUX TX");
-+ TB_DP_AUX_TX_HOPID, link_nr, "AUX TX");
- if (!path)
- goto err_free;
- tb_dp_init_aux_path(path);
- paths[TB_DP_AUX_PATH_OUT] = path;
-
- path = tb_path_alloc(tb, out, TB_DP_AUX_RX_HOPID, in,
-- TB_DP_AUX_RX_HOPID, 1, "AUX RX");
-+ TB_DP_AUX_RX_HOPID, link_nr, "AUX RX");
- if (!path)
- goto err_free;
- tb_dp_init_aux_path(path);
-diff --git a/drivers/thunderbolt/tunnel.h b/drivers/thunderbolt/tunnel.h
-index eea14e24f7e0..a92027431697 100644
---- a/drivers/thunderbolt/tunnel.h
-+++ b/drivers/thunderbolt/tunnel.h
-@@ -69,8 +69,8 @@ struct tb_tunnel *tb_tunnel_alloc_pci(struct tb *tb, struct tb_port *up,
- struct tb_port *down);
- struct tb_tunnel *tb_tunnel_discover_dp(struct tb *tb, struct tb_port *in);
- struct tb_tunnel *tb_tunnel_alloc_dp(struct tb *tb, struct tb_port *in,
-- struct tb_port *out, int max_up,
-- int max_down);
-+ struct tb_port *out, int link_nr,
-+ int max_up, int max_down);
- struct tb_tunnel *tb_tunnel_alloc_dma(struct tb *tb, struct tb_port *nhi,
- struct tb_port *dst, int transmit_path,
- int transmit_ring, int receive_path,
---
-2.35.1
-
+++ /dev/null
-From 84ef0f0bcb1952f7d87d311fcab83cf61819780d Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 31 Mar 2022 17:10:05 +0800
-Subject: tty: Fix a possible resource leak in icom_probe
-
-From: Huang Guobin <huangguobin4@huawei.com>
-
-[ Upstream commit ee157a79e7c82b01ae4c25de0ac75899801f322c ]
-
-When pci_read_config_dword failed, call pci_release_regions() and
-pci_disable_device() to recycle the resource previously allocated.
-
-Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
-Signed-off-by: Huang Guobin <huangguobin4@huawei.com>
-Link: https://lore.kernel.org/r/20220331091005.3290753-1-huangguobin4@huawei.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/tty/serial/icom.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/tty/serial/icom.c b/drivers/tty/serial/icom.c
-index 03a2fe9f4c9a..02b375ba2f07 100644
---- a/drivers/tty/serial/icom.c
-+++ b/drivers/tty/serial/icom.c
-@@ -1501,7 +1501,7 @@ static int icom_probe(struct pci_dev *dev,
- retval = pci_read_config_dword(dev, PCI_COMMAND, &command_reg);
- if (retval) {
- dev_err(&dev->dev, "PCI Config read FAILED\n");
-- return retval;
-+ goto probe_exit0;
- }
-
- pci_write_config_dword(dev, PCI_COMMAND,
---
-2.35.1
-
+++ /dev/null
-From 90e85f95371854241bb68b32958e7daf009616c6 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 10 Apr 2022 19:48:14 +0800
-Subject: tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
-
-From: Zheyu Ma <zheyuma97@gmail.com>
-
-[ Upstream commit 689ca31c542687709ba21ec2195c1fbce34fd029 ]
-
-When the driver fails at alloc_hdlcdev(), and then we remove the driver
-module, we will get the following splat:
-
-[ 25.065966] general protection fault, probably for non-canonical address 0xdffffc0000000182: 0000 [#1] PREEMPT SMP KASAN PTI
-[ 25.066914] KASAN: null-ptr-deref in range [0x0000000000000c10-0x0000000000000c17]
-[ 25.069262] RIP: 0010:detach_hdlc_protocol+0x2a/0x3e0
-[ 25.077709] Call Trace:
-[ 25.077924] <TASK>
-[ 25.078108] unregister_hdlc_device+0x16/0x30
-[ 25.078481] slgt_cleanup+0x157/0x9f0 [synclink_gt]
-
-Fix this by checking whether the 'info->netdev' is a null pointer first.
-
-Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
-Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
-Link: https://lore.kernel.org/r/20220410114814.3920474-1-zheyuma97@gmail.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/tty/synclink_gt.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/drivers/tty/synclink_gt.c b/drivers/tty/synclink_gt.c
-index 25c558e65ece..9bc2a9265277 100644
---- a/drivers/tty/synclink_gt.c
-+++ b/drivers/tty/synclink_gt.c
-@@ -1746,6 +1746,8 @@ static int hdlcdev_init(struct slgt_info *info)
- */
- static void hdlcdev_exit(struct slgt_info *info)
- {
-+ if (!info->netdev)
-+ return;
- unregister_hdlc_device(info->netdev);
- free_netdev(info->netdev);
- info->netdev = NULL;
---
-2.35.1
-
+++ /dev/null
-From 0d429d588bad9ec919939e3d2aca69685fffd956 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 6 May 2022 15:46:12 +0200
-Subject: um: line: Use separate IRQs per line
-
-From: Johannes Berg <johannes.berg@intel.com>
-
-[ Upstream commit d5a9597d6916a76663085db984cb8fe97f0a5c56 ]
-
-Today, all possible serial lines (ssl*=) as well as all
-possible consoles (con*=) each share a single interrupt
-(with a fixed number) with others of the same type.
-
-Now, if you have two lines, say ssl0 and ssl1, and one
-of them is connected to an fd you cannot read (e.g. a
-file), but the other gets a read interrupt, then both
-of them get the interrupt since it's shared. Then, the
-read() call will return EOF, since it's a file being
-written and there's nothing to read (at least not at
-the current offset, at the end).
-
-Unfortunately, this is treated as a read error, and we
-close this line, losing all the possible output.
-
-It might be possible to work around this and make the
-IRQ sharing work, however, now that we have dynamically
-allocated IRQs that are easy to use, simply use that to
-achieve separating between the events; then there's no
-interrupt for that line and we never attempt the read
-in the first place, thus not closing the line.
-
-This manifested itself in the wifi hostap/hwsim tests
-where the parallel script communicates via one serial
-console and the kernel messages go to another (a file)
-and sending data on the communication console caused
-the kernel messages to stop flowing into the file.
-
-Reported-by: Jouni Malinen <j@w1.fi>
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
-Acked-By: anton ivanov <anton.ivanov@cambridgegreys.com>
-Signed-off-by: Richard Weinberger <richard@nod.at>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/um/drivers/chan_kern.c | 10 +++++-----
- arch/um/drivers/line.c | 22 +++++++++++++---------
- arch/um/drivers/line.h | 4 ++--
- arch/um/drivers/ssl.c | 2 --
- arch/um/drivers/stdio_console.c | 2 --
- arch/um/include/asm/irq.h | 22 +++++++++-------------
- 6 files changed, 29 insertions(+), 33 deletions(-)
-
-diff --git a/arch/um/drivers/chan_kern.c b/arch/um/drivers/chan_kern.c
-index 62997055c454..26a702a06515 100644
---- a/arch/um/drivers/chan_kern.c
-+++ b/arch/um/drivers/chan_kern.c
-@@ -133,7 +133,7 @@ static void line_timer_cb(struct work_struct *work)
- struct line *line = container_of(work, struct line, task.work);
-
- if (!line->throttled)
-- chan_interrupt(line, line->driver->read_irq);
-+ chan_interrupt(line, line->read_irq);
- }
-
- int enable_chan(struct line *line)
-@@ -195,9 +195,9 @@ void free_irqs(void)
- chan = list_entry(ele, struct chan, free_list);
-
- if (chan->input && chan->enabled)
-- um_free_irq(chan->line->driver->read_irq, chan);
-+ um_free_irq(chan->line->read_irq, chan);
- if (chan->output && chan->enabled)
-- um_free_irq(chan->line->driver->write_irq, chan);
-+ um_free_irq(chan->line->write_irq, chan);
- chan->enabled = 0;
- }
- }
-@@ -215,9 +215,9 @@ static void close_one_chan(struct chan *chan, int delay_free_irq)
- spin_unlock_irqrestore(&irqs_to_free_lock, flags);
- } else {
- if (chan->input && chan->enabled)
-- um_free_irq(chan->line->driver->read_irq, chan);
-+ um_free_irq(chan->line->read_irq, chan);
- if (chan->output && chan->enabled)
-- um_free_irq(chan->line->driver->write_irq, chan);
-+ um_free_irq(chan->line->write_irq, chan);
- chan->enabled = 0;
- }
- if (chan->ops->close != NULL)
-diff --git a/arch/um/drivers/line.c b/arch/um/drivers/line.c
-index 8febf95da96e..02b0befd6763 100644
---- a/arch/um/drivers/line.c
-+++ b/arch/um/drivers/line.c
-@@ -139,7 +139,7 @@ static int flush_buffer(struct line *line)
- count = line->buffer + LINE_BUFSIZE - line->head;
-
- n = write_chan(line->chan_out, line->head, count,
-- line->driver->write_irq);
-+ line->write_irq);
- if (n < 0)
- return n;
- if (n == count) {
-@@ -156,7 +156,7 @@ static int flush_buffer(struct line *line)
-
- count = line->tail - line->head;
- n = write_chan(line->chan_out, line->head, count,
-- line->driver->write_irq);
-+ line->write_irq);
-
- if (n < 0)
- return n;
-@@ -195,7 +195,7 @@ int line_write(struct tty_struct *tty, const unsigned char *buf, int len)
- ret = buffer_data(line, buf, len);
- else {
- n = write_chan(line->chan_out, buf, len,
-- line->driver->write_irq);
-+ line->write_irq);
- if (n < 0) {
- ret = n;
- goto out_up;
-@@ -215,7 +215,7 @@ void line_throttle(struct tty_struct *tty)
- {
- struct line *line = tty->driver_data;
-
-- deactivate_chan(line->chan_in, line->driver->read_irq);
-+ deactivate_chan(line->chan_in, line->read_irq);
- line->throttled = 1;
- }
-
-@@ -224,7 +224,7 @@ void line_unthrottle(struct tty_struct *tty)
- struct line *line = tty->driver_data;
-
- line->throttled = 0;
-- chan_interrupt(line, line->driver->read_irq);
-+ chan_interrupt(line, line->read_irq);
- }
-
- static irqreturn_t line_write_interrupt(int irq, void *data)
-@@ -260,19 +260,23 @@ int line_setup_irq(int fd, int input, int output, struct line *line, void *data)
- int err;
-
- if (input) {
-- err = um_request_irq(driver->read_irq, fd, IRQ_READ,
-- line_interrupt, IRQF_SHARED,
-+ err = um_request_irq(UM_IRQ_ALLOC, fd, IRQ_READ,
-+ line_interrupt, 0,
- driver->read_irq_name, data);
- if (err < 0)
- return err;
-+
-+ line->read_irq = err;
- }
-
- if (output) {
-- err = um_request_irq(driver->write_irq, fd, IRQ_WRITE,
-- line_write_interrupt, IRQF_SHARED,
-+ err = um_request_irq(UM_IRQ_ALLOC, fd, IRQ_WRITE,
-+ line_write_interrupt, 0,
- driver->write_irq_name, data);
- if (err < 0)
- return err;
-+
-+ line->write_irq = err;
- }
-
- return 0;
-diff --git a/arch/um/drivers/line.h b/arch/um/drivers/line.h
-index bdb16b96e76f..f15be75a3bf3 100644
---- a/arch/um/drivers/line.h
-+++ b/arch/um/drivers/line.h
-@@ -23,9 +23,7 @@ struct line_driver {
- const short minor_start;
- const short type;
- const short subtype;
-- const int read_irq;
- const char *read_irq_name;
-- const int write_irq;
- const char *write_irq_name;
- struct mc_device mc;
- struct tty_driver *driver;
-@@ -35,6 +33,8 @@ struct line {
- struct tty_port port;
- int valid;
-
-+ int read_irq, write_irq;
-+
- char *init_str;
- struct list_head chan_list;
- struct chan *chan_in, *chan_out;
-diff --git a/arch/um/drivers/ssl.c b/arch/um/drivers/ssl.c
-index 41eae2e8fb65..8514966778d5 100644
---- a/arch/um/drivers/ssl.c
-+++ b/arch/um/drivers/ssl.c
-@@ -47,9 +47,7 @@ static struct line_driver driver = {
- .minor_start = 64,
- .type = TTY_DRIVER_TYPE_SERIAL,
- .subtype = 0,
-- .read_irq = SSL_IRQ,
- .read_irq_name = "ssl",
-- .write_irq = SSL_WRITE_IRQ,
- .write_irq_name = "ssl-write",
- .mc = {
- .list = LIST_HEAD_INIT(driver.mc.list),
-diff --git a/arch/um/drivers/stdio_console.c b/arch/um/drivers/stdio_console.c
-index e8b762f4d8c2..489d5a746ed3 100644
---- a/arch/um/drivers/stdio_console.c
-+++ b/arch/um/drivers/stdio_console.c
-@@ -53,9 +53,7 @@ static struct line_driver driver = {
- .minor_start = 0,
- .type = TTY_DRIVER_TYPE_CONSOLE,
- .subtype = SYSTEM_TYPE_CONSOLE,
-- .read_irq = CONSOLE_IRQ,
- .read_irq_name = "console",
-- .write_irq = CONSOLE_WRITE_IRQ,
- .write_irq_name = "console-write",
- .mc = {
- .list = LIST_HEAD_INIT(driver.mc.list),
-diff --git a/arch/um/include/asm/irq.h b/arch/um/include/asm/irq.h
-index e187c789369d..749dfe8512e8 100644
---- a/arch/um/include/asm/irq.h
-+++ b/arch/um/include/asm/irq.h
-@@ -4,19 +4,15 @@
-
- #define TIMER_IRQ 0
- #define UMN_IRQ 1
--#define CONSOLE_IRQ 2
--#define CONSOLE_WRITE_IRQ 3
--#define UBD_IRQ 4
--#define UM_ETH_IRQ 5
--#define SSL_IRQ 6
--#define SSL_WRITE_IRQ 7
--#define ACCEPT_IRQ 8
--#define MCONSOLE_IRQ 9
--#define WINCH_IRQ 10
--#define SIGIO_WRITE_IRQ 11
--#define TELNETD_IRQ 12
--#define XTERM_IRQ 13
--#define RANDOM_IRQ 14
-+#define UBD_IRQ 2
-+#define UM_ETH_IRQ 3
-+#define ACCEPT_IRQ 4
-+#define MCONSOLE_IRQ 5
-+#define WINCH_IRQ 6
-+#define SIGIO_WRITE_IRQ 7
-+#define TELNETD_IRQ 8
-+#define XTERM_IRQ 9
-+#define RANDOM_IRQ 10
-
- #ifdef CONFIG_UML_NET_VECTOR
-
---
-2.35.1
-
+++ /dev/null
-From c6cc9e374ea0f52a2776013d0436edaab51e4bb3 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 5 May 2022 12:46:18 +0200
-Subject: usb: dwc2: gadget: don't reset gadget's driver->bus
-
-From: Marek Szyprowski <m.szyprowski@samsung.com>
-
-[ Upstream commit 3120aac6d0ecd9accf56894aeac0e265f74d3d5a ]
-
-UDC driver should not touch gadget's driver internals, especially it
-should not reset driver->bus. This wasn't harmful so far, but since
-commit fc274c1e9973 ("USB: gadget: Add a new bus for gadgets") gadget
-subsystem got it's own bus and messing with ->bus triggers the
-following NULL pointer dereference:
-
-dwc2 12480000.hsotg: bound driver g_ether
-8<--- cut here ---
-Unable to handle kernel NULL pointer dereference at virtual address 00000000
-[00000000] *pgd=00000000
-Internal error: Oops: 5 [#1] SMP ARM
-Modules linked in: ...
-CPU: 0 PID: 620 Comm: modprobe Not tainted 5.18.0-rc5-next-20220504 #11862
-Hardware name: Samsung Exynos (Flattened Device Tree)
-PC is at module_add_driver+0x44/0xe8
-LR is at sysfs_do_create_link_sd+0x84/0xe0
-...
-Process modprobe (pid: 620, stack limit = 0x(ptrval))
-...
- module_add_driver from bus_add_driver+0xf4/0x1e4
- bus_add_driver from driver_register+0x78/0x10c
- driver_register from usb_gadget_register_driver_owner+0x40/0xb4
- usb_gadget_register_driver_owner from do_one_initcall+0x44/0x1e0
- do_one_initcall from do_init_module+0x44/0x1c8
- do_init_module from load_module+0x19b8/0x1b9c
- load_module from sys_finit_module+0xdc/0xfc
- sys_finit_module from ret_fast_syscall+0x0/0x54
-Exception stack(0xf1771fa8 to 0xf1771ff0)
-...
-dwc2 12480000.hsotg: new device is high-speed
----[ end trace 0000000000000000 ]---
-
-Fix this by removing driver->bus entry reset.
-
-Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
-Link: https://lore.kernel.org/r/20220505104618.22729-1-m.szyprowski@samsung.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/dwc2/gadget.c | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
-index 0909b088a284..e1cebf581a4a 100644
---- a/drivers/usb/dwc2/gadget.c
-+++ b/drivers/usb/dwc2/gadget.c
-@@ -4544,7 +4544,6 @@ static int dwc2_hsotg_udc_start(struct usb_gadget *gadget,
-
- WARN_ON(hsotg->driver);
-
-- driver->driver.bus = NULL;
- hsotg->driver = driver;
- hsotg->gadget.dev.of_node = hsotg->dev->of_node;
- hsotg->gadget.speed = USB_SPEED_UNKNOWN;
---
-2.35.1
-
+++ /dev/null
-From 238b5d99974acbd8d985bf2a7076092318d975b7 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 21 Apr 2022 10:39:27 -0700
-Subject: USB: hcd-pci: Fully suspend across freeze/thaw cycle
-
-From: Evan Green <evgreen@chromium.org>
-
-[ Upstream commit 63acaa8e9c65dc34dc249440216f8e977f5d2748 ]
-
-The documentation for the freeze() method says that it "should quiesce
-the device so that it doesn't generate IRQs or DMA". The unspoken
-consequence of not doing this is that MSIs aimed at non-boot CPUs may
-get fully lost if they're sent during the period where the target CPU is
-offline.
-
-The current callbacks for USB HCD do not fully quiesce interrupts,
-specifically on XHCI. Change to use the full suspend/resume flow for
-freeze/thaw to ensure interrupts are fully quiesced. This fixes issues
-where USB devices fail to thaw during hibernation because XHCI misses
-its interrupt and cannot recover.
-
-Acked-by: Alan Stern <stern@rowland.harvard.edu>
-Signed-off-by: Evan Green <evgreen@chromium.org>
-Link: https://lore.kernel.org/r/20220421103751.v3.2.I8226c7fdae88329ef70957b96a39b346c69a914e@changeid
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/core/hcd-pci.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c
-index d630cccd2e6e..5af810cd8a58 100644
---- a/drivers/usb/core/hcd-pci.c
-+++ b/drivers/usb/core/hcd-pci.c
-@@ -616,10 +616,10 @@ const struct dev_pm_ops usb_hcd_pci_pm_ops = {
- .suspend_noirq = hcd_pci_suspend_noirq,
- .resume_noirq = hcd_pci_resume_noirq,
- .resume = hcd_pci_resume,
-- .freeze = check_root_hub_suspended,
-+ .freeze = hcd_pci_suspend,
- .freeze_noirq = check_root_hub_suspended,
- .thaw_noirq = NULL,
-- .thaw = NULL,
-+ .thaw = hcd_pci_resume,
- .poweroff = hcd_pci_suspend,
- .poweroff_noirq = hcd_pci_suspend_noirq,
- .restore_noirq = hcd_pci_resume_noirq,
---
-2.35.1
-
+++ /dev/null
-From 771fffe3e1f07ea821c9de6e50263d40c29115bb Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 2 Mar 2022 11:37:16 +0800
-Subject: USB: host: isp116x: check return value after calling
- platform_get_resource()
-
-From: Zhen Ni <nizhen@uniontech.com>
-
-[ Upstream commit 134a3408c2d3f7e23eb0e4556e0a2d9f36c2614e ]
-
-It will cause null-ptr-deref if platform_get_resource() returns NULL,
-we need check the return value.
-
-Signed-off-by: Zhen Ni <nizhen@uniontech.com>
-Link: https://lore.kernel.org/r/20220302033716.31272-1-nizhen@uniontech.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/host/isp116x-hcd.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/usb/host/isp116x-hcd.c b/drivers/usb/host/isp116x-hcd.c
-index 8835f6bd528e..8c7f0991c21b 100644
---- a/drivers/usb/host/isp116x-hcd.c
-+++ b/drivers/usb/host/isp116x-hcd.c
-@@ -1541,10 +1541,12 @@ static int isp116x_remove(struct platform_device *pdev)
-
- iounmap(isp116x->data_reg);
- res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
-- release_mem_region(res->start, 2);
-+ if (res)
-+ release_mem_region(res->start, 2);
- iounmap(isp116x->addr_reg);
- res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-- release_mem_region(res->start, 2);
-+ if (res)
-+ release_mem_region(res->start, 2);
-
- usb_put_hcd(hcd);
- return 0;
---
-2.35.1
-
+++ /dev/null
-From 5c85e0ea8418da36cf5eb27b3e217f79a811502a Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 26 Apr 2022 22:53:29 +0800
-Subject: watchdog: wdat_wdt: Stop watchdog when rebooting the system
-
-From: Liu Xinpeng <liuxp11@chinatelecom.cn>
-
-[ Upstream commit 27fdf84510a1374748904db43f6755f912736d92 ]
-
-Executing reboot command several times on the machine "Dell
-PowerEdge R740", UEFI security detection stopped machine
-with the following prompt:
-
-UEFI0082: The system was reset due to a timeout from the watchdog
-timer. Check the System Event Log (SEL) or crash dumps from
-Operating Sysstem to identify the source that triggered the
-watchdog timer reset. Update the firmware or driver for the
-identified device.
-
-iDRAC has warning event: "The watchdog timer reset the system".
-
-This patch fixes this issue by adding the reboot notifier.
-
-Signed-off-by: Liu Xinpeng <liuxp11@chinatelecom.cn>
-Reviewed-by: Guenter Roeck <linux@roeck-us.net>
-Link: https://lore.kernel.org/r/1650984810-6247-3-git-send-email-liuxp11@chinatelecom.cn
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
-Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/watchdog/wdat_wdt.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/drivers/watchdog/wdat_wdt.c b/drivers/watchdog/wdat_wdt.c
-index 195c8c004b69..4fac8148a8e6 100644
---- a/drivers/watchdog/wdat_wdt.c
-+++ b/drivers/watchdog/wdat_wdt.c
-@@ -462,6 +462,7 @@ static int wdat_wdt_probe(struct platform_device *pdev)
- return ret;
-
- watchdog_set_nowayout(&wdat->wdd, nowayout);
-+ watchdog_stop_on_reboot(&wdat->wdd);
- return devm_watchdog_register_device(dev, &wdat->wdd);
- }
-
---
-2.35.1
-
+++ /dev/null
-From 9fc9454781e24e6bba48b445c1282d6dbe8a2bb7 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 2 May 2022 12:15:23 +0200
-Subject: x86/cpu: Elide KCSAN for cpu_has() and friends
-
-From: Peter Zijlstra <peterz@infradead.org>
-
-[ Upstream commit a6a5eb269f6f3a2fe392f725a8d9052190c731e2 ]
-
-As x86 uses the <asm-generic/bitops/instrumented-*.h> headers, the
-regular forms of all bitops are instrumented with explicit calls to
-KASAN and KCSAN checks. As these are explicit calls, these are not
-suppressed by the noinstr function attribute.
-
-This can result in calls to those check functions in noinstr code, which
-objtool warns about:
-
-vmlinux.o: warning: objtool: enter_from_user_mode+0x24: call to __kcsan_check_access() leaves .noinstr.text section
-vmlinux.o: warning: objtool: syscall_enter_from_user_mode+0x28: call to __kcsan_check_access() leaves .noinstr.text section
-vmlinux.o: warning: objtool: syscall_enter_from_user_mode_prepare+0x24: call to __kcsan_check_access() leaves .noinstr.text section
-vmlinux.o: warning: objtool: irqentry_enter_from_user_mode+0x24: call to __kcsan_check_access() leaves .noinstr.text section
-
-Prevent this by using the arch_*() bitops, which are the underlying
-bitops without explciit instrumentation.
-
-[null: Changelog]
-Reported-by: kernel test robot <lkp@intel.com>
-Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
-Link: https://lkml.kernel.org/r/20220502111216.290518605@infradead.org
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/x86/include/asm/cpufeature.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h
-index 16a51e7288d5..b0f206681fde 100644
---- a/arch/x86/include/asm/cpufeature.h
-+++ b/arch/x86/include/asm/cpufeature.h
-@@ -51,7 +51,7 @@ extern const char * const x86_power_flags[32];
- extern const char * const x86_bug_flags[NBUGINTS*32];
-
- #define test_cpu_cap(c, bit) \
-- test_bit(bit, (unsigned long *)((c)->x86_capability))
-+ arch_test_bit(bit, (unsigned long *)((c)->x86_capability))
-
- /*
- * There are 32 bits/features in each mask word. The high bits
---
-2.35.1
-
+++ /dev/null
-From d53aeec3a3e70c3e319a6c0e0685a1f18282cc6d Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 16 May 2022 18:30:55 +0800
-Subject: ASoC: rt5640: Do not manipulate pin "Platform Clock" if the "Platform
- Clock" is not in the DAPM
-
-From: Oder Chiou <oder_chiou@realtek.com>
-
-[ Upstream commit 832296804bc7171730884e78c761c29f6d258e13 ]
-
-The pin "Platform Clock" was only used by the Intel Byt CR platform. In the
-others, the error log will be informed. The patch will set the flag to
-avoid the pin "Platform Clock" manipulated by the other platforms.
-
-Signed-off-by: Oder Chiou <oder_chiou@realtek.com>
-Reported-by: Sameer Pujar <spujar@nvidia.com>
-Link: https://lore.kernel.org/r/20220516103055.20003-1-oder_chiou@realtek.com
-Signed-off-by: Mark Brown <broonie@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- sound/soc/codecs/rt5640.c | 11 +++++++++--
- sound/soc/codecs/rt5640.h | 2 ++
- sound/soc/intel/boards/bytcr_rt5640.c | 2 ++
- 3 files changed, 13 insertions(+), 2 deletions(-)
-
-diff --git a/sound/soc/codecs/rt5640.c b/sound/soc/codecs/rt5640.c
-index e7a82565b905..f078463346e8 100644
---- a/sound/soc/codecs/rt5640.c
-+++ b/sound/soc/codecs/rt5640.c
-@@ -2097,12 +2097,14 @@ EXPORT_SYMBOL_GPL(rt5640_sel_asrc_clk_src);
- void rt5640_enable_micbias1_for_ovcd(struct snd_soc_component *component)
- {
- struct snd_soc_dapm_context *dapm = snd_soc_component_get_dapm(component);
-+ struct rt5640_priv *rt5640 = snd_soc_component_get_drvdata(component);
-
- snd_soc_dapm_mutex_lock(dapm);
- snd_soc_dapm_force_enable_pin_unlocked(dapm, "LDO2");
- snd_soc_dapm_force_enable_pin_unlocked(dapm, "MICBIAS1");
- /* OVCD is unreliable when used with RCCLK as sysclk-source */
-- snd_soc_dapm_force_enable_pin_unlocked(dapm, "Platform Clock");
-+ if (rt5640->use_platform_clock)
-+ snd_soc_dapm_force_enable_pin_unlocked(dapm, "Platform Clock");
- snd_soc_dapm_sync_unlocked(dapm);
- snd_soc_dapm_mutex_unlock(dapm);
- }
-@@ -2111,9 +2113,11 @@ EXPORT_SYMBOL_GPL(rt5640_enable_micbias1_for_ovcd);
- void rt5640_disable_micbias1_for_ovcd(struct snd_soc_component *component)
- {
- struct snd_soc_dapm_context *dapm = snd_soc_component_get_dapm(component);
-+ struct rt5640_priv *rt5640 = snd_soc_component_get_drvdata(component);
-
- snd_soc_dapm_mutex_lock(dapm);
-- snd_soc_dapm_disable_pin_unlocked(dapm, "Platform Clock");
-+ if (rt5640->use_platform_clock)
-+ snd_soc_dapm_disable_pin_unlocked(dapm, "Platform Clock");
- snd_soc_dapm_disable_pin_unlocked(dapm, "MICBIAS1");
- snd_soc_dapm_disable_pin_unlocked(dapm, "LDO2");
- snd_soc_dapm_sync_unlocked(dapm);
-@@ -2538,6 +2542,9 @@ static void rt5640_enable_jack_detect(struct snd_soc_component *component,
- rt5640->jd_gpio_irq_requested = true;
- }
-
-+ if (jack_data && jack_data->use_platform_clock)
-+ rt5640->use_platform_clock = jack_data->use_platform_clock;
-+
- ret = request_irq(rt5640->irq, rt5640_irq,
- IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
- "rt5640", rt5640);
-diff --git a/sound/soc/codecs/rt5640.h b/sound/soc/codecs/rt5640.h
-index 9e49b9a0ccaa..505c93514051 100644
---- a/sound/soc/codecs/rt5640.h
-+++ b/sound/soc/codecs/rt5640.h
-@@ -2155,11 +2155,13 @@ struct rt5640_priv {
- bool jd_inverted;
- unsigned int ovcd_th;
- unsigned int ovcd_sf;
-+ bool use_platform_clock;
- };
-
- struct rt5640_set_jack_data {
- int codec_irq_override;
- struct gpio_desc *jd_gpio;
-+ bool use_platform_clock;
- };
-
- int rt5640_dmic_enable(struct snd_soc_component *component,
-diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c
-index b5ac226c59e1..754cc4fc706d 100644
---- a/sound/soc/intel/boards/bytcr_rt5640.c
-+++ b/sound/soc/intel/boards/bytcr_rt5640.c
-@@ -1191,12 +1191,14 @@ static int byt_rt5640_init(struct snd_soc_pcm_runtime *runtime)
- {
- struct snd_soc_card *card = runtime->card;
- struct byt_rt5640_private *priv = snd_soc_card_get_drvdata(card);
-+ struct rt5640_set_jack_data *jack_data = &priv->jack_data;
- struct snd_soc_component *component = asoc_rtd_to_codec(runtime, 0)->component;
- const struct snd_soc_dapm_route *custom_map = NULL;
- int num_routes = 0;
- int ret;
-
- card->dapm.idle_bias_off = true;
-+ jack_data->use_platform_clock = true;
-
- /* Start with RC clk for jack-detect (we disable MCLK below) */
- if (byt_rt5640_quirk & BYT_RT5640_MCLK_EN)
---
-2.35.1
-
+++ /dev/null
-From 2aa5354db7e598d806767a94109388300a56f46f Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 10 Mar 2022 09:34:19 -0500
-Subject: ceph: allow ceph.dir.rctime xattr to be updatable
-
-From: Venky Shankar <vshankar@redhat.com>
-
-[ Upstream commit d7a2dc523085f8b8c60548ceedc696934aefeb0e ]
-
-`rctime' has been a pain point in cephfs due to its buggy
-nature - inconsistent values reported and those sorts.
-Fixing rctime is non-trivial needing an overall redesign
-of the entire nested statistics infrastructure.
-
-As a workaround, PR
-
- http://github.com/ceph/ceph/pull/37938
-
-allows this extended attribute to be manually set. This allows
-users to "fixup" inconsistent rctime values. While this sounds
-messy, its probably the wisest approach allowing users/scripts
-to workaround buggy rctime values.
-
-The above PR enables Ceph MDS to allow manually setting
-rctime extended attribute with the corresponding user-land
-changes. We may as well allow the same to be done via kclient
-for parity.
-
-Signed-off-by: Venky Shankar <vshankar@redhat.com>
-Reviewed-by: Xiubo Li <xiubli@redhat.com>
-Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/ceph/xattr.c | 10 +++++++++-
- 1 file changed, 9 insertions(+), 1 deletion(-)
-
-diff --git a/fs/ceph/xattr.c b/fs/ceph/xattr.c
-index fcf7dfdecf96..e41b22bd66ce 100644
---- a/fs/ceph/xattr.c
-+++ b/fs/ceph/xattr.c
-@@ -366,6 +366,14 @@ static ssize_t ceph_vxattrcb_auth_mds(struct ceph_inode_info *ci,
- }
- #define XATTR_RSTAT_FIELD(_type, _name) \
- XATTR_NAME_CEPH(_type, _name, VXATTR_FLAG_RSTAT)
-+#define XATTR_RSTAT_FIELD_UPDATABLE(_type, _name) \
-+ { \
-+ .name = CEPH_XATTR_NAME(_type, _name), \
-+ .name_size = sizeof (CEPH_XATTR_NAME(_type, _name)), \
-+ .getxattr_cb = ceph_vxattrcb_ ## _type ## _ ## _name, \
-+ .exists_cb = NULL, \
-+ .flags = VXATTR_FLAG_RSTAT, \
-+ }
- #define XATTR_LAYOUT_FIELD(_type, _name, _field) \
- { \
- .name = CEPH_XATTR_NAME2(_type, _name, _field), \
-@@ -404,7 +412,7 @@ static struct ceph_vxattr ceph_dir_vxattrs[] = {
- XATTR_RSTAT_FIELD(dir, rsubdirs),
- XATTR_RSTAT_FIELD(dir, rsnaps),
- XATTR_RSTAT_FIELD(dir, rbytes),
-- XATTR_RSTAT_FIELD(dir, rctime),
-+ XATTR_RSTAT_FIELD_UPDATABLE(dir, rctime),
- {
- .name = "ceph.dir.pin",
- .name_size = sizeof("ceph.dir.pin"),
---
-2.35.1
-
+++ /dev/null
-From 350b4d04994e593fbba16e23080827a7209979ef Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 19 Apr 2022 08:58:49 +0800
-Subject: ceph: flush the mdlog for filesystem sync
-
-From: Xiubo Li <xiubli@redhat.com>
-
-[ Upstream commit 1b2ba3c5616e17ff951359e25c658a1c3f146f1e ]
-
-Before waiting for a request's safe reply, we will send the mdlog flush
-request to the relevant MDS. And this will also flush the mdlog for all
-the other unsafe requests in the same session, so we can record the last
-session and no need to flush mdlog again in the next loop. But there
-still have cases that it may send the mdlog flush requst twice or more,
-but that should be not often.
-
-Rename wait_unsafe_requests() to
-flush_mdlog_and_wait_mdsc_unsafe_requests() to make it more
-descriptive.
-
-[xiubli: fold in MDS request refcount leak fix from Jeff]
-
-URL: https://tracker.ceph.com/issues/55284
-URL: https://tracker.ceph.com/issues/55411
-Signed-off-by: Xiubo Li <xiubli@redhat.com>
-Reviewed-by: Jeff Layton <jlayton@kernel.org>
-Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/ceph/mds_client.c | 33 +++++++++++++++++++++++++++------
- 1 file changed, 27 insertions(+), 6 deletions(-)
-
-diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
-index b34d6286ee90..7744db8f5bb0 100644
---- a/fs/ceph/mds_client.c
-+++ b/fs/ceph/mds_client.c
-@@ -4709,15 +4709,17 @@ void ceph_mdsc_pre_umount(struct ceph_mds_client *mdsc)
- }
-
- /*
-- * wait for all write mds requests to flush.
-+ * flush the mdlog and wait for all write mds requests to flush.
- */
--static void wait_unsafe_requests(struct ceph_mds_client *mdsc, u64 want_tid)
-+static void flush_mdlog_and_wait_mdsc_unsafe_requests(struct ceph_mds_client *mdsc,
-+ u64 want_tid)
- {
- struct ceph_mds_request *req = NULL, *nextreq;
-+ struct ceph_mds_session *last_session = NULL;
- struct rb_node *n;
-
- mutex_lock(&mdsc->mutex);
-- dout("wait_unsafe_requests want %lld\n", want_tid);
-+ dout("%s want %lld\n", __func__, want_tid);
- restart:
- req = __get_oldest_req(mdsc);
- while (req && req->r_tid <= want_tid) {
-@@ -4729,14 +4731,32 @@ static void wait_unsafe_requests(struct ceph_mds_client *mdsc, u64 want_tid)
- nextreq = NULL;
- if (req->r_op != CEPH_MDS_OP_SETFILELOCK &&
- (req->r_op & CEPH_MDS_OP_WRITE)) {
-+ struct ceph_mds_session *s = req->r_session;
-+
-+ if (!s) {
-+ req = nextreq;
-+ continue;
-+ }
-+
- /* write op */
- ceph_mdsc_get_request(req);
- if (nextreq)
- ceph_mdsc_get_request(nextreq);
-+ s = ceph_get_mds_session(s);
- mutex_unlock(&mdsc->mutex);
-- dout("wait_unsafe_requests wait on %llu (want %llu)\n",
-+
-+ /* send flush mdlog request to MDS */
-+ if (last_session != s) {
-+ send_flush_mdlog(s);
-+ ceph_put_mds_session(last_session);
-+ last_session = s;
-+ } else {
-+ ceph_put_mds_session(s);
-+ }
-+ dout("%s wait on %llu (want %llu)\n", __func__,
- req->r_tid, want_tid);
- wait_for_completion(&req->r_safe_completion);
-+
- mutex_lock(&mdsc->mutex);
- ceph_mdsc_put_request(req);
- if (!nextreq)
-@@ -4751,7 +4771,8 @@ static void wait_unsafe_requests(struct ceph_mds_client *mdsc, u64 want_tid)
- req = nextreq;
- }
- mutex_unlock(&mdsc->mutex);
-- dout("wait_unsafe_requests done\n");
-+ ceph_put_mds_session(last_session);
-+ dout("%s done\n", __func__);
- }
-
- void ceph_mdsc_sync(struct ceph_mds_client *mdsc)
-@@ -4780,7 +4801,7 @@ void ceph_mdsc_sync(struct ceph_mds_client *mdsc)
- dout("sync want tid %lld flush_seq %lld\n",
- want_tid, want_flush);
-
-- wait_unsafe_requests(mdsc, want_tid);
-+ flush_mdlog_and_wait_mdsc_unsafe_requests(mdsc, want_tid);
- wait_caps_flush(mdsc, want_flush);
- }
-
---
-2.35.1
-
+++ /dev/null
-From 32572ab0677d8f16c1ffc74ad0d849611f7079ad Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 6 Apr 2022 15:57:03 +0800
-Subject: char: xillybus: fix a refcount leak in cleanup_dev()
-
-From: Hangyu Hua <hbh25y@gmail.com>
-
-[ Upstream commit b67d19662fdee275c479d21853bc1239600a798f ]
-
-usb_get_dev is called in xillyusb_probe. So it is better to call
-usb_put_dev before xdev is released.
-
-Acked-by: Eli Billauer <eli.billauer@gmail.com>
-Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
-Link: https://lore.kernel.org/r/20220406075703.23464-1-hbh25y@gmail.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/char/xillybus/xillyusb.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/drivers/char/xillybus/xillyusb.c b/drivers/char/xillybus/xillyusb.c
-index dc3551796e5e..39bcbfd908b4 100644
---- a/drivers/char/xillybus/xillyusb.c
-+++ b/drivers/char/xillybus/xillyusb.c
-@@ -549,6 +549,7 @@ static void cleanup_dev(struct kref *kref)
- if (xdev->workq)
- destroy_workqueue(xdev->workq);
-
-+ usb_put_dev(xdev->udev);
- kfree(xdev->channels); /* Argument may be NULL, and that's fine */
- kfree(xdev);
- }
---
-2.35.1
-
+++ /dev/null
-From b340e2af62d5f9c2c6071e417760ec78faa81425 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 1 Jun 2022 22:08:46 -0500
-Subject: cifs: version operations for smb20 unneeded when legacy support
- disabled
-
-From: Steve French <stfrench@microsoft.com>
-
-[ Upstream commit 7ef93ffccd55fb0ba000ed16ef6a81cd7dee07b5 ]
-
-We should not be including unused smb20 specific code when legacy
-support is disabled (CONFIG_CIFS_ALLOW_INSECURE_LEGACY turned
-off). For example smb2_operations and smb2_values aren't used
-in that case. Over time we can move more and more SMB1/CIFS and SMB2.0
-code into the insecure legacy ifdefs
-
-Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com>
-Signed-off-by: Steve French <stfrench@microsoft.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/cifs/cifsglob.h | 4 +++-
- fs/cifs/smb2ops.c | 7 ++++++-
- 2 files changed, 9 insertions(+), 2 deletions(-)
-
-diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
-index 7f28fe8f6ba7..bf6cc128436a 100644
---- a/fs/cifs/cifsglob.h
-+++ b/fs/cifs/cifsglob.h
-@@ -1915,11 +1915,13 @@ extern mempool_t *cifs_mid_poolp;
-
- /* Operations for different SMB versions */
- #define SMB1_VERSION_STRING "1.0"
-+#define SMB20_VERSION_STRING "2.0"
-+#ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
- extern struct smb_version_operations smb1_operations;
- extern struct smb_version_values smb1_values;
--#define SMB20_VERSION_STRING "2.0"
- extern struct smb_version_operations smb20_operations;
- extern struct smb_version_values smb20_values;
-+#endif /* CIFS_ALLOW_INSECURE_LEGACY */
- #define SMB21_VERSION_STRING "2.1"
- extern struct smb_version_operations smb21_operations;
- extern struct smb_version_values smb21_values;
-diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
-index ab74a678fb93..e0a1cb4b9f19 100644
---- a/fs/cifs/smb2ops.c
-+++ b/fs/cifs/smb2ops.c
-@@ -4297,11 +4297,13 @@ smb3_set_oplock_level(struct cifsInodeInfo *cinode, __u32 oplock,
- }
- }
-
-+#ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
- static bool
- smb2_is_read_op(__u32 oplock)
- {
- return oplock == SMB2_OPLOCK_LEVEL_II;
- }
-+#endif /* CIFS_ALLOW_INSECURE_LEGACY */
-
- static bool
- smb21_is_read_op(__u32 oplock)
-@@ -5400,7 +5402,7 @@ smb2_make_node(unsigned int xid, struct inode *inode,
- return rc;
- }
-
--
-+#ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
- struct smb_version_operations smb20_operations = {
- .compare_fids = smb2_compare_fids,
- .setup_request = smb2_setup_request,
-@@ -5499,6 +5501,7 @@ struct smb_version_operations smb20_operations = {
- .is_status_io_timeout = smb2_is_status_io_timeout,
- .is_network_name_deleted = smb2_is_network_name_deleted,
- };
-+#endif /* CIFS_ALLOW_INSECURE_LEGACY */
-
- struct smb_version_operations smb21_operations = {
- .compare_fids = smb2_compare_fids,
-@@ -5830,6 +5833,7 @@ struct smb_version_operations smb311_operations = {
- .is_network_name_deleted = smb2_is_network_name_deleted,
- };
-
-+#ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
- struct smb_version_values smb20_values = {
- .version_string = SMB20_VERSION_STRING,
- .protocol_id = SMB20_PROT_ID,
-@@ -5850,6 +5854,7 @@ struct smb_version_values smb20_values = {
- .signing_required = SMB2_NEGOTIATE_SIGNING_REQUIRED,
- .create_lease_size = sizeof(struct create_lease),
- };
-+#endif /* ALLOW_INSECURE_LEGACY */
-
- struct smb_version_values smb21_values = {
- .version_string = SMB21_VERSION_STRING,
---
-2.35.1
-
+++ /dev/null
-From c5b63e926992a4c8bfd05cad1b3c3becf518b472 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 6 May 2022 17:25:22 +0100
-Subject: clocksource/drivers/sp804: Avoid error on multiple instances
-
-From: Andre Przywara <andre.przywara@arm.com>
-
-[ Upstream commit a98399cbc1e05f7b977419f03905501d566cf54e ]
-
-When a machine sports more than one SP804 timer instance, we only bring
-up the first one, since multiple timers of the same kind are not useful
-to Linux. As this is intentional behaviour, we should not return an
-error message, as we do today:
-===============
-[ 0.000800] Failed to initialize '/bus@8000000/motherboard-bus@8000000/iofpga-bus@300000000/timer@120000': -22
-===============
-
-Replace the -EINVAL return with a debug message and return 0 instead.
-
-Also we do not reach the init function anymore if the DT node is
-disabled (as this is now handled by OF_DECLARE), so remove the explicit
-check for that case.
-
-This fixes a long standing bogus error when booting ARM's fastmodels.
-
-Signed-off-by: Andre Przywara <andre.przywara@arm.com>
-Reviewed-by: Robin Murphy <robin.murphy@arm.com>
-Link: https://lore.kernel.org/r/20220506162522.3675399-1-andre.przywara@arm.com
-Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/clocksource/timer-sp804.c | 10 +++++-----
- 1 file changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/drivers/clocksource/timer-sp804.c b/drivers/clocksource/timer-sp804.c
-index 401d592e85f5..e6a87f4af2b5 100644
---- a/drivers/clocksource/timer-sp804.c
-+++ b/drivers/clocksource/timer-sp804.c
-@@ -259,6 +259,11 @@ static int __init sp804_of_init(struct device_node *np, struct sp804_timer *time
- struct clk *clk1, *clk2;
- const char *name = of_get_property(np, "compatible", NULL);
-
-+ if (initialized) {
-+ pr_debug("%pOF: skipping further SP804 timer device\n", np);
-+ return 0;
-+ }
-+
- base = of_iomap(np, 0);
- if (!base)
- return -ENXIO;
-@@ -270,11 +275,6 @@ static int __init sp804_of_init(struct device_node *np, struct sp804_timer *time
- writel(0, timer1_base + timer->ctrl);
- writel(0, timer2_base + timer->ctrl);
-
-- if (initialized || !of_device_is_available(np)) {
-- ret = -EINVAL;
-- goto err;
-- }
--
- clk1 = of_clk_get(np, 0);
- if (IS_ERR(clk1))
- clk1 = NULL;
---
-2.35.1
-
+++ /dev/null
-From fe46cfe0b45420f22c18ec84120ac45aa052572c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 9 Apr 2022 14:49:53 +0800
-Subject: drivers: staging: rtl8192bs: Fix deadlock in
- rtw_joinbss_event_prehandle()
-
-From: Duoming Zhou <duoming@zju.edu.cn>
-
-[ Upstream commit 041879b12ddb0c6c83ed9c0bdd10dc82a056f2fc ]
-
-There is a deadlock in rtw_joinbss_event_prehandle(), which is shown
-below:
-
- (Thread 1) | (Thread 2)
- | _set_timer()
-rtw_joinbss_event_prehandle()| mod_timer()
- spin_lock_bh() //(1) | (wait a time)
- ... | _rtw_join_timeout_handler()
- del_timer_sync() | spin_lock_bh() //(2)
- (wait timer to stop) | ...
-
-We hold pmlmepriv->lock in position (1) of thread 1 and
-use del_timer_sync() to wait timer to stop, but timer handler
-also need pmlmepriv->lock in position (2) of thread 2.
-As a result, rtw_joinbss_event_prehandle() will block forever.
-
-This patch extracts del_timer_sync() from the protection of
-spin_lock_bh(), which could let timer handler to obtain
-the needed lock. What`s more, we change spin_lock_bh() to
-spin_lock_irq() in _rtw_join_timeout_handler() in order to
-prevent deadlock.
-
-Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
-Link: https://lore.kernel.org/r/20220409064953.67420-1-duoming@zju.edu.cn
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/staging/rtl8723bs/core/rtw_mlme.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/staging/rtl8723bs/core/rtw_mlme.c b/drivers/staging/rtl8723bs/core/rtw_mlme.c
-index a6e5f2332e12..c29e3c68e61e 100644
---- a/drivers/staging/rtl8723bs/core/rtw_mlme.c
-+++ b/drivers/staging/rtl8723bs/core/rtw_mlme.c
-@@ -1240,8 +1240,10 @@ void rtw_joinbss_event_prehandle(struct adapter *adapter, u8 *pbuf)
-
- spin_unlock_bh(&pmlmepriv->scanned_queue.lock);
-
-+ spin_unlock_bh(&pmlmepriv->lock);
- /* s5. Cancel assoc_timer */
- del_timer_sync(&pmlmepriv->assoc_timer);
-+ spin_lock_bh(&pmlmepriv->lock);
- } else {
- spin_unlock_bh(&(pmlmepriv->scanned_queue.lock));
- }
-@@ -1547,7 +1549,7 @@ void _rtw_join_timeout_handler(struct timer_list *t)
- if (adapter->bDriverStopped || adapter->bSurpriseRemoved)
- return;
-
-- spin_lock_bh(&pmlmepriv->lock);
-+ spin_lock_irq(&pmlmepriv->lock);
-
- if (rtw_to_roam(adapter) > 0) { /* join timeout caused by roaming */
- while (1) {
-@@ -1575,7 +1577,7 @@ void _rtw_join_timeout_handler(struct timer_list *t)
-
- }
-
-- spin_unlock_bh(&pmlmepriv->lock);
-+ spin_unlock_irq(&pmlmepriv->lock);
- }
-
- /*
---
-2.35.1
-
+++ /dev/null
-From 83c365d7dbdcdd45c2c43ca5fd2a7c74c7da863c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 17 Apr 2022 22:16:41 +0800
-Subject: drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop()
-
-From: Duoming Zhou <duoming@zju.edu.cn>
-
-[ Upstream commit 9b6bdbd9337de3917945847bde262a34a87a6303 ]
-
-There is a deadlock in rtllib_beacons_stop(), which is shown
-below:
-
- (Thread 1) | (Thread 2)
- | rtllib_send_beacon()
-rtllib_beacons_stop() | mod_timer()
- spin_lock_irqsave() //(1) | (wait a time)
- ... | rtllib_send_beacon_cb()
- del_timer_sync() | spin_lock_irqsave() //(2)
- (wait timer to stop) | ...
-
-We hold ieee->beacon_lock in position (1) of thread 1 and
-use del_timer_sync() to wait timer to stop, but timer handler
-also need ieee->beacon_lock in position (2) of thread 2.
-As a result, rtllib_beacons_stop() will block forever.
-
-This patch extracts del_timer_sync() from the protection of
-spin_lock_irqsave(), which could let timer handler to obtain
-the needed lock.
-
-Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
-Link: https://lore.kernel.org/r/20220417141641.124388-1-duoming@zju.edu.cn
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/staging/rtl8192e/rtllib_softmac.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/staging/rtl8192e/rtllib_softmac.c b/drivers/staging/rtl8192e/rtllib_softmac.c
-index 4b6c2295a3cf..b5a38f0a8d79 100644
---- a/drivers/staging/rtl8192e/rtllib_softmac.c
-+++ b/drivers/staging/rtl8192e/rtllib_softmac.c
-@@ -651,9 +651,9 @@ static void rtllib_beacons_stop(struct rtllib_device *ieee)
- spin_lock_irqsave(&ieee->beacon_lock, flags);
-
- ieee->beacon_txing = 0;
-- del_timer_sync(&ieee->beacon_timer);
-
- spin_unlock_irqrestore(&ieee->beacon_lock, flags);
-+ del_timer_sync(&ieee->beacon_timer);
-
- }
-
---
-2.35.1
-
+++ /dev/null
-From d4850d3a0c3712b99a339ad302032b04e87d48ef Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 17 Apr 2022 21:54:07 +0800
-Subject: drivers: staging: rtl8192u: Fix deadlock in ieee80211_beacons_stop()
-
-From: Duoming Zhou <duoming@zju.edu.cn>
-
-[ Upstream commit 806c7b53414934ba2a39449b31fd1a038e500273 ]
-
-There is a deadlock in ieee80211_beacons_stop(), which is shown below:
-
- (Thread 1) | (Thread 2)
- | ieee80211_send_beacon()
-ieee80211_beacons_stop() | mod_timer()
- spin_lock_irqsave() //(1) | (wait a time)
- ... | ieee80211_send_beacon_cb()
- del_timer_sync() | spin_lock_irqsave() //(2)
- (wait timer to stop) | ...
-
-We hold ieee->beacon_lock in position (1) of thread 1 and use
-del_timer_sync() to wait timer to stop, but timer handler
-also need ieee->beacon_lock in position (2) of thread 2.
-As a result, ieee80211_beacons_stop() will block forever.
-
-This patch extracts del_timer_sync() from the protection of
-spin_lock_irqsave(), which could let timer handler to obtain
-the needed lock.
-
-Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
-Link: https://lore.kernel.org/r/20220417135407.109536-1-duoming@zju.edu.cn
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c b/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c
-index 1a43979939a8..79f3fbe25556 100644
---- a/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c
-+++ b/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c
-@@ -528,9 +528,9 @@ static void ieee80211_beacons_stop(struct ieee80211_device *ieee)
- spin_lock_irqsave(&ieee->beacon_lock, flags);
-
- ieee->beacon_txing = 0;
-- del_timer_sync(&ieee->beacon_timer);
-
- spin_unlock_irqrestore(&ieee->beacon_lock, flags);
-+ del_timer_sync(&ieee->beacon_timer);
- }
-
- void ieee80211_stop_send_beacons(struct ieee80211_device *ieee)
---
-2.35.1
-
+++ /dev/null
-From 49f8593ac1291083fad5c9a7ce2600bb0dbf885a Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 9 Apr 2022 14:18:35 +0800
-Subject: drivers: staging: rtl8723bs: Fix deadlock in
- rtw_surveydone_event_callback()
-
-From: Duoming Zhou <duoming@zju.edu.cn>
-
-[ Upstream commit cc7ad0d77b51c872d629bcd98aea463a3c4109e7 ]
-
-There is a deadlock in rtw_surveydone_event_callback(),
-which is shown below:
-
- (Thread 1) | (Thread 2)
- | _set_timer()
-rtw_surveydone_event_callback()| mod_timer()
- spin_lock_bh() //(1) | (wait a time)
- ... | rtw_scan_timeout_handler()
- del_timer_sync() | spin_lock_bh() //(2)
- (wait timer to stop) | ...
-
-We hold pmlmepriv->lock in position (1) of thread 1 and use
-del_timer_sync() to wait timer to stop, but timer handler
-also need pmlmepriv->lock in position (2) of thread 2.
-As a result, rtw_surveydone_event_callback() will block forever.
-
-This patch extracts del_timer_sync() from the protection of
-spin_lock_bh(), which could let timer handler to obtain
-the needed lock. What`s more, we change spin_lock_bh() in
-rtw_scan_timeout_handler() to spin_lock_irq(). Otherwise,
-spin_lock_bh() will also cause deadlock() in timer handler.
-
-Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
-Link: https://lore.kernel.org/r/20220409061836.60529-1-duoming@zju.edu.cn
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/staging/rtl8723bs/core/rtw_mlme.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/staging/rtl8723bs/core/rtw_mlme.c b/drivers/staging/rtl8723bs/core/rtw_mlme.c
-index 9202223ebc0c..a6e5f2332e12 100644
---- a/drivers/staging/rtl8723bs/core/rtw_mlme.c
-+++ b/drivers/staging/rtl8723bs/core/rtw_mlme.c
-@@ -751,7 +751,9 @@ void rtw_surveydone_event_callback(struct adapter *adapter, u8 *pbuf)
- }
-
- if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY)) {
-+ spin_unlock_bh(&pmlmepriv->lock);
- del_timer_sync(&pmlmepriv->scan_to_timer);
-+ spin_lock_bh(&pmlmepriv->lock);
- _clr_fwstate_(pmlmepriv, _FW_UNDER_SURVEY);
- }
-
-@@ -1586,11 +1588,11 @@ void rtw_scan_timeout_handler(struct timer_list *t)
- mlmepriv.scan_to_timer);
- struct mlme_priv *pmlmepriv = &adapter->mlmepriv;
-
-- spin_lock_bh(&pmlmepriv->lock);
-+ spin_lock_irq(&pmlmepriv->lock);
-
- _clr_fwstate_(pmlmepriv, _FW_UNDER_SURVEY);
-
-- spin_unlock_bh(&pmlmepriv->lock);
-+ spin_unlock_irq(&pmlmepriv->lock);
-
- rtw_indicate_scan_done(adapter, true);
- }
---
-2.35.1
-
+++ /dev/null
-From 1cd4834d730e47a87f64767ad1963da38c6ac523 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 17 Apr 2022 19:16:26 +0800
-Subject: drivers: tty: serial: Fix deadlock in sa1100_set_termios()
-
-From: Duoming Zhou <duoming@zju.edu.cn>
-
-[ Upstream commit 62b2caef400c1738b6d22f636c628d9f85cd4c4c ]
-
-There is a deadlock in sa1100_set_termios(), which is shown
-below:
-
- (Thread 1) | (Thread 2)
- | sa1100_enable_ms()
-sa1100_set_termios() | mod_timer()
- spin_lock_irqsave() //(1) | (wait a time)
- ... | sa1100_timeout()
- del_timer_sync() | spin_lock_irqsave() //(2)
- (wait timer to stop) | ...
-
-We hold sport->port.lock in position (1) of thread 1 and
-use del_timer_sync() to wait timer to stop, but timer handler
-also need sport->port.lock in position (2) of thread 2. As a result,
-sa1100_set_termios() will block forever.
-
-This patch moves del_timer_sync() before spin_lock_irqsave()
-in order to prevent the deadlock.
-
-Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
-Link: https://lore.kernel.org/r/20220417111626.7802-1-duoming@zju.edu.cn
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/tty/serial/sa1100.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/tty/serial/sa1100.c b/drivers/tty/serial/sa1100.c
-index 697b6a002a16..4ddcc985621a 100644
---- a/drivers/tty/serial/sa1100.c
-+++ b/drivers/tty/serial/sa1100.c
-@@ -446,6 +446,8 @@ sa1100_set_termios(struct uart_port *port, struct ktermios *termios,
- baud = uart_get_baud_rate(port, termios, old, 0, port->uartclk/16);
- quot = uart_get_divisor(port, baud);
-
-+ del_timer_sync(&sport->timer);
-+
- spin_lock_irqsave(&sport->port.lock, flags);
-
- sport->port.read_status_mask &= UTSR0_TO_SM(UTSR0_TFS);
-@@ -476,8 +478,6 @@ sa1100_set_termios(struct uart_port *port, struct ktermios *termios,
- UTSR1_TO_SM(UTSR1_ROR);
- }
-
-- del_timer_sync(&sport->timer);
--
- /*
- * Update the per-port timeout.
- */
---
-2.35.1
-
+++ /dev/null
-From e08c778353ce8957cdd9f42e264c13388051171c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 17 Apr 2022 20:03:05 +0800
-Subject: drivers: usb: host: Fix deadlock in oxu_bus_suspend()
-
-From: Duoming Zhou <duoming@zju.edu.cn>
-
-[ Upstream commit 4d378f2ae58138d4c55684e1d274e7dd94aa6524 ]
-
-There is a deadlock in oxu_bus_suspend(), which is shown below:
-
- (Thread 1) | (Thread 2)
- | timer_action()
-oxu_bus_suspend() | mod_timer()
- spin_lock_irq() //(1) | (wait a time)
- ... | oxu_watchdog()
- del_timer_sync() | spin_lock_irq() //(2)
- (wait timer to stop) | ...
-
-We hold oxu->lock in position (1) of thread 1, and use
-del_timer_sync() to wait timer to stop, but timer handler
-also need oxu->lock in position (2) of thread 2. As a result,
-oxu_bus_suspend() will block forever.
-
-This patch extracts del_timer_sync() from the protection of
-spin_lock_irq(), which could let timer handler to obtain
-the needed lock.
-
-Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
-Link: https://lore.kernel.org/r/20220417120305.64577-1-duoming@zju.edu.cn
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/host/oxu210hp-hcd.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/drivers/usb/host/oxu210hp-hcd.c b/drivers/usb/host/oxu210hp-hcd.c
-index e82ff2a49672..4f5498521e1b 100644
---- a/drivers/usb/host/oxu210hp-hcd.c
-+++ b/drivers/usb/host/oxu210hp-hcd.c
-@@ -3909,8 +3909,10 @@ static int oxu_bus_suspend(struct usb_hcd *hcd)
- }
- }
-
-+ spin_unlock_irq(&oxu->lock);
- /* turn off now-idle HC */
- del_timer_sync(&oxu->watchdog);
-+ spin_lock_irq(&oxu->lock);
- ehci_halt(oxu);
- hcd->state = HC_STATE_SUSPENDED;
-
---
-2.35.1
-
+++ /dev/null
-From d1c2bc44385b034f6caac8b44bd3e85a7405fd45 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 3 May 2022 18:30:25 -0400
-Subject: drm/amd/display: Check if modulo is 0 before dividing.
-
-From: David Galiffi <David.Galiffi@amd.com>
-
-[ Upstream commit 49947b906a6bd9668eaf4f9cf691973c25c26955 ]
-
-[How & Why]
-If a value of 0 is read, then this will cause a divide-by-0 panic.
-
-Reviewed-by: Martin Leung <Martin.Leung@amd.com>
-Acked-by: Qingqing Zhuo <qingqing.zhuo@amd.com>
-Signed-off-by: David Galiffi <David.Galiffi@amd.com>
-Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
-Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c | 9 ++++++---
- 1 file changed, 6 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c b/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c
-index 2c7eb982eabc..054823d12403 100644
---- a/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c
-+++ b/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c
-@@ -1013,9 +1013,12 @@ static bool get_pixel_clk_frequency_100hz(
- * not be programmed equal to DPREFCLK
- */
- modulo_hz = REG_READ(MODULO[inst]);
-- *pixel_clk_khz = div_u64((uint64_t)clock_hz*
-- clock_source->ctx->dc->clk_mgr->dprefclk_khz*10,
-- modulo_hz);
-+ if (modulo_hz)
-+ *pixel_clk_khz = div_u64((uint64_t)clock_hz*
-+ clock_source->ctx->dc->clk_mgr->dprefclk_khz*10,
-+ modulo_hz);
-+ else
-+ *pixel_clk_khz = 0;
- } else {
- /* NOTE: There is agreement with VBIOS here that MODULO is
- * programmed equal to DPREFCLK, in which case PHASE will be
---
-2.35.1
-
+++ /dev/null
-From dae0d0a77847df84e41ebd781d6854e1efc37980 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 17 May 2022 17:57:46 +0800
-Subject: drm/amd/pm: fix a potential gpu_metrics_table memory leak
-
-From: Gong Yuanjun <ruc_gongyuanjun@163.com>
-
-[ Upstream commit d2f4460a3d9502513419f06cc376c7ade49d5753 ]
-
-gpu_metrics_table is allocated in yellow_carp_init_smc_tables() but
-not freed in yellow_carp_fini_smc_tables().
-
-Signed-off-by: Gong Yuanjun <ruc_gongyuanjun@163.com>
-Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/amd/pm/swsmu/smu13/yellow_carp_ppt.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/yellow_carp_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/yellow_carp_ppt.c
-index d0715927b07f..13461e28aeed 100644
---- a/drivers/gpu/drm/amd/pm/swsmu/smu13/yellow_carp_ppt.c
-+++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/yellow_carp_ppt.c
-@@ -190,6 +190,9 @@ static int yellow_carp_fini_smc_tables(struct smu_context *smu)
- kfree(smu_table->watermarks_table);
- smu_table->watermarks_table = NULL;
-
-+ kfree(smu_table->gpu_metrics_table);
-+ smu_table->gpu_metrics_table = NULL;
-+
- return 0;
- }
-
---
-2.35.1
-
+++ /dev/null
-From a987929a48334130242f31d4f09f234e9cd2528e Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 19 May 2022 10:50:25 +0530
-Subject: drm/amd/pm: Fix missing thermal throttler status
-
-From: Lijo Lazar <lijo.lazar@amd.com>
-
-[ Upstream commit b0f4d663fce6a4232d3c20ce820f919111b1c60b ]
-
-On aldebaran, when thermal throttling happens due to excessive GPU
-temperature, the reason for throttling event is missed in warning
-message. This patch fixes it.
-
-Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
-Reviewed-by: Yang Wang <kevinyang.wang@amd.com>
-Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c
-index 4885c4ae78b7..27a54145d352 100644
---- a/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c
-+++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c
-@@ -1643,6 +1643,7 @@ static const struct throttling_logging_label {
- uint32_t feature_mask;
- const char *label;
- } logging_label[] = {
-+ {(1U << THROTTLER_TEMP_GPU_BIT), "GPU"},
- {(1U << THROTTLER_TEMP_MEM_BIT), "HBM"},
- {(1U << THROTTLER_TEMP_VR_GFX_BIT), "VR of GFX rail"},
- {(1U << THROTTLER_TEMP_VR_MEM_BIT), "VR of HBM rail"},
---
-2.35.1
-
+++ /dev/null
-From fc42b8a84fb3a975a5aacb14e7477288ffbf39e8 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 28 Apr 2022 13:51:16 -0700
-Subject: drm/amd/pm: use bitmap_{from,to}_arr32 where appropriate
-
-From: Yury Norov <yury.norov@gmail.com>
-
-[ Upstream commit 525d6515604eb1373ce5e6372a6b6640953b2d6a ]
-
-The smu_v1X_0_set_allowed_mask() uses bitmap_copy() to convert
-bitmap to 32-bit array. This may be wrong due to endiannes issues.
-Fix it by switching to bitmap_{from,to}_arr32.
-
-CC: Alexander Gordeev <agordeev@linux.ibm.com>
-CC: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
-CC: Christian Borntraeger <borntraeger@linux.ibm.com>
-CC: Claudio Imbrenda <imbrenda@linux.ibm.com>
-CC: David Hildenbrand <david@redhat.com>
-CC: Heiko Carstens <hca@linux.ibm.com>
-CC: Janosch Frank <frankja@linux.ibm.com>
-CC: Rasmus Villemoes <linux@rasmusvillemoes.dk>
-CC: Sven Schnelle <svens@linux.ibm.com>
-CC: Vasily Gorbik <gor@linux.ibm.com>
-Signed-off-by: Yury Norov <yury.norov@gmail.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c | 2 +-
- drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c
-index 4e9e2cf39859..5fcbec9dd45d 100644
---- a/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c
-+++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c
-@@ -777,7 +777,7 @@ int smu_v11_0_set_allowed_mask(struct smu_context *smu)
- goto failed;
- }
-
-- bitmap_copy((unsigned long *)feature_mask, feature->allowed, 64);
-+ bitmap_to_arr32(feature_mask, feature->allowed, 64);
-
- ret = smu_cmn_send_smc_msg_with_param(smu, SMU_MSG_SetAllowedFeaturesMaskHigh,
- feature_mask[1], NULL);
-diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
-index b54790d3483e..4a5e91b59f0c 100644
---- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
-+++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
-@@ -726,7 +726,7 @@ int smu_v13_0_set_allowed_mask(struct smu_context *smu)
- if (bitmap_empty(feature->allowed, SMU_FEATURE_MAX) || feature->feature_num < 64)
- goto failed;
-
-- bitmap_copy((unsigned long *)feature_mask, feature->allowed, 64);
-+ bitmap_to_arr32(feature_mask, feature->allowed, 64);
-
- ret = smu_cmn_send_smc_msg_with_param(smu, SMU_MSG_SetAllowedFeaturesMaskHigh,
- feature_mask[1], NULL);
---
-2.35.1
-
+++ /dev/null
-From e5e2dbbaa758b909449fe93a571113cd7ec7771b Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 17 May 2022 17:57:00 +0800
-Subject: drm/radeon: fix a possible null pointer dereference
-
-From: Gong Yuanjun <ruc_gongyuanjun@163.com>
-
-[ Upstream commit a2b28708b645c5632dc93669ab06e97874c8244f ]
-
-In radeon_fp_native_mode(), the return value of drm_mode_duplicate()
-is assigned to mode, which will lead to a NULL pointer dereference
-on failure of drm_mode_duplicate(). Add a check to avoid npd.
-
-The failure status of drm_cvt_mode() on the other path is checked too.
-
-Signed-off-by: Gong Yuanjun <ruc_gongyuanjun@163.com>
-Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/radeon/radeon_connectors.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
-index 1546abcadacf..d157bb9072e8 100644
---- a/drivers/gpu/drm/radeon/radeon_connectors.c
-+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
-@@ -473,6 +473,8 @@ static struct drm_display_mode *radeon_fp_native_mode(struct drm_encoder *encode
- native_mode->vdisplay != 0 &&
- native_mode->clock != 0) {
- mode = drm_mode_duplicate(dev, native_mode);
-+ if (!mode)
-+ return NULL;
- mode->type = DRM_MODE_TYPE_PREFERRED | DRM_MODE_TYPE_DRIVER;
- drm_mode_set_name(mode);
-
-@@ -487,6 +489,8 @@ static struct drm_display_mode *radeon_fp_native_mode(struct drm_encoder *encode
- * simpler.
- */
- mode = drm_cvt_mode(dev, native_mode->hdisplay, native_mode->vdisplay, 60, true, false, false);
-+ if (!mode)
-+ return NULL;
- mode->type = DRM_MODE_TYPE_PREFERRED | DRM_MODE_TYPE_DRIVER;
- DRM_DEBUG_KMS("Adding cvt approximation of native panel mode %s\n", mode->name);
- }
---
-2.35.1
-
+++ /dev/null
-From f287ce4d44f10f7a07dc1b46c7e9129072b33f6e Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 17 Dec 2021 09:28:46 +0300
-Subject: extcon: Fix extcon_get_extcon_dev() error handling
-
-From: Dan Carpenter <dan.carpenter@oracle.com>
-
-[ Upstream commit 58e4a2d27d3255e4e8c507fdc13734dccc9fc4c7 ]
-
-The extcon_get_extcon_dev() function returns error pointers on error,
-NULL when it's a -EPROBE_DEFER defer situation, and ERR_PTR(-ENODEV)
-when the CONFIG_EXTCON option is disabled. This is very complicated for
-the callers to handle and a number of them had bugs that would lead to
-an Oops.
-
-In real life, there are two things which prevented crashes. First,
-error pointers would only be returned if there was bug in the caller
-where they passed a NULL "extcon_name" and none of them do that.
-Second, only two out of the eight drivers will build when CONFIG_EXTCON
-is disabled.
-
-The normal way to write this would be to return -EPROBE_DEFER directly
-when appropriate and return NULL when CONFIG_EXTCON is disabled. Then
-the error handling is simple and just looks like:
-
- dev->edev = extcon_get_extcon_dev(acpi_dev_name(adev));
- if (IS_ERR(dev->edev))
- return PTR_ERR(dev->edev);
-
-For the two drivers which can build with CONFIG_EXTCON disabled, then
-extcon_get_extcon_dev() will now return NULL which is not treated as an
-error and the probe will continue successfully. Those two drivers are
-"typec_fusb302" and "max8997-battery". In the original code, the
-typec_fusb302 driver had an 800ms hang in tcpm_get_current_limit() but
-now that function is a no-op. For the max8997-battery driver everything
-should continue working as is.
-
-Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
-Reviewed-by: Hans de Goede <hdegoede@redhat.com>
-Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
-Reviewed-by: Guenter Roeck <linux@roeck-us.net>
-Acked-by: Sebastian Reichel <sebastian.reichel@collabora.com>
-Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/extcon/extcon-axp288.c | 4 ++--
- drivers/extcon/extcon.c | 4 +++-
- drivers/power/supply/axp288_charger.c | 17 ++++++++++-------
- drivers/power/supply/charger-manager.c | 7 ++-----
- drivers/power/supply/max8997_charger.c | 8 ++++----
- drivers/usb/dwc3/drd.c | 9 ++-------
- drivers/usb/phy/phy-omap-otg.c | 4 ++--
- drivers/usb/typec/tcpm/fusb302.c | 4 ++--
- include/linux/extcon.h | 2 +-
- 9 files changed, 28 insertions(+), 31 deletions(-)
-
-diff --git a/drivers/extcon/extcon-axp288.c b/drivers/extcon/extcon-axp288.c
-index 7c6d5857ff25..180be768c215 100644
---- a/drivers/extcon/extcon-axp288.c
-+++ b/drivers/extcon/extcon-axp288.c
-@@ -394,8 +394,8 @@ static int axp288_extcon_probe(struct platform_device *pdev)
- if (adev) {
- info->id_extcon = extcon_get_extcon_dev(acpi_dev_name(adev));
- put_device(&adev->dev);
-- if (!info->id_extcon)
-- return -EPROBE_DEFER;
-+ if (IS_ERR(info->id_extcon))
-+ return PTR_ERR(info->id_extcon);
-
- dev_info(dev, "controlling USB role\n");
- } else {
-diff --git a/drivers/extcon/extcon.c b/drivers/extcon/extcon.c
-index a09e704fd0fa..adb957470c65 100644
---- a/drivers/extcon/extcon.c
-+++ b/drivers/extcon/extcon.c
-@@ -851,6 +851,8 @@ EXPORT_SYMBOL_GPL(extcon_set_property_capability);
- * @extcon_name: the extcon name provided with extcon_dev_register()
- *
- * Return the pointer of extcon device if success or ERR_PTR(err) if fail.
-+ * NOTE: This function returns -EPROBE_DEFER so it may only be called from
-+ * probe() functions.
- */
- struct extcon_dev *extcon_get_extcon_dev(const char *extcon_name)
- {
-@@ -864,7 +866,7 @@ struct extcon_dev *extcon_get_extcon_dev(const char *extcon_name)
- if (!strcmp(sd->name, extcon_name))
- goto out;
- }
-- sd = NULL;
-+ sd = ERR_PTR(-EPROBE_DEFER);
- out:
- mutex_unlock(&extcon_dev_list_lock);
- return sd;
-diff --git a/drivers/power/supply/axp288_charger.c b/drivers/power/supply/axp288_charger.c
-index 19746e658a6a..15219ed43ce9 100644
---- a/drivers/power/supply/axp288_charger.c
-+++ b/drivers/power/supply/axp288_charger.c
-@@ -865,17 +865,20 @@ static int axp288_charger_probe(struct platform_device *pdev)
- info->regmap_irqc = axp20x->regmap_irqc;
-
- info->cable.edev = extcon_get_extcon_dev(AXP288_EXTCON_DEV_NAME);
-- if (info->cable.edev == NULL) {
-- dev_dbg(dev, "%s is not ready, probe deferred\n",
-- AXP288_EXTCON_DEV_NAME);
-- return -EPROBE_DEFER;
-+ if (IS_ERR(info->cable.edev)) {
-+ dev_err_probe(dev, PTR_ERR(info->cable.edev),
-+ "extcon_get_extcon_dev(%s) failed\n",
-+ AXP288_EXTCON_DEV_NAME);
-+ return PTR_ERR(info->cable.edev);
- }
-
- if (acpi_dev_present(USB_HOST_EXTCON_HID, NULL, -1)) {
- info->otg.cable = extcon_get_extcon_dev(USB_HOST_EXTCON_NAME);
-- if (info->otg.cable == NULL) {
-- dev_dbg(dev, "EXTCON_USB_HOST is not ready, probe deferred\n");
-- return -EPROBE_DEFER;
-+ if (IS_ERR(info->otg.cable)) {
-+ dev_err_probe(dev, PTR_ERR(info->otg.cable),
-+ "extcon_get_extcon_dev(%s) failed\n",
-+ USB_HOST_EXTCON_NAME);
-+ return PTR_ERR(info->otg.cable);
- }
- dev_info(dev, "Using " USB_HOST_EXTCON_HID " extcon for usb-id\n");
- }
-diff --git a/drivers/power/supply/charger-manager.c b/drivers/power/supply/charger-manager.c
-index d67edb760c94..92db79400a6a 100644
---- a/drivers/power/supply/charger-manager.c
-+++ b/drivers/power/supply/charger-manager.c
-@@ -985,13 +985,10 @@ static int charger_extcon_init(struct charger_manager *cm,
- cable->nb.notifier_call = charger_extcon_notifier;
-
- cable->extcon_dev = extcon_get_extcon_dev(cable->extcon_name);
-- if (IS_ERR_OR_NULL(cable->extcon_dev)) {
-+ if (IS_ERR(cable->extcon_dev)) {
- pr_err("Cannot find extcon_dev for %s (cable: %s)\n",
- cable->extcon_name, cable->name);
-- if (cable->extcon_dev == NULL)
-- return -EPROBE_DEFER;
-- else
-- return PTR_ERR(cable->extcon_dev);
-+ return PTR_ERR(cable->extcon_dev);
- }
-
- for (i = 0; i < ARRAY_SIZE(extcon_mapping); i++) {
-diff --git a/drivers/power/supply/max8997_charger.c b/drivers/power/supply/max8997_charger.c
-index 25207fe2aa68..bfa7a576523d 100644
---- a/drivers/power/supply/max8997_charger.c
-+++ b/drivers/power/supply/max8997_charger.c
-@@ -248,10 +248,10 @@ static int max8997_battery_probe(struct platform_device *pdev)
- dev_info(&pdev->dev, "couldn't get charger regulator\n");
- }
- charger->edev = extcon_get_extcon_dev("max8997-muic");
-- if (IS_ERR_OR_NULL(charger->edev)) {
-- if (!charger->edev)
-- return -EPROBE_DEFER;
-- dev_info(charger->dev, "couldn't get extcon device\n");
-+ if (IS_ERR(charger->edev)) {
-+ dev_err_probe(charger->dev, PTR_ERR(charger->edev),
-+ "couldn't get extcon device: max8997-muic\n");
-+ return PTR_ERR(charger->edev);
- }
-
- if (!IS_ERR(charger->reg) && !IS_ERR_OR_NULL(charger->edev)) {
-diff --git a/drivers/usb/dwc3/drd.c b/drivers/usb/dwc3/drd.c
-index f148b0370f82..81ff21bd405a 100644
---- a/drivers/usb/dwc3/drd.c
-+++ b/drivers/usb/dwc3/drd.c
-@@ -454,13 +454,8 @@ static struct extcon_dev *dwc3_get_extcon(struct dwc3 *dwc)
- * This device property is for kernel internal use only and
- * is expected to be set by the glue code.
- */
-- if (device_property_read_string(dev, "linux,extcon-name", &name) == 0) {
-- edev = extcon_get_extcon_dev(name);
-- if (!edev)
-- return ERR_PTR(-EPROBE_DEFER);
--
-- return edev;
-- }
-+ if (device_property_read_string(dev, "linux,extcon-name", &name) == 0)
-+ return extcon_get_extcon_dev(name);
-
- /*
- * Try to get an extcon device from the USB PHY controller's "port"
-diff --git a/drivers/usb/phy/phy-omap-otg.c b/drivers/usb/phy/phy-omap-otg.c
-index ee0863c6553e..6e6ef8c0bc7e 100644
---- a/drivers/usb/phy/phy-omap-otg.c
-+++ b/drivers/usb/phy/phy-omap-otg.c
-@@ -95,8 +95,8 @@ static int omap_otg_probe(struct platform_device *pdev)
- return -ENODEV;
-
- extcon = extcon_get_extcon_dev(config->extcon);
-- if (!extcon)
-- return -EPROBE_DEFER;
-+ if (IS_ERR(extcon))
-+ return PTR_ERR(extcon);
-
- otg_dev = devm_kzalloc(&pdev->dev, sizeof(*otg_dev), GFP_KERNEL);
- if (!otg_dev)
-diff --git a/drivers/usb/typec/tcpm/fusb302.c b/drivers/usb/typec/tcpm/fusb302.c
-index 72f9001b0792..96c55eaf3f80 100644
---- a/drivers/usb/typec/tcpm/fusb302.c
-+++ b/drivers/usb/typec/tcpm/fusb302.c
-@@ -1708,8 +1708,8 @@ static int fusb302_probe(struct i2c_client *client,
- */
- if (device_property_read_string(dev, "linux,extcon-name", &name) == 0) {
- chip->extcon = extcon_get_extcon_dev(name);
-- if (!chip->extcon)
-- return -EPROBE_DEFER;
-+ if (IS_ERR(chip->extcon))
-+ return PTR_ERR(chip->extcon);
- }
-
- chip->vbus = devm_regulator_get(chip->dev, "vbus");
-diff --git a/include/linux/extcon.h b/include/linux/extcon.h
-index 0c19010da77f..685401d94d39 100644
---- a/include/linux/extcon.h
-+++ b/include/linux/extcon.h
-@@ -296,7 +296,7 @@ static inline void devm_extcon_unregister_notifier_all(struct device *dev,
-
- static inline struct extcon_dev *extcon_get_extcon_dev(const char *extcon_name)
- {
-- return ERR_PTR(-ENODEV);
-+ return NULL;
- }
-
- static inline struct extcon_dev *extcon_find_edev_by_node(struct device_node *node)
---
-2.35.1
-
+++ /dev/null
-From c2661d06a3434e3a06db07a9bd79331c101cbcea Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 27 Apr 2022 12:00:05 +0900
-Subject: extcon: Modify extcon device to be created after driver data is set
-
-From: bumwoo lee <bw365.lee@samsung.com>
-
-[ Upstream commit 5dcc2afe716d69f5112ce035cb14f007461ff189 ]
-
-Currently, someone can invoke the sysfs such as state_show()
-intermittently before dev_set_drvdata() is done.
-And it can be a cause of kernel Oops because of edev is Null at that time.
-So modified the driver registration to after setting drviver data.
-
-- Oops's backtrace.
-
-Backtrace:
-[<c067865c>] (state_show) from [<c05222e8>] (dev_attr_show)
-[<c05222c0>] (dev_attr_show) from [<c02c66e0>] (sysfs_kf_seq_show)
-[<c02c6648>] (sysfs_kf_seq_show) from [<c02c496c>] (kernfs_seq_show)
-[<c02c4938>] (kernfs_seq_show) from [<c025e2a0>] (seq_read)
-[<c025e11c>] (seq_read) from [<c02c50a0>] (kernfs_fop_read)
-[<c02c5064>] (kernfs_fop_read) from [<c0231cac>] (__vfs_read)
-[<c0231c5c>] (__vfs_read) from [<c0231ee0>] (vfs_read)
-[<c0231e34>] (vfs_read) from [<c0232464>] (ksys_read)
-[<c02323f0>] (ksys_read) from [<c02324fc>] (sys_read)
-[<c02324e4>] (sys_read) from [<c00091d0>] (__sys_trace_return)
-
-Signed-off-by: bumwoo lee <bw365.lee@samsung.com>
-Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/extcon/extcon.c | 29 +++++++++++++++++------------
- 1 file changed, 17 insertions(+), 12 deletions(-)
-
-diff --git a/drivers/extcon/extcon.c b/drivers/extcon/extcon.c
-index adb957470c65..97e35c32bfa5 100644
---- a/drivers/extcon/extcon.c
-+++ b/drivers/extcon/extcon.c
-@@ -1220,19 +1220,14 @@ int extcon_dev_register(struct extcon_dev *edev)
- edev->dev.type = &edev->extcon_dev_type;
- }
-
-- ret = device_register(&edev->dev);
-- if (ret) {
-- put_device(&edev->dev);
-- goto err_dev;
-- }
--
- spin_lock_init(&edev->lock);
-- edev->nh = devm_kcalloc(&edev->dev, edev->max_supported,
-- sizeof(*edev->nh), GFP_KERNEL);
-- if (!edev->nh) {
-- ret = -ENOMEM;
-- device_unregister(&edev->dev);
-- goto err_dev;
-+ if (edev->max_supported) {
-+ edev->nh = kcalloc(edev->max_supported, sizeof(*edev->nh),
-+ GFP_KERNEL);
-+ if (!edev->nh) {
-+ ret = -ENOMEM;
-+ goto err_alloc_nh;
-+ }
- }
-
- for (index = 0; index < edev->max_supported; index++)
-@@ -1243,6 +1238,12 @@ int extcon_dev_register(struct extcon_dev *edev)
- dev_set_drvdata(&edev->dev, edev);
- edev->state = 0;
-
-+ ret = device_register(&edev->dev);
-+ if (ret) {
-+ put_device(&edev->dev);
-+ goto err_dev;
-+ }
-+
- mutex_lock(&extcon_dev_list_lock);
- list_add(&edev->entry, &extcon_dev_list);
- mutex_unlock(&extcon_dev_list_lock);
-@@ -1250,6 +1251,9 @@ int extcon_dev_register(struct extcon_dev *edev)
- return 0;
-
- err_dev:
-+ if (edev->max_supported)
-+ kfree(edev->nh);
-+err_alloc_nh:
- if (edev->max_supported)
- kfree(edev->extcon_dev_type.groups);
- err_alloc_groups:
-@@ -1310,6 +1314,7 @@ void extcon_dev_unregister(struct extcon_dev *edev)
- if (edev->max_supported) {
- kfree(edev->extcon_dev_type.groups);
- kfree(edev->cables);
-+ kfree(edev->nh);
- }
-
- put_device(&edev->dev);
---
-2.35.1
-
+++ /dev/null
-From 76582268bcd933d81d283b9c4f5302111fd40dcf Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 5 Mar 2022 11:14:05 +0800
-Subject: iio: dummy: iio_simple_dummy: check the return value of kstrdup()
-
-From: Xiaoke Wang <xkernel.wang@foxmail.com>
-
-[ Upstream commit ba93642188a6fed754bf7447f638bc410e05a929 ]
-
-kstrdup() is also a memory allocation-related function, it returns NULL
-when some memory errors happen. So it is better to check the return
-value of it so to catch the memory error in time. Besides, there should
-have a kfree() to clear up the allocation if we get a failure later in
-this function to prevent memory leak.
-
-Signed-off-by: Xiaoke Wang <xkernel.wang@foxmail.com>
-Link: https://lore.kernel.org/r/tencent_C920CFCC33B9CC1C63141FE1334A39FF8508@qq.com
-Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/iio/dummy/iio_simple_dummy.c | 20 ++++++++++++--------
- 1 file changed, 12 insertions(+), 8 deletions(-)
-
-diff --git a/drivers/iio/dummy/iio_simple_dummy.c b/drivers/iio/dummy/iio_simple_dummy.c
-index c0b7ef900735..c24f609c2ade 100644
---- a/drivers/iio/dummy/iio_simple_dummy.c
-+++ b/drivers/iio/dummy/iio_simple_dummy.c
-@@ -575,10 +575,9 @@ static struct iio_sw_device *iio_dummy_probe(const char *name)
- */
-
- swd = kzalloc(sizeof(*swd), GFP_KERNEL);
-- if (!swd) {
-- ret = -ENOMEM;
-- goto error_kzalloc;
-- }
-+ if (!swd)
-+ return ERR_PTR(-ENOMEM);
-+
- /*
- * Allocate an IIO device.
- *
-@@ -590,7 +589,7 @@ static struct iio_sw_device *iio_dummy_probe(const char *name)
- indio_dev = iio_device_alloc(parent, sizeof(*st));
- if (!indio_dev) {
- ret = -ENOMEM;
-- goto error_ret;
-+ goto error_free_swd;
- }
-
- st = iio_priv(indio_dev);
-@@ -616,6 +615,10 @@ static struct iio_sw_device *iio_dummy_probe(const char *name)
- * indio_dev->name = spi_get_device_id(spi)->name;
- */
- indio_dev->name = kstrdup(name, GFP_KERNEL);
-+ if (!indio_dev->name) {
-+ ret = -ENOMEM;
-+ goto error_free_device;
-+ }
-
- /* Provide description of available channels */
- indio_dev->channels = iio_dummy_channels;
-@@ -632,7 +635,7 @@ static struct iio_sw_device *iio_dummy_probe(const char *name)
-
- ret = iio_simple_dummy_events_register(indio_dev);
- if (ret < 0)
-- goto error_free_device;
-+ goto error_free_name;
-
- ret = iio_simple_dummy_configure_buffer(indio_dev);
- if (ret < 0)
-@@ -649,11 +652,12 @@ static struct iio_sw_device *iio_dummy_probe(const char *name)
- iio_simple_dummy_unconfigure_buffer(indio_dev);
- error_unregister_events:
- iio_simple_dummy_events_unregister(indio_dev);
-+error_free_name:
-+ kfree(indio_dev->name);
- error_free_device:
- iio_device_free(indio_dev);
--error_ret:
-+error_free_swd:
- kfree(swd);
--error_kzalloc:
- return ERR_PTR(ret);
- }
-
---
-2.35.1
-
+++ /dev/null
-From b1f81ca1dd90288ae7524db1c274f77482f4467a Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 7 Feb 2022 15:38:33 +0100
-Subject: iio: st_sensors: Add a local lock for protecting odr
-
-From: Miquel Raynal <miquel.raynal@bootlin.com>
-
-[ Upstream commit 474010127e2505fc463236470908e1ff5ddb3578 ]
-
-Right now the (framework) mlock lock is (ab)used for multiple purposes:
-1- protecting concurrent accesses over the odr local cache
-2- avoid changing samplig frequency whilst buffer is running
-
-Let's start by handling situation #1 with a local lock.
-
-Suggested-by: Jonathan Cameron <jic23@kernel.org>
-Cc: Denis Ciocca <denis.ciocca@st.com>
-Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
-Link: https://lore.kernel.org/r/20220207143840.707510-7-miquel.raynal@bootlin.com
-Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- .../iio/common/st_sensors/st_sensors_core.c | 24 ++++++++++++++-----
- include/linux/iio/common/st_sensors.h | 3 +++
- 2 files changed, 21 insertions(+), 6 deletions(-)
-
-diff --git a/drivers/iio/common/st_sensors/st_sensors_core.c b/drivers/iio/common/st_sensors/st_sensors_core.c
-index eb452d0c423c..5c7e4e725819 100644
---- a/drivers/iio/common/st_sensors/st_sensors_core.c
-+++ b/drivers/iio/common/st_sensors/st_sensors_core.c
-@@ -71,16 +71,18 @@ static int st_sensors_match_odr(struct st_sensor_settings *sensor_settings,
-
- int st_sensors_set_odr(struct iio_dev *indio_dev, unsigned int odr)
- {
-- int err;
-+ int err = 0;
- struct st_sensor_odr_avl odr_out = {0, 0};
- struct st_sensor_data *sdata = iio_priv(indio_dev);
-
-+ mutex_lock(&sdata->odr_lock);
-+
- if (!sdata->sensor_settings->odr.mask)
-- return 0;
-+ goto unlock_mutex;
-
- err = st_sensors_match_odr(sdata->sensor_settings, odr, &odr_out);
- if (err < 0)
-- goto st_sensors_match_odr_error;
-+ goto unlock_mutex;
-
- if ((sdata->sensor_settings->odr.addr ==
- sdata->sensor_settings->pw.addr) &&
-@@ -103,7 +105,9 @@ int st_sensors_set_odr(struct iio_dev *indio_dev, unsigned int odr)
- if (err >= 0)
- sdata->odr = odr_out.hz;
-
--st_sensors_match_odr_error:
-+unlock_mutex:
-+ mutex_unlock(&sdata->odr_lock);
-+
- return err;
- }
- EXPORT_SYMBOL(st_sensors_set_odr);
-@@ -361,6 +365,8 @@ int st_sensors_init_sensor(struct iio_dev *indio_dev,
- struct st_sensors_platform_data *of_pdata;
- int err = 0;
-
-+ mutex_init(&sdata->odr_lock);
-+
- /* If OF/DT pdata exists, it will take precedence of anything else */
- of_pdata = st_sensors_dev_probe(indio_dev->dev.parent, pdata);
- if (IS_ERR(of_pdata))
-@@ -554,18 +560,24 @@ int st_sensors_read_info_raw(struct iio_dev *indio_dev,
- err = -EBUSY;
- goto out;
- } else {
-+ mutex_lock(&sdata->odr_lock);
- err = st_sensors_set_enable(indio_dev, true);
-- if (err < 0)
-+ if (err < 0) {
-+ mutex_unlock(&sdata->odr_lock);
- goto out;
-+ }
-
- msleep((sdata->sensor_settings->bootime * 1000) / sdata->odr);
- err = st_sensors_read_axis_data(indio_dev, ch, val);
-- if (err < 0)
-+ if (err < 0) {
-+ mutex_unlock(&sdata->odr_lock);
- goto out;
-+ }
-
- *val = *val >> ch->scan_type.shift;
-
- err = st_sensors_set_enable(indio_dev, false);
-+ mutex_unlock(&sdata->odr_lock);
- }
- out:
- mutex_unlock(&indio_dev->mlock);
-diff --git a/include/linux/iio/common/st_sensors.h b/include/linux/iio/common/st_sensors.h
-index 22f67845cdd3..db4a1b260348 100644
---- a/include/linux/iio/common/st_sensors.h
-+++ b/include/linux/iio/common/st_sensors.h
-@@ -237,6 +237,7 @@ struct st_sensor_settings {
- * @hw_irq_trigger: if we're using the hardware interrupt on the sensor.
- * @hw_timestamp: Latest timestamp from the interrupt handler, when in use.
- * @buffer_data: Data used by buffer part.
-+ * @odr_lock: Local lock for preventing concurrent ODR accesses/changes
- */
- struct st_sensor_data {
- struct iio_trigger *trig;
-@@ -261,6 +262,8 @@ struct st_sensor_data {
- s64 hw_timestamp;
-
- char buffer_data[ST_SENSORS_MAX_BUFFER_SIZE] ____cacheline_aligned;
-+
-+ struct mutex odr_lock;
- };
-
- #ifdef CONFIG_IIO_BUFFER
---
-2.35.1
-
+++ /dev/null
-From ebde77429110dae179fa2e79f21412e5158d1cad Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 2 May 2022 12:30:20 +0200
-Subject: jump_label,noinstr: Avoid instrumentation for JUMP_LABEL=n builds
-
-From: Peter Zijlstra <peterz@infradead.org>
-
-[ Upstream commit 656d054e0a15ec327bd82801ccd58201e59f6896 ]
-
-When building x86_64 with JUMP_LABEL=n it's possible for
-instrumentation to sneak into noinstr:
-
-vmlinux.o: warning: objtool: exit_to_user_mode+0x14: call to static_key_count.constprop.0() leaves .noinstr.text section
-vmlinux.o: warning: objtool: syscall_exit_to_user_mode+0x2d: call to static_key_count.constprop.0() leaves .noinstr.text section
-vmlinux.o: warning: objtool: irqentry_exit_to_user_mode+0x1b: call to static_key_count.constprop.0() leaves .noinstr.text section
-
-Switch to arch_ prefixed atomic to avoid the explicit instrumentation.
-
-Reported-by: kernel test robot <lkp@intel.com>
-Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- include/linux/jump_label.h | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/include/linux/jump_label.h b/include/linux/jump_label.h
-index 48b9b2a82767..019e55c13248 100644
---- a/include/linux/jump_label.h
-+++ b/include/linux/jump_label.h
-@@ -261,9 +261,9 @@ extern void static_key_disable_cpuslocked(struct static_key *key);
- #include <linux/atomic.h>
- #include <linux/bug.h>
-
--static inline int static_key_count(struct static_key *key)
-+static __always_inline int static_key_count(struct static_key *key)
- {
-- return atomic_read(&key->enabled);
-+ return arch_atomic_read(&key->enabled);
- }
-
- static __always_inline void jump_label_init(void)
---
-2.35.1
-
+++ /dev/null
-From d9854790cf0a5f986003b89bc8a779f45be3e69c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 16 May 2022 12:09:51 -0700
-Subject: kernfs: Separate kernfs_pr_cont_buf and rename_lock.
-
-From: Hao Luo <haoluo@google.com>
-
-[ Upstream commit 1a702dc88e150487c9c173a249b3d236498b9183 ]
-
-Previously the protection of kernfs_pr_cont_buf was piggy backed by
-rename_lock, which means that pr_cont() needs to be protected under
-rename_lock. This can cause potential circular lock dependencies.
-
-If there is an OOM, we have the following call hierarchy:
-
- -> cpuset_print_current_mems_allowed()
- -> pr_cont_cgroup_name()
- -> pr_cont_kernfs_name()
-
-pr_cont_kernfs_name() will grab rename_lock and call printk. So we have
-the following lock dependencies:
-
- kernfs_rename_lock -> console_sem
-
-Sometimes, printk does a wakeup before releasing console_sem, which has
-the dependence chain:
-
- console_sem -> p->pi_lock -> rq->lock
-
-Now, imagine one wants to read cgroup_name under rq->lock, for example,
-printing cgroup_name in a tracepoint in the scheduler code. They will
-be holding rq->lock and take rename_lock:
-
- rq->lock -> kernfs_rename_lock
-
-Now they will deadlock.
-
-A prevention to this circular lock dependency is to separate the
-protection of pr_cont_buf from rename_lock. In principle, rename_lock
-is to protect the integrity of cgroup name when copying to buf. Once
-pr_cont_buf has got its content, rename_lock can be dropped. So it's
-safe to drop rename_lock after kernfs_name_locked (and
-kernfs_path_from_node_locked) and rely on a dedicated pr_cont_lock
-to protect pr_cont_buf.
-
-Acked-by: Tejun Heo <tj@kernel.org>
-Signed-off-by: Hao Luo <haoluo@google.com>
-Link: https://lore.kernel.org/r/20220516190951.3144144-1-haoluo@google.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/kernfs/dir.c | 31 +++++++++++++++++++------------
- 1 file changed, 19 insertions(+), 12 deletions(-)
-
-diff --git a/fs/kernfs/dir.c b/fs/kernfs/dir.c
-index 4096953390b4..52f3afeed612 100644
---- a/fs/kernfs/dir.c
-+++ b/fs/kernfs/dir.c
-@@ -18,7 +18,15 @@
- #include "kernfs-internal.h"
-
- static DEFINE_SPINLOCK(kernfs_rename_lock); /* kn->parent and ->name */
--static char kernfs_pr_cont_buf[PATH_MAX]; /* protected by rename_lock */
-+/*
-+ * Don't use rename_lock to piggy back on pr_cont_buf. We don't want to
-+ * call pr_cont() while holding rename_lock. Because sometimes pr_cont()
-+ * will perform wakeups when releasing console_sem. Holding rename_lock
-+ * will introduce deadlock if the scheduler reads the kernfs_name in the
-+ * wakeup path.
-+ */
-+static DEFINE_SPINLOCK(kernfs_pr_cont_lock);
-+static char kernfs_pr_cont_buf[PATH_MAX]; /* protected by pr_cont_lock */
- static DEFINE_SPINLOCK(kernfs_idr_lock); /* root->ino_idr */
-
- #define rb_to_kn(X) rb_entry((X), struct kernfs_node, rb)
-@@ -229,12 +237,12 @@ void pr_cont_kernfs_name(struct kernfs_node *kn)
- {
- unsigned long flags;
-
-- spin_lock_irqsave(&kernfs_rename_lock, flags);
-+ spin_lock_irqsave(&kernfs_pr_cont_lock, flags);
-
-- kernfs_name_locked(kn, kernfs_pr_cont_buf, sizeof(kernfs_pr_cont_buf));
-+ kernfs_name(kn, kernfs_pr_cont_buf, sizeof(kernfs_pr_cont_buf));
- pr_cont("%s", kernfs_pr_cont_buf);
-
-- spin_unlock_irqrestore(&kernfs_rename_lock, flags);
-+ spin_unlock_irqrestore(&kernfs_pr_cont_lock, flags);
- }
-
- /**
-@@ -248,10 +256,10 @@ void pr_cont_kernfs_path(struct kernfs_node *kn)
- unsigned long flags;
- int sz;
-
-- spin_lock_irqsave(&kernfs_rename_lock, flags);
-+ spin_lock_irqsave(&kernfs_pr_cont_lock, flags);
-
-- sz = kernfs_path_from_node_locked(kn, NULL, kernfs_pr_cont_buf,
-- sizeof(kernfs_pr_cont_buf));
-+ sz = kernfs_path_from_node(kn, NULL, kernfs_pr_cont_buf,
-+ sizeof(kernfs_pr_cont_buf));
- if (sz < 0) {
- pr_cont("(error)");
- goto out;
-@@ -265,7 +273,7 @@ void pr_cont_kernfs_path(struct kernfs_node *kn)
- pr_cont("%s", kernfs_pr_cont_buf);
-
- out:
-- spin_unlock_irqrestore(&kernfs_rename_lock, flags);
-+ spin_unlock_irqrestore(&kernfs_pr_cont_lock, flags);
- }
-
- /**
-@@ -823,13 +831,12 @@ static struct kernfs_node *kernfs_walk_ns(struct kernfs_node *parent,
-
- lockdep_assert_held_read(&kernfs_root(parent)->kernfs_rwsem);
-
-- /* grab kernfs_rename_lock to piggy back on kernfs_pr_cont_buf */
-- spin_lock_irq(&kernfs_rename_lock);
-+ spin_lock_irq(&kernfs_pr_cont_lock);
-
- len = strlcpy(kernfs_pr_cont_buf, path, sizeof(kernfs_pr_cont_buf));
-
- if (len >= sizeof(kernfs_pr_cont_buf)) {
-- spin_unlock_irq(&kernfs_rename_lock);
-+ spin_unlock_irq(&kernfs_pr_cont_lock);
- return NULL;
- }
-
-@@ -841,7 +848,7 @@ static struct kernfs_node *kernfs_walk_ns(struct kernfs_node *parent,
- parent = kernfs_find_ns(parent, name, ns);
- }
-
-- spin_unlock_irq(&kernfs_rename_lock);
-+ spin_unlock_irq(&kernfs_pr_cont_lock);
-
- return parent;
- }
---
-2.35.1
-
+++ /dev/null
-From c1a4c52ca3f02d390db60f0663aad244ea5af8cc Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 18 May 2022 06:46:08 +0900
-Subject: ksmbd: smbd: fix connection dropped issue
-
-From: Hyunchul Lee <hyc.lee@gmail.com>
-
-[ Upstream commit 5366afc4065075a4456941fbd51c33604d631ee5 ]
-
-When there are bursty connection requests,
-RDMA connection event handler is deferred and
-Negotiation requests are received even if
-connection status is NEW.
-
-To handle it, set the status to CONNECTED
-if Negotiation requests are received.
-
-Reported-by: Yufan Chen <wiz.chen@gmail.com>
-Signed-off-by: Hyunchul Lee <hyc.lee@gmail.com>
-Tested-by: Yufan Chen <wiz.chen@gmail.com>
-Acked-by: Namjae Jeon <linkinjeon@kernel.org>
-Signed-off-by: Steve French <stfrench@microsoft.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/ksmbd/transport_rdma.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/fs/ksmbd/transport_rdma.c b/fs/ksmbd/transport_rdma.c
-index ba5a22bc2e6d..d3b60b833a81 100644
---- a/fs/ksmbd/transport_rdma.c
-+++ b/fs/ksmbd/transport_rdma.c
-@@ -569,6 +569,7 @@ static void recv_done(struct ib_cq *cq, struct ib_wc *wc)
- }
- t->negotiation_requested = true;
- t->full_packet_received = true;
-+ t->status = SMB_DIRECT_CS_CONNECTED;
- enqueue_reassembly(t, recvmsg, 0);
- wake_up_interruptible(&t->wait_status);
- break;
---
-2.35.1
-
+++ /dev/null
-From b9e784f501cb44354841739c6deaf466af5156e6 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 16 Feb 2022 12:15:03 -0800
-Subject: lkdtm/usercopy: Expand size of "out of frame" object
-
-From: Kees Cook <keescook@chromium.org>
-
-[ Upstream commit f387e86d3a74407bdd9c5815820ac9d060962840 ]
-
-To be sufficiently out of range for the usercopy test to see the lifetime
-mismatch, expand the size of the "bad" buffer, which will let it be
-beyond current_stack_pointer regardless of stack growth direction.
-Paired with the recent addition of stack depth checking under
-CONFIG_HARDENED_USERCOPY=y, this will correctly start tripping again.
-
-Reported-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
-Cc: Arnd Bergmann <arnd@arndb.de>
-Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Reviewed-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
-Link: https://lore.kernel.org/lkml/762faf1b-0443-5ddf-4430-44a20cf2ec4d@collabora.com/
-Signed-off-by: Kees Cook <keescook@chromium.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/misc/lkdtm/usercopy.c | 17 ++++++++++++++---
- 1 file changed, 14 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/misc/lkdtm/usercopy.c b/drivers/misc/lkdtm/usercopy.c
-index 9161ce7ed47a..3fead5efe523 100644
---- a/drivers/misc/lkdtm/usercopy.c
-+++ b/drivers/misc/lkdtm/usercopy.c
-@@ -30,12 +30,12 @@ static const unsigned char test_text[] = "This is a test.\n";
- */
- static noinline unsigned char *trick_compiler(unsigned char *stack)
- {
-- return stack + 0;
-+ return stack + unconst;
- }
-
- static noinline unsigned char *do_usercopy_stack_callee(int value)
- {
-- unsigned char buf[32];
-+ unsigned char buf[128];
- int i;
-
- /* Exercise stack to avoid everything living in registers. */
-@@ -43,7 +43,12 @@ static noinline unsigned char *do_usercopy_stack_callee(int value)
- buf[i] = value & 0xff;
- }
-
-- return trick_compiler(buf);
-+ /*
-+ * Put the target buffer in the middle of stack allocation
-+ * so that we don't step on future stack users regardless
-+ * of stack growth direction.
-+ */
-+ return trick_compiler(&buf[(128/2)-32]);
- }
-
- static noinline void do_usercopy_stack(bool to_user, bool bad_frame)
-@@ -66,6 +71,12 @@ static noinline void do_usercopy_stack(bool to_user, bool bad_frame)
- bad_stack -= sizeof(unsigned long);
- }
-
-+#ifdef ARCH_HAS_CURRENT_STACK_POINTER
-+ pr_info("stack : %px\n", (void *)current_stack_pointer);
-+#endif
-+ pr_info("good_stack: %px-%px\n", good_stack, good_stack + sizeof(good_stack));
-+ pr_info("bad_stack : %px-%px\n", bad_stack, bad_stack + sizeof(good_stack));
-+
- user_addr = vm_mmap(NULL, 0, PAGE_SIZE,
- PROT_READ | PROT_WRITE | PROT_EXEC,
- MAP_ANONYMOUS | MAP_PRIVATE, 0);
---
-2.35.1
-
+++ /dev/null
-From d73524eff20eb6c55915237a20f4e7ee044ea7be Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 29 Apr 2022 16:49:09 +0800
-Subject: md: protect md_unregister_thread from reentrancy
-
-From: Guoqing Jiang <guoqing.jiang@cloud.ionos.com>
-
-[ Upstream commit 1e267742283a4b5a8ca65755c44166be27e9aa0f ]
-
-Generally, the md_unregister_thread is called with reconfig_mutex, but
-raid_message in dm-raid doesn't hold reconfig_mutex to unregister thread,
-so md_unregister_thread can be called simulitaneously from two call sites
-in theory.
-
-Then after previous commit which remove the protection of reconfig_mutex
-for md_unregister_thread completely, the potential issue could be worse
-than before.
-
-Let's take pers_lock at the beginning of function to ensure reentrancy.
-
-Reported-by: Donald Buczek <buczek@molgen.mpg.de>
-Signed-off-by: Guoqing Jiang <guoqing.jiang@linux.dev>
-Signed-off-by: Song Liu <song@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/md/md.c | 15 ++++++++++-----
- 1 file changed, 10 insertions(+), 5 deletions(-)
-
-diff --git a/drivers/md/md.c b/drivers/md/md.c
-index 43c5890dc9f3..79d64640240b 100644
---- a/drivers/md/md.c
-+++ b/drivers/md/md.c
-@@ -7962,17 +7962,22 @@ EXPORT_SYMBOL(md_register_thread);
-
- void md_unregister_thread(struct md_thread **threadp)
- {
-- struct md_thread *thread = *threadp;
-- if (!thread)
-- return;
-- pr_debug("interrupting MD-thread pid %d\n", task_pid_nr(thread->tsk));
-- /* Locking ensures that mddev_unlock does not wake_up a
-+ struct md_thread *thread;
-+
-+ /*
-+ * Locking ensures that mddev_unlock does not wake_up a
- * non-existent thread
- */
- spin_lock(&pers_lock);
-+ thread = *threadp;
-+ if (!thread) {
-+ spin_unlock(&pers_lock);
-+ return;
-+ }
- *threadp = NULL;
- spin_unlock(&pers_lock);
-
-+ pr_debug("interrupting MD-thread pid %d\n", task_pid_nr(thread->tsk));
- kthread_stop(thread->tsk);
- kfree(thread);
- }
---
-2.35.1
-
+++ /dev/null
-From 5d634380c55b54d299eeb4c19cbcded0d4d03367 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 29 Apr 2022 15:09:13 -0600
-Subject: misc: rtsx: set NULL intfdata when probe fails
-
-From: Shuah Khan <skhan@linuxfoundation.org>
-
-[ Upstream commit f861d36e021e1ac4a0a2a1f6411d623809975d63 ]
-
-rtsx_usb_probe() doesn't call usb_set_intfdata() to null out the
-interface pointer when probe fails. This leaves a stale pointer.
-Noticed the missing usb_set_intfdata() while debugging an unrelated
-invalid DMA mapping problem.
-
-Fix it with a call to usb_set_intfdata(..., NULL).
-
-Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
-Link: https://lore.kernel.org/r/20220429210913.46804-1-skhan@linuxfoundation.org
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/misc/cardreader/rtsx_usb.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/drivers/misc/cardreader/rtsx_usb.c b/drivers/misc/cardreader/rtsx_usb.c
-index 59eda55d92a3..1ef9b61077c4 100644
---- a/drivers/misc/cardreader/rtsx_usb.c
-+++ b/drivers/misc/cardreader/rtsx_usb.c
-@@ -667,6 +667,7 @@ static int rtsx_usb_probe(struct usb_interface *intf,
- return 0;
-
- out_init_fail:
-+ usb_set_intfdata(ucr->pusb_intf, NULL);
- usb_free_coherent(ucr->pusb_dev, IOBUF_SIZE, ucr->iobuf,
- ucr->iobuf_dma);
- return ret;
---
-2.35.1
-
+++ /dev/null
-From 82c0fcae86f8f8dcc88ecedfeb2c3635b982b187 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 24 May 2022 01:46:22 +0900
-Subject: modpost: fix undefined behavior of is_arm_mapping_symbol()
-
-From: Masahiro Yamada <masahiroy@kernel.org>
-
-[ Upstream commit d6b732666a1bae0df3c3ae06925043bba34502b1 ]
-
-The return value of is_arm_mapping_symbol() is unpredictable when "$"
-is passed in.
-
-strchr(3) says:
- The strchr() and strrchr() functions return a pointer to the matched
- character or NULL if the character is not found. The terminating null
- byte is considered part of the string, so that if c is specified as
- '\0', these functions return a pointer to the terminator.
-
-When str[1] is '\0', strchr("axtd", str[1]) is not NULL, and str[2] is
-referenced (i.e. buffer overrun).
-
-Test code
----------
-
- char str1[] = "abc";
- char str2[] = "ab";
-
- strcpy(str1, "$");
- strcpy(str2, "$");
-
- printf("test1: %d\n", is_arm_mapping_symbol(str1));
- printf("test2: %d\n", is_arm_mapping_symbol(str2));
-
-Result
-------
-
- test1: 0
- test2: 1
-
-Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
-Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- scripts/mod/modpost.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
-index 3b098e26938e..eae6ae9d3c3b 100644
---- a/scripts/mod/modpost.c
-+++ b/scripts/mod/modpost.c
-@@ -1260,7 +1260,8 @@ static int secref_whitelist(const struct sectioncheck *mismatch,
-
- static inline int is_arm_mapping_symbol(const char *str)
- {
-- return str[0] == '$' && strchr("axtd", str[1])
-+ return str[0] == '$' &&
-+ (str[1] == 'a' || str[1] == 'd' || str[1] == 't' || str[1] == 'x')
- && (str[2] == '\0' || str[2] == '.');
- }
-
---
-2.35.1
-
+++ /dev/null
-From 39856ba158eaf2303a49e1adf3d5d7ad03809541 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 21 May 2022 15:37:44 +0800
-Subject: nbd: call genl_unregister_family() first in nbd_cleanup()
-
-From: Yu Kuai <yukuai3@huawei.com>
-
-[ Upstream commit 06c4da89c24e7023ea448cadf8e9daf06a0aae6e ]
-
-Otherwise there may be race between module removal and the handling of
-netlink command, which can lead to the oops as shown below:
-
- BUG: kernel NULL pointer dereference, address: 0000000000000098
- Oops: 0002 [#1] SMP PTI
- CPU: 1 PID: 31299 Comm: nbd-client Tainted: G E 5.14.0-rc4
- Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
- RIP: 0010:down_write+0x1a/0x50
- Call Trace:
- start_creating+0x89/0x130
- debugfs_create_dir+0x1b/0x130
- nbd_start_device+0x13d/0x390 [nbd]
- nbd_genl_connect+0x42f/0x748 [nbd]
- genl_family_rcv_msg_doit.isra.0+0xec/0x150
- genl_rcv_msg+0xe5/0x1e0
- netlink_rcv_skb+0x55/0x100
- genl_rcv+0x29/0x40
- netlink_unicast+0x1a8/0x250
- netlink_sendmsg+0x21b/0x430
- ____sys_sendmsg+0x2a4/0x2d0
- ___sys_sendmsg+0x81/0xc0
- __sys_sendmsg+0x62/0xb0
- __x64_sys_sendmsg+0x1f/0x30
- do_syscall_64+0x3b/0xc0
- entry_SYSCALL_64_after_hwframe+0x44/0xae
- Modules linked in: nbd(E-)
-
-Signed-off-by: Hou Tao <houtao1@huawei.com>
-Signed-off-by: Yu Kuai <yukuai3@huawei.com>
-Reviewed-by: Josef Bacik <josef@toxicpanda.com>
-Link: https://lore.kernel.org/r/20220521073749.3146892-2-yukuai3@huawei.com
-Signed-off-by: Jens Axboe <axboe@kernel.dk>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/block/nbd.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
-index ed678037ba6d..b4d309af27dd 100644
---- a/drivers/block/nbd.c
-+++ b/drivers/block/nbd.c
-@@ -2544,6 +2544,12 @@ static void __exit nbd_cleanup(void)
- struct nbd_device *nbd;
- LIST_HEAD(del_list);
-
-+ /*
-+ * Unregister netlink interface prior to waiting
-+ * for the completion of netlink commands.
-+ */
-+ genl_unregister_family(&nbd_genl_family);
-+
- nbd_dbg_close();
-
- mutex_lock(&nbd_index_mutex);
-@@ -2562,7 +2568,6 @@ static void __exit nbd_cleanup(void)
- destroy_workqueue(nbd_del_wq);
-
- idr_destroy(&nbd_index_idr);
-- genl_unregister_family(&nbd_genl_family);
- unregister_blkdev(NBD_MAJOR, "nbd");
- }
-
---
-2.35.1
-
+++ /dev/null
-From ff2e2a7ebcb8c5b96f33fbef678f4acef012599d Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 21 May 2022 15:37:47 +0800
-Subject: nbd: fix io hung while disconnecting device
-
-From: Yu Kuai <yukuai3@huawei.com>
-
-[ Upstream commit 09dadb5985023e27d4740ebd17e6fea4640110e5 ]
-
-In our tests, "qemu-nbd" triggers a io hung:
-
-INFO: task qemu-nbd:11445 blocked for more than 368 seconds.
- Not tainted 5.18.0-rc3-next-20220422-00003-g2176915513ca #884
-"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
-task:qemu-nbd state:D stack: 0 pid:11445 ppid: 1 flags:0x00000000
-Call Trace:
- <TASK>
- __schedule+0x480/0x1050
- ? _raw_spin_lock_irqsave+0x3e/0xb0
- schedule+0x9c/0x1b0
- blk_mq_freeze_queue_wait+0x9d/0xf0
- ? ipi_rseq+0x70/0x70
- blk_mq_freeze_queue+0x2b/0x40
- nbd_add_socket+0x6b/0x270 [nbd]
- nbd_ioctl+0x383/0x510 [nbd]
- blkdev_ioctl+0x18e/0x3e0
- __x64_sys_ioctl+0xac/0x120
- do_syscall_64+0x35/0x80
- entry_SYSCALL_64_after_hwframe+0x44/0xae
-RIP: 0033:0x7fd8ff706577
-RSP: 002b:00007fd8fcdfebf8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
-RAX: ffffffffffffffda RBX: 0000000040000000 RCX: 00007fd8ff706577
-RDX: 000000000000000d RSI: 000000000000ab00 RDI: 000000000000000f
-RBP: 000000000000000f R08: 000000000000fbe8 R09: 000055fe497c62b0
-R10: 00000002aff20000 R11: 0000000000000246 R12: 000000000000006d
-R13: 0000000000000000 R14: 00007ffe82dc5e70 R15: 00007fd8fcdff9c0
-
-"qemu-ndb -d" will call ioctl 'NBD_DISCONNECT' first, however, following
-message was found:
-
-block nbd0: Send disconnect failed -32
-
-Which indicate that something is wrong with the server. Then,
-"qemu-nbd -d" will call ioctl 'NBD_CLEAR_SOCK', however ioctl can't clear
-requests after commit 2516ab1543fd("nbd: only clear the queue on device
-teardown"). And in the meantime, request can't complete through timeout
-because nbd_xmit_timeout() will always return 'BLK_EH_RESET_TIMER', which
-means such request will never be completed in this situation.
-
-Now that the flag 'NBD_CMD_INFLIGHT' can make sure requests won't
-complete multiple times, switch back to call nbd_clear_sock() in
-nbd_clear_sock_ioctl(), so that inflight requests can be cleared.
-
-Signed-off-by: Yu Kuai <yukuai3@huawei.com>
-Reviewed-by: Josef Bacik <josef@toxicpanda.com>
-Link: https://lore.kernel.org/r/20220521073749.3146892-5-yukuai3@huawei.com
-Signed-off-by: Jens Axboe <axboe@kernel.dk>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/block/nbd.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
-index 7af1c9dbe9f5..151264a4be36 100644
---- a/drivers/block/nbd.c
-+++ b/drivers/block/nbd.c
-@@ -1434,7 +1434,7 @@ static int nbd_start_device_ioctl(struct nbd_device *nbd, struct block_device *b
- static void nbd_clear_sock_ioctl(struct nbd_device *nbd,
- struct block_device *bdev)
- {
-- sock_shutdown(nbd);
-+ nbd_clear_sock(nbd);
- __invalidate_device(bdev, true);
- nbd_bdev_reset(bdev);
- if (test_and_clear_bit(NBD_RT_HAS_CONFIG_REF,
---
-2.35.1
-
+++ /dev/null
-From 7b09a406f6d79f43726f1912c1f1906ca770a31d Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 21 May 2022 15:37:45 +0800
-Subject: nbd: fix race between nbd_alloc_config() and module removal
-
-From: Yu Kuai <yukuai3@huawei.com>
-
-[ Upstream commit c55b2b983b0fa012942c3eb16384b2b722caa810 ]
-
-When nbd module is being removing, nbd_alloc_config() may be
-called concurrently by nbd_genl_connect(), although try_module_get()
-will return false, but nbd_alloc_config() doesn't handle it.
-
-The race may lead to the leak of nbd_config and its related
-resources (e.g, recv_workq) and oops in nbd_read_stat() due
-to the unload of nbd module as shown below:
-
- BUG: kernel NULL pointer dereference, address: 0000000000000040
- Oops: 0000 [#1] SMP PTI
- CPU: 5 PID: 13840 Comm: kworker/u17:33 Not tainted 5.14.0+ #1
- Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
- Workqueue: knbd16-recv recv_work [nbd]
- RIP: 0010:nbd_read_stat.cold+0x130/0x1a4 [nbd]
- Call Trace:
- recv_work+0x3b/0xb0 [nbd]
- process_one_work+0x1ed/0x390
- worker_thread+0x4a/0x3d0
- kthread+0x12a/0x150
- ret_from_fork+0x22/0x30
-
-Fixing it by checking the return value of try_module_get()
-in nbd_alloc_config(). As nbd_alloc_config() may return ERR_PTR(-ENODEV),
-assign nbd->config only when nbd_alloc_config() succeeds to ensure
-the value of nbd->config is binary (valid or NULL).
-
-Also adding a debug message to check the reference counter
-of nbd_config during module removal.
-
-Signed-off-by: Hou Tao <houtao1@huawei.com>
-Signed-off-by: Yu Kuai <yukuai3@huawei.com>
-Reviewed-by: Josef Bacik <josef@toxicpanda.com>
-Link: https://lore.kernel.org/r/20220521073749.3146892-3-yukuai3@huawei.com
-Signed-off-by: Jens Axboe <axboe@kernel.dk>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/block/nbd.c | 28 +++++++++++++++++++---------
- 1 file changed, 19 insertions(+), 9 deletions(-)
-
-diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
-index b4d309af27dd..7af1c9dbe9f5 100644
---- a/drivers/block/nbd.c
-+++ b/drivers/block/nbd.c
-@@ -1533,15 +1533,20 @@ static struct nbd_config *nbd_alloc_config(void)
- {
- struct nbd_config *config;
-
-+ if (!try_module_get(THIS_MODULE))
-+ return ERR_PTR(-ENODEV);
-+
- config = kzalloc(sizeof(struct nbd_config), GFP_NOFS);
-- if (!config)
-- return NULL;
-+ if (!config) {
-+ module_put(THIS_MODULE);
-+ return ERR_PTR(-ENOMEM);
-+ }
-+
- atomic_set(&config->recv_threads, 0);
- init_waitqueue_head(&config->recv_wq);
- init_waitqueue_head(&config->conn_wait);
- config->blksize_bits = NBD_DEF_BLKSIZE_BITS;
- atomic_set(&config->live_connections, 0);
-- try_module_get(THIS_MODULE);
- return config;
- }
-
-@@ -1568,12 +1573,13 @@ static int nbd_open(struct block_device *bdev, fmode_t mode)
- mutex_unlock(&nbd->config_lock);
- goto out;
- }
-- config = nbd->config = nbd_alloc_config();
-- if (!config) {
-- ret = -ENOMEM;
-+ config = nbd_alloc_config();
-+ if (IS_ERR(config)) {
-+ ret = PTR_ERR(config);
- mutex_unlock(&nbd->config_lock);
- goto out;
- }
-+ nbd->config = config;
- refcount_set(&nbd->config_refs, 1);
- refcount_inc(&nbd->refs);
- mutex_unlock(&nbd->config_lock);
-@@ -1980,13 +1986,14 @@ static int nbd_genl_connect(struct sk_buff *skb, struct genl_info *info)
- nbd_put(nbd);
- return -EINVAL;
- }
-- config = nbd->config = nbd_alloc_config();
-- if (!nbd->config) {
-+ config = nbd_alloc_config();
-+ if (IS_ERR(config)) {
- mutex_unlock(&nbd->config_lock);
- nbd_put(nbd);
- printk(KERN_ERR "nbd: couldn't allocate config\n");
-- return -ENOMEM;
-+ return PTR_ERR(config);
- }
-+ nbd->config = config;
- refcount_set(&nbd->config_refs, 1);
- set_bit(NBD_RT_BOUND, &config->runtime_flags);
-
-@@ -2559,6 +2566,9 @@ static void __exit nbd_cleanup(void)
- while (!list_empty(&del_list)) {
- nbd = list_first_entry(&del_list, struct nbd_device, list);
- list_del_init(&nbd->list);
-+ if (refcount_read(&nbd->config_refs))
-+ printk(KERN_ERR "nbd: possibly leaking nbd_config (ref %d)\n",
-+ refcount_read(&nbd->config_refs));
- if (refcount_read(&nbd->refs) != 1)
- printk(KERN_ERR "nbd: possibly leaking a device\n");
- nbd_put(nbd);
---
-2.35.1
-
+++ /dev/null
-From 212e727f5154ea83d0037f613e9e62adc6d7c3a8 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 25 May 2022 00:56:18 +0200
-Subject: net, neigh: Set lower cap for neigh_managed_work rearming
-
-From: Daniel Borkmann <daniel@iogearbox.net>
-
-[ Upstream commit ed6cd6a17896561b9f51ab4c0d9bbb29e762b597 ]
-
-Yuwei reported that plain reuse of DELAY_PROBE_TIME to rearm work queue
-in neigh_managed_work is problematic if user explicitly configures the
-DELAY_PROBE_TIME to 0 for a neighbor table. Such misconfig can then hog
-CPU to 100% processing the system work queue. Instead, set lower interval
-bound to HZ which is totally sufficient. Yuwei is additionally looking
-into making the interval separately configurable from DELAY_PROBE_TIME.
-
-Reported-by: Yuwei Wang <wangyuweihx@gmail.com>
-Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
-Link: https://lore.kernel.org/netdev/797c3c53-ce1b-9f60-e253-cda615788f4a@iogearbox.net
-Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org>
-Link: https://lore.kernel.org/r/3b8c5aa906c52c3a8c995d1b2e8ccf650ea7c716.1653432794.git.daniel@iogearbox.net
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/core/neighbour.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/net/core/neighbour.c b/net/core/neighbour.c
-index ec0bf737b076..a252f4090d75 100644
---- a/net/core/neighbour.c
-+++ b/net/core/neighbour.c
-@@ -1579,7 +1579,7 @@ static void neigh_managed_work(struct work_struct *work)
- list_for_each_entry(neigh, &tbl->managed_list, managed_list)
- neigh_event_send_probe(neigh, NULL, false);
- queue_delayed_work(system_power_efficient_wq, &tbl->managed_work,
-- NEIGH_VAR(&tbl->parms, DELAY_PROBE_TIME));
-+ max(NEIGH_VAR(&tbl->parms, DELAY_PROBE_TIME), HZ));
- write_unlock_bh(&tbl->lock);
- }
-
---
-2.35.1
-
+++ /dev/null
-From c54bf9cff81f9a2369311a7e1d67ae13edb080af Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 18 May 2022 13:52:23 -0700
-Subject: nodemask: Fix return values to be unsigned
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Kees Cook <keescook@chromium.org>
-
-[ Upstream commit 0dfe54071d7c828a02917b595456bfde1afdddc9 ]
-
-The nodemask routines had mixed return values that provided potentially
-signed return values that could never happen. This was leading to the
-compiler getting confusing about the range of possible return values
-(it was thinking things could be negative where they could not be). Fix
-all the nodemask routines that should be returning unsigned
-(or bool) values. Silences:
-
- mm/swapfile.c: In function ‘setup_swap_info’:
- mm/swapfile.c:2291:47: error: array subscript -1 is below array bounds of ‘struct plist_node[]’ [-Werror=array-bounds]
- 2291 | p->avail_lists[i].prio = 1;
- | ~~~~~~~~~~~~~~^~~
- In file included from mm/swapfile.c:16:
- ./include/linux/swap.h:292:27: note: while referencing ‘avail_lists’
- 292 | struct plist_node avail_lists[]; /*
- | ^~~~~~~~~~~
-
-Reported-by: Christophe de Dinechin <dinechin@redhat.com>
-Link: https://lore.kernel.org/lkml/20220414150855.2407137-3-dinechin@redhat.com/
-Cc: Alexey Dobriyan <adobriyan@gmail.com>
-Cc: Yury Norov <yury.norov@gmail.com>
-Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
-Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
-Cc: Andrew Morton <akpm@linux-foundation.org>
-Cc: Zhen Lei <thunder.leizhen@huawei.com>
-Signed-off-by: Kees Cook <keescook@chromium.org>
-Signed-off-by: Yury Norov <yury.norov@gmail.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- include/linux/nodemask.h | 38 +++++++++++++++++++-------------------
- lib/nodemask.c | 4 ++--
- 2 files changed, 21 insertions(+), 21 deletions(-)
-
-diff --git a/include/linux/nodemask.h b/include/linux/nodemask.h
-index c6199dbe2591..0f233b76c9ce 100644
---- a/include/linux/nodemask.h
-+++ b/include/linux/nodemask.h
-@@ -42,11 +42,11 @@
- * void nodes_shift_right(dst, src, n) Shift right
- * void nodes_shift_left(dst, src, n) Shift left
- *
-- * int first_node(mask) Number lowest set bit, or MAX_NUMNODES
-- * int next_node(node, mask) Next node past 'node', or MAX_NUMNODES
-- * int next_node_in(node, mask) Next node past 'node', or wrap to first,
-+ * unsigned int first_node(mask) Number lowest set bit, or MAX_NUMNODES
-+ * unsigend int next_node(node, mask) Next node past 'node', or MAX_NUMNODES
-+ * unsigned int next_node_in(node, mask) Next node past 'node', or wrap to first,
- * or MAX_NUMNODES
-- * int first_unset_node(mask) First node not set in mask, or
-+ * unsigned int first_unset_node(mask) First node not set in mask, or
- * MAX_NUMNODES
- *
- * nodemask_t nodemask_of_node(node) Return nodemask with bit 'node' set
-@@ -153,7 +153,7 @@ static inline void __nodes_clear(nodemask_t *dstp, unsigned int nbits)
-
- #define node_test_and_set(node, nodemask) \
- __node_test_and_set((node), &(nodemask))
--static inline int __node_test_and_set(int node, nodemask_t *addr)
-+static inline bool __node_test_and_set(int node, nodemask_t *addr)
- {
- return test_and_set_bit(node, addr->bits);
- }
-@@ -200,7 +200,7 @@ static inline void __nodes_complement(nodemask_t *dstp,
-
- #define nodes_equal(src1, src2) \
- __nodes_equal(&(src1), &(src2), MAX_NUMNODES)
--static inline int __nodes_equal(const nodemask_t *src1p,
-+static inline bool __nodes_equal(const nodemask_t *src1p,
- const nodemask_t *src2p, unsigned int nbits)
- {
- return bitmap_equal(src1p->bits, src2p->bits, nbits);
-@@ -208,7 +208,7 @@ static inline int __nodes_equal(const nodemask_t *src1p,
-
- #define nodes_intersects(src1, src2) \
- __nodes_intersects(&(src1), &(src2), MAX_NUMNODES)
--static inline int __nodes_intersects(const nodemask_t *src1p,
-+static inline bool __nodes_intersects(const nodemask_t *src1p,
- const nodemask_t *src2p, unsigned int nbits)
- {
- return bitmap_intersects(src1p->bits, src2p->bits, nbits);
-@@ -216,20 +216,20 @@ static inline int __nodes_intersects(const nodemask_t *src1p,
-
- #define nodes_subset(src1, src2) \
- __nodes_subset(&(src1), &(src2), MAX_NUMNODES)
--static inline int __nodes_subset(const nodemask_t *src1p,
-+static inline bool __nodes_subset(const nodemask_t *src1p,
- const nodemask_t *src2p, unsigned int nbits)
- {
- return bitmap_subset(src1p->bits, src2p->bits, nbits);
- }
-
- #define nodes_empty(src) __nodes_empty(&(src), MAX_NUMNODES)
--static inline int __nodes_empty(const nodemask_t *srcp, unsigned int nbits)
-+static inline bool __nodes_empty(const nodemask_t *srcp, unsigned int nbits)
- {
- return bitmap_empty(srcp->bits, nbits);
- }
-
- #define nodes_full(nodemask) __nodes_full(&(nodemask), MAX_NUMNODES)
--static inline int __nodes_full(const nodemask_t *srcp, unsigned int nbits)
-+static inline bool __nodes_full(const nodemask_t *srcp, unsigned int nbits)
- {
- return bitmap_full(srcp->bits, nbits);
- }
-@@ -260,15 +260,15 @@ static inline void __nodes_shift_left(nodemask_t *dstp,
- > MAX_NUMNODES, then the silly min_ts could be dropped. */
-
- #define first_node(src) __first_node(&(src))
--static inline int __first_node(const nodemask_t *srcp)
-+static inline unsigned int __first_node(const nodemask_t *srcp)
- {
-- return min_t(int, MAX_NUMNODES, find_first_bit(srcp->bits, MAX_NUMNODES));
-+ return min_t(unsigned int, MAX_NUMNODES, find_first_bit(srcp->bits, MAX_NUMNODES));
- }
-
- #define next_node(n, src) __next_node((n), &(src))
--static inline int __next_node(int n, const nodemask_t *srcp)
-+static inline unsigned int __next_node(int n, const nodemask_t *srcp)
- {
-- return min_t(int,MAX_NUMNODES,find_next_bit(srcp->bits, MAX_NUMNODES, n+1));
-+ return min_t(unsigned int, MAX_NUMNODES, find_next_bit(srcp->bits, MAX_NUMNODES, n+1));
- }
-
- /*
-@@ -276,7 +276,7 @@ static inline int __next_node(int n, const nodemask_t *srcp)
- * the first node in src if needed. Returns MAX_NUMNODES if src is empty.
- */
- #define next_node_in(n, src) __next_node_in((n), &(src))
--int __next_node_in(int node, const nodemask_t *srcp);
-+unsigned int __next_node_in(int node, const nodemask_t *srcp);
-
- static inline void init_nodemask_of_node(nodemask_t *mask, int node)
- {
-@@ -296,9 +296,9 @@ static inline void init_nodemask_of_node(nodemask_t *mask, int node)
- })
-
- #define first_unset_node(mask) __first_unset_node(&(mask))
--static inline int __first_unset_node(const nodemask_t *maskp)
-+static inline unsigned int __first_unset_node(const nodemask_t *maskp)
- {
-- return min_t(int,MAX_NUMNODES,
-+ return min_t(unsigned int, MAX_NUMNODES,
- find_first_zero_bit(maskp->bits, MAX_NUMNODES));
- }
-
-@@ -435,11 +435,11 @@ static inline int num_node_state(enum node_states state)
-
- #define first_online_node first_node(node_states[N_ONLINE])
- #define first_memory_node first_node(node_states[N_MEMORY])
--static inline int next_online_node(int nid)
-+static inline unsigned int next_online_node(int nid)
- {
- return next_node(nid, node_states[N_ONLINE]);
- }
--static inline int next_memory_node(int nid)
-+static inline unsigned int next_memory_node(int nid)
- {
- return next_node(nid, node_states[N_MEMORY]);
- }
-diff --git a/lib/nodemask.c b/lib/nodemask.c
-index 3aa454c54c0d..e22647f5181b 100644
---- a/lib/nodemask.c
-+++ b/lib/nodemask.c
-@@ -3,9 +3,9 @@
- #include <linux/module.h>
- #include <linux/random.h>
-
--int __next_node_in(int node, const nodemask_t *srcp)
-+unsigned int __next_node_in(int node, const nodemask_t *srcp)
- {
-- int ret = __next_node(node, srcp);
-+ unsigned int ret = __next_node(node, srcp);
-
- if (ret == MAX_NUMNODES)
- ret = __first_node(srcp);
---
-2.35.1
-
+++ /dev/null
-From 83719229113d8e8ce3fba58eeb76166fd1a174ba Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 23 May 2022 22:05:24 +0200
-Subject: Revert "net: af_key: add check for pfkey_broadcast in function
- pfkey_process"
-
-From: Michal Kubecek <mkubecek@suse.cz>
-
-[ Upstream commit 9c90c9b3e50e16d03c7f87d63e9db373974781e0 ]
-
-This reverts commit 4dc2a5a8f6754492180741facf2a8787f2c415d7.
-
-A non-zero return value from pfkey_broadcast() does not necessarily mean
-an error occurred as this function returns -ESRCH when no registered
-listener received the message. In particular, a call with
-BROADCAST_PROMISC_ONLY flag and null one_sk argument can never return
-zero so that this commit in fact prevents processing any PF_KEY message.
-One visible effect is that racoon daemon fails to find encryption
-algorithms like aes and refuses to start.
-
-Excluding -ESRCH return value would fix this but it's not obvious that
-we really want to bail out here and most other callers of
-pfkey_broadcast() also ignore the return value. Also, as pointed out by
-Steffen Klassert, PF_KEY is kind of deprecated and newer userspace code
-should use netlink instead so that we should only disturb the code for
-really important fixes.
-
-v2: add a comment explaining why is the return value ignored
-
-Signed-off-by: Michal Kubecek <mkubecek@suse.cz>
-Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/key/af_key.c | 10 ++++++----
- 1 file changed, 6 insertions(+), 4 deletions(-)
-
-diff --git a/net/key/af_key.c b/net/key/af_key.c
-index 339d95df19d3..d93bde657359 100644
---- a/net/key/af_key.c
-+++ b/net/key/af_key.c
-@@ -2826,10 +2826,12 @@ static int pfkey_process(struct sock *sk, struct sk_buff *skb, const struct sadb
- void *ext_hdrs[SADB_EXT_MAX];
- int err;
-
-- err = pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL,
-- BROADCAST_PROMISC_ONLY, NULL, sock_net(sk));
-- if (err)
-- return err;
-+ /* Non-zero return value of pfkey_broadcast() does not always signal
-+ * an error and even on an actual error we may still want to process
-+ * the message so rather ignore the return value.
-+ */
-+ pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL,
-+ BROADCAST_PROMISC_ONLY, NULL, sock_net(sk));
-
- memset(ext_hdrs, 0, sizeof(ext_hdrs));
- err = parse_exthdrs(skb, hdr, ext_hdrs);
---
-2.35.1
-
+++ /dev/null
-From 3d244c4b4bb46672d5e11a5b5ce98facd4498a29 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 11 May 2022 15:18:54 -0500
-Subject: Revert "PCI: brcmstb: Add control of subdevice voltage regulators"
-
-From: Bjorn Helgaas <bhelgaas@google.com>
-
-[ Upstream commit 212942609d83b591f5a2f2691df122d13aa3a87d ]
-
-This reverts commit 93e41f3fca3d4a0f927b784012338c37f80a8a80.
-
-This is part of a revert of the following commits:
-
- 11ed8b8624b8 ("PCI: brcmstb: Do not turn off WOL regulators on suspend")
- 93e41f3fca3d ("PCI: brcmstb: Add control of subdevice voltage regulators")
- 67211aadcb4b ("PCI: brcmstb: Add mechanism to turn on subdev regulators")
- 830aa6f29f07 ("PCI: brcmstb: Split brcm_pcie_setup() into two funcs")
-
-Cyril reported that 830aa6f29f07 ("PCI: brcmstb: Split brcm_pcie_setup()
-into two funcs"), which appeared in v5.17-rc1, broke booting on the
-Raspberry Pi Compute Module 4. Apparently 830aa6f29f07 panics with an
-Asynchronous SError Interrupt, and after further commits here is a black
-screen on HDMI and no output on the serial console.
-
-This does not seem to affect the Raspberry Pi 4 B.
-
-Link: https://bugzilla.kernel.org/show_bug.cgi?id=215925
-Link: https://lore.kernel.org/r/20220511201856.808690-3-helgaas@kernel.org
-Reported-by: Cyril Brulebois <kibi@debian.org>
-Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/pci/controller/pcie-brcmstb.c | 83 ++-------------------------
- 1 file changed, 5 insertions(+), 78 deletions(-)
-
-diff --git a/drivers/pci/controller/pcie-brcmstb.c b/drivers/pci/controller/pcie-brcmstb.c
-index 3edd63735948..fd464d38fecb 100644
---- a/drivers/pci/controller/pcie-brcmstb.c
-+++ b/drivers/pci/controller/pcie-brcmstb.c
-@@ -196,8 +196,6 @@ static inline void brcm_pcie_bridge_sw_init_set_generic(struct brcm_pcie *pcie,
- static inline void brcm_pcie_perst_set_4908(struct brcm_pcie *pcie, u32 val);
- static inline void brcm_pcie_perst_set_7278(struct brcm_pcie *pcie, u32 val);
- static inline void brcm_pcie_perst_set_generic(struct brcm_pcie *pcie, u32 val);
--static int brcm_pcie_linkup(struct brcm_pcie *pcie);
--static int brcm_pcie_add_bus(struct pci_bus *bus);
-
- enum {
- RGR1_SW_INIT_1,
-@@ -331,8 +329,6 @@ struct brcm_pcie {
- u32 hw_rev;
- void (*perst_set)(struct brcm_pcie *pcie, u32 val);
- void (*bridge_sw_init_set)(struct brcm_pcie *pcie, u32 val);
-- bool refusal_mode;
-- struct subdev_regulators *sr;
- };
-
- static inline bool is_bmips(const struct brcm_pcie *pcie)
-@@ -501,34 +497,6 @@ static int pci_subdev_regulators_add_bus(struct pci_bus *bus)
- return 0;
- }
-
--static int brcm_pcie_add_bus(struct pci_bus *bus)
--{
-- struct device *dev = &bus->dev;
-- struct brcm_pcie *pcie = (struct brcm_pcie *) bus->sysdata;
-- int ret;
--
-- if (!dev->of_node || !bus->parent || !pci_is_root_bus(bus->parent))
-- return 0;
--
-- ret = pci_subdev_regulators_add_bus(bus);
-- if (ret)
-- return ret;
--
-- /* Grab the regulators for suspend/resume */
-- pcie->sr = bus->dev.driver_data;
--
-- /*
-- * If we have failed linkup there is no point to return an error as
-- * currently it will cause a WARNING() from pci_alloc_child_bus().
-- * We return 0 and turn on the "refusal_mode" so that any further
-- * accesses to the pci_dev just get 0xffffffff
-- */
-- if (brcm_pcie_linkup(pcie) != 0)
-- pcie->refusal_mode = true;
--
-- return 0;
--}
--
- static void pci_subdev_regulators_remove_bus(struct pci_bus *bus)
- {
- struct device *dev = &bus->dev;
-@@ -857,18 +825,6 @@ static void __iomem *brcm_pcie_map_conf(struct pci_bus *bus, unsigned int devfn,
- /* Accesses to the RC go right to the RC registers if slot==0 */
- if (pci_is_root_bus(bus))
- return PCI_SLOT(devfn) ? NULL : base + where;
-- if (pcie->refusal_mode) {
-- /*
-- * At this point we do not have link. There will be a CPU
-- * abort -- a quirk with this controller --if Linux tries
-- * to read any config-space registers besides those
-- * targeting the host bridge. To prevent this we hijack
-- * the address to point to a safe access that will return
-- * 0xffffffff.
-- */
-- writel(0xffffffff, base + PCIE_MISC_RC_BAR2_CONFIG_HI);
-- return base + PCIE_MISC_RC_BAR2_CONFIG_HI + (where & 0x3);
-- }
-
- /* For devices, write to the config space index register */
- idx = PCIE_ECAM_OFFSET(bus->number, devfn, 0);
-@@ -897,7 +853,7 @@ static struct pci_ops brcm_pcie_ops = {
- .map_bus = brcm_pcie_map_conf,
- .read = pci_generic_config_read,
- .write = pci_generic_config_write,
-- .add_bus = brcm_pcie_add_bus,
-+ .add_bus = pci_subdev_regulators_add_bus,
- .remove_bus = pci_subdev_regulators_remove_bus,
- };
-
-@@ -1370,14 +1326,6 @@ static int brcm_pcie_suspend(struct device *dev)
- return ret;
- }
-
-- if (pcie->sr) {
-- ret = regulator_bulk_disable(pcie->sr->num_supplies, pcie->sr->supplies);
-- if (ret) {
-- dev_err(dev, "Could not turn off regulators\n");
-- reset_control_reset(pcie->rescal);
-- return ret;
-- }
-- }
- clk_disable_unprepare(pcie->clk);
-
- return 0;
-@@ -1395,17 +1343,9 @@ static int brcm_pcie_resume(struct device *dev)
- if (ret)
- return ret;
-
-- if (pcie->sr) {
-- ret = regulator_bulk_enable(pcie->sr->num_supplies, pcie->sr->supplies);
-- if (ret) {
-- dev_err(dev, "Could not turn on regulators\n");
-- goto err_disable_clk;
-- }
-- }
--
- ret = reset_control_reset(pcie->rescal);
- if (ret)
-- goto err_regulator;
-+ goto err_disable_clk;
-
- ret = brcm_phy_start(pcie);
- if (ret)
-@@ -1437,9 +1377,6 @@ static int brcm_pcie_resume(struct device *dev)
-
- err_reset:
- reset_control_rearm(pcie->rescal);
--err_regulator:
-- if (pcie->sr)
-- regulator_bulk_disable(pcie->sr->num_supplies, pcie->sr->supplies);
- err_disable_clk:
- clk_disable_unprepare(pcie->clk);
- return ret;
-@@ -1571,17 +1508,7 @@ static int brcm_pcie_probe(struct platform_device *pdev)
-
- platform_set_drvdata(pdev, pcie);
-
-- ret = pci_host_probe(bridge);
-- if (!ret && !brcm_pcie_link_up(pcie))
-- ret = -ENODEV;
--
-- if (ret) {
-- brcm_pcie_remove(pdev);
-- return ret;
-- }
--
-- return 0;
--
-+ return pci_host_probe(bridge);
- fail:
- __brcm_pcie_remove(pcie);
- return ret;
-@@ -1590,8 +1517,8 @@ static int brcm_pcie_probe(struct platform_device *pdev)
- MODULE_DEVICE_TABLE(of, brcm_pcie_match);
-
- static const struct dev_pm_ops brcm_pcie_pm_ops = {
-- .suspend_noirq = brcm_pcie_suspend,
-- .resume_noirq = brcm_pcie_resume,
-+ .suspend = brcm_pcie_suspend,
-+ .resume = brcm_pcie_resume,
- };
-
- static struct platform_driver brcm_pcie_driver = {
---
-2.35.1
-
+++ /dev/null
-From a40adc64d59da281bb95540df88930167cf32acd Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 11 May 2022 15:18:55 -0500
-Subject: Revert "PCI: brcmstb: Add mechanism to turn on subdev regulators"
-
-From: Bjorn Helgaas <bhelgaas@google.com>
-
-[ Upstream commit 420be2f7ebe60c9ba3e332f5290017cd168e2bf8 ]
-
-This reverts commit 67211aadcb4b968d0fdc57bc27240fa71500c2d4.
-
-This is part of a revert of the following commits:
-
- 11ed8b8624b8 ("PCI: brcmstb: Do not turn off WOL regulators on suspend")
- 93e41f3fca3d ("PCI: brcmstb: Add control of subdevice voltage regulators")
- 67211aadcb4b ("PCI: brcmstb: Add mechanism to turn on subdev regulators")
- 830aa6f29f07 ("PCI: brcmstb: Split brcm_pcie_setup() into two funcs")
-
-Cyril reported that 830aa6f29f07 ("PCI: brcmstb: Split brcm_pcie_setup()
-into two funcs"), which appeared in v5.17-rc1, broke booting on the
-Raspberry Pi Compute Module 4. Apparently 830aa6f29f07 panics with an
-Asynchronous SError Interrupt, and after further commits here is a black
-screen on HDMI and no output on the serial console.
-
-This does not seem to affect the Raspberry Pi 4 B.
-
-Link: https://bugzilla.kernel.org/show_bug.cgi?id=215925
-Link: https://lore.kernel.org/r/20220511201856.808690-4-helgaas@kernel.org
-Reported-by: Cyril Brulebois <kibi@debian.org>
-Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/pci/controller/pcie-brcmstb.c | 76 ---------------------------
- 1 file changed, 76 deletions(-)
-
-diff --git a/drivers/pci/controller/pcie-brcmstb.c b/drivers/pci/controller/pcie-brcmstb.c
-index fd464d38fecb..0e8346114a8d 100644
---- a/drivers/pci/controller/pcie-brcmstb.c
-+++ b/drivers/pci/controller/pcie-brcmstb.c
-@@ -24,7 +24,6 @@
- #include <linux/pci.h>
- #include <linux/pci-ecam.h>
- #include <linux/printk.h>
--#include <linux/regulator/consumer.h>
- #include <linux/reset.h>
- #include <linux/sizes.h>
- #include <linux/slab.h>
-@@ -284,14 +283,6 @@ static const struct pcie_cfg_data bcm2711_cfg = {
- .bridge_sw_init_set = brcm_pcie_bridge_sw_init_set_generic,
- };
-
--struct subdev_regulators {
-- unsigned int num_supplies;
-- struct regulator_bulk_data supplies[];
--};
--
--static int pci_subdev_regulators_add_bus(struct pci_bus *bus);
--static void pci_subdev_regulators_remove_bus(struct pci_bus *bus);
--
- struct brcm_msi {
- struct device *dev;
- void __iomem *base;
-@@ -445,71 +436,6 @@ static int brcm_pcie_set_ssc(struct brcm_pcie *pcie)
- return ssc && pll ? 0 : -EIO;
- }
-
--static void *alloc_subdev_regulators(struct device *dev)
--{
-- static const char * const supplies[] = {
-- "vpcie3v3",
-- "vpcie3v3aux",
-- "vpcie12v",
-- };
-- const size_t size = sizeof(struct subdev_regulators)
-- + sizeof(struct regulator_bulk_data) * ARRAY_SIZE(supplies);
-- struct subdev_regulators *sr;
-- int i;
--
-- sr = devm_kzalloc(dev, size, GFP_KERNEL);
-- if (sr) {
-- sr->num_supplies = ARRAY_SIZE(supplies);
-- for (i = 0; i < ARRAY_SIZE(supplies); i++)
-- sr->supplies[i].supply = supplies[i];
-- }
--
-- return sr;
--}
--
--static int pci_subdev_regulators_add_bus(struct pci_bus *bus)
--{
-- struct device *dev = &bus->dev;
-- struct subdev_regulators *sr;
-- int ret;
--
-- if (!dev->of_node || !bus->parent || !pci_is_root_bus(bus->parent))
-- return 0;
--
-- if (dev->driver_data)
-- dev_err(dev, "dev.driver_data unexpectedly non-NULL\n");
--
-- sr = alloc_subdev_regulators(dev);
-- if (!sr)
-- return -ENOMEM;
--
-- dev->driver_data = sr;
-- ret = regulator_bulk_get(dev, sr->num_supplies, sr->supplies);
-- if (ret)
-- return ret;
--
-- ret = regulator_bulk_enable(sr->num_supplies, sr->supplies);
-- if (ret) {
-- dev_err(dev, "failed to enable regulators for downstream device\n");
-- return ret;
-- }
--
-- return 0;
--}
--
--static void pci_subdev_regulators_remove_bus(struct pci_bus *bus)
--{
-- struct device *dev = &bus->dev;
-- struct subdev_regulators *sr = dev->driver_data;
--
-- if (!sr || !bus->parent || !pci_is_root_bus(bus->parent))
-- return;
--
-- if (regulator_bulk_disable(sr->num_supplies, sr->supplies))
-- dev_err(dev, "failed to disable regulators for downstream device\n");
-- dev->driver_data = NULL;
--}
--
- /* Limits operation to a specific generation (1, 2, or 3) */
- static void brcm_pcie_set_gen(struct brcm_pcie *pcie, int gen)
- {
-@@ -853,8 +779,6 @@ static struct pci_ops brcm_pcie_ops = {
- .map_bus = brcm_pcie_map_conf,
- .read = pci_generic_config_read,
- .write = pci_generic_config_write,
-- .add_bus = pci_subdev_regulators_add_bus,
-- .remove_bus = pci_subdev_regulators_remove_bus,
- };
-
- static struct pci_ops brcm_pcie_ops32 = {
---
-2.35.1
-
+++ /dev/null
-From 6d02312f54e149d9ecff06ea835657ae9ee96604 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 11 May 2022 15:18:53 -0500
-Subject: Revert "PCI: brcmstb: Do not turn off WOL regulators on suspend"
-
-From: Bjorn Helgaas <bhelgaas@google.com>
-
-[ Upstream commit 7894025c783ca36394d3afe49c8cfb4c830b82fe ]
-
-This reverts commit 11ed8b8624b8085f706864b4addcd304b1e4fc38.
-
-This is part of a revert of the following commits:
-
- 11ed8b8624b8 ("PCI: brcmstb: Do not turn off WOL regulators on suspend")
- 93e41f3fca3d ("PCI: brcmstb: Add control of subdevice voltage regulators")
- 67211aadcb4b ("PCI: brcmstb: Add mechanism to turn on subdev regulators")
- 830aa6f29f07 ("PCI: brcmstb: Split brcm_pcie_setup() into two funcs")
-
-Cyril reported that 830aa6f29f07 ("PCI: brcmstb: Split brcm_pcie_setup()
-into two funcs"), which appeared in v5.17-rc1, broke booting on the
-Raspberry Pi Compute Module 4. Apparently 830aa6f29f07 panics with an
-Asynchronous SError Interrupt, and after further commits here is a black
-screen on HDMI and no output on the serial console.
-
-This does not seem to affect the Raspberry Pi 4 B.
-
-Link: https://bugzilla.kernel.org/show_bug.cgi?id=215925
-Link: https://lore.kernel.org/r/20220511201856.808690-2-helgaas@kernel.org
-Reported-by: Cyril Brulebois <kibi@debian.org>
-Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/pci/controller/pcie-brcmstb.c | 53 +++++----------------------
- 1 file changed, 9 insertions(+), 44 deletions(-)
-
-diff --git a/drivers/pci/controller/pcie-brcmstb.c b/drivers/pci/controller/pcie-brcmstb.c
-index 375c0c40bbf8..3edd63735948 100644
---- a/drivers/pci/controller/pcie-brcmstb.c
-+++ b/drivers/pci/controller/pcie-brcmstb.c
-@@ -333,7 +333,6 @@ struct brcm_pcie {
- void (*bridge_sw_init_set)(struct brcm_pcie *pcie, u32 val);
- bool refusal_mode;
- struct subdev_regulators *sr;
-- bool ep_wakeup_capable;
- };
-
- static inline bool is_bmips(const struct brcm_pcie *pcie)
-@@ -1351,21 +1350,9 @@ static void brcm_pcie_turn_off(struct brcm_pcie *pcie)
- pcie->bridge_sw_init_set(pcie, 1);
- }
-
--static int pci_dev_may_wakeup(struct pci_dev *dev, void *data)
--{
-- bool *ret = data;
--
-- if (device_may_wakeup(&dev->dev)) {
-- *ret = true;
-- dev_info(&dev->dev, "disable cancelled for wake-up device\n");
-- }
-- return (int) *ret;
--}
--
- static int brcm_pcie_suspend(struct device *dev)
- {
- struct brcm_pcie *pcie = dev_get_drvdata(dev);
-- struct pci_host_bridge *bridge = pci_host_bridge_from_priv(pcie);
- int ret;
-
- brcm_pcie_turn_off(pcie);
-@@ -1384,22 +1371,11 @@ static int brcm_pcie_suspend(struct device *dev)
- }
-
- if (pcie->sr) {
-- /*
-- * Now turn off the regulators, but if at least one
-- * downstream device is enabled as a wake-up source, do not
-- * turn off regulators.
-- */
-- pcie->ep_wakeup_capable = false;
-- pci_walk_bus(bridge->bus, pci_dev_may_wakeup,
-- &pcie->ep_wakeup_capable);
-- if (!pcie->ep_wakeup_capable) {
-- ret = regulator_bulk_disable(pcie->sr->num_supplies,
-- pcie->sr->supplies);
-- if (ret) {
-- dev_err(dev, "Could not turn off regulators\n");
-- reset_control_reset(pcie->rescal);
-- return ret;
-- }
-+ ret = regulator_bulk_disable(pcie->sr->num_supplies, pcie->sr->supplies);
-+ if (ret) {
-+ dev_err(dev, "Could not turn off regulators\n");
-+ reset_control_reset(pcie->rescal);
-+ return ret;
- }
- }
- clk_disable_unprepare(pcie->clk);
-@@ -1420,21 +1396,10 @@ static int brcm_pcie_resume(struct device *dev)
- return ret;
-
- if (pcie->sr) {
-- if (pcie->ep_wakeup_capable) {
-- /*
-- * We are resuming from a suspend. In the suspend we
-- * did not disable the power supplies, so there is
-- * no need to enable them (and falsely increase their
-- * usage count).
-- */
-- pcie->ep_wakeup_capable = false;
-- } else {
-- ret = regulator_bulk_enable(pcie->sr->num_supplies,
-- pcie->sr->supplies);
-- if (ret) {
-- dev_err(dev, "Could not turn on regulators\n");
-- goto err_disable_clk;
-- }
-+ ret = regulator_bulk_enable(pcie->sr->num_supplies, pcie->sr->supplies);
-+ if (ret) {
-+ dev_err(dev, "Could not turn on regulators\n");
-+ goto err_disable_clk;
- }
- }
-
---
-2.35.1
-
+++ /dev/null
-From 58d794d932e0c687f91e35a6b0ea1a89c8dc5491 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 11 May 2022 15:18:56 -0500
-Subject: Revert "PCI: brcmstb: Split brcm_pcie_setup() into two funcs"
-
-From: Bjorn Helgaas <bhelgaas@google.com>
-
-[ Upstream commit f4fd559de3434c44bed1d2912bd0c75cfa42898b ]
-
-This reverts commit 830aa6f29f07a4e2f1a947dfa72b3ccddb46dd21.
-
-This is part of a revert of the following commits:
-
- 11ed8b8624b8 ("PCI: brcmstb: Do not turn off WOL regulators on suspend")
- 93e41f3fca3d ("PCI: brcmstb: Add control of subdevice voltage regulators")
- 67211aadcb4b ("PCI: brcmstb: Add mechanism to turn on subdev regulators")
- 830aa6f29f07 ("PCI: brcmstb: Split brcm_pcie_setup() into two funcs")
-
-Cyril reported that 830aa6f29f07 ("PCI: brcmstb: Split brcm_pcie_setup()
-into two funcs"), which appeared in v5.17-rc1, broke booting on the
-Raspberry Pi Compute Module 4. Apparently 830aa6f29f07 panics with an
-Asynchronous SError Interrupt, and after further commits here is a black
-screen on HDMI and no output on the serial console.
-
-This does not seem to affect the Raspberry Pi 4 B.
-
-Link: https://bugzilla.kernel.org/show_bug.cgi?id=215925
-Link: https://lore.kernel.org/r/20220511201856.808690-5-helgaas@kernel.org
-Reported-by: Cyril Brulebois <kibi@debian.org>
-Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/pci/controller/pcie-brcmstb.c | 65 +++++++++++----------------
- 1 file changed, 26 insertions(+), 39 deletions(-)
-
-diff --git a/drivers/pci/controller/pcie-brcmstb.c b/drivers/pci/controller/pcie-brcmstb.c
-index 0e8346114a8d..e61058e13818 100644
---- a/drivers/pci/controller/pcie-brcmstb.c
-+++ b/drivers/pci/controller/pcie-brcmstb.c
-@@ -926,9 +926,16 @@ static inline int brcm_pcie_get_rc_bar2_size_and_offset(struct brcm_pcie *pcie,
-
- static int brcm_pcie_setup(struct brcm_pcie *pcie)
- {
-+ struct pci_host_bridge *bridge = pci_host_bridge_from_priv(pcie);
- u64 rc_bar2_offset, rc_bar2_size;
- void __iomem *base = pcie->base;
-- int ret, memc;
-+ struct device *dev = pcie->dev;
-+ struct resource_entry *entry;
-+ bool ssc_good = false;
-+ struct resource *res;
-+ int num_out_wins = 0;
-+ u16 nlw, cls, lnksta;
-+ int i, ret, memc;
- u32 tmp, burst, aspm_support;
-
- /* Reset the bridge */
-@@ -1018,40 +1025,6 @@ static int brcm_pcie_setup(struct brcm_pcie *pcie)
- if (pcie->gen)
- brcm_pcie_set_gen(pcie, pcie->gen);
-
-- /* Don't advertise L0s capability if 'aspm-no-l0s' */
-- aspm_support = PCIE_LINK_STATE_L1;
-- if (!of_property_read_bool(pcie->np, "aspm-no-l0s"))
-- aspm_support |= PCIE_LINK_STATE_L0S;
-- tmp = readl(base + PCIE_RC_CFG_PRIV1_LINK_CAPABILITY);
-- u32p_replace_bits(&tmp, aspm_support,
-- PCIE_RC_CFG_PRIV1_LINK_CAPABILITY_ASPM_SUPPORT_MASK);
-- writel(tmp, base + PCIE_RC_CFG_PRIV1_LINK_CAPABILITY);
--
-- /*
-- * For config space accesses on the RC, show the right class for
-- * a PCIe-PCIe bridge (the default setting is to be EP mode).
-- */
-- tmp = readl(base + PCIE_RC_CFG_PRIV1_ID_VAL3);
-- u32p_replace_bits(&tmp, 0x060400,
-- PCIE_RC_CFG_PRIV1_ID_VAL3_CLASS_CODE_MASK);
-- writel(tmp, base + PCIE_RC_CFG_PRIV1_ID_VAL3);
--
-- return 0;
--}
--
--static int brcm_pcie_linkup(struct brcm_pcie *pcie)
--{
-- struct pci_host_bridge *bridge = pci_host_bridge_from_priv(pcie);
-- struct device *dev = pcie->dev;
-- void __iomem *base = pcie->base;
-- struct resource_entry *entry;
-- struct resource *res;
-- int num_out_wins = 0;
-- u16 nlw, cls, lnksta;
-- bool ssc_good = false;
-- u32 tmp;
-- int ret, i;
--
- /* Unassert the fundamental reset */
- pcie->perst_set(pcie, 0);
-
-@@ -1102,6 +1075,24 @@ static int brcm_pcie_linkup(struct brcm_pcie *pcie)
- num_out_wins++;
- }
-
-+ /* Don't advertise L0s capability if 'aspm-no-l0s' */
-+ aspm_support = PCIE_LINK_STATE_L1;
-+ if (!of_property_read_bool(pcie->np, "aspm-no-l0s"))
-+ aspm_support |= PCIE_LINK_STATE_L0S;
-+ tmp = readl(base + PCIE_RC_CFG_PRIV1_LINK_CAPABILITY);
-+ u32p_replace_bits(&tmp, aspm_support,
-+ PCIE_RC_CFG_PRIV1_LINK_CAPABILITY_ASPM_SUPPORT_MASK);
-+ writel(tmp, base + PCIE_RC_CFG_PRIV1_LINK_CAPABILITY);
-+
-+ /*
-+ * For config space accesses on the RC, show the right class for
-+ * a PCIe-PCIe bridge (the default setting is to be EP mode).
-+ */
-+ tmp = readl(base + PCIE_RC_CFG_PRIV1_ID_VAL3);
-+ u32p_replace_bits(&tmp, 0x060400,
-+ PCIE_RC_CFG_PRIV1_ID_VAL3_CLASS_CODE_MASK);
-+ writel(tmp, base + PCIE_RC_CFG_PRIV1_ID_VAL3);
-+
- if (pcie->ssc) {
- ret = brcm_pcie_set_ssc(pcie);
- if (ret == 0)
-@@ -1290,10 +1281,6 @@ static int brcm_pcie_resume(struct device *dev)
- if (ret)
- goto err_reset;
-
-- ret = brcm_pcie_linkup(pcie);
-- if (ret)
-- goto err_reset;
--
- if (pcie->msi)
- brcm_msi_set_regs(pcie->msi);
-
---
-2.35.1
-
+++ /dev/null
-From cdd6df4335c151c038dd46260e132e2cfe488d03 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 30 May 2022 11:27:05 +0200
-Subject: s390/gmap: voluntarily schedule during key setting
-
-From: Christian Borntraeger <borntraeger@linux.ibm.com>
-
-[ Upstream commit 6d5946274df1fff539a7eece458a43be733d1db8 ]
-
-With large and many guest with storage keys it is possible to create
-large latencies or stalls during initial key setting:
-
-rcu: INFO: rcu_sched self-detected stall on CPU
-rcu: 18-....: (2099 ticks this GP) idle=54e/1/0x4000000000000002 softirq=35598716/35598716 fqs=998
- (t=2100 jiffies g=155867385 q=20879)
-Task dump for CPU 18:
-CPU 1/KVM R running task 0 1030947 256019 0x06000004
-Call Trace:
-sched_show_task
-rcu_dump_cpu_stacks
-rcu_sched_clock_irq
-update_process_times
-tick_sched_handle
-tick_sched_timer
-__hrtimer_run_queues
-hrtimer_interrupt
-do_IRQ
-ext_int_handler
-ptep_zap_key
-
-The mmap lock is held during the page walking but since this is a
-semaphore scheduling is still possible. Same for the kvm srcu.
-To minimize overhead do this on every segment table entry or large page.
-
-Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
-Reviewed-by: Alexander Gordeev <agordeev@linux.ibm.com>
-Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
-Link: https://lore.kernel.org/r/20220530092706.11637-2-borntraeger@linux.ibm.com
-Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
-Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/s390/mm/gmap.c | 14 ++++++++++++++
- 1 file changed, 14 insertions(+)
-
-diff --git a/arch/s390/mm/gmap.c b/arch/s390/mm/gmap.c
-index dfee0ebb2fac..88f6d923ee45 100644
---- a/arch/s390/mm/gmap.c
-+++ b/arch/s390/mm/gmap.c
-@@ -2601,6 +2601,18 @@ static int __s390_enable_skey_pte(pte_t *pte, unsigned long addr,
- return 0;
- }
-
-+/*
-+ * Give a chance to schedule after setting a key to 256 pages.
-+ * We only hold the mm lock, which is a rwsem and the kvm srcu.
-+ * Both can sleep.
-+ */
-+static int __s390_enable_skey_pmd(pmd_t *pmd, unsigned long addr,
-+ unsigned long next, struct mm_walk *walk)
-+{
-+ cond_resched();
-+ return 0;
-+}
-+
- static int __s390_enable_skey_hugetlb(pte_t *pte, unsigned long addr,
- unsigned long hmask, unsigned long next,
- struct mm_walk *walk)
-@@ -2623,12 +2635,14 @@ static int __s390_enable_skey_hugetlb(pte_t *pte, unsigned long addr,
- end = start + HPAGE_SIZE - 1;
- __storage_key_init_range(start, end);
- set_bit(PG_arch_1, &page->flags);
-+ cond_resched();
- return 0;
- }
-
- static const struct mm_walk_ops enable_skey_walk_ops = {
- .hugetlb_entry = __s390_enable_skey_hugetlb,
- .pte_entry = __s390_enable_skey_pte,
-+ .pmd_entry = __s390_enable_skey_pmd,
- };
-
- int s390_enable_skey(void)
---
-2.35.1
-
+++ /dev/null
-From 1c2c1de1d5a1283262e55c18d22c9de90e80da54 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 23 May 2022 14:02:44 +0200
-Subject: scsi: myrb: Fix up null pointer access on myrb_cleanup()
-
-From: Hannes Reinecke <hare@suse.de>
-
-[ Upstream commit f9f0a46141e2e39bedb4779c88380d1b5f018c14 ]
-
-When myrb_probe() fails the callback might not be set, so we need to
-validate the 'disable_intr' callback in myrb_cleanup() to not cause a null
-pointer exception. And while at it do not call myrb_cleanup() if we cannot
-enable the PCI device at all.
-
-Link: https://lore.kernel.org/r/20220523120244.99515-1-hare@suse.de
-Reported-by: Zheyu Ma <zheyuma97@gmail.com>
-Tested-by: Zheyu Ma <zheyuma97@gmail.com>
-Signed-off-by: Hannes Reinecke <hare@suse.de>
-Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/scsi/myrb.c | 11 ++++++++---
- 1 file changed, 8 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/scsi/myrb.c b/drivers/scsi/myrb.c
-index 71585528e8db..e885c1dbf61f 100644
---- a/drivers/scsi/myrb.c
-+++ b/drivers/scsi/myrb.c
-@@ -1239,7 +1239,8 @@ static void myrb_cleanup(struct myrb_hba *cb)
- myrb_unmap(cb);
-
- if (cb->mmio_base) {
-- cb->disable_intr(cb->io_base);
-+ if (cb->disable_intr)
-+ cb->disable_intr(cb->io_base);
- iounmap(cb->mmio_base);
- }
- if (cb->irq)
-@@ -3413,9 +3414,13 @@ static struct myrb_hba *myrb_detect(struct pci_dev *pdev,
- mutex_init(&cb->dcmd_mutex);
- mutex_init(&cb->dma_mutex);
- cb->pdev = pdev;
-+ cb->host = shost;
-
-- if (pci_enable_device(pdev))
-- goto failure;
-+ if (pci_enable_device(pdev)) {
-+ dev_err(&pdev->dev, "Failed to enable PCI device\n");
-+ scsi_host_put(shost);
-+ return NULL;
-+ }
-
- if (privdata->hw_init == DAC960_PD_hw_init ||
- privdata->hw_init == DAC960_P_hw_init) {
---
-2.35.1
-
+++ /dev/null
-From 79622a3fb185fc84ff471a0c7cb9961622feb8ae Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 6 May 2022 23:39:24 +0206
-Subject: serial: msm_serial: disable interrupts in __msm_console_write()
-
-From: John Ogness <john.ogness@linutronix.de>
-
-[ Upstream commit aabdbb1b7a5819e18c403334a31fb0cc2c06ad41 ]
-
-__msm_console_write() assumes that interrupts are disabled, but
-with threaded console printers it is possible that the write()
-callback of the console is called with interrupts enabled.
-
-Explicitly disable interrupts using local_irq_save() to preserve
-the assumed context.
-
-Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
-Reviewed-by: Petr Mladek <pmladek@suse.com>
-Signed-off-by: John Ogness <john.ogness@linutronix.de>
-Link: https://lore.kernel.org/r/20220506213324.470461-1-john.ogness@linutronix.de
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/tty/serial/msm_serial.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/drivers/tty/serial/msm_serial.c b/drivers/tty/serial/msm_serial.c
-index 23c94b927776..e676ec761f18 100644
---- a/drivers/tty/serial/msm_serial.c
-+++ b/drivers/tty/serial/msm_serial.c
-@@ -1599,6 +1599,7 @@ static inline struct uart_port *msm_get_port_from_line(unsigned int line)
- static void __msm_console_write(struct uart_port *port, const char *s,
- unsigned int count, bool is_uartdm)
- {
-+ unsigned long flags;
- int i;
- int num_newlines = 0;
- bool replaced = false;
-@@ -1616,6 +1617,8 @@ static void __msm_console_write(struct uart_port *port, const char *s,
- num_newlines++;
- count += num_newlines;
-
-+ local_irq_save(flags);
-+
- if (port->sysrq)
- locked = 0;
- else if (oops_in_progress)
-@@ -1661,6 +1664,8 @@ static void __msm_console_write(struct uart_port *port, const char *s,
-
- if (locked)
- spin_unlock(&port->lock);
-+
-+ local_irq_restore(flags);
- }
-
- static void msm_console_write(struct console *co, const char *s,
---
-2.35.1
-
drm-imx-fix-compiler-warning-with-gcc-12.patch
nfp-flower-restructure-flow-key-for-gre-vlan-combina.patch
iov_iter-fix-iter_xarray_get_pages-_alloc.patch
-iio-dummy-iio_simple_dummy-check-the-return-value-of.patch
-staging-rtl8712-fix-a-potential-memory-leak-in-r871x.patch
-iio-st_sensors-add-a-local-lock-for-protecting-odr.patch
-lkdtm-usercopy-expand-size-of-out-of-frame-object.patch
-drivers-staging-rtl8723bs-fix-deadlock-in-rtw_survey.patch
-drivers-staging-rtl8192bs-fix-deadlock-in-rtw_joinbs.patch
-tty-synclink_gt-fix-null-pointer-dereference-in-slgt.patch
-tty-fix-a-possible-resource-leak-in-icom_probe.patch
-thunderbolt-use-different-lane-for-second-displaypor.patch
-drivers-staging-rtl8192u-fix-deadlock-in-ieee80211_b.patch
-drivers-staging-rtl8192e-fix-deadlock-in-rtllib_beac.patch
-usb-host-isp116x-check-return-value-after-calling-pl.patch
-drivers-tty-serial-fix-deadlock-in-sa1100_set_termio.patch
-drivers-usb-host-fix-deadlock-in-oxu_bus_suspend.patch
-usb-hcd-pci-fully-suspend-across-freeze-thaw-cycle.patch
-char-xillybus-fix-a-refcount-leak-in-cleanup_dev.patch
-sysrq-do-not-omit-current-cpu-when-showing-backtrace.patch
-usb-dwc2-gadget-don-t-reset-gadget-s-driver-bus.patch
-usb-dwc3-host-stop-setting-the-acpi-companion.patch
-soundwire-qcom-adjust-autoenumeration-timeout.patch
-misc-rtsx-set-null-intfdata-when-probe-fails.patch
-extcon-fix-extcon_get_extcon_dev-error-handling.patch
-extcon-modify-extcon-device-to-be-created-after-driv.patch
-clocksource-drivers-sp804-avoid-error-on-multiple-in.patch
-staging-rtl8712-fix-uninit-value-in-usb_read8-and-fr.patch
-staging-rtl8712-fix-uninit-value-in-r871xu_drv_init.patch
-serial-msm_serial-disable-interrupts-in-__msm_consol.patch
-kernfs-separate-kernfs_pr_cont_buf-and-rename_lock.patch
-watchdog-wdat_wdt-stop-watchdog-when-rebooting-the-s.patch
-ksmbd-smbd-fix-connection-dropped-issue.patch
-md-protect-md_unregister_thread-from-reentrancy.patch
-scsi-myrb-fix-up-null-pointer-access-on-myrb_cleanup.patch
-asoc-rt5640-do-not-manipulate-pin-platform-clock-if-.patch
-revert-net-af_key-add-check-for-pfkey_broadcast-in-f.patch
-ceph-allow-ceph.dir.rctime-xattr-to-be-updatable.patch
-ceph-flush-the-mdlog-for-filesystem-sync.patch
-net-neigh-set-lower-cap-for-neigh_managed_work-rearm.patch
-drm-amd-display-check-if-modulo-is-0-before-dividing.patch
-drm-radeon-fix-a-possible-null-pointer-dereference.patch
-drm-amd-pm-fix-a-potential-gpu_metrics_table-memory-.patch
-drm-amd-pm-fix-missing-thermal-throttler-status.patch
-um-line-use-separate-irqs-per-line.patch
-modpost-fix-undefined-behavior-of-is_arm_mapping_sym.patch
-x86-cpu-elide-kcsan-for-cpu_has-and-friends.patch
-jump_label-noinstr-avoid-instrumentation-for-jump_la.patch
-nbd-call-genl_unregister_family-first-in-nbd_cleanup.patch
-nbd-fix-race-between-nbd_alloc_config-and-module-rem.patch
-nbd-fix-io-hung-while-disconnecting-device.patch
-revert-pci-brcmstb-do-not-turn-off-wol-regulators-on.patch
-revert-pci-brcmstb-add-control-of-subdevice-voltage-.patch
-revert-pci-brcmstb-add-mechanism-to-turn-on-subdev-r.patch
-revert-pci-brcmstb-split-brcm_pcie_setup-into-two-fu.patch
-s390-gmap-voluntarily-schedule-during-key-setting.patch
-cifs-version-operations-for-smb20-unneeded-when-lega.patch
-drm-amd-pm-use-bitmap_-from-to-_arr32-where-appropri.patch
-nodemask-fix-return-values-to-be-unsigned.patch
-iio-dummy-iio_simple_dummy-check-the-return-value-of.patch-32203
-staging-rtl8712-fix-a-potential-memory-leak-in-r871x.patch-3215
-iio-st_sensors-add-a-local-lock-for-protecting-odr.patch-23369
-lkdtm-usercopy-expand-size-of-out-of-frame-object.patch-1664
-drivers-staging-rtl8723bs-fix-deadlock-in-rtw_survey.patch-8280
-drivers-staging-rtl8192bs-fix-deadlock-in-rtw_joinbs.patch-1742
-tty-synclink_gt-fix-null-pointer-dereference-in-slgt.patch-12333
-tty-fix-a-possible-resource-leak-in-icom_probe.patch-26286
-thunderbolt-use-different-lane-for-second-displaypor.patch-16383
-drivers-staging-rtl8192u-fix-deadlock-in-ieee80211_b.patch-19747
-drivers-staging-rtl8192e-fix-deadlock-in-rtllib_beac.patch-1974
-usb-host-isp116x-check-return-value-after-calling-pl.patch-21079
-drivers-tty-serial-fix-deadlock-in-sa1100_set_termio.patch-13213
-drivers-usb-host-fix-deadlock-in-oxu_bus_suspend.patch-13879
-usb-hcd-pci-fully-suspend-across-freeze-thaw-cycle.patch-10992
-char-xillybus-fix-a-refcount-leak-in-cleanup_dev.patch-25183
-sysrq-do-not-omit-current-cpu-when-showing-backtrace.patch-6961
-usb-dwc2-gadget-don-t-reset-gadget-s-driver-bus.patch-3262
-usb-dwc3-host-stop-setting-the-acpi-companion.patch-7526
-soundwire-qcom-adjust-autoenumeration-timeout.patch-23665
-misc-rtsx-set-null-intfdata-when-probe-fails.patch-16936
-extcon-fix-extcon_get_extcon_dev-error-handling.patch-17131
-extcon-modify-extcon-device-to-be-created-after-driv.patch-30520
-clocksource-drivers-sp804-avoid-error-on-multiple-in.patch-3965
-staging-rtl8712-fix-uninit-value-in-usb_read8-and-fr.patch-3090
-staging-rtl8712-fix-uninit-value-in-r871xu_drv_init.patch-30000
-serial-msm_serial-disable-interrupts-in-__msm_consol.patch-31685
-kernfs-separate-kernfs_pr_cont_buf-and-rename_lock.patch-30374
-watchdog-wdat_wdt-stop-watchdog-when-rebooting-the-s.patch-22196
-ksmbd-smbd-fix-connection-dropped-issue.patch-11678
-md-protect-md_unregister_thread-from-reentrancy.patch-28629
-scsi-myrb-fix-up-null-pointer-access-on-myrb_cleanup.patch-15807
-asoc-rt5640-do-not-manipulate-pin-platform-clock-if-.patch-2367
-revert-net-af_key-add-check-for-pfkey_broadcast-in-f.patch-2195
-ceph-allow-ceph.dir.rctime-xattr-to-be-updatable.patch-29589
-ceph-flush-the-mdlog-for-filesystem-sync.patch-6478
-net-neigh-set-lower-cap-for-neigh_managed_work-rearm.patch-24510
-drm-amd-display-check-if-modulo-is-0-before-dividing.patch-6891
-drm-radeon-fix-a-possible-null-pointer-dereference.patch-6823
-drm-amd-pm-fix-a-potential-gpu_metrics_table-memory-.patch-19701
-drm-amd-pm-fix-missing-thermal-throttler-status.patch-11168
-um-line-use-separate-irqs-per-line.patch-4313
-modpost-fix-undefined-behavior-of-is_arm_mapping_sym.patch-1109
-x86-cpu-elide-kcsan-for-cpu_has-and-friends.patch-12739
-jump_label-noinstr-avoid-instrumentation-for-jump_la.patch-25223
-nbd-call-genl_unregister_family-first-in-nbd_cleanup.patch-29357
-nbd-fix-race-between-nbd_alloc_config-and-module-rem.patch-7958
-nbd-fix-io-hung-while-disconnecting-device.patch-28247
-revert-pci-brcmstb-do-not-turn-off-wol-regulators-on.patch-20569
-revert-pci-brcmstb-add-control-of-subdevice-voltage-.patch-31690
-revert-pci-brcmstb-add-mechanism-to-turn-on-subdev-r.patch-17581
-revert-pci-brcmstb-split-brcm_pcie_setup-into-two-fu.patch-29815
-s390-gmap-voluntarily-schedule-during-key-setting.patch-3950
-cifs-version-operations-for-smb20-unneeded-when-lega.patch-27538
-drm-amd-pm-use-bitmap_-from-to-_arr32-where-appropri.patch-2786
-nodemask-fix-return-values-to-be-unsigned.patch-24003
-iio-dummy-iio_simple_dummy-check-the-return-value-of.patch-12389
-staging-rtl8712-fix-a-potential-memory-leak-in-r871x.patch-18013
-iio-st_sensors-add-a-local-lock-for-protecting-odr.patch-15166
-lkdtm-usercopy-expand-size-of-out-of-frame-object.patch-10216
-drivers-staging-rtl8723bs-fix-deadlock-in-rtw_survey.patch-19419
-drivers-staging-rtl8192bs-fix-deadlock-in-rtw_joinbs.patch-10163
-tty-synclink_gt-fix-null-pointer-dereference-in-slgt.patch-20775
-tty-fix-a-possible-resource-leak-in-icom_probe.patch-15234
-thunderbolt-use-different-lane-for-second-displaypor.patch-31630
-drivers-staging-rtl8192u-fix-deadlock-in-ieee80211_b.patch-30680
-drivers-staging-rtl8192e-fix-deadlock-in-rtllib_beac.patch-11260
-usb-host-isp116x-check-return-value-after-calling-pl.patch-7162
-drivers-tty-serial-fix-deadlock-in-sa1100_set_termio.patch-28988
-drivers-usb-host-fix-deadlock-in-oxu_bus_suspend.patch-26072
-usb-hcd-pci-fully-suspend-across-freeze-thaw-cycle.patch-8153
-char-xillybus-fix-a-refcount-leak-in-cleanup_dev.patch-11241
-sysrq-do-not-omit-current-cpu-when-showing-backtrace.patch-8225
-usb-dwc2-gadget-don-t-reset-gadget-s-driver-bus.patch-17563
-usb-dwc3-host-stop-setting-the-acpi-companion.patch-16921
-soundwire-qcom-adjust-autoenumeration-timeout.patch-17890
-misc-rtsx-set-null-intfdata-when-probe-fails.patch-5635
-extcon-fix-extcon_get_extcon_dev-error-handling.patch-4210
-extcon-modify-extcon-device-to-be-created-after-driv.patch-20553
-clocksource-drivers-sp804-avoid-error-on-multiple-in.patch-765
-staging-rtl8712-fix-uninit-value-in-usb_read8-and-fr.patch-4895
-staging-rtl8712-fix-uninit-value-in-r871xu_drv_init.patch-30645
-serial-msm_serial-disable-interrupts-in-__msm_consol.patch-11604
-kernfs-separate-kernfs_pr_cont_buf-and-rename_lock.patch-18555
-watchdog-wdat_wdt-stop-watchdog-when-rebooting-the-s.patch-3011
-ksmbd-smbd-fix-connection-dropped-issue.patch-2115
-md-protect-md_unregister_thread-from-reentrancy.patch-15973
-scsi-myrb-fix-up-null-pointer-access-on-myrb_cleanup.patch-30360
-asoc-rt5640-do-not-manipulate-pin-platform-clock-if-.patch-24620
-revert-net-af_key-add-check-for-pfkey_broadcast-in-f.patch-13021
-ceph-allow-ceph.dir.rctime-xattr-to-be-updatable.patch-19722
-ceph-flush-the-mdlog-for-filesystem-sync.patch-12755
-net-neigh-set-lower-cap-for-neigh_managed_work-rearm.patch-28856
-drm-amd-display-check-if-modulo-is-0-before-dividing.patch-27638
-drm-radeon-fix-a-possible-null-pointer-dereference.patch-19654
-drm-amd-pm-fix-a-potential-gpu_metrics_table-memory-.patch-26433
-drm-amd-pm-fix-missing-thermal-throttler-status.patch-27903
-um-line-use-separate-irqs-per-line.patch-32534
-modpost-fix-undefined-behavior-of-is_arm_mapping_sym.patch-6649
-x86-cpu-elide-kcsan-for-cpu_has-and-friends.patch-22522
-jump_label-noinstr-avoid-instrumentation-for-jump_la.patch-29707
-nbd-call-genl_unregister_family-first-in-nbd_cleanup.patch-17037
-nbd-fix-race-between-nbd_alloc_config-and-module-rem.patch-26067
-nbd-fix-io-hung-while-disconnecting-device.patch-28894
-revert-pci-brcmstb-do-not-turn-off-wol-regulators-on.patch-11731
-revert-pci-brcmstb-add-control-of-subdevice-voltage-.patch-23622
-revert-pci-brcmstb-add-mechanism-to-turn-on-subdev-r.patch-8780
-revert-pci-brcmstb-split-brcm_pcie_setup-into-two-fu.patch-10549
-s390-gmap-voluntarily-schedule-during-key-setting.patch-30253
-cifs-version-operations-for-smb20-unneeded-when-lega.patch-8255
-drm-amd-pm-use-bitmap_-from-to-_arr32-where-appropri.patch-22626
-nodemask-fix-return-values-to-be-unsigned.patch-8529
+++ /dev/null
-From 217acb86289e7e5b9996810301c6a4d7ceed863f Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 6 May 2022 09:47:05 +0100
-Subject: soundwire: qcom: adjust autoenumeration timeout
-
-From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
-
-[ Upstream commit 74da272400b46f2e898f115d1b1cd60828766919 ]
-
-Currently timeout for autoenumeration during probe and bus reset is set to
-2 secs which is really a big value. This can have an adverse effect on
-boot time if the slave device is not ready/reset.
-This was the case with wcd938x which was not reset yet but we spent 2
-secs waiting in the soundwire controller probe. Reduce this time to
-1/10 of Hz which should be good enough time to finish autoenumeration
-if any slaves are available on the bus.
-
-Reported-by: Srinivasa Rao Mandadapu <quic_srivasam@quicinc.com>
-Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
-Link: https://lore.kernel.org/r/20220506084705.18525-1-srinivas.kandagatla@linaro.org
-Signed-off-by: Vinod Koul <vkoul@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/soundwire/qcom.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/soundwire/qcom.c b/drivers/soundwire/qcom.c
-index 54813417ef8e..249f1b69ec94 100644
---- a/drivers/soundwire/qcom.c
-+++ b/drivers/soundwire/qcom.c
-@@ -99,7 +99,7 @@
-
- #define SWRM_SPECIAL_CMD_ID 0xF
- #define MAX_FREQ_NUM 1
--#define TIMEOUT_MS (2 * HZ)
-+#define TIMEOUT_MS 100
- #define QCOM_SWRM_MAX_RD_LEN 0x1
- #define QCOM_SDW_MAX_PORTS 14
- #define DEFAULT_CLK_FREQ 9600000
---
-2.35.1
-
+++ /dev/null
-From 303c91e26fe3ae75422d5ab99f9b97ccf64998e4 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 5 Apr 2022 12:43:07 +0800
-Subject: staging: rtl8712: fix a potential memory leak in r871xu_drv_init()
-
-From: Xiaoke Wang <xkernel.wang@foxmail.com>
-
-[ Upstream commit 7288ff561de650d4139fab80e9cb0da9b5b32434 ]
-
-In r871xu_drv_init(), if r8712_init_drv_sw() fails, then the memory
-allocated by r8712_alloc_io_queue() in r8712_usb_dvobj_init() is not
-properly released as there is no action will be performed by
-r8712_usb_dvobj_deinit().
-To properly release it, we should call r8712_free_io_queue() in
-r8712_usb_dvobj_deinit().
-
-Besides, in r871xu_dev_remove(), r8712_usb_dvobj_deinit() will be called
-by r871x_dev_unload() under condition `padapter->bup` and
-r8712_free_io_queue() is called by r8712_free_drv_sw().
-However, r8712_usb_dvobj_deinit() does not rely on `padapter->bup` and
-calling r8712_free_io_queue() in r8712_free_drv_sw() is negative for
-better understading the code.
-So I move r8712_usb_dvobj_deinit() into r871xu_dev_remove(), and remove
-r8712_free_io_queue() from r8712_free_drv_sw().
-
-Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
-Signed-off-by: Xiaoke Wang <xkernel.wang@foxmail.com>
-Link: https://lore.kernel.org/r/tencent_B8048C592777830380A23A7C4409F9DF1305@qq.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/staging/rtl8712/os_intfs.c | 1 -
- drivers/staging/rtl8712/usb_intf.c | 6 +++---
- 2 files changed, 3 insertions(+), 4 deletions(-)
-
-diff --git a/drivers/staging/rtl8712/os_intfs.c b/drivers/staging/rtl8712/os_intfs.c
-index d15d52c0d1a7..003e97205124 100644
---- a/drivers/staging/rtl8712/os_intfs.c
-+++ b/drivers/staging/rtl8712/os_intfs.c
-@@ -332,7 +332,6 @@ void r8712_free_drv_sw(struct _adapter *padapter)
- r8712_free_evt_priv(&padapter->evtpriv);
- r8712_DeInitSwLeds(padapter);
- r8712_free_mlme_priv(&padapter->mlmepriv);
-- r8712_free_io_queue(padapter);
- _free_xmit_priv(&padapter->xmitpriv);
- _r8712_free_sta_priv(&padapter->stapriv);
- _r8712_free_recv_priv(&padapter->recvpriv);
-diff --git a/drivers/staging/rtl8712/usb_intf.c b/drivers/staging/rtl8712/usb_intf.c
-index ee4c61f85a07..56450ede9f23 100644
---- a/drivers/staging/rtl8712/usb_intf.c
-+++ b/drivers/staging/rtl8712/usb_intf.c
-@@ -265,6 +265,7 @@ static uint r8712_usb_dvobj_init(struct _adapter *padapter)
-
- static void r8712_usb_dvobj_deinit(struct _adapter *padapter)
- {
-+ r8712_free_io_queue(padapter);
- }
-
- void rtl871x_intf_stop(struct _adapter *padapter)
-@@ -302,9 +303,6 @@ void r871x_dev_unload(struct _adapter *padapter)
- rtl8712_hal_deinit(padapter);
- }
-
-- /*s6.*/
-- if (padapter->dvobj_deinit)
-- padapter->dvobj_deinit(padapter);
- padapter->bup = false;
- }
- }
-@@ -607,6 +605,8 @@ static void r871xu_dev_remove(struct usb_interface *pusb_intf)
- /* Stop driver mlme relation timer */
- r8712_stop_drv_timers(padapter);
- r871x_dev_unload(padapter);
-+ if (padapter->dvobj_deinit)
-+ padapter->dvobj_deinit(padapter);
- r8712_free_drv_sw(padapter);
- free_netdev(pnetdev);
-
---
-2.35.1
-
+++ /dev/null
-From 6d9a15d279560f687a0fb1bb462a3bc95e34ce80 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 16 May 2022 17:22:41 +0800
-Subject: staging: rtl8712: fix uninit-value in r871xu_drv_init()
-
-From: Wang Cheng <wanngchenng@gmail.com>
-
-[ Upstream commit 0458e5428e5e959d201a40ffe71d762a79ecedc4 ]
-
-When 'tmpU1b' returns from r8712_read8(padapter, EE_9346CR) is 0,
-'mac[6]' will not be initialized.
-
-BUG: KMSAN: uninit-value in r871xu_drv_init+0x2d54/0x3070 drivers/staging/rtl8712/usb_intf.c:541
- r871xu_drv_init+0x2d54/0x3070 drivers/staging/rtl8712/usb_intf.c:541
- usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396
- really_probe+0x653/0x14b0 drivers/base/dd.c:596
- __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752
- driver_probe_device drivers/base/dd.c:782 [inline]
- __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899
- bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427
- __device_attach+0x593/0x8e0 drivers/base/dd.c:970
- device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017
- bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487
- device_add+0x1fff/0x26e0 drivers/base/core.c:3405
- usb_set_configuration+0x37e9/0x3ed0 drivers/usb/core/message.c:2170
- usb_generic_driver_probe+0x13c/0x300 drivers/usb/core/generic.c:238
- usb_probe_device+0x309/0x570 drivers/usb/core/driver.c:293
- really_probe+0x653/0x14b0 drivers/base/dd.c:596
- __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752
- driver_probe_device drivers/base/dd.c:782 [inline]
- __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899
- bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427
- __device_attach+0x593/0x8e0 drivers/base/dd.c:970
- device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017
- bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487
- device_add+0x1fff/0x26e0 drivers/base/core.c:3405
- usb_new_device+0x1b8e/0x2950 drivers/usb/core/hub.c:2566
- hub_port_connect drivers/usb/core/hub.c:5358 [inline]
- hub_port_connect_change drivers/usb/core/hub.c:5502 [inline]
- port_event drivers/usb/core/hub.c:5660 [inline]
- hub_event+0x58e3/0x89e0 drivers/usb/core/hub.c:5742
- process_one_work+0xdb6/0x1820 kernel/workqueue.c:2307
- worker_thread+0x10b3/0x21e0 kernel/workqueue.c:2454
- kthread+0x3c7/0x500 kernel/kthread.c:377
- ret_from_fork+0x1f/0x30
-
-Local variable mac created at:
- r871xu_drv_init+0x1771/0x3070 drivers/staging/rtl8712/usb_intf.c:394
- usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396
-
-KMSAN: uninit-value in r871xu_drv_init
-https://syzkaller.appspot.com/bug?id=3cd92b1d85428b128503bfa7a250294c9ae00bd8
-
-Reported-by: <syzbot+6f5ecd144854c0d8580b@syzkaller.appspotmail.com>
-Tested-by: <syzbot+6f5ecd144854c0d8580b@syzkaller.appspotmail.com>
-Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
-Signed-off-by: Wang Cheng <wanngchenng@gmail.com>
-Link: https://lore.kernel.org/r/14c3886173dfa4597f0704547c414cfdbcd11d16.1652618244.git.wanngchenng@gmail.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/staging/rtl8712/usb_intf.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/staging/rtl8712/usb_intf.c b/drivers/staging/rtl8712/usb_intf.c
-index 56450ede9f23..1ff3e2658e77 100644
---- a/drivers/staging/rtl8712/usb_intf.c
-+++ b/drivers/staging/rtl8712/usb_intf.c
-@@ -536,13 +536,13 @@ static int r871xu_drv_init(struct usb_interface *pusb_intf,
- } else {
- AutoloadFail = false;
- }
-- if (((mac[0] == 0xff) && (mac[1] == 0xff) &&
-+ if ((!AutoloadFail) ||
-+ ((mac[0] == 0xff) && (mac[1] == 0xff) &&
- (mac[2] == 0xff) && (mac[3] == 0xff) &&
- (mac[4] == 0xff) && (mac[5] == 0xff)) ||
- ((mac[0] == 0x00) && (mac[1] == 0x00) &&
- (mac[2] == 0x00) && (mac[3] == 0x00) &&
-- (mac[4] == 0x00) && (mac[5] == 0x00)) ||
-- (!AutoloadFail)) {
-+ (mac[4] == 0x00) && (mac[5] == 0x00))) {
- mac[0] = 0x00;
- mac[1] = 0xe0;
- mac[2] = 0x4c;
---
-2.35.1
-
+++ /dev/null
-From ad4a4f01a1ec3c7fdb6140f675c52e3063783e2b Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 16 May 2022 17:22:23 +0800
-Subject: staging: rtl8712: fix uninit-value in usb_read8() and friends
-
-From: Wang Cheng <wanngchenng@gmail.com>
-
-[ Upstream commit d1b57669732d09da7e13ef86d058dab0cd57f6e0 ]
-
-When r8712_usbctrl_vendorreq() returns negative, 'data' in
-usb_read{8,16,32} will not be initialized.
-
-BUG: KMSAN: uninit-value in string_nocheck lib/vsprintf.c:643 [inline]
-BUG: KMSAN: uninit-value in string+0x4ec/0x6f0 lib/vsprintf.c:725
- string_nocheck lib/vsprintf.c:643 [inline]
- string+0x4ec/0x6f0 lib/vsprintf.c:725
- vsnprintf+0x2222/0x3650 lib/vsprintf.c:2806
- va_format lib/vsprintf.c:1704 [inline]
- pointer+0x18e6/0x1f70 lib/vsprintf.c:2443
- vsnprintf+0x1a9b/0x3650 lib/vsprintf.c:2810
- vprintk_store+0x537/0x2150 kernel/printk/printk.c:2158
- vprintk_emit+0x28b/0xab0 kernel/printk/printk.c:2256
- dev_vprintk_emit+0x5ef/0x6d0 drivers/base/core.c:4604
- dev_printk_emit+0x1dd/0x21f drivers/base/core.c:4615
- __dev_printk+0x3be/0x440 drivers/base/core.c:4627
- _dev_info+0x1ea/0x22f drivers/base/core.c:4673
- r871xu_drv_init+0x1929/0x3070 drivers/staging/rtl8712/usb_intf.c:401
- usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396
- really_probe+0x6c7/0x1350 drivers/base/dd.c:621
- __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752
- driver_probe_device drivers/base/dd.c:782 [inline]
- __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899
- bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427
- __device_attach+0x593/0x8e0 drivers/base/dd.c:970
- device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017
- bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487
- device_add+0x1fff/0x26e0 drivers/base/core.c:3405
- usb_set_configuration+0x37e9/0x3ed0 drivers/usb/core/message.c:2170
- usb_generic_driver_probe+0x13c/0x300 drivers/usb/core/generic.c:238
- usb_probe_device+0x309/0x570 drivers/usb/core/driver.c:293
- really_probe+0x6c7/0x1350 drivers/base/dd.c:621
- __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752
- driver_probe_device drivers/base/dd.c:782 [inline]
- __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899
- bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427
- __device_attach+0x593/0x8e0 drivers/base/dd.c:970
- device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017
- bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487
- device_add+0x1fff/0x26e0 drivers/base/core.c:3405
- usb_new_device+0x1b91/0x2950 drivers/usb/core/hub.c:2566
- hub_port_connect drivers/usb/core/hub.c:5363 [inline]
- hub_port_connect_change drivers/usb/core/hub.c:5507 [inline]
- port_event drivers/usb/core/hub.c:5665 [inline]
- hub_event+0x58e3/0x89e0 drivers/usb/core/hub.c:5747
- process_one_work+0xdb6/0x1820 kernel/workqueue.c:2289
- worker_thread+0x10d0/0x2240 kernel/workqueue.c:2436
- kthread+0x3c7/0x500 kernel/kthread.c:376
- ret_from_fork+0x1f/0x30
-
-Local variable data created at:
- usb_read8+0x5d/0x130 drivers/staging/rtl8712/usb_ops.c:33
- r8712_read8+0xa5/0xd0 drivers/staging/rtl8712/rtl8712_io.c:29
-
-KMSAN: uninit-value in r871xu_drv_init
-https://syzkaller.appspot.com/bug?id=3cd92b1d85428b128503bfa7a250294c9ae00bd8
-
-Reported-by: <syzbot+6f5ecd144854c0d8580b@syzkaller.appspotmail.com>
-Tested-by: <syzbot+6f5ecd144854c0d8580b@syzkaller.appspotmail.com>
-Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
-Signed-off-by: Wang Cheng <wanngchenng@gmail.com>
-Link: https://lore.kernel.org/r/b9b7a6ee02c02aa28054f5cf16129977775f3cd9.1652618244.git.wanngchenng@gmail.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/staging/rtl8712/usb_ops.c | 27 ++++++++++++++++++---------
- 1 file changed, 18 insertions(+), 9 deletions(-)
-
-diff --git a/drivers/staging/rtl8712/usb_ops.c b/drivers/staging/rtl8712/usb_ops.c
-index e64845e6adf3..af9966d03979 100644
---- a/drivers/staging/rtl8712/usb_ops.c
-+++ b/drivers/staging/rtl8712/usb_ops.c
-@@ -29,7 +29,8 @@ static u8 usb_read8(struct intf_hdl *intfhdl, u32 addr)
- u16 wvalue;
- u16 index;
- u16 len;
-- __le32 data;
-+ int status;
-+ __le32 data = 0;
- struct intf_priv *intfpriv = intfhdl->pintfpriv;
-
- request = 0x05;
-@@ -37,8 +38,10 @@ static u8 usb_read8(struct intf_hdl *intfhdl, u32 addr)
- index = 0;
- wvalue = (u16)(addr & 0x0000ffff);
- len = 1;
-- r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index, &data, len,
-- requesttype);
-+ status = r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index,
-+ &data, len, requesttype);
-+ if (status < 0)
-+ return 0;
- return (u8)(le32_to_cpu(data) & 0x0ff);
- }
-
-@@ -49,7 +52,8 @@ static u16 usb_read16(struct intf_hdl *intfhdl, u32 addr)
- u16 wvalue;
- u16 index;
- u16 len;
-- __le32 data;
-+ int status;
-+ __le32 data = 0;
- struct intf_priv *intfpriv = intfhdl->pintfpriv;
-
- request = 0x05;
-@@ -57,8 +61,10 @@ static u16 usb_read16(struct intf_hdl *intfhdl, u32 addr)
- index = 0;
- wvalue = (u16)(addr & 0x0000ffff);
- len = 2;
-- r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index, &data, len,
-- requesttype);
-+ status = r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index,
-+ &data, len, requesttype);
-+ if (status < 0)
-+ return 0;
- return (u16)(le32_to_cpu(data) & 0xffff);
- }
-
-@@ -69,7 +75,8 @@ static u32 usb_read32(struct intf_hdl *intfhdl, u32 addr)
- u16 wvalue;
- u16 index;
- u16 len;
-- __le32 data;
-+ int status;
-+ __le32 data = 0;
- struct intf_priv *intfpriv = intfhdl->pintfpriv;
-
- request = 0x05;
-@@ -77,8 +84,10 @@ static u32 usb_read32(struct intf_hdl *intfhdl, u32 addr)
- index = 0;
- wvalue = (u16)(addr & 0x0000ffff);
- len = 4;
-- r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index, &data, len,
-- requesttype);
-+ status = r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index,
-+ &data, len, requesttype);
-+ if (status < 0)
-+ return 0;
- return le32_to_cpu(data);
- }
-
---
-2.35.1
-
+++ /dev/null
-From 7f849f2fb6dff8e5a4aed231dc66e5c280ccfcc9 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 17 Jan 2022 23:43:00 +0800
-Subject: sysrq: do not omit current cpu when showing backtrace of all active
- CPUs
-
-From: Changbin Du <changbin.du@gmail.com>
-
-[ Upstream commit 5390e7f46b9d5546d45a83e6463bc656678b1d0e ]
-
-The backtrace of current CPU also should be printed as it is active. This
-change add stack trace for current CPU and print a hint for idle CPU for
-the generic workqueue based printing. (x86 already does this)
-
-Now it looks like below:
-[ 279.401567] sysrq: Show backtrace of all active CPUs
-[ 279.407234] sysrq: CPU5:
-[ 279.407505] Call Trace:
-[ 279.408789] [<ffffffff8000606c>] dump_backtrace+0x2c/0x3a
-[ 279.411698] [<ffffffff800060ac>] show_stack+0x32/0x3e
-[ 279.411809] [<ffffffff80542258>] sysrq_handle_showallcpus+0x4c/0xc6
-[ 279.411929] [<ffffffff80542f16>] __handle_sysrq+0x106/0x26c
-[ 279.412034] [<ffffffff805436a8>] write_sysrq_trigger+0x64/0x74
-[ 279.412139] [<ffffffff8029cd48>] proc_reg_write+0x8e/0xe2
-[ 279.412252] [<ffffffff8021a8f8>] vfs_write+0x90/0x2be
-[ 279.412362] [<ffffffff8021acd2>] ksys_write+0xa6/0xce
-[ 279.412467] [<ffffffff8021ad24>] sys_write+0x2a/0x38
-[ 279.412689] [<ffffffff80003ff8>] ret_from_syscall+0x0/0x2
-[ 279.417173] sysrq: CPU6: backtrace skipped as idling
-[ 279.417185] sysrq: CPU4: backtrace skipped as idling
-[ 279.417187] sysrq: CPU0: backtrace skipped as idling
-[ 279.417181] sysrq: CPU7: backtrace skipped as idling
-[ 279.417190] sysrq: CPU1: backtrace skipped as idling
-[ 279.417193] sysrq: CPU3: backtrace skipped as idling
-[ 279.417219] sysrq: CPU2:
-[ 279.419179] Call Trace:
-[ 279.419440] [<ffffffff8000606c>] dump_backtrace+0x2c/0x3a
-[ 279.419782] [<ffffffff800060ac>] show_stack+0x32/0x3e
-[ 279.420015] [<ffffffff80542b30>] showacpu+0x5c/0x96
-[ 279.420317] [<ffffffff800ba71c>] flush_smp_call_function_queue+0xd6/0x218
-[ 279.420569] [<ffffffff800bb438>] generic_smp_call_function_single_interrupt+0x14/0x1c
-[ 279.420798] [<ffffffff800079ae>] handle_IPI+0xaa/0x13a
-[ 279.421024] [<ffffffff804dcb92>] riscv_intc_irq+0x56/0x70
-[ 279.421274] [<ffffffff80a05b70>] generic_handle_arch_irq+0x6a/0xfa
-[ 279.421518] [<ffffffff80004006>] ret_from_exception+0x0/0x10
-[ 279.421750] [<ffffffff80096492>] rcu_idle_enter+0x16/0x1e
-
-Signed-off-by: Changbin Du <changbin.du@gmail.com>
-Link: https://lore.kernel.org/r/20220117154300.2808-1-changbin.du@gmail.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/tty/sysrq.c | 13 +++++++++----
- 1 file changed, 9 insertions(+), 4 deletions(-)
-
-diff --git a/drivers/tty/sysrq.c b/drivers/tty/sysrq.c
-index bbfd004449b5..34cfdda4aff5 100644
---- a/drivers/tty/sysrq.c
-+++ b/drivers/tty/sysrq.c
-@@ -232,8 +232,10 @@ static void showacpu(void *dummy)
- unsigned long flags;
-
- /* Idle CPUs have no interesting backtrace. */
-- if (idle_cpu(smp_processor_id()))
-+ if (idle_cpu(smp_processor_id())) {
-+ pr_info("CPU%d: backtrace skipped as idling\n", smp_processor_id());
- return;
-+ }
-
- raw_spin_lock_irqsave(&show_lock, flags);
- pr_info("CPU%d:\n", smp_processor_id());
-@@ -260,10 +262,13 @@ static void sysrq_handle_showallcpus(int key)
-
- if (in_hardirq())
- regs = get_irq_regs();
-- if (regs) {
-- pr_info("CPU%d:\n", smp_processor_id());
-+
-+ pr_info("CPU%d:\n", smp_processor_id());
-+ if (regs)
- show_regs(regs);
-- }
-+ else
-+ show_stack(NULL, NULL, KERN_INFO);
-+
- schedule_work(&sysrq_showallcpus);
- }
- }
---
-2.35.1
-
+++ /dev/null
-From b0b56a40b217b7bb49d7afaa35a07f77a7d2efa4 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 1 Apr 2022 17:24:28 +0300
-Subject: thunderbolt: Use different lane for second DisplayPort tunnel
-
-From: Mika Westerberg <mika.westerberg@linux.intel.com>
-
-[ Upstream commit 9d2d0a5cf0ca063f417681cc33e767ce52615286 ]
-
-Brad reported that on Apple hardware with Light Ridge or Falcon Ridge
-controller, plugging in a chain of Thunderbolt displays (Light Ridge
-based controllers) causes all kinds of tearing and flickering. The
-reason for this is that on Thunderbolt 1 hardware there is no lane
-bonding so we have two independent 10 Gb/s lanes, and currently Linux
-tunnels both displays through the lane 1. This makes the displays to
-share the 10 Gb/s bandwidth which may not be enough for higher
-resolutions.
-
-For this reason make the second tunnel go through the lane 0 instead.
-This seems to match what the macOS connection manager is also doing.
-
-Reported-by: Brad Campbell <lists2009@fnarfbargle.com>
-Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
-Tested-by: Brad Campbell <lists2009@fnarfbargle.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/thunderbolt/tb.c | 19 +++++++++++++++++--
- drivers/thunderbolt/test.c | 16 ++++++++--------
- drivers/thunderbolt/tunnel.c | 11 ++++++-----
- drivers/thunderbolt/tunnel.h | 4 ++--
- 4 files changed, 33 insertions(+), 17 deletions(-)
-
-diff --git a/drivers/thunderbolt/tb.c b/drivers/thunderbolt/tb.c
-index cbd0ad85ffb1..a1f5d1842811 100644
---- a/drivers/thunderbolt/tb.c
-+++ b/drivers/thunderbolt/tb.c
-@@ -867,7 +867,7 @@ static struct tb_port *tb_find_dp_out(struct tb *tb, struct tb_port *in)
-
- static void tb_tunnel_dp(struct tb *tb)
- {
-- int available_up, available_down, ret;
-+ int available_up, available_down, ret, link_nr;
- struct tb_cm *tcm = tb_priv(tb);
- struct tb_port *port, *in, *out;
- struct tb_tunnel *tunnel;
-@@ -912,6 +912,20 @@ static void tb_tunnel_dp(struct tb *tb)
- return;
- }
-
-+ /*
-+ * This is only applicable to links that are not bonded (so
-+ * when Thunderbolt 1 hardware is involved somewhere in the
-+ * topology). For these try to share the DP bandwidth between
-+ * the two lanes.
-+ */
-+ link_nr = 1;
-+ list_for_each_entry(tunnel, &tcm->tunnel_list, list) {
-+ if (tb_tunnel_is_dp(tunnel)) {
-+ link_nr = 0;
-+ break;
-+ }
-+ }
-+
- /*
- * DP stream needs the domain to be active so runtime resume
- * both ends of the tunnel.
-@@ -943,7 +957,8 @@ static void tb_tunnel_dp(struct tb *tb)
- tb_dbg(tb, "available bandwidth for new DP tunnel %u/%u Mb/s\n",
- available_up, available_down);
-
-- tunnel = tb_tunnel_alloc_dp(tb, in, out, available_up, available_down);
-+ tunnel = tb_tunnel_alloc_dp(tb, in, out, link_nr, available_up,
-+ available_down);
- if (!tunnel) {
- tb_port_dbg(out, "could not allocate DP tunnel\n");
- goto err_reclaim;
-diff --git a/drivers/thunderbolt/test.c b/drivers/thunderbolt/test.c
-index 1f69bab236ee..66b6e665e96f 100644
---- a/drivers/thunderbolt/test.c
-+++ b/drivers/thunderbolt/test.c
-@@ -1348,7 +1348,7 @@ static void tb_test_tunnel_dp(struct kunit *test)
- in = &host->ports[5];
- out = &dev->ports[13];
-
-- tunnel = tb_tunnel_alloc_dp(NULL, in, out, 0, 0);
-+ tunnel = tb_tunnel_alloc_dp(NULL, in, out, 1, 0, 0);
- KUNIT_ASSERT_TRUE(test, tunnel != NULL);
- KUNIT_EXPECT_EQ(test, tunnel->type, TB_TUNNEL_DP);
- KUNIT_EXPECT_PTR_EQ(test, tunnel->src_port, in);
-@@ -1394,7 +1394,7 @@ static void tb_test_tunnel_dp_chain(struct kunit *test)
- in = &host->ports[5];
- out = &dev4->ports[14];
-
-- tunnel = tb_tunnel_alloc_dp(NULL, in, out, 0, 0);
-+ tunnel = tb_tunnel_alloc_dp(NULL, in, out, 1, 0, 0);
- KUNIT_ASSERT_TRUE(test, tunnel != NULL);
- KUNIT_EXPECT_EQ(test, tunnel->type, TB_TUNNEL_DP);
- KUNIT_EXPECT_PTR_EQ(test, tunnel->src_port, in);
-@@ -1444,7 +1444,7 @@ static void tb_test_tunnel_dp_tree(struct kunit *test)
- in = &dev2->ports[13];
- out = &dev5->ports[13];
-
-- tunnel = tb_tunnel_alloc_dp(NULL, in, out, 0, 0);
-+ tunnel = tb_tunnel_alloc_dp(NULL, in, out, 1, 0, 0);
- KUNIT_ASSERT_TRUE(test, tunnel != NULL);
- KUNIT_EXPECT_EQ(test, tunnel->type, TB_TUNNEL_DP);
- KUNIT_EXPECT_PTR_EQ(test, tunnel->src_port, in);
-@@ -1509,7 +1509,7 @@ static void tb_test_tunnel_dp_max_length(struct kunit *test)
- in = &dev6->ports[13];
- out = &dev12->ports[13];
-
-- tunnel = tb_tunnel_alloc_dp(NULL, in, out, 0, 0);
-+ tunnel = tb_tunnel_alloc_dp(NULL, in, out, 1, 0, 0);
- KUNIT_ASSERT_TRUE(test, tunnel != NULL);
- KUNIT_EXPECT_EQ(test, tunnel->type, TB_TUNNEL_DP);
- KUNIT_EXPECT_PTR_EQ(test, tunnel->src_port, in);
-@@ -1627,7 +1627,7 @@ static void tb_test_tunnel_port_on_path(struct kunit *test)
- in = &dev2->ports[13];
- out = &dev5->ports[13];
-
-- dp_tunnel = tb_tunnel_alloc_dp(NULL, in, out, 0, 0);
-+ dp_tunnel = tb_tunnel_alloc_dp(NULL, in, out, 1, 0, 0);
- KUNIT_ASSERT_TRUE(test, dp_tunnel != NULL);
-
- KUNIT_EXPECT_TRUE(test, tb_tunnel_port_on_path(dp_tunnel, in));
-@@ -2009,7 +2009,7 @@ static void tb_test_credit_alloc_dp(struct kunit *test)
- in = &host->ports[5];
- out = &dev->ports[14];
-
-- tunnel = tb_tunnel_alloc_dp(NULL, in, out, 0, 0);
-+ tunnel = tb_tunnel_alloc_dp(NULL, in, out, 1, 0, 0);
- KUNIT_ASSERT_TRUE(test, tunnel != NULL);
- KUNIT_ASSERT_EQ(test, tunnel->npaths, (size_t)3);
-
-@@ -2245,7 +2245,7 @@ static struct tb_tunnel *TB_TEST_DP_TUNNEL1(struct kunit *test,
-
- in = &host->ports[5];
- out = &dev->ports[13];
-- dp_tunnel1 = tb_tunnel_alloc_dp(NULL, in, out, 0, 0);
-+ dp_tunnel1 = tb_tunnel_alloc_dp(NULL, in, out, 1, 0, 0);
- KUNIT_ASSERT_TRUE(test, dp_tunnel1 != NULL);
- KUNIT_ASSERT_EQ(test, dp_tunnel1->npaths, (size_t)3);
-
-@@ -2282,7 +2282,7 @@ static struct tb_tunnel *TB_TEST_DP_TUNNEL2(struct kunit *test,
-
- in = &host->ports[6];
- out = &dev->ports[14];
-- dp_tunnel2 = tb_tunnel_alloc_dp(NULL, in, out, 0, 0);
-+ dp_tunnel2 = tb_tunnel_alloc_dp(NULL, in, out, 1, 0, 0);
- KUNIT_ASSERT_TRUE(test, dp_tunnel2 != NULL);
- KUNIT_ASSERT_EQ(test, dp_tunnel2->npaths, (size_t)3);
-
-diff --git a/drivers/thunderbolt/tunnel.c b/drivers/thunderbolt/tunnel.c
-index a473cc7d9a8d..500a0afe3073 100644
---- a/drivers/thunderbolt/tunnel.c
-+++ b/drivers/thunderbolt/tunnel.c
-@@ -848,6 +848,7 @@ struct tb_tunnel *tb_tunnel_discover_dp(struct tb *tb, struct tb_port *in,
- * @tb: Pointer to the domain structure
- * @in: DP in adapter port
- * @out: DP out adapter port
-+ * @link_nr: Preferred lane adapter when the link is not bonded
- * @max_up: Maximum available upstream bandwidth for the DP tunnel (%0
- * if not limited)
- * @max_down: Maximum available downstream bandwidth for the DP tunnel
-@@ -859,8 +860,8 @@ struct tb_tunnel *tb_tunnel_discover_dp(struct tb *tb, struct tb_port *in,
- * Return: Returns a tb_tunnel on success or NULL on failure.
- */
- struct tb_tunnel *tb_tunnel_alloc_dp(struct tb *tb, struct tb_port *in,
-- struct tb_port *out, int max_up,
-- int max_down)
-+ struct tb_port *out, int link_nr,
-+ int max_up, int max_down)
- {
- struct tb_tunnel *tunnel;
- struct tb_path **paths;
-@@ -884,21 +885,21 @@ struct tb_tunnel *tb_tunnel_alloc_dp(struct tb *tb, struct tb_port *in,
- paths = tunnel->paths;
-
- path = tb_path_alloc(tb, in, TB_DP_VIDEO_HOPID, out, TB_DP_VIDEO_HOPID,
-- 1, "Video");
-+ link_nr, "Video");
- if (!path)
- goto err_free;
- tb_dp_init_video_path(path);
- paths[TB_DP_VIDEO_PATH_OUT] = path;
-
- path = tb_path_alloc(tb, in, TB_DP_AUX_TX_HOPID, out,
-- TB_DP_AUX_TX_HOPID, 1, "AUX TX");
-+ TB_DP_AUX_TX_HOPID, link_nr, "AUX TX");
- if (!path)
- goto err_free;
- tb_dp_init_aux_path(path);
- paths[TB_DP_AUX_PATH_OUT] = path;
-
- path = tb_path_alloc(tb, out, TB_DP_AUX_RX_HOPID, in,
-- TB_DP_AUX_RX_HOPID, 1, "AUX RX");
-+ TB_DP_AUX_RX_HOPID, link_nr, "AUX RX");
- if (!path)
- goto err_free;
- tb_dp_init_aux_path(path);
-diff --git a/drivers/thunderbolt/tunnel.h b/drivers/thunderbolt/tunnel.h
-index 03e56076b5bc..bb4d1f1d6d0b 100644
---- a/drivers/thunderbolt/tunnel.h
-+++ b/drivers/thunderbolt/tunnel.h
-@@ -71,8 +71,8 @@ struct tb_tunnel *tb_tunnel_alloc_pci(struct tb *tb, struct tb_port *up,
- struct tb_tunnel *tb_tunnel_discover_dp(struct tb *tb, struct tb_port *in,
- bool alloc_hopid);
- struct tb_tunnel *tb_tunnel_alloc_dp(struct tb *tb, struct tb_port *in,
-- struct tb_port *out, int max_up,
-- int max_down);
-+ struct tb_port *out, int link_nr,
-+ int max_up, int max_down);
- struct tb_tunnel *tb_tunnel_alloc_dma(struct tb *tb, struct tb_port *nhi,
- struct tb_port *dst, int transmit_path,
- int transmit_ring, int receive_path,
---
-2.35.1
-
+++ /dev/null
-From 1eb71bf0a647cf3d028561238edb733e5775a1b9 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 31 Mar 2022 17:10:05 +0800
-Subject: tty: Fix a possible resource leak in icom_probe
-
-From: Huang Guobin <huangguobin4@huawei.com>
-
-[ Upstream commit ee157a79e7c82b01ae4c25de0ac75899801f322c ]
-
-When pci_read_config_dword failed, call pci_release_regions() and
-pci_disable_device() to recycle the resource previously allocated.
-
-Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
-Signed-off-by: Huang Guobin <huangguobin4@huawei.com>
-Link: https://lore.kernel.org/r/20220331091005.3290753-1-huangguobin4@huawei.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/tty/serial/icom.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/tty/serial/icom.c b/drivers/tty/serial/icom.c
-index 03a2fe9f4c9a..02b375ba2f07 100644
---- a/drivers/tty/serial/icom.c
-+++ b/drivers/tty/serial/icom.c
-@@ -1501,7 +1501,7 @@ static int icom_probe(struct pci_dev *dev,
- retval = pci_read_config_dword(dev, PCI_COMMAND, &command_reg);
- if (retval) {
- dev_err(&dev->dev, "PCI Config read FAILED\n");
-- return retval;
-+ goto probe_exit0;
- }
-
- pci_write_config_dword(dev, PCI_COMMAND,
---
-2.35.1
-
+++ /dev/null
-From c6555612f16c9a2268d5b71377bac512da5286a1 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 10 Apr 2022 19:48:14 +0800
-Subject: tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
-
-From: Zheyu Ma <zheyuma97@gmail.com>
-
-[ Upstream commit 689ca31c542687709ba21ec2195c1fbce34fd029 ]
-
-When the driver fails at alloc_hdlcdev(), and then we remove the driver
-module, we will get the following splat:
-
-[ 25.065966] general protection fault, probably for non-canonical address 0xdffffc0000000182: 0000 [#1] PREEMPT SMP KASAN PTI
-[ 25.066914] KASAN: null-ptr-deref in range [0x0000000000000c10-0x0000000000000c17]
-[ 25.069262] RIP: 0010:detach_hdlc_protocol+0x2a/0x3e0
-[ 25.077709] Call Trace:
-[ 25.077924] <TASK>
-[ 25.078108] unregister_hdlc_device+0x16/0x30
-[ 25.078481] slgt_cleanup+0x157/0x9f0 [synclink_gt]
-
-Fix this by checking whether the 'info->netdev' is a null pointer first.
-
-Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
-Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
-Link: https://lore.kernel.org/r/20220410114814.3920474-1-zheyuma97@gmail.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/tty/synclink_gt.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/drivers/tty/synclink_gt.c b/drivers/tty/synclink_gt.c
-index 25c558e65ece..9bc2a9265277 100644
---- a/drivers/tty/synclink_gt.c
-+++ b/drivers/tty/synclink_gt.c
-@@ -1746,6 +1746,8 @@ static int hdlcdev_init(struct slgt_info *info)
- */
- static void hdlcdev_exit(struct slgt_info *info)
- {
-+ if (!info->netdev)
-+ return;
- unregister_hdlc_device(info->netdev);
- free_netdev(info->netdev);
- info->netdev = NULL;
---
-2.35.1
-
+++ /dev/null
-From 47bc96090df6db7c65c4a3e07c1ea5d83b800db6 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 6 May 2022 15:46:12 +0200
-Subject: um: line: Use separate IRQs per line
-
-From: Johannes Berg <johannes.berg@intel.com>
-
-[ Upstream commit d5a9597d6916a76663085db984cb8fe97f0a5c56 ]
-
-Today, all possible serial lines (ssl*=) as well as all
-possible consoles (con*=) each share a single interrupt
-(with a fixed number) with others of the same type.
-
-Now, if you have two lines, say ssl0 and ssl1, and one
-of them is connected to an fd you cannot read (e.g. a
-file), but the other gets a read interrupt, then both
-of them get the interrupt since it's shared. Then, the
-read() call will return EOF, since it's a file being
-written and there's nothing to read (at least not at
-the current offset, at the end).
-
-Unfortunately, this is treated as a read error, and we
-close this line, losing all the possible output.
-
-It might be possible to work around this and make the
-IRQ sharing work, however, now that we have dynamically
-allocated IRQs that are easy to use, simply use that to
-achieve separating between the events; then there's no
-interrupt for that line and we never attempt the read
-in the first place, thus not closing the line.
-
-This manifested itself in the wifi hostap/hwsim tests
-where the parallel script communicates via one serial
-console and the kernel messages go to another (a file)
-and sending data on the communication console caused
-the kernel messages to stop flowing into the file.
-
-Reported-by: Jouni Malinen <j@w1.fi>
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
-Acked-By: anton ivanov <anton.ivanov@cambridgegreys.com>
-Signed-off-by: Richard Weinberger <richard@nod.at>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/um/drivers/chan_kern.c | 10 +++++-----
- arch/um/drivers/line.c | 22 +++++++++++++---------
- arch/um/drivers/line.h | 4 ++--
- arch/um/drivers/ssl.c | 2 --
- arch/um/drivers/stdio_console.c | 2 --
- arch/um/include/asm/irq.h | 22 +++++++++-------------
- 6 files changed, 29 insertions(+), 33 deletions(-)
-
-diff --git a/arch/um/drivers/chan_kern.c b/arch/um/drivers/chan_kern.c
-index 62997055c454..26a702a06515 100644
---- a/arch/um/drivers/chan_kern.c
-+++ b/arch/um/drivers/chan_kern.c
-@@ -133,7 +133,7 @@ static void line_timer_cb(struct work_struct *work)
- struct line *line = container_of(work, struct line, task.work);
-
- if (!line->throttled)
-- chan_interrupt(line, line->driver->read_irq);
-+ chan_interrupt(line, line->read_irq);
- }
-
- int enable_chan(struct line *line)
-@@ -195,9 +195,9 @@ void free_irqs(void)
- chan = list_entry(ele, struct chan, free_list);
-
- if (chan->input && chan->enabled)
-- um_free_irq(chan->line->driver->read_irq, chan);
-+ um_free_irq(chan->line->read_irq, chan);
- if (chan->output && chan->enabled)
-- um_free_irq(chan->line->driver->write_irq, chan);
-+ um_free_irq(chan->line->write_irq, chan);
- chan->enabled = 0;
- }
- }
-@@ -215,9 +215,9 @@ static void close_one_chan(struct chan *chan, int delay_free_irq)
- spin_unlock_irqrestore(&irqs_to_free_lock, flags);
- } else {
- if (chan->input && chan->enabled)
-- um_free_irq(chan->line->driver->read_irq, chan);
-+ um_free_irq(chan->line->read_irq, chan);
- if (chan->output && chan->enabled)
-- um_free_irq(chan->line->driver->write_irq, chan);
-+ um_free_irq(chan->line->write_irq, chan);
- chan->enabled = 0;
- }
- if (chan->ops->close != NULL)
-diff --git a/arch/um/drivers/line.c b/arch/um/drivers/line.c
-index 8febf95da96e..02b0befd6763 100644
---- a/arch/um/drivers/line.c
-+++ b/arch/um/drivers/line.c
-@@ -139,7 +139,7 @@ static int flush_buffer(struct line *line)
- count = line->buffer + LINE_BUFSIZE - line->head;
-
- n = write_chan(line->chan_out, line->head, count,
-- line->driver->write_irq);
-+ line->write_irq);
- if (n < 0)
- return n;
- if (n == count) {
-@@ -156,7 +156,7 @@ static int flush_buffer(struct line *line)
-
- count = line->tail - line->head;
- n = write_chan(line->chan_out, line->head, count,
-- line->driver->write_irq);
-+ line->write_irq);
-
- if (n < 0)
- return n;
-@@ -195,7 +195,7 @@ int line_write(struct tty_struct *tty, const unsigned char *buf, int len)
- ret = buffer_data(line, buf, len);
- else {
- n = write_chan(line->chan_out, buf, len,
-- line->driver->write_irq);
-+ line->write_irq);
- if (n < 0) {
- ret = n;
- goto out_up;
-@@ -215,7 +215,7 @@ void line_throttle(struct tty_struct *tty)
- {
- struct line *line = tty->driver_data;
-
-- deactivate_chan(line->chan_in, line->driver->read_irq);
-+ deactivate_chan(line->chan_in, line->read_irq);
- line->throttled = 1;
- }
-
-@@ -224,7 +224,7 @@ void line_unthrottle(struct tty_struct *tty)
- struct line *line = tty->driver_data;
-
- line->throttled = 0;
-- chan_interrupt(line, line->driver->read_irq);
-+ chan_interrupt(line, line->read_irq);
- }
-
- static irqreturn_t line_write_interrupt(int irq, void *data)
-@@ -260,19 +260,23 @@ int line_setup_irq(int fd, int input, int output, struct line *line, void *data)
- int err;
-
- if (input) {
-- err = um_request_irq(driver->read_irq, fd, IRQ_READ,
-- line_interrupt, IRQF_SHARED,
-+ err = um_request_irq(UM_IRQ_ALLOC, fd, IRQ_READ,
-+ line_interrupt, 0,
- driver->read_irq_name, data);
- if (err < 0)
- return err;
-+
-+ line->read_irq = err;
- }
-
- if (output) {
-- err = um_request_irq(driver->write_irq, fd, IRQ_WRITE,
-- line_write_interrupt, IRQF_SHARED,
-+ err = um_request_irq(UM_IRQ_ALLOC, fd, IRQ_WRITE,
-+ line_write_interrupt, 0,
- driver->write_irq_name, data);
- if (err < 0)
- return err;
-+
-+ line->write_irq = err;
- }
-
- return 0;
-diff --git a/arch/um/drivers/line.h b/arch/um/drivers/line.h
-index bdb16b96e76f..f15be75a3bf3 100644
---- a/arch/um/drivers/line.h
-+++ b/arch/um/drivers/line.h
-@@ -23,9 +23,7 @@ struct line_driver {
- const short minor_start;
- const short type;
- const short subtype;
-- const int read_irq;
- const char *read_irq_name;
-- const int write_irq;
- const char *write_irq_name;
- struct mc_device mc;
- struct tty_driver *driver;
-@@ -35,6 +33,8 @@ struct line {
- struct tty_port port;
- int valid;
-
-+ int read_irq, write_irq;
-+
- char *init_str;
- struct list_head chan_list;
- struct chan *chan_in, *chan_out;
-diff --git a/arch/um/drivers/ssl.c b/arch/um/drivers/ssl.c
-index 41eae2e8fb65..8514966778d5 100644
---- a/arch/um/drivers/ssl.c
-+++ b/arch/um/drivers/ssl.c
-@@ -47,9 +47,7 @@ static struct line_driver driver = {
- .minor_start = 64,
- .type = TTY_DRIVER_TYPE_SERIAL,
- .subtype = 0,
-- .read_irq = SSL_IRQ,
- .read_irq_name = "ssl",
-- .write_irq = SSL_WRITE_IRQ,
- .write_irq_name = "ssl-write",
- .mc = {
- .list = LIST_HEAD_INIT(driver.mc.list),
-diff --git a/arch/um/drivers/stdio_console.c b/arch/um/drivers/stdio_console.c
-index e8b762f4d8c2..489d5a746ed3 100644
---- a/arch/um/drivers/stdio_console.c
-+++ b/arch/um/drivers/stdio_console.c
-@@ -53,9 +53,7 @@ static struct line_driver driver = {
- .minor_start = 0,
- .type = TTY_DRIVER_TYPE_CONSOLE,
- .subtype = SYSTEM_TYPE_CONSOLE,
-- .read_irq = CONSOLE_IRQ,
- .read_irq_name = "console",
-- .write_irq = CONSOLE_WRITE_IRQ,
- .write_irq_name = "console-write",
- .mc = {
- .list = LIST_HEAD_INIT(driver.mc.list),
-diff --git a/arch/um/include/asm/irq.h b/arch/um/include/asm/irq.h
-index e187c789369d..749dfe8512e8 100644
---- a/arch/um/include/asm/irq.h
-+++ b/arch/um/include/asm/irq.h
-@@ -4,19 +4,15 @@
-
- #define TIMER_IRQ 0
- #define UMN_IRQ 1
--#define CONSOLE_IRQ 2
--#define CONSOLE_WRITE_IRQ 3
--#define UBD_IRQ 4
--#define UM_ETH_IRQ 5
--#define SSL_IRQ 6
--#define SSL_WRITE_IRQ 7
--#define ACCEPT_IRQ 8
--#define MCONSOLE_IRQ 9
--#define WINCH_IRQ 10
--#define SIGIO_WRITE_IRQ 11
--#define TELNETD_IRQ 12
--#define XTERM_IRQ 13
--#define RANDOM_IRQ 14
-+#define UBD_IRQ 2
-+#define UM_ETH_IRQ 3
-+#define ACCEPT_IRQ 4
-+#define MCONSOLE_IRQ 5
-+#define WINCH_IRQ 6
-+#define SIGIO_WRITE_IRQ 7
-+#define TELNETD_IRQ 8
-+#define XTERM_IRQ 9
-+#define RANDOM_IRQ 10
-
- #ifdef CONFIG_UML_NET_VECTOR
-
---
-2.35.1
-
+++ /dev/null
-From 22cd611af11339dc0a5fc43e8f14799b43b98679 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 5 May 2022 12:46:18 +0200
-Subject: usb: dwc2: gadget: don't reset gadget's driver->bus
-
-From: Marek Szyprowski <m.szyprowski@samsung.com>
-
-[ Upstream commit 3120aac6d0ecd9accf56894aeac0e265f74d3d5a ]
-
-UDC driver should not touch gadget's driver internals, especially it
-should not reset driver->bus. This wasn't harmful so far, but since
-commit fc274c1e9973 ("USB: gadget: Add a new bus for gadgets") gadget
-subsystem got it's own bus and messing with ->bus triggers the
-following NULL pointer dereference:
-
-dwc2 12480000.hsotg: bound driver g_ether
-8<--- cut here ---
-Unable to handle kernel NULL pointer dereference at virtual address 00000000
-[00000000] *pgd=00000000
-Internal error: Oops: 5 [#1] SMP ARM
-Modules linked in: ...
-CPU: 0 PID: 620 Comm: modprobe Not tainted 5.18.0-rc5-next-20220504 #11862
-Hardware name: Samsung Exynos (Flattened Device Tree)
-PC is at module_add_driver+0x44/0xe8
-LR is at sysfs_do_create_link_sd+0x84/0xe0
-...
-Process modprobe (pid: 620, stack limit = 0x(ptrval))
-...
- module_add_driver from bus_add_driver+0xf4/0x1e4
- bus_add_driver from driver_register+0x78/0x10c
- driver_register from usb_gadget_register_driver_owner+0x40/0xb4
- usb_gadget_register_driver_owner from do_one_initcall+0x44/0x1e0
- do_one_initcall from do_init_module+0x44/0x1c8
- do_init_module from load_module+0x19b8/0x1b9c
- load_module from sys_finit_module+0xdc/0xfc
- sys_finit_module from ret_fast_syscall+0x0/0x54
-Exception stack(0xf1771fa8 to 0xf1771ff0)
-...
-dwc2 12480000.hsotg: new device is high-speed
----[ end trace 0000000000000000 ]---
-
-Fix this by removing driver->bus entry reset.
-
-Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
-Link: https://lore.kernel.org/r/20220505104618.22729-1-m.szyprowski@samsung.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/dwc2/gadget.c | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
-index eee3504397e6..fe2a58c75861 100644
---- a/drivers/usb/dwc2/gadget.c
-+++ b/drivers/usb/dwc2/gadget.c
-@@ -4544,7 +4544,6 @@ static int dwc2_hsotg_udc_start(struct usb_gadget *gadget,
-
- WARN_ON(hsotg->driver);
-
-- driver->driver.bus = NULL;
- hsotg->driver = driver;
- hsotg->gadget.dev.of_node = hsotg->dev->of_node;
- hsotg->gadget.speed = USB_SPEED_UNKNOWN;
---
-2.35.1
-
+++ /dev/null
-From ed5bd37f68016e2764e671622312c517c5d52a64 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 28 Apr 2022 14:10:56 +0300
-Subject: usb: dwc3: host: Stop setting the ACPI companion
-
-From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
-
-[ Upstream commit 7fd069d65da2e20b1caec3b7bcf9dfbe28c04bb2 ]
-
-It is no longer needed. The sysdev pointer is now used when
-assigning the ACPI companions to the xHCI ports and USB
-devices.
-
-Assigning the ACPI companion here resulted in the
-fwnode->secondary pointer to be replaced also for the parent
-dwc3 device since the primary fwnode (the ACPI companion)
-was shared. That was unintentional and it created potential
-side effects like resource leaks.
-
-Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
-Link: https://lore.kernel.org/r/20220428111056.3558-3-heikki.krogerus@linux.intel.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/dwc3/host.c | 2 --
- 1 file changed, 2 deletions(-)
-
-diff --git a/drivers/usb/dwc3/host.c b/drivers/usb/dwc3/host.c
-index eda871973d6c..f56c30cf151e 100644
---- a/drivers/usb/dwc3/host.c
-+++ b/drivers/usb/dwc3/host.c
-@@ -7,7 +7,6 @@
- * Authors: Felipe Balbi <balbi@ti.com>,
- */
-
--#include <linux/acpi.h>
- #include <linux/irq.h>
- #include <linux/of.h>
- #include <linux/platform_device.h>
-@@ -83,7 +82,6 @@ int dwc3_host_init(struct dwc3 *dwc)
- }
-
- xhci->dev.parent = dwc->dev;
-- ACPI_COMPANION_SET(&xhci->dev, ACPI_COMPANION(dwc->dev));
-
- dwc->xhci = xhci;
-
---
-2.35.1
-
+++ /dev/null
-From df95921d19f5ebdfd9d763db43a4c2d87b040c0c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 21 Apr 2022 10:39:27 -0700
-Subject: USB: hcd-pci: Fully suspend across freeze/thaw cycle
-
-From: Evan Green <evgreen@chromium.org>
-
-[ Upstream commit 63acaa8e9c65dc34dc249440216f8e977f5d2748 ]
-
-The documentation for the freeze() method says that it "should quiesce
-the device so that it doesn't generate IRQs or DMA". The unspoken
-consequence of not doing this is that MSIs aimed at non-boot CPUs may
-get fully lost if they're sent during the period where the target CPU is
-offline.
-
-The current callbacks for USB HCD do not fully quiesce interrupts,
-specifically on XHCI. Change to use the full suspend/resume flow for
-freeze/thaw to ensure interrupts are fully quiesced. This fixes issues
-where USB devices fail to thaw during hibernation because XHCI misses
-its interrupt and cannot recover.
-
-Acked-by: Alan Stern <stern@rowland.harvard.edu>
-Signed-off-by: Evan Green <evgreen@chromium.org>
-Link: https://lore.kernel.org/r/20220421103751.v3.2.I8226c7fdae88329ef70957b96a39b346c69a914e@changeid
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/core/hcd-pci.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c
-index d630cccd2e6e..5af810cd8a58 100644
---- a/drivers/usb/core/hcd-pci.c
-+++ b/drivers/usb/core/hcd-pci.c
-@@ -616,10 +616,10 @@ const struct dev_pm_ops usb_hcd_pci_pm_ops = {
- .suspend_noirq = hcd_pci_suspend_noirq,
- .resume_noirq = hcd_pci_resume_noirq,
- .resume = hcd_pci_resume,
-- .freeze = check_root_hub_suspended,
-+ .freeze = hcd_pci_suspend,
- .freeze_noirq = check_root_hub_suspended,
- .thaw_noirq = NULL,
-- .thaw = NULL,
-+ .thaw = hcd_pci_resume,
- .poweroff = hcd_pci_suspend,
- .poweroff_noirq = hcd_pci_suspend_noirq,
- .restore_noirq = hcd_pci_resume_noirq,
---
-2.35.1
-
+++ /dev/null
-From 0aeeed2cc0fa37ddd604497b21b3359457bfb389 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 2 Mar 2022 11:37:16 +0800
-Subject: USB: host: isp116x: check return value after calling
- platform_get_resource()
-
-From: Zhen Ni <nizhen@uniontech.com>
-
-[ Upstream commit 134a3408c2d3f7e23eb0e4556e0a2d9f36c2614e ]
-
-It will cause null-ptr-deref if platform_get_resource() returns NULL,
-we need check the return value.
-
-Signed-off-by: Zhen Ni <nizhen@uniontech.com>
-Link: https://lore.kernel.org/r/20220302033716.31272-1-nizhen@uniontech.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/host/isp116x-hcd.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/usb/host/isp116x-hcd.c b/drivers/usb/host/isp116x-hcd.c
-index 8835f6bd528e..8c7f0991c21b 100644
---- a/drivers/usb/host/isp116x-hcd.c
-+++ b/drivers/usb/host/isp116x-hcd.c
-@@ -1541,10 +1541,12 @@ static int isp116x_remove(struct platform_device *pdev)
-
- iounmap(isp116x->data_reg);
- res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
-- release_mem_region(res->start, 2);
-+ if (res)
-+ release_mem_region(res->start, 2);
- iounmap(isp116x->addr_reg);
- res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-- release_mem_region(res->start, 2);
-+ if (res)
-+ release_mem_region(res->start, 2);
-
- usb_put_hcd(hcd);
- return 0;
---
-2.35.1
-
+++ /dev/null
-From 4c4378ac863ec0b635cc2c9a0c0dde046cf92775 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 26 Apr 2022 22:53:29 +0800
-Subject: watchdog: wdat_wdt: Stop watchdog when rebooting the system
-
-From: Liu Xinpeng <liuxp11@chinatelecom.cn>
-
-[ Upstream commit 27fdf84510a1374748904db43f6755f912736d92 ]
-
-Executing reboot command several times on the machine "Dell
-PowerEdge R740", UEFI security detection stopped machine
-with the following prompt:
-
-UEFI0082: The system was reset due to a timeout from the watchdog
-timer. Check the System Event Log (SEL) or crash dumps from
-Operating Sysstem to identify the source that triggered the
-watchdog timer reset. Update the firmware or driver for the
-identified device.
-
-iDRAC has warning event: "The watchdog timer reset the system".
-
-This patch fixes this issue by adding the reboot notifier.
-
-Signed-off-by: Liu Xinpeng <liuxp11@chinatelecom.cn>
-Reviewed-by: Guenter Roeck <linux@roeck-us.net>
-Link: https://lore.kernel.org/r/1650984810-6247-3-git-send-email-liuxp11@chinatelecom.cn
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
-Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/watchdog/wdat_wdt.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/drivers/watchdog/wdat_wdt.c b/drivers/watchdog/wdat_wdt.c
-index 195c8c004b69..4fac8148a8e6 100644
---- a/drivers/watchdog/wdat_wdt.c
-+++ b/drivers/watchdog/wdat_wdt.c
-@@ -462,6 +462,7 @@ static int wdat_wdt_probe(struct platform_device *pdev)
- return ret;
-
- watchdog_set_nowayout(&wdat->wdd, nowayout);
-+ watchdog_stop_on_reboot(&wdat->wdd);
- return devm_watchdog_register_device(dev, &wdat->wdd);
- }
-
---
-2.35.1
-
+++ /dev/null
-From 543d474c81691c4810cfac09f654b2fd4256a34e Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 2 May 2022 12:15:23 +0200
-Subject: x86/cpu: Elide KCSAN for cpu_has() and friends
-
-From: Peter Zijlstra <peterz@infradead.org>
-
-[ Upstream commit a6a5eb269f6f3a2fe392f725a8d9052190c731e2 ]
-
-As x86 uses the <asm-generic/bitops/instrumented-*.h> headers, the
-regular forms of all bitops are instrumented with explicit calls to
-KASAN and KCSAN checks. As these are explicit calls, these are not
-suppressed by the noinstr function attribute.
-
-This can result in calls to those check functions in noinstr code, which
-objtool warns about:
-
-vmlinux.o: warning: objtool: enter_from_user_mode+0x24: call to __kcsan_check_access() leaves .noinstr.text section
-vmlinux.o: warning: objtool: syscall_enter_from_user_mode+0x28: call to __kcsan_check_access() leaves .noinstr.text section
-vmlinux.o: warning: objtool: syscall_enter_from_user_mode_prepare+0x24: call to __kcsan_check_access() leaves .noinstr.text section
-vmlinux.o: warning: objtool: irqentry_enter_from_user_mode+0x24: call to __kcsan_check_access() leaves .noinstr.text section
-
-Prevent this by using the arch_*() bitops, which are the underlying
-bitops without explciit instrumentation.
-
-[null: Changelog]
-Reported-by: kernel test robot <lkp@intel.com>
-Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
-Link: https://lkml.kernel.org/r/20220502111216.290518605@infradead.org
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/x86/include/asm/cpufeature.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h
-index 1261842d006c..49a3b122279e 100644
---- a/arch/x86/include/asm/cpufeature.h
-+++ b/arch/x86/include/asm/cpufeature.h
-@@ -51,7 +51,7 @@ extern const char * const x86_power_flags[32];
- extern const char * const x86_bug_flags[NBUGINTS*32];
-
- #define test_cpu_cap(c, bit) \
-- test_bit(bit, (unsigned long *)((c)->x86_capability))
-+ arch_test_bit(bit, (unsigned long *)((c)->x86_capability))
-
- /*
- * There are 32 bits/features in each mask word. The high bits
---
-2.35.1
-
+++ /dev/null
-From 76e8f49949f933b0f7f882227c9c34b3c7f1b824 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 16 May 2022 18:30:55 +0800
-Subject: ASoC: rt5640: Do not manipulate pin "Platform Clock" if the "Platform
- Clock" is not in the DAPM
-
-From: Oder Chiou <oder_chiou@realtek.com>
-
-[ Upstream commit 832296804bc7171730884e78c761c29f6d258e13 ]
-
-The pin "Platform Clock" was only used by the Intel Byt CR platform. In the
-others, the error log will be informed. The patch will set the flag to
-avoid the pin "Platform Clock" manipulated by the other platforms.
-
-Signed-off-by: Oder Chiou <oder_chiou@realtek.com>
-Reported-by: Sameer Pujar <spujar@nvidia.com>
-Link: https://lore.kernel.org/r/20220516103055.20003-1-oder_chiou@realtek.com
-Signed-off-by: Mark Brown <broonie@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- sound/soc/codecs/rt5640.c | 11 +++++++++--
- sound/soc/codecs/rt5640.h | 2 ++
- sound/soc/intel/boards/bytcr_rt5640.c | 2 ++
- 3 files changed, 13 insertions(+), 2 deletions(-)
-
-diff --git a/sound/soc/codecs/rt5640.c b/sound/soc/codecs/rt5640.c
-index 30c2e7cb7ed2..3559d9ecfa07 100644
---- a/sound/soc/codecs/rt5640.c
-+++ b/sound/soc/codecs/rt5640.c
-@@ -2094,12 +2094,14 @@ EXPORT_SYMBOL_GPL(rt5640_sel_asrc_clk_src);
- void rt5640_enable_micbias1_for_ovcd(struct snd_soc_component *component)
- {
- struct snd_soc_dapm_context *dapm = snd_soc_component_get_dapm(component);
-+ struct rt5640_priv *rt5640 = snd_soc_component_get_drvdata(component);
-
- snd_soc_dapm_mutex_lock(dapm);
- snd_soc_dapm_force_enable_pin_unlocked(dapm, "LDO2");
- snd_soc_dapm_force_enable_pin_unlocked(dapm, "MICBIAS1");
- /* OVCD is unreliable when used with RCCLK as sysclk-source */
-- snd_soc_dapm_force_enable_pin_unlocked(dapm, "Platform Clock");
-+ if (rt5640->use_platform_clock)
-+ snd_soc_dapm_force_enable_pin_unlocked(dapm, "Platform Clock");
- snd_soc_dapm_sync_unlocked(dapm);
- snd_soc_dapm_mutex_unlock(dapm);
- }
-@@ -2108,9 +2110,11 @@ EXPORT_SYMBOL_GPL(rt5640_enable_micbias1_for_ovcd);
- void rt5640_disable_micbias1_for_ovcd(struct snd_soc_component *component)
- {
- struct snd_soc_dapm_context *dapm = snd_soc_component_get_dapm(component);
-+ struct rt5640_priv *rt5640 = snd_soc_component_get_drvdata(component);
-
- snd_soc_dapm_mutex_lock(dapm);
-- snd_soc_dapm_disable_pin_unlocked(dapm, "Platform Clock");
-+ if (rt5640->use_platform_clock)
-+ snd_soc_dapm_disable_pin_unlocked(dapm, "Platform Clock");
- snd_soc_dapm_disable_pin_unlocked(dapm, "MICBIAS1");
- snd_soc_dapm_disable_pin_unlocked(dapm, "LDO2");
- snd_soc_dapm_sync_unlocked(dapm);
-@@ -2535,6 +2539,9 @@ static void rt5640_enable_jack_detect(struct snd_soc_component *component,
- rt5640->jd_gpio_irq_requested = true;
- }
-
-+ if (jack_data && jack_data->use_platform_clock)
-+ rt5640->use_platform_clock = jack_data->use_platform_clock;
-+
- ret = request_irq(rt5640->irq, rt5640_irq,
- IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
- "rt5640", rt5640);
-diff --git a/sound/soc/codecs/rt5640.h b/sound/soc/codecs/rt5640.h
-index 9e49b9a0ccaa..505c93514051 100644
---- a/sound/soc/codecs/rt5640.h
-+++ b/sound/soc/codecs/rt5640.h
-@@ -2155,11 +2155,13 @@ struct rt5640_priv {
- bool jd_inverted;
- unsigned int ovcd_th;
- unsigned int ovcd_sf;
-+ bool use_platform_clock;
- };
-
- struct rt5640_set_jack_data {
- int codec_irq_override;
- struct gpio_desc *jd_gpio;
-+ bool use_platform_clock;
- };
-
- int rt5640_dmic_enable(struct snd_soc_component *component,
-diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c
-index f81ae742faa7..75ec4a9322bb 100644
---- a/sound/soc/intel/boards/bytcr_rt5640.c
-+++ b/sound/soc/intel/boards/bytcr_rt5640.c
-@@ -1191,12 +1191,14 @@ static int byt_rt5640_init(struct snd_soc_pcm_runtime *runtime)
- {
- struct snd_soc_card *card = runtime->card;
- struct byt_rt5640_private *priv = snd_soc_card_get_drvdata(card);
-+ struct rt5640_set_jack_data *jack_data = &priv->jack_data;
- struct snd_soc_component *component = asoc_rtd_to_codec(runtime, 0)->component;
- const struct snd_soc_dapm_route *custom_map = NULL;
- int num_routes = 0;
- int ret;
-
- card->dapm.idle_bias_off = true;
-+ jack_data->use_platform_clock = true;
-
- /* Start with RC clk for jack-detect (we disable MCLK below) */
- if (byt_rt5640_quirk & BYT_RT5640_MCLK_EN)
---
-2.35.1
-
+++ /dev/null
-From bbc6fa900b5d7eab0805274b8dc5f356f6b79a72 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 23 May 2022 16:59:53 +0530
-Subject: ASoC: SOF: amd: Fixed Build error
-
-From: Syed Saba kareem <ssabakar@amd.com>
-
-[ Upstream commit 803a1f7272797faa15a7879cdc70f9adaf3fdcba ]
-
-Add linux/module.h in acp-pci.c to solve the below dependency
-
-All error/warnings (new ones prefixed by >>):
-
->> sound/soc/amd/acp/acp-pci.c:148:1: warning: data definition has no type or storage class
-148 | MODULE_DEVICE_TABLE(pci, acp_pci_ids);
-| ^~~~~~~~~~~~~~~~~~~
->> sound/soc/amd/acp/acp-pci.c:148:1: error: type defaults to 'int' in declaration of 'MODULE_DEVICE_TABLE' [-Werror=implicit-int]
-...
-
-Reported-by: kernel test robot <lkp@intel.com>
-Signed-off-by: Syed Saba Kareem<ssabakar@amd.com>
-Link: https://lore.kernel.org/r/20220523112956.3087604-1-ssabakar@amd.com
-Signed-off-by: Mark Brown <broonie@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- sound/soc/amd/acp/acp-pci.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/sound/soc/amd/acp/acp-pci.c b/sound/soc/amd/acp/acp-pci.c
-index 340e39d7f420..c893963ee2d0 100644
---- a/sound/soc/amd/acp/acp-pci.c
-+++ b/sound/soc/amd/acp/acp-pci.c
-@@ -16,6 +16,7 @@
- #include <linux/pci.h>
- #include <linux/platform_device.h>
- #include <linux/pm_runtime.h>
-+#include <linux/module.h>
-
- #include "amd.h"
- #include "../mach-config.h"
---
-2.35.1
-
+++ /dev/null
-From 3937cca317a0012fa1ff11b73644f2e5d3a03901 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 10 Mar 2022 09:34:19 -0500
-Subject: ceph: allow ceph.dir.rctime xattr to be updatable
-
-From: Venky Shankar <vshankar@redhat.com>
-
-[ Upstream commit d7a2dc523085f8b8c60548ceedc696934aefeb0e ]
-
-`rctime' has been a pain point in cephfs due to its buggy
-nature - inconsistent values reported and those sorts.
-Fixing rctime is non-trivial needing an overall redesign
-of the entire nested statistics infrastructure.
-
-As a workaround, PR
-
- http://github.com/ceph/ceph/pull/37938
-
-allows this extended attribute to be manually set. This allows
-users to "fixup" inconsistent rctime values. While this sounds
-messy, its probably the wisest approach allowing users/scripts
-to workaround buggy rctime values.
-
-The above PR enables Ceph MDS to allow manually setting
-rctime extended attribute with the corresponding user-land
-changes. We may as well allow the same to be done via kclient
-for parity.
-
-Signed-off-by: Venky Shankar <vshankar@redhat.com>
-Reviewed-by: Xiubo Li <xiubli@redhat.com>
-Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/ceph/xattr.c | 10 +++++++++-
- 1 file changed, 9 insertions(+), 1 deletion(-)
-
-diff --git a/fs/ceph/xattr.c b/fs/ceph/xattr.c
-index afec84088471..8c2dc2c762a4 100644
---- a/fs/ceph/xattr.c
-+++ b/fs/ceph/xattr.c
-@@ -366,6 +366,14 @@ static ssize_t ceph_vxattrcb_auth_mds(struct ceph_inode_info *ci,
- }
- #define XATTR_RSTAT_FIELD(_type, _name) \
- XATTR_NAME_CEPH(_type, _name, VXATTR_FLAG_RSTAT)
-+#define XATTR_RSTAT_FIELD_UPDATABLE(_type, _name) \
-+ { \
-+ .name = CEPH_XATTR_NAME(_type, _name), \
-+ .name_size = sizeof (CEPH_XATTR_NAME(_type, _name)), \
-+ .getxattr_cb = ceph_vxattrcb_ ## _type ## _ ## _name, \
-+ .exists_cb = NULL, \
-+ .flags = VXATTR_FLAG_RSTAT, \
-+ }
- #define XATTR_LAYOUT_FIELD(_type, _name, _field) \
- { \
- .name = CEPH_XATTR_NAME2(_type, _name, _field), \
-@@ -404,7 +412,7 @@ static struct ceph_vxattr ceph_dir_vxattrs[] = {
- XATTR_RSTAT_FIELD(dir, rsubdirs),
- XATTR_RSTAT_FIELD(dir, rsnaps),
- XATTR_RSTAT_FIELD(dir, rbytes),
-- XATTR_RSTAT_FIELD(dir, rctime),
-+ XATTR_RSTAT_FIELD_UPDATABLE(dir, rctime),
- {
- .name = "ceph.dir.pin",
- .name_size = sizeof("ceph.dir.pin"),
---
-2.35.1
-
+++ /dev/null
-From 1cb138db0961f2d10eca67ad0b734a85103ab87c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 25 Apr 2022 16:08:24 +0800
-Subject: ceph: fix possible deadlock when holding Fwb to get inline_data
-
-From: Xiubo Li <xiubli@redhat.com>
-
-[ Upstream commit 825978fd6a0defc3c29d8a38b6cea76a0938d21e ]
-
-1, mount with wsync.
-2, create a file with O_RDWR, and the request was sent to mds.0:
-
- ceph_atomic_open()-->
- ceph_mdsc_do_request(openc)
- finish_open(file, dentry, ceph_open)-->
- ceph_open()-->
- ceph_init_file()-->
- ceph_init_file_info()-->
- ceph_uninline_data()-->
- {
- ...
- if (inline_version == 1 || /* initial version, no data */
- inline_version == CEPH_INLINE_NONE)
- goto out_unlock;
- ...
- }
-
-The inline_version will be 1, which is the initial version for the
-new create file. And here the ci->i_inline_version will keep with 1,
-it's buggy.
-
-3, buffer write to the file immediately:
-
- ceph_write_iter()-->
- ceph_get_caps(file, need=Fw, want=Fb, ...);
- generic_perform_write()-->
- a_ops->write_begin()-->
- ceph_write_begin()-->
- netfs_write_begin()-->
- netfs_begin_read()-->
- netfs_rreq_submit_slice()-->
- netfs_read_from_server()-->
- rreq->netfs_ops->issue_read()-->
- ceph_netfs_issue_read()-->
- {
- ...
- if (ci->i_inline_version != CEPH_INLINE_NONE &&
- ceph_netfs_issue_op_inline(subreq))
- return;
- ...
- }
- ceph_put_cap_refs(ci, Fwb);
-
-The ceph_netfs_issue_op_inline() will send a getattr(Fsr) request to
-mds.1.
-
-4, then the mds.1 will request the rd lock for CInode::filelock from
-the auth mds.0, the mds.0 will do the CInode::filelock state transation
-from excl --> sync, but it need to revoke the Fxwb caps back from the
-clients.
-
-While the kernel client has aleady held the Fwb caps and waiting for
-the getattr(Fsr).
-
-It's deadlock!
-
-URL: https://tracker.ceph.com/issues/55377
-Signed-off-by: Xiubo Li <xiubli@redhat.com>
-Reviewed-by: Jeff Layton <jlayton@kernel.org>
-Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/ceph/addr.c | 33 +++++++++++++++++++--------------
- 1 file changed, 19 insertions(+), 14 deletions(-)
-
-diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c
-index b6edcf89a429..adef10a6e5c7 100644
---- a/fs/ceph/addr.c
-+++ b/fs/ceph/addr.c
-@@ -1644,7 +1644,7 @@ int ceph_uninline_data(struct file *file)
- struct inode *inode = file_inode(file);
- struct ceph_inode_info *ci = ceph_inode(inode);
- struct ceph_fs_client *fsc = ceph_inode_to_client(inode);
-- struct ceph_osd_request *req;
-+ struct ceph_osd_request *req = NULL;
- struct ceph_cap_flush *prealloc_cf;
- struct folio *folio = NULL;
- u64 inline_version = CEPH_INLINE_NONE;
-@@ -1652,10 +1652,23 @@ int ceph_uninline_data(struct file *file)
- int err = 0;
- u64 len;
-
-+ spin_lock(&ci->i_ceph_lock);
-+ inline_version = ci->i_inline_version;
-+ spin_unlock(&ci->i_ceph_lock);
-+
-+ dout("uninline_data %p %llx.%llx inline_version %llu\n",
-+ inode, ceph_vinop(inode), inline_version);
-+
-+ if (inline_version == CEPH_INLINE_NONE)
-+ return 0;
-+
- prealloc_cf = ceph_alloc_cap_flush();
- if (!prealloc_cf)
- return -ENOMEM;
-
-+ if (inline_version == 1) /* initial version, no data */
-+ goto out_uninline;
-+
- folio = read_mapping_folio(inode->i_mapping, 0, file);
- if (IS_ERR(folio)) {
- err = PTR_ERR(folio);
-@@ -1664,17 +1677,6 @@ int ceph_uninline_data(struct file *file)
-
- folio_lock(folio);
-
-- spin_lock(&ci->i_ceph_lock);
-- inline_version = ci->i_inline_version;
-- spin_unlock(&ci->i_ceph_lock);
--
-- dout("uninline_data %p %llx.%llx inline_version %llu\n",
-- inode, ceph_vinop(inode), inline_version);
--
-- if (inline_version == 1 || /* initial version, no data */
-- inline_version == CEPH_INLINE_NONE)
-- goto out_unlock;
--
- len = i_size_read(inode);
- if (len > folio_size(folio))
- len = folio_size(folio);
-@@ -1739,6 +1741,7 @@ int ceph_uninline_data(struct file *file)
- ceph_update_write_metrics(&fsc->mdsc->metric, req->r_start_latency,
- req->r_end_latency, len, err);
-
-+out_uninline:
- if (!err) {
- int dirty;
-
-@@ -1757,8 +1760,10 @@ int ceph_uninline_data(struct file *file)
- if (err == -ECANCELED)
- err = 0;
- out_unlock:
-- folio_unlock(folio);
-- folio_put(folio);
-+ if (folio) {
-+ folio_unlock(folio);
-+ folio_put(folio);
-+ }
- out:
- ceph_free_cap_flush(prealloc_cf);
- dout("uninline_data %p %llx.%llx inline_version %llu = %d\n",
---
-2.35.1
-
+++ /dev/null
-From 7ca64874d4e5b75a94822f9b7e976877bfe4a311 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 19 Apr 2022 08:58:49 +0800
-Subject: ceph: flush the mdlog for filesystem sync
-
-From: Xiubo Li <xiubli@redhat.com>
-
-[ Upstream commit 1b2ba3c5616e17ff951359e25c658a1c3f146f1e ]
-
-Before waiting for a request's safe reply, we will send the mdlog flush
-request to the relevant MDS. And this will also flush the mdlog for all
-the other unsafe requests in the same session, so we can record the last
-session and no need to flush mdlog again in the next loop. But there
-still have cases that it may send the mdlog flush requst twice or more,
-but that should be not often.
-
-Rename wait_unsafe_requests() to
-flush_mdlog_and_wait_mdsc_unsafe_requests() to make it more
-descriptive.
-
-[xiubli: fold in MDS request refcount leak fix from Jeff]
-
-URL: https://tracker.ceph.com/issues/55284
-URL: https://tracker.ceph.com/issues/55411
-Signed-off-by: Xiubo Li <xiubli@redhat.com>
-Reviewed-by: Jeff Layton <jlayton@kernel.org>
-Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/ceph/mds_client.c | 33 +++++++++++++++++++++++++++------
- 1 file changed, 27 insertions(+), 6 deletions(-)
-
-diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
-index 1bd3e1bb0fdf..8c249511344d 100644
---- a/fs/ceph/mds_client.c
-+++ b/fs/ceph/mds_client.c
-@@ -4700,15 +4700,17 @@ void ceph_mdsc_pre_umount(struct ceph_mds_client *mdsc)
- }
-
- /*
-- * wait for all write mds requests to flush.
-+ * flush the mdlog and wait for all write mds requests to flush.
- */
--static void wait_unsafe_requests(struct ceph_mds_client *mdsc, u64 want_tid)
-+static void flush_mdlog_and_wait_mdsc_unsafe_requests(struct ceph_mds_client *mdsc,
-+ u64 want_tid)
- {
- struct ceph_mds_request *req = NULL, *nextreq;
-+ struct ceph_mds_session *last_session = NULL;
- struct rb_node *n;
-
- mutex_lock(&mdsc->mutex);
-- dout("wait_unsafe_requests want %lld\n", want_tid);
-+ dout("%s want %lld\n", __func__, want_tid);
- restart:
- req = __get_oldest_req(mdsc);
- while (req && req->r_tid <= want_tid) {
-@@ -4720,14 +4722,32 @@ static void wait_unsafe_requests(struct ceph_mds_client *mdsc, u64 want_tid)
- nextreq = NULL;
- if (req->r_op != CEPH_MDS_OP_SETFILELOCK &&
- (req->r_op & CEPH_MDS_OP_WRITE)) {
-+ struct ceph_mds_session *s = req->r_session;
-+
-+ if (!s) {
-+ req = nextreq;
-+ continue;
-+ }
-+
- /* write op */
- ceph_mdsc_get_request(req);
- if (nextreq)
- ceph_mdsc_get_request(nextreq);
-+ s = ceph_get_mds_session(s);
- mutex_unlock(&mdsc->mutex);
-- dout("wait_unsafe_requests wait on %llu (want %llu)\n",
-+
-+ /* send flush mdlog request to MDS */
-+ if (last_session != s) {
-+ send_flush_mdlog(s);
-+ ceph_put_mds_session(last_session);
-+ last_session = s;
-+ } else {
-+ ceph_put_mds_session(s);
-+ }
-+ dout("%s wait on %llu (want %llu)\n", __func__,
- req->r_tid, want_tid);
- wait_for_completion(&req->r_safe_completion);
-+
- mutex_lock(&mdsc->mutex);
- ceph_mdsc_put_request(req);
- if (!nextreq)
-@@ -4742,7 +4762,8 @@ static void wait_unsafe_requests(struct ceph_mds_client *mdsc, u64 want_tid)
- req = nextreq;
- }
- mutex_unlock(&mdsc->mutex);
-- dout("wait_unsafe_requests done\n");
-+ ceph_put_mds_session(last_session);
-+ dout("%s done\n", __func__);
- }
-
- void ceph_mdsc_sync(struct ceph_mds_client *mdsc)
-@@ -4771,7 +4792,7 @@ void ceph_mdsc_sync(struct ceph_mds_client *mdsc)
- dout("sync want tid %lld flush_seq %lld\n",
- want_tid, want_flush);
-
-- wait_unsafe_requests(mdsc, want_tid);
-+ flush_mdlog_and_wait_mdsc_unsafe_requests(mdsc, want_tid);
- wait_caps_flush(mdsc, want_flush);
- }
-
---
-2.35.1
-
+++ /dev/null
-From ac3aa115a117f69274833b87a9ef1dce1ea8c309 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 6 Apr 2022 15:57:03 +0800
-Subject: char: xillybus: fix a refcount leak in cleanup_dev()
-
-From: Hangyu Hua <hbh25y@gmail.com>
-
-[ Upstream commit b67d19662fdee275c479d21853bc1239600a798f ]
-
-usb_get_dev is called in xillyusb_probe. So it is better to call
-usb_put_dev before xdev is released.
-
-Acked-by: Eli Billauer <eli.billauer@gmail.com>
-Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
-Link: https://lore.kernel.org/r/20220406075703.23464-1-hbh25y@gmail.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/char/xillybus/xillyusb.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/drivers/char/xillybus/xillyusb.c b/drivers/char/xillybus/xillyusb.c
-index dc3551796e5e..39bcbfd908b4 100644
---- a/drivers/char/xillybus/xillyusb.c
-+++ b/drivers/char/xillybus/xillyusb.c
-@@ -549,6 +549,7 @@ static void cleanup_dev(struct kref *kref)
- if (xdev->workq)
- destroy_workqueue(xdev->workq);
-
-+ usb_put_dev(xdev->udev);
- kfree(xdev->channels); /* Argument may be NULL, and that's fine */
- kfree(xdev);
- }
---
-2.35.1
-
+++ /dev/null
-From 074577b13f4be36b936a10c07f591fa6f88ff0ed Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 1 Jun 2022 00:03:18 -0500
-Subject: cifs: fix potential deadlock in direct reclaim
-
-From: Vincent Whitchurch <vincent.whitchurch@axis.com>
-
-[ Upstream commit cc391b694ff085f62f133e6b8f864d43a8e69dfd ]
-
-The srv_mutex is used during writeback so cifs should ensure that
-allocations done when that mutex is held are done with GFP_NOFS, to
-avoid having direct reclaim ending up waiting for the same mutex and
-causing a deadlock. This is detected by lockdep with the splat below:
-
- ======================================================
- WARNING: possible circular locking dependency detected
- 5.18.0 #70 Not tainted
- ------------------------------------------------------
- kswapd0/49 is trying to acquire lock:
- ffff8880195782e0 (&tcp_ses->srv_mutex){+.+.}-{3:3}, at: compound_send_recv
-
- but task is already holding lock:
- ffffffffa98e66c0 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat
-
- which lock already depends on the new lock.
-
- the existing dependency chain (in reverse order) is:
-
- -> #1 (fs_reclaim){+.+.}-{0:0}:
- fs_reclaim_acquire
- kmem_cache_alloc_trace
- __request_module
- crypto_alg_mod_lookup
- crypto_alloc_tfm_node
- crypto_alloc_shash
- cifs_alloc_hash
- smb311_crypto_shash_allocate
- smb311_update_preauth_hash
- compound_send_recv
- cifs_send_recv
- SMB2_negotiate
- smb2_negotiate
- cifs_negotiate_protocol
- cifs_get_smb_ses
- cifs_mount
- cifs_smb3_do_mount
- smb3_get_tree
- vfs_get_tree
- path_mount
- __x64_sys_mount
- do_syscall_64
- entry_SYSCALL_64_after_hwframe
-
- -> #0 (&tcp_ses->srv_mutex){+.+.}-{3:3}:
- __lock_acquire
- lock_acquire
- __mutex_lock
- mutex_lock_nested
- compound_send_recv
- cifs_send_recv
- SMB2_write
- smb2_sync_write
- cifs_write
- cifs_writepage_locked
- cifs_writepage
- shrink_page_list
- shrink_lruvec
- shrink_node
- balance_pgdat
- kswapd
- kthread
- ret_from_fork
-
- other info that might help us debug this:
-
- Possible unsafe locking scenario:
-
- CPU0 CPU1
- ---- ----
- lock(fs_reclaim);
- lock(&tcp_ses->srv_mutex);
- lock(fs_reclaim);
- lock(&tcp_ses->srv_mutex);
-
- *** DEADLOCK ***
-
- 1 lock held by kswapd0/49:
- #0: ffffffffa98e66c0 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat
-
- stack backtrace:
- CPU: 2 PID: 49 Comm: kswapd0 Not tainted 5.18.0 #70
- Call Trace:
- <TASK>
- dump_stack_lvl
- dump_stack
- print_circular_bug.cold
- check_noncircular
- __lock_acquire
- lock_acquire
- __mutex_lock
- mutex_lock_nested
- compound_send_recv
- cifs_send_recv
- SMB2_write
- smb2_sync_write
- cifs_write
- cifs_writepage_locked
- cifs_writepage
- shrink_page_list
- shrink_lruvec
- shrink_node
- balance_pgdat
- kswapd
- kthread
- ret_from_fork
- </TASK>
-
-Fix this by using the memalloc_nofs_save/restore APIs around the places
-where the srv_mutex is held. Do this in a wrapper function for the
-lock/unlock of the srv_mutex, and rename the srv_mutex to avoid missing
-call sites in the conversion.
-
-Note that there is another lockdep warning involving internal crypto
-locks, which was masked by this problem and is visible after this fix,
-see the discussion in this thread:
-
- https://lore.kernel.org/all/20220523123755.GA13668@axis.com/
-
-Link: https://lore.kernel.org/r/CANT5p=rqcYfYMVHirqvdnnca4Mo+JQSw5Qu12v=kPfpk5yhhmg@mail.gmail.com/
-Reported-by: Shyam Prasad N <nspmangalore@gmail.com>
-Suggested-by: Lars Persson <larper@axis.com>
-Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com>
-Reviewed-by: Enzo Matsumiya <ematsumiya@suse.de>
-Signed-off-by: Vincent Whitchurch <vincent.whitchurch@axis.com>
-Signed-off-by: Steve French <stfrench@microsoft.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/cifs/cifs_swn.c | 4 ++--
- fs/cifs/cifsencrypt.c | 8 ++++----
- fs/cifs/cifsglob.h | 20 +++++++++++++++++++-
- fs/cifs/connect.c | 26 +++++++++++++-------------
- fs/cifs/dfs_cache.c | 4 ++--
- fs/cifs/sess.c | 6 +++---
- fs/cifs/smb1ops.c | 6 +++---
- fs/cifs/smb2pdu.c | 6 +++---
- fs/cifs/smbdirect.c | 4 ++--
- fs/cifs/transport.c | 40 ++++++++++++++++++++--------------------
- 10 files changed, 71 insertions(+), 53 deletions(-)
-
-diff --git a/fs/cifs/cifs_swn.c b/fs/cifs/cifs_swn.c
-index 180c234c2f46..1e4c7cc5287f 100644
---- a/fs/cifs/cifs_swn.c
-+++ b/fs/cifs/cifs_swn.c
-@@ -465,7 +465,7 @@ static int cifs_swn_reconnect(struct cifs_tcon *tcon, struct sockaddr_storage *a
- int ret = 0;
-
- /* Store the reconnect address */
-- mutex_lock(&tcon->ses->server->srv_mutex);
-+ cifs_server_lock(tcon->ses->server);
- if (cifs_sockaddr_equal(&tcon->ses->server->dstaddr, addr))
- goto unlock;
-
-@@ -501,7 +501,7 @@ static int cifs_swn_reconnect(struct cifs_tcon *tcon, struct sockaddr_storage *a
- cifs_signal_cifsd_for_reconnect(tcon->ses->server, false);
-
- unlock:
-- mutex_unlock(&tcon->ses->server->srv_mutex);
-+ cifs_server_unlock(tcon->ses->server);
-
- return ret;
- }
-diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c
-index 0912d8bbbac1..663cb9db4908 100644
---- a/fs/cifs/cifsencrypt.c
-+++ b/fs/cifs/cifsencrypt.c
-@@ -236,9 +236,9 @@ int cifs_verify_signature(struct smb_rqst *rqst,
- cpu_to_le32(expected_sequence_number);
- cifs_pdu->Signature.Sequence.Reserved = 0;
-
-- mutex_lock(&server->srv_mutex);
-+ cifs_server_lock(server);
- rc = cifs_calc_signature(rqst, server, what_we_think_sig_should_be);
-- mutex_unlock(&server->srv_mutex);
-+ cifs_server_unlock(server);
-
- if (rc)
- return rc;
-@@ -626,7 +626,7 @@ setup_ntlmv2_rsp(struct cifs_ses *ses, const struct nls_table *nls_cp)
-
- memcpy(ses->auth_key.response + baselen, tiblob, tilen);
-
-- mutex_lock(&ses->server->srv_mutex);
-+ cifs_server_lock(ses->server);
-
- rc = cifs_alloc_hash("hmac(md5)",
- &ses->server->secmech.hmacmd5,
-@@ -678,7 +678,7 @@ setup_ntlmv2_rsp(struct cifs_ses *ses, const struct nls_table *nls_cp)
- cifs_dbg(VFS, "%s: Could not generate md5 hash\n", __func__);
-
- unlock:
-- mutex_unlock(&ses->server->srv_mutex);
-+ cifs_server_unlock(ses->server);
- setup_ntlmv2_rsp_ret:
- kfree(tiblob);
-
-diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
-index 5024b6792dab..e7503c1131a3 100644
---- a/fs/cifs/cifsglob.h
-+++ b/fs/cifs/cifsglob.h
-@@ -16,6 +16,7 @@
- #include <linux/mempool.h>
- #include <linux/workqueue.h>
- #include <linux/utsname.h>
-+#include <linux/sched/mm.h>
- #include <linux/netfs.h>
- #include "cifs_fs_sb.h"
- #include "cifsacl.h"
-@@ -621,7 +622,8 @@ struct TCP_Server_Info {
- unsigned int in_flight; /* number of requests on the wire to server */
- unsigned int max_in_flight; /* max number of requests that were on wire */
- spinlock_t req_lock; /* protect the two values above */
-- struct mutex srv_mutex;
-+ struct mutex _srv_mutex;
-+ unsigned int nofs_flag;
- struct task_struct *tsk;
- char server_GUID[16];
- __u16 sec_mode;
-@@ -736,6 +738,22 @@ struct TCP_Server_Info {
- #endif
- };
-
-+static inline void cifs_server_lock(struct TCP_Server_Info *server)
-+{
-+ unsigned int nofs_flag = memalloc_nofs_save();
-+
-+ mutex_lock(&server->_srv_mutex);
-+ server->nofs_flag = nofs_flag;
-+}
-+
-+static inline void cifs_server_unlock(struct TCP_Server_Info *server)
-+{
-+ unsigned int nofs_flag = server->nofs_flag;
-+
-+ mutex_unlock(&server->_srv_mutex);
-+ memalloc_nofs_restore(nofs_flag);
-+}
-+
- struct cifs_credits {
- unsigned int value;
- unsigned int instance;
-diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
-index aa2d4c49e2a5..4a0b44052c35 100644
---- a/fs/cifs/connect.c
-+++ b/fs/cifs/connect.c
-@@ -148,7 +148,7 @@ static void cifs_resolve_server(struct work_struct *work)
- struct TCP_Server_Info *server = container_of(work,
- struct TCP_Server_Info, resolve.work);
-
-- mutex_lock(&server->srv_mutex);
-+ cifs_server_lock(server);
-
- /*
- * Resolve the hostname again to make sure that IP address is up-to-date.
-@@ -159,7 +159,7 @@ static void cifs_resolve_server(struct work_struct *work)
- __func__, rc);
- }
-
-- mutex_unlock(&server->srv_mutex);
-+ cifs_server_unlock(server);
- }
-
- /*
-@@ -267,7 +267,7 @@ cifs_abort_connection(struct TCP_Server_Info *server)
-
- /* do not want to be sending data on a socket we are freeing */
- cifs_dbg(FYI, "%s: tearing down socket\n", __func__);
-- mutex_lock(&server->srv_mutex);
-+ cifs_server_lock(server);
- if (server->ssocket) {
- cifs_dbg(FYI, "State: 0x%x Flags: 0x%lx\n", server->ssocket->state,
- server->ssocket->flags);
-@@ -296,7 +296,7 @@ cifs_abort_connection(struct TCP_Server_Info *server)
- mid->mid_flags |= MID_DELETED;
- }
- spin_unlock(&GlobalMid_Lock);
-- mutex_unlock(&server->srv_mutex);
-+ cifs_server_unlock(server);
-
- cifs_dbg(FYI, "%s: issuing mid callbacks\n", __func__);
- list_for_each_entry_safe(mid, nmid, &retry_list, qhead) {
-@@ -306,9 +306,9 @@ cifs_abort_connection(struct TCP_Server_Info *server)
- }
-
- if (cifs_rdma_enabled(server)) {
-- mutex_lock(&server->srv_mutex);
-+ cifs_server_lock(server);
- smbd_destroy(server);
-- mutex_unlock(&server->srv_mutex);
-+ cifs_server_unlock(server);
- }
- }
-
-@@ -359,7 +359,7 @@ static int __cifs_reconnect(struct TCP_Server_Info *server,
-
- do {
- try_to_freeze();
-- mutex_lock(&server->srv_mutex);
-+ cifs_server_lock(server);
-
- if (!cifs_swn_set_server_dstaddr(server)) {
- /* resolve the hostname again to make sure that IP address is up-to-date */
-@@ -372,7 +372,7 @@ static int __cifs_reconnect(struct TCP_Server_Info *server,
- else
- rc = generic_ip_connect(server);
- if (rc) {
-- mutex_unlock(&server->srv_mutex);
-+ cifs_server_unlock(server);
- cifs_dbg(FYI, "%s: reconnect error %d\n", __func__, rc);
- msleep(3000);
- } else {
-@@ -383,7 +383,7 @@ static int __cifs_reconnect(struct TCP_Server_Info *server,
- server->tcpStatus = CifsNeedNegotiate;
- spin_unlock(&cifs_tcp_ses_lock);
- cifs_swn_reset_server_dstaddr(server);
-- mutex_unlock(&server->srv_mutex);
-+ cifs_server_unlock(server);
- mod_delayed_work(cifsiod_wq, &server->reconnect, 0);
- }
- } while (server->tcpStatus == CifsNeedReconnect);
-@@ -488,12 +488,12 @@ static int reconnect_dfs_server(struct TCP_Server_Info *server)
-
- do {
- try_to_freeze();
-- mutex_lock(&server->srv_mutex);
-+ cifs_server_lock(server);
-
- rc = reconnect_target_unlocked(server, &tl, &target_hint);
- if (rc) {
- /* Failed to reconnect socket */
-- mutex_unlock(&server->srv_mutex);
-+ cifs_server_unlock(server);
- cifs_dbg(FYI, "%s: reconnect error %d\n", __func__, rc);
- msleep(3000);
- continue;
-@@ -510,7 +510,7 @@ static int reconnect_dfs_server(struct TCP_Server_Info *server)
- server->tcpStatus = CifsNeedNegotiate;
- spin_unlock(&cifs_tcp_ses_lock);
- cifs_swn_reset_server_dstaddr(server);
-- mutex_unlock(&server->srv_mutex);
-+ cifs_server_unlock(server);
- mod_delayed_work(cifsiod_wq, &server->reconnect, 0);
- } while (server->tcpStatus == CifsNeedReconnect);
-
-@@ -1565,7 +1565,7 @@ cifs_get_tcp_session(struct smb3_fs_context *ctx,
- init_waitqueue_head(&tcp_ses->response_q);
- init_waitqueue_head(&tcp_ses->request_q);
- INIT_LIST_HEAD(&tcp_ses->pending_mid_q);
-- mutex_init(&tcp_ses->srv_mutex);
-+ mutex_init(&tcp_ses->_srv_mutex);
- memcpy(tcp_ses->workstation_RFC1001_name,
- ctx->source_rfc1001_name, RFC1001_NAME_LEN_WITH_NULL);
- memcpy(tcp_ses->server_RFC1001_name,
-diff --git a/fs/cifs/dfs_cache.c b/fs/cifs/dfs_cache.c
-index c5dd6f7305bd..aa7d00b5b3e7 100644
---- a/fs/cifs/dfs_cache.c
-+++ b/fs/cifs/dfs_cache.c
-@@ -1327,9 +1327,9 @@ static bool target_share_equal(struct TCP_Server_Info *server, const char *s1, c
- cifs_dbg(VFS, "%s: failed to convert address \'%s\'. skip address matching.\n",
- __func__, ip);
- } else {
-- mutex_lock(&server->srv_mutex);
-+ cifs_server_lock(server);
- match = cifs_match_ipaddr((struct sockaddr *)&server->dstaddr, &sa);
-- mutex_unlock(&server->srv_mutex);
-+ cifs_server_unlock(server);
- }
-
- kfree(ip);
-diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
-index 1a0995bb5d90..20f3abc40267 100644
---- a/fs/cifs/sess.c
-+++ b/fs/cifs/sess.c
-@@ -1093,14 +1093,14 @@ sess_establish_session(struct sess_data *sess_data)
- struct cifs_ses *ses = sess_data->ses;
- struct TCP_Server_Info *server = sess_data->server;
-
-- mutex_lock(&server->srv_mutex);
-+ cifs_server_lock(server);
- if (!server->session_estab) {
- if (server->sign) {
- server->session_key.response =
- kmemdup(ses->auth_key.response,
- ses->auth_key.len, GFP_KERNEL);
- if (!server->session_key.response) {
-- mutex_unlock(&server->srv_mutex);
-+ cifs_server_unlock(server);
- return -ENOMEM;
- }
- server->session_key.len =
-@@ -1109,7 +1109,7 @@ sess_establish_session(struct sess_data *sess_data)
- server->sequence_number = 0x2;
- server->session_estab = true;
- }
-- mutex_unlock(&server->srv_mutex);
-+ cifs_server_unlock(server);
-
- cifs_dbg(FYI, "CIFS session established successfully\n");
- return 0;
-diff --git a/fs/cifs/smb1ops.c b/fs/cifs/smb1ops.c
-index c71c9a44bef4..2e20ee4dab7b 100644
---- a/fs/cifs/smb1ops.c
-+++ b/fs/cifs/smb1ops.c
-@@ -38,10 +38,10 @@ send_nt_cancel(struct TCP_Server_Info *server, struct smb_rqst *rqst,
- in_buf->WordCount = 0;
- put_bcc(0, in_buf);
-
-- mutex_lock(&server->srv_mutex);
-+ cifs_server_lock(server);
- rc = cifs_sign_smb(in_buf, server, &mid->sequence_number);
- if (rc) {
-- mutex_unlock(&server->srv_mutex);
-+ cifs_server_unlock(server);
- return rc;
- }
-
-@@ -55,7 +55,7 @@ send_nt_cancel(struct TCP_Server_Info *server, struct smb_rqst *rqst,
- if (rc < 0)
- server->sequence_number--;
-
-- mutex_unlock(&server->srv_mutex);
-+ cifs_server_unlock(server);
-
- cifs_dbg(FYI, "issued NT_CANCEL for mid %u, rc = %d\n",
- get_mid(in_buf), rc);
-diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
-index f5321a3500f3..cf10b93fb41a 100644
---- a/fs/cifs/smb2pdu.c
-+++ b/fs/cifs/smb2pdu.c
-@@ -1369,13 +1369,13 @@ SMB2_sess_establish_session(struct SMB2_sess_data *sess_data)
- struct cifs_ses *ses = sess_data->ses;
- struct TCP_Server_Info *server = sess_data->server;
-
-- mutex_lock(&server->srv_mutex);
-+ cifs_server_lock(server);
- if (server->ops->generate_signingkey) {
- rc = server->ops->generate_signingkey(ses, server);
- if (rc) {
- cifs_dbg(FYI,
- "SMB3 session key generation failed\n");
-- mutex_unlock(&server->srv_mutex);
-+ cifs_server_unlock(server);
- return rc;
- }
- }
-@@ -1383,7 +1383,7 @@ SMB2_sess_establish_session(struct SMB2_sess_data *sess_data)
- server->sequence_number = 0x2;
- server->session_estab = true;
- }
-- mutex_unlock(&server->srv_mutex);
-+ cifs_server_unlock(server);
-
- cifs_dbg(FYI, "SMB2/3 session established successfully\n");
- return rc;
-diff --git a/fs/cifs/smbdirect.c b/fs/cifs/smbdirect.c
-index 31ef64eb7fbb..35829d2a0918 100644
---- a/fs/cifs/smbdirect.c
-+++ b/fs/cifs/smbdirect.c
-@@ -1382,9 +1382,9 @@ void smbd_destroy(struct TCP_Server_Info *server)
- log_rdma_event(INFO, "freeing mr list\n");
- wake_up_interruptible_all(&info->wait_mr);
- while (atomic_read(&info->mr_used_count)) {
-- mutex_unlock(&server->srv_mutex);
-+ cifs_server_unlock(server);
- msleep(1000);
-- mutex_lock(&server->srv_mutex);
-+ cifs_server_lock(server);
- }
- destroy_mr_list(info);
-
-diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
-index c667e6ddfe2f..71750cf7bf55 100644
---- a/fs/cifs/transport.c
-+++ b/fs/cifs/transport.c
-@@ -822,7 +822,7 @@ cifs_call_async(struct TCP_Server_Info *server, struct smb_rqst *rqst,
- } else
- instance = exist_credits->instance;
-
-- mutex_lock(&server->srv_mutex);
-+ cifs_server_lock(server);
-
- /*
- * We can't use credits obtained from the previous session to send this
-@@ -830,14 +830,14 @@ cifs_call_async(struct TCP_Server_Info *server, struct smb_rqst *rqst,
- * return -EAGAIN in such cases to let callers handle it.
- */
- if (instance != server->reconnect_instance) {
-- mutex_unlock(&server->srv_mutex);
-+ cifs_server_unlock(server);
- add_credits_and_wake_if(server, &credits, optype);
- return -EAGAIN;
- }
-
- mid = server->ops->setup_async_request(server, rqst);
- if (IS_ERR(mid)) {
-- mutex_unlock(&server->srv_mutex);
-+ cifs_server_unlock(server);
- add_credits_and_wake_if(server, &credits, optype);
- return PTR_ERR(mid);
- }
-@@ -868,7 +868,7 @@ cifs_call_async(struct TCP_Server_Info *server, struct smb_rqst *rqst,
- cifs_delete_mid(mid);
- }
-
-- mutex_unlock(&server->srv_mutex);
-+ cifs_server_unlock(server);
-
- if (rc == 0)
- return 0;
-@@ -1109,7 +1109,7 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
- * of smb data.
- */
-
-- mutex_lock(&server->srv_mutex);
-+ cifs_server_lock(server);
-
- /*
- * All the parts of the compound chain belong obtained credits from the
-@@ -1119,7 +1119,7 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
- * handle it.
- */
- if (instance != server->reconnect_instance) {
-- mutex_unlock(&server->srv_mutex);
-+ cifs_server_unlock(server);
- for (j = 0; j < num_rqst; j++)
- add_credits(server, &credits[j], optype);
- return -EAGAIN;
-@@ -1131,7 +1131,7 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
- revert_current_mid(server, i);
- for (j = 0; j < i; j++)
- cifs_delete_mid(midQ[j]);
-- mutex_unlock(&server->srv_mutex);
-+ cifs_server_unlock(server);
-
- /* Update # of requests on wire to server */
- for (j = 0; j < num_rqst; j++)
-@@ -1163,7 +1163,7 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
- server->sequence_number -= 2;
- }
-
-- mutex_unlock(&server->srv_mutex);
-+ cifs_server_unlock(server);
-
- /*
- * If sending failed for some reason or it is an oplock break that we
-@@ -1190,9 +1190,9 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
- if ((ses->status == CifsNew) || (optype & CIFS_NEG_OP) || (optype & CIFS_SESS_OP)) {
- spin_unlock(&cifs_tcp_ses_lock);
-
-- mutex_lock(&server->srv_mutex);
-+ cifs_server_lock(server);
- smb311_update_preauth_hash(ses, server, rqst[0].rq_iov, rqst[0].rq_nvec);
-- mutex_unlock(&server->srv_mutex);
-+ cifs_server_unlock(server);
-
- spin_lock(&cifs_tcp_ses_lock);
- }
-@@ -1266,9 +1266,9 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
- .iov_len = resp_iov[0].iov_len
- };
- spin_unlock(&cifs_tcp_ses_lock);
-- mutex_lock(&server->srv_mutex);
-+ cifs_server_lock(server);
- smb311_update_preauth_hash(ses, server, &iov, 1);
-- mutex_unlock(&server->srv_mutex);
-+ cifs_server_unlock(server);
- spin_lock(&cifs_tcp_ses_lock);
- }
- spin_unlock(&cifs_tcp_ses_lock);
-@@ -1385,11 +1385,11 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses,
- and avoid races inside tcp sendmsg code that could cause corruption
- of smb data */
-
-- mutex_lock(&server->srv_mutex);
-+ cifs_server_lock(server);
-
- rc = allocate_mid(ses, in_buf, &midQ);
- if (rc) {
-- mutex_unlock(&server->srv_mutex);
-+ cifs_server_unlock(server);
- /* Update # of requests on wire to server */
- add_credits(server, &credits, 0);
- return rc;
-@@ -1397,7 +1397,7 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses,
-
- rc = cifs_sign_smb(in_buf, server, &midQ->sequence_number);
- if (rc) {
-- mutex_unlock(&server->srv_mutex);
-+ cifs_server_unlock(server);
- goto out;
- }
-
-@@ -1411,7 +1411,7 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses,
- if (rc < 0)
- server->sequence_number -= 2;
-
-- mutex_unlock(&server->srv_mutex);
-+ cifs_server_unlock(server);
-
- if (rc < 0)
- goto out;
-@@ -1530,18 +1530,18 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon,
- and avoid races inside tcp sendmsg code that could cause corruption
- of smb data */
-
-- mutex_lock(&server->srv_mutex);
-+ cifs_server_lock(server);
-
- rc = allocate_mid(ses, in_buf, &midQ);
- if (rc) {
-- mutex_unlock(&server->srv_mutex);
-+ cifs_server_unlock(server);
- return rc;
- }
-
- rc = cifs_sign_smb(in_buf, server, &midQ->sequence_number);
- if (rc) {
- cifs_delete_mid(midQ);
-- mutex_unlock(&server->srv_mutex);
-+ cifs_server_unlock(server);
- return rc;
- }
-
-@@ -1554,7 +1554,7 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon,
- if (rc < 0)
- server->sequence_number -= 2;
-
-- mutex_unlock(&server->srv_mutex);
-+ cifs_server_unlock(server);
-
- if (rc < 0) {
- cifs_delete_mid(midQ);
---
-2.35.1
-
+++ /dev/null
-From 246da61ed303d14bf169e9635b014e30520ae472 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 1 Jun 2022 22:08:46 -0500
-Subject: cifs: version operations for smb20 unneeded when legacy support
- disabled
-
-From: Steve French <stfrench@microsoft.com>
-
-[ Upstream commit 7ef93ffccd55fb0ba000ed16ef6a81cd7dee07b5 ]
-
-We should not be including unused smb20 specific code when legacy
-support is disabled (CONFIG_CIFS_ALLOW_INSECURE_LEGACY turned
-off). For example smb2_operations and smb2_values aren't used
-in that case. Over time we can move more and more SMB1/CIFS and SMB2.0
-code into the insecure legacy ifdefs
-
-Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com>
-Signed-off-by: Steve French <stfrench@microsoft.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/cifs/cifsglob.h | 4 +++-
- fs/cifs/smb2ops.c | 7 ++++++-
- 2 files changed, 9 insertions(+), 2 deletions(-)
-
-diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
-index e7503c1131a3..a6cade2aebd9 100644
---- a/fs/cifs/cifsglob.h
-+++ b/fs/cifs/cifsglob.h
-@@ -1929,11 +1929,13 @@ extern mempool_t *cifs_mid_poolp;
-
- /* Operations for different SMB versions */
- #define SMB1_VERSION_STRING "1.0"
-+#define SMB20_VERSION_STRING "2.0"
-+#ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
- extern struct smb_version_operations smb1_operations;
- extern struct smb_version_values smb1_values;
--#define SMB20_VERSION_STRING "2.0"
- extern struct smb_version_operations smb20_operations;
- extern struct smb_version_values smb20_values;
-+#endif /* CIFS_ALLOW_INSECURE_LEGACY */
- #define SMB21_VERSION_STRING "2.1"
- extern struct smb_version_operations smb21_operations;
- extern struct smb_version_values smb21_values;
-diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
-index 861291662c95..6e26edbffc48 100644
---- a/fs/cifs/smb2ops.c
-+++ b/fs/cifs/smb2ops.c
-@@ -4326,11 +4326,13 @@ smb3_set_oplock_level(struct cifsInodeInfo *cinode, __u32 oplock,
- }
- }
-
-+#ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
- static bool
- smb2_is_read_op(__u32 oplock)
- {
- return oplock == SMB2_OPLOCK_LEVEL_II;
- }
-+#endif /* CIFS_ALLOW_INSECURE_LEGACY */
-
- static bool
- smb21_is_read_op(__u32 oplock)
-@@ -5429,7 +5431,7 @@ smb2_make_node(unsigned int xid, struct inode *inode,
- return rc;
- }
-
--
-+#ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
- struct smb_version_operations smb20_operations = {
- .compare_fids = smb2_compare_fids,
- .setup_request = smb2_setup_request,
-@@ -5528,6 +5530,7 @@ struct smb_version_operations smb20_operations = {
- .is_status_io_timeout = smb2_is_status_io_timeout,
- .is_network_name_deleted = smb2_is_network_name_deleted,
- };
-+#endif /* CIFS_ALLOW_INSECURE_LEGACY */
-
- struct smb_version_operations smb21_operations = {
- .compare_fids = smb2_compare_fids,
-@@ -5859,6 +5862,7 @@ struct smb_version_operations smb311_operations = {
- .is_network_name_deleted = smb2_is_network_name_deleted,
- };
-
-+#ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
- struct smb_version_values smb20_values = {
- .version_string = SMB20_VERSION_STRING,
- .protocol_id = SMB20_PROT_ID,
-@@ -5879,6 +5883,7 @@ struct smb_version_values smb20_values = {
- .signing_required = SMB2_NEGOTIATE_SIGNING_REQUIRED,
- .create_lease_size = sizeof(struct create_lease),
- };
-+#endif /* ALLOW_INSECURE_LEGACY */
-
- struct smb_version_values smb21_values = {
- .version_string = SMB21_VERSION_STRING,
---
-2.35.1
-
+++ /dev/null
-From 1bb8a686191c6ebef7c826477a9f92bd6fbee280 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 6 May 2022 17:25:22 +0100
-Subject: clocksource/drivers/sp804: Avoid error on multiple instances
-
-From: Andre Przywara <andre.przywara@arm.com>
-
-[ Upstream commit a98399cbc1e05f7b977419f03905501d566cf54e ]
-
-When a machine sports more than one SP804 timer instance, we only bring
-up the first one, since multiple timers of the same kind are not useful
-to Linux. As this is intentional behaviour, we should not return an
-error message, as we do today:
-===============
-[ 0.000800] Failed to initialize '/bus@8000000/motherboard-bus@8000000/iofpga-bus@300000000/timer@120000': -22
-===============
-
-Replace the -EINVAL return with a debug message and return 0 instead.
-
-Also we do not reach the init function anymore if the DT node is
-disabled (as this is now handled by OF_DECLARE), so remove the explicit
-check for that case.
-
-This fixes a long standing bogus error when booting ARM's fastmodels.
-
-Signed-off-by: Andre Przywara <andre.przywara@arm.com>
-Reviewed-by: Robin Murphy <robin.murphy@arm.com>
-Link: https://lore.kernel.org/r/20220506162522.3675399-1-andre.przywara@arm.com
-Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/clocksource/timer-sp804.c | 10 +++++-----
- 1 file changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/drivers/clocksource/timer-sp804.c b/drivers/clocksource/timer-sp804.c
-index 401d592e85f5..e6a87f4af2b5 100644
---- a/drivers/clocksource/timer-sp804.c
-+++ b/drivers/clocksource/timer-sp804.c
-@@ -259,6 +259,11 @@ static int __init sp804_of_init(struct device_node *np, struct sp804_timer *time
- struct clk *clk1, *clk2;
- const char *name = of_get_property(np, "compatible", NULL);
-
-+ if (initialized) {
-+ pr_debug("%pOF: skipping further SP804 timer device\n", np);
-+ return 0;
-+ }
-+
- base = of_iomap(np, 0);
- if (!base)
- return -ENXIO;
-@@ -270,11 +275,6 @@ static int __init sp804_of_init(struct device_node *np, struct sp804_timer *time
- writel(0, timer1_base + timer->ctrl);
- writel(0, timer2_base + timer->ctrl);
-
-- if (initialized || !of_device_is_available(np)) {
-- ret = -EINVAL;
-- goto err;
-- }
--
- clk1 = of_clk_get(np, 0);
- if (IS_ERR(clk1))
- clk1 = NULL;
---
-2.35.1
-
+++ /dev/null
-From 31c5432026e9c7ab74543b11a81938c82a51a0ec Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 9 Apr 2022 14:49:53 +0800
-Subject: drivers: staging: rtl8192bs: Fix deadlock in
- rtw_joinbss_event_prehandle()
-
-From: Duoming Zhou <duoming@zju.edu.cn>
-
-[ Upstream commit 041879b12ddb0c6c83ed9c0bdd10dc82a056f2fc ]
-
-There is a deadlock in rtw_joinbss_event_prehandle(), which is shown
-below:
-
- (Thread 1) | (Thread 2)
- | _set_timer()
-rtw_joinbss_event_prehandle()| mod_timer()
- spin_lock_bh() //(1) | (wait a time)
- ... | _rtw_join_timeout_handler()
- del_timer_sync() | spin_lock_bh() //(2)
- (wait timer to stop) | ...
-
-We hold pmlmepriv->lock in position (1) of thread 1 and
-use del_timer_sync() to wait timer to stop, but timer handler
-also need pmlmepriv->lock in position (2) of thread 2.
-As a result, rtw_joinbss_event_prehandle() will block forever.
-
-This patch extracts del_timer_sync() from the protection of
-spin_lock_bh(), which could let timer handler to obtain
-the needed lock. What`s more, we change spin_lock_bh() to
-spin_lock_irq() in _rtw_join_timeout_handler() in order to
-prevent deadlock.
-
-Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
-Link: https://lore.kernel.org/r/20220409064953.67420-1-duoming@zju.edu.cn
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/staging/rtl8723bs/core/rtw_mlme.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/staging/rtl8723bs/core/rtw_mlme.c b/drivers/staging/rtl8723bs/core/rtw_mlme.c
-index 62f140985e3f..24d6af886f72 100644
---- a/drivers/staging/rtl8723bs/core/rtw_mlme.c
-+++ b/drivers/staging/rtl8723bs/core/rtw_mlme.c
-@@ -1240,8 +1240,10 @@ void rtw_joinbss_event_prehandle(struct adapter *adapter, u8 *pbuf)
-
- spin_unlock_bh(&pmlmepriv->scanned_queue.lock);
-
-+ spin_unlock_bh(&pmlmepriv->lock);
- /* s5. Cancel assoc_timer */
- del_timer_sync(&pmlmepriv->assoc_timer);
-+ spin_lock_bh(&pmlmepriv->lock);
- } else {
- spin_unlock_bh(&(pmlmepriv->scanned_queue.lock));
- }
-@@ -1547,7 +1549,7 @@ void _rtw_join_timeout_handler(struct timer_list *t)
- if (adapter->bDriverStopped || adapter->bSurpriseRemoved)
- return;
-
-- spin_lock_bh(&pmlmepriv->lock);
-+ spin_lock_irq(&pmlmepriv->lock);
-
- if (rtw_to_roam(adapter) > 0) { /* join timeout caused by roaming */
- while (1) {
-@@ -1575,7 +1577,7 @@ void _rtw_join_timeout_handler(struct timer_list *t)
-
- }
-
-- spin_unlock_bh(&pmlmepriv->lock);
-+ spin_unlock_irq(&pmlmepriv->lock);
- }
-
- /*
---
-2.35.1
-
+++ /dev/null
-From 6adcfe2f4ddf7d8601e95c081d61c36fcb0f82b3 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 17 Apr 2022 22:16:41 +0800
-Subject: drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop()
-
-From: Duoming Zhou <duoming@zju.edu.cn>
-
-[ Upstream commit 9b6bdbd9337de3917945847bde262a34a87a6303 ]
-
-There is a deadlock in rtllib_beacons_stop(), which is shown
-below:
-
- (Thread 1) | (Thread 2)
- | rtllib_send_beacon()
-rtllib_beacons_stop() | mod_timer()
- spin_lock_irqsave() //(1) | (wait a time)
- ... | rtllib_send_beacon_cb()
- del_timer_sync() | spin_lock_irqsave() //(2)
- (wait timer to stop) | ...
-
-We hold ieee->beacon_lock in position (1) of thread 1 and
-use del_timer_sync() to wait timer to stop, but timer handler
-also need ieee->beacon_lock in position (2) of thread 2.
-As a result, rtllib_beacons_stop() will block forever.
-
-This patch extracts del_timer_sync() from the protection of
-spin_lock_irqsave(), which could let timer handler to obtain
-the needed lock.
-
-Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
-Link: https://lore.kernel.org/r/20220417141641.124388-1-duoming@zju.edu.cn
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/staging/rtl8192e/rtllib_softmac.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/staging/rtl8192e/rtllib_softmac.c b/drivers/staging/rtl8192e/rtllib_softmac.c
-index 4b6c2295a3cf..b5a38f0a8d79 100644
---- a/drivers/staging/rtl8192e/rtllib_softmac.c
-+++ b/drivers/staging/rtl8192e/rtllib_softmac.c
-@@ -651,9 +651,9 @@ static void rtllib_beacons_stop(struct rtllib_device *ieee)
- spin_lock_irqsave(&ieee->beacon_lock, flags);
-
- ieee->beacon_txing = 0;
-- del_timer_sync(&ieee->beacon_timer);
-
- spin_unlock_irqrestore(&ieee->beacon_lock, flags);
-+ del_timer_sync(&ieee->beacon_timer);
-
- }
-
---
-2.35.1
-
+++ /dev/null
-From a22d2c687afc24debe29d07fd597d6e392af424c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 9 Apr 2022 15:21:35 +0800
-Subject: drivers: staging: rtl8192eu: Fix deadlock in
- rtw_joinbss_event_prehandle
-
-From: Duoming Zhou <duoming@zju.edu.cn>
-
-[ Upstream commit 0fcddf9c7c10202946d5b19409efbdff744fba88 ]
-
-There is a deadlock in rtw_joinbss_event_prehandle(), which is shown below:
-
- (Thread 1) | (Thread 2)
- | _set_timer()
-rtw_joinbss_event_prehandle()| mod_timer()
- spin_lock_bh() //(1) | (wait a time)
- ... | rtw_join_timeout_handler()
- | _rtw_join_timeout_handler()
- del_timer_sync() | spin_lock_bh() //(2)
- (wait timer to stop) | ...
-
-We hold pmlmepriv->lock in position (1) of thread 1 and
-use del_timer_sync() to wait timer to stop, but timer handler
-also need pmlmepriv->lock in position (2) of thread 2.
-As a result, rtw_joinbss_event_prehandle() will block forever.
-
-This patch extracts del_timer_sync() from the protection of
-spin_lock_bh(), which could let timer handler to obtain
-the needed lock. What`s more, we change spin_lock_bh() to
-spin_lock_irq() in _rtw_join_timeout_handler() in order to
-prevent deadlock.
-
-Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
-Link: https://lore.kernel.org/r/20220409072135.74248-1-duoming@zju.edu.cn
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/staging/r8188eu/core/rtw_mlme.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/staging/r8188eu/core/rtw_mlme.c b/drivers/staging/r8188eu/core/rtw_mlme.c
-index 6f0bff186477..76cf6a69bf0f 100644
---- a/drivers/staging/r8188eu/core/rtw_mlme.c
-+++ b/drivers/staging/r8188eu/core/rtw_mlme.c
-@@ -1071,8 +1071,10 @@ void rtw_joinbss_event_prehandle(struct adapter *adapter, u8 *pbuf)
- rtw_indicate_connect(adapter);
- }
-
-+ spin_unlock_bh(&pmlmepriv->lock);
- /* s5. Cancel assoc_timer */
- del_timer_sync(&pmlmepriv->assoc_timer);
-+ spin_lock_bh(&pmlmepriv->lock);
- } else {
- spin_unlock_bh(&pmlmepriv->scanned_queue.lock);
- goto ignore_joinbss_callback;
-@@ -1310,7 +1312,7 @@ void _rtw_join_timeout_handler (struct adapter *adapter)
- if (adapter->bDriverStopped || adapter->bSurpriseRemoved)
- return;
-
-- spin_lock_bh(&pmlmepriv->lock);
-+ spin_lock_irq(&pmlmepriv->lock);
-
- if (rtw_to_roaming(adapter) > 0) { /* join timeout caused by roaming */
- while (1) {
-@@ -1329,7 +1331,7 @@ void _rtw_join_timeout_handler (struct adapter *adapter)
- rtw_indicate_disconnect(adapter);
- free_scanqueue(pmlmepriv);/* */
- }
-- spin_unlock_bh(&pmlmepriv->lock);
-+ spin_unlock_irq(&pmlmepriv->lock);
-
- }
-
---
-2.35.1
-
+++ /dev/null
-From 544fed6b9d7cfb60f34a880fc9f2723b81a04a7c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 17 Apr 2022 21:54:07 +0800
-Subject: drivers: staging: rtl8192u: Fix deadlock in ieee80211_beacons_stop()
-
-From: Duoming Zhou <duoming@zju.edu.cn>
-
-[ Upstream commit 806c7b53414934ba2a39449b31fd1a038e500273 ]
-
-There is a deadlock in ieee80211_beacons_stop(), which is shown below:
-
- (Thread 1) | (Thread 2)
- | ieee80211_send_beacon()
-ieee80211_beacons_stop() | mod_timer()
- spin_lock_irqsave() //(1) | (wait a time)
- ... | ieee80211_send_beacon_cb()
- del_timer_sync() | spin_lock_irqsave() //(2)
- (wait timer to stop) | ...
-
-We hold ieee->beacon_lock in position (1) of thread 1 and use
-del_timer_sync() to wait timer to stop, but timer handler
-also need ieee->beacon_lock in position (2) of thread 2.
-As a result, ieee80211_beacons_stop() will block forever.
-
-This patch extracts del_timer_sync() from the protection of
-spin_lock_irqsave(), which could let timer handler to obtain
-the needed lock.
-
-Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
-Link: https://lore.kernel.org/r/20220417135407.109536-1-duoming@zju.edu.cn
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c b/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c
-index 1a43979939a8..79f3fbe25556 100644
---- a/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c
-+++ b/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c
-@@ -528,9 +528,9 @@ static void ieee80211_beacons_stop(struct ieee80211_device *ieee)
- spin_lock_irqsave(&ieee->beacon_lock, flags);
-
- ieee->beacon_txing = 0;
-- del_timer_sync(&ieee->beacon_timer);
-
- spin_unlock_irqrestore(&ieee->beacon_lock, flags);
-+ del_timer_sync(&ieee->beacon_timer);
- }
-
- void ieee80211_stop_send_beacons(struct ieee80211_device *ieee)
---
-2.35.1
-
+++ /dev/null
-From cb20856735638e051f53037027e131dac26976d7 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 9 Apr 2022 14:18:35 +0800
-Subject: drivers: staging: rtl8723bs: Fix deadlock in
- rtw_surveydone_event_callback()
-
-From: Duoming Zhou <duoming@zju.edu.cn>
-
-[ Upstream commit cc7ad0d77b51c872d629bcd98aea463a3c4109e7 ]
-
-There is a deadlock in rtw_surveydone_event_callback(),
-which is shown below:
-
- (Thread 1) | (Thread 2)
- | _set_timer()
-rtw_surveydone_event_callback()| mod_timer()
- spin_lock_bh() //(1) | (wait a time)
- ... | rtw_scan_timeout_handler()
- del_timer_sync() | spin_lock_bh() //(2)
- (wait timer to stop) | ...
-
-We hold pmlmepriv->lock in position (1) of thread 1 and use
-del_timer_sync() to wait timer to stop, but timer handler
-also need pmlmepriv->lock in position (2) of thread 2.
-As a result, rtw_surveydone_event_callback() will block forever.
-
-This patch extracts del_timer_sync() from the protection of
-spin_lock_bh(), which could let timer handler to obtain
-the needed lock. What`s more, we change spin_lock_bh() in
-rtw_scan_timeout_handler() to spin_lock_irq(). Otherwise,
-spin_lock_bh() will also cause deadlock() in timer handler.
-
-Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
-Link: https://lore.kernel.org/r/20220409061836.60529-1-duoming@zju.edu.cn
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/staging/rtl8723bs/core/rtw_mlme.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/staging/rtl8723bs/core/rtw_mlme.c b/drivers/staging/rtl8723bs/core/rtw_mlme.c
-index ed2d3b7d44d9..62f140985e3f 100644
---- a/drivers/staging/rtl8723bs/core/rtw_mlme.c
-+++ b/drivers/staging/rtl8723bs/core/rtw_mlme.c
-@@ -751,7 +751,9 @@ void rtw_surveydone_event_callback(struct adapter *adapter, u8 *pbuf)
- }
-
- if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY)) {
-+ spin_unlock_bh(&pmlmepriv->lock);
- del_timer_sync(&pmlmepriv->scan_to_timer);
-+ spin_lock_bh(&pmlmepriv->lock);
- _clr_fwstate_(pmlmepriv, _FW_UNDER_SURVEY);
- }
-
-@@ -1586,11 +1588,11 @@ void rtw_scan_timeout_handler(struct timer_list *t)
- mlmepriv.scan_to_timer);
- struct mlme_priv *pmlmepriv = &adapter->mlmepriv;
-
-- spin_lock_bh(&pmlmepriv->lock);
-+ spin_lock_irq(&pmlmepriv->lock);
-
- _clr_fwstate_(pmlmepriv, _FW_UNDER_SURVEY);
-
-- spin_unlock_bh(&pmlmepriv->lock);
-+ spin_unlock_irq(&pmlmepriv->lock);
-
- rtw_indicate_scan_done(adapter, true);
- }
---
-2.35.1
-
+++ /dev/null
-From ec3834eb7abb671d654d26cbb732ab744548b77b Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 17 Apr 2022 19:16:26 +0800
-Subject: drivers: tty: serial: Fix deadlock in sa1100_set_termios()
-
-From: Duoming Zhou <duoming@zju.edu.cn>
-
-[ Upstream commit 62b2caef400c1738b6d22f636c628d9f85cd4c4c ]
-
-There is a deadlock in sa1100_set_termios(), which is shown
-below:
-
- (Thread 1) | (Thread 2)
- | sa1100_enable_ms()
-sa1100_set_termios() | mod_timer()
- spin_lock_irqsave() //(1) | (wait a time)
- ... | sa1100_timeout()
- del_timer_sync() | spin_lock_irqsave() //(2)
- (wait timer to stop) | ...
-
-We hold sport->port.lock in position (1) of thread 1 and
-use del_timer_sync() to wait timer to stop, but timer handler
-also need sport->port.lock in position (2) of thread 2. As a result,
-sa1100_set_termios() will block forever.
-
-This patch moves del_timer_sync() before spin_lock_irqsave()
-in order to prevent the deadlock.
-
-Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
-Link: https://lore.kernel.org/r/20220417111626.7802-1-duoming@zju.edu.cn
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/tty/serial/sa1100.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/tty/serial/sa1100.c b/drivers/tty/serial/sa1100.c
-index 5fe6cccfc1ae..e64e42a19d1a 100644
---- a/drivers/tty/serial/sa1100.c
-+++ b/drivers/tty/serial/sa1100.c
-@@ -446,6 +446,8 @@ sa1100_set_termios(struct uart_port *port, struct ktermios *termios,
- baud = uart_get_baud_rate(port, termios, old, 0, port->uartclk/16);
- quot = uart_get_divisor(port, baud);
-
-+ del_timer_sync(&sport->timer);
-+
- spin_lock_irqsave(&sport->port.lock, flags);
-
- sport->port.read_status_mask &= UTSR0_TO_SM(UTSR0_TFS);
-@@ -476,8 +478,6 @@ sa1100_set_termios(struct uart_port *port, struct ktermios *termios,
- UTSR1_TO_SM(UTSR1_ROR);
- }
-
-- del_timer_sync(&sport->timer);
--
- /*
- * Update the per-port timeout.
- */
---
-2.35.1
-
+++ /dev/null
-From 6ad47b24a67d8e8548a00c3ca97a00312eb22499 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 17 Apr 2022 20:03:05 +0800
-Subject: drivers: usb: host: Fix deadlock in oxu_bus_suspend()
-
-From: Duoming Zhou <duoming@zju.edu.cn>
-
-[ Upstream commit 4d378f2ae58138d4c55684e1d274e7dd94aa6524 ]
-
-There is a deadlock in oxu_bus_suspend(), which is shown below:
-
- (Thread 1) | (Thread 2)
- | timer_action()
-oxu_bus_suspend() | mod_timer()
- spin_lock_irq() //(1) | (wait a time)
- ... | oxu_watchdog()
- del_timer_sync() | spin_lock_irq() //(2)
- (wait timer to stop) | ...
-
-We hold oxu->lock in position (1) of thread 1, and use
-del_timer_sync() to wait timer to stop, but timer handler
-also need oxu->lock in position (2) of thread 2. As a result,
-oxu_bus_suspend() will block forever.
-
-This patch extracts del_timer_sync() from the protection of
-spin_lock_irq(), which could let timer handler to obtain
-the needed lock.
-
-Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
-Link: https://lore.kernel.org/r/20220417120305.64577-1-duoming@zju.edu.cn
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/host/oxu210hp-hcd.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/drivers/usb/host/oxu210hp-hcd.c b/drivers/usb/host/oxu210hp-hcd.c
-index b741670525e3..ee403df33093 100644
---- a/drivers/usb/host/oxu210hp-hcd.c
-+++ b/drivers/usb/host/oxu210hp-hcd.c
-@@ -3909,8 +3909,10 @@ static int oxu_bus_suspend(struct usb_hcd *hcd)
- }
- }
-
-+ spin_unlock_irq(&oxu->lock);
- /* turn off now-idle HC */
- del_timer_sync(&oxu->watchdog);
-+ spin_lock_irq(&oxu->lock);
- ehci_halt(oxu);
- hcd->state = HC_STATE_SUSPENDED;
-
---
-2.35.1
-
+++ /dev/null
-From f75b21d7890b7a5cb2e2e4e911f17d23fee16a94 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 3 May 2022 18:30:25 -0400
-Subject: drm/amd/display: Check if modulo is 0 before dividing.
-
-From: David Galiffi <David.Galiffi@amd.com>
-
-[ Upstream commit 49947b906a6bd9668eaf4f9cf691973c25c26955 ]
-
-[How & Why]
-If a value of 0 is read, then this will cause a divide-by-0 panic.
-
-Reviewed-by: Martin Leung <Martin.Leung@amd.com>
-Acked-by: Qingqing Zhuo <qingqing.zhuo@amd.com>
-Signed-off-by: David Galiffi <David.Galiffi@amd.com>
-Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
-Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c | 9 ++++++---
- 1 file changed, 6 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c b/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c
-index cc5128e67daf..8e9a7409c17a 100644
---- a/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c
-+++ b/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c
-@@ -1105,9 +1105,12 @@ static bool get_pixel_clk_frequency_100hz(
- * not be programmed equal to DPREFCLK
- */
- modulo_hz = REG_READ(MODULO[inst]);
-- *pixel_clk_khz = div_u64((uint64_t)clock_hz*
-- clock_source->ctx->dc->clk_mgr->dprefclk_khz*10,
-- modulo_hz);
-+ if (modulo_hz)
-+ *pixel_clk_khz = div_u64((uint64_t)clock_hz*
-+ clock_source->ctx->dc->clk_mgr->dprefclk_khz*10,
-+ modulo_hz);
-+ else
-+ *pixel_clk_khz = 0;
- } else {
- /* NOTE: There is agreement with VBIOS here that MODULO is
- * programmed equal to DPREFCLK, in which case PHASE will be
---
-2.35.1
-
+++ /dev/null
-From 3979afeed945c7e58acbc32f54313fbbd7fd21dd Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 5 May 2022 16:50:42 -0400
-Subject: drm/amd/display: Check zero planes for OTG disable W/A on clock
- change
-
-From: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
-
-[ Upstream commit 66a197203794339b028eedfa880bff9367fce783 ]
-
-[Why]
-A display clock change hang can occur when switching between DIO and HPO
-enabled modes during the optimize_bandwidth in dc_commit_state_no_check
-call.
-
-This happens when going from 4k120 8bpc 420 to 4k144 10bpc 444.
-
-Display clock in the DIO case is 1200MHz, but pixel rate is 600MHz
-because the pixel format is 420.
-
-Display clock in the HPO case is less (800MHz?) because of ODM combine
-which results in a smaller divider.
-
-The DIO is still active in prepare but not active in the optimize which
-results in the hang occuring.
-
-During this change there are no planes on the stream so it's safe to
-apply the workaround, but dpms_off = false and signal type is not
-virtual.
-
-[How]
-Check for plane_count == 0, no planes on the stream.
-
-It's easiest to check pipe->plane_state == NULL as an equivalent check
-rather than trying to search for the stream status in the context
-associated with the stream, so let's do that.
-
-The primary, non MPO pipe should not have a NULL plane state.
-
-Reviewed-by: Dmytro Laktyushkin <Dmytro.Laktyushkin@amd.com>
-Acked-by: Qingqing Zhuo <qingqing.zhuo@amd.com>
-Signed-off-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
-Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
-Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c | 3 ++-
- drivers/gpu/drm/amd/display/dc/clk_mgr/dcn316/dcn316_clk_mgr.c | 3 ++-
- 2 files changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c
-index 8be4c1970628..3bf2ab2ff7f8 100644
---- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c
-+++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c
-@@ -91,7 +91,8 @@ static void dcn315_disable_otg_wa(struct clk_mgr *clk_mgr_base, bool disable)
-
- if (pipe->top_pipe || pipe->prev_odm_pipe)
- continue;
-- if (pipe->stream && (pipe->stream->dpms_off || dc_is_virtual_signal(pipe->stream->signal))) {
-+ if (pipe->stream && (pipe->stream->dpms_off || pipe->plane_state == NULL ||
-+ dc_is_virtual_signal(pipe->stream->signal))) {
- if (disable)
- pipe->stream_res.tg->funcs->immediate_disable_crtc(pipe->stream_res.tg);
- else
-diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn316/dcn316_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn316/dcn316_clk_mgr.c
-index 3121dd2d2a91..fc3af81ed6c6 100644
---- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn316/dcn316_clk_mgr.c
-+++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn316/dcn316_clk_mgr.c
-@@ -122,7 +122,8 @@ static void dcn316_disable_otg_wa(struct clk_mgr *clk_mgr_base, bool disable)
-
- if (pipe->top_pipe || pipe->prev_odm_pipe)
- continue;
-- if (pipe->stream && (pipe->stream->dpms_off || dc_is_virtual_signal(pipe->stream->signal))) {
-+ if (pipe->stream && (pipe->stream->dpms_off || pipe->plane_state == NULL ||
-+ dc_is_virtual_signal(pipe->stream->signal))) {
- if (disable)
- pipe->stream_res.tg->funcs->immediate_disable_crtc(pipe->stream_res.tg);
- else
---
-2.35.1
-
+++ /dev/null
-From fae326ea43e0f415e90fcbd9e8c9b4f0d8bf5cfa Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 6 Apr 2022 14:14:50 +0800
-Subject: drm/amd/pm: correct the metrics version for SMU 11.0.11/12/13
-
-From: Evan Quan <evan.quan@amd.com>
-
-[ Upstream commit 396beb91a9eb86cbfa404e4220cca8f3ada70777 ]
-
-Correct the metrics version used for SMU 11.0.11/12/13.
-Fixes misreported GPU metrics (e.g., fan speed, etc.) depending
-on which version of SMU firmware is loaded.
-
-Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1925
-Signed-off-by: Evan Quan <evan.quan@amd.com>
-Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- .../amd/pm/swsmu/smu11/sienna_cichlid_ppt.c | 57 ++++++++++++++-----
- 1 file changed, 44 insertions(+), 13 deletions(-)
-
-diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
-index 38f04836c82f..7a1e225fb823 100644
---- a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
-+++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
-@@ -586,12 +586,28 @@ static int sienna_cichlid_get_smu_metrics_data(struct smu_context *smu,
- uint16_t average_gfx_activity;
- int ret = 0;
-
-- if ((smu->adev->ip_versions[MP1_HWIP][0] == IP_VERSION(11, 0, 7)) &&
-- (smu->smc_fw_version >= 0x3A4900))
-- use_metrics_v3 = true;
-- else if ((smu->adev->ip_versions[MP1_HWIP][0] == IP_VERSION(11, 0, 7)) &&
-- (smu->smc_fw_version >= 0x3A4300))
-- use_metrics_v2 = true;
-+ switch (smu->adev->ip_versions[MP1_HWIP][0]) {
-+ case IP_VERSION(11, 0, 7):
-+ if (smu->smc_fw_version >= 0x3A4900)
-+ use_metrics_v3 = true;
-+ else if (smu->smc_fw_version >= 0x3A4300)
-+ use_metrics_v2 = true;
-+ break;
-+ case IP_VERSION(11, 0, 11):
-+ if (smu->smc_fw_version >= 0x412D00)
-+ use_metrics_v2 = true;
-+ break;
-+ case IP_VERSION(11, 0, 12):
-+ if (smu->smc_fw_version >= 0x3B2300)
-+ use_metrics_v2 = true;
-+ break;
-+ case IP_VERSION(11, 0, 13):
-+ if (smu->smc_fw_version >= 0x491100)
-+ use_metrics_v2 = true;
-+ break;
-+ default:
-+ break;
-+ }
-
- ret = smu_cmn_get_metrics_table(smu,
- NULL,
-@@ -3701,13 +3717,28 @@ static ssize_t sienna_cichlid_get_gpu_metrics(struct smu_context *smu,
- uint16_t average_gfx_activity;
- int ret = 0;
-
-- if ((adev->ip_versions[MP1_HWIP][0] == IP_VERSION(11, 0, 7)) &&
-- (smu->smc_fw_version >= 0x3A4900))
-- use_metrics_v3 = true;
-- else if ((adev->ip_versions[MP1_HWIP][0] == IP_VERSION(11, 0, 7)) &&
-- (smu->smc_fw_version >= 0x3A4300))
-- use_metrics_v2 = true;
--
-+ switch (smu->adev->ip_versions[MP1_HWIP][0]) {
-+ case IP_VERSION(11, 0, 7):
-+ if (smu->smc_fw_version >= 0x3A4900)
-+ use_metrics_v3 = true;
-+ else if (smu->smc_fw_version >= 0x3A4300)
-+ use_metrics_v2 = true;
-+ break;
-+ case IP_VERSION(11, 0, 11):
-+ if (smu->smc_fw_version >= 0x412D00)
-+ use_metrics_v2 = true;
-+ break;
-+ case IP_VERSION(11, 0, 12):
-+ if (smu->smc_fw_version >= 0x3B2300)
-+ use_metrics_v2 = true;
-+ break;
-+ case IP_VERSION(11, 0, 13):
-+ if (smu->smc_fw_version >= 0x491100)
-+ use_metrics_v2 = true;
-+ break;
-+ default:
-+ break;
-+ }
-
- ret = smu_cmn_get_metrics_table(smu,
- &metrics_external,
---
-2.35.1
-
+++ /dev/null
-From 8cc9ea2df9b163cedb5c3623fb8ec7bdf6aa4be6 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 17 May 2022 17:57:46 +0800
-Subject: drm/amd/pm: fix a potential gpu_metrics_table memory leak
-
-From: Gong Yuanjun <ruc_gongyuanjun@163.com>
-
-[ Upstream commit d2f4460a3d9502513419f06cc376c7ade49d5753 ]
-
-gpu_metrics_table is allocated in yellow_carp_init_smc_tables() but
-not freed in yellow_carp_fini_smc_tables().
-
-Signed-off-by: Gong Yuanjun <ruc_gongyuanjun@163.com>
-Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/amd/pm/swsmu/smu13/yellow_carp_ppt.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/yellow_carp_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/yellow_carp_ppt.c
-index 87257b1b028f..feff4f8c927c 100644
---- a/drivers/gpu/drm/amd/pm/swsmu/smu13/yellow_carp_ppt.c
-+++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/yellow_carp_ppt.c
-@@ -190,6 +190,9 @@ static int yellow_carp_fini_smc_tables(struct smu_context *smu)
- kfree(smu_table->watermarks_table);
- smu_table->watermarks_table = NULL;
-
-+ kfree(smu_table->gpu_metrics_table);
-+ smu_table->gpu_metrics_table = NULL;
-+
- return 0;
- }
-
---
-2.35.1
-
+++ /dev/null
-From 623981b66d4ee221379d7c87b49b71cef6037d97 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 19 May 2022 10:50:25 +0530
-Subject: drm/amd/pm: Fix missing thermal throttler status
-
-From: Lijo Lazar <lijo.lazar@amd.com>
-
-[ Upstream commit b0f4d663fce6a4232d3c20ce820f919111b1c60b ]
-
-On aldebaran, when thermal throttling happens due to excessive GPU
-temperature, the reason for throttling event is missed in warning
-message. This patch fixes it.
-
-Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
-Reviewed-by: Yang Wang <kevinyang.wang@amd.com>
-Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c
-index cd81f848d45a..7f998f24af81 100644
---- a/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c
-+++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c
-@@ -1664,6 +1664,7 @@ static const struct throttling_logging_label {
- uint32_t feature_mask;
- const char *label;
- } logging_label[] = {
-+ {(1U << THROTTLER_TEMP_GPU_BIT), "GPU"},
- {(1U << THROTTLER_TEMP_MEM_BIT), "HBM"},
- {(1U << THROTTLER_TEMP_VR_GFX_BIT), "VR of GFX rail"},
- {(1U << THROTTLER_TEMP_VR_MEM_BIT), "VR of HBM rail"},
---
-2.35.1
-
+++ /dev/null
-From cd73a2c7abe5b84f5e90e930b6bf429598e23470 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 28 Apr 2022 13:51:16 -0700
-Subject: drm/amd/pm: use bitmap_{from,to}_arr32 where appropriate
-
-From: Yury Norov <yury.norov@gmail.com>
-
-[ Upstream commit 525d6515604eb1373ce5e6372a6b6640953b2d6a ]
-
-The smu_v1X_0_set_allowed_mask() uses bitmap_copy() to convert
-bitmap to 32-bit array. This may be wrong due to endiannes issues.
-Fix it by switching to bitmap_{from,to}_arr32.
-
-CC: Alexander Gordeev <agordeev@linux.ibm.com>
-CC: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
-CC: Christian Borntraeger <borntraeger@linux.ibm.com>
-CC: Claudio Imbrenda <imbrenda@linux.ibm.com>
-CC: David Hildenbrand <david@redhat.com>
-CC: Heiko Carstens <hca@linux.ibm.com>
-CC: Janosch Frank <frankja@linux.ibm.com>
-CC: Rasmus Villemoes <linux@rasmusvillemoes.dk>
-CC: Sven Schnelle <svens@linux.ibm.com>
-CC: Vasily Gorbik <gor@linux.ibm.com>
-Signed-off-by: Yury Norov <yury.norov@gmail.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c | 2 +-
- drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c
-index b87f550af26b..5f8809f6990d 100644
---- a/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c
-+++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c
-@@ -781,7 +781,7 @@ int smu_v11_0_set_allowed_mask(struct smu_context *smu)
- goto failed;
- }
-
-- bitmap_copy((unsigned long *)feature_mask, feature->allowed, 64);
-+ bitmap_to_arr32(feature_mask, feature->allowed, 64);
-
- ret = smu_cmn_send_smc_msg_with_param(smu, SMU_MSG_SetAllowedFeaturesMaskHigh,
- feature_mask[1], NULL);
-diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
-index cf09e30bdfe0..747430ce6394 100644
---- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
-+++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
-@@ -730,7 +730,7 @@ int smu_v13_0_set_allowed_mask(struct smu_context *smu)
- feature->feature_num < 64)
- return -EINVAL;
-
-- bitmap_copy((unsigned long *)feature_mask, feature->allowed, 64);
-+ bitmap_to_arr32(feature_mask, feature->allowed, 64);
-
- ret = smu_cmn_send_smc_msg_with_param(smu, SMU_MSG_SetAllowedFeaturesMaskHigh,
- feature_mask[1], NULL);
---
-2.35.1
-
+++ /dev/null
-From ce283962630be95ccc8e28968ffbfe89873c4f94 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 17 May 2022 17:57:00 +0800
-Subject: drm/radeon: fix a possible null pointer dereference
-
-From: Gong Yuanjun <ruc_gongyuanjun@163.com>
-
-[ Upstream commit a2b28708b645c5632dc93669ab06e97874c8244f ]
-
-In radeon_fp_native_mode(), the return value of drm_mode_duplicate()
-is assigned to mode, which will lead to a NULL pointer dereference
-on failure of drm_mode_duplicate(). Add a check to avoid npd.
-
-The failure status of drm_cvt_mode() on the other path is checked too.
-
-Signed-off-by: Gong Yuanjun <ruc_gongyuanjun@163.com>
-Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/radeon/radeon_connectors.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
-index 0cb1345c6ba4..fabe4f4ca124 100644
---- a/drivers/gpu/drm/radeon/radeon_connectors.c
-+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
-@@ -473,6 +473,8 @@ static struct drm_display_mode *radeon_fp_native_mode(struct drm_encoder *encode
- native_mode->vdisplay != 0 &&
- native_mode->clock != 0) {
- mode = drm_mode_duplicate(dev, native_mode);
-+ if (!mode)
-+ return NULL;
- mode->type = DRM_MODE_TYPE_PREFERRED | DRM_MODE_TYPE_DRIVER;
- drm_mode_set_name(mode);
-
-@@ -487,6 +489,8 @@ static struct drm_display_mode *radeon_fp_native_mode(struct drm_encoder *encode
- * simpler.
- */
- mode = drm_cvt_mode(dev, native_mode->hdisplay, native_mode->vdisplay, 60, true, false, false);
-+ if (!mode)
-+ return NULL;
- mode->type = DRM_MODE_TYPE_PREFERRED | DRM_MODE_TYPE_DRIVER;
- DRM_DEBUG_KMS("Adding cvt approximation of native panel mode %s\n", mode->name);
- }
---
-2.35.1
-
+++ /dev/null
-From c18123f10f37ff858069156c701bb7f1996d4c94 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 17 Dec 2021 09:28:46 +0300
-Subject: extcon: Fix extcon_get_extcon_dev() error handling
-
-From: Dan Carpenter <dan.carpenter@oracle.com>
-
-[ Upstream commit 58e4a2d27d3255e4e8c507fdc13734dccc9fc4c7 ]
-
-The extcon_get_extcon_dev() function returns error pointers on error,
-NULL when it's a -EPROBE_DEFER defer situation, and ERR_PTR(-ENODEV)
-when the CONFIG_EXTCON option is disabled. This is very complicated for
-the callers to handle and a number of them had bugs that would lead to
-an Oops.
-
-In real life, there are two things which prevented crashes. First,
-error pointers would only be returned if there was bug in the caller
-where they passed a NULL "extcon_name" and none of them do that.
-Second, only two out of the eight drivers will build when CONFIG_EXTCON
-is disabled.
-
-The normal way to write this would be to return -EPROBE_DEFER directly
-when appropriate and return NULL when CONFIG_EXTCON is disabled. Then
-the error handling is simple and just looks like:
-
- dev->edev = extcon_get_extcon_dev(acpi_dev_name(adev));
- if (IS_ERR(dev->edev))
- return PTR_ERR(dev->edev);
-
-For the two drivers which can build with CONFIG_EXTCON disabled, then
-extcon_get_extcon_dev() will now return NULL which is not treated as an
-error and the probe will continue successfully. Those two drivers are
-"typec_fusb302" and "max8997-battery". In the original code, the
-typec_fusb302 driver had an 800ms hang in tcpm_get_current_limit() but
-now that function is a no-op. For the max8997-battery driver everything
-should continue working as is.
-
-Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
-Reviewed-by: Hans de Goede <hdegoede@redhat.com>
-Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
-Reviewed-by: Guenter Roeck <linux@roeck-us.net>
-Acked-by: Sebastian Reichel <sebastian.reichel@collabora.com>
-Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/extcon/extcon-axp288.c | 4 ++--
- drivers/extcon/extcon.c | 4 +++-
- drivers/power/supply/axp288_charger.c | 17 ++++++++++-------
- drivers/power/supply/charger-manager.c | 7 ++-----
- drivers/power/supply/max8997_charger.c | 8 ++++----
- drivers/usb/dwc3/drd.c | 9 ++-------
- drivers/usb/phy/phy-omap-otg.c | 4 ++--
- drivers/usb/typec/tcpm/fusb302.c | 4 ++--
- include/linux/extcon.h | 2 +-
- 9 files changed, 28 insertions(+), 31 deletions(-)
-
-diff --git a/drivers/extcon/extcon-axp288.c b/drivers/extcon/extcon-axp288.c
-index 7c6d5857ff25..180be768c215 100644
---- a/drivers/extcon/extcon-axp288.c
-+++ b/drivers/extcon/extcon-axp288.c
-@@ -394,8 +394,8 @@ static int axp288_extcon_probe(struct platform_device *pdev)
- if (adev) {
- info->id_extcon = extcon_get_extcon_dev(acpi_dev_name(adev));
- put_device(&adev->dev);
-- if (!info->id_extcon)
-- return -EPROBE_DEFER;
-+ if (IS_ERR(info->id_extcon))
-+ return PTR_ERR(info->id_extcon);
-
- dev_info(dev, "controlling USB role\n");
- } else {
-diff --git a/drivers/extcon/extcon.c b/drivers/extcon/extcon.c
-index a09e704fd0fa..adb957470c65 100644
---- a/drivers/extcon/extcon.c
-+++ b/drivers/extcon/extcon.c
-@@ -851,6 +851,8 @@ EXPORT_SYMBOL_GPL(extcon_set_property_capability);
- * @extcon_name: the extcon name provided with extcon_dev_register()
- *
- * Return the pointer of extcon device if success or ERR_PTR(err) if fail.
-+ * NOTE: This function returns -EPROBE_DEFER so it may only be called from
-+ * probe() functions.
- */
- struct extcon_dev *extcon_get_extcon_dev(const char *extcon_name)
- {
-@@ -864,7 +866,7 @@ struct extcon_dev *extcon_get_extcon_dev(const char *extcon_name)
- if (!strcmp(sd->name, extcon_name))
- goto out;
- }
-- sd = NULL;
-+ sd = ERR_PTR(-EPROBE_DEFER);
- out:
- mutex_unlock(&extcon_dev_list_lock);
- return sd;
-diff --git a/drivers/power/supply/axp288_charger.c b/drivers/power/supply/axp288_charger.c
-index 19746e658a6a..15219ed43ce9 100644
---- a/drivers/power/supply/axp288_charger.c
-+++ b/drivers/power/supply/axp288_charger.c
-@@ -865,17 +865,20 @@ static int axp288_charger_probe(struct platform_device *pdev)
- info->regmap_irqc = axp20x->regmap_irqc;
-
- info->cable.edev = extcon_get_extcon_dev(AXP288_EXTCON_DEV_NAME);
-- if (info->cable.edev == NULL) {
-- dev_dbg(dev, "%s is not ready, probe deferred\n",
-- AXP288_EXTCON_DEV_NAME);
-- return -EPROBE_DEFER;
-+ if (IS_ERR(info->cable.edev)) {
-+ dev_err_probe(dev, PTR_ERR(info->cable.edev),
-+ "extcon_get_extcon_dev(%s) failed\n",
-+ AXP288_EXTCON_DEV_NAME);
-+ return PTR_ERR(info->cable.edev);
- }
-
- if (acpi_dev_present(USB_HOST_EXTCON_HID, NULL, -1)) {
- info->otg.cable = extcon_get_extcon_dev(USB_HOST_EXTCON_NAME);
-- if (info->otg.cable == NULL) {
-- dev_dbg(dev, "EXTCON_USB_HOST is not ready, probe deferred\n");
-- return -EPROBE_DEFER;
-+ if (IS_ERR(info->otg.cable)) {
-+ dev_err_probe(dev, PTR_ERR(info->otg.cable),
-+ "extcon_get_extcon_dev(%s) failed\n",
-+ USB_HOST_EXTCON_NAME);
-+ return PTR_ERR(info->otg.cable);
- }
- dev_info(dev, "Using " USB_HOST_EXTCON_HID " extcon for usb-id\n");
- }
-diff --git a/drivers/power/supply/charger-manager.c b/drivers/power/supply/charger-manager.c
-index d67edb760c94..92db79400a6a 100644
---- a/drivers/power/supply/charger-manager.c
-+++ b/drivers/power/supply/charger-manager.c
-@@ -985,13 +985,10 @@ static int charger_extcon_init(struct charger_manager *cm,
- cable->nb.notifier_call = charger_extcon_notifier;
-
- cable->extcon_dev = extcon_get_extcon_dev(cable->extcon_name);
-- if (IS_ERR_OR_NULL(cable->extcon_dev)) {
-+ if (IS_ERR(cable->extcon_dev)) {
- pr_err("Cannot find extcon_dev for %s (cable: %s)\n",
- cable->extcon_name, cable->name);
-- if (cable->extcon_dev == NULL)
-- return -EPROBE_DEFER;
-- else
-- return PTR_ERR(cable->extcon_dev);
-+ return PTR_ERR(cable->extcon_dev);
- }
-
- for (i = 0; i < ARRAY_SIZE(extcon_mapping); i++) {
-diff --git a/drivers/power/supply/max8997_charger.c b/drivers/power/supply/max8997_charger.c
-index 127c73b0b3bd..1ec3535a257d 100644
---- a/drivers/power/supply/max8997_charger.c
-+++ b/drivers/power/supply/max8997_charger.c
-@@ -242,10 +242,10 @@ static int max8997_battery_probe(struct platform_device *pdev)
- dev_info(&pdev->dev, "couldn't get charger regulator\n");
- }
- charger->edev = extcon_get_extcon_dev("max8997-muic");
-- if (IS_ERR_OR_NULL(charger->edev)) {
-- if (!charger->edev)
-- return -EPROBE_DEFER;
-- dev_info(charger->dev, "couldn't get extcon device\n");
-+ if (IS_ERR(charger->edev)) {
-+ dev_err_probe(charger->dev, PTR_ERR(charger->edev),
-+ "couldn't get extcon device: max8997-muic\n");
-+ return PTR_ERR(charger->edev);
- }
-
- if (!IS_ERR(charger->reg) && !IS_ERR_OR_NULL(charger->edev)) {
-diff --git a/drivers/usb/dwc3/drd.c b/drivers/usb/dwc3/drd.c
-index 8cad9e7d3368..4982edd13047 100644
---- a/drivers/usb/dwc3/drd.c
-+++ b/drivers/usb/dwc3/drd.c
-@@ -455,13 +455,8 @@ static struct extcon_dev *dwc3_get_extcon(struct dwc3 *dwc)
- * This device property is for kernel internal use only and
- * is expected to be set by the glue code.
- */
-- if (device_property_read_string(dev, "linux,extcon-name", &name) == 0) {
-- edev = extcon_get_extcon_dev(name);
-- if (!edev)
-- return ERR_PTR(-EPROBE_DEFER);
--
-- return edev;
-- }
-+ if (device_property_read_string(dev, "linux,extcon-name", &name) == 0)
-+ return extcon_get_extcon_dev(name);
-
- /*
- * Try to get an extcon device from the USB PHY controller's "port"
-diff --git a/drivers/usb/phy/phy-omap-otg.c b/drivers/usb/phy/phy-omap-otg.c
-index ee0863c6553e..6e6ef8c0bc7e 100644
---- a/drivers/usb/phy/phy-omap-otg.c
-+++ b/drivers/usb/phy/phy-omap-otg.c
-@@ -95,8 +95,8 @@ static int omap_otg_probe(struct platform_device *pdev)
- return -ENODEV;
-
- extcon = extcon_get_extcon_dev(config->extcon);
-- if (!extcon)
-- return -EPROBE_DEFER;
-+ if (IS_ERR(extcon))
-+ return PTR_ERR(extcon);
-
- otg_dev = devm_kzalloc(&pdev->dev, sizeof(*otg_dev), GFP_KERNEL);
- if (!otg_dev)
-diff --git a/drivers/usb/typec/tcpm/fusb302.c b/drivers/usb/typec/tcpm/fusb302.c
-index 72f9001b0792..96c55eaf3f80 100644
---- a/drivers/usb/typec/tcpm/fusb302.c
-+++ b/drivers/usb/typec/tcpm/fusb302.c
-@@ -1708,8 +1708,8 @@ static int fusb302_probe(struct i2c_client *client,
- */
- if (device_property_read_string(dev, "linux,extcon-name", &name) == 0) {
- chip->extcon = extcon_get_extcon_dev(name);
-- if (!chip->extcon)
-- return -EPROBE_DEFER;
-+ if (IS_ERR(chip->extcon))
-+ return PTR_ERR(chip->extcon);
- }
-
- chip->vbus = devm_regulator_get(chip->dev, "vbus");
-diff --git a/include/linux/extcon.h b/include/linux/extcon.h
-index 0c19010da77f..685401d94d39 100644
---- a/include/linux/extcon.h
-+++ b/include/linux/extcon.h
-@@ -296,7 +296,7 @@ static inline void devm_extcon_unregister_notifier_all(struct device *dev,
-
- static inline struct extcon_dev *extcon_get_extcon_dev(const char *extcon_name)
- {
-- return ERR_PTR(-ENODEV);
-+ return NULL;
- }
-
- static inline struct extcon_dev *extcon_find_edev_by_node(struct device_node *node)
---
-2.35.1
-
+++ /dev/null
-From 842f21decbc0a1884b1e51a6723e6c7f3bf35b1e Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 27 Apr 2022 12:00:05 +0900
-Subject: extcon: Modify extcon device to be created after driver data is set
-
-From: bumwoo lee <bw365.lee@samsung.com>
-
-[ Upstream commit 5dcc2afe716d69f5112ce035cb14f007461ff189 ]
-
-Currently, someone can invoke the sysfs such as state_show()
-intermittently before dev_set_drvdata() is done.
-And it can be a cause of kernel Oops because of edev is Null at that time.
-So modified the driver registration to after setting drviver data.
-
-- Oops's backtrace.
-
-Backtrace:
-[<c067865c>] (state_show) from [<c05222e8>] (dev_attr_show)
-[<c05222c0>] (dev_attr_show) from [<c02c66e0>] (sysfs_kf_seq_show)
-[<c02c6648>] (sysfs_kf_seq_show) from [<c02c496c>] (kernfs_seq_show)
-[<c02c4938>] (kernfs_seq_show) from [<c025e2a0>] (seq_read)
-[<c025e11c>] (seq_read) from [<c02c50a0>] (kernfs_fop_read)
-[<c02c5064>] (kernfs_fop_read) from [<c0231cac>] (__vfs_read)
-[<c0231c5c>] (__vfs_read) from [<c0231ee0>] (vfs_read)
-[<c0231e34>] (vfs_read) from [<c0232464>] (ksys_read)
-[<c02323f0>] (ksys_read) from [<c02324fc>] (sys_read)
-[<c02324e4>] (sys_read) from [<c00091d0>] (__sys_trace_return)
-
-Signed-off-by: bumwoo lee <bw365.lee@samsung.com>
-Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/extcon/extcon.c | 29 +++++++++++++++++------------
- 1 file changed, 17 insertions(+), 12 deletions(-)
-
-diff --git a/drivers/extcon/extcon.c b/drivers/extcon/extcon.c
-index adb957470c65..97e35c32bfa5 100644
---- a/drivers/extcon/extcon.c
-+++ b/drivers/extcon/extcon.c
-@@ -1220,19 +1220,14 @@ int extcon_dev_register(struct extcon_dev *edev)
- edev->dev.type = &edev->extcon_dev_type;
- }
-
-- ret = device_register(&edev->dev);
-- if (ret) {
-- put_device(&edev->dev);
-- goto err_dev;
-- }
--
- spin_lock_init(&edev->lock);
-- edev->nh = devm_kcalloc(&edev->dev, edev->max_supported,
-- sizeof(*edev->nh), GFP_KERNEL);
-- if (!edev->nh) {
-- ret = -ENOMEM;
-- device_unregister(&edev->dev);
-- goto err_dev;
-+ if (edev->max_supported) {
-+ edev->nh = kcalloc(edev->max_supported, sizeof(*edev->nh),
-+ GFP_KERNEL);
-+ if (!edev->nh) {
-+ ret = -ENOMEM;
-+ goto err_alloc_nh;
-+ }
- }
-
- for (index = 0; index < edev->max_supported; index++)
-@@ -1243,6 +1238,12 @@ int extcon_dev_register(struct extcon_dev *edev)
- dev_set_drvdata(&edev->dev, edev);
- edev->state = 0;
-
-+ ret = device_register(&edev->dev);
-+ if (ret) {
-+ put_device(&edev->dev);
-+ goto err_dev;
-+ }
-+
- mutex_lock(&extcon_dev_list_lock);
- list_add(&edev->entry, &extcon_dev_list);
- mutex_unlock(&extcon_dev_list_lock);
-@@ -1250,6 +1251,9 @@ int extcon_dev_register(struct extcon_dev *edev)
- return 0;
-
- err_dev:
-+ if (edev->max_supported)
-+ kfree(edev->nh);
-+err_alloc_nh:
- if (edev->max_supported)
- kfree(edev->extcon_dev_type.groups);
- err_alloc_groups:
-@@ -1310,6 +1314,7 @@ void extcon_dev_unregister(struct extcon_dev *edev)
- if (edev->max_supported) {
- kfree(edev->extcon_dev_type.groups);
- kfree(edev->cables);
-+ kfree(edev->nh);
- }
-
- put_device(&edev->dev);
---
-2.35.1
-
+++ /dev/null
-From 61210097ba5adb00873a65028a7970545e7ca095 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 5 Mar 2022 11:14:05 +0800
-Subject: iio: dummy: iio_simple_dummy: check the return value of kstrdup()
-
-From: Xiaoke Wang <xkernel.wang@foxmail.com>
-
-[ Upstream commit ba93642188a6fed754bf7447f638bc410e05a929 ]
-
-kstrdup() is also a memory allocation-related function, it returns NULL
-when some memory errors happen. So it is better to check the return
-value of it so to catch the memory error in time. Besides, there should
-have a kfree() to clear up the allocation if we get a failure later in
-this function to prevent memory leak.
-
-Signed-off-by: Xiaoke Wang <xkernel.wang@foxmail.com>
-Link: https://lore.kernel.org/r/tencent_C920CFCC33B9CC1C63141FE1334A39FF8508@qq.com
-Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/iio/dummy/iio_simple_dummy.c | 20 ++++++++++++--------
- 1 file changed, 12 insertions(+), 8 deletions(-)
-
-diff --git a/drivers/iio/dummy/iio_simple_dummy.c b/drivers/iio/dummy/iio_simple_dummy.c
-index c0b7ef900735..c24f609c2ade 100644
---- a/drivers/iio/dummy/iio_simple_dummy.c
-+++ b/drivers/iio/dummy/iio_simple_dummy.c
-@@ -575,10 +575,9 @@ static struct iio_sw_device *iio_dummy_probe(const char *name)
- */
-
- swd = kzalloc(sizeof(*swd), GFP_KERNEL);
-- if (!swd) {
-- ret = -ENOMEM;
-- goto error_kzalloc;
-- }
-+ if (!swd)
-+ return ERR_PTR(-ENOMEM);
-+
- /*
- * Allocate an IIO device.
- *
-@@ -590,7 +589,7 @@ static struct iio_sw_device *iio_dummy_probe(const char *name)
- indio_dev = iio_device_alloc(parent, sizeof(*st));
- if (!indio_dev) {
- ret = -ENOMEM;
-- goto error_ret;
-+ goto error_free_swd;
- }
-
- st = iio_priv(indio_dev);
-@@ -616,6 +615,10 @@ static struct iio_sw_device *iio_dummy_probe(const char *name)
- * indio_dev->name = spi_get_device_id(spi)->name;
- */
- indio_dev->name = kstrdup(name, GFP_KERNEL);
-+ if (!indio_dev->name) {
-+ ret = -ENOMEM;
-+ goto error_free_device;
-+ }
-
- /* Provide description of available channels */
- indio_dev->channels = iio_dummy_channels;
-@@ -632,7 +635,7 @@ static struct iio_sw_device *iio_dummy_probe(const char *name)
-
- ret = iio_simple_dummy_events_register(indio_dev);
- if (ret < 0)
-- goto error_free_device;
-+ goto error_free_name;
-
- ret = iio_simple_dummy_configure_buffer(indio_dev);
- if (ret < 0)
-@@ -649,11 +652,12 @@ static struct iio_sw_device *iio_dummy_probe(const char *name)
- iio_simple_dummy_unconfigure_buffer(indio_dev);
- error_unregister_events:
- iio_simple_dummy_events_unregister(indio_dev);
-+error_free_name:
-+ kfree(indio_dev->name);
- error_free_device:
- iio_device_free(indio_dev);
--error_ret:
-+error_free_swd:
- kfree(swd);
--error_kzalloc:
- return ERR_PTR(ret);
- }
-
---
-2.35.1
-
+++ /dev/null
-From 9b2f1718400fa75342239e65eb25fd1926f33152 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 7 Feb 2022 15:38:33 +0100
-Subject: iio: st_sensors: Add a local lock for protecting odr
-
-From: Miquel Raynal <miquel.raynal@bootlin.com>
-
-[ Upstream commit 474010127e2505fc463236470908e1ff5ddb3578 ]
-
-Right now the (framework) mlock lock is (ab)used for multiple purposes:
-1- protecting concurrent accesses over the odr local cache
-2- avoid changing samplig frequency whilst buffer is running
-
-Let's start by handling situation #1 with a local lock.
-
-Suggested-by: Jonathan Cameron <jic23@kernel.org>
-Cc: Denis Ciocca <denis.ciocca@st.com>
-Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
-Link: https://lore.kernel.org/r/20220207143840.707510-7-miquel.raynal@bootlin.com
-Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- .../iio/common/st_sensors/st_sensors_core.c | 24 ++++++++++++++-----
- include/linux/iio/common/st_sensors.h | 3 +++
- 2 files changed, 21 insertions(+), 6 deletions(-)
-
-diff --git a/drivers/iio/common/st_sensors/st_sensors_core.c b/drivers/iio/common/st_sensors/st_sensors_core.c
-index fa9bcdf0d190..b92de90a125c 100644
---- a/drivers/iio/common/st_sensors/st_sensors_core.c
-+++ b/drivers/iio/common/st_sensors/st_sensors_core.c
-@@ -71,16 +71,18 @@ static int st_sensors_match_odr(struct st_sensor_settings *sensor_settings,
-
- int st_sensors_set_odr(struct iio_dev *indio_dev, unsigned int odr)
- {
-- int err;
-+ int err = 0;
- struct st_sensor_odr_avl odr_out = {0, 0};
- struct st_sensor_data *sdata = iio_priv(indio_dev);
-
-+ mutex_lock(&sdata->odr_lock);
-+
- if (!sdata->sensor_settings->odr.mask)
-- return 0;
-+ goto unlock_mutex;
-
- err = st_sensors_match_odr(sdata->sensor_settings, odr, &odr_out);
- if (err < 0)
-- goto st_sensors_match_odr_error;
-+ goto unlock_mutex;
-
- if ((sdata->sensor_settings->odr.addr ==
- sdata->sensor_settings->pw.addr) &&
-@@ -103,7 +105,9 @@ int st_sensors_set_odr(struct iio_dev *indio_dev, unsigned int odr)
- if (err >= 0)
- sdata->odr = odr_out.hz;
-
--st_sensors_match_odr_error:
-+unlock_mutex:
-+ mutex_unlock(&sdata->odr_lock);
-+
- return err;
- }
- EXPORT_SYMBOL_NS(st_sensors_set_odr, IIO_ST_SENSORS);
-@@ -361,6 +365,8 @@ int st_sensors_init_sensor(struct iio_dev *indio_dev,
- struct st_sensors_platform_data *of_pdata;
- int err = 0;
-
-+ mutex_init(&sdata->odr_lock);
-+
- /* If OF/DT pdata exists, it will take precedence of anything else */
- of_pdata = st_sensors_dev_probe(indio_dev->dev.parent, pdata);
- if (IS_ERR(of_pdata))
-@@ -554,18 +560,24 @@ int st_sensors_read_info_raw(struct iio_dev *indio_dev,
- err = -EBUSY;
- goto out;
- } else {
-+ mutex_lock(&sdata->odr_lock);
- err = st_sensors_set_enable(indio_dev, true);
-- if (err < 0)
-+ if (err < 0) {
-+ mutex_unlock(&sdata->odr_lock);
- goto out;
-+ }
-
- msleep((sdata->sensor_settings->bootime * 1000) / sdata->odr);
- err = st_sensors_read_axis_data(indio_dev, ch, val);
-- if (err < 0)
-+ if (err < 0) {
-+ mutex_unlock(&sdata->odr_lock);
- goto out;
-+ }
-
- *val = *val >> ch->scan_type.shift;
-
- err = st_sensors_set_enable(indio_dev, false);
-+ mutex_unlock(&sdata->odr_lock);
- }
- out:
- mutex_unlock(&indio_dev->mlock);
-diff --git a/include/linux/iio/common/st_sensors.h b/include/linux/iio/common/st_sensors.h
-index 22f67845cdd3..db4a1b260348 100644
---- a/include/linux/iio/common/st_sensors.h
-+++ b/include/linux/iio/common/st_sensors.h
-@@ -237,6 +237,7 @@ struct st_sensor_settings {
- * @hw_irq_trigger: if we're using the hardware interrupt on the sensor.
- * @hw_timestamp: Latest timestamp from the interrupt handler, when in use.
- * @buffer_data: Data used by buffer part.
-+ * @odr_lock: Local lock for preventing concurrent ODR accesses/changes
- */
- struct st_sensor_data {
- struct iio_trigger *trig;
-@@ -261,6 +262,8 @@ struct st_sensor_data {
- s64 hw_timestamp;
-
- char buffer_data[ST_SENSORS_MAX_BUFFER_SIZE] ____cacheline_aligned;
-+
-+ struct mutex odr_lock;
- };
-
- #ifdef CONFIG_IIO_BUFFER
---
-2.35.1
-
+++ /dev/null
-From 91d845de974cd69422dd925d848418977a0b5af2 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 2 May 2022 12:30:20 +0200
-Subject: jump_label,noinstr: Avoid instrumentation for JUMP_LABEL=n builds
-
-From: Peter Zijlstra <peterz@infradead.org>
-
-[ Upstream commit 656d054e0a15ec327bd82801ccd58201e59f6896 ]
-
-When building x86_64 with JUMP_LABEL=n it's possible for
-instrumentation to sneak into noinstr:
-
-vmlinux.o: warning: objtool: exit_to_user_mode+0x14: call to static_key_count.constprop.0() leaves .noinstr.text section
-vmlinux.o: warning: objtool: syscall_exit_to_user_mode+0x2d: call to static_key_count.constprop.0() leaves .noinstr.text section
-vmlinux.o: warning: objtool: irqentry_exit_to_user_mode+0x1b: call to static_key_count.constprop.0() leaves .noinstr.text section
-
-Switch to arch_ prefixed atomic to avoid the explicit instrumentation.
-
-Reported-by: kernel test robot <lkp@intel.com>
-Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- include/linux/jump_label.h | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/include/linux/jump_label.h b/include/linux/jump_label.h
-index 107751cc047b..bf1eef337a07 100644
---- a/include/linux/jump_label.h
-+++ b/include/linux/jump_label.h
-@@ -256,9 +256,9 @@ extern void static_key_disable_cpuslocked(struct static_key *key);
- #include <linux/atomic.h>
- #include <linux/bug.h>
-
--static inline int static_key_count(struct static_key *key)
-+static __always_inline int static_key_count(struct static_key *key)
- {
-- return atomic_read(&key->enabled);
-+ return arch_atomic_read(&key->enabled);
- }
-
- static __always_inline void jump_label_init(void)
---
-2.35.1
-
+++ /dev/null
-From 146af8b28629b4cc96eed8d7429a2276032457ec Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 16 May 2022 12:09:51 -0700
-Subject: kernfs: Separate kernfs_pr_cont_buf and rename_lock.
-
-From: Hao Luo <haoluo@google.com>
-
-[ Upstream commit 1a702dc88e150487c9c173a249b3d236498b9183 ]
-
-Previously the protection of kernfs_pr_cont_buf was piggy backed by
-rename_lock, which means that pr_cont() needs to be protected under
-rename_lock. This can cause potential circular lock dependencies.
-
-If there is an OOM, we have the following call hierarchy:
-
- -> cpuset_print_current_mems_allowed()
- -> pr_cont_cgroup_name()
- -> pr_cont_kernfs_name()
-
-pr_cont_kernfs_name() will grab rename_lock and call printk. So we have
-the following lock dependencies:
-
- kernfs_rename_lock -> console_sem
-
-Sometimes, printk does a wakeup before releasing console_sem, which has
-the dependence chain:
-
- console_sem -> p->pi_lock -> rq->lock
-
-Now, imagine one wants to read cgroup_name under rq->lock, for example,
-printing cgroup_name in a tracepoint in the scheduler code. They will
-be holding rq->lock and take rename_lock:
-
- rq->lock -> kernfs_rename_lock
-
-Now they will deadlock.
-
-A prevention to this circular lock dependency is to separate the
-protection of pr_cont_buf from rename_lock. In principle, rename_lock
-is to protect the integrity of cgroup name when copying to buf. Once
-pr_cont_buf has got its content, rename_lock can be dropped. So it's
-safe to drop rename_lock after kernfs_name_locked (and
-kernfs_path_from_node_locked) and rely on a dedicated pr_cont_lock
-to protect pr_cont_buf.
-
-Acked-by: Tejun Heo <tj@kernel.org>
-Signed-off-by: Hao Luo <haoluo@google.com>
-Link: https://lore.kernel.org/r/20220516190951.3144144-1-haoluo@google.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/kernfs/dir.c | 31 +++++++++++++++++++------------
- 1 file changed, 19 insertions(+), 12 deletions(-)
-
-diff --git a/fs/kernfs/dir.c b/fs/kernfs/dir.c
-index e205fde7163a..6eca72cfa1f2 100644
---- a/fs/kernfs/dir.c
-+++ b/fs/kernfs/dir.c
-@@ -18,7 +18,15 @@
- #include "kernfs-internal.h"
-
- static DEFINE_SPINLOCK(kernfs_rename_lock); /* kn->parent and ->name */
--static char kernfs_pr_cont_buf[PATH_MAX]; /* protected by rename_lock */
-+/*
-+ * Don't use rename_lock to piggy back on pr_cont_buf. We don't want to
-+ * call pr_cont() while holding rename_lock. Because sometimes pr_cont()
-+ * will perform wakeups when releasing console_sem. Holding rename_lock
-+ * will introduce deadlock if the scheduler reads the kernfs_name in the
-+ * wakeup path.
-+ */
-+static DEFINE_SPINLOCK(kernfs_pr_cont_lock);
-+static char kernfs_pr_cont_buf[PATH_MAX]; /* protected by pr_cont_lock */
- static DEFINE_SPINLOCK(kernfs_idr_lock); /* root->ino_idr */
-
- #define rb_to_kn(X) rb_entry((X), struct kernfs_node, rb)
-@@ -229,12 +237,12 @@ void pr_cont_kernfs_name(struct kernfs_node *kn)
- {
- unsigned long flags;
-
-- spin_lock_irqsave(&kernfs_rename_lock, flags);
-+ spin_lock_irqsave(&kernfs_pr_cont_lock, flags);
-
-- kernfs_name_locked(kn, kernfs_pr_cont_buf, sizeof(kernfs_pr_cont_buf));
-+ kernfs_name(kn, kernfs_pr_cont_buf, sizeof(kernfs_pr_cont_buf));
- pr_cont("%s", kernfs_pr_cont_buf);
-
-- spin_unlock_irqrestore(&kernfs_rename_lock, flags);
-+ spin_unlock_irqrestore(&kernfs_pr_cont_lock, flags);
- }
-
- /**
-@@ -248,10 +256,10 @@ void pr_cont_kernfs_path(struct kernfs_node *kn)
- unsigned long flags;
- int sz;
-
-- spin_lock_irqsave(&kernfs_rename_lock, flags);
-+ spin_lock_irqsave(&kernfs_pr_cont_lock, flags);
-
-- sz = kernfs_path_from_node_locked(kn, NULL, kernfs_pr_cont_buf,
-- sizeof(kernfs_pr_cont_buf));
-+ sz = kernfs_path_from_node(kn, NULL, kernfs_pr_cont_buf,
-+ sizeof(kernfs_pr_cont_buf));
- if (sz < 0) {
- pr_cont("(error)");
- goto out;
-@@ -265,7 +273,7 @@ void pr_cont_kernfs_path(struct kernfs_node *kn)
- pr_cont("%s", kernfs_pr_cont_buf);
-
- out:
-- spin_unlock_irqrestore(&kernfs_rename_lock, flags);
-+ spin_unlock_irqrestore(&kernfs_pr_cont_lock, flags);
- }
-
- /**
-@@ -823,13 +831,12 @@ static struct kernfs_node *kernfs_walk_ns(struct kernfs_node *parent,
-
- lockdep_assert_held_read(&kernfs_root(parent)->kernfs_rwsem);
-
-- /* grab kernfs_rename_lock to piggy back on kernfs_pr_cont_buf */
-- spin_lock_irq(&kernfs_rename_lock);
-+ spin_lock_irq(&kernfs_pr_cont_lock);
-
- len = strlcpy(kernfs_pr_cont_buf, path, sizeof(kernfs_pr_cont_buf));
-
- if (len >= sizeof(kernfs_pr_cont_buf)) {
-- spin_unlock_irq(&kernfs_rename_lock);
-+ spin_unlock_irq(&kernfs_pr_cont_lock);
- return NULL;
- }
-
-@@ -841,7 +848,7 @@ static struct kernfs_node *kernfs_walk_ns(struct kernfs_node *parent,
- parent = kernfs_find_ns(parent, name, ns);
- }
-
-- spin_unlock_irq(&kernfs_rename_lock);
-+ spin_unlock_irq(&kernfs_pr_cont_lock);
-
- return parent;
- }
---
-2.35.1
-
+++ /dev/null
-From 2f22b320f6307a7b6dee25fc1764076bcc79a537 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 18 May 2022 06:46:08 +0900
-Subject: ksmbd: smbd: fix connection dropped issue
-
-From: Hyunchul Lee <hyc.lee@gmail.com>
-
-[ Upstream commit 5366afc4065075a4456941fbd51c33604d631ee5 ]
-
-When there are bursty connection requests,
-RDMA connection event handler is deferred and
-Negotiation requests are received even if
-connection status is NEW.
-
-To handle it, set the status to CONNECTED
-if Negotiation requests are received.
-
-Reported-by: Yufan Chen <wiz.chen@gmail.com>
-Signed-off-by: Hyunchul Lee <hyc.lee@gmail.com>
-Tested-by: Yufan Chen <wiz.chen@gmail.com>
-Acked-by: Namjae Jeon <linkinjeon@kernel.org>
-Signed-off-by: Steve French <stfrench@microsoft.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/ksmbd/transport_rdma.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/fs/ksmbd/transport_rdma.c b/fs/ksmbd/transport_rdma.c
-index e646d79554b8..3f5d13571694 100644
---- a/fs/ksmbd/transport_rdma.c
-+++ b/fs/ksmbd/transport_rdma.c
-@@ -569,6 +569,7 @@ static void recv_done(struct ib_cq *cq, struct ib_wc *wc)
- }
- t->negotiation_requested = true;
- t->full_packet_received = true;
-+ t->status = SMB_DIRECT_CS_CONNECTED;
- enqueue_reassembly(t, recvmsg, 0);
- wake_up_interruptible(&t->wait_status);
- break;
---
-2.35.1
-
+++ /dev/null
-From 3172843c57c74f51236235df5604e5b18ac19b2b Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 16 Feb 2022 12:15:03 -0800
-Subject: lkdtm/usercopy: Expand size of "out of frame" object
-
-From: Kees Cook <keescook@chromium.org>
-
-[ Upstream commit f387e86d3a74407bdd9c5815820ac9d060962840 ]
-
-To be sufficiently out of range for the usercopy test to see the lifetime
-mismatch, expand the size of the "bad" buffer, which will let it be
-beyond current_stack_pointer regardless of stack growth direction.
-Paired with the recent addition of stack depth checking under
-CONFIG_HARDENED_USERCOPY=y, this will correctly start tripping again.
-
-Reported-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
-Cc: Arnd Bergmann <arnd@arndb.de>
-Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Reviewed-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
-Link: https://lore.kernel.org/lkml/762faf1b-0443-5ddf-4430-44a20cf2ec4d@collabora.com/
-Signed-off-by: Kees Cook <keescook@chromium.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/misc/lkdtm/usercopy.c | 17 ++++++++++++++---
- 1 file changed, 14 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/misc/lkdtm/usercopy.c b/drivers/misc/lkdtm/usercopy.c
-index 9161ce7ed47a..3fead5efe523 100644
---- a/drivers/misc/lkdtm/usercopy.c
-+++ b/drivers/misc/lkdtm/usercopy.c
-@@ -30,12 +30,12 @@ static const unsigned char test_text[] = "This is a test.\n";
- */
- static noinline unsigned char *trick_compiler(unsigned char *stack)
- {
-- return stack + 0;
-+ return stack + unconst;
- }
-
- static noinline unsigned char *do_usercopy_stack_callee(int value)
- {
-- unsigned char buf[32];
-+ unsigned char buf[128];
- int i;
-
- /* Exercise stack to avoid everything living in registers. */
-@@ -43,7 +43,12 @@ static noinline unsigned char *do_usercopy_stack_callee(int value)
- buf[i] = value & 0xff;
- }
-
-- return trick_compiler(buf);
-+ /*
-+ * Put the target buffer in the middle of stack allocation
-+ * so that we don't step on future stack users regardless
-+ * of stack growth direction.
-+ */
-+ return trick_compiler(&buf[(128/2)-32]);
- }
-
- static noinline void do_usercopy_stack(bool to_user, bool bad_frame)
-@@ -66,6 +71,12 @@ static noinline void do_usercopy_stack(bool to_user, bool bad_frame)
- bad_stack -= sizeof(unsigned long);
- }
-
-+#ifdef ARCH_HAS_CURRENT_STACK_POINTER
-+ pr_info("stack : %px\n", (void *)current_stack_pointer);
-+#endif
-+ pr_info("good_stack: %px-%px\n", good_stack, good_stack + sizeof(good_stack));
-+ pr_info("bad_stack : %px-%px\n", bad_stack, bad_stack + sizeof(good_stack));
-+
- user_addr = vm_mmap(NULL, 0, PAGE_SIZE,
- PROT_READ | PROT_WRITE | PROT_EXEC,
- MAP_ANONYMOUS | MAP_PRIVATE, 0);
---
-2.35.1
-
+++ /dev/null
-From b1bf5687a2b6395a479cac0edf3c953442d2dbfb Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 29 Apr 2022 16:49:09 +0800
-Subject: md: protect md_unregister_thread from reentrancy
-
-From: Guoqing Jiang <guoqing.jiang@cloud.ionos.com>
-
-[ Upstream commit 1e267742283a4b5a8ca65755c44166be27e9aa0f ]
-
-Generally, the md_unregister_thread is called with reconfig_mutex, but
-raid_message in dm-raid doesn't hold reconfig_mutex to unregister thread,
-so md_unregister_thread can be called simulitaneously from two call sites
-in theory.
-
-Then after previous commit which remove the protection of reconfig_mutex
-for md_unregister_thread completely, the potential issue could be worse
-than before.
-
-Let's take pers_lock at the beginning of function to ensure reentrancy.
-
-Reported-by: Donald Buczek <buczek@molgen.mpg.de>
-Signed-off-by: Guoqing Jiang <guoqing.jiang@linux.dev>
-Signed-off-by: Song Liu <song@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/md/md.c | 15 ++++++++++-----
- 1 file changed, 10 insertions(+), 5 deletions(-)
-
-diff --git a/drivers/md/md.c b/drivers/md/md.c
-index 066f792b374e..f79cab8c7700 100644
---- a/drivers/md/md.c
-+++ b/drivers/md/md.c
-@@ -7960,17 +7960,22 @@ EXPORT_SYMBOL(md_register_thread);
-
- void md_unregister_thread(struct md_thread **threadp)
- {
-- struct md_thread *thread = *threadp;
-- if (!thread)
-- return;
-- pr_debug("interrupting MD-thread pid %d\n", task_pid_nr(thread->tsk));
-- /* Locking ensures that mddev_unlock does not wake_up a
-+ struct md_thread *thread;
-+
-+ /*
-+ * Locking ensures that mddev_unlock does not wake_up a
- * non-existent thread
- */
- spin_lock(&pers_lock);
-+ thread = *threadp;
-+ if (!thread) {
-+ spin_unlock(&pers_lock);
-+ return;
-+ }
- *threadp = NULL;
- spin_unlock(&pers_lock);
-
-+ pr_debug("interrupting MD-thread pid %d\n", task_pid_nr(thread->tsk));
- kthread_stop(thread->tsk);
- kfree(thread);
- }
---
-2.35.1
-
+++ /dev/null
-From 34d786dd066a65e48d4691fc40b2d51afa204d04 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 29 Apr 2022 15:09:13 -0600
-Subject: misc: rtsx: set NULL intfdata when probe fails
-
-From: Shuah Khan <skhan@linuxfoundation.org>
-
-[ Upstream commit f861d36e021e1ac4a0a2a1f6411d623809975d63 ]
-
-rtsx_usb_probe() doesn't call usb_set_intfdata() to null out the
-interface pointer when probe fails. This leaves a stale pointer.
-Noticed the missing usb_set_intfdata() while debugging an unrelated
-invalid DMA mapping problem.
-
-Fix it with a call to usb_set_intfdata(..., NULL).
-
-Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
-Link: https://lore.kernel.org/r/20220429210913.46804-1-skhan@linuxfoundation.org
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/misc/cardreader/rtsx_usb.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/drivers/misc/cardreader/rtsx_usb.c b/drivers/misc/cardreader/rtsx_usb.c
-index 59eda55d92a3..1ef9b61077c4 100644
---- a/drivers/misc/cardreader/rtsx_usb.c
-+++ b/drivers/misc/cardreader/rtsx_usb.c
-@@ -667,6 +667,7 @@ static int rtsx_usb_probe(struct usb_interface *intf,
- return 0;
-
- out_init_fail:
-+ usb_set_intfdata(ucr->pusb_intf, NULL);
- usb_free_coherent(ucr->pusb_dev, IOBUF_SIZE, ucr->iobuf,
- ucr->iobuf_dma);
- return ret;
---
-2.35.1
-
+++ /dev/null
-From 90b603462d81919e0b937ba225958d595436a1ae Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 24 May 2022 01:46:22 +0900
-Subject: modpost: fix undefined behavior of is_arm_mapping_symbol()
-
-From: Masahiro Yamada <masahiroy@kernel.org>
-
-[ Upstream commit d6b732666a1bae0df3c3ae06925043bba34502b1 ]
-
-The return value of is_arm_mapping_symbol() is unpredictable when "$"
-is passed in.
-
-strchr(3) says:
- The strchr() and strrchr() functions return a pointer to the matched
- character or NULL if the character is not found. The terminating null
- byte is considered part of the string, so that if c is specified as
- '\0', these functions return a pointer to the terminator.
-
-When str[1] is '\0', strchr("axtd", str[1]) is not NULL, and str[2] is
-referenced (i.e. buffer overrun).
-
-Test code
----------
-
- char str1[] = "abc";
- char str2[] = "ab";
-
- strcpy(str1, "$");
- strcpy(str2, "$");
-
- printf("test1: %d\n", is_arm_mapping_symbol(str1));
- printf("test2: %d\n", is_arm_mapping_symbol(str2));
-
-Result
-------
-
- test1: 0
- test2: 1
-
-Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
-Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- scripts/mod/modpost.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
-index d81019db9da4..b28344fd7408 100644
---- a/scripts/mod/modpost.c
-+++ b/scripts/mod/modpost.c
-@@ -1267,7 +1267,8 @@ static int secref_whitelist(const struct sectioncheck *mismatch,
-
- static inline int is_arm_mapping_symbol(const char *str)
- {
-- return str[0] == '$' && strchr("axtd", str[1])
-+ return str[0] == '$' &&
-+ (str[1] == 'a' || str[1] == 'd' || str[1] == 't' || str[1] == 'x')
- && (str[2] == '\0' || str[2] == '.');
- }
-
---
-2.35.1
-
+++ /dev/null
-From ead2a1c1d7d3ede88eb162a76be083bdaf83afc2 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 21 May 2022 15:37:44 +0800
-Subject: nbd: call genl_unregister_family() first in nbd_cleanup()
-
-From: Yu Kuai <yukuai3@huawei.com>
-
-[ Upstream commit 06c4da89c24e7023ea448cadf8e9daf06a0aae6e ]
-
-Otherwise there may be race between module removal and the handling of
-netlink command, which can lead to the oops as shown below:
-
- BUG: kernel NULL pointer dereference, address: 0000000000000098
- Oops: 0002 [#1] SMP PTI
- CPU: 1 PID: 31299 Comm: nbd-client Tainted: G E 5.14.0-rc4
- Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
- RIP: 0010:down_write+0x1a/0x50
- Call Trace:
- start_creating+0x89/0x130
- debugfs_create_dir+0x1b/0x130
- nbd_start_device+0x13d/0x390 [nbd]
- nbd_genl_connect+0x42f/0x748 [nbd]
- genl_family_rcv_msg_doit.isra.0+0xec/0x150
- genl_rcv_msg+0xe5/0x1e0
- netlink_rcv_skb+0x55/0x100
- genl_rcv+0x29/0x40
- netlink_unicast+0x1a8/0x250
- netlink_sendmsg+0x21b/0x430
- ____sys_sendmsg+0x2a4/0x2d0
- ___sys_sendmsg+0x81/0xc0
- __sys_sendmsg+0x62/0xb0
- __x64_sys_sendmsg+0x1f/0x30
- do_syscall_64+0x3b/0xc0
- entry_SYSCALL_64_after_hwframe+0x44/0xae
- Modules linked in: nbd(E-)
-
-Signed-off-by: Hou Tao <houtao1@huawei.com>
-Signed-off-by: Yu Kuai <yukuai3@huawei.com>
-Reviewed-by: Josef Bacik <josef@toxicpanda.com>
-Link: https://lore.kernel.org/r/20220521073749.3146892-2-yukuai3@huawei.com
-Signed-off-by: Jens Axboe <axboe@kernel.dk>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/block/nbd.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
-index c860a9930855..b564942be5a3 100644
---- a/drivers/block/nbd.c
-+++ b/drivers/block/nbd.c
-@@ -2545,6 +2545,12 @@ static void __exit nbd_cleanup(void)
- struct nbd_device *nbd;
- LIST_HEAD(del_list);
-
-+ /*
-+ * Unregister netlink interface prior to waiting
-+ * for the completion of netlink commands.
-+ */
-+ genl_unregister_family(&nbd_genl_family);
-+
- nbd_dbg_close();
-
- mutex_lock(&nbd_index_mutex);
-@@ -2563,7 +2569,6 @@ static void __exit nbd_cleanup(void)
- destroy_workqueue(nbd_del_wq);
-
- idr_destroy(&nbd_index_idr);
-- genl_unregister_family(&nbd_genl_family);
- unregister_blkdev(NBD_MAJOR, "nbd");
- }
-
---
-2.35.1
-
+++ /dev/null
-From 64ce3f4aa3a826b4c67bc9a201f192d71a5e0290 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 21 May 2022 15:37:47 +0800
-Subject: nbd: fix io hung while disconnecting device
-
-From: Yu Kuai <yukuai3@huawei.com>
-
-[ Upstream commit 09dadb5985023e27d4740ebd17e6fea4640110e5 ]
-
-In our tests, "qemu-nbd" triggers a io hung:
-
-INFO: task qemu-nbd:11445 blocked for more than 368 seconds.
- Not tainted 5.18.0-rc3-next-20220422-00003-g2176915513ca #884
-"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
-task:qemu-nbd state:D stack: 0 pid:11445 ppid: 1 flags:0x00000000
-Call Trace:
- <TASK>
- __schedule+0x480/0x1050
- ? _raw_spin_lock_irqsave+0x3e/0xb0
- schedule+0x9c/0x1b0
- blk_mq_freeze_queue_wait+0x9d/0xf0
- ? ipi_rseq+0x70/0x70
- blk_mq_freeze_queue+0x2b/0x40
- nbd_add_socket+0x6b/0x270 [nbd]
- nbd_ioctl+0x383/0x510 [nbd]
- blkdev_ioctl+0x18e/0x3e0
- __x64_sys_ioctl+0xac/0x120
- do_syscall_64+0x35/0x80
- entry_SYSCALL_64_after_hwframe+0x44/0xae
-RIP: 0033:0x7fd8ff706577
-RSP: 002b:00007fd8fcdfebf8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
-RAX: ffffffffffffffda RBX: 0000000040000000 RCX: 00007fd8ff706577
-RDX: 000000000000000d RSI: 000000000000ab00 RDI: 000000000000000f
-RBP: 000000000000000f R08: 000000000000fbe8 R09: 000055fe497c62b0
-R10: 00000002aff20000 R11: 0000000000000246 R12: 000000000000006d
-R13: 0000000000000000 R14: 00007ffe82dc5e70 R15: 00007fd8fcdff9c0
-
-"qemu-ndb -d" will call ioctl 'NBD_DISCONNECT' first, however, following
-message was found:
-
-block nbd0: Send disconnect failed -32
-
-Which indicate that something is wrong with the server. Then,
-"qemu-nbd -d" will call ioctl 'NBD_CLEAR_SOCK', however ioctl can't clear
-requests after commit 2516ab1543fd("nbd: only clear the queue on device
-teardown"). And in the meantime, request can't complete through timeout
-because nbd_xmit_timeout() will always return 'BLK_EH_RESET_TIMER', which
-means such request will never be completed in this situation.
-
-Now that the flag 'NBD_CMD_INFLIGHT' can make sure requests won't
-complete multiple times, switch back to call nbd_clear_sock() in
-nbd_clear_sock_ioctl(), so that inflight requests can be cleared.
-
-Signed-off-by: Yu Kuai <yukuai3@huawei.com>
-Reviewed-by: Josef Bacik <josef@toxicpanda.com>
-Link: https://lore.kernel.org/r/20220521073749.3146892-5-yukuai3@huawei.com
-Signed-off-by: Jens Axboe <axboe@kernel.dk>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/block/nbd.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
-index 87b5f6e3c60f..ee5adca0ba7b 100644
---- a/drivers/block/nbd.c
-+++ b/drivers/block/nbd.c
-@@ -1434,7 +1434,7 @@ static int nbd_start_device_ioctl(struct nbd_device *nbd, struct block_device *b
- static void nbd_clear_sock_ioctl(struct nbd_device *nbd,
- struct block_device *bdev)
- {
-- sock_shutdown(nbd);
-+ nbd_clear_sock(nbd);
- __invalidate_device(bdev, true);
- nbd_bdev_reset(bdev);
- if (test_and_clear_bit(NBD_RT_HAS_CONFIG_REF,
---
-2.35.1
-
+++ /dev/null
-From 6e3cc7a62346cd0bdc38761a1fac005928dd9862 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 21 May 2022 15:37:45 +0800
-Subject: nbd: fix race between nbd_alloc_config() and module removal
-
-From: Yu Kuai <yukuai3@huawei.com>
-
-[ Upstream commit c55b2b983b0fa012942c3eb16384b2b722caa810 ]
-
-When nbd module is being removing, nbd_alloc_config() may be
-called concurrently by nbd_genl_connect(), although try_module_get()
-will return false, but nbd_alloc_config() doesn't handle it.
-
-The race may lead to the leak of nbd_config and its related
-resources (e.g, recv_workq) and oops in nbd_read_stat() due
-to the unload of nbd module as shown below:
-
- BUG: kernel NULL pointer dereference, address: 0000000000000040
- Oops: 0000 [#1] SMP PTI
- CPU: 5 PID: 13840 Comm: kworker/u17:33 Not tainted 5.14.0+ #1
- Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
- Workqueue: knbd16-recv recv_work [nbd]
- RIP: 0010:nbd_read_stat.cold+0x130/0x1a4 [nbd]
- Call Trace:
- recv_work+0x3b/0xb0 [nbd]
- process_one_work+0x1ed/0x390
- worker_thread+0x4a/0x3d0
- kthread+0x12a/0x150
- ret_from_fork+0x22/0x30
-
-Fixing it by checking the return value of try_module_get()
-in nbd_alloc_config(). As nbd_alloc_config() may return ERR_PTR(-ENODEV),
-assign nbd->config only when nbd_alloc_config() succeeds to ensure
-the value of nbd->config is binary (valid or NULL).
-
-Also adding a debug message to check the reference counter
-of nbd_config during module removal.
-
-Signed-off-by: Hou Tao <houtao1@huawei.com>
-Signed-off-by: Yu Kuai <yukuai3@huawei.com>
-Reviewed-by: Josef Bacik <josef@toxicpanda.com>
-Link: https://lore.kernel.org/r/20220521073749.3146892-3-yukuai3@huawei.com
-Signed-off-by: Jens Axboe <axboe@kernel.dk>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/block/nbd.c | 28 +++++++++++++++++++---------
- 1 file changed, 19 insertions(+), 9 deletions(-)
-
-diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
-index b564942be5a3..87b5f6e3c60f 100644
---- a/drivers/block/nbd.c
-+++ b/drivers/block/nbd.c
-@@ -1533,15 +1533,20 @@ static struct nbd_config *nbd_alloc_config(void)
- {
- struct nbd_config *config;
-
-+ if (!try_module_get(THIS_MODULE))
-+ return ERR_PTR(-ENODEV);
-+
- config = kzalloc(sizeof(struct nbd_config), GFP_NOFS);
-- if (!config)
-- return NULL;
-+ if (!config) {
-+ module_put(THIS_MODULE);
-+ return ERR_PTR(-ENOMEM);
-+ }
-+
- atomic_set(&config->recv_threads, 0);
- init_waitqueue_head(&config->recv_wq);
- init_waitqueue_head(&config->conn_wait);
- config->blksize_bits = NBD_DEF_BLKSIZE_BITS;
- atomic_set(&config->live_connections, 0);
-- try_module_get(THIS_MODULE);
- return config;
- }
-
-@@ -1568,12 +1573,13 @@ static int nbd_open(struct block_device *bdev, fmode_t mode)
- mutex_unlock(&nbd->config_lock);
- goto out;
- }
-- config = nbd->config = nbd_alloc_config();
-- if (!config) {
-- ret = -ENOMEM;
-+ config = nbd_alloc_config();
-+ if (IS_ERR(config)) {
-+ ret = PTR_ERR(config);
- mutex_unlock(&nbd->config_lock);
- goto out;
- }
-+ nbd->config = config;
- refcount_set(&nbd->config_refs, 1);
- refcount_inc(&nbd->refs);
- mutex_unlock(&nbd->config_lock);
-@@ -1981,13 +1987,14 @@ static int nbd_genl_connect(struct sk_buff *skb, struct genl_info *info)
- nbd_put(nbd);
- return -EINVAL;
- }
-- config = nbd->config = nbd_alloc_config();
-- if (!nbd->config) {
-+ config = nbd_alloc_config();
-+ if (IS_ERR(config)) {
- mutex_unlock(&nbd->config_lock);
- nbd_put(nbd);
- printk(KERN_ERR "nbd: couldn't allocate config\n");
-- return -ENOMEM;
-+ return PTR_ERR(config);
- }
-+ nbd->config = config;
- refcount_set(&nbd->config_refs, 1);
- set_bit(NBD_RT_BOUND, &config->runtime_flags);
-
-@@ -2560,6 +2567,9 @@ static void __exit nbd_cleanup(void)
- while (!list_empty(&del_list)) {
- nbd = list_first_entry(&del_list, struct nbd_device, list);
- list_del_init(&nbd->list);
-+ if (refcount_read(&nbd->config_refs))
-+ printk(KERN_ERR "nbd: possibly leaking nbd_config (ref %d)\n",
-+ refcount_read(&nbd->config_refs));
- if (refcount_read(&nbd->refs) != 1)
- printk(KERN_ERR "nbd: possibly leaking a device\n");
- nbd_put(nbd);
---
-2.35.1
-
+++ /dev/null
-From fd3dadd6e272889f33a8fee7f1591d4f164a8637 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 25 May 2022 00:56:18 +0200
-Subject: net, neigh: Set lower cap for neigh_managed_work rearming
-
-From: Daniel Borkmann <daniel@iogearbox.net>
-
-[ Upstream commit ed6cd6a17896561b9f51ab4c0d9bbb29e762b597 ]
-
-Yuwei reported that plain reuse of DELAY_PROBE_TIME to rearm work queue
-in neigh_managed_work is problematic if user explicitly configures the
-DELAY_PROBE_TIME to 0 for a neighbor table. Such misconfig can then hog
-CPU to 100% processing the system work queue. Instead, set lower interval
-bound to HZ which is totally sufficient. Yuwei is additionally looking
-into making the interval separately configurable from DELAY_PROBE_TIME.
-
-Reported-by: Yuwei Wang <wangyuweihx@gmail.com>
-Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
-Link: https://lore.kernel.org/netdev/797c3c53-ce1b-9f60-e253-cda615788f4a@iogearbox.net
-Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org>
-Link: https://lore.kernel.org/r/3b8c5aa906c52c3a8c995d1b2e8ccf650ea7c716.1653432794.git.daniel@iogearbox.net
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/core/neighbour.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/net/core/neighbour.c b/net/core/neighbour.c
-index f64ebd050f6c..fd69133dc7c5 100644
---- a/net/core/neighbour.c
-+++ b/net/core/neighbour.c
-@@ -1579,7 +1579,7 @@ static void neigh_managed_work(struct work_struct *work)
- list_for_each_entry(neigh, &tbl->managed_list, managed_list)
- neigh_event_send_probe(neigh, NULL, false);
- queue_delayed_work(system_power_efficient_wq, &tbl->managed_work,
-- NEIGH_VAR(&tbl->parms, DELAY_PROBE_TIME));
-+ max(NEIGH_VAR(&tbl->parms, DELAY_PROBE_TIME), HZ));
- write_unlock_bh(&tbl->lock);
- }
-
---
-2.35.1
-
+++ /dev/null
-From 885c3dc5f3f034b1870e4acab684c0ec2c805d78 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 18 May 2022 13:52:23 -0700
-Subject: nodemask: Fix return values to be unsigned
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Kees Cook <keescook@chromium.org>
-
-[ Upstream commit 0dfe54071d7c828a02917b595456bfde1afdddc9 ]
-
-The nodemask routines had mixed return values that provided potentially
-signed return values that could never happen. This was leading to the
-compiler getting confusing about the range of possible return values
-(it was thinking things could be negative where they could not be). Fix
-all the nodemask routines that should be returning unsigned
-(or bool) values. Silences:
-
- mm/swapfile.c: In function ‘setup_swap_info’:
- mm/swapfile.c:2291:47: error: array subscript -1 is below array bounds of ‘struct plist_node[]’ [-Werror=array-bounds]
- 2291 | p->avail_lists[i].prio = 1;
- | ~~~~~~~~~~~~~~^~~
- In file included from mm/swapfile.c:16:
- ./include/linux/swap.h:292:27: note: while referencing ‘avail_lists’
- 292 | struct plist_node avail_lists[]; /*
- | ^~~~~~~~~~~
-
-Reported-by: Christophe de Dinechin <dinechin@redhat.com>
-Link: https://lore.kernel.org/lkml/20220414150855.2407137-3-dinechin@redhat.com/
-Cc: Alexey Dobriyan <adobriyan@gmail.com>
-Cc: Yury Norov <yury.norov@gmail.com>
-Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
-Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
-Cc: Andrew Morton <akpm@linux-foundation.org>
-Cc: Zhen Lei <thunder.leizhen@huawei.com>
-Signed-off-by: Kees Cook <keescook@chromium.org>
-Signed-off-by: Yury Norov <yury.norov@gmail.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- include/linux/nodemask.h | 38 +++++++++++++++++++-------------------
- lib/nodemask.c | 4 ++--
- 2 files changed, 21 insertions(+), 21 deletions(-)
-
-diff --git a/include/linux/nodemask.h b/include/linux/nodemask.h
-index c6199dbe2591..0f233b76c9ce 100644
---- a/include/linux/nodemask.h
-+++ b/include/linux/nodemask.h
-@@ -42,11 +42,11 @@
- * void nodes_shift_right(dst, src, n) Shift right
- * void nodes_shift_left(dst, src, n) Shift left
- *
-- * int first_node(mask) Number lowest set bit, or MAX_NUMNODES
-- * int next_node(node, mask) Next node past 'node', or MAX_NUMNODES
-- * int next_node_in(node, mask) Next node past 'node', or wrap to first,
-+ * unsigned int first_node(mask) Number lowest set bit, or MAX_NUMNODES
-+ * unsigend int next_node(node, mask) Next node past 'node', or MAX_NUMNODES
-+ * unsigned int next_node_in(node, mask) Next node past 'node', or wrap to first,
- * or MAX_NUMNODES
-- * int first_unset_node(mask) First node not set in mask, or
-+ * unsigned int first_unset_node(mask) First node not set in mask, or
- * MAX_NUMNODES
- *
- * nodemask_t nodemask_of_node(node) Return nodemask with bit 'node' set
-@@ -153,7 +153,7 @@ static inline void __nodes_clear(nodemask_t *dstp, unsigned int nbits)
-
- #define node_test_and_set(node, nodemask) \
- __node_test_and_set((node), &(nodemask))
--static inline int __node_test_and_set(int node, nodemask_t *addr)
-+static inline bool __node_test_and_set(int node, nodemask_t *addr)
- {
- return test_and_set_bit(node, addr->bits);
- }
-@@ -200,7 +200,7 @@ static inline void __nodes_complement(nodemask_t *dstp,
-
- #define nodes_equal(src1, src2) \
- __nodes_equal(&(src1), &(src2), MAX_NUMNODES)
--static inline int __nodes_equal(const nodemask_t *src1p,
-+static inline bool __nodes_equal(const nodemask_t *src1p,
- const nodemask_t *src2p, unsigned int nbits)
- {
- return bitmap_equal(src1p->bits, src2p->bits, nbits);
-@@ -208,7 +208,7 @@ static inline int __nodes_equal(const nodemask_t *src1p,
-
- #define nodes_intersects(src1, src2) \
- __nodes_intersects(&(src1), &(src2), MAX_NUMNODES)
--static inline int __nodes_intersects(const nodemask_t *src1p,
-+static inline bool __nodes_intersects(const nodemask_t *src1p,
- const nodemask_t *src2p, unsigned int nbits)
- {
- return bitmap_intersects(src1p->bits, src2p->bits, nbits);
-@@ -216,20 +216,20 @@ static inline int __nodes_intersects(const nodemask_t *src1p,
-
- #define nodes_subset(src1, src2) \
- __nodes_subset(&(src1), &(src2), MAX_NUMNODES)
--static inline int __nodes_subset(const nodemask_t *src1p,
-+static inline bool __nodes_subset(const nodemask_t *src1p,
- const nodemask_t *src2p, unsigned int nbits)
- {
- return bitmap_subset(src1p->bits, src2p->bits, nbits);
- }
-
- #define nodes_empty(src) __nodes_empty(&(src), MAX_NUMNODES)
--static inline int __nodes_empty(const nodemask_t *srcp, unsigned int nbits)
-+static inline bool __nodes_empty(const nodemask_t *srcp, unsigned int nbits)
- {
- return bitmap_empty(srcp->bits, nbits);
- }
-
- #define nodes_full(nodemask) __nodes_full(&(nodemask), MAX_NUMNODES)
--static inline int __nodes_full(const nodemask_t *srcp, unsigned int nbits)
-+static inline bool __nodes_full(const nodemask_t *srcp, unsigned int nbits)
- {
- return bitmap_full(srcp->bits, nbits);
- }
-@@ -260,15 +260,15 @@ static inline void __nodes_shift_left(nodemask_t *dstp,
- > MAX_NUMNODES, then the silly min_ts could be dropped. */
-
- #define first_node(src) __first_node(&(src))
--static inline int __first_node(const nodemask_t *srcp)
-+static inline unsigned int __first_node(const nodemask_t *srcp)
- {
-- return min_t(int, MAX_NUMNODES, find_first_bit(srcp->bits, MAX_NUMNODES));
-+ return min_t(unsigned int, MAX_NUMNODES, find_first_bit(srcp->bits, MAX_NUMNODES));
- }
-
- #define next_node(n, src) __next_node((n), &(src))
--static inline int __next_node(int n, const nodemask_t *srcp)
-+static inline unsigned int __next_node(int n, const nodemask_t *srcp)
- {
-- return min_t(int,MAX_NUMNODES,find_next_bit(srcp->bits, MAX_NUMNODES, n+1));
-+ return min_t(unsigned int, MAX_NUMNODES, find_next_bit(srcp->bits, MAX_NUMNODES, n+1));
- }
-
- /*
-@@ -276,7 +276,7 @@ static inline int __next_node(int n, const nodemask_t *srcp)
- * the first node in src if needed. Returns MAX_NUMNODES if src is empty.
- */
- #define next_node_in(n, src) __next_node_in((n), &(src))
--int __next_node_in(int node, const nodemask_t *srcp);
-+unsigned int __next_node_in(int node, const nodemask_t *srcp);
-
- static inline void init_nodemask_of_node(nodemask_t *mask, int node)
- {
-@@ -296,9 +296,9 @@ static inline void init_nodemask_of_node(nodemask_t *mask, int node)
- })
-
- #define first_unset_node(mask) __first_unset_node(&(mask))
--static inline int __first_unset_node(const nodemask_t *maskp)
-+static inline unsigned int __first_unset_node(const nodemask_t *maskp)
- {
-- return min_t(int,MAX_NUMNODES,
-+ return min_t(unsigned int, MAX_NUMNODES,
- find_first_zero_bit(maskp->bits, MAX_NUMNODES));
- }
-
-@@ -435,11 +435,11 @@ static inline int num_node_state(enum node_states state)
-
- #define first_online_node first_node(node_states[N_ONLINE])
- #define first_memory_node first_node(node_states[N_MEMORY])
--static inline int next_online_node(int nid)
-+static inline unsigned int next_online_node(int nid)
- {
- return next_node(nid, node_states[N_ONLINE]);
- }
--static inline int next_memory_node(int nid)
-+static inline unsigned int next_memory_node(int nid)
- {
- return next_node(nid, node_states[N_MEMORY]);
- }
-diff --git a/lib/nodemask.c b/lib/nodemask.c
-index 3aa454c54c0d..e22647f5181b 100644
---- a/lib/nodemask.c
-+++ b/lib/nodemask.c
-@@ -3,9 +3,9 @@
- #include <linux/module.h>
- #include <linux/random.h>
-
--int __next_node_in(int node, const nodemask_t *srcp)
-+unsigned int __next_node_in(int node, const nodemask_t *srcp)
- {
-- int ret = __next_node(node, srcp);
-+ unsigned int ret = __next_node(node, srcp);
-
- if (ret == MAX_NUMNODES)
- ret = __first_node(srcp);
---
-2.35.1
-
+++ /dev/null
-From 34589130438dcd98ac38450e2853ba3cd6b00de4 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 2 May 2022 11:15:14 +0200
-Subject: objtool: Mark __ubsan_handle_builtin_unreachable() as noreturn
-
-From: Peter Zijlstra <peterz@infradead.org>
-
-[ Upstream commit 385bd430c011a8cb8278e61c32d602d11e06f414 ]
-
- fs/ntfs3/ntfs3.prelink.o: warning: objtool: ni_read_frame() falls through to next function ni_readpage_cmpr.cold()
-
-That is in fact:
-
-000000000000124a <ni_read_frame.cold>:
- 124a: 44 89 e0 mov %r12d,%eax
- 124d: 0f b6 55 98 movzbl -0x68(%rbp),%edx
- 1251: 48 c7 c7 00 00 00 00 mov $0x0,%rdi 1254: R_X86_64_32S .data+0x1380
- 1258: 48 89 c6 mov %rax,%rsi
- 125b: e8 00 00 00 00 call 1260 <ni_read_frame.cold+0x16> 125c: R_X86_64_PLT32 __ubsan_handle_shift_out_of_bounds-0x4
- 1260: 48 8d 7d cc lea -0x34(%rbp),%rdi
- 1264: e8 00 00 00 00 call 1269 <ni_read_frame.cold+0x1f> 1265: R_X86_64_PLT32 __tsan_read4-0x4
- 1269: 8b 45 cc mov -0x34(%rbp),%eax
- 126c: e9 00 00 00 00 jmp 1271 <ni_read_frame.cold+0x27> 126d: R_X86_64_PC32 .text+0x19109
- 1271: 48 8b 75 a0 mov -0x60(%rbp),%rsi
- 1275: 48 63 d0 movslq %eax,%rdx
- 1278: 48 c7 c7 00 00 00 00 mov $0x0,%rdi 127b: R_X86_64_32S .data+0x13a0
- 127f: 89 45 88 mov %eax,-0x78(%rbp)
- 1282: e8 00 00 00 00 call 1287 <ni_read_frame.cold+0x3d> 1283: R_X86_64_PLT32 __ubsan_handle_shift_out_of_bounds-0x4
- 1287: 8b 45 88 mov -0x78(%rbp),%eax
- 128a: e9 00 00 00 00 jmp 128f <ni_read_frame.cold+0x45> 128b: R_X86_64_PC32 .text+0x19098
- 128f: 48 c7 c7 00 00 00 00 mov $0x0,%rdi 1292: R_X86_64_32S .data+0x11f0
- 1296: e8 00 00 00 00 call 129b <ni_readpage_cmpr.cold> 1297: R_X86_64_PLT32 __ubsan_handle_builtin_unreachable-0x4
-
-000000000000129b <ni_readpage_cmpr.cold>:
-
-Tell objtool that __ubsan_handle_builtin_unreachable() is a noreturn.
-
-Reported-by: kernel test robot <lkp@intel.com>
-Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
-Link: https://lkml.kernel.org/r/20220502091514.GB479834@worktop.programming.kicks-ass.net
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- tools/objtool/check.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/tools/objtool/check.c b/tools/objtool/check.c
-index 8a0971a620f0..f66e4ac0af94 100644
---- a/tools/objtool/check.c
-+++ b/tools/objtool/check.c
-@@ -185,7 +185,8 @@ static bool __dead_end_function(struct objtool_file *file, struct symbol *func,
- "do_group_exit",
- "stop_this_cpu",
- "__invalid_creds",
-- "cpu_startup_entry",
-+ "cpu_startup_entry",
-+ "__ubsan_handle_builtin_unreachable",
- };
-
- if (!func)
---
-2.35.1
-
+++ /dev/null
-From e69b31e017a220e79d33a84e707783ebeda4043a Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 23 May 2022 22:05:24 +0200
-Subject: Revert "net: af_key: add check for pfkey_broadcast in function
- pfkey_process"
-
-From: Michal Kubecek <mkubecek@suse.cz>
-
-[ Upstream commit 9c90c9b3e50e16d03c7f87d63e9db373974781e0 ]
-
-This reverts commit 4dc2a5a8f6754492180741facf2a8787f2c415d7.
-
-A non-zero return value from pfkey_broadcast() does not necessarily mean
-an error occurred as this function returns -ESRCH when no registered
-listener received the message. In particular, a call with
-BROADCAST_PROMISC_ONLY flag and null one_sk argument can never return
-zero so that this commit in fact prevents processing any PF_KEY message.
-One visible effect is that racoon daemon fails to find encryption
-algorithms like aes and refuses to start.
-
-Excluding -ESRCH return value would fix this but it's not obvious that
-we really want to bail out here and most other callers of
-pfkey_broadcast() also ignore the return value. Also, as pointed out by
-Steffen Klassert, PF_KEY is kind of deprecated and newer userspace code
-should use netlink instead so that we should only disturb the code for
-really important fixes.
-
-v2: add a comment explaining why is the return value ignored
-
-Signed-off-by: Michal Kubecek <mkubecek@suse.cz>
-Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/key/af_key.c | 10 ++++++----
- 1 file changed, 6 insertions(+), 4 deletions(-)
-
-diff --git a/net/key/af_key.c b/net/key/af_key.c
-index 339d95df19d3..d93bde657359 100644
---- a/net/key/af_key.c
-+++ b/net/key/af_key.c
-@@ -2826,10 +2826,12 @@ static int pfkey_process(struct sock *sk, struct sk_buff *skb, const struct sadb
- void *ext_hdrs[SADB_EXT_MAX];
- int err;
-
-- err = pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL,
-- BROADCAST_PROMISC_ONLY, NULL, sock_net(sk));
-- if (err)
-- return err;
-+ /* Non-zero return value of pfkey_broadcast() does not always signal
-+ * an error and even on an actual error we may still want to process
-+ * the message so rather ignore the return value.
-+ */
-+ pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL,
-+ BROADCAST_PROMISC_ONLY, NULL, sock_net(sk));
-
- memset(ext_hdrs, 0, sizeof(ext_hdrs));
- err = parse_exthdrs(skb, hdr, ext_hdrs);
---
-2.35.1
-
+++ /dev/null
-From 0b3096e2e4774eb33a07fdcf6be538b732129843 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 11 May 2022 15:18:54 -0500
-Subject: Revert "PCI: brcmstb: Add control of subdevice voltage regulators"
-
-From: Bjorn Helgaas <bhelgaas@google.com>
-
-[ Upstream commit 212942609d83b591f5a2f2691df122d13aa3a87d ]
-
-This reverts commit 93e41f3fca3d4a0f927b784012338c37f80a8a80.
-
-This is part of a revert of the following commits:
-
- 11ed8b8624b8 ("PCI: brcmstb: Do not turn off WOL regulators on suspend")
- 93e41f3fca3d ("PCI: brcmstb: Add control of subdevice voltage regulators")
- 67211aadcb4b ("PCI: brcmstb: Add mechanism to turn on subdev regulators")
- 830aa6f29f07 ("PCI: brcmstb: Split brcm_pcie_setup() into two funcs")
-
-Cyril reported that 830aa6f29f07 ("PCI: brcmstb: Split brcm_pcie_setup()
-into two funcs"), which appeared in v5.17-rc1, broke booting on the
-Raspberry Pi Compute Module 4. Apparently 830aa6f29f07 panics with an
-Asynchronous SError Interrupt, and after further commits here is a black
-screen on HDMI and no output on the serial console.
-
-This does not seem to affect the Raspberry Pi 4 B.
-
-Link: https://bugzilla.kernel.org/show_bug.cgi?id=215925
-Link: https://lore.kernel.org/r/20220511201856.808690-3-helgaas@kernel.org
-Reported-by: Cyril Brulebois <kibi@debian.org>
-Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/pci/controller/pcie-brcmstb.c | 83 ++-------------------------
- 1 file changed, 5 insertions(+), 78 deletions(-)
-
-diff --git a/drivers/pci/controller/pcie-brcmstb.c b/drivers/pci/controller/pcie-brcmstb.c
-index 3edd63735948..fd464d38fecb 100644
---- a/drivers/pci/controller/pcie-brcmstb.c
-+++ b/drivers/pci/controller/pcie-brcmstb.c
-@@ -196,8 +196,6 @@ static inline void brcm_pcie_bridge_sw_init_set_generic(struct brcm_pcie *pcie,
- static inline void brcm_pcie_perst_set_4908(struct brcm_pcie *pcie, u32 val);
- static inline void brcm_pcie_perst_set_7278(struct brcm_pcie *pcie, u32 val);
- static inline void brcm_pcie_perst_set_generic(struct brcm_pcie *pcie, u32 val);
--static int brcm_pcie_linkup(struct brcm_pcie *pcie);
--static int brcm_pcie_add_bus(struct pci_bus *bus);
-
- enum {
- RGR1_SW_INIT_1,
-@@ -331,8 +329,6 @@ struct brcm_pcie {
- u32 hw_rev;
- void (*perst_set)(struct brcm_pcie *pcie, u32 val);
- void (*bridge_sw_init_set)(struct brcm_pcie *pcie, u32 val);
-- bool refusal_mode;
-- struct subdev_regulators *sr;
- };
-
- static inline bool is_bmips(const struct brcm_pcie *pcie)
-@@ -501,34 +497,6 @@ static int pci_subdev_regulators_add_bus(struct pci_bus *bus)
- return 0;
- }
-
--static int brcm_pcie_add_bus(struct pci_bus *bus)
--{
-- struct device *dev = &bus->dev;
-- struct brcm_pcie *pcie = (struct brcm_pcie *) bus->sysdata;
-- int ret;
--
-- if (!dev->of_node || !bus->parent || !pci_is_root_bus(bus->parent))
-- return 0;
--
-- ret = pci_subdev_regulators_add_bus(bus);
-- if (ret)
-- return ret;
--
-- /* Grab the regulators for suspend/resume */
-- pcie->sr = bus->dev.driver_data;
--
-- /*
-- * If we have failed linkup there is no point to return an error as
-- * currently it will cause a WARNING() from pci_alloc_child_bus().
-- * We return 0 and turn on the "refusal_mode" so that any further
-- * accesses to the pci_dev just get 0xffffffff
-- */
-- if (brcm_pcie_linkup(pcie) != 0)
-- pcie->refusal_mode = true;
--
-- return 0;
--}
--
- static void pci_subdev_regulators_remove_bus(struct pci_bus *bus)
- {
- struct device *dev = &bus->dev;
-@@ -857,18 +825,6 @@ static void __iomem *brcm_pcie_map_conf(struct pci_bus *bus, unsigned int devfn,
- /* Accesses to the RC go right to the RC registers if slot==0 */
- if (pci_is_root_bus(bus))
- return PCI_SLOT(devfn) ? NULL : base + where;
-- if (pcie->refusal_mode) {
-- /*
-- * At this point we do not have link. There will be a CPU
-- * abort -- a quirk with this controller --if Linux tries
-- * to read any config-space registers besides those
-- * targeting the host bridge. To prevent this we hijack
-- * the address to point to a safe access that will return
-- * 0xffffffff.
-- */
-- writel(0xffffffff, base + PCIE_MISC_RC_BAR2_CONFIG_HI);
-- return base + PCIE_MISC_RC_BAR2_CONFIG_HI + (where & 0x3);
-- }
-
- /* For devices, write to the config space index register */
- idx = PCIE_ECAM_OFFSET(bus->number, devfn, 0);
-@@ -897,7 +853,7 @@ static struct pci_ops brcm_pcie_ops = {
- .map_bus = brcm_pcie_map_conf,
- .read = pci_generic_config_read,
- .write = pci_generic_config_write,
-- .add_bus = brcm_pcie_add_bus,
-+ .add_bus = pci_subdev_regulators_add_bus,
- .remove_bus = pci_subdev_regulators_remove_bus,
- };
-
-@@ -1370,14 +1326,6 @@ static int brcm_pcie_suspend(struct device *dev)
- return ret;
- }
-
-- if (pcie->sr) {
-- ret = regulator_bulk_disable(pcie->sr->num_supplies, pcie->sr->supplies);
-- if (ret) {
-- dev_err(dev, "Could not turn off regulators\n");
-- reset_control_reset(pcie->rescal);
-- return ret;
-- }
-- }
- clk_disable_unprepare(pcie->clk);
-
- return 0;
-@@ -1395,17 +1343,9 @@ static int brcm_pcie_resume(struct device *dev)
- if (ret)
- return ret;
-
-- if (pcie->sr) {
-- ret = regulator_bulk_enable(pcie->sr->num_supplies, pcie->sr->supplies);
-- if (ret) {
-- dev_err(dev, "Could not turn on regulators\n");
-- goto err_disable_clk;
-- }
-- }
--
- ret = reset_control_reset(pcie->rescal);
- if (ret)
-- goto err_regulator;
-+ goto err_disable_clk;
-
- ret = brcm_phy_start(pcie);
- if (ret)
-@@ -1437,9 +1377,6 @@ static int brcm_pcie_resume(struct device *dev)
-
- err_reset:
- reset_control_rearm(pcie->rescal);
--err_regulator:
-- if (pcie->sr)
-- regulator_bulk_disable(pcie->sr->num_supplies, pcie->sr->supplies);
- err_disable_clk:
- clk_disable_unprepare(pcie->clk);
- return ret;
-@@ -1571,17 +1508,7 @@ static int brcm_pcie_probe(struct platform_device *pdev)
-
- platform_set_drvdata(pdev, pcie);
-
-- ret = pci_host_probe(bridge);
-- if (!ret && !brcm_pcie_link_up(pcie))
-- ret = -ENODEV;
--
-- if (ret) {
-- brcm_pcie_remove(pdev);
-- return ret;
-- }
--
-- return 0;
--
-+ return pci_host_probe(bridge);
- fail:
- __brcm_pcie_remove(pcie);
- return ret;
-@@ -1590,8 +1517,8 @@ static int brcm_pcie_probe(struct platform_device *pdev)
- MODULE_DEVICE_TABLE(of, brcm_pcie_match);
-
- static const struct dev_pm_ops brcm_pcie_pm_ops = {
-- .suspend_noirq = brcm_pcie_suspend,
-- .resume_noirq = brcm_pcie_resume,
-+ .suspend = brcm_pcie_suspend,
-+ .resume = brcm_pcie_resume,
- };
-
- static struct platform_driver brcm_pcie_driver = {
---
-2.35.1
-
+++ /dev/null
-From 502ca41174c237035460f07be7b9218cd99246e0 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 11 May 2022 15:18:55 -0500
-Subject: Revert "PCI: brcmstb: Add mechanism to turn on subdev regulators"
-
-From: Bjorn Helgaas <bhelgaas@google.com>
-
-[ Upstream commit 420be2f7ebe60c9ba3e332f5290017cd168e2bf8 ]
-
-This reverts commit 67211aadcb4b968d0fdc57bc27240fa71500c2d4.
-
-This is part of a revert of the following commits:
-
- 11ed8b8624b8 ("PCI: brcmstb: Do not turn off WOL regulators on suspend")
- 93e41f3fca3d ("PCI: brcmstb: Add control of subdevice voltage regulators")
- 67211aadcb4b ("PCI: brcmstb: Add mechanism to turn on subdev regulators")
- 830aa6f29f07 ("PCI: brcmstb: Split brcm_pcie_setup() into two funcs")
-
-Cyril reported that 830aa6f29f07 ("PCI: brcmstb: Split brcm_pcie_setup()
-into two funcs"), which appeared in v5.17-rc1, broke booting on the
-Raspberry Pi Compute Module 4. Apparently 830aa6f29f07 panics with an
-Asynchronous SError Interrupt, and after further commits here is a black
-screen on HDMI and no output on the serial console.
-
-This does not seem to affect the Raspberry Pi 4 B.
-
-Link: https://bugzilla.kernel.org/show_bug.cgi?id=215925
-Link: https://lore.kernel.org/r/20220511201856.808690-4-helgaas@kernel.org
-Reported-by: Cyril Brulebois <kibi@debian.org>
-Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/pci/controller/pcie-brcmstb.c | 76 ---------------------------
- 1 file changed, 76 deletions(-)
-
-diff --git a/drivers/pci/controller/pcie-brcmstb.c b/drivers/pci/controller/pcie-brcmstb.c
-index fd464d38fecb..0e8346114a8d 100644
---- a/drivers/pci/controller/pcie-brcmstb.c
-+++ b/drivers/pci/controller/pcie-brcmstb.c
-@@ -24,7 +24,6 @@
- #include <linux/pci.h>
- #include <linux/pci-ecam.h>
- #include <linux/printk.h>
--#include <linux/regulator/consumer.h>
- #include <linux/reset.h>
- #include <linux/sizes.h>
- #include <linux/slab.h>
-@@ -284,14 +283,6 @@ static const struct pcie_cfg_data bcm2711_cfg = {
- .bridge_sw_init_set = brcm_pcie_bridge_sw_init_set_generic,
- };
-
--struct subdev_regulators {
-- unsigned int num_supplies;
-- struct regulator_bulk_data supplies[];
--};
--
--static int pci_subdev_regulators_add_bus(struct pci_bus *bus);
--static void pci_subdev_regulators_remove_bus(struct pci_bus *bus);
--
- struct brcm_msi {
- struct device *dev;
- void __iomem *base;
-@@ -445,71 +436,6 @@ static int brcm_pcie_set_ssc(struct brcm_pcie *pcie)
- return ssc && pll ? 0 : -EIO;
- }
-
--static void *alloc_subdev_regulators(struct device *dev)
--{
-- static const char * const supplies[] = {
-- "vpcie3v3",
-- "vpcie3v3aux",
-- "vpcie12v",
-- };
-- const size_t size = sizeof(struct subdev_regulators)
-- + sizeof(struct regulator_bulk_data) * ARRAY_SIZE(supplies);
-- struct subdev_regulators *sr;
-- int i;
--
-- sr = devm_kzalloc(dev, size, GFP_KERNEL);
-- if (sr) {
-- sr->num_supplies = ARRAY_SIZE(supplies);
-- for (i = 0; i < ARRAY_SIZE(supplies); i++)
-- sr->supplies[i].supply = supplies[i];
-- }
--
-- return sr;
--}
--
--static int pci_subdev_regulators_add_bus(struct pci_bus *bus)
--{
-- struct device *dev = &bus->dev;
-- struct subdev_regulators *sr;
-- int ret;
--
-- if (!dev->of_node || !bus->parent || !pci_is_root_bus(bus->parent))
-- return 0;
--
-- if (dev->driver_data)
-- dev_err(dev, "dev.driver_data unexpectedly non-NULL\n");
--
-- sr = alloc_subdev_regulators(dev);
-- if (!sr)
-- return -ENOMEM;
--
-- dev->driver_data = sr;
-- ret = regulator_bulk_get(dev, sr->num_supplies, sr->supplies);
-- if (ret)
-- return ret;
--
-- ret = regulator_bulk_enable(sr->num_supplies, sr->supplies);
-- if (ret) {
-- dev_err(dev, "failed to enable regulators for downstream device\n");
-- return ret;
-- }
--
-- return 0;
--}
--
--static void pci_subdev_regulators_remove_bus(struct pci_bus *bus)
--{
-- struct device *dev = &bus->dev;
-- struct subdev_regulators *sr = dev->driver_data;
--
-- if (!sr || !bus->parent || !pci_is_root_bus(bus->parent))
-- return;
--
-- if (regulator_bulk_disable(sr->num_supplies, sr->supplies))
-- dev_err(dev, "failed to disable regulators for downstream device\n");
-- dev->driver_data = NULL;
--}
--
- /* Limits operation to a specific generation (1, 2, or 3) */
- static void brcm_pcie_set_gen(struct brcm_pcie *pcie, int gen)
- {
-@@ -853,8 +779,6 @@ static struct pci_ops brcm_pcie_ops = {
- .map_bus = brcm_pcie_map_conf,
- .read = pci_generic_config_read,
- .write = pci_generic_config_write,
-- .add_bus = pci_subdev_regulators_add_bus,
-- .remove_bus = pci_subdev_regulators_remove_bus,
- };
-
- static struct pci_ops brcm_pcie_ops32 = {
---
-2.35.1
-
+++ /dev/null
-From 971ea98230b54cd404d1c7dae9e9c21c4c9dca29 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 11 May 2022 15:18:53 -0500
-Subject: Revert "PCI: brcmstb: Do not turn off WOL regulators on suspend"
-
-From: Bjorn Helgaas <bhelgaas@google.com>
-
-[ Upstream commit 7894025c783ca36394d3afe49c8cfb4c830b82fe ]
-
-This reverts commit 11ed8b8624b8085f706864b4addcd304b1e4fc38.
-
-This is part of a revert of the following commits:
-
- 11ed8b8624b8 ("PCI: brcmstb: Do not turn off WOL regulators on suspend")
- 93e41f3fca3d ("PCI: brcmstb: Add control of subdevice voltage regulators")
- 67211aadcb4b ("PCI: brcmstb: Add mechanism to turn on subdev regulators")
- 830aa6f29f07 ("PCI: brcmstb: Split brcm_pcie_setup() into two funcs")
-
-Cyril reported that 830aa6f29f07 ("PCI: brcmstb: Split brcm_pcie_setup()
-into two funcs"), which appeared in v5.17-rc1, broke booting on the
-Raspberry Pi Compute Module 4. Apparently 830aa6f29f07 panics with an
-Asynchronous SError Interrupt, and after further commits here is a black
-screen on HDMI and no output on the serial console.
-
-This does not seem to affect the Raspberry Pi 4 B.
-
-Link: https://bugzilla.kernel.org/show_bug.cgi?id=215925
-Link: https://lore.kernel.org/r/20220511201856.808690-2-helgaas@kernel.org
-Reported-by: Cyril Brulebois <kibi@debian.org>
-Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/pci/controller/pcie-brcmstb.c | 53 +++++----------------------
- 1 file changed, 9 insertions(+), 44 deletions(-)
-
-diff --git a/drivers/pci/controller/pcie-brcmstb.c b/drivers/pci/controller/pcie-brcmstb.c
-index 375c0c40bbf8..3edd63735948 100644
---- a/drivers/pci/controller/pcie-brcmstb.c
-+++ b/drivers/pci/controller/pcie-brcmstb.c
-@@ -333,7 +333,6 @@ struct brcm_pcie {
- void (*bridge_sw_init_set)(struct brcm_pcie *pcie, u32 val);
- bool refusal_mode;
- struct subdev_regulators *sr;
-- bool ep_wakeup_capable;
- };
-
- static inline bool is_bmips(const struct brcm_pcie *pcie)
-@@ -1351,21 +1350,9 @@ static void brcm_pcie_turn_off(struct brcm_pcie *pcie)
- pcie->bridge_sw_init_set(pcie, 1);
- }
-
--static int pci_dev_may_wakeup(struct pci_dev *dev, void *data)
--{
-- bool *ret = data;
--
-- if (device_may_wakeup(&dev->dev)) {
-- *ret = true;
-- dev_info(&dev->dev, "disable cancelled for wake-up device\n");
-- }
-- return (int) *ret;
--}
--
- static int brcm_pcie_suspend(struct device *dev)
- {
- struct brcm_pcie *pcie = dev_get_drvdata(dev);
-- struct pci_host_bridge *bridge = pci_host_bridge_from_priv(pcie);
- int ret;
-
- brcm_pcie_turn_off(pcie);
-@@ -1384,22 +1371,11 @@ static int brcm_pcie_suspend(struct device *dev)
- }
-
- if (pcie->sr) {
-- /*
-- * Now turn off the regulators, but if at least one
-- * downstream device is enabled as a wake-up source, do not
-- * turn off regulators.
-- */
-- pcie->ep_wakeup_capable = false;
-- pci_walk_bus(bridge->bus, pci_dev_may_wakeup,
-- &pcie->ep_wakeup_capable);
-- if (!pcie->ep_wakeup_capable) {
-- ret = regulator_bulk_disable(pcie->sr->num_supplies,
-- pcie->sr->supplies);
-- if (ret) {
-- dev_err(dev, "Could not turn off regulators\n");
-- reset_control_reset(pcie->rescal);
-- return ret;
-- }
-+ ret = regulator_bulk_disable(pcie->sr->num_supplies, pcie->sr->supplies);
-+ if (ret) {
-+ dev_err(dev, "Could not turn off regulators\n");
-+ reset_control_reset(pcie->rescal);
-+ return ret;
- }
- }
- clk_disable_unprepare(pcie->clk);
-@@ -1420,21 +1396,10 @@ static int brcm_pcie_resume(struct device *dev)
- return ret;
-
- if (pcie->sr) {
-- if (pcie->ep_wakeup_capable) {
-- /*
-- * We are resuming from a suspend. In the suspend we
-- * did not disable the power supplies, so there is
-- * no need to enable them (and falsely increase their
-- * usage count).
-- */
-- pcie->ep_wakeup_capable = false;
-- } else {
-- ret = regulator_bulk_enable(pcie->sr->num_supplies,
-- pcie->sr->supplies);
-- if (ret) {
-- dev_err(dev, "Could not turn on regulators\n");
-- goto err_disable_clk;
-- }
-+ ret = regulator_bulk_enable(pcie->sr->num_supplies, pcie->sr->supplies);
-+ if (ret) {
-+ dev_err(dev, "Could not turn on regulators\n");
-+ goto err_disable_clk;
- }
- }
-
---
-2.35.1
-
+++ /dev/null
-From fd21f90b380e2c8aa73257396ab9f91a2baeb3d4 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 11 May 2022 15:18:56 -0500
-Subject: Revert "PCI: brcmstb: Split brcm_pcie_setup() into two funcs"
-
-From: Bjorn Helgaas <bhelgaas@google.com>
-
-[ Upstream commit f4fd559de3434c44bed1d2912bd0c75cfa42898b ]
-
-This reverts commit 830aa6f29f07a4e2f1a947dfa72b3ccddb46dd21.
-
-This is part of a revert of the following commits:
-
- 11ed8b8624b8 ("PCI: brcmstb: Do not turn off WOL regulators on suspend")
- 93e41f3fca3d ("PCI: brcmstb: Add control of subdevice voltage regulators")
- 67211aadcb4b ("PCI: brcmstb: Add mechanism to turn on subdev regulators")
- 830aa6f29f07 ("PCI: brcmstb: Split brcm_pcie_setup() into two funcs")
-
-Cyril reported that 830aa6f29f07 ("PCI: brcmstb: Split brcm_pcie_setup()
-into two funcs"), which appeared in v5.17-rc1, broke booting on the
-Raspberry Pi Compute Module 4. Apparently 830aa6f29f07 panics with an
-Asynchronous SError Interrupt, and after further commits here is a black
-screen on HDMI and no output on the serial console.
-
-This does not seem to affect the Raspberry Pi 4 B.
-
-Link: https://bugzilla.kernel.org/show_bug.cgi?id=215925
-Link: https://lore.kernel.org/r/20220511201856.808690-5-helgaas@kernel.org
-Reported-by: Cyril Brulebois <kibi@debian.org>
-Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/pci/controller/pcie-brcmstb.c | 65 +++++++++++----------------
- 1 file changed, 26 insertions(+), 39 deletions(-)
-
-diff --git a/drivers/pci/controller/pcie-brcmstb.c b/drivers/pci/controller/pcie-brcmstb.c
-index 0e8346114a8d..e61058e13818 100644
---- a/drivers/pci/controller/pcie-brcmstb.c
-+++ b/drivers/pci/controller/pcie-brcmstb.c
-@@ -926,9 +926,16 @@ static inline int brcm_pcie_get_rc_bar2_size_and_offset(struct brcm_pcie *pcie,
-
- static int brcm_pcie_setup(struct brcm_pcie *pcie)
- {
-+ struct pci_host_bridge *bridge = pci_host_bridge_from_priv(pcie);
- u64 rc_bar2_offset, rc_bar2_size;
- void __iomem *base = pcie->base;
-- int ret, memc;
-+ struct device *dev = pcie->dev;
-+ struct resource_entry *entry;
-+ bool ssc_good = false;
-+ struct resource *res;
-+ int num_out_wins = 0;
-+ u16 nlw, cls, lnksta;
-+ int i, ret, memc;
- u32 tmp, burst, aspm_support;
-
- /* Reset the bridge */
-@@ -1018,40 +1025,6 @@ static int brcm_pcie_setup(struct brcm_pcie *pcie)
- if (pcie->gen)
- brcm_pcie_set_gen(pcie, pcie->gen);
-
-- /* Don't advertise L0s capability if 'aspm-no-l0s' */
-- aspm_support = PCIE_LINK_STATE_L1;
-- if (!of_property_read_bool(pcie->np, "aspm-no-l0s"))
-- aspm_support |= PCIE_LINK_STATE_L0S;
-- tmp = readl(base + PCIE_RC_CFG_PRIV1_LINK_CAPABILITY);
-- u32p_replace_bits(&tmp, aspm_support,
-- PCIE_RC_CFG_PRIV1_LINK_CAPABILITY_ASPM_SUPPORT_MASK);
-- writel(tmp, base + PCIE_RC_CFG_PRIV1_LINK_CAPABILITY);
--
-- /*
-- * For config space accesses on the RC, show the right class for
-- * a PCIe-PCIe bridge (the default setting is to be EP mode).
-- */
-- tmp = readl(base + PCIE_RC_CFG_PRIV1_ID_VAL3);
-- u32p_replace_bits(&tmp, 0x060400,
-- PCIE_RC_CFG_PRIV1_ID_VAL3_CLASS_CODE_MASK);
-- writel(tmp, base + PCIE_RC_CFG_PRIV1_ID_VAL3);
--
-- return 0;
--}
--
--static int brcm_pcie_linkup(struct brcm_pcie *pcie)
--{
-- struct pci_host_bridge *bridge = pci_host_bridge_from_priv(pcie);
-- struct device *dev = pcie->dev;
-- void __iomem *base = pcie->base;
-- struct resource_entry *entry;
-- struct resource *res;
-- int num_out_wins = 0;
-- u16 nlw, cls, lnksta;
-- bool ssc_good = false;
-- u32 tmp;
-- int ret, i;
--
- /* Unassert the fundamental reset */
- pcie->perst_set(pcie, 0);
-
-@@ -1102,6 +1075,24 @@ static int brcm_pcie_linkup(struct brcm_pcie *pcie)
- num_out_wins++;
- }
-
-+ /* Don't advertise L0s capability if 'aspm-no-l0s' */
-+ aspm_support = PCIE_LINK_STATE_L1;
-+ if (!of_property_read_bool(pcie->np, "aspm-no-l0s"))
-+ aspm_support |= PCIE_LINK_STATE_L0S;
-+ tmp = readl(base + PCIE_RC_CFG_PRIV1_LINK_CAPABILITY);
-+ u32p_replace_bits(&tmp, aspm_support,
-+ PCIE_RC_CFG_PRIV1_LINK_CAPABILITY_ASPM_SUPPORT_MASK);
-+ writel(tmp, base + PCIE_RC_CFG_PRIV1_LINK_CAPABILITY);
-+
-+ /*
-+ * For config space accesses on the RC, show the right class for
-+ * a PCIe-PCIe bridge (the default setting is to be EP mode).
-+ */
-+ tmp = readl(base + PCIE_RC_CFG_PRIV1_ID_VAL3);
-+ u32p_replace_bits(&tmp, 0x060400,
-+ PCIE_RC_CFG_PRIV1_ID_VAL3_CLASS_CODE_MASK);
-+ writel(tmp, base + PCIE_RC_CFG_PRIV1_ID_VAL3);
-+
- if (pcie->ssc) {
- ret = brcm_pcie_set_ssc(pcie);
- if (ret == 0)
-@@ -1290,10 +1281,6 @@ static int brcm_pcie_resume(struct device *dev)
- if (ret)
- goto err_reset;
-
-- ret = brcm_pcie_linkup(pcie);
-- if (ret)
-- goto err_reset;
--
- if (pcie->msi)
- brcm_msi_set_regs(pcie->msi);
-
---
-2.35.1
-
+++ /dev/null
-From ff9cc6db2ae8c7886a8546a71cfd708c8a28a359 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 30 May 2022 11:27:05 +0200
-Subject: s390/gmap: voluntarily schedule during key setting
-
-From: Christian Borntraeger <borntraeger@linux.ibm.com>
-
-[ Upstream commit 6d5946274df1fff539a7eece458a43be733d1db8 ]
-
-With large and many guest with storage keys it is possible to create
-large latencies or stalls during initial key setting:
-
-rcu: INFO: rcu_sched self-detected stall on CPU
-rcu: 18-....: (2099 ticks this GP) idle=54e/1/0x4000000000000002 softirq=35598716/35598716 fqs=998
- (t=2100 jiffies g=155867385 q=20879)
-Task dump for CPU 18:
-CPU 1/KVM R running task 0 1030947 256019 0x06000004
-Call Trace:
-sched_show_task
-rcu_dump_cpu_stacks
-rcu_sched_clock_irq
-update_process_times
-tick_sched_handle
-tick_sched_timer
-__hrtimer_run_queues
-hrtimer_interrupt
-do_IRQ
-ext_int_handler
-ptep_zap_key
-
-The mmap lock is held during the page walking but since this is a
-semaphore scheduling is still possible. Same for the kvm srcu.
-To minimize overhead do this on every segment table entry or large page.
-
-Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
-Reviewed-by: Alexander Gordeev <agordeev@linux.ibm.com>
-Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
-Link: https://lore.kernel.org/r/20220530092706.11637-2-borntraeger@linux.ibm.com
-Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
-Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/s390/mm/gmap.c | 14 ++++++++++++++
- 1 file changed, 14 insertions(+)
-
-diff --git a/arch/s390/mm/gmap.c b/arch/s390/mm/gmap.c
-index 1ac73917a8d3..b8ae4a4aa2ba 100644
---- a/arch/s390/mm/gmap.c
-+++ b/arch/s390/mm/gmap.c
-@@ -2608,6 +2608,18 @@ static int __s390_enable_skey_pte(pte_t *pte, unsigned long addr,
- return 0;
- }
-
-+/*
-+ * Give a chance to schedule after setting a key to 256 pages.
-+ * We only hold the mm lock, which is a rwsem and the kvm srcu.
-+ * Both can sleep.
-+ */
-+static int __s390_enable_skey_pmd(pmd_t *pmd, unsigned long addr,
-+ unsigned long next, struct mm_walk *walk)
-+{
-+ cond_resched();
-+ return 0;
-+}
-+
- static int __s390_enable_skey_hugetlb(pte_t *pte, unsigned long addr,
- unsigned long hmask, unsigned long next,
- struct mm_walk *walk)
-@@ -2630,12 +2642,14 @@ static int __s390_enable_skey_hugetlb(pte_t *pte, unsigned long addr,
- end = start + HPAGE_SIZE - 1;
- __storage_key_init_range(start, end);
- set_bit(PG_arch_1, &page->flags);
-+ cond_resched();
- return 0;
- }
-
- static const struct mm_walk_ops enable_skey_walk_ops = {
- .hugetlb_entry = __s390_enable_skey_hugetlb,
- .pte_entry = __s390_enable_skey_pte,
-+ .pmd_entry = __s390_enable_skey_pmd,
- };
-
- int s390_enable_skey(void)
---
-2.35.1
-
+++ /dev/null
-From 40c35aab8b96b8507abc830d2a897820df1d1b6f Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 23 May 2022 14:02:44 +0200
-Subject: scsi: myrb: Fix up null pointer access on myrb_cleanup()
-
-From: Hannes Reinecke <hare@suse.de>
-
-[ Upstream commit f9f0a46141e2e39bedb4779c88380d1b5f018c14 ]
-
-When myrb_probe() fails the callback might not be set, so we need to
-validate the 'disable_intr' callback in myrb_cleanup() to not cause a null
-pointer exception. And while at it do not call myrb_cleanup() if we cannot
-enable the PCI device at all.
-
-Link: https://lore.kernel.org/r/20220523120244.99515-1-hare@suse.de
-Reported-by: Zheyu Ma <zheyuma97@gmail.com>
-Tested-by: Zheyu Ma <zheyuma97@gmail.com>
-Signed-off-by: Hannes Reinecke <hare@suse.de>
-Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/scsi/myrb.c | 11 ++++++++---
- 1 file changed, 8 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/scsi/myrb.c b/drivers/scsi/myrb.c
-index 71585528e8db..e885c1dbf61f 100644
---- a/drivers/scsi/myrb.c
-+++ b/drivers/scsi/myrb.c
-@@ -1239,7 +1239,8 @@ static void myrb_cleanup(struct myrb_hba *cb)
- myrb_unmap(cb);
-
- if (cb->mmio_base) {
-- cb->disable_intr(cb->io_base);
-+ if (cb->disable_intr)
-+ cb->disable_intr(cb->io_base);
- iounmap(cb->mmio_base);
- }
- if (cb->irq)
-@@ -3413,9 +3414,13 @@ static struct myrb_hba *myrb_detect(struct pci_dev *pdev,
- mutex_init(&cb->dcmd_mutex);
- mutex_init(&cb->dma_mutex);
- cb->pdev = pdev;
-+ cb->host = shost;
-
-- if (pci_enable_device(pdev))
-- goto failure;
-+ if (pci_enable_device(pdev)) {
-+ dev_err(&pdev->dev, "Failed to enable PCI device\n");
-+ scsi_host_put(shost);
-+ return NULL;
-+ }
-
- if (privdata->hw_init == DAC960_PD_hw_init ||
- privdata->hw_init == DAC960_P_hw_init) {
---
-2.35.1
-
+++ /dev/null
-From c56389e9d140ff3af4a0605d150a5971e613d3aa Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 6 May 2022 23:39:24 +0206
-Subject: serial: msm_serial: disable interrupts in __msm_console_write()
-
-From: John Ogness <john.ogness@linutronix.de>
-
-[ Upstream commit aabdbb1b7a5819e18c403334a31fb0cc2c06ad41 ]
-
-__msm_console_write() assumes that interrupts are disabled, but
-with threaded console printers it is possible that the write()
-callback of the console is called with interrupts enabled.
-
-Explicitly disable interrupts using local_irq_save() to preserve
-the assumed context.
-
-Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
-Reviewed-by: Petr Mladek <pmladek@suse.com>
-Signed-off-by: John Ogness <john.ogness@linutronix.de>
-Link: https://lore.kernel.org/r/20220506213324.470461-1-john.ogness@linutronix.de
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/tty/serial/msm_serial.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/drivers/tty/serial/msm_serial.c b/drivers/tty/serial/msm_serial.c
-index 23c94b927776..e676ec761f18 100644
---- a/drivers/tty/serial/msm_serial.c
-+++ b/drivers/tty/serial/msm_serial.c
-@@ -1599,6 +1599,7 @@ static inline struct uart_port *msm_get_port_from_line(unsigned int line)
- static void __msm_console_write(struct uart_port *port, const char *s,
- unsigned int count, bool is_uartdm)
- {
-+ unsigned long flags;
- int i;
- int num_newlines = 0;
- bool replaced = false;
-@@ -1616,6 +1617,8 @@ static void __msm_console_write(struct uart_port *port, const char *s,
- num_newlines++;
- count += num_newlines;
-
-+ local_irq_save(flags);
-+
- if (port->sysrq)
- locked = 0;
- else if (oops_in_progress)
-@@ -1661,6 +1664,8 @@ static void __msm_console_write(struct uart_port *port, const char *s,
-
- if (locked)
- spin_unlock(&port->lock);
-+
-+ local_irq_restore(flags);
- }
-
- static void msm_console_write(struct console *co, const char *s,
---
-2.35.1
-
nfp-flower-restructure-flow-key-for-gre-vlan-combina.patch
net-seg6-fix-seg6_lookup_any_nexthop-to-handle-vrfs-.patch
iov_iter-fix-iter_xarray_get_pages-_alloc.patch
-iio-dummy-iio_simple_dummy-check-the-return-value-of.patch
-staging-rtl8712-fix-a-potential-memory-leak-in-r871x.patch
-iio-st_sensors-add-a-local-lock-for-protecting-odr.patch
-lkdtm-usercopy-expand-size-of-out-of-frame-object.patch
-drivers-staging-rtl8723bs-fix-deadlock-in-rtw_survey.patch
-drivers-staging-rtl8192bs-fix-deadlock-in-rtw_joinbs.patch
-drivers-staging-rtl8192eu-fix-deadlock-in-rtw_joinbs.patch
-tty-synclink_gt-fix-null-pointer-dereference-in-slgt.patch
-tty-fix-a-possible-resource-leak-in-icom_probe.patch
-thunderbolt-use-different-lane-for-second-displaypor.patch
-drivers-staging-rtl8192u-fix-deadlock-in-ieee80211_b.patch
-drivers-staging-rtl8192e-fix-deadlock-in-rtllib_beac.patch
-usb-host-isp116x-check-return-value-after-calling-pl.patch
-drivers-tty-serial-fix-deadlock-in-sa1100_set_termio.patch
-drivers-usb-host-fix-deadlock-in-oxu_bus_suspend.patch
-usb-hcd-pci-fully-suspend-across-freeze-thaw-cycle.patch
-char-xillybus-fix-a-refcount-leak-in-cleanup_dev.patch
-sysrq-do-not-omit-current-cpu-when-showing-backtrace.patch
-usb-dwc2-gadget-don-t-reset-gadget-s-driver-bus.patch
-usb-dwc3-host-stop-setting-the-acpi-companion.patch
-usb-dwc3-gadget-only-end-transfer-for-ep0-data-phase.patch
-soundwire-qcom-adjust-autoenumeration-timeout.patch
-misc-rtsx-set-null-intfdata-when-probe-fails.patch
-extcon-fix-extcon_get_extcon_dev-error-handling.patch
-extcon-modify-extcon-device-to-be-created-after-driv.patch
-clocksource-drivers-sp804-avoid-error-on-multiple-in.patch
-staging-rtl8712-fix-uninit-value-in-usb_read8-and-fr.patch
-staging-rtl8712-fix-uninit-value-in-r871xu_drv_init.patch
-serial-msm_serial-disable-interrupts-in-__msm_consol.patch
-kernfs-separate-kernfs_pr_cont_buf-and-rename_lock.patch
-watchdog-wdat_wdt-stop-watchdog-when-rebooting-the-s.patch
-ksmbd-smbd-fix-connection-dropped-issue.patch
-md-protect-md_unregister_thread-from-reentrancy.patch
-asoc-sof-amd-fixed-build-error.patch
-scsi-myrb-fix-up-null-pointer-access-on-myrb_cleanup.patch
-asoc-rt5640-do-not-manipulate-pin-platform-clock-if-.patch
-revert-net-af_key-add-check-for-pfkey_broadcast-in-f.patch
-ceph-allow-ceph.dir.rctime-xattr-to-be-updatable.patch
-ceph-flush-the-mdlog-for-filesystem-sync.patch
-ceph-fix-possible-deadlock-when-holding-fwb-to-get-i.patch
-net-neigh-set-lower-cap-for-neigh_managed_work-rearm.patch
-drm-amd-display-check-if-modulo-is-0-before-dividing.patch
-drm-amd-display-check-zero-planes-for-otg-disable-w-.patch
-drm-radeon-fix-a-possible-null-pointer-dereference.patch
-drm-amd-pm-fix-a-potential-gpu_metrics_table-memory-.patch
-drm-amd-pm-fix-missing-thermal-throttler-status.patch
-drm-amd-pm-correct-the-metrics-version-for-smu-11.0..patch
-um-line-use-separate-irqs-per-line.patch
-modpost-fix-undefined-behavior-of-is_arm_mapping_sym.patch
-objtool-mark-__ubsan_handle_builtin_unreachable-as-n.patch
-x86-cpu-elide-kcsan-for-cpu_has-and-friends.patch
-jump_label-noinstr-avoid-instrumentation-for-jump_la.patch
-nbd-call-genl_unregister_family-first-in-nbd_cleanup.patch
-nbd-fix-race-between-nbd_alloc_config-and-module-rem.patch
-nbd-fix-io-hung-while-disconnecting-device.patch
-revert-pci-brcmstb-do-not-turn-off-wol-regulators-on.patch
-revert-pci-brcmstb-add-control-of-subdevice-voltage-.patch
-revert-pci-brcmstb-add-mechanism-to-turn-on-subdev-r.patch
-revert-pci-brcmstb-split-brcm_pcie_setup-into-two-fu.patch
-cifs-fix-potential-deadlock-in-direct-reclaim.patch
-s390-gmap-voluntarily-schedule-during-key-setting.patch
-cifs-version-operations-for-smb20-unneeded-when-lega.patch
-drm-amd-pm-use-bitmap_-from-to-_arr32-where-appropri.patch
-nodemask-fix-return-values-to-be-unsigned.patch
-iio-dummy-iio_simple_dummy-check-the-return-value-of.patch-12382
-staging-rtl8712-fix-a-potential-memory-leak-in-r871x.patch-18885
-iio-st_sensors-add-a-local-lock-for-protecting-odr.patch-18728
-lkdtm-usercopy-expand-size-of-out-of-frame-object.patch-17562
-drivers-staging-rtl8723bs-fix-deadlock-in-rtw_survey.patch-9809
-drivers-staging-rtl8192bs-fix-deadlock-in-rtw_joinbs.patch-7875
-drivers-staging-rtl8192eu-fix-deadlock-in-rtw_joinbs.patch-30294
-tty-synclink_gt-fix-null-pointer-dereference-in-slgt.patch-22280
-tty-fix-a-possible-resource-leak-in-icom_probe.patch-25309
-thunderbolt-use-different-lane-for-second-displaypor.patch-24126
-drivers-staging-rtl8192u-fix-deadlock-in-ieee80211_b.patch-29219
-drivers-staging-rtl8192e-fix-deadlock-in-rtllib_beac.patch-11615
-usb-host-isp116x-check-return-value-after-calling-pl.patch-10409
-drivers-tty-serial-fix-deadlock-in-sa1100_set_termio.patch-18469
-drivers-usb-host-fix-deadlock-in-oxu_bus_suspend.patch-15886
-usb-hcd-pci-fully-suspend-across-freeze-thaw-cycle.patch-10756
-char-xillybus-fix-a-refcount-leak-in-cleanup_dev.patch-28896
-sysrq-do-not-omit-current-cpu-when-showing-backtrace.patch-5482
-usb-dwc2-gadget-don-t-reset-gadget-s-driver-bus.patch-18859
-usb-dwc3-host-stop-setting-the-acpi-companion.patch-8895
-usb-dwc3-gadget-only-end-transfer-for-ep0-data-phase.patch-30224
-soundwire-qcom-adjust-autoenumeration-timeout.patch-10713
-misc-rtsx-set-null-intfdata-when-probe-fails.patch-23910
-extcon-fix-extcon_get_extcon_dev-error-handling.patch-1431
-extcon-modify-extcon-device-to-be-created-after-driv.patch-12137
-clocksource-drivers-sp804-avoid-error-on-multiple-in.patch-10102
-staging-rtl8712-fix-uninit-value-in-usb_read8-and-fr.patch-20736
-staging-rtl8712-fix-uninit-value-in-r871xu_drv_init.patch-838
-serial-msm_serial-disable-interrupts-in-__msm_consol.patch-23259
-kernfs-separate-kernfs_pr_cont_buf-and-rename_lock.patch-29269
-watchdog-wdat_wdt-stop-watchdog-when-rebooting-the-s.patch-2058
-ksmbd-smbd-fix-connection-dropped-issue.patch-32654
-md-protect-md_unregister_thread-from-reentrancy.patch-14889
-asoc-sof-amd-fixed-build-error.patch-32099
-scsi-myrb-fix-up-null-pointer-access-on-myrb_cleanup.patch-14900
-asoc-rt5640-do-not-manipulate-pin-platform-clock-if-.patch-25457
-revert-net-af_key-add-check-for-pfkey_broadcast-in-f.patch-5154
-ceph-allow-ceph.dir.rctime-xattr-to-be-updatable.patch-23953
-ceph-flush-the-mdlog-for-filesystem-sync.patch-6835
-ceph-fix-possible-deadlock-when-holding-fwb-to-get-i.patch-24843
-net-neigh-set-lower-cap-for-neigh_managed_work-rearm.patch-12422
-drm-amd-display-check-if-modulo-is-0-before-dividing.patch-17317
-drm-amd-display-check-zero-planes-for-otg-disable-w-.patch-24858
-drm-radeon-fix-a-possible-null-pointer-dereference.patch-12982
-drm-amd-pm-fix-a-potential-gpu_metrics_table-memory-.patch-25253
-drm-amd-pm-fix-missing-thermal-throttler-status.patch-5045
-drm-amd-pm-correct-the-metrics-version-for-smu-11.0..patch-10653
-um-line-use-separate-irqs-per-line.patch-21021
-modpost-fix-undefined-behavior-of-is_arm_mapping_sym.patch-13820
-objtool-mark-__ubsan_handle_builtin_unreachable-as-n.patch-26323
-x86-cpu-elide-kcsan-for-cpu_has-and-friends.patch-25341
-jump_label-noinstr-avoid-instrumentation-for-jump_la.patch-1843
-nbd-call-genl_unregister_family-first-in-nbd_cleanup.patch-18536
-nbd-fix-race-between-nbd_alloc_config-and-module-rem.patch-11645
-nbd-fix-io-hung-while-disconnecting-device.patch-15469
-revert-pci-brcmstb-do-not-turn-off-wol-regulators-on.patch-2764
-revert-pci-brcmstb-add-control-of-subdevice-voltage-.patch-18657
-revert-pci-brcmstb-add-mechanism-to-turn-on-subdev-r.patch-31265
-revert-pci-brcmstb-split-brcm_pcie_setup-into-two-fu.patch-136
-cifs-fix-potential-deadlock-in-direct-reclaim.patch-20282
-s390-gmap-voluntarily-schedule-during-key-setting.patch-22453
-cifs-version-operations-for-smb20-unneeded-when-lega.patch-10203
-drm-amd-pm-use-bitmap_-from-to-_arr32-where-appropri.patch-23458
-nodemask-fix-return-values-to-be-unsigned.patch-6108
-iio-dummy-iio_simple_dummy-check-the-return-value-of.patch-25290
-staging-rtl8712-fix-a-potential-memory-leak-in-r871x.patch-16672
-iio-st_sensors-add-a-local-lock-for-protecting-odr.patch-13697
-lkdtm-usercopy-expand-size-of-out-of-frame-object.patch-548
-drivers-staging-rtl8723bs-fix-deadlock-in-rtw_survey.patch-7816
-drivers-staging-rtl8192bs-fix-deadlock-in-rtw_joinbs.patch-15932
-drivers-staging-rtl8192eu-fix-deadlock-in-rtw_joinbs.patch-15459
-tty-synclink_gt-fix-null-pointer-dereference-in-slgt.patch-29302
-tty-fix-a-possible-resource-leak-in-icom_probe.patch-8143
-thunderbolt-use-different-lane-for-second-displaypor.patch-17165
-drivers-staging-rtl8192u-fix-deadlock-in-ieee80211_b.patch-32201
-drivers-staging-rtl8192e-fix-deadlock-in-rtllib_beac.patch-6301
-usb-host-isp116x-check-return-value-after-calling-pl.patch-16939
-drivers-tty-serial-fix-deadlock-in-sa1100_set_termio.patch-912
-drivers-usb-host-fix-deadlock-in-oxu_bus_suspend.patch-31448
-usb-hcd-pci-fully-suspend-across-freeze-thaw-cycle.patch-17233
-char-xillybus-fix-a-refcount-leak-in-cleanup_dev.patch-25315
-sysrq-do-not-omit-current-cpu-when-showing-backtrace.patch-30024
-usb-dwc2-gadget-don-t-reset-gadget-s-driver-bus.patch-16939
-usb-dwc3-host-stop-setting-the-acpi-companion.patch-9952
-usb-dwc3-gadget-only-end-transfer-for-ep0-data-phase.patch-18553
-soundwire-qcom-adjust-autoenumeration-timeout.patch-21204
-misc-rtsx-set-null-intfdata-when-probe-fails.patch-11863
-extcon-fix-extcon_get_extcon_dev-error-handling.patch-13126
-extcon-modify-extcon-device-to-be-created-after-driv.patch-18947
-clocksource-drivers-sp804-avoid-error-on-multiple-in.patch-20437
-staging-rtl8712-fix-uninit-value-in-usb_read8-and-fr.patch-12512
-staging-rtl8712-fix-uninit-value-in-r871xu_drv_init.patch-6562
-serial-msm_serial-disable-interrupts-in-__msm_consol.patch-27135
-kernfs-separate-kernfs_pr_cont_buf-and-rename_lock.patch-22025
-watchdog-wdat_wdt-stop-watchdog-when-rebooting-the-s.patch-6749
-ksmbd-smbd-fix-connection-dropped-issue.patch-4395
-md-protect-md_unregister_thread-from-reentrancy.patch-20545
-asoc-sof-amd-fixed-build-error.patch-9931
-scsi-myrb-fix-up-null-pointer-access-on-myrb_cleanup.patch-8779
-asoc-rt5640-do-not-manipulate-pin-platform-clock-if-.patch-23345
-revert-net-af_key-add-check-for-pfkey_broadcast-in-f.patch-32535
-ceph-allow-ceph.dir.rctime-xattr-to-be-updatable.patch-9110
-ceph-flush-the-mdlog-for-filesystem-sync.patch-30361
-ceph-fix-possible-deadlock-when-holding-fwb-to-get-i.patch-25948
-net-neigh-set-lower-cap-for-neigh_managed_work-rearm.patch-2075
-drm-amd-display-check-if-modulo-is-0-before-dividing.patch-30941
-drm-amd-display-check-zero-planes-for-otg-disable-w-.patch-18902
-drm-radeon-fix-a-possible-null-pointer-dereference.patch-25827
-drm-amd-pm-fix-a-potential-gpu_metrics_table-memory-.patch-9143
-drm-amd-pm-fix-missing-thermal-throttler-status.patch-20182
-drm-amd-pm-correct-the-metrics-version-for-smu-11.0..patch-8466
-um-line-use-separate-irqs-per-line.patch-6588
-modpost-fix-undefined-behavior-of-is_arm_mapping_sym.patch-14918
-objtool-mark-__ubsan_handle_builtin_unreachable-as-n.patch-15495
-x86-cpu-elide-kcsan-for-cpu_has-and-friends.patch-12716
-jump_label-noinstr-avoid-instrumentation-for-jump_la.patch-16434
-nbd-call-genl_unregister_family-first-in-nbd_cleanup.patch-3718
-nbd-fix-race-between-nbd_alloc_config-and-module-rem.patch-3787
-nbd-fix-io-hung-while-disconnecting-device.patch-32202
-revert-pci-brcmstb-do-not-turn-off-wol-regulators-on.patch-30181
-revert-pci-brcmstb-add-control-of-subdevice-voltage-.patch-30306
-revert-pci-brcmstb-add-mechanism-to-turn-on-subdev-r.patch-20492
-revert-pci-brcmstb-split-brcm_pcie_setup-into-two-fu.patch-12929
-cifs-fix-potential-deadlock-in-direct-reclaim.patch-13026
-s390-gmap-voluntarily-schedule-during-key-setting.patch-20205
-cifs-version-operations-for-smb20-unneeded-when-lega.patch-23927
-drm-amd-pm-use-bitmap_-from-to-_arr32-where-appropri.patch-14562
-nodemask-fix-return-values-to-be-unsigned.patch-29450
+++ /dev/null
-From 24d99b30b2ac263d7ed85ca70b9688bf65db3059 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 6 May 2022 09:47:05 +0100
-Subject: soundwire: qcom: adjust autoenumeration timeout
-
-From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
-
-[ Upstream commit 74da272400b46f2e898f115d1b1cd60828766919 ]
-
-Currently timeout for autoenumeration during probe and bus reset is set to
-2 secs which is really a big value. This can have an adverse effect on
-boot time if the slave device is not ready/reset.
-This was the case with wcd938x which was not reset yet but we spent 2
-secs waiting in the soundwire controller probe. Reduce this time to
-1/10 of Hz which should be good enough time to finish autoenumeration
-if any slaves are available on the bus.
-
-Reported-by: Srinivasa Rao Mandadapu <quic_srivasam@quicinc.com>
-Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
-Link: https://lore.kernel.org/r/20220506084705.18525-1-srinivas.kandagatla@linaro.org
-Signed-off-by: Vinod Koul <vkoul@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/soundwire/qcom.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/soundwire/qcom.c b/drivers/soundwire/qcom.c
-index b38525b35bec..7b8ef45abee4 100644
---- a/drivers/soundwire/qcom.c
-+++ b/drivers/soundwire/qcom.c
-@@ -105,7 +105,7 @@
-
- #define SWRM_SPECIAL_CMD_ID 0xF
- #define MAX_FREQ_NUM 1
--#define TIMEOUT_MS (2 * HZ)
-+#define TIMEOUT_MS 100
- #define QCOM_SWRM_MAX_RD_LEN 0x1
- #define QCOM_SDW_MAX_PORTS 14
- #define DEFAULT_CLK_FREQ 9600000
---
-2.35.1
-
+++ /dev/null
-From 82d072fde9674c66ae3323816c99f0d044764945 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 5 Apr 2022 12:43:07 +0800
-Subject: staging: rtl8712: fix a potential memory leak in r871xu_drv_init()
-
-From: Xiaoke Wang <xkernel.wang@foxmail.com>
-
-[ Upstream commit 7288ff561de650d4139fab80e9cb0da9b5b32434 ]
-
-In r871xu_drv_init(), if r8712_init_drv_sw() fails, then the memory
-allocated by r8712_alloc_io_queue() in r8712_usb_dvobj_init() is not
-properly released as there is no action will be performed by
-r8712_usb_dvobj_deinit().
-To properly release it, we should call r8712_free_io_queue() in
-r8712_usb_dvobj_deinit().
-
-Besides, in r871xu_dev_remove(), r8712_usb_dvobj_deinit() will be called
-by r871x_dev_unload() under condition `padapter->bup` and
-r8712_free_io_queue() is called by r8712_free_drv_sw().
-However, r8712_usb_dvobj_deinit() does not rely on `padapter->bup` and
-calling r8712_free_io_queue() in r8712_free_drv_sw() is negative for
-better understading the code.
-So I move r8712_usb_dvobj_deinit() into r871xu_dev_remove(), and remove
-r8712_free_io_queue() from r8712_free_drv_sw().
-
-Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
-Signed-off-by: Xiaoke Wang <xkernel.wang@foxmail.com>
-Link: https://lore.kernel.org/r/tencent_B8048C592777830380A23A7C4409F9DF1305@qq.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/staging/rtl8712/os_intfs.c | 1 -
- drivers/staging/rtl8712/usb_intf.c | 6 +++---
- 2 files changed, 3 insertions(+), 4 deletions(-)
-
-diff --git a/drivers/staging/rtl8712/os_intfs.c b/drivers/staging/rtl8712/os_intfs.c
-index d15d52c0d1a7..003e97205124 100644
---- a/drivers/staging/rtl8712/os_intfs.c
-+++ b/drivers/staging/rtl8712/os_intfs.c
-@@ -332,7 +332,6 @@ void r8712_free_drv_sw(struct _adapter *padapter)
- r8712_free_evt_priv(&padapter->evtpriv);
- r8712_DeInitSwLeds(padapter);
- r8712_free_mlme_priv(&padapter->mlmepriv);
-- r8712_free_io_queue(padapter);
- _free_xmit_priv(&padapter->xmitpriv);
- _r8712_free_sta_priv(&padapter->stapriv);
- _r8712_free_recv_priv(&padapter->recvpriv);
-diff --git a/drivers/staging/rtl8712/usb_intf.c b/drivers/staging/rtl8712/usb_intf.c
-index ee4c61f85a07..56450ede9f23 100644
---- a/drivers/staging/rtl8712/usb_intf.c
-+++ b/drivers/staging/rtl8712/usb_intf.c
-@@ -265,6 +265,7 @@ static uint r8712_usb_dvobj_init(struct _adapter *padapter)
-
- static void r8712_usb_dvobj_deinit(struct _adapter *padapter)
- {
-+ r8712_free_io_queue(padapter);
- }
-
- void rtl871x_intf_stop(struct _adapter *padapter)
-@@ -302,9 +303,6 @@ void r871x_dev_unload(struct _adapter *padapter)
- rtl8712_hal_deinit(padapter);
- }
-
-- /*s6.*/
-- if (padapter->dvobj_deinit)
-- padapter->dvobj_deinit(padapter);
- padapter->bup = false;
- }
- }
-@@ -607,6 +605,8 @@ static void r871xu_dev_remove(struct usb_interface *pusb_intf)
- /* Stop driver mlme relation timer */
- r8712_stop_drv_timers(padapter);
- r871x_dev_unload(padapter);
-+ if (padapter->dvobj_deinit)
-+ padapter->dvobj_deinit(padapter);
- r8712_free_drv_sw(padapter);
- free_netdev(pnetdev);
-
---
-2.35.1
-
+++ /dev/null
-From a86a6788a10792b2e38d717065cb93ae71af9d63 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 16 May 2022 17:22:41 +0800
-Subject: staging: rtl8712: fix uninit-value in r871xu_drv_init()
-
-From: Wang Cheng <wanngchenng@gmail.com>
-
-[ Upstream commit 0458e5428e5e959d201a40ffe71d762a79ecedc4 ]
-
-When 'tmpU1b' returns from r8712_read8(padapter, EE_9346CR) is 0,
-'mac[6]' will not be initialized.
-
-BUG: KMSAN: uninit-value in r871xu_drv_init+0x2d54/0x3070 drivers/staging/rtl8712/usb_intf.c:541
- r871xu_drv_init+0x2d54/0x3070 drivers/staging/rtl8712/usb_intf.c:541
- usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396
- really_probe+0x653/0x14b0 drivers/base/dd.c:596
- __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752
- driver_probe_device drivers/base/dd.c:782 [inline]
- __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899
- bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427
- __device_attach+0x593/0x8e0 drivers/base/dd.c:970
- device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017
- bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487
- device_add+0x1fff/0x26e0 drivers/base/core.c:3405
- usb_set_configuration+0x37e9/0x3ed0 drivers/usb/core/message.c:2170
- usb_generic_driver_probe+0x13c/0x300 drivers/usb/core/generic.c:238
- usb_probe_device+0x309/0x570 drivers/usb/core/driver.c:293
- really_probe+0x653/0x14b0 drivers/base/dd.c:596
- __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752
- driver_probe_device drivers/base/dd.c:782 [inline]
- __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899
- bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427
- __device_attach+0x593/0x8e0 drivers/base/dd.c:970
- device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017
- bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487
- device_add+0x1fff/0x26e0 drivers/base/core.c:3405
- usb_new_device+0x1b8e/0x2950 drivers/usb/core/hub.c:2566
- hub_port_connect drivers/usb/core/hub.c:5358 [inline]
- hub_port_connect_change drivers/usb/core/hub.c:5502 [inline]
- port_event drivers/usb/core/hub.c:5660 [inline]
- hub_event+0x58e3/0x89e0 drivers/usb/core/hub.c:5742
- process_one_work+0xdb6/0x1820 kernel/workqueue.c:2307
- worker_thread+0x10b3/0x21e0 kernel/workqueue.c:2454
- kthread+0x3c7/0x500 kernel/kthread.c:377
- ret_from_fork+0x1f/0x30
-
-Local variable mac created at:
- r871xu_drv_init+0x1771/0x3070 drivers/staging/rtl8712/usb_intf.c:394
- usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396
-
-KMSAN: uninit-value in r871xu_drv_init
-https://syzkaller.appspot.com/bug?id=3cd92b1d85428b128503bfa7a250294c9ae00bd8
-
-Reported-by: <syzbot+6f5ecd144854c0d8580b@syzkaller.appspotmail.com>
-Tested-by: <syzbot+6f5ecd144854c0d8580b@syzkaller.appspotmail.com>
-Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
-Signed-off-by: Wang Cheng <wanngchenng@gmail.com>
-Link: https://lore.kernel.org/r/14c3886173dfa4597f0704547c414cfdbcd11d16.1652618244.git.wanngchenng@gmail.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/staging/rtl8712/usb_intf.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/staging/rtl8712/usb_intf.c b/drivers/staging/rtl8712/usb_intf.c
-index 56450ede9f23..1ff3e2658e77 100644
---- a/drivers/staging/rtl8712/usb_intf.c
-+++ b/drivers/staging/rtl8712/usb_intf.c
-@@ -536,13 +536,13 @@ static int r871xu_drv_init(struct usb_interface *pusb_intf,
- } else {
- AutoloadFail = false;
- }
-- if (((mac[0] == 0xff) && (mac[1] == 0xff) &&
-+ if ((!AutoloadFail) ||
-+ ((mac[0] == 0xff) && (mac[1] == 0xff) &&
- (mac[2] == 0xff) && (mac[3] == 0xff) &&
- (mac[4] == 0xff) && (mac[5] == 0xff)) ||
- ((mac[0] == 0x00) && (mac[1] == 0x00) &&
- (mac[2] == 0x00) && (mac[3] == 0x00) &&
-- (mac[4] == 0x00) && (mac[5] == 0x00)) ||
-- (!AutoloadFail)) {
-+ (mac[4] == 0x00) && (mac[5] == 0x00))) {
- mac[0] = 0x00;
- mac[1] = 0xe0;
- mac[2] = 0x4c;
---
-2.35.1
-
+++ /dev/null
-From b12de292718eb0d00ea937dbe849dc6befdf2f11 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 16 May 2022 17:22:23 +0800
-Subject: staging: rtl8712: fix uninit-value in usb_read8() and friends
-
-From: Wang Cheng <wanngchenng@gmail.com>
-
-[ Upstream commit d1b57669732d09da7e13ef86d058dab0cd57f6e0 ]
-
-When r8712_usbctrl_vendorreq() returns negative, 'data' in
-usb_read{8,16,32} will not be initialized.
-
-BUG: KMSAN: uninit-value in string_nocheck lib/vsprintf.c:643 [inline]
-BUG: KMSAN: uninit-value in string+0x4ec/0x6f0 lib/vsprintf.c:725
- string_nocheck lib/vsprintf.c:643 [inline]
- string+0x4ec/0x6f0 lib/vsprintf.c:725
- vsnprintf+0x2222/0x3650 lib/vsprintf.c:2806
- va_format lib/vsprintf.c:1704 [inline]
- pointer+0x18e6/0x1f70 lib/vsprintf.c:2443
- vsnprintf+0x1a9b/0x3650 lib/vsprintf.c:2810
- vprintk_store+0x537/0x2150 kernel/printk/printk.c:2158
- vprintk_emit+0x28b/0xab0 kernel/printk/printk.c:2256
- dev_vprintk_emit+0x5ef/0x6d0 drivers/base/core.c:4604
- dev_printk_emit+0x1dd/0x21f drivers/base/core.c:4615
- __dev_printk+0x3be/0x440 drivers/base/core.c:4627
- _dev_info+0x1ea/0x22f drivers/base/core.c:4673
- r871xu_drv_init+0x1929/0x3070 drivers/staging/rtl8712/usb_intf.c:401
- usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396
- really_probe+0x6c7/0x1350 drivers/base/dd.c:621
- __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752
- driver_probe_device drivers/base/dd.c:782 [inline]
- __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899
- bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427
- __device_attach+0x593/0x8e0 drivers/base/dd.c:970
- device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017
- bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487
- device_add+0x1fff/0x26e0 drivers/base/core.c:3405
- usb_set_configuration+0x37e9/0x3ed0 drivers/usb/core/message.c:2170
- usb_generic_driver_probe+0x13c/0x300 drivers/usb/core/generic.c:238
- usb_probe_device+0x309/0x570 drivers/usb/core/driver.c:293
- really_probe+0x6c7/0x1350 drivers/base/dd.c:621
- __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752
- driver_probe_device drivers/base/dd.c:782 [inline]
- __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899
- bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427
- __device_attach+0x593/0x8e0 drivers/base/dd.c:970
- device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017
- bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487
- device_add+0x1fff/0x26e0 drivers/base/core.c:3405
- usb_new_device+0x1b91/0x2950 drivers/usb/core/hub.c:2566
- hub_port_connect drivers/usb/core/hub.c:5363 [inline]
- hub_port_connect_change drivers/usb/core/hub.c:5507 [inline]
- port_event drivers/usb/core/hub.c:5665 [inline]
- hub_event+0x58e3/0x89e0 drivers/usb/core/hub.c:5747
- process_one_work+0xdb6/0x1820 kernel/workqueue.c:2289
- worker_thread+0x10d0/0x2240 kernel/workqueue.c:2436
- kthread+0x3c7/0x500 kernel/kthread.c:376
- ret_from_fork+0x1f/0x30
-
-Local variable data created at:
- usb_read8+0x5d/0x130 drivers/staging/rtl8712/usb_ops.c:33
- r8712_read8+0xa5/0xd0 drivers/staging/rtl8712/rtl8712_io.c:29
-
-KMSAN: uninit-value in r871xu_drv_init
-https://syzkaller.appspot.com/bug?id=3cd92b1d85428b128503bfa7a250294c9ae00bd8
-
-Reported-by: <syzbot+6f5ecd144854c0d8580b@syzkaller.appspotmail.com>
-Tested-by: <syzbot+6f5ecd144854c0d8580b@syzkaller.appspotmail.com>
-Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
-Signed-off-by: Wang Cheng <wanngchenng@gmail.com>
-Link: https://lore.kernel.org/r/b9b7a6ee02c02aa28054f5cf16129977775f3cd9.1652618244.git.wanngchenng@gmail.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/staging/rtl8712/usb_ops.c | 27 ++++++++++++++++++---------
- 1 file changed, 18 insertions(+), 9 deletions(-)
-
-diff --git a/drivers/staging/rtl8712/usb_ops.c b/drivers/staging/rtl8712/usb_ops.c
-index e64845e6adf3..af9966d03979 100644
---- a/drivers/staging/rtl8712/usb_ops.c
-+++ b/drivers/staging/rtl8712/usb_ops.c
-@@ -29,7 +29,8 @@ static u8 usb_read8(struct intf_hdl *intfhdl, u32 addr)
- u16 wvalue;
- u16 index;
- u16 len;
-- __le32 data;
-+ int status;
-+ __le32 data = 0;
- struct intf_priv *intfpriv = intfhdl->pintfpriv;
-
- request = 0x05;
-@@ -37,8 +38,10 @@ static u8 usb_read8(struct intf_hdl *intfhdl, u32 addr)
- index = 0;
- wvalue = (u16)(addr & 0x0000ffff);
- len = 1;
-- r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index, &data, len,
-- requesttype);
-+ status = r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index,
-+ &data, len, requesttype);
-+ if (status < 0)
-+ return 0;
- return (u8)(le32_to_cpu(data) & 0x0ff);
- }
-
-@@ -49,7 +52,8 @@ static u16 usb_read16(struct intf_hdl *intfhdl, u32 addr)
- u16 wvalue;
- u16 index;
- u16 len;
-- __le32 data;
-+ int status;
-+ __le32 data = 0;
- struct intf_priv *intfpriv = intfhdl->pintfpriv;
-
- request = 0x05;
-@@ -57,8 +61,10 @@ static u16 usb_read16(struct intf_hdl *intfhdl, u32 addr)
- index = 0;
- wvalue = (u16)(addr & 0x0000ffff);
- len = 2;
-- r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index, &data, len,
-- requesttype);
-+ status = r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index,
-+ &data, len, requesttype);
-+ if (status < 0)
-+ return 0;
- return (u16)(le32_to_cpu(data) & 0xffff);
- }
-
-@@ -69,7 +75,8 @@ static u32 usb_read32(struct intf_hdl *intfhdl, u32 addr)
- u16 wvalue;
- u16 index;
- u16 len;
-- __le32 data;
-+ int status;
-+ __le32 data = 0;
- struct intf_priv *intfpriv = intfhdl->pintfpriv;
-
- request = 0x05;
-@@ -77,8 +84,10 @@ static u32 usb_read32(struct intf_hdl *intfhdl, u32 addr)
- index = 0;
- wvalue = (u16)(addr & 0x0000ffff);
- len = 4;
-- r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index, &data, len,
-- requesttype);
-+ status = r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index,
-+ &data, len, requesttype);
-+ if (status < 0)
-+ return 0;
- return le32_to_cpu(data);
- }
-
---
-2.35.1
-
+++ /dev/null
-From 6b5a95edc10125da876b5f82238e1a0fab2f4e18 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 17 Jan 2022 23:43:00 +0800
-Subject: sysrq: do not omit current cpu when showing backtrace of all active
- CPUs
-
-From: Changbin Du <changbin.du@gmail.com>
-
-[ Upstream commit 5390e7f46b9d5546d45a83e6463bc656678b1d0e ]
-
-The backtrace of current CPU also should be printed as it is active. This
-change add stack trace for current CPU and print a hint for idle CPU for
-the generic workqueue based printing. (x86 already does this)
-
-Now it looks like below:
-[ 279.401567] sysrq: Show backtrace of all active CPUs
-[ 279.407234] sysrq: CPU5:
-[ 279.407505] Call Trace:
-[ 279.408789] [<ffffffff8000606c>] dump_backtrace+0x2c/0x3a
-[ 279.411698] [<ffffffff800060ac>] show_stack+0x32/0x3e
-[ 279.411809] [<ffffffff80542258>] sysrq_handle_showallcpus+0x4c/0xc6
-[ 279.411929] [<ffffffff80542f16>] __handle_sysrq+0x106/0x26c
-[ 279.412034] [<ffffffff805436a8>] write_sysrq_trigger+0x64/0x74
-[ 279.412139] [<ffffffff8029cd48>] proc_reg_write+0x8e/0xe2
-[ 279.412252] [<ffffffff8021a8f8>] vfs_write+0x90/0x2be
-[ 279.412362] [<ffffffff8021acd2>] ksys_write+0xa6/0xce
-[ 279.412467] [<ffffffff8021ad24>] sys_write+0x2a/0x38
-[ 279.412689] [<ffffffff80003ff8>] ret_from_syscall+0x0/0x2
-[ 279.417173] sysrq: CPU6: backtrace skipped as idling
-[ 279.417185] sysrq: CPU4: backtrace skipped as idling
-[ 279.417187] sysrq: CPU0: backtrace skipped as idling
-[ 279.417181] sysrq: CPU7: backtrace skipped as idling
-[ 279.417190] sysrq: CPU1: backtrace skipped as idling
-[ 279.417193] sysrq: CPU3: backtrace skipped as idling
-[ 279.417219] sysrq: CPU2:
-[ 279.419179] Call Trace:
-[ 279.419440] [<ffffffff8000606c>] dump_backtrace+0x2c/0x3a
-[ 279.419782] [<ffffffff800060ac>] show_stack+0x32/0x3e
-[ 279.420015] [<ffffffff80542b30>] showacpu+0x5c/0x96
-[ 279.420317] [<ffffffff800ba71c>] flush_smp_call_function_queue+0xd6/0x218
-[ 279.420569] [<ffffffff800bb438>] generic_smp_call_function_single_interrupt+0x14/0x1c
-[ 279.420798] [<ffffffff800079ae>] handle_IPI+0xaa/0x13a
-[ 279.421024] [<ffffffff804dcb92>] riscv_intc_irq+0x56/0x70
-[ 279.421274] [<ffffffff80a05b70>] generic_handle_arch_irq+0x6a/0xfa
-[ 279.421518] [<ffffffff80004006>] ret_from_exception+0x0/0x10
-[ 279.421750] [<ffffffff80096492>] rcu_idle_enter+0x16/0x1e
-
-Signed-off-by: Changbin Du <changbin.du@gmail.com>
-Link: https://lore.kernel.org/r/20220117154300.2808-1-changbin.du@gmail.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/tty/sysrq.c | 13 +++++++++----
- 1 file changed, 9 insertions(+), 4 deletions(-)
-
-diff --git a/drivers/tty/sysrq.c b/drivers/tty/sysrq.c
-index bbfd004449b5..34cfdda4aff5 100644
---- a/drivers/tty/sysrq.c
-+++ b/drivers/tty/sysrq.c
-@@ -232,8 +232,10 @@ static void showacpu(void *dummy)
- unsigned long flags;
-
- /* Idle CPUs have no interesting backtrace. */
-- if (idle_cpu(smp_processor_id()))
-+ if (idle_cpu(smp_processor_id())) {
-+ pr_info("CPU%d: backtrace skipped as idling\n", smp_processor_id());
- return;
-+ }
-
- raw_spin_lock_irqsave(&show_lock, flags);
- pr_info("CPU%d:\n", smp_processor_id());
-@@ -260,10 +262,13 @@ static void sysrq_handle_showallcpus(int key)
-
- if (in_hardirq())
- regs = get_irq_regs();
-- if (regs) {
-- pr_info("CPU%d:\n", smp_processor_id());
-+
-+ pr_info("CPU%d:\n", smp_processor_id());
-+ if (regs)
- show_regs(regs);
-- }
-+ else
-+ show_stack(NULL, NULL, KERN_INFO);
-+
- schedule_work(&sysrq_showallcpus);
- }
- }
---
-2.35.1
-
+++ /dev/null
-From c52927a257f05240ba17f2c5b9849ff1f58ee39b Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 1 Apr 2022 17:24:28 +0300
-Subject: thunderbolt: Use different lane for second DisplayPort tunnel
-
-From: Mika Westerberg <mika.westerberg@linux.intel.com>
-
-[ Upstream commit 9d2d0a5cf0ca063f417681cc33e767ce52615286 ]
-
-Brad reported that on Apple hardware with Light Ridge or Falcon Ridge
-controller, plugging in a chain of Thunderbolt displays (Light Ridge
-based controllers) causes all kinds of tearing and flickering. The
-reason for this is that on Thunderbolt 1 hardware there is no lane
-bonding so we have two independent 10 Gb/s lanes, and currently Linux
-tunnels both displays through the lane 1. This makes the displays to
-share the 10 Gb/s bandwidth which may not be enough for higher
-resolutions.
-
-For this reason make the second tunnel go through the lane 0 instead.
-This seems to match what the macOS connection manager is also doing.
-
-Reported-by: Brad Campbell <lists2009@fnarfbargle.com>
-Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
-Tested-by: Brad Campbell <lists2009@fnarfbargle.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/thunderbolt/tb.c | 19 +++++++++++++++++--
- drivers/thunderbolt/test.c | 16 ++++++++--------
- drivers/thunderbolt/tunnel.c | 11 ++++++-----
- drivers/thunderbolt/tunnel.h | 4 ++--
- 4 files changed, 33 insertions(+), 17 deletions(-)
-
-diff --git a/drivers/thunderbolt/tb.c b/drivers/thunderbolt/tb.c
-index 9beb47b31c75..44d04b651a8b 100644
---- a/drivers/thunderbolt/tb.c
-+++ b/drivers/thunderbolt/tb.c
-@@ -867,7 +867,7 @@ static struct tb_port *tb_find_dp_out(struct tb *tb, struct tb_port *in)
-
- static void tb_tunnel_dp(struct tb *tb)
- {
-- int available_up, available_down, ret;
-+ int available_up, available_down, ret, link_nr;
- struct tb_cm *tcm = tb_priv(tb);
- struct tb_port *port, *in, *out;
- struct tb_tunnel *tunnel;
-@@ -912,6 +912,20 @@ static void tb_tunnel_dp(struct tb *tb)
- return;
- }
-
-+ /*
-+ * This is only applicable to links that are not bonded (so
-+ * when Thunderbolt 1 hardware is involved somewhere in the
-+ * topology). For these try to share the DP bandwidth between
-+ * the two lanes.
-+ */
-+ link_nr = 1;
-+ list_for_each_entry(tunnel, &tcm->tunnel_list, list) {
-+ if (tb_tunnel_is_dp(tunnel)) {
-+ link_nr = 0;
-+ break;
-+ }
-+ }
-+
- /*
- * DP stream needs the domain to be active so runtime resume
- * both ends of the tunnel.
-@@ -943,7 +957,8 @@ static void tb_tunnel_dp(struct tb *tb)
- tb_dbg(tb, "available bandwidth for new DP tunnel %u/%u Mb/s\n",
- available_up, available_down);
-
-- tunnel = tb_tunnel_alloc_dp(tb, in, out, available_up, available_down);
-+ tunnel = tb_tunnel_alloc_dp(tb, in, out, link_nr, available_up,
-+ available_down);
- if (!tunnel) {
- tb_port_dbg(out, "could not allocate DP tunnel\n");
- goto err_reclaim;
-diff --git a/drivers/thunderbolt/test.c b/drivers/thunderbolt/test.c
-index 1f69bab236ee..66b6e665e96f 100644
---- a/drivers/thunderbolt/test.c
-+++ b/drivers/thunderbolt/test.c
-@@ -1348,7 +1348,7 @@ static void tb_test_tunnel_dp(struct kunit *test)
- in = &host->ports[5];
- out = &dev->ports[13];
-
-- tunnel = tb_tunnel_alloc_dp(NULL, in, out, 0, 0);
-+ tunnel = tb_tunnel_alloc_dp(NULL, in, out, 1, 0, 0);
- KUNIT_ASSERT_TRUE(test, tunnel != NULL);
- KUNIT_EXPECT_EQ(test, tunnel->type, TB_TUNNEL_DP);
- KUNIT_EXPECT_PTR_EQ(test, tunnel->src_port, in);
-@@ -1394,7 +1394,7 @@ static void tb_test_tunnel_dp_chain(struct kunit *test)
- in = &host->ports[5];
- out = &dev4->ports[14];
-
-- tunnel = tb_tunnel_alloc_dp(NULL, in, out, 0, 0);
-+ tunnel = tb_tunnel_alloc_dp(NULL, in, out, 1, 0, 0);
- KUNIT_ASSERT_TRUE(test, tunnel != NULL);
- KUNIT_EXPECT_EQ(test, tunnel->type, TB_TUNNEL_DP);
- KUNIT_EXPECT_PTR_EQ(test, tunnel->src_port, in);
-@@ -1444,7 +1444,7 @@ static void tb_test_tunnel_dp_tree(struct kunit *test)
- in = &dev2->ports[13];
- out = &dev5->ports[13];
-
-- tunnel = tb_tunnel_alloc_dp(NULL, in, out, 0, 0);
-+ tunnel = tb_tunnel_alloc_dp(NULL, in, out, 1, 0, 0);
- KUNIT_ASSERT_TRUE(test, tunnel != NULL);
- KUNIT_EXPECT_EQ(test, tunnel->type, TB_TUNNEL_DP);
- KUNIT_EXPECT_PTR_EQ(test, tunnel->src_port, in);
-@@ -1509,7 +1509,7 @@ static void tb_test_tunnel_dp_max_length(struct kunit *test)
- in = &dev6->ports[13];
- out = &dev12->ports[13];
-
-- tunnel = tb_tunnel_alloc_dp(NULL, in, out, 0, 0);
-+ tunnel = tb_tunnel_alloc_dp(NULL, in, out, 1, 0, 0);
- KUNIT_ASSERT_TRUE(test, tunnel != NULL);
- KUNIT_EXPECT_EQ(test, tunnel->type, TB_TUNNEL_DP);
- KUNIT_EXPECT_PTR_EQ(test, tunnel->src_port, in);
-@@ -1627,7 +1627,7 @@ static void tb_test_tunnel_port_on_path(struct kunit *test)
- in = &dev2->ports[13];
- out = &dev5->ports[13];
-
-- dp_tunnel = tb_tunnel_alloc_dp(NULL, in, out, 0, 0);
-+ dp_tunnel = tb_tunnel_alloc_dp(NULL, in, out, 1, 0, 0);
- KUNIT_ASSERT_TRUE(test, dp_tunnel != NULL);
-
- KUNIT_EXPECT_TRUE(test, tb_tunnel_port_on_path(dp_tunnel, in));
-@@ -2009,7 +2009,7 @@ static void tb_test_credit_alloc_dp(struct kunit *test)
- in = &host->ports[5];
- out = &dev->ports[14];
-
-- tunnel = tb_tunnel_alloc_dp(NULL, in, out, 0, 0);
-+ tunnel = tb_tunnel_alloc_dp(NULL, in, out, 1, 0, 0);
- KUNIT_ASSERT_TRUE(test, tunnel != NULL);
- KUNIT_ASSERT_EQ(test, tunnel->npaths, (size_t)3);
-
-@@ -2245,7 +2245,7 @@ static struct tb_tunnel *TB_TEST_DP_TUNNEL1(struct kunit *test,
-
- in = &host->ports[5];
- out = &dev->ports[13];
-- dp_tunnel1 = tb_tunnel_alloc_dp(NULL, in, out, 0, 0);
-+ dp_tunnel1 = tb_tunnel_alloc_dp(NULL, in, out, 1, 0, 0);
- KUNIT_ASSERT_TRUE(test, dp_tunnel1 != NULL);
- KUNIT_ASSERT_EQ(test, dp_tunnel1->npaths, (size_t)3);
-
-@@ -2282,7 +2282,7 @@ static struct tb_tunnel *TB_TEST_DP_TUNNEL2(struct kunit *test,
-
- in = &host->ports[6];
- out = &dev->ports[14];
-- dp_tunnel2 = tb_tunnel_alloc_dp(NULL, in, out, 0, 0);
-+ dp_tunnel2 = tb_tunnel_alloc_dp(NULL, in, out, 1, 0, 0);
- KUNIT_ASSERT_TRUE(test, dp_tunnel2 != NULL);
- KUNIT_ASSERT_EQ(test, dp_tunnel2->npaths, (size_t)3);
-
-diff --git a/drivers/thunderbolt/tunnel.c b/drivers/thunderbolt/tunnel.c
-index 118742ec93ed..8ccd70920b6a 100644
---- a/drivers/thunderbolt/tunnel.c
-+++ b/drivers/thunderbolt/tunnel.c
-@@ -858,6 +858,7 @@ struct tb_tunnel *tb_tunnel_discover_dp(struct tb *tb, struct tb_port *in,
- * @tb: Pointer to the domain structure
- * @in: DP in adapter port
- * @out: DP out adapter port
-+ * @link_nr: Preferred lane adapter when the link is not bonded
- * @max_up: Maximum available upstream bandwidth for the DP tunnel (%0
- * if not limited)
- * @max_down: Maximum available downstream bandwidth for the DP tunnel
-@@ -869,8 +870,8 @@ struct tb_tunnel *tb_tunnel_discover_dp(struct tb *tb, struct tb_port *in,
- * Return: Returns a tb_tunnel on success or NULL on failure.
- */
- struct tb_tunnel *tb_tunnel_alloc_dp(struct tb *tb, struct tb_port *in,
-- struct tb_port *out, int max_up,
-- int max_down)
-+ struct tb_port *out, int link_nr,
-+ int max_up, int max_down)
- {
- struct tb_tunnel *tunnel;
- struct tb_path **paths;
-@@ -894,21 +895,21 @@ struct tb_tunnel *tb_tunnel_alloc_dp(struct tb *tb, struct tb_port *in,
- paths = tunnel->paths;
-
- path = tb_path_alloc(tb, in, TB_DP_VIDEO_HOPID, out, TB_DP_VIDEO_HOPID,
-- 1, "Video");
-+ link_nr, "Video");
- if (!path)
- goto err_free;
- tb_dp_init_video_path(path);
- paths[TB_DP_VIDEO_PATH_OUT] = path;
-
- path = tb_path_alloc(tb, in, TB_DP_AUX_TX_HOPID, out,
-- TB_DP_AUX_TX_HOPID, 1, "AUX TX");
-+ TB_DP_AUX_TX_HOPID, link_nr, "AUX TX");
- if (!path)
- goto err_free;
- tb_dp_init_aux_path(path);
- paths[TB_DP_AUX_PATH_OUT] = path;
-
- path = tb_path_alloc(tb, out, TB_DP_AUX_RX_HOPID, in,
-- TB_DP_AUX_RX_HOPID, 1, "AUX RX");
-+ TB_DP_AUX_RX_HOPID, link_nr, "AUX RX");
- if (!path)
- goto err_free;
- tb_dp_init_aux_path(path);
-diff --git a/drivers/thunderbolt/tunnel.h b/drivers/thunderbolt/tunnel.h
-index 03e56076b5bc..bb4d1f1d6d0b 100644
---- a/drivers/thunderbolt/tunnel.h
-+++ b/drivers/thunderbolt/tunnel.h
-@@ -71,8 +71,8 @@ struct tb_tunnel *tb_tunnel_alloc_pci(struct tb *tb, struct tb_port *up,
- struct tb_tunnel *tb_tunnel_discover_dp(struct tb *tb, struct tb_port *in,
- bool alloc_hopid);
- struct tb_tunnel *tb_tunnel_alloc_dp(struct tb *tb, struct tb_port *in,
-- struct tb_port *out, int max_up,
-- int max_down);
-+ struct tb_port *out, int link_nr,
-+ int max_up, int max_down);
- struct tb_tunnel *tb_tunnel_alloc_dma(struct tb *tb, struct tb_port *nhi,
- struct tb_port *dst, int transmit_path,
- int transmit_ring, int receive_path,
---
-2.35.1
-
+++ /dev/null
-From 258ad7c484ba648f299a3f50a492ee5d4272cc3f Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 31 Mar 2022 17:10:05 +0800
-Subject: tty: Fix a possible resource leak in icom_probe
-
-From: Huang Guobin <huangguobin4@huawei.com>
-
-[ Upstream commit ee157a79e7c82b01ae4c25de0ac75899801f322c ]
-
-When pci_read_config_dword failed, call pci_release_regions() and
-pci_disable_device() to recycle the resource previously allocated.
-
-Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
-Signed-off-by: Huang Guobin <huangguobin4@huawei.com>
-Link: https://lore.kernel.org/r/20220331091005.3290753-1-huangguobin4@huawei.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/tty/serial/icom.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/tty/serial/icom.c b/drivers/tty/serial/icom.c
-index 03a2fe9f4c9a..02b375ba2f07 100644
---- a/drivers/tty/serial/icom.c
-+++ b/drivers/tty/serial/icom.c
-@@ -1501,7 +1501,7 @@ static int icom_probe(struct pci_dev *dev,
- retval = pci_read_config_dword(dev, PCI_COMMAND, &command_reg);
- if (retval) {
- dev_err(&dev->dev, "PCI Config read FAILED\n");
-- return retval;
-+ goto probe_exit0;
- }
-
- pci_write_config_dword(dev, PCI_COMMAND,
---
-2.35.1
-
+++ /dev/null
-From f103f0c7f356225f2017463cfef3dd2e204a0235 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 10 Apr 2022 19:48:14 +0800
-Subject: tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
-
-From: Zheyu Ma <zheyuma97@gmail.com>
-
-[ Upstream commit 689ca31c542687709ba21ec2195c1fbce34fd029 ]
-
-When the driver fails at alloc_hdlcdev(), and then we remove the driver
-module, we will get the following splat:
-
-[ 25.065966] general protection fault, probably for non-canonical address 0xdffffc0000000182: 0000 [#1] PREEMPT SMP KASAN PTI
-[ 25.066914] KASAN: null-ptr-deref in range [0x0000000000000c10-0x0000000000000c17]
-[ 25.069262] RIP: 0010:detach_hdlc_protocol+0x2a/0x3e0
-[ 25.077709] Call Trace:
-[ 25.077924] <TASK>
-[ 25.078108] unregister_hdlc_device+0x16/0x30
-[ 25.078481] slgt_cleanup+0x157/0x9f0 [synclink_gt]
-
-Fix this by checking whether the 'info->netdev' is a null pointer first.
-
-Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
-Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
-Link: https://lore.kernel.org/r/20220410114814.3920474-1-zheyuma97@gmail.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/tty/synclink_gt.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/drivers/tty/synclink_gt.c b/drivers/tty/synclink_gt.c
-index 25c558e65ece..9bc2a9265277 100644
---- a/drivers/tty/synclink_gt.c
-+++ b/drivers/tty/synclink_gt.c
-@@ -1746,6 +1746,8 @@ static int hdlcdev_init(struct slgt_info *info)
- */
- static void hdlcdev_exit(struct slgt_info *info)
- {
-+ if (!info->netdev)
-+ return;
- unregister_hdlc_device(info->netdev);
- free_netdev(info->netdev);
- info->netdev = NULL;
---
-2.35.1
-
+++ /dev/null
-From da1319fb7a05aab68283f7dd935976fc839fc166 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 6 May 2022 15:46:12 +0200
-Subject: um: line: Use separate IRQs per line
-
-From: Johannes Berg <johannes.berg@intel.com>
-
-[ Upstream commit d5a9597d6916a76663085db984cb8fe97f0a5c56 ]
-
-Today, all possible serial lines (ssl*=) as well as all
-possible consoles (con*=) each share a single interrupt
-(with a fixed number) with others of the same type.
-
-Now, if you have two lines, say ssl0 and ssl1, and one
-of them is connected to an fd you cannot read (e.g. a
-file), but the other gets a read interrupt, then both
-of them get the interrupt since it's shared. Then, the
-read() call will return EOF, since it's a file being
-written and there's nothing to read (at least not at
-the current offset, at the end).
-
-Unfortunately, this is treated as a read error, and we
-close this line, losing all the possible output.
-
-It might be possible to work around this and make the
-IRQ sharing work, however, now that we have dynamically
-allocated IRQs that are easy to use, simply use that to
-achieve separating between the events; then there's no
-interrupt for that line and we never attempt the read
-in the first place, thus not closing the line.
-
-This manifested itself in the wifi hostap/hwsim tests
-where the parallel script communicates via one serial
-console and the kernel messages go to another (a file)
-and sending data on the communication console caused
-the kernel messages to stop flowing into the file.
-
-Reported-by: Jouni Malinen <j@w1.fi>
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
-Acked-By: anton ivanov <anton.ivanov@cambridgegreys.com>
-Signed-off-by: Richard Weinberger <richard@nod.at>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/um/drivers/chan_kern.c | 10 +++++-----
- arch/um/drivers/line.c | 22 +++++++++++++---------
- arch/um/drivers/line.h | 4 ++--
- arch/um/drivers/ssl.c | 2 --
- arch/um/drivers/stdio_console.c | 2 --
- arch/um/include/asm/irq.h | 22 +++++++++-------------
- 6 files changed, 29 insertions(+), 33 deletions(-)
-
-diff --git a/arch/um/drivers/chan_kern.c b/arch/um/drivers/chan_kern.c
-index 62997055c454..26a702a06515 100644
---- a/arch/um/drivers/chan_kern.c
-+++ b/arch/um/drivers/chan_kern.c
-@@ -133,7 +133,7 @@ static void line_timer_cb(struct work_struct *work)
- struct line *line = container_of(work, struct line, task.work);
-
- if (!line->throttled)
-- chan_interrupt(line, line->driver->read_irq);
-+ chan_interrupt(line, line->read_irq);
- }
-
- int enable_chan(struct line *line)
-@@ -195,9 +195,9 @@ void free_irqs(void)
- chan = list_entry(ele, struct chan, free_list);
-
- if (chan->input && chan->enabled)
-- um_free_irq(chan->line->driver->read_irq, chan);
-+ um_free_irq(chan->line->read_irq, chan);
- if (chan->output && chan->enabled)
-- um_free_irq(chan->line->driver->write_irq, chan);
-+ um_free_irq(chan->line->write_irq, chan);
- chan->enabled = 0;
- }
- }
-@@ -215,9 +215,9 @@ static void close_one_chan(struct chan *chan, int delay_free_irq)
- spin_unlock_irqrestore(&irqs_to_free_lock, flags);
- } else {
- if (chan->input && chan->enabled)
-- um_free_irq(chan->line->driver->read_irq, chan);
-+ um_free_irq(chan->line->read_irq, chan);
- if (chan->output && chan->enabled)
-- um_free_irq(chan->line->driver->write_irq, chan);
-+ um_free_irq(chan->line->write_irq, chan);
- chan->enabled = 0;
- }
- if (chan->ops->close != NULL)
-diff --git a/arch/um/drivers/line.c b/arch/um/drivers/line.c
-index 8febf95da96e..02b0befd6763 100644
---- a/arch/um/drivers/line.c
-+++ b/arch/um/drivers/line.c
-@@ -139,7 +139,7 @@ static int flush_buffer(struct line *line)
- count = line->buffer + LINE_BUFSIZE - line->head;
-
- n = write_chan(line->chan_out, line->head, count,
-- line->driver->write_irq);
-+ line->write_irq);
- if (n < 0)
- return n;
- if (n == count) {
-@@ -156,7 +156,7 @@ static int flush_buffer(struct line *line)
-
- count = line->tail - line->head;
- n = write_chan(line->chan_out, line->head, count,
-- line->driver->write_irq);
-+ line->write_irq);
-
- if (n < 0)
- return n;
-@@ -195,7 +195,7 @@ int line_write(struct tty_struct *tty, const unsigned char *buf, int len)
- ret = buffer_data(line, buf, len);
- else {
- n = write_chan(line->chan_out, buf, len,
-- line->driver->write_irq);
-+ line->write_irq);
- if (n < 0) {
- ret = n;
- goto out_up;
-@@ -215,7 +215,7 @@ void line_throttle(struct tty_struct *tty)
- {
- struct line *line = tty->driver_data;
-
-- deactivate_chan(line->chan_in, line->driver->read_irq);
-+ deactivate_chan(line->chan_in, line->read_irq);
- line->throttled = 1;
- }
-
-@@ -224,7 +224,7 @@ void line_unthrottle(struct tty_struct *tty)
- struct line *line = tty->driver_data;
-
- line->throttled = 0;
-- chan_interrupt(line, line->driver->read_irq);
-+ chan_interrupt(line, line->read_irq);
- }
-
- static irqreturn_t line_write_interrupt(int irq, void *data)
-@@ -260,19 +260,23 @@ int line_setup_irq(int fd, int input, int output, struct line *line, void *data)
- int err;
-
- if (input) {
-- err = um_request_irq(driver->read_irq, fd, IRQ_READ,
-- line_interrupt, IRQF_SHARED,
-+ err = um_request_irq(UM_IRQ_ALLOC, fd, IRQ_READ,
-+ line_interrupt, 0,
- driver->read_irq_name, data);
- if (err < 0)
- return err;
-+
-+ line->read_irq = err;
- }
-
- if (output) {
-- err = um_request_irq(driver->write_irq, fd, IRQ_WRITE,
-- line_write_interrupt, IRQF_SHARED,
-+ err = um_request_irq(UM_IRQ_ALLOC, fd, IRQ_WRITE,
-+ line_write_interrupt, 0,
- driver->write_irq_name, data);
- if (err < 0)
- return err;
-+
-+ line->write_irq = err;
- }
-
- return 0;
-diff --git a/arch/um/drivers/line.h b/arch/um/drivers/line.h
-index bdb16b96e76f..f15be75a3bf3 100644
---- a/arch/um/drivers/line.h
-+++ b/arch/um/drivers/line.h
-@@ -23,9 +23,7 @@ struct line_driver {
- const short minor_start;
- const short type;
- const short subtype;
-- const int read_irq;
- const char *read_irq_name;
-- const int write_irq;
- const char *write_irq_name;
- struct mc_device mc;
- struct tty_driver *driver;
-@@ -35,6 +33,8 @@ struct line {
- struct tty_port port;
- int valid;
-
-+ int read_irq, write_irq;
-+
- char *init_str;
- struct list_head chan_list;
- struct chan *chan_in, *chan_out;
-diff --git a/arch/um/drivers/ssl.c b/arch/um/drivers/ssl.c
-index 41eae2e8fb65..8514966778d5 100644
---- a/arch/um/drivers/ssl.c
-+++ b/arch/um/drivers/ssl.c
-@@ -47,9 +47,7 @@ static struct line_driver driver = {
- .minor_start = 64,
- .type = TTY_DRIVER_TYPE_SERIAL,
- .subtype = 0,
-- .read_irq = SSL_IRQ,
- .read_irq_name = "ssl",
-- .write_irq = SSL_WRITE_IRQ,
- .write_irq_name = "ssl-write",
- .mc = {
- .list = LIST_HEAD_INIT(driver.mc.list),
-diff --git a/arch/um/drivers/stdio_console.c b/arch/um/drivers/stdio_console.c
-index e8b762f4d8c2..489d5a746ed3 100644
---- a/arch/um/drivers/stdio_console.c
-+++ b/arch/um/drivers/stdio_console.c
-@@ -53,9 +53,7 @@ static struct line_driver driver = {
- .minor_start = 0,
- .type = TTY_DRIVER_TYPE_CONSOLE,
- .subtype = SYSTEM_TYPE_CONSOLE,
-- .read_irq = CONSOLE_IRQ,
- .read_irq_name = "console",
-- .write_irq = CONSOLE_WRITE_IRQ,
- .write_irq_name = "console-write",
- .mc = {
- .list = LIST_HEAD_INIT(driver.mc.list),
-diff --git a/arch/um/include/asm/irq.h b/arch/um/include/asm/irq.h
-index e187c789369d..749dfe8512e8 100644
---- a/arch/um/include/asm/irq.h
-+++ b/arch/um/include/asm/irq.h
-@@ -4,19 +4,15 @@
-
- #define TIMER_IRQ 0
- #define UMN_IRQ 1
--#define CONSOLE_IRQ 2
--#define CONSOLE_WRITE_IRQ 3
--#define UBD_IRQ 4
--#define UM_ETH_IRQ 5
--#define SSL_IRQ 6
--#define SSL_WRITE_IRQ 7
--#define ACCEPT_IRQ 8
--#define MCONSOLE_IRQ 9
--#define WINCH_IRQ 10
--#define SIGIO_WRITE_IRQ 11
--#define TELNETD_IRQ 12
--#define XTERM_IRQ 13
--#define RANDOM_IRQ 14
-+#define UBD_IRQ 2
-+#define UM_ETH_IRQ 3
-+#define ACCEPT_IRQ 4
-+#define MCONSOLE_IRQ 5
-+#define WINCH_IRQ 6
-+#define SIGIO_WRITE_IRQ 7
-+#define TELNETD_IRQ 8
-+#define XTERM_IRQ 9
-+#define RANDOM_IRQ 10
-
- #ifdef CONFIG_UML_NET_VECTOR
-
---
-2.35.1
-
+++ /dev/null
-From af2237f6ce3df2180c1ce3e74a283f8edb357432 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 5 May 2022 12:46:18 +0200
-Subject: usb: dwc2: gadget: don't reset gadget's driver->bus
-
-From: Marek Szyprowski <m.szyprowski@samsung.com>
-
-[ Upstream commit 3120aac6d0ecd9accf56894aeac0e265f74d3d5a ]
-
-UDC driver should not touch gadget's driver internals, especially it
-should not reset driver->bus. This wasn't harmful so far, but since
-commit fc274c1e9973 ("USB: gadget: Add a new bus for gadgets") gadget
-subsystem got it's own bus and messing with ->bus triggers the
-following NULL pointer dereference:
-
-dwc2 12480000.hsotg: bound driver g_ether
-8<--- cut here ---
-Unable to handle kernel NULL pointer dereference at virtual address 00000000
-[00000000] *pgd=00000000
-Internal error: Oops: 5 [#1] SMP ARM
-Modules linked in: ...
-CPU: 0 PID: 620 Comm: modprobe Not tainted 5.18.0-rc5-next-20220504 #11862
-Hardware name: Samsung Exynos (Flattened Device Tree)
-PC is at module_add_driver+0x44/0xe8
-LR is at sysfs_do_create_link_sd+0x84/0xe0
-...
-Process modprobe (pid: 620, stack limit = 0x(ptrval))
-...
- module_add_driver from bus_add_driver+0xf4/0x1e4
- bus_add_driver from driver_register+0x78/0x10c
- driver_register from usb_gadget_register_driver_owner+0x40/0xb4
- usb_gadget_register_driver_owner from do_one_initcall+0x44/0x1e0
- do_one_initcall from do_init_module+0x44/0x1c8
- do_init_module from load_module+0x19b8/0x1b9c
- load_module from sys_finit_module+0xdc/0xfc
- sys_finit_module from ret_fast_syscall+0x0/0x54
-Exception stack(0xf1771fa8 to 0xf1771ff0)
-...
-dwc2 12480000.hsotg: new device is high-speed
----[ end trace 0000000000000000 ]---
-
-Fix this by removing driver->bus entry reset.
-
-Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
-Link: https://lore.kernel.org/r/20220505104618.22729-1-m.szyprowski@samsung.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/dwc2/gadget.c | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
-index eee3504397e6..fe2a58c75861 100644
---- a/drivers/usb/dwc2/gadget.c
-+++ b/drivers/usb/dwc2/gadget.c
-@@ -4544,7 +4544,6 @@ static int dwc2_hsotg_udc_start(struct usb_gadget *gadget,
-
- WARN_ON(hsotg->driver);
-
-- driver->driver.bus = NULL;
- hsotg->driver = driver;
- hsotg->gadget.dev.of_node = hsotg->dev->of_node;
- hsotg->gadget.speed = USB_SPEED_UNKNOWN;
---
-2.35.1
-
+++ /dev/null
-From 1d6ee9118e5b4c56125c2b1e617732b81267b895 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 21 Apr 2022 19:22:57 -0700
-Subject: usb: dwc3: gadget: Only End Transfer for ep0 data phase
-
-From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
-
-[ Upstream commit ace17b6ee4f92ab0375d12a1b42494f8590a96b6 ]
-
-The driver shouldn't be able to issue End Transfer to the control
-endpoint at anytime. Typically we should only do so in error cases such
-as invalid/unexpected direction of Data Phase as described in the
-control transfer flow of the programming guide. It _may_ end started
-data phase during controller deinitialization from soft disconnect or
-driver removal. However, that should not happen because the driver
-should be maintained in EP0_SETUP_PHASE during driver tear-down. On
-soft-connect, the controller should be reset from a soft-reset and there
-should be no issue starting the control endpoint.
-
-Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
-Link: https://lore.kernel.org/r/3c6643678863a26702e4115e9e19d7d94a30d49c.1650593829.git.Thinh.Nguyen@synopsys.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/dwc3/gadget.c | 11 +++++++++++
- 1 file changed, 11 insertions(+)
-
-diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
-index 6936d8ce8981..bf2eaa09d73c 100644
---- a/drivers/usb/dwc3/gadget.c
-+++ b/drivers/usb/dwc3/gadget.c
-@@ -3685,6 +3685,17 @@ static void dwc3_reset_gadget(struct dwc3 *dwc)
- void dwc3_stop_active_transfer(struct dwc3_ep *dep, bool force,
- bool interrupt)
- {
-+ struct dwc3 *dwc = dep->dwc;
-+
-+ /*
-+ * Only issue End Transfer command to the control endpoint of a started
-+ * Data Phase. Typically we should only do so in error cases such as
-+ * invalid/unexpected direction as described in the control transfer
-+ * flow of the programming guide.
-+ */
-+ if (dep->number <= 1 && dwc->ep0state != EP0_DATA_PHASE)
-+ return;
-+
- if (!(dep->flags & DWC3_EP_TRANSFER_STARTED) ||
- (dep->flags & DWC3_EP_DELAY_STOP) ||
- (dep->flags & DWC3_EP_END_TRANSFER_PENDING))
---
-2.35.1
-
+++ /dev/null
-From 1cab95277a8cf04eef5b4b0aff905e61ebdd097a Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 28 Apr 2022 14:10:56 +0300
-Subject: usb: dwc3: host: Stop setting the ACPI companion
-
-From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
-
-[ Upstream commit 7fd069d65da2e20b1caec3b7bcf9dfbe28c04bb2 ]
-
-It is no longer needed. The sysdev pointer is now used when
-assigning the ACPI companions to the xHCI ports and USB
-devices.
-
-Assigning the ACPI companion here resulted in the
-fwnode->secondary pointer to be replaced also for the parent
-dwc3 device since the primary fwnode (the ACPI companion)
-was shared. That was unintentional and it created potential
-side effects like resource leaks.
-
-Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
-Link: https://lore.kernel.org/r/20220428111056.3558-3-heikki.krogerus@linux.intel.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/dwc3/host.c | 2 --
- 1 file changed, 2 deletions(-)
-
-diff --git a/drivers/usb/dwc3/host.c b/drivers/usb/dwc3/host.c
-index eda871973d6c..f56c30cf151e 100644
---- a/drivers/usb/dwc3/host.c
-+++ b/drivers/usb/dwc3/host.c
-@@ -7,7 +7,6 @@
- * Authors: Felipe Balbi <balbi@ti.com>,
- */
-
--#include <linux/acpi.h>
- #include <linux/irq.h>
- #include <linux/of.h>
- #include <linux/platform_device.h>
-@@ -83,7 +82,6 @@ int dwc3_host_init(struct dwc3 *dwc)
- }
-
- xhci->dev.parent = dwc->dev;
-- ACPI_COMPANION_SET(&xhci->dev, ACPI_COMPANION(dwc->dev));
-
- dwc->xhci = xhci;
-
---
-2.35.1
-
+++ /dev/null
-From e12ba94cfdab861400b38ad800058e02c13aef81 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 21 Apr 2022 10:39:27 -0700
-Subject: USB: hcd-pci: Fully suspend across freeze/thaw cycle
-
-From: Evan Green <evgreen@chromium.org>
-
-[ Upstream commit 63acaa8e9c65dc34dc249440216f8e977f5d2748 ]
-
-The documentation for the freeze() method says that it "should quiesce
-the device so that it doesn't generate IRQs or DMA". The unspoken
-consequence of not doing this is that MSIs aimed at non-boot CPUs may
-get fully lost if they're sent during the period where the target CPU is
-offline.
-
-The current callbacks for USB HCD do not fully quiesce interrupts,
-specifically on XHCI. Change to use the full suspend/resume flow for
-freeze/thaw to ensure interrupts are fully quiesced. This fixes issues
-where USB devices fail to thaw during hibernation because XHCI misses
-its interrupt and cannot recover.
-
-Acked-by: Alan Stern <stern@rowland.harvard.edu>
-Signed-off-by: Evan Green <evgreen@chromium.org>
-Link: https://lore.kernel.org/r/20220421103751.v3.2.I8226c7fdae88329ef70957b96a39b346c69a914e@changeid
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/core/hcd-pci.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c
-index 8176bc81a635..ae5e6d572376 100644
---- a/drivers/usb/core/hcd-pci.c
-+++ b/drivers/usb/core/hcd-pci.c
-@@ -616,10 +616,10 @@ const struct dev_pm_ops usb_hcd_pci_pm_ops = {
- .suspend_noirq = hcd_pci_suspend_noirq,
- .resume_noirq = hcd_pci_resume_noirq,
- .resume = hcd_pci_resume,
-- .freeze = check_root_hub_suspended,
-+ .freeze = hcd_pci_suspend,
- .freeze_noirq = check_root_hub_suspended,
- .thaw_noirq = NULL,
-- .thaw = NULL,
-+ .thaw = hcd_pci_resume,
- .poweroff = hcd_pci_suspend,
- .poweroff_noirq = hcd_pci_suspend_noirq,
- .restore_noirq = hcd_pci_resume_noirq,
---
-2.35.1
-
+++ /dev/null
-From def74869a3074252a06bd16cd1d5bcd7ed443e32 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 2 Mar 2022 11:37:16 +0800
-Subject: USB: host: isp116x: check return value after calling
- platform_get_resource()
-
-From: Zhen Ni <nizhen@uniontech.com>
-
-[ Upstream commit 134a3408c2d3f7e23eb0e4556e0a2d9f36c2614e ]
-
-It will cause null-ptr-deref if platform_get_resource() returns NULL,
-we need check the return value.
-
-Signed-off-by: Zhen Ni <nizhen@uniontech.com>
-Link: https://lore.kernel.org/r/20220302033716.31272-1-nizhen@uniontech.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/host/isp116x-hcd.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/usb/host/isp116x-hcd.c b/drivers/usb/host/isp116x-hcd.c
-index 8835f6bd528e..8c7f0991c21b 100644
---- a/drivers/usb/host/isp116x-hcd.c
-+++ b/drivers/usb/host/isp116x-hcd.c
-@@ -1541,10 +1541,12 @@ static int isp116x_remove(struct platform_device *pdev)
-
- iounmap(isp116x->data_reg);
- res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
-- release_mem_region(res->start, 2);
-+ if (res)
-+ release_mem_region(res->start, 2);
- iounmap(isp116x->addr_reg);
- res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-- release_mem_region(res->start, 2);
-+ if (res)
-+ release_mem_region(res->start, 2);
-
- usb_put_hcd(hcd);
- return 0;
---
-2.35.1
-
+++ /dev/null
-From 75d4c6bbd5604a35eb8dfb9075a450cc4707cf6c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 26 Apr 2022 22:53:29 +0800
-Subject: watchdog: wdat_wdt: Stop watchdog when rebooting the system
-
-From: Liu Xinpeng <liuxp11@chinatelecom.cn>
-
-[ Upstream commit 27fdf84510a1374748904db43f6755f912736d92 ]
-
-Executing reboot command several times on the machine "Dell
-PowerEdge R740", UEFI security detection stopped machine
-with the following prompt:
-
-UEFI0082: The system was reset due to a timeout from the watchdog
-timer. Check the System Event Log (SEL) or crash dumps from
-Operating Sysstem to identify the source that triggered the
-watchdog timer reset. Update the firmware or driver for the
-identified device.
-
-iDRAC has warning event: "The watchdog timer reset the system".
-
-This patch fixes this issue by adding the reboot notifier.
-
-Signed-off-by: Liu Xinpeng <liuxp11@chinatelecom.cn>
-Reviewed-by: Guenter Roeck <linux@roeck-us.net>
-Link: https://lore.kernel.org/r/1650984810-6247-3-git-send-email-liuxp11@chinatelecom.cn
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
-Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/watchdog/wdat_wdt.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/drivers/watchdog/wdat_wdt.c b/drivers/watchdog/wdat_wdt.c
-index 195c8c004b69..4fac8148a8e6 100644
---- a/drivers/watchdog/wdat_wdt.c
-+++ b/drivers/watchdog/wdat_wdt.c
-@@ -462,6 +462,7 @@ static int wdat_wdt_probe(struct platform_device *pdev)
- return ret;
-
- watchdog_set_nowayout(&wdat->wdd, nowayout);
-+ watchdog_stop_on_reboot(&wdat->wdd);
- return devm_watchdog_register_device(dev, &wdat->wdd);
- }
-
---
-2.35.1
-
+++ /dev/null
-From ee58fc3eb5968e63a5dd02262121a06fe2ce2882 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 2 May 2022 12:15:23 +0200
-Subject: x86/cpu: Elide KCSAN for cpu_has() and friends
-
-From: Peter Zijlstra <peterz@infradead.org>
-
-[ Upstream commit a6a5eb269f6f3a2fe392f725a8d9052190c731e2 ]
-
-As x86 uses the <asm-generic/bitops/instrumented-*.h> headers, the
-regular forms of all bitops are instrumented with explicit calls to
-KASAN and KCSAN checks. As these are explicit calls, these are not
-suppressed by the noinstr function attribute.
-
-This can result in calls to those check functions in noinstr code, which
-objtool warns about:
-
-vmlinux.o: warning: objtool: enter_from_user_mode+0x24: call to __kcsan_check_access() leaves .noinstr.text section
-vmlinux.o: warning: objtool: syscall_enter_from_user_mode+0x28: call to __kcsan_check_access() leaves .noinstr.text section
-vmlinux.o: warning: objtool: syscall_enter_from_user_mode_prepare+0x24: call to __kcsan_check_access() leaves .noinstr.text section
-vmlinux.o: warning: objtool: irqentry_enter_from_user_mode+0x24: call to __kcsan_check_access() leaves .noinstr.text section
-
-Prevent this by using the arch_*() bitops, which are the underlying
-bitops without explciit instrumentation.
-
-[null: Changelog]
-Reported-by: kernel test robot <lkp@intel.com>
-Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
-Link: https://lkml.kernel.org/r/20220502111216.290518605@infradead.org
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/x86/include/asm/cpufeature.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h
-index 1261842d006c..49a3b122279e 100644
---- a/arch/x86/include/asm/cpufeature.h
-+++ b/arch/x86/include/asm/cpufeature.h
-@@ -51,7 +51,7 @@ extern const char * const x86_power_flags[32];
- extern const char * const x86_bug_flags[NBUGINTS*32];
-
- #define test_cpu_cap(c, bit) \
-- test_bit(bit, (unsigned long *)((c)->x86_capability))
-+ arch_test_bit(bit, (unsigned long *)((c)->x86_capability))
-
- /*
- * There are 32 bits/features in each mask word. The high bits
---
-2.35.1
-
+++ /dev/null
-From cc9c4fc59d4f9705d9047b3ffe85c7c9fc6b8750 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 10 Mar 2022 09:34:19 -0500
-Subject: ceph: allow ceph.dir.rctime xattr to be updatable
-
-From: Venky Shankar <vshankar@redhat.com>
-
-[ Upstream commit d7a2dc523085f8b8c60548ceedc696934aefeb0e ]
-
-`rctime' has been a pain point in cephfs due to its buggy
-nature - inconsistent values reported and those sorts.
-Fixing rctime is non-trivial needing an overall redesign
-of the entire nested statistics infrastructure.
-
-As a workaround, PR
-
- http://github.com/ceph/ceph/pull/37938
-
-allows this extended attribute to be manually set. This allows
-users to "fixup" inconsistent rctime values. While this sounds
-messy, its probably the wisest approach allowing users/scripts
-to workaround buggy rctime values.
-
-The above PR enables Ceph MDS to allow manually setting
-rctime extended attribute with the corresponding user-land
-changes. We may as well allow the same to be done via kclient
-for parity.
-
-Signed-off-by: Venky Shankar <vshankar@redhat.com>
-Reviewed-by: Xiubo Li <xiubli@redhat.com>
-Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/ceph/xattr.c | 10 +++++++++-
- 1 file changed, 9 insertions(+), 1 deletion(-)
-
-diff --git a/fs/ceph/xattr.c b/fs/ceph/xattr.c
-index cb18ee637cb7..4bcf0226818d 100644
---- a/fs/ceph/xattr.c
-+++ b/fs/ceph/xattr.c
-@@ -316,6 +316,14 @@ static ssize_t ceph_vxattrcb_snap_btime(struct ceph_inode_info *ci, char *val,
- }
- #define XATTR_RSTAT_FIELD(_type, _name) \
- XATTR_NAME_CEPH(_type, _name, VXATTR_FLAG_RSTAT)
-+#define XATTR_RSTAT_FIELD_UPDATABLE(_type, _name) \
-+ { \
-+ .name = CEPH_XATTR_NAME(_type, _name), \
-+ .name_size = sizeof (CEPH_XATTR_NAME(_type, _name)), \
-+ .getxattr_cb = ceph_vxattrcb_ ## _type ## _ ## _name, \
-+ .exists_cb = NULL, \
-+ .flags = VXATTR_FLAG_RSTAT, \
-+ }
- #define XATTR_LAYOUT_FIELD(_type, _name, _field) \
- { \
- .name = CEPH_XATTR_NAME2(_type, _name, _field), \
-@@ -353,7 +361,7 @@ static struct ceph_vxattr ceph_dir_vxattrs[] = {
- XATTR_RSTAT_FIELD(dir, rfiles),
- XATTR_RSTAT_FIELD(dir, rsubdirs),
- XATTR_RSTAT_FIELD(dir, rbytes),
-- XATTR_RSTAT_FIELD(dir, rctime),
-+ XATTR_RSTAT_FIELD_UPDATABLE(dir, rctime),
- {
- .name = "ceph.dir.pin",
- .name_size = sizeof("ceph.dir.pin"),
---
-2.35.1
-
+++ /dev/null
-From b20c6ecafe2413b7135926983de5b7fbbc21fd89 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 1 Jun 2022 22:08:46 -0500
-Subject: cifs: version operations for smb20 unneeded when legacy support
- disabled
-
-From: Steve French <stfrench@microsoft.com>
-
-[ Upstream commit 7ef93ffccd55fb0ba000ed16ef6a81cd7dee07b5 ]
-
-We should not be including unused smb20 specific code when legacy
-support is disabled (CONFIG_CIFS_ALLOW_INSECURE_LEGACY turned
-off). For example smb2_operations and smb2_values aren't used
-in that case. Over time we can move more and more SMB1/CIFS and SMB2.0
-code into the insecure legacy ifdefs
-
-Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com>
-Signed-off-by: Steve French <stfrench@microsoft.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/cifs/cifsglob.h | 4 +++-
- fs/cifs/smb2ops.c | 7 ++++++-
- 2 files changed, 9 insertions(+), 2 deletions(-)
-
-diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
-index 9c0e348cb00f..414936989255 100644
---- a/fs/cifs/cifsglob.h
-+++ b/fs/cifs/cifsglob.h
-@@ -1930,11 +1930,13 @@ extern mempool_t *cifs_mid_poolp;
-
- /* Operations for different SMB versions */
- #define SMB1_VERSION_STRING "1.0"
-+#define SMB20_VERSION_STRING "2.0"
-+#ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
- extern struct smb_version_operations smb1_operations;
- extern struct smb_version_values smb1_values;
--#define SMB20_VERSION_STRING "2.0"
- extern struct smb_version_operations smb20_operations;
- extern struct smb_version_values smb20_values;
-+#endif /* CIFS_ALLOW_INSECURE_LEGACY */
- #define SMB21_VERSION_STRING "2.1"
- extern struct smb_version_operations smb21_operations;
- extern struct smb_version_values smb21_values;
-diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
-index 7985fe25850b..57164563eec6 100644
---- a/fs/cifs/smb2ops.c
-+++ b/fs/cifs/smb2ops.c
-@@ -3487,11 +3487,13 @@ smb3_set_oplock_level(struct cifsInodeInfo *cinode, __u32 oplock,
- }
- }
-
-+#ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
- static bool
- smb2_is_read_op(__u32 oplock)
- {
- return oplock == SMB2_OPLOCK_LEVEL_II;
- }
-+#endif /* CIFS_ALLOW_INSECURE_LEGACY */
-
- static bool
- smb21_is_read_op(__u32 oplock)
-@@ -4573,7 +4575,7 @@ smb2_make_node(unsigned int xid, struct inode *inode,
- return rc;
- }
-
--
-+#ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
- struct smb_version_operations smb20_operations = {
- .compare_fids = smb2_compare_fids,
- .setup_request = smb2_setup_request,
-@@ -4670,6 +4672,7 @@ struct smb_version_operations smb20_operations = {
- .fiemap = smb3_fiemap,
- .llseek = smb3_llseek,
- };
-+#endif /* CIFS_ALLOW_INSECURE_LEGACY */
-
- struct smb_version_operations smb21_operations = {
- .compare_fids = smb2_compare_fids,
-@@ -4987,6 +4990,7 @@ struct smb_version_operations smb311_operations = {
- .llseek = smb3_llseek,
- };
-
-+#ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
- struct smb_version_values smb20_values = {
- .version_string = SMB20_VERSION_STRING,
- .protocol_id = SMB20_PROT_ID,
-@@ -5007,6 +5011,7 @@ struct smb_version_values smb20_values = {
- .signing_required = SMB2_NEGOTIATE_SIGNING_REQUIRED,
- .create_lease_size = sizeof(struct create_lease),
- };
-+#endif /* ALLOW_INSECURE_LEGACY */
-
- struct smb_version_values smb21_values = {
- .version_string = SMB21_VERSION_STRING,
---
-2.35.1
-
+++ /dev/null
-From 85593620c88452228dba78a9de0deceda9f7d7cd Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 6 May 2022 17:25:22 +0100
-Subject: clocksource/drivers/sp804: Avoid error on multiple instances
-
-From: Andre Przywara <andre.przywara@arm.com>
-
-[ Upstream commit a98399cbc1e05f7b977419f03905501d566cf54e ]
-
-When a machine sports more than one SP804 timer instance, we only bring
-up the first one, since multiple timers of the same kind are not useful
-to Linux. As this is intentional behaviour, we should not return an
-error message, as we do today:
-===============
-[ 0.000800] Failed to initialize '/bus@8000000/motherboard-bus@8000000/iofpga-bus@300000000/timer@120000': -22
-===============
-
-Replace the -EINVAL return with a debug message and return 0 instead.
-
-Also we do not reach the init function anymore if the DT node is
-disabled (as this is now handled by OF_DECLARE), so remove the explicit
-check for that case.
-
-This fixes a long standing bogus error when booting ARM's fastmodels.
-
-Signed-off-by: Andre Przywara <andre.przywara@arm.com>
-Reviewed-by: Robin Murphy <robin.murphy@arm.com>
-Link: https://lore.kernel.org/r/20220506162522.3675399-1-andre.przywara@arm.com
-Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/clocksource/timer-sp804.c | 10 +++++-----
- 1 file changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/drivers/clocksource/timer-sp804.c b/drivers/clocksource/timer-sp804.c
-index 9c841980eed1..c9aa0498fb84 100644
---- a/drivers/clocksource/timer-sp804.c
-+++ b/drivers/clocksource/timer-sp804.c
-@@ -215,6 +215,11 @@ static int __init sp804_of_init(struct device_node *np)
- struct clk *clk1, *clk2;
- const char *name = of_get_property(np, "compatible", NULL);
-
-+ if (initialized) {
-+ pr_debug("%pOF: skipping further SP804 timer device\n", np);
-+ return 0;
-+ }
-+
- base = of_iomap(np, 0);
- if (!base)
- return -ENXIO;
-@@ -223,11 +228,6 @@ static int __init sp804_of_init(struct device_node *np)
- writel(0, base + TIMER_CTRL);
- writel(0, base + TIMER_2_BASE + TIMER_CTRL);
-
-- if (initialized || !of_device_is_available(np)) {
-- ret = -EINVAL;
-- goto err;
-- }
--
- clk1 = of_clk_get(np, 0);
- if (IS_ERR(clk1))
- clk1 = NULL;
---
-2.35.1
-
+++ /dev/null
-From 5d768bb1c2114889f915d61f5e89908046483371 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 17 Apr 2022 22:16:41 +0800
-Subject: drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop()
-
-From: Duoming Zhou <duoming@zju.edu.cn>
-
-[ Upstream commit 9b6bdbd9337de3917945847bde262a34a87a6303 ]
-
-There is a deadlock in rtllib_beacons_stop(), which is shown
-below:
-
- (Thread 1) | (Thread 2)
- | rtllib_send_beacon()
-rtllib_beacons_stop() | mod_timer()
- spin_lock_irqsave() //(1) | (wait a time)
- ... | rtllib_send_beacon_cb()
- del_timer_sync() | spin_lock_irqsave() //(2)
- (wait timer to stop) | ...
-
-We hold ieee->beacon_lock in position (1) of thread 1 and
-use del_timer_sync() to wait timer to stop, but timer handler
-also need ieee->beacon_lock in position (2) of thread 2.
-As a result, rtllib_beacons_stop() will block forever.
-
-This patch extracts del_timer_sync() from the protection of
-spin_lock_irqsave(), which could let timer handler to obtain
-the needed lock.
-
-Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
-Link: https://lore.kernel.org/r/20220417141641.124388-1-duoming@zju.edu.cn
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/staging/rtl8192e/rtllib_softmac.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/staging/rtl8192e/rtllib_softmac.c b/drivers/staging/rtl8192e/rtllib_softmac.c
-index 4ff8fd694c60..0154f5791b12 100644
---- a/drivers/staging/rtl8192e/rtllib_softmac.c
-+++ b/drivers/staging/rtl8192e/rtllib_softmac.c
-@@ -651,9 +651,9 @@ static void rtllib_beacons_stop(struct rtllib_device *ieee)
- spin_lock_irqsave(&ieee->beacon_lock, flags);
-
- ieee->beacon_txing = 0;
-- del_timer_sync(&ieee->beacon_timer);
-
- spin_unlock_irqrestore(&ieee->beacon_lock, flags);
-+ del_timer_sync(&ieee->beacon_timer);
-
- }
-
---
-2.35.1
-
+++ /dev/null
-From dc58a7bd5a8b348c7c3cbd1bf29207f6cb3787cc Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 17 Apr 2022 21:54:07 +0800
-Subject: drivers: staging: rtl8192u: Fix deadlock in ieee80211_beacons_stop()
-
-From: Duoming Zhou <duoming@zju.edu.cn>
-
-[ Upstream commit 806c7b53414934ba2a39449b31fd1a038e500273 ]
-
-There is a deadlock in ieee80211_beacons_stop(), which is shown below:
-
- (Thread 1) | (Thread 2)
- | ieee80211_send_beacon()
-ieee80211_beacons_stop() | mod_timer()
- spin_lock_irqsave() //(1) | (wait a time)
- ... | ieee80211_send_beacon_cb()
- del_timer_sync() | spin_lock_irqsave() //(2)
- (wait timer to stop) | ...
-
-We hold ieee->beacon_lock in position (1) of thread 1 and use
-del_timer_sync() to wait timer to stop, but timer handler
-also need ieee->beacon_lock in position (2) of thread 2.
-As a result, ieee80211_beacons_stop() will block forever.
-
-This patch extracts del_timer_sync() from the protection of
-spin_lock_irqsave(), which could let timer handler to obtain
-the needed lock.
-
-Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
-Link: https://lore.kernel.org/r/20220417135407.109536-1-duoming@zju.edu.cn
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c b/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c
-index 33a6af7aad22..a869694337f7 100644
---- a/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c
-+++ b/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c
-@@ -528,9 +528,9 @@ static void ieee80211_beacons_stop(struct ieee80211_device *ieee)
- spin_lock_irqsave(&ieee->beacon_lock, flags);
-
- ieee->beacon_txing = 0;
-- del_timer_sync(&ieee->beacon_timer);
-
- spin_unlock_irqrestore(&ieee->beacon_lock, flags);
-+ del_timer_sync(&ieee->beacon_timer);
- }
-
- void ieee80211_stop_send_beacons(struct ieee80211_device *ieee)
---
-2.35.1
-
+++ /dev/null
-From f2f635fb9718c49e557d2f5fca4812216f2c5f33 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 17 Apr 2022 19:16:26 +0800
-Subject: drivers: tty: serial: Fix deadlock in sa1100_set_termios()
-
-From: Duoming Zhou <duoming@zju.edu.cn>
-
-[ Upstream commit 62b2caef400c1738b6d22f636c628d9f85cd4c4c ]
-
-There is a deadlock in sa1100_set_termios(), which is shown
-below:
-
- (Thread 1) | (Thread 2)
- | sa1100_enable_ms()
-sa1100_set_termios() | mod_timer()
- spin_lock_irqsave() //(1) | (wait a time)
- ... | sa1100_timeout()
- del_timer_sync() | spin_lock_irqsave() //(2)
- (wait timer to stop) | ...
-
-We hold sport->port.lock in position (1) of thread 1 and
-use del_timer_sync() to wait timer to stop, but timer handler
-also need sport->port.lock in position (2) of thread 2. As a result,
-sa1100_set_termios() will block forever.
-
-This patch moves del_timer_sync() before spin_lock_irqsave()
-in order to prevent the deadlock.
-
-Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
-Link: https://lore.kernel.org/r/20220417111626.7802-1-duoming@zju.edu.cn
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/tty/serial/sa1100.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/tty/serial/sa1100.c b/drivers/tty/serial/sa1100.c
-index 8e618129e65c..ff4b44bdf6b6 100644
---- a/drivers/tty/serial/sa1100.c
-+++ b/drivers/tty/serial/sa1100.c
-@@ -454,6 +454,8 @@ sa1100_set_termios(struct uart_port *port, struct ktermios *termios,
- baud = uart_get_baud_rate(port, termios, old, 0, port->uartclk/16);
- quot = uart_get_divisor(port, baud);
-
-+ del_timer_sync(&sport->timer);
-+
- spin_lock_irqsave(&sport->port.lock, flags);
-
- sport->port.read_status_mask &= UTSR0_TO_SM(UTSR0_TFS);
-@@ -484,8 +486,6 @@ sa1100_set_termios(struct uart_port *port, struct ktermios *termios,
- UTSR1_TO_SM(UTSR1_ROR);
- }
-
-- del_timer_sync(&sport->timer);
--
- /*
- * Update the per-port timeout.
- */
---
-2.35.1
-
+++ /dev/null
-From a32eba7fcf32331222b91c602853f7024e6659e3 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 17 Apr 2022 20:03:05 +0800
-Subject: drivers: usb: host: Fix deadlock in oxu_bus_suspend()
-
-From: Duoming Zhou <duoming@zju.edu.cn>
-
-[ Upstream commit 4d378f2ae58138d4c55684e1d274e7dd94aa6524 ]
-
-There is a deadlock in oxu_bus_suspend(), which is shown below:
-
- (Thread 1) | (Thread 2)
- | timer_action()
-oxu_bus_suspend() | mod_timer()
- spin_lock_irq() //(1) | (wait a time)
- ... | oxu_watchdog()
- del_timer_sync() | spin_lock_irq() //(2)
- (wait timer to stop) | ...
-
-We hold oxu->lock in position (1) of thread 1, and use
-del_timer_sync() to wait timer to stop, but timer handler
-also need oxu->lock in position (2) of thread 2. As a result,
-oxu_bus_suspend() will block forever.
-
-This patch extracts del_timer_sync() from the protection of
-spin_lock_irq(), which could let timer handler to obtain
-the needed lock.
-
-Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
-Link: https://lore.kernel.org/r/20220417120305.64577-1-duoming@zju.edu.cn
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/host/oxu210hp-hcd.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/drivers/usb/host/oxu210hp-hcd.c b/drivers/usb/host/oxu210hp-hcd.c
-index 65985247fc00..f05b6f2b0865 100644
---- a/drivers/usb/host/oxu210hp-hcd.c
-+++ b/drivers/usb/host/oxu210hp-hcd.c
-@@ -3906,8 +3906,10 @@ static int oxu_bus_suspend(struct usb_hcd *hcd)
- }
- }
-
-+ spin_unlock_irq(&oxu->lock);
- /* turn off now-idle HC */
- del_timer_sync(&oxu->watchdog);
-+ spin_lock_irq(&oxu->lock);
- ehci_halt(oxu);
- hcd->state = HC_STATE_SUSPENDED;
-
---
-2.35.1
-
+++ /dev/null
-From 78c2356bacc6fab62b20de1f53c3e5a331e4cd29 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 17 May 2022 17:57:00 +0800
-Subject: drm/radeon: fix a possible null pointer dereference
-
-From: Gong Yuanjun <ruc_gongyuanjun@163.com>
-
-[ Upstream commit a2b28708b645c5632dc93669ab06e97874c8244f ]
-
-In radeon_fp_native_mode(), the return value of drm_mode_duplicate()
-is assigned to mode, which will lead to a NULL pointer dereference
-on failure of drm_mode_duplicate(). Add a check to avoid npd.
-
-The failure status of drm_cvt_mode() on the other path is checked too.
-
-Signed-off-by: Gong Yuanjun <ruc_gongyuanjun@163.com>
-Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/radeon/radeon_connectors.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
-index bc63f4cecf5d..ca6ccd69424e 100644
---- a/drivers/gpu/drm/radeon/radeon_connectors.c
-+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
-@@ -477,6 +477,8 @@ static struct drm_display_mode *radeon_fp_native_mode(struct drm_encoder *encode
- native_mode->vdisplay != 0 &&
- native_mode->clock != 0) {
- mode = drm_mode_duplicate(dev, native_mode);
-+ if (!mode)
-+ return NULL;
- mode->type = DRM_MODE_TYPE_PREFERRED | DRM_MODE_TYPE_DRIVER;
- drm_mode_set_name(mode);
-
-@@ -491,6 +493,8 @@ static struct drm_display_mode *radeon_fp_native_mode(struct drm_encoder *encode
- * simpler.
- */
- mode = drm_cvt_mode(dev, native_mode->hdisplay, native_mode->vdisplay, 60, true, false, false);
-+ if (!mode)
-+ return NULL;
- mode->type = DRM_MODE_TYPE_PREFERRED | DRM_MODE_TYPE_DRIVER;
- DRM_DEBUG_KMS("Adding cvt approximation of native panel mode %s\n", mode->name);
- }
---
-2.35.1
-
+++ /dev/null
-From 0c83aaf031418486d5d9cfca0442e454023b30a2 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 27 Apr 2022 12:00:05 +0900
-Subject: extcon: Modify extcon device to be created after driver data is set
-
-From: bumwoo lee <bw365.lee@samsung.com>
-
-[ Upstream commit 5dcc2afe716d69f5112ce035cb14f007461ff189 ]
-
-Currently, someone can invoke the sysfs such as state_show()
-intermittently before dev_set_drvdata() is done.
-And it can be a cause of kernel Oops because of edev is Null at that time.
-So modified the driver registration to after setting drviver data.
-
-- Oops's backtrace.
-
-Backtrace:
-[<c067865c>] (state_show) from [<c05222e8>] (dev_attr_show)
-[<c05222c0>] (dev_attr_show) from [<c02c66e0>] (sysfs_kf_seq_show)
-[<c02c6648>] (sysfs_kf_seq_show) from [<c02c496c>] (kernfs_seq_show)
-[<c02c4938>] (kernfs_seq_show) from [<c025e2a0>] (seq_read)
-[<c025e11c>] (seq_read) from [<c02c50a0>] (kernfs_fop_read)
-[<c02c5064>] (kernfs_fop_read) from [<c0231cac>] (__vfs_read)
-[<c0231c5c>] (__vfs_read) from [<c0231ee0>] (vfs_read)
-[<c0231e34>] (vfs_read) from [<c0232464>] (ksys_read)
-[<c02323f0>] (ksys_read) from [<c02324fc>] (sys_read)
-[<c02324e4>] (sys_read) from [<c00091d0>] (__sys_trace_return)
-
-Signed-off-by: bumwoo lee <bw365.lee@samsung.com>
-Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/extcon/extcon.c | 29 +++++++++++++++++------------
- 1 file changed, 17 insertions(+), 12 deletions(-)
-
-diff --git a/drivers/extcon/extcon.c b/drivers/extcon/extcon.c
-index 5c9e156cd086..6b905c3d30f4 100644
---- a/drivers/extcon/extcon.c
-+++ b/drivers/extcon/extcon.c
-@@ -1230,19 +1230,14 @@ int extcon_dev_register(struct extcon_dev *edev)
- edev->dev.type = &edev->extcon_dev_type;
- }
-
-- ret = device_register(&edev->dev);
-- if (ret) {
-- put_device(&edev->dev);
-- goto err_dev;
-- }
--
- spin_lock_init(&edev->lock);
-- edev->nh = devm_kcalloc(&edev->dev, edev->max_supported,
-- sizeof(*edev->nh), GFP_KERNEL);
-- if (!edev->nh) {
-- ret = -ENOMEM;
-- device_unregister(&edev->dev);
-- goto err_dev;
-+ if (edev->max_supported) {
-+ edev->nh = kcalloc(edev->max_supported, sizeof(*edev->nh),
-+ GFP_KERNEL);
-+ if (!edev->nh) {
-+ ret = -ENOMEM;
-+ goto err_alloc_nh;
-+ }
- }
-
- for (index = 0; index < edev->max_supported; index++)
-@@ -1253,6 +1248,12 @@ int extcon_dev_register(struct extcon_dev *edev)
- dev_set_drvdata(&edev->dev, edev);
- edev->state = 0;
-
-+ ret = device_register(&edev->dev);
-+ if (ret) {
-+ put_device(&edev->dev);
-+ goto err_dev;
-+ }
-+
- mutex_lock(&extcon_dev_list_lock);
- list_add(&edev->entry, &extcon_dev_list);
- mutex_unlock(&extcon_dev_list_lock);
-@@ -1260,6 +1261,9 @@ int extcon_dev_register(struct extcon_dev *edev)
- return 0;
-
- err_dev:
-+ if (edev->max_supported)
-+ kfree(edev->nh);
-+err_alloc_nh:
- if (edev->max_supported)
- kfree(edev->extcon_dev_type.groups);
- err_alloc_groups:
-@@ -1320,6 +1324,7 @@ void extcon_dev_unregister(struct extcon_dev *edev)
- if (edev->max_supported) {
- kfree(edev->extcon_dev_type.groups);
- kfree(edev->cables);
-+ kfree(edev->nh);
- }
-
- put_device(&edev->dev);
---
-2.35.1
-
+++ /dev/null
-From 171e8f304848860347dc381cd54c7ef333e3c99d Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 5 Mar 2022 11:14:05 +0800
-Subject: iio: dummy: iio_simple_dummy: check the return value of kstrdup()
-
-From: Xiaoke Wang <xkernel.wang@foxmail.com>
-
-[ Upstream commit ba93642188a6fed754bf7447f638bc410e05a929 ]
-
-kstrdup() is also a memory allocation-related function, it returns NULL
-when some memory errors happen. So it is better to check the return
-value of it so to catch the memory error in time. Besides, there should
-have a kfree() to clear up the allocation if we get a failure later in
-this function to prevent memory leak.
-
-Signed-off-by: Xiaoke Wang <xkernel.wang@foxmail.com>
-Link: https://lore.kernel.org/r/tencent_C920CFCC33B9CC1C63141FE1334A39FF8508@qq.com
-Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/iio/dummy/iio_simple_dummy.c | 20 ++++++++++++--------
- 1 file changed, 12 insertions(+), 8 deletions(-)
-
-diff --git a/drivers/iio/dummy/iio_simple_dummy.c b/drivers/iio/dummy/iio_simple_dummy.c
-index 6cb02299a215..18cfe1cb7a40 100644
---- a/drivers/iio/dummy/iio_simple_dummy.c
-+++ b/drivers/iio/dummy/iio_simple_dummy.c
-@@ -568,10 +568,9 @@ static struct iio_sw_device *iio_dummy_probe(const char *name)
- struct iio_sw_device *swd;
-
- swd = kzalloc(sizeof(*swd), GFP_KERNEL);
-- if (!swd) {
-- ret = -ENOMEM;
-- goto error_kzalloc;
-- }
-+ if (!swd)
-+ return ERR_PTR(-ENOMEM);
-+
- /*
- * Allocate an IIO device.
- *
-@@ -583,7 +582,7 @@ static struct iio_sw_device *iio_dummy_probe(const char *name)
- indio_dev = iio_device_alloc(sizeof(*st));
- if (!indio_dev) {
- ret = -ENOMEM;
-- goto error_ret;
-+ goto error_free_swd;
- }
-
- st = iio_priv(indio_dev);
-@@ -614,6 +613,10 @@ static struct iio_sw_device *iio_dummy_probe(const char *name)
- * indio_dev->name = spi_get_device_id(spi)->name;
- */
- indio_dev->name = kstrdup(name, GFP_KERNEL);
-+ if (!indio_dev->name) {
-+ ret = -ENOMEM;
-+ goto error_free_device;
-+ }
-
- /* Provide description of available channels */
- indio_dev->channels = iio_dummy_channels;
-@@ -630,7 +633,7 @@ static struct iio_sw_device *iio_dummy_probe(const char *name)
-
- ret = iio_simple_dummy_events_register(indio_dev);
- if (ret < 0)
-- goto error_free_device;
-+ goto error_free_name;
-
- ret = iio_simple_dummy_configure_buffer(indio_dev);
- if (ret < 0)
-@@ -647,11 +650,12 @@ static struct iio_sw_device *iio_dummy_probe(const char *name)
- iio_simple_dummy_unconfigure_buffer(indio_dev);
- error_unregister_events:
- iio_simple_dummy_events_unregister(indio_dev);
-+error_free_name:
-+ kfree(indio_dev->name);
- error_free_device:
- iio_device_free(indio_dev);
--error_ret:
-+error_free_swd:
- kfree(swd);
--error_kzalloc:
- return ERR_PTR(ret);
- }
-
---
-2.35.1
-
+++ /dev/null
-From 1973420fcc435022f93847c25a0c9f6bf0aa838a Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 7 Feb 2022 15:38:33 +0100
-Subject: iio: st_sensors: Add a local lock for protecting odr
-
-From: Miquel Raynal <miquel.raynal@bootlin.com>
-
-[ Upstream commit 474010127e2505fc463236470908e1ff5ddb3578 ]
-
-Right now the (framework) mlock lock is (ab)used for multiple purposes:
-1- protecting concurrent accesses over the odr local cache
-2- avoid changing samplig frequency whilst buffer is running
-
-Let's start by handling situation #1 with a local lock.
-
-Suggested-by: Jonathan Cameron <jic23@kernel.org>
-Cc: Denis Ciocca <denis.ciocca@st.com>
-Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
-Link: https://lore.kernel.org/r/20220207143840.707510-7-miquel.raynal@bootlin.com
-Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- .../iio/common/st_sensors/st_sensors_core.c | 24 ++++++++++++++-----
- include/linux/iio/common/st_sensors.h | 3 +++
- 2 files changed, 21 insertions(+), 6 deletions(-)
-
-diff --git a/drivers/iio/common/st_sensors/st_sensors_core.c b/drivers/iio/common/st_sensors/st_sensors_core.c
-index 364683783ae5..c25b0bc89b0c 100644
---- a/drivers/iio/common/st_sensors/st_sensors_core.c
-+++ b/drivers/iio/common/st_sensors/st_sensors_core.c
-@@ -76,16 +76,18 @@ static int st_sensors_match_odr(struct st_sensor_settings *sensor_settings,
-
- int st_sensors_set_odr(struct iio_dev *indio_dev, unsigned int odr)
- {
-- int err;
-+ int err = 0;
- struct st_sensor_odr_avl odr_out = {0, 0};
- struct st_sensor_data *sdata = iio_priv(indio_dev);
-
-+ mutex_lock(&sdata->odr_lock);
-+
- if (!sdata->sensor_settings->odr.mask)
-- return 0;
-+ goto unlock_mutex;
-
- err = st_sensors_match_odr(sdata->sensor_settings, odr, &odr_out);
- if (err < 0)
-- goto st_sensors_match_odr_error;
-+ goto unlock_mutex;
-
- if ((sdata->sensor_settings->odr.addr ==
- sdata->sensor_settings->pw.addr) &&
-@@ -108,7 +110,9 @@ int st_sensors_set_odr(struct iio_dev *indio_dev, unsigned int odr)
- if (err >= 0)
- sdata->odr = odr_out.hz;
-
--st_sensors_match_odr_error:
-+unlock_mutex:
-+ mutex_unlock(&sdata->odr_lock);
-+
- return err;
- }
- EXPORT_SYMBOL(st_sensors_set_odr);
-@@ -384,6 +388,8 @@ int st_sensors_init_sensor(struct iio_dev *indio_dev,
- struct st_sensors_platform_data *of_pdata;
- int err = 0;
-
-+ mutex_init(&sdata->odr_lock);
-+
- /* If OF/DT pdata exists, it will take precedence of anything else */
- of_pdata = st_sensors_of_probe(indio_dev->dev.parent, pdata);
- if (of_pdata)
-@@ -575,18 +581,24 @@ int st_sensors_read_info_raw(struct iio_dev *indio_dev,
- err = -EBUSY;
- goto out;
- } else {
-+ mutex_lock(&sdata->odr_lock);
- err = st_sensors_set_enable(indio_dev, true);
-- if (err < 0)
-+ if (err < 0) {
-+ mutex_unlock(&sdata->odr_lock);
- goto out;
-+ }
-
- msleep((sdata->sensor_settings->bootime * 1000) / sdata->odr);
- err = st_sensors_read_axis_data(indio_dev, ch, val);
-- if (err < 0)
-+ if (err < 0) {
-+ mutex_unlock(&sdata->odr_lock);
- goto out;
-+ }
-
- *val = *val >> ch->scan_type.shift;
-
- err = st_sensors_set_enable(indio_dev, false);
-+ mutex_unlock(&sdata->odr_lock);
- }
- out:
- mutex_unlock(&indio_dev->mlock);
-diff --git a/include/linux/iio/common/st_sensors.h b/include/linux/iio/common/st_sensors.h
-index 686be532f4cb..7816bf070f83 100644
---- a/include/linux/iio/common/st_sensors.h
-+++ b/include/linux/iio/common/st_sensors.h
-@@ -228,6 +228,7 @@ struct st_sensor_settings {
- * @hw_irq_trigger: if we're using the hardware interrupt on the sensor.
- * @hw_timestamp: Latest timestamp from the interrupt handler, when in use.
- * @buffer_data: Data used by buffer part.
-+ * @odr_lock: Local lock for preventing concurrent ODR accesses/changes
- */
- struct st_sensor_data {
- struct device *dev;
-@@ -253,6 +254,8 @@ struct st_sensor_data {
- s64 hw_timestamp;
-
- char buffer_data[ST_SENSORS_MAX_BUFFER_SIZE] ____cacheline_aligned;
-+
-+ struct mutex odr_lock;
- };
-
- #ifdef CONFIG_IIO_BUFFER
---
-2.35.1
-
+++ /dev/null
-From 314a95ca68c5cbeda9ac37f0bc96ad945e6d39dd Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 16 May 2022 12:09:51 -0700
-Subject: kernfs: Separate kernfs_pr_cont_buf and rename_lock.
-
-From: Hao Luo <haoluo@google.com>
-
-[ Upstream commit 1a702dc88e150487c9c173a249b3d236498b9183 ]
-
-Previously the protection of kernfs_pr_cont_buf was piggy backed by
-rename_lock, which means that pr_cont() needs to be protected under
-rename_lock. This can cause potential circular lock dependencies.
-
-If there is an OOM, we have the following call hierarchy:
-
- -> cpuset_print_current_mems_allowed()
- -> pr_cont_cgroup_name()
- -> pr_cont_kernfs_name()
-
-pr_cont_kernfs_name() will grab rename_lock and call printk. So we have
-the following lock dependencies:
-
- kernfs_rename_lock -> console_sem
-
-Sometimes, printk does a wakeup before releasing console_sem, which has
-the dependence chain:
-
- console_sem -> p->pi_lock -> rq->lock
-
-Now, imagine one wants to read cgroup_name under rq->lock, for example,
-printing cgroup_name in a tracepoint in the scheduler code. They will
-be holding rq->lock and take rename_lock:
-
- rq->lock -> kernfs_rename_lock
-
-Now they will deadlock.
-
-A prevention to this circular lock dependency is to separate the
-protection of pr_cont_buf from rename_lock. In principle, rename_lock
-is to protect the integrity of cgroup name when copying to buf. Once
-pr_cont_buf has got its content, rename_lock can be dropped. So it's
-safe to drop rename_lock after kernfs_name_locked (and
-kernfs_path_from_node_locked) and rely on a dedicated pr_cont_lock
-to protect pr_cont_buf.
-
-Acked-by: Tejun Heo <tj@kernel.org>
-Signed-off-by: Hao Luo <haoluo@google.com>
-Link: https://lore.kernel.org/r/20220516190951.3144144-1-haoluo@google.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/kernfs/dir.c | 31 +++++++++++++++++++------------
- 1 file changed, 19 insertions(+), 12 deletions(-)
-
-diff --git a/fs/kernfs/dir.c b/fs/kernfs/dir.c
-index 7d4af6cea2a6..99ee657596b5 100644
---- a/fs/kernfs/dir.c
-+++ b/fs/kernfs/dir.c
-@@ -19,7 +19,15 @@
-
- DEFINE_MUTEX(kernfs_mutex);
- static DEFINE_SPINLOCK(kernfs_rename_lock); /* kn->parent and ->name */
--static char kernfs_pr_cont_buf[PATH_MAX]; /* protected by rename_lock */
-+/*
-+ * Don't use rename_lock to piggy back on pr_cont_buf. We don't want to
-+ * call pr_cont() while holding rename_lock. Because sometimes pr_cont()
-+ * will perform wakeups when releasing console_sem. Holding rename_lock
-+ * will introduce deadlock if the scheduler reads the kernfs_name in the
-+ * wakeup path.
-+ */
-+static DEFINE_SPINLOCK(kernfs_pr_cont_lock);
-+static char kernfs_pr_cont_buf[PATH_MAX]; /* protected by pr_cont_lock */
- static DEFINE_SPINLOCK(kernfs_idr_lock); /* root->ino_idr */
-
- #define rb_to_kn(X) rb_entry((X), struct kernfs_node, rb)
-@@ -230,12 +238,12 @@ void pr_cont_kernfs_name(struct kernfs_node *kn)
- {
- unsigned long flags;
-
-- spin_lock_irqsave(&kernfs_rename_lock, flags);
-+ spin_lock_irqsave(&kernfs_pr_cont_lock, flags);
-
-- kernfs_name_locked(kn, kernfs_pr_cont_buf, sizeof(kernfs_pr_cont_buf));
-+ kernfs_name(kn, kernfs_pr_cont_buf, sizeof(kernfs_pr_cont_buf));
- pr_cont("%s", kernfs_pr_cont_buf);
-
-- spin_unlock_irqrestore(&kernfs_rename_lock, flags);
-+ spin_unlock_irqrestore(&kernfs_pr_cont_lock, flags);
- }
-
- /**
-@@ -249,10 +257,10 @@ void pr_cont_kernfs_path(struct kernfs_node *kn)
- unsigned long flags;
- int sz;
-
-- spin_lock_irqsave(&kernfs_rename_lock, flags);
-+ spin_lock_irqsave(&kernfs_pr_cont_lock, flags);
-
-- sz = kernfs_path_from_node_locked(kn, NULL, kernfs_pr_cont_buf,
-- sizeof(kernfs_pr_cont_buf));
-+ sz = kernfs_path_from_node(kn, NULL, kernfs_pr_cont_buf,
-+ sizeof(kernfs_pr_cont_buf));
- if (sz < 0) {
- pr_cont("(error)");
- goto out;
-@@ -266,7 +274,7 @@ void pr_cont_kernfs_path(struct kernfs_node *kn)
- pr_cont("%s", kernfs_pr_cont_buf);
-
- out:
-- spin_unlock_irqrestore(&kernfs_rename_lock, flags);
-+ spin_unlock_irqrestore(&kernfs_pr_cont_lock, flags);
- }
-
- /**
-@@ -870,13 +878,12 @@ static struct kernfs_node *kernfs_walk_ns(struct kernfs_node *parent,
-
- lockdep_assert_held(&kernfs_mutex);
-
-- /* grab kernfs_rename_lock to piggy back on kernfs_pr_cont_buf */
-- spin_lock_irq(&kernfs_rename_lock);
-+ spin_lock_irq(&kernfs_pr_cont_lock);
-
- len = strlcpy(kernfs_pr_cont_buf, path, sizeof(kernfs_pr_cont_buf));
-
- if (len >= sizeof(kernfs_pr_cont_buf)) {
-- spin_unlock_irq(&kernfs_rename_lock);
-+ spin_unlock_irq(&kernfs_pr_cont_lock);
- return NULL;
- }
-
-@@ -888,7 +895,7 @@ static struct kernfs_node *kernfs_walk_ns(struct kernfs_node *parent,
- parent = kernfs_find_ns(parent, name, ns);
- }
-
-- spin_unlock_irq(&kernfs_rename_lock);
-+ spin_unlock_irq(&kernfs_pr_cont_lock);
-
- return parent;
- }
---
-2.35.1
-
+++ /dev/null
-From 9982bb566d6c5fa21bca3c8bdeef16e5ac208f50 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 16 Feb 2022 12:15:03 -0800
-Subject: lkdtm/usercopy: Expand size of "out of frame" object
-
-From: Kees Cook <keescook@chromium.org>
-
-[ Upstream commit f387e86d3a74407bdd9c5815820ac9d060962840 ]
-
-To be sufficiently out of range for the usercopy test to see the lifetime
-mismatch, expand the size of the "bad" buffer, which will let it be
-beyond current_stack_pointer regardless of stack growth direction.
-Paired with the recent addition of stack depth checking under
-CONFIG_HARDENED_USERCOPY=y, this will correctly start tripping again.
-
-Reported-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
-Cc: Arnd Bergmann <arnd@arndb.de>
-Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Reviewed-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
-Link: https://lore.kernel.org/lkml/762faf1b-0443-5ddf-4430-44a20cf2ec4d@collabora.com/
-Signed-off-by: Kees Cook <keescook@chromium.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/misc/lkdtm/usercopy.c | 17 ++++++++++++++---
- 1 file changed, 14 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/misc/lkdtm/usercopy.c b/drivers/misc/lkdtm/usercopy.c
-index e172719dd86d..4617c63b1026 100644
---- a/drivers/misc/lkdtm/usercopy.c
-+++ b/drivers/misc/lkdtm/usercopy.c
-@@ -30,12 +30,12 @@ static const unsigned char test_text[] = "This is a test.\n";
- */
- static noinline unsigned char *trick_compiler(unsigned char *stack)
- {
-- return stack + 0;
-+ return stack + unconst;
- }
-
- static noinline unsigned char *do_usercopy_stack_callee(int value)
- {
-- unsigned char buf[32];
-+ unsigned char buf[128];
- int i;
-
- /* Exercise stack to avoid everything living in registers. */
-@@ -43,7 +43,12 @@ static noinline unsigned char *do_usercopy_stack_callee(int value)
- buf[i] = value & 0xff;
- }
-
-- return trick_compiler(buf);
-+ /*
-+ * Put the target buffer in the middle of stack allocation
-+ * so that we don't step on future stack users regardless
-+ * of stack growth direction.
-+ */
-+ return trick_compiler(&buf[(128/2)-32]);
- }
-
- static noinline void do_usercopy_stack(bool to_user, bool bad_frame)
-@@ -66,6 +71,12 @@ static noinline void do_usercopy_stack(bool to_user, bool bad_frame)
- bad_stack -= sizeof(unsigned long);
- }
-
-+#ifdef ARCH_HAS_CURRENT_STACK_POINTER
-+ pr_info("stack : %px\n", (void *)current_stack_pointer);
-+#endif
-+ pr_info("good_stack: %px-%px\n", good_stack, good_stack + sizeof(good_stack));
-+ pr_info("bad_stack : %px-%px\n", bad_stack, bad_stack + sizeof(good_stack));
-+
- user_addr = vm_mmap(NULL, 0, PAGE_SIZE,
- PROT_READ | PROT_WRITE | PROT_EXEC,
- MAP_ANONYMOUS | MAP_PRIVATE, 0);
---
-2.35.1
-
+++ /dev/null
-From 03ce42d9156493b91fe289d663ad7c6a8de207e9 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 29 Apr 2022 16:49:09 +0800
-Subject: md: protect md_unregister_thread from reentrancy
-
-From: Guoqing Jiang <guoqing.jiang@cloud.ionos.com>
-
-[ Upstream commit 1e267742283a4b5a8ca65755c44166be27e9aa0f ]
-
-Generally, the md_unregister_thread is called with reconfig_mutex, but
-raid_message in dm-raid doesn't hold reconfig_mutex to unregister thread,
-so md_unregister_thread can be called simulitaneously from two call sites
-in theory.
-
-Then after previous commit which remove the protection of reconfig_mutex
-for md_unregister_thread completely, the potential issue could be worse
-than before.
-
-Let's take pers_lock at the beginning of function to ensure reentrancy.
-
-Reported-by: Donald Buczek <buczek@molgen.mpg.de>
-Signed-off-by: Guoqing Jiang <guoqing.jiang@linux.dev>
-Signed-off-by: Song Liu <song@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/md/md.c | 15 ++++++++++-----
- 1 file changed, 10 insertions(+), 5 deletions(-)
-
-diff --git a/drivers/md/md.c b/drivers/md/md.c
-index 4d1ef470f2fa..11fd3b32b562 100644
---- a/drivers/md/md.c
-+++ b/drivers/md/md.c
-@@ -7777,17 +7777,22 @@ EXPORT_SYMBOL(md_register_thread);
-
- void md_unregister_thread(struct md_thread **threadp)
- {
-- struct md_thread *thread = *threadp;
-- if (!thread)
-- return;
-- pr_debug("interrupting MD-thread pid %d\n", task_pid_nr(thread->tsk));
-- /* Locking ensures that mddev_unlock does not wake_up a
-+ struct md_thread *thread;
-+
-+ /*
-+ * Locking ensures that mddev_unlock does not wake_up a
- * non-existent thread
- */
- spin_lock(&pers_lock);
-+ thread = *threadp;
-+ if (!thread) {
-+ spin_unlock(&pers_lock);
-+ return;
-+ }
- *threadp = NULL;
- spin_unlock(&pers_lock);
-
-+ pr_debug("interrupting MD-thread pid %d\n", task_pid_nr(thread->tsk));
- kthread_stop(thread->tsk);
- kfree(thread);
- }
---
-2.35.1
-
+++ /dev/null
-From 2ffec88231dc331af44e58722774223117d28b42 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 29 Apr 2022 15:09:13 -0600
-Subject: misc: rtsx: set NULL intfdata when probe fails
-
-From: Shuah Khan <skhan@linuxfoundation.org>
-
-[ Upstream commit f861d36e021e1ac4a0a2a1f6411d623809975d63 ]
-
-rtsx_usb_probe() doesn't call usb_set_intfdata() to null out the
-interface pointer when probe fails. This leaves a stale pointer.
-Noticed the missing usb_set_intfdata() while debugging an unrelated
-invalid DMA mapping problem.
-
-Fix it with a call to usb_set_intfdata(..., NULL).
-
-Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
-Link: https://lore.kernel.org/r/20220429210913.46804-1-skhan@linuxfoundation.org
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/misc/cardreader/rtsx_usb.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/drivers/misc/cardreader/rtsx_usb.c b/drivers/misc/cardreader/rtsx_usb.c
-index a328cab11014..4aef33d07cc3 100644
---- a/drivers/misc/cardreader/rtsx_usb.c
-+++ b/drivers/misc/cardreader/rtsx_usb.c
-@@ -667,6 +667,7 @@ static int rtsx_usb_probe(struct usb_interface *intf,
- return 0;
-
- out_init_fail:
-+ usb_set_intfdata(ucr->pusb_intf, NULL);
- usb_free_coherent(ucr->pusb_dev, IOBUF_SIZE, ucr->iobuf,
- ucr->iobuf_dma);
- return ret;
---
-2.35.1
-
+++ /dev/null
-From 1c8416f44678bea1e5ad790b0913d738b26213d1 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 24 May 2022 01:46:22 +0900
-Subject: modpost: fix undefined behavior of is_arm_mapping_symbol()
-
-From: Masahiro Yamada <masahiroy@kernel.org>
-
-[ Upstream commit d6b732666a1bae0df3c3ae06925043bba34502b1 ]
-
-The return value of is_arm_mapping_symbol() is unpredictable when "$"
-is passed in.
-
-strchr(3) says:
- The strchr() and strrchr() functions return a pointer to the matched
- character or NULL if the character is not found. The terminating null
- byte is considered part of the string, so that if c is specified as
- '\0', these functions return a pointer to the terminator.
-
-When str[1] is '\0', strchr("axtd", str[1]) is not NULL, and str[2] is
-referenced (i.e. buffer overrun).
-
-Test code
----------
-
- char str1[] = "abc";
- char str2[] = "ab";
-
- strcpy(str1, "$");
- strcpy(str2, "$");
-
- printf("test1: %d\n", is_arm_mapping_symbol(str1));
- printf("test2: %d\n", is_arm_mapping_symbol(str2));
-
-Result
-------
-
- test1: 0
- test2: 1
-
-Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
-Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- scripts/mod/modpost.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
-index 74e2052f429d..59011ddf8bb8 100644
---- a/scripts/mod/modpost.c
-+++ b/scripts/mod/modpost.c
-@@ -1283,7 +1283,8 @@ static int secref_whitelist(const struct sectioncheck *mismatch,
-
- static inline int is_arm_mapping_symbol(const char *str)
- {
-- return str[0] == '$' && strchr("axtd", str[1])
-+ return str[0] == '$' &&
-+ (str[1] == 'a' || str[1] == 'd' || str[1] == 't' || str[1] == 'x')
- && (str[2] == '\0' || str[2] == '.');
- }
-
---
-2.35.1
-
+++ /dev/null
-From 833347952c126bfd6efc3e2d35ab0f4e84a21393 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 21 May 2022 15:37:44 +0800
-Subject: nbd: call genl_unregister_family() first in nbd_cleanup()
-
-From: Yu Kuai <yukuai3@huawei.com>
-
-[ Upstream commit 06c4da89c24e7023ea448cadf8e9daf06a0aae6e ]
-
-Otherwise there may be race between module removal and the handling of
-netlink command, which can lead to the oops as shown below:
-
- BUG: kernel NULL pointer dereference, address: 0000000000000098
- Oops: 0002 [#1] SMP PTI
- CPU: 1 PID: 31299 Comm: nbd-client Tainted: G E 5.14.0-rc4
- Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
- RIP: 0010:down_write+0x1a/0x50
- Call Trace:
- start_creating+0x89/0x130
- debugfs_create_dir+0x1b/0x130
- nbd_start_device+0x13d/0x390 [nbd]
- nbd_genl_connect+0x42f/0x748 [nbd]
- genl_family_rcv_msg_doit.isra.0+0xec/0x150
- genl_rcv_msg+0xe5/0x1e0
- netlink_rcv_skb+0x55/0x100
- genl_rcv+0x29/0x40
- netlink_unicast+0x1a8/0x250
- netlink_sendmsg+0x21b/0x430
- ____sys_sendmsg+0x2a4/0x2d0
- ___sys_sendmsg+0x81/0xc0
- __sys_sendmsg+0x62/0xb0
- __x64_sys_sendmsg+0x1f/0x30
- do_syscall_64+0x3b/0xc0
- entry_SYSCALL_64_after_hwframe+0x44/0xae
- Modules linked in: nbd(E-)
-
-Signed-off-by: Hou Tao <houtao1@huawei.com>
-Signed-off-by: Yu Kuai <yukuai3@huawei.com>
-Reviewed-by: Josef Bacik <josef@toxicpanda.com>
-Link: https://lore.kernel.org/r/20220521073749.3146892-2-yukuai3@huawei.com
-Signed-off-by: Jens Axboe <axboe@kernel.dk>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/block/nbd.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
-index 510e75435c43..f3425e51a54b 100644
---- a/drivers/block/nbd.c
-+++ b/drivers/block/nbd.c
-@@ -2446,6 +2446,12 @@ static void __exit nbd_cleanup(void)
- struct nbd_device *nbd;
- LIST_HEAD(del_list);
-
-+ /*
-+ * Unregister netlink interface prior to waiting
-+ * for the completion of netlink commands.
-+ */
-+ genl_unregister_family(&nbd_genl_family);
-+
- nbd_dbg_close();
-
- mutex_lock(&nbd_index_mutex);
-@@ -2461,7 +2467,6 @@ static void __exit nbd_cleanup(void)
- }
-
- idr_destroy(&nbd_index_idr);
-- genl_unregister_family(&nbd_genl_family);
- unregister_blkdev(NBD_MAJOR, "nbd");
- }
-
---
-2.35.1
-
+++ /dev/null
-From 11ce3f2859abba20f67674edcd06697bac0ee76f Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 21 May 2022 15:37:47 +0800
-Subject: nbd: fix io hung while disconnecting device
-
-From: Yu Kuai <yukuai3@huawei.com>
-
-[ Upstream commit 09dadb5985023e27d4740ebd17e6fea4640110e5 ]
-
-In our tests, "qemu-nbd" triggers a io hung:
-
-INFO: task qemu-nbd:11445 blocked for more than 368 seconds.
- Not tainted 5.18.0-rc3-next-20220422-00003-g2176915513ca #884
-"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
-task:qemu-nbd state:D stack: 0 pid:11445 ppid: 1 flags:0x00000000
-Call Trace:
- <TASK>
- __schedule+0x480/0x1050
- ? _raw_spin_lock_irqsave+0x3e/0xb0
- schedule+0x9c/0x1b0
- blk_mq_freeze_queue_wait+0x9d/0xf0
- ? ipi_rseq+0x70/0x70
- blk_mq_freeze_queue+0x2b/0x40
- nbd_add_socket+0x6b/0x270 [nbd]
- nbd_ioctl+0x383/0x510 [nbd]
- blkdev_ioctl+0x18e/0x3e0
- __x64_sys_ioctl+0xac/0x120
- do_syscall_64+0x35/0x80
- entry_SYSCALL_64_after_hwframe+0x44/0xae
-RIP: 0033:0x7fd8ff706577
-RSP: 002b:00007fd8fcdfebf8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
-RAX: ffffffffffffffda RBX: 0000000040000000 RCX: 00007fd8ff706577
-RDX: 000000000000000d RSI: 000000000000ab00 RDI: 000000000000000f
-RBP: 000000000000000f R08: 000000000000fbe8 R09: 000055fe497c62b0
-R10: 00000002aff20000 R11: 0000000000000246 R12: 000000000000006d
-R13: 0000000000000000 R14: 00007ffe82dc5e70 R15: 00007fd8fcdff9c0
-
-"qemu-ndb -d" will call ioctl 'NBD_DISCONNECT' first, however, following
-message was found:
-
-block nbd0: Send disconnect failed -32
-
-Which indicate that something is wrong with the server. Then,
-"qemu-nbd -d" will call ioctl 'NBD_CLEAR_SOCK', however ioctl can't clear
-requests after commit 2516ab1543fd("nbd: only clear the queue on device
-teardown"). And in the meantime, request can't complete through timeout
-because nbd_xmit_timeout() will always return 'BLK_EH_RESET_TIMER', which
-means such request will never be completed in this situation.
-
-Now that the flag 'NBD_CMD_INFLIGHT' can make sure requests won't
-complete multiple times, switch back to call nbd_clear_sock() in
-nbd_clear_sock_ioctl(), so that inflight requests can be cleared.
-
-Signed-off-by: Yu Kuai <yukuai3@huawei.com>
-Reviewed-by: Josef Bacik <josef@toxicpanda.com>
-Link: https://lore.kernel.org/r/20220521073749.3146892-5-yukuai3@huawei.com
-Signed-off-by: Jens Axboe <axboe@kernel.dk>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/block/nbd.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
-index ef355f14ed2c..09323b0510f0 100644
---- a/drivers/block/nbd.c
-+++ b/drivers/block/nbd.c
-@@ -1344,7 +1344,7 @@ static int nbd_start_device_ioctl(struct nbd_device *nbd, struct block_device *b
- static void nbd_clear_sock_ioctl(struct nbd_device *nbd,
- struct block_device *bdev)
- {
-- sock_shutdown(nbd);
-+ nbd_clear_sock(nbd);
- __invalidate_device(bdev, true);
- nbd_bdev_reset(bdev);
- if (test_and_clear_bit(NBD_RT_HAS_CONFIG_REF,
---
-2.35.1
-
+++ /dev/null
-From b03ec3925adcc7a94cfa1c4fd4cca5d66e7ccaa8 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 21 May 2022 15:37:45 +0800
-Subject: nbd: fix race between nbd_alloc_config() and module removal
-
-From: Yu Kuai <yukuai3@huawei.com>
-
-[ Upstream commit c55b2b983b0fa012942c3eb16384b2b722caa810 ]
-
-When nbd module is being removing, nbd_alloc_config() may be
-called concurrently by nbd_genl_connect(), although try_module_get()
-will return false, but nbd_alloc_config() doesn't handle it.
-
-The race may lead to the leak of nbd_config and its related
-resources (e.g, recv_workq) and oops in nbd_read_stat() due
-to the unload of nbd module as shown below:
-
- BUG: kernel NULL pointer dereference, address: 0000000000000040
- Oops: 0000 [#1] SMP PTI
- CPU: 5 PID: 13840 Comm: kworker/u17:33 Not tainted 5.14.0+ #1
- Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
- Workqueue: knbd16-recv recv_work [nbd]
- RIP: 0010:nbd_read_stat.cold+0x130/0x1a4 [nbd]
- Call Trace:
- recv_work+0x3b/0xb0 [nbd]
- process_one_work+0x1ed/0x390
- worker_thread+0x4a/0x3d0
- kthread+0x12a/0x150
- ret_from_fork+0x22/0x30
-
-Fixing it by checking the return value of try_module_get()
-in nbd_alloc_config(). As nbd_alloc_config() may return ERR_PTR(-ENODEV),
-assign nbd->config only when nbd_alloc_config() succeeds to ensure
-the value of nbd->config is binary (valid or NULL).
-
-Also adding a debug message to check the reference counter
-of nbd_config during module removal.
-
-Signed-off-by: Hou Tao <houtao1@huawei.com>
-Signed-off-by: Yu Kuai <yukuai3@huawei.com>
-Reviewed-by: Josef Bacik <josef@toxicpanda.com>
-Link: https://lore.kernel.org/r/20220521073749.3146892-3-yukuai3@huawei.com
-Signed-off-by: Jens Axboe <axboe@kernel.dk>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/block/nbd.c | 28 +++++++++++++++++++---------
- 1 file changed, 19 insertions(+), 9 deletions(-)
-
-diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
-index f3425e51a54b..ef355f14ed2c 100644
---- a/drivers/block/nbd.c
-+++ b/drivers/block/nbd.c
-@@ -1457,15 +1457,20 @@ static struct nbd_config *nbd_alloc_config(void)
- {
- struct nbd_config *config;
-
-+ if (!try_module_get(THIS_MODULE))
-+ return ERR_PTR(-ENODEV);
-+
- config = kzalloc(sizeof(struct nbd_config), GFP_NOFS);
-- if (!config)
-- return NULL;
-+ if (!config) {
-+ module_put(THIS_MODULE);
-+ return ERR_PTR(-ENOMEM);
-+ }
-+
- atomic_set(&config->recv_threads, 0);
- init_waitqueue_head(&config->recv_wq);
- init_waitqueue_head(&config->conn_wait);
- config->blksize = NBD_DEF_BLKSIZE;
- atomic_set(&config->live_connections, 0);
-- try_module_get(THIS_MODULE);
- return config;
- }
-
-@@ -1492,12 +1497,13 @@ static int nbd_open(struct block_device *bdev, fmode_t mode)
- mutex_unlock(&nbd->config_lock);
- goto out;
- }
-- config = nbd->config = nbd_alloc_config();
-- if (!config) {
-- ret = -ENOMEM;
-+ config = nbd_alloc_config();
-+ if (IS_ERR(config)) {
-+ ret = PTR_ERR(config);
- mutex_unlock(&nbd->config_lock);
- goto out;
- }
-+ nbd->config = config;
- refcount_set(&nbd->config_refs, 1);
- refcount_inc(&nbd->refs);
- mutex_unlock(&nbd->config_lock);
-@@ -1919,13 +1925,14 @@ static int nbd_genl_connect(struct sk_buff *skb, struct genl_info *info)
- nbd_put(nbd);
- return -EINVAL;
- }
-- config = nbd->config = nbd_alloc_config();
-- if (!nbd->config) {
-+ config = nbd_alloc_config();
-+ if (IS_ERR(config)) {
- mutex_unlock(&nbd->config_lock);
- nbd_put(nbd);
- printk(KERN_ERR "nbd: couldn't allocate config\n");
-- return -ENOMEM;
-+ return PTR_ERR(config);
- }
-+ nbd->config = config;
- refcount_set(&nbd->config_refs, 1);
- set_bit(NBD_RT_BOUND, &config->runtime_flags);
-
-@@ -2461,6 +2468,9 @@ static void __exit nbd_cleanup(void)
- while (!list_empty(&del_list)) {
- nbd = list_first_entry(&del_list, struct nbd_device, list);
- list_del_init(&nbd->list);
-+ if (refcount_read(&nbd->config_refs))
-+ printk(KERN_ERR "nbd: possibly leaking nbd_config (ref %d)\n",
-+ refcount_read(&nbd->config_refs));
- if (refcount_read(&nbd->refs) != 1)
- printk(KERN_ERR "nbd: possibly leaking a device\n");
- nbd_put(nbd);
---
-2.35.1
-
+++ /dev/null
-From f95b3ce84d426db6cfeb579f6e6878f23bfee3d3 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 18 May 2022 13:52:23 -0700
-Subject: nodemask: Fix return values to be unsigned
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Kees Cook <keescook@chromium.org>
-
-[ Upstream commit 0dfe54071d7c828a02917b595456bfde1afdddc9 ]
-
-The nodemask routines had mixed return values that provided potentially
-signed return values that could never happen. This was leading to the
-compiler getting confusing about the range of possible return values
-(it was thinking things could be negative where they could not be). Fix
-all the nodemask routines that should be returning unsigned
-(or bool) values. Silences:
-
- mm/swapfile.c: In function ‘setup_swap_info’:
- mm/swapfile.c:2291:47: error: array subscript -1 is below array bounds of ‘struct plist_node[]’ [-Werror=array-bounds]
- 2291 | p->avail_lists[i].prio = 1;
- | ~~~~~~~~~~~~~~^~~
- In file included from mm/swapfile.c:16:
- ./include/linux/swap.h:292:27: note: while referencing ‘avail_lists’
- 292 | struct plist_node avail_lists[]; /*
- | ^~~~~~~~~~~
-
-Reported-by: Christophe de Dinechin <dinechin@redhat.com>
-Link: https://lore.kernel.org/lkml/20220414150855.2407137-3-dinechin@redhat.com/
-Cc: Alexey Dobriyan <adobriyan@gmail.com>
-Cc: Yury Norov <yury.norov@gmail.com>
-Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
-Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
-Cc: Andrew Morton <akpm@linux-foundation.org>
-Cc: Zhen Lei <thunder.leizhen@huawei.com>
-Signed-off-by: Kees Cook <keescook@chromium.org>
-Signed-off-by: Yury Norov <yury.norov@gmail.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- include/linux/nodemask.h | 38 +++++++++++++++++++-------------------
- lib/nodemask.c | 4 ++--
- 2 files changed, 21 insertions(+), 21 deletions(-)
-
-diff --git a/include/linux/nodemask.h b/include/linux/nodemask.h
-index 8a404dfeec42..a8d79f5b9a52 100644
---- a/include/linux/nodemask.h
-+++ b/include/linux/nodemask.h
-@@ -42,11 +42,11 @@
- * void nodes_shift_right(dst, src, n) Shift right
- * void nodes_shift_left(dst, src, n) Shift left
- *
-- * int first_node(mask) Number lowest set bit, or MAX_NUMNODES
-- * int next_node(node, mask) Next node past 'node', or MAX_NUMNODES
-- * int next_node_in(node, mask) Next node past 'node', or wrap to first,
-+ * unsigned int first_node(mask) Number lowest set bit, or MAX_NUMNODES
-+ * unsigend int next_node(node, mask) Next node past 'node', or MAX_NUMNODES
-+ * unsigned int next_node_in(node, mask) Next node past 'node', or wrap to first,
- * or MAX_NUMNODES
-- * int first_unset_node(mask) First node not set in mask, or
-+ * unsigned int first_unset_node(mask) First node not set in mask, or
- * MAX_NUMNODES
- *
- * nodemask_t nodemask_of_node(node) Return nodemask with bit 'node' set
-@@ -153,7 +153,7 @@ static inline void __nodes_clear(nodemask_t *dstp, unsigned int nbits)
-
- #define node_test_and_set(node, nodemask) \
- __node_test_and_set((node), &(nodemask))
--static inline int __node_test_and_set(int node, nodemask_t *addr)
-+static inline bool __node_test_and_set(int node, nodemask_t *addr)
- {
- return test_and_set_bit(node, addr->bits);
- }
-@@ -200,7 +200,7 @@ static inline void __nodes_complement(nodemask_t *dstp,
-
- #define nodes_equal(src1, src2) \
- __nodes_equal(&(src1), &(src2), MAX_NUMNODES)
--static inline int __nodes_equal(const nodemask_t *src1p,
-+static inline bool __nodes_equal(const nodemask_t *src1p,
- const nodemask_t *src2p, unsigned int nbits)
- {
- return bitmap_equal(src1p->bits, src2p->bits, nbits);
-@@ -208,7 +208,7 @@ static inline int __nodes_equal(const nodemask_t *src1p,
-
- #define nodes_intersects(src1, src2) \
- __nodes_intersects(&(src1), &(src2), MAX_NUMNODES)
--static inline int __nodes_intersects(const nodemask_t *src1p,
-+static inline bool __nodes_intersects(const nodemask_t *src1p,
- const nodemask_t *src2p, unsigned int nbits)
- {
- return bitmap_intersects(src1p->bits, src2p->bits, nbits);
-@@ -216,20 +216,20 @@ static inline int __nodes_intersects(const nodemask_t *src1p,
-
- #define nodes_subset(src1, src2) \
- __nodes_subset(&(src1), &(src2), MAX_NUMNODES)
--static inline int __nodes_subset(const nodemask_t *src1p,
-+static inline bool __nodes_subset(const nodemask_t *src1p,
- const nodemask_t *src2p, unsigned int nbits)
- {
- return bitmap_subset(src1p->bits, src2p->bits, nbits);
- }
-
- #define nodes_empty(src) __nodes_empty(&(src), MAX_NUMNODES)
--static inline int __nodes_empty(const nodemask_t *srcp, unsigned int nbits)
-+static inline bool __nodes_empty(const nodemask_t *srcp, unsigned int nbits)
- {
- return bitmap_empty(srcp->bits, nbits);
- }
-
- #define nodes_full(nodemask) __nodes_full(&(nodemask), MAX_NUMNODES)
--static inline int __nodes_full(const nodemask_t *srcp, unsigned int nbits)
-+static inline bool __nodes_full(const nodemask_t *srcp, unsigned int nbits)
- {
- return bitmap_full(srcp->bits, nbits);
- }
-@@ -260,15 +260,15 @@ static inline void __nodes_shift_left(nodemask_t *dstp,
- > MAX_NUMNODES, then the silly min_ts could be dropped. */
-
- #define first_node(src) __first_node(&(src))
--static inline int __first_node(const nodemask_t *srcp)
-+static inline unsigned int __first_node(const nodemask_t *srcp)
- {
-- return min_t(int, MAX_NUMNODES, find_first_bit(srcp->bits, MAX_NUMNODES));
-+ return min_t(unsigned int, MAX_NUMNODES, find_first_bit(srcp->bits, MAX_NUMNODES));
- }
-
- #define next_node(n, src) __next_node((n), &(src))
--static inline int __next_node(int n, const nodemask_t *srcp)
-+static inline unsigned int __next_node(int n, const nodemask_t *srcp)
- {
-- return min_t(int,MAX_NUMNODES,find_next_bit(srcp->bits, MAX_NUMNODES, n+1));
-+ return min_t(unsigned int, MAX_NUMNODES, find_next_bit(srcp->bits, MAX_NUMNODES, n+1));
- }
-
- /*
-@@ -276,7 +276,7 @@ static inline int __next_node(int n, const nodemask_t *srcp)
- * the first node in src if needed. Returns MAX_NUMNODES if src is empty.
- */
- #define next_node_in(n, src) __next_node_in((n), &(src))
--int __next_node_in(int node, const nodemask_t *srcp);
-+unsigned int __next_node_in(int node, const nodemask_t *srcp);
-
- static inline void init_nodemask_of_node(nodemask_t *mask, int node)
- {
-@@ -296,9 +296,9 @@ static inline void init_nodemask_of_node(nodemask_t *mask, int node)
- })
-
- #define first_unset_node(mask) __first_unset_node(&(mask))
--static inline int __first_unset_node(const nodemask_t *maskp)
-+static inline unsigned int __first_unset_node(const nodemask_t *maskp)
- {
-- return min_t(int,MAX_NUMNODES,
-+ return min_t(unsigned int, MAX_NUMNODES,
- find_first_zero_bit(maskp->bits, MAX_NUMNODES));
- }
-
-@@ -434,11 +434,11 @@ static inline int num_node_state(enum node_states state)
-
- #define first_online_node first_node(node_states[N_ONLINE])
- #define first_memory_node first_node(node_states[N_MEMORY])
--static inline int next_online_node(int nid)
-+static inline unsigned int next_online_node(int nid)
- {
- return next_node(nid, node_states[N_ONLINE]);
- }
--static inline int next_memory_node(int nid)
-+static inline unsigned int next_memory_node(int nid)
- {
- return next_node(nid, node_states[N_MEMORY]);
- }
-diff --git a/lib/nodemask.c b/lib/nodemask.c
-index 3aa454c54c0d..e22647f5181b 100644
---- a/lib/nodemask.c
-+++ b/lib/nodemask.c
-@@ -3,9 +3,9 @@
- #include <linux/module.h>
- #include <linux/random.h>
-
--int __next_node_in(int node, const nodemask_t *srcp)
-+unsigned int __next_node_in(int node, const nodemask_t *srcp)
- {
-- int ret = __next_node(node, srcp);
-+ unsigned int ret = __next_node(node, srcp);
-
- if (ret == MAX_NUMNODES)
- ret = __first_node(srcp);
---
-2.35.1
-
+++ /dev/null
-From e963029e0985625e2166b6191fd05d7f12deb614 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 23 May 2022 22:05:24 +0200
-Subject: Revert "net: af_key: add check for pfkey_broadcast in function
- pfkey_process"
-
-From: Michal Kubecek <mkubecek@suse.cz>
-
-[ Upstream commit 9c90c9b3e50e16d03c7f87d63e9db373974781e0 ]
-
-This reverts commit 4dc2a5a8f6754492180741facf2a8787f2c415d7.
-
-A non-zero return value from pfkey_broadcast() does not necessarily mean
-an error occurred as this function returns -ESRCH when no registered
-listener received the message. In particular, a call with
-BROADCAST_PROMISC_ONLY flag and null one_sk argument can never return
-zero so that this commit in fact prevents processing any PF_KEY message.
-One visible effect is that racoon daemon fails to find encryption
-algorithms like aes and refuses to start.
-
-Excluding -ESRCH return value would fix this but it's not obvious that
-we really want to bail out here and most other callers of
-pfkey_broadcast() also ignore the return value. Also, as pointed out by
-Steffen Klassert, PF_KEY is kind of deprecated and newer userspace code
-should use netlink instead so that we should only disturb the code for
-really important fixes.
-
-v2: add a comment explaining why is the return value ignored
-
-Signed-off-by: Michal Kubecek <mkubecek@suse.cz>
-Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/key/af_key.c | 10 ++++++----
- 1 file changed, 6 insertions(+), 4 deletions(-)
-
-diff --git a/net/key/af_key.c b/net/key/af_key.c
-index dd064d5eff6e..32fe99cd01fc 100644
---- a/net/key/af_key.c
-+++ b/net/key/af_key.c
-@@ -2830,10 +2830,12 @@ static int pfkey_process(struct sock *sk, struct sk_buff *skb, const struct sadb
- void *ext_hdrs[SADB_EXT_MAX];
- int err;
-
-- err = pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL,
-- BROADCAST_PROMISC_ONLY, NULL, sock_net(sk));
-- if (err)
-- return err;
-+ /* Non-zero return value of pfkey_broadcast() does not always signal
-+ * an error and even on an actual error we may still want to process
-+ * the message so rather ignore the return value.
-+ */
-+ pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL,
-+ BROADCAST_PROMISC_ONLY, NULL, sock_net(sk));
-
- memset(ext_hdrs, 0, sizeof(ext_hdrs));
- err = parse_exthdrs(skb, hdr, ext_hdrs);
---
-2.35.1
-
+++ /dev/null
-From 76934b6ca9091a995b1d5f8222c0b225df1f9358 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 30 May 2022 11:27:05 +0200
-Subject: s390/gmap: voluntarily schedule during key setting
-
-From: Christian Borntraeger <borntraeger@linux.ibm.com>
-
-[ Upstream commit 6d5946274df1fff539a7eece458a43be733d1db8 ]
-
-With large and many guest with storage keys it is possible to create
-large latencies or stalls during initial key setting:
-
-rcu: INFO: rcu_sched self-detected stall on CPU
-rcu: 18-....: (2099 ticks this GP) idle=54e/1/0x4000000000000002 softirq=35598716/35598716 fqs=998
- (t=2100 jiffies g=155867385 q=20879)
-Task dump for CPU 18:
-CPU 1/KVM R running task 0 1030947 256019 0x06000004
-Call Trace:
-sched_show_task
-rcu_dump_cpu_stacks
-rcu_sched_clock_irq
-update_process_times
-tick_sched_handle
-tick_sched_timer
-__hrtimer_run_queues
-hrtimer_interrupt
-do_IRQ
-ext_int_handler
-ptep_zap_key
-
-The mmap lock is held during the page walking but since this is a
-semaphore scheduling is still possible. Same for the kvm srcu.
-To minimize overhead do this on every segment table entry or large page.
-
-Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
-Reviewed-by: Alexander Gordeev <agordeev@linux.ibm.com>
-Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
-Link: https://lore.kernel.org/r/20220530092706.11637-2-borntraeger@linux.ibm.com
-Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
-Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/s390/mm/gmap.c | 14 ++++++++++++++
- 1 file changed, 14 insertions(+)
-
-diff --git a/arch/s390/mm/gmap.c b/arch/s390/mm/gmap.c
-index 5e5a4e1f0e6c..19ee8355b2a7 100644
---- a/arch/s390/mm/gmap.c
-+++ b/arch/s390/mm/gmap.c
-@@ -2579,6 +2579,18 @@ static int __s390_enable_skey_pte(pte_t *pte, unsigned long addr,
- return 0;
- }
-
-+/*
-+ * Give a chance to schedule after setting a key to 256 pages.
-+ * We only hold the mm lock, which is a rwsem and the kvm srcu.
-+ * Both can sleep.
-+ */
-+static int __s390_enable_skey_pmd(pmd_t *pmd, unsigned long addr,
-+ unsigned long next, struct mm_walk *walk)
-+{
-+ cond_resched();
-+ return 0;
-+}
-+
- static int __s390_enable_skey_hugetlb(pte_t *pte, unsigned long addr,
- unsigned long hmask, unsigned long next,
- struct mm_walk *walk)
-@@ -2601,12 +2613,14 @@ static int __s390_enable_skey_hugetlb(pte_t *pte, unsigned long addr,
- end = start + HPAGE_SIZE - 1;
- __storage_key_init_range(start, end);
- set_bit(PG_arch_1, &page->flags);
-+ cond_resched();
- return 0;
- }
-
- static const struct mm_walk_ops enable_skey_walk_ops = {
- .hugetlb_entry = __s390_enable_skey_hugetlb,
- .pte_entry = __s390_enable_skey_pte,
-+ .pmd_entry = __s390_enable_skey_pmd,
- };
-
- int s390_enable_skey(void)
---
-2.35.1
-
+++ /dev/null
-From da376061523361a263c4fee95dba6a7305117726 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 23 May 2022 14:02:44 +0200
-Subject: scsi: myrb: Fix up null pointer access on myrb_cleanup()
-
-From: Hannes Reinecke <hare@suse.de>
-
-[ Upstream commit f9f0a46141e2e39bedb4779c88380d1b5f018c14 ]
-
-When myrb_probe() fails the callback might not be set, so we need to
-validate the 'disable_intr' callback in myrb_cleanup() to not cause a null
-pointer exception. And while at it do not call myrb_cleanup() if we cannot
-enable the PCI device at all.
-
-Link: https://lore.kernel.org/r/20220523120244.99515-1-hare@suse.de
-Reported-by: Zheyu Ma <zheyuma97@gmail.com>
-Tested-by: Zheyu Ma <zheyuma97@gmail.com>
-Signed-off-by: Hannes Reinecke <hare@suse.de>
-Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/scsi/myrb.c | 11 ++++++++---
- 1 file changed, 8 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/scsi/myrb.c b/drivers/scsi/myrb.c
-index 539ac8ce4fcd..35b32920a94a 100644
---- a/drivers/scsi/myrb.c
-+++ b/drivers/scsi/myrb.c
-@@ -1241,7 +1241,8 @@ static void myrb_cleanup(struct myrb_hba *cb)
- myrb_unmap(cb);
-
- if (cb->mmio_base) {
-- cb->disable_intr(cb->io_base);
-+ if (cb->disable_intr)
-+ cb->disable_intr(cb->io_base);
- iounmap(cb->mmio_base);
- }
- if (cb->irq)
-@@ -3516,9 +3517,13 @@ static struct myrb_hba *myrb_detect(struct pci_dev *pdev,
- mutex_init(&cb->dcmd_mutex);
- mutex_init(&cb->dma_mutex);
- cb->pdev = pdev;
-+ cb->host = shost;
-
-- if (pci_enable_device(pdev))
-- goto failure;
-+ if (pci_enable_device(pdev)) {
-+ dev_err(&pdev->dev, "Failed to enable PCI device\n");
-+ scsi_host_put(shost);
-+ return NULL;
-+ }
-
- if (privdata->hw_init == DAC960_PD_hw_init ||
- privdata->hw_init == DAC960_P_hw_init) {
---
-2.35.1
-
+++ /dev/null
-From d47d812bd7dd4a4e6328524a46657c003f9f9682 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 6 May 2022 23:39:24 +0206
-Subject: serial: msm_serial: disable interrupts in __msm_console_write()
-
-From: John Ogness <john.ogness@linutronix.de>
-
-[ Upstream commit aabdbb1b7a5819e18c403334a31fb0cc2c06ad41 ]
-
-__msm_console_write() assumes that interrupts are disabled, but
-with threaded console printers it is possible that the write()
-callback of the console is called with interrupts enabled.
-
-Explicitly disable interrupts using local_irq_save() to preserve
-the assumed context.
-
-Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
-Reviewed-by: Petr Mladek <pmladek@suse.com>
-Signed-off-by: John Ogness <john.ogness@linutronix.de>
-Link: https://lore.kernel.org/r/20220506213324.470461-1-john.ogness@linutronix.de
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/tty/serial/msm_serial.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/drivers/tty/serial/msm_serial.c b/drivers/tty/serial/msm_serial.c
-index 5129c2dfbe07..aac96659694d 100644
---- a/drivers/tty/serial/msm_serial.c
-+++ b/drivers/tty/serial/msm_serial.c
-@@ -1579,6 +1579,7 @@ static inline struct uart_port *msm_get_port_from_line(unsigned int line)
- static void __msm_console_write(struct uart_port *port, const char *s,
- unsigned int count, bool is_uartdm)
- {
-+ unsigned long flags;
- int i;
- int num_newlines = 0;
- bool replaced = false;
-@@ -1596,6 +1597,8 @@ static void __msm_console_write(struct uart_port *port, const char *s,
- num_newlines++;
- count += num_newlines;
-
-+ local_irq_save(flags);
-+
- if (port->sysrq)
- locked = 0;
- else if (oops_in_progress)
-@@ -1641,6 +1644,8 @@ static void __msm_console_write(struct uart_port *port, const char *s,
-
- if (locked)
- spin_unlock(&port->lock);
-+
-+ local_irq_restore(flags);
- }
-
- static void msm_console_write(struct console *co, const char *s,
---
-2.35.1
-
ip_gre-test-csum_start-instead-of-transport-header.patch
net-altera-fix-refcount-leak-in-altera_tse_mdio_crea.patch
drm-imx-fix-compiler-warning-with-gcc-12.patch
-iio-dummy-iio_simple_dummy-check-the-return-value-of.patch
-iio-st_sensors-add-a-local-lock-for-protecting-odr.patch
-lkdtm-usercopy-expand-size-of-out-of-frame-object.patch
-tty-synclink_gt-fix-null-pointer-dereference-in-slgt.patch
-tty-fix-a-possible-resource-leak-in-icom_probe.patch
-drivers-staging-rtl8192u-fix-deadlock-in-ieee80211_b.patch
-drivers-staging-rtl8192e-fix-deadlock-in-rtllib_beac.patch
-usb-host-isp116x-check-return-value-after-calling-pl.patch
-drivers-tty-serial-fix-deadlock-in-sa1100_set_termio.patch
-drivers-usb-host-fix-deadlock-in-oxu_bus_suspend.patch
-usb-hcd-pci-fully-suspend-across-freeze-thaw-cycle.patch
-usb-dwc2-gadget-don-t-reset-gadget-s-driver-bus.patch
-misc-rtsx-set-null-intfdata-when-probe-fails.patch
-extcon-modify-extcon-device-to-be-created-after-driv.patch
-clocksource-drivers-sp804-avoid-error-on-multiple-in.patch
-staging-rtl8712-fix-uninit-value-in-usb_read8-and-fr.patch
-staging-rtl8712-fix-uninit-value-in-r871xu_drv_init.patch
-serial-msm_serial-disable-interrupts-in-__msm_consol.patch
-kernfs-separate-kernfs_pr_cont_buf-and-rename_lock.patch
-watchdog-wdat_wdt-stop-watchdog-when-rebooting-the-s.patch
-md-protect-md_unregister_thread-from-reentrancy.patch
-scsi-myrb-fix-up-null-pointer-access-on-myrb_cleanup.patch
-revert-net-af_key-add-check-for-pfkey_broadcast-in-f.patch
-ceph-allow-ceph.dir.rctime-xattr-to-be-updatable.patch
-drm-radeon-fix-a-possible-null-pointer-dereference.patch
-modpost-fix-undefined-behavior-of-is_arm_mapping_sym.patch
-x86-cpu-elide-kcsan-for-cpu_has-and-friends.patch
-nbd-call-genl_unregister_family-first-in-nbd_cleanup.patch
-nbd-fix-race-between-nbd_alloc_config-and-module-rem.patch
-nbd-fix-io-hung-while-disconnecting-device.patch
-s390-gmap-voluntarily-schedule-during-key-setting.patch
-cifs-version-operations-for-smb20-unneeded-when-lega.patch
-nodemask-fix-return-values-to-be-unsigned.patch
-iio-dummy-iio_simple_dummy-check-the-return-value-of.patch-17101
-iio-st_sensors-add-a-local-lock-for-protecting-odr.patch-13927
-lkdtm-usercopy-expand-size-of-out-of-frame-object.patch-29744
-tty-synclink_gt-fix-null-pointer-dereference-in-slgt.patch-19519
-tty-fix-a-possible-resource-leak-in-icom_probe.patch-13287
-drivers-staging-rtl8192u-fix-deadlock-in-ieee80211_b.patch-20640
-drivers-staging-rtl8192e-fix-deadlock-in-rtllib_beac.patch-1150
-usb-host-isp116x-check-return-value-after-calling-pl.patch-13067
-drivers-tty-serial-fix-deadlock-in-sa1100_set_termio.patch-17372
-drivers-usb-host-fix-deadlock-in-oxu_bus_suspend.patch-10368
-usb-hcd-pci-fully-suspend-across-freeze-thaw-cycle.patch-8082
-usb-dwc2-gadget-don-t-reset-gadget-s-driver-bus.patch-3942
-misc-rtsx-set-null-intfdata-when-probe-fails.patch-26052
-extcon-modify-extcon-device-to-be-created-after-driv.patch-20453
-clocksource-drivers-sp804-avoid-error-on-multiple-in.patch-6388
-staging-rtl8712-fix-uninit-value-in-usb_read8-and-fr.patch-7800
-staging-rtl8712-fix-uninit-value-in-r871xu_drv_init.patch-22514
-serial-msm_serial-disable-interrupts-in-__msm_consol.patch-4094
-kernfs-separate-kernfs_pr_cont_buf-and-rename_lock.patch-1991
-watchdog-wdat_wdt-stop-watchdog-when-rebooting-the-s.patch-27197
-md-protect-md_unregister_thread-from-reentrancy.patch-23575
-scsi-myrb-fix-up-null-pointer-access-on-myrb_cleanup.patch-4611
-revert-net-af_key-add-check-for-pfkey_broadcast-in-f.patch-6877
-ceph-allow-ceph.dir.rctime-xattr-to-be-updatable.patch-8296
-drm-radeon-fix-a-possible-null-pointer-dereference.patch-4187
-modpost-fix-undefined-behavior-of-is_arm_mapping_sym.patch-17057
-x86-cpu-elide-kcsan-for-cpu_has-and-friends.patch-16086
-nbd-call-genl_unregister_family-first-in-nbd_cleanup.patch-30175
-nbd-fix-race-between-nbd_alloc_config-and-module-rem.patch-3924
-nbd-fix-io-hung-while-disconnecting-device.patch-253
-s390-gmap-voluntarily-schedule-during-key-setting.patch-14573
-cifs-version-operations-for-smb20-unneeded-when-lega.patch-22295
-nodemask-fix-return-values-to-be-unsigned.patch-11120
-iio-dummy-iio_simple_dummy-check-the-return-value-of.patch-15185
-iio-st_sensors-add-a-local-lock-for-protecting-odr.patch-20799
-lkdtm-usercopy-expand-size-of-out-of-frame-object.patch-872
-tty-synclink_gt-fix-null-pointer-dereference-in-slgt.patch-24386
-tty-fix-a-possible-resource-leak-in-icom_probe.patch-12822
-drivers-staging-rtl8192u-fix-deadlock-in-ieee80211_b.patch-12748
-drivers-staging-rtl8192e-fix-deadlock-in-rtllib_beac.patch-2910
-usb-host-isp116x-check-return-value-after-calling-pl.patch-13722
-drivers-tty-serial-fix-deadlock-in-sa1100_set_termio.patch-4706
-drivers-usb-host-fix-deadlock-in-oxu_bus_suspend.patch-30007
-usb-hcd-pci-fully-suspend-across-freeze-thaw-cycle.patch-27708
-usb-dwc2-gadget-don-t-reset-gadget-s-driver-bus.patch-3732
-misc-rtsx-set-null-intfdata-when-probe-fails.patch-20163
-extcon-modify-extcon-device-to-be-created-after-driv.patch-16347
-clocksource-drivers-sp804-avoid-error-on-multiple-in.patch-18501
-staging-rtl8712-fix-uninit-value-in-usb_read8-and-fr.patch-16561
-staging-rtl8712-fix-uninit-value-in-r871xu_drv_init.patch-8090
-serial-msm_serial-disable-interrupts-in-__msm_consol.patch-16829
-kernfs-separate-kernfs_pr_cont_buf-and-rename_lock.patch-30895
-watchdog-wdat_wdt-stop-watchdog-when-rebooting-the-s.patch-24020
-md-protect-md_unregister_thread-from-reentrancy.patch-20609
-scsi-myrb-fix-up-null-pointer-access-on-myrb_cleanup.patch-18078
-revert-net-af_key-add-check-for-pfkey_broadcast-in-f.patch-22922
-ceph-allow-ceph.dir.rctime-xattr-to-be-updatable.patch-27795
-drm-radeon-fix-a-possible-null-pointer-dereference.patch-13903
-modpost-fix-undefined-behavior-of-is_arm_mapping_sym.patch-5121
-x86-cpu-elide-kcsan-for-cpu_has-and-friends.patch-25276
-nbd-call-genl_unregister_family-first-in-nbd_cleanup.patch-2229
-nbd-fix-race-between-nbd_alloc_config-and-module-rem.patch-13158
-nbd-fix-io-hung-while-disconnecting-device.patch-17356
-s390-gmap-voluntarily-schedule-during-key-setting.patch-13970
-cifs-version-operations-for-smb20-unneeded-when-lega.patch-5219
-nodemask-fix-return-values-to-be-unsigned.patch-11672
+++ /dev/null
-From acb87dffa4033e0c6888b307708923c4344f831d Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 16 May 2022 17:22:41 +0800
-Subject: staging: rtl8712: fix uninit-value in r871xu_drv_init()
-
-From: Wang Cheng <wanngchenng@gmail.com>
-
-[ Upstream commit 0458e5428e5e959d201a40ffe71d762a79ecedc4 ]
-
-When 'tmpU1b' returns from r8712_read8(padapter, EE_9346CR) is 0,
-'mac[6]' will not be initialized.
-
-BUG: KMSAN: uninit-value in r871xu_drv_init+0x2d54/0x3070 drivers/staging/rtl8712/usb_intf.c:541
- r871xu_drv_init+0x2d54/0x3070 drivers/staging/rtl8712/usb_intf.c:541
- usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396
- really_probe+0x653/0x14b0 drivers/base/dd.c:596
- __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752
- driver_probe_device drivers/base/dd.c:782 [inline]
- __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899
- bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427
- __device_attach+0x593/0x8e0 drivers/base/dd.c:970
- device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017
- bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487
- device_add+0x1fff/0x26e0 drivers/base/core.c:3405
- usb_set_configuration+0x37e9/0x3ed0 drivers/usb/core/message.c:2170
- usb_generic_driver_probe+0x13c/0x300 drivers/usb/core/generic.c:238
- usb_probe_device+0x309/0x570 drivers/usb/core/driver.c:293
- really_probe+0x653/0x14b0 drivers/base/dd.c:596
- __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752
- driver_probe_device drivers/base/dd.c:782 [inline]
- __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899
- bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427
- __device_attach+0x593/0x8e0 drivers/base/dd.c:970
- device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017
- bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487
- device_add+0x1fff/0x26e0 drivers/base/core.c:3405
- usb_new_device+0x1b8e/0x2950 drivers/usb/core/hub.c:2566
- hub_port_connect drivers/usb/core/hub.c:5358 [inline]
- hub_port_connect_change drivers/usb/core/hub.c:5502 [inline]
- port_event drivers/usb/core/hub.c:5660 [inline]
- hub_event+0x58e3/0x89e0 drivers/usb/core/hub.c:5742
- process_one_work+0xdb6/0x1820 kernel/workqueue.c:2307
- worker_thread+0x10b3/0x21e0 kernel/workqueue.c:2454
- kthread+0x3c7/0x500 kernel/kthread.c:377
- ret_from_fork+0x1f/0x30
-
-Local variable mac created at:
- r871xu_drv_init+0x1771/0x3070 drivers/staging/rtl8712/usb_intf.c:394
- usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396
-
-KMSAN: uninit-value in r871xu_drv_init
-https://syzkaller.appspot.com/bug?id=3cd92b1d85428b128503bfa7a250294c9ae00bd8
-
-Reported-by: <syzbot+6f5ecd144854c0d8580b@syzkaller.appspotmail.com>
-Tested-by: <syzbot+6f5ecd144854c0d8580b@syzkaller.appspotmail.com>
-Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
-Signed-off-by: Wang Cheng <wanngchenng@gmail.com>
-Link: https://lore.kernel.org/r/14c3886173dfa4597f0704547c414cfdbcd11d16.1652618244.git.wanngchenng@gmail.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/staging/rtl8712/usb_intf.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/staging/rtl8712/usb_intf.c b/drivers/staging/rtl8712/usb_intf.c
-index 49188ab04612..f7c1258eaa39 100644
---- a/drivers/staging/rtl8712/usb_intf.c
-+++ b/drivers/staging/rtl8712/usb_intf.c
-@@ -539,13 +539,13 @@ static int r871xu_drv_init(struct usb_interface *pusb_intf,
- } else {
- AutoloadFail = false;
- }
-- if (((mac[0] == 0xff) && (mac[1] == 0xff) &&
-+ if ((!AutoloadFail) ||
-+ ((mac[0] == 0xff) && (mac[1] == 0xff) &&
- (mac[2] == 0xff) && (mac[3] == 0xff) &&
- (mac[4] == 0xff) && (mac[5] == 0xff)) ||
- ((mac[0] == 0x00) && (mac[1] == 0x00) &&
- (mac[2] == 0x00) && (mac[3] == 0x00) &&
-- (mac[4] == 0x00) && (mac[5] == 0x00)) ||
-- (!AutoloadFail)) {
-+ (mac[4] == 0x00) && (mac[5] == 0x00))) {
- mac[0] = 0x00;
- mac[1] = 0xe0;
- mac[2] = 0x4c;
---
-2.35.1
-
+++ /dev/null
-From afbf82746b91c4b1cf2c8f47fbe64c5dfd8264fe Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 16 May 2022 17:22:23 +0800
-Subject: staging: rtl8712: fix uninit-value in usb_read8() and friends
-
-From: Wang Cheng <wanngchenng@gmail.com>
-
-[ Upstream commit d1b57669732d09da7e13ef86d058dab0cd57f6e0 ]
-
-When r8712_usbctrl_vendorreq() returns negative, 'data' in
-usb_read{8,16,32} will not be initialized.
-
-BUG: KMSAN: uninit-value in string_nocheck lib/vsprintf.c:643 [inline]
-BUG: KMSAN: uninit-value in string+0x4ec/0x6f0 lib/vsprintf.c:725
- string_nocheck lib/vsprintf.c:643 [inline]
- string+0x4ec/0x6f0 lib/vsprintf.c:725
- vsnprintf+0x2222/0x3650 lib/vsprintf.c:2806
- va_format lib/vsprintf.c:1704 [inline]
- pointer+0x18e6/0x1f70 lib/vsprintf.c:2443
- vsnprintf+0x1a9b/0x3650 lib/vsprintf.c:2810
- vprintk_store+0x537/0x2150 kernel/printk/printk.c:2158
- vprintk_emit+0x28b/0xab0 kernel/printk/printk.c:2256
- dev_vprintk_emit+0x5ef/0x6d0 drivers/base/core.c:4604
- dev_printk_emit+0x1dd/0x21f drivers/base/core.c:4615
- __dev_printk+0x3be/0x440 drivers/base/core.c:4627
- _dev_info+0x1ea/0x22f drivers/base/core.c:4673
- r871xu_drv_init+0x1929/0x3070 drivers/staging/rtl8712/usb_intf.c:401
- usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396
- really_probe+0x6c7/0x1350 drivers/base/dd.c:621
- __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752
- driver_probe_device drivers/base/dd.c:782 [inline]
- __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899
- bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427
- __device_attach+0x593/0x8e0 drivers/base/dd.c:970
- device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017
- bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487
- device_add+0x1fff/0x26e0 drivers/base/core.c:3405
- usb_set_configuration+0x37e9/0x3ed0 drivers/usb/core/message.c:2170
- usb_generic_driver_probe+0x13c/0x300 drivers/usb/core/generic.c:238
- usb_probe_device+0x309/0x570 drivers/usb/core/driver.c:293
- really_probe+0x6c7/0x1350 drivers/base/dd.c:621
- __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752
- driver_probe_device drivers/base/dd.c:782 [inline]
- __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899
- bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427
- __device_attach+0x593/0x8e0 drivers/base/dd.c:970
- device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017
- bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487
- device_add+0x1fff/0x26e0 drivers/base/core.c:3405
- usb_new_device+0x1b91/0x2950 drivers/usb/core/hub.c:2566
- hub_port_connect drivers/usb/core/hub.c:5363 [inline]
- hub_port_connect_change drivers/usb/core/hub.c:5507 [inline]
- port_event drivers/usb/core/hub.c:5665 [inline]
- hub_event+0x58e3/0x89e0 drivers/usb/core/hub.c:5747
- process_one_work+0xdb6/0x1820 kernel/workqueue.c:2289
- worker_thread+0x10d0/0x2240 kernel/workqueue.c:2436
- kthread+0x3c7/0x500 kernel/kthread.c:376
- ret_from_fork+0x1f/0x30
-
-Local variable data created at:
- usb_read8+0x5d/0x130 drivers/staging/rtl8712/usb_ops.c:33
- r8712_read8+0xa5/0xd0 drivers/staging/rtl8712/rtl8712_io.c:29
-
-KMSAN: uninit-value in r871xu_drv_init
-https://syzkaller.appspot.com/bug?id=3cd92b1d85428b128503bfa7a250294c9ae00bd8
-
-Reported-by: <syzbot+6f5ecd144854c0d8580b@syzkaller.appspotmail.com>
-Tested-by: <syzbot+6f5ecd144854c0d8580b@syzkaller.appspotmail.com>
-Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
-Signed-off-by: Wang Cheng <wanngchenng@gmail.com>
-Link: https://lore.kernel.org/r/b9b7a6ee02c02aa28054f5cf16129977775f3cd9.1652618244.git.wanngchenng@gmail.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/staging/rtl8712/usb_ops.c | 27 ++++++++++++++++++---------
- 1 file changed, 18 insertions(+), 9 deletions(-)
-
-diff --git a/drivers/staging/rtl8712/usb_ops.c b/drivers/staging/rtl8712/usb_ops.c
-index e64845e6adf3..af9966d03979 100644
---- a/drivers/staging/rtl8712/usb_ops.c
-+++ b/drivers/staging/rtl8712/usb_ops.c
-@@ -29,7 +29,8 @@ static u8 usb_read8(struct intf_hdl *intfhdl, u32 addr)
- u16 wvalue;
- u16 index;
- u16 len;
-- __le32 data;
-+ int status;
-+ __le32 data = 0;
- struct intf_priv *intfpriv = intfhdl->pintfpriv;
-
- request = 0x05;
-@@ -37,8 +38,10 @@ static u8 usb_read8(struct intf_hdl *intfhdl, u32 addr)
- index = 0;
- wvalue = (u16)(addr & 0x0000ffff);
- len = 1;
-- r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index, &data, len,
-- requesttype);
-+ status = r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index,
-+ &data, len, requesttype);
-+ if (status < 0)
-+ return 0;
- return (u8)(le32_to_cpu(data) & 0x0ff);
- }
-
-@@ -49,7 +52,8 @@ static u16 usb_read16(struct intf_hdl *intfhdl, u32 addr)
- u16 wvalue;
- u16 index;
- u16 len;
-- __le32 data;
-+ int status;
-+ __le32 data = 0;
- struct intf_priv *intfpriv = intfhdl->pintfpriv;
-
- request = 0x05;
-@@ -57,8 +61,10 @@ static u16 usb_read16(struct intf_hdl *intfhdl, u32 addr)
- index = 0;
- wvalue = (u16)(addr & 0x0000ffff);
- len = 2;
-- r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index, &data, len,
-- requesttype);
-+ status = r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index,
-+ &data, len, requesttype);
-+ if (status < 0)
-+ return 0;
- return (u16)(le32_to_cpu(data) & 0xffff);
- }
-
-@@ -69,7 +75,8 @@ static u32 usb_read32(struct intf_hdl *intfhdl, u32 addr)
- u16 wvalue;
- u16 index;
- u16 len;
-- __le32 data;
-+ int status;
-+ __le32 data = 0;
- struct intf_priv *intfpriv = intfhdl->pintfpriv;
-
- request = 0x05;
-@@ -77,8 +84,10 @@ static u32 usb_read32(struct intf_hdl *intfhdl, u32 addr)
- index = 0;
- wvalue = (u16)(addr & 0x0000ffff);
- len = 4;
-- r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index, &data, len,
-- requesttype);
-+ status = r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index,
-+ &data, len, requesttype);
-+ if (status < 0)
-+ return 0;
- return le32_to_cpu(data);
- }
-
---
-2.35.1
-
+++ /dev/null
-From 47dea293251c4c81f4c642a01793de33ae7e15af Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 31 Mar 2022 17:10:05 +0800
-Subject: tty: Fix a possible resource leak in icom_probe
-
-From: Huang Guobin <huangguobin4@huawei.com>
-
-[ Upstream commit ee157a79e7c82b01ae4c25de0ac75899801f322c ]
-
-When pci_read_config_dword failed, call pci_release_regions() and
-pci_disable_device() to recycle the resource previously allocated.
-
-Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
-Signed-off-by: Huang Guobin <huangguobin4@huawei.com>
-Link: https://lore.kernel.org/r/20220331091005.3290753-1-huangguobin4@huawei.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/tty/serial/icom.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/tty/serial/icom.c b/drivers/tty/serial/icom.c
-index 624f3d541c68..d047380259b5 100644
---- a/drivers/tty/serial/icom.c
-+++ b/drivers/tty/serial/icom.c
-@@ -1499,7 +1499,7 @@ static int icom_probe(struct pci_dev *dev,
- retval = pci_read_config_dword(dev, PCI_COMMAND, &command_reg);
- if (retval) {
- dev_err(&dev->dev, "PCI Config read FAILED\n");
-- return retval;
-+ goto probe_exit0;
- }
-
- pci_write_config_dword(dev, PCI_COMMAND,
---
-2.35.1
-
+++ /dev/null
-From 8449f2a7c279186d4cc219f6f75a531facbad205 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 10 Apr 2022 19:48:14 +0800
-Subject: tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
-
-From: Zheyu Ma <zheyuma97@gmail.com>
-
-[ Upstream commit 689ca31c542687709ba21ec2195c1fbce34fd029 ]
-
-When the driver fails at alloc_hdlcdev(), and then we remove the driver
-module, we will get the following splat:
-
-[ 25.065966] general protection fault, probably for non-canonical address 0xdffffc0000000182: 0000 [#1] PREEMPT SMP KASAN PTI
-[ 25.066914] KASAN: null-ptr-deref in range [0x0000000000000c10-0x0000000000000c17]
-[ 25.069262] RIP: 0010:detach_hdlc_protocol+0x2a/0x3e0
-[ 25.077709] Call Trace:
-[ 25.077924] <TASK>
-[ 25.078108] unregister_hdlc_device+0x16/0x30
-[ 25.078481] slgt_cleanup+0x157/0x9f0 [synclink_gt]
-
-Fix this by checking whether the 'info->netdev' is a null pointer first.
-
-Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
-Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
-Link: https://lore.kernel.org/r/20220410114814.3920474-1-zheyuma97@gmail.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/tty/synclink_gt.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/drivers/tty/synclink_gt.c b/drivers/tty/synclink_gt.c
-index ff345a8e0fcc..b72471373c71 100644
---- a/drivers/tty/synclink_gt.c
-+++ b/drivers/tty/synclink_gt.c
-@@ -1752,6 +1752,8 @@ static int hdlcdev_init(struct slgt_info *info)
- */
- static void hdlcdev_exit(struct slgt_info *info)
- {
-+ if (!info->netdev)
-+ return;
- unregister_hdlc_device(info->netdev);
- free_netdev(info->netdev);
- info->netdev = NULL;
---
-2.35.1
-
+++ /dev/null
-From dfb83d4099c995c1f0efa2372a4ef38a73da6f32 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 5 May 2022 12:46:18 +0200
-Subject: usb: dwc2: gadget: don't reset gadget's driver->bus
-
-From: Marek Szyprowski <m.szyprowski@samsung.com>
-
-[ Upstream commit 3120aac6d0ecd9accf56894aeac0e265f74d3d5a ]
-
-UDC driver should not touch gadget's driver internals, especially it
-should not reset driver->bus. This wasn't harmful so far, but since
-commit fc274c1e9973 ("USB: gadget: Add a new bus for gadgets") gadget
-subsystem got it's own bus and messing with ->bus triggers the
-following NULL pointer dereference:
-
-dwc2 12480000.hsotg: bound driver g_ether
-8<--- cut here ---
-Unable to handle kernel NULL pointer dereference at virtual address 00000000
-[00000000] *pgd=00000000
-Internal error: Oops: 5 [#1] SMP ARM
-Modules linked in: ...
-CPU: 0 PID: 620 Comm: modprobe Not tainted 5.18.0-rc5-next-20220504 #11862
-Hardware name: Samsung Exynos (Flattened Device Tree)
-PC is at module_add_driver+0x44/0xe8
-LR is at sysfs_do_create_link_sd+0x84/0xe0
-...
-Process modprobe (pid: 620, stack limit = 0x(ptrval))
-...
- module_add_driver from bus_add_driver+0xf4/0x1e4
- bus_add_driver from driver_register+0x78/0x10c
- driver_register from usb_gadget_register_driver_owner+0x40/0xb4
- usb_gadget_register_driver_owner from do_one_initcall+0x44/0x1e0
- do_one_initcall from do_init_module+0x44/0x1c8
- do_init_module from load_module+0x19b8/0x1b9c
- load_module from sys_finit_module+0xdc/0xfc
- sys_finit_module from ret_fast_syscall+0x0/0x54
-Exception stack(0xf1771fa8 to 0xf1771ff0)
-...
-dwc2 12480000.hsotg: new device is high-speed
----[ end trace 0000000000000000 ]---
-
-Fix this by removing driver->bus entry reset.
-
-Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
-Link: https://lore.kernel.org/r/20220505104618.22729-1-m.szyprowski@samsung.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/dwc2/gadget.c | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
-index 379bbf27c7ce..8fd6eefc671c 100644
---- a/drivers/usb/dwc2/gadget.c
-+++ b/drivers/usb/dwc2/gadget.c
-@@ -4486,7 +4486,6 @@ static int dwc2_hsotg_udc_start(struct usb_gadget *gadget,
-
- WARN_ON(hsotg->driver);
-
-- driver->driver.bus = NULL;
- hsotg->driver = driver;
- hsotg->gadget.dev.of_node = hsotg->dev->of_node;
- hsotg->gadget.speed = USB_SPEED_UNKNOWN;
---
-2.35.1
-
+++ /dev/null
-From 43ade6fa32fa4326267d0a6acbabae89d88e8699 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 21 Apr 2022 10:39:27 -0700
-Subject: USB: hcd-pci: Fully suspend across freeze/thaw cycle
-
-From: Evan Green <evgreen@chromium.org>
-
-[ Upstream commit 63acaa8e9c65dc34dc249440216f8e977f5d2748 ]
-
-The documentation for the freeze() method says that it "should quiesce
-the device so that it doesn't generate IRQs or DMA". The unspoken
-consequence of not doing this is that MSIs aimed at non-boot CPUs may
-get fully lost if they're sent during the period where the target CPU is
-offline.
-
-The current callbacks for USB HCD do not fully quiesce interrupts,
-specifically on XHCI. Change to use the full suspend/resume flow for
-freeze/thaw to ensure interrupts are fully quiesced. This fixes issues
-where USB devices fail to thaw during hibernation because XHCI misses
-its interrupt and cannot recover.
-
-Acked-by: Alan Stern <stern@rowland.harvard.edu>
-Signed-off-by: Evan Green <evgreen@chromium.org>
-Link: https://lore.kernel.org/r/20220421103751.v3.2.I8226c7fdae88329ef70957b96a39b346c69a914e@changeid
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/core/hcd-pci.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c
-index 9e26b0143a59..db16efe293e0 100644
---- a/drivers/usb/core/hcd-pci.c
-+++ b/drivers/usb/core/hcd-pci.c
-@@ -604,10 +604,10 @@ const struct dev_pm_ops usb_hcd_pci_pm_ops = {
- .suspend_noirq = hcd_pci_suspend_noirq,
- .resume_noirq = hcd_pci_resume_noirq,
- .resume = hcd_pci_resume,
-- .freeze = check_root_hub_suspended,
-+ .freeze = hcd_pci_suspend,
- .freeze_noirq = check_root_hub_suspended,
- .thaw_noirq = NULL,
-- .thaw = NULL,
-+ .thaw = hcd_pci_resume,
- .poweroff = hcd_pci_suspend,
- .poweroff_noirq = hcd_pci_suspend_noirq,
- .restore_noirq = hcd_pci_resume_noirq,
---
-2.35.1
-
+++ /dev/null
-From 8e6c366a536bfbd5938fce7b9d0573b4466cd4f6 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 2 Mar 2022 11:37:16 +0800
-Subject: USB: host: isp116x: check return value after calling
- platform_get_resource()
-
-From: Zhen Ni <nizhen@uniontech.com>
-
-[ Upstream commit 134a3408c2d3f7e23eb0e4556e0a2d9f36c2614e ]
-
-It will cause null-ptr-deref if platform_get_resource() returns NULL,
-we need check the return value.
-
-Signed-off-by: Zhen Ni <nizhen@uniontech.com>
-Link: https://lore.kernel.org/r/20220302033716.31272-1-nizhen@uniontech.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/host/isp116x-hcd.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/usb/host/isp116x-hcd.c b/drivers/usb/host/isp116x-hcd.c
-index a87c0b26279e..00a4e12a1f15 100644
---- a/drivers/usb/host/isp116x-hcd.c
-+++ b/drivers/usb/host/isp116x-hcd.c
-@@ -1541,10 +1541,12 @@ static int isp116x_remove(struct platform_device *pdev)
-
- iounmap(isp116x->data_reg);
- res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
-- release_mem_region(res->start, 2);
-+ if (res)
-+ release_mem_region(res->start, 2);
- iounmap(isp116x->addr_reg);
- res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-- release_mem_region(res->start, 2);
-+ if (res)
-+ release_mem_region(res->start, 2);
-
- usb_put_hcd(hcd);
- return 0;
---
-2.35.1
-
+++ /dev/null
-From aba3df857925e8e19961ed19706e33075f3d1134 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 26 Apr 2022 22:53:29 +0800
-Subject: watchdog: wdat_wdt: Stop watchdog when rebooting the system
-
-From: Liu Xinpeng <liuxp11@chinatelecom.cn>
-
-[ Upstream commit 27fdf84510a1374748904db43f6755f912736d92 ]
-
-Executing reboot command several times on the machine "Dell
-PowerEdge R740", UEFI security detection stopped machine
-with the following prompt:
-
-UEFI0082: The system was reset due to a timeout from the watchdog
-timer. Check the System Event Log (SEL) or crash dumps from
-Operating Sysstem to identify the source that triggered the
-watchdog timer reset. Update the firmware or driver for the
-identified device.
-
-iDRAC has warning event: "The watchdog timer reset the system".
-
-This patch fixes this issue by adding the reboot notifier.
-
-Signed-off-by: Liu Xinpeng <liuxp11@chinatelecom.cn>
-Reviewed-by: Guenter Roeck <linux@roeck-us.net>
-Link: https://lore.kernel.org/r/1650984810-6247-3-git-send-email-liuxp11@chinatelecom.cn
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
-Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/watchdog/wdat_wdt.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/drivers/watchdog/wdat_wdt.c b/drivers/watchdog/wdat_wdt.c
-index 88c5e6361aa0..fddbb39433be 100644
---- a/drivers/watchdog/wdat_wdt.c
-+++ b/drivers/watchdog/wdat_wdt.c
-@@ -462,6 +462,7 @@ static int wdat_wdt_probe(struct platform_device *pdev)
- return ret;
-
- watchdog_set_nowayout(&wdat->wdd, nowayout);
-+ watchdog_stop_on_reboot(&wdat->wdd);
- return devm_watchdog_register_device(dev, &wdat->wdd);
- }
-
---
-2.35.1
-
+++ /dev/null
-From 14cf77106f6544cebbfe9f534af8292c5d27b309 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 2 May 2022 12:15:23 +0200
-Subject: x86/cpu: Elide KCSAN for cpu_has() and friends
-
-From: Peter Zijlstra <peterz@infradead.org>
-
-[ Upstream commit a6a5eb269f6f3a2fe392f725a8d9052190c731e2 ]
-
-As x86 uses the <asm-generic/bitops/instrumented-*.h> headers, the
-regular forms of all bitops are instrumented with explicit calls to
-KASAN and KCSAN checks. As these are explicit calls, these are not
-suppressed by the noinstr function attribute.
-
-This can result in calls to those check functions in noinstr code, which
-objtool warns about:
-
-vmlinux.o: warning: objtool: enter_from_user_mode+0x24: call to __kcsan_check_access() leaves .noinstr.text section
-vmlinux.o: warning: objtool: syscall_enter_from_user_mode+0x28: call to __kcsan_check_access() leaves .noinstr.text section
-vmlinux.o: warning: objtool: syscall_enter_from_user_mode_prepare+0x24: call to __kcsan_check_access() leaves .noinstr.text section
-vmlinux.o: warning: objtool: irqentry_enter_from_user_mode+0x24: call to __kcsan_check_access() leaves .noinstr.text section
-
-Prevent this by using the arch_*() bitops, which are the underlying
-bitops without explciit instrumentation.
-
-[null: Changelog]
-Reported-by: kernel test robot <lkp@intel.com>
-Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
-Link: https://lkml.kernel.org/r/20220502111216.290518605@infradead.org
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/x86/include/asm/cpufeature.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h
-index 59bf91c57aa8..619c1f80a2ab 100644
---- a/arch/x86/include/asm/cpufeature.h
-+++ b/arch/x86/include/asm/cpufeature.h
-@@ -49,7 +49,7 @@ extern const char * const x86_power_flags[32];
- extern const char * const x86_bug_flags[NBUGINTS*32];
-
- #define test_cpu_cap(c, bit) \
-- test_bit(bit, (unsigned long *)((c)->x86_capability))
-+ arch_test_bit(bit, (unsigned long *)((c)->x86_capability))
-
- /*
- * There are 32 bits/features in each mask word. The high bits
---
-2.35.1
-
projects / thirdparty / kernel / stable-queue.git / commitdiff
