)]}' { "log": [ { "commit": "8ed710da2873c2aeb3bb805864a699affaf1d03b", "tree": "05b670351c1073307551aa28c8a8f1a39a6fe715", "parents": [ "5b3e0cd872b09c3c771e19464db9dfc20972c39f", "b7d9aae404841d9999b7476170867ae441e948d2" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Dec 06 11:03:03 2022 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Dec 06 11:03:03 2022 -0800" }, "message": "Merge tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux\n\nPull arm64 fix from Catalin Marinas:\n \"Revert the dropping of the cache invalidation from the arm64\n arch_dma_prep_coherent() as it caused a regression in the\n qcom_q6v5_mss remoteproc driver.\n\n The driver is already buggy but the original arm64 change made\n the problem obvious. The change will be re-introduced once the\n driver is fixed\"\n\n* tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:\n Revert \"arm64: dma: Drop cache invalidation from arch_dma_prep_coherent()\"\n" }, { "commit": "5b3e0cd872b09c3c771e19464db9dfc20972c39f", "tree": "bfc66f651d3e2902c4fbdb98b85897f046587333", "parents": [ "b71101d6ae7b1149123b0479ea21e9ad391fdd49", "34e30ebbe48cc43c14276f863f0d2995c8f13186" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Dec 06 10:49:19 2022 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Dec 06 10:49:19 2022 -0800" }, "message": "Merge tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/virt/kvm/kvm\n\nPull kvm fixes from Paolo Bonzini:\n \"Unless anything comes from the ARM side, this should be the last pull\n request for this release - and it\u0027s mostly documentation:\n\n - Document the interaction between KVM_CAP_HALT_POLL and halt_poll_ns\n\n - s390: fix multi-epoch extension in nested guests\n\n - x86: fix uninitialized variable on nested triple fault\"\n\n* tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/virt/kvm/kvm:\n KVM: Document the interaction between KVM_CAP_HALT_POLL and halt_poll_ns\n KVM: Move halt-polling documentation into common directory\n KVM: x86: fix uninitialized variable use on KVM_REQ_TRIPLE_FAULT\n KVM: s390: vsie: Fix the initialization of the epoch extension (epdx) field\n" }, { "commit": "b71101d6ae7b1149123b0479ea21e9ad391fdd49", "tree": "f11ae2330fd32ac31bb34c168960991c68102124", "parents": [ "bce9332220bd677d83b19d21502776ad555a0e73", "74e7e1efdad45580cc3839f2a155174cf158f9b5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Dec 06 10:19:05 2022 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Dec 06 10:19:05 2022 -0800" }, "message": "Merge tag \u0027for-linus-xsa-6.1-rc9-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip\n\nPull xen fixes from Juergen Gross:\n \"Two zero-day fixes for the xen-netback driver (XSA-423 and XSA-424)\"\n\n* tag \u0027for-linus-xsa-6.1-rc9-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:\n xen/netback: don\u0027t call kfree_skb() with interrupts disabled\n xen/netback: Ensure protocol headers don\u0027t fall in the non-linear area\n" }, { "commit": "b7d9aae404841d9999b7476170867ae441e948d2", "tree": "49abffd639a66a61d1371f66aa9032d9d6c4ff5c", "parents": [ "5b47348fc0b18a78c96f8474cc90b7525ad1bbfe" ], "author": { "name": "Will Deacon", "email": "will@kernel.org", "time": "Tue Dec 06 10:34:03 2022 +0000" }, "committer": { "name": "Catalin Marinas", "email": "catalin.marinas@arm.com", "time": "Tue Dec 06 17:30:39 2022 +0000" }, "message": "Revert \"arm64: dma: Drop cache invalidation from arch_dma_prep_coherent()\"\n\nThis reverts commit c44094eee32f32f175aadc0efcac449d99b1bbf7.\n\nAlthough the semantics of the DMA API require only a clean operation\nhere, it turns out that the Qualcomm \u0027qcom_q6v5_mss\u0027 remoteproc driver\n(ab)uses the DMA API for transferring the modem firmware to the secure\nworld via calls to Trustzone [1].\n\nOnce the firmware buffer has changed hands, _any_ access from the\nnon-secure side (i.e. Linux) will be detected on the bus and result in a\nfull system reset [2]. Although this is possible even with this revert\nin place (due to speculative reads via the cacheable linear alias of\nmemory), anecdotally the problem occurs considerably more frequently\nwhen the lines have not been invalidated, assumedly due to some\nmicro-architectural interactions with the cache hierarchy.\n\nRevert the offending change for now, along with a comment, so that the\nQualcomm developers have time to fix the driver [3] to use a firmware\nbuffer which does not have a cacheable alias in the linear map.\n\nLink: https://lore.kernel.org/r/20221114110329.68413-1-manivannan.sadhasivam@linaro.org [1]\nLink: https://lore.kernel.org/r/CAMi1Hd3H2k1J8hJ6e-Miy5+nVDNzv6qQ3nN-9929B0GbHJkXEg@mail.gmail.com/ [2]\nLink: https://lore.kernel.org/r/20221206092152.GD15486@thinkpad [2]\nReported-by: Amit Pundir \u003camit.pundir@linaro.org\u003e\nReported-by: Manivannan Sadhasivam \u003cmanivannan.sadhasivam@linaro.org\u003e\nCc: Thorsten Leemhuis \u003cregressions@leemhuis.info\u003e\nCc: Sibi Sankar \u003cquic_sibis@quicinc.com\u003e\nSigned-off-by: Will Deacon \u003cwill@kernel.org\u003e\nAcked-by: Manivannan Sadhasivam \u003cmanivannan.sadhasivam@linaro.org\u003e\nLink: https://lore.kernel.org/r/20221206103403.646-1-will@kernel.org\nSigned-off-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\n" }, { "commit": "74e7e1efdad45580cc3839f2a155174cf158f9b5", "tree": "1100c46e8284b318acc575598e9ab91560d895dd", "parents": [ "ad7f402ae4f466647c3a669b8a6f3e5d4271c84a" ], "author": { "name": "Juergen Gross", "email": "jgross@suse.com", "time": "Tue Dec 06 08:54:24 2022 +0100" }, "committer": { "name": "Juergen Gross", "email": "jgross@suse.com", "time": "Tue Dec 06 16:00:33 2022 +0100" }, "message": "xen/netback: don\u0027t call kfree_skb() with interrupts disabled\n\nIt is not allowed to call kfree_skb() from hardware interrupt\ncontext or with interrupts being disabled. So remove kfree_skb()\nfrom the spin_lock_irqsave() section and use the already existing\n\"drop\" label in xenvif_start_xmit() for dropping the SKB. At the\nsame time replace the dev_kfree_skb() call there with a call of\ndev_kfree_skb_any(), as xenvif_start_xmit() can be called with\ndisabled interrupts.\n\nThis is XSA-424 / CVE-2022-42328 / CVE-2022-42329.\n\nFixes: be81992f9086 (\"xen/netback: don\u0027t queue unlimited number of packages\")\nReported-by: Yang Yingliang \u003cyangyingliang@huawei.com\u003e\nSigned-off-by: Juergen Gross \u003cjgross@suse.com\u003e\nReviewed-by: Jan Beulich \u003cjbeulich@suse.com\u003e\nSigned-off-by: Juergen Gross \u003cjgross@suse.com\u003e\n" }, { "commit": "ad7f402ae4f466647c3a669b8a6f3e5d4271c84a", "tree": "866672210017eefe20cb7052c9dc0edb6b267bd4", "parents": [ "76dcd734eca23168cb008912c0f69ff408905235" ], "author": { "name": "Ross Lagerwall", "email": "ross.lagerwall@citrix.com", "time": "Tue Nov 22 09:16:59 2022 +0000" }, "committer": { "name": "Juergen Gross", "email": "jgross@suse.com", "time": "Tue Dec 06 16:00:30 2022 +0100" }, "message": "xen/netback: Ensure protocol headers don\u0027t fall in the non-linear area\n\nIn some cases, the frontend may send a packet where the protocol headers\nare spread across multiple slots. This would result in netback creating\nan skb where the protocol headers spill over into the non-linear area.\nSome drivers and NICs don\u0027t handle this properly resulting in an\ninterface reset or worse.\n\nThis issue was introduced by the removal of an unconditional skb pull in\nthe tx path to improve performance. Fix this without reintroducing the\npull by setting up grant copy ops for as many slots as needed to reach\nthe XEN_NETBACK_TX_COPY_LEN size. Adjust the rest of the code to handle\nmultiple copy operations per skb.\n\nThis is XSA-423 / CVE-2022-3643.\n\nFixes: 7e5d7753956b (\"xen-netback: remove unconditional __pskb_pull_tail() in guest Tx path\")\nSigned-off-by: Ross Lagerwall \u003cross.lagerwall@citrix.com\u003e\nReviewed-by: Paul Durrant \u003cpaul@xen.org\u003e\nSigned-off-by: Juergen Gross \u003cjgross@suse.com\u003e\n" }, { "commit": "bce9332220bd677d83b19d21502776ad555a0e73", "tree": "11748b90fcc9854d161b1a79d55631aa10e85f83", "parents": [ "e6cfaf34be9fcd1a8285a294e18986bfc41a409c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Dec 05 12:09:06 2022 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Dec 05 12:09:06 2022 -0800" }, "message": "proc: proc_skip_spaces() shouldn\u0027t think it is working on C strings\n\nproc_skip_spaces() seems to think it is working on C strings, and ends\nup being just a wrapper around skip_spaces() with a really odd calling\nconvention.\n\nInstead of basing it on skip_spaces(), it should have looked more like\nproc_skip_char(), which really is the exact same function (except it\nskips a particular character, rather than whitespace). So use that as\ninspiration, odd coding and all.\n\nNow the calling convention actually makes sense and works for the\nintended purpose.\n\nReported-and-tested-by: Kyle Zeng \u003czengyhkyle@gmail.com\u003e\nAcked-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "e6cfaf34be9fcd1a8285a294e18986bfc41a409c", "tree": "99980bc2f566db463d0080a56af31d6b76e230bd", "parents": [ "b52be557e24c47286738276121177a41f54e3b83" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Dec 05 11:33:40 2022 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Dec 05 11:33:40 2022 -0800" }, "message": "proc: avoid integer type confusion in get_proc_long\n\nproc_get_long() is passed a size_t, but then assigns it to an \u0027int\u0027\nvariable for the length. Let\u0027s not do that, even if our IO paths are\nlimited to MAX_RW_COUNT (exactly because of these kinds of type errors).\n\nSo do the proper test in the rigth type.\n\nReported-by: Kyle Zeng \u003czengyhkyle@gmail.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "b52be557e24c47286738276121177a41f54e3b83", "tree": "52f3f9d59b50122fb86e964d2f7d9cf167f9caca", "parents": [ "76dcd734eca23168cb008912c0f69ff408905235" ], "author": { "name": "Jann Horn", "email": "jannh@google.com", "time": "Mon Dec 05 17:59:27 2022 +0100" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Dec 05 10:54:44 2022 -0800" }, "message": "ipc/sem: Fix dangling sem_array access in semtimedop race\n\nWhen __do_semtimedop() goes to sleep because it has to wait for a\nsemaphore value becoming zero or becoming bigger than some threshold, it\nlinks the on-stack sem_queue to the sem_array, then goes to sleep\nwithout holding a reference on the sem_array.\n\nWhen __do_semtimedop() comes back out of sleep, one of two things must\nhappen:\n\n a) We prove that the on-stack sem_queue has been disconnected from the\n (possibly freed) sem_array, making it safe to return from the stack\n frame that the sem_queue exists in.\n\n b) We stabilize our reference to the sem_array, lock the sem_array, and\n detach the sem_queue from the sem_array ourselves.\n\nsem_array has RCU lifetime, so for case (b), the reference can be\nstabilized inside an RCU read-side critical section by locklessly\nchecking whether the sem_queue is still connected to the sem_array.\n\nHowever, the current code does the lockless check on sem_queue before\nstarting an RCU read-side critical section, so the result of the\nlockless check immediately becomes useless.\n\nFix it by doing rcu_read_lock() before the lockless check. Now RCU\nensures that if we observe the object being on our queue, the object\ncan\u0027t be freed until rcu_read_unlock().\n\nThis bug is only hittable on kernel builds with full preemption support\n(either CONFIG_PREEMPT or PREEMPT_DYNAMIC with preempt\u003dfull).\n\nFixes: 370b262c896e (\"ipc/sem: avoid idr tree lookup for interrupted semop\")\nCc: stable@vger.kernel.org\nSigned-off-by: Jann Horn \u003cjannh@google.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "76dcd734eca23168cb008912c0f69ff408905235", "tree": "a9d5b1688530158d0af4ab9425191920d541e129", "parents": [ "0ba09b1733878afe838fe35c310715fda3d46428" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Dec 04 14:48:12 2022 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Dec 04 14:48:12 2022 -0800" }, "message": "Linux 6.1-rc8\n" }, { "commit": "0ba09b1733878afe838fe35c310715fda3d46428", "tree": "3e5e9a8d7f2c84233b65fc9cc88672d536425994", "parents": [ "23393c6461422df5bf8084a086ada9a7e17dc2ba" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Dec 04 12:51:59 2022 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Dec 04 12:51:59 2022 -0800" }, "message": "Revert \"mm: align larger anonymous mappings on THP boundaries\"\n\nThis reverts commit f35b5d7d676e59e401690b678cd3cfec5e785c23.\n\nIt has been reported to cause huge performance regressions on some loads\n(will-it-scale.per_process_ops, but also building the kernel with\nclang).\n\nThe commit did speed up gcc builds by a small amount, so it\u0027s not an\nunambiguous regression, but until the big regressions are understood,\nlet\u0027s revert it.\n\nReported-by: kernel test robot \u003cyujie.liu@intel.com\u003e\nLink: https://lore.kernel.org/r/202210181535.7144dd15-yujie.liu@intel.com\nReported-by: Nathan Chancellor \u003cnathan@kernel.org\u003e\nLink: https://lore.kernel.org/lkml/Y1DNQaoPWxE%2BrGce@dev-arch.thelio-3990X/\nCc: Huang, Ying \u003cying.huang@intel.com\u003e\nCc: Rik van Riel \u003criel@surriel.com\u003e\nCc: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nCc: Yang Shi \u003cshy828301@gmail.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "23393c6461422df5bf8084a086ada9a7e17dc2ba", "tree": "cbfa8776c492847467dc362edd23e75806b021df", "parents": [ "0c3b5bcb484a659dd14466f92a073b57b2d3c1a5" ], "author": { "name": "Jan Dabros", "email": "jsd@semihalf.com", "time": "Mon Nov 28 20:56:51 2022 +0100" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Dec 04 12:49:13 2022 -0800" }, "message": "char: tpm: Protect tpm_pm_suspend with locks\n\nCurrently tpm transactions are executed unconditionally in\ntpm_pm_suspend() function, which may lead to races with other tpm\naccessors in the system.\n\nSpecifically, the hw_random tpm driver makes use of tpm_get_random(),\nand this function is called in a loop from a kthread, which means it\u0027s\nnot frozen alongside userspace, and so can race with the work done\nduring system suspend:\n\n tpm tpm0: tpm_transmit: tpm_recv: error -52\n tpm tpm0: invalid TPM_STS.x 0xff, dumping stack for forensics\n CPU: 0 PID: 1 Comm: init Not tainted 6.1.0-rc5+ #135\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-20220807_005459-localhost 04/01/2014\n Call Trace:\n tpm_tis_status.cold+0x19/0x20\n tpm_transmit+0x13b/0x390\n tpm_transmit_cmd+0x20/0x80\n tpm1_pm_suspend+0xa6/0x110\n tpm_pm_suspend+0x53/0x80\n __pnp_bus_suspend+0x35/0xe0\n __device_suspend+0x10f/0x350\n\nFix this by calling tpm_try_get_ops(), which itself is a wrapper around\ntpm_chip_start(), but takes the appropriate mutex.\n\nSigned-off-by: Jan Dabros \u003cjsd@semihalf.com\u003e\nReported-by: Vlastimil Babka \u003cvbabka@suse.cz\u003e\nTested-by: Jason A. Donenfeld \u003cJason@zx2c4.com\u003e\nTested-by: Vlastimil Babka \u003cvbabka@suse.cz\u003e\nLink: https://lore.kernel.org/all/c5ba47ef-393f-1fba-30bd-1230d1b4b592@suse.cz/\nCc: stable@vger.kernel.org\nFixes: e891db1a18bf (\"tpm: turn on TPM on suspend for TPM 1.x\")\n[Jason: reworked commit message, added metadata]\nSigned-off-by: Jason A. Donenfeld \u003cJason@zx2c4.com\u003e\nReviewed-by: Jarkko Sakkinen \u003cjarkko@kernel.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "0c3b5bcb484a659dd14466f92a073b57b2d3c1a5", "tree": "24b84594b56f1974c16255b96cab11cddfe7d0d2", "parents": [ "eea8bebd51739cc7a3bb501032ee877b4aada553", "517e6a301f34613bff24a8e35b5455884f2d83d8" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Dec 04 12:36:23 2022 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Dec 04 12:36:23 2022 -0800" }, "message": "Merge tag \u0027perf_urgent_for_v6.1_rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull perf fix from Borislav Petkov:\n\n - Fix a use-after-free case where the perf pending task callback would\n see an already freed event\n\n* tag \u0027perf_urgent_for_v6.1_rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n perf: Fix perf_pending_task() UaF\n" }, { "commit": "eea8bebd51739cc7a3bb501032ee877b4aada553", "tree": "d03b835e416a0450d77a5840438b217544d62174", "parents": [ "ae6bb71711713e7b6b2d9ed2af7318dc8ae5cfb2", "d9f15a9de44affe733e34f93bc184945ba277e6d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Dec 04 12:33:44 2022 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Dec 04 12:33:44 2022 -0800" }, "message": "Merge tag \u0027timers_urgent_for_v6.1_rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull timer fix from Borislav Petkov:\n\n - Revert a fix to RISC-V timers supposed to address an uncertainty\n whether clock events are received during S3 or not which locks up\n other RISC-V platforms. The issue will be fixed differently later.\n\n* tag \u0027timers_urgent_for_v6.1_rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n Revert \"clocksource/drivers/riscv: Events are stopped during CPU suspend\"\n" }, { "commit": "ae6bb71711713e7b6b2d9ed2af7318dc8ae5cfb2", "tree": "4e739a8f6e6a899e4267559038efb7002c72ac61", "parents": [ "50f36c5aa12c8d0f2adca662e0c106212ea897a8", "2e7ec190a0e38aaa8a6d87fd5f804ec07947febc" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Dec 04 12:24:58 2022 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Dec 04 12:24:58 2022 -0800" }, "message": "Merge tag \u0027powerpc-6.1-6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux\n\nPull powerpc fixes from Michael Ellerman:\n\n - Fix oops in 32-bit BPF tail call tests\n\n - Add missing declaration for machine_check_early_boot()\n\nThanks to Christophe Leroy and Naveen N. Rao.\n\n* tag \u0027powerpc-6.1-6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:\n powerpc/64s: Add missing declaration for machine_check_early_boot()\n powerpc/bpf/32: Fix Oops on tail call tests\n" }, { "commit": "50f36c5aa12c8d0f2adca662e0c106212ea897a8", "tree": "b1d631285b925629b8158396b22789bb480ece71", "parents": [ "c2bf05db6c78f53ca5cd4b48f3b9b71f78d215f1", "8c9a59939deb4bfafdc451100c03d1e848b4169b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Dec 04 12:18:37 2022 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Dec 04 12:18:37 2022 -0800" }, "message": "Merge tag \u0027input-for-v6.1-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input\n\nPull input fix from Dmitry Torokhov:\n\n - a fix for Raydium touchscreen driver to stop leaking memory when\n sending commands to the chip\n\n* tag \u0027input-for-v6.1-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:\n Input: raydium_ts_i2c - fix memory leak in raydium_i2c_send()\n" }, { "commit": "c2bf05db6c78f53ca5cd4b48f3b9b71f78d215f1", "tree": "c22612c69faf8a733677500044f7bf5906d47ed0", "parents": [ "6085bc95797caa55a68bc0f7dd73e8c33e91037f", "d36678f7905cbd1dc55a8a96e066dafd749d4600" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Dec 03 13:51:37 2022 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Dec 03 13:51:37 2022 -0800" }, "message": "Merge tag \u0027i2c-for-6.1-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux\n\nPull i2c fixes from Wolfram Sang:\n \"A power state fix in the core for ACPI devices, a regression fix\n regarding bus recovery for the cadence driver, a DMA handling fix for\n the imx driver, and two error path fixes (npcm7xx and qcom-geni)\"\n\n* tag \u0027i2c-for-6.1-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:\n i2c: imx: Only DMA messages with I2C_M_DMA_SAFE flag set\n i2c: qcom-geni: fix error return code in geni_i2c_gpi_xfer\n i2c: cadence: Fix regression with bus recovery\n i2c: Restore initial power state if probe fails\n i2c: npcm7xx: Fix error handling in npcm_i2c_init()\n" }, { "commit": "6085bc95797caa55a68bc0f7dd73e8c33e91037f", "tree": "5e7677184729a6150e91e8217c28e9c024453987", "parents": [ "97ee9d1c16963375eefdf964c429897d27e28956", "472faf72b33d80aa8e7a99c9410c1a23d3bf0cd8" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Dec 03 13:43:38 2022 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Dec 03 13:43:38 2022 -0800" }, "message": "Merge tag \u0027dax-fixes-6.1-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm\n\nPull dax fixes from Dan Williams:\n \"A few bug fixes around the handling of \"Soft Reserved\" memory and\n memory tiering information.\n\n Linux is starting to enounter more real world systems that deploy an\n ACPI HMAT to describe different performance classes of memory, as well\n the \"special purpose\" (Linux \"Soft Reserved\") designation from EFI.\n\n These fixes result from that testing.\n\n It has all appeared in -next for a while with no known issues.\n\n - Fix duplicate overlapping device-dax instances for HMAT described\n \"Soft Reserved\" Memory\n\n - Fix missing node targets in the sysfs representation of memory\n tiers\n\n - Remove a confusing variable initialization\"\n\n* tag \u0027dax-fixes-6.1-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm:\n device-dax: Fix duplicate \u0027hmem\u0027 device registration\n ACPI: HMAT: Fix initiator registration for single-initiator systems\n ACPI: HMAT: remove unnecessary variable initialization\n" }, { "commit": "97ee9d1c16963375eefdf964c429897d27e28956", "tree": "b55765e771adcc04e3d3e7ff2ad1adfbd08eaccd", "parents": [ "63050a5ca130e76af7199c9a3fba1d175f3a1102", "d0f411c0b9bdef85f647e15a2fcc790b29891f2c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Dec 02 16:27:15 2022 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Dec 02 16:27:15 2022 -0800" }, "message": "Merge tag \u0027block-6.1-2022-12-02\u0027 of git://git.kernel.dk/linux\n\nPull block fixes from Jens Axboe:\n \"Just a small NVMe merge for this week, fixing protection of the name\n space list, and a missing clear of a reserved field when unused\"\n\n* tag \u0027block-6.1-2022-12-02\u0027 of git://git.kernel.dk/linux:\n nvme: fix SRCU protection of nvme_ns_head list\n nvme-pci: clear the prp2 field when not used\n" }, { "commit": "63050a5ca130e76af7199c9a3fba1d175f3a1102", "tree": "776d5dd6c38dd092e95e4d7e094d416b9dece485", "parents": [ "0e15c3c75a28b10bac7b3ad7627fd6b458623283", "6989ea4881c8944fbf04378418bb1af63d875ef8" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Dec 02 16:22:17 2022 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Dec 02 16:22:17 2022 -0800" }, "message": "Merge tag \u0027pinctrl-v6.1-5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl\n\nPull pin control fixes from Linus Walleij:\n \"Three driver fixes. The Intel fix looks like the most important.\n\n - Fix a potential divide by zero in pinctrl-singe (OMAP and\n HiSilicon)\n\n - Disable IRQs on startup in the Mediatek driver. This is a classic,\n we should be looking out for this more.\n\n - Save and restore pins in \u0027direct IRQ\u0027 mode in the Intel driver,\n this works around firmware bugs\"\n\n* tag \u0027pinctrl-v6.1-5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:\n pinctrl: intel: Save and restore pins in \"direct IRQ\" mode\n pinctrl: meditatek: Startup with the IRQs disabled\n pinctrl: single: Fix potential division by zero\n" }, { "commit": "0e15c3c75a28b10bac7b3ad7627fd6b458623283", "tree": "3d75b73ea25112e6b90c870473a38cf0cbcbbb7b", "parents": [ "2df2adc3e69d32751eb534ed55c591854260c4a3", "39cefc5f6cd25d555e0455b24810e9aff365b8d6" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Dec 02 16:04:53 2022 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Dec 02 16:04:53 2022 -0800" }, "message": "Merge tag \u0027riscv-for-linus-6.1-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux\n\nPull RISC-V fixes from Palmer Dabbelt:\n\n - build fix for the NR_CPUS Kconfig SBI version dependency\n\n - fixes to early memory initialization, to fix page permissions in EFI\n and post-initmem-free\n\n - build fix for the VDSO, to avoid trying to profile the VDSO functions\n\n - fixes for kexec crash handling, to fix multi-core and interrupt\n related initialization inside the crash kernel\n\n - fix for a race condition when handling multiple concurrect kernel\n stack overflows\n\n* tag \u0027riscv-for-linus-6.1-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:\n riscv: kexec: Fixup crash_smp_send_stop without multi cores\n riscv: kexec: Fixup irq controller broken in kexec crash path\n riscv: mm: Proper page permissions after initmem free\n riscv: vdso: fix section overlapping under some conditions\n riscv: fix race when vmap stack overflow\n riscv: Sync efi page table\u0027s kernel mappings before switching\n riscv: Fix NR_CPUS range conditions\n" }, { "commit": "2df2adc3e69d32751eb534ed55c591854260c4a3", "tree": "af568527f21b153fd0b906296b440d562703c71a", "parents": [ "f66f62f83dba3ec4237c3dd7a95b776824ac91a0", "dd30dcfa7a74a06f8dcdab260d8d5adf32f17333" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Dec 02 15:58:07 2022 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Dec 02 15:58:07 2022 -0800" }, "message": "Merge tag \u0027mmc-v6.1-rc5-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc\n\nPull MMC fixes from Ulf Hansson:\n \"MMC core:\n - Fix ambiguous TRIM and DISCARD args\n - Fix removal of debugfs file for mmc_test\n\n MMC host:\n - mtk-sd: Add missing clk_disable_unprepare() in an error path\n - sdhci: Fix I/O voltage switch delay for UHS-I SD cards\n - sdhci-esdhc-imx: Fix CQHCI exit halt state check\n - sdhci-sprd: Fix voltage switch\"\n\n* tag \u0027mmc-v6.1-rc5-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:\n mmc: sdhci-sprd: Fix no reset data and command after voltage switch\n mmc: sdhci: Fix voltage switch delay\n mmc: mtk-sd: Fix missing clk_disable_unprepare in msdc_of_clock_parse()\n mmc: mmc_test: Fix removal of debugfs file\n mmc: sdhci-esdhc-imx: correct CQHCI exit halt state check\n mmc: core: Fix ambiguous TRIM and DISCARD arg\n" }, { "commit": "f66f62f83dba3ec4237c3dd7a95b776824ac91a0", "tree": "20a3193ade3b0f11ebac8c4b11aa77dcd967f42c", "parents": [ "66065157420c5b9b3f078f43d313c153e1ff7f83", "4bedbbd782ebbe7287231fea862c158d4f08a9e3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Dec 02 15:54:12 2022 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Dec 02 15:54:12 2022 -0800" }, "message": "Merge tag \u0027iommu-fixes-v6.1-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu\n\nPull iommu fixes from Joerg Roedel:\n \"Intel VT-d fixes:\n\n - IO/TLB flush fix\n\n - Various pci_dev refcount fixes\"\n\n* tag \u0027iommu-fixes-v6.1-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu:\n iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init()\n iommu/vt-d: Fix PCI device refcount leak in has_external_pci()\n iommu/vt-d: Fix PCI device refcount leak in prq_event_thread()\n iommu/vt-d: Add a fix for devices need extra dtlb flush\n" }, { "commit": "66065157420c5b9b3f078f43d313c153e1ff7f83", "tree": "dc02217a2dc270e6f592cf4dff5d5720d2ef85aa", "parents": [ "a1e9185d20b56af04022d2e656802254f4ea47eb" ], "author": { "name": "Pawan Gupta", "email": "pawan.kumar.gupta@linux.intel.com", "time": "Wed Nov 30 07:25:51 2022 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Dec 02 15:45:33 2022 -0800" }, "message": "x86/bugs: Make sure MSR_SPEC_CTRL is updated properly upon resume from S3\n\nThe \"force\" argument to write_spec_ctrl_current() is currently ambiguous\nas it does not guarantee the MSR write. This is due to the optimization\nthat writes to the MSR happen only when the new value differs from the\ncached value.\n\nThis is fine in most cases, but breaks for S3 resume when the cached MSR\nvalue gets out of sync with the hardware MSR value due to S3 resetting\nit.\n\nWhen x86_spec_ctrl_current is same as x86_spec_ctrl_base, the MSR write\nis skipped. Which results in SPEC_CTRL mitigations not getting restored.\n\nMove the MSR write from write_spec_ctrl_current() to a new function that\nunconditionally writes to the MSR. Update the callers accordingly and\nrename functions.\n\n [ bp: Rework a bit. ]\n\nFixes: caa0ff24d5d0 (\"x86/bugs: Keep a per-CPU IA32_SPEC_CTRL value\")\nSuggested-by: Borislav Petkov \u003cbp@alien8.de\u003e\nSigned-off-by: Pawan Gupta \u003cpawan.kumar.gupta@linux.intel.com\u003e\nSigned-off-by: Borislav Petkov (AMD) \u003cbp@alien8.de\u003e\nReviewed-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: \u003cstable@kernel.org\u003e\nLink: https://lore.kernel.org/r/806d39b0bfec2fe8f50dc5446dff20f5bb24a959.1669821572.git.pawan.kumar.gupta@linux.intel.com\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "8c9a59939deb4bfafdc451100c03d1e848b4169b", "tree": "8821226291cba357916388a1f973911d84a690c7", "parents": [ "81cd7e8489278d28794e7b272950c3e00c344e44" ], "author": { "name": "Zhang Xiaoxu", "email": "zhangxiaoxu5@huawei.com", "time": "Fri Dec 02 15:37:46 2022 -0800" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Fri Dec 02 15:42:21 2022 -0800" }, "message": "Input: raydium_ts_i2c - fix memory leak in raydium_i2c_send()\n\nThere is a kmemleak when test the raydium_i2c_ts with bpf mock device:\n\n unreferenced object 0xffff88812d3675a0 (size 8):\n comm \"python3\", pid 349, jiffies 4294741067 (age 95.695s)\n hex dump (first 8 bytes):\n 11 0e 10 c0 01 00 04 00 ........\n backtrace:\n [\u003c0000000068427125\u003e] __kmalloc+0x46/0x1b0\n [\u003c0000000090180f91\u003e] raydium_i2c_send+0xd4/0x2bf [raydium_i2c_ts]\n [\u003c000000006e631aee\u003e] raydium_i2c_initialize.cold+0xbc/0x3e4 [raydium_i2c_ts]\n [\u003c00000000dc6fcf38\u003e] raydium_i2c_probe+0x3cd/0x6bc [raydium_i2c_ts]\n [\u003c00000000a310de16\u003e] i2c_device_probe+0x651/0x680\n [\u003c00000000f5a96bf3\u003e] really_probe+0x17c/0x3f0\n [\u003c00000000096ba499\u003e] __driver_probe_device+0xe3/0x170\n [\u003c00000000c5acb4d9\u003e] driver_probe_device+0x49/0x120\n [\u003c00000000264fe082\u003e] __device_attach_driver+0xf7/0x150\n [\u003c00000000f919423c\u003e] bus_for_each_drv+0x114/0x180\n [\u003c00000000e067feca\u003e] __device_attach+0x1e5/0x2d0\n [\u003c0000000054301fc2\u003e] bus_probe_device+0x126/0x140\n [\u003c00000000aad93b22\u003e] device_add+0x810/0x1130\n [\u003c00000000c086a53f\u003e] i2c_new_client_device+0x352/0x4e0\n [\u003c000000003c2c248c\u003e] of_i2c_register_device+0xf1/0x110\n [\u003c00000000ffec4177\u003e] of_i2c_notify+0x100/0x160\n unreferenced object 0xffff88812d3675c8 (size 8):\n comm \"python3\", pid 349, jiffies 4294741070 (age 95.692s)\n hex dump (first 8 bytes):\n 22 00 36 2d 81 88 ff ff \".6-....\n backtrace:\n [\u003c0000000068427125\u003e] __kmalloc+0x46/0x1b0\n [\u003c0000000090180f91\u003e] raydium_i2c_send+0xd4/0x2bf [raydium_i2c_ts]\n [\u003c000000001d5c9620\u003e] raydium_i2c_initialize.cold+0x223/0x3e4 [raydium_i2c_ts]\n [\u003c00000000dc6fcf38\u003e] raydium_i2c_probe+0x3cd/0x6bc [raydium_i2c_ts]\n [\u003c00000000a310de16\u003e] i2c_device_probe+0x651/0x680\n [\u003c00000000f5a96bf3\u003e] really_probe+0x17c/0x3f0\n [\u003c00000000096ba499\u003e] __driver_probe_device+0xe3/0x170\n [\u003c00000000c5acb4d9\u003e] driver_probe_device+0x49/0x120\n [\u003c00000000264fe082\u003e] __device_attach_driver+0xf7/0x150\n [\u003c00000000f919423c\u003e] bus_for_each_drv+0x114/0x180\n [\u003c00000000e067feca\u003e] __device_attach+0x1e5/0x2d0\n [\u003c0000000054301fc2\u003e] bus_probe_device+0x126/0x140\n [\u003c00000000aad93b22\u003e] device_add+0x810/0x1130\n [\u003c00000000c086a53f\u003e] i2c_new_client_device+0x352/0x4e0\n [\u003c000000003c2c248c\u003e] of_i2c_register_device+0xf1/0x110\n [\u003c00000000ffec4177\u003e] of_i2c_notify+0x100/0x160\n\nAfter BANK_SWITCH command from i2c BUS, no matter success or error\nhappened, the tx_buf should be freed.\n\nFixes: 3b384bd6c3f2 (\"Input: raydium_ts_i2c - do not split tx transactions\")\nSigned-off-by: Zhang Xiaoxu \u003czhangxiaoxu5@huawei.com\u003e\nLink: https://lore.kernel.org/r/20221202103412.2120169-1-zhangxiaoxu5@huawei.com\nCc: stable@vger.kernel.org\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "a1e9185d20b56af04022d2e656802254f4ea47eb", "tree": "a22e8f43742ac1d803dadf16edb1ac3aa972ed34", "parents": [ "c290db013742e98fe5b64073bc2dd8c8a2ac9e4c", "b47068b4aa53a57552398e3f60d0ed1918700c2b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Dec 02 15:40:35 2022 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Dec 02 15:40:35 2022 -0800" }, "message": "Merge tag \u0027sound-6.1-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound\n\nPull sound fixes from Takashi Iwai:\n \"Likely the last piece for 6.1; the only significant fixes are ASoC\n core ops fixes, while others are device-specific (rather minor) fixes\n in ASoC and FireWire drivers.\n\n All appear safe enough to take as a late stage material\"\n\n* tag \u0027sound-6.1-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:\n ALSA: dice: fix regression for Lexicon I-ONIX FW810S\n ASoC: cs42l51: Correct PGA Volume minimum value\n ASoC: ops: Correct bounds check for second channel on SX controls\n ASoC: tlv320adc3xxx: Fix build error for implicit function declaration\n ASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx()\n ASoC: ops: Fix bounds check for _sx controls\n ASoC: fsl_micfil: explicitly clear CHnF flags\n ASoC: fsl_micfil: explicitly clear software reset bit\n" }, { "commit": "c290db013742e98fe5b64073bc2dd8c8a2ac9e4c", "tree": "a3d68aed71f6cffe854f43323d5daee697c1f455", "parents": [ "bdaa78c6aa861f0e8c612a0b2272423d92f0071c", "c082fbd687ad70a92e0a8be486a7555a66f03079" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Dec 02 15:35:21 2022 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Dec 02 15:35:21 2022 -0800" }, "message": "Merge tag \u0027drm-fixes-2022-12-02\u0027 of git://anongit.freedesktop.org/drm/drm\n\nPull drm fixes from Dave Airlie:\n \"Things do seem to have finally settled down, just four i915 and one\n amdgpu this week. Probably won\u0027t have much for next week if you do\n push rc8 out.\n\n i915:\n - Fix dram info readout\n - Remove non-existent pipes from bigjoiner pipe mask\n - Fix negative value passed as remaining time\n - Never return 0 if not all requests retired\n\n amdgpu:\n - VCN fix for vangogh\"\n\n* tag \u0027drm-fixes-2022-12-02\u0027 of git://anongit.freedesktop.org/drm/drm:\n drm/amdgpu: enable Vangogh VCN indirect sram mode\n drm/i915: Never return 0 if not all requests retired\n drm/i915: Fix negative value passed as remaining time\n drm/i915: Remove non-existent pipes from bigjoiner pipe mask\n drm/i915/mtl: Fix dram info readout\n" }, { "commit": "bdaa78c6aa861f0e8c612a0b2272423d92f0071c", "tree": "3a4c4e15fb169955c8c07d20bdd8cef84ef0f35a", "parents": [ "6647e76ab623b2b3fb2efe03a86e9c9046c52c33", "1d351f1894342c378b96bb9ed89f8debb1e24e9f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Dec 02 13:39:38 2022 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Dec 02 13:39:38 2022 -0800" }, "message": "Merge tag \u0027mm-hotfixes-stable-2022-12-02\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm\n\nPull misc hotfixes from Andrew Morton:\n \"15 hotfixes, 11 marked cc:stable.\n\n Only three or four of the latter address post-6.0 issues, which is\n hopefully a sign that things are converging\"\n\n* tag \u0027mm-hotfixes-stable-2022-12-02\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:\n revert \"kbuild: fix -Wimplicit-function-declaration in license_is_gpl_compatible\"\n Kconfig.debug: provide a little extra FRAME_WARN leeway when KASAN is enabled\n drm/amdgpu: temporarily disable broken Clang builds due to blown stack-frame\n mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths\n mm/khugepaged: fix GUP-fast interaction by sending IPI\n mm/khugepaged: take the right locks for page table retraction\n mm: migrate: fix THP\u0027s mapcount on isolation\n mm: introduce arch_has_hw_nonleaf_pmd_young()\n mm: add dummy pmd_young() for architectures not having it\n mm/damon/sysfs: fix wrong empty schemes assumption under online tuning in damon_sysfs_set_schemes()\n tools/vm/slabinfo-gnuplot: use \"grep -E\" instead of \"egrep\"\n nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry()\n hugetlb: don\u0027t delete vma_lock in hugetlb MADV_DONTNEED processing\n madvise: use zap_page_range_single for madvise dontneed\n mm: replace VM_WARN_ON to pr_warn if the node is offline with __GFP_THISNODE\n" }, { "commit": "6647e76ab623b2b3fb2efe03a86e9c9046c52c33", "tree": "98b29c1adf438d99df8617cbc274f59c94caf382", "parents": [ "a4412fdd49dc011bcc2c0d81ac4cab7457092650" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Nov 30 16:10:52 2022 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Dec 02 13:33:57 2022 -0800" }, "message": "v4l2: don\u0027t fall back to follow_pfn() if pin_user_pages_fast() fails\n\nThe V4L2_MEMORY_USERPTR interface is long deprecated and shouldn\u0027t be\nused (and is discouraged for any modern v4l drivers). And Seth Jenkins\npoints out that the fallback to VM_PFNMAP/VM_IO is fundamentally racy\nand dangerous.\n\nNote that it\u0027s not even a case that should trigger, since any normal\nuser pointer logic ends up just using the pin_user_pages_fast() call\nthat does the proper page reference counting. That\u0027s not the problem\ncase, only if you try to use special device mappings do you have any\nissues.\n\nNormally I\u0027d just remove this during the merge window, but since Seth\npointed out the problem cases, we really want to know as soon as\npossible if there are actually any users of this odd special case of a\nlegacy interface. Neither Hans nor Mauro seem to think that such\nmis-uses of the old legacy interface should exist. As Mauro says:\n\n \"See, V4L2 has actually 4 streaming APIs:\n - Kernel-allocated mmap (usually referred simply as just mmap);\n - USERPTR mmap;\n - read();\n - dmabuf;\n\n The USERPTR is one of the oldest way to use it, coming from V4L\n version 1 times, and by far the least used one\"\n\nAnd Hans chimed in on the USERPTR interface:\n\n \"To be honest, I wouldn\u0027t mind if it goes away completely, but that\u0027s a\n bit of a pipe dream right now\"\n\nbut while removing this legacy interface entirely may be a pipe dream we\ncan at least try to remove the unlikely (and actively broken) case of\nusing special device mappings for USERPTR accesses.\n\nThis replaces it with a WARN_ONCE() that we can remove once we\u0027ve\nhopefully confirmed that no actual users exist.\n\nNOTE! Longer term, this means that a \u0027struct frame_vector\u0027 only ever\ncontains proper page pointers, and all the games we have with converting\nthem to pages can go away (grep for \u0027frame_vector_to_pages()\u0027 and the\nuses of \u0027vec-\u003eis_pfns\u0027). But this is just the first step, to verify\nthat this code really is all dead, and do so as quickly as possible.\n\nReported-by: Seth Jenkins \u003csethjenkins@google.com\u003e\nAcked-by: Hans Verkuil \u003chverkuil@xs4all.nl\u003e\nAcked-by: Mauro Carvalho Chehab \u003cmchehab@kernel.org\u003e\nCc: David Hildenbrand \u003cdavid@redhat.com\u003e\nCc: Jan Kara \u003cjack@suse.cz\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "34e30ebbe48cc43c14276f863f0d2995c8f13186", "tree": "b67a8f87a7f9c80c56b9723f1b1fc01af1219278", "parents": [ "b8b43a4c2e9f66481cc667007aac6d0372e9c4cb" ], "author": { "name": "David Matlack", "email": "dmatlack@google.com", "time": "Thu Dec 01 11:52:49 2022 -0800" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Fri Dec 02 13:20:30 2022 -0500" }, "message": "KVM: Document the interaction between KVM_CAP_HALT_POLL and halt_poll_ns\n\nClarify the existing documentation about how KVM_CAP_HALT_POLL and\nhalt_poll_ns interact to make it clear that VMs using KVM_CAP_HALT_POLL\nignore halt_poll_ns.\n\nSigned-off-by: David Matlack \u003cdmatlack@google.com\u003e\nMessage-Id: \u003c20221201195249.3369720-3-dmatlack@google.com\u003e\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n" }, { "commit": "b8b43a4c2e9f66481cc667007aac6d0372e9c4cb", "tree": "516601220002a5cc3bec4f974e800bc836a136bf", "parents": [ "e542baf30b48605d4336bf54b98e76b8fb98af30" ], "author": { "name": "David Matlack", "email": "dmatlack@google.com", "time": "Thu Dec 01 11:52:48 2022 -0800" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Fri Dec 02 13:20:30 2022 -0500" }, "message": "KVM: Move halt-polling documentation into common directory\n\nMove halt-polling.rst into the common KVM documentation directory and\nout of the x86-specific directory. Halt-polling is a common feature and\nthe existing documentation is already written as such.\n\nSigned-off-by: David Matlack \u003cdmatlack@google.com\u003e\nMessage-Id: \u003c20221201195249.3369720-2-dmatlack@google.com\u003e\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n" }, { "commit": "d0f411c0b9bdef85f647e15a2fcc790b29891f2c", "tree": "3beda37d611a5015e83b5fb3eed15c361c3436c4", "parents": [ "7d4a93176e0142ce16d23c849a47d5b00b856296", "899d2a05dc14733cfba6224083c6b0dd5a738590" ], "author": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Fri Dec 02 08:01:06 2022 -0700" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Fri Dec 02 08:01:06 2022 -0700" }, "message": "Merge tag \u0027nvme-6.1-2022-01-02\u0027 of git://git.infradead.org/nvme into block-6.1\n\nPull NVMe fixes from Christoph:\n\n\"nvme fixes for Linux 6.1\n\n - fix SRCU protection of nvme_ns_head list (Caleb Sander)\n - clear the prp2 field when not used (Lei Rao)\"\n\n* tag \u0027nvme-6.1-2022-01-02\u0027 of git://git.infradead.org/nvme:\n nvme: fix SRCU protection of nvme_ns_head list\n nvme-pci: clear the prp2 field when not used\n" }, { "commit": "4bedbbd782ebbe7287231fea862c158d4f08a9e3", "tree": "e29f3c7bdff76e49762be071a55cad97f9c40383", "parents": [ "afca9e19cc720bfafc75dc5ce429c185ca93f31d" ], "author": { "name": "Xiongfeng Wang", "email": "wangxiongfeng2@huawei.com", "time": "Thu Dec 01 12:01:27 2022 +0800" }, "committer": { "name": "Joerg Roedel", "email": "jroedel@suse.de", "time": "Fri Dec 02 11:45:33 2022 +0100" }, "message": "iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init()\n\nfor_each_pci_dev() is implemented by pci_get_device(). The comment of\npci_get_device() says that it will increase the reference count for the\nreturned pci_dev and also decrease the reference count for the input\npci_dev @from if it is not NULL.\n\nIf we break for_each_pci_dev() loop with pdev not NULL, we need to call\npci_dev_put() to decrease the reference count. Add the missing\npci_dev_put() for the error path to avoid reference count leak.\n\nFixes: 2e4552893038 (\"iommu/vt-d: Unify the way to process DMAR device scope array\")\nSigned-off-by: Xiongfeng Wang \u003cwangxiongfeng2@huawei.com\u003e\nLink: https://lore.kernel.org/r/20221121113649.190393-3-wangxiongfeng2@huawei.com\nSigned-off-by: Lu Baolu \u003cbaolu.lu@linux.intel.com\u003e\nSigned-off-by: Joerg Roedel \u003cjroedel@suse.de\u003e\n" }, { "commit": "afca9e19cc720bfafc75dc5ce429c185ca93f31d", "tree": "b6ec38ee30d35bddab2ad8cfad87899ef221fb11", "parents": [ "6927d352380797ddbee18631491ec428741696e2" ], "author": { "name": "Xiongfeng Wang", "email": "wangxiongfeng2@huawei.com", "time": "Thu Dec 01 12:01:26 2022 +0800" }, "committer": { "name": "Joerg Roedel", "email": "jroedel@suse.de", "time": "Fri Dec 02 11:45:32 2022 +0100" }, "message": "iommu/vt-d: Fix PCI device refcount leak in has_external_pci()\n\nfor_each_pci_dev() is implemented by pci_get_device(). The comment of\npci_get_device() says that it will increase the reference count for the\nreturned pci_dev and also decrease the reference count for the input\npci_dev @from if it is not NULL.\n\nIf we break for_each_pci_dev() loop with pdev not NULL, we need to call\npci_dev_put() to decrease the reference count. Add the missing\npci_dev_put() before \u0027return true\u0027 to avoid reference count leak.\n\nFixes: 89a6079df791 (\"iommu/vt-d: Force IOMMU on for platform opt in hint\")\nSigned-off-by: Xiongfeng Wang \u003cwangxiongfeng2@huawei.com\u003e\nLink: https://lore.kernel.org/r/20221121113649.190393-2-wangxiongfeng2@huawei.com\nSigned-off-by: Lu Baolu \u003cbaolu.lu@linux.intel.com\u003e\nSigned-off-by: Joerg Roedel \u003cjroedel@suse.de\u003e\n" }, { "commit": "6927d352380797ddbee18631491ec428741696e2", "tree": "563f48eead2d51af123511262616365ddc87d036", "parents": [ "e65a6897be5e4939d477c4969a05e12d90b08409" ], "author": { "name": "Yang Yingliang", "email": "yangyingliang@huawei.com", "time": "Thu Dec 01 12:01:25 2022 +0800" }, "committer": { "name": "Joerg Roedel", "email": "jroedel@suse.de", "time": "Fri Dec 02 11:45:32 2022 +0100" }, "message": "iommu/vt-d: Fix PCI device refcount leak in prq_event_thread()\n\nAs comment of pci_get_domain_bus_and_slot() says, it returns a pci device\nwith refcount increment, when finish using it, the caller must decrease\nthe reference count by calling pci_dev_put(). So call pci_dev_put() after\nusing the \u0027pdev\u0027 to avoid refcount leak.\n\nBesides, if the \u0027pdev\u0027 is null or intel_svm_prq_report() returns error,\nthere is no need to trace this fault.\n\nFixes: 06f4b8d09dba (\"iommu/vt-d: Remove unnecessary SVA data accesses in page fault path\")\nSuggested-by: Lu Baolu \u003cbaolu.lu@linux.intel.com\u003e\nSigned-off-by: Yang Yingliang \u003cyangyingliang@huawei.com\u003e\nLink: https://lore.kernel.org/r/20221119144028.2452731-1-yangyingliang@huawei.com\nSigned-off-by: Lu Baolu \u003cbaolu.lu@linux.intel.com\u003e\nSigned-off-by: Joerg Roedel \u003cjroedel@suse.de\u003e\n" }, { "commit": "e65a6897be5e4939d477c4969a05e12d90b08409", "tree": "fcf5b9b14878f28778b3ae8bd0830185704f42cc", "parents": [ "b7b275e60bcd5f89771e865a8239325f86d9927d" ], "author": { "name": "Jacob Pan", "email": "jacob.jun.pan@linux.intel.com", "time": "Thu Dec 01 12:01:24 2022 +0800" }, "committer": { "name": "Joerg Roedel", "email": "jroedel@suse.de", "time": "Fri Dec 02 11:45:31 2022 +0100" }, "message": "iommu/vt-d: Add a fix for devices need extra dtlb flush\n\nQAT devices on Intel Sapphire Rapids and Emerald Rapids have a defect in\naddress translation service (ATS). These devices may inadvertently issue\nATS invalidation completion before posted writes initiated with\ntranslated address that utilized translations matching the invalidation\naddress range, violating the invalidation completion ordering.\n\nThis patch adds an extra device TLB invalidation for the affected devices,\nit is needed to ensure no more posted writes with translated address\nfollowing the invalidation completion. Therefore, the ordering is\npreserved and data-corruption is prevented.\n\nDevice TLBs are invalidated under the following six conditions:\n1. Device driver does DMA API unmap IOVA\n2. Device driver unbind a PASID from a process, sva_unbind_device()\n3. PASID is torn down, after PASID cache is flushed. e.g. process\nexit_mmap() due to crash\n4. Under SVA usage, called by mmu_notifier.invalidate_range() where\nVM has to free pages that were unmapped\n5. userspace driver unmaps a DMA buffer\n6. Cache invalidation in vSVA usage (upcoming)\n\nFor #1 and #2, device drivers are responsible for stopping DMA traffic\nbefore unmap/unbind. For #3, iommu driver gets mmu_notifier to\ninvalidate TLB the same way as normal user unmap which will do an extra\ninvalidation. The dTLB invalidation after PASID cache flush does not\nneed an extra invalidation.\n\nTherefore, we only need to deal with #4 and #5 in this patch. #1 is also\ncovered by this patch due to common code path with #5.\n\nTested-by: Yuzhang Luo \u003cyuzhang.luo@intel.com\u003e\nReviewed-by: Ashok Raj \u003cashok.raj@intel.com\u003e\nReviewed-by: Kevin Tian \u003ckevin.tian@intel.com\u003e\nSigned-off-by: Jacob Pan \u003cjacob.jun.pan@linux.intel.com\u003e\nLink: https://lore.kernel.org/r/20221130062449.1360063-1-jacob.jun.pan@linux.intel.com\nSigned-off-by: Lu Baolu \u003cbaolu.lu@linux.intel.com\u003e\nSigned-off-by: Joerg Roedel \u003cjroedel@suse.de\u003e\n" }, { "commit": "c082fbd687ad70a92e0a8be486a7555a66f03079", "tree": "f14b9d2efd8f2068dd2f79a352016e415eaa1c6d", "parents": [ "65a388250e391b7127efd6751f64f3e4955e43a0", "9a8cc8cabc1e351614fd7f9e774757a5143b6fe8" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Dec 02 09:12:46 2022 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Dec 02 09:12:46 2022 +1000" }, "message": "Merge tag \u0027amd-drm-fixes-6.1-2022-12-01\u0027 of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes\n\namd-drm-fixes-6.1-2022-12-01:\n\namdgpu:\n- VCN fix for vangogh\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nFrom: Alex Deucher \u003calexander.deucher@amd.com\u003e\nLink: https://patchwork.freedesktop.org/patch/msgid/20221201202015.5931-1-alexander.deucher@amd.com\n" }, { "commit": "d36678f7905cbd1dc55a8a96e066dafd749d4600", "tree": "6280bbc393d22ebb6ebc2f7d1cb6026669750e89", "parents": [ "7d8ccf4f117d082156e842d959f634efcf203cef" ], "author": { "name": "Andrew Lunn", "email": "andrew@lunn.ch", "time": "Thu Nov 10 00:59:02 2022 +0100" }, "committer": { "name": "Wolfram Sang", "email": "wsa@kernel.org", "time": "Fri Dec 02 00:12:25 2022 +0100" }, "message": "i2c: imx: Only DMA messages with I2C_M_DMA_SAFE flag set\n\nRecent changes to the DMA code has resulting in the IMX driver failing\nI2C transfers when the buffer has been vmalloc. Only perform DMA\ntransfers if the message has the I2C_M_DMA_SAFE flag set, indicating\nthe client is providing a buffer which is DMA safe.\n\nThis is a minimal fix for stable. The I2C core provides helpers to\nallocate a bounce buffer. For a fuller fix the master should make use\nof these helpers.\n\nFixes: 4544b9f25e70 (\"dma-mapping: Add vmap checks to dma_map_single()\")\nSigned-off-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nAcked-by: Oleksij Rempel \u003co.rempel@pengutronix.de\u003e\nSigned-off-by: Wolfram Sang \u003cwsa@kernel.org\u003e\n" }, { "commit": "7d8ccf4f117d082156e842d959f634efcf203cef", "tree": "4256eb5701b3bf41e2f3da75ee3bd57e383c0f91", "parents": [ "8bfd4ec726945cec35ee5cafebc1c55b83d5a9fb" ], "author": { "name": "Wang Yufen", "email": "wangyufen@huawei.com", "time": "Mon Nov 21 18:17:52 2022 +0800" }, "committer": { "name": "Wolfram Sang", "email": "wsa@kernel.org", "time": "Thu Dec 01 23:55:22 2022 +0100" }, "message": "i2c: qcom-geni: fix error return code in geni_i2c_gpi_xfer\n\nFix to return a negative error code from the gi2c-\u003eerr instead of\n0.\n\nFixes: d8703554f4de (\"i2c: qcom-geni: Add support for GPI DMA\")\nSigned-off-by: Wang Yufen \u003cwangyufen@huawei.com\u003e\nReviewed-by: Tommaso Merciai \u003ctommaso.merciai@amarulasoluitons.com\u003e\nSigned-off-by: Wolfram Sang \u003cwsa@kernel.org\u003e\n" }, { "commit": "8bfd4ec726945cec35ee5cafebc1c55b83d5a9fb", "tree": "3c5f384a8830a4ab2ff4951130543e1dea366927", "parents": [ "79ece9b292af6b0edcfb4d67a00711d25507640b" ], "author": { "name": "Carsten Haitzler", "email": "carsten.haitzler@arm.com", "time": "Mon Nov 28 10:51:58 2022 +0000" }, "committer": { "name": "Wolfram Sang", "email": "wsa@kernel.org", "time": "Thu Dec 01 23:55:12 2022 +0100" }, "message": "i2c: cadence: Fix regression with bus recovery\n\nCommit \"i2c: cadence: Add standard bus recovery support\" breaks for i2c\ndevices that have no pinctrl defined. There is no requirement for this\nto exist in the DT. This has worked perfectly well without this before in\nat least 1 real usage case on hardware (Mali Komeda DPU, Cadence i2c to\ntalk to a tda99xx phy). Adding the requirement to have pinctrl set up in\nthe device tree (or otherwise be found) is a regression where the whole\ni2c device is lost entirely (in this case dropping entire devices which\nthen leads to the drm display stack unable to find the phy for display\noutput, thus having no drm display device and so on down the chain).\n\nThis converts the above commit to an enhancement if pinctrl can be found\nfor the i2c device, providing a timeout on read with recovery, but if not,\ndo what used to be done rather than a fatal loss of a device.\n\nThis restores the mentioned display devices to their working state again.\n\nFixes: 58b924241d0a (\"i2c: cadence: Add standard bus recovery support\")\nSigned-off-by: Carsten Haitzler \u003ccarsten.haitzler@arm.com\u003e\nReviewed-by: Shubhrajyoti Datta \u003cshubhrajyoti.datta@amd.com\u003e\nReviewed-by: Michael Grzeschik \u003cm.grzeschik@pengutronix.de\u003e\nAcked-by: Michal Simek \u003cmichal.simek@amd.com\u003e\n[wsa: added braces to else-branch]\nSigned-off-by: Wolfram Sang \u003cwsa@kernel.org\u003e\n" }, { "commit": "65a388250e391b7127efd6751f64f3e4955e43a0", "tree": "aa0a8bc318917875a05ce9bad72f58f15ab09b47", "parents": [ "b7b275e60bcd5f89771e865a8239325f86d9927d", "12b8b046e4c9de40fa59b6f067d6826f4e688f68" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Dec 02 07:34:27 2022 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Dec 02 07:34:28 2022 +1000" }, "message": "Merge tag \u0027drm-intel-fixes-2022-12-01\u0027 of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes\n\n- Fix dram info readout (Radhakrishna Sripada)\n- Remove non-existent pipes from bigjoiner pipe mask (Ville Syrjälä)\n- Fix negative value passed as remaining time (Janusz Krzysztofik)\n- Never return 0 if not all requests retired (Janusz Krzysztofik)\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nFrom: Tvrtko Ursulin \u003ctvrtko.ursulin@linux.intel.com\u003e\nLink: https://patchwork.freedesktop.org/patch/msgid/Y4hp+a3TJ13t2ZA1@tursulin-desk\n" }, { "commit": "a4412fdd49dc011bcc2c0d81ac4cab7457092650", "tree": "167aee62fd6789b8913d6336901204f1fdb2739c", "parents": [ "355479c70a489415ef6e2624e514f8f15a40861b" ], "author": { "name": "Steven Rostedt (Google)", "email": "rostedt@goodmis.org", "time": "Mon Nov 21 10:44:03 2022 -0500" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Dec 01 13:14:21 2022 -0800" }, "message": "error-injection: Add prompt for function error injection\n\nThe config to be able to inject error codes into any function annotated\nwith ALLOW_ERROR_INJECTION() is enabled when FUNCTION_ERROR_INJECTION is\nenabled. But unfortunately, this is always enabled on x86 when KPROBES\nis enabled, and there\u0027s no way to turn it off.\n\nAs kprobes is useful for observability of the kernel, it is useful to\nhave it enabled in production environments. But error injection should\nbe avoided. Add a prompt to the config to allow it to be disabled even\nwhen kprobes is enabled, and get rid of the \"def_bool y\".\n\nThis is a kernel debug feature (it\u0027s in Kconfig.debug), and should have\nnever been something enabled by default.\n\nCc: stable@vger.kernel.org\nFixes: 540adea3809f6 (\"error-injection: Separate error-injection from kprobe\")\nSigned-off-by: Steven Rostedt (Google) \u003crostedt@goodmis.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "9a8cc8cabc1e351614fd7f9e774757a5143b6fe8", "tree": "42536400855b31d382e167c99ce5bd25c6c26d92", "parents": [ "b7b275e60bcd5f89771e865a8239325f86d9927d" ], "author": { "name": "Leo Liu", "email": "leo.liu@amd.com", "time": "Tue Nov 29 18:53:18 2022 -0500" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Dec 01 15:09:49 2022 -0500" }, "message": "drm/amdgpu: enable Vangogh VCN indirect sram mode\n\nSo that uses PSP to initialize HW.\n\nFixes: 0c2c02b66c672e (\"drm/amdgpu/vcn: add firmware support for dimgrey_cavefish\")\nSigned-off-by: Leo Liu \u003cleo.liu@amd.com\u003e\nReviewed-by: James Zhu \u003cJames.Zhu@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nCc: stable@vger.kernel.org\n" }, { "commit": "39cefc5f6cd25d555e0455b24810e9aff365b8d6", "tree": "3f5ae903747a2bec6fab24ea9de151ddbdf766cf", "parents": [ "d556a9aeb62a6cd44aa05aeadcc48245da0a1939", "7e1864332fbc1b993659eab7974da9fe8bf8c128" ], "author": { "name": "Palmer Dabbelt", "email": "palmer@rivosinc.com", "time": "Thu Dec 01 11:38:39 2022 -0800" }, "committer": { "name": "Palmer Dabbelt", "email": "palmer@rivosinc.com", "time": "Thu Dec 01 11:38:39 2022 -0800" }, "message": "RISC-V: Fix a race condition during kernel stack overflow\n\nThis fixes a concrete bug but is also the basis for some cleanup work,\nso I\u0027m merging it based on the offending commit in order to minimize\nfuture conflicts.\n\n* commit \u00277e1864332fbc1b993659eab7974da9fe8bf8c128\u0027:\n riscv: fix race when vmap stack overflow\n" }, { "commit": "355479c70a489415ef6e2624e514f8f15a40861b", "tree": "e94869ceb0f314a61437ee9a7f62f2ccb56ed1a9", "parents": [ "e214dd935bf154af4c2d5013b16a283d592ccea5", "7572ac3c979d4d0fb42d73a72d2608656516ff4f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Dec 01 11:25:11 2022 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Dec 01 11:25:11 2022 -0800" }, "message": "Merge tag \u0027efi-fixes-for-v6.1-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi\n\nPull EFI fix from Ard Biesheuvel:\n \"A single revert for some code that I added during this cycle. The code\n is not wrong, but it should be a bit more careful about how to handle\n the shadow call stack pointer, so it is better to revert it for now\n and bring it back later in improved form.\n\n Summary:\n\n - Revert runtime service sync exception recovery on arm64\"\n\n* tag \u0027efi-fixes-for-v6.1-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi:\n arm64: efi: Revert \"Recover from synchronous exceptions ...\"\n" }, { "commit": "e214dd935bf154af4c2d5013b16a283d592ccea5", "tree": "775c3260b6524e0a110934506a3c6e3d3ca05ed2", "parents": [ "063c0e773ab33103407a76051821777014b756fe", "9bdc112be727cf1ba65be79541147f960c3349d8" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Dec 01 11:10:25 2022 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Dec 01 11:10:25 2022 -0800" }, "message": "Merge tag \u0027hwmon-for-v6.1-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging\n\nPull hwmon fixes from Guenter Roeck:\n\n - Fix refcount leak and NULL pointer access in coretemp driver\n\n - Fix UAF in ibmpex driver\n\n - Add missing pci_disable_device() to i5500_temp driver\n\n - Fix calculation in ina3221 driver\n\n - Fix temperature scaling in ltc2947 driver\n\n - Check result of devm_kcalloc call in asus-ec-sensors driver\n\n* tag \u0027hwmon-for-v6.1-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:\n hwmon: (asus-ec-sensors) Add checks for devm_kcalloc\n hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new()\n hwmon: (coretemp) Check for null before removing sysfs attrs\n hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails\n hwmon: (i5500_temp) fix missing pci_disable_device()\n hwmon: (ina3221) Fix shunt sum critical calculation\n hwmon: (ltc2947) fix temperature scaling\n" }, { "commit": "9bdc112be727cf1ba65be79541147f960c3349d8", "tree": "80f3242643a1c11dcd89dd5bce0a689850fb85e9", "parents": [ "7dec14537c5906b8bf40fd6fd6d9c3850f8df11d" ], "author": { "name": "Yuan Can", "email": "yuancan@huawei.com", "time": "Fri Nov 25 01:43:29 2022 +0000" }, "committer": { "name": "Guenter Roeck", "email": "linux@roeck-us.net", "time": "Thu Dec 01 09:20:55 2022 -0800" }, "message": "hwmon: (asus-ec-sensors) Add checks for devm_kcalloc\n\nAs the devm_kcalloc may return NULL, the return value needs to be checked\nto avoid NULL poineter dereference.\n\nFixes: d0ddfd241e57 (\"hwmon: (asus-ec-sensors) add driver for ASUS EC\")\nSigned-off-by: Yuan Can \u003cyuancan@huawei.com\u003e\nLink: https://lore.kernel.org/r/20221125014329.121560-1-yuancan@huawei.com\nSigned-off-by: Guenter Roeck \u003clinux@roeck-us.net\u003e\n" }, { "commit": "7dec14537c5906b8bf40fd6fd6d9c3850f8df11d", "tree": "5e7ea0218c3de1b7b2a98a4fa852f1028891313d", "parents": [ "a89ff5f5cc64b9fe7a992cf56988fd36f56ca82a" ], "author": { "name": "Yang Yingliang", "email": "yangyingliang@huawei.com", "time": "Fri Nov 18 17:33:03 2022 +0800" }, "committer": { "name": "Guenter Roeck", "email": "linux@roeck-us.net", "time": "Thu Dec 01 09:20:55 2022 -0800" }, "message": "hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new()\n\nAs comment of pci_get_domain_bus_and_slot() says, it returns\na pci device with refcount increment, when finish using it,\nthe caller must decrement the reference count by calling\npci_dev_put(). So call it after using to avoid refcount leak.\n\nFixes: 14513ee696a0 (\"hwmon: (coretemp) Use PCI host bridge ID to identify CPU if necessary\")\nSigned-off-by: Yang Yingliang \u003cyangyingliang@huawei.com\u003e\nLink: https://lore.kernel.org/r/20221118093303.214163-1-yangyingliang@huawei.com\nSigned-off-by: Guenter Roeck \u003clinux@roeck-us.net\u003e\n" }, { "commit": "a89ff5f5cc64b9fe7a992cf56988fd36f56ca82a", "tree": "d8e127ed83cd83cf0b5294f350050b615419aaf1", "parents": [ "e2a87785aab0dac190ac89be6a9ba955e2c634f2" ], "author": { "name": "Phil Auld", "email": "pauld@redhat.com", "time": "Thu Nov 17 11:23:13 2022 -0500" }, "committer": { "name": "Guenter Roeck", "email": "linux@roeck-us.net", "time": "Thu Dec 01 09:20:24 2022 -0800" }, "message": "hwmon: (coretemp) Check for null before removing sysfs attrs\n\nIf coretemp_add_core() gets an error then pdata-\u003ecore_data[indx]\nis already NULL and has been kfreed. Don\u0027t pass that to\nsysfs_remove_group() as that will crash in sysfs_remove_group().\n\n[Shortened for readability]\n[91854.020159] sysfs: cannot create duplicate filename \u0027/devices/platform/coretemp.0/hwmon/hwmon2/temp20_label\u0027\n\u003ccpu offline\u003e\n[91855.126115] BUG: kernel NULL pointer dereference, address: 0000000000000188\n[91855.165103] #PF: supervisor read access in kernel mode\n[91855.194506] #PF: error_code(0x0000) - not-present page\n[91855.224445] PGD 0 P4D 0\n[91855.238508] Oops: 0000 [#1] PREEMPT SMP PTI\n...\n[91855.342716] RIP: 0010:sysfs_remove_group+0xc/0x80\n...\n[91855.796571] Call Trace:\n[91855.810524] coretemp_cpu_offline+0x12b/0x1dd [coretemp]\n[91855.841738] ? coretemp_cpu_online+0x180/0x180 [coretemp]\n[91855.871107] cpuhp_invoke_callback+0x105/0x4b0\n[91855.893432] cpuhp_thread_fun+0x8e/0x150\n...\n\nFix this by checking for NULL first.\n\nSigned-off-by: Phil Auld \u003cpauld@redhat.com\u003e\nCc: linux-hwmon@vger.kernel.org\nCc: Fenghua Yu \u003cfenghua.yu@intel.com\u003e\nCc: Jean Delvare \u003cjdelvare@suse.com\u003e\nCc: Guenter Roeck \u003clinux@roeck-us.net\u003e\nLink: https://lore.kernel.org/r/20221117162313.3164803-1-pauld@redhat.com\nFixes: 199e0de7f5df3 (\"hwmon: (coretemp) Merge pkgtemp with coretemp\")\nSigned-off-by: Guenter Roeck \u003clinux@roeck-us.net\u003e\n" }, { "commit": "7572ac3c979d4d0fb42d73a72d2608656516ff4f", "tree": "1f5d452d5b93e3ac525dbaa04ed9106aa9ba4b18", "parents": [ "9b9eaee9828fe98b030cf43ac50065a54a2f5d52" ], "author": { "name": "Ard Biesheuvel", "email": "ardb@kernel.org", "time": "Wed Nov 30 17:37:17 2022 +0100" }, "committer": { "name": "Ard Biesheuvel", "email": "ardb@kernel.org", "time": "Thu Dec 01 14:48:26 2022 +0100" }, "message": "arm64: efi: Revert \"Recover from synchronous exceptions ...\"\n\nThis reverts commit 23715a26c8d81291, which introduced some code in\nassembler that manipulates both the ordinary and the shadow call stack\npointer in a way that could potentially be taken advantage of. So let\u0027s\nrevert it, and do a better job the next time around.\n\nSigned-off-by: Ard Biesheuvel \u003cardb@kernel.org\u003e\n" }, { "commit": "d9f15a9de44affe733e34f93bc184945ba277e6d", "tree": "f131c286029757fc8715c9b0e9a371660e72281d", "parents": [ "b7b275e60bcd5f89771e865a8239325f86d9927d" ], "author": { "name": "Conor Dooley", "email": "conor.dooley@microchip.com", "time": "Tue Nov 22 12:16:21 2022 +0000" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Thu Dec 01 12:05:29 2022 +0100" }, "message": "Revert \"clocksource/drivers/riscv: Events are stopped during CPU suspend\"\n\nThis reverts commit 232ccac1bd9b5bfe73895f527c08623e7fa0752d.\n\nOn the subject of suspend, the RISC-V SBI spec states:\n\n This does not cover whether any given events actually reach the hart or\n not, just what the hart will do if it receives an event. On PolarFire\n SoC, and potentially other SiFive based implementations, events from the\n RISC-V timer do reach a hart during suspend. This is not the case for the\n implementation on the Allwinner D1 - there timer events are not received\n during suspend.\n\nTo fix this, the CLOCK_EVT_FEAT_C3STOP (mis)feature was enabled for the\ntimer driver - but this has broken both RCU stall detection and timers\ngenerally on PolarFire SoC and potentially other SiFive based\nimplementations.\n\nIf an AXI read to the PCIe controller on PolarFire SoC times out, the\nsystem will stall, however, with CLOCK_EVT_FEAT_C3STOP active, the system\njust locks up without RCU stalling:\n\n\tio scheduler mq-deadline registered\n\tio scheduler kyber registered\n\tmicrochip-pcie 2000000000.pcie: host bridge /soc/pcie@2000000000 ranges:\n\tmicrochip-pcie 2000000000.pcie: MEM 0x2008000000..0x2087ffffff -\u003e 0x0008000000\n\tmicrochip-pcie 2000000000.pcie: sec error in pcie2axi buffer\n\tmicrochip-pcie 2000000000.pcie: ded error in pcie2axi buffer\n\tmicrochip-pcie 2000000000.pcie: axi read request error\n\tmicrochip-pcie 2000000000.pcie: axi read timeout\n\tmicrochip-pcie 2000000000.pcie: sec error in pcie2axi buffer\n\tmicrochip-pcie 2000000000.pcie: ded error in pcie2axi buffer\n\tmicrochip-pcie 2000000000.pcie: sec error in pcie2axi buffer\n\tmicrochip-pcie 2000000000.pcie: ded error in pcie2axi buffer\n\tmicrochip-pcie 2000000000.pcie: sec error in pcie2axi buffer\n\tmicrochip-pcie 2000000000.pcie: ded error in pcie2axi buffer\n\tFreeing initrd memory: 7332K\n\nSimilarly issues were reported with clock_nanosleep() - with a test app\nthat sleeps each cpu for 6, 5, 4, 3 ms respectively, HZ\u003d250 \u0026 the blamed\ncommit in place, the sleep times are rounded up to the next jiffy:\n\n\u003d\u003d CPU: 1 \u003d\u003d \u003d\u003d CPU: 2 \u003d\u003d \u003d\u003d CPU: 3 \u003d\u003d \u003d\u003d CPU: 4 \u003d\u003d\nMean: 7.974992 Mean: 7.976534 Mean: 7.962591 Mean: 3.952179\nStd Dev: 0.154374 Std Dev: 0.156082 Std Dev: 0.171018 Std Dev: 0.076193\nHi: 9.472000 Hi: 10.495000 Hi: 8.864000 Hi: 4.736000\nLo: 6.087000 Lo: 6.380000 Lo: 4.872000 Lo: 3.403000\nSamples: 521 Samples: 521 Samples: 521 Samples: 521\n\nFortunately, the D1 has a second timer, which is \"currently used in\npreference to the RISC-V/SBI timer driver\" so a revert here does not\nhurt operation of D1 in its current form.\n\nUltimately, a DeviceTree property (or node) will be added to encode the\nbehaviour of the timers, but until then revert the addition of\nCLOCK_EVT_FEAT_C3STOP.\n\nFixes: 232ccac1bd9b (\"clocksource/drivers/riscv: Events are stopped during CPU suspend\")\nSigned-off-by: Conor Dooley \u003cconor.dooley@microchip.com\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nReviewed-by: Palmer Dabbelt \u003cpalmer@rivosinc.com\u003e\nAcked-by: Palmer Dabbelt \u003cpalmer@rivosinc.com\u003e\nAcked-by: Samuel Holland \u003csamuel@sholland.org\u003e\nLink: https://lore.kernel.org/linux-riscv/YzYTNQRxLr7Q9JR0@spud/\nLink: https://github.com/riscv-non-isa/riscv-sbi-doc/issues/98/\nLink: https://lore.kernel.org/linux-riscv/bf6d3b1f-f703-4a25-833e-972a44a04114@sholland.org/\nLink: https://lore.kernel.org/r/20221122121620.3522431-1-conor.dooley@microchip.com\n\n" }, { "commit": "dd30dcfa7a74a06f8dcdab260d8d5adf32f17333", "tree": "adcc8d5b02d0e0247f181cfaecd2994969f96aa6", "parents": [ "c981cdfb9925f64a364f13c2b4f98f877308a408" ], "author": { "name": "Wenchao Chen", "email": "wenchao.chen@unisoc.com", "time": "Wed Nov 30 20:13:28 2022 +0800" }, "committer": { "name": "Ulf Hansson", "email": "ulf.hansson@linaro.org", "time": "Thu Dec 01 11:28:39 2022 +0100" }, "message": "mmc: sdhci-sprd: Fix no reset data and command after voltage switch\n\nAfter switching the voltage, no reset data and command will cause\nCMD2 timeout.\n\nFixes: 29ca763fc26f (\"mmc: sdhci-sprd: Add pin control support for voltage switch\")\nSigned-off-by: Wenchao Chen \u003cwenchao.chen@unisoc.com\u003e\nAcked-by: Adrian Hunter \u003cadrian.hunter@intel.com\u003e\nReviewed-by: Baolin Wang \u003cbaolin.wang@linux.alibaba.com\u003e\nCc: stable@vger.kernel.org\nLink: https://lore.kernel.org/r/20221130121328.25553-1-wenchao.chen@unisoc.com\nSigned-off-by: Ulf Hansson \u003culf.hansson@linaro.org\u003e\n" }, { "commit": "063c0e773ab33103407a76051821777014b756fe", "tree": "d40b3f4276f3a5dc361f190d2ff8faac8300b4a9", "parents": [ "ef4d3ea40565a781c25847e9cb96c1bd9f462bc6", "f6abcc21d94393801937aed808b8f055ffec8579" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Nov 30 15:46:46 2022 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Nov 30 15:46:46 2022 -0800" }, "message": "Merge tag \u0027clk-fixes-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux\n\nPull clk fixes from Stephen Boyd:\n \"A set of clk driver fixes that resolve issues for various SoCs.\n\n Most of these are incorrect clk data, like bad parent descriptions.\n When the clk tree is improperly described things don\u0027t work, like USB\n and UFS controllers, because clk frequencies are wonky. Here are the\n extra details:\n\n - Fix the parent of UFS reference clks on Qualcomm SC8280XP so that\n UFS works properly\n\n - Fix the clk ID for USB on AT91 RM9200 so the USB driver continues\n to probe\n\n - Stop using of_device_get_match_data() on the wrong device for a\n Samsung Exynos driver so it gets the proper clk data\n\n - Fix ExynosAutov9 binding\n\n - Fix the parent of the div4 clk on Exynos7885\n\n - Stop calling runtime PM APIs from the Qualcomm GDSC driver directly\n as it leads to a lockdep splat and is just plain wrong because it\n violates runtime PM semantics by calling runtime PM APIs when the\n device has been runtime PM disabled\"\n\n* tag \u0027clk-fixes-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux:\n clk: qcom: gcc-sc8280xp: add cxo as parent for three ufs ref clks\n ARM: at91: rm9200: fix usb device clock id\n clk: samsung: Revert \"clk: samsung: exynos-clkout: Use of_device_get_match_data()\"\n dt-bindings: clock: exynosautov9: fix reference to CMU_FSYS1\n clk: qcom: gdsc: Remove direct runtime PM calls\n clk: samsung: exynos7885: Correct \"div4\" clock parents\n" }, { "commit": "1d351f1894342c378b96bb9ed89f8debb1e24e9f", "tree": "ff34283fb44fb6b49c0bc7e549c6c309a65eb4a5", "parents": [ "152fe65f300e1819d59b80477d3e0999b4d5d7d2" ], "author": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Mon Nov 28 13:21:40 2022 -0800" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Wed Nov 30 14:49:42 2022 -0800" }, "message": "revert \"kbuild: fix -Wimplicit-function-declaration in license_is_gpl_compatible\"\n\nIt causes build failures with unusual CC/HOSTCC combinations.\n\nQuoting\nhttps://lkml.kernel.org/r/A222B1E6-69B8-4085-AD1B-27BDB72CA971@goldelico.com:\n\n HOSTCC scripts/mod/modpost.o - due to target missing\nIn file included from include/linux/string.h:5,\n from scripts/mod/../../include/linux/license.h:5,\n from scripts/mod/modpost.c:24:\ninclude/linux/compiler.h:246:10: fatal error: asm/rwonce.h: No such file or directory\n 246 | #include \u003casm/rwonce.h\u003e\n | ^~~~~~~~~~~~~~\ncompilation terminated.\n\n...\n\nThe problem is that HOSTCC is not necessarily the same compiler or even\narchitecture as CC and pulling in \u003clinux/compiler.h\u003e or \u003casm/rwonce.h\u003e\nfiles indirectly isn\u0027t a good idea then.\n\nMy toolchain is providing HOSTCC \u003d gcc (MacPorts) and CC \u003d arm-linux-gnueabihf\n(built from gcc source) and all running on Darwin.\n\nIf I change the include to \u003cstring.h\u003e I can then \"HOSTCC scripts/mod/modpost.c\"\nbut then it fails for \"CC kernel/module/main.c\" not finding \u003cstring.h\u003e:\n\n CC kernel/module/main.o - due to target missing\nIn file included from kernel/module/main.c:43:0:\n./include/linux/license.h:5:20: fatal error: string.h: No such file or directory\n #include \u003cstring.h\u003e\n ^\ncompilation terminated.\n\nReported-by: \"H. Nikolaus Schaller\" \u003chns@goldelico.com\u003e\nCc: Sam James \u003csam@gentoo.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "152fe65f300e1819d59b80477d3e0999b4d5d7d2", "tree": "d5c1f51c5239dc9aad9b5e2e7b36aa99ff0b5b4a", "parents": [ "6f6cb1714365a07dbc66851879538df9f6969288" ], "author": { "name": "Lee Jones", "email": "lee@kernel.org", "time": "Fri Nov 25 12:07:50 2022 +0000" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Wed Nov 30 14:49:42 2022 -0800" }, "message": "Kconfig.debug: provide a little extra FRAME_WARN leeway when KASAN is enabled\n\nWhen enabled, KASAN enlarges function\u0027s stack-frames. Pushing quite a few\nover the current threshold. This can mainly be seen on 32-bit\narchitectures where the present limit (when !GCC) is a lowly 1024-Bytes.\n\nLink: https://lkml.kernel.org/r/20221125120750.3537134-3-lee@kernel.org\nSigned-off-by: Lee Jones \u003clee@kernel.org\u003e\nAcked-by: Arnd Bergmann \u003carnd@arndb.de\u003e\nCc: Alex Deucher \u003calexander.deucher@amd.com\u003e\nCc: \"Christian König\" \u003cchristian.koenig@amd.com\u003e\nCc: Daniel Vetter \u003cdaniel@ffwll.ch\u003e\nCc: David Airlie \u003cairlied@gmail.com\u003e\nCc: Harry Wentland \u003charry.wentland@amd.com\u003e\nCc: Leo Li \u003csunpeng.li@amd.com\u003e\nCc: Maarten Lankhorst \u003cmaarten.lankhorst@linux.intel.com\u003e\nCc: Maxime Ripard \u003cmripard@kernel.org\u003e\nCc: Nathan Chancellor \u003cnathan@kernel.org\u003e\nCc: Nick Desaulniers \u003cndesaulniers@google.com\u003e\nCc: \"Pan, Xinhui\" \u003cXinhui.Pan@amd.com\u003e\nCc: Rodrigo Siqueira \u003cRodrigo.Siqueira@amd.com\u003e\nCc: Thomas Zimmermann \u003ctzimmermann@suse.de\u003e\nCc: Tom Rix \u003ctrix@redhat.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "6f6cb1714365a07dbc66851879538df9f6969288", "tree": "39c3ee7151eabb112291b9c84ff308d811b41d54", "parents": [ "f268f6cf875f3220afc77bdd0bf1bb136eb54db9" ], "author": { "name": "Lee Jones", "email": "lee@kernel.org", "time": "Fri Nov 25 12:07:49 2022 +0000" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Wed Nov 30 14:49:42 2022 -0800" }, "message": "drm/amdgpu: temporarily disable broken Clang builds due to blown stack-frame\n\nPatch series \"Fix a bunch of allmodconfig errors\", v2.\n\nSince b339ec9c229aa (\"kbuild: Only default to -Werror if COMPILE_TEST\")\nWERROR now defaults to COMPILE_TEST meaning that it\u0027s enabled for\nallmodconfig builds. This leads to some interesting build failures when\nusing Clang, each resolved in this set.\n\nWith this set applied, I am able to obtain a successful allmodconfig Arm\nbuild.\n\n\nThis patch (of 2):\n\ncalculate_bandwidth() is presently broken on all !(X86_64 || SPARC64 ||\nARM64) architectures built with Clang (all released versions), whereby the\nstack frame gets blown up to well over 5k. This would cause an immediate\nkernel panic on most architectures. We\u0027ll revert this when the following\nbug report has been resolved:\nhttps://github.com/llvm/llvm-project/issues/41896.\n\nLink: https://lkml.kernel.org/r/20221125120750.3537134-1-lee@kernel.org\nLink: https://lkml.kernel.org/r/20221125120750.3537134-2-lee@kernel.org\nSigned-off-by: Lee Jones \u003clee@kernel.org\u003e\nSuggested-by: Arnd Bergmann \u003carnd@arndb.de\u003e\nAcked-by: Arnd Bergmann \u003carnd@arndb.de\u003e\nCc: Alex Deucher \u003calexander.deucher@amd.com\u003e\nCc: \"Christian König\" \u003cchristian.koenig@amd.com\u003e\nCc: Daniel Vetter \u003cdaniel@ffwll.ch\u003e\nCc: David Airlie \u003cairlied@gmail.com\u003e\nCc: Harry Wentland \u003charry.wentland@amd.com\u003e\nCc: Lee Jones \u003clee@kernel.org\u003e\nCc: Leo Li \u003csunpeng.li@amd.com\u003e\nCc: Maarten Lankhorst \u003cmaarten.lankhorst@linux.intel.com\u003e\nCc: Maxime Ripard \u003cmripard@kernel.org\u003e\nCc: Nathan Chancellor \u003cnathan@kernel.org\u003e\nCc: Nick Desaulniers \u003cndesaulniers@google.com\u003e\nCc: \"Pan, Xinhui\" \u003cXinhui.Pan@amd.com\u003e\nCc: Rodrigo Siqueira \u003cRodrigo.Siqueira@amd.com\u003e\nCc: Thomas Zimmermann \u003ctzimmermann@suse.de\u003e\nCc: Tom Rix \u003ctrix@redhat.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "f268f6cf875f3220afc77bdd0bf1bb136eb54db9", "tree": "f834a079ef989491ff51dac481179e5e199b8495", "parents": [ "2ba99c5e08812494bc57f319fb562f527d9bacd8" ], "author": { "name": "Jann Horn", "email": "jannh@google.com", "time": "Fri Nov 25 22:37:14 2022 +0100" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Wed Nov 30 14:49:42 2022 -0800" }, "message": "mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths\n\nAny codepath that zaps page table entries must invoke MMU notifiers to\nensure that secondary MMUs (like KVM) don\u0027t keep accessing pages which\naren\u0027t mapped anymore. Secondary MMUs don\u0027t hold their own references to\npages that are mirrored over, so failing to notify them can lead to page\nuse-after-free.\n\nI\u0027m marking this as addressing an issue introduced in commit f3f0e1d2150b\n(\"khugepaged: add support of collapse for tmpfs/shmem pages\"), but most of\nthe security impact of this only came in commit 27e1f8273113 (\"khugepaged:\nenable collapse pmd for pte-mapped THP\"), which actually omitted flushes\nfor the removal of present PTEs, not just for the removal of empty page\ntables.\n\nLink: https://lkml.kernel.org/r/20221129154730.2274278-3-jannh@google.com\nLink: https://lkml.kernel.org/r/20221128180252.1684965-3-jannh@google.com\nLink: https://lkml.kernel.org/r/20221125213714.4115729-3-jannh@google.com\nFixes: f3f0e1d2150b (\"khugepaged: add support of collapse for tmpfs/shmem pages\")\nSigned-off-by: Jann Horn \u003cjannh@google.com\u003e\nAcked-by: David Hildenbrand \u003cdavid@redhat.com\u003e\nReviewed-by: Yang Shi \u003cshy828301@gmail.com\u003e\nCc: John Hubbard \u003cjhubbard@nvidia.com\u003e\nCc: Peter Xu \u003cpeterx@redhat.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "2ba99c5e08812494bc57f319fb562f527d9bacd8", "tree": "2a2cdaaa8a0bd83cc2e1a1feb93c6772a681a3cd", "parents": [ "8d3c106e19e8d251da31ff4cc7462e4565d65084" ], "author": { "name": "Jann Horn", "email": "jannh@google.com", "time": "Fri Nov 25 22:37:13 2022 +0100" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Wed Nov 30 14:49:42 2022 -0800" }, "message": "mm/khugepaged: fix GUP-fast interaction by sending IPI\n\nSince commit 70cbc3cc78a99 (\"mm: gup: fix the fast GUP race against THP\ncollapse\"), the lockless_pages_from_mm() fastpath rechecks the pmd_t to\nensure that the page table was not removed by khugepaged in between.\n\nHowever, lockless_pages_from_mm() still requires that the page table is\nnot concurrently freed. Fix it by sending IPIs (if the architecture uses\nsemi-RCU-style page table freeing) before freeing/reusing page tables.\n\nLink: https://lkml.kernel.org/r/20221129154730.2274278-2-jannh@google.com\nLink: https://lkml.kernel.org/r/20221128180252.1684965-2-jannh@google.com\nLink: https://lkml.kernel.org/r/20221125213714.4115729-2-jannh@google.com\nFixes: ba76149f47d8 (\"thp: khugepaged\")\nSigned-off-by: Jann Horn \u003cjannh@google.com\u003e\nReviewed-by: Yang Shi \u003cshy828301@gmail.com\u003e\nAcked-by: David Hildenbrand \u003cdavid@redhat.com\u003e\nCc: John Hubbard \u003cjhubbard@nvidia.com\u003e\nCc: Peter Xu \u003cpeterx@redhat.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "8d3c106e19e8d251da31ff4cc7462e4565d65084", "tree": "b58b92f7188c321289e55f808ab20ba524933e40", "parents": [ "829ae0f81ce093d674ff2256f66a714753e9ce32" ], "author": { "name": "Jann Horn", "email": "jannh@google.com", "time": "Fri Nov 25 22:37:12 2022 +0100" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Wed Nov 30 14:49:42 2022 -0800" }, "message": "mm/khugepaged: take the right locks for page table retraction\n\npagetable walks on address ranges mapped by VMAs can be done under the\nmmap lock, the lock of an anon_vma attached to the VMA, or the lock of the\nVMA\u0027s address_space. Only one of these needs to be held, and it does not\nneed to be held in exclusive mode.\n\nUnder those circumstances, the rules for concurrent access to page table\nentries are:\n\n - Terminal page table entries (entries that don\u0027t point to another page\n table) can be arbitrarily changed under the page table lock, with the\n exception that they always need to be consistent for\n hardware page table walks and lockless_pages_from_mm().\n This includes that they can be changed into non-terminal entries.\n - Non-terminal page table entries (which point to another page table)\n can not be modified; readers are allowed to READ_ONCE() an entry, verify\n that it is non-terminal, and then assume that its value will stay as-is.\n\nRetracting a page table involves modifying a non-terminal entry, so\npage-table-level locks are insufficient to protect against concurrent page\ntable traversal; it requires taking all the higher-level locks under which\nit is possible to start a page walk in the relevant range in exclusive\nmode.\n\nThe collapse_huge_page() path for anonymous THP already follows this rule,\nbut the shmem/file THP path was getting it wrong, making it possible for\nconcurrent rmap-based operations to cause corruption.\n\nLink: https://lkml.kernel.org/r/20221129154730.2274278-1-jannh@google.com\nLink: https://lkml.kernel.org/r/20221128180252.1684965-1-jannh@google.com\nLink: https://lkml.kernel.org/r/20221125213714.4115729-1-jannh@google.com\nFixes: 27e1f8273113 (\"khugepaged: enable collapse pmd for pte-mapped THP\")\nSigned-off-by: Jann Horn \u003cjannh@google.com\u003e\nReviewed-by: Yang Shi \u003cshy828301@gmail.com\u003e\nAcked-by: David Hildenbrand \u003cdavid@redhat.com\u003e\nCc: John Hubbard \u003cjhubbard@nvidia.com\u003e\nCc: Peter Xu \u003cpeterx@redhat.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "829ae0f81ce093d674ff2256f66a714753e9ce32", "tree": "ab3125d823307a8246a51cb411b4c12600f244f7", "parents": [ "4aaf269c768dbacd6268af73fda2ffccaa3f1d88" ], "author": { "name": "Gavin Shan", "email": "gshan@redhat.com", "time": "Thu Nov 24 17:55:23 2022 +0800" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Wed Nov 30 14:49:41 2022 -0800" }, "message": "mm: migrate: fix THP\u0027s mapcount on isolation\n\nThe issue is reported when removing memory through virtio_mem device. The\ntransparent huge page, experienced copy-on-write fault, is wrongly\nregarded as pinned. The transparent huge page is escaped from being\nisolated in isolate_migratepages_block(). The transparent huge page can\u0027t\nbe migrated and the corresponding memory block can\u0027t be put into offline\nstate.\n\nFix it by replacing page_mapcount() with total_mapcount(). With this, the\ntransparent huge page can be isolated and migrated, and the memory block\ncan be put into offline state. Besides, The page\u0027s refcount is increased\na bit earlier to avoid the page is released when the check is executed.\n\nLink: https://lkml.kernel.org/r/20221124095523.31061-1-gshan@redhat.com\nFixes: 1da2f328fa64 (\"mm,thp,compaction,cma: allow THP migration for CMA allocations\")\nSigned-off-by: Gavin Shan \u003cgshan@redhat.com\u003e\nReported-by: Zhenyu Zhang \u003czhenyzha@redhat.com\u003e\nTested-by: Zhenyu Zhang \u003czhenyzha@redhat.com\u003e\nSuggested-by: David Hildenbrand \u003cdavid@redhat.com\u003e\nAcked-by: David Hildenbrand \u003cdavid@redhat.com\u003e\nCc: Alistair Popple \u003capopple@nvidia.com\u003e\nCc: Hugh Dickins \u003chughd@google.com\u003e\nCc: Kirill A. Shutemov \u003ckirill.shutemov@linux.intel.com\u003e\nCc: Matthew Wilcox \u003cwilly@infradead.org\u003e\nCc: William Kucharski \u003cwilliam.kucharski@oracle.com\u003e\nCc: Zi Yan \u003cziy@nvidia.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\t[5.7+]\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "4aaf269c768dbacd6268af73fda2ffccaa3f1d88", "tree": "33b5f4fb5b5fc66701c0e74fc738d6f556cb2c9a", "parents": [ "6617da8fb565445e0be4a4885443006374943d09" ], "author": { "name": "Juergen Gross", "email": "jgross@suse.com", "time": "Wed Nov 23 07:45:10 2022 +0100" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Wed Nov 30 14:49:41 2022 -0800" }, "message": "mm: introduce arch_has_hw_nonleaf_pmd_young()\n\nWhen running as a Xen PV guests commit eed9a328aa1a (\"mm: x86: add\nCONFIG_ARCH_HAS_NONLEAF_PMD_YOUNG\") can cause a protection violation in\npmdp_test_and_clear_young():\n\n BUG: unable to handle page fault for address: ffff8880083374d0\n #PF: supervisor write access in kernel mode\n #PF: error_code(0x0003) - permissions violation\n PGD 3026067 P4D 3026067 PUD 3027067 PMD 7fee5067 PTE 8010000008337065\n Oops: 0003 [#1] PREEMPT SMP NOPTI\n CPU: 7 PID: 158 Comm: kswapd0 Not tainted 6.1.0-rc5-20221118-doflr+ #1\n RIP: e030:pmdp_test_and_clear_young+0x25/0x40\n\nThis happens because the Xen hypervisor can\u0027t emulate direct writes to\npage table entries other than PTEs.\n\nThis can easily be fixed by introducing arch_has_hw_nonleaf_pmd_young()\nsimilar to arch_has_hw_pte_young() and test that instead of\nCONFIG_ARCH_HAS_NONLEAF_PMD_YOUNG.\n\nLink: https://lkml.kernel.org/r/20221123064510.16225-1-jgross@suse.com\nFixes: eed9a328aa1a (\"mm: x86: add CONFIG_ARCH_HAS_NONLEAF_PMD_YOUNG\")\nSigned-off-by: Juergen Gross \u003cjgross@suse.com\u003e\nReported-by: Sander Eikelenboom \u003clinux@eikelenboom.it\u003e\nAcked-by: Yu Zhao \u003cyuzhao@google.com\u003e\nTested-by: Sander Eikelenboom \u003clinux@eikelenboom.it\u003e\nAcked-by: David Hildenbrand \u003cdavid@redhat.com\u003e\t[core changes]\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "6617da8fb565445e0be4a4885443006374943d09", "tree": "8ae5dabc8b1fd904e4aa442144ecb55bb0a4cfa0", "parents": [ "95bc35f9bee5220dad4e8567654ab3288a181639" ], "author": { "name": "Juergen Gross", "email": "jgross@suse.com", "time": "Wed Nov 30 14:49:41 2022 -0800" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Wed Nov 30 14:49:41 2022 -0800" }, "message": "mm: add dummy pmd_young() for architectures not having it\n\nIn order to avoid #ifdeffery add a dummy pmd_young() implementation as a\nfallback. This is required for the later patch \"mm: introduce\narch_has_hw_nonleaf_pmd_young()\".\n\nLink: https://lkml.kernel.org/r/fd3ac3cd-7349-6bbd-890a-71a9454ca0b3@suse.com\nSigned-off-by: Juergen Gross \u003cjgross@suse.com\u003e\nAcked-by: Yu Zhao \u003cyuzhao@google.com\u003e\nCc: Borislav Petkov \u003cbp@alien8.de\u003e\nCc: Dave Hansen \u003cdave.hansen@linux.intel.com\u003e\nCc: Geert Uytterhoeven \u003cgeert@linux-m68k.org\u003e\nCc: \"H. Peter Anvin\" \u003chpa@zytor.com\u003e\nCc: Ingo Molnar \u003cmingo@redhat.com\u003e\nCc: Sander Eikelenboom \u003clinux@eikelenboom.it\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "95bc35f9bee5220dad4e8567654ab3288a181639", "tree": "7fc2cb9389cc4ac5815d4d20ed1807640d84d002", "parents": [ "a435874bf626f55d7147026b059008c8de89fbb8" ], "author": { "name": "SeongJae Park", "email": "sj@kernel.org", "time": "Tue Nov 22 19:48:31 2022 +0000" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Wed Nov 30 14:49:41 2022 -0800" }, "message": "mm/damon/sysfs: fix wrong empty schemes assumption under online tuning in damon_sysfs_set_schemes()\n\nCommit da87878010e5 (\"mm/damon/sysfs: support online inputs update\") made\n\u0027damon_sysfs_set_schemes()\u0027 to be called for running DAMON context, which\ncould have schemes. In the case, DAMON sysfs interface is supposed to\nupdate, remove, or add schemes to reflect the sysfs files. However, the\ncode is assuming the DAMON context wouldn\u0027t have schemes at all, and\ntherefore creates and adds new schemes. As a result, the code doesn\u0027t\nwork as intended for online schemes tuning and could have more than\nexpected memory footprint. The schemes are all in the DAMON context, so\nit doesn\u0027t leak the memory, though.\n\nRemove the wrong asssumption (the DAMON context wouldn\u0027t have schemes) in\n\u0027damon_sysfs_set_schemes()\u0027 to fix the bug.\n\nLink: https://lkml.kernel.org/r/20221122194831.3472-1-sj@kernel.org\nFixes: da87878010e5 (\"mm/damon/sysfs: support online inputs update\")\nSigned-off-by: SeongJae Park \u003csj@kernel.org\u003e\nCc: \u003cstable@vger.kernel.org\u003e\t[5.19+]\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "a435874bf626f55d7147026b059008c8de89fbb8", "tree": "08c6a8d29e8d646059cd023930e145708f409bf2", "parents": [ "f0a0ccda18d6fd826d7c7e7ad48a6ed61c20f8b4" ], "author": { "name": "Tiezhu Yang", "email": "yangtiezhu@loongson.cn", "time": "Sat Nov 19 10:36:59 2022 +0800" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Wed Nov 30 14:49:41 2022 -0800" }, "message": "tools/vm/slabinfo-gnuplot: use \"grep -E\" instead of \"egrep\"\n\nThe latest version of grep claims the egrep is now obsolete so the build\nnow contains warnings that look like:\n\n\tegrep: warning: egrep is obsolescent; using grep -E\n\nfix this up by moving the related file to use \"grep -E\" instead.\n\n sed -i \"s/egrep/grep -E/g\" `grep egrep -rwl tools/vm`\n\nHere are the steps to install the latest grep:\n\n wget http://ftp.gnu.org/gnu/grep/grep-3.8.tar.gz\n tar xf grep-3.8.tar.gz\n cd grep-3.8 \u0026\u0026 ./configure \u0026\u0026 make\n sudo make install\n export PATH\u003d/usr/local/bin:$PATH\n\nLink: https://lkml.kernel.org/r/1668825419-30584-1-git-send-email-yangtiezhu@loongson.cn\nSigned-off-by: Tiezhu Yang \u003cyangtiezhu@loongson.cn\u003e\nReviewed-by: Sergey Senozhatsky \u003csenozhatsky@chromium.org\u003e\nCc: Vlastimil Babka \u003cvbabka@suse.cz\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "f0a0ccda18d6fd826d7c7e7ad48a6ed61c20f8b4", "tree": "1a09362248cad71e638a6038e372d4a66bb13ef6", "parents": [ "04ada095dcfc4ae359418053c0be94453bdf1e84" ], "author": { "name": "ZhangPeng", "email": "zhangpeng362@huawei.com", "time": "Sat Nov 19 21:05:42 2022 +0900" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Wed Nov 30 14:49:40 2022 -0800" }, "message": "nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry()\n\nSyzbot reported a null-ptr-deref bug:\n\n NILFS (loop0): segctord starting. Construction interval \u003d 5 seconds, CP\n frequency \u003c 30 seconds\n general protection fault, probably for non-canonical address\n 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN\n KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]\n CPU: 1 PID: 3603 Comm: segctord Not tainted\n 6.1.0-rc2-syzkaller-00105-gb229b6ca5abb #0\n Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google\n 10/11/2022\n RIP: 0010:nilfs_palloc_commit_free_entry+0xe5/0x6b0\n fs/nilfs2/alloc.c:608\n Code: 00 00 00 00 fc ff df 80 3c 02 00 0f 85 cd 05 00 00 48 b8 00 00 00\n 00 00 fc ff df 4c 8b 73 08 49 8d 7e 10 48 89 fa 48 c1 ea 03 \u003c80\u003e 3c 02\n 00 0f 85 26 05 00 00 49 8b 46 10 be a6 00 00 00 48 c7 c7\n RSP: 0018:ffffc90003dff830 EFLAGS: 00010212\n RAX: dffffc0000000000 RBX: ffff88802594e218 RCX: 000000000000000d\n RDX: 0000000000000002 RSI: 0000000000002000 RDI: 0000000000000010\n RBP: ffff888071880222 R08: 0000000000000005 R09: 000000000000003f\n R10: 000000000000000d R11: 0000000000000000 R12: ffff888071880158\n R13: ffff88802594e220 R14: 0000000000000000 R15: 0000000000000004\n FS: 0000000000000000(0000) GS:ffff8880b9b00000(0000)\n knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007fb1c08316a8 CR3: 0000000018560000 CR4: 0000000000350ee0\n Call Trace:\n \u003cTASK\u003e\n nilfs_dat_commit_free fs/nilfs2/dat.c:114 [inline]\n nilfs_dat_commit_end+0x464/0x5f0 fs/nilfs2/dat.c:193\n nilfs_dat_commit_update+0x26/0x40 fs/nilfs2/dat.c:236\n nilfs_btree_commit_update_v+0x87/0x4a0 fs/nilfs2/btree.c:1940\n nilfs_btree_commit_propagate_v fs/nilfs2/btree.c:2016 [inline]\n nilfs_btree_propagate_v fs/nilfs2/btree.c:2046 [inline]\n nilfs_btree_propagate+0xa00/0xd60 fs/nilfs2/btree.c:2088\n nilfs_bmap_propagate+0x73/0x170 fs/nilfs2/bmap.c:337\n nilfs_collect_file_data+0x45/0xd0 fs/nilfs2/segment.c:568\n nilfs_segctor_apply_buffers+0x14a/0x470 fs/nilfs2/segment.c:1018\n nilfs_segctor_scan_file+0x3f4/0x6f0 fs/nilfs2/segment.c:1067\n nilfs_segctor_collect_blocks fs/nilfs2/segment.c:1197 [inline]\n nilfs_segctor_collect fs/nilfs2/segment.c:1503 [inline]\n nilfs_segctor_do_construct+0x12fc/0x6af0 fs/nilfs2/segment.c:2045\n nilfs_segctor_construct+0x8e3/0xb30 fs/nilfs2/segment.c:2379\n nilfs_segctor_thread_construct fs/nilfs2/segment.c:2487 [inline]\n nilfs_segctor_thread+0x3c3/0xf30 fs/nilfs2/segment.c:2570\n kthread+0x2e4/0x3a0 kernel/kthread.c:376\n ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306\n \u003c/TASK\u003e\n ...\n\nIf DAT metadata file is corrupted on disk, there is a case where\nreq-\u003epr_desc_bh is NULL and blocknr is 0 at nilfs_dat_commit_end() during\na b-tree operation that cascadingly updates ancestor nodes of the b-tree,\nbecause nilfs_dat_commit_alloc() for a lower level block can initialize\nthe blocknr on the same DAT entry between nilfs_dat_prepare_end() and\nnilfs_dat_commit_end().\n\nIf this happens, nilfs_dat_commit_end() calls nilfs_dat_commit_free()\nwithout valid buffer heads in req-\u003epr_desc_bh and req-\u003epr_bitmap_bh, and\ncauses the NULL pointer dereference above in\nnilfs_palloc_commit_free_entry() function, which leads to a crash.\n\nFix this by adding a NULL check on req-\u003epr_desc_bh and req-\u003epr_bitmap_bh\nbefore nilfs_palloc_commit_free_entry() in nilfs_dat_commit_free().\n\nThis also calls nilfs_error() in that case to notify that there is a fatal\nflaw in the filesystem metadata and prevent further operations.\n\nLink: https://lkml.kernel.org/r/00000000000097c20205ebaea3d6@google.com\nLink: https://lkml.kernel.org/r/20221114040441.1649940-1-zhangpeng362@huawei.com\nLink: https://lkml.kernel.org/r/20221119120542.17204-1-konishi.ryusuke@gmail.com\nSigned-off-by: ZhangPeng \u003czhangpeng362@huawei.com\u003e\nSigned-off-by: Ryusuke Konishi \u003ckonishi.ryusuke@gmail.com\u003e\nReported-by: syzbot+ebe05ee8e98f755f61d0@syzkaller.appspotmail.com\nTested-by: Ryusuke Konishi \u003ckonishi.ryusuke@gmail.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "04ada095dcfc4ae359418053c0be94453bdf1e84", "tree": "493fbb1c7b453fc424e422d3c4211abe36aef92d", "parents": [ "21b85b09527c28e242db55c1b751f7f7549b830c" ], "author": { "name": "Mike Kravetz", "email": "mike.kravetz@oracle.com", "time": "Mon Nov 14 15:55:06 2022 -0800" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Wed Nov 30 14:49:40 2022 -0800" }, "message": "hugetlb: don\u0027t delete vma_lock in hugetlb MADV_DONTNEED processing\n\nmadvise(MADV_DONTNEED) ends up calling zap_page_range() to clear page\ntables associated with the address range. For hugetlb vmas,\nzap_page_range will call __unmap_hugepage_range_final. However,\n__unmap_hugepage_range_final assumes the passed vma is about to be removed\nand deletes the vma_lock to prevent pmd sharing as the vma is on the way\nout. In the case of madvise(MADV_DONTNEED) the vma remains, but the\nmissing vma_lock prevents pmd sharing and could potentially lead to issues\nwith truncation/fault races.\n\nThis issue was originally reported here [1] as a BUG triggered in\npage_try_dup_anon_rmap. Prior to the introduction of the hugetlb\nvma_lock, __unmap_hugepage_range_final cleared the VM_MAYSHARE flag to\nprevent pmd sharing. Subsequent faults on this vma were confused as\nVM_MAYSHARE indicates a sharable vma, but was not set so page_mapping was\nnot set in new pages added to the page table. This resulted in pages that\nappeared anonymous in a VM_SHARED vma and triggered the BUG.\n\nAddress issue by adding a new zap flag ZAP_FLAG_UNMAP to indicate an unmap\ncall from unmap_vmas(). This is used to indicate the \u0027final\u0027 unmapping of\na hugetlb vma. When called via MADV_DONTNEED, this flag is not set and\nthe vm_lock is not deleted.\n\n[1] https://lore.kernel.org/lkml/CAO4mrfdLMXsao9RF4fUE8-Wfde8xmjsKrTNMNC9wjUb6JudD0g@mail.gmail.com/\n\nLink: https://lkml.kernel.org/r/20221114235507.294320-3-mike.kravetz@oracle.com\nFixes: 90e7e7f5ef3f (\"mm: enable MADV_DONTNEED for hugetlb mappings\")\nSigned-off-by: Mike Kravetz \u003cmike.kravetz@oracle.com\u003e\nReported-by: Wei Chen \u003charperchen1110@gmail.com\u003e\nCc: Axel Rasmussen \u003caxelrasmussen@google.com\u003e\nCc: David Hildenbrand \u003cdavid@redhat.com\u003e\nCc: Matthew Wilcox \u003cwilly@infradead.org\u003e\nCc: Mina Almasry \u003calmasrymina@google.com\u003e\nCc: Nadav Amit \u003cnadav.amit@gmail.com\u003e\nCc: Naoya Horiguchi \u003cnaoya.horiguchi@linux.dev\u003e\nCc: Peter Xu \u003cpeterx@redhat.com\u003e\nCc: Rik van Riel \u003criel@surriel.com\u003e\nCc: Vlastimil Babka \u003cvbabka@suse.cz\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "21b85b09527c28e242db55c1b751f7f7549b830c", "tree": "8da18cd8ecabadc8b441d76da2eabbb0000a2018", "parents": [ "dec1d352de5c6e2bcdbb03a2e7a84d85ad2e4f14" ], "author": { "name": "Mike Kravetz", "email": "mike.kravetz@oracle.com", "time": "Mon Nov 14 15:55:05 2022 -0800" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Wed Nov 30 14:49:40 2022 -0800" }, "message": "madvise: use zap_page_range_single for madvise dontneed\n\nThis series addresses the issue first reported in [1], and fully described\nin patch 2. Patches 1 and 2 address the user visible issue and are tagged\nfor stable backports.\n\nWhile exploring solutions to this issue, related problems with mmu\nnotification calls were discovered. This is addressed in the patch\n\"hugetlb: remove duplicate mmu notifications:\". Since there are no user\nvisible effects, this third is not tagged for stable backports.\n\nPrevious discussions suggested further cleanup by removing the\nroutine zap_page_range. This is possible because zap_page_range_single\nis now exported, and all callers of zap_page_range pass ranges entirely\nwithin a single vma. This work will be done in a later patch so as not\nto distract from this bug fix.\n\n[1] https://lore.kernel.org/lkml/CAO4mrfdLMXsao9RF4fUE8-Wfde8xmjsKrTNMNC9wjUb6JudD0g@mail.gmail.com/\n\n\nThis patch (of 2):\n\nExpose the routine zap_page_range_single to zap a range within a single\nvma. The madvise routine madvise_dontneed_single_vma can use this routine\nas it explicitly operates on a single vma. Also, update the mmu\nnotification range in zap_page_range_single to take hugetlb pmd sharing\ninto account. This is required as MADV_DONTNEED supports hugetlb vmas.\n\nLink: https://lkml.kernel.org/r/20221114235507.294320-1-mike.kravetz@oracle.com\nLink: https://lkml.kernel.org/r/20221114235507.294320-2-mike.kravetz@oracle.com\nFixes: 90e7e7f5ef3f (\"mm: enable MADV_DONTNEED for hugetlb mappings\")\nSigned-off-by: Mike Kravetz \u003cmike.kravetz@oracle.com\u003e\nReported-by: Wei Chen \u003charperchen1110@gmail.com\u003e\nCc: Axel Rasmussen \u003caxelrasmussen@google.com\u003e\nCc: David Hildenbrand \u003cdavid@redhat.com\u003e\nCc: Matthew Wilcox \u003cwilly@infradead.org\u003e\nCc: Mina Almasry \u003calmasrymina@google.com\u003e\nCc: Nadav Amit \u003cnadav.amit@gmail.com\u003e\nCc: Naoya Horiguchi \u003cnaoya.horiguchi@linux.dev\u003e\nCc: Peter Xu \u003cpeterx@redhat.com\u003e\nCc: Rik van Riel \u003criel@surriel.com\u003e\nCc: Vlastimil Babka \u003cvbabka@suse.cz\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "dec1d352de5c6e2bcdbb03a2e7a84d85ad2e4f14", "tree": "b94fb6805131ae79cd0c147b9789da2d2aa6eb90", "parents": [ "de3db3f883a82c4800f4af0ae2cc3b96a408ee9b" ], "author": { "name": "Yang Shi", "email": "shy828301@gmail.com", "time": "Tue Nov 08 10:43:57 2022 -0800" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Wed Nov 30 14:49:40 2022 -0800" }, "message": "mm: replace VM_WARN_ON to pr_warn if the node is offline with __GFP_THISNODE\n\nSyzbot reported the below splat:\n\nWARNING: CPU: 1 PID: 3646 at include/linux/gfp.h:221 __alloc_pages_node\ninclude/linux/gfp.h:221 [inline]\nWARNING: CPU: 1 PID: 3646 at include/linux/gfp.h:221\nhpage_collapse_alloc_page mm/khugepaged.c:807 [inline]\nWARNING: CPU: 1 PID: 3646 at include/linux/gfp.h:221\nalloc_charge_hpage+0x802/0xaa0 mm/khugepaged.c:963\nModules linked in:\nCPU: 1 PID: 3646 Comm: syz-executor210 Not tainted\n6.1.0-rc1-syzkaller-00454-ga70385240892 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS\nGoogle 10/11/2022\nRIP: 0010:__alloc_pages_node include/linux/gfp.h:221 [inline]\nRIP: 0010:hpage_collapse_alloc_page mm/khugepaged.c:807 [inline]\nRIP: 0010:alloc_charge_hpage+0x802/0xaa0 mm/khugepaged.c:963\nCode: e5 01 4c 89 ee e8 6e f9 ae ff 4d 85 ed 0f 84 28 fc ff ff e8 70 fc\nae ff 48 8d 6b ff 4c 8d 63 07 e9 16 fc ff ff e8 5e fc ae ff \u003c0f\u003e 0b e9\n96 fa ff ff 41 bc 1a 00 00 00 e9 86 fd ff ff e8 47 fc ae\nRSP: 0018:ffffc90003fdf7d8 EFLAGS: 00010293\nRAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000\nRDX: ffff888077f457c0 RSI: ffffffff81cd8f42 RDI: 0000000000000001\nRBP: ffff888079388c0c R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000\nR13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000\nFS: 00007f6b48ccf700(0000) GS:ffff8880b9b00000(0000)\nknlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f6b48a819f0 CR3: 00000000171e7000 CR4: 00000000003506e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n collapse_file+0x1ca/0x5780 mm/khugepaged.c:1715\n hpage_collapse_scan_file+0xd6c/0x17a0 mm/khugepaged.c:2156\n madvise_collapse+0x53a/0xb40 mm/khugepaged.c:2611\n madvise_vma_behavior+0xd0a/0x1cc0 mm/madvise.c:1066\n madvise_walk_vmas+0x1c7/0x2b0 mm/madvise.c:1240\n do_madvise.part.0+0x24a/0x340 mm/madvise.c:1419\n do_madvise mm/madvise.c:1432 [inline]\n __do_sys_madvise mm/madvise.c:1432 [inline]\n __se_sys_madvise mm/madvise.c:1430 [inline]\n __x64_sys_madvise+0x113/0x150 mm/madvise.c:1430\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\nRIP: 0033:0x7f6b48a4eef9\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 b1 15 00 00 90 48 89 f8 48 89\nf7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01\nf0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f6b48ccf318 EFLAGS: 00000246 ORIG_RAX: 000000000000001c\nRAX: ffffffffffffffda RBX: 00007f6b48af0048 RCX: 00007f6b48a4eef9\nRDX: 0000000000000019 RSI: 0000000000600003 RDI: 0000000020000000\nRBP: 00007f6b48af0040 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 00007f6b48aa53a4\nR13: 00007f6b48bffcbf R14: 00007f6b48ccf400 R15: 0000000000022000\n \u003c/TASK\u003e\n\nIt is because khugepaged allocates pages with __GFP_THISNODE, but the\npreferred node is bogus. The previous patch fixed the khugepaged code to\navoid allocating page from non-existing node. But it is still racy\nagainst memory hotremove. There is no synchronization with the memory\nhotplug so it is possible that memory gets offline during a longer taking\nscanning.\n\nSo this warning still seems not quite helpful because:\n * There is no guarantee the node is online for __GFP_THISNODE context\n for all the callsites.\n * Kernel just fails the allocation regardless the warning, and it looks\n all callsites handle the allocation failure gracefully.\n\nAlthough while the warning has helped to identify a buggy code, it is not\nsafe in general and this warning could panic the system with panic-on-warn\nconfiguration which tends to be used surprisingly often. So replace\nVM_WARN_ON to pr_warn(). And the warning will be triggered if\n__GFP_NOWARN is set since the allocator would print out warning for such\ncase if __GFP_NOWARN is not set.\n\n[shy828301@gmail.com: rename nid to this_node and gfp to warn_gfp]\n Link: https://lkml.kernel.org/r/20221123193014.153983-1-shy828301@gmail.com\n[akpm@linux-foundation.org: fix whitespace]\n[akpm@linux-foundation.org: print gfp_mask instead of warn_gfp, per Michel]\nLink: https://lkml.kernel.org/r/20221108184357.55614-3-shy828301@gmail.com\nFixes: 7d8faaf15545 (\"mm/madvise: introduce MADV_COLLAPSE sync hugepage collapse\")\nSigned-off-by: Yang Shi \u003cshy828301@gmail.com\u003e\nReported-by: \u003csyzbot+0044b22d177870ee974f@syzkaller.appspotmail.com\u003e\nSuggested-by: Michal Hocko \u003cmhocko@suse.com\u003e\nAcked-by: Michal Hocko \u003cmhocko@suse.com\u003e\nCc: Zach O\u0027Keefe \u003czokeefe@google.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "ef4d3ea40565a781c25847e9cb96c1bd9f462bc6", "tree": "a1997480de0c6f5647cc2601f0756afd954b603e", "parents": [ "04aa64375f48a5d430b5550d9271f8428883e550" ], "author": { "name": "Marc Dionne", "email": "marc.dionne@auristor.com", "time": "Wed Nov 30 17:55:51 2022 +0000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Nov 30 10:02:37 2022 -0800" }, "message": "afs: Fix server-\u003eactive leak in afs_put_server\n\nThe atomic_read was accidentally replaced with atomic_inc_return,\nwhich prevents the server from getting cleaned up and causes rmmod\nto hang with a warning:\n\n Can\u0027t purge s\u003d00000001\n\nFixes: 2757a4dc1849 (\"afs: Fix access after dec in put functions\")\nSigned-off-by: Marc Dionne \u003cmarc.dionne@auristor.com\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nLink: https://lore.kernel.org/r/20221130174053.2665818-1-marc.dionne@auristor.com/\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "04aa64375f48a5d430b5550d9271f8428883e550", "tree": "edf677f29dd9a9eae66a7ac0ce57562354c780f7", "parents": [ "01f856ae6d0ca5ad0505b79bf2d22d7ca439b2a1" ], "author": { "name": "Andrzej Hajda", "email": "andrzej.hajda@intel.com", "time": "Mon Nov 14 11:38:24 2022 +0100" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Nov 30 08:44:00 2022 -0800" }, "message": "drm/i915: fix TLB invalidation for Gen12 video and compute engines\n\nIn case of Gen12 video and compute engines, TLB_INV registers are masked -\nto modify one bit, corresponding bit in upper half of the register must\nbe enabled, otherwise nothing happens.\n\nCVE: CVE-2022-4139\nSuggested-by: Chris Wilson \u003cchris.p.wilson@intel.com\u003e\nSigned-off-by: Andrzej Hajda \u003candrzej.hajda@intel.com\u003e\nAcked-by: Daniel Vetter \u003cdaniel.vetter@ffwll.ch\u003e\nFixes: 7938d61591d3 (\"drm/i915: Flush TLBs before releasing backing store\")\nCc: stable@vger.kernel.org\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "b47068b4aa53a57552398e3f60d0ed1918700c2b", "tree": "f5e4ec1b48d94cfd7440dc7784586a5e64cf0094", "parents": [ "9b84f0f74d0d716e3fd18dc428ac111266ef5844", "3d1bb6cc1a654c8693a85b1d262e610196edec8b" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Wed Nov 30 17:26:55 2022 +0100" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Wed Nov 30 17:26:55 2022 +0100" }, "message": "Merge tag \u0027asoc-fix-v6.1-rc7\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus\n\nASoC: Fixes for v6.1\n\nSome more fixes for v6.1, some of these are very old and were originally\nintended to get sent for v5.18 but got lost in the shuffle when there\nwas an issue with Linus not liking my branching strategy and I rebuilt\nbits of my workflow. The ops changes have been validated by people\nlooking at real hardware and are how things getting dropped got noticed.\n" }, { "commit": "e542baf30b48605d4336bf54b98e76b8fb98af30", "tree": "cff04a9ff3efc9015ca361dedccb0b0abd0f7dbd", "parents": [ "7e3bba93f42e9d9abe81344bdba5ddc635b7c449" ], "author": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Wed Nov 30 11:14:35 2022 -0500" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Wed Nov 30 11:18:20 2022 -0500" }, "message": "KVM: x86: fix uninitialized variable use on KVM_REQ_TRIPLE_FAULT\n\nIf a triple fault was fixed by kvm_x86_ops.nested_ops-\u003etriple_fault (by\nturning it into a vmexit), there is no need to leave vcpu_enter_guest().\nAny vcpu-\u003erequests will be caught later before the actual vmentry,\nand in fact vcpu_enter_guest() was not initializing the \"r\" variable.\nDepending on the compiler\u0027s whims, this could cause the\nx86_64/triple_fault_event_test test to fail.\n\nCc: Maxim Levitsky \u003cmlevitsk@redhat.com\u003e\nFixes: 92e7d5c83aff (\"KVM: x86: allow L1 to not intercept triple fault\")\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n" }, { "commit": "9b84f0f74d0d716e3fd18dc428ac111266ef5844", "tree": "d8423647951c3ef2509560c6ca818156aaa27b8b", "parents": [ "ecae4c8954a1faba6fcc4fe6ec1680b3c4e393d1" ], "author": { "name": "Takashi Sakamoto", "email": "o-takashi@sakamocchi.jp", "time": "Wed Nov 30 22:06:04 2022 +0900" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Wed Nov 30 16:15:02 2022 +0100" }, "message": "ALSA: dice: fix regression for Lexicon I-ONIX FW810S\n\nFor Lexicon I-ONIX FW810S, the call of ioctl(2) with\nSNDRV_PCM_IOCTL_HW_PARAMS can returns -ETIMEDOUT. This is a regression due\nto the commit 41319eb56e19 (\"ALSA: dice: wait just for\nNOTIFY_CLOCK_ACCEPTED after GLOBAL_CLOCK_SELECT operation\"). The device\ndoes not emit NOTIFY_CLOCK_ACCEPTED notification when accepting\nGLOBAL_CLOCK_SELECT operation with the same parameters as current ones.\n\nThis commit fixes the regression. When receiving no notification, return\n-ETIMEDOUT as long as operating for any change.\n\nFixes: 41319eb56e19 (\"ALSA: dice: wait just for NOTIFY_CLOCK_ACCEPTED after GLOBAL_CLOCK_SELECT operation\")\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Takashi Sakamoto \u003co-takashi@sakamocchi.jp\u003e\nLink: https://lore.kernel.org/r/20221130130604.29774-1-o-takashi@sakamocchi.jp\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" }, { "commit": "899d2a05dc14733cfba6224083c6b0dd5a738590", "tree": "3beda37d611a5015e83b5fb3eed15c361c3436c4", "parents": [ "a56ea6147facce4ac1fc38675455f9733d96232b" ], "author": { "name": "Caleb Sander", "email": "csander@purestorage.com", "time": "Fri Nov 18 16:27:56 2022 -0700" }, "committer": { "name": "Christoph Hellwig", "email": "hch@lst.de", "time": "Wed Nov 30 14:37:46 2022 +0100" }, "message": "nvme: fix SRCU protection of nvme_ns_head list\n\nWalking the nvme_ns_head siblings list is protected by the head\u0027s srcu\nin nvme_ns_head_submit_bio() but not nvme_mpath_revalidate_paths().\nRemoving namespaces from the list also fails to synchronize the srcu.\nConcurrent scan work can therefore cause use-after-frees.\n\nHold the head\u0027s srcu lock in nvme_mpath_revalidate_paths() and\nsynchronize with the srcu, not the global RCU, in nvme_ns_remove().\n\nObserved the following panic when making NVMe/RDMA connections\nwith native multipath on the Rocky Linux 8.6 kernel\n(it seems the upstream kernel has the same race condition).\nDisassembly shows the faulting instruction is cmp 0x50(%rdx),%rcx;\ncomputing capacity !\u003d get_capacity(ns-\u003edisk).\nAddress 0x50 is dereferenced because ns-\u003edisk is NULL.\nThe NULL disk appears to be the result of concurrent scan work\nfreeing the namespace (note the log line in the middle of the panic).\n\n[37314.206036] BUG: unable to handle kernel NULL pointer dereference at 0000000000000050\n[37314.206036] nvme0n3: detected capacity change from 0 to 11811160064\n[37314.299753] PGD 0 P4D 0\n[37314.299756] Oops: 0000 [#1] SMP PTI\n[37314.299759] CPU: 29 PID: 322046 Comm: kworker/u98:3 Kdump: loaded Tainted: G W X --------- - - 4.18.0-372.32.1.el8test86.x86_64 #1\n[37314.299762] Hardware name: Dell Inc. PowerEdge R720/0JP31P, BIOS 2.7.0 05/23/2018\n[37314.299763] Workqueue: nvme-wq nvme_scan_work [nvme_core]\n[37314.299783] RIP: 0010:nvme_mpath_revalidate_paths+0x26/0xb0 [nvme_core]\n[37314.299790] Code: 1f 44 00 00 66 66 66 66 90 55 53 48 8b 5f 50 48 8b 83 c8 c9 00 00 48 8b 13 48 8b 48 50 48 39 d3 74 20 48 8d 42 d0 48 8b 50 20 \u003c48\u003e 3b 4a 50 74 05 f0 80 60 70 ef 48 8b 50 30 48 8d 42 d0 48 39 d3\n[37315.058803] RSP: 0018:ffffabe28f913d10 EFLAGS: 00010202\n[37315.121316] RAX: ffff927a077da800 RBX: ffff92991dd70000 RCX: 0000000001600000\n[37315.206704] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff92991b719800\n[37315.292106] RBP: ffff929a6b70c000 R08: 000000010234cd4a R09: c0000000ffff7fff\n[37315.377501] R10: 0000000000000001 R11: ffffabe28f913a30 R12: 0000000000000000\n[37315.462889] R13: ffff92992716600c R14: ffff929964e6e030 R15: ffff92991dd70000\n[37315.548286] FS: 0000000000000000(0000) GS:ffff92b87fb80000(0000) knlGS:0000000000000000\n[37315.645111] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[37315.713871] CR2: 0000000000000050 CR3: 0000002208810006 CR4: 00000000000606e0\n[37315.799267] Call Trace:\n[37315.828515] nvme_update_ns_info+0x1ac/0x250 [nvme_core]\n[37315.892075] nvme_validate_or_alloc_ns+0x2ff/0xa00 [nvme_core]\n[37315.961871] ? __blk_mq_free_request+0x6b/0x90\n[37316.015021] nvme_scan_work+0x151/0x240 [nvme_core]\n[37316.073371] process_one_work+0x1a7/0x360\n[37316.121318] ? create_worker+0x1a0/0x1a0\n[37316.168227] worker_thread+0x30/0x390\n[37316.212024] ? create_worker+0x1a0/0x1a0\n[37316.258939] kthread+0x10a/0x120\n[37316.297557] ? set_kthread_struct+0x50/0x50\n[37316.347590] ret_from_fork+0x35/0x40\n[37316.390360] Modules linked in: nvme_rdma nvme_tcp(X) nvme_fabrics nvme_core netconsole iscsi_tcp libiscsi_tcp dm_queue_length dm_service_time nf_conntrack_netlink br_netfilter bridge stp llc overlay nft_chain_nat ipt_MASQUERADE nf_nat xt_addrtype xt_CT nft_counter xt_state xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 xt_comment xt_multiport nft_compat nf_tables libcrc32c nfnetlink dm_multipath tg3 rpcrdma sunrpc rdma_ucm ib_srpt ib_isert iscsi_target_mod target_core_mod ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm intel_rapl_msr iTCO_wdt iTCO_vendor_support dcdbas intel_rapl_common sb_edac x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel ipmi_ssif kvm irqbypass crct10dif_pclmul crc32_pclmul mlx5_ib ghash_clmulni_intel ib_uverbs rapl intel_cstate intel_uncore ib_core ipmi_si joydev mei_me pcspkr ipmi_devintf mei lpc_ich wmi ipmi_msghandler acpi_power_meter ext4 mbcache jbd2 sd_mod t10_pi sg mgag200 mlx5_core drm_kms_helper syscopyarea\n[37316.390419] sysfillrect ahci sysimgblt fb_sys_fops libahci drm crc32c_intel libata mlxfw pci_hyperv_intf tls i2c_algo_bit psample dm_mirror dm_region_hash dm_log dm_mod fuse [last unloaded: nvme_core]\n[37317.645908] CR2: 0000000000000050\n\nFixes: e7d65803e2bb (\"nvme-multipath: revalidate paths during rescan\")\nSigned-off-by: Caleb Sander \u003ccsander@purestorage.com\u003e\nSigned-off-by: Christoph Hellwig \u003chch@lst.de\u003e\n" }, { "commit": "a56ea6147facce4ac1fc38675455f9733d96232b", "tree": "385330cd65bbab17d9f89cbe0929ba97e6f1d60e", "parents": [ "7d4a93176e0142ce16d23c849a47d5b00b856296" ], "author": { "name": "Lei Rao", "email": "lei.rao@intel.com", "time": "Tue Nov 29 17:48:11 2022 +0800" }, "committer": { "name": "Christoph Hellwig", "email": "hch@lst.de", "time": "Wed Nov 30 14:34:17 2022 +0100" }, "message": "nvme-pci: clear the prp2 field when not used\n\nIf the prp2 field is not filled in nvme_setup_prp_simple(), the prp2\nfield is garbage data. According to nvme spec, the prp2 is reserved if\nthe data transfer does not cross a memory page boundary, so clear it to\nzero if it is not used.\n\nSigned-off-by: Lei Rao \u003clei.rao@intel.com\u003e\nSigned-off-by: Christoph Hellwig \u003chch@lst.de\u003e\n" }, { "commit": "d556a9aeb62a6cd44aa05aeadcc48245da0a1939", "tree": "5ee2a8a0d8d1ab6c5f09b2be4e18f114d29d27ac", "parents": [ "6fdd5d2f8c2f54b7fad4ff4df2a19542aeaf6102", "9b932aadfc47de5d70b53ea04b0d1b5f6c82945b" ], "author": { "name": "Palmer Dabbelt", "email": "palmer@rivosinc.com", "time": "Tue Nov 29 21:51:05 2022 -0800" }, "committer": { "name": "Palmer Dabbelt", "email": "palmer@rivosinc.com", "time": "Tue Nov 29 21:51:05 2022 -0800" }, "message": "Merge patch series \"riscv: kexec: Fxiup crash_save percpu and machine_kexec_mask_interrupts\"\n\nguoren@kernel.org \u003cguoren@kernel.org\u003e says:\n\nFrom: Guo Ren \u003cguoren@linux.alibaba.com\u003e\n\nCurrent riscv kexec can\u0027t crash_save percpu states and disable\ninterrupts properly. The patch series fix them, make kexec work correct.\n\n* b4-shazam-merge:\n riscv: kexec: Fixup crash_smp_send_stop without multi cores\n riscv: kexec: Fixup irq controller broken in kexec crash path\n\nLink: https://lore.kernel.org/r/20221020141603.2856206-1-guoren@kernel.org\nSigned-off-by: Palmer Dabbelt \u003cpalmer@rivosinc.com\u003e\n" }, { "commit": "9b932aadfc47de5d70b53ea04b0d1b5f6c82945b", "tree": "37e6bab1a7cfa542670e9f06d2aa0afa78a68579", "parents": [ "b17d19a5314a37f7197afd1a0200affd21a7227d" ], "author": { "name": "Guo Ren", "email": "guoren@linux.alibaba.com", "time": "Thu Oct 20 10:16:03 2022 -0400" }, "committer": { "name": "Palmer Dabbelt", "email": "palmer@rivosinc.com", "time": "Tue Nov 29 21:50:59 2022 -0800" }, "message": "riscv: kexec: Fixup crash_smp_send_stop without multi cores\n\nCurrent crash_smp_send_stop is the same as the generic one in\nkernel/panic and misses crash_save_cpu in percpu. This patch is inspired\nby 78fd584cdec0 (\"arm64: kdump: implement machine_crash_shutdown()\")\nand adds the same mechanism for riscv.\n\nBefore this patch, test result:\ncrash\u003e help -r\nCPU 0: [OFFLINE]\n\nCPU 1:\nepc : ffffffff80009ff0 ra : ffffffff800b789a sp : ff2000001098bb40\n gp : ffffffff815fca60 tp : ff60000004680000 t0 : 6666666666663c5b\n t1 : 0000000000000000 t2 : 666666666666663c s0 : ff2000001098bc90\n s1 : ffffffff81600798 a0 : ff2000001098bb48 a1 : 0000000000000000\n a2 : 0000000000000000 a3 : 0000000000000001 a4 : 0000000000000000\n a5 : ff60000004690800 a6 : 0000000000000000 a7 : 0000000000000000\n s2 : ff2000001098bb48 s3 : ffffffff81093ec8 s4 : ffffffff816004ac\n s5 : 0000000000000000 s6 : 0000000000000007 s7 : ffffffff80e7f720\n s8 : 00fffffffffff3f0 s9 : 0000000000000007 s10: 00aaaaaaaab98700\n s11: 0000000000000001 t3 : ffffffff819a8097 t4 : ffffffff819a8097\n t5 : ffffffff819a8098 t6 : ff2000001098b9a8\n\nCPU 2: [OFFLINE]\n\nCPU 3: [OFFLINE]\n\nAfter this patch, test result:\ncrash\u003e help -r\nCPU 0:\nepc : ffffffff80003f34 ra : ffffffff808caa7c sp : ffffffff81403eb0\n gp : ffffffff815fcb48 tp : ffffffff81413400 t0 : 0000000000000000\n t1 : 0000000000000000 t2 : 0000000000000000 s0 : ffffffff81403ec0\n s1 : 0000000000000000 a0 : 0000000000000000 a1 : 0000000000000000\n a2 : 0000000000000000 a3 : 0000000000000000 a4 : 0000000000000000\n a5 : 0000000000000000 a6 : 0000000000000000 a7 : 0000000000000000\n s2 : ffffffff816001c8 s3 : ffffffff81600370 s4 : ffffffff80c32e18\n s5 : ffffffff819d3018 s6 : ffffffff810e2110 s7 : 0000000000000000\n s8 : 0000000000000000 s9 : 0000000080039eac s10: 0000000000000000\n s11: 0000000000000000 t3 : 0000000000000000 t4 : 0000000000000000\n t5 : 0000000000000000 t6 : 0000000000000000\n\nCPU 1:\nepc : ffffffff80003f34 ra : ffffffff808caa7c sp : ff2000000068bf30\n gp : ffffffff815fcb48 tp : ff6000000240d400 t0 : 0000000000000000\n t1 : 0000000000000000 t2 : 0000000000000000 s0 : ff2000000068bf40\n s1 : 0000000000000001 a0 : 0000000000000000 a1 : 0000000000000000\n a2 : 0000000000000000 a3 : 0000000000000000 a4 : 0000000000000000\n a5 : 0000000000000000 a6 : 0000000000000000 a7 : 0000000000000000\n s2 : ffffffff816001c8 s3 : ffffffff81600370 s4 : ffffffff80c32e18\n s5 : ffffffff819d3018 s6 : ffffffff810e2110 s7 : 0000000000000000\n s8 : 0000000000000000 s9 : 0000000080039ea8 s10: 0000000000000000\n s11: 0000000000000000 t3 : 0000000000000000 t4 : 0000000000000000\n t5 : 0000000000000000 t6 : 0000000000000000\n\nCPU 2:\nepc : ffffffff80003f34 ra : ffffffff808caa7c sp : ff20000000693f30\n gp : ffffffff815fcb48 tp : ff6000000240e900 t0 : 0000000000000000\n t1 : 0000000000000000 t2 : 0000000000000000 s0 : ff20000000693f40\n s1 : 0000000000000002 a0 : 0000000000000000 a1 : 0000000000000000\n a2 : 0000000000000000 a3 : 0000000000000000 a4 : 0000000000000000\n a5 : 0000000000000000 a6 : 0000000000000000 a7 : 0000000000000000\n s2 : ffffffff816001c8 s3 : ffffffff81600370 s4 : ffffffff80c32e18\n s5 : ffffffff819d3018 s6 : ffffffff810e2110 s7 : 0000000000000000\n s8 : 0000000000000000 s9 : 0000000080039eb0 s10: 0000000000000000\n s11: 0000000000000000 t3 : 0000000000000000 t4 : 0000000000000000\n t5 : 0000000000000000 t6 : 0000000000000000\n\nCPU 3:\nepc : ffffffff8000a1e4 ra : ffffffff800b7bba sp : ff200000109bbb40\n gp : ffffffff815fcb48 tp : ff6000000373aa00 t0 : 6666666666663c5b\n t1 : 0000000000000000 t2 : 666666666666663c s0 : ff200000109bbc90\n s1 : ffffffff816007a0 a0 : ff200000109bbb48 a1 : 0000000000000000\n a2 : 0000000000000000 a3 : 0000000000000001 a4 : 0000000000000000\n a5 : ff60000002c61c00 a6 : 0000000000000000 a7 : 0000000000000000\n s2 : ff200000109bbb48 s3 : ffffffff810941a8 s4 : ffffffff816004b4\n s5 : 0000000000000000 s6 : 0000000000000007 s7 : ffffffff80e7f7a0\n s8 : 00fffffffffff3f0 s9 : 0000000000000007 s10: 00aaaaaaaab98700\n s11: 0000000000000001 t3 : ffffffff819a8097 t4 : ffffffff819a8097\n t5 : ffffffff819a8098 t6 : ff200000109bb9a8\n\nFixes: ad943893d5f1 (\"RISC-V: Fixup schedule out issue in machine_crash_shutdown()\")\nReviewed-by: Xianting Tian \u003cxianting.tian@linux.alibaba.com\u003e\nSigned-off-by: Guo Ren \u003cguoren@linux.alibaba.com\u003e\nSigned-off-by: Guo Ren \u003cguoren@kernel.org\u003e\nCc: Nick Kossifidis \u003cmick@ics.forth.gr\u003e\nLink: https://lore.kernel.org/r/20221020141603.2856206-3-guoren@kernel.org\nSigned-off-by: Palmer Dabbelt \u003cpalmer@rivosinc.com\u003e\n" }, { "commit": "b17d19a5314a37f7197afd1a0200affd21a7227d", "tree": "839898de2b24078bdc33d8b87228d4d148a3548c", "parents": [ "9abf2313adc1ca1b6180c508c25f22f9395cc780" ], "author": { "name": "Guo Ren", "email": "guoren@linux.alibaba.com", "time": "Thu Oct 20 10:16:02 2022 -0400" }, "committer": { "name": "Palmer Dabbelt", "email": "palmer@rivosinc.com", "time": "Tue Nov 29 21:50:58 2022 -0800" }, "message": "riscv: kexec: Fixup irq controller broken in kexec crash path\n\nIf a crash happens on cpu3 and all interrupts are binding on cpu0, the\nbad irq routing will cause a crash kernel which can\u0027t receive any irq.\nBecause crash kernel won\u0027t clean up all harts\u0027 PLIC enable bits in\nenable registers. This patch is similar to 9141a003a491 (\"ARM: 7316/1:\nkexec: EOI active and mask all interrupts in kexec crash path\") and\n78fd584cdec0 (\"arm64: kdump: implement machine_crash_shutdown()\"), and\nPowerPC also has the same mechanism.\n\nFixes: fba8a8674f68 (\"RISC-V: Add kexec support\")\nSigned-off-by: Guo Ren \u003cguoren@linux.alibaba.com\u003e\nSigned-off-by: Guo Ren \u003cguoren@kernel.org\u003e\nReviewed-by: Xianting Tian \u003cxianting.tian@linux.alibaba.com\u003e\nCc: Nick Kossifidis \u003cmick@ics.forth.gr\u003e\nCc: Palmer Dabbelt \u003cpalmer@rivosinc.com\u003e\nLink: https://lore.kernel.org/r/20221020141603.2856206-2-guoren@kernel.org\nSigned-off-by: Palmer Dabbelt \u003cpalmer@rivosinc.com\u003e\n" }, { "commit": "6fdd5d2f8c2f54b7fad4ff4df2a19542aeaf6102", "tree": "4528ce538bb426e6bfc1db9ca5cdcedaf31f9140", "parents": [ "74f6bb55c834da6d4bac24f44868202743189b2b" ], "author": { "name": "Björn Töpel", "email": "bjorn@rivosinc.com", "time": "Tue Nov 15 10:06:40 2022 +0100" }, "committer": { "name": "Palmer Dabbelt", "email": "palmer@rivosinc.com", "time": "Tue Nov 29 18:54:30 2022 -0800" }, "message": "riscv: mm: Proper page permissions after initmem free\n\n64-bit RISC-V kernels have the kernel image mapped separately to alias\nthe linear map. The linear map and the kernel image map are documented\nas \"direct mapping\" and \"kernel\" respectively in [1].\n\nAt image load time, the linear map corresponding to the kernel image\nis set to PAGE_READ permission, and the kernel image map is set to\nPAGE_READ|PAGE_EXEC.\n\nWhen the initmem is freed, the pages in the linear map should be\nrestored to PAGE_READ|PAGE_WRITE, whereas the corresponding pages in\nthe kernel image map should be restored to PAGE_READ, by removing the\nPAGE_EXEC permission.\n\nThis is not the case. For 64-bit kernels, only the linear map is\nrestored to its proper page permissions at initmem free, and not the\nkernel image map.\n\nIn practise this results in that the kernel can potentially jump to\ndead __init code, and start executing invalid instructions, without\ngetting an exception.\n\nRestore the freed initmem properly, by setting both the kernel image\nmap to the correct permissions.\n\n[1] Documentation/riscv/vm-layout.rst\n\nFixes: e5c35fa04019 (\"riscv: Map the kernel with correct permissions the first time\")\nSigned-off-by: Björn Töpel \u003cbjorn@rivosinc.com\u003e\nReviewed-by: Alexandre Ghiti \u003calex@ghiti.fr\u003e\nTested-by: Alexandre Ghiti \u003calex@ghiti.fr\u003e\nLink: https://lore.kernel.org/r/20221115090641.258476-1-bjorn@kernel.org\nCc: stable@vger.kernel.org\nSigned-off-by: Palmer Dabbelt \u003cpalmer@rivosinc.com\u003e\n" }, { "commit": "74f6bb55c834da6d4bac24f44868202743189b2b", "tree": "a9c39240144b3f0cfb9b4028403a5ebde076fe92", "parents": [ "3f105a742725a1b78766a55169f1d827732e62b8" ], "author": { "name": "Jisheng Zhang", "email": "jszhang@kernel.org", "time": "Thu Nov 03 01:02:54 2022 +0800" }, "committer": { "name": "Palmer Dabbelt", "email": "palmer@rivosinc.com", "time": "Tue Nov 29 18:45:53 2022 -0800" }, "message": "riscv: vdso: fix section overlapping under some conditions\n\nlkp reported a build error, I tried the config and can reproduce\nbuild error as below:\n\n VDSOLD arch/riscv/kernel/vdso/vdso.so.dbg\nld.lld: error: section .note file range overlaps with .text\n\u003e\u003e\u003e .note range is [0x7C8, 0x803]\n\u003e\u003e\u003e .text range is [0x800, 0x1993]\n\nld.lld: error: section .text file range overlaps with .dynamic\n\u003e\u003e\u003e .text range is [0x800, 0x1993]\n\u003e\u003e\u003e .dynamic range is [0x808, 0x937]\n\nld.lld: error: section .note virtual address range overlaps with .text\n\u003e\u003e\u003e .note range is [0x7C8, 0x803]\n\u003e\u003e\u003e .text range is [0x800, 0x1993]\n\nFix it by setting DISABLE_BRANCH_PROFILING which will disable branch\ntracing for vdso, thus avoid useless _ftrace_annotated_branch section\nand _ftrace_branch section. Although we can also fix it by removing\nthe hardcoded .text begin address, but I think that\u0027s another story\nand should be put into another patch.\n\nLink: https://lore.kernel.org/lkml/202210122123.Cc4FPShJ-lkp@intel.com/#r\nReported-by: kernel test robot \u003clkp@intel.com\u003e\nSigned-off-by: Jisheng Zhang \u003cjszhang@kernel.org\u003e\nLink: https://lore.kernel.org/r/20221102170254.1925-1-jszhang@kernel.org\nFixes: ad5d1122b82f (\"riscv: use vDSO common flow to reduce the latency of the time-related functions\")\nCc: stable@vger.kernel.org\nSigned-off-by: Palmer Dabbelt \u003cpalmer@rivosinc.com\u003e\n" }, { "commit": "7e1864332fbc1b993659eab7974da9fe8bf8c128", "tree": "3c6cd7287a3463cb214208ffceb5b4f0210360b0", "parents": [ "31da94c25aea835ceac00575a9fd206c5a833fed" ], "author": { "name": "Jisheng Zhang", "email": "jszhang@kernel.org", "time": "Sun Oct 30 20:45:17 2022 +0800" }, "committer": { "name": "Palmer Dabbelt", "email": "palmer@rivosinc.com", "time": "Tue Nov 29 18:16:55 2022 -0800" }, "message": "riscv: fix race when vmap stack overflow\n\nCurrently, when detecting vmap stack overflow, riscv firstly switches\nto the so called shadow stack, then use this shadow stack to call the\nget_overflow_stack() to get the overflow stack. However, there\u0027s\na race here if two or more harts use the same shadow stack at the same\ntime.\n\nTo solve this race, we introduce spin_shadow_stack atomic var, which\nwill be swap between its own address and 0 in atomic way, when the\nvar is set, it means the shadow_stack is being used; when the var\nis cleared, it means the shadow_stack isn\u0027t being used.\n\nFixes: 31da94c25aea (\"riscv: add VMAP_STACK overflow detection\")\nSigned-off-by: Jisheng Zhang \u003cjszhang@kernel.org\u003e\nSuggested-by: Guo Ren \u003cguoren@kernel.org\u003e\nReviewed-by: Guo Ren \u003cguoren@kernel.org\u003e\nLink: https://lore.kernel.org/r/20221030124517.2370-1-jszhang@kernel.org\n[Palmer: Add AQ to the swap, and also some comments.]\nSigned-off-by: Palmer Dabbelt \u003cpalmer@rivosinc.com\u003e\n" }, { "commit": "01f856ae6d0ca5ad0505b79bf2d22d7ca439b2a1", "tree": "99d081cd09d33624a44605a1388726955a0a1f0c", "parents": [ "ca57f02295f188d6c65ec02202402979880fa6d8", "d66233a312ec9013af3e37e4030b479a20811ec3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Nov 29 09:52:10 2022 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Nov 29 09:52:10 2022 -0800" }, "message": "Merge tag \u0027net-6.1-rc8-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Jakub Kicinski:\n \"Including fixes from bpf, can and wifi.\n\n Current release - new code bugs:\n\n - eth: mlx5e:\n - use kvfree() in mlx5e_accel_fs_tcp_create()\n - MACsec, fix RX data path 16 RX security channel limit\n - MACsec, fix memory leak when MACsec device is deleted\n - MACsec, fix update Rx secure channel active field\n - MACsec, fix add Rx security association (SA) rule memory leak\n\n Previous releases - regressions:\n\n - wifi: cfg80211: don\u0027t allow multi-BSSID in S1G\n\n - stmmac: set MAC\u0027s flow control register to reflect current settings\n\n - eth: mlx5:\n - E-switch, fix duplicate lag creation\n - fix use-after-free when reverting termination table\n\n Previous releases - always broken:\n\n - ipv4: fix route deletion when nexthop info is not specified\n\n - bpf: fix a local storage BPF map bug where the value\u0027s spin lock\n field can get initialized incorrectly\n\n - tipc: re-fetch skb cb after tipc_msg_validate\n\n - wifi: wilc1000: fix Information Element parsing\n\n - packet: do not set TP_STATUS_CSUM_VALID on CHECKSUM_COMPLETE\n\n - sctp: fix memory leak in sctp_stream_outq_migrate()\n\n - can: can327: fix potential skb leak when netdev is down\n\n - can: add number of missing netdev freeing on error paths\n\n - aquantia: do not purge addresses when setting the number of rings\n\n - wwan: iosm:\n - fix incorrect skb length leading to truncated packet\n - fix crash in peek throughput test due to skb UAF\"\n\n* tag \u0027net-6.1-rc8-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (79 commits)\n net: ethernet: renesas: ravb: Fix promiscuous mode after system resumed\n MAINTAINERS: Update maintainer list for chelsio drivers\n ionic: update MAINTAINERS entry\n sctp: fix memory leak in sctp_stream_outq_migrate()\n packet: do not set TP_STATUS_CSUM_VALID on CHECKSUM_COMPLETE\n net/mlx5: Lag, Fix for loop when checking lag\n Revert \"net/mlx5e: MACsec, remove replay window size limitation in offload path\"\n net: marvell: prestera: Fix a NULL vs IS_ERR() check in some functions\n net: tun: Fix use-after-free in tun_detach()\n net: mdiobus: fix unbalanced node reference count\n net: hsr: Fix potential use-after-free\n tipc: re-fetch skb cb after tipc_msg_validate\n mptcp: fix sleep in atomic at close time\n mptcp: don\u0027t orphan ssk in mptcp_close()\n dsa: lan9303: Correct stat name\n ipv4: Fix route deletion when nexthop info is not specified\n net: wwan: iosm: fix incorrect skb length\n net: wwan: iosm: fix crash in peek throughput test\n net: wwan: iosm: fix dma_alloc_coherent incompatible pointer type\n net: wwan: iosm: fix kernel test robot reported error\n ...\n" }, { "commit": "517e6a301f34613bff24a8e35b5455884f2d83d8", "tree": "b68b636c5defda5acaf08265087297172771655d", "parents": [ "030a976efae83f7b6593afb11a8254d42f9290fe" ], "author": { "name": "Peter Zijlstra", "email": "peterz@infradead.org", "time": "Thu Nov 24 12:49:12 2022 +0100" }, "committer": { "name": "Peter Zijlstra", "email": "peterz@infradead.org", "time": "Tue Nov 29 17:42:49 2022 +0100" }, "message": "perf: Fix perf_pending_task() UaF\n\nPer syzbot it is possible for perf_pending_task() to run after the\nevent is free()\u0027d. There are two related but distinct cases:\n\n - the task_work was already queued before destroying the event;\n - destroying the event itself queues the task_work.\n\nThe first cannot be solved using task_work_cancel() since\nperf_release() itself might be called from a task_work (____fput),\nwhich means the current-\u003etask_works list is already empty and\ntask_work_cancel() won\u0027t be able to find the perf_pending_task()\nentry.\n\nThe simplest alternative is extending the perf_event lifetime to cover\nthe task_work.\n\nThe second is just silly, queueing a task_work while you know the\nevent is going away makes no sense and is easily avoided by\nre-arranging how the event is marked STATE_DEAD and ensuring it goes\nthrough STATE_OFF on the way down.\n\nReported-by: syzbot+9228d6098455bb209ec8@syzkaller.appspotmail.com\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nTested-by: Marco Elver \u003celver@google.com\u003e\n" }, { "commit": "d66233a312ec9013af3e37e4030b479a20811ec3", "tree": "517d7c57fe54f891f168ea924509765731bf4669", "parents": [ "178833f99f587e9de9c888c38d82521dcfda12f0" ], "author": { "name": "Yoshihiro Shimoda", "email": "yoshihiro.shimoda.uh@renesas.com", "time": "Mon Nov 28 15:56:04 2022 +0900" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Nov 29 08:41:01 2022 -0800" }, "message": "net: ethernet: renesas: ravb: Fix promiscuous mode after system resumed\n\nAfter system resumed on some environment board, the promiscuous mode\nis disabled because the SoC turned off. So, call ravb_set_rx_mode() in\nthe ravb_resume() to fix the issue.\n\nReported-by: Tho Vu \u003ctho.vu.wh@renesas.com\u003e\nFixes: 0184165b2f42 (\"ravb: add sleep PM suspend/resume support\")\nSigned-off-by: Yoshihiro Shimoda \u003cyoshihiro.shimoda.uh@renesas.com\u003e\nReviewed-by: Pavan Chebbi \u003cpavan.chebbi@broadcom.com\u003e\nReviewed-by: Sergey Shtylyov \u003cs.shtylyov@omp.ru\u003e\nLink: https://lore.kernel.org/r/20221128065604.1864391-1-yoshihiro.shimoda.uh@renesas.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "178833f99f587e9de9c888c38d82521dcfda12f0", "tree": "06bee321763b24e2c5e544bad9e0394b5d0da6fd", "parents": [ "91a2bbfff3e3c64b3e1aa3ad04381d0572b3d543" ], "author": { "name": "Ayush Sawal", "email": "ayush.sawal@chelsio.com", "time": "Tue Nov 29 04:43:48 2022 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Nov 29 08:41:01 2022 -0800" }, "message": "MAINTAINERS: Update maintainer list for chelsio drivers\n\nThis updates the maintainers for chelsio inline crypto drivers and\nchelsio crypto drivers.\n\nSigned-off-by: Ayush Sawal \u003cayush.sawal@chelsio.com\u003e\nLink: https://lore.kernel.org/r/20221128231348.8225-1-ayush.sawal@chelsio.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "91a2bbfff3e3c64b3e1aa3ad04381d0572b3d543", "tree": "feb2b4a7544b536dd02d3ca9b0dbcdb9e44a269a", "parents": [ "9ed7bfc79542119ac0a9e1ce8a2a5285e43433e9" ], "author": { "name": "Shannon Nelson", "email": "shannon.nelson@amd.com", "time": "Mon Nov 28 17:17:34 2022 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Nov 29 08:31:39 2022 -0800" }, "message": "ionic: update MAINTAINERS entry\n\nNow that Pensando is a part of AMD we need to update\na couple of addresses. We\u0027re keeping the mailing list\naddress for the moment, but that will likely change in\nthe near future.\n\nSigned-off-by: Shannon Nelson \u003cshannon.nelson@amd.com\u003e\nSigned-off-by: Brett Creeley \u003cbrett.creeley@amd.com\u003e\nLink: https://lore.kernel.org/r/20221129011734.20849-1-shannon.nelson@amd.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9ed7bfc79542119ac0a9e1ce8a2a5285e43433e9", "tree": "3d01462e2ffd50cdf2b0edeb4c1b4d0c512a944e", "parents": [ "b85f628aa158a653c006e9c1405a117baef8c868" ], "author": { "name": "Zhengchao Shao", "email": "shaozhengchao@huawei.com", "time": "Sat Nov 26 11:17:20 2022 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Nov 29 08:30:50 2022 -0800" }, "message": "sctp: fix memory leak in sctp_stream_outq_migrate()\n\nWhen sctp_stream_outq_migrate() is called to release stream out resources,\nthe memory pointed to by prio_head in stream out is not released.\n\nThe memory leak information is as follows:\n unreferenced object 0xffff88801fe79f80 (size 64):\n comm \"sctp_repo\", pid 7957, jiffies 4294951704 (age 36.480s)\n hex dump (first 32 bytes):\n 80 9f e7 1f 80 88 ff ff 80 9f e7 1f 80 88 ff ff ................\n 90 9f e7 1f 80 88 ff ff 90 9f e7 1f 80 88 ff ff ................\n backtrace:\n [\u003cffffffff81b215c6\u003e] kmalloc_trace+0x26/0x60\n [\u003cffffffff88ae517c\u003e] sctp_sched_prio_set+0x4cc/0x770\n [\u003cffffffff88ad64f2\u003e] sctp_stream_init_ext+0xd2/0x1b0\n [\u003cffffffff88aa2604\u003e] sctp_sendmsg_to_asoc+0x1614/0x1a30\n [\u003cffffffff88ab7ff1\u003e] sctp_sendmsg+0xda1/0x1ef0\n [\u003cffffffff87f765ed\u003e] inet_sendmsg+0x9d/0xe0\n [\u003cffffffff8754b5b3\u003e] sock_sendmsg+0xd3/0x120\n [\u003cffffffff8755446a\u003e] __sys_sendto+0x23a/0x340\n [\u003cffffffff87554651\u003e] __x64_sys_sendto+0xe1/0x1b0\n [\u003cffffffff89978b49\u003e] do_syscall_64+0x39/0xb0\n [\u003cffffffff89a0008b\u003e] entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nLink: https://syzkaller.appspot.com/bug?exrid\u003d29c402e56c4760763cc0\nFixes: 637784ade221 (\"sctp: introduce priority based stream scheduler\")\nReported-by: syzbot+29c402e56c4760763cc0@syzkaller.appspotmail.com\nSigned-off-by: Zhengchao Shao \u003cshaozhengchao@huawei.com\u003e\nReviewed-by: Xin Long \u003clucien.xin@gmail.com\u003e\nLink: https://lore.kernel.org/r/20221126031720.378562-1-shaozhengchao@huawei.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b85f628aa158a653c006e9c1405a117baef8c868", "tree": "b6dd965eb193f783e7647875779dd4ea0ff4b7ca", "parents": [ "0e682f04b4b59eac0b0a030251513589c4607458" ], "author": { "name": "Willem de Bruijn", "email": "willemb@google.com", "time": "Mon Nov 28 11:18:12 2022 -0500" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Nov 29 08:30:18 2022 -0800" }, "message": "packet: do not set TP_STATUS_CSUM_VALID on CHECKSUM_COMPLETE\n\nCHECKSUM_COMPLETE signals that skb-\u003ecsum stores the sum over the\nentire packet. It does not imply that an embedded l4 checksum\nfield has been validated.\n\nFixes: 682f048bd494 (\"af_packet: pass checksum validation status to the user\")\nSigned-off-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://lore.kernel.org/r/20221128161812.640098-1-willemdebruijn.kernel@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "0e682f04b4b59eac0b0a030251513589c4607458", "tree": "8646bcc0aa9a171c09a75f996b82f6ec29e61122", "parents": [ "dda3bbbb26c823cd54d5bf211df7db12147c9392" ], "author": { "name": "Chris Mi", "email": "cmi@nvidia.com", "time": "Tue Nov 29 01:30:06 2022 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Nov 29 08:19:59 2022 -0800" }, "message": "net/mlx5: Lag, Fix for loop when checking lag\n\nThe cited commit adds a for loop to check if each port supports lag\nor not. But dev is not initialized correctly. Fix it by initializing\ndev for each iteration.\n\nFixes: e87c6a832f88 (\"net/mlx5: E-switch, Fix duplicate lag creation\")\nSigned-off-by: Chris Mi \u003ccmi@nvidia.com\u003e\nReported-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nSigned-off-by: Saeed Mahameed \u003csaeedm@nvidia.com\u003e\nLink: https://lore.kernel.org/r/20221129093006.378840-2-saeed@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "dda3bbbb26c823cd54d5bf211df7db12147c9392", "tree": "acdb675190c6b9bd0ffdb6911f5fb051c72b61fc", "parents": [ "e493bec343fa76e95631d0e21fd4a3538aa90c56" ], "author": { "name": "Saeed Mahameed", "email": "saeedm@nvidia.com", "time": "Tue Nov 29 01:30:05 2022 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Nov 29 08:19:59 2022 -0800" }, "message": "Revert \"net/mlx5e: MACsec, remove replay window size limitation in offload path\"\n\nThis reverts commit c0071be0e16c461680d87b763ba1ee5e46548fde.\n\nThe cited commit removed the validity checks which initialized the\nwindow_sz and never removed the use of the now uninitialized variable,\nso now we are left with wrong value in the window size and the following\nclang warning: [-Wuninitialized]\ndrivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c:232:45:\n warning: variable \u0027window_sz\u0027 is uninitialized when used here\n MLX5_SET(macsec_aso, aso_ctx, window_size, window_sz);\n\nRevet at this time to address the clang issue due to lack of time to\ntest the proper solution.\n\nFixes: c0071be0e16c (\"net/mlx5e: MACsec, remove replay window size limitation in offload path\")\nSigned-off-by: Saeed Mahameed \u003csaeedm@nvidia.com\u003e\nReported-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://lore.kernel.org/r/20221129093006.378840-1-saeed@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c981cdfb9925f64a364f13c2b4f98f877308a408", "tree": "6a40d833d1581fca8725b5e840ecd5f72b3dba7c", "parents": [ "c61bfb1cb63ddab52b31cf5f1924688917e61fad" ], "author": { "name": "Adrian Hunter", "email": "adrian.hunter@intel.com", "time": "Mon Nov 28 15:32:56 2022 +0200" }, "committer": { "name": "Ulf Hansson", "email": "ulf.hansson@linaro.org", "time": "Tue Nov 29 13:42:42 2022 +0100" }, "message": "mmc: sdhci: Fix voltage switch delay\n\nCommit 20b92a30b561 (\"mmc: sdhci: update signal voltage switch code\")\nremoved voltage switch delays from sdhci because mmc core had been\nenhanced to support them. However that assumed that sdhci_set_ios()\ndid a single clock change, which it did not, and so the delays in mmc\ncore, which should have come after the first clock change, were not\neffective.\n\nFix by avoiding re-configuring UHS and preset settings when the clock\nis turning on and the settings have not changed. That then also avoids\nthe associated clock changes, so that then sdhci_set_ios() does a single\nclock change when voltage switching, and the mmc core delays become\neffective.\n\nTo do that has meant keeping track of driver strength (host-\u003edrv_type),\nand cases of reinitialization (host-\u003ereinit_uhs).\n\nNote also, the \u0027turning_on_clk\u0027 restriction should not be necessary\nbut is done to minimize the impact of the change on stable kernels.\n\nFixes: 20b92a30b561 (\"mmc: sdhci: update signal voltage switch code\")\nCc: stable@vger.kernel.org\nSigned-off-by: Adrian Hunter \u003cadrian.hunter@intel.com\u003e\nLink: https://lore.kernel.org/r/20221128133259.38305-2-adrian.hunter@intel.com\nSigned-off-by: Ulf Hansson \u003culf.hansson@linaro.org\u003e\n" }, { "commit": "c61bfb1cb63ddab52b31cf5f1924688917e61fad", "tree": "c38a73af4af2d28fc6681ccfcc338199f49a3d48", "parents": [ "f4307b4df1c28842bb1950ff0e1b97e17031b17f" ], "author": { "name": "Gaosheng Cui", "email": "cuigaosheng1@huawei.com", "time": "Fri Nov 25 17:01:41 2022 +0800" }, "committer": { "name": "Ulf Hansson", "email": "ulf.hansson@linaro.org", "time": "Tue Nov 29 13:26:06 2022 +0100" }, "message": "mmc: mtk-sd: Fix missing clk_disable_unprepare in msdc_of_clock_parse()\n\nThe clk_disable_unprepare() should be called in the error handling\nof devm_clk_bulk_get_optional, fix it by replacing devm_clk_get_optional\nand clk_prepare_enable by devm_clk_get_optional_enabled.\n\nFixes: f5eccd94b63f (\"mmc: mediatek: Add subsys clock control for MT8192 msdc\")\nSigned-off-by: Gaosheng Cui \u003ccuigaosheng1@huawei.com\u003e\nCc: stable@vger.kernel.org\nLink: https://lore.kernel.org/r/20221125090141.3626747-1-cuigaosheng1@huawei.com\nSigned-off-by: Ulf Hansson \u003culf.hansson@linaro.org\u003e\n" }, { "commit": "e493bec343fa76e95631d0e21fd4a3538aa90c56", "tree": "6fab44c2a6d1dd7454bd34f3c839d5d429199475", "parents": [ "5daadc86f27ea4d691e2131c04310d0418c6cd12" ], "author": { "name": "Shang XiaoJing", "email": "shangxiaojing@huawei.com", "time": "Fri Nov 25 09:27:51 2022 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Nov 29 12:29:46 2022 +0100" }, "message": "net: marvell: prestera: Fix a NULL vs IS_ERR() check in some functions\n\nrhashtable_lookup_fast() returns NULL when failed instead of error\npointer.\n\nFixes: 396b80cb5cc8 (\"net: marvell: prestera: Add neighbour cache accounting\")\nFixes: 0a23ae237171 (\"net: marvell: prestera: Add router nexthops ABI\")\nSigned-off-by: Shang XiaoJing \u003cshangxiaojing@huawei.com\u003e\nLink: https://lore.kernel.org/r/20221125012751.23249-1-shangxiaojing@huawei.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "5daadc86f27ea4d691e2131c04310d0418c6cd12", "tree": "ab726a5f51c1b830fcf96f6e4fe1a4ca5f2497b7", "parents": [ "cdde1560118f82498fc9e9a7c1ef7f0ef7755891" ], "author": { "name": "Shigeru Yoshida", "email": "syoshida@redhat.com", "time": "Fri Nov 25 02:51:34 2022 +0900" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Nov 29 12:14:15 2022 +0100" }, "message": "net: tun: Fix use-after-free in tun_detach()\n\nsyzbot reported use-after-free in tun_detach() [1]. This causes call\ntrace like below:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nBUG: KASAN: use-after-free in notifier_call_chain+0x1ee/0x200 kernel/notifier.c:75\nRead of size 8 at addr ffff88807324e2a8 by task syz-executor.0/3673\n\nCPU: 0 PID: 3673 Comm: syz-executor.0 Not tainted 6.1.0-rc5-syzkaller-00044-gcc675d22e422 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106\n print_address_description mm/kasan/report.c:284 [inline]\n print_report+0x15e/0x461 mm/kasan/report.c:395\n kasan_report+0xbf/0x1f0 mm/kasan/report.c:495\n notifier_call_chain+0x1ee/0x200 kernel/notifier.c:75\n call_netdevice_notifiers_info+0x86/0x130 net/core/dev.c:1942\n call_netdevice_notifiers_extack net/core/dev.c:1983 [inline]\n call_netdevice_notifiers net/core/dev.c:1997 [inline]\n netdev_wait_allrefs_any net/core/dev.c:10237 [inline]\n netdev_run_todo+0xbc6/0x1100 net/core/dev.c:10351\n tun_detach drivers/net/tun.c:704 [inline]\n tun_chr_close+0xe4/0x190 drivers/net/tun.c:3467\n __fput+0x27c/0xa90 fs/file_table.c:320\n task_work_run+0x16f/0x270 kernel/task_work.c:179\n exit_task_work include/linux/task_work.h:38 [inline]\n do_exit+0xb3d/0x2a30 kernel/exit.c:820\n do_group_exit+0xd4/0x2a0 kernel/exit.c:950\n get_signal+0x21b1/0x2440 kernel/signal.c:2858\n arch_do_signal_or_restart+0x86/0x2300 arch/x86/kernel/signal.c:869\n exit_to_user_mode_loop kernel/entry/common.c:168 [inline]\n exit_to_user_mode_prepare+0x15f/0x250 kernel/entry/common.c:203\n __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline]\n syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:296\n do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nThe cause of the issue is that sock_put() from __tun_detach() drops\nlast reference count for struct net, and then notifier_call_chain()\nfrom netdev_state_change() accesses that struct net.\n\nThis patch fixes the issue by calling sock_put() from tun_detach()\nafter all necessary accesses for the struct net has done.\n\nFixes: 83c1f36f9880 (\"tun: send netlink notification when the device is modified\")\nReported-by: syzbot+106f9b687cd64ee70cd1@syzkaller.appspotmail.com\nLink: https://syzkaller.appspot.com/bug?id\u003d96eb7f1ce75ef933697f24eeab928c4a716edefe [1]\nSigned-off-by: Shigeru Yoshida \u003csyoshida@redhat.com\u003e\nLink: https://lore.kernel.org/r/20221124175134.1589053-1-syoshida@redhat.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "7e3bba93f42e9d9abe81344bdba5ddc635b7c449", "tree": "8d1d9ac6cbeb1d5c536b6ff4dc606c5532946949", "parents": [ "b7b275e60bcd5f89771e865a8239325f86d9927d", "0dd4cdccdab3d74bd86b868768a7dca216bcce7e" ], "author": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Tue Nov 29 04:15:33 2022 -0500" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Tue Nov 29 04:15:33 2022 -0500" }, "message": "Merge tag \u0027kvm-s390-master-6.1-2\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD\n\nVSIE epdx shadowing fix\n" }, { "commit": "12b8b046e4c9de40fa59b6f067d6826f4e688f68", "tree": "aa0a8bc318917875a05ce9bad72f58f15ab09b47", "parents": [ "a8899b8728013c7b2456f0bfa20e5fea85ee0fd1" ], "author": { "name": "Janusz Krzysztofik", "email": "janusz.krzysztofik@linux.intel.com", "time": "Mon Nov 21 15:56:55 2022 +0100" }, "committer": { "name": "Tvrtko Ursulin", "email": "tvrtko.ursulin@intel.com", "time": "Tue Nov 29 08:49:15 2022 +0000" }, "message": "drm/i915: Never return 0 if not all requests retired\n\nUsers of intel_gt_retire_requests_timeout() expect 0 return value on\nsuccess. However, we have no protection from passing back 0 potentially\nreturned by a call to dma_fence_wait_timeout() when it succedes right\nafter its timeout has expired.\n\nReplace 0 with -ETIME before potentially using the timeout value as return\ncode, so -ETIME is returned if there are still some requests not retired\nafter timeout, 0 otherwise.\n\nv3: Use conditional expression, more compact but also better reflecting\n intention standing behind the change.\n\nv2: Move the added lines down so flush_submission() is not affected.\n\nFixes: f33a8a51602c (\"drm/i915: Merge wait_for_timelines with retire_request\")\nSigned-off-by: Janusz Krzysztofik \u003cjanusz.krzysztofik@linux.intel.com\u003e\nReviewed-by: Andrzej Hajda \u003candrzej.hajda@intel.com\u003e\nCc: stable@vger.kernel.org # v5.5+\nSigned-off-by: Tvrtko Ursulin \u003ctvrtko.ursulin@intel.com\u003e\nLink: https://patchwork.freedesktop.org/patch/msgid/20221121145655.75141-3-janusz.krzysztofik@linux.intel.com\n(cherry picked from commit f301a29f143760ce8d3d6b6a8436d45d3448cde6)\nSigned-off-by: Tvrtko Ursulin \u003ctvrtko.ursulin@intel.com\u003e\n" }, { "commit": "a8899b8728013c7b2456f0bfa20e5fea85ee0fd1", "tree": "9e2041c5433bb8030c1bb3ef27d0ff9502081a20", "parents": [ "3c1ea6a5f4f55d4e376675dda16945eb5d9bb4de" ], "author": { "name": "Janusz Krzysztofik", "email": "janusz.krzysztofik@linux.intel.com", "time": "Mon Nov 21 15:56:54 2022 +0100" }, "committer": { "name": "Tvrtko Ursulin", "email": "tvrtko.ursulin@intel.com", "time": "Tue Nov 29 08:49:15 2022 +0000" }, "message": "drm/i915: Fix negative value passed as remaining time\n\nCommit b97060a99b01 (\"drm/i915/guc: Update intel_gt_wait_for_idle to work\nwith GuC\") extended the API of intel_gt_retire_requests_timeout() with an\nextra argument \u0027remaining_timeout\u0027, intended for passing back unconsumed\nportion of requested timeout when 0 (success) is returned. However, when\nrequest retirement happens to succeed despite an error returned by a call\nto dma_fence_wait_timeout(), that error code (a negative value) is passed\nback instead of remaining time. If we then pass that negative value\nforward as requested timeout to intel_uc_wait_for_idle(), an explicit BUG\nwill be triggered.\n\nIf request retirement succeeds but an error code is passed back via\nremaininig_timeout, we may have no clue on how much of the initial timeout\nmight have been left for spending it on waiting for GuC to become idle.\nOTOH, since all pending requests have been successfully retired, that\nerror code has been already ignored by intel_gt_retire_requests_timeout(),\nthen we shouldn\u0027t fail.\n\nAssume no more time has been left on error and pass 0 timeout value to\nintel_uc_wait_for_idle() to give it a chance to return success if GuC is\nalready idle.\n\nv3: Don\u0027t fail on any error passed back via remaining_timeout.\n\nv2: Fix the issue on the caller side, not the provider.\n\nFixes: b97060a99b01 (\"drm/i915/guc: Update intel_gt_wait_for_idle to work with GuC\")\nSigned-off-by: Janusz Krzysztofik \u003cjanusz.krzysztofik@linux.intel.com\u003e\nCc: stable@vger.kernel.org # v5.15+\nReviewed-by: Andrzej Hajda \u003candrzej.hajda@intel.com\u003e\nSigned-off-by: Tvrtko Ursulin \u003ctvrtko.ursulin@intel.com\u003e\nLink: https://patchwork.freedesktop.org/patch/msgid/20221121145655.75141-2-janusz.krzysztofik@linux.intel.com\n(cherry picked from commit f235dbd5b768e238d365fd05d92de5a32abc1c1f)\nSigned-off-by: Tvrtko Ursulin \u003ctvrtko.ursulin@intel.com\u003e\n" }, { "commit": "3c1ea6a5f4f55d4e376675dda16945eb5d9bb4de", "tree": "b04508a1e001c15ca14c4d79f010c267ca8a02c3", "parents": [ "2f3830544a89af2e72e7fd3d6ca44dd9cffec197" ], "author": { "name": "Ville Syrjälä", "email": "ville.syrjala@linux.intel.com", "time": "Fri Nov 18 20:52:01 2022 +0200" }, "committer": { "name": "Tvrtko Ursulin", "email": "tvrtko.ursulin@intel.com", "time": "Tue Nov 29 08:49:15 2022 +0000" }, "message": "drm/i915: Remove non-existent pipes from bigjoiner pipe mask\n\nbigjoiner_pipes() doesn\u0027t consider that:\n- RKL only has three pipes\n- some pipes may be fused off\n\nThis means that intel_atomic_check_bigjoiner() won\u0027t reject\nall configurations that would need a non-existent pipe.\nInstead we just keep on rolling witout actually having\nreserved the slave pipe we need.\n\nIt\u0027s possible that we don\u0027t outright explode anywhere due to\nthis since eg. for_each_intel_crtc_in_pipe_mask() will only\nwalk the crtcs we\u0027ve registered even though the passed in\npipe_mask asks for more of them. But clearly the thing won\u0027t\ndo what is expected of it when the required pipes are not\npresent.\n\nFix the problem by consulting the device info pipe_mask already\nin bigjoiner_pipes().\n\nCc: stable@vger.kernel.org\nSigned-off-by: Ville Syrjälä \u003cville.syrjala@linux.intel.com\u003e\nLink: https://patchwork.freedesktop.org/patch/msgid/20221118185201.10469-1-ville.syrjala@linux.intel.com\nReviewed-by: Arun R Murthy \u003carun.r.murthy@intel.com\u003e\n(cherry picked from commit f1c87a94a1087a26f41007ee83264033007421b5)\nSigned-off-by: Tvrtko Ursulin \u003ctvrtko.ursulin@intel.com\u003e\n" }, { "commit": "2f3830544a89af2e72e7fd3d6ca44dd9cffec197", "tree": "f0d65ebb80ac04e38fd963e2cd5f83be2317a534", "parents": [ "b7b275e60bcd5f89771e865a8239325f86d9927d" ], "author": { "name": "Radhakrishna Sripada", "email": "radhakrishna.sripada@intel.com", "time": "Thu Nov 17 13:30:14 2022 -0800" }, "committer": { "name": "Tvrtko Ursulin", "email": "tvrtko.ursulin@intel.com", "time": "Tue Nov 29 08:49:14 2022 +0000" }, "message": "drm/i915/mtl: Fix dram info readout\n\nMEM_SS_INFO_GLOBAL Register info read from the hardware is cached in val. However\nthe variable is being modified when determining the DRAM type thereby clearing out\nthe channels and qgv info extracted later in the function xelpdp_get_dram_info. Preserve\nthe register value and use extracted fields in the switch statement.\n\nFixes: 825477e77912 (\"drm/i915/mtl: Obtain SAGV values from MMIO instead of GT pcode mailbox\")\nCc: Matt Roper \u003cmatthew.d.roper@intel.com\u003e\nSigned-off-by: Radhakrishna Sripada \u003cradhakrishna.sripada@intel.com\u003e\nReviewed-by: Matt Roper \u003cmatthew.d.roper@intel.com\u003e\nLink: https://patchwork.freedesktop.org/patch/msgid/20221117213015.584417-1-radhakrishna.sripada@intel.com\n(cherry picked from commit ec35c41d91052a3a15dd3767075620af448b8030)\nSigned-off-by: Tvrtko Ursulin \u003ctvrtko.ursulin@intel.com\u003e\n" }, { "commit": "ca57f02295f188d6c65ec02202402979880fa6d8", "tree": "f07b10e0876285ea7174fd79bf91aa947d089ed4", "parents": [ "4009166c3918ccfbf4daf0790630261153d6b646" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Mon Nov 28 22:02:56 2022 +0000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Nov 28 18:40:07 2022 -0800" }, "message": "afs: Fix fileserver probe RTT handling\n\nThe fileserver probing code attempts to work out the best fileserver to\nuse for a volume by retrieving the RTT calculated by AF_RXRPC for the\nprobe call sent to each server and comparing them. Sometimes, however,\nno RTT estimate is available and rxrpc_kernel_get_srtt() returns false,\nleading good fileservers to be given an RTT of UINT_MAX and thus causing\nthe rotation algorithm to ignore them.\n\nFix afs_select_fileserver() to ignore rxrpc_kernel_get_srtt()\u0027s return\nvalue and just take the estimated RTT it provides - which will be capped\nat 1 second.\n\nFixes: 1d4adfaf6574 (\"rxrpc: Make rxrpc_kernel_get_srtt() indicate validity\")\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nReviewed-by: Marc Dionne \u003cmarc.dionne@auristor.com\u003e\nTested-by: Marc Dionne \u003cmarc.dionne@auristor.com\u003e\ncc: linux-afs@lists.infradead.org\nLink: https://lore.kernel.org/r/166965503999.3392585.13954054113218099395.stgit@warthog.procyon.org.uk/\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" } ], "next": "cdde1560118f82498fc9e9a7c1ef7f0ef7755891" }