)]}' { "log": [ { "commit": "44149752e9987a9eac5ad78e6d3a20934b5e018d", "tree": "695c8aaaca4366e391889baccfe27301ce2d5aa5", "parents": [ "e44f45fee8d5520c6a72e308054fc627e8e38619", "7e27cb6ad4d85fc8bac2a2a896da62ef66b8598e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 13 16:28:33 2023 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 13 16:28:33 2023 -0700" }, "message": "Merge tag \u0027cgroup-for-6.3-rc6-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup\n\nPull cgroup fixes from Tejun Heo:\n \"This is a relatively big pull request this late in the cycle but the\n major contributor is the cpuset bug which is rather significant:\n\n - Fix several cpuset bugs including one where it wasn\u0027t applying the\n target cgroup when tasks are created with CLONE_INTO_CGROUP\n\n With a few smaller fixes:\n\n - Fix inversed locking order in cgroup1 freezer implementation\n\n - Fix garbage cpu.stat::core_sched.forceidle_usec reporting in the\n root cgroup\"\n\n* tag \u0027cgroup-for-6.3-rc6-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:\n cgroup/cpuset: Make cpuset_attach_task() skip subpartitions CPUs for top_cpuset\n cgroup/cpuset: Add cpuset_can_fork() and cpuset_cancel_fork() methods\n cgroup/cpuset: Make cpuset_fork() handle CLONE_INTO_CGROUP properly\n cgroup/cpuset: Wake up cpuset_attach_wq tasks in cpuset_cancel_attach()\n cgroup,freezer: hold cpu_hotplug_lock before freezer_mutex\n cgroup/cpuset: Fix partition root\u0027s cpuset.cpus update bug\n cgroup: fix display of forceidle time at root\n" }, { "commit": "e44f45fee8d5520c6a72e308054fc627e8e38619", "tree": "889892fb56225dfd8a2e34a5b42e75693de34294", "parents": [ "829cca4d1783088e43bace57a555044cc937c554", "632e04739c8f45c2d9ca4d4c5bd18d80c2ac9296" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 13 16:16:33 2023 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 13 16:16:33 2023 -0700" }, "message": "Merge tag \u0027clk-fixes-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux\n\nPull clk fixes from Stephen Boyd:\n \"A few more clk driver fixes:\n\n - Set the max_register member of the spreadtrum regmap so that reads\n don\u0027t go off the end of the I/O space\n\n - Avoid a clk parent error in the i.MX imx6ul driver when the\n selector is unknown\n\n - Fix an oops due to REGCACHE_NONE usage by the Renesas 9-series\n driver\"\n\n* tag \u0027clk-fixes-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux:\n clk: rs9: Fix suspend/resume\n clk: imx6ul: fix \"failed to get parent\" error\n clk: sprd: set max_register according to mapping range\n" }, { "commit": "829cca4d1783088e43bace57a555044cc937c554", "tree": "78a99d818c13e7a7601297ce59fd103918458010", "parents": [ "4413ad01e27eb989f4b19bb5b038328c220a383d", "d0f89c4c1d4e7614581d4fe7caebb3ce6bceafe6" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 13 15:33:04 2023 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 13 15:33:04 2023 -0700" }, "message": "Merge tag \u0027net-6.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Jakub Kicinski:\n \"Including fixes from bpf, and bluetooth.\n\n Not all that quiet given spring celebrations, but \"current\" fixes are\n thinning out, which is encouraging. One outstanding regression in the\n mlx5 driver when using old FW, not blocking but we\u0027re pushing for a\n fix.\n\n Current release - new code bugs:\n\n - eth: enetc: workaround for unresponsive pMAC after receiving\n express traffic\n\n Previous releases - regressions:\n\n - rtnetlink: restore RTM_NEW/DELLINK notification behavior, keep the\n pid/seq fields 0 for backward compatibility\n\n Previous releases - always broken:\n\n - sctp: fix a potential overflow in sctp_ifwdtsn_skip\n\n - mptcp:\n - use mptcp_schedule_work instead of open-coding it and make the\n worker check stricter, to avoid scheduling work on closed\n sockets\n - fix NULL pointer dereference on fastopen early fallback\n\n - skbuff: fix memory corruption due to a race between skb coalescing\n and releasing clones confusing page_pool reference counting\n\n - bonding: fix neighbor solicitation validation on backup slaves\n\n - bpf: tcp: use sock_gen_put instead of sock_put in bpf_iter_tcp\n\n - bpf: arm64: fixed a BTI error on returning to patched function\n\n - openvswitch: fix race on port output leading to inf loop\n\n - sfp: initialize sfp-\u003ei2c_block_size at sfp allocation to avoid\n returning a different errno than expected\n\n - phy: nxp-c45-tja11xx: unregister PTP, purge queues on remove\n\n - Bluetooth: fix printing errors if LE Connection times out\n\n - Bluetooth: assorted UaF, deadlock and data race fixes\n\n - eth: macb: fix memory corruption in extended buffer descriptor mode\n\n Misc:\n\n - adjust the XDP Rx flow hash API to also include the protocol layers\n over which the hash was computed\"\n\n* tag \u0027net-6.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (50 commits)\n selftests/bpf: Adjust bpf_xdp_metadata_rx_hash for new arg\n mlx4: bpf_xdp_metadata_rx_hash add xdp rss hash type\n veth: bpf_xdp_metadata_rx_hash add xdp rss hash type\n mlx5: bpf_xdp_metadata_rx_hash add xdp rss hash type\n xdp: rss hash types representation\n selftests/bpf: xdp_hw_metadata remove bpf_printk and add counters\n skbuff: Fix a race between coalescing and releasing SKBs\n net: macb: fix a memory corruption in extended buffer descriptor mode\n selftests: add the missing CONFIG_IP_SCTP in net config\n udp6: fix potential access to stale information\n selftests: openvswitch: adjust datapath NL message declaration\n selftests: mptcp: userspace pm: uniform verify events\n mptcp: fix NULL pointer dereference on fastopen early fallback\n mptcp: stricter state check in mptcp_worker\n mptcp: use mptcp_schedule_work instead of open-coding it\n net: enetc: workaround for unresponsive pMAC after receiving express traffic\n sctp: fix a potential overflow in sctp_ifwdtsn_skip\n net: qrtr: Fix an uninit variable access bug in qrtr_tx_resume()\n rtnetlink: Restore RTM_NEW/DELLINK notification behavior\n net: ti/cpsw: Add explicit platform_device.h and of_platform.h includes\n ...\n" }, { "commit": "4413ad01e27eb989f4b19bb5b038328c220a383d", "tree": "d4a54ae82e8e14c0d4b3572f514c7e316c1e8fec", "parents": [ "531f27ad5e3a85128a9668c9063c58fc35d4e89b", "1a50d9403fb90cbe4dea0ec9fd0351d2ecbd8924" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 13 15:21:56 2023 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 13 15:21:56 2023 -0700" }, "message": "Merge tag \u0027devicetree-fixes-for-6.2-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux\n\nPull devicetree fixes from Rob Herring:\n\n - Fix interaction between fw_devlink and DT overlays causing devices to\n not be probed\n\n - Fix the compatible string for loongson,cpu-interrupt-controller\n\n* tag \u0027devicetree-fixes-for-6.2-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux:\n treewide: Fix probing of devices in DT overlays\n dt-bindings: interrupt-controller: loongarch: Fix mismatched compatible\n" }, { "commit": "531f27ad5e3a85128a9668c9063c58fc35d4e89b", "tree": "69ba363357157f8a7ff6ba53baacd0bc3b09f176", "parents": [ "f1be7b6c165f0d451c3ea2062f506bf5f130bd5e", "534e465845ebfb4a97eb5459d3931a0b35e3b9a5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 13 15:17:59 2023 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 13 15:17:59 2023 -0700" }, "message": "Merge tag \u0027pinctrl-v6.3-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl\n\nPull pin control fix from Linus Walleij:\n \"This is just a revert of the AMD fix, because the fix broke some\n laptops. We are working on a proper solution\"\n\n* tag \u0027pinctrl-v6.3-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:\n Revert \"pinctrl: amd: Disable and mask interrupts on resume\"\n" }, { "commit": "f1be7b6c165f0d451c3ea2062f506bf5f130bd5e", "tree": "8334c60726cf8d1612136d6682589eedc9fbd02e", "parents": [ "de4664485abbc0529b1eec44d0061bbfe58a28fb", "cab2932213c5cd72a9e04e5e82002e81b946592b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 13 14:58:55 2023 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 13 14:58:55 2023 -0700" }, "message": "Merge tag \u0027drm-fixes-2023-04-13\u0027 of git://anongit.freedesktop.org/drm/drm\n\nPull drm fixes from Daniel Vetter:\n\n - two fbcon regressions\n\n - amdgpu: dp mst, smu13\n\n - i915: dual link dsi for tgl+\n\n - armada, nouveau, drm/sched, fbmem\n\n* tag \u0027drm-fixes-2023-04-13\u0027 of git://anongit.freedesktop.org/drm/drm:\n fbcon: set_con2fb_map needs to set con2fb_map!\n fbcon: Fix error paths in set_con2fb_map\n drm/amd/pm: correct the pcie link state check for SMU13\n drm/amd/pm: correct SMU13.0.7 max shader clock reporting\n drm/amd/pm: correct SMU13.0.7 pstate profiling clock settings\n drm/amd/display: Pass the right info to drm_dp_remove_payload\n drm/armada: Fix a potential double free in an error handling path\n fbmem: Reject FB_ACTIVATE_KD_TEXT from userspace\n drm/nouveau/fb: add missing sysmen flush callbacks\n drm/i915/dsi: fix DSS CTL register offsets for TGL+\n drm/scheduler: Fix UAF race in drm_sched_entity_push_job()\n" }, { "commit": "d0f89c4c1d4e7614581d4fe7caebb3ce6bceafe6", "tree": "27fc5232d3f0adfc0a960e0971c074fce437a829", "parents": [ "0646dc31ca886693274df5749cd0c8c1eaaeb5ca", "b65ef48c95b95960e91f9f3c45e6d079be00f0f3" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 13 13:04:44 2023 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 13 13:04:44 2023 -0700" }, "message": "Merge tag \u0027for-netdev\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf\n\nDaniel Borkmann says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\npull-request: bpf 2023-04-13\n\nWe\u0027ve added 6 non-merge commits during the last 1 day(s) which contain\na total of 14 files changed, 205 insertions(+), 38 deletions(-).\n\nThe main changes are:\n\n1) One late straggler fix on the XDP hints side which fixes\n bpf_xdp_metadata_rx_hash kfunc API before the release goes out\n in order to provide information on the RSS hash type,\n from Jesper Dangaard Brouer.\n\n* tag \u0027for-netdev\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:\n selftests/bpf: Adjust bpf_xdp_metadata_rx_hash for new arg\n mlx4: bpf_xdp_metadata_rx_hash add xdp rss hash type\n veth: bpf_xdp_metadata_rx_hash add xdp rss hash type\n mlx5: bpf_xdp_metadata_rx_hash add xdp rss hash type\n xdp: rss hash types representation\n selftests/bpf: xdp_hw_metadata remove bpf_printk and add counters\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://lore.kernel.org/r/20230413192939.10202-1-daniel@iogearbox.net\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "cab2932213c5cd72a9e04e5e82002e81b946592b", "tree": "1d2f684e585f26354bb6c6f7fceab1430d011241", "parents": [ "fffb0b52d5258554c645c966c6cbef7de50b851d", "5603effb8295ada8419408d038a34ca89d658229" ], "author": { "name": "Daniel Vetter", "email": "daniel.vetter@ffwll.ch", "time": "Thu Apr 13 20:47:58 2023 +0200" }, "committer": { "name": "Daniel Vetter", "email": "daniel.vetter@ffwll.ch", "time": "Thu Apr 13 20:47:58 2023 +0200" }, "message": "Merge tag \u0027drm-misc-fixes-2023-04-13\u0027 of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes\n\nShort summary of fixes pull:\n\n * armada: Fix double free\n * fb: Clear FB_ACTIVATE_KD_TEXT in ioctl\n * nouveau: Add missing callbacks\n * scheduler: Fix use-after-free error\n\nSigned-off-by: Daniel Vetter \u003cdaniel.vetter@ffwll.ch\u003e\nFrom: Thomas Zimmermann \u003ctzimmermann@suse.de\u003e\nLink: https://patchwork.freedesktop.org/patch/msgid/20230413184233.GA8148@linux-uq9g\n" }, { "commit": "b65ef48c95b95960e91f9f3c45e6d079be00f0f3", "tree": "27fc5232d3f0adfc0a960e0971c074fce437a829", "parents": [ "0646dc31ca886693274df5749cd0c8c1eaaeb5ca", "0f26b74e7d071b0dc18e2c43d79d496c2b144035" ], "author": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Thu Apr 13 11:05:49 2023 -0700" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Thu Apr 13 11:15:11 2023 -0700" }, "message": "Merge branch \u0027XDP-hints: change RX-hash kfunc bpf_xdp_metadata_rx_hash\u0027\n\nJesper Dangaard Brouer says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nCurrent API for bpf_xdp_metadata_rx_hash() returns the raw RSS hash value,\nbut doesn\u0027t provide information on the RSS hash type (part of 6.3-rc).\n\nThis patchset proposal is to change the function call signature via adding\na pointer value argument for providing the RSS hash type.\n\nPatchset also removes all bpf_printk\u0027s from xdp_hw_metadata program\nthat we expect driver developers to use. Instead counters are introduced\nfor relaying e.g. skip and fail info.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n" }, { "commit": "0f26b74e7d071b0dc18e2c43d79d496c2b144035", "tree": "27fc5232d3f0adfc0a960e0971c074fce437a829", "parents": [ "9123397aeeb4f93dda5828e37c35312f1b62231e" ], "author": { "name": "Jesper Dangaard Brouer", "email": "brouer@redhat.com", "time": "Wed Apr 12 21:49:00 2023 +0200" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Thu Apr 13 11:15:11 2023 -0700" }, "message": "selftests/bpf: Adjust bpf_xdp_metadata_rx_hash for new arg\n\nUpdate BPF selftests to use the new RSS type argument for kfunc\nbpf_xdp_metadata_rx_hash.\n\nSigned-off-by: Jesper Dangaard Brouer \u003cbrouer@redhat.com\u003e\nAcked-by: Toke Høiland-Jørgensen \u003ctoke@redhat.com\u003e\nAcked-by: Stanislav Fomichev \u003csdf@google.com\u003e\nLink: https://lore.kernel.org/r/168132894068.340624.8914711185697163690.stgit@firesoul\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n" }, { "commit": "9123397aeeb4f93dda5828e37c35312f1b62231e", "tree": "758e807766ea3bc07d441fce5eb60dfdb4eb5065", "parents": [ "96b1a098f3db06223a6b6268e756f980d5c07f10" ], "author": { "name": "Jesper Dangaard Brouer", "email": "brouer@redhat.com", "time": "Wed Apr 12 21:48:55 2023 +0200" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Thu Apr 13 11:15:11 2023 -0700" }, "message": "mlx4: bpf_xdp_metadata_rx_hash add xdp rss hash type\n\nUpdate API for bpf_xdp_metadata_rx_hash() with arg for xdp rss hash type\nvia matching individual Completion Queue Entry (CQE) status bits.\n\nFixes: ab46182d0dcb (\"net/mlx4_en: Support RX XDP metadata\")\nSigned-off-by: Jesper Dangaard Brouer \u003cbrouer@redhat.com\u003e\nAcked-by: Toke Høiland-Jørgensen \u003ctoke@redhat.com\u003e\nAcked-by: Stanislav Fomichev \u003csdf@google.com\u003e\nLink: https://lore.kernel.org/r/168132893562.340624.12779118462402031248.stgit@firesoul\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n" }, { "commit": "96b1a098f3db06223a6b6268e756f980d5c07f10", "tree": "27458edf4d91e5a6cc500bc048d2b48977b5d7d7", "parents": [ "67f245c2ec0af17d7a90c78910e28bc8b206297c" ], "author": { "name": "Jesper Dangaard Brouer", "email": "brouer@redhat.com", "time": "Wed Apr 12 21:48:50 2023 +0200" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Thu Apr 13 11:15:10 2023 -0700" }, "message": "veth: bpf_xdp_metadata_rx_hash add xdp rss hash type\n\nUpdate API for bpf_xdp_metadata_rx_hash() with arg for xdp rss hash type.\n\nThe veth driver currently only support XDP-hints based on SKB code path.\nThe SKB have lost information about the RSS hash type, by compressing\nthe information down to a single bitfield skb-\u003el4_hash, that only knows\nif this was a L4 hash value.\n\nIn preparation for veth, the xdp_rss_hash_type have an L4 indication\nbit that allow us to return a meaningful L4 indication when working\nwith SKB based packets.\n\nFixes: 306531f0249f (\"veth: Support RX XDP metadata\")\nSigned-off-by: Jesper Dangaard Brouer \u003cbrouer@redhat.com\u003e\nAcked-by: Toke Høiland-Jørgensen \u003ctoke@redhat.com\u003e\nAcked-by: Stanislav Fomichev \u003csdf@google.com\u003e\nLink: https://lore.kernel.org/r/168132893055.340624.16209448340644513469.stgit@firesoul\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n" }, { "commit": "67f245c2ec0af17d7a90c78910e28bc8b206297c", "tree": "329122721793c547a8bccf69ac978d18ec2a70b0", "parents": [ "0cd917a4a8ace70ff9082d797c899f6bf10de910" ], "author": { "name": "Jesper Dangaard Brouer", "email": "brouer@redhat.com", "time": "Wed Apr 12 21:48:45 2023 +0200" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Thu Apr 13 11:15:10 2023 -0700" }, "message": "mlx5: bpf_xdp_metadata_rx_hash add xdp rss hash type\n\nUpdate API for bpf_xdp_metadata_rx_hash() with arg for xdp rss hash type\nvia mapping table.\n\nThe mlx5 hardware can also identify and RSS hash IPSEC. This indicate\nhash includes SPI (Security Parameters Index) as part of IPSEC hash.\n\nExtend xdp core enum xdp_rss_hash_type with IPSEC hash type.\n\nFixes: bc8d405b1ba9 (\"net/mlx5e: Support RX XDP metadata\")\nSigned-off-by: Jesper Dangaard Brouer \u003cbrouer@redhat.com\u003e\nAcked-by: Toke Høiland-Jørgensen \u003ctoke@redhat.com\u003e\nAcked-by: Stanislav Fomichev \u003csdf@google.com\u003e\nLink: https://lore.kernel.org/r/168132892548.340624.11185734579430124869.stgit@firesoul\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n" }, { "commit": "0cd917a4a8ace70ff9082d797c899f6bf10de910", "tree": "dc6f519d426f87391f289943d7168c994dc8bfb3", "parents": [ "e8163b98d96c4d87c870689f560c53be7ccd55c8" ], "author": { "name": "Jesper Dangaard Brouer", "email": "brouer@redhat.com", "time": "Wed Apr 12 21:48:40 2023 +0200" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Thu Apr 13 11:15:10 2023 -0700" }, "message": "xdp: rss hash types representation\n\nThe RSS hash type specifies what portion of packet data NIC hardware used\nwhen calculating RSS hash value. The RSS types are focused on Internet\ntraffic protocols at OSI layers L3 and L4. L2 (e.g. ARP) often get hash\nvalue zero and no RSS type. For L3 focused on IPv4 vs. IPv6, and L4\nprimarily TCP vs UDP, but some hardware supports SCTP.\n\nHardware RSS types are differently encoded for each hardware NIC. Most\nhardware represent RSS hash type as a number. Determining L3 vs L4 often\nrequires a mapping table as there often isn\u0027t a pattern or sorting\naccording to ISO layer.\n\nThe patch introduce a XDP RSS hash type (enum xdp_rss_hash_type) that\ncontains both BITs for the L3/L4 types, and combinations to be used by\ndrivers for their mapping tables. The enum xdp_rss_type_bits get exposed\nto BPF via BTF, and it is up to the BPF-programmer to match using these\ndefines.\n\nThis proposal change the kfunc API bpf_xdp_metadata_rx_hash() adding\na pointer value argument for provide the RSS hash type.\nChange signature for all xmo_rx_hash calls in drivers to make it compile.\n\nThe RSS type implementations for each driver comes as separate patches.\n\nFixes: 3d76a4d3d4e5 (\"bpf: XDP metadata RX kfuncs\")\nSigned-off-by: Jesper Dangaard Brouer \u003cbrouer@redhat.com\u003e\nAcked-by: Toke Høiland-Jørgensen \u003ctoke@redhat.com\u003e\nAcked-by: Stanislav Fomichev \u003csdf@google.com\u003e\nLink: https://lore.kernel.org/r/168132892042.340624.582563003880565460.stgit@firesoul\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n" }, { "commit": "e8163b98d96c4d87c870689f560c53be7ccd55c8", "tree": "0abd60a76fb9e7dbdf856d046d5ca7aa73b83e21", "parents": [ "0646dc31ca886693274df5749cd0c8c1eaaeb5ca" ], "author": { "name": "Jesper Dangaard Brouer", "email": "brouer@redhat.com", "time": "Wed Apr 12 21:48:35 2023 +0200" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Thu Apr 13 11:15:10 2023 -0700" }, "message": "selftests/bpf: xdp_hw_metadata remove bpf_printk and add counters\n\nThe tool xdp_hw_metadata can be used by driver developers\nimplementing XDP-hints metadata kfuncs.\n\nRemove all bpf_printk calls, as the tool already transfers all the\nXDP-hints related information via metadata area to AF_XDP\nuserspace process.\n\nAdd counters for providing remaining information about failure and\nskipped packet events.\n\nSigned-off-by: Jesper Dangaard Brouer \u003cbrouer@redhat.com\u003e\nAcked-by: Stanislav Fomichev \u003csdf@google.com\u003e\nLink: https://lore.kernel.org/r/168132891533.340624.7313781245316405141.stgit@firesoul\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n" }, { "commit": "fffb0b52d5258554c645c966c6cbef7de50b851d", "tree": "ba200e418489a315f7bad0bdb47c5cecf10bc096", "parents": [ "edf79dd2172233452ff142dcc98b19d955fc8974" ], "author": { "name": "Daniel Vetter", "email": "daniel.vetter@ffwll.ch", "time": "Wed Apr 12 17:31:46 2023 +0200" }, "committer": { "name": "Daniel Vetter", "email": "daniel.vetter@ffwll.ch", "time": "Thu Apr 13 20:10:11 2023 +0200" }, "message": "fbcon: set_con2fb_map needs to set con2fb_map!\n\nI got really badly confused in d443d9386472 (\"fbcon: move more common\ncode into fb_open()\") because we set the con2fb_map before the failure\npoints, which didn\u0027t look good.\n\nBut in trying to fix that I moved the assignment into the wrong path -\nwe need to do it for _all_ vc we take over, not just the first one\n(which additionally requires the call to con2fb_acquire_newinfo).\n\nI\u0027ve figured this out because of a KASAN bug report, where the\nfbcon_registered_fb and fbcon_display arrays went out of sync in\nfbcon_mode_deleted() because the con2fb_map pointed at the old\nfb_info, but the modes and everything was updated for the new one.\n\nSigned-off-by: Daniel Vetter \u003cdaniel.vetter@intel.com\u003e\nReviewed-by: Javier Martinez Canillas \u003cjavierm@redhat.com\u003e\nAcked-by: Helge Deller \u003cdeller@gmx.de\u003e\nTested-by: Xingyuan Mo \u003chdthky0@gmail.com\u003e\nFixes: d443d9386472 (\"fbcon: move more common code into fb_open()\")\nReported-by: Xingyuan Mo \u003chdthky0@gmail.com\u003e\nCc: Thomas Zimmermann \u003ctzimmermann@suse.de\u003e\nCc: Sam Ravnborg \u003csam@ravnborg.org\u003e\nCc: Xingyuan Mo \u003chdthky0@gmail.com\u003e\nCc: Thomas Zimmermann \u003ctzimmermann@suse.de\u003e\nCc: Helge Deller \u003cdeller@gmx.de\u003e\nCc: \u003cstable@vger.kernel.org\u003e # v5.19+\n" }, { "commit": "edf79dd2172233452ff142dcc98b19d955fc8974", "tree": "07231d46907c6d22322a152716bc1779e7f7eaae", "parents": [ "a552b73f36cb3e59fd2015307fde8ff53874d1af" ], "author": { "name": "Daniel Vetter", "email": "daniel.vetter@ffwll.ch", "time": "Wed Apr 12 17:23:49 2023 +0200" }, "committer": { "name": "Daniel Vetter", "email": "daniel.vetter@ffwll.ch", "time": "Thu Apr 13 20:09:55 2023 +0200" }, "message": "fbcon: Fix error paths in set_con2fb_map\n\nThis is a regressoin introduced in b07db3958485 (\"fbcon: Ditch error\nhandling for con2fb_release_oldinfo\"). I failed to realize what the if\n(!err) checks. The mentioned commit was dropping the\ncon2fb_release_oldinfo() return value but the if (!err) was also\nchecking whether the con2fb_acquire_newinfo() function call above\nfailed or not.\n\nFix this with an early return statement.\n\nNote that there\u0027s still a difference compared to the orginal state of\nthe code, the below lines are now also skipped on error:\n\n\tif (!search_fb_in_map(info_idx))\n\t\tinfo_idx \u003d newidx;\n\nThese are only needed when we\u0027ve actually thrown out an old fb_info\nfrom the console mappings, which only happens later on.\n\nAlso move the fbcon_add_cursor_work() call into the same if block,\nit\u0027s all protected by console_lock so doesn\u0027t matter when we set up\nthe blinking cursor delayed work anyway. This further simplifies the\ncontrol flow and allows us to ditch the found local variable.\n\nv2: Clarify commit message (Javier)\n\nSigned-off-by: Daniel Vetter \u003cdaniel.vetter@intel.com\u003e\nReviewed-by: Javier Martinez Canillas \u003cjavierm@redhat.com\u003e\nAcked-by: Helge Deller \u003cdeller@gmx.de\u003e\nTested-by: Xingyuan Mo \u003chdthky0@gmail.com\u003e\nFixes: b07db3958485 (\"fbcon: Ditch error handling for con2fb_release_oldinfo\")\nCc: Thomas Zimmermann \u003ctzimmermann@suse.de\u003e\nCc: Sam Ravnborg \u003csam@ravnborg.org\u003e\nCc: Xingyuan Mo \u003chdthky0@gmail.com\u003e\nCc: Thomas Zimmermann \u003ctzimmermann@suse.de\u003e\nCc: Helge Deller \u003cdeller@gmx.de\u003e\nCc: \u003cstable@vger.kernel.org\u003e # v5.19+\n" }, { "commit": "0646dc31ca886693274df5749cd0c8c1eaaeb5ca", "tree": "de6987cab2265de59fb06fb362f8ced2507ecaa9", "parents": [ "e8b74453555872851bdd7ea43a7c0ec39659834f" ], "author": { "name": "Liang Chen", "email": "liangchen.linux@gmail.com", "time": "Thu Apr 13 17:03:53 2023 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 13 10:08:42 2023 -0700" }, "message": "skbuff: Fix a race between coalescing and releasing SKBs\n\nCommit 1effe8ca4e34 (\"skbuff: fix coalescing for page_pool fragment\nrecycling\") allowed coalescing to proceed with non page pool page and page\npool page when @from is cloned, i.e.\n\nto-\u003epp_recycle --\u003e false\nfrom-\u003epp_recycle --\u003e true\nskb_cloned(from) --\u003e true\n\nHowever, it actually requires skb_cloned(@from) to hold true until\ncoalescing finishes in this situation. If the other cloned SKB is\nreleased while the merging is in process, from_shinfo-\u003enr_frags will be\nset to 0 toward the end of the function, causing the increment of frag\npage _refcount to be unexpectedly skipped resulting in inconsistent\nreference counts. Later when SKB(@to) is released, it frees the page\ndirectly even though the page pool page is still in use, leading to\nuse-after-free or double-free errors. So it should be prohibited.\n\nThe double-free error message below prompted us to investigate:\nBUG: Bad page state in process swapper/1 pfn:0e0d1\npage:00000000c6548b28 refcount:-1 mapcount:0 mapping:0000000000000000\nindex:0x2 pfn:0xe0d1\nflags: 0xfffffc0000000(node\u003d0|zone\u003d1|lastcpupid\u003d0x1fffff)\nraw: 000fffffc0000000 0000000000000000 ffffffff00000101 0000000000000000\nraw: 0000000000000002 0000000000000000 ffffffffffffffff 0000000000000000\npage dumped because: nonzero _refcount\n\nCPU: 1 PID: 0 Comm: swapper/1 Tainted: G E 6.2.0+\nCall Trace:\n \u003cIRQ\u003e\ndump_stack_lvl+0x32/0x50\nbad_page+0x69/0xf0\nfree_pcp_prepare+0x260/0x2f0\nfree_unref_page+0x20/0x1c0\nskb_release_data+0x10b/0x1a0\nnapi_consume_skb+0x56/0x150\nnet_rx_action+0xf0/0x350\n? __napi_schedule+0x79/0x90\n__do_softirq+0xc8/0x2b1\n__irq_exit_rcu+0xb9/0xf0\ncommon_interrupt+0x82/0xa0\n\u003c/IRQ\u003e\n\u003cTASK\u003e\nasm_common_interrupt+0x22/0x40\nRIP: 0010:default_idle+0xb/0x20\n\nFixes: 53e0961da1c7 (\"page_pool: add frag page recycling support in page pool\")\nSigned-off-by: Liang Chen \u003cliangchen.linux@gmail.com\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://lore.kernel.org/r/20230413090353.14448-1-liangchen.linux@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e8b74453555872851bdd7ea43a7c0ec39659834f", "tree": "e6d40da02dda78218de8760f59a14e58e0b916c9", "parents": [ "3a0385be133e7091cc9a9a998c7ec712bb9585db" ], "author": { "name": "Roman Gushchin", "email": "roman.gushchin@linux.dev", "time": "Wed Apr 12 16:21:44 2023 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 13 10:05:07 2023 -0700" }, "message": "net: macb: fix a memory corruption in extended buffer descriptor mode\n\nFor quite some time we were chasing a bug which looked like a sudden\npermanent failure of networking and mmc on some of our devices.\nThe bug was very sensitive to any software changes and even more to\nany kernel debug options.\n\nFinally we got a setup where the problem was reproducible with\nCONFIG_DMA_API_DEBUG\u003dy and it revealed the issue with the rx dma:\n\n[ 16.992082] ------------[ cut here ]------------\n[ 16.996779] DMA-API: macb ff0b0000.ethernet: device driver tries to free DMA memory it has not allocated [device address\u003d0x0000000875e3e244] [size\u003d1536 bytes]\n[ 17.011049] WARNING: CPU: 0 PID: 85 at kernel/dma/debug.c:1011 check_unmap+0x6a0/0x900\n[ 17.018977] Modules linked in: xxxxx\n[ 17.038823] CPU: 0 PID: 85 Comm: irq/55-8000f000 Not tainted 5.4.0 #28\n[ 17.045345] Hardware name: xxxxx\n[ 17.049528] pstate: 60000005 (nZCv daif -PAN -UAO)\n[ 17.054322] pc : check_unmap+0x6a0/0x900\n[ 17.058243] lr : check_unmap+0x6a0/0x900\n[ 17.062163] sp : ffffffc010003c40\n[ 17.065470] x29: ffffffc010003c40 x28: 000000004000c03c\n[ 17.070783] x27: ffffffc010da7048 x26: ffffff8878e38800\n[ 17.076095] x25: ffffff8879d22810 x24: ffffffc010003cc8\n[ 17.081407] x23: 0000000000000000 x22: ffffffc010a08750\n[ 17.086719] x21: ffffff8878e3c7c0 x20: ffffffc010acb000\n[ 17.092032] x19: 0000000875e3e244 x18: 0000000000000010\n[ 17.097343] x17: 0000000000000000 x16: 0000000000000000\n[ 17.102647] x15: ffffff8879e4a988 x14: 0720072007200720\n[ 17.107959] x13: 0720072007200720 x12: 0720072007200720\n[ 17.113261] x11: 0720072007200720 x10: 0720072007200720\n[ 17.118565] x9 : 0720072007200720 x8 : 000000000000022d\n[ 17.123869] x7 : 0000000000000015 x6 : 0000000000000098\n[ 17.129173] x5 : 0000000000000000 x4 : 0000000000000000\n[ 17.134475] x3 : 00000000ffffffff x2 : ffffffc010a1d370\n[ 17.139778] x1 : b420c9d75d27bb00 x0 : 0000000000000000\n[ 17.145082] Call trace:\n[ 17.147524] check_unmap+0x6a0/0x900\n[ 17.151091] debug_dma_unmap_page+0x88/0x90\n[ 17.155266] gem_rx+0x114/0x2f0\n[ 17.158396] macb_poll+0x58/0x100\n[ 17.161705] net_rx_action+0x118/0x400\n[ 17.165445] __do_softirq+0x138/0x36c\n[ 17.169100] irq_exit+0x98/0xc0\n[ 17.172234] __handle_domain_irq+0x64/0xc0\n[ 17.176320] gic_handle_irq+0x5c/0xc0\n[ 17.179974] el1_irq+0xb8/0x140\n[ 17.183109] xiic_process+0x5c/0xe30\n[ 17.186677] irq_thread_fn+0x28/0x90\n[ 17.190244] irq_thread+0x208/0x2a0\n[ 17.193724] kthread+0x130/0x140\n[ 17.196945] ret_from_fork+0x10/0x20\n[ 17.200510] ---[ end trace 7240980785f81d6f ]---\n\n[ 237.021490] ------------[ cut here ]------------\n[ 237.026129] DMA-API: exceeded 7 overlapping mappings of cacheline 0x0000000021d79e7b\n[ 237.033886] WARNING: CPU: 0 PID: 0 at kernel/dma/debug.c:499 add_dma_entry+0x214/0x240\n[ 237.041802] Modules linked in: xxxxx\n[ 237.061637] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G W 5.4.0 #28\n[ 237.068941] Hardware name: xxxxx\n[ 237.073116] pstate: 80000085 (Nzcv daIf -PAN -UAO)\n[ 237.077900] pc : add_dma_entry+0x214/0x240\n[ 237.081986] lr : add_dma_entry+0x214/0x240\n[ 237.086072] sp : ffffffc010003c30\n[ 237.089379] x29: ffffffc010003c30 x28: ffffff8878a0be00\n[ 237.094683] x27: 0000000000000180 x26: ffffff8878e387c0\n[ 237.099987] x25: 0000000000000002 x24: 0000000000000000\n[ 237.105290] x23: 000000000000003b x22: ffffffc010a0fa00\n[ 237.110594] x21: 0000000021d79e7b x20: ffffffc010abe600\n[ 237.115897] x19: 00000000ffffffef x18: 0000000000000010\n[ 237.121201] x17: 0000000000000000 x16: 0000000000000000\n[ 237.126504] x15: ffffffc010a0fdc8 x14: 0720072007200720\n[ 237.131807] x13: 0720072007200720 x12: 0720072007200720\n[ 237.137111] x11: 0720072007200720 x10: 0720072007200720\n[ 237.142415] x9 : 0720072007200720 x8 : 0000000000000259\n[ 237.147718] x7 : 0000000000000001 x6 : 0000000000000000\n[ 237.153022] x5 : ffffffc010003a20 x4 : 0000000000000001\n[ 237.158325] x3 : 0000000000000006 x2 : 0000000000000007\n[ 237.163628] x1 : 8ac721b3a7dc1c00 x0 : 0000000000000000\n[ 237.168932] Call trace:\n[ 237.171373] add_dma_entry+0x214/0x240\n[ 237.175115] debug_dma_map_page+0xf8/0x120\n[ 237.179203] gem_rx_refill+0x190/0x280\n[ 237.182942] gem_rx+0x224/0x2f0\n[ 237.186075] macb_poll+0x58/0x100\n[ 237.189384] net_rx_action+0x118/0x400\n[ 237.193125] __do_softirq+0x138/0x36c\n[ 237.196780] irq_exit+0x98/0xc0\n[ 237.199914] __handle_domain_irq+0x64/0xc0\n[ 237.204000] gic_handle_irq+0x5c/0xc0\n[ 237.207654] el1_irq+0xb8/0x140\n[ 237.210789] arch_cpu_idle+0x40/0x200\n[ 237.214444] default_idle_call+0x18/0x30\n[ 237.218359] do_idle+0x200/0x280\n[ 237.221578] cpu_startup_entry+0x20/0x30\n[ 237.225493] rest_init+0xe4/0xf0\n[ 237.228713] arch_call_rest_init+0xc/0x14\n[ 237.232714] start_kernel+0x47c/0x4a8\n[ 237.236367] ---[ end trace 7240980785f81d70 ]---\n\nLars was fast to find an explanation: according to the datasheet\nbit 2 of the rx buffer descriptor entry has a different meaning in the\nextended mode:\n Address [2] of beginning of buffer, or\n in extended buffer descriptor mode (DMA configuration register [28] \u003d 1),\n indicates a valid timestamp in the buffer descriptor entry.\n\nThe macb driver didn\u0027t mask this bit while getting an address and it\neventually caused a memory corruption and a dma failure.\n\nThe problem is resolved by explicitly clearing the problematic bit\nif hw timestamping is used.\n\nFixes: 7b4296148066 (\"net: macb: Add support for PTP timestamps in DMA descriptors\")\nSigned-off-by: Roman Gushchin \u003croman.gushchin@linux.dev\u003e\nCo-developed-by: Lars-Peter Clausen \u003clars@metafoo.de\u003e\nSigned-off-by: Lars-Peter Clausen \u003clars@metafoo.de\u003e\nAcked-by: Nicolas Ferre \u003cnicolas.ferre@microchip.com\u003e\nReviewed-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://lore.kernel.org/r/20230412232144.770336-1-roman.gushchin@linux.dev\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "3a0385be133e7091cc9a9a998c7ec712bb9585db", "tree": "f08b09f0eb2ce8b3ab44c3cafb00610c957ee0a7", "parents": [ "1c5950fc6fe996235f1d18539b9c6b64b597f50f" ], "author": { "name": "Xin Long", "email": "lucien.xin@gmail.com", "time": "Wed Apr 12 11:13:06 2023 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 13 10:04:55 2023 -0700" }, "message": "selftests: add the missing CONFIG_IP_SCTP in net config\n\nThe selftest sctp_vrf needs CONFIG_IP_SCTP set in config\nwhen building the kernel, so add it.\n\nFixes: a61bd7b9fef3 (\"selftests: add a selftest for sctp vrf\")\nReported-by: Naresh Kamboju \u003cnaresh.kamboju@linaro.org\u003e\nSigned-off-by: Xin Long \u003clucien.xin@gmail.com\u003e\nReviewed-by: Sridhar Samudrala \u003csridhar.samudrala@intel.com\u003e\nLink: https://lore.kernel.org/r/61dddebc4d2dd98fe7fb145e24d4b2430e42b572.1681312386.git.lucien.xin@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1c5950fc6fe996235f1d18539b9c6b64b597f50f", "tree": "70d65ea09555a8eaa1a255c7655cc197e7634807", "parents": [ "306dc21361993f4fe50a15d4db6b1a4de5d0adb0" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Wed Apr 12 13:03:08 2023 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 13 10:04:37 2023 -0700" }, "message": "udp6: fix potential access to stale information\n\nlena wang reported an issue caused by udpv6_sendmsg()\nmangling msg-\u003emsg_name and msg-\u003emsg_namelen, which\nare later read from ____sys_sendmsg() :\n\n\t/*\n\t * If this is sendmmsg() and sending to current destination address was\n\t * successful, remember it.\n\t */\n\tif (used_address \u0026\u0026 err \u003e\u003d 0) {\n\t\tused_address-\u003ename_len \u003d msg_sys-\u003emsg_namelen;\n\t\tif (msg_sys-\u003emsg_name)\n\t\t\tmemcpy(\u0026used_address-\u003ename, msg_sys-\u003emsg_name,\n\t\t\t used_address-\u003ename_len);\n\t}\n\nudpv6_sendmsg() wants to pretend the remote address family\nis AF_INET in order to call udp_sendmsg().\n\nA fix would be to modify the address in-place, instead\nof using a local variable, but this could have other side effects.\n\nInstead, restore initial values before we return from udpv6_sendmsg().\n\nFixes: c71d8ebe7a44 (\"net: Fix security_socket_sendmsg() bypass problem.\")\nReported-by: lena wang \u003clena.wang@mediatek.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Maciej Żenczykowski \u003cmaze@google.com\u003e\nLink: https://lore.kernel.org/r/20230412130308.1202254-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "306dc21361993f4fe50a15d4db6b1a4de5d0adb0", "tree": "ae363e205ae7130bb908b6d88238d3a4d86fc9b8", "parents": [ "ecfcc6fbeb57c6b076cddba99f04c6e800b61dff" ], "author": { "name": "Aaron Conole", "email": "aconole@redhat.com", "time": "Wed Apr 12 07:58:28 2023 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 13 10:01:23 2023 -0700" }, "message": "selftests: openvswitch: adjust datapath NL message declaration\n\nThe netlink message for creating a new datapath takes an array\nof ports for the PID creation. This shouldn\u0027t cause much issue\nbut correct it for future cases where we need to do decode of\ndatapath information that could include the per-cpu PID map.\n\nFixes: 25f16c873fb1 (\"selftests: add openvswitch selftest suite\")\nSigned-off-by: Aaron Conole \u003caconole@redhat.com\u003e\nLink: https://lore.kernel.org/r/20230412115828.3991806-1-aconole@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ecfcc6fbeb57c6b076cddba99f04c6e800b61dff", "tree": "03c80239fbb5bde319ee672781d86361eae84adb", "parents": [ "5b7be2d4fd6eb8bec14c2de96c664e07c7d0bd82", "711ae788cbbb82818531b55e32b09518ee09a11a" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 13 09:59:00 2023 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 13 09:59:01 2023 -0700" }, "message": "Merge branch \u0027mptcp-more-fixes-for-6-3\u0027\n\nMatthieu Baerts says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nmptcp: more fixes for 6.3\n\nPatch 1 avoids scheduling the MPTCP worker on a closed socket on some\nedge cases. It fixes issues that can be visible from v5.11.\n\nPatch 2 makes sure the MPTCP worker doesn\u0027t try to manipulate\ndisconnected sockets. This is also a fix for an issue that can be\nvisible from v5.11.\n\nPatch 3 fixes a NULL pointer dereference when MPTCP FastOpen is used\nand an early fallback is done. A fix for v6.2.\n\nPatch 4 improves the stability of the userspace PM selftest for a\nsubtest added in v6.2.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://lore.kernel.org/r/20230411-upstream-net-20230411-mptcp-fixes-v1-0-ca540f3ef986@tessares.net\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "711ae788cbbb82818531b55e32b09518ee09a11a", "tree": "03c80239fbb5bde319ee672781d86361eae84adb", "parents": [ "c0ff6f6da66a7791a32c0234388b1bdc00244917" ], "author": { "name": "Matthieu Baerts", "email": "matthieu.baerts@tessares.net", "time": "Tue Apr 11 22:42:12 2023 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 13 09:58:55 2023 -0700" }, "message": "selftests: mptcp: userspace pm: uniform verify events\n\nSimply adding a \"sleep\" before checking something is usually not a good\nidea because the time that has been picked can not be enough or too\nmuch. The best is to wait for events with a timeout.\n\nIn this selftest, \u0027sleep 0.5\u0027 is used more than 40 times. It is always\nused before calling a \u0027verify_*\u0027 function except for this\nverify_listener_events which has been added later.\n\nAt the end, using all these \u0027sleep 0.5\u0027 seems to work: the slow CIs\ndon\u0027t complain so far. Also because it doesn\u0027t take too much time, we\ncan just add two more \u0027sleep 0.5\u0027 to uniform what is done before calling\na \u0027verify_*\u0027 function. For the same reasons, we can also delay a bigger\nrefactoring to replace all these \u0027sleep 0.5\u0027 by functions waiting for\nevents instead of waiting for a fix time and hope for the best.\n\nFixes: 6c73008aa301 (\"selftests: mptcp: listener test for userspace PM\")\nCc: stable@vger.kernel.org\nSuggested-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nSigned-off-by: Matthieu Baerts \u003cmatthieu.baerts@tessares.net\u003e\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c0ff6f6da66a7791a32c0234388b1bdc00244917", "tree": "497dbc31124fcf1c5548279c653fb401d371dd22", "parents": [ "d6a0443733434408f2cbd4c53fea6910599bab9e" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Apr 11 22:42:11 2023 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 13 09:58:55 2023 -0700" }, "message": "mptcp: fix NULL pointer dereference on fastopen early fallback\n\nIn case of early fallback to TCP, subflow_syn_recv_sock() deletes\nthe subflow context before returning the newly allocated sock to\nthe caller.\n\nThe fastopen path does not cope with the above unconditionally\ndereferencing the subflow context.\n\nFixes: 36b122baf6a8 (\"mptcp: add subflow_v(4,6)_send_synack()\")\nCc: stable@vger.kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nReviewed-by: Matthieu Baerts \u003cmatthieu.baerts@tessares.net\u003e\nSigned-off-by: Matthieu Baerts \u003cmatthieu.baerts@tessares.net\u003e\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d6a0443733434408f2cbd4c53fea6910599bab9e", "tree": "a6f0cde6b41f033e15a9e4893128c7cacda4a8e3", "parents": [ "a5cb752b125766524c921faab1a45cc96065b0a7" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Apr 11 22:42:10 2023 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 13 09:58:55 2023 -0700" }, "message": "mptcp: stricter state check in mptcp_worker\n\nAs reported by Christoph, the mptcp protocol can run the\nworker when the relevant msk socket is in an unexpected state:\n\nconnect()\n// incoming reset + fastclose\n// the mptcp worker is scheduled\nmptcp_disconnect()\n// msk is now CLOSED\nlisten()\nmptcp_worker()\n\nLeading to the following splat:\n\ndivide error: 0000 [#1] PREEMPT SMP\nCPU: 1 PID: 21 Comm: kworker/1:0 Not tainted 6.3.0-rc1-gde5e8fd0123c #11\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014\nWorkqueue: events mptcp_worker\nRIP: 0010:__tcp_select_window+0x22c/0x4b0 net/ipv4/tcp_output.c:3018\nRSP: 0018:ffffc900000b3c98 EFLAGS: 00010293\nRAX: 000000000000ffd7 RBX: 000000000000ffd7 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: ffffffff8214ce97 RDI: 0000000000000004\nRBP: 000000000000ffd7 R08: 0000000000000004 R09: 0000000000010000\nR10: 000000000000ffd7 R11: ffff888005afa148 R12: 000000000000ffd7\nR13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\nFS: 0000000000000000(0000) GS:ffff88803ed00000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000405270 CR3: 000000003011e006 CR4: 0000000000370ee0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n tcp_select_window net/ipv4/tcp_output.c:262 [inline]\n __tcp_transmit_skb+0x356/0x1280 net/ipv4/tcp_output.c:1345\n tcp_transmit_skb net/ipv4/tcp_output.c:1417 [inline]\n tcp_send_active_reset+0x13e/0x320 net/ipv4/tcp_output.c:3459\n mptcp_check_fastclose net/mptcp/protocol.c:2530 [inline]\n mptcp_worker+0x6c7/0x800 net/mptcp/protocol.c:2705\n process_one_work+0x3bd/0x950 kernel/workqueue.c:2390\n worker_thread+0x5b/0x610 kernel/workqueue.c:2537\n kthread+0x138/0x170 kernel/kthread.c:376\n ret_from_fork+0x2c/0x50 arch/x86/entry/entry_64.S:308\n \u003c/TASK\u003e\n\nThis change addresses the issue explicitly checking for bad states\nbefore running the mptcp worker.\n\nFixes: e16163b6e2b7 (\"mptcp: refactor shutdown and close\")\nCc: stable@vger.kernel.org\nReported-by: Christoph Paasch \u003ccpaasch@apple.com\u003e\nLink: https://github.com/multipath-tcp/mptcp_net-next/issues/374\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nReviewed-by: Matthieu Baerts \u003cmatthieu.baerts@tessares.net\u003e\nTested-by: Christoph Paasch \u003ccpaasch@apple.com\u003e\nSigned-off-by: Matthieu Baerts \u003cmatthieu.baerts@tessares.net\u003e\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a5cb752b125766524c921faab1a45cc96065b0a7", "tree": "6f9fd2b692c99934f2712ad5f12a19c9eb330985", "parents": [ "5b7be2d4fd6eb8bec14c2de96c664e07c7d0bd82" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Apr 11 22:42:09 2023 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 13 09:58:55 2023 -0700" }, "message": "mptcp: use mptcp_schedule_work instead of open-coding it\n\nBeyond reducing code duplication this also avoids scheduling\nthe mptcp_worker on a closed socket on some edge scenarios.\n\nThe addressed issue is actually older than the blamed commit\nbelow, but this fix needs it as a pre-requisite.\n\nFixes: ba8f48f7a4d7 (\"mptcp: introduce mptcp_schedule_work\")\nCc: stable@vger.kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nReviewed-by: Matthieu Baerts \u003cmatthieu.baerts@tessares.net\u003e\nSigned-off-by: Matthieu Baerts \u003cmatthieu.baerts@tessares.net\u003e\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a552b73f36cb3e59fd2015307fde8ff53874d1af", "tree": "5d441488477711c6a438b505bdafe0a02b852c16", "parents": [ "62b92afd6e253fab3b4cf1bbb614e270a848e98f", "6b8446859c971a5783a2cdc90adf32e64de3bd23" ], "author": { "name": "Daniel Vetter", "email": "daniel.vetter@ffwll.ch", "time": "Thu Apr 13 14:24:44 2023 +0200" }, "committer": { "name": "Daniel Vetter", "email": "daniel.vetter@ffwll.ch", "time": "Thu Apr 13 14:24:45 2023 +0200" }, "message": "Merge tag \u0027drm-intel-fixes-2023-04-13\u0027 of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes\n\ndrm/i915 fixes for v6.3-rc7:\n- Fix dual link DSI for TGL+\n\nSigned-off-by: Daniel Vetter \u003cdaniel.vetter@ffwll.ch\u003e\nFrom: Jani Nikula \u003cjani.nikula@intel.com\u003e\nLink: https://patchwork.freedesktop.org/patch/msgid/877cugckzu.fsf@intel.com\n" }, { "commit": "5b7be2d4fd6eb8bec14c2de96c664e07c7d0bd82", "tree": "dd29fddf3ac72a1ca3311052bdbc2a96bc6fd1cf", "parents": [ "32832a2caf82663870126c5186cf8f86c8b2a649" ], "author": { "name": "Vladimir Oltean", "email": "vladimir.oltean@nxp.com", "time": "Tue Apr 11 22:26:45 2023 +0300" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 13 12:42:54 2023 +0200" }, "message": "net: enetc: workaround for unresponsive pMAC after receiving express traffic\n\nI have observed an issue where the RX direction of the LS1028A ENETC pMAC\nseems unresponsive. The minimal procedure to reproduce the issue is:\n\n1. Connect ENETC port 0 with a loopback RJ45 cable to one of the Felix\n switch ports (0).\n\n2. Bring the ports up (MAC Merge layer is not enabled on either end).\n\n3. Send a large quantity of unidirectional (express) traffic from Felix\n to ENETC. I tried altering frame size and frame count, and it doesn\u0027t\n appear to be specific to either of them, but rather, to the quantity\n of octets received. Lowering the frame count, the minimum quantity of\n packets to reproduce relatively consistently seems to be around 37000\n frames at 1514 octets (w/o FCS) each.\n\n4. Using ethtool --set-mm, enable the pMAC in the Felix and in the ENETC\n ports, in both RX and TX directions, and with verification on both\n ends.\n\n5. Wait for verification to complete on both sides.\n\n6. Configure a traffic class as preemptible on both ends.\n\n7. Send some packets again.\n\nThe issue is at step 5, where the verification process of ENETC ends\n(meaning that Felix responds with an SMD-R and ENETC sees the response),\nbut the verification process of Felix never ends (it remains VERIFYING).\n\nIf step 3 is skipped or if ENETC receives less traffic than\napproximately that threshold, the test runs all the way through\n(verification succeeds on both ends, preemptible traffic passes fine).\n\nIf, between step 4 and 5, the step below is also introduced:\n\n4.1. Disable and re-enable PM0_COMMAND_CONFIG bit RX_EN\n\nthen again, the sequence of steps runs all the way through, and\nverification succeeds, even if there was the previous RX traffic\ninjected into ENETC.\n\nTraffic sent *by* the ENETC port prior to enabling the MAC Merge layer\ndoes not seem to influence the verification result, only received\ntraffic does.\n\nThe LS1028A manual does not mention any relationship between\nPM0_COMMAND_CONFIG and MMCSR, and the hardware people don\u0027t seem to\nknow for now either.\n\nThe bit that is toggled to work around the issue is also toggled\nby enetc_mac_enable(), called from phylink\u0027s mac_link_down() and\nmac_link_up() methods - which is how the workaround was found:\nverification would work after a link down/up.\n\nFixes: c7b9e8086902 (\"net: enetc: add support for MAC Merge layer\")\nSigned-off-by: Vladimir Oltean \u003cvladimir.oltean@nxp.com\u003e\nReviewed-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://lore.kernel.org/r/20230411192645.1896048-1-vladimir.oltean@nxp.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "32832a2caf82663870126c5186cf8f86c8b2a649", "tree": "c53ebff8f60f06b37bd7b35c9aaacc3b270c931e", "parents": [ "6417070918de3bcdbe0646e7256dae58fd8083ba" ], "author": { "name": "Xin Long", "email": "lucien.xin@gmail.com", "time": "Mon Apr 10 15:43:30 2023 -0400" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 13 10:01:59 2023 +0200" }, "message": "sctp: fix a potential overflow in sctp_ifwdtsn_skip\n\nCurrently, when traversing ifwdtsn skips with _sctp_walk_ifwdtsn, it only\nchecks the pos against the end of the chunk. However, the data left for\nthe last pos may be \u003c sizeof(struct sctp_ifwdtsn_skip), and dereference\nit as struct sctp_ifwdtsn_skip may cause coverflow.\n\nThis patch fixes it by checking the pos against \"the end of the chunk -\nsizeof(struct sctp_ifwdtsn_skip)\" in sctp_ifwdtsn_skip, similar to\nsctp_fwdtsn_skip.\n\nFixes: 0fc2ea922c8a (\"sctp: implement validate_ftsn for sctp_stream_interleave\")\nSigned-off-by: Xin Long \u003clucien.xin@gmail.com\u003e\nLink: https://lore.kernel.org/r/2a71bffcd80b4f2c61fac6d344bb2f11c8fd74f7.1681155810.git.lucien.xin@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "62b92afd6e253fab3b4cf1bbb614e270a848e98f", "tree": "1f1f0d4187d9ad17eae54619ada25d4fa1f4a115", "parents": [ "09a9639e56c01c7a00d6c0ca63f4c7c41abe075d", "b9a24d8bd51e2db425602fa82d7f4c06aa3db852" ], "author": { "name": "Daniel Vetter", "email": "daniel.vetter@ffwll.ch", "time": "Thu Apr 13 09:57:19 2023 +0200" }, "committer": { "name": "Daniel Vetter", "email": "daniel.vetter@ffwll.ch", "time": "Thu Apr 13 09:57:19 2023 +0200" }, "message": "Merge tag \u0027amd-drm-fixes-6.3-2023-04-12\u0027 of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes\n\namd-drm-fixes-6.3-2023-04-12:\n\namdgpu:\n- SMU13 fixes\n- DP MST fix\n\nSigned-off-by: Daniel Vetter \u003cdaniel.vetter@ffwll.ch\u003e\nFrom: Alex Deucher \u003calexander.deucher@amd.com\u003e\nLink: https://patchwork.freedesktop.org/patch/msgid/20230412215637.7881-1-alexander.deucher@amd.com\n" }, { "commit": "6417070918de3bcdbe0646e7256dae58fd8083ba", "tree": "f498ec96216dd9aed85a0fa90dc5b3a156446590", "parents": [ "59d3efd27c11c59b32291e5ebc307bed2edb65ee" ], "author": { "name": "Ziyang Xuan", "email": "william.xuanziyang@huawei.com", "time": "Mon Apr 10 09:23:52 2023 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 13 09:35:30 2023 +0200" }, "message": "net: qrtr: Fix an uninit variable access bug in qrtr_tx_resume()\n\nSyzbot reported a bug as following:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nBUG: KMSAN: uninit-value in qrtr_tx_resume+0x185/0x1f0 net/qrtr/af_qrtr.c:230\n qrtr_tx_resume+0x185/0x1f0 net/qrtr/af_qrtr.c:230\n qrtr_endpoint_post+0xf85/0x11b0 net/qrtr/af_qrtr.c:519\n qrtr_tun_write_iter+0x270/0x400 net/qrtr/tun.c:108\n call_write_iter include/linux/fs.h:2189 [inline]\n aio_write+0x63a/0x950 fs/aio.c:1600\n io_submit_one+0x1d1c/0x3bf0 fs/aio.c:2019\n __do_sys_io_submit fs/aio.c:2078 [inline]\n __se_sys_io_submit+0x293/0x770 fs/aio.c:2048\n __x64_sys_io_submit+0x92/0xd0 fs/aio.c:2048\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nUninit was created at:\n slab_post_alloc_hook mm/slab.h:766 [inline]\n slab_alloc_node mm/slub.c:3452 [inline]\n __kmem_cache_alloc_node+0x71f/0xce0 mm/slub.c:3491\n __do_kmalloc_node mm/slab_common.c:967 [inline]\n __kmalloc_node_track_caller+0x114/0x3b0 mm/slab_common.c:988\n kmalloc_reserve net/core/skbuff.c:492 [inline]\n __alloc_skb+0x3af/0x8f0 net/core/skbuff.c:565\n __netdev_alloc_skb+0x120/0x7d0 net/core/skbuff.c:630\n qrtr_endpoint_post+0xbd/0x11b0 net/qrtr/af_qrtr.c:446\n qrtr_tun_write_iter+0x270/0x400 net/qrtr/tun.c:108\n call_write_iter include/linux/fs.h:2189 [inline]\n aio_write+0x63a/0x950 fs/aio.c:1600\n io_submit_one+0x1d1c/0x3bf0 fs/aio.c:2019\n __do_sys_io_submit fs/aio.c:2078 [inline]\n __se_sys_io_submit+0x293/0x770 fs/aio.c:2048\n __x64_sys_io_submit+0x92/0xd0 fs/aio.c:2048\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nIt is because that skb-\u003elen requires at least sizeof(struct qrtr_ctrl_pkt)\nin qrtr_tx_resume(). And skb-\u003elen equals to size in qrtr_endpoint_post().\nBut size is less than sizeof(struct qrtr_ctrl_pkt) when qrtr_cb-\u003etype\nequals to QRTR_TYPE_RESUME_TX in qrtr_endpoint_post() under the syzbot\nscenario. This triggers the uninit variable access bug.\n\nAdd size check when qrtr_cb-\u003etype equals to QRTR_TYPE_RESUME_TX in\nqrtr_endpoint_post() to fix the bug.\n\nFixes: 5fdeb0d372ab (\"net: qrtr: Implement outgoing flow control\")\nReported-by: syzbot+4436c9630a45820fda76@syzkaller.appspotmail.com\nLink: https://syzkaller.appspot.com/bug?id\u003dc14607f0963d27d5a3d5f4c8639b500909e43540\nSuggested-by: Manivannan Sadhasivam \u003cmani@kernel.org\u003e\nSigned-off-by: Ziyang Xuan \u003cwilliam.xuanziyang@huawei.com\u003e\nReviewed-by: Simon Horman \u003csimon.horman@corigine.com\u003e\nLink: https://lore.kernel.org/r/20230410012352.3997823-1-william.xuanziyang@huawei.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "59d3efd27c11c59b32291e5ebc307bed2edb65ee", "tree": "ce16413675c1a6a99ecad9f1ddcdb61aed9e9371", "parents": [ "136f36c74b0345d5d0087d4094894a006470bbd5" ], "author": { "name": "Martin Willi", "email": "martin@strongswan.org", "time": "Tue Apr 11 09:43:19 2023 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 12 20:47:58 2023 -0700" }, "message": "rtnetlink: Restore RTM_NEW/DELLINK notification behavior\n\nThe commits referenced below allows userspace to use the NLM_F_ECHO flag\nfor RTM_NEW/DELLINK operations to receive unicast notifications for the\naffected link. Prior to these changes, applications may have relied on\nmulticast notifications to learn the same information without specifying\nthe NLM_F_ECHO flag.\n\nFor such applications, the mentioned commits changed the behavior for\nrequests not using NLM_F_ECHO. Multicast notifications are still received,\nbut now use the portid of the requester and the sequence number of the\nrequest instead of zero values used previously. For the application, this\nmessage may be unexpected and likely handled as a response to the\nNLM_F_ACKed request, especially if it uses the same socket to handle\nrequests and notifications.\n\nTo fix existing applications relying on the old notification behavior,\nset the portid and sequence number in the notification only if the\nrequest included the NLM_F_ECHO flag. This restores the old behavior\nfor applications not using it, but allows unicasted notifications for\nothers.\n\nFixes: f3a63cce1b4f (\"rtnetlink: Honour NLM_F_ECHO flag in rtnl_delete_link\")\nFixes: d88e136cab37 (\"rtnetlink: Honour NLM_F_ECHO flag in rtnl_newlink_create\")\nSigned-off-by: Martin Willi \u003cmartin@strongswan.org\u003e\nAcked-by: Guillaume Nault \u003cgnault@redhat.com\u003e\nAcked-by: Hangbin Liu \u003cliuhangbin@gmail.com\u003e\nLink: https://lore.kernel.org/r/20230411074319.24133-1-martin@strongswan.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "de4664485abbc0529b1eec44d0061bbfe58a28fb", "tree": "e0a3690791cbb21c9bee9aab5a640b2ce443930d", "parents": [ "b05e0f5e74e48a3e39066794fc1d7df37507953d", "38518593ec55e897abda4b4be77b2ec8ec4447d1" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Apr 12 17:26:00 2023 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Apr 12 17:26:00 2023 -0700" }, "message": "Merge tag \u0027for-linus-2023041201\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid\n\nPull HID fixes from Jiri Kosina:\n\n - kernel panic fix for intel-ish-hid driver (Tanu Malhotra)\n\n - buffer overflow fix in hid-sensor-custom driver (Todd Brandt)\n\n - two device specific quirks (Alessandro Manca, Philippe Troin)\n\n* tag \u0027for-linus-2023041201\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid:\n HID: intel-ish-hid: Fix kernel panic during warm reset\n HID: hid-sensor-custom: Fix buffer overrun in device name\n HID: topre: Add support for 87 keys Realforce R2\n HID: add HP 13t-aw100 \u0026 14t-ea100 digitizer battery quirks\n" }, { "commit": "b05e0f5e74e48a3e39066794fc1d7df37507953d", "tree": "aabfd4f2dc870dcec975186cdfab21e8f063c003", "parents": [ "0bcc4025550403ae28d2984bddacafbca0a2f112", "d9503be5a100c553731c0e8a82c7b4201e8a970c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Apr 12 17:20:55 2023 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Apr 12 17:20:55 2023 -0700" }, "message": "Merge tag \u0027dmaengine-fix-6.3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine\n\nPull dmaengine fixes from Vinod Koul:\n \"A couple of fixes in apple driver, core and kernedoc fix for dmaengine\n subsystem:\n\n - apple admac driver fixes for current_tx, src_addr_widths and\n global\u0027 interrupt flags handling\n\n - xdma kerneldoc fix\n\n - core fix for use of devm_add_action_or_reset\"\n\n* tag \u0027dmaengine-fix-6.3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine:\n dmaengine: apple-admac: Fix \u0027current_tx\u0027 not getting freed\n dmaengine: apple-admac: Set src_addr_widths capability\n dmaengine: apple-admac: Handle \u0027global\u0027 interrupt flags\n dmaengine: xilinx: xdma: Fix some kernel-doc comments\n dmaengine: Actually use devm_add_action_or_reset()\n" }, { "commit": "b9a24d8bd51e2db425602fa82d7f4c06aa3db852", "tree": "1f1f0d4187d9ad17eae54619ada25d4fa1f4a115", "parents": [ "85e0689eb6b10cd3b2fb455d1b3f4d4d0b13ff78" ], "author": { "name": "Evan Quan", "email": "evan.quan@amd.com", "time": "Fri Apr 07 17:12:15 2023 +0800" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Wed Apr 12 16:11:22 2023 -0400" }, "message": "drm/amd/pm: correct the pcie link state check for SMU13\n\nUpdate the driver implementations to fit those data exposed\nby PMFW.\n\nSigned-off-by: Evan Quan \u003cevan.quan@amd.com\u003e\nAcked-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nCc: stable@vger.kernel.org # 6.1.x\n" }, { "commit": "85e0689eb6b10cd3b2fb455d1b3f4d4d0b13ff78", "tree": "d0e11435b37722ff79b706bceab873800b76bae5", "parents": [ "f06b8887e3ef4f50098d3a949aef392c529c831a" ], "author": { "name": "Horatio Zhang", "email": "Hongkun.Zhang@amd.com", "time": "Thu Apr 06 13:32:14 2023 +0800" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Wed Apr 12 16:11:21 2023 -0400" }, "message": "drm/amd/pm: correct SMU13.0.7 max shader clock reporting\n\nCorrect the max shader clock reporting on SMU\n13.0.7.\n\nSigned-off-by: Horatio Zhang \u003cHongkun.Zhang@amd.com\u003e\nReviewed-by: Kenneth Feng \u003ckenneth.feng@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nCc: stable@vger.kernel.org # 6.1.x\n" }, { "commit": "f06b8887e3ef4f50098d3a949aef392c529c831a", "tree": "8645d20eb54ee868970ff463801e23b077d41a96", "parents": [ "b8ca445f550a9a079134f836466ddda3bfad6108" ], "author": { "name": "Horatio Zhang", "email": "Hongkun.Zhang@amd.com", "time": "Thu Apr 06 11:17:38 2023 +0800" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Wed Apr 12 16:11:21 2023 -0400" }, "message": "drm/amd/pm: correct SMU13.0.7 pstate profiling clock settings\n\nCorrect the pstate standard/peak profiling mode clock\nsettings for SMU13.0.7.\n\nSigned-off-by: Horatio Zhang \u003cHongkun.Zhang@amd.com\u003e\nReviewed-by: Kenneth Feng \u003ckenneth.feng@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nCc: stable@vger.kernel.org # 6.1.x\n" }, { "commit": "b8ca445f550a9a079134f836466ddda3bfad6108", "tree": "8f6f1f181968e75de41dbd465b4aa4e2e1abe092", "parents": [ "09a9639e56c01c7a00d6c0ca63f4c7c41abe075d" ], "author": { "name": "Wayne Lin", "email": "Wayne.Lin@amd.com", "time": "Fri Feb 17 13:26:56 2023 +0800" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Wed Apr 12 16:11:17 2023 -0400" }, "message": "drm/amd/display: Pass the right info to drm_dp_remove_payload\n\n[Why \u0026 How]\ndrm_dp_remove_payload() interface was changed. Correct amdgpu dm code\nto pass the right parameter to the drm helper function.\n\nReviewed-by: Jerry Zuo \u003cJerry.Zuo@amd.com\u003e\nAcked-by: Qingqing Zhuo \u003cqingqing.zhuo@amd.com\u003e\nSigned-off-by: Wayne Lin \u003cWayne.Lin@amd.com\u003e\nTested-by: Daniel Wheeler \u003cdaniel.wheeler@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n" }, { "commit": "7e27cb6ad4d85fc8bac2a2a896da62ef66b8598e", "tree": "fcba6d0b65c67f720e6410ba684637295bf960bd", "parents": [ "eee87853794187f6adbe19533ed79c8b44b36a91" ], "author": { "name": "Waiman Long", "email": "longman@redhat.com", "time": "Tue Apr 11 09:36:00 2023 -0400" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Wed Apr 12 08:23:58 2023 -1000" }, "message": "cgroup/cpuset: Make cpuset_attach_task() skip subpartitions CPUs for top_cpuset\n\nIt is found that attaching a task to the top_cpuset does not currently\nignore CPUs allocated to subpartitions in cpuset_attach_task(). So the\ncode is changed to fix that.\n\nSigned-off-by: Waiman Long \u003clongman@redhat.com\u003e\nReviewed-by: Michal Koutný \u003cmkoutny@suse.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\n" }, { "commit": "eee87853794187f6adbe19533ed79c8b44b36a91", "tree": "326dbfa685987b930fa1bcf0ac0e01f2e1e4b92f", "parents": [ "42a11bf5c5436e91b040aeb04063be1710bb9f9c" ], "author": { "name": "Waiman Long", "email": "longman@redhat.com", "time": "Tue Apr 11 09:35:59 2023 -0400" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Wed Apr 12 08:23:58 2023 -1000" }, "message": "cgroup/cpuset: Add cpuset_can_fork() and cpuset_cancel_fork() methods\n\nIn the case of CLONE_INTO_CGROUP, not all cpusets are ready to accept\nnew tasks. It is too late to check that in cpuset_fork(). So we need\nto add the cpuset_can_fork() and cpuset_cancel_fork() methods to\npre-check it before we can allow attachment to a different cpuset.\n\nWe also need to set the attach_in_progress flag to alert other code\nthat a new task is going to be added to the cpuset.\n\nFixes: ef2c41cf38a7 (\"clone3: allow spawning processes into cgroups\")\nSuggested-by: Michal Koutný \u003cmkoutny@suse.com\u003e\nSigned-off-by: Waiman Long \u003clongman@redhat.com\u003e\nCc: stable@vger.kernel.org # v5.7+\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\n" }, { "commit": "42a11bf5c5436e91b040aeb04063be1710bb9f9c", "tree": "ff02e5249b0b5f2e8f16c820c57c0339fd2e5217", "parents": [ "ba9182a89626d5f83c2ee4594f55cb9c1e60f0e2" ], "author": { "name": "Waiman Long", "email": "longman@redhat.com", "time": "Tue Apr 11 09:35:58 2023 -0400" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Wed Apr 12 08:23:58 2023 -1000" }, "message": "cgroup/cpuset: Make cpuset_fork() handle CLONE_INTO_CGROUP properly\n\nBy default, the clone(2) syscall spawn a child process into the same\ncgroup as its parent. With the use of the CLONE_INTO_CGROUP flag\nintroduced by commit ef2c41cf38a7 (\"clone3: allow spawning processes\ninto cgroups\"), the child will be spawned into a different cgroup which\nis somewhat similar to writing the child\u0027s tid into \"cgroup.threads\".\n\nThe current cpuset_fork() method does not properly handle the\nCLONE_INTO_CGROUP case where the cpuset of the child may be different\nfrom that of its parent. Update the cpuset_fork() method to treat the\nCLONE_INTO_CGROUP case similar to cpuset_attach().\n\nSince the newly cloned task has not been running yet, its actual\nmemory usage isn\u0027t known. So it is not necessary to make change to mm\nin cpuset_fork().\n\nFixes: ef2c41cf38a7 (\"clone3: allow spawning processes into cgroups\")\nReported-by: Giuseppe Scrivano \u003cgscrivan@redhat.com\u003e\nSigned-off-by: Waiman Long \u003clongman@redhat.com\u003e\nCc: stable@vger.kernel.org # v5.7+\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\n" }, { "commit": "ba9182a89626d5f83c2ee4594f55cb9c1e60f0e2", "tree": "c932a0a2c3b593f3f4d6ffd90bcffbb6dad9cdc9", "parents": [ "57dcd64c7e036299ef526b400a8d12b8a2352f26" ], "author": { "name": "Waiman Long", "email": "longman@redhat.com", "time": "Tue Apr 11 09:35:57 2023 -0400" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Wed Apr 12 08:23:58 2023 -1000" }, "message": "cgroup/cpuset: Wake up cpuset_attach_wq tasks in cpuset_cancel_attach()\n\nAfter a successful cpuset_can_attach() call which increments the\nattach_in_progress flag, either cpuset_cancel_attach() or cpuset_attach()\nwill be called later. In cpuset_attach(), tasks in cpuset_attach_wq,\nif present, will be woken up at the end. That is not the case in\ncpuset_cancel_attach(). So missed wakeup is possible if the attach\noperation is somehow cancelled. Fix that by doing the wakeup in\ncpuset_cancel_attach() as well.\n\nFixes: e44193d39e8d (\"cpuset: let hotplug propagation work wait for task attaching\")\nSigned-off-by: Waiman Long \u003clongman@redhat.com\u003e\nReviewed-by: Michal Koutný \u003cmkoutny@suse.com\u003e\nCc: stable@vger.kernel.org # v3.11+\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\n" }, { "commit": "57dcd64c7e036299ef526b400a8d12b8a2352f26", "tree": "d1d3ce7f7c94faf2c288ca7d7c4ef79bc19260c9", "parents": [ "292fd843de26c551856e66faf134512c52dd78b4" ], "author": { "name": "Tetsuo Handa", "email": "penguin-kernel@I-love.SAKURA.ne.jp", "time": "Wed Apr 05 22:15:32 2023 +0900" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Wed Apr 12 07:30:28 2023 -1000" }, "message": "cgroup,freezer: hold cpu_hotplug_lock before freezer_mutex\n\nsyzbot is reporting circular locking dependency between cpu_hotplug_lock\nand freezer_mutex, for commit f5d39b020809 (\"freezer,sched: Rewrite core\nfreezer logic\") replaced atomic_inc() in freezer_apply_state() with\nstatic_branch_inc() which holds cpu_hotplug_lock.\n\ncpu_hotplug_lock \u003d\u003e cgroup_threadgroup_rwsem \u003d\u003e freezer_mutex\n\n cgroup_file_write() {\n cgroup_procs_write() {\n __cgroup_procs_write() {\n cgroup_procs_write_start() {\n cgroup_attach_lock() {\n cpus_read_lock() {\n percpu_down_read(\u0026cpu_hotplug_lock);\n }\n percpu_down_write(\u0026cgroup_threadgroup_rwsem);\n }\n }\n cgroup_attach_task() {\n cgroup_migrate() {\n cgroup_migrate_execute() {\n freezer_attach() {\n mutex_lock(\u0026freezer_mutex);\n (...snipped...)\n }\n }\n }\n }\n (...snipped...)\n }\n }\n }\n\nfreezer_mutex \u003d\u003e cpu_hotplug_lock\n\n cgroup_file_write() {\n freezer_write() {\n freezer_change_state() {\n mutex_lock(\u0026freezer_mutex);\n freezer_apply_state() {\n static_branch_inc(\u0026freezer_active) {\n static_key_slow_inc() {\n cpus_read_lock();\n static_key_slow_inc_cpuslocked();\n cpus_read_unlock();\n }\n }\n }\n mutex_unlock(\u0026freezer_mutex);\n }\n }\n }\n\nSwap locking order by moving cpus_read_lock() in freezer_apply_state()\nto before mutex_lock(\u0026freezer_mutex) in freezer_change_state().\n\nReported-by: syzbot \u003csyzbot+c39682e86c9d84152f93@syzkaller.appspotmail.com\u003e\nLink: https://syzkaller.appspot.com/bug?extid\u003dc39682e86c9d84152f93\nSuggested-by: Hillf Danton \u003chdanton@sina.com\u003e\nFixes: f5d39b020809 (\"freezer,sched: Rewrite core freezer logic\")\nSigned-off-by: Tetsuo Handa \u003cpenguin-kernel@I-love.SAKURA.ne.jp\u003e\nAcked-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nReviewed-by: Mukesh Ojha \u003cquic_mojha@quicinc.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\n" }, { "commit": "0bcc4025550403ae28d2984bddacafbca0a2f112", "tree": "8a63e18c5c0d584a1ce2ba22bcc6765443392edb", "parents": [ "e62252bc55b6d4eddc6c2bdbf95a448180d6a08d" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Wed Apr 12 13:18:57 2023 +0100" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Apr 12 09:26:36 2023 -0700" }, "message": "netfs: Fix netfs_extract_iter_to_sg() for ITER_UBUF/IOVEC\n\nFix netfs_extract_iter_to_sg() for ITER_UBUF and ITER_IOVEC to set the\nsize of the page to the part of the page extracted, not the remaining\namount of data in the extracted page array at that point.\n\nThis doesn\u0027t yet affect anything as cifs, the only current user, only\npasses in non-user-backed iterators.\n\nFixes: 018584697533 (\"netfs: Add a function to extract an iterator into a scatterlist\")\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nReviewed-by: Jeff Layton \u003cjlayton@kernel.org\u003e\nCc: Steve French \u003csfrench@samba.org\u003e\nCc: Shyam Prasad N \u003cnspmangalore@gmail.com\u003e\nCc: Rohith Surabattula \u003crohiths.msft@gmail.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "5603effb8295ada8419408d038a34ca89d658229", "tree": "b06d8e309631d507c7b030e943b8479e2d15250b", "parents": [ "b89ce1177d42d5c124e83f3858818cd4e6a2c46f", "09a9639e56c01c7a00d6c0ca63f4c7c41abe075d" ], "author": { "name": "Maarten Lankhorst", "email": "maarten.lankhorst@linux.intel.com", "time": "Wed Apr 12 12:01:32 2023 +0200" }, "committer": { "name": "Maarten Lankhorst", "email": "maarten.lankhorst@linux.intel.com", "time": "Wed Apr 12 12:01:32 2023 +0200" }, "message": "Merge remote-tracking branch \u0027drm/drm-fixes\u0027 into drm-misc-fixes\n\nWe were stuck on rc2, should at least attempt to track drm-fixes\nslightly.\n\nSigned-off-by: Maarten Lankhorst \u003cmaarten.lankhorst@linux.intel.com\u003e\n" }, { "commit": "136f36c74b0345d5d0087d4094894a006470bbd5", "tree": "28a564b5d9a8e22e69d70cc580050cf0aae21988", "parents": [ "a56ef25619e079bd7d744636cf18d054d1e91982" ], "author": { "name": "Rob Herring", "email": "robh@kernel.org", "time": "Mon Apr 10 18:27:19 2023 -0500" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Apr 12 10:54:12 2023 +0100" }, "message": "net: ti/cpsw: Add explicit platform_device.h and of_platform.h includes\n\nTI CPSW uses of_platform_* functions which are declared in of_platform.h.\nof_platform.h gets implicitly included by of_device.h, but that is going\nto be removed soon. Nothing else depends on of_device.h so it can be\ndropped. of_platform.h also implicitly includes platform_device.h, so\nadd an explicit include for it, too.\n\nSigned-off-by: Rob Herring \u003crobh@kernel.org\u003e\nReviewed-by: Jesse Brandeburg \u003cjesse.brandeburg@intel.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "a56ef25619e079bd7d744636cf18d054d1e91982", "tree": "3d2a7f9a47bbe246c0d2452d520891c9d68eb844", "parents": [ "9744d2bf19762703704ecba885b7ac282c02eacf" ], "author": { "name": "Harshit Mogalapalli", "email": "harshit.m.mogalapalli@oracle.com", "time": "Sat Apr 08 12:43:21 2023 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Apr 12 10:45:32 2023 +0100" }, "message": "net: wwan: iosm: Fix error handling path in ipc_pcie_probe()\n\nSmatch reports:\n\tdrivers/net/wwan/iosm/iosm_ipc_pcie.c:298 ipc_pcie_probe()\n\twarn: missing unwind goto?\n\nWhen dma_set_mask fails it directly returns without disabling pci\ndevice and freeing ipc_pcie. Fix this my calling a correct goto label\n\nAs dma_set_mask returns either 0 or -EIO, we can use a goto label, as\nit finally returns -EIO.\n\nAdd a set_mask_fail goto label which stands consistent with other goto\nlabels in this function..\n\nFixes: 035e3befc191 (\"net: wwan: iosm: fix driver not working with INTEL_IOMMU disabled\")\nReviewed-by: Simon Horman \u003csimon.horman@corigine.com\u003e\nSigned-off-by: Harshit Mogalapalli \u003charshit.m.mogalapalli@oracle.com\u003e\nReviewed-by: Simon Horman \u003csimon.horman@corigine.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "9744d2bf19762703704ecba885b7ac282c02eacf", "tree": "e1c64a64b0d2355b1ca8211b7225730ab703bf8f", "parents": [ "7573099e10ca69c3be33995c1fcd0d241226816d" ], "author": { "name": "Kuniyuki Iwashima", "email": "kuniyu@amazon.com", "time": "Sat Apr 08 11:49:43 2023 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Apr 12 10:37:00 2023 +0100" }, "message": "smc: Fix use-after-free in tcp_write_timer_handler().\n\nWith Eric\u0027s ref tracker, syzbot finally found a repro for\nuse-after-free in tcp_write_timer_handler() by kernel TCP\nsockets. [0]\n\nIf SMC creates a kernel socket in __smc_create(), the kernel\nsocket is supposed to be freed in smc_clcsock_release() by\ncalling sock_release() when we close() the parent SMC socket.\n\nHowever, at the end of smc_clcsock_release(), the kernel\nsocket\u0027s sk_state might not be TCP_CLOSE. This means that\nwe have not called inet_csk_destroy_sock() in __tcp_close()\nand have not stopped the TCP timers.\n\nThe kernel socket\u0027s TCP timers can be fired later, so we\nneed to hold a refcnt for net as we do for MPTCP subflows\nin mptcp_subflow_create_socket().\n\n[0]:\nleaked reference.\n sk_alloc (./include/net/net_namespace.h:335 net/core/sock.c:2108)\n inet_create (net/ipv4/af_inet.c:319 net/ipv4/af_inet.c:244)\n __sock_create (net/socket.c:1546)\n smc_create (net/smc/af_smc.c:3269 net/smc/af_smc.c:3284)\n __sock_create (net/socket.c:1546)\n __sys_socket (net/socket.c:1634 net/socket.c:1618 net/socket.c:1661)\n __x64_sys_socket (net/socket.c:1672)\n do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120)\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nBUG: KASAN: slab-use-after-free in tcp_write_timer_handler (net/ipv4/tcp_timer.c:378 net/ipv4/tcp_timer.c:624 net/ipv4/tcp_timer.c:594)\nRead of size 1 at addr ffff888052b65e0d by task syzrepro/18091\n\nCPU: 0 PID: 18091 Comm: syzrepro Tainted: G W 6.3.0-rc4-01174-gb5d54eb5899a #7\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-1.amzn2022.0.1 04/01/2014\nCall Trace:\n \u003cIRQ\u003e\n dump_stack_lvl (lib/dump_stack.c:107)\n print_report (mm/kasan/report.c:320 mm/kasan/report.c:430)\n kasan_report (mm/kasan/report.c:538)\n tcp_write_timer_handler (net/ipv4/tcp_timer.c:378 net/ipv4/tcp_timer.c:624 net/ipv4/tcp_timer.c:594)\n tcp_write_timer (./include/linux/spinlock.h:390 net/ipv4/tcp_timer.c:643)\n call_timer_fn (./arch/x86/include/asm/jump_label.h:27 ./include/linux/jump_label.h:207 ./include/trace/events/timer.h:127 kernel/time/timer.c:1701)\n __run_timers.part.0 (kernel/time/timer.c:1752 kernel/time/timer.c:2022)\n run_timer_softirq (kernel/time/timer.c:2037)\n __do_softirq (./arch/x86/include/asm/jump_label.h:27 ./include/linux/jump_label.h:207 ./include/trace/events/irq.h:142 kernel/softirq.c:572)\n __irq_exit_rcu (kernel/softirq.c:445 kernel/softirq.c:650)\n irq_exit_rcu (kernel/softirq.c:664)\n sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1107 (discriminator 14))\n \u003c/IRQ\u003e\n\nFixes: ac7138746e14 (\"smc: establish new socket family\")\nReported-by: syzbot+7e1e1bdb852961150198@syzkaller.appspotmail.com\nLink: https://lore.kernel.org/netdev/000000000000a3f51805f8bcc43a@google.com/\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@amazon.com\u003e\nReviewed-by: Tony Lu \u003ctonylu@linux.alibaba.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "7573099e10ca69c3be33995c1fcd0d241226816d", "tree": "396dfcc4af89054ef2bd3017f3731d2eaee5d42d", "parents": [ "adacf21f1c9a65e299a103f78b3e6dd71c5ec99b" ], "author": { "name": "Denis Plotnikov", "email": "den-plotnikov@yandex-team.ru", "time": "Fri Apr 07 10:18:49 2023 +0300" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Apr 12 08:32:38 2023 +0100" }, "message": "qlcnic: check pci_reset_function result\n\nStatic code analyzer complains to unchecked return value.\nThe result of pci_reset_function() is unchecked.\nDespite, the issue is on the FLR supported code path and in that\ncase reset can be done with pcie_flr(), the patch uses less invasive\napproach by adding the result check of pci_reset_function().\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.\n\nFixes: 7e2cf4feba05 (\"qlcnic: change driver hardware interface mechanism\")\nSigned-off-by: Denis Plotnikov \u003cden-plotnikov@yandex-team.ru\u003e\nReviewed-by: Simon Horman \u003csimon.horman@corigine.com\u003e\nReviewed-by: Bjorn Helgaas \u003cbhelgaas@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "adacf21f1c9a65e299a103f78b3e6dd71c5ec99b", "tree": "205008c0f3625f1676595280d7b2672cbf80daf4", "parents": [ "160c13175e392961fd18a9fdb89e5425b3ac7099", "9c85b7fa12ef2e4fc11a4e31ac595fb5f9d0ddf9" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 11 21:37:53 2023 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 11 21:37:53 2023 -0700" }, "message": "Merge branch \u002740GbE\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue\n\nTony Nguyen says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\niavf: fix racing in VLANs\n\nAhmed Zaki says:\n\nThis patchset mainly fixes a racing issue in the iavf where the number of\nVLANs in the vlan_filter_list might be more than the PF limit. To fix that,\nwe get rid of the cvlans and svlans bitmaps and keep all the required info\nin the list.\n\nThe second patch adds two new states that are needed so that we keep the\nVLAN info while the interface goes DOWN:\n -- DISABLE (notify PF, but keep the filter in the list)\n -- INACTIVE (dev is DOWN, filter is removed from PF)\n\nFinally, the current code keeps each state in a separate bit field, which\nis error prone. The first patch refactors that by replacing all bits with\na single enum. The changes are minimal where each bit change is replaced\nwith the new state value.\n\n* \u002740GbE\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue:\n iavf: remove active_cvlans and active_svlans bitmaps\n iavf: refactor VLAN filter states\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://lore.kernel.org/r/20230407210730.3046149-1-anthony.l.nguyen@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "160c13175e392961fd18a9fdb89e5425b3ac7099", "tree": "ba2046bf1a937d5949d202819eb5a3c22646f888", "parents": [ "a4506722dc39ca840593f14e3faa4c9ba9408211", "a2a9339e1c9deb7e1e079e12e27a0265aea8421a" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 11 21:18:23 2023 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 11 21:18:23 2023 -0700" }, "message": "Merge tag \u0027for-net-2023-04-10\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth\n\nLuiz Augusto von Dentz says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nbluetooth pull request for net:\n\n - Fix not setting Dath Path for broadcast sink\n - Fix not cleaning up on LE Connection failure\n - SCO: Fix possible circular locking dependency\n - L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}\n - Fix race condition in hidp_session_thread\n - btbcm: Fix logic error in forming the board name\n - btbcm: Fix use after free in btsdio_remove\n\n* tag \u0027for-net-2023-04-10\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth:\n Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}\n Bluetooth: Set ISO Data Path on broadcast sink\n Bluetooth: hci_conn: Fix possible UAF\n Bluetooth: SCO: Fix possible circular locking dependency sco_sock_getsockopt\n Bluetooth: SCO: Fix possible circular locking dependency on sco_connect_cfm\n bluetooth: btbcm: Fix logic error in forming the board name.\n Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition\n Bluetooth: Fix race condition in hidp_session_thread\n Bluetooth: Fix printing errors if LE Connection times out\n Bluetooth: hci_conn: Fix not cleaning up on LE Connection failure\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://lore.kernel.org/r/20230410172718.4067798-1-luiz.dentz@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "534e465845ebfb4a97eb5459d3931a0b35e3b9a5", "tree": "fc0fca3198bfb495b5cf5f62d7920e0ca39eb0ae", "parents": [ "7e364e56293bb98cae1b55fd835f5991c4e96e7d" ], "author": { "name": "Kornel Dulęba", "email": "korneld@chromium.org", "time": "Tue Apr 11 13:49:32 2023 +0000" }, "committer": { "name": "Linus Walleij", "email": "linus.walleij@linaro.org", "time": "Tue Apr 11 22:45:42 2023 +0200" }, "message": "Revert \"pinctrl: amd: Disable and mask interrupts on resume\"\n\nThis reverts commit b26cd9325be4c1fcd331b77f10acb627c560d4d7.\n\nThis patch introduces a regression on Lenovo Z13, which can\u0027t wake\nfrom the lid with it applied; and some unspecified AMD based Dell\nplatforms are unable to wake from hitting the power button\n\nSigned-off-by: Kornel Dulęba \u003ckorneld@chromium.org\u003e\nReviewed-by: Mario Limonciello \u003cmario.limonciello@amd.com\u003e\nLink: https://lore.kernel.org/r/20230411134932.292287-1-korneld@chromium.org\nSigned-off-by: Linus Walleij \u003clinus.walleij@linaro.org\u003e\n" }, { "commit": "1a50d9403fb90cbe4dea0ec9fd0351d2ecbd8924", "tree": "28951664bc283d248bd30a565ddcba34f792034c", "parents": [ "e87245045b2b23e6dae3406c30b11cd8429eb061" ], "author": { "name": "Geert Uytterhoeven", "email": "geert+renesas@glider.be", "time": "Thu Mar 30 15:26:13 2023 +0200" }, "committer": { "name": "Rob Herring", "email": "robh@kernel.org", "time": "Tue Apr 11 14:39:52 2023 -0500" }, "message": "treewide: Fix probing of devices in DT overlays\n\nWhen loading a DT overlay that creates a device, the device is not\nprobed, unless the DT overlay is unloaded and reloaded again.\n\nAfter the recent refactoring to improve fw_devlink, it no longer depends\non the \"compatible\" property to identify which device tree nodes will\nbecome struct devices. fw_devlink now picks up dangling consumers\n(consumers pointing to descendent device tree nodes of a device that\naren\u0027t converted to child devices) when a device is successfully bound\nto a driver. See __fw_devlink_pickup_dangling_consumers().\n\nHowever, during DT overlay, a device\u0027s device tree node can have\nsub-nodes added/removed without unbinding/rebinding the driver. This\ndifference in behavior between the normal device instantiation and\nprobing flow vs. the DT overlay flow has a bunch of implications that\nare pointed out elsewhere[1]. One of them is that the fw_devlink logic\nto pick up dangling consumers is never exercised.\n\nThis patch solves the fw_devlink issue by marking all DT nodes added by\nDT overlays with FWNODE_FLAG_NOT_DEVICE (fwnode that won\u0027t become\ndevice), and by clearing the flag when a struct device is actually\ncreated for the DT node. This way, fw_devlink knows not to have\nconsumers waiting on these newly added DT nodes, and to propagate the\ndependency to an ancestor DT node that has the corresponding struct\ndevice.\n\nBased on a patch by Saravana Kannan, which covered only platform and spi\ndevices.\n\n[1] https://lore.kernel.org/r/CAGETcx_bkuFaLCiPrAWCPQz+w79ccDp6\u003d9e881qmK\u003dvx3hBMyg@mail.gmail.com\n\nFixes: 4a032827daa89350 (\"of: property: Simplify of_link_to_phandle()\")\nLink: https://lore.kernel.org/r/CAGETcx_+rhHvaC_HJXGrr5_WAd2+k5f\u003drWYnkCZ6z5bGX-wj4w@mail.gmail.com\nSigned-off-by: Geert Uytterhoeven \u003cgeert+renesas@glider.be\u003e\nAcked-by: Mark Brown \u003cbroonie@kernel.org\u003e\nAcked-by: Wolfram Sang \u003cwsa@kernel.org\u003e # for I2C\nAcked-by: Shawn Guo \u003cshawnguo@kernel.org\u003e\nAcked-by: Saravana Kannan \u003csaravanak@google.com\u003e\nTested-by: Ivan Bornyakov \u003ci.bornyakov@metrotek.ru\u003e\nLink: https://lore.kernel.org/r/e1fa546682ea4c8474ff997ab6244c5e11b6f8bc.1680182615.git.geert+renesas@glider.be\nSigned-off-by: Rob Herring \u003crobh@kernel.org\u003e\n" }, { "commit": "e87245045b2b23e6dae3406c30b11cd8429eb061", "tree": "c52b7591be25cccee314b0323e85c411bf96c3c7", "parents": [ "707344c8a188bb1d6704d3546229fc7a07c01a63" ], "author": { "name": "Liu Peibao", "email": "liupeibao@loongson.cn", "time": "Sat Apr 01 17:13:04 2023 +0800" }, "committer": { "name": "Rob Herring", "email": "robh@kernel.org", "time": "Tue Apr 11 14:39:15 2023 -0500" }, "message": "dt-bindings: interrupt-controller: loongarch: Fix mismatched compatible\n\nThe \"compatible\" doesn\u0027t match what the kernel is using. Fix it as\nkernel using.\n\nFixes: 6b2748ada244 (\"dt-bindings: interrupt-controller: add yaml for LoongArch CPU interrupt controller\")\nReported-by: Rob Herring \u003crobh@kernel.org\u003e\nLink: https://lore.kernel.org/all/20221208020954.GA3368836-robh@kernel.org/\nAcked-by: Krzysztof Kozlowski \u003ckrzysztof.kozlowski@linaro.org\u003e\nSigned-off-by: Liu Peibao \u003cliupeibao@loongson.cn\u003e\nLink: https://lore.kernel.org/r/20230401091304.12633-1-liupeibao@loongson.cn\n[robh: Rename file to match compatible, fix subject typo]\nSigned-off-by: Rob Herring \u003crobh@kernel.org\u003e\n" }, { "commit": "e62252bc55b6d4eddc6c2bdbf95a448180d6a08d", "tree": "b8abd09da09b3abb87059b9cd0ca823eeb49da8b", "parents": [ "2c40519251d61590377b313379ae2d4d4ef28266", "30ba2d09edb5ea857a1473ae3d820911347ada62" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Apr 11 11:59:49 2023 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Apr 11 11:59:49 2023 -0700" }, "message": "Merge tag \u0027pci-v6.3-fixes-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci\n\nPull pci fixes from Bjorn Helgaas:\n\n - Provide pci_msix_can_alloc_dyn() stub when CONFIG_PCI_MSI unset to\n avoid build errors (Reinette Chatre)\n\n - Quirk AMD XHCI controller that loses MSI-X state in D3hot to avoid\n broken USB after hotplug or suspend/resume (Basavaraj Natikar)\n\n - Fix use-after-free in pci_bus_release_domain_nr() (Rob Herring)\n\n* tag \u0027pci-v6.3-fixes-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci:\n PCI: Fix use-after-free in pci_bus_release_domain_nr()\n x86/PCI: Add quirk for AMD XHCI controller that loses MSI-X state in D3hot\n PCI/MSI: Provide missing stub for pci_msix_can_alloc_dyn()\n" }, { "commit": "2c40519251d61590377b313379ae2d4d4ef28266", "tree": "7da3113eef6634b8d95c785724708bfd314c8bf6", "parents": [ "793cfd598370cf9440d7877ddddda1251307f729", "68d99ab0e9221ef54506f827576c5a914680eeaf" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Apr 11 11:43:16 2023 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Apr 11 11:43:16 2023 -0700" }, "message": "Merge tag \u0027for-6.3-rc6-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux\n\nPull btrfs fixes from David Sterba:\n\n - fix fast checksum detection, this affects filesystems with non-crc32c\n checksum, calculation would not be offloaded to worker threads\n\n - restore thread_pool mount option behaviour for endio workers, the new\n value for maximum active threads would not be set to the actual work\n queues\n\n* tag \u0027for-6.3-rc6-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:\n btrfs: fix fast csum implementation detection\n btrfs: restore the thread_pool\u003d behavior in remount for the end I/O workqueues\n" }, { "commit": "b89ce1177d42d5c124e83f3858818cd4e6a2c46f", "tree": "039492a61fd500f37e48538deb43d9064a1a6954", "parents": [ "6fd33a3333c7916689b8f051a185defe4dd515b0" ], "author": { "name": "Christophe JAILLET", "email": "christophe.jaillet@wanadoo.fr", "time": "Sun Dec 26 17:34:16 2021 +0100" }, "committer": { "name": "Daniel Vetter", "email": "daniel.vetter@ffwll.ch", "time": "Tue Apr 11 20:29:33 2023 +0200" }, "message": "drm/armada: Fix a potential double free in an error handling path\n\n\u0027priv\u0027 is a managed resource, so there is no need to free it explicitly or\nthere will be a double free().\n\nFixes: 90ad200b4cbc (\"drm/armada: Use devm_drm_dev_alloc\")\nSigned-off-by: Christophe JAILLET \u003cchristophe.jaillet@wanadoo.fr\u003e\nSigned-off-by: Daniel Vetter \u003cdaniel.vetter@ffwll.ch\u003e\nLink: https://patchwork.freedesktop.org/patch/msgid/c4f3c9207a9fce35cb6dd2cc60e755275961588a.1640536364.git.christophe.jaillet@wanadoo.fr\n" }, { "commit": "793cfd598370cf9440d7877ddddda1251307f729", "tree": "23f4651228ff90aa54289b30c4b0a6d1213032c0", "parents": [ "43fef9ae02fb5fa554e5df3c1899f06e4394cffc", "93942b70461574ca7fc3d91494ca89b16a4c64c7" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Apr 11 10:09:29 2023 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Apr 11 10:09:29 2023 -0700" }, "message": "Merge tag \u0027mtd/fixes-for-6.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux\n\nPull mtd fixes from Miquel Raynal:\n \"Core fix:\n\n - mtdblock: Tolerate corrected bit-flips\n\n Raw NAND fixes:\n\n - meson: Fix bitmask for length in command word\n\n - stm32_fmc2:\n\n - Remove unsupported EDO mode\n\n - Use timings.mode instead of checking tRC_min.\n\n The first patch is the real fix but nowadays we use\n timings.mode instead of bare timings, so in order to ease the\n backports, the fix was split into two steps, the first one easy\n to backport on older kernels, the second one just as a\n follow-up so recent stable kernels would look like the\n mainline\"\n\n* tag \u0027mtd/fixes-for-6.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux:\n mtd: rawnand: meson: fix bitmask for length in command word\n mtdblock: tolerate corrected bit-flips\n mtd: rawnand: stm32_fmc2: use timings.mode instead of checking tRC_min\n mtd: rawnand: stm32_fmc2: remove unsupported EDO mode\n" }, { "commit": "43fef9ae02fb5fa554e5df3c1899f06e4394cffc", "tree": "9ae8c8ab1ead9852250f5ebbce98e5ed66d1aa7c", "parents": [ "aa4c9185f0a16662c25d814c713b3cd0b4f4e97a", "2096134b5a00bf0bd15745d3a492039e801e84c0" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Apr 11 09:51:45 2023 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Apr 11 09:51:45 2023 -0700" }, "message": "Merge tag \u0027ata-6.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata\n\nPull ata fix from Damien Le Moal:\n\n - Update my email address in the MAINTAINERS file\n\n* tag \u0027ata-6.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata:\n MAINTAINERS: Change ata maintainer email addresses\n" }, { "commit": "aa4c9185f0a16662c25d814c713b3cd0b4f4e97a", "tree": "c5191c9a156737fded4dfa0da4f19ffb69837226", "parents": [ "0d3eb744aed40ffce820cded61d7eac515199165", "0bf9601f8ef0703523018e975d6c1f3fdfcff4b9" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Apr 11 09:36:42 2023 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Apr 11 09:36:42 2023 -0700" }, "message": "Merge tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/virt/kvm/kvm\n\nPull kvm fixes from Paolo Bonzini:\n \"Two ARM fixes:\n\n - Ensure the guest PMU context is restored before the first KVM_RUN,\n fixing an issue where EL0 event counting is broken after vCPU\n save/restore\n\n - Actually initialize ID_AA64PFR0_EL1.{CSV2,CSV3} based on the\n sanitized, system-wide values for protected VMs\"\n\n* tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/virt/kvm/kvm:\n KVM: arm64: Advertise ID_AA64PFR0_EL1.CSV2/3 to protected VMs\n KVM: arm64: PMU: Restore the guest\u0027s EL0 event counting after migration\n" }, { "commit": "6fd33a3333c7916689b8f051a185defe4dd515b0", "tree": "0508254f987e6bc327fe0e90bd6f267b68b5adaf", "parents": [ "86d8740dae5a397d8344ae75f8758103c1fcba97" ], "author": { "name": "Daniel Vetter", "email": "daniel.vetter@ffwll.ch", "time": "Tue Apr 04 21:39:34 2023 +0200" }, "committer": { "name": "Daniel Vetter", "email": "daniel.vetter@ffwll.ch", "time": "Tue Apr 11 16:24:38 2023 +0200" }, "message": "fbmem: Reject FB_ACTIVATE_KD_TEXT from userspace\n\nThis is an oversight from dc5bdb68b5b3 (\"drm/fb-helper: Fix vt\nrestore\") - I failed to realize that nasty userspace could set this.\n\nIt\u0027s not pretty to mix up kernel-internal and userspace uapi flags\nlike this, but since the entire fb_var_screeninfo structure is uapi\nwe\u0027d need to either add a new parameter to the -\u003efb_set_par callback\nand fb_set_par() function, which has a _lot_ of users. Or some other\nfairly ugly side-channel int fb_info. Neither is a pretty prospect.\n\nInstead just correct the issue at hand by filtering out this\nkernel-internal flag in the ioctl handling code.\n\nReviewed-by: Javier Martinez Canillas \u003cjavierm@redhat.com\u003e\nAcked-by: Maarten Lankhorst \u003cmaarten.lankhorst@linux.intel.com\u003e\nSigned-off-by: Daniel Vetter \u003cdaniel.vetter@intel.com\u003e\nFixes: dc5bdb68b5b3 (\"drm/fb-helper: Fix vt restore\")\nCc: Alex Deucher \u003calexander.deucher@amd.com\u003e\nCc: shlomo@fastmail.com\nCc: Michel Dänzer \u003cmichel@daenzer.net\u003e\nCc: Noralf Trønnes \u003cnoralf@tronnes.org\u003e\nCc: Thomas Zimmermann \u003ctzimmermann@suse.de\u003e\nCc: Daniel Vetter \u003cdaniel.vetter@intel.com\u003e\nCc: Maarten Lankhorst \u003cmaarten.lankhorst@linux.intel.com\u003e\nCc: Maxime Ripard \u003cmripard@kernel.org\u003e\nCc: David Airlie \u003cairlied@linux.ie\u003e\nCc: Daniel Vetter \u003cdaniel@ffwll.ch\u003e\nCc: dri-devel@lists.freedesktop.org\nCc: \u003cstable@vger.kernel.org\u003e # v5.7+\nCc: Bartlomiej Zolnierkiewicz \u003cb.zolnierkie@samsung.com\u003e\nCc: Geert Uytterhoeven \u003cgeert@linux-m68k.org\u003e\nCc: Nathan Chancellor \u003cnatechancellor@gmail.com\u003e\nCc: Qiujun Huang \u003chqjagain@gmail.com\u003e\nCc: Peter Rosin \u003cpeda@axentia.se\u003e\nCc: linux-fbdev@vger.kernel.org\nCc: Helge Deller \u003cdeller@gmx.de\u003e\nCc: Sam Ravnborg \u003csam@ravnborg.org\u003e\nCc: Geert Uytterhoeven \u003cgeert+renesas@glider.be\u003e\nCc: Samuel Thibault \u003csamuel.thibault@ens-lyon.org\u003e\nCc: Tetsuo Handa \u003cpenguin-kernel@I-love.SAKURA.ne.jp\u003e\nCc: Shigeru Yoshida \u003csyoshida@redhat.com\u003e\nLink: https://patchwork.freedesktop.org/patch/msgid/20230404193934.472457-1-daniel.vetter@ffwll.ch\n" }, { "commit": "a4506722dc39ca840593f14e3faa4c9ba9408211", "tree": "5c5b51253c8f9a635b6416134f54db671b9085a4", "parents": [ "9a06fe08ae938bc2c2fb96e36ebcdb7b1a5133c4" ], "author": { "name": "Radu Pirea (OSS)", "email": "radu-nicolae.pirea@oss.nxp.com", "time": "Thu Apr 06 12:59:04 2023 +0300" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Apr 11 15:28:31 2023 +0200" }, "message": "net: phy: nxp-c45-tja11xx: add remove callback\n\nUnregister PTP clock when the driver is removed.\nPurge the RX and TX skb queues.\n\nFixes: 514def5dd339 (\"phy: nxp-c45-tja11xx: add timestamping support\")\nCC: stable@vger.kernel.org # 5.15+\nSigned-off-by: Radu Pirea (OSS) \u003cradu-nicolae.pirea@oss.nxp.com\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://lore.kernel.org/r/20230406095904.75456-1-radu-nicolae.pirea@oss.nxp.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "86d8740dae5a397d8344ae75f8758103c1fcba97", "tree": "ca04e22bb96a925b3e1312a8445878e25beffd17", "parents": [ "1e1d3574e69f70b848f9d50eca2c5ff04931b7ba" ], "author": { "name": "Karol Herbst", "email": "kherbst@redhat.com", "time": "Wed Apr 05 13:04:55 2023 +0200" }, "committer": { "name": "Karol Herbst", "email": "kherbst@redhat.com", "time": "Tue Apr 11 12:35:46 2023 +0200" }, "message": "drm/nouveau/fb: add missing sysmen flush callbacks\n\nCloses: https://gitlab.freedesktop.org/drm/nouveau/-/issues/203\nFixes: 5728d064190e1 (\"drm/nouveau/fb: handle sysmem flush page from common code\")\nSigned-off-by: Karol Herbst \u003ckherbst@redhat.com\u003e\nReviewed-by: Lyude Paul \u003clyude@redhat.com\u003e\nReviewed-by: Ben Skeggs \u003cbskeggs@redhat.com\u003e\nLink: https://patchwork.freedesktop.org/patch/msgid/20230405110455.1368428-1-kherbst@redhat.com\n" }, { "commit": "6b8446859c971a5783a2cdc90adf32e64de3bd23", "tree": "618b63a9d5a1df1e7e75c6cc8d8fab9bb0dd2584", "parents": [ "09a9639e56c01c7a00d6c0ca63f4c7c41abe075d" ], "author": { "name": "Jani Nikula", "email": "jani.nikula@intel.com", "time": "Wed Mar 01 17:14:09 2023 +0200" }, "committer": { "name": "Jani Nikula", "email": "jani.nikula@intel.com", "time": "Tue Apr 11 11:41:57 2023 +0300" }, "message": "drm/i915/dsi: fix DSS CTL register offsets for TGL+\n\nOn TGL+ the DSS control registers are at different offsets, and there\u0027s\none per pipe. Fix the offsets to fix dual link DSI for TGL+.\n\nThere would be helpers for this in the DSC code, but just do the quick\nfix now for DSI. Long term, we should probably move all the DSS handling\ninto intel_vdsc.c, so exporting the helpers seems counter-productive.\n\nCloses: https://gitlab.freedesktop.org/drm/intel/-/issues/8232\nCc: Ville Syrjala \u003cville.syrjala@linux.intel.com\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Jani Nikula \u003cjani.nikula@intel.com\u003e\nReviewed-by: Ville Syrjälä \u003cville.syrjala@linux.intel.com\u003e\nLink: https://patchwork.freedesktop.org/patch/msgid/20230301151409.1581574-1-jani.nikula@intel.com\n(cherry picked from commit 1a62dd9895dca78bee28bba3a36f08836fdd143d)\n" }, { "commit": "2096134b5a00bf0bd15745d3a492039e801e84c0", "tree": "d03bfe8654e8bf7909491425e6d12ecfe851b697", "parents": [ "5bc9e2d43f86105a95f86fa096fb4e517bb0ce73" ], "author": { "name": "Damien Le Moal", "email": "dlemoal@kernel.org", "time": "Mon Apr 10 11:31:11 2023 +0900" }, "committer": { "name": "Damien Le Moal", "email": "dlemoal@kernel.org", "time": "Tue Apr 11 16:10:10 2023 +0900" }, "message": "MAINTAINERS: Change ata maintainer email addresses\n\nChange my email address referenced in the MAINTAINERS file for the ata\nsubsystem to dlemoal@kernel.org. And while at it, also change other\nreferences for zonefs and the k210 drivers to the same address.\n\nSigned-off-by: Damien Le Moal \u003cdlemoal@kernel.org\u003e\nReviewed-by: Chaitanya Kulkarni \u003ckch@nvidia.com\u003e\n" }, { "commit": "0d3eb744aed40ffce820cded61d7eac515199165", "tree": "21469705de5f4dc3ee0d9fa7e5582e8828f2561a", "parents": [ "dfc191544864601a056ce7691d600e70d60d3ca1", "5da7cb193db32da783a3f3e77d8b639989321d48" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Apr 10 14:15:17 2023 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Apr 10 14:15:17 2023 -0700" }, "message": "Merge tag \u0027urgent-rcu.2023.04.07a\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu\n\nPull RCU fix from Paul McKenney:\n \"This fixes a pair of bugs in which an improbable but very real\n sequence of events can cause kfree_rcu() to be a bit too quick about\n freeing the memory passed to it.\n\n It turns out that this pair of bugs is about two years old, and so\n this is not a v6.3 regression. However: (1) It just started showing up\n in the wild and (2) Its consequences are dire, so its fix needs to go\n in sooner rather than later.\n\n Testing is of course being upgraded, and the upgraded tests detect\n this situation very quickly. But to the best of my knowledge right\n now, the tests are not particularly urgent and will thus most likely\n show up in the v6.5 merge window (the one after this coming one).\n\n Kudos to Ziwei Dai and his group for tracking this one down the hard\n way!\"\n\n* tag \u0027urgent-rcu.2023.04.07a\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu:\n rcu/kvfree: Avoid freeing new kfree_rcu() memory after old grace period\n" }, { "commit": "dfc191544864601a056ce7691d600e70d60d3ca1", "tree": "b8e11dd5fac75867be1f0e185fd79520811971dd", "parents": [ "c118b59e71d2a910ee300f8be40fa864a91bb6ca", "9da667e50c7e62266f3c2f8ad57b32fca40716b1" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Apr 10 13:35:54 2023 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Apr 10 13:35:54 2023 -0700" }, "message": "Merge tag \u0027for_linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost\n\nPull virtio fixes from Michael Tsirkin:\n \"Some last minute fixes - most of them for regressions\"\n\n* tag \u0027for_linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost:\n vdpa_sim_net: complete the initialization before register the device\n vdpa/mlx5: Add and remove debugfs in setup/teardown driver\n tools/virtio: fix typo in README instructions\n vhost-scsi: Fix crash during LUN unmapping\n vhost-scsi: Fix vhost_scsi struct use after free\n virtio-blk: fix ZBD probe in kernels without ZBD support\n virtio-blk: fix to match virtio spec\n" }, { "commit": "c118b59e71d2a910ee300f8be40fa864a91bb6ca", "tree": "c6200c5449e1802a2c7ef66373d6185468051139", "parents": [ "411eb014108594d160a20381e8738de6c62e2e5b", "347dca97f75d461ac2ac256b68e495dfc6f14d61" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Apr 10 13:25:08 2023 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Apr 10 13:25:08 2023 -0700" }, "message": "Merge tag \u00279p-6.3-fixes-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs\n\nPull 9p fixes from Eric Van Hensbergen:\n \"These are some collected fixes for the 6.3-rc series that have been\n passed our 9p regression tests and been in for-next for at least a\n week.\n\n They include a fix for a KASAN reported problem in the extended\n attribute handling code and a use after free in the xen transport.\n\n This also includes some updates for the MAINTAINERS file including the\n transition of our development mailing list from sourceforge.net to\n lists.linux.dev\"\n\n* tag \u00279p-6.3-fixes-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs:\n Update email address and mailing list for v9fs\n 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition\n 9P FS: Fix wild-memory-access write in v9fs_get_acl\n" }, { "commit": "411eb014108594d160a20381e8738de6c62e2e5b", "tree": "39b65f481ffda186aeafd6bcd1c11c5e6bf8bcec", "parents": [ "09a9639e56c01c7a00d6c0ca63f4c7c41abe075d", "a3046a618a284579d1189af8711765f553eed707" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Apr 10 13:13:33 2023 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Apr 10 13:13:33 2023 -0700" }, "message": "Merge tag \u0027uml-for-linus-6.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux\n\nPull UML fix from Richard Weinberger:\n\n - Build regression fix for older gcc versions\n\n* tag \u0027uml-for-linus-6.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux:\n um: Only disable SSE on clang to work around old GCC bugs\n" }, { "commit": "a2a9339e1c9deb7e1e079e12e27a0265aea8421a", "tree": "e150b8893796fc828dbbfccced609ab5655d8d31", "parents": [ "d2e4f1b1cba8742db66aaf77374cab7c0c7c8656" ], "author": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Thu Apr 06 09:33:09 2023 -0700" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Apr 10 10:24:32 2023 -0700" }, "message": "Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}\n\nSimilar to commit d0be8347c623 (\"Bluetooth: L2CAP: Fix use-after-free\ncaused by l2cap_chan_put\"), just use l2cap_chan_hold_unless_zero to\nprevent referencing a channel that is about to be destroyed.\n\nCc: stable@kernel.org\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\nSigned-off-by: Min Li \u003clm0963hack@gmail.com\u003e\n" }, { "commit": "d2e4f1b1cba8742db66aaf77374cab7c0c7c8656", "tree": "78d19ab3e0fd4eb2403ca465603bf6aa55986242", "parents": [ "5dc7d23e167e2882ef118456ceccd57873e876d8" ], "author": { "name": "Claudia Draghicescu", "email": "claudia.rosu@nxp.com", "time": "Wed Apr 05 14:19:18 2023 +0300" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Apr 10 10:24:16 2023 -0700" }, "message": "Bluetooth: Set ISO Data Path on broadcast sink\n\nThis patch enables ISO data rx on broadcast sink.\n\nFixes: eca0ae4aea66 (\"Bluetooth: Add initial implementation of BIS connections\")\nSigned-off-by: Claudia Draghicescu \u003cclaudia.rosu@nxp.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "5dc7d23e167e2882ef118456ceccd57873e876d8", "tree": "cde057d2994eab53a8a08c3a1cd4e4631b4a25ac", "parents": [ "975abc0c90fc485ff9b4a6afa475c3b1398d5d47" ], "author": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Apr 03 14:19:14 2023 -0700" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Apr 10 10:24:00 2023 -0700" }, "message": "Bluetooth: hci_conn: Fix possible UAF\n\nThis fixes the following trace:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nBUG: KASAN: slab-use-after-free in hci_conn_del+0xba/0x3a0\nWrite of size 8 at addr ffff88800208e9c8 by task iso-tester/31\n\nCPU: 0 PID: 31 Comm: iso-tester Not tainted 6.3.0-rc2-g991aa4a69a47\n #4716\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.1-2.fc36\n04/01/2014\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x1d/0x70\n print_report+0xce/0x610\n ? __virt_addr_valid+0xd4/0x150\n ? hci_conn_del+0xba/0x3a0\n kasan_report+0xdd/0x110\n ? hci_conn_del+0xba/0x3a0\n hci_conn_del+0xba/0x3a0\n hci_conn_hash_flush+0xf2/0x120\n hci_dev_close_sync+0x388/0x920\n hci_unregister_dev+0x122/0x260\n vhci_release+0x4f/0x90\n __fput+0x102/0x430\n task_work_run+0xf1/0x160\n ? __pfx_task_work_run+0x10/0x10\n ? mark_held_locks+0x24/0x90\n exit_to_user_mode_prepare+0x170/0x180\n syscall_exit_to_user_mode+0x19/0x50\n do_syscall_64+0x4e/0x90\n entry_SYSCALL_64_after_hwframe+0x70/0xda\n\nFixes: 0f00cd322d22 (\"Bluetooth: Free potentially unfreed SCO connection\")\nLink: https://syzkaller.appspot.com/bug?extid\u003d8bb72f86fc823817bc5d\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "975abc0c90fc485ff9b4a6afa475c3b1398d5d47", "tree": "3cf1e3ff695016767937140e3d188d7fca450d84", "parents": [ "9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3" ], "author": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Thu Mar 30 14:45:03 2023 -0700" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Apr 10 10:23:45 2023 -0700" }, "message": "Bluetooth: SCO: Fix possible circular locking dependency sco_sock_getsockopt\n\nThis attempts to fix the following trace:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nWARNING: possible circular locking dependency detected\n6.3.0-rc2-g68fcb3a7bf97 #4706 Not tainted\n------------------------------------------------------\nsco-tester/31 is trying to acquire lock:\nffff8880025b8070 (\u0026hdev-\u003elock){+.+.}-{3:3}, at:\nsco_sock_getsockopt+0x1fc/0xa90\n\nbut task is already holding lock:\nffff888001eeb130 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at:\nsco_sock_getsockopt+0x104/0xa90\n\nwhich lock already depends on the new lock.\n\nthe existing dependency chain (in reverse order) is:\n\n-\u003e #2 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}:\n lock_sock_nested+0x32/0x80\n sco_connect_cfm+0x118/0x4a0\n hci_sync_conn_complete_evt+0x1e6/0x3d0\n hci_event_packet+0x55c/0x7c0\n hci_rx_work+0x34c/0xa00\n process_one_work+0x575/0x910\n worker_thread+0x89/0x6f0\n kthread+0x14e/0x180\n ret_from_fork+0x2b/0x50\n\n-\u003e #1 (hci_cb_list_lock){+.+.}-{3:3}:\n __mutex_lock+0x13b/0xcc0\n hci_sync_conn_complete_evt+0x1ad/0x3d0\n hci_event_packet+0x55c/0x7c0\n hci_rx_work+0x34c/0xa00\n process_one_work+0x575/0x910\n worker_thread+0x89/0x6f0\n kthread+0x14e/0x180\n ret_from_fork+0x2b/0x50\n\n-\u003e #0 (\u0026hdev-\u003elock){+.+.}-{3:3}:\n __lock_acquire+0x18cc/0x3740\n lock_acquire+0x151/0x3a0\n __mutex_lock+0x13b/0xcc0\n sco_sock_getsockopt+0x1fc/0xa90\n __sys_getsockopt+0xe9/0x190\n __x64_sys_getsockopt+0x5b/0x70\n do_syscall_64+0x42/0x90\n entry_SYSCALL_64_after_hwframe+0x70/0xda\n\nother info that might help us debug this:\n\nChain exists of:\n \u0026hdev-\u003elock --\u003e hci_cb_list_lock --\u003e sk_lock-AF_BLUETOOTH-BTPROTO_SCO\n\n Possible unsafe locking scenario:\n\n CPU0 CPU1\n ---- ----\n lock(sk_lock-AF_BLUETOOTH-BTPROTO_SCO);\n lock(hci_cb_list_lock);\n lock(sk_lock-AF_BLUETOOTH-BTPROTO_SCO);\n lock(\u0026hdev-\u003elock);\n\n *** DEADLOCK ***\n\n1 lock held by sco-tester/31:\n #0: ffff888001eeb130 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0},\n at: sco_sock_getsockopt+0x104/0xa90\n\nFixes: 248733e87d50 (\"Bluetooth: Allow querying of supported offload codecs over SCO socket\")\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3", "tree": "dbbc369152b074a5a47d0bb6dfdcd3397c952cec", "parents": [ "b76abe4648c1acc791a207e7c08d1719eb9f4ea8" ], "author": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Thu Mar 30 14:15:50 2023 -0700" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Apr 10 10:23:30 2023 -0700" }, "message": "Bluetooth: SCO: Fix possible circular locking dependency on sco_connect_cfm\n\nThis attempts to fix the following trace:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nWARNING: possible circular locking dependency detected\n6.3.0-rc2-g0b93eeba4454 #4703 Not tainted\n------------------------------------------------------\nkworker/u3:0/46 is trying to acquire lock:\nffff888001fd9130 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at:\nsco_connect_cfm+0x118/0x4a0\n\nbut task is already holding lock:\nffffffff831e3340 (hci_cb_list_lock){+.+.}-{3:3}, at:\nhci_sync_conn_complete_evt+0x1ad/0x3d0\n\nwhich lock already depends on the new lock.\n\nthe existing dependency chain (in reverse order) is:\n\n-\u003e #2 (hci_cb_list_lock){+.+.}-{3:3}:\n __mutex_lock+0x13b/0xcc0\n hci_sync_conn_complete_evt+0x1ad/0x3d0\n hci_event_packet+0x55c/0x7c0\n hci_rx_work+0x34c/0xa00\n process_one_work+0x575/0x910\n worker_thread+0x89/0x6f0\n kthread+0x14e/0x180\n ret_from_fork+0x2b/0x50\n\n-\u003e #1 (\u0026hdev-\u003elock){+.+.}-{3:3}:\n __mutex_lock+0x13b/0xcc0\n sco_sock_connect+0xfc/0x630\n __sys_connect+0x197/0x1b0\n __x64_sys_connect+0x37/0x50\n do_syscall_64+0x42/0x90\n entry_SYSCALL_64_after_hwframe+0x70/0xda\n\n-\u003e #0 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}:\n __lock_acquire+0x18cc/0x3740\n lock_acquire+0x151/0x3a0\n lock_sock_nested+0x32/0x80\n sco_connect_cfm+0x118/0x4a0\n hci_sync_conn_complete_evt+0x1e6/0x3d0\n hci_event_packet+0x55c/0x7c0\n hci_rx_work+0x34c/0xa00\n process_one_work+0x575/0x910\n worker_thread+0x89/0x6f0\n kthread+0x14e/0x180\n ret_from_fork+0x2b/0x50\n\nother info that might help us debug this:\n\nChain exists of:\n sk_lock-AF_BLUETOOTH-BTPROTO_SCO --\u003e \u0026hdev-\u003elock --\u003e hci_cb_list_lock\n\n Possible unsafe locking scenario:\n\n CPU0 CPU1\n ---- ----\n lock(hci_cb_list_lock);\n lock(\u0026hdev-\u003elock);\n lock(hci_cb_list_lock);\n lock(sk_lock-AF_BLUETOOTH-BTPROTO_SCO);\n\n *** DEADLOCK ***\n\n4 locks held by kworker/u3:0/46:\n #0: ffff8880028d1130 ((wq_completion)hci0#2){+.+.}-{0:0}, at:\n process_one_work+0x4c0/0x910\n #1: ffff8880013dfde0 ((work_completion)(\u0026hdev-\u003erx_work)){+.+.}-{0:0},\n at: process_one_work+0x4c0/0x910\n #2: ffff8880025d8070 (\u0026hdev-\u003elock){+.+.}-{3:3}, at:\n hci_sync_conn_complete_evt+0xa6/0x3d0\n #3: ffffffffb79e3340 (hci_cb_list_lock){+.+.}-{3:3}, at:\n hci_sync_conn_complete_evt+0x1ad/0x3d0\n\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "b76abe4648c1acc791a207e7c08d1719eb9f4ea8", "tree": "6d0afb0ec8de98ed352c993c7b02ff3c87b44dc6", "parents": [ "73f7b171b7c09139eb3c6a5677c200dc1be5f318" ], "author": { "name": "Sasha Finkelstein", "email": "fnkl.kernel@gmail.com", "time": "Fri Mar 10 11:28:42 2023 +0100" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Apr 10 10:23:15 2023 -0700" }, "message": "bluetooth: btbcm: Fix logic error in forming the board name.\n\nThis patch fixes an incorrect loop exit condition in code that replaces\n\u0027/\u0027 symbols in the board name. There might also be a memory corruption\nissue here, but it is unlikely to be a real problem.\n\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Sasha Finkelstein \u003cfnkl.kernel@gmail.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "73f7b171b7c09139eb3c6a5677c200dc1be5f318", "tree": "d231eddc6d2705bac3eca408fc9d6259f7c680d8", "parents": [ "c95930abd687fcd1aa040dc4fe90dff947916460" ], "author": { "name": "Zheng Wang", "email": "zyytlz.wz@163.com", "time": "Thu Mar 09 00:45:01 2023 +0800" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Apr 10 10:23:01 2023 -0700" }, "message": "Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition\n\nIn btsdio_probe, the data-\u003ework is bound with btsdio_work. It will be\nstarted in btsdio_send_frame.\n\nIf the btsdio_remove runs with a unfinished work, there may be a race\ncondition that hdev is freed but used in btsdio_work. Fix it by\ncanceling the work before do cleanup in btsdio_remove.\n\nSigned-off-by: Zheng Wang \u003czyytlz.wz@163.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "c95930abd687fcd1aa040dc4fe90dff947916460", "tree": "ee7c2ab5647d59aacab0db64e4f407a9446acc65", "parents": [ "b62e72200eaad523f08d8319bba50fc652e032a8" ], "author": { "name": "Min Li", "email": "lm0963hack@gmail.com", "time": "Sat Mar 04 22:23:30 2023 +0800" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Apr 10 10:22:46 2023 -0700" }, "message": "Bluetooth: Fix race condition in hidp_session_thread\n\nThere is a potential race condition in hidp_session_thread that may\nlead to use-after-free. For instance, the timer is active while\nhidp_del_timer is called in hidp_session_thread(). After hidp_session_put,\nthen \u0027session\u0027 will be freed, causing kernel panic when hidp_idle_timeout\nis running.\n\nThe solution is to use del_timer_sync instead of del_timer.\n\nHere is the call trace:\n\n? hidp_session_probe+0x780/0x780\ncall_timer_fn+0x2d/0x1e0\n__run_timers.part.0+0x569/0x940\nhidp_session_probe+0x780/0x780\ncall_timer_fn+0x1e0/0x1e0\nktime_get+0x5c/0xf0\nlapic_next_deadline+0x2c/0x40\nclockevents_program_event+0x205/0x320\nrun_timer_softirq+0xa9/0x1b0\n__do_softirq+0x1b9/0x641\n__irq_exit_rcu+0xdc/0x190\nirq_exit_rcu+0xe/0x20\nsysvec_apic_timer_interrupt+0xa1/0xc0\n\nCc: stable@vger.kernel.org\nSigned-off-by: Min Li \u003clm0963hack@gmail.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "b62e72200eaad523f08d8319bba50fc652e032a8", "tree": "66625f0a647df3eb763c12dda88a954848777e06", "parents": [ "19cf60bf63cbaf5262eac400c707966e19999b83" ], "author": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Fri Mar 24 13:18:20 2023 -0700" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Apr 10 10:21:33 2023 -0700" }, "message": "Bluetooth: Fix printing errors if LE Connection times out\n\nThis fixes errors like bellow when LE Connection times out since that\nis actually not a controller error:\n\n Bluetooth: hci0: Opcode 0x200d failed: -110\n Bluetooth: hci0: request failed to create LE connection: err -110\n\nInstead the code shall properly detect if -ETIMEDOUT is returned and\nsend HCI_OP_LE_CREATE_CONN_CANCEL to give up on the connection.\n\nLink: https://github.com/bluez/bluez/issues/340\nFixes: 8e8b92ee60de (\"Bluetooth: hci_sync: Add hci_le_create_conn_sync\")\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "19cf60bf63cbaf5262eac400c707966e19999b83", "tree": "5cd5329ae73fe13dd068efd9dc2c6dabac907a98", "parents": [ "b9881d9a761a7e078c394ff8e30e1659d74f898f" ], "author": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Fri Mar 24 10:57:55 2023 -0700" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Apr 10 10:21:33 2023 -0700" }, "message": "Bluetooth: hci_conn: Fix not cleaning up on LE Connection failure\n\nhci_connect_le_scan_cleanup shall always be invoked to cleanup the\nstates and re-enable passive scanning if necessary, otherwise it may\ncause the pending action to stay active causing multiple attempts to\nconnect.\n\nFixes: 9b3628d79b46 (\"Bluetooth: hci_sync: Cleanup hci_conn if it cannot be aborted\")\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "09a9639e56c01c7a00d6c0ca63f4c7c41abe075d", "tree": "6b9de1a3c786a4bc9d151f35d7337e35772460cd", "parents": [ "faf8f41858e2792925b2c526e16d2f539a53a730" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 09 11:15:57 2023 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 09 11:15:57 2023 -0700" }, "message": "Linux 6.3-rc6\n" }, { "commit": "faf8f41858e2792925b2c526e16d2f539a53a730", "tree": "7126af1ee693de4564d0493ff646c286b249f413", "parents": [ "4ba115e2694dc9a10abfe94766d70b64ae9479c7", "24d3ae2f37d8bc3c14b31d353c5d27baf582b6a6" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 09 10:10:46 2023 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 09 10:10:46 2023 -0700" }, "message": "Merge tag \u0027perf_urgent_for_v6.3_rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull perf fixes from Borislav Petkov:\n\n - Fix \"same task\" check when redirecting event output\n\n - Do not wait unconditionally for RCU on the event migration path if\n there are no events to migrate\n\n* tag \u0027perf_urgent_for_v6.3_rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n perf/core: Fix the same task check in perf_event_set_output\n perf: Optimize perf_pmu_migrate_context()\n" }, { "commit": "4ba115e2694dc9a10abfe94766d70b64ae9479c7", "tree": "573e42a9734b3c8e2f1ca6ef20d962edbd4620e5", "parents": [ "c08cfd6716a170c549c1140f1d4a0e749c888a79", "81515ecf155a38f3532bf5ddef88d651898df6be" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 09 10:00:16 2023 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 09 10:00:16 2023 -0700" }, "message": "Merge tag \u0027x86_urgent_for_v6.3_rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull x86 fixes from Borislav Petkov:\n\n - Add a new Intel Arrow Lake CPU model number\n\n - Fix a confusion about how to check the version of the ACPI spec which\n supports a \"online capable\" bit in the MADT table which lead to a\n bunch of boot breakages with Zen1 systems and VMs\n\n* tag \u0027x86_urgent_for_v6.3_rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n x86/cpu: Add model number for Intel Arrow Lake processor\n x86/acpi/boot: Correct acpi_is_processor_usable() check\n x86/ACPI/boot: Use FADT version to check support for online capable\n" }, { "commit": "c08cfd6716a170c549c1140f1d4a0e749c888a79", "tree": "d2e78d27dc00081775cf793071f4a3fedff7135e", "parents": [ "cdc9718d5e590d6905361800b938b93f2b66818e", "ca712e47054678c5ce93a0e0f686353ad5561195" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 09 09:45:46 2023 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 09 09:45:46 2023 -0700" }, "message": "Merge tag \u0027cxl-fixes-6.3-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl\n\nPull compute express link (cxl) fixes from Dan Williams:\n \"Several fixes for driver startup regressions that landed during the\n merge window as well as some older bugs.\n\n The regressions were due to a lack of testing with what the CXL\n specification calls Restricted CXL Host (RCH) topologies compared to\n the testing with Virtual Host (VH) CXL topologies. A VH topology is\n typical PCIe while RCH topologies map CXL endpoints as Root Complex\n Integrated endpoints. The impact is some driver crashes on startup.\n\n This merge window also added compatibility for range registers (the\n mechanism that CXL 1.1 defined for mapping memory) to treat them like\n HDM decoders (the mechanism that CXL 2.0 defined for mapping\n Host-managed Device Memory). That work collided with the new region\n enumeration code that was tested with CXL 2.0 setups, and fails with\n crashes at startup.\n\n Lastly, the DOE (Data Object Exchange) implementation for retrieving\n an ACPI-like data table from CXL devices is being reworked for v6.4.\n Several fixes fell out of that work that are suitable for v6.3.\n\n All of this has been in linux-next for a while, and all reported\n issues [1] have been addressed.\n\n Summary:\n\n - Fix several issues with region enumeration in RCH topologies that\n can trigger crashes on driver startup or shutdown.\n\n - Fix CXL DVSEC range register compatibility versus region\n enumeration that leads to startup crashes\n\n - Fix CDAT endiannes handling\n\n - Fix multiple buffer handling boundary conditions\n\n - Fix Data Object Exchange (DOE) workqueue usage vs\n CONFIG_DEBUG_OBJECTS warn splats\"\n\nLink: http://lore.kernel.org/r/20230405075704.33de8121@canb.auug.org.au [1]\n\n* tag \u0027cxl-fixes-6.3-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl:\n cxl/hdm: Extend DVSEC range register emulation for region enumeration\n cxl/hdm: Limit emulation to the number of range registers\n cxl/region: Move coherence tracking into cxl_region_attach()\n cxl/region: Fix region setup/teardown for RCDs\n cxl/port: Fix find_cxl_root() for RCDs and simplify it\n cxl/hdm: Skip emulation when driver manages mem_enable\n cxl/hdm: Fix double allocation of @cxlhdm\n PCI/DOE: Fix memory leak with CONFIG_DEBUG_OBJECTS\u003dy\n PCI/DOE: Silence WARN splat with CONFIG_DEBUG_OBJECTS\u003dy\n cxl/pci: Handle excessive CDAT length\n cxl/pci: Handle truncated CDAT entries\n cxl/pci: Handle truncated CDAT header\n cxl/pci: Fix CDAT retrieval on big endian\n" }, { "commit": "9a06fe08ae938bc2c2fb96e36ebcdb7b1a5133c4", "tree": "ab9b924053b727145b72e3d46401acee71c16496", "parents": [ "5cc33f139e11b893ff6dc60d8a0ae865a65521ac", "bef227c1537cb8005311c0842bc5449e8c7a5973" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Apr 09 16:01:28 2023 +0100" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Apr 09 16:01:28 2023 +0100" }, "message": "Merge branch \u0027sfp-eeprom\u0027\n\nIvan Bornyakov says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: fix EEPROM read of absent SFP module\n\nThe patchset is to improve EEPROM read requests when SFP module is\nabsent.\n\nChangeLog:\nv1:\nhttps://lore.kernel.org/netdev/20230405153900.747-1-i.bornyakov@metrotek.ru/\nv2:\n * reword commit message of \"net: sfp: initialize sfp-\u003ei2c_block_size\n at sfp allocation\"\n * add second patch to eliminate excessive I2C transfers in\n sfp_module_eeprom() and sfp_module_eeprom_by_page()\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "bef227c1537cb8005311c0842bc5449e8c7a5973", "tree": "ab9b924053b727145b72e3d46401acee71c16496", "parents": [ "813c2dd78618f108fdcf9cd726ea90f081ee2881" ], "author": { "name": "Ivan Bornyakov", "email": "i.bornyakov@metrotek.ru", "time": "Thu Apr 06 16:08:33 2023 +0300" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Apr 09 16:01:28 2023 +0100" }, "message": "net: sfp: avoid EEPROM read of absent SFP module\n\nIf SFP module is not present, it is sensible to fail sfp_module_eeprom()\nand sfp_module_eeprom_by_page() early to avoid excessive I2C transfers\nwhich are garanteed to fail.\n\nSuggested-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nSigned-off-by: Ivan Bornyakov \u003ci.bornyakov@metrotek.ru\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "813c2dd78618f108fdcf9cd726ea90f081ee2881", "tree": "2ff47a35085e4c7b883ee3503bed49963dcd972f", "parents": [ "5cc33f139e11b893ff6dc60d8a0ae865a65521ac" ], "author": { "name": "Ivan Bornyakov", "email": "i.bornyakov@metrotek.ru", "time": "Thu Apr 06 16:08:32 2023 +0300" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Apr 09 16:01:28 2023 +0100" }, "message": "net: sfp: initialize sfp-\u003ei2c_block_size at sfp allocation\n\nsfp-\u003ei2c_block_size is initialized at SFP module insertion in\nsfp_sm_mod_probe(). Because of that, if SFP module was never inserted\nsince boot, sfp_read() call will lead to zero-length I2C read attempt,\nand not all I2C controllers are happy with zero-length reads.\n\nOne way to issue sfp_read() on empty SFP cage is to execute ethtool -m.\nIf SFP module was never plugged since boot, there will be a zero-length\nI2C read attempt.\n\n # ethtool -m xge0\n i2c i2c-3: adapter quirk: no zero length (addr 0x0050, size 0, read)\n Cannot get Module EEPROM data: Operation not supported\n\nIf SFP module was plugged then removed at least once,\nsfp-\u003ei2c_block_size will be initialized and ethtool -m will fail with\ndifferent exit code and without I2C error\n\n # ethtool -m xge0\n Cannot get Module EEPROM data: Remote I/O error\n\nFix this by initializing sfp-\u003ei2_block_size at struct sfp allocation\nstage so no wild sfp_read() could issue zero-length I2C read.\n\nSigned-off-by: Ivan Bornyakov \u003ci.bornyakov@metrotek.ru\u003e\nFixes: 0d035bed2a4a (\"net: sfp: VSOL V2801F / CarlitoxxPro CPGOS03-0490 v2.0 workaround\")\nCc: stable@vger.kernel.org\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "cdc9718d5e590d6905361800b938b93f2b66818e", "tree": "5c37463668b3af718226015816bbff65373c0fac", "parents": [ "68047c48b2288803c441df9f3e61d0d26bed87df", "4f5d5b33fc400911d6e1f49095522b361d9cbe13" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 08 18:37:45 2023 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 08 18:37:45 2023 -0700" }, "message": "Merge tag \u00276.3-rc5-smb3-cifs-client-fixes\u0027 of git://git.samba.org/sfrench/cifs-2.6\n\nPull cifs client fixes from Steve French:\n \"Two cifs/smb3 client fixes, one for stable:\n\n - double lock fix for a cifs/smb1 reconnect path\n\n - DFS prefixpath fix for reconnect when server moved\"\n\n* tag \u00276.3-rc5-smb3-cifs-client-fixes\u0027 of git://git.samba.org/sfrench/cifs-2.6:\n cifs: double lock in cifs_reconnect_tcon()\n cifs: sanitize paths in cifs_update_super_prepath.\n" }, { "commit": "68047c48b2288803c441df9f3e61d0d26bed87df", "tree": "f99fbe44477b8708cd59b13f82ec67da83f1569b", "parents": [ "aa46fe36bbac623d58817eb12ed0222d88fe6b16", "4bffd2c7a3fc165fc70bc69211b8e6436f41a5c3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 08 12:21:37 2023 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 08 12:21:37 2023 -0700" }, "message": "Merge tag \u0027char-misc-6.3-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc\n\nPull char/misc driver fixes from Greg KH:\n \"Here are a small set of various small driver changes for 6.3-rc6.\n Included in here are:\n\n - iio driver fixes for reported problems\n\n - coresight hwtracing bugfix for reported problem\n\n - small counter driver bugfixes\n\n All have been in linux-next for a while with no reported problems\"\n\n* tag \u0027char-misc-6.3-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:\n coresight: etm4x: Do not access TRCIDR1 for identification\n coresight-etm4: Fix for() loop drvdata-\u003enr_addr_cmp range bug\n iio: adc: ti-ads7950: Set `can_sleep` flag for GPIO chip\n iio: adc: palmas_gpadc: fix NULL dereference on rmmod\n counter: 104-quad-8: Fix Synapse action reported for Index signals\n counter: 104-quad-8: Fix race condition between FLAG and CNTR reads\n iio: adc: max11410: fix read_poll_timeout() usage\n iio: dac: cio-dac: Fix max DAC write value check for 12-bit\n iio: light: cm32181: Unregister second I2C client if present\n iio: accel: kionix-kx022a: Get the timestamp from the driver\u0027s private data in the trigger_handler\n iio: adc: ad7791: fix IRQ flags\n iio: buffer: make sure O_NONBLOCK is respected\n iio: buffer: correctly return bytes written in output buffers\n iio: light: vcnl4000: Fix WARN_ON on uninitialized lock\n iio: adis16480: select CONFIG_CRC32\n drivers: iio: adc: ltc2497: fix LSB shift\n iio: adc: qcom-spmi-adc5: Fix the channel name\n" }, { "commit": "aa46fe36bbac623d58817eb12ed0222d88fe6b16", "tree": "9692031cf9eecfb03ce36875302c6e2d793ada40", "parents": [ "a211b1c05d487dc9f78688ac3058d2d7a4581807", "f92ed0cd9328aed918ebb0ebb64d259eccbcc6e7" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 08 12:17:46 2023 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 08 12:17:46 2023 -0700" }, "message": "Merge tag \u0027tty-6.3-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty\n\nPull tty/serial driver fixes from Greg KH:\n \"Here are some small tty and serial driver fixes for some reported\n problems:\n\n - fsl_uart driver bugfixes\n\n - sh-sci serial driver bugfixes\n\n - renesas serial driver DT binding bugfixes\n\n - 8250 DMA bugfix\n\n All of these have been in linux-next for a while with no reported\n problems\"\n\n* tag \u0027tty-6.3-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:\n tty: serial: sh-sci: Fix Rx on RZ/G2L SCI\n tty: serial: fsl_lpuart: fix crash in lpuart_uport_is_active\n tty: serial: fsl_lpuart: avoid checking for transfer complete when UARTCTRL_SBK is asserted in lpuart32_tx_empty\n serial: 8250: Prevent starting up DMA Rx on THRI interrupt\n dt-bindings: serial: renesas,scif: Fix 4th IRQ for 4-IRQ SCIFs\n tty: serial: sh-sci: Fix transmit end interrupt handler\n" }, { "commit": "a211b1c05d487dc9f78688ac3058d2d7a4581807", "tree": "c40530250bc09e48494753862788b5ab387379a6", "parents": [ "a79d5c76f705de81cb6b55ad279dde9759da06d2", "1edf48991a783d00a3a18dc0d27c88139e4030a2" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 08 12:13:39 2023 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 08 12:13:39 2023 -0700" }, "message": "Merge tag \u0027usb-6.3-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb\n\nPull USB bugfixes from Greg KH:\n \"Here are some small USB bugfixes for 6.3-rc6 that have been in my\n tree, and in linux-next, for a while. Included in here are:\n\n - new usb-serial driver device ids\n\n - xhci bugfixes for reported problems\n\n - gadget driver bugfixes for reported problems\n\n - dwc3 new device id\n\n All have been in linux-next with no reported problems\"\n\n* tag \u0027usb-6.3-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:\n usb: cdnsp: Fixes error: uninitialized symbol \u0027len\u0027\n usb: gadgetfs: Fix ep_read_iter to handle ITER_UBUF\n usb: gadget: f_fs: Fix ffs_epfile_read_iter to handle ITER_UBUF\n usb: typec: altmodes/displayport: Fix configure initial pin assignment\n usb: dwc3: pci: add support for the Intel Meteor Lake-S\n xhci: Free the command allocated for setting LPM if we return early\n Revert \"usb: xhci-pci: Set PROBE_PREFER_ASYNCHRONOUS\"\n xhci: also avoid the XHCI_ZERO_64B_REGS quirk with a passthrough iommu\n USB: serial: option: add Quectel RM500U-CN modem\n usb: xhci: tegra: fix sleep in atomic call\n USB: serial: option: add Telit FE990 compositions\n USB: serial: cp210x: add Silicon Labs IFS-USB-DATACABLE IDs\n" }, { "commit": "a79d5c76f705de81cb6b55ad279dde9759da06d2", "tree": "df348093b769b0821d94e9b456f2afbc1a48af84", "parents": [ "da0af3c55955efceb7d23f40c8f3d9f4b590d34a", "48b19b79cfa37b1e50da3b5a8af529f994c08901" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 08 11:57:05 2023 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 08 11:57:05 2023 -0700" }, "message": "Merge tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi\n\nPull SCSI fixes from James Bottomley:\n \"Four small fixes, all in drivers. They\u0027re all one or two lines except\n for the ufs one, but that\u0027s a simple revert of a previous feature\"\n\n* tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:\n scsi: iscsi_tcp: Check that sock is valid before iscsi_set_param()\n scsi: qla2xxx: Fix memory leak in qla2x00_probe_one()\n scsi: mpi3mr: Handle soft reset in progress fault code (0xF002)\n scsi: Revert \"scsi: ufs: core: Initialize devfreq synchronously\"\n" }, { "commit": "da0af3c55955efceb7d23f40c8f3d9f4b590d34a", "tree": "c152bbed370d061697796212ffc51cc2c0ae7862", "parents": [ "d3f05a4c428565163f26b5d34f60f02ee4ea4009", "3723091ea1884d599cc8b8bf719d6f42e8d4d8b1" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 08 11:40:41 2023 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 08 11:40:41 2023 -0700" }, "message": "Merge tag \u0027block-6.3-2023-04-06\u0027 of git://git.kernel.dk/linux\n\nPull block fixes from Jens Axboe:\n\n - Ensure that ublk always reads the whole sqe upfront (me)\n\n - Fix for a block size probing issue with ublk (Ming)\n\n - Fix for the bio based polling (Keith)\n\n - NVMe pull request via Christoph:\n - fix discard support without oncs (Keith Busch)\n\n - Partition scan error handling regression fix (Yu)\n\n* tag \u0027block-6.3-2023-04-06\u0027 of git://git.kernel.dk/linux:\n block: don\u0027t set GD_NEED_PART_SCAN if scan partition failed\n block: ublk: make sure that block size is set correctly\n ublk: read any SQE values upfront\n nvme: fix discard support without oncs\n blk-mq: directly poll requests\n" }, { "commit": "d3f05a4c428565163f26b5d34f60f02ee4ea4009", "tree": "d575facda7a2a6c97a7bcd874168c22b094782ff", "parents": [ "973ad544f04a5eff3435fd36e02392c5afeafc0f", "b4a72c0589fdea6259720375426179888969d6a2" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 08 11:34:17 2023 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 08 11:34:17 2023 -0700" }, "message": "Merge tag \u0027io_uring-6.3-2023-04-06\u0027 of git://git.kernel.dk/linux\n\nPull io_uring fixes from Jens Axboe:\n \"Just two minor fixes for provided buffers - one where we could\n potentially leak a buffer, and one where the returned values was\n off-by-one in some cases\"\n\n* tag \u0027io_uring-6.3-2023-04-06\u0027 of git://git.kernel.dk/linux:\n io_uring: fix memory leak when removing provided buffers\n io_uring: fix return value when removing provided buffers\n" }, { "commit": "973ad544f04a5eff3435fd36e02392c5afeafc0f", "tree": "984762be52ad0eeb06bc3e051d83010649e61267", "parents": [ "1a8a804a4f5d6d0ec77831ca776b8db4a7a98306", "bbb73a103fbbed6f63cb738d3783261c4241b4b2" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 08 11:10:49 2023 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 08 11:10:49 2023 -0700" }, "message": "Merge tag \u0027dma-mapping-6.3-2023-04-08\u0027 of git://git.infradead.org/users/hch/dma-mapping\n\nPull dma-mapping fix from Christoph Hellwig:\n\n - fix a braino in the swiotlb alignment check fix (Petr Tesarik)\n\n* tag \u0027dma-mapping-6.3-2023-04-08\u0027 of git://git.infradead.org/users/hch/dma-mapping:\n swiotlb: fix a braino in the alignment check fix\n" }, { "commit": "1a8a804a4f5d6d0ec77831ca776b8db4a7a98306", "tree": "fd405f2b481866825e79ee9f1f434d7d7252512c", "parents": [ "6fda0bb806fa77c9cfe12cdcbbd8cbbe946b9c37", "31c683967174b487939efaf65e41f5ff1404e141" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 08 11:02:03 2023 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 08 11:02:03 2023 -0700" }, "message": "Merge tag \u0027trace-v6.3-rc5-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace\n\nPull tracing fixes from Steven Rostedt:\n \"A couple more minor fixes:\n\n - Reset direct-\u003eaddr back to its original value on error in updating\n the direct trampoline code\n\n - Make lastcmd_mutex static\"\n\n* tag \u0027trace-v6.3-rc5-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:\n tracing/synthetic: Make lastcmd_mutex static\n ftrace: Fix issue that \u0027direct-\u003eaddr\u0027 not restored in modify_ftrace_direct()\n" }, { "commit": "6fda0bb806fa77c9cfe12cdcbbd8cbbe946b9c37", "tree": "210209ed6927e88d103ca3044b0ebea5519f476f", "parents": [ "aa318c48808c0aa73216bd94c54c4553d3663add", "c45ea315a602d45569b08b93e9ab30f6a63a38aa" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 08 10:51:12 2023 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 08 10:51:12 2023 -0700" }, "message": "Merge tag \u0027mm-hotfixes-stable-2023-04-07-16-23\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm\n\nPull MM fixes from Andrew Morton:\n \"28 hotfixes.\n\n 23 are cc:stable and the other five address issues which were\n introduced during this merge cycle.\n\n 20 are for MM and the remainder are for other subsystems\"\n\n* tag \u0027mm-hotfixes-stable-2023-04-07-16-23\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (28 commits)\n maple_tree: fix a potential concurrency bug in RCU mode\n maple_tree: fix get wrong data_end in mtree_lookup_walk()\n mm/swap: fix swap_info_struct race between swapoff and get_swap_pages()\n nilfs2: fix sysfs interface lifetime\n mm: take a page reference when removing device exclusive entries\n mm: vmalloc: avoid warn_alloc noise caused by fatal signal\n nilfs2: initialize \"struct nilfs_binfo_dat\"-\u003ebi_pad field\n nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread()\n zsmalloc: document freeable stats\n zsmalloc: document new fullness grouping\n fsdax: force clear dirty mark if CoW\n mm/hugetlb: fix uffd wr-protection for CoW optimization path\n mm: enable maple tree RCU mode by default\n maple_tree: add RCU lock checking to rcu callback functions\n maple_tree: add smp_rmb() to dead node detection\n maple_tree: fix write memory barrier of nodes once dead for RCU mode\n maple_tree: remove extra smp_wmb() from mas_dead_leaves()\n maple_tree: fix freeing of nodes in rcu mode\n maple_tree: detect dead nodes in mas_start()\n maple_tree: be more cautious about dead nodes\n ...\n" }, { "commit": "5cc33f139e11b893ff6dc60d8a0ae865a65521ac", "tree": "8cb9fd9c23d1c93d7e89a4bb1c807f7c050cc944", "parents": [ "bdaaecc127d471c422ee9e994978617c8aa79e1e" ], "author": { "name": "Douglas Anderson", "email": "dianders@chromium.org", "time": "Thu Apr 06 17:14:26 2023 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Apr 07 20:12:46 2023 -0700" }, "message": "r8152: Add __GFP_NOWARN to big allocations\n\nWhen memory is a little tight on my system, it\u0027s pretty easy to see\nwarnings that look like this.\n\n ksoftirqd/0: page allocation failure: order:3, mode:0x40a20(GFP_ATOMIC|__GFP_COMP), nodemask\u003d(null),cpuset\u003d/,mems_allowed\u003d0\n ...\n Call trace:\n dump_backtrace+0x0/0x1e8\n show_stack+0x20/0x2c\n dump_stack_lvl+0x60/0x78\n dump_stack+0x18/0x38\n warn_alloc+0x104/0x174\n __alloc_pages+0x588/0x67c\n alloc_rx_agg+0xa0/0x190 [r8152 ...]\n r8152_poll+0x270/0x760 [r8152 ...]\n __napi_poll+0x44/0x1ec\n net_rx_action+0x100/0x300\n __do_softirq+0xec/0x38c\n run_ksoftirqd+0x38/0xec\n smpboot_thread_fn+0xb8/0x248\n kthread+0x134/0x154\n ret_from_fork+0x10/0x20\n\nOn a fragmented system it\u0027s normal that order 3 allocations will\nsometimes fail, especially atomic ones. The driver handles these\nfailures fine and the WARN just creates spam in the logs for this\ncase. The __GFP_NOWARN flag is exactly for this situation, so add it\nto the allocation.\n\nNOTE: my testing is on a 5.15 system, but there should be no reason\nthat this would be fundamentally different on a mainline kernel.\n\nSigned-off-by: Douglas Anderson \u003cdianders@chromium.org\u003e\nAcked-by: Hayes Wang \u003chayeswang@realtek.com\u003e\nLink: https://lore.kernel.org/r/20230406171411.1.I84dbef45786af440fd269b71e9436a96a8e7a152@changeid\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "bdaaecc127d471c422ee9e994978617c8aa79e1e", "tree": "b0a3e0aa7815e37aa6ed7ba6eee512c7a70cd0fe", "parents": [ "066b86787fa3d97b7aefb5ac0a99a22dad2d15f8" ], "author": { "name": "Radu Pirea (OSS)", "email": "radu-nicolae.pirea@oss.nxp.com", "time": "Thu Apr 06 12:59:53 2023 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Apr 07 19:48:34 2023 -0700" }, "message": "net: phy: nxp-c45-tja11xx: fix unsigned long multiplication overflow\n\nAny multiplication between GENMASK(31, 0) and a number bigger than 1\nwill be truncated because of the overflow, if the size of unsigned long\nis 32 bits.\n\nReplaced GENMASK with GENMASK_ULL to make sure that multiplication will\nbe between 64 bits values.\n\nCc: \u003cstable@vger.kernel.org\u003e # 5.15+\nFixes: 514def5dd339 (\"phy: nxp-c45-tja11xx: add timestamping support\")\nSigned-off-by: Radu Pirea (OSS) \u003cradu-nicolae.pirea@oss.nxp.com\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://lore.kernel.org/r/20230406095953.75622-1-radu-nicolae.pirea@oss.nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "066b86787fa3d97b7aefb5ac0a99a22dad2d15f8", "tree": "f4efbdd182aa1645fd226c9524ed4b3cd64e69a5", "parents": [ "029294d01907ac4ae7c57bbb122fef2367136ed4" ], "author": { "name": "Felix Huettner", "email": "felix.huettner@mail.schwarz", "time": "Wed Apr 05 07:53:41 2023 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Apr 07 19:42:53 2023 -0700" }, "message": "net: openvswitch: fix race on port output\n\nassume the following setup on a single machine:\n1. An openvswitch instance with one bridge and default flows\n2. two network namespaces \"server\" and \"client\"\n3. two ovs interfaces \"server\" and \"client\" on the bridge\n4. for each ovs interface a veth pair with a matching name and 32 rx and\n tx queues\n5. move the ends of the veth pairs to the respective network namespaces\n6. assign ip addresses to each of the veth ends in the namespaces (needs\n to be the same subnet)\n7. start some http server on the server network namespace\n8. test if a client in the client namespace can reach the http server\n\nwhen following the actions below the host has a chance of getting a cpu\nstuck in a infinite loop:\n1. send a large amount of parallel requests to the http server (around\n 3000 curls should work)\n2. in parallel delete the network namespace (do not delete interfaces or\n stop the server, just kill the namespace)\n\nthere is a low chance that this will cause the below kernel cpu stuck\nmessage. If this does not happen just retry.\nBelow there is also the output of bpftrace for the functions mentioned\nin the output.\n\nThe series of events happening here is:\n1. the network namespace is deleted calling\n `unregister_netdevice_many_notify` somewhere in the process\n2. this sets first `NETREG_UNREGISTERING` on both ends of the veth and\n then runs `synchronize_net`\n3. it then calls `call_netdevice_notifiers` with `NETDEV_UNREGISTER`\n4. this is then handled by `dp_device_event` which calls\n `ovs_netdev_detach_dev` (if a vport is found, which is the case for\n the veth interface attached to ovs)\n5. this removes the rx_handlers of the device but does not prevent\n packages to be sent to the device\n6. `dp_device_event` then queues the vport deletion to work in\n background as a ovs_lock is needed that we do not hold in the\n unregistration path\n7. `unregister_netdevice_many_notify` continues to call\n `netdev_unregister_kobject` which sets `real_num_tx_queues` to 0\n8. port deletion continues (but details are not relevant for this issue)\n9. at some future point the background task deletes the vport\n\nIf after 7. but before 9. a packet is send to the ovs vport (which is\nnot deleted at this point in time) which forwards it to the\n`dev_queue_xmit` flow even though the device is unregistering.\nIn `skb_tx_hash` (which is called in the `dev_queue_xmit`) path there is\na while loop (if the packet has a rx_queue recorded) that is infinite if\n`dev-\u003ereal_num_tx_queues` is zero.\n\nTo prevent this from happening we update `do_output` to handle devices\nwithout carrier the same as if the device is not found (which would\nbe the code path after 9. is done).\n\nAdditionally we now produce a warning in `skb_tx_hash` if we will hit\nthe infinite loop.\n\nbpftrace (first word is function name):\n\n__dev_queue_xmit server: real_num_tx_queues: 1, cpu: 2, pid: 28024, tid: 28024, skb_addr: 0xffff9edb6f207000, reg_state: 1\nnetdev_core_pick_tx server: addr: 0xffff9f0a46d4a000 real_num_tx_queues: 1, cpu: 2, pid: 28024, tid: 28024, skb_addr: 0xffff9edb6f207000, reg_state: 1\ndp_device_event server: real_num_tx_queues: 1 cpu 9, pid: 21024, tid: 21024, event 2, reg_state: 1\nsynchronize_rcu_expedited: cpu 9, pid: 21024, tid: 21024\nsynchronize_rcu_expedited: cpu 9, pid: 21024, tid: 21024\nsynchronize_rcu_expedited: cpu 9, pid: 21024, tid: 21024\nsynchronize_rcu_expedited: cpu 9, pid: 21024, tid: 21024\ndp_device_event server: real_num_tx_queues: 1 cpu 9, pid: 21024, tid: 21024, event 6, reg_state: 2\novs_netdev_detach_dev server: real_num_tx_queues: 1 cpu 9, pid: 21024, tid: 21024, reg_state: 2\nnetdev_rx_handler_unregister server: real_num_tx_queues: 1, cpu: 9, pid: 21024, tid: 21024, reg_state: 2\nsynchronize_rcu_expedited: cpu 9, pid: 21024, tid: 21024\nnetdev_rx_handler_unregister ret server: real_num_tx_queues: 1, cpu: 9, pid: 21024, tid: 21024, reg_state: 2\ndp_device_event server: real_num_tx_queues: 1 cpu 9, pid: 21024, tid: 21024, event 27, reg_state: 2\ndp_device_event server: real_num_tx_queues: 1 cpu 9, pid: 21024, tid: 21024, event 22, reg_state: 2\ndp_device_event server: real_num_tx_queues: 1 cpu 9, pid: 21024, tid: 21024, event 18, reg_state: 2\nnetdev_unregister_kobject: real_num_tx_queues: 1, cpu: 9, pid: 21024, tid: 21024\nsynchronize_rcu_expedited: cpu 9, pid: 21024, tid: 21024\novs_vport_send server: real_num_tx_queues: 0, cpu: 2, pid: 28024, tid: 28024, skb_addr: 0xffff9edb6f207000, reg_state: 2\n__dev_queue_xmit server: real_num_tx_queues: 0, cpu: 2, pid: 28024, tid: 28024, skb_addr: 0xffff9edb6f207000, reg_state: 2\nnetdev_core_pick_tx server: addr: 0xffff9f0a46d4a000 real_num_tx_queues: 0, cpu: 2, pid: 28024, tid: 28024, skb_addr: 0xffff9edb6f207000, reg_state: 2\nbroken device server: real_num_tx_queues: 0, cpu: 2, pid: 28024, tid: 28024\novs_dp_detach_port server: real_num_tx_queues: 0 cpu 9, pid: 9124, tid: 9124, reg_state: 2\nsynchronize_rcu_expedited: cpu 9, pid: 33604, tid: 33604\n\nstuck message:\n\nwatchdog: BUG: soft lockup - CPU#5 stuck for 26s! [curl:1929279]\nModules linked in: veth pktgen bridge stp llc ip_set_hash_net nft_counter xt_set nft_compat nf_tables ip_set_hash_ip ip_set nfnetlink_cttimeout nfnetlink openvswitch nsh nf_conncount nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 tls binfmt_misc nls_iso8859_1 input_leds joydev serio_raw dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua sch_fq_codel drm efi_pstore virtio_rng ip_tables x_tables autofs4 btrfs blake2b_generic zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear hid_generic usbhid hid crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel virtio_net ahci net_failover crypto_simd cryptd psmouse libahci virtio_blk failover\nCPU: 5 PID: 1929279 Comm: curl Not tainted 5.15.0-67-generic #74-Ubuntu\nHardware name: OpenStack Foundation OpenStack Nova, BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\nRIP: 0010:netdev_pick_tx+0xf1/0x320\nCode: 00 00 8d 48 ff 0f b7 c1 66 39 ca 0f 86 e9 01 00 00 45 0f b7 ff 41 39 c7 0f 87 5b 01 00 00 44 29 f8 41 39 c7 0f 87 4f 01 00 00 \u003ceb\u003e f2 0f 1f 44 00 00 49 8b 94 24 28 04 00 00 48 85 d2 0f 84 53 01\nRSP: 0018:ffffb78b40298820 EFLAGS: 00000246\nRAX: 0000000000000000 RBX: ffff9c8773adc2e0 RCX: 000000000000083f\nRDX: 0000000000000000 RSI: ffff9c8773adc2e0 RDI: ffff9c870a25e000\nRBP: ffffb78b40298858 R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: ffff9c870a25e000\nR13: ffff9c870a25e000 R14: ffff9c87fe043480 R15: 0000000000000000\nFS: 00007f7b80008f00(0000) GS:ffff9c8e5f740000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f7b80f6a0b0 CR3: 0000000329d66000 CR4: 0000000000350ee0\nCall Trace:\n \u003cIRQ\u003e\n netdev_core_pick_tx+0xa4/0xb0\n __dev_queue_xmit+0xf8/0x510\n ? __bpf_prog_exit+0x1e/0x30\n dev_queue_xmit+0x10/0x20\n ovs_vport_send+0xad/0x170 [openvswitch]\n do_output+0x59/0x180 [openvswitch]\n do_execute_actions+0xa80/0xaa0 [openvswitch]\n ? kfree+0x1/0x250\n ? kfree+0x1/0x250\n ? kprobe_perf_func+0x4f/0x2b0\n ? flow_lookup.constprop.0+0x5c/0x110 [openvswitch]\n ovs_execute_actions+0x4c/0x120 [openvswitch]\n ovs_dp_process_packet+0xa1/0x200 [openvswitch]\n ? ovs_ct_update_key.isra.0+0xa8/0x120 [openvswitch]\n ? ovs_ct_fill_key+0x1d/0x30 [openvswitch]\n ? ovs_flow_key_extract+0x2db/0x350 [openvswitch]\n ovs_vport_receive+0x77/0xd0 [openvswitch]\n ? __htab_map_lookup_elem+0x4e/0x60\n ? bpf_prog_680e8aff8547aec1_kfree+0x3b/0x714\n ? trace_call_bpf+0xc8/0x150\n ? kfree+0x1/0x250\n ? kfree+0x1/0x250\n ? kprobe_perf_func+0x4f/0x2b0\n ? kprobe_perf_func+0x4f/0x2b0\n ? __mod_memcg_lruvec_state+0x63/0xe0\n netdev_port_receive+0xc4/0x180 [openvswitch]\n ? netdev_port_receive+0x180/0x180 [openvswitch]\n netdev_frame_hook+0x1f/0x40 [openvswitch]\n __netif_receive_skb_core.constprop.0+0x23d/0xf00\n __netif_receive_skb_one_core+0x3f/0xa0\n __netif_receive_skb+0x15/0x60\n process_backlog+0x9e/0x170\n __napi_poll+0x33/0x180\n net_rx_action+0x126/0x280\n ? ttwu_do_activate+0x72/0xf0\n __do_softirq+0xd9/0x2e7\n ? rcu_report_exp_cpu_mult+0x1b0/0x1b0\n do_softirq+0x7d/0xb0\n \u003c/IRQ\u003e\n \u003cTASK\u003e\n __local_bh_enable_ip+0x54/0x60\n ip_finish_output2+0x191/0x460\n __ip_finish_output+0xb7/0x180\n ip_finish_output+0x2e/0xc0\n ip_output+0x78/0x100\n ? __ip_finish_output+0x180/0x180\n ip_local_out+0x5e/0x70\n __ip_queue_xmit+0x184/0x440\n ? tcp_syn_options+0x1f9/0x300\n ip_queue_xmit+0x15/0x20\n __tcp_transmit_skb+0x910/0x9c0\n ? __mod_memcg_state+0x44/0xa0\n tcp_connect+0x437/0x4e0\n ? ktime_get_with_offset+0x60/0xf0\n tcp_v4_connect+0x436/0x530\n __inet_stream_connect+0xd4/0x3a0\n ? kprobe_perf_func+0x4f/0x2b0\n ? aa_sk_perm+0x43/0x1c0\n inet_stream_connect+0x3b/0x60\n __sys_connect_file+0x63/0x70\n __sys_connect+0xa6/0xd0\n ? setfl+0x108/0x170\n ? do_fcntl+0xe8/0x5a0\n __x64_sys_connect+0x18/0x20\n do_syscall_64+0x5c/0xc0\n ? __x64_sys_fcntl+0xa9/0xd0\n ? exit_to_user_mode_prepare+0x37/0xb0\n ? syscall_exit_to_user_mode+0x27/0x50\n ? do_syscall_64+0x69/0xc0\n ? __sys_setsockopt+0xea/0x1e0\n ? exit_to_user_mode_prepare+0x37/0xb0\n ? syscall_exit_to_user_mode+0x27/0x50\n ? __x64_sys_setsockopt+0x1f/0x30\n ? do_syscall_64+0x69/0xc0\n ? irqentry_exit+0x1d/0x30\n ? exc_page_fault+0x89/0x170\n entry_SYSCALL_64_after_hwframe+0x61/0xcb\nRIP: 0033:0x7f7b8101c6a7\nCode: 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2a 00 00 00 0f 05 \u003c48\u003e 3d 00 f0 ff ff 77 51 c3 48 83 ec 18 89 54 24 0c 48 89 34 24 89\nRSP: 002b:00007ffffd6b2198 EFLAGS: 00000246 ORIG_RAX: 000000000000002a\nRAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f7b8101c6a7\nRDX: 0000000000000010 RSI: 00007ffffd6b2360 RDI: 0000000000000005\nRBP: 0000561f1370d560 R08: 00002795ad21d1ac R09: 0030312e302e302e\nR10: 00007ffffd73f080 R11: 0000000000000246 R12: 0000561f1370c410\nR13: 0000000000000000 R14: 0000000000000005 R15: 0000000000000000\n \u003c/TASK\u003e\n\nFixes: 7f8a436eaa2c (\"openvswitch: Add conntrack action\")\nCo-developed-by: Luca Czesla \u003cluca.czesla@mail.schwarz\u003e\nSigned-off-by: Luca Czesla \u003cluca.czesla@mail.schwarz\u003e\nSigned-off-by: Felix Huettner \u003cfelix.huettner@mail.schwarz\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Simon Horman \u003csimon.horman@corigine.com\u003e\nLink: https://lore.kernel.org/r/ZC0pBXBAgh7c76CA@kernel-bug-kernel-bug\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" } ], "next": "029294d01907ac4ae7c57bbb122fef2367136ed4" }