1. 12 Oct, 2021 3 commits
    • Marek Vasut's avatar
      drm/msm: Avoid potential overflow in timeout_to_jiffies() · 171316a6
      Marek Vasut authored
      The return type of ktime_divns() is s64. The timeout_to_jiffies() currently
      assigns the result of this ktime_divns() to unsigned long, which on 32 bit
      systems may overflow. Furthermore, the result of this function is sometimes
      also passed to functions which expect signed long, dma_fence_wait_timeout()
      is one such example.
      
      Fix this by adjusting the type of remaining_jiffies to s64, so we do not
      suffer overflow there, and return a value limited to range of 0..INT_MAX,
      which is safe for all usecases of this timeout.
      
      The above overflow can be triggered if userspace passes in too large timeout
      value, larger than INT_MAX / HZ seconds. The kernel detects it and complains
      about "schedule_timeout: wrong timeout value %lx" and generates a warning
      backtrace.
      
      Note that this fixes commit 6cedb8b3 ("drm/msm: avoid using 'timespec'"),
      because the previously used timespec_to_jiffies() function returned unsigned
      long instead of s64:
      static inline unsigned long timespec_to_jiffies(const struct timespec *value)
      
      Fixes: 6cedb8b3 ("drm/msm: avoid using 'timespec'")
      Signed-off-by: default avatarMarek Vasut <marex@denx.de>
      Cc: Arnd Bergmann <arnd@arndb.de>
      Cc: Jordan Crouse <jcrouse@codeaurora.org>
      Cc: Rob Clark <robdclark@chromium.org>
      Cc: stable@vger.kernel.org # 5.6+
      Acked-by: default avatarArnd Bergmann <arnd@arndb.de>
      Reviewed-by: default avatarDmitry Baryshkov <dmitry.baryshkov@linaro.org>
      Link: https://lore.kernel.org/r/20210917005913.157379-1-marex@denx.deSigned-off-by: default avatarRob Clark <robdclark@chromium.org>
      171316a6
    • Stephan Gerhold's avatar
      drm/msm: Fix devfreq NULL pointer dereference on a3xx · efb8a170
      Stephan Gerhold authored
      There is no devfreq on a3xx at the moment since gpu_busy is not
      implemented. This means that msm_devfreq_init() will return early
      and the entire devfreq setup is skipped.
      
      However, msm_devfreq_active() and msm_devfreq_idle() are still called
      unconditionally later, causing a NULL pointer dereference:
      
        Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010
        Internal error: Oops: 96000004 [#1] PREEMPT SMP
        CPU: 0 PID: 133 Comm: ring0 Not tainted 5.15.0-rc1 #4
        Hardware name: Longcheer L8150 (DT)
        pc : mutex_lock_io+0x2bc/0x2f0
        lr : msm_devfreq_active+0x3c/0xe0 [msm]
        Call trace:
         mutex_lock_io+0x2bc/0x2f0
         msm_gpu_submit+0x164/0x180 [msm]
         msm_job_run+0x54/0xe0 [msm]
         drm_sched_main+0x2b0/0x4a0 [gpu_sched]
         kthread+0x154/0x160
         ret_from_fork+0x10/0x20
      
      Fix this by adding a check in msm_devfreq_active/idle() which ensures
      that devfreq was actually initialized earlier.
      
      Fixes: 9bc95570 ("drm/msm: Devfreq tuning")
      Reported-by: default avatarNikita Travkin <nikita@trvn.ru>
      Tested-by: default avatarNikita Travkin <nikita@trvn.ru>
      Signed-off-by: default avatarStephan Gerhold <stephan@gerhold.net>
      Link: https://lore.kernel.org/r/20210913164556.16284-1-stephan@gerhold.netSigned-off-by: default avatarRob Clark <robdclark@chromium.org>
      efb8a170
    • Kuogee Hsieh's avatar
      drm/msm/dp: only signal audio when disconnected detected at dp_pm_resume · 9463b64d
      Kuogee Hsieh authored
      Currently there is audio not working problem after system resume from suspend
      if hdmi monitor stay plugged in at DUT. However this problem does not happen
      at normal operation but at a particular test case. The root cause is DP driver
      signal audio with connected state at resume which trigger audio trying to setup
      audio data path through DP main link but failed due to display port is not setup
      and enabled by upper layer framework yet. This patch only have DP driver signal
      audio only when DP is in disconnected state so that audio option shows correct
      state after system resume. DP driver will not signal audio with connected state
      until display enabled executed by upper layer framework where display port is
      setup completed and main link is running.
      
      Changes in V2:
      -- add details commit text
      
      Fixes: afc9b8b6 ("drm/msm/dp: signal audio plugged change at dp_pm_resume")
      Signed-off-by: default avatarKuogee Hsieh <khsieh@codeaurora.org>
      Reviewed-by: default avatarStephen Boyd <swboyd@chromium.org>
      Link: https://lore.kernel.org/r/1632932224-25102-1-git-send-email-khsieh@codeaurora.orgSigned-off-by: default avatarRob Clark <robdclark@chromium.org>
      9463b64d
  2. 01 Oct, 2021 6 commits
    • Arnd Bergmann's avatar
      drm/msm/submit: fix overflow check on 64-bit architectures · 95c58291
      Arnd Bergmann authored
      The overflow check does causes a warning from clang-14 when 'sz' is a type
      that is smaller than size_t:
      
      drivers/gpu/drm/msm/msm_gem_submit.c:217:10: error: result of comparison of constant 18446744073709551615 with expression of type 'unsigned int' is always false [-Werror,-Wtautological-constant-out-of-range-compare]
                      if (sz == SIZE_MAX) {
      
      Change the type accordingly.
      
      Fixes: 20224d71 ("drm/msm/submit: Move copy_from_user ahead of locking bos")
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Reviewed-by: default avatarStephen Boyd <swboyd@chromium.org>
      Link: https://lore.kernel.org/r/20210927113632.3849987-1-arnd@kernel.orgSigned-off-by: default avatarRob Clark <robdclark@chromium.org>
      95c58291
    • Rob Clark's avatar
      drm/msm: One sched entity per process per priority · 68002469
      Rob Clark authored
      Some userspace apps make assumptions that rendering against multiple
      contexts within the same process (from the same thread, with appropriate
      MakeCurrent() calls) provides sufficient synchronization without any
      external synchronization (ie. glFenceSync()/glWaitSync()).  Since a
      submitqueue maps to a gl/vk context, having multiple sched entities of
      the same priority only works with implicit sync enabled.
      
      To fix this, limit things to a single sched entity per priority level
      per process.
      
      An alternative would be sharing submitqueues between contexts in
      userspace, but tracking of per-context faults (ie. GL_EXT_robustness)
      is already done at the submitqueue level, so this is not an option.
      Signed-off-by: default avatarRob Clark <robdclark@chromium.org>
      68002469
    • Rob Clark's avatar
      drm/msm: A bit more docs + cleanup · 4cd82aa3
      Rob Clark authored
      msm_file_private is more gpu related, and in the next commit it will
      need access to other GPU specific #defines.  While we're at it, add
      some comments.
      Signed-off-by: default avatarRob Clark <robdclark@chromium.org>
      4cd82aa3
    • Rob Clark's avatar
      drm/msm/a6xx: Track current ctx by seqno · 14eb0cb4
      Rob Clark authored
      In theory a context can be destroyed and a new one allocated at the same
      address, making the pointer comparision to detect when we don't need to
      update the current pagetables invalid.  Instead assign a sequence number
      to each context on creation, and use this for the check.
      
      Fixes: 84c31ee1 ("drm/msm/a6xx: Add support for per-instance pagetables")
      Signed-off-by: default avatarRob Clark <robdclark@chromium.org>
      14eb0cb4
    • Rob Clark's avatar
      drm/msm/a6xx: Serialize GMU communication · f6f59072
      Rob Clark authored
      I've seen some crashes in our crash reporting that *look* like multiple
      threads stomping on each other while communicating with GMU.  So wrap
      all those paths in a lock.
      Signed-off-by: default avatarRob Clark <robdclark@chromium.org>
      f6f59072
    • Rob Clark's avatar
      drm/msm: Fix crash on dev file close · 654e9c18
      Rob Clark authored
      If the device file was opened prior to fw being available (such as from
      initrd before rootfs is mounted, when the initrd does not contain GPU
      fw), that would cause a later crash when the dev file is closed due to
      unitialized submitqueues list:
      
         CPU: 4 PID: 263 Comm: plymouthd Tainted: G        W         5.15.0-rc2-next-20210924 #2
         Hardware name: LENOVO 81JL/LNVNB161216, BIOS 9UCN33WW(V2.06) 06/ 4/2019
         pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
         pc : msm_submitqueue_close+0x30/0x190 [msm]
         lr : msm_postclose+0x54/0xf0 [msm]
         sp : ffff80001074bb80
         x29: ffff80001074bb80 x28: ffff03ad80c4db80 x27: ffff03ad80dc5ab0
         x26: 0000000000000000 x25: ffff03ad80dc5af8 x24: ffff03ad81e90800
         x23: 0000000000000000 x22: ffff03ad81e90800 x21: ffff03ad8b35e788
         x20: ffff03ad81e90878 x19: 0000000000000000 x18: 0000000000000000
         x17: 0000000000000000 x16: ffffda15f14f7940 x15: 0000000000000000
         x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000040
         x11: 0000000000000000 x10: 0000000000000000 x9 : ffffda15cd18ff88
         x8 : ffff03ad80c4db80 x7 : 0000000000000228 x6 : 0000000000000000
         x5 : 1793a4e807e636bd x4 : ffff03ad80c4db80 x3 : ffff03ad81e90878
         x2 : 0000000000000000 x1 : ffff03ad80c4db80 x0 : 0000000000000000
         Call trace:
          msm_submitqueue_close+0x30/0x190 [msm]
          msm_postclose+0x54/0xf0 [msm]
          drm_file_free.part.0+0x1cc/0x2e0 [drm]
          drm_close_helper.isra.0+0x74/0x84 [drm]
          drm_release+0x78/0x120 [drm]
          __fput+0x78/0x23c
          ____fput+0x1c/0x30
          task_work_run+0xcc/0x22c
          do_exit+0x304/0x9f4
          do_group_exit+0x44/0xb0
          __wake_up_parent+0x0/0x3c
          invoke_syscall+0x50/0x120
          el0_svc_common.constprop.0+0x4c/0xf4
          do_el0_svc+0x30/0x9c
          el0_svc+0x20/0x60
          el0t_64_sync_handler+0xe8/0xf0
          el0t_64_sync+0x1a0/0x1a4
         Code: aa0003f5 a90153f3 f8408eb3 aa1303e0 (f85e8674)
         ---[ end trace 39b2fa37509a2be2 ]---
         Fixing recursive fault but reboot is needed!
      
      Fixes: 86c2a0f0 drm/msm: ("Small submitqueue creation cleanup")
      Reported-by: default avatarSteev Klimaszewski <steev@kali.org>
      Signed-off-by: default avatarRob Clark <robdclark@chromium.org>
      654e9c18
  3. 26 Sep, 2021 7 commits
    • Linus Torvalds's avatar
      Linux 5.15-rc3 · 5816b3e6
      Linus Torvalds authored
      5816b3e6
    • Linus Torvalds's avatar
      Merge tag '5.15-rc2-ksmbd-fixes' of git://git.samba.org/ksmbd · 5e5d7597
      Linus Torvalds authored
      Pull ksmbd fixes from Steve French:
       "Five fixes for the ksmbd kernel server, including three security
        fixes:
      
         - remove follow symlinks support
      
         - use LOOKUP_BENEATH to prevent out of share access
      
         - SMB3 compounding security fix
      
         - fix for returning the default streams correctly, fixing a bug when
           writing ppt or doc files from some clients
      
         - logging more clearly that ksmbd is experimental (at module load
           time)"
      
      * tag '5.15-rc2-ksmbd-fixes' of git://git.samba.org/ksmbd:
        ksmbd: use LOOKUP_BENEATH to prevent the out of share access
        ksmbd: remove follow symlinks support
        ksmbd: check protocol id in ksmbd_verify_smb_message()
        ksmbd: add default data stream name in FILE_STREAM_INFORMATION
        ksmbd: log that server is experimental at module load
      5e5d7597
    • Linus Torvalds's avatar
      Merge tag 'edac_urgent_for_v5.15_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras · 996148ee
      Linus Torvalds authored
      Pull EDAC fixes from Borislav Petkov:
       "Fix two EDAC drivers using the wrong value type for the DIMM mode"
      
      * tag 'edac_urgent_for_v5.15_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras:
        EDAC/dmc520: Assign the proper type to dimm->edac_mode
        EDAC/synopsys: Fix wrong value type assignment for edac_mode
      996148ee
    • Linus Torvalds's avatar
      Merge tag 'thermal-v5.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/thermal/linux · 299d6e47
      Linus Torvalds authored
      Pull thermal fixes from Daniel Lezcano:
      
       - Fix thermal shutdown after a suspend/resume due to a wrong TCC value
         restored on Intel platform (Antoine Tenart)
      
       - Fix potential buffer overflow when building the list of policies. The
         buffer size is not updated after writing to it (Dan Carpenter)
      
       - Fix wrong check against IS_ERR instead of NULL (Ansuel Smith)
      
      * tag 'thermal-v5.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/thermal/linux:
        thermal/drivers/tsens: Fix wrong check for tzd in irq handlers
        thermal/core: Potential buffer overflow in thermal_build_list_of_policies()
        thermal/drivers/int340x: Do not set a wrong tcc offset on resume
      299d6e47
    • Linus Torvalds's avatar
      Merge tag 'x86-urgent-2021-09-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 5bb7b210
      Linus Torvalds authored
      Pull x86 fixes from Thomas Gleixner:
       "A set of fixes for X86:
      
         - Prevent sending the wrong signal when protection keys are enabled
           and the kernel handles a fault in the vsyscall emulation.
      
         - Invoke early_reserve_memory() before invoking e820_memory_setup()
           which is required to make the Xen dom0 e820 hooks work correctly.
      
         - Use the correct data type for the SETZ operand in the EMQCMDS
           instruction wrapper.
      
         - Prevent undefined behaviour to the potential unaligned accesss in
           the instruction decoder library"
      
      * tag 'x86-urgent-2021-09-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/insn, tools/x86: Fix undefined behavior due to potential unaligned accesses
        x86/asm: Fix SETZ size enqcmds() build failure
        x86/setup: Call early_reserve_memory() earlier
        x86/fault: Fix wrong signal when vsyscall fails with pkey
      5bb7b210
    • Linus Torvalds's avatar
      Merge tag 'timers-urgent-2021-09-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 3a398acc
      Linus Torvalds authored
      Pull timer fix from Thomas Gleixner:
       "A single fix for the recently introduced regression in posix CPU
        timers which failed to stop the timer when requested. That caused
        unexpected signals to be sent to the process/thread causing
        malfunction"
      
      * tag 'timers-urgent-2021-09-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        posix-cpu-timers: Prevent spuriously armed 0-value itimer
      3a398acc
    • Linus Torvalds's avatar
      Merge tag 'irq-urgent-2021-09-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · dc0f97c2
      Linus Torvalds authored
      Pull irq fixes from Thomas Gleixner:
       "A set of fixes for interrupt chip drivers:
      
         - Work around a bad GIC integration on a Renesas platform which can't
           handle byte-sized MMIO access
      
         - Plug a potential memory leak in the GICv4 driver
      
         - Fix a regression in the Armada 370-XP IPI code which was caused by
           issuing EOI instack of ACK.
      
         - A couple of small fixes here and there"
      
      * tag 'irq-urgent-2021-09-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        irqchip/gic: Work around broken Renesas integration
        irqchip/renesas-rza1: Use semicolons instead of commas
        irqchip/gic-v3-its: Fix potential VPE leak on error
        irqchip/goldfish-pic: Select GENERIC_IRQ_CHIP to fix build
        irqchip/mbigen: Repair non-kernel-doc notation
        irqdomain: Change the type of 'size' in __irq_domain_add() to be consistent
        irqchip/armada-370-xp: Fix ack/eoi breakage
        Documentation: Fix irq-domain.rst build warning
      dc0f97c2
  4. 25 Sep, 2021 13 commits
    • Linus Torvalds's avatar
      Merge branch 'akpm' (patches from Andrew) · a3b397b4
      Linus Torvalds authored
      Merge misc fixes from Andrew Morton:
       "16 patches.
      
        Subsystems affected by this patch series: xtensa, sh, ocfs2, scripts,
        lib, and mm (memory-failure, kasan, damon, shmem, tools, pagecache,
        debug, and pagemap)"
      
      * emailed patches from Andrew Morton <akpm@linux-foundation.org>:
        mm: fix uninitialized use in overcommit_policy_handler
        mm/memory_failure: fix the missing pte_unmap() call
        kasan: always respect CONFIG_KASAN_STACK
        sh: pgtable-3level: fix cast to pointer from integer of different size
        mm/debug: sync up latest migrate_reason to migrate_reason_names
        mm/debug: sync up MR_CONTIG_RANGE and MR_LONGTERM_PIN
        mm: fs: invalidate bh_lrus for only cold path
        lib/zlib_inflate/inffast: check config in C to avoid unused function warning
        tools/vm/page-types: remove dependency on opt_file for idle page tracking
        scripts/sorttable: riscv: fix undeclared identifier 'EM_RISCV' error
        ocfs2: drop acl cache for directories too
        mm/shmem.c: fix judgment error in shmem_is_huge()
        xtensa: increase size of gcc stack frame check
        mm/damon: don't use strnlen() with known-bogus source length
        kasan: fix Kconfig check of CC_HAS_WORKING_NOSANITIZE_ADDRESS
        mm, hwpoison: add is_free_buddy_page() in HWPoisonHandlable()
      a3b397b4
    • Linus Torvalds's avatar
      Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi · bb19237b
      Linus Torvalds authored
      Pull SCSI fixes from James Bottomley:
       "Thirty-three fixes, I'm afraid.
      
        Essentially the build up from the last couple of weeks while I've been
        dealling with Linux Plumbers conference infrastructure issues. It's
        mostly the usual assortment of spelling fixes and minor corrections.
      
        The only core relevant changes are to the sd driver to reduce the spin
        up message spew and fix a small memory leak on the freeing path"
      
      * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (33 commits)
        scsi: ses: Retry failed Send/Receive Diagnostic commands
        scsi: target: Fix spelling mistake "CONFLIFT" -> "CONFLICT"
        scsi: lpfc: Fix gcc -Wstringop-overread warning, again
        scsi: lpfc: Use correct scnprintf() limit
        scsi: lpfc: Fix sprintf() overflow in lpfc_display_fpin_wwpn()
        scsi: core: Remove 'current_tag'
        scsi: acornscsi: Remove tagged queuing vestiges
        scsi: fas216: Kill scmd->tag
        scsi: qla2xxx: Restore initiator in dual mode
        scsi: ufs: core: Unbreak the reset handler
        scsi: sd_zbc: Support disks with more than 2**32 logical blocks
        scsi: ufs: core: Revert "scsi: ufs: Synchronize SCSI and UFS error handling"
        scsi: bsg: Fix device unregistration
        scsi: sd: Make sd_spinup_disk() less noisy
        scsi: ufs: ufs-pci: Fix Intel LKF link stability
        scsi: mpt3sas: Clean up some inconsistent indenting
        scsi: megaraid: Clean up some inconsistent indenting
        scsi: sr: Fix spelling mistake "does'nt" -> "doesn't"
        scsi: Remove SCSI CDROM MAINTAINERS entry
        scsi: megaraid: Fix Coccinelle warning
        ...
      bb19237b
    • Linus Torvalds's avatar
      Merge tag 'io_uring-5.15-2021-09-25' of git://git.kernel.dk/linux-block · f6f360ae
      Linus Torvalds authored
      Pull io_uring fixes from Jens Axboe:
       "This one looks a bit bigger than it is, but that's mainly because 2/3
        of it is enabling IORING_OP_CLOSE to close direct file descriptors.
      
        We've had a few folks using them and finding it confusing that the way
        to close them is through using -1 for file update, this just brings
        API symmetry for direct descriptors. Hence I think we should just do
        this now and have a better API for 5.15 release. There's some room for
        de-duplicating the close code, but we're leaving that for the next
        merge window.
      
        Outside of that, just small fixes:
      
         - Poll race fixes (Hao)
      
         - io-wq core dump exit fix (me)
      
         - Reschedule around potentially intensive tctx and buffer iterators
           on teardown (me)
      
         - Fix for always ending up punting files update to io-wq (me)
      
         - Put the provided buffer meta data under memcg accounting (me)
      
         - Tweak for io_write(), removing dead code that was added with the
           iterator changes in this release (Pavel)"
      
      * tag 'io_uring-5.15-2021-09-25' of git://git.kernel.dk/linux-block:
        io_uring: make OP_CLOSE consistent with direct open
        io_uring: kill extra checks in io_write()
        io_uring: don't punt files update to io-wq unconditionally
        io_uring: put provided buffer meta data under memcg accounting
        io_uring: allow conditional reschedule for intensive iterators
        io_uring: fix potential req refcount underflow
        io_uring: fix missing set of EPOLLONESHOT for CQ ring overflow
        io_uring: fix race between poll completion and cancel_hash insertion
        io-wq: ensure we exit if thread group is exiting
      f6f360ae
    • Linus Torvalds's avatar
      Merge tag 'block-5.15-2021-09-25' of git://git.kernel.dk/linux-block · 2d70de4e
      Linus Torvalds authored
      Pull block fixes from Jens Axboe:
      
       - NVMe pull request via Christoph:
            - keep ctrl->namespaces ordered (Christoph Hellwig)
            - fix incorrect h2cdata pdu offset accounting in nvme-tcp (Sagi
              Grimberg)
            - handled updated hw_queues in nvme-fc more carefully (Daniel
              Wagner, James Smart)
      
       - md lock order fix (Christoph)
      
       - fallocate locking fix (Ming)
      
       - blktrace UAF fix (Zhihao)
      
       - rq-qos bio tracking fix (Ming)
      
      * tag 'block-5.15-2021-09-25' of git://git.kernel.dk/linux-block:
        block: hold ->invalidate_lock in blkdev_fallocate
        blktrace: Fix uaf in blk_trace access after removing by sysfs
        block: don't call rq_qos_ops->done_bio if the bio isn't tracked
        md: fix a lock order reversal in md_alloc
        nvme: keep ctrl->namespaces ordered
        nvme-tcp: fix incorrect h2cdata pdu offset accounting
        nvme-fc: remove freeze/unfreeze around update_nr_hw_queues
        nvme-fc: avoid race between time out and tear down
        nvme-fc: update hardware queues before using them
      2d70de4e
    • Linus Torvalds's avatar
      Merge tag 'for-linus-5.15b-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip · 57398443
      Linus Torvalds authored
      Pull xen fixes from Juergen Gross:
       "Some minor cleanups and fixes of some theoretical bugs, as well as a
        fix of a bug introduced in 5.15-rc1"
      
      * tag 'for-linus-5.15b-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
        xen/x86: fix PV trap handling on secondary processors
        xen/balloon: fix balloon kthread freezing
        swiotlb-xen: this is PV-only on x86
        xen/pci-swiotlb: reduce visibility of symbols
        PCI: only build xen-pcifront in PV-enabled environments
        swiotlb-xen: ensure to issue well-formed XENMEM_exchange requests
        Xen/gntdev: don't ignore kernel unmapping error
        xen/x86: drop redundant zeroing from cpu_initialize_context()
      57398443
    • Linus Torvalds's avatar
      Merge tag 'linux-kselftest-fixes-5.15-rc3' of... · 90316e6e
      Linus Torvalds authored
      Merge tag 'linux-kselftest-fixes-5.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest
      
      Pull Kselftest fixes from Shuah Khan:
      
       - fix to Kselftest common framework header install to run before other
         targets for it work correctly in parallel build case.
      
       - fixes to kvm test to not ignore fscanf() returns which could result
         in inconsistent test behavior and failures.
      
      * tag 'linux-kselftest-fixes-5.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest:
        selftests: kvm: fix get_run_delay() ignoring fscanf() return warn
        selftests: kvm: move get_run_delay() into lib/test_util
        selftests:kvm: fix get_trans_hugepagesz() ignoring fscanf() return warn
        selftests:kvm: fix get_warnings_count() ignoring fscanf() return warn
        selftests: be sure to make khdr before other targets
      90316e6e
    • Linus Torvalds's avatar
      Merge tag 'erofs-for-5.15-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs · a5e0acea
      Linus Torvalds authored
      Pull erofs fixes from Gao Xiang:
       "Two bugfixes to fix the 4KiB blockmap chunk format availability and a
        dangling pointer usage. There is also a trivial cleanup to clarify
        compacted_2b if compacted_4b_initial > totalidx.
      
        Summary:
      
         - fix the dangling pointer use in erofs_lookup tracepoint
      
         - fix unsupported chunk format check
      
         - zero out compacted_2b if compacted_4b_initial > totalidx"
      
      * tag 'erofs-for-5.15-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs:
        erofs: clear compacted_2b if compacted_4b_initial > totalidx
        erofs: fix misbehavior of unsupported chunk format check
        erofs: fix up erofs_lookup tracepoint
      a5e0acea
    • Linus Torvalds's avatar
      Merge tag '5.15-rc2-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6 · b8f42965
      Linus Torvalds authored
      Pull cifs fixes from Steve French:
       "Six small cifs/smb3 fixes, two for stable:
      
         - important fix for deferred close (found by a git functional test)
           related to attribute caching on close.
      
         - four (two cosmetic, two more serious) small fixes for problems
           pointed out by smatch via Dan Carpenter
      
         - fix for comment formatting problems pointed out by W=1"
      
      * tag '5.15-rc2-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6:
        cifs: fix incorrect check for null pointer in header_assemble
        smb3: correct server pointer dereferencing check to be more consistent
        smb3: correct smb3 ACL security descriptor
        cifs: Clear modified attribute bit from inode flags
        cifs: Deal with some warnings from W=1
        cifs: fix a sign extension bug
      b8f42965
    • Linus Torvalds's avatar
      Merge tag 'char-misc-5.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc · 85736168
      Linus Torvalds authored
      Pull char/misc driver fixes from Greg KH:
       "Here are some small char and misc driver fixes for 5.15-rc3.
      
        Nothing huge in here, just fixes for a number of small issues that
        have been reported. These include:
      
         - habanalabs race conditions and other bugs fixed
      
         - binder driver fixes
      
         - fpga driver fixes
      
         - coresight build warning fix
      
         - nvmem driver fix
      
         - comedi memory leak fix
      
         - bcm-vk tty race fix
      
         - other tiny driver fixes
      
        All of these have been in linux-next for a while with no reported
        issues"
      
      * tag 'char-misc-5.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (21 commits)
        comedi: Fix memory leak in compat_insnlist()
        nvmem: NVMEM_NINTENDO_OTP should depend on WII
        misc: bcm-vk: fix tty registration race
        fpga: dfl: Avoid reads to AFU CSRs during enumeration
        fpga: machxo2-spi: Fix missing error code in machxo2_write_complete()
        fpga: machxo2-spi: Return an error on failure
        habanalabs: expose a single cs seq in staged submissions
        habanalabs: fix wait offset handling
        habanalabs: rate limit multi CS completion errors
        habanalabs/gaudi: fix LBW RR configuration
        habanalabs: Fix spelling mistake "FEADBACK" -> "FEEDBACK"
        habanalabs: fail collective wait when not supported
        habanalabs/gaudi: use direct MSI in single mode
        habanalabs: fix kernel OOPs related to staged cs
        habanalabs: fix potential race in interrupt wait ioctl
        mcb: fix error handling in mcb_alloc_bus()
        misc: genwqe: Fixes DMA mask setting
        coresight: syscfg: Fix compiler warning
        nvmem: core: Add stubs for nvmem_cell_read_variable_le_u32/64 if !CONFIG_NVMEM
        binder: make sure fd closes complete
        ...
      85736168
    • Linus Torvalds's avatar
      Merge tag 'staging-5.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging · 9cbef308
      Linus Torvalds authored
      Pull staging driver fixes from Greg KH:
       "Here are two small staging driver fixes for 5.15-rc3:
      
         - greybus tty use-after-free bugfix
      
         - r8188eu ioctl overlap build warning fix
      
        Note, the r8188eu ioctl has been entirely removed for 5.16-rc1, but
        it's good to get this fixed now for people using this in 5.15.
      
        Both of these have been in linux-next for a while with no reported
        issues"
      
      * tag 'staging-5.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
        staging: r8188eu: fix -Wrestrict warnings
        staging: greybus: uart: fix tty use after free
      9cbef308
    • Linus Torvalds's avatar
      Merge tag 'tty-5.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty · f9d4be25
      Linus Torvalds authored
      Pull tty/serial fixes from Greg KH:
       "Here are four small tty/serial driver fixes for 5.15-rc3. They
        include:
      
         - remove an export now that no one is using it anymore
      
         - mvebu-uart tx_empty callback fix
      
         - 8250_omap bugfix
      
         - synclink_gt build fix
      
        All of these have been in linux-next for a while with no reported
        issues"
      
      * tag 'tty-5.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
        tty: unexport tty_ldisc_release
        tty: synclink_gt: rename a conflicting function name
        serial: mvebu-uart: fix driver's tx_empty callback
        serial: 8250: 8250_omap: Fix RX_LVL register offset
      f9d4be25
    • Linus Torvalds's avatar
      Merge tag 'usb-5.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb · 2c4e969c
      Linus Torvalds authored
      Pull USB driver fixes from Greg KH:
       "Here are some USB driver fixes and new device ids for 5.15-rc3.
      
        They include:
      
         - usb-storage quirk additions
      
         - usb-serial new device ids
      
         - usb-serial driver fixes
      
         - USB roothub registration bugfix to resolve a long-reported issue
      
         - usb gadget driver fixes for a large number of small things
      
         - dwc2 driver fixes
      
        All of these have been in linux-next for a while with no reported
        issues"
      
      * tag 'usb-5.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (28 commits)
        USB: serial: option: add device id for Foxconn T99W265
        USB: serial: cp210x: add ID for GW Instek GDM-834x Digital Multimeter
        USB: serial: cp210x: add part-number debug printk
        USB: serial: cp210x: fix dropped characters with CP2102
        MAINTAINERS: usb, update Peter Korsgaard's entries
        usb: musb: tusb6010: uninitialized data in tusb_fifo_write_unaligned()
        usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
        Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
        USB: serial: option: remove duplicate USB device ID
        USB: serial: mos7840: remove duplicated 0xac24 device ID
        arm64: dts: qcom: ipq8074: remove USB tx-fifo-resize property
        usb: gadget: f_uac2: Populate SS descriptors' wBytesPerInterval
        usb: gadget: f_uac2: Add missing companion descriptor for feedback EP
        usb: dwc2: gadget: Fix ISOC transfer complete handling for DDMA
        usb: core: hcd: Modularize HCD stop configuration in usb_stop_hcd()
        xhci: Set HCD flag to defer primary roothub registration
        usb: core: hcd: Add support for deferring roothub registration
        usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave
        usb: dwc3: core: balance phy init and exit
        Revert "USB: bcma: Add a check for devm_gpiod_get"
        ...
      2c4e969c
    • Hyunchul Lee's avatar
      ksmbd: use LOOKUP_BENEATH to prevent the out of share access · 265fd199
      Hyunchul Lee authored
      instead of removing '..' in a given path, call
      kern_path with LOOKUP_BENEATH flag to prevent
      the out of share access.
      
      ran various test on this:
      smb2-cat-async smb://127.0.0.1/homes/../out_of_share
      smb2-cat-async smb://127.0.0.1/homes/foo/../../out_of_share
      smbclient //127.0.0.1/homes -c "mkdir ../foo2"
      smbclient //127.0.0.1/homes -c "rename bar ../bar"
      
      Cc: Ronnie Sahlberg <ronniesahlberg@gmail.com>
      Cc: Ralph Boehme <slow@samba.org>
      Tested-by: default avatarSteve French <smfrench@gmail.com>
      Tested-by: default avatarNamjae Jeon <linkinjeon@kernel.org>
      Acked-by: default avatarNamjae Jeon <linkinjeon@kernel.org>
      Signed-off-by: default avatarHyunchul Lee <hyc.lee@gmail.com>
      Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
      265fd199
  5. 24 Sep, 2021 11 commits