An error occurred fetching the project authors.
  1. 02 Jun, 2022 28 commits
    • Ke Liu's avatar
      xdp: Directly use ida_alloc()/free() APIs · 21f1481a
      Ke Liu authored
      Use ida_alloc() / ida_free() instead of the deprecated ida_simple_get() /
      ida_simple_remove().
      Signed-off-by: default avatarKe Liu <liuke94@huawei.com>
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Signed-off-by: default avatarAndrii Nakryiko <andrii@kernel.org>
      Reviewed-by: default avatarMaciej Fijalkowski <maciej.fijalkowski@intel.com>
      Acked-by: default avatarJesper Dangaard Brouer <brouer@redhat.com>
      Link: https://lore.kernel.org/bpf/20220527064609.2358482-1-liuke94@huawei.com
      21f1481a
    • Linus Torvalds's avatar
      Merge tag 'net-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net · 58f9d52f
      Linus Torvalds authored
      Pull networking fixes from Jakub Kicinski:
       "Including fixes from bpf and netfilter.
      
        Current release - new code bugs:
      
         - af_packet: make sure to pull the MAC header, avoid skb panic in GSO
      
         - ptp_clockmatrix: fix inverted logic in is_single_shot()
      
         - netfilter: flowtable: fix missing FLOWI_FLAG_ANYSRC flag
      
         - dt-bindings: net: adin: fix adi,phy-output-clock description syntax
      
         - wifi: iwlwifi: pcie: rename CAUSE macro, avoid MIPS build warning
      
        Previous releases - regressions:
      
         - Revert "net: af_key: add check for pfkey_broadcast in function
           pfkey_process"
      
         - tcp: fix tcp_mtup_probe_success vs wrong snd_cwnd
      
         - nf_tables: disallow non-stateful expression in sets earlier
      
         - nft_limit: clone packet limits' cost value
      
         - nf_tables: double hook unregistration in netns path
      
         - ping6: fix ping -6 with interface name
      
        Previous releases - always broken:
      
         - sched: fix memory barriers to prevent skbs from getting stuck in
           lockless qdiscs
      
         - neigh: set lower cap for neigh_managed_work rearming, avoid
           constantly scheduling the probe work
      
         - bpf: fix probe read error on big endian in ___bpf_prog_run()
      
         - amt: memory leak and error handling fixes
      
        Misc:
      
         - ipv6: expand & rename accept_unsolicited_na to accept_untracked_na"
      
      * tag 'net-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (80 commits)
        net/af_packet: make sure to pull mac header
        net: add debug info to __skb_pull()
        net: CONFIG_DEBUG_NET depends on CONFIG_NET
        stmmac: intel: Add RPL-P PCI ID
        net: stmmac: use dev_err_probe() for reporting mdio bus registration failure
        tipc: check attribute length for bearer name
        ice: fix access-beyond-end in the switch code
        nfp: remove padding in nfp_nfdk_tx_desc
        ax25: Fix ax25 session cleanup problems
        net: usb: qmi_wwan: Add support for Cinterion MV31 with new baseline
        sfc/siena: fix wrong tx channel offset with efx_separate_tx_channels
        sfc/siena: fix considering that all channels have TX queues
        socket: Don't use u8 type in uapi socket.h
        net/sched: act_api: fix error code in tcf_ct_flow_table_fill_tuple_ipv6()
        net: ping6: Fix ping -6 with interface name
        macsec: fix UAF bug for real_dev
        octeontx2-af: fix error code in is_valid_offset()
        wifi: mac80211: fix use-after-free in chanctx code
        bonding: guard ns_targets by CONFIG_IPV6
        tcp: tcp_rtx_synack() can be called from process context
        ...
      58f9d52f
    • Saravana Kannan's avatar
      module: Fix prefix for module.sig_enforce module param · 73503963
      Saravana Kannan authored
      Commit cfc1d277 ("module: Move all into module/") changed the prefix
      of the module param by moving/renaming files.  A later commit also moves
      the module_param() into a different file, thereby changing the prefix
      yet again.
      
      This would break kernel cmdline compatibility and also userspace
      compatibility at /sys/module/module/parameters/sig_enforce.
      
      So, set the prefix back to "module.".
      
      Fixes: cfc1d277 ("module: Move all into module/")
      Link: https://lore.kernel.org/lkml/20220602034111.4163292-1-saravanak@google.com/
      Cc: Christophe Leroy <christophe.leroy@csgroup.eu>
      Cc: Aaron Tomlin <atomlin@redhat.com>
      Acked-by: default avatarLuis Chamberlain <mcgrof@kernel.org>
      Signed-off-by: default avatarSaravana Kannan <saravanak@google.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      73503963
    • Linus Torvalds's avatar
      Merge tag 'pci-v5.19-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci · c399c85d
      Linus Torvalds authored
      Pull pci fixes from Bjorn Helgaas:
      
       - Revert brcmstb patches that broke booting on Raspberry Pi Compute
         Module 4 (Bjorn Helgaas)
      
       - Fix bridge_d3_blacklist[] error that overwrote the existing Gigabyte
         X299 entry instead of adding a new one (Bjorn Helgaas)
      
       - Update Lorenzo Pieralisi's email address in MAINTAINERS (Lorenzo
         Pieralisi)
      
      * tag 'pci-v5.19-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci:
        MAINTAINERS: Update Lorenzo Pieralisi's email address
        PCI/PM: Fix bridge_d3_blacklist[] Elo i2 overwrite of Gigabyte X299
        Revert "PCI: brcmstb: Split brcm_pcie_setup() into two funcs"
        Revert "PCI: brcmstb: Add mechanism to turn on subdev regulators"
        Revert "PCI: brcmstb: Add control of subdevice voltage regulators"
        Revert "PCI: brcmstb: Do not turn off WOL regulators on suspend"
      c399c85d
    • Jakub Kicinski's avatar
      Merge branch 'net-af_packet-be-careful-when-expanding-mac-header-size' · 638696ef
      Jakub Kicinski authored
      Eric Dumazet says:
      
      ====================
      net: af_packet: be careful when expanding mac header size
      
      A recent regression in af_packet needed a preliminary debug patch,
      which will presumably be useful for next bugs hunting.
      
      The af_packet fix is to make sure MAC headers are contained in
      skb linear part, as GSO stack requests.
      
      v2: CONFIG_DEBUG_NET depends on CONFIG_NET to avoid compile
         errors found by kernel bots.
      ====================
      
      Link: https://lore.kernel.org/r/20220602161859.2546399-1-eric.dumazet@gmail.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      638696ef
    • Eric Dumazet's avatar
      net/af_packet: make sure to pull mac header · e9d3f809
      Eric Dumazet authored
      GSO assumes skb->head contains link layer headers.
      
      tun device in some case can provide base 14 bytes,
      regardless of VLAN being used or not.
      
      After blamed commit, we can end up setting a network
      header offset of 18+, we better pull the missing
      bytes to avoid a posible crash in GSO.
      
      syzbot report was:
      kernel BUG at include/linux/skbuff.h:2699!
      invalid opcode: 0000 [#1] PREEMPT SMP KASAN
      CPU: 1 PID: 3601 Comm: syz-executor210 Not tainted 5.18.0-syzkaller-11338-g2c5ca23f #0
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
      RIP: 0010:__skb_pull include/linux/skbuff.h:2699 [inline]
      RIP: 0010:skb_mac_gso_segment+0x48f/0x530 net/core/gro.c:136
      Code: 00 48 c7 c7 00 96 d4 8a c6 05 cb d3 45 06 01 e8 26 bb d0 01 e9 2f fd ff ff 49 c7 c4 ea ff ff ff e9 f1 fe ff ff e8 91 84 19 fa <0f> 0b 48 89 df e8 97 44 66 fa e9 7f fd ff ff e8 ad 44 66 fa e9 48
      RSP: 0018:ffffc90002e2f4b8 EFLAGS: 00010293
      RAX: 0000000000000000 RBX: 0000000000000012 RCX: 0000000000000000
      RDX: ffff88805bb58000 RSI: ffffffff8760ed0f RDI: 0000000000000004
      RBP: 0000000000005dbc R08: 0000000000000004 R09: 0000000000000fe0
      R10: 0000000000000fe4 R11: 0000000000000000 R12: 0000000000000fe0
      R13: ffff88807194d780 R14: 1ffff920005c5e9b R15: 0000000000000012
      FS:  000055555730f300(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 00000000200015c0 CR3: 0000000071ff8000 CR4: 0000000000350ee0
      Call Trace:
       <TASK>
       __skb_gso_segment+0x327/0x6e0 net/core/dev.c:3411
       skb_gso_segment include/linux/netdevice.h:4749 [inline]
       validate_xmit_skb+0x6bc/0xf10 net/core/dev.c:3669
       validate_xmit_skb_list+0xbc/0x120 net/core/dev.c:3719
       sch_direct_xmit+0x3d1/0xbe0 net/sched/sch_generic.c:327
       __dev_xmit_skb net/core/dev.c:3815 [inline]
       __dev_queue_xmit+0x14a1/0x3a00 net/core/dev.c:4219
       packet_snd net/packet/af_packet.c:3071 [inline]
       packet_sendmsg+0x21cb/0x5550 net/packet/af_packet.c:3102
       sock_sendmsg_nosec net/socket.c:714 [inline]
       sock_sendmsg+0xcf/0x120 net/socket.c:734
       ____sys_sendmsg+0x6eb/0x810 net/socket.c:2492
       ___sys_sendmsg+0xf3/0x170 net/socket.c:2546
       __sys_sendmsg net/socket.c:2575 [inline]
       __do_sys_sendmsg net/socket.c:2584 [inline]
       __se_sys_sendmsg net/socket.c:2582 [inline]
       __x64_sys_sendmsg+0x132/0x220 net/socket.c:2582
       do_syscall_x64 arch/x86/entry/common.c:50 [inline]
       do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
       entry_SYSCALL_64_after_hwframe+0x46/0xb0
      RIP: 0033:0x7f4b95da06c9
      Code: 28 c3 e8 4a 15 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
      RSP: 002b:00007ffd7defc4c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
      RAX: ffffffffffffffda RBX: 00007ffd7defc4f0 RCX: 00007f4b95da06c9
      RDX: 0000000000000000 RSI: 0000000020000140 RDI: 0000000000000003
      RBP: 0000000000000003 R08: bb1414ac00000050 R09: bb1414ac00000050
      R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000000
      R13: 00007ffd7defc4e0 R14: 00007ffd7defc4d8 R15: 00007ffd7defc4d4
       </TASK>
      
      Fixes: dfed913e ("net/af_packet: add VLAN support for AF_PACKET SOCK_RAW GSO")
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
      Acked-by: default avatarHangbin Liu <liuhangbin@gmail.com>
      Acked-by: default avatarWillem de Bruijn <willemb@google.com>
      Cc: Michael S. Tsirkin <mst@redhat.com>
      Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      e9d3f809
    • Eric Dumazet's avatar
      net: add debug info to __skb_pull() · 22296a5c
      Eric Dumazet authored
      While analyzing yet another syzbot report, I found the following
      patch very useful. It allows to better understand what went wrong.
      
      This debug info is only enabled if CONFIG_DEBUG_NET=y,
      which is the case for syzbot builds.
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Acked-by: default avatarWillem de Bruijn <willemb@google.com>
      Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      22296a5c
    • Eric Dumazet's avatar
      net: CONFIG_DEBUG_NET depends on CONFIG_NET · eb0b39ef
      Eric Dumazet authored
      It makes little sense to debug networking stacks
      if networking is not compiled in.
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      eb0b39ef
    • Michael Sit Wei Hong's avatar
    • Rasmus Villemoes's avatar
      net: stmmac: use dev_err_probe() for reporting mdio bus registration failure · 839612d2
      Rasmus Villemoes authored
      I have a board where these two lines are always printed during boot:
      
         imx-dwmac 30bf0000.ethernet: Cannot register the MDIO bus
         imx-dwmac 30bf0000.ethernet: stmmac_dvr_probe: MDIO bus (id: 1) registration failed
      
      It's perfectly fine, and the device is successfully (and silently, as
      far as the console goes) probed later.
      
      Use dev_err_probe() instead, which will demote these messages to debug
      level (thus removing the alarming messages from the console) when the
      error is -EPROBE_DEFER, and also has the advantage of including the
      error code if/when it happens to be something other than -EPROBE_DEFER.
      
      While here, add the missing \n to one of the format strings.
      Signed-off-by: default avatarRasmus Villemoes <linux@rasmusvillemoes.dk>
      Link: https://lore.kernel.org/r/20220602074840.1143360-1-linux@rasmusvillemoes.dkSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      839612d2
    • Hoang Le's avatar
      tipc: check attribute length for bearer name · 7f36f798
      Hoang Le authored
      syzbot reported uninit-value:
      =====================================================
      BUG: KMSAN: uninit-value in string_nocheck lib/vsprintf.c:644 [inline]
      BUG: KMSAN: uninit-value in string+0x4f9/0x6f0 lib/vsprintf.c:725
       string_nocheck lib/vsprintf.c:644 [inline]
       string+0x4f9/0x6f0 lib/vsprintf.c:725
       vsnprintf+0x2222/0x3650 lib/vsprintf.c:2806
       vprintk_store+0x537/0x2150 kernel/printk/printk.c:2158
       vprintk_emit+0x28b/0xab0 kernel/printk/printk.c:2256
       vprintk_default+0x86/0xa0 kernel/printk/printk.c:2283
       vprintk+0x15f/0x180 kernel/printk/printk_safe.c:50
       _printk+0x18d/0x1cf kernel/printk/printk.c:2293
       tipc_enable_bearer net/tipc/bearer.c:371 [inline]
       __tipc_nl_bearer_enable+0x2022/0x22a0 net/tipc/bearer.c:1033
       tipc_nl_bearer_enable+0x6c/0xb0 net/tipc/bearer.c:1042
       genl_family_rcv_msg_doit net/netlink/genetlink.c:731 [inline]
      
      - Do sanity check the attribute length for TIPC_NLA_BEARER_NAME.
      - Do not use 'illegal name' in printing message.
      
      Reported-by: syzbot+e820fdc8ce362f2dea51@syzkaller.appspotmail.com
      Fixes: cb30a633 ("tipc: refactor function tipc_enable_bearer()")
      Acked-by: default avatarJon Maloy <jmaloy@redhat.com>
      Signed-off-by: default avatarHoang Le <hoang.h.le@dektech.com.au>
      Link: https://lore.kernel.org/r/20220602063053.5892-1-hoang.h.le@dektech.com.auSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      7f36f798
    • Linus Torvalds's avatar
      Merge tag 'ceph-for-5.19-rc1' of https://github.com/ceph/ceph-client · 17d8e3d9
      Linus Torvalds authored
      Pull ceph updates from Ilya Dryomov:
       "A big pile of assorted fixes and improvements for the filesystem with
        nothing in particular standing out, except perhaps that the fact that
        the MDS never really maintained atime was made official and thus it's
        no longer updated on the client either.
      
        We also have a MAINTAINERS update: Jeff is transitioning his
        filesystem maintainership duties to Xiubo"
      
      * tag 'ceph-for-5.19-rc1' of https://github.com/ceph/ceph-client: (23 commits)
        MAINTAINERS: move myself from ceph "Maintainer" to "Reviewer"
        ceph: fix decoding of client session messages flags
        ceph: switch TASK_INTERRUPTIBLE to TASK_KILLABLE
        ceph: remove redundant variable ino
        ceph: try to queue a writeback if revoking fails
        ceph: fix statfs for subdir mounts
        ceph: fix possible deadlock when holding Fwb to get inline_data
        ceph: redirty the page for writepage on failure
        ceph: try to choose the auth MDS if possible for getattr
        ceph: disable updating the atime since cephfs won't maintain it
        ceph: flush the mdlog for filesystem sync
        ceph: rename unsafe_request_wait()
        libceph: use swap() macro instead of taking tmp variable
        ceph: fix statx AT_STATX_DONT_SYNC vs AT_STATX_FORCE_SYNC check
        ceph: no need to invalidate the fscache twice
        ceph: replace usage of found with dedicated list iterator variable
        ceph: use dedicated list iterator variable
        ceph: update the dlease for the hashed dentry when removing
        ceph: stop retrying the request when exceeding 256 times
        ceph: stop forwarding the request when exceeding 256 times
        ...
      17d8e3d9
    • Linus Torvalds's avatar
      Merge tag 'livepatching-for-5.19' of... · 7c9e960c
      Linus Torvalds authored
      Merge tag 'livepatching-for-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/livepatching/livepatching
      
      Pull livepatching cleanup from Petr Mladek:
      
       - Remove duplicated livepatch code [Christophe]
      
      * tag 'livepatching-for-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/livepatching/livepatching:
        livepatch: Remove klp_arch_set_pc() and asm/livepatch.h
      7c9e960c
    • Linus Torvalds's avatar
      Merge tag 'printk-for-5.19-fixup' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux · 12831f64
      Linus Torvalds authored
      Pull printk fixup from Petr Mladek:
      
       - Revert inappropriate use of wake_up_interruptible_all() in printk()
      
      * tag 'printk-for-5.19-fixup' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux:
        Revert "printk: wake up all waiters"
      12831f64
    • Linus Torvalds's avatar
      Merge tag 'memblock-v5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock · ca1dcc6d
      Linus Torvalds authored
      Pull memblock test suite updates from Mike Rapoport:
       "Comment updates for memblock test suite
      
        Update comments in the memblock tests so that they will have
        consistent style"
      
      * tag 'memblock-v5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock:
        memblock tests: remove completed TODO item
        memblock tests: update style of comments for memblock_free_*() functions
        memblock tests: update style of comments for memblock_remove_*() functions
        memblock tests: update style of comments for memblock_reserve_*() functions
        memblock tests: update style of comments for memblock_add_*() functions
      ca1dcc6d
    • Dan Carpenter's avatar
      i2c: ismt: prevent memory corruption in ismt_access() · 690b2549
      Dan Carpenter authored
      The "data->block[0]" variable comes from the user and is a number
      between 0-255.  It needs to be capped to prevent writing beyond the end
      of dma_buffer[].
      
      Fixes: 5e9a97b1 ("i2c: ismt: Adding support for I2C_SMBUS_BLOCK_PROC_CALL")
      Reported-and-tested-by: default avatarZheyu Ma <zheyuma97@gmail.com>
      Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Reviewed-by: default avatarMika Westerberg <mika.westerberg@linux.intel.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      690b2549
    • Alexander Lobakin's avatar
      ice: fix access-beyond-end in the switch code · 6e1ff618
      Alexander Lobakin authored
      Global `-Warray-bounds` enablement revealed some problems, one of
      which is the way we define and use AQC rules messages.
      In fact, they have a shared header, followed by the actual message,
      which can be of one of several different formats. So it is
      straightforward enough to define that header as a separate struct
      and then embed it into message structures as needed, but currently
      all the formats reside in one union coupled with the header. Then,
      the code allocates only the memory needed for a particular message
      format, leaving the union potentially incomplete.
      There are no actual reads or writes beyond the end of an allocated
      chunk, but at the same time, the whole implementation is fragile and
      backed by an equilibrium rather than strong type and memory checks.
      
      Define the structures the other way around: one for the common
      header and the rest for the actual formats with the header embedded.
      There are no places where several union members would be used at the
      same time anyway. This allows to use proper struct_size() and let
      the compiler know what is going to be done.
      Finally, unsilence `-Warray-bounds` back for ice_switch.c.
      
      Other little things worth mentioning:
      * &ice_sw_rule_vsi_list_query is not used anywhere, remove it. It's
        weird anyway to talk to hardware with purely kernel types
        (bitmaps);
      * expand the ICE_SW_RULE_*_SIZE() macros to pass a structure
        variable name to struct_size() to let it do strict typechecking;
      * rename ice_sw_rule_lkup_rx_tx::hdr to ::hdr_data to keep ::hdr
        for the header structure to have the same name for it constistenly
        everywhere;
      * drop the duplicate of %ICE_SW_RULE_RX_TX_NO_HDR_SIZE residing in
        ice_switch.h.
      
      Fixes: 9daf8208 ("ice: Add support for switch filter programming")
      Fixes: 66486d89 ("ice: replace single-element array used for C struct hack")
      Signed-off-by: default avatarAlexander Lobakin <alexandr.lobakin@intel.com>
      Reviewed-by: default avatarMarcin Szycik <marcin.szycik@linux.intel.com>
      Acked-by: default avatarTony Nguyen <anthony.l.nguyen@intel.com>
      Link: https://lore.kernel.org/r/20220601105924.2841410-1-alexandr.lobakin@intel.comSigned-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      6e1ff618
    • Fei Qin's avatar
      nfp: remove padding in nfp_nfdk_tx_desc · c6fbbf1e
      Fei Qin authored
      NFDK firmware supports 48-bit dma addressing and
      parses 16 high bits of dma addresses.
      
      In nfp_nfdk_tx_desc, dma related structure and tso
      related structure are union. When "mss" be filled
      with nonzero value due to enable tso, the memory used
      by "padding" may be also filled. Then, firmware may
      parse wrong dma addresses which causes TX watchdog
      timeout problem.
      
      This patch removes padding and unifies the dma_addr_hi
      bits with the one in firmware. nfp_nfdk_tx_desc_set_dma_addr
      is also added to match this change.
      
      Fixes: c10d12e3 ("nfp: add support for NFDK data path")
      Signed-off-by: default avatarFei Qin <fei.qin@corigine.com>
      Signed-off-by: default avatarYinjun Zhang <yinjun.zhang@corigine.com>
      Signed-off-by: default avatarLouis Peens <louis.peens@corigine.com>
      Signed-off-by: default avatarSimon Horman <simon.horman@corigine.com>
      Link: https://lore.kernel.org/r/20220601083449.50556-1-simon.horman@corigine.comSigned-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      c6fbbf1e
    • Duoming Zhou's avatar
      ax25: Fix ax25 session cleanup problems · 7d8a3a47
      Duoming Zhou authored
      There are session cleanup problems in ax25_release() and
      ax25_disconnect(). If we setup a session and then disconnect,
      the disconnected session is still in "LISTENING" state that
      is shown below.
      
      Active AX.25 sockets
      Dest       Source     Device  State        Vr/Vs    Send-Q  Recv-Q
      DL9SAU-4   DL9SAU-3   ???     LISTENING    000/000  0       0
      DL9SAU-3   DL9SAU-4   ???     LISTENING    000/000  0       0
      
      The first reason is caused by del_timer_sync() in ax25_release().
      The timers of ax25 are used for correct session cleanup. If we use
      ax25_release() to close ax25 sessions and ax25_dev is not null,
      the del_timer_sync() functions in ax25_release() will execute.
      As a result, the sessions could not be cleaned up correctly,
      because the timers have stopped.
      
      In order to solve this problem, this patch adds a device_up flag
      in ax25_dev in order to judge whether the device is up. If there
      are sessions to be cleaned up, the del_timer_sync() in
      ax25_release() will not execute. What's more, we add ax25_cb_del()
      in ax25_kill_by_device(), because the timers have been stopped
      and there are no functions that could delete ax25_cb if we do not
      call ax25_release(). Finally, we reorder the position of
      ax25_list_lock in ax25_cb_del() in order to synchronize among
      different functions that call ax25_cb_del().
      
      The second reason is caused by improper check in ax25_disconnect().
      The incoming ax25 sessions which ax25->sk is null will close
      heartbeat timer, because the check "if(!ax25->sk || ..)" is
      satisfied. As a result, the session could not be cleaned up properly.
      
      In order to solve this problem, this patch changes the improper
      check to "if(ax25->sk && ..)" in ax25_disconnect().
      
      What`s more, the ax25_disconnect() may be called twice, which is
      not necessary. For example, ax25_kill_by_device() calls
      ax25_disconnect() and sets ax25->state to AX25_STATE_0, but
      ax25_release() calls ax25_disconnect() again.
      
      In order to solve this problem, this patch add a check in
      ax25_release(). If the flag of ax25->sk equals to SOCK_DEAD,
      the ax25_disconnect() in ax25_release() should not be executed.
      
      Fixes: 82e31755 ("ax25: Fix UAF bugs in ax25 timers")
      Fixes: 8a367e74 ("ax25: Fix segfault after sock connection timeout")
      Reported-and-tested-by: default avatarThomas Osterried <thomas@osterried.de>
      Signed-off-by: default avatarDuoming Zhou <duoming@zju.edu.cn>
      Link: https://lore.kernel.org/r/20220530152158.108619-1-duoming@zju.edu.cnSigned-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      7d8a3a47
    • Stephen Brennan's avatar
      assoc_array: Fix BUG_ON during garbage collect · d1dc8776
      Stephen Brennan authored
      A rare BUG_ON triggered in assoc_array_gc:
      
          [3430308.818153] kernel BUG at lib/assoc_array.c:1609!
      
      Which corresponded to the statement currently at line 1593 upstream:
      
          BUG_ON(assoc_array_ptr_is_meta(p));
      
      Using the data from the core dump, I was able to generate a userspace
      reproducer[1] and determine the cause of the bug.
      
      [1]: https://github.com/brenns10/kernel_stuff/tree/master/assoc_array_gc
      
      After running the iterator on the entire branch, an internal tree node
      looked like the following:
      
          NODE (nr_leaves_on_branch: 3)
            SLOT [0] NODE (2 leaves)
            SLOT [1] NODE (1 leaf)
            SLOT [2..f] NODE (empty)
      
      In the userspace reproducer, the pr_devel output when compressing this
      node was:
      
          -- compress node 0x5607cc089380 --
          free=0, leaves=0
          [0] retain node 2/1 [nx 0]
          [1] fold node 1/1 [nx 0]
          [2] fold node 0/1 [nx 2]
          [3] fold node 0/2 [nx 2]
          [4] fold node 0/3 [nx 2]
          [5] fold node 0/4 [nx 2]
          [6] fold node 0/5 [nx 2]
          [7] fold node 0/6 [nx 2]
          [8] fold node 0/7 [nx 2]
          [9] fold node 0/8 [nx 2]
          [10] fold node 0/9 [nx 2]
          [11] fold node 0/10 [nx 2]
          [12] fold node 0/11 [nx 2]
          [13] fold node 0/12 [nx 2]
          [14] fold node 0/13 [nx 2]
          [15] fold node 0/14 [nx 2]
          after: 3
      
      At slot 0, an internal node with 2 leaves could not be folded into the
      node, because there was only one available slot (slot 0). Thus, the
      internal node was retained. At slot 1, the node had one leaf, and was
      able to be folded in successfully. The remaining nodes had no leaves,
      and so were removed. By the end of the compression stage, there were 14
      free slots, and only 3 leaf nodes. The tree was ascended and then its
      parent node was compressed. When this node was seen, it could not be
      folded, due to the internal node it contained.
      
      The invariant for compression in this function is: whenever
      nr_leaves_on_branch < ASSOC_ARRAY_FAN_OUT, the node should contain all
      leaf nodes. The compression step currently cannot guarantee this, given
      the corner case shown above.
      
      To fix this issue, retry compression whenever we have retained a node,
      and yet nr_leaves_on_branch < ASSOC_ARRAY_FAN_OUT. This second
      compression will then allow the node in slot 1 to be folded in,
      satisfying the invariant. Below is the output of the reproducer once the
      fix is applied:
      
          -- compress node 0x560e9c562380 --
          free=0, leaves=0
          [0] retain node 2/1 [nx 0]
          [1] fold node 1/1 [nx 0]
          [2] fold node 0/1 [nx 2]
          [3] fold node 0/2 [nx 2]
          [4] fold node 0/3 [nx 2]
          [5] fold node 0/4 [nx 2]
          [6] fold node 0/5 [nx 2]
          [7] fold node 0/6 [nx 2]
          [8] fold node 0/7 [nx 2]
          [9] fold node 0/8 [nx 2]
          [10] fold node 0/9 [nx 2]
          [11] fold node 0/10 [nx 2]
          [12] fold node 0/11 [nx 2]
          [13] fold node 0/12 [nx 2]
          [14] fold node 0/13 [nx 2]
          [15] fold node 0/14 [nx 2]
          internal nodes remain despite enough space, retrying
          -- compress node 0x560e9c562380 --
          free=14, leaves=1
          [0] fold node 2/15 [nx 0]
          after: 3
      
      Changes
      =======
      DH:
       - Use false instead of 0.
       - Reorder the inserted lines in a couple of places to put retained before
         next_slot.
      
      ver #2)
       - Fix typo in pr_devel, correct comparison to "<="
      
      Fixes: 3cb98950 ("Add a generic associative array implementation.")
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarStephen Brennan <stephen.s.brennan@oracle.com>
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      cc: Andrew Morton <akpm@linux-foundation.org>
      cc: keyrings@vger.kernel.org
      Link: https://lore.kernel.org/r/20220511225517.407935-1-stephen.s.brennan@oracle.com/ # v1
      Link: https://lore.kernel.org/r/20220512215045.489140-1-stephen.s.brennan@oracle.com/ # v2
      Reviewed-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      d1dc8776
    • Slark Xiao's avatar
      net: usb: qmi_wwan: Add support for Cinterion MV31 with new baseline · 9f4fc18b
      Slark Xiao authored
      Adding support for Cinterion device MV31 with Qualcomm
      new baseline. Use different PIDs to separate it from
      previous base line products.
      All interfaces settings keep same as previous.
      
      T:  Bus=03 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  7 Spd=480 MxCh= 0
      D:  Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
      P:  Vendor=1e2d ProdID=00b9 Rev=04.14
      S:  Manufacturer=Cinterion
      S:  Product=Cinterion PID 0x00B9 USB Mobile Broadband
      S:  SerialNumber=90418e79
      C:  #Ifs= 4 Cfg#= 1 Atr=a0 MxPwr=500mA
      I:  If#=0x0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan
      I:  If#=0x1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
      I:  If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option
      I:  If#=0x3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
      Signed-off-by: default avatarSlark Xiao <slark_xiao@163.com>
      Acked-by: default avatarBjørn Mork <bjorn@mork.no>
      Link: https://lore.kernel.org/r/20220601040531.6016-1-slark_xiao@163.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      9f4fc18b
    • Jakub Kicinski's avatar
      Merge tag 'mlx5-fixes-2022-05-31' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux · c034ff2b
      Jakub Kicinski authored
      Saeed Mahameed says:
      
      ====================
      mlx5 fixes 2022-05-31
      
      This series provides bug fixes to mlx5 driver.
      Please pull and let me know if there is any problem.
      
      * tag 'mlx5-fixes-2022-05-31' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux:
        net/mlx5: Fix mlx5_get_next_dev() peer device matching
        net/mlx5e: Update netdev features after changing XDP state
        net/mlx5: correct ECE offset in query qp output
        net/mlx5e: Disable softirq in mlx5e_activate_rq to avoid race condition
        net/mlx5: CT: Fix header-rewrite re-use for tupels
        net/mlx5e: TC NIC mode, fix tc chains miss table
        net/mlx5: Don't use already freed action pointer
      ====================
      
      Link: https://lore.kernel.org/r/20220531205447.99236-1-saeed@kernel.orgSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      c034ff2b
    • Jakub Kicinski's avatar
      Merge branch 'sfc-siena-fix-some-efx_separate_tx_channels-errors' · 11049c9e
      Jakub Kicinski authored
      Íñigo Huguet says:
      
      ====================
      sfc/siena: fix some efx_separate_tx_channels errors
      
      Trying to load sfc driver with modparam efx_separate_tx_channels=1
      resulted in errors during initialization and not being able to use the
      NIC. This patches fix a few bugs and make it work again.
      
      This has been already done for sfc, do it also for sfc_siena.
      ====================
      
      Link: https://lore.kernel.org/r/20220601063603.15362-1-ihuguet@redhat.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      11049c9e
    • Íñigo Huguet's avatar
      sfc/siena: fix wrong tx channel offset with efx_separate_tx_channels · 25bde571
      Íñigo Huguet authored
      tx_channel_offset is calculated in efx_allocate_msix_channels, but it is
      also calculated again in efx_set_channels because it was originally done
      there, and when efx_allocate_msix_channels was introduced it was
      forgotten to be removed from efx_set_channels.
      
      Moreover, the old calculation is wrong when using
      efx_separate_tx_channels because now we can have XDP channels after the
      TX channels, so n_channels - n_tx_channels doesn't point to the first TX
      channel.
      
      Remove the old calculation from efx_set_channels, and add the
      initialization of this variable if MSI or legacy interrupts are used,
      next to the initialization of the rest of the related variables, where
      it was missing.
      
      This has been already done for sfc, do it also for sfc_siena.
      
      Fixes: 3990a8ff ("sfc: allocate channels for XDP tx queues")
      Reported-by: default avatarTianhao Zhao <tizhao@redhat.com>
      Signed-off-by: default avatarÍñigo Huguet <ihuguet@redhat.com>
      Acked-by: default avatarMartin Habets <habetsm.xilinx@gmail.com>
      Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      25bde571
    • Martin Habets's avatar
      sfc/siena: fix considering that all channels have TX queues · 183614bf
      Martin Habets authored
      Normally, all channels have RX and TX queues, but this is not true if
      modparam efx_separate_tx_channels=1 is used. In that cases, some
      channels only have RX queues and others only TX queues (or more
      preciselly, they have them allocated, but not initialized).
      
      Fix efx_channel_has_tx_queues to return the correct value for this case
      too.
      
      This has been already done for sfc, do it also for sfc_siena.
      
      Messages shown at probe time before the fix:
       sfc 0000:03:00.0 ens6f0np0: MC command 0x82 inlen 544 failed rc=-22 (raw=0) arg=0
       ------------[ cut here ]------------
       netdevice: ens6f0np0: failed to initialise TXQ -1
       WARNING: CPU: 1 PID: 626 at drivers/net/ethernet/sfc/ef10.c:2393 efx_ef10_tx_init+0x201/0x300 [sfc]
       [...] stripped
       RIP: 0010:efx_ef10_tx_init+0x201/0x300 [sfc]
       [...] stripped
       Call Trace:
        efx_init_tx_queue+0xaa/0xf0 [sfc]
        efx_start_channels+0x49/0x120 [sfc]
        efx_start_all+0x1f8/0x430 [sfc]
        efx_net_open+0x5a/0xe0 [sfc]
        __dev_open+0xd0/0x190
        __dev_change_flags+0x1b3/0x220
        dev_change_flags+0x21/0x60
       [...] stripped
      
      Messages shown at remove time before the fix:
       sfc 0000:03:00.0 ens6f0np0: failed to flush 10 queues
       sfc 0000:03:00.0 ens6f0np0: failed to flush queues
      
      Fixes: 8700aff0 ("sfc: fix channel allocation with brute force")
      Reported-by: default avatarTianhao Zhao <tizhao@redhat.com>
      Signed-off-by: default avatarMartin Habets <habetsm.xilinx@gmail.com>
      Tested-by: default avatarÍñigo Huguet <ihuguet@redhat.com>
      Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      183614bf
    • Jakub Kicinski's avatar
      Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec · 2440d206
      Jakub Kicinski authored
      Steffen Klassert says:
      
      ====================
      ipsec 2022-06-01
      
      1) Revert "net: af_key: add check for pfkey_broadcast in function pfkey_process"
         From Michal Kubecek.
      
      2) Don't set IPv4 DF bit when encapsulating IPv6 frames below 1280 bytes.
         From Maciej Żenczykowski.
      
      * 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec:
        xfrm: do not set IPv4 DF flag when encapsulating IPv6 frames <= 1280 bytes.
        Revert "net: af_key: add check for pfkey_broadcast in function pfkey_process"
      ====================
      
      Link: https://lore.kernel.org/r/20220601103349.2297361-1-steffen.klassert@secunet.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      2440d206
    • Jakub Kicinski's avatar
      Merge tag 'wireless-2022-06-01' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless · 38a4762e
      Jakub Kicinski authored
      Kalle Valo says:
      
      ====================
      wireless fixes for v5.19
      
      First set of fixes for v5.19. Build fixes for iwlwifi and libertas, a
      scheduling while atomic fix for rtw88 and use-after-free fix for
      mac80211.
      
      * tag 'wireless-2022-06-01' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless:
        wifi: mac80211: fix use-after-free in chanctx code
        wifi: rtw88: add a work to correct atomic scheduling warning of ::set_tim
        wifi: iwlwifi: pcie: rename CAUSE macro
        wifi: libertas: use variable-size data in assoc req/resp cmd
      ====================
      
      Link: https://lore.kernel.org/r/20220601110741.90B28C385A5@smtp.kernel.orgSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      38a4762e
    • Linus Torvalds's avatar
      Merge tag 'xfs-5.19-for-linus-2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux · 0e5ab8dd
      Linus Torvalds authored
      Pull more xfs updates from Dave Chinner:
       "This update is largely bug fixes and cleanups for all the code merged
        in the first pull request. The majority of them are to the new logged
        attribute code, but there are also a couple of fixes for other log
        recovery and memory leaks that have recently been found.
      
        Summary:
      
         - fix refcount leak in xfs_ifree()
      
         - fix xfs_buf_cancel structure leaks in log recovery
      
         - fix dquot leak after failed quota check
      
         - fix a couple of problematic ASSERTS
      
         - fix small aim7 perf regression in from new btree sibling validation
      
         - clean up log incompat feature marking for new logged attribute
           feature
      
         - disallow logged attributes on legacy V4 filesystem formats.
      
         - fix da state leak when freeing attr intents
      
         - improve validation of the attr log items in recovery
      
         - use slab caches for commonly used attr structures
      
         - fix leaks of attr name/value buffer and reduce copying overhead
           during intent logging
      
         - remove some dead debug code from log recovery"
      
      * tag 'xfs-5.19-for-linus-2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: (33 commits)
        xfs: fix xfs_ifree() error handling to not leak perag ref
        xfs: move xfs_attr_use_log_assist usage out of libxfs
        xfs: move xfs_attr_use_log_assist out of xfs_log.c
        xfs: warn about LARP once per mount
        xfs: implement per-mount warnings for scrub and shrink usage
        xfs: don't log every time we clear the log incompat flags
        xfs: convert buf_cancel_table allocation to kmalloc_array
        xfs: don't leak xfs_buf_cancel structures when recovery fails
        xfs: refactor buffer cancellation table allocation
        xfs: don't leak btree cursor when insrec fails after a split
        xfs: purge dquots after inode walk fails during quotacheck
        xfs: assert in xfs_btree_del_cursor should take into account error
        xfs: don't assert fail on perag references on teardown
        xfs: avoid unnecessary runtime sibling pointer endian conversions
        xfs: share xattr name and value buffers when logging xattr updates
        xfs: do not use logged xattr updates on V4 filesystems
        xfs: Remove duplicate include
        xfs: reduce IOCB_NOWAIT judgment for retry exclusive unaligned DIO
        xfs: Remove dead code
        xfs: fix typo in comment
        ...
      0e5ab8dd
  2. 01 Jun, 2022 12 commits
    • Tobias Klauser's avatar
      socket: Don't use u8 type in uapi socket.h · 8d3398ba
      Tobias Klauser authored
      Use plain 255 instead, which also avoid introducing an additional header
      dependency on <linux/types.h>
      
      Fixes: 26859240 ("txhash: Add socket option to control TX hash rethink behavior")
      Signed-off-by: default avatarTobias Klauser <tklauser@distanz.ch>
      Link: https://lore.kernel.org/r/20220531094345.13801-1-tklauser@distanz.chSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      8d3398ba
    • Linus Torvalds's avatar
      Merge tag 'rtc-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux · 54eb8462
      Linus Torvalds authored
      Pull RTC updates from Alexandre Belloni:
       "A new driver represents the bulk of the changes and then we get the
        usual small fixes.
      
        New driver:
      
         - Renesas RZN1 rtc
      
        Drivers:
      
         - sun6i: Add nvmem support"
      
      * tag 'rtc-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux:
        rtc: mxc: Silence a clang warning
        rtc: rzn1: Fix a variable type
        rtc: rzn1: Fix error code in probe
        rtc: rzn1: Avoid mixing variables
        rtc: ftrtc010: Fix error handling in ftrtc010_rtc_probe
        rtc: mt6397: check return value after calling platform_get_resource()
        rtc: rzn1: fix platform_no_drv_owner.cocci warning
        rtc: gamecube: Add missing iounmap in gamecube_rtc_read_offset_from_sram
        rtc: meson: Fix email address in MODULE_AUTHOR
        rtc: simplify the return expression of rx8025_set_offset()
        rtc: pcf85063: Add a compatible entry for pca85073a
        dt-binding: pcf85063: Add an entry for pca85073a
        MAINTAINERS: Add myself as maintainer of the RZN1 RTC driver
        rtc: rzn1: Add oscillator offset support
        rtc: rzn1: Add alarm support
        rtc: rzn1: Add new RTC driver
        dt-bindings: rtc: rzn1: Describe the RZN1 RTC
        rtc: sun6i: Add NVMEM provider
      54eb8462
    • Linus Torvalds's avatar
      Merge tag 'i3c/for-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux · 55fe9217
      Linus Torvalds authored
      Pull i3c updates from Alexandre Belloni:
       "Only clean ups and no functional change this cycle. A couple of yaml
        conversions of the DT bindings, and a couple of code cleanups"
      
      * tag 'i3c/for-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux:
        MAINTAINERS: rectify entries for some i3c drivers after dt conversion
        i3c: master: svc: fix returnvar.cocci warning
        i3c/master: simplify the return expression of i3c_hci_remove()
        dt-bindings: i3c: Convert snps,dw-i3c-master to DT schema
        dt-bindings: i3c: Convert cdns,i3c-master to DT schema
      55fe9217
    • Linus Torvalds's avatar
      Merge tag 'for-5.19/dm-fixes' of... · fa78526a
      Linus Torvalds authored
      Merge tag 'for-5.19/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm
      
      Pull device mapper fixes from Mike Snitzer:
      
       - Fix DM core's dm_table_supports_poll to return false if target has no
         data devices.
      
       - Fix DM verity target so that it cannot be switched to a different DM
         target type (e.g. dm-linear) via DM table reload.
      
      * tag 'for-5.19/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:
        dm verity: set DM_TARGET_IMMUTABLE feature flag
        dm table: fix dm_table_supports_poll to return false if no data devices
      fa78526a
    • Fabio Estevam's avatar
      rtc: mxc: Silence a clang warning · f78e3d40
      Fabio Estevam authored
      Change the of_device_get_match_data() cast to (uintptr_t)
      to silence the following clang warning:
      
      drivers/rtc/rtc-mxc.c:315:19: warning: cast to smaller integer type 'enum imx_rtc_type' from 'const void *' [-Wvoid-pointer-to-enum-cast]
      Reported-by: default avatarkernel test robot <lkp@intel.com>
      Fixes: ba7aa630 ("rtc: mxc: use of_device_get_match_data")
      Signed-off-by: default avatarFabio Estevam <festevam@gmail.com>
      Signed-off-by: default avatarAlexandre Belloni <alexandre.belloni@bootlin.com>
      Link: https://lore.kernel.org/r/20220526011459.1167197-1-festevam@gmail.com
      f78e3d40
    • Linus Torvalds's avatar
      Merge tag 'for-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply · c7993147
      Linus Torvalds authored
      Pull power supply and reset updates from Sebastian Reichel:
       "Not much from the power-supply subsystem this time around, since I was
        busy most of the cycle. This also contains some fixes that I
        originally planned to send for 5.18. Apart from this there is nothing
        noteworthy.
      
        Power-supply core:
      
         - init power_supply_info struct to zero
      
        Drivers:
      
         - bq27xxx: expose data for uncalibrated battery
      
         - bq24190-charger: use pm_runtime_resume_and_get
      
         - ab8500_fg: allocate wq in probe
      
         - axp288_fuel_gauge: drop BIOS version from 'T3 MRD' quirk
      
         - axp288_fuel_gauge: modify 'T3 MRD' quirk to also fix 'One Mix 1'"
      
      * tag 'for-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply:
        power: supply: bq24190_charger: using pm_runtime_resume_and_get instead of pm_runtime_get_sync
        power: supply: bq27xxx: expose battery data when CI=1
        power: supply: ab8500_fg: Allocate wq in probe
        power: supply: axp288_fuel_gauge: Drop BIOS version check from "T3 MRD" DMI quirk
        power: supply: axp288_fuel_gauge: Fix battery reporting on the One Mix 1
        power: supply: core: Initialize struct to zero
      c7993147
    • Linus Torvalds's avatar
      Merge tag 'linux-watchdog-5.19-rc1' of git://www.linux-watchdog.org/linux-watchdog · 96752be4
      Linus Torvalds authored
      Pull watchdog updates from Wim Van Sebroeck:
      
       - Add MediaTek MT8186 support
      
       - Add Mediatek MT7986 reset-controller support
      
       - Add i.MX93 support
      
       - Add watchdog driver for Sunplus SP7021
      
       - Add SC8180X and SC8280XP compatibles
      
       - Add Renesas RZ/N1 Watchdog driver and support for RZ/N1
      
       - rzg2l_wdt improvements and fixes
      
       - Several other improvements and fixes
      
      * tag 'linux-watchdog-5.19-rc1' of git://www.linux-watchdog.org/linux-watchdog: (38 commits)
        watchdog: ts4800_wdt: Fix refcount leak in ts4800_wdt_probe
        dt-bindings: watchdog: renesas,wdt: R-Car V3U is R-Car Gen4
        watchdog: Add Renesas RZ/N1 Watchdog driver
        dt-bindings: watchdog: renesas,wdt: Add support for RZ/N1
        watchdog: wdat_wdt: Stop watchdog when uninstalling module
        watchdog: wdat_wdt: Stop watchdog when rebooting the system
        watchdog: wdat_wdt: Using the existing function to check parameter timeout
        dt-bindings: watchdog: da9062: add watchdog timeout mode
        dt-bindings: watchdog: renesas,wdt: Document RZ/G2UL SoC
        watchdog: iTCO_wdt: Using existing macro define covers more scenarios
        watchdog: rti-wdt: Fix pm_runtime_get_sync() error checking
        dt-bindings: watchdog: Add SC8180X and SC8280XP compatibles
        watchdog: rti_wdt: Fix calculation and evaluation of preset heartbeat
        dt-bindings: watchdog: uniphier: Use unevaluatedProperties
        watchdog: sp805: disable watchdog on remove
        watchdog: da9063: optionally disable watchdog during suspend
        dt-bindings: mfd: da9063: watchdog: add suspend disable option
        dt-bindings: watchdog: sunxi: clarify clock support
        dt-bindings: watchdog: sunxi: fix F1C100s compatible
        watchdog: Add watchdog driver for Sunplus SP7021
        ...
      96752be4
    • Linus Torvalds's avatar
      Merge tag 'vfio-v5.19-rc1' of https://github.com/awilliam/linux-vfio · 17688215
      Linus Torvalds authored
      Pull vfio updates from Alex Williamson:
      
       - Improvements to mlx5 vfio-pci variant driver, including support for
         parallel migration per PF (Yishai Hadas)
      
       - Remove redundant iommu_present() check (Robin Murphy)
      
       - Ongoing refactoring to consolidate the VFIO driver facing API to use
         vfio_device (Jason Gunthorpe)
      
       - Use drvdata to store vfio_device among all vfio-pci and variant
         drivers (Jason Gunthorpe)
      
       - Remove redundant code now that IOMMU core manages group DMA ownership
         (Jason Gunthorpe)
      
       - Remove vfio_group from external API handling struct file ownership
         (Jason Gunthorpe)
      
       - Correct typo in uapi comments (Thomas Huth)
      
       - Fix coccicheck detected deadlock (Wan Jiabing)
      
       - Use rwsem to remove races and simplify code around container and kvm
         association to groups (Jason Gunthorpe)
      
       - Harden access to devices in low power states and use runtime PM to
         enable d3cold support for unused devices (Abhishek Sahu)
      
       - Fix dma_owner handling of fake IOMMU groups (Jason Gunthorpe)
      
       - Set driver_managed_dma on vfio-pci variant drivers (Jason Gunthorpe)
      
       - Pass KVM pointer directly rather than via notifier (Matthew Rosato)
      
      * tag 'vfio-v5.19-rc1' of https://github.com/awilliam/linux-vfio: (38 commits)
        vfio: remove VFIO_GROUP_NOTIFY_SET_KVM
        vfio/pci: Add driver_managed_dma to the new vfio_pci drivers
        vfio: Do not manipulate iommu dma_owner for fake iommu groups
        vfio/pci: Move the unused device into low power state with runtime PM
        vfio/pci: Virtualize PME related registers bits and initialize to zero
        vfio/pci: Change the PF power state to D0 before enabling VFs
        vfio/pci: Invalidate mmaps and block the access in D3hot power state
        vfio: Change struct vfio_group::container_users to a non-atomic int
        vfio: Simplify the life cycle of the group FD
        vfio: Fully lock struct vfio_group::container
        vfio: Split up vfio_group_get_device_fd()
        vfio: Change struct vfio_group::opened from an atomic to bool
        vfio: Add missing locking for struct vfio_group::kvm
        kvm/vfio: Fix potential deadlock problem in vfio
        include/uapi/linux/vfio.h: Fix trivial typo - _IORW should be _IOWR instead
        vfio/pci: Use the struct file as the handle not the vfio_group
        kvm/vfio: Remove vfio_group from kvm
        vfio: Change vfio_group_set_kvm() to vfio_file_set_kvm()
        vfio: Change vfio_external_check_extension() to vfio_file_enforced_coherent()
        vfio: Remove vfio_external_group_match_file()
        ...
      17688215
    • Lukas Bulwahn's avatar
      MAINTAINERS: rectify entries for some i3c drivers after dt conversion · 66ed42ca
      Lukas Bulwahn authored
      Commit 4bd69ecf ("dt-bindings: i3c: Convert cdns,i3c-master to DT
      schema") and commit 6742ca62 ("dt-bindings: i3c: Convert
      snps,dw-i3c-master to DT schema") convert some i3c dt-bindings to yaml,
      but miss to adjust its reference in MAINTAINERS.
      
      Hence, ./scripts/get_maintainer.pl --self-test=patterns complains about
      broken references.
      
      Repair these file references in I3C DRIVER FOR CADENCE I3C MASTER IP and
      I3C DRIVER FOR SYNOPSYS DESIGNWARE.
      Signed-off-by: default avatarLukas Bulwahn <lukas.bulwahn@gmail.com>
      Signed-off-by: default avatarAlexandre Belloni <alexandre.belloni@bootlin.com>
      Link: https://lore.kernel.org/r/20220601074212.19984-1-lukas.bulwahn@gmail.com
      66ed42ca
    • Linus Torvalds's avatar
      Merge tag 'erofs-for-5.19-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs · 8171acb8
      Linus Torvalds authored
      Pull more erofs updates from Gao Xiang:
       "This is a follow-up to the main updates, including some fixes of
        fscache mode related to compressed inodes and a cachefiles tracepoint.
        There is also a patch to fix an unexpected decompression strategy
        change due to a cleanup in the past. All the fixes are quite small.
      
        Apart from these, documentation is also updated for a better
        description of recent new features.
      
        In addition, this has some trivial cleanups without actual code logic
        changes, so I could have a more recent codebase to work on folios and
        avoiding the PG_error page flag for the next cycle.
      
        Summary:
      
         - Leave compressed inodes unsupported in fscache mode for now
      
         - Avoid crash when using tracepoint cachefiles_prep_read
      
         - Fix `backmost' behavior due to a recent cleanup
      
         - Update documentation for better description of recent new features
      
         - Several decompression cleanups w/o logical change"
      
      * tag 'erofs-for-5.19-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs:
        erofs: fix 'backmost' member of z_erofs_decompress_frontend
        erofs: simplify z_erofs_pcluster_readmore()
        erofs: get rid of label `restart_now'
        erofs: get rid of `struct z_erofs_collection'
        erofs: update documentation
        erofs: fix crash when enable tracepoint cachefiles_prep_read
        erofs: leave compressed inodes unsupported in fscache mode for now
      8171acb8
    • Linus Torvalds's avatar
      Merge tag '5.19-rc-ksmbd-server-fixes' of git://git.samba.org/ksmbd · e5b02087
      Linus Torvalds authored
      Pull ksmbd server updates from Steve French:
      
       - rdma (smbdirect) fixes, cleanup and optimizations
      
       - crediting (flow control) fix for mounts from Windows client
      
       - ACL fix
      
       - Windows client query dir fix
      
       - write validation fix
      
       - cleanups
      
      * tag '5.19-rc-ksmbd-server-fixes' of git://git.samba.org/ksmbd:
        ksmbd: smbd: relax the count of sges required
        ksmbd: fix outstanding credits related bugs
        ksmbd: smbd: fix connection dropped issue
        ksmbd: Fix some kernel-doc comments
        ksmbd: fix wrong smbd max read/write size check
        ksmbd: add smbd max io size parameter
        ksmbd: handle smb2 query dir request for OutputBufferLength that is too small
        ksmbd: smbd: handle multiple Buffer descriptors
        ksmbd: smbd: change the return value of get_sg_list
        ksmbd: smbd: simplify tracking pending packets
        ksmbd: smbd: introduce read/write credits for RDMA read/write
        ksmbd: smbd: change prototypes of RDMA read/write related functions
        ksmbd: validate length in smb2_write()
        ksmbd: fix reference count leak in smb_check_perm_dacl()
      e5b02087
    • David Howells's avatar
      afs: Fix infinite loop found by xfstest generic/676 · 17eabd42
      David Howells authored
      In AFS, a directory is handled as a file that the client downloads and
      parses locally for the purposes of performing lookup and getdents
      operations.  The in-kernel afs filesystem has a number of functions that
      do this.
      
      A directory file is arranged as a series of 2K blocks divided into
      32-byte slots, where a directory entry occupies one or more slots, plus
      each block starts with one or more metadata blocks.
      
      When parsing a block, if the last slots are occupied by a dirent that
      occupies more than a single slot and the file position points at a slot
      that's not the initial one, the logic in afs_dir_iterate_block() that
      skips over it won't advance the file pointer to the end of it.  This
      will cause an infinite loop in getdents() as it will keep retrying that
      block and failing to advance beyond the final entry.
      
      Fix this by advancing the file pointer if the next entry will be beyond
      it when we skip a block.
      
      This was found by the generic/676 xfstest but can also be triggered with
      something like:
      
      	~/xfstests-dev/src/t_readdir_3 /xfstest.test/z 4000 1
      
      Fixes: 1da177e4 ("Linux-2.6.12-rc2")
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      Reviewed-by: default avatarMarc Dionne <marc.dionne@auristor.com>
      Tested-by: default avatarMarc Dionne <marc.dionne@auristor.com>
      cc: linux-afs@lists.infradead.org
      Link: http://lore.kernel.org/r/165391973497.110268.2939296942213894166.stgit@warthog.procyon.org.uk/Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      17eabd42