1. 12 Mar, 2023 4 commits
    • Linus Torvalds's avatar
      Merge tag 'kernel.fork.v6.3-rc2' of gitolite.kernel.org:pub/scm/linux/kernel/git/brauner/linux · f5eded1f
      Linus Torvalds authored
      Pull clone3 fix from Christian Brauner:
       "A simple fix for the clone3() system call.
      
        The CLONE_NEWTIME allows the creation of time namespaces. The flag
        reuses a bit from the CSIGNAL bits that are used in the legacy clone()
        system call to set the signal that gets sent to the parent after the
        child exits.
      
        The clone3() system call doesn't rely on CSIGNAL anymore as it uses a
        dedicated .exit_signal field in struct clone_args. So we blocked all
        CSIGNAL bits in clone3_args_valid(). When CLONE_NEWTIME was introduced
        and reused a CSIGNAL bit we forgot to adapt clone3_args_valid()
        causing CLONE_NEWTIME with clone3() to be rejected. Fix this"
      
      * tag 'kernel.fork.v6.3-rc2' of gitolite.kernel.org:pub/scm/linux/kernel/git/brauner/linux:
        selftests/clone3: test clone3 with CLONE_NEWTIME
        fork: allow CLONE_NEWTIME in clone3 flags
      f5eded1f
    • Linus Torvalds's avatar
      Merge tag 'vfs.misc.v6.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/idmapping · 3b11717f
      Linus Torvalds authored
      Pull vfs fixes from Christian Brauner:
      
       - When allocating pages for a watch queue failed, we didn't return an
         error causing userspace to proceed even though all subsequent
         notifcations would be lost. Make sure to return an error.
      
       - Fix a misformed tree entry for the idmapping maintainers entry.
      
       - When setting file leases from an idmapped mount via
         generic_setlease() we need to take the idmapping into account
         otherwise taking a lease would fail from an idmapped mount.
      
       - Remove two redundant assignments, one in splice code and the other in
         locks code, that static checkers complained about.
      
      * tag 'vfs.misc.v6.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/idmapping:
        filelocks: use mount idmapping for setlease permission check
        fs/locks: Remove redundant assignment to cmd
        splice: Remove redundant assignment to ret
        MAINTAINERS: repair a malformed T: entry in IDMAPPED MOUNTS
        watch_queue: fix IOC_WATCH_QUEUE_SET_SIZE alloc error paths
      3b11717f
    • Linus Torvalds's avatar
      Merge tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 · 40d0c090
      Linus Torvalds authored
      Pull ext4 fixes from Ted Ts'o:
       "Bug fixes and regressions for ext4, the most serious of which is a
        potential deadlock during directory renames that was introduced during
        the merge window discovered by a combination of syzbot and lockdep"
      
      * tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:
        ext4: zero i_disksize when initializing the bootloader inode
        ext4: make sure fs error flag setted before clear journal error
        ext4: commit super block if fs record error when journal record without error
        ext4, jbd2: add an optimized bmap for the journal inode
        ext4: fix WARNING in ext4_update_inline_data
        ext4: move where set the MAY_INLINE_DATA flag is set
        ext4: Fix deadlock during directory rename
        ext4: Fix comment about the 64BIT feature
        docs: ext4: modify the group desc size to 64
        ext4: fix another off-by-one fsmap error on 1k block filesystems
        ext4: fix RENAME_WHITEOUT handling for inline directories
        ext4: make kobj_type structures constant
        ext4: fix cgroup writeback accounting with fs-layer encryption
      40d0c090
    • Linus Torvalds's avatar
      cpumask: relax sanity checking constraints · e7304080
      Linus Torvalds authored
      The cpumask_check() was unnecessarily tight, and causes problems for the
      users of cpumask_next().
      
      We have a number of users that take the previous return value of one of
      the bit scanning functions and subtract one to keep it in "range".  But
      since the scanning functions end up returning up to 'small_cpumask_bits'
      instead of the tighter 'nr_cpumask_bits', the range really needs to be
      using that widened form.
      
      [ This "previous-1" behavior is also the reason we have all those
        comments about /* -1 is a legal arg here. */ and separate checks for
        that being ok.  So we could have just made "small_cpumask_bits-1"
        be a similar special "don't check this" value.
      
        Tetsuo Handa even suggested a patch that only does that for
        cpumask_next(), since that seems to be the only actual case that
        triggers, but that all makes it even _more_ magical and special. So
        just relax the check ]
      
      One example of this kind of pattern being the 'c_start()' function in
      arch/x86/kernel/cpu/proc.c, but also duplicated in various forms on
      other architectures.
      
      Reported-by: syzbot+96cae094d90877641f32@syzkaller.appspotmail.com
      Link: https://syzkaller.appspot.com/bug?extid=96cae094d90877641f32Reported-by: default avatarTetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
      Link: https://lore.kernel.org/lkml/c1f4cc16-feea-b83c-82cf-1a1f007b7eb9@I-love.SAKURA.ne.jp/
      Fixes: 596ff4a0 ("cpumask: re-introduce constant-sized cpumask optimizations")
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      e7304080
  2. 11 Mar, 2023 13 commits
    • Linus Torvalds's avatar
      Merge tag 'i2c-for-6.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux · 81ff8554
      Linus Torvalds authored
      Pull i2c updates from Wolfram Sang:
       "This marks the end of a transition to let I2C have the same probe
        semantics as other subsystems. Uwe took care that no drivers in the
        current tree nor in -next use the deprecated .probe call. So, it is a
        good time to switch to the new, standard semantics now.
      
        There is also a regression fix:
      
         - regression fix for the notifier handling of the I2C core
      
         - final coversions of drivers away from deprecated .probe
      
         - make .probe_new the standard probe and convert I2C core to use it
      
      * tag 'i2c-for-6.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
        i2c: dev: Fix bus callback return values
        i2c: Convert drivers to new .probe() callback
        i2c: mux: Convert all drivers to new .probe() callback
        i2c: Switch .probe() to not take an id parameter
        media: i2c: ov2685: convert to i2c's .probe_new()
        media: i2c: ov5695: convert to i2c's .probe_new()
        w1: ds2482: Convert to i2c's .probe_new()
        serial: sc16is7xx: Convert to i2c's .probe_new()
        mtd: maps: pismo: Convert to i2c's .probe_new()
        misc: ad525x_dpot-i2c: Convert to i2c's .probe_new()
      81ff8554
    • Richard Weinberger's avatar
      ubi: block: Fix missing blk_mq_end_request · e25c54d1
      Richard Weinberger authored
      Switching to BLK_MQ_F_BLOCKING wrongly removed the call to
      blk_mq_end_request(). Add it back to have our IOs finished
      
      Fixes: 91cc8fbc ("ubi: block: set BLK_MQ_F_BLOCKING")
      Analyzed-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      Reported-by: default avatarDaniel Palmer <daniel@0x0f.com>
      Link: https://lore.kernel.org/linux-mtd/CAHk-=wi29bbBNh3RqJKu3PxzpjDN5D5K17gEVtXrb7-6bfrnMQ@mail.gmail.com/Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
      Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
      Tested-by: default avatarDaniel Palmer <daniel@0x0f.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      e25c54d1
    • Zhihao Cheng's avatar
      ext4: zero i_disksize when initializing the bootloader inode · f5361da1
      Zhihao Cheng authored
      If the boot loader inode has never been used before, the
      EXT4_IOC_SWAP_BOOT inode will initialize it, including setting the
      i_size to 0.  However, if the "never before used" boot loader has a
      non-zero i_size, then i_disksize will be non-zero, and the
      inconsistency between i_size and i_disksize can trigger a kernel
      warning:
      
       WARNING: CPU: 0 PID: 2580 at fs/ext4/file.c:319
       CPU: 0 PID: 2580 Comm: bb Not tainted 6.3.0-rc1-00004-g703695902cfa
       RIP: 0010:ext4_file_write_iter+0xbc7/0xd10
       Call Trace:
        vfs_write+0x3b1/0x5c0
        ksys_write+0x77/0x160
        __x64_sys_write+0x22/0x30
        do_syscall_64+0x39/0x80
      
      Reproducer:
       1. create corrupted image and mount it:
             mke2fs -t ext4 /tmp/foo.img 200
             debugfs -wR "sif <5> size 25700" /tmp/foo.img
             mount -t ext4 /tmp/foo.img /mnt
             cd /mnt
             echo 123 > file
       2. Run the reproducer program:
             posix_memalign(&buf, 1024, 1024)
             fd = open("file", O_RDWR | O_DIRECT);
             ioctl(fd, EXT4_IOC_SWAP_BOOT);
             write(fd, buf, 1024);
      
      Fix this by setting i_disksize as well as i_size to zero when
      initiaizing the boot loader inode.
      
      Link: https://bugzilla.kernel.org/show_bug.cgi?id=217159
      Cc: stable@kernel.org
      Signed-off-by: default avatarZhihao Cheng <chengzhihao1@huawei.com>
      Link: https://lore.kernel.org/r/20230308032643.641113-1-chengzhihao1@huawei.comSigned-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
      f5361da1
    • Ye Bin's avatar
      ext4: make sure fs error flag setted before clear journal error · f57886ca
      Ye Bin authored
      Now, jounral error number maybe cleared even though ext4_commit_super()
      failed. This may lead to error flag miss, then fsck will miss to check
      file system deeply.
      Signed-off-by: default avatarYe Bin <yebin10@huawei.com>
      Reviewed-by: default avatarJan Kara <jack@suse.cz>
      Link: https://lore.kernel.org/r/20230307061703.245965-3-yebin@huaweicloud.com
      f57886ca
    • Ye Bin's avatar
      ext4: commit super block if fs record error when journal record without error · eee00237
      Ye Bin authored
      Now, 'es->s_state' maybe covered by recover journal. And journal errno
      maybe not recorded in journal sb as IO error. ext4_update_super() only
      update error information when 'sbi->s_add_error_count' large than zero.
      Then 'EXT4_ERROR_FS' flag maybe lost.
      To solve above issue just recover 'es->s_state' error flag after journal
      replay like error info.
      Signed-off-by: default avatarYe Bin <yebin10@huawei.com>
      Reviewed-by: default avatarBaokun Li <libaokun1@huawei.com>
      Reviewed-by: default avatarJan Kara <jack@suse.cz>
      Link: https://lore.kernel.org/r/20230307061703.245965-2-yebin@huaweicloud.com
      eee00237
    • Theodore Ts'o's avatar
      ext4, jbd2: add an optimized bmap for the journal inode · 62913ae9
      Theodore Ts'o authored
      The generic bmap() function exported by the VFS takes locks and does
      checks that are not necessary for the journal inode.  So allow the
      file system to set a journal-optimized bmap function in
      journal->j_bmap.
      
      Reported-by: syzbot+9543479984ae9e576000@syzkaller.appspotmail.com
      Link: https://syzkaller.appspot.com/bug?id=e4aaa78795e490421c79f76ec3679006c8ff4cf0Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
      62913ae9
    • Ye Bin's avatar
      ext4: fix WARNING in ext4_update_inline_data · 2b96b4a5
      Ye Bin authored
      Syzbot found the following issue:
      EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 without journal. Quota mode: none.
      fscrypt: AES-256-CTS-CBC using implementation "cts-cbc-aes-aesni"
      fscrypt: AES-256-XTS using implementation "xts-aes-aesni"
      ------------[ cut here ]------------
      WARNING: CPU: 0 PID: 5071 at mm/page_alloc.c:5525 __alloc_pages+0x30a/0x560 mm/page_alloc.c:5525
      Modules linked in:
      CPU: 1 PID: 5071 Comm: syz-executor263 Not tainted 6.2.0-rc1-syzkaller #0
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
      RIP: 0010:__alloc_pages+0x30a/0x560 mm/page_alloc.c:5525
      RSP: 0018:ffffc90003c2f1c0 EFLAGS: 00010246
      RAX: ffffc90003c2f220 RBX: 0000000000000014 RCX: 0000000000000000
      RDX: 0000000000000028 RSI: 0000000000000000 RDI: ffffc90003c2f248
      RBP: ffffc90003c2f2d8 R08: dffffc0000000000 R09: ffffc90003c2f220
      R10: fffff52000785e49 R11: 1ffff92000785e44 R12: 0000000000040d40
      R13: 1ffff92000785e40 R14: dffffc0000000000 R15: 1ffff92000785e3c
      FS:  0000555556c0d300(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 00007f95d5e04138 CR3: 00000000793aa000 CR4: 00000000003506f0
      DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
      Call Trace:
       <TASK>
       __alloc_pages_node include/linux/gfp.h:237 [inline]
       alloc_pages_node include/linux/gfp.h:260 [inline]
       __kmalloc_large_node+0x95/0x1e0 mm/slab_common.c:1113
       __do_kmalloc_node mm/slab_common.c:956 [inline]
       __kmalloc+0xfe/0x190 mm/slab_common.c:981
       kmalloc include/linux/slab.h:584 [inline]
       kzalloc include/linux/slab.h:720 [inline]
       ext4_update_inline_data+0x236/0x6b0 fs/ext4/inline.c:346
       ext4_update_inline_dir fs/ext4/inline.c:1115 [inline]
       ext4_try_add_inline_entry+0x328/0x990 fs/ext4/inline.c:1307
       ext4_add_entry+0x5a4/0xeb0 fs/ext4/namei.c:2385
       ext4_add_nondir+0x96/0x260 fs/ext4/namei.c:2772
       ext4_create+0x36c/0x560 fs/ext4/namei.c:2817
       lookup_open fs/namei.c:3413 [inline]
       open_last_lookups fs/namei.c:3481 [inline]
       path_openat+0x12ac/0x2dd0 fs/namei.c:3711
       do_filp_open+0x264/0x4f0 fs/namei.c:3741
       do_sys_openat2+0x124/0x4e0 fs/open.c:1310
       do_sys_open fs/open.c:1326 [inline]
       __do_sys_openat fs/open.c:1342 [inline]
       __se_sys_openat fs/open.c:1337 [inline]
       __x64_sys_openat+0x243/0x290 fs/open.c:1337
       do_syscall_x64 arch/x86/entry/common.c:50 [inline]
       do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
       entry_SYSCALL_64_after_hwframe+0x63/0xcd
      
      Above issue happens as follows:
      ext4_iget
         ext4_find_inline_data_nolock ->i_inline_off=164 i_inline_size=60
      ext4_try_add_inline_entry
         __ext4_mark_inode_dirty
            ext4_expand_extra_isize_ea ->i_extra_isize=32 s_want_extra_isize=44
               ext4_xattr_shift_entries
      	 ->after shift i_inline_off is incorrect, actually is change to 176
      ext4_try_add_inline_entry
        ext4_update_inline_dir
          get_max_inline_xattr_value_size
            if (EXT4_I(inode)->i_inline_off)
      	entry = (struct ext4_xattr_entry *)((void *)raw_inode +
      			EXT4_I(inode)->i_inline_off);
              free += EXT4_XATTR_SIZE(le32_to_cpu(entry->e_value_size));
      	->As entry is incorrect, then 'free' may be negative
         ext4_update_inline_data
            value = kzalloc(len, GFP_NOFS);
            -> len is unsigned int, maybe very large, then trigger warning when
               'kzalloc()'
      
      To resolve the above issue we need to update 'i_inline_off' after
      'ext4_xattr_shift_entries()'.  We do not need to set
      EXT4_STATE_MAY_INLINE_DATA flag here, since ext4_mark_inode_dirty()
      already sets this flag if needed.  Setting EXT4_STATE_MAY_INLINE_DATA
      when it is needed may trigger a BUG_ON in ext4_writepages().
      
      Reported-by: syzbot+d30838395804afc2fa6f@syzkaller.appspotmail.com
      Cc: stable@kernel.org
      Signed-off-by: default avatarYe Bin <yebin10@huawei.com>
      Reviewed-by: default avatarJan Kara <jack@suse.cz>
      Link: https://lore.kernel.org/r/20230307015253.2232062-3-yebin@huaweicloud.comSigned-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
      2b96b4a5
    • Ye Bin's avatar
      ext4: move where set the MAY_INLINE_DATA flag is set · 1dcdce59
      Ye Bin authored
      The only caller of ext4_find_inline_data_nolock() that needs setting of
      EXT4_STATE_MAY_INLINE_DATA flag is ext4_iget_extra_inode().  In
      ext4_write_inline_data_end() we just need to update inode->i_inline_off.
      Since we are going to add one more caller that does not need to set
      EXT4_STATE_MAY_INLINE_DATA, just move setting of EXT4_STATE_MAY_INLINE_DATA
      out to ext4_iget_extra_inode().
      Signed-off-by: default avatarYe Bin <yebin10@huawei.com>
      Cc: stable@kernel.org
      Reviewed-by: default avatarJan Kara <jack@suse.cz>
      Link: https://lore.kernel.org/r/20230307015253.2232062-2-yebin@huaweicloud.comSigned-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
      1dcdce59
    • Linus Torvalds's avatar
      Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi · ef5f68cc
      Linus Torvalds authored
      Pull SCSI fixes from James Bottomley:
       "Twenty fixes all in drivers except the one zone storage revalidation
        fix to sd.
      
        The megaraid_sas fixes are more on the level of a driver update
        (enabling crash dump and increasing lun number) but I thought you
        could let this slide on -rc1 and the next most extensive update is a
        load of fixes to mpi3mr"
      
      * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
        scsi: sd: Fix wrong zone_write_granularity value during revalidate
        scsi: storvsc: Handle BlockSize change in Hyper-V VHD/VHDX file
        scsi: megaraid_sas: Driver version update to 07.725.01.00-rc1
        scsi: megaraid_sas: Add crash dump mode capability bit in MFI capabilities
        scsi: megaraid_sas: Update max supported LD IDs to 240
        scsi: mpi3mr: Bad drive in topology results kernel crash
        scsi: mpi3mr: NVMe command size greater than 8K fails
        scsi: mpi3mr: Return proper values for failures in firmware init path
        scsi: mpi3mr: Wait for diagnostic save during controller init
        scsi: mpi3mr: Driver unload crashes host when enhanced logging is enabled
        scsi: mpi3mr: ioctl timeout when disabling/enabling interrupt
        scsi: lpfc: Avoid usage of list iterator variable after loop
        scsi: lpfc: Check kzalloc() in lpfc_sli4_cgn_params_read()
        scsi: ufs: mcq: qcom: Clean the return path of ufs_qcom_mcq_config_resource()
        scsi: ufs: mcq: qcom: Fix passing zero to PTR_ERR
        scsi: ufs: ufs-qcom: Remove impossible check
        scsi: ufs: core: Add soft dependency on governor_simpleondemand
        scsi: hisi_sas: Check devm_add_action() return value
        scsi: qla2xxx: Add option to disable FC2 Target support
        scsi: target: iscsi: Fix an error message in iscsi_check_key()
      ef5f68cc
    • Linus Torvalds's avatar
      Merge tag 'block-6.3-2023-03-09' of git://git.kernel.dk/linux · 40f879bd
      Linus Torvalds authored
      Pull block fixes from Jens Axboe:
      
       - Fix a regression in exclusive mode handling of the partition code,
         introduced in this merge windoe (Yu)
      
       - Fix for a use-after-free in BFQ (Yu)
      
       - Add sysfs documentation for the 'hidden' attribute (Sagi)
      
      * tag 'block-6.3-2023-03-09' of git://git.kernel.dk/linux:
        block, bfq: fix uaf for 'stable_merge_bfqq'
        docs: sysfs-block: document hidden sysfs entry
        block: fix wrong mode for blkdev_put() from disk_scan_partitions()
      40f879bd
    • Linus Torvalds's avatar
      Merge tag 'pull-highmem' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · d33d4c9e
      Linus Torvalds authored
      Pull put_and_unmap_page() helper from Al Viro:
       "kmap_local_page() conversions in local filesystems keep running into
        kunmap_local_page()+put_page() combinations.  We can keep inventing
        names for identical inline helpers, but it's getting rather
        inconvenient. I've added a trivial helper to linux/highmem.h instead.
      
        I would've held that back until the merge window, if not for the mess
        it causes in tree topology - I've several branches merging from that
        one, and it's only going to get worse if e.g. ext2 stuff gets picked
        by Jan"
      
      * tag 'pull-highmem' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        new helper: put_and_unmap_page()
      d33d4c9e
    • Linus Torvalds's avatar
      Merge tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · 4831f762
      Linus Torvalds authored
      Pull misc fixes from Al Viro:
       "pick_file() speculation fix + fix for alpha mis(merge,cherry-pick)
      
        The fs/file.c one is a genuine missing speculation barrier in
        pick_file() (reachable e.g. via close(2)). The alpha one is strictly
        speaking not a bug fix, but only because confusion between
        preempt_enable() and preempt_disable() is harmless on architecture
        without CONFIG_PREEMPT.
      
        Looks like alpha.git picked the wrong version of patch - that braino
        used to be there in early versions, but it had been fixed quite a
        while ago..."
      
      * tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        fs: prevent out-of-bounds array speculation when closing a file descriptor
        alpha: fix lazy-FPU mis(merged/applied/whatnot)
      4831f762
    • Linus Torvalds's avatar
      Merge tag 'thermal-6.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · a0aefd30
      Linus Torvalds authored
      Pull thermal control fix from Rafael Wysocki:
       "Fix a recently introduced deadlock in the int340x thermal control
        driver (Srinivas Pandruvada)"
      
      * tag 'thermal-6.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        thermal: intel: int340x: processor_thermal: Fix deadlock
      a0aefd30
  3. 10 Mar, 2023 17 commits
    • Linus Torvalds's avatar
      Merge tag 'riscv-for-linus-6.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux · 55a21105
      Linus Torvalds authored
      Pull RISC-V fixes from Palmer Dabbelt:
      
       - RISC-V architecture-specific ELF attributes have been disabled in the
         kernel builds
      
       - A fix for a locking failure while during errata patching that
         manifests on SiFive-based systems
      
       - A fix for a KASAN failure during stack unwinding
      
       - A fix for some lockdep failures during text patching
      
      * tag 'riscv-for-linus-6.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
        RISC-V: Don't check text_mutex during stop_machine
        riscv: Use READ_ONCE_NOCHECK in imprecise unwinding stack mode
        RISC-V: fix taking the text_mutex twice during sifive errata patching
        RISC-V: Stop emitting attributes
      55a21105
    • Linus Torvalds's avatar
      Merge tag 'drm-fixes-2023-03-10' of git://anongit.freedesktop.org/drm/drm · b0d14d2a
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "Weekly fixes.
      
        msm and amdgpu are the vast majority of these, otherwise some
        straggler misc from last week for nouveau and cirrus and a mailmap
        update for a drm developer.
      
        mailmap:
         - add an entry
      
        nouveau:
         - fix system shutdown regression
         - build warning fix
      
        cirrus:
         - NULL ptr deref fix
      
        msm:
         - fix invalid ptr free in syncobj cleanup
         - sync GMU removal in teardown
         - a5xx preemption fixes
         - fix runpm imbalance
         - DPU hw fixes
         - stack corruption fix
         - clear DSPP reservation
      
        amdgpu:
         - Misc display fixes
         - UMC 8.10 fixes
         - Driver unload fixes
         - NBIO 7.3.0 fix
         - Error checking fixes for soc15, nv, soc21 read register interface
         - Fix video cap query for VCN 4.0.4
      
        amdkfd:
         - Fix return check in doorbell handling"
      
      * tag 'drm-fixes-2023-03-10' of git://anongit.freedesktop.org/drm/drm: (42 commits)
        drm/amdgpu/soc21: Add video cap query support for VCN_4_0_4
        drm/amdgpu: fix error checking in amdgpu_read_mm_registers for nv
        drm/amdgpu: fix error checking in amdgpu_read_mm_registers for soc21
        drm/amdgpu: fix error checking in amdgpu_read_mm_registers for soc15
        drm/amdgpu: Fix the warning info when removing amdgpu device
        drm/amdgpu: fix return value check in kfd
        drm/amd: Fix initialization mistake for NBIO 7.3.0
        drm/amdgpu: Fix call trace warning and hang when removing amdgpu device
        mailmap: add mailmap entries for Faith.
        drm/msm: DEVFREQ_GOV_SIMPLE_ONDEMAND is no longer needed
        drm/amd/display: Update clock table to include highest clock setting
        drm/amd/pm: Enable ecc_info table support for smu v13_0_10
        drm/amdgpu: Support umc node harvest config on umc v8_10
        drm/connector: print max_requested_bpc in state debugfs
        drm/display: Don't block HDR_OUTPUT_METADATA on unknown EOTF
        drm/msm/dpu: clear DSPP reservations in rm release
        drm/msm/disp/dpu: fix sc7280_pp base offset
        drm/msm/dpu: fix stack smashing in dpu_hw_ctl_setup_blendstage
        drm/msm/dpu: don't use DPU_CLK_CTRL_CURSORn for DMA SSPP clocks
        drm/msm/dpu: fix clocks settings for msm8998 SSPP blocks
        ...
      b0d14d2a
    • Linus Torvalds's avatar
      Merge tag 'erofs-for-6.3-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs · 388a8101
      Linus Torvalds authored
      Pull erofs fixes from Gao Xiang:
       "The most important one reverts an improper fix which can cause an
        unexpected warning more often on specific images, and another one
        fixes LZMA decompression on 32-bit platforms. The others are minor
        fixes and cleanups.
      
         - Fix LZMA decompression failure on HIGHMEM platforms
      
         - Revert an inproper fix since it is actually an implementation issue
           of vmalloc()
      
         - Avoid a wrong DBG_BUGON since it could be triggered with -EINTR
      
         - Minor cleanups"
      
      * tag 'erofs-for-6.3-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs:
        erofs: use wrapper i_blocksize() in erofs_file_read_iter()
        erofs: get rid of a useless DBG_BUGON
        erofs: Revert "erofs: fix kvcalloc() misuse with __GFP_NOFAIL"
        erofs: fix wrong kunmap when using LZMA on HIGHMEM platforms
        erofs: mark z_erofs_lzma_init/erofs_pcpubuf_init w/ __init
      388a8101
    • Linus Torvalds's avatar
      Merge tag 'nfsd-6.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux · 92cadfcf
      Linus Torvalds authored
      Pull nfsd fixes from Chuck Lever:
      
       - Protect NFSD writes against filesystem freezing
      
       - Fix a potential memory leak during server shutdown
      
      * tag 'nfsd-6.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux:
        SUNRPC: Fix a server shutdown leak
        NFSD: Protect against filesystem freezing
      92cadfcf
    • Linus Torvalds's avatar
      Merge tag 'for-6.3-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux · ae195ca1
      Linus Torvalds authored
      Pull btrfs fixes from David Sterba:
       "First batch of fixes. Among them there are two updates to sysfs and
        ioctl which are not strictly fixes but are used for testing so there's
        no reason to delay them.
      
         - fix block group item corruption after inserting new block group
      
         - fix extent map logging bit not cleared for split maps after
           dropping range
      
         - fix calculation of unusable block group space reporting bogus
           values due to 32/64b division
      
         - fix unnecessary increment of read error stat on write error
      
         - improve error handling in inode update
      
         - export per-device fsid in DEV_INFO ioctl to distinguish seeding
           devices, needed for testing
      
         - allocator size classes:
            - fix potential dead lock in size class loading logic
            - print sysfs stats for the allocation classes"
      
      * tag 'for-6.3-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
        btrfs: fix block group item corruption after inserting new block group
        btrfs: fix extent map logging bit not cleared for split maps after dropping range
        btrfs: fix percent calculation for bg reclaim message
        btrfs: fix unnecessary increment of read error stat on write error
        btrfs: handle btrfs_del_item errors in __btrfs_update_delayed_inode
        btrfs: ioctl: return device fsid from DEV_INFO ioctl
        btrfs: fix potential dead lock in size class loading logic
        btrfs: sysfs: add size class stats
      ae195ca1
    • Linus Torvalds's avatar
      Merge tag 'io_uring-6.3-2023-03-09' of git://git.kernel.dk/linux · f331c5de
      Linus Torvalds authored
      Pull io_uring fixes from Jens Axboe:
      
       - Stop setting PF_NO_SETAFFINITY on io-wq workers.
      
         This has been reported in the past as it confuses some applications,
         as some of their threads will fail with -1/EINVAL if attempted
         affinitized. Most recent report was on cpusets, where enabling that
         with io-wq workers active will fail.
      
         Just deal with the mask changing by checking when a worker times out,
         and then exit if we have no work pending.
      
       - Fix an issue with passthrough support where we don't properly check
         if the file type has pollable uring_cmd support.
      
       - Fix a reported W=1 warning on a variable being set and unused. Add a
         special helper for iterating these lists that doesn't save the
         previous list element, if that iterator never ends up using it.
      
      * tag 'io_uring-6.3-2023-03-09' of git://git.kernel.dk/linux:
        io_uring: silence variable ‘prev’ set but not used warning
        io_uring/uring_cmd: ensure that device supports IOPOLL
        io_uring/io-wq: stop setting PF_NO_SETAFFINITY on io-wq workers
      f331c5de
    • Linus Torvalds's avatar
      Merge tag 'perf-tools-fixes-for-v6.3-1-2023-03-09' of... · 49be4fb2
      Linus Torvalds authored
      Merge tag 'perf-tools-fixes-for-v6.3-1-2023-03-09' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux
      
      Pull perf tools fixes from Arnaldo Carvalho de Melo:
      
       - Add Adrian Hunter to MAINTAINERS as a perf tools reviewer
      
       - Sync various tools/ copies of kernel headers with the kernel sources,
         this time trying to avoid first merging with upstream to then update
         but instead copy from upstream so that a merge is avoided and the end
         result after merging this pull request is the one expected,
         tools/perf/check-headers.sh (mostly) happy, less warnings while
         building tools/perf/
      
       - Fix counting when initial delay configured by setting
         perf_attr.enable_on_exec when starting workloads from the perf
         command line
      
       - Don't avoid emitting a PERF_RECORD_MMAP2 in 'perf inject
         --buildid-all' when that record comes with a build-id, otherwise we
         end up not being able to resolve symbols
      
       - Don't use comma as the CSV output separator the "stat+csv_output"
         test, as comma can appear on some tests as a modifier for an event,
         use @ instead, ditto for the JSON linter test
      
       - The offcpu test was looking for some bits being set on
         task_struct->prev_state without masking other bits not important for
         this specific 'perf test', fix it
      
      * tag 'perf-tools-fixes-for-v6.3-1-2023-03-09' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux:
        perf tools: Add Adrian Hunter to MAINTAINERS as a reviewer
        tools headers UAPI: Sync linux/perf_event.h with the kernel sources
        tools headers x86 cpufeatures: Sync with the kernel sources
        tools include UAPI: Sync linux/vhost.h with the kernel sources
        tools arch x86: Sync the msr-index.h copy with the kernel sources
        tools headers kvm: Sync uapi/{asm/linux} kvm.h headers with the kernel sources
        tools include UAPI: Synchronize linux/fcntl.h with the kernel sources
        tools headers: Synchronize {linux,vdso}/bits.h with the kernel sources
        tools headers UAPI: Sync linux/prctl.h with the kernel sources
        tools headers: Update the copy of x86's mem{cpy,set}_64.S used in 'perf bench'
        perf stat: Fix counting when initial delay configured
        tools headers svm: Sync svm headers with the kernel sources
        perf test: Avoid counting commas in json linter
        perf tests stat+csv_output: Switch CSV separator to @
        perf inject: Fix --buildid-all not to eat up MMAP2
        tools arch x86: Sync the msr-index.h copy with the kernel sources
        perf test: Fix offcpu test prev_state check
      49be4fb2
    • Dave Airlie's avatar
      Merge tag 'amd-drm-fixes-6.3-2023-03-09' of... · 519b2331
      Dave Airlie authored
      Merge tag 'amd-drm-fixes-6.3-2023-03-09' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes
      
      amd-drm-fixes-6.3-2023-03-09:
      
      amdgpu:
      - Misc display fixes
      - UMC 8.10 fixes
      - Driver unload fixes
      - NBIO 7.3.0 fix
      - Error checking fixes for soc15, nv, soc21 read register interface
      - Fix video cap query for VCN 4.0.4
      
      amdkfd:
      - Fix return check in doorbell handling
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      From: Alex Deucher <alexander.deucher@amd.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20230310031314.1296929-1-alexander.deucher@amd.com
      519b2331
    • Theodore Ts'o's avatar
      fs: prevent out-of-bounds array speculation when closing a file descriptor · 609d5444
      Theodore Ts'o authored
      Google-Bug-Id: 114199369
      Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      609d5444
    • Veerabadhran Gopalakrishnan's avatar
      drm/amdgpu/soc21: Add video cap query support for VCN_4_0_4 · 6ce2ea07
      Veerabadhran Gopalakrishnan authored
      Added the video capability query support for VCN version 4_0_4
      Signed-off-by: default avatarVeerabadhran Gopalakrishnan <veerabadhran.gopalakrishnan@amd.com>
      Reviewed-by: default avatarLeo Liu <leo.liu@amd.com>
      Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      Cc: stable@vger.kernel.org # 6.1.x
      6ce2ea07
    • Alex Deucher's avatar
      drm/amdgpu: fix error checking in amdgpu_read_mm_registers for nv · b42fee5e
      Alex Deucher authored
      Properly skip non-existent registers as well.
      
      Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2442Reviewed-by: default avatarHawking Zhang <Hawking.Zhang@amd.com>
      Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      Cc: stable@vger.kernel.org
      b42fee5e
    • Alex Deucher's avatar
      drm/amdgpu: fix error checking in amdgpu_read_mm_registers for soc21 · 2915e43a
      Alex Deucher authored
      Properly skip non-existent registers as well.
      
      Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2442Reviewed-by: default avatarHawking Zhang <Hawking.Zhang@amd.com>
      Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      Cc: stable@vger.kernel.org
      2915e43a
    • Alex Deucher's avatar
      drm/amdgpu: fix error checking in amdgpu_read_mm_registers for soc15 · 0dcdf849
      Alex Deucher authored
      Properly skip non-existent registers as well.
      
      Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2442Reviewed-by: default avatarHawking Zhang <Hawking.Zhang@amd.com>
      Reviewed-by: default avatarEvan Quan <evan.quan@amd.com>
      Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      Cc: stable@vger.kernel.org
      0dcdf849
    • lyndonli's avatar
      drm/amdgpu: Fix the warning info when removing amdgpu device · 8879ec6d
      lyndonli authored
      Actually, the drm_dev_enter in psp_cmd_submit_buf does not
      protect anything. If DRM device is unplugged, it will always
      check the condition in WARN_ON. So drop drm_dev_enter and
      drm_dev_exit in psp_cmd_submit_buf.
      
      When removing amdgpu, the calling order is as follows:
      amdgpu_pci_remove
          drm_dev_unplug
          amdgpu_driver_unload_kms
              amdgpu_device_fini_hw
                  amdgpu_device_ip_fini_early
                      psp_hw_fini
                          psp_ras_terminate
                              psp_ta_unloadye
                                  psp_cmd_submit_buf
      
      [ 4507.740388] Call Trace:
      [ 4507.740389]  <TASK>
      [ 4507.740391]  psp_ta_unload+0x44/0x70 [amdgpu]
      [ 4507.740485]  psp_ras_terminate+0x4d/0x70 [amdgpu]
      [ 4507.740575]  psp_hw_fini+0x28/0xa0 [amdgpu]
      [ 4507.740662]  amdgpu_device_fini_hw+0x328/0x442 [amdgpu]
      [ 4507.740791]  amdgpu_driver_unload_kms+0x51/0x60 [amdgpu]
      [ 4507.740875]  amdgpu_pci_remove+0x5a/0x140 [amdgpu]
      [ 4507.740962]  ? _raw_spin_unlock_irqrestore+0x27/0x43
      [ 4507.740965]  ? __pm_runtime_resume+0x60/0x90
      [ 4507.740968]  pci_device_remove+0x39/0xb0
      [ 4507.740971]  device_remove+0x46/0x70
      [ 4507.740972]  device_release_driver_internal+0xd1/0x160
      [ 4507.740974]  driver_detach+0x4a/0x90
      [ 4507.740975]  bus_remove_driver+0x6c/0xf0
      [ 4507.740976]  driver_unregister+0x31/0x50
      [ 4507.740977]  pci_unregister_driver+0x40/0x90
      [ 4507.740978]  amdgpu_exit+0x15/0x120 [amdgpu]
      
      v2: fix commit message style issue
      Signed-off-by: default avatarlyndonli <Lyndon.Li@amd.com>
      Reviewed-by: default avatarGuchun Chen <guchun.chen@amd.com>
      Acked-by: default avatarChristian König <christian.koenig@amd.com>
      Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      8879ec6d
    • Shashank Sharma's avatar
      drm/amdgpu: fix return value check in kfd · 20534dbc
      Shashank Sharma authored
      This patch fixes a return value check in kfd doorbell handling.
      This function should return 0(error) only when the ida_simple_get
      returns < 0(error), return > 0 is a success case.
      
      Cc: Felix Kuehling <Felix.Kuehling@amd.com>
      Cc: Alex Deucher <alexander.deucher@amd.com>
      Fixes: 16f00131 ("drm/amdkfd: Allocate doorbells only when needed")
      Acked-by: default avatarChristian Koenig <chriatian.koenig@amd.com>
      Reviewed-by: default avatarFelix Kuehling <Felix.Kuehling@amd.com>
      Signed-off-by: default avatarShashank Sharma <shashank.sharma@amd.com>
      Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      20534dbc
    • Mario Limonciello's avatar
      drm/amd: Fix initialization mistake for NBIO 7.3.0 · 1717cc5f
      Mario Limonciello authored
      The same strapping initialization issue that happened on NBIO 7.5.1
      appears to be happening on NBIO 7.3.0.
      Apply the same fix to 7.3.0 as well.
      
      Note: This workaround relies upon the integrated GPU being enabled
      in BIOS. If the integrated GPU is disabled in BIOS a different
      workaround will be required.
      Reported-by: default avatarThomas Glanzmann <thomas@glanzmann.de>
      Cc: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
      Link: https://lore.kernel.org/linux-usb/Y%2Fz9GdHjPyF2rNG3@glanzmann.de/T/#uSigned-off-by: default avatarMario Limonciello <mario.limonciello@amd.com>
      Reviewed-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      1717cc5f
    • lyndonli's avatar
      drm/amdgpu: Fix call trace warning and hang when removing amdgpu device · 93bb18d2
      lyndonli authored
      On GPUs with RAS enabled, below call trace and hang are observed when
      shutting down device.
      
      v2: use DRM device unplugged flag instead of shutdown flag as the check to
      prevent memory wipe in shutdown stage.
      
      [ +0.000000] RIP: 0010:amdgpu_vram_mgr_fini+0x18d/0x1c0 [amdgpu]
      [ +0.000001] PKRU: 55555554
      [ +0.000001] Call Trace:
      [ +0.000001] <TASK>
      [ +0.000002] amdgpu_ttm_fini+0x140/0x1c0 [amdgpu]
      [ +0.000183] amdgpu_bo_fini+0x27/0xa0 [amdgpu]
      [ +0.000184] gmc_v11_0_sw_fini+0x2b/0x40 [amdgpu]
      [ +0.000163] amdgpu_device_fini_sw+0xb6/0x510 [amdgpu]
      [ +0.000152] amdgpu_driver_release_kms+0x16/0x30 [amdgpu]
      [ +0.000090] drm_dev_release+0x28/0x50 [drm]
      [ +0.000016] devm_drm_dev_init_release+0x38/0x60 [drm]
      [ +0.000011] devm_action_release+0x15/0x20
      [ +0.000003] release_nodes+0x40/0xc0
      [ +0.000001] devres_release_all+0x9e/0xe0
      [ +0.000001] device_unbind_cleanup+0x12/0x80
      [ +0.000003] device_release_driver_internal+0xff/0x160
      [ +0.000001] driver_detach+0x4a/0x90
      [ +0.000001] bus_remove_driver+0x6c/0xf0
      [ +0.000001] driver_unregister+0x31/0x50
      [ +0.000001] pci_unregister_driver+0x40/0x90
      [ +0.000003] amdgpu_exit+0x15/0x120 [amdgpu]
      Signed-off-by: default avatarlyndonli <Lyndon.Li@amd.com>
      Reviewed-by: default avatarGuchun Chen <guchun.chen@amd.com>
      Reviewed-by: default avatarChristian König <christian.koenig@amd.com>
      Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      93bb18d2
  4. 09 Mar, 2023 6 commits
    • Conor Dooley's avatar
      RISC-V: Don't check text_mutex during stop_machine · 2a8db5ec
      Conor Dooley authored
      We're currently using stop_machine() to update ftrace & kprobes, which
      means that the thread that takes text_mutex during may not be the same
      as the thread that eventually patches the code.  This isn't actually a
      race because the lock is still held (preventing any other concurrent
      accesses) and there is only one thread running during stop_machine(),
      but it does trigger a lockdep failure.
      
      This patch just elides the lockdep check during stop_machine.
      
      Fixes: c15ac4fd ("riscv/ftrace: Add dynamic function tracer support")
      Suggested-by: default avatarSteven Rostedt <rostedt@goodmis.org>
      Reported-by: default avatarChangbin Du <changbin.du@gmail.com>
      Signed-off-by: default avatarPalmer Dabbelt <palmerdabbelt@google.com>
      Signed-off-by: default avatarConor Dooley <conor.dooley@microchip.com>
      Link: https://lore.kernel.org/r/20230303143754.4005217-1-conor.dooley@microchip.comSigned-off-by: default avatarPalmer Dabbelt <palmer@rivosinc.com>
      2a8db5ec
    • Alexandre Ghiti's avatar
      riscv: Use READ_ONCE_NOCHECK in imprecise unwinding stack mode · 76950340
      Alexandre Ghiti authored
      When CONFIG_FRAME_POINTER is unset, the stack unwinding function
      walk_stackframe randomly reads the stack and then, when KASAN is enabled,
      it can lead to the following backtrace:
      
      [    0.000000] ==================================================================
      [    0.000000] BUG: KASAN: stack-out-of-bounds in walk_stackframe+0xa6/0x11a
      [    0.000000] Read of size 8 at addr ffffffff81807c40 by task swapper/0
      [    0.000000]
      [    0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 6.2.0-12919-g24203e6db61f #43
      [    0.000000] Hardware name: riscv-virtio,qemu (DT)
      [    0.000000] Call Trace:
      [    0.000000] [<ffffffff80007ba8>] walk_stackframe+0x0/0x11a
      [    0.000000] [<ffffffff80099ecc>] init_param_lock+0x26/0x2a
      [    0.000000] [<ffffffff80007c4a>] walk_stackframe+0xa2/0x11a
      [    0.000000] [<ffffffff80c49c80>] dump_stack_lvl+0x22/0x36
      [    0.000000] [<ffffffff80c3783e>] print_report+0x198/0x4a8
      [    0.000000] [<ffffffff80099ecc>] init_param_lock+0x26/0x2a
      [    0.000000] [<ffffffff80007c4a>] walk_stackframe+0xa2/0x11a
      [    0.000000] [<ffffffff8015f68a>] kasan_report+0x9a/0xc8
      [    0.000000] [<ffffffff80007c4a>] walk_stackframe+0xa2/0x11a
      [    0.000000] [<ffffffff80007c4a>] walk_stackframe+0xa2/0x11a
      [    0.000000] [<ffffffff8006e99c>] desc_make_final+0x80/0x84
      [    0.000000] [<ffffffff8009a04e>] stack_trace_save+0x88/0xa6
      [    0.000000] [<ffffffff80099fc2>] filter_irq_stacks+0x72/0x76
      [    0.000000] [<ffffffff8006b95e>] devkmsg_read+0x32a/0x32e
      [    0.000000] [<ffffffff8015ec16>] kasan_save_stack+0x28/0x52
      [    0.000000] [<ffffffff8006e998>] desc_make_final+0x7c/0x84
      [    0.000000] [<ffffffff8009a04a>] stack_trace_save+0x84/0xa6
      [    0.000000] [<ffffffff8015ec52>] kasan_set_track+0x12/0x20
      [    0.000000] [<ffffffff8015f22e>] __kasan_slab_alloc+0x58/0x5e
      [    0.000000] [<ffffffff8015e7ea>] __kmem_cache_create+0x21e/0x39a
      [    0.000000] [<ffffffff80e133ac>] create_boot_cache+0x70/0x9c
      [    0.000000] [<ffffffff80e17ab2>] kmem_cache_init+0x6c/0x11e
      [    0.000000] [<ffffffff80e00fd6>] mm_init+0xd8/0xfe
      [    0.000000] [<ffffffff80e011d8>] start_kernel+0x190/0x3ca
      [    0.000000]
      [    0.000000] The buggy address belongs to stack of task swapper/0
      [    0.000000]  and is located at offset 0 in frame:
      [    0.000000]  stack_trace_save+0x0/0xa6
      [    0.000000]
      [    0.000000] This frame has 1 object:
      [    0.000000]  [32, 56) 'c'
      [    0.000000]
      [    0.000000] The buggy address belongs to the physical page:
      [    0.000000] page:(____ptrval____) refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x81a07
      [    0.000000] flags: 0x1000(reserved|zone=0)
      [    0.000000] raw: 0000000000001000 ff600003f1e3d150 ff600003f1e3d150 0000000000000000
      [    0.000000] raw: 0000000000000000 0000000000000000 00000001ffffffff
      [    0.000000] page dumped because: kasan: bad access detected
      [    0.000000]
      [    0.000000] Memory state around the buggy address:
      [    0.000000]  ffffffff81807b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      [    0.000000]  ffffffff81807b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      [    0.000000] >ffffffff81807c00: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 f3
      [    0.000000]                                            ^
      [    0.000000]  ffffffff81807c80: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
      [    0.000000]  ffffffff81807d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      [    0.000000] ==================================================================
      
      Fix that by using READ_ONCE_NOCHECK when reading the stack in imprecise
      mode.
      
      Fixes: 5d8544e2 ("RISC-V: Generic library routines and assembly")
      Reported-by: default avatarChathura Rajapaksha <chathura.abeyrathne.lk@gmail.com>
      Link: https://lore.kernel.org/all/CAD7mqryDQCYyJ1gAmtMm8SASMWAQ4i103ptTb0f6Oda=tPY2=A@mail.gmail.com/Suggested-by: default avatarDmitry Vyukov <dvyukov@google.com>
      Signed-off-by: default avatarAlexandre Ghiti <alexghiti@rivosinc.com>
      Link: https://lore.kernel.org/r/20230308091639.602024-1-alexghiti@rivosinc.comSigned-off-by: default avatarPalmer Dabbelt <palmer@rivosinc.com>
      76950340
    • Seth Forshee's avatar
      filelocks: use mount idmapping for setlease permission check · 42d0c4bd
      Seth Forshee authored
      A user should be allowed to take out a lease via an idmapped mount if
      the fsuid matches the mapped uid of the inode. generic_setlease() is
      checking the unmapped inode uid, causing these operations to be denied.
      
      Fix this by comparing against the mapped inode uid instead of the
      unmapped uid.
      
      Fixes: 9caccd41 ("fs: introduce MOUNT_ATTR_IDMAP")
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarSeth Forshee (DigitalOcean) <sforshee@kernel.org>
      Signed-off-by: default avatarChristian Brauner (Microsoft) <brauner@kernel.org>
      42d0c4bd
    • Geert Uytterhoeven's avatar
      i2c: dev: Fix bus callback return values · 9e5f81f9
      Geert Uytterhoeven authored
      The i2cdev_{at,de}tach_adapter() callbacks are used for two purposes:
        1. As notifier callbacks, when (un)registering I2C adapters created or
           destroyed after i2c_dev_init(),
        2. As bus iterator callbacks, for registering already existing
           adapters from i2c_dev_init(), and for cleanup.
      
      Unfortunately both use cases expect different return values: the former
      expects NOTIFY_* return codes, while the latter expects zero or error
      codes, and aborts in case of error.
      
      Hence in case 2, as soon as i2cdev_{at,de}tach_adapter() returns
      (non-zero) NOTIFY_OK, the bus iterator aborts.  This causes (a) only the
      first already existing adapter to be registered, leading to missing
      /dev/i2c-* entries, and (b) a failure to unregister all but the first
      I2C adapter during cleanup.
      
      Fix this by introducing separate callbacks for the bus iterator,
      wrapping the notifier functions, and always returning succes.
      Any errors inside these callback functions are unlikely to happen, and
      are fatal anyway.
      
      Fixes: cddf70d0 ("i2c: dev: fix notifier return values")
      Signed-off-by: default avatarGeert Uytterhoeven <geert+renesas@glider.be>
      Reviewed-by: default avatarBartosz Golaszewski <bartosz.golaszewski@linaro.org>
      Signed-off-by: default avatarWolfram Sang <wsa@kernel.org>
      9e5f81f9
    • Uwe Kleine-König's avatar
      i2c: Convert drivers to new .probe() callback · 834a9dc4
      Uwe Kleine-König authored
      Now that .probe() was changed not to get the id parameter, drivers can
      be converted back to that with the eventual goal to drop .probe_new().
      
      Implement that for the i2c drivers that are part of the i2c core.
      Signed-off-by: default avatarUwe Kleine-König <u.kleine-koenig@pengutronix.de>
      Signed-off-by: default avatarWolfram Sang <wsa@kernel.org>
      834a9dc4
    • Uwe Kleine-König's avatar
      i2c: mux: Convert all drivers to new .probe() callback · 2f2afad9
      Uwe Kleine-König authored
      Now that .probe() was changed not to get the id parameter, drivers can
      be converted back to that with the eventual goal to drop .probe_new().
      
      Implement that for the i2c mux drivers.
      Acked-by: default avatarGuenter Roeck <linux@roeck-us.net>
      Acked-by: default avatarPeter Rosin <peda@axentia.se>
      Signed-off-by: default avatarUwe Kleine-König <u.kleine-koenig@pengutronix.de>
      Signed-off-by: default avatarWolfram Sang <wsa@kernel.org>
      2f2afad9