1. 06 Nov, 2022 13 commits
    • Linus Torvalds's avatar
      Merge tag 'x86_urgent_for_v6.1_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · f6f52047
      Linus Torvalds authored
      Pull x86 fixes from Borislav Petkov:
      
       - Add new Intel CPU models
      
       - Enforce that TDX guests are successfully loaded only on TDX hardware
         where virtualization exception (#VE) delivery on kernel memory is
         disabled because handling those in all possible cases is "essentially
         impossible"
      
       - Add the proper include to the syscall wrappers so that BTF can see
         the real pt_regs definition and not only the forward declaration
      
      * tag 'x86_urgent_for_v6.1_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/cpu: Add several Intel server CPU model numbers
        x86/tdx: Panic on bad configs that #VE on "private" memory access
        x86/tdx: Prepare for using "INFO" call for a second purpose
        x86/syscall: Include asm/ptrace.h in syscall_wrapper header
      f6f52047
    • Linus Torvalds's avatar
      Merge tag 'kbuild-fixes-v6.1-2' of... · 35697d81
      Linus Torvalds authored
      Merge tag 'kbuild-fixes-v6.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild
      
      Pull Kbuild fixes from Masahiro Yamada:
      
       - Use POSIX-compatible grep options
      
       - Document git-related tips for reproducible builds
      
       - Fix a typo in the modpost rule
      
       - Suppress SIGPIPE error message from gcc-ar and llvm-ar
      
       - Fix segmentation fault in the menuconfig search
      
      * tag 'kbuild-fixes-v6.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild:
        kconfig: fix segmentation fault in menuconfig search
        kbuild: fix SIGPIPE error message for AR=gcc-ar and AR=llvm-ar
        kbuild: fix typo in modpost
        Documentation: kbuild: Add description of git for reproducible builds
        kbuild: use POSIX-compatible grep option
      35697d81
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm · 089d1c31
      Linus Torvalds authored
      Pull kvm fixes from Paolo Bonzini:
      "ARM:
      
         - Fix the pKVM stage-1 walker erronously using the stage-2 accessor
      
         - Correctly convert vcpu->kvm to a hyp pointer when generating an
           exception in a nVHE+MTE configuration
      
         - Check that KVM_CAP_DIRTY_LOG_* are valid before enabling them
      
         - Fix SMPRI_EL1/TPIDR2_EL0 trapping on VHE
      
         - Document the boot requirements for FGT when entering the kernel at
           EL1
      
        x86:
      
         - Use SRCU to protect zap in __kvm_set_or_clear_apicv_inhibit()
      
         - Make argument order consistent for kvcalloc()
      
         - Userspace API fixes for DEBUGCTL and LBRs"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
        KVM: x86: Fix a typo about the usage of kvcalloc()
        KVM: x86: Use SRCU to protect zap in __kvm_set_or_clear_apicv_inhibit()
        KVM: VMX: Ignore guest CPUID for host userspace writes to DEBUGCTL
        KVM: VMX: Fold vmx_supported_debugctl() into vcpu_supported_debugctl()
        KVM: VMX: Advertise PMU LBRs if and only if perf supports LBRs
        arm64: booting: Document our requirements for fine grained traps with SME
        KVM: arm64: Fix SMPRI_EL1/TPIDR2_EL0 trapping on VHE
        KVM: Check KVM_CAP_DIRTY_LOG_{RING, RING_ACQ_REL} prior to enabling them
        KVM: arm64: Fix bad dereference on MTE-enabled systems
        KVM: arm64: Use correct accessor to parse stage-1 PTEs
      089d1c31
    • Linus Torvalds's avatar
      Merge tag 'for-linus-6.1-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip · 6e8c78d3
      Linus Torvalds authored
      Pull xen fixes from Juergen Gross:
       "One fix for silencing a smatch warning, and a small cleanup patch"
      
      * tag 'for-linus-6.1-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
        x86/xen: simplify sysenter and syscall setup
        x86/xen: silence smatch warning in pmu_msr_chk_emulated()
      6e8c78d3
    • Linus Torvalds's avatar
      Merge tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 · 9761070d
      Linus Torvalds authored
      Pull ext4 fixes from Ted Ts'o:
       "Fix a number of bugs, including some regressions, the most serious of
        which was one which would cause online resizes to fail with file
        systems with metadata checksums enabled.
      
        Also fix a warning caused by the newly added fortify string checker,
        plus some bugs that were found using fuzzed file systems"
      
      * tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:
        ext4: fix fortify warning in fs/ext4/fast_commit.c:1551
        ext4: fix wrong return err in ext4_load_and_init_journal()
        ext4: fix warning in 'ext4_da_release_space'
        ext4: fix BUG_ON() when directory entry has invalid rec_len
        ext4: update the backup superblock's at the end of the online resize
      9761070d
    • Linus Torvalds's avatar
      Merge tag '6.1-rc4-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6 · 90153f92
      Linus Torvalds authored
      Pull cifs fixes from Steve French:
       "One symlink handling fix and two fixes foir multichannel issues with
        iterating channels, including for oplock breaks when leases are
        disabled"
      
      * tag '6.1-rc4-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6:
        cifs: fix use-after-free on the link name
        cifs: avoid unnecessary iteration of tcp sessions
        cifs: always iterate smb sessions using primary channel
      90153f92
    • Linus Torvalds's avatar
      Merge tag 'trace-v6.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace · 8391aa4b
      Linus Torvalds authored
      Pull `lTracing fixes for 6.1-rc3:
      
       - Fixed NULL pointer dereference in the ring buffer wait-waiters code
         for machines that have less CPUs than what nr_cpu_ids returns.
      
         The buffer array is of size nr_cpu_ids, but only the online CPUs get
         initialized.
      
       - Fixed use after free call in ftrace_shutdown.
      
       - Fix accounting of if a kprobe is enabled
      
       - Fix NULL pointer dereference on error path of fprobe rethook_alloc().
      
       - Fix unregistering of fprobe_kprobe_handler
      
       - Fix memory leak in kprobe test module
      
      * tag 'trace-v6.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
        tracing: kprobe: Fix memory leak in test_gen_kprobe/kretprobe_cmd()
        tracing/fprobe: Fix to check whether fprobe is registered correctly
        fprobe: Check rethook_alloc() return in rethook initialization
        kprobe: reverse kp->flags when arm_kprobe failed
        ftrace: Fix use-after-free for dynamic ftrace_ops
        ring-buffer: Check for NULL cpu_buffer in ring_buffer_wake_waiters()
      8391aa4b
    • Paolo Bonzini's avatar
      Merge tag 'kvmarm-fixes-6.1-3' of... · f4298cac
      Paolo Bonzini authored
      Merge tag 'kvmarm-fixes-6.1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD
      
      * Fix the pKVM stage-1 walker erronously using the stage-2 accessor
      
      * Correctly convert vcpu->kvm to a hyp pointer when generating
        an exception in a nVHE+MTE configuration
      
      * Check that KVM_CAP_DIRTY_LOG_* are valid before enabling them
      
      * Fix SMPRI_EL1/TPIDR2_EL0 trapping on VHE
      
      * Document the boot requirements for FGT when entering the kernel
        at EL1
      f4298cac
    • Paolo Bonzini's avatar
      Merge branch 'kvm-master' into HEAD · 14620149
      Paolo Bonzini authored
      x86:
      * Use SRCU to protect zap in __kvm_set_or_clear_apicv_inhibit()
      
      * Make argument order consistent for kvcalloc()
      
      * Userspace API fixes for DEBUGCTL and LBRs
      14620149
    • Theodore Ts'o's avatar
      ext4: fix fortify warning in fs/ext4/fast_commit.c:1551 · 0d043351
      Theodore Ts'o authored
      With the new fortify string system, rework the memcpy to avoid this
      warning:
      
      memcpy: detected field-spanning write (size 60) of single field "&raw_inode->i_generation" at fs/ext4/fast_commit.c:1551 (size 4)
      
      Cc: stable@kernel.org
      Fixes: 54d9469b ("fortify: Add run-time WARN for cross-field memcpy()")
      Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
      0d043351
    • Jason Yan's avatar
      ext4: fix wrong return err in ext4_load_and_init_journal() · 9f2a1d9f
      Jason Yan authored
      The return value is wrong in ext4_load_and_init_journal(). The local
      variable 'err' need to be initialized before goto out. The original code
      in __ext4_fill_super() is fine because it has two return values 'ret'
      and 'err' and 'ret' is initialized as -EINVAL. After we factor out
      ext4_load_and_init_journal(), this code is broken. So fix it by directly
      returning -EINVAL in the error handler path.
      
      Cc: stable@kernel.org
      Fixes: 9c1dd22d ("ext4: factor out ext4_load_and_init_journal()")
      Signed-off-by: default avatarJason Yan <yanaijie@huawei.com>
      Reviewed-by: default avatarJan Kara <jack@suse.cz>
      Link: https://lore.kernel.org/r/20221025040206.3134773-1-yanaijie@huawei.comSigned-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
      9f2a1d9f
    • Ye Bin's avatar
      ext4: fix warning in 'ext4_da_release_space' · 1b8f787e
      Ye Bin authored
      Syzkaller report issue as follows:
      EXT4-fs (loop0): Free/Dirty block details
      EXT4-fs (loop0): free_blocks=0
      EXT4-fs (loop0): dirty_blocks=0
      EXT4-fs (loop0): Block reservation details
      EXT4-fs (loop0): i_reserved_data_blocks=0
      EXT4-fs warning (device loop0): ext4_da_release_space:1527: ext4_da_release_space: ino 18, to_free 1 with only 0 reserved data blocks
      ------------[ cut here ]------------
      WARNING: CPU: 0 PID: 92 at fs/ext4/inode.c:1528 ext4_da_release_space+0x25e/0x370 fs/ext4/inode.c:1524
      Modules linked in:
      CPU: 0 PID: 92 Comm: kworker/u4:4 Not tainted 6.0.0-syzkaller-09423-g493ffd66 #0
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022
      Workqueue: writeback wb_workfn (flush-7:0)
      RIP: 0010:ext4_da_release_space+0x25e/0x370 fs/ext4/inode.c:1528
      RSP: 0018:ffffc900015f6c90 EFLAGS: 00010296
      RAX: 42215896cd52ea00 RBX: 0000000000000000 RCX: 42215896cd52ea00
      RDX: 0000000000000000 RSI: 0000000080000001 RDI: 0000000000000000
      RBP: 1ffff1100e907d96 R08: ffffffff816aa79d R09: fffff520002bece5
      R10: fffff520002bece5 R11: 1ffff920002bece4 R12: ffff888021fd2000
      R13: ffff88807483ecb0 R14: 0000000000000001 R15: ffff88807483e740
      FS:  0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 00005555569ba628 CR3: 000000000c88e000 CR4: 00000000003506f0
      DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
      Call Trace:
       <TASK>
       ext4_es_remove_extent+0x1ab/0x260 fs/ext4/extents_status.c:1461
       mpage_release_unused_pages+0x24d/0xef0 fs/ext4/inode.c:1589
       ext4_writepages+0x12eb/0x3be0 fs/ext4/inode.c:2852
       do_writepages+0x3c3/0x680 mm/page-writeback.c:2469
       __writeback_single_inode+0xd1/0x670 fs/fs-writeback.c:1587
       writeback_sb_inodes+0xb3b/0x18f0 fs/fs-writeback.c:1870
       wb_writeback+0x41f/0x7b0 fs/fs-writeback.c:2044
       wb_do_writeback fs/fs-writeback.c:2187 [inline]
       wb_workfn+0x3cb/0xef0 fs/fs-writeback.c:2227
       process_one_work+0x877/0xdb0 kernel/workqueue.c:2289
       worker_thread+0xb14/0x1330 kernel/workqueue.c:2436
       kthread+0x266/0x300 kernel/kthread.c:376
       ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
       </TASK>
      
      Above issue may happens as follows:
      ext4_da_write_begin
        ext4_create_inline_data
          ext4_clear_inode_flag(inode, EXT4_INODE_EXTENTS);
          ext4_set_inode_flag(inode, EXT4_INODE_INLINE_DATA);
      __ext4_ioctl
        ext4_ext_migrate -> will lead to eh->eh_entries not zero, and set extent flag
      ext4_da_write_begin
        ext4_da_convert_inline_data_to_extent
          ext4_da_write_inline_data_begin
            ext4_da_map_blocks
              ext4_insert_delayed_block
      	  if (!ext4_es_scan_clu(inode, &ext4_es_is_delonly, lblk))
      	    if (!ext4_es_scan_clu(inode, &ext4_es_is_mapped, lblk))
      	      ext4_clu_mapped(inode, EXT4_B2C(sbi, lblk)); -> will return 1
      	       allocated = true;
                ext4_es_insert_delayed_block(inode, lblk, allocated);
      ext4_writepages
        mpage_map_and_submit_extent(handle, &mpd, &give_up_on_write); -> return -ENOSPC
        mpage_release_unused_pages(&mpd, give_up_on_write); -> give_up_on_write == 1
          ext4_es_remove_extent
            ext4_da_release_space(inode, reserved);
              if (unlikely(to_free > ei->i_reserved_data_blocks))
      	  -> to_free == 1  but ei->i_reserved_data_blocks == 0
      	  -> then trigger warning as above
      
      To solve above issue, forbid inode do migrate which has inline data.
      
      Cc: stable@kernel.org
      Reported-by: syzbot+c740bb18df70ad00952e@syzkaller.appspotmail.com
      Signed-off-by: default avatarYe Bin <yebin10@huawei.com>
      Reviewed-by: default avatarJan Kara <jack@suse.cz>
      Link: https://lore.kernel.org/r/20221018022701.683489-1-yebin10@huawei.comSigned-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
      1b8f787e
    • Luís Henriques's avatar
      ext4: fix BUG_ON() when directory entry has invalid rec_len · 17a0bc9b
      Luís Henriques authored
      The rec_len field in the directory entry has to be a multiple of 4.  A
      corrupted filesystem image can be used to hit a BUG() in
      ext4_rec_len_to_disk(), called from make_indexed_dir().
      
       ------------[ cut here ]------------
       kernel BUG at fs/ext4/ext4.h:2413!
       ...
       RIP: 0010:make_indexed_dir+0x53f/0x5f0
       ...
       Call Trace:
        <TASK>
        ? add_dirent_to_buf+0x1b2/0x200
        ext4_add_entry+0x36e/0x480
        ext4_add_nondir+0x2b/0xc0
        ext4_create+0x163/0x200
        path_openat+0x635/0xe90
        do_filp_open+0xb4/0x160
        ? __create_object.isra.0+0x1de/0x3b0
        ? _raw_spin_unlock+0x12/0x30
        do_sys_openat2+0x91/0x150
        __x64_sys_open+0x6c/0xa0
        do_syscall_64+0x3c/0x80
        entry_SYSCALL_64_after_hwframe+0x46/0xb0
      
      The fix simply adds a call to ext4_check_dir_entry() to validate the
      directory entry, returning -EFSCORRUPTED if the entry is invalid.
      
      CC: stable@kernel.org
      Link: https://bugzilla.kernel.org/show_bug.cgi?id=216540Signed-off-by: default avatarLuís Henriques <lhenriques@suse.de>
      Link: https://lore.kernel.org/r/20221012131330.32456-1-lhenriques@suse.deSigned-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
      17a0bc9b
  2. 05 Nov, 2022 8 commits
    • Linus Torvalds's avatar
      Merge tag 'acpi-6.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · 2f5065a0
      Linus Torvalds authored
      Pull ACPI fix from Rafael Wysocki:
       "Add StorageD3Enable quirk for Dell Inspiron 16 5625 (Mario
        Limonciello)"
      
      * tag 'acpi-6.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        ACPI: x86: Add another system to quirk list for forcing StorageD3Enable
      2f5065a0
    • Rafael J. Wysocki's avatar
      Merge branch 'acpi-x86' · 6faf4ce5
      Rafael J. Wysocki authored
      * acpi-x86:
        ACPI: x86: Add another system to quirk list for forcing StorageD3Enable
      6faf4ce5
    • Linus Torvalds's avatar
      Merge tag 'block-6.1-2022-11-05' of git://git.kernel.dk/linux · 4869f575
      Linus Torvalds authored
      Pull block fixes from Jens Axboe:
      
       - Fixes for the ublk driver (Ming)
      
       - Fixes for error handling memory leaks (Chen Jun, Chen Zhongjin)
      
       - Explicitly clear the last request in a chain when the plug is
         flushed, as it may have already been issued (Al)
      
      * tag 'block-6.1-2022-11-05' of git://git.kernel.dk/linux:
        block: blk_add_rq_to_plug(): clear stale 'last' after flush
        blk-mq: Fix kmemleak in blk_mq_init_allocated_queue
        block: Fix possible memory leak for rq_wb on add_disk failure
        ublk_drv: add ublk_queue_cmd() for cleanup
        ublk_drv: avoid to touch io_uring cmd in blk_mq io path
        ublk_drv: comment on ublk_driver entry of Kconfig
        ublk_drv: return flag of UBLK_F_URING_CMD_COMP_IN_TASK in case of module
      4869f575
    • ChenXiaoSong's avatar
      cifs: fix use-after-free on the link name · 542228db
      ChenXiaoSong authored
      xfstests generic/011 reported use-after-free bug as follows:
      
        BUG: KASAN: use-after-free in __d_alloc+0x269/0x859
        Read of size 15 at addr ffff8880078933a0 by task dirstress/952
      
        CPU: 1 PID: 952 Comm: dirstress Not tainted 6.1.0-rc3+ #77
        Call Trace:
         __dump_stack+0x23/0x29
         dump_stack_lvl+0x51/0x73
         print_address_description+0x67/0x27f
         print_report+0x3e/0x5c
         kasan_report+0x7b/0xa8
         kasan_check_range+0x1b2/0x1c1
         memcpy+0x22/0x5d
         __d_alloc+0x269/0x859
         d_alloc+0x45/0x20c
         d_alloc_parallel+0xb2/0x8b2
         lookup_open+0x3b8/0x9f9
         open_last_lookups+0x63d/0xc26
         path_openat+0x11a/0x261
         do_filp_open+0xcc/0x168
         do_sys_openat2+0x13b/0x3f7
         do_sys_open+0x10f/0x146
         __se_sys_creat+0x27/0x2e
         __x64_sys_creat+0x55/0x6a
         do_syscall_64+0x40/0x96
         entry_SYSCALL_64_after_hwframe+0x63/0xcd
      
        Allocated by task 952:
         kasan_save_stack+0x1f/0x42
         kasan_set_track+0x21/0x2a
         kasan_save_alloc_info+0x17/0x1d
         __kasan_kmalloc+0x7e/0x87
         __kmalloc_node_track_caller+0x59/0x155
         kstrndup+0x60/0xe6
         parse_mf_symlink+0x215/0x30b
         check_mf_symlink+0x260/0x36a
         cifs_get_inode_info+0x14e1/0x1690
         cifs_revalidate_dentry_attr+0x70d/0x964
         cifs_revalidate_dentry+0x36/0x62
         cifs_d_revalidate+0x162/0x446
         lookup_open+0x36f/0x9f9
         open_last_lookups+0x63d/0xc26
         path_openat+0x11a/0x261
         do_filp_open+0xcc/0x168
         do_sys_openat2+0x13b/0x3f7
         do_sys_open+0x10f/0x146
         __se_sys_creat+0x27/0x2e
         __x64_sys_creat+0x55/0x6a
         do_syscall_64+0x40/0x96
         entry_SYSCALL_64_after_hwframe+0x63/0xcd
      
        Freed by task 950:
         kasan_save_stack+0x1f/0x42
         kasan_set_track+0x21/0x2a
         kasan_save_free_info+0x1c/0x34
         ____kasan_slab_free+0x1c1/0x1d5
         __kasan_slab_free+0xe/0x13
         __kmem_cache_free+0x29a/0x387
         kfree+0xd3/0x10e
         cifs_fattr_to_inode+0xb6a/0xc8c
         cifs_get_inode_info+0x3cb/0x1690
         cifs_revalidate_dentry_attr+0x70d/0x964
         cifs_revalidate_dentry+0x36/0x62
         cifs_d_revalidate+0x162/0x446
         lookup_open+0x36f/0x9f9
         open_last_lookups+0x63d/0xc26
         path_openat+0x11a/0x261
         do_filp_open+0xcc/0x168
         do_sys_openat2+0x13b/0x3f7
         do_sys_open+0x10f/0x146
         __se_sys_creat+0x27/0x2e
         __x64_sys_creat+0x55/0x6a
         do_syscall_64+0x40/0x96
         entry_SYSCALL_64_after_hwframe+0x63/0xcd
      
      When opened a symlink, link name is from 'inode->i_link', but it may be
      reset to a new value when revalidate the dentry. If some processes get the
      link name on the race scenario, then UAF will happen on link name.
      
      Fix this by implementing 'get_link' interface to duplicate the link name.
      
      Fixes: 76894f3e ("cifs: improve symlink handling for smb2+")
      Signed-off-by: default avatarChenXiaoSong <chenxiaosong2@huawei.com>
      Reviewed-by: default avatarPaulo Alcantara (SUSE) <pc@cjr.nz>
      Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
      542228db
    • Shyam Prasad N's avatar
      cifs: avoid unnecessary iteration of tcp sessions · 23d9b9b7
      Shyam Prasad N authored
      In a few places, we do unnecessary iterations of
      tcp sessions, even when the server struct is provided.
      
      The change avoids it and uses the server struct provided.
      Signed-off-by: default avatarShyam Prasad N <sprasad@microsoft.com>
      Reviewed-by: default avatarPaulo Alcantara (SUSE) <pc@cjr.nz>
      Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
      23d9b9b7
    • Shyam Prasad N's avatar
      cifs: always iterate smb sessions using primary channel · 8abcaeae
      Shyam Prasad N authored
      smb sessions and tcons currently hang off primary channel only.
      Secondary channels have the lists as empty. Whenever there's a
      need to iterate sessions or tcons, we should use the list in the
      corresponding primary channel.
      Signed-off-by: default avatarShyam Prasad N <sprasad@microsoft.com>
      Reviewed-by: default avatarPaulo Alcantara (SUSE) <pc@cjr.nz>
      Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
      8abcaeae
    • Linus Torvalds's avatar
      Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux · b208b9fb
      Linus Torvalds authored
      Pull arm64 fixes from Catalin Marinas:
      
       - Avoid kprobe recursion when cortex_a76_erratum_1463225_debug_handler()
         is not inlined (change to __always_inline).
      
       - Fix the visibility of compat hwcaps, broken by recent changes to
         consolidate the visibility of hwcaps and the user-space view of the
         ID registers.
      
      * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
        arm64: cpufeature: Fix the visibility of compat hwcaps
        arm64: entry: avoid kprobe recursion
      b208b9fb
    • Linus Torvalds's avatar
      Merge tag 'i2c-for-6.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux · 74f3f1d7
      Linus Torvalds authored
      Pull i2c fixes from Wolfram Sang:
       "A documentation fix and driver fixes for piix4, tegra, and i801"
      
      * tag 'i2c-for-6.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
        Documentation: devres: add missing I2C helper
        i2c: i801: add lis3lv02d's I2C address for Vostro 5568
        i2c: tegra: Allocate DMA memory for DMA engine
        i2c: piix4: Fix adapter not be removed in piix4_remove()
      74f3f1d7
  3. 04 Nov, 2022 9 commits
    • Linus Torvalds's avatar
      Merge tag 'xfs-6.1-fixes-4' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux · 64c3dd0b
      Linus Torvalds authored
      Pull xfs fixes from Darrick Wong:
       "Dave and I had thought that this would be a very quiet cycle, but we
        thought wrong.
      
        At first there were the usual trickle of minor bugfixes, but then
        Zorro pulled -rc1 and noticed complaints about the stronger memcpy
        checks w.r.t. flex arrays.
      
        Analyzing how to fix that revealed a bunch of validation gaps in
        validating ondisk log items during recovery, and then a customer hit
        an infinite loop in the refcounting code on a corrupt filesystem.
      
        So. This largeish batch of fixes addresses all those problems, I hope.
      
        Summary:
      
         - Fix a UAF bug during log recovery
      
         - Fix memory leaks when mount fails
      
         - Detect corrupt bestfree information in a directory block
      
         - Fix incorrect return value type for the dax page fault handlers
      
         - Fix fortify complaints about memcpy of xfs log item objects
      
         - Strengthen inadequate validation of recovered log items
      
         - Fix incorrectly declared flex array in EFI log item structs
      
         - Log corrupt log items for debugging purposes
      
         - Fix infinite loop problems in the refcount code if the refcount
           btree node block keys are corrupt
      
         - Fix infinite loop problems in the refcount code if the refcount
           btree records suffer MSB bitflips
      
         - Add more sanity checking to continued defer ops to prevent
           overflows from one AG to the next or off EOFS"
      
      * tag 'xfs-6.1-fixes-4' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: (28 commits)
        xfs: rename XFS_REFC_COW_START to _COWFLAG
        xfs: fix uninitialized list head in struct xfs_refcount_recovery
        xfs: fix agblocks check in the cow leftover recovery function
        xfs: check record domain when accessing refcount records
        xfs: remove XFS_FIND_RCEXT_SHARED and _COW
        xfs: refactor domain and refcount checking
        xfs: report refcount domain in tracepoints
        xfs: track cow/shared record domains explicitly in xfs_refcount_irec
        xfs: refactor refcount record usage in xchk_refcountbt_rec
        xfs: dump corrupt recovered log intent items to dmesg consistently
        xfs: move _irec structs to xfs_types.h
        xfs: actually abort log recovery on corrupt intent-done log items
        xfs: check deferred refcount op continuation parameters
        xfs: refactor all the EFI/EFD log item sizeof logic
        xfs: create a predicate to verify per-AG extents
        xfs: fix memcpy fortify errors in EFI log format copying
        xfs: make sure aglen never goes negative in xfs_refcount_adjust_extents
        xfs: fix memcpy fortify errors in RUI log format copying
        xfs: fix memcpy fortify errors in CUI log format copying
        xfs: fix memcpy fortify errors in BUI log format copying
        ...
      64c3dd0b
    • Linus Torvalds's avatar
      Merge tag 'landlock-6.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux · 5d8401be
      Linus Torvalds authored
      Pull landlock fix from Mickaël Salaün:
       "Fix the test build for some distros"
      
      * tag 'landlock-6.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux:
        selftests/landlock: Build without static libraries
      5d8401be
    • Linus Torvalds's avatar
      Merge tag 'hardening-v6.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux · bd745027
      Linus Torvalds authored
      Pull hardening fix from Kees Cook:
      
       - Correctly report struct member size on memcpy overflow (Kees Cook)
      
      * tag 'hardening-v6.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
        fortify: Capture __bos() results in const temp vars
      bd745027
    • Linus Torvalds's avatar
      Merge tag 'efi-fixes-for-v6.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi · 1caa2f18
      Linus Torvalds authored
      Pull EFI fixes from Ard Biesheuvel:
      
       - A pair of tweaks to the EFI random seed code so that externally
         provided version of this config table are handled more robustly
      
       - Another fix for the v6.0 EFI variable refactor that turned out to
         break Apple machines which don't provide QueryVariableInfo()
      
       - Add some guard rails to the EFI runtime service call wrapper so we
         can recover from synchronous exceptions caused by firmware
      
      * tag 'efi-fixes-for-v6.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi:
        arm64: efi: Recover from synchronous exceptions occurring in firmware
        efi: efivars: Fix variable writes with unsupported query_variable_store()
        efi: random: Use 'ACPI reclaim' memory for random seed
        efi: random: reduce seed size to 32 bytes
        efi/tpm: Pass correct address to memblock_reserve
      1caa2f18
    • Linus Torvalds's avatar
      Merge tag 'soc-fixes-6.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc · 10d916c8
      Linus Torvalds authored
      Pull ARM SoC fixes from Arnd Bergmann:
       "There are not a lot of important fixes for the soc tree yet this time,
        but it's time to upstream what I got so far:
      
         - DT Fixes for Arm Juno and ST-Ericsson Ux500 to add missing critical
           temperature points
      
         - A number of fixes for the Arm SCMI firmware, addressing correctness
           issues in the code, in particular error handling and resource
           leaks.
      
         - One error handling fix for the new i.MX93 power domain driver
      
         - Several devicetree fixes for NXP i.MX6/8/9 and Layerscape chips,
           fixing incorrect or missing DT properties for MDIO controller
           nodes, CPLD, USB and regulators for various boards, as well as some
           fixes for DT schema checks.
      
         - MAINTAINERS file updates for HiSilicon LPC Bus and Broadcom git
           URLs"
      
      * tag 'soc-fixes-6.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (26 commits)
        arm64: dts: juno: Add thermal critical trip points
        firmware: arm_scmi: Fix deferred_tx_wq release on error paths
        firmware: arm_scmi: Fix devres allocation device in virtio transport
        firmware: arm_scmi: Make Rx chan_setup fail on memory errors
        firmware: arm_scmi: Make tx_prepare time out eventually
        firmware: arm_scmi: Suppress the driver's bind attributes
        firmware: arm_scmi: Cleanup the core driver removal callback
        MAINTAINERS: Update HiSilicon LPC BUS Driver maintainer
        ARM: dts: ux500: Add trips to battery thermal zones
        arm64: dts: ls208xa: specify clock frequencies for the MDIO controllers
        arm64: dts: ls1088a: specify clock frequencies for the MDIO controllers
        arm64: dts: lx2160a: specify clock frequencies for the MDIO controllers
        soc: imx: imx93-pd: Fix the error handling path of imx93_pd_probe()
        arm64: dts: imx93: correct gpio-ranges
        arm64: dts: imx93: correct s4mu interrupt names
        dt-bindings: power: gpcv2: add power-domains property
        arm64: dts: imx8: correct clock order
        ARM: dts: imx6dl-yapp4: Do not allow PM to switch PU regulator off on Q/QP
        ARM: dts: imx6qdl-gw59{10,13}: fix user pushbutton GPIO offset
        arm64: dts: imx8mn: Correct the usb power domain
        ...
      10d916c8
    • Tony Luck's avatar
      x86/cpu: Add several Intel server CPU model numbers · 7beade0d
      Tony Luck authored
      These servers are all on the public versions of the roadmap. The model
      numbers for Grand Ridge, Granite Rapids, and Sierra Forest were included
      in the September 2022 edition of the Instruction Set Extensions document.
      Signed-off-by: default avatarTony Luck <tony.luck@intel.com>
      Signed-off-by: default avatarBorislav Petkov <bp@suse.de>
      Acked-by: default avatarDave Hansen <dave.hansen@linux.intel.com>
      Link: https://lore.kernel.org/r/20221103203310.5058-1-tony.luck@intel.com
      7beade0d
    • Linus Torvalds's avatar
      Merge tag 'drm-fixes-2022-11-04-1' of git://anongit.freedesktop.org/drm/drm · fde25beb
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "This is the weekly fixes for rc4. Misc fixes across rockchip, imx,
        amdgpu and i915.
      
        The biggest change is for amdkfd where the trap handler needs an
        updated fw from a header which makes it a bit larger. I hadn't noticed
        this particular file before so I'm going to figure out what the magic
        is for, but the fix should be fine for now.
      
        amdgpu:
         - DCN 3.1.4 fixes
         - DCN 3.2.x fixes
         - GC 11.x fixes
         - Virtual display fix
         - Fail suspend if resources can't be evicted
         - SR-IOV fix
         - Display PSR fix
      
        amdkfd:
         - Fix possible NULL pointer deref
         - GC 11.x trap handler fix
      
        i915:
         - Add locking around DKL PHY register accesses
         - Stop abusing swiotlb_max_segment
         - Filter out invalid outputs more sensibly
         - Setup DDC fully before output init
         - Simplify intel_panel_add_edid_alt_fixed_modes()
         - Grab mode_config.mutex during LVDS init to avoid WARNs
      
        rockchip:
         - fix probing issues
         - fix framebuffer without iommu
         - fix vop selection
         - fix NULL ptr access
      
        imx:
         - Fix Kconfig
         - fix mode_valid function"
      
      * tag 'drm-fixes-2022-11-04-1' of git://anongit.freedesktop.org/drm/drm: (35 commits)
        drm/amdkfd: update GFX11 CWSR trap handler
        drm/amd/display: Investigate tool reported FCLK P-state deviations
        drm/amd/display: Add DSC delay factor workaround
        drm/amd/display: Round up DST_after_scaler to nearest int
        drm/amd/display: Use forced DSC bpp in DML
        drm/amd/display: Fix DCN32 DSC delay calculation
        drm/amdgpu: Disable GPU reset on SRIOV before remove pci.
        drm/amdgpu: disable GFXOFF during compute for GFX11
        drm/amd: Fail the suspend if resources can't be evicted
        drm/amdkfd: Fix NULL pointer dereference in svm_migrate_to_ram()
        drm/amdgpu: correct MES debugfs versions
        drm/amdgpu: set fb_modifiers_not_supported in vkms
        drm/amd/display: cursor update command incomplete
        drm/amd/display: Enable timing sync on DCN32
        drm/amd/display: Set memclk levels to be at least 1 for dcn32
        drm/amd/display: Update latencies on DCN321
        drm/amd/display: Limit dcn32 to 1950Mhz display clock
        drm/amd/display: Ignore Cable ID Feature
        drm/amd/display: Update DSC capabilitie for DCN314
        drm/imx: imx-tve: Fix return type of imx_tve_connector_mode_valid
        ...
      fde25beb
    • Linus Torvalds's avatar
      Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux · db385e0b
      Linus Torvalds authored
      Pull clk fixes from Stephen Boyd:
       "Fixes in clk drivers and some clk rate range fixes in the core as
        well:
      
         - Make sure the struct clk_rate_request is more sane
      
         - Remove a WARN_ON that was triggering for clks with no parents that
           can change frequency
      
         - Fix bad i2c bus transactions on Renesas rs9
      
         - Actually return an error in clk_mt8195_topck_probe() on an error
           path
      
         - Keep the GPU memories powered while the clk isn't enabled on
           Qualcomm's sc7280 SoC
      
         - Fix the parent clk for HSCIF modules on Renesas' R-Car V4H SoC"
      
      * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux:
        clk: qcom: Update the force mem core bit for GPU clocks
        clk: Initialize max_rate in struct clk_rate_request
        clk: Initialize the clk_rate_request even if clk_core is NULL
        clk: Remove WARN_ON NULL parent in clk_core_init_rate_req()
        clk: renesas: r8a779g0: Fix HSCIF parent clocks
        clk: renesas: r8a779g0: Add SASYNCPER clocks
        clk: mediatek: clk-mt8195-topckgen: Fix error return code in clk_mt8195_topck_probe()
        clk: sifive: select by default if SOC_SIFIVE
        clk: rs9: Fix I2C accessors
      db385e0b
    • Shang XiaoJing's avatar
      tracing: kprobe: Fix memory leak in test_gen_kprobe/kretprobe_cmd() · 66f0919c
      Shang XiaoJing authored
      test_gen_kprobe_cmd() only free buf in fail path, hence buf will leak
      when there is no failure. Move kfree(buf) from fail path to common path
      to prevent the memleak. The same reason and solution in
      test_gen_kretprobe_cmd().
      
      unreferenced object 0xffff888143b14000 (size 2048):
        comm "insmod", pid 52490, jiffies 4301890980 (age 40.553s)
        hex dump (first 32 bytes):
          70 3a 6b 70 72 6f 62 65 73 2f 67 65 6e 5f 6b 70  p:kprobes/gen_kp
          72 6f 62 65 5f 74 65 73 74 20 64 6f 5f 73 79 73  robe_test do_sys
        backtrace:
          [<000000006d7b836b>] kmalloc_trace+0x27/0xa0
          [<0000000009528b5b>] 0xffffffffa059006f
          [<000000008408b580>] do_one_initcall+0x87/0x2a0
          [<00000000c4980a7e>] do_init_module+0xdf/0x320
          [<00000000d775aad0>] load_module+0x3006/0x3390
          [<00000000e9a74b80>] __do_sys_finit_module+0x113/0x1b0
          [<000000003726480d>] do_syscall_64+0x35/0x80
          [<000000003441e93b>] entry_SYSCALL_64_after_hwframe+0x46/0xb0
      
      Link: https://lore.kernel.org/all/20221102072954.26555-1-shangxiaojing@huawei.com/
      
      Fixes: 64836248 ("tracing: Add kprobe event command generation test module")
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarShang XiaoJing <shangxiaojing@huawei.com>
      Acked-by: default avatarMasami Hiramatsu (Google) <mhiramat@kernel.org>
      Signed-off-by: default avatarMasami Hiramatsu (Google) <mhiramat@kernel.org>
      66f0919c
  4. 03 Nov, 2022 10 commits