1. 07 Apr, 2021 2 commits
    • Greg Kroah-Hartman's avatar
      Merge tag 'phy-for-5.13' of... · fbb0ad42
      Greg Kroah-Hartman authored
      Merge tag 'phy-for-5.13' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy into char-misc-next
      
      Vinod writes:
      
      phy-for-5.13
      
        - Updates:
      	- Yaml conversion for mvebu-utmi binding, bcm-ns-usb2 and
      	  bcm-ns-usb3 bindings
      	- Mediatek dsi and hdmi phy updates
      	- TI j721e-wiz updates for AM64
      	- Cadence-torrent phy updates for SGMII/QSGMII
      
        - New support:
      	- usb3-dp phy for Qualcomm SM8250
      	- UTMI phy for Armada CP110
      	- USB phy for Qualcomm SC7280
      	- Binding and driver for Sparx5 ethernet serdes
      
      * tag 'phy-for-5.13' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy: (75 commits)
        phy: fix resource_size.cocci warnings
        phy: Sparx5 Eth SerDes: Use direct register operations
        phy: hisilicon: Use the correct HiSilicon copyright
        phy: marvell: phy-mvebu-cp11i-utmi needs USB_COMMON
        phy: qcom-qmp: add support for sm8250-usb3-dp phy
        phy: qcom-qmp: rename common registers
        phy: qcom-qmp: move DP functions to callbacks
        dt-bindings: phy: qcom,qmp-usb3-dp: Add support for SM8250
        dt-bindings: phy: qcom,qmp-usb3-dp-phy: move usb3 compatibles back to qcom,qmp-phy.yaml
        phy: ti: j721e-wiz: Configure 'p_standard_mode' only for DP/QSGMII
        dt-bindings: phy: fix dt_binding_check warning in mediatek, ufs-phy.yaml
        phy: zynqmp: Handle the clock enable/disable properly
        dt-bindings: phy: bcm-ns-usb3-phy: convert to yaml
        dt-bindings: phy: bcm-ns-usb2-phy: convert to yaml
        phy: microchip: PHY_SPARX5_SERDES should depend on ARCH_SPARX5
        phy: cadence-torrent: Add delay for PIPE clock to be stable
        phy: cadence-torrent: Explicitly request exclusive reset control
        phy: cadence-torrent: Do not configure SERDES if it's already configured
        phy: cadence-torrent: Group reset APIs and clock APIs
        phy: ti: j721e-wiz: Do not configure wiz if its already configured
        ...
      fbb0ad42
    • Greg Kroah-Hartman's avatar
      Merge tag 'soundwire-5.13-rc1' of... · 39b53e23
      Greg Kroah-Hartman authored
      Merge tag 'soundwire-5.13-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire into char-misc-next
      
      Vinod writes:
      
      soundwire updates for 5.13-rc1
      
      Updates for v5.13-rc1 are:
      
      Core:
       - Ability to add quirks for masters
       - static checker cleanup for bus code
      
      Drivers:
       - DMI quirks for Intel controllers
       - static checker cleanup for drivers
       - add auto enumeration support qcom controller
      
      * tag 'soundwire-5.13-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire: (45 commits)
        soundwire: intel_init: test link->cdns
        soundwire: qcom: handle return correctly in qcom_swrm_transport_params
        soundwire: qcom: cleanup internal port config indexing
        soundwire: qcom: wait for fifo space to be available before read/write
        soundwire: qcom: add static port map support
        soundwire: qcom: update port map allocation bit mask
        soundwire: add static port mapping support
        soundwire: stream: fix memory leak in stream config error path
        soundwire: qcom: use signed variable for error return
        soundwire: qcom: wait for enumeration to be complete in probe
        soundwire: qcom: add auto enumeration support
        soundwire: export sdw_compare_devid, sdw_extract_slave_id and sdw_slave_add
        soundwire: qcom: add support to new interrupts
        soundwire: qcom: update register read/write routine
        soundwire: qcom: start the clock during initialization
        soundwire: qcom: set continue execution flag for ignored commands
        soundwire: qcom: add support to missing transport params
        dt-bindings: soundwire: qcom: clarify data port bus parameters
        soundwire: cadence: only prepare attached devices on clock stop
        soundwire: generic_allocation: fix confusion between group and packing
        ...
      39b53e23
  2. 06 Apr, 2021 12 commits
  3. 05 Apr, 2021 7 commits
  4. 04 Apr, 2021 2 commits
    • Linus Torvalds's avatar
      Linux 5.12-rc6 · e49d033b
      Linus Torvalds authored
      e49d033b
    • Zheyu Ma's avatar
      firewire: nosy: Fix a use-after-free bug in nosy_ioctl() · 829933ef
      Zheyu Ma authored
      For each device, the nosy driver allocates a pcilynx structure.
      A use-after-free might happen in the following scenario:
      
       1. Open nosy device for the first time and call ioctl with command
          NOSY_IOC_START, then a new client A will be malloced and added to
          doubly linked list.
       2. Open nosy device for the second time and call ioctl with command
          NOSY_IOC_START, then a new client B will be malloced and added to
          doubly linked list.
       3. Call ioctl with command NOSY_IOC_START for client A, then client A
          will be readded to the doubly linked list. Now the doubly linked
          list is messed up.
       4. Close the first nosy device and nosy_release will be called. In
          nosy_release, client A will be unlinked and freed.
       5. Close the second nosy device, and client A will be referenced,
          resulting in UAF.
      
      The root cause of this bug is that the element in the doubly linked list
      is reentered into the list.
      
      Fix this bug by adding a check before inserting a client.  If a client
      is already in the linked list, don't insert it.
      
      The following KASAN report reveals it:
      
         BUG: KASAN: use-after-free in nosy_release+0x1ea/0x210
         Write of size 8 at addr ffff888102ad7360 by task poc
         CPU: 3 PID: 337 Comm: poc Not tainted 5.12.0-rc5+ #6
         Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
         Call Trace:
           nosy_release+0x1ea/0x210
           __fput+0x1e2/0x840
           task_work_run+0xe8/0x180
           exit_to_user_mode_prepare+0x114/0x120
           syscall_exit_to_user_mode+0x1d/0x40
           entry_SYSCALL_64_after_hwframe+0x44/0xae
      
         Allocated by task 337:
           nosy_open+0x154/0x4d0
           misc_open+0x2ec/0x410
           chrdev_open+0x20d/0x5a0
           do_dentry_open+0x40f/0xe80
           path_openat+0x1cf9/0x37b0
           do_filp_open+0x16d/0x390
           do_sys_openat2+0x11d/0x360
           __x64_sys_open+0xfd/0x1a0
           do_syscall_64+0x33/0x40
           entry_SYSCALL_64_after_hwframe+0x44/0xae
      
         Freed by task 337:
           kfree+0x8f/0x210
           nosy_release+0x158/0x210
           __fput+0x1e2/0x840
           task_work_run+0xe8/0x180
           exit_to_user_mode_prepare+0x114/0x120
           syscall_exit_to_user_mode+0x1d/0x40
           entry_SYSCALL_64_after_hwframe+0x44/0xae
      
         The buggy address belongs to the object at ffff888102ad7300 which belongs to the cache kmalloc-128 of size 128
         The buggy address is located 96 bytes inside of 128-byte region [ffff888102ad7300, ffff888102ad7380)
      
      [ Modified to use 'list_empty()' inside proper lock  - Linus ]
      
      Link: https://lore.kernel.org/lkml/1617433116-5930-1-git-send-email-zheyuma97@gmail.com/Reported-and-tested-by: default avatar马哲宇 (Zheyu Ma) <zheyuma97@gmail.com>
      Signed-off-by: default avatarZheyu Ma <zheyuma97@gmail.com>
      Cc: Greg Kroah-Hartman <greg@kroah.com>
      Cc: Stefan Richter <stefanr@s5r6.in-berlin.de>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      829933ef
  5. 03 Apr, 2021 14 commits
  6. 02 Apr, 2021 3 commits
    • Linus Torvalds's avatar
      Merge tag 'block-5.12-2021-04-02' of git://git.kernel.dk/linux-block · d93a0d43
      Linus Torvalds authored
      Pull block fixes from Jens Axboe:
      
       - Remove comment that never came to fruition in 22 years of development
         (Christoph)
      
       - Remove unused request flag (Christoph)
      
       - Fix for null_blk fake timeout handling (Damien)
      
       - Fix for IOCB_NOWAIT being ignored for O_DIRECT on raw bdevs (Pavel)
      
       - Error propagation fix for multiple split bios (Yufen)
      
      * tag 'block-5.12-2021-04-02' of git://git.kernel.dk/linux-block:
        block: remove the unused RQF_ALLOCED flag
        block: update a few comments in uapi/linux/blkpg.h
        block: don't ignore REQ_NOWAIT for direct IO
        null_blk: fix command timeout completion handling
        block: only update parent bi_status when bio fail
      d93a0d43
    • Linus Torvalds's avatar
      Merge tag 'io_uring-5.12-2021-04-02' of git://git.kernel.dk/linux-block · 1faccb63
      Linus Torvalds authored
      Pull io_uring fixes from Jens Axboe:
       "Nothing really major in here, and finally nothing really related to
        signals. A few minor fixups related to the threading changes, and some
        general fixes, that's it.
      
        There's the pending gdb-get-confused-about-arch, but that's more of a
        cosmetic issue, nothing that hinder use of it. And given that other
        archs will likely be affected by that oddity too, better to postpone
        any changes there until 5.13 imho"
      
      * tag 'io_uring-5.12-2021-04-02' of git://git.kernel.dk/linux-block:
        io_uring: move reissue into regular IO path
        io_uring: fix EIOCBQUEUED iter revert
        io_uring/io-wq: protect against sprintf overflow
        io_uring: don't mark S_ISBLK async work as unbounded
        io_uring: drop sqd lock before handling signals for SQPOLL
        io_uring: handle setup-failed ctx in kill_timeouts
        io_uring: always go for cancellation spin on exec
      1faccb63
    • Linus Torvalds's avatar
      Merge tag 'acpi-5.12-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · 0a84c2e4
      Linus Torvalds authored
      Pull ACPI fixes from Rafael Wysocki:
       "These fix an ACPI tables management issue, an issue related to the
        ACPI enumeration of devices and CPU wakeup in the ACPI processor
        driver.
      
        Specifics:
      
         - Ensure that the memory occupied by ACPI tables on x86 will always
           be reserved to prevent it from being allocated for other purposes
           which was possible in some cases (Rafael Wysocki).
      
         - Fix the ACPI device enumeration code to prevent it from attempting
           to evaluate the _STA control method for devices with unmet
           dependencies which is likely to fail (Hans de Goede).
      
         - Fix the handling of CPU0 wakeup in the ACPI processor driver to
           prevent CPU0 online failures from occurring (Vitaly Kuznetsov)"
      
      * tag 'acpi-5.12-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        ACPI: processor: Fix CPU0 wakeup in acpi_idle_play_dead()
        ACPI: scan: Fix _STA getting called on devices with unmet dependencies
        ACPI: tables: x86: Reserve memory occupied by ACPI tables
      0a84c2e4