summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2023-10-08Linux 6.6-rc5Linus Torvalds1-1/+1
2023-10-08Merge tag '6.6-rc4-ksmbd-server-fixes' of git://git.samba.org/ksmbdLinus Torvalds10-45/+151
Pull smb server fixes from Steve French: "Six SMB3 server fixes for various races found by RO0T Lab of Huawei: - Fix oops when racing between oplock break ack and freeing file - Simultaneous request fixes for parallel logoffs, and for parallel lock requests - Fixes for tree disconnect race, session expire race, and close/open race" * tag '6.6-rc4-ksmbd-server-fixes' of git://git.samba.org/ksmbd: ksmbd: fix race condition between tree conn lookup and disconnect ksmbd: fix race condition from parallel smb2 lock requests ksmbd: fix race condition from parallel smb2 logoff requests ksmbd: fix uaf in smb20_oplock_break_ack ksmbd: fix race condition with fp ksmbd: fix race condition between session lookup and expire
2023-10-08Merge tag 'sched-urgent-2023-10-08' of ↵Linus Torvalds2-4/+15
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull misc scheduler fixes from Ingo Molnar: - Two EEVDF fixes: one to fix sysctl_sched_base_slice propagation, and to fix an avg_vruntime() corner-case. - A cpufreq frequency scaling fix * tag 'sched-urgent-2023-10-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: cpufreq: schedutil: Update next_freq when cpufreq_limits change sched/eevdf: Fix avg_vruntime() sched/eevdf: Also update slice on placement
2023-10-08Merge tag 'x86-urgent-2023-10-08' of ↵Linus Torvalds2-16/+56
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull misc x86 fixes from Ingo Molnar: - Fix SEV-SNP guest crashes that may happen on NMIs - Fix a potential SEV platform memory setup overflow * tag 'x86-urgent-2023-10-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/sev: Change npages to unsigned long in snp_accept_memory() x86/sev: Use the GHCB protocol when available for SNP CPUID requests
2023-10-07Merge tag 'parisc-for-6.6-rc5' of ↵Linus Torvalds3-23/+23
git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc fixes from Helge Deller: - fix random faults in mmap'd memory on pre PA8800 processors - fix boot crash with nr_cpus=1 on kernel command line * tag 'parisc-for-6.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: Restore __ldcw_align for PA-RISC 2.0 processors parisc: Fix crash with nr_cpus=1 option
2023-10-07parisc: Restore __ldcw_align for PA-RISC 2.0 processorsJohn David Anglin2-22/+20
Back in 2005, Kyle McMartin removed the 16-byte alignment for ldcw semaphores on PA 2.0 machines (CONFIG_PA20). This broke spinlocks on pre PA8800 processors. The main symptom was random faults in mmap'd memory (e.g., gcc compilations, etc). Unfortunately, the errata for this ldcw change is lost. The issue is the 16-byte alignment required for ldcw semaphore instructions can only be reduced to natural alignment when the ldcw operation can be handled coherently in cache. Only PA8800 and PA8900 processors actually support doing the operation in cache. Aligning the spinlock dynamically adds two integer instructions to each spinlock. Tested on rp3440, c8000 and a500. Signed-off-by: John David Anglin <dave.anglin@bell.net> Link: https://lore.kernel.org/linux-parisc/6b332788-2227-127f-ba6d-55e99ecf4ed8@bell.net/T/#t Link: https://lore.kernel.org/linux-parisc/20050609050702.GB4641@roadwarrior.mcmartin.ca/ Cc: stable@vger.kernel.org Signed-off-by: Helge Deller <deller@gmx.de>
2023-10-07parisc: Fix crash with nr_cpus=1 optionHelge Deller1-1/+3
John David Anglin reported that giving "nr_cpus=1" on the command line causes a crash, while "maxcpus=1" works. Reported-by: John David Anglin <dave.anglin@bell.net> Signed-off-by: Helge Deller <deller@gmx.de> Cc: stable@vger.kernel.org # v5.18+
2023-10-07Merge tag '6.6-rc4-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6Linus Torvalds1-13/+13
Pull smb client fixes from Steve French: - protect cifs/smb3 socket connect from BPF address overwrite - fix case when directory leases disabled but wasting resources with unneeded thread on each mount * tag '6.6-rc4-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: smb: client: do not start laundromat thread on nohandlecache smb: use kernel_connect() and kernel_bind()
2023-10-07Merge tag 'xfs-6.6-fixes-3' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linuxLinus Torvalds6-117/+311
Pull xfs fixes from Chandan Babu: - Prevent filesystem hang when executing fstrim operations on large and slow storage * tag 'xfs-6.6-fixes-3' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: abort fstrim if kernel is suspending xfs: reduce AGF hold times during fstrim operations xfs: move log discard work to xfs_discard.c
2023-10-07Merge tag 'for-6.6/dm-fixes-2' of ↵Linus Torvalds2-10/+9
git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper fixes from Mike Snitzer: - Fix memory leak when freeing dm zoned target device - Update dm-devel mailing list address in MAINTAINERS * tag 'for-6.6/dm-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: MAINTAINERS: update the dm-devel mailing list dm zoned: free dmz->ddev array in dmz_put_zoned_devices
2023-10-07Merge tag 'media/v6.6-3' of ↵Linus Torvalds7-36/+30
git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fixes from Mauro Carvalho Chehab: - two Kconfig build fixes under randconfig - pxa_camera: Fix an error handling path - mediatek: vcodec: Fix a NULL-access pointer - tegra-video: fix an infinite recursion regression * tag 'media/v6.6-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: media: mediatek: vcodec: Fix encoder access NULL pointer staging: media: tegra-video: fix infinite recursion regression media: pci: intel: ivsc: select V4L2_FWNODE media: ipu-bridge: Fix Kconfig dependencies media: pxa_camera: Fix an error handling path in pxa_camera_probe()
2023-10-07Merge tag 'devicetree-fixes-for-6.6-2' of ↵Linus Torvalds13-100/+90
git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree fixes from Rob Herring: - Fix potential memory leak in of_changeset_action() - Fix some i.MX binding warnings - Fix typo in renesas,vin binding field-even-active property - Fix andestech,ax45mp-cache example unit-address - Add missing additionalProperties on RiscV CPU interrupt-controller node - Add missing unevaluatedProperties on media bindings - Fix brcm,iproc-pcie binding 'msi' child node schema - Fix MEMSIC MXC4005 compatible string * tag 'devicetree-fixes-for-6.6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: dt-bindings: trivial-devices: Fix MEMSIC MXC4005 compatible string dt-bindings: PCI: brcm,iproc-pcie: Fix 'msi' child node schema dt-bindings: PCI: brcm,iproc-pcie: Drop common pci-bus properties dt-bindings: PCI: brcm,iproc-pcie: Fix example indentation media: dt-bindings: Add missing unevaluatedProperties on child node schemas dt-bindings: bus: fsl,imx8qxp-pixel-link-msi-bus: Drop child 'reg' property media: dt-bindings: imx7-csi: Make power-domains not required for imx8mq dt-bindings: media: renesas,vin: Fix field-even-active spelling dt-bindings: cache: andestech,ax45mp-cache: Fix unit address in example of: overlay: Reorder struct fragment fields kerneldoc dt-bindings: display: fsl,imx6-hdmi: Change to 'unevaluatedProperties: false' dt-bindings: riscv: cpus: Add missing additionalProperties on interrupt-controller node of: dynamic: Fix potential memory leak in of_changeset_action()
2023-10-07Merge tag 'gpio-fixes-for-v6.6-rc5' of ↵Linus Torvalds2-1/+2
git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: "Another round of driver one-liners from the GPIO subsystem: - disable pin control on MMP GPIOs in gpio-pxa - fix the GPIO number passed to one of the pinctrl callbacks in gpio-aspeed" * tag 'gpio-fixes-for-v6.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: aspeed: fix the GPIO number passed to pinctrl_gpio_set_config() gpio: pxa: disable pinctrl calls for MMP_GPIO
2023-10-07Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdmaLinus Torvalds14-30/+54
Pull rdma fixes from Jason Gunthorpe: "This includes a fix for a significant security miss in checking the RDMA_NLDEV_CMD_SYS_SET operation. Summary: - UAF in SRP - Error unwind failure in siw connection management - Missing error checks - NULL/ERR_PTR confusion in erdma - Possible string truncation in CMA configfs and mlx4 - Data ordering issue in bnxt_re - Missing stats decrement on object destroy in bnxt_re - Mlx5 bugs in this merge window: * Incorrect access_flag in the new mkey cache * Missing unlock on error in flow steering * lockdep possible deadlock on new mkey cache destruction (Plus a fix for this too) - Don't leak kernel stack memory to userspace in the CM - Missing permission validation for RDMA_NLDEV_CMD_SYS_SET" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: RDMA/core: Require admin capabilities to set system parameters RDMA/mlx5: Remove not-used cache disable flag RDMA/cma: Initialize ib_sa_multicast structure to 0 when join RDMA/mlx5: Fix mkey cache possible deadlock on cleanup RDMA/mlx5: Fix NULL string error RDMA/mlx5: Fix mutex unlocking on error flow for steering anchor creation RDMA/mlx5: Fix assigning access flags to cache mkeys IB/mlx4: Fix the size of a buffer in add_port_entries() RDMA/bnxt_re: Decrement resource stats correctly RDMA/bnxt_re: Fix the handling of control path response data RDMA/cma: Fix truncation compilation warning in make_cma_ports RDMA/erdma: Fix NULL pointer access in regmr_cmd RDMA/erdma: Fix error code in erdma_create_scatter_mtt() RDMA/uverbs: Fix typo of sizeof argument RDMA/cxgb4: Check skb value for failure to allocate RDMA/siw: Fix connection failure handling RDMA/srp: Do not call scsi_done() from srp_abort()
2023-10-07MAINTAINERS: Remove myself from the general IRQ subsystem maintenanceMarc Zyngier1-2/+1
It is pretty obvious that I haven't done much on the IRQ side for a while, and it is unlikely that I'll have more bandwidth for it any time soon. People keep sending me patches that I end-up reviewing in a cursory manner, which isn't great for anyone. So in everyone's interest, I'm removing myself from the list of maintainers and leave the irqchip and irqdomain subsystems in Thomas' capable hands. Signed-off-by: Marc Zyngier <maz@kernel.org> Link: https://lore.kernel.org/r/20231002141302.3409485-3-maz@kernel.org
2023-10-07MAINTAINERS: Add myself as the ARM GIC maintainerMarc Zyngier1-0/+11
The ARM GIC maintenance is currently covered by the blanket IRQCHIP DRIVERS entry, which I'm about to remove myself from. It is unlikely that anyone is mad enough to pick this up, so I'll keep doing that for the foreseable future. Signed-off-by: Marc Zyngier <maz@kernel.org> Reviewed-by: Zenghui Yu <zenghui.yu@linux.dev> Link: https://lore.kernel.org/r/20231002141302.3409485-2-maz@kernel.org
2023-10-07irqchip/renesas-rzg2l: Convert to irq_data_get_irq_chip_data()Geert Uytterhoeven1-1/+1
Use the existing irq_data_get_irq_chip_data() helper instead of open-coding the same operation. Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Signed-off-by: Marc Zyngier <maz@kernel.org> Link: https://lore.kernel.org/r/8e47cc6400e5a82c854c855948d2665a3a3197e3.1695819391.git.geert+renesas@glider.be
2023-10-07irqchip/stm32-exti: add missing DT IRQ flag translationBen Wolsieffer1-0/+1
The STM32F4/7 EXTI driver was missing the xlate callback, so IRQ trigger flags specified in the device tree were being ignored. This was preventing the RTC alarm interrupt from working, because it must be set to trigger on the rising edge to function correctly. Signed-off-by: Ben Wolsieffer <ben.wolsieffer@hefring.com> Signed-off-by: Marc Zyngier <maz@kernel.org> Link: https://lore.kernel.org/r/20231003162003.1649967-1-ben.wolsieffer@hefring.com
2023-10-07irqchip/riscv-intc: Mark all INTC nodes as initializedAnup Patel1-1/+9
The RISC-V INTC local interrupts are per-HART (or per-CPU) so we create INTC IRQ domain only for the INTC node belonging to the boot HART. This means only the boot HART INTC node will be marked as initialized and other INTC nodes won't be marked which results downstream interrupt controllers (such as PLIC, IMSIC and APLIC direct-mode) not being probed due to missing device suppliers. To address this issue, we mark all INTC node for which we don't create IRQ domain as initialized. Reported-by: Dmitry Dunaev <dunaev@tecon.ru> Signed-off-by: Anup Patel <apatel@ventanamicro.com> Signed-off-by: Marc Zyngier <maz@kernel.org> Link: https://lore.kernel.org/r/20230926102801.1591126-1-dunaev@tecon.ru Link: https://lore.kernel.org/r/20231003044403.1974628-4-apatel@ventanamicro.com
2023-10-07irqchip/gic-v3: Enable non-coherent redistributors/ITSes DT probingLorenzo Pieralisi3-4/+34
The GIC architecture specification defines a set of registers for redistributors and ITSes that control the sharebility and cacheability attributes of redistributors/ITSes initiator ports on the interconnect (GICR_[V]PROPBASER, GICR_[V]PENDBASER, GITS_BASER<n>). Architecturally the GIC provides a means to drive shareability and cacheability attributes signals and related IWB/OWB/ISH barriers but it is not mandatory for designs to wire up the corresponding interconnect signals that control the cacheability/shareability of transactions. Redistributors and ITSes interconnect ports can be connected to non-coherent interconnects that are not able to manage the shareability/cacheability attributes; this implicitly makes the redistributors and ITSes non-coherent observers. So far, the GIC driver on probe executes a write to "probe" for the redistributors and ITSes registers shareability bitfields by writing a value (ie InnerShareable - the shareability domain the CPUs are in) and check it back to detect whether the value sticks or not; this hinges on a GIC programming model behaviour that predates the current specifications, that just define shareability bits as writeable but do not guarantee that writing certain shareability values enable the expected behaviour for the redistributors/ITSes memory interconnect ports. To enable non-coherent GIC designs, introduce the "dma-noncoherent" device tree property to allow firmware to describe redistributors and ITSes as non-coherent observers on the memory interconnect and use the property to force the shareability attributes to be programmed into the redistributors and ITSes registers through the GIC quirks mechanism. Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org> Cc: Robin Murphy <robin.murphy@arm.com> Cc: Mark Rutland <mark.rutland@arm.com> Cc: Marc Zyngier <maz@kernel.org> Signed-off-by: Marc Zyngier <maz@kernel.org> Link: https://lore.kernel.org/r/20231006125929.48591-3-lpieralisi@kernel.org
2023-10-07irqchip/gic-v3-its: Split allocation from initialisation of its_nodeMarc Zyngier1-60/+89
In order to pave the way for more fancy quirk handling without making more of a mess of this terrible driver, split the allocation of the ITS descriptor (its_node) from the actual probing. This will allow firmware-specific hooks to be added between these two points. Signed-off-by: Marc Zyngier <maz@kernel.org> Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org> Signed-off-by: Marc Zyngier <maz@kernel.org> Link: https://lore.kernel.org/r/20231006125929.48591-4-lpieralisi@kernel.org
2023-10-07dt-bindings: interrupt-controller: arm,gic-v3: Add dma-noncoherent propertyLorenzo Pieralisi1-0/+12
The GIC v3 specifications allow redistributors and ITSes interconnect ports used to access memory to be wired up in a way that makes the respective initiators/memory observers non-coherent. Add the standard dma-noncoherent property to the GICv3 bindings to allow firmware to describe the redistributors/ITSes components and interconnect ports behaviour in system designs where the redistributors and ITSes are not coherent with the CPU. Reviewed-by: Rob Herring <robh@kernel.org> Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org> Cc: Rob Herring <robh@kernel.org> Signed-off-by: Marc Zyngier <maz@kernel.org> Link: https://lore.kernel.org/r/20231006125929.48591-2-lpieralisi@kernel.org
2023-10-07dt-bindings: interrupt-controller: renesas,irqc: Add r8a779f0 supportGeert Uytterhoeven1-0/+1
Document support for the Interrupt Controller for External Devices (INT-EX) in the Renesas R-Car S4-8 (R8A779F0) SoC. Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com> Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com> Acked-by: Conor Dooley <conor.dooley@microchip.com> Signed-off-by: Marc Zyngier <maz@kernel.org> Link: https://lore.kernel.org/r/9467a1c67d5d240211f88336973fa968d39cc860.1690446928.git.geert+renesas@glider.be
2023-10-07dt-bindings: interrupt-controller: renesas,rzg2l-irqc: Document RZ/G2UL SoCLad Prabhakar1-55/+170
Document RZ/G2UL (R9A07G043U) IRQC bindings. The IRQC block on RZ/G2UL SoC is almost identical to one found on the RZ/G2L SoC the only difference being it can support BUS_ERR_INT for which it has additional registers. Hence new generic compatible string "renesas,r9a07g043u-irqc" is added for RZ/G2UL SoC. Now that we have additional interrupt for RZ/G2UL and RZ/Five SoC interrupt-names property is added so that we can parse them based on names. While at it updated the example node to four spaces and added interrupt-names property. Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Reviewed-by: Rob Herring <robh@kernel.org> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: Marc Zyngier <maz@kernel.org> Link: https://lore.kernel.org/r/20231006121058.13890-1-prabhakar.mahadev-lad.rj@bp.renesas.com
2023-10-07MAINTAINERS: update the dm-devel mailing listMike Snitzer1-2/+2
dm-devel@redhat.com has migrated to dm-devel@lists.linux.dev Signed-off-by: Mike Snitzer <snitzer@kernel.org>
2023-10-07Merge tag 'pm-6.6-rc5' of ↵Linus Torvalds1-2/+2
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fix from Rafael Wysocki: "Fix a recently introduced hibernation crash (Pavankumar Kondeti)" * tag 'pm-6.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: PM: hibernate: Fix copying the zero bitmap to safe pages
2023-10-07Merge tag 'block-6.6-2023-10-06' of git://git.kernel.dk/linuxLinus Torvalds2-1/+9
Pull block fixes from Jens Axboe: "Just two minor fixes, for nbd and md" * tag 'block-6.6-2023-10-06' of git://git.kernel.dk/linux: nbd: don't call blk_mark_disk_dead nbd_clear_sock_ioctl md/raid5: release batch_last before waiting for another stripe_head
2023-10-07Merge tag 'io_uring-6.6-2023-10-06' of git://git.kernel.dk/linuxLinus Torvalds4-29/+65
Pull io_uring fixes from Jens Axboe: - syzbot report on a crash on 32-bit arm with highmem, and went digging to check for potentially similar issues and found one more (me) - Fix a syzbot report with PROVE_LOCKING=y and setting up the ring in a disabled state (me) - Fix for race with CPU hotplut and io-wq init (Jeff) * tag 'io_uring-6.6-2023-10-06' of git://git.kernel.dk/linux: io-wq: fully initialize wqe before calling cpuhp_state_add_instance_nocalls() io_uring: don't allow IORING_SETUP_NO_MMAP rings on highmem pages io_uring: ensure io_lockdep_assert_cq_locked() handles disabled rings io_uring/kbuf: don't allow registered buffer rings on highmem pages
2023-10-06dt-bindings: trivial-devices: Fix MEMSIC MXC4005 compatible stringLuca Ceresoli1-1/+1
The correct name of this chip is MXC4005, not MX4005. This is confirmed both by the manufacturer website and by the title of the original commit, which added other MXCxxxx devices as well but only this one misses a "c" in the compatible string. Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Fixes: d9bf5d37fd58 ("dt-bindings:trivial-devices: Add memsic,mxc4005/mxc6255/mxc6655 entries") Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Link: https://lore.kernel.org/r/20231004-mxc4005-device-tree-support-v1-1-e7c0faea72e4@bootlin.com Signed-off-by: Rob Herring <robh@kernel.org>
2023-10-06dt-bindings: PCI: brcm,iproc-pcie: Fix 'msi' child node schemaRob Herring1-8/+16
The 'msi' child node schema is missing constraints on additional properties. It turns out it is incomplete and properties for it are documented in the parent node by mistake. Move the reference to msi-controller.yaml and the custom properties to the 'msi' node. Adding 'unevaluatedProperties' ensures all the properties in the 'msi' node are documented. With the schema corrected, a minimal interrupt controller node is needed to properly decode the interrupt properties since the example has multiple interrupt parents. Acked-by: Conor Dooley <conor.dooley@microchip.com> Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com> Fixes: 905b986d099c ("dt-bindings: pci: Convert iProc PCIe to YAML") Link: https://lore.kernel.org/r/20230926155613.33904-3-robh@kernel.org Signed-off-by: Rob Herring <robh@kernel.org>
2023-10-06dt-bindings: PCI: brcm,iproc-pcie: Drop common pci-bus propertiesRob Herring1-15/+0
Drop the unnecessary listing of properties already defined in pci-bus.yaml. Unless there are additional constraints, it is not necessary. Acked-by: Conor Dooley <conor.dooley@microchip.com> Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com> Link: https://lore.kernel.org/r/20230926155351.31117-2-robh@kernel.org Signed-off-by: Rob Herring <robh@kernel.org>
2023-10-06dt-bindings: PCI: brcm,iproc-pcie: Fix example indentationRob Herring1-64/+60
The example's indentation is off. While fixing this, the 'bus' node is unnecessary and can be dropped. It is also preferred to split up unrelated examples to their own entries. Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com> Acked-by: Conor Dooley <conor.dooley@microchip.com> Link: https://lore.kernel.org/r/20230926155351.31117-1-robh@kernel.org Signed-off-by: Rob Herring <robh@kernel.org>
2023-10-06media: dt-bindings: Add missing unevaluatedProperties on child node schemasRob Herring3-0/+4
Just as unevaluatedProperties or additionalProperties are required at the top level of schemas, they should (and will) also be required for child node schemas. That ensures only documented properties are present for any node. Acked-by: Conor Dooley <conor.dooley@microchip.com> Link: https://lore.kernel.org/r/20230925212803.1976803-1-robh@kernel.org Signed-off-by: Rob Herring <robh@kernel.org>
2023-10-06dt-bindings: bus: fsl,imx8qxp-pixel-link-msi-bus: Drop child 'reg' propertyRob Herring1-3/+0
A bus schema based on simple-pm-bus shouldn't define how many 'reg' entries a child device has. That is a property of the device. Drop the 'reg' entry. Reviewed-by: Liu Ying <victor.liu@nxp.com> Acked-by: Conor Dooley <conor.dooley@microchip.com> Link: https://lore.kernel.org/r/20230925212639.1975002-1-robh@kernel.org Signed-off-by: Rob Herring <robh@kernel.org>
2023-10-06media: dt-bindings: imx7-csi: Make power-domains not required for imx8mqFabio Estevam1-1/+0
On i.MX8MQ the MIPI CSI block does have an associated power-domain, but the CSI bridge does not. Remove the power-domains requirement from the i.MX8MQ CSI bridge to fix the following schema warning: imx8mq-librem5-r4.dtb: csi@30a90000: 'power-domains' is a required property from schema $id: http://devicetree.org/schemas/media/nxp,imx7-csi.yaml# Fixes: de655386845a ("media: dt-bindings: media: imx7-csi: Document i.MX8M power-domains property") Signed-off-by: Fabio Estevam <festevam@denx.de> Acked-by: Conor Dooley <conor.dooley@microchip.com> Reviewed-by: Marek Vasut <marex@denx.de> Link: https://lore.kernel.org/r/20231004201105.2323758-1-festevam@gmail.com Signed-off-by: Rob Herring <robh@kernel.org>
2023-10-06Merge tag 'pci-v6.6-fixes-2' of ↵Linus Torvalds4-19/+43
git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull PCI fixes from Bjorn Helgaas: - Fix a qcom register offset that broke IPQ8074 PCIe controller enumeration (Sricharan Ramabadhran) - Handle interrupt parsing failures when creating a device tree node to avoid using uninitialized data (Lizhi Hou) - Clean up if adding PCI device node fails when creating a device tree node to avoid a memory leak (Lizhi Hou) - If a link is down, mark all downstream devices as "disconnected" so we don't wait for them on resume (Mika Westerberg) * tag 'pci-v6.6-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: PCI/PM: Mark devices disconnected if upstream PCIe link is down on resume PCI: of: Destroy changeset when adding PCI device node fails PCI: of_property: Handle interrupt parsing failures PCI: qcom: Fix IPQ8074 enumeration
2023-10-06Merge tag 'platform-drivers-x86-v6.6-4' of ↵Linus Torvalds6-18/+94
git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver fixes from Hans de Goede: "Bug fixes, build warning fixes and DMI quirk additions" * tag 'platform-drivers-x86-v6.6-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: platform/x86: hp-wmi:: Mark driver struct with __refdata to prevent section mismatch warning platform/x86: touchscreen_dmi: Add info for the Positivo C4128B platform/x86: touchscreen_dmi: Add info for the BUSH Bush Windows tablet platform/mellanox: tmfifo: fix kernel-doc warnings platform/x86/intel/ifs: release cpus_read_lock() platform/x86: hp-bioscfg: Fix reference leak platform/x86: think-lmi: Fix reference leak
2023-10-06Merge tag 'for-6.6-rc4-tag' of ↵Linus Torvalds4-17/+47
git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - reject unknown mount options - adjust transaction abort error message level - fix one more build warning with -Wmaybe-uninitialized - proper error handling in several COW-related cases * tag 'for-6.6-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: error out when reallocating block for defrag using a stale transaction btrfs: error when COWing block from a root that is being deleted btrfs: error out when COWing block using a stale transaction btrfs: always print transaction aborted messages with an error level btrfs: reject unknown mount options early btrfs: fix some -Wmaybe-uninitialized warnings in ioctl.c
2023-10-06Merge tag 'arm64-fixes' of ↵Linus Torvalds10-3/+60
git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: "A typo fix for a PMU driver, a workround for a side-channel erratum on Cortex-A520 and a fix for the local timer save/restore when using ACPI with Qualcomm's custom CPUs: - Workaround for Cortex-A520 erratum #2966298 - Fix typo in Arm CMN PMU driver that breaks counter overflow handling - Fix timer handling across idle for Qualcomm custom CPUs" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: cpuidle, ACPI: Evaluate LPI arch_flags for broadcast timer arm64: errata: Add Cortex-A520 speculative unprivileged load workaround arm64: Add Cortex-A520 CPU part definition perf/arm-cmn: Fix the unhandled overflow status of counter 4 to 7
2023-10-06Merge tag 'drm-fixes-2023-10-06' of git://anongit.freedesktop.org/drm/drmLinus Torvalds17-39/+120
Pull drm fixes from Dave Airlie: "Regular weekly pull, all seems pretty normal, i915 and amdgpu mostly. There is one small new uAPI addition for nouveau but getting it in now avoids a bunch of userspace dances, and it's for a userspace that hasn't yet released, so should have no side effects. i915: - Fix for OpenGL CTS regression on Compute Shaders - Fix for default engines initialization - Fix TLB invalidation for Multi-GT devices amdgpu: - Add missing unique_id for GC 11.0.3 - Fix memory leak in FRU error path - Fix PCIe link reporting on some SMU 11 parts - Fix ACPI _PR3 detection - Fix DISPCLK WDIVIDER handling in OTG code tests: - Fix kunit release panel: - panel-orientation: Add quirk for One Mix 25 nouveau: - Report IB limit via getparams - Replace some magic numbers with constants - small clean up" * tag 'drm-fixes-2023-10-06' of git://anongit.freedesktop.org/drm/drm: drm/amd/display: apply edge-case DISPCLK WDIVIDER changes to master OTG pipes only drm/amd: Fix detection of _PR3 on the PCIe root port drm/amd: Fix logic error in sienna_cichlid_update_pcie_parameters() drm/amdgpu: Fix a memory leak drm/amd/pm: add unique_id for gc 11.0.3 drm/i915: Invalidate the TLBs on each GT drm/i915: Register engines early to avoid type confusion drm/i915: Don't set PIPE_CONTROL_FLUSH_L3 for aux inval drm/nouveau: exec: report max pushs through getparam drm/nouveau: chan: use channel class definitions drm/nouveau: chan: use struct nvif_mclass drm: panel-orientation-quirks: Add quirk for One Mix 2S drm/tests: Fix kunit_release_action ctx argument
2023-10-06HID: logitech-hidpp: Fix kernel crash on receiver USB disconnectHans de Goede1-1/+2
hidpp_connect_event() has *four* time-of-check vs time-of-use (TOCTOU) races when it races with itself. hidpp_connect_event() primarily runs from a workqueue but it also runs on probe() and if a "device-connected" packet is received by the hw when the thread running hidpp_connect_event() from probe() is waiting on the hw, then a second thread running hidpp_connect_event() will be started from the workqueue. This opens the following races (note the below code is simplified): 1. Retrieving + printing the protocol (harmless race): if (!hidpp->protocol_major) { hidpp_root_get_protocol_version() hidpp->protocol_major = response.rap.params[0]; } We can actually see this race hit in the dmesg in the abrt output attached to rhbz#2227968: [ 3064.624215] logitech-hidpp-device 0003:046D:4071.0049: HID++ 4.5 device connected. [ 3064.658184] logitech-hidpp-device 0003:046D:4071.0049: HID++ 4.5 device connected. Testing with extra logging added has shown that after this the 2 threads take turn grabbing the hw access mutex (send_mutex) so they ping-pong through all the other TOCTOU cases managing to hit all of them: 2. Updating the name to the HIDPP name (harmless race): if (hidpp->name == hdev->name) { ... hidpp->name = new_name; } 3. Initializing the power_supply class for the battery (problematic!): hidpp_initialize_battery() { if (hidpp->battery.ps) return 0; probe_battery(); /* Blocks, threads take turns executing this */ hidpp->battery.desc.properties = devm_kmemdup(dev, hidpp_battery_props, cnt, GFP_KERNEL); hidpp->battery.ps = devm_power_supply_register(&hidpp->hid_dev->dev, &hidpp->battery.desc, cfg); } 4. Creating delayed input_device (potentially problematic): if (hidpp->delayed_input) return; hidpp->delayed_input = hidpp_allocate_input(hdev); The really big problem here is 3. Hitting the race leads to the following sequence: hidpp->battery.desc.properties = devm_kmemdup(dev, hidpp_battery_props, cnt, GFP_KERNEL); hidpp->battery.ps = devm_power_supply_register(&hidpp->hid_dev->dev, &hidpp->battery.desc, cfg); ... hidpp->battery.desc.properties = devm_kmemdup(dev, hidpp_battery_props, cnt, GFP_KERNEL); hidpp->battery.ps = devm_power_supply_register(&hidpp->hid_dev->dev, &hidpp->battery.desc, cfg); So now we have registered 2 power supplies for the same battery, which looks a bit weird from userspace's pov but this is not even the really big problem. Notice how: 1. This is all devm-maganaged 2. The hidpp->battery.desc struct is shared between the 2 power supplies 3. hidpp->battery.desc.properties points to the result from the second devm_kmemdup() This causes a use after free scenario on USB disconnect of the receiver: 1. The last registered power supply class device gets unregistered 2. The memory from the last devm_kmemdup() call gets freed, hidpp->battery.desc.properties now points to freed memory 3. The first registered power supply class device gets unregistered, this involves sending a remove uevent to userspace which invokes power_supply_uevent() to fill the uevent data 4. power_supply_uevent() uses hidpp->battery.desc.properties which now points to freed memory leading to backtraces like this one: Sep 22 20:01:35 eric kernel: BUG: unable to handle page fault for address: ffffb2140e017f08 ... Sep 22 20:01:35 eric kernel: Workqueue: usb_hub_wq hub_event Sep 22 20:01:35 eric kernel: RIP: 0010:power_supply_uevent+0xee/0x1d0 ... Sep 22 20:01:35 eric kernel: ? asm_exc_page_fault+0x26/0x30 Sep 22 20:01:35 eric kernel: ? power_supply_uevent+0xee/0x1d0 Sep 22 20:01:35 eric kernel: ? power_supply_uevent+0x10d/0x1d0 Sep 22 20:01:35 eric kernel: dev_uevent+0x10f/0x2d0 Sep 22 20:01:35 eric kernel: kobject_uevent_env+0x291/0x680 Sep 22 20:01:35 eric kernel: power_supply_unregister+0x8e/0xa0 Sep 22 20:01:35 eric kernel: release_nodes+0x3d/0xb0 Sep 22 20:01:35 eric kernel: devres_release_group+0xfc/0x130 Sep 22 20:01:35 eric kernel: hid_device_remove+0x56/0xa0 Sep 22 20:01:35 eric kernel: device_release_driver_internal+0x19f/0x200 Sep 22 20:01:35 eric kernel: bus_remove_device+0xc6/0x130 Sep 22 20:01:35 eric kernel: device_del+0x15c/0x3f0 Sep 22 20:01:35 eric kernel: ? __queue_work+0x1df/0x440 Sep 22 20:01:35 eric kernel: hid_destroy_device+0x4b/0x60 Sep 22 20:01:35 eric kernel: logi_dj_remove+0x9a/0x100 [hid_logitech_dj 5c91534a0ead2b65e04dd799a0437e3b99b21bc4] Sep 22 20:01:35 eric kernel: hid_device_remove+0x44/0xa0 Sep 22 20:01:35 eric kernel: device_release_driver_internal+0x19f/0x200 Sep 22 20:01:35 eric kernel: bus_remove_device+0xc6/0x130 Sep 22 20:01:35 eric kernel: device_del+0x15c/0x3f0 Sep 22 20:01:35 eric kernel: ? __queue_work+0x1df/0x440 Sep 22 20:01:35 eric kernel: hid_destroy_device+0x4b/0x60 Sep 22 20:01:35 eric kernel: usbhid_disconnect+0x47/0x60 [usbhid 727dcc1c0b94e6b4418727a468398ac3bca492f3] Sep 22 20:01:35 eric kernel: usb_unbind_interface+0x90/0x270 Sep 22 20:01:35 eric kernel: device_release_driver_internal+0x19f/0x200 Sep 22 20:01:35 eric kernel: bus_remove_device+0xc6/0x130 Sep 22 20:01:35 eric kernel: device_del+0x15c/0x3f0 Sep 22 20:01:35 eric kernel: ? kobject_put+0xa0/0x1d0 Sep 22 20:01:35 eric kernel: usb_disable_device+0xcd/0x1e0 Sep 22 20:01:35 eric kernel: usb_disconnect+0xde/0x2c0 Sep 22 20:01:35 eric kernel: usb_disconnect+0xc3/0x2c0 Sep 22 20:01:35 eric kernel: hub_event+0xe80/0x1c10 There have been quite a few bug reports (see Link tags) about this crash. Fix all the TOCTOU issues, including the really bad power-supply related system crash on USB disconnect, by making probe() use the workqueue for running hidpp_connect_event() too, so that it can never run more then once. Link: https://bugzilla.redhat.com/show_bug.cgi?id=2227221 Link: https://bugzilla.redhat.com/show_bug.cgi?id=2227968 Link: https://bugzilla.redhat.com/show_bug.cgi?id=2227968 Link: https://bugzilla.redhat.com/show_bug.cgi?id=2242189 Link: https://bugzilla.kernel.org/show_bug.cgi?id=217412#c58 Cc: stable@vger.kernel.org Signed-off-by: Hans de Goede <hdegoede@redhat.com> Link: https://lore.kernel.org/r/20231005182638.3776-1-hdegoede@redhat.com Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
2023-10-06platform/x86: hp-wmi:: Mark driver struct with __refdata to prevent section ↵Uwe Kleine-König1-1/+7
mismatch warning As described in the added code comment, a reference to .exit.text is ok for drivers registered via module_platform_driver_probe(). Make this explicit to prevent a section mismatch warning: WARNING: modpost: drivers/platform/x86/hp/hp-wmi: section mismatch in reference: hp_wmi_driver+0x8 (section: .data) -> hp_wmi_bios_remove (section: .exit.text) Fixes: c165b80cfecc ("hp-wmi: fix handling of platform device") Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Link: https://lore.kernel.org/r/20231004111624.2667753-1-u.kleine-koenig@pengutronix.de Reviewed-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Hans de Goede <hdegoede@redhat.com>
2023-10-06Merge tag 'asoc-fix-v6.6-rc5' of ↵Takashi Iwai7-15/+40
https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: More fixes for v6.6 Some additional fixes for v6.6, some fairly unremarkable driver specific ones and a couple of minor core fixes for error handling and improved logging.
2023-10-06ALSA: hda/realtek: Change model for Intel RVP boardKailang Yang1-2/+2
Intel RVP board (0x12cc) has Headset Mic issue for reboot. If system plugged headset when system reboot the headset Mic was gone. Fixes: 1a93f10c5b12 ("ALSA: hda/realtek: Add "Intel Reference board" and "NUC 13" SSID in the ALC256") Signed-off-by: Kailang Yang <kailang@realtek.com> Link: https://lore.kernel.org/r/28112f54c0c6496f97ac845645bc0256@realtek.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2023-10-06ALSA: usb-audio: Fix microphone sound on Opencomm2 HeadsetWhaleChang1-1/+5
When a Opencomm2 Headset is connected to a Bluetooth USB dongle, the audio playback functions properly, but the microphone does not work. In the dmesg logs, there are messages indicating that the init_pitch function fails when the capture process begins. The microphone only functions when the ep pitch control is not set. Toggling the pitch control off bypasses the init_piatch function and allows the microphone to work. Signed-off-by: WhaleChang <whalechang@google.com> Link: https://lore.kernel.org/r/20231006044852.4181022-1-whalechang@google.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2023-10-06ALSA: hda: cs35l41: Cleanup and fix double free in firmware requestStefan Binding1-36/+79
There is an unlikely but possible double free when loading firmware, and a missing free calls if a firmware is successfully requested but the coefficient file request fails, leading to the fallback firmware request occurring without clearing the previously loaded firmware. Fixes: cd40dad2ca91 ("ALSA: hda: cs35l41: Ensure firmware/tuning pairs are always loaded") Reported-by: kernel test robot <lkp@intel.com> Reported-by: Dan Carpenter <dan.carpenter@linaro.org> Closes: https://lore.kernel.org/r/202309291331.0JUUQnPT-lkp@intel.com/ Signed-off-by: Stefan Binding <sbinding@opensource.cirrus.com> Link: https://lore.kernel.org/r/20231003142138.180108-1-sbinding@opensource.cirrus.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2023-10-06quota: Fix slow quotaoffJan Kara3-29/+43
Eric has reported that commit dabc8b207566 ("quota: fix dqput() to follow the guarantees dquot_srcu should provide") heavily increases runtime of generic/270 xfstest for ext4 in nojournal mode. The reason for this is that ext4 in nojournal mode leaves dquots dirty until the last dqput() and thus the cleanup done in quota_release_workfn() has to write them all. Due to the way quota_release_workfn() is written this results in synchronize_srcu() call for each dirty dquot which makes the dquot cleanup when turning quotas off extremely slow. To be able to avoid synchronize_srcu() for each dirty dquot we need to rework how we track dquots to be cleaned up. Instead of keeping the last dquot reference while it is on releasing_dquots list, we drop it right away and mark the dquot with new DQ_RELEASING_B bit instead. This way we can we can remove dquot from releasing_dquots list when new reference to it is acquired and thus there's no need to call synchronize_srcu() each time we drop dq_list_lock. References: https://lore.kernel.org/all/ZRytn6CxFK2oECUt@debian-BULLSEYE-live-builder-AMD64 Reported-by: Eric Whitney <enwlinux@gmail.com> Fixes: dabc8b207566 ("quota: fix dqput() to follow the guarantees dquot_srcu should provide") CC: stable@vger.kernel.org Signed-off-by: Jan Kara <jack@suse.cz>
2023-10-06HID: i2c-hid: fix handling of unpopulated devicesJohan Hovold1-63/+81
A recent commit reordered probe so that the interrupt line is now requested before making sure that the device exists. This breaks machines like the Lenovo ThinkPad X13s which rely on the HID driver to probe second-source devices and only register the variant that is actually populated. Specifically, the interrupt line may now already be (temporarily) claimed when doing asynchronous probing of the touchpad: genirq: Flags mismatch irq 191. 00082008 (hid-over-i2c) vs. 00082008 (hid-over-i2c) i2c_hid_of 21-0015: Could not register for hid-over-i2c interrupt, irq = 191, ret = -16 i2c_hid_of: probe of 21-0015 failed with error -16 Fix this by restoring the old behaviour of first making sure the device exists before requesting the interrupt line. Note that something like this should probably be implemented also for "panel followers", whose actual probe is currently effectively deferred until the DRM panel is probed (e.g. by powering down the device after making sure it exists and only then register it as a follower). Fixes: 675cd877c952 ("HID: i2c-hid: Rearrange probe() to power things up later") Cc: Douglas Anderson <dianders@chromium.org> Cc: Maxime Ripard <mripard@kernel.org> Signed-off-by: Johan Hovold <johan+linaro@kernel.org> Tested-by: Dennis Gilmore <dgilmore@redhat.com> Reviewed-by: Douglas Anderson <dianders@chromium.org> Tested-by: Douglas Anderson <dianders@chromium.org> Link: https://lore.kernel.org/r/20231002155857.24584-1-johan+linaro@kernel.org Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
2023-10-06Merge tag 'erofs-for-6.6-rc5-fixes' of ↵Linus Torvalds3-5/+42
git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs Pull erofs fixes from Gao Xiang: - Fix a memory leak issue when using LZMA global compressed deduplication - Fix empty device tags in flatdev mode - Update documentation for recent new features * tag 'erofs-for-6.6-rc5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs: erofs: update documentation erofs: allow empty device tags in flatdev mode erofs: fix memory leak of LZMA global compressed deduplication
2023-10-06Merge tag 'for-linus-2023100502' of ↵Linus Torvalds11-76/+135
git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Jiri Kosina: - power management fix for intel-ish-hid (Srinivas Pandruvada) - power management fix for hid-nintendo (Martino Fontana) - error handling fixes for nvidia-shield (Christophe JAILLET) - memory leak fix for hid-sony (Christophe JAILLET) - fix for slab out-of-bound write in hid-holtek (Ma Ke) - other assorted smaller fixes and device ID / quirk entry additions * tag 'for-linus-2023100502' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: Add quirk to ignore the touchscreen battery on HP ENVY 15-eu0556ng HID: intel-ish-hid: ipc: Disable and reenable ACPI GPE bit HID: sony: remove duplicate NULL check before calling usb_free_urb() HID: nintendo: reinitialize USB Pro Controller after resuming from suspend HID: nvidia-shield: Fix some missing function calls() in the probe error handling path HID: nvidia-shield: Fix a missing led_classdev_unregister() in the probe error handling path HID: multitouch: Add required quirk for Synaptics 0xcd7e device HID: nvidia-shield: Select POWER_SUPPLY Kconfig option HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event HID: nvidia-shield: add LEDS_CLASS dependency HID: logitech-hidpp: Add Bluetooth ID for the Logitech M720 Triathlon mouse HID: steelseries: Fix signedness bug in steelseries_headset_arctis_1_fetch_battery() HID: sony: Fix a potential memory leak in sony_probe()
generated by cgit v1.2.3 (git 2.39.0) at 2024-08-04 13:49:08 +0300