Commit Graph

1138638 Commits

Author SHA1 Message Date
Anup Patel
52ec4b695d RISC-V: KVM: Save mvendorid, marchid, and mimpid when creating VCPU
We should save VCPU mvendorid, marchid, and mimpid at the time
of creating VCPU so that we don't have to do host SBI call every
time Guest/VM ask for these details.

Signed-off-by: Anup Patel <apatel@ventanamicro.com>
Reviewed-by: Atish Patra <atishp@rivosinc.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Signed-off-by: Anup Patel <anup@brainfault.org>
2022-12-07 09:17:43 +05:30
Anup Patel
a1a44e227c RISC-V: Export sbi_get_mvendorid() and friends
The sbi_get_mvendorid(), sbi_get_marchid(), and sbi_get_mimpid()
can be used by KVM module so let us export these functions.

Signed-off-by: Anup Patel <apatel@ventanamicro.com>
Reviewed-by: Atish Patra <atishp@rivosinc.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Acked-by: Palmer Dabbelt <palmer@rivosinc.com>
Signed-off-by: Anup Patel <anup@brainfault.org>
2022-12-07 09:17:38 +05:30
Anup Patel
23fe562e45 RISC-V: KVM: Move sbi related struct and functions to kvm_vcpu_sbi.h
Just like asm/kvm_vcpu_timer.h, we should have all sbi related struct
and functions in asm/kvm_vcpu_sbi.h.

Signed-off-by: Anup Patel <apatel@ventanamicro.com>
Reviewed-by: Atish Patra <atishp@rivosinc.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Signed-off-by: Anup Patel <anup@brainfault.org>
2022-12-07 09:17:27 +05:30
Anup Patel
e81af89bae RISC-V: KVM: Use switch-case in kvm_riscv_vcpu_set/get_reg()
We should use switch-case in kvm_riscv_vcpu_set/get_reg() functions
because the else-if ladder is quite big now.

Signed-off-by: Anup Patel <apatel@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Atish Patra <atishp@rivosinc.com>
Signed-off-by: Anup Patel <anup@brainfault.org>
2022-12-07 09:17:19 +05:30
Anup Patel
1343c61a70 RISC-V: KVM: Remove redundant includes of asm/csr.h
We should include asm/csr.h only where required so let us remove
redundant includes of this header.

Signed-off-by: Anup Patel <apatel@ventanamicro.com>
Reviewed-by: Atish Patra <atishp@rivosinc.com>
Signed-off-by: Anup Patel <anup@brainfault.org>
2022-12-07 09:17:12 +05:30
Anup Patel
fabd6179d0 RISC-V: KVM: Remove redundant includes of asm/kvm_vcpu_timer.h
The asm/kvm_vcpu_timer.h is redundantly included in vcpu_sbi_base.c
so let us remove it.

Signed-off-by: Anup Patel <apatel@ventanamicro.com>
Reviewed-by: Atish Patra <atishp@rivosinc.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Signed-off-by: Anup Patel <anup@brainfault.org>
2022-12-07 09:17:05 +05:30
Anup Patel
e482d9e33d RISC-V: KVM: Fix reg_val check in kvm_riscv_vcpu_set_reg_config()
The reg_val check in kvm_riscv_vcpu_set_reg_config() should only
be done for isa config register.

Fixes: 9bfd900bee ("RISC-V: KVM: Improve ISA extension by using a bitmap")
Signed-off-by: Anup Patel <apatel@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Atish Patra <atishp@rivosinc.com>
Signed-off-by: Anup Patel <anup@brainfault.org>
2022-12-07 09:16:51 +05:30
Christophe JAILLET
3e2d4756e2 RISC-V: KVM: Simplify kvm_arch_prepare_memory_region()
In kvm_arch_prepare_memory_region(), if no error occurs, a spin_lock()/
spin_unlock() call can be avoided.

Switch to kvm_riscv_gstage_iounmap() that is the same as the current code,
but with a better semantic.
It also embeds the locking logic. So it is avoided if ret == 0.

Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Reviewed-by: Anup Patel <anup@brainfault.org>
Signed-off-by: Anup Patel <anup@brainfault.org>
2022-12-07 09:16:39 +05:30
Anup Patel
af934432e4 RISC-V: KVM: Exit run-loop immediately if xfer_to_guest fails
If xfer_to_guest_mode_handle_work() fails in the run-loop then exit
the run-loop immediately instead of doing it after some more work.

Signed-off-by: Anup Patel <apatel@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Signed-off-by: Anup Patel <anup@brainfault.org>
2022-12-07 09:16:21 +05:30
Bo Liu
b3f2575a99 RISC-V: KVM: use vma_lookup() instead of find_vma_intersection()
vma_lookup() finds the vma of a specific address with a cleaner
interface and is more readable.

Signed-off-by: Bo Liu <liubo03@inspur.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Signed-off-by: Anup Patel <anup@brainfault.org>
2022-12-07 09:16:11 +05:30
XiakaiPan
e78a11174d RISC-V: KVM: Add exit logic to main.c
Several lines of code are inserted to remove KVM module normally
using rmmod command just like others.

Signed-off-by: XiakaiPan <13212017962@163.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Tested-by: Andrew Jones <ajones@ventanamicro.com>
Signed-off-by: Anup Patel <anup@brainfault.org>
2022-12-07 09:16:02 +05:30
Linus Torvalds
76dcd734ec Linux 6.1-rc8 2022-12-04 14:48:12 -08:00
Linus Torvalds
0ba09b1733 Revert "mm: align larger anonymous mappings on THP boundaries"
This reverts commit f35b5d7d67.

It has been reported to cause huge performance regressions on some loads
(will-it-scale.per_process_ops, but also building the kernel with
clang).

The commit did speed up gcc builds by a small amount, so it's not an
unambiguous regression, but until the big regressions are understood,
let's revert it.

Reported-by: kernel test robot <yujie.liu@intel.com>
Link: https://lore.kernel.org/r/202210181535.7144dd15-yujie.liu@intel.com
Reported-by: Nathan Chancellor <nathan@kernel.org>
Link: https://lore.kernel.org/lkml/Y1DNQaoPWxE%2BrGce@dev-arch.thelio-3990X/
Cc: Huang, Ying <ying.huang@intel.com>
Cc: Rik van Riel <riel@surriel.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Yang Shi <shy828301@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2022-12-04 12:51:59 -08:00
Jan Dabros
23393c6461 char: tpm: Protect tpm_pm_suspend with locks
Currently tpm transactions are executed unconditionally in
tpm_pm_suspend() function, which may lead to races with other tpm
accessors in the system.

Specifically, the hw_random tpm driver makes use of tpm_get_random(),
and this function is called in a loop from a kthread, which means it's
not frozen alongside userspace, and so can race with the work done
during system suspend:

  tpm tpm0: tpm_transmit: tpm_recv: error -52
  tpm tpm0: invalid TPM_STS.x 0xff, dumping stack for forensics
  CPU: 0 PID: 1 Comm: init Not tainted 6.1.0-rc5+ #135
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-20220807_005459-localhost 04/01/2014
  Call Trace:
   tpm_tis_status.cold+0x19/0x20
   tpm_transmit+0x13b/0x390
   tpm_transmit_cmd+0x20/0x80
   tpm1_pm_suspend+0xa6/0x110
   tpm_pm_suspend+0x53/0x80
   __pnp_bus_suspend+0x35/0xe0
   __device_suspend+0x10f/0x350

Fix this by calling tpm_try_get_ops(), which itself is a wrapper around
tpm_chip_start(), but takes the appropriate mutex.

Signed-off-by: Jan Dabros <jsd@semihalf.com>
Reported-by: Vlastimil Babka <vbabka@suse.cz>
Tested-by: Jason A. Donenfeld <Jason@zx2c4.com>
Tested-by: Vlastimil Babka <vbabka@suse.cz>
Link: https://lore.kernel.org/all/c5ba47ef-393f-1fba-30bd-1230d1b4b592@suse.cz/
Cc: stable@vger.kernel.org
Fixes: e891db1a18 ("tpm: turn on TPM on suspend for TPM 1.x")
[Jason: reworked commit message, added metadata]
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2022-12-04 12:49:13 -08:00
Linus Torvalds
0c3b5bcb48 - Fix a use-after-free case where the perf pending task callback would
see an already freed event
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmOMqHUACgkQEsHwGGHe
 VUpRzw/9Gow+0wbm2XhMuweUA6t3LgNweOmzDl9w8k1f55OD6niCvuDiF9jSaiKZ
 UwGyErasp2dlEVjuNGnp42qSHos3vRiR7sdZZQG+7opWV2FFyxyFpx5x8UEgVnFy
 gOuEij5vLXBApUdNRAcVqCbvivs4Lv6SggDyQ075zGzuOmUv57vw2jDt8YfKaFcp
 jZTiL+j5GKwihndDB6ayx+7Gwo9a9ASKrTgz8JK2tPOIHZR4X9y9ot1IanZnxzwF
 d0kFpLgF/ZqjPRpJoaFn/jgk1AfahQyYHXh7lQ1aP7rLSLRRGcfTBX4n9nC3BYT+
 EHaA94l151L1mzbR69ij9tryAERU4NlguD/FIuCeW+6IEPiuwBNGklXF+rRegNj4
 IYC0ZSld/NyWKtOrwNSrFRMsxFm583Pg6TaBkvU1rGd5YVQ7GImrj7UjecXO/W71
 iXpfarF7ur2zmd+5+F5FB34VYw8GumRo+D+XIb34+8UMBURTX36hgXvSC3sVyyCw
 b0c758F3+1zTwm8z52T1RhOOp47t5iWAznwTq6k1cT7788PDXJ9sGYXIpdLpwKcI
 Fuj61alwamGeUciCr0iKGtCLRHayZII7OeQh1VjXuqgCwI3hI2j3EaI9C74WSApn
 ttVInS0Ka2xcu//A1VFltkMOWNMQK9JeTlqdqctwypTL3WVb2XA=
 =jo4r
 -----END PGP SIGNATURE-----

Merge tag 'perf_urgent_for_v6.1_rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull perf fix from Borislav Petkov:

 - Fix a use-after-free case where the perf pending task callback would
   see an already freed event

* tag 'perf_urgent_for_v6.1_rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  perf: Fix perf_pending_task() UaF
2022-12-04 12:36:23 -08:00
Linus Torvalds
eea8bebd51 - Revert a fix to RISC-V timers supposed to address an uncertainty
whether clock events are received during S3 or not which locks up other
 RISC-V platforms. The issue will be fixed differently later.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmOMnhwACgkQEsHwGGHe
 VUrQsBAAt8ILDPAfXSvnak9p6qWywfa5/eMzychUFx4z8UBaTgeTTq5MHIADSkTj
 m4vSroX/IzhEzYMDZtLTrggNKta0pTddQkw1wZXZztu4QeixHkGyHrVOaGaWLbPd
 8Z+D4yjPuhdvCP8cXq0X3YynmNRDOaNMZMuwq9AtZplZHmBHTdSpDFU5ZbhSlhPT
 DXABL5wVOJ1lOzGxtUPCjzgGj/Vo7wSfwA+XGCprj7+1/CO9iMF6LaFhnAf4huLl
 alscLysRxbonZ/HKydWFMLMWo7/hcb2kr69QZ2qWlIfCSXHIDE3jF7m/7lpF0FrQ
 Ggn9DrcS5uTLWwxZEnbHqKJKQ+JNz9S9gBY2pv6omKVhT0iGkCI9V/h/26QhY6DK
 4MQ0PeV+Jrb9rpl6xv41Zqg9S+JzjOrnJPSDgJKK+DUPba4L6vkEJvOErQ1rfB+N
 3E/+s2IKXjHFz281jtwmjM37lcNxI8ULvvrw3o8SVxPVyldWJyXIgOndSvYMsKpg
 0usXPiTruNc+l39WP2Gf1GgEKlML21GfeFMeuC8ekbTnIYRbHbgUYRhOrOv0nOf8
 KUDmp4J/0Ko478jQG2WsTXQ77KM88X2tWdTgfqVpj+Tl+FvVvDuLuREbnBFijBnd
 ED/Hyu6i5snCe8ZMwqOHezFBFAZrMgUZwcnvR9NwvIxmzd8Nr0M=
 =Urji
 -----END PGP SIGNATURE-----

Merge tag 'timers_urgent_for_v6.1_rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull timer fix from Borislav Petkov:

 - Revert a fix to RISC-V timers supposed to address an uncertainty
   whether clock events are received during S3 or not which locks up
   other RISC-V platforms. The issue will be fixed differently later.

* tag 'timers_urgent_for_v6.1_rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  Revert "clocksource/drivers/riscv: Events are stopped during CPU suspend"
2022-12-04 12:33:44 -08:00
Linus Torvalds
ae6bb71711 powerpc fixes for 6.1 #6
- Fix oops in 32-bit BPF tail call tests
  - Add missing declaration for machine_check_early_boot()
 
 Thanks to: Christophe Leroy, Naveen N. Rao.
 -----BEGIN PGP SIGNATURE-----
 
 iQJHBAABCAAxFiEEJFGtCPCthwEv2Y/bUevqPMjhpYAFAmOMnI8THG1wZUBlbGxl
 cm1hbi5pZC5hdQAKCRBR6+o8yOGlgN7mD/9+9S6UugT20o82MtWLuyBMsNC+ILcf
 op23x6uYXp9aS/1/8ktRFhH3C6r74QvRxvnDs6He/Ai7jz4jlYNLNT2SfJ70WZGy
 SLlQKJwV1eUz502zCqV0s5/G/77wlrEfCrL3wToa0G6aw8/u1ECtSSXFx/fCAG0K
 jehHASbGxcyJiNZboMPJ940CXdeQNIK0ICbpi06Qvr4Uc3tybeICzgWGNzBROGIH
 q+kdOrMN2mF5LQONOKyC2OI94CNWJmBdqTTOle0jqWJT6h23vh4Oys+oO6uHyszU
 6+qM1Ze4oLrU/oCaQXA1y4oFB2VL1pkFo2aO1rRot+GuqAIjy7BJlUdSfB6hQto5
 JmtU0u7p3gBxU8BhMxufErNYODiXYQ0IVRR1YWHBoRs9aXyyQ/I0Ux46hvMI8qEN
 HyUt4wPWUt1L0QDP9hlGjSbwz/rs0lyDc+L46+TH45CozSHssWSQo5VRSmuyMuQ1
 juQgNvydDdC7S+JIa6ppmNmhLlIm0jGyp7fM5SN4bopcc3bBT6LMIK+Am1O0bWsU
 petyukpuXD8kjxDazid56JkJNva0nnhScLfTQuvxxkViiVyCcuXSZh8g8/C1iMmk
 7apvijphBG3ZwC0JZbwJjQxsi74uzdN8vxJMc7kZilY/qMngjVE3NoI9rPgbwvi+
 lYdwu5F1KnxxAA==
 =Ea1J
 -----END PGP SIGNATURE-----

Merge tag 'powerpc-6.1-6' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux

Pull powerpc fixes from Michael Ellerman:

 - Fix oops in 32-bit BPF tail call tests

 - Add missing declaration for machine_check_early_boot()

Thanks to Christophe Leroy and Naveen N. Rao.

* tag 'powerpc-6.1-6' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
  powerpc/64s: Add missing declaration for machine_check_early_boot()
  powerpc/bpf/32: Fix Oops on tail call tests
2022-12-04 12:24:58 -08:00
Linus Torvalds
50f36c5aa1 Input updates for v6.1-rc7
- a fix for Raydium touchscreen driver to stop leaking memory when
   sending commands to the chip.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQST2eWILY88ieB2DOtAj56VGEWXnAUCY4wjZwAKCRBAj56VGEWX
 nJI2AQCcfR1zDi8yQOtR2KjKK0DJX7QmKQVK/SbodlFNUnYNPgD8CpDM67vH6Sle
 g2TpbVin8186G+a1PBu21NbdbicHYQA=
 =AbZG
 -----END PGP SIGNATURE-----

Merge tag 'input-for-v6.1-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input

Pull input fix from Dmitry Torokhov:

 - a fix for Raydium touchscreen driver to stop leaking memory when
   sending commands to the chip

* tag 'input-for-v6.1-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: raydium_ts_i2c - fix memory leak in raydium_i2c_send()
2022-12-04 12:18:37 -08:00
Linus Torvalds
c2bf05db6c I2C has this time a power state fix in the core for ACPI devices, a
regression fix regarding bus recovery for the cadence driver, a DMA
 handling fix for the imx driver, and two error path fixes (npcm7xx and
 qcom-geni).
 -----BEGIN PGP SIGNATURE-----
 
 iQJDBAABCgAtFiEEOZGx6rniZ1Gk92RdFA3kzBSgKbYFAmOLav8PHHdzYUBrZXJu
 ZWwub3JnAAoJEBQN5MwUoCm2s7gP+wZTI7tJutMLBHOPji2lvoinD9J19Gk7CLbU
 95DrL54VSpt9QB3FzH5du7fsEmmpKaepcG6hXDiG3XNoGyBBPxd8tmEU/SOnyvRI
 ucMIBb+DNum+CEWdf3XyTu3VTMpi4iuvxOTlhFkvfZqZXIsjSoiCjVOtA/npiW25
 svAflgdm69eBNpr6/w5oJbCsh+cRzmV8V3Un2iwouWV0kUWTlDU11Iu93snzUSEe
 fPFOJZVm3R8gyALTlE4v0i7irRWaeKKuoS+dpV5h/hComqL+lvZ4jc+KCiYetimE
 jhdWz9RjgX3FKnCk5zap1lagdjDcJ3L0s4m4/LFm7t/OJiLJEkVByqgrftlR3FhM
 T4aFFYPegsbvcXz4Gmx4cMILbzIYoh3mN4uaspmCLi3B9fe7NK8iRLN66DmMfoKI
 HCZ8FbWuUFk2w/2pPaz5GKfwXDO2YUgKtANdn+zHK8wWJnNQzGPGVkL1XHJeFbJS
 dXNka6YITm2Tra3MePT+ra3SfACfS2fGBgH8s0tnyaRQNOUYI6fqokM1IGrCKbTr
 nEN8VXIWFVm+3++AlVJcQw26DIN0jGE2PRJQhyiZnxTyryvW6yrkE/KFOOMKA7Ro
 5CMccDjY2pkLO9uQmpqeOsQscQh3X36gN8TL2RkTTdB97t71XX+//CkBE9VcJOPM
 Ovw2YYWO
 =WDqW
 -----END PGP SIGNATURE-----

Merge tag 'i2c-for-6.1-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux

Pull i2c fixes from Wolfram Sang:
 "A power state fix in the core for ACPI devices, a regression fix
  regarding bus recovery for the cadence driver, a DMA handling fix for
  the imx driver, and two error path fixes (npcm7xx and qcom-geni)"

* tag 'i2c-for-6.1-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
  i2c: imx: Only DMA messages with I2C_M_DMA_SAFE flag set
  i2c: qcom-geni: fix error return code in geni_i2c_gpi_xfer
  i2c: cadence: Fix regression with bus recovery
  i2c: Restore initial power state if probe fails
  i2c: npcm7xx: Fix error handling in npcm_i2c_init()
2022-12-03 13:51:37 -08:00
Linus Torvalds
6085bc9579 dax fixes for v6.1-rc8
- Fix duplicate overlapping device-dax instances for HMAT described
   "Soft Reserved" Memory
 
 - Fix missing node targets in the sysfs representation of memory tiers
 
 - Remove a confusing variable initialization
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQSbo+XnGs+rwLz9XGXfioYZHlFsZwUCY4q2jAAKCRDfioYZHlFs
 Z1P/AQCbMguw+Nj0oTj64TxvrJ6JjFbmJXI8YTFuSt7yOK4XLgD+OlH4SmZyQ1rH
 HSY2kAl1mPKiqdoO0tKwcNtYYrOZtQQ=
 =4hxx
 -----END PGP SIGNATURE-----

Merge tag 'dax-fixes-6.1-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm

Pull dax fixes from Dan Williams:
 "A few bug fixes around the handling of "Soft Reserved" memory and
  memory tiering information.

  Linux is starting to enounter more real world systems that deploy an
  ACPI HMAT to describe different performance classes of memory, as well
  the "special purpose" (Linux "Soft Reserved") designation from EFI.

  These fixes result from that testing.

  It has all appeared in -next for a while with no known issues.

   - Fix duplicate overlapping device-dax instances for HMAT described
     "Soft Reserved" Memory

   - Fix missing node targets in the sysfs representation of memory
     tiers

   - Remove a confusing variable initialization"

* tag 'dax-fixes-6.1-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm:
  device-dax: Fix duplicate 'hmem' device registration
  ACPI: HMAT: Fix initiator registration for single-initiator systems
  ACPI: HMAT: remove unnecessary variable initialization
2022-12-03 13:43:38 -08:00
Linus Torvalds
97ee9d1c16 block-6.1-2022-12-02
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmOKM1MQHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgprErD/4vyIhYg4ZM9HOWNjpuT8oZCG6yRZ4gLhz0
 GT7VRcb8GKEkKUMmeazaxocWbC3fc+yvj49Oan1Uj7/teHTmJDM0pF/fMpJdkJrF
 z+PAy2++MGF++QNBq+wrDEIDsJ4QvRxDDJe9N+KDTtX6UsoBFYxJhem4JzZpM4BI
 4GY8jYiKlx42WM58stZ0DXOucG1DsKaOQKYRQGjtKYvA0dTn7dj9btY+n6rGerEX
 4265huzW5iY+MZWc5KLXGSr0wIJqAiKMoecN03JSBHONFVB4cjMQpZuQfSChqkUS
 3fhVmFOZnYMzMIZgiwhFxuIP/QzLjctdibwU9JusqChYP9Mx7HQ2+gs7H7i5PSdS
 9m64g2u+GuRjbgIeeGPVMPnBR3UG2GE8BDRfFBBCtbdmHXIKoolXdKvG9enRjXit
 e4wjGQDHk6x9iV6LITH1Jn82kzk6TTuBkdSBJN6u8KASeOCoPwWuhgyRXo6+jh5D
 1wd2mYxtM1UB2mZilPpflDSpzZCrp/CMjbLVPIV0aTxmmeEJN+Ao2PnduNjEBxoh
 kYwlScoz9DPvMf59UU45MLc9/vYchL14VoPOl59osLlQrWf9vPMATlU1CaRgQSVa
 apBNAMzWFTMGxXCtIsUoClNX7uuHrqrMEjBbhWuWp4DSOVQoJORrU5ymX9M92MYP
 f0incJSEZQ==
 =Gdkx
 -----END PGP SIGNATURE-----

Merge tag 'block-6.1-2022-12-02' of git://git.kernel.dk/linux

Pull block fixes from Jens Axboe:
 "Just a small NVMe merge for this week, fixing protection of the name
  space list, and a missing clear of a reserved field when unused"

* tag 'block-6.1-2022-12-02' of git://git.kernel.dk/linux:
  nvme: fix SRCU protection of nvme_ns_head list
  nvme-pci: clear the prp2 field when not used
2022-12-02 16:27:15 -08:00
Linus Torvalds
63050a5ca1 Pin control fixes for the v6.1 series:
- Fix a potential divide by zero in pinctrl-singe (OMAP
   and HiSilicon)
 
 - Disable IRQs on startup in the Mediatek driver. This
   is a classic, we should be looking out for this more.
 
 - Save and restore pins in "direct IRQ" mode in the Intel
   driver, this works around firmware bugs.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEElDRnuGcz/wPCXQWMQRCzN7AZXXMFAmOKZB4ACgkQQRCzN7AZ
 XXMsnw/+PSijwUPsikfZYtgp2BTxMb/xr0XKmggqheNzEs1e0xYHBTJO9nLuUCxG
 v0zfpTMgwhx9/988Y39/fRih/DEKB5s/CMV7Ic5DQCmPo9NC5apeWvW80aQPbEun
 jwEEmjIUHHx9nX9z4B9CSICZA7XUiTb9vbHIG2KJCX7L3atzkOMmTYNi62qLQ6CU
 fo6JYZm1V3zdqLX3dD8HlDdVfzyywvG9MAhFlRgxPk/s2E8BMQdRL93rejPYKvWh
 fFH6aQrJMgEymzgRq+vfI62XRKK0ebE6A4084BMHSxflh+LNpjFwZfaNTotaqPHY
 uVVmPOGH2wjLHRFit0mp+6xWL9sGjggawJ4Y56gYpsUnNN+aKhkpjdvm9UFscnql
 6MZFx6hKbx91czhSD0M5nSWTR7AQwP3YLgOPZnGS0bt7WvuX306eh1CxYcbHlBFq
 KM4u7B36Q89b0Ac2+CjyXo4rUdXyeMRY6kDFuVaqVGyU1SEIWaqP9wwGDDY5ZXWx
 Kqc+mP5Zr6TzUbx4Amry/EswynT5zeqr6N8DFWcDZW2VJwiDqPs7g3ZIVxqpv719
 OOFzwNGtCkrjYs2SH9o697gC5xPofw2OgIFUeYMFNoCNjmjhegym6qrVAT45IOV1
 SYYoRKEFFdof9DbhJrWUmOBkMqtuPhycZClbHpRHoI/309Cq7eo=
 =bP9I
 -----END PGP SIGNATURE-----

Merge tag 'pinctrl-v6.1-5' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl

Pull pin control fixes from Linus Walleij:
 "Three driver fixes. The Intel fix looks like the most important.

   - Fix a potential divide by zero in pinctrl-singe (OMAP and
     HiSilicon)

   - Disable IRQs on startup in the Mediatek driver. This is a classic,
     we should be looking out for this more.

   - Save and restore pins in 'direct IRQ' mode in the Intel driver,
     this works around firmware bugs"

* tag 'pinctrl-v6.1-5' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
  pinctrl: intel: Save and restore pins in "direct IRQ" mode
  pinctrl: meditatek: Startup with the IRQs disabled
  pinctrl: single: Fix potential division by zero
2022-12-02 16:22:17 -08:00
Linus Torvalds
0e15c3c75a RISC-V Fixes for 6.1-rc8
* A build-time fix for the NR_CPUS Kconfig SBI version dependency.
 * A pair of fixes to early memory initialization, to fix page
   permissions in EFI and post-initmem-free.
 * A build-time fix for the VDSO, to avoid trying to profile the VDSO
   functions.
 * A pair of fixes for kexec crash handling, to fix multi-core and
   interrupt related initialization inside the crash kernel.
 * A fix to avoid a race condition when handling multiple concurrect
   kernel stack overflows.
 -----BEGIN PGP SIGNATURE-----
 
 iQJHBAABCAAxFiEEKzw3R0RoQ7JKlDp6LhMZ81+7GIkFAmOKLK8THHBhbG1lckBk
 YWJiZWx0LmNvbQAKCRAuExnzX7sYidb0EACeA33Y1YMY/0W679rJgPgeas2xLfRU
 RIpSFZk1ylBQi8upQi6XWjh8xb/kd9LVglORRazaCcVYzmRNWOtcLfpIfYccqFhv
 7aszAXbajHtXJHN8GK0XKf2S4PazchtQ6tTsmDT12VwnWDn8pEOdW3BOBEvh6DPX
 Mn+tMZeCmcI9jzaR7OwaZYyZmc4u16MTsh9stCfnmcU9tS9oq1JTPY1UHUqGzeiC
 W8zzHyREHoKO5fU4JZYQYDoXtuqqfjiBXWVxIogQduBzMwyXKP6RR1+qMtDvLc8k
 OhThrde1NCIFD6se6IQlvjMdUaroMZf0gprhahbcjABdtvsPYwAG0TBLMNaHYUZT
 Pl+np/xmFocTOPcMQ1A57qlPUfeAsR55eE0bEjxLiy5H7ygnEu3D2st+uBtiO69v
 d6gie9qmrEF230dHJ7qJnbMtrJcAL/u671ylmRS8iwFZlbOE+Ra2aqsBgf+9ri56
 syZY8ovnPUl72ZNZtLiBxnDSIegMfLr7As1vFlAXT+ZntDRKR1ZGkXDvSk9apOMd
 oxIiIOPTQHQQKlzH8oZEIDTnuL7T6+6CtwvlF74keSF+y4YMQJTmDTIARJ7z5rab
 aiR+pU4HdvF6Koujv4imlO/9Ahwk9G/vCQ9zyz/AGG21kic4gACvA45Z5AjKoakP
 PgIh0Uintun+yw==
 =u62e
 -----END PGP SIGNATURE-----

Merge tag 'riscv-for-linus-6.1-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux

Pull RISC-V fixes from Palmer Dabbelt:

 - build fix for the NR_CPUS Kconfig SBI version dependency

 - fixes to early memory initialization, to fix page permissions in EFI
   and post-initmem-free

 - build fix for the VDSO, to avoid trying to profile the VDSO functions

 - fixes for kexec crash handling, to fix multi-core and interrupt
   related initialization inside the crash kernel

 - fix for a race condition when handling multiple concurrect kernel
   stack overflows

* tag 'riscv-for-linus-6.1-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
  riscv: kexec: Fixup crash_smp_send_stop without multi cores
  riscv: kexec: Fixup irq controller broken in kexec crash path
  riscv: mm: Proper page permissions after initmem free
  riscv: vdso: fix section overlapping under some conditions
  riscv: fix race when vmap stack overflow
  riscv: Sync efi page table's kernel mappings before switching
  riscv: Fix NR_CPUS range conditions
2022-12-02 16:04:53 -08:00
Linus Torvalds
2df2adc3e6 MMC core:
- Fix ambiguous TRIM and DISCARD args
  - Fix removal of debugfs file for mmc_test
 
 MMC host:
  - mtk-sd: Add missing clk_disable_unprepare() in an error path
  - sdhci: Fix I/O voltage switch delay for UHS-I SD cards
  - sdhci-esdhc-imx: Fix CQHCI exit halt state check
  - sdhci-sprd: Fix voltage switch
 -----BEGIN PGP SIGNATURE-----
 
 iQJLBAABCgA1FiEEugLDXPmKSktSkQsV/iaEJXNYjCkFAmOJt2wXHHVsZi5oYW5z
 c29uQGxpbmFyby5vcmcACgkQ/iaEJXNYjCnIfhAAzDpsdF1zBYQDHelN6DsqMX4c
 vHmBO8P9DE9xfhmdt3bnCa+26WIzmXGJ/8/jZLkV9ZGYLeAjkj6sYPQ2Zgvndecd
 f+9l4sGBiL1b26ON2wQqnrsZcEedtDh3xYdAtuHyEwqb4hRs+ryl9vMGvwdfE685
 T0Y+rvIxsT9m+X0kQfJzc7hedJ+K7wytkY5MmQhh5bMzhm7+6BhQJf/ABG2CTdUm
 Wilx9VJIxeVfORg1jEgQ+ssR0K9RmbuzAb3690xUYKobAK034JbSCvhodXIzVMYU
 g4iJ2m5rZrvdYKweuO98AAoRQ4DzNo2scGjmF9V2ImBrIbkIc2Mq2wms3PhNoYCu
 Rvzoa6fkoOR8acSo4dU3433xeZfdOIX9h0o5sBI+esERfdST1FwQ5FpF4SAiAr3u
 wXo/KZV/PfSZUAPHzbKCvIiEd330MJD6z18ORUYviqAcQNjqEhYyeARrzKxbkJA7
 zOn3yirLR6yGm5cZ1YS0+A8wj4GBcf7XwkSJs2ospQqeTCpqZwceOxogs03myey9
 Igx7IGT/PRHbMWFli584iERL+L6LbHUtZguJGabr/xh7YHt/vbOniH9BiG6AexXZ
 UzOjDaddzVJeAmvARQMowV7WssxvdVg8jnO19T4v93At0LKmTwUC015AQigaAvDP
 PZ3jUC/QBty5d7N3GBg=
 =7SFO
 -----END PGP SIGNATURE-----

Merge tag 'mmc-v6.1-rc5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc

Pull MMC fixes from Ulf Hansson:
 "MMC core:
   - Fix ambiguous TRIM and DISCARD args
   - Fix removal of debugfs file for mmc_test

  MMC host:
   - mtk-sd: Add missing clk_disable_unprepare() in an error path
   - sdhci: Fix I/O voltage switch delay for UHS-I SD cards
   - sdhci-esdhc-imx: Fix CQHCI exit halt state check
   - sdhci-sprd: Fix voltage switch"

* tag 'mmc-v6.1-rc5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
  mmc: sdhci-sprd: Fix no reset data and command after voltage switch
  mmc: sdhci: Fix voltage switch delay
  mmc: mtk-sd: Fix missing clk_disable_unprepare in msdc_of_clock_parse()
  mmc: mmc_test: Fix removal of debugfs file
  mmc: sdhci-esdhc-imx: correct CQHCI exit halt state check
  mmc: core: Fix ambiguous TRIM and DISCARD arg
2022-12-02 15:58:07 -08:00
Linus Torvalds
f66f62f83d IOMMU Fixes for Linux v6.1-rc7
Including:
 
 	- Intel VT-d fixes:
 	  - IO/TLB flush fix
 	  - Various pci_dev refcount fixes
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEr9jSbILcajRFYWYyK/BELZcBGuMFAmOKBQkACgkQK/BELZcB
 GuOzPhAAtJfmbfbvGLjCz/e9DgLl1sdfFrR1FwzwpXmQ3iV1isBy8AG/PX2+uBMs
 Qcge0BkzX0X/8I/lbnJYHbix3Z0cjDuYl4kPyYP8V5+tqSuJRnAODw+GJK17ntn8
 EfsDG4fZzEIUAgPE8PP4qXZwXI2pLfF6A4CT0ztB46976fpzcLAUicG0H2Opy9vQ
 DmDNOsg3R0yBB/1XaN0QSavfnoLKmaB37aHv0GeN4l5aue6tgWzxKUxBKSWnA7nF
 ZS+3XFe0tAhmxPH3JGmHqloxQrR52zqq9vMsbn0PTND6UKCN/pEo+3TkJQ9FLxvm
 qQi1lrAf9zRoIcsodXVAvgWbEgbR5LWxAffSwz+oJBv9MwMA8pfCG95HGBVX90fD
 WY01XcsnHmo1BqOHg5P9lSC979xGdltL71IjbKi1r31njZ2VByfDNcsa9OSBCD0L
 9Y8JJ0vW8ipbpDEDoxZUuElY+UkKUyJFurNVPxpCiKQhIdWdTPUurnvCBQgi5uas
 zVtI6OP/I7MIZbc00C4Y7KfsLm0MqlVOYzhvG+8vGW9GLUTVtWF0MkP6sfUEiQmS
 OqsxqTiLjbGfIOBvhZxyVZ7sCVY2d776KS6d9LlYINmRn8UAzIQC01szyr+Jx5m4
 jqs/ujTVIr2UiZ2QSrdQ2wNsrab/4vUrAN/O+uoJ5eV537ryKl8=
 =rgA1
 -----END PGP SIGNATURE-----

Merge tag 'iommu-fixes-v6.1-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu

Pull iommu fixes from Joerg Roedel:
 "Intel VT-d fixes:

   - IO/TLB flush fix

   - Various pci_dev refcount fixes"

* tag 'iommu-fixes-v6.1-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu:
  iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init()
  iommu/vt-d: Fix PCI device refcount leak in has_external_pci()
  iommu/vt-d: Fix PCI device refcount leak in prq_event_thread()
  iommu/vt-d: Add a fix for devices need extra dtlb flush
2022-12-02 15:54:12 -08:00
Pawan Gupta
6606515742 x86/bugs: Make sure MSR_SPEC_CTRL is updated properly upon resume from S3
The "force" argument to write_spec_ctrl_current() is currently ambiguous
as it does not guarantee the MSR write. This is due to the optimization
that writes to the MSR happen only when the new value differs from the
cached value.

This is fine in most cases, but breaks for S3 resume when the cached MSR
value gets out of sync with the hardware MSR value due to S3 resetting
it.

When x86_spec_ctrl_current is same as x86_spec_ctrl_base, the MSR write
is skipped. Which results in SPEC_CTRL mitigations not getting restored.

Move the MSR write from write_spec_ctrl_current() to a new function that
unconditionally writes to the MSR. Update the callers accordingly and
rename functions.

  [ bp: Rework a bit. ]

Fixes: caa0ff24d5 ("x86/bugs: Keep a per-CPU IA32_SPEC_CTRL value")
Suggested-by: Borislav Petkov <bp@alien8.de>
Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Cc: <stable@kernel.org>
Link: https://lore.kernel.org/r/806d39b0bfec2fe8f50dc5446dff20f5bb24a959.1669821572.git.pawan.kumar.gupta@linux.intel.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2022-12-02 15:45:33 -08:00
Zhang Xiaoxu
8c9a59939d Input: raydium_ts_i2c - fix memory leak in raydium_i2c_send()
There is a kmemleak when test the raydium_i2c_ts with bpf mock device:

  unreferenced object 0xffff88812d3675a0 (size 8):
    comm "python3", pid 349, jiffies 4294741067 (age 95.695s)
    hex dump (first 8 bytes):
      11 0e 10 c0 01 00 04 00                          ........
    backtrace:
      [<0000000068427125>] __kmalloc+0x46/0x1b0
      [<0000000090180f91>] raydium_i2c_send+0xd4/0x2bf [raydium_i2c_ts]
      [<000000006e631aee>] raydium_i2c_initialize.cold+0xbc/0x3e4 [raydium_i2c_ts]
      [<00000000dc6fcf38>] raydium_i2c_probe+0x3cd/0x6bc [raydium_i2c_ts]
      [<00000000a310de16>] i2c_device_probe+0x651/0x680
      [<00000000f5a96bf3>] really_probe+0x17c/0x3f0
      [<00000000096ba499>] __driver_probe_device+0xe3/0x170
      [<00000000c5acb4d9>] driver_probe_device+0x49/0x120
      [<00000000264fe082>] __device_attach_driver+0xf7/0x150
      [<00000000f919423c>] bus_for_each_drv+0x114/0x180
      [<00000000e067feca>] __device_attach+0x1e5/0x2d0
      [<0000000054301fc2>] bus_probe_device+0x126/0x140
      [<00000000aad93b22>] device_add+0x810/0x1130
      [<00000000c086a53f>] i2c_new_client_device+0x352/0x4e0
      [<000000003c2c248c>] of_i2c_register_device+0xf1/0x110
      [<00000000ffec4177>] of_i2c_notify+0x100/0x160
  unreferenced object 0xffff88812d3675c8 (size 8):
    comm "python3", pid 349, jiffies 4294741070 (age 95.692s)
    hex dump (first 8 bytes):
      22 00 36 2d 81 88 ff ff                          ".6-....
    backtrace:
      [<0000000068427125>] __kmalloc+0x46/0x1b0
      [<0000000090180f91>] raydium_i2c_send+0xd4/0x2bf [raydium_i2c_ts]
      [<000000001d5c9620>] raydium_i2c_initialize.cold+0x223/0x3e4 [raydium_i2c_ts]
      [<00000000dc6fcf38>] raydium_i2c_probe+0x3cd/0x6bc [raydium_i2c_ts]
      [<00000000a310de16>] i2c_device_probe+0x651/0x680
      [<00000000f5a96bf3>] really_probe+0x17c/0x3f0
      [<00000000096ba499>] __driver_probe_device+0xe3/0x170
      [<00000000c5acb4d9>] driver_probe_device+0x49/0x120
      [<00000000264fe082>] __device_attach_driver+0xf7/0x150
      [<00000000f919423c>] bus_for_each_drv+0x114/0x180
      [<00000000e067feca>] __device_attach+0x1e5/0x2d0
      [<0000000054301fc2>] bus_probe_device+0x126/0x140
      [<00000000aad93b22>] device_add+0x810/0x1130
      [<00000000c086a53f>] i2c_new_client_device+0x352/0x4e0
      [<000000003c2c248c>] of_i2c_register_device+0xf1/0x110
      [<00000000ffec4177>] of_i2c_notify+0x100/0x160

After BANK_SWITCH command from i2c BUS, no matter success or error
happened, the tx_buf should be freed.

Fixes: 3b384bd6c3 ("Input: raydium_ts_i2c - do not split tx transactions")
Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
Link: https://lore.kernel.org/r/20221202103412.2120169-1-zhangxiaoxu5@huawei.com
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2022-12-02 15:42:21 -08:00
Linus Torvalds
a1e9185d20 sound fixes for 6.1-rc8
Likely the last piece for 6.1; the only significant fixes are ASoC
 core ops fixes, while others are device-specific (rather minor)
 fixes in ASoC and FireWire drivers.
 
 All appear safe enough to take as a late stage material.
 -----BEGIN PGP SIGNATURE-----
 
 iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAmOJuooOHHRpd2FpQHN1
 c2UuZGUACgkQLtJE4w1nLE+RThAAxOJ3TUepppN5MXhM2r4khA1dV8xKIexOHddv
 n1g/rmqkHsSr+VltnQ2GbnUUmt4fgl5nXFEOlZCDW2z60j6Ue28fbimW6DH5yd+V
 rjbPg2i9zolwVH8MZsvl7jbb2jMeFFqXhwa8650Oxg3BRdOshUhvpFAbjWoAAZEk
 p0E9oSGvhmebtQlbtlHWlDBwdfPxbyc5pFxM5ESe9ckq6Uc5WTfrkrw7uz9yeqED
 vP92waW6UywBPpeXRgZBzvvAZP3tNTs/NW8VZWtpDzesdBH6M2hlGpL0MviBjI0J
 gWgThxjOoS8yi/Js+18DDWq8GgO57PQoZKaexCfJvKVDx2aSRH66LPhv+cVROhP7
 jPFzH30ESb65TjKrMUnTcPujs+uq4YLPsZ7KBTg1ylUEC1477Ja5C1Q1lsLCXj1+
 c7NoAO6/8nEjuezlun3kNXZ1dJGuFSRW2MdzyXGOAsVKwFPUfJGNFCE/h77826jn
 50SHMRwnNkOHIYDzB+W7fZ5HPId6QCzXZLoPuzbFpEeLYjqNUO8KYp3oh+ssfXiu
 cKioCzl07Fx4DKl5NNCG6VXXVKhzYj9MwtzNCIMIP8neWarMuW2e82/H+rS3v8Fc
 4hM8mZ90u8mxd36cMa+SLYpIfdTUEMAZpdtMc4WHc7BBjaZx5FDU5QZYkqZpdsOY
 L/BcX5Q=
 =XTUR
 -----END PGP SIGNATURE-----

Merge tag 'sound-6.1-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound fixes from Takashi Iwai:
 "Likely the last piece for 6.1; the only significant fixes are ASoC
  core ops fixes, while others are device-specific (rather minor) fixes
  in ASoC and FireWire drivers.

  All appear safe enough to take as a late stage material"

* tag 'sound-6.1-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
  ALSA: dice: fix regression for Lexicon I-ONIX FW810S
  ASoC: cs42l51: Correct PGA Volume minimum value
  ASoC: ops: Correct bounds check for second channel on SX controls
  ASoC: tlv320adc3xxx: Fix build error for implicit function declaration
  ASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx()
  ASoC: ops: Fix bounds check for _sx controls
  ASoC: fsl_micfil: explicitly clear CHnF flags
  ASoC: fsl_micfil: explicitly clear software reset bit
2022-12-02 15:40:35 -08:00
Linus Torvalds
c290db0137 drm fixes for 6.1-rc8
i915:
 - Fix dram info readout
 - Remove non-existent pipes from bigjoiner pipe mask
 - Fix negative value passed as remaining time
 - Never return 0 if not all requests retired
 
 amdgpu:
 - VCN fix for vangogh
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmOJV+oACgkQDHTzWXnE
 hr4fLhAAjvH0Qp/b7mjJ6J7C5b8w2IPGVUDeGdZIqmaFv905825o8Hoj132F5HV0
 NvSK5B69Z+of958ky1ksXowAMfKyUbqpOx00QjX1F4v+R0C1QAslobQirhfVpaf5
 uvqw69/b1A7uPI1Pz+2SXWgmmrJ1qyMc7fqPodNWudBDyjm+Wsz6NnTxCF+OMsJV
 LRlZ73IjLqfX17sUFpH9Gr/1PsAF9d4PkLPcc2WVFQrV8O7K5dPBwRdtqtCuZ54K
 zRE3k0hIYyRQHhqCd+IBGpnbwTGAhLIb4FAN+wQ5hmO/gU5kJm3o+1ruhpUepiLM
 jhZOHritZAqU3NE42odWrKT3Juz9Zvf84fTaULKcmk/cNUPPBhlLbBU4CL5/OCAD
 RbT7kSxMzqO1uVDKXggblaFWjeMmeulz3iSqU3dmSGWue39/2kMSDKKykCSpSJTn
 ync5iEXD9nIADjgdnu9W7sbQaEhoJc0/bJ01/sy1FPimR5rcJh15pozabSMz95cO
 YtnkzYymyCQbyaSdPHgWSRrAmFHfGi6rMdLR+vl6CHTRdyYfb/tB5hhcwxLZoWpt
 K4/+IrJO7kUR7wbBpYRq1sQfl98PinfVxXiCI3PnLSBBkLFCNxRwrYw+4hMe2Bjw
 sYPT7ADAIwNW2HWM+z7GxTMYQZK5lcsolPeFaxycA3h4B5NA8QU=
 =TdXQ
 -----END PGP SIGNATURE-----

Merge tag 'drm-fixes-2022-12-02' of git://anongit.freedesktop.org/drm/drm

Pull drm fixes from Dave Airlie:
 "Things do seem to have finally settled down, just four i915 and one
  amdgpu this week. Probably won't have much for next week if you do
  push rc8 out.

  i915:
   - Fix dram info readout
   - Remove non-existent pipes from bigjoiner pipe mask
   - Fix negative value passed as remaining time
   - Never return 0 if not all requests retired

  amdgpu:
   - VCN fix for vangogh"

* tag 'drm-fixes-2022-12-02' of git://anongit.freedesktop.org/drm/drm:
  drm/amdgpu: enable Vangogh VCN indirect sram mode
  drm/i915: Never return 0 if not all requests retired
  drm/i915: Fix negative value passed as remaining time
  drm/i915: Remove non-existent pipes from bigjoiner pipe mask
  drm/i915/mtl: Fix dram info readout
2022-12-02 15:35:21 -08:00
Linus Torvalds
bdaa78c6aa 15 hotfixes. 11 marked cc:stable. Only three or four of the latter
address post-6.0 issues, which is hopefully a sign that things are
 converging.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCY4pQpQAKCRDdBJ7gKXxA
 jquxAP9Lqif7CGDgdq8uWY2hHS/Ujc3k7Ohgyzs37olnCuU8KwEA6/J7SpjsBgtY
 OfzvnwxpCTh8Kfzu/oNckIHo/EEiIA8=
 =o6qT
 -----END PGP SIGNATURE-----

Merge tag 'mm-hotfixes-stable-2022-12-02' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Pull misc hotfixes from Andrew Morton:
 "15 hotfixes,  11 marked cc:stable.

  Only three or four of the latter address post-6.0 issues, which is
  hopefully a sign that things are converging"

* tag 'mm-hotfixes-stable-2022-12-02' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:
  revert "kbuild: fix -Wimplicit-function-declaration in license_is_gpl_compatible"
  Kconfig.debug: provide a little extra FRAME_WARN leeway when KASAN is enabled
  drm/amdgpu: temporarily disable broken Clang builds due to blown stack-frame
  mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths
  mm/khugepaged: fix GUP-fast interaction by sending IPI
  mm/khugepaged: take the right locks for page table retraction
  mm: migrate: fix THP's mapcount on isolation
  mm: introduce arch_has_hw_nonleaf_pmd_young()
  mm: add dummy pmd_young() for architectures not having it
  mm/damon/sysfs: fix wrong empty schemes assumption under online tuning in damon_sysfs_set_schemes()
  tools/vm/slabinfo-gnuplot: use "grep -E" instead of "egrep"
  nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry()
  hugetlb: don't delete vma_lock in hugetlb MADV_DONTNEED processing
  madvise: use zap_page_range_single for madvise dontneed
  mm: replace VM_WARN_ON to pr_warn if the node is offline with __GFP_THISNODE
2022-12-02 13:39:38 -08:00
Linus Torvalds
6647e76ab6 v4l2: don't fall back to follow_pfn() if pin_user_pages_fast() fails
The V4L2_MEMORY_USERPTR interface is long deprecated and shouldn't be
used (and is discouraged for any modern v4l drivers).  And Seth Jenkins
points out that the fallback to VM_PFNMAP/VM_IO is fundamentally racy
and dangerous.

Note that it's not even a case that should trigger, since any normal
user pointer logic ends up just using the pin_user_pages_fast() call
that does the proper page reference counting.  That's not the problem
case, only if you try to use special device mappings do you have any
issues.

Normally I'd just remove this during the merge window, but since Seth
pointed out the problem cases, we really want to know as soon as
possible if there are actually any users of this odd special case of a
legacy interface.  Neither Hans nor Mauro seem to think that such
mis-uses of the old legacy interface should exist.  As Mauro says:

 "See, V4L2 has actually 4 streaming APIs:
        - Kernel-allocated mmap (usually referred simply as just mmap);
        - USERPTR mmap;
        - read();
        - dmabuf;

  The USERPTR is one of the oldest way to use it, coming from V4L
  version 1 times, and by far the least used one"

And Hans chimed in on the USERPTR interface:

 "To be honest, I wouldn't mind if it goes away completely, but that's a
  bit of a pipe dream right now"

but while removing this legacy interface entirely may be a pipe dream we
can at least try to remove the unlikely (and actively broken) case of
using special device mappings for USERPTR accesses.

This replaces it with a WARN_ONCE() that we can remove once we've
hopefully confirmed that no actual users exist.

NOTE! Longer term, this means that a 'struct frame_vector' only ever
contains proper page pointers, and all the games we have with converting
them to pages can go away (grep for 'frame_vector_to_pages()' and the
uses of 'vec->is_pfns').  But this is just the first step, to verify
that this code really is all dead, and do so as quickly as possible.

Reported-by: Seth Jenkins <sethjenkins@google.com>
Acked-by: Hans Verkuil <hverkuil@xs4all.nl>
Acked-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Cc: David Hildenbrand <david@redhat.com>
Cc: Jan Kara <jack@suse.cz>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2022-12-02 13:33:57 -08:00
Jens Axboe
d0f411c0b9 nvme fixes for Linux 6.1
- fix SRCU protection of nvme_ns_head list (Caleb Sander)
  - clear the prp2 field when not used (Lei Rao)
 -----BEGIN PGP SIGNATURE-----
 
 iQI/BAABCgApFiEEgdbnc3r/njty3Iq9D55TZVIEUYMFAmOJxmMLHGhjaEBsc3Qu
 ZGUACgkQD55TZVIEUYOMmg//V5SBQ+Y7+j2ZtUYrJ8TnV9HehCwBTkoLXvsOOto7
 AFbEfsqFmWEVttCZCyKHlAliwZZc5JonPT6PSxEgf6vLeFo4Ijpgl/k9I7L3FBgm
 6ZsztVTZH2/FV5eUPHn5/TEdJ7vJkDM3S/uH0RbrZQpdP0qfEgwrgloVpvXa4dj+
 jqw8W97oR6dpgGgLm/9IXhQFxVz3inff8iaOWl2ihGK1QlujZFY1sd67mSrfiwhN
 w70pH1MNYDe2IjgegjfElywUGvZM5nkLtQKZD7wK9nPOZxep/SPtnYvVGweJCOyt
 qSgknVw9vAH4MnbqJ9GSF66d6LcXdzW71d8RMR1tx+Y3Ib+0vlVcxk3L7MPsfSYH
 2bMgPmmUg/PZxFuxQ51Tyor75zlqLTH069p/AAxS5gyLW1CHk8GUPognGEb+PPFc
 8nZsomSLozxBwqD5vb+gKLo9aPKn1pZhKIRwVTabPeVu91IW/u0iuBibH6O8Ou1Y
 YiKRwYI9RoXD9PxtahjL0ONSvWriR1lXhAW/iE5ViTSqao9/jqHvy16VPW86fjr7
 LrTos7wBBHDWCvwlQTErKwcJUr1Y68at8A4zKewNQDCWGRBQ150JV7hqvguUtqNE
 +lkotIok4YXTcF9GMozIFRxt/nWs8e7eR67/D8WgJqlCXf8BinqOMnN3//qXZkCE
 YIw=
 =K3vx
 -----END PGP SIGNATURE-----

Merge tag 'nvme-6.1-2022-01-02' of git://git.infradead.org/nvme into block-6.1

Pull NVMe fixes from Christoph:

"nvme fixes for Linux 6.1

 - fix SRCU protection of nvme_ns_head list (Caleb Sander)
 - clear the prp2 field when not used (Lei Rao)"

* tag 'nvme-6.1-2022-01-02' of git://git.infradead.org/nvme:
  nvme: fix SRCU protection of nvme_ns_head list
  nvme-pci: clear the prp2 field when not used
2022-12-02 08:01:06 -07:00
Xiongfeng Wang
4bedbbd782 iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init()
for_each_pci_dev() is implemented by pci_get_device(). The comment of
pci_get_device() says that it will increase the reference count for the
returned pci_dev and also decrease the reference count for the input
pci_dev @from if it is not NULL.

If we break for_each_pci_dev() loop with pdev not NULL, we need to call
pci_dev_put() to decrease the reference count. Add the missing
pci_dev_put() for the error path to avoid reference count leak.

Fixes: 2e45528930 ("iommu/vt-d: Unify the way to process DMAR device scope array")
Signed-off-by: Xiongfeng Wang <wangxiongfeng2@huawei.com>
Link: https://lore.kernel.org/r/20221121113649.190393-3-wangxiongfeng2@huawei.com
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
2022-12-02 11:45:33 +01:00
Xiongfeng Wang
afca9e19cc iommu/vt-d: Fix PCI device refcount leak in has_external_pci()
for_each_pci_dev() is implemented by pci_get_device(). The comment of
pci_get_device() says that it will increase the reference count for the
returned pci_dev and also decrease the reference count for the input
pci_dev @from if it is not NULL.

If we break for_each_pci_dev() loop with pdev not NULL, we need to call
pci_dev_put() to decrease the reference count. Add the missing
pci_dev_put() before 'return true' to avoid reference count leak.

Fixes: 89a6079df7 ("iommu/vt-d: Force IOMMU on for platform opt in hint")
Signed-off-by: Xiongfeng Wang <wangxiongfeng2@huawei.com>
Link: https://lore.kernel.org/r/20221121113649.190393-2-wangxiongfeng2@huawei.com
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
2022-12-02 11:45:32 +01:00
Yang Yingliang
6927d35238 iommu/vt-d: Fix PCI device refcount leak in prq_event_thread()
As comment of pci_get_domain_bus_and_slot() says, it returns a pci device
with refcount increment, when finish using it, the caller must decrease
the reference count by calling pci_dev_put(). So call pci_dev_put() after
using the 'pdev' to avoid refcount leak.

Besides, if the 'pdev' is null or intel_svm_prq_report() returns error,
there is no need to trace this fault.

Fixes: 06f4b8d09d ("iommu/vt-d: Remove unnecessary SVA data accesses in page fault path")
Suggested-by: Lu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Link: https://lore.kernel.org/r/20221119144028.2452731-1-yangyingliang@huawei.com
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
2022-12-02 11:45:32 +01:00
Jacob Pan
e65a6897be iommu/vt-d: Add a fix for devices need extra dtlb flush
QAT devices on Intel Sapphire Rapids and Emerald Rapids have a defect in
address translation service (ATS). These devices may inadvertently issue
ATS invalidation completion before posted writes initiated with
translated address that utilized translations matching the invalidation
address range, violating the invalidation completion ordering.

This patch adds an extra device TLB invalidation for the affected devices,
it is needed to ensure no more posted writes with translated address
following the invalidation completion. Therefore, the ordering is
preserved and data-corruption is prevented.

Device TLBs are invalidated under the following six conditions:
1. Device driver does DMA API unmap IOVA
2. Device driver unbind a PASID from a process, sva_unbind_device()
3. PASID is torn down, after PASID cache is flushed. e.g. process
exit_mmap() due to crash
4. Under SVA usage, called by mmu_notifier.invalidate_range() where
VM has to free pages that were unmapped
5. userspace driver unmaps a DMA buffer
6. Cache invalidation in vSVA usage (upcoming)

For #1 and #2, device drivers are responsible for stopping DMA traffic
before unmap/unbind. For #3, iommu driver gets mmu_notifier to
invalidate TLB the same way as normal user unmap which will do an extra
invalidation. The dTLB invalidation after PASID cache flush does not
need an extra invalidation.

Therefore, we only need to deal with #4 and #5 in this patch. #1 is also
covered by this patch due to common code path with #5.

Tested-by: Yuzhang Luo <yuzhang.luo@intel.com>
Reviewed-by: Ashok Raj <ashok.raj@intel.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Signed-off-by: Jacob Pan <jacob.jun.pan@linux.intel.com>
Link: https://lore.kernel.org/r/20221130062449.1360063-1-jacob.jun.pan@linux.intel.com
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
2022-12-02 11:45:31 +01:00
Dave Airlie
c082fbd687 Merge tag 'amd-drm-fixes-6.1-2022-12-01' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes
amd-drm-fixes-6.1-2022-12-01:

amdgpu:
- VCN fix for vangogh

Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Alex Deucher <alexander.deucher@amd.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20221201202015.5931-1-alexander.deucher@amd.com
2022-12-02 09:12:46 +10:00
Andrew Lunn
d36678f790 i2c: imx: Only DMA messages with I2C_M_DMA_SAFE flag set
Recent changes to the DMA code has resulting in the IMX driver failing
I2C transfers when the buffer has been vmalloc. Only perform DMA
transfers if the message has the I2C_M_DMA_SAFE flag set, indicating
the client is providing a buffer which is DMA safe.

This is a minimal fix for stable. The I2C core provides helpers to
allocate a bounce buffer. For a fuller fix the master should make use
of these helpers.

Fixes: 4544b9f25e ("dma-mapping: Add vmap checks to dma_map_single()")
Signed-off-by: Andrew Lunn <andrew@lunn.ch>
Acked-by: Oleksij Rempel <o.rempel@pengutronix.de>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
2022-12-02 00:12:25 +01:00
Wang Yufen
7d8ccf4f11 i2c: qcom-geni: fix error return code in geni_i2c_gpi_xfer
Fix to return a negative error code from the gi2c->err instead of
0.

Fixes: d8703554f4 ("i2c: qcom-geni: Add support for GPI DMA")
Signed-off-by: Wang Yufen <wangyufen@huawei.com>
Reviewed-by: Tommaso Merciai <tommaso.merciai@amarulasoluitons.com>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
2022-12-01 23:55:22 +01:00
Carsten Haitzler
8bfd4ec726 i2c: cadence: Fix regression with bus recovery
Commit "i2c: cadence: Add standard bus recovery support" breaks for i2c
devices that have no pinctrl defined. There is no requirement for this
to exist in the DT. This has worked perfectly well without this before in
at least 1 real usage case on hardware (Mali Komeda DPU, Cadence i2c to
talk to a tda99xx phy). Adding the requirement to have pinctrl set up in
the device tree (or otherwise be found) is a regression where the whole
i2c device is lost entirely (in this case dropping entire devices which
then leads to the drm display stack unable to find the phy for display
output, thus having no drm display device and so on down the chain).

This converts the above commit to an enhancement if pinctrl can be found
for the i2c device, providing a timeout on read with recovery, but if not,
do what used to be done rather than a fatal loss of a device.

This restores the mentioned display devices to their working state again.

Fixes: 58b924241d ("i2c: cadence: Add standard bus recovery support")
Signed-off-by: Carsten Haitzler <carsten.haitzler@arm.com>
Reviewed-by: Shubhrajyoti Datta <shubhrajyoti.datta@amd.com>
Reviewed-by: Michael Grzeschik <m.grzeschik@pengutronix.de>
Acked-by: Michal Simek <michal.simek@amd.com>
[wsa: added braces to else-branch]
Signed-off-by: Wolfram Sang <wsa@kernel.org>
2022-12-01 23:55:12 +01:00
Dave Airlie
65a388250e Merge tag 'drm-intel-fixes-2022-12-01' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes
- Fix dram info readout (Radhakrishna Sripada)
- Remove non-existent pipes from bigjoiner pipe mask (Ville Syrjälä)
- Fix negative value passed as remaining time (Janusz Krzysztofik)
- Never return 0 if not all requests retired (Janusz Krzysztofik)

Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Tvrtko Ursulin <tvrtko.ursulin@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/Y4hp+a3TJ13t2ZA1@tursulin-desk
2022-12-02 07:34:28 +10:00
Steven Rostedt (Google)
a4412fdd49 error-injection: Add prompt for function error injection
The config to be able to inject error codes into any function annotated
with ALLOW_ERROR_INJECTION() is enabled when FUNCTION_ERROR_INJECTION is
enabled.  But unfortunately, this is always enabled on x86 when KPROBES
is enabled, and there's no way to turn it off.

As kprobes is useful for observability of the kernel, it is useful to
have it enabled in production environments.  But error injection should
be avoided.  Add a prompt to the config to allow it to be disabled even
when kprobes is enabled, and get rid of the "def_bool y".

This is a kernel debug feature (it's in Kconfig.debug), and should have
never been something enabled by default.

Cc: stable@vger.kernel.org
Fixes: 540adea380 ("error-injection: Separate error-injection from kprobe")
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2022-12-01 13:14:21 -08:00
Leo Liu
9a8cc8cabc drm/amdgpu: enable Vangogh VCN indirect sram mode
So that uses PSP to initialize HW.

Fixes: 0c2c02b66c ("drm/amdgpu/vcn: add firmware support for dimgrey_cavefish")
Signed-off-by: Leo Liu <leo.liu@amd.com>
Reviewed-by: James Zhu <James.Zhu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
2022-12-01 15:09:49 -05:00
Palmer Dabbelt
39cefc5f6c
RISC-V: Fix a race condition during kernel stack overflow
This fixes a concrete bug but is also the basis for some cleanup work,
so I'm merging it based on the offending commit in order to minimize
future conflicts.

* commit '7e1864332fbc1b993659eab7974da9fe8bf8c128':
  riscv: fix race when vmap stack overflow
2022-12-01 11:38:39 -08:00
Linus Torvalds
355479c70a Final EFI fix for v6.1
- Revert runtime service sync exception recovery on arm64
 -----BEGIN PGP SIGNATURE-----
 
 iQGzBAABCgAdFiEE+9lifEBpyUIVN1cpw08iOZLZjyQFAmOIsLoACgkQw08iOZLZ
 jyQspgv7BFM/z+PXeKCPee6uGUhNCjUoKP3Pnoo9jwe3sbSVagYUZZ5/vx01Ei33
 FHDi4FeSxo+adg2tb8xf8X5tZmfHYiQM5gEqK3xZXaBSJRT7FFY9+eRL6753Qe5W
 yxn220/nI9xTErGeEAabAHIngIOpth5nGQhRDQbM8r7EZDobGUu0NrJSRVnS7IBF
 Ov14VMkfqryInnJ8tzHwP4hz40Rrkf54dgNTPyJvUxJ3LCR5TqmeRp+16CZg87By
 CnmySayLnr+YLbZjp8vmQy9eUGVf4acPoDcXfBTe/lkE1BA4Qi+Hd/TaYgE8Fj0C
 B5g+sZa3khhaQc4Oc2RMOqpxK80DK41n1Vvy1UOZGOBFgZVoxT2bmDbAPohLyU/4
 lw6LqioDR2N4ZxiANGHuOVa8so8iY+Et30fLqRkeXj1TXqC84tDoxXGhsTEjF1Ad
 Vi0GGmrj4No4l0RM+4yGZIhNMaMGd5OhGdbwAiKUaLS9UyjvfqkaLGJ9S2wYVgZj
 R1PoDRWX
 =r/C6
 -----END PGP SIGNATURE-----

Merge tag 'efi-fixes-for-v6.1-4' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi

Pull EFI fix from Ard Biesheuvel:
 "A single revert for some code that I added during this cycle. The code
  is not wrong, but it should be a bit more careful about how to handle
  the shadow call stack pointer, so it is better to revert it for now
  and bring it back later in improved form.

  Summary:

   - Revert runtime service sync exception recovery on arm64"

* tag 'efi-fixes-for-v6.1-4' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi:
  arm64: efi: Revert "Recover from synchronous exceptions ..."
2022-12-01 11:25:11 -08:00
Linus Torvalds
e214dd935b hwmon fixes for v6.1-rc8
- Fix refcount leak and NULL pointer access in coretemp driver
 
 - Fix UAF in ibmpex driver
 
 - Add missing pci_disable_device() to i5500_temp driver
 
 - Fix calculation in ina3221 driver
 
 - Fix temperature scaling in ltc2947 driver
 
 - Check result of devm_kcalloc call in asus-ec-sensors driver
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEiHPvMQj9QTOCiqgVyx8mb86fmYEFAmOI4z8ACgkQyx8mb86f
 mYGkVw//bRNXzSxR7CVZsukTBId3rnztk0Nzg3tJAkTBwoJknNBm1BpbpENTmnBt
 ir07aRhAkM/Vu4532kP8TOpe2k6gLbehzGmJIt3Eg3QB0/3CnwJcHVLEFwK/KeZH
 5I1fw8K7NWVsyD/9s4MA5E/qNFJh5YW8VgAQCMi+dYuc67erFJQFLG8o6aby7W1B
 aYH9cRp+ZjV2n8Y+tsh/GNe694ln9wKiCa5RlbspC8tiHH+RAcUdtscFX1tL5oxR
 iDAJ3A0F3de39hrCHE4LErZ4UcvNdCnGJzlmBIRkxSoSbbpbwNDDsswsJuZZ9NtD
 ErSc3zqKGS/dsbsLhMm8Ny0WcwEj1qIfg4Wfk8uAYFraiBYpQ+NITDtRN36mQoIL
 8WBzqs9n8pNnI3qQ602g24txlSYKLXvMgKoDYyglcRQkOca2Y13iGspK+QWQISRO
 pCkelFwlG/0JkR9ez11AxUOYAecwudgTMAlSd5YomxYT9fUq7zb8nWPokHLGrWCA
 paQgvJy+mmIt/3CZY2J3ecjoleuySqsVrWSQcUrLoYQ/wDIULKtNQGD6CAcYMtH4
 /A6Q4ZTH8lU+btYxTpc0FkUBxgkYISl1BC1Xa/ml20SLjWVbXklzlDf6Woqp9nz1
 bvwyzKW+SA56Dmf3D4/NIU6AJ7LgYTHBf7/rhp8xSaooY/aKVdY=
 =MhQc
 -----END PGP SIGNATURE-----

Merge tag 'hwmon-for-v6.1-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging

Pull hwmon fixes from Guenter Roeck:

 - Fix refcount leak and NULL pointer access in coretemp driver

 - Fix UAF in ibmpex driver

 - Add missing pci_disable_device() to i5500_temp driver

 - Fix calculation in ina3221 driver

 - Fix temperature scaling in ltc2947 driver

 - Check result of devm_kcalloc call in asus-ec-sensors driver

* tag 'hwmon-for-v6.1-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
  hwmon: (asus-ec-sensors) Add checks for devm_kcalloc
  hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new()
  hwmon: (coretemp) Check for null before removing sysfs attrs
  hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails
  hwmon: (i5500_temp) fix missing pci_disable_device()
  hwmon: (ina3221) Fix shunt sum critical calculation
  hwmon: (ltc2947) fix temperature scaling
2022-12-01 11:10:25 -08:00
Yuan Can
9bdc112be7 hwmon: (asus-ec-sensors) Add checks for devm_kcalloc
As the devm_kcalloc may return NULL, the return value needs to be checked
to avoid NULL poineter dereference.

Fixes: d0ddfd241e ("hwmon: (asus-ec-sensors) add driver for ASUS EC")
Signed-off-by: Yuan Can <yuancan@huawei.com>
Link: https://lore.kernel.org/r/20221125014329.121560-1-yuancan@huawei.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2022-12-01 09:20:55 -08:00
Yang Yingliang
7dec14537c hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new()
As comment of pci_get_domain_bus_and_slot() says, it returns
a pci device with refcount increment, when finish using it,
the caller must decrement the reference count by calling
pci_dev_put(). So call it after using to avoid refcount leak.

Fixes: 14513ee696 ("hwmon: (coretemp) Use PCI host bridge ID to identify CPU if necessary")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Link: https://lore.kernel.org/r/20221118093303.214163-1-yangyingliang@huawei.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2022-12-01 09:20:55 -08:00
Phil Auld
a89ff5f5cc hwmon: (coretemp) Check for null before removing sysfs attrs
If coretemp_add_core() gets an error then pdata->core_data[indx]
is already NULL and has been kfreed. Don't pass that to
sysfs_remove_group() as that will crash in sysfs_remove_group().

[Shortened for readability]
[91854.020159] sysfs: cannot create duplicate filename '/devices/platform/coretemp.0/hwmon/hwmon2/temp20_label'
<cpu offline>
[91855.126115] BUG: kernel NULL pointer dereference, address: 0000000000000188
[91855.165103] #PF: supervisor read access in kernel mode
[91855.194506] #PF: error_code(0x0000) - not-present page
[91855.224445] PGD 0 P4D 0
[91855.238508] Oops: 0000 [#1] PREEMPT SMP PTI
...
[91855.342716] RIP: 0010:sysfs_remove_group+0xc/0x80
...
[91855.796571] Call Trace:
[91855.810524]  coretemp_cpu_offline+0x12b/0x1dd [coretemp]
[91855.841738]  ? coretemp_cpu_online+0x180/0x180 [coretemp]
[91855.871107]  cpuhp_invoke_callback+0x105/0x4b0
[91855.893432]  cpuhp_thread_fun+0x8e/0x150
...

Fix this by checking for NULL first.

Signed-off-by: Phil Auld <pauld@redhat.com>
Cc: linux-hwmon@vger.kernel.org
Cc: Fenghua Yu <fenghua.yu@intel.com>
Cc: Jean Delvare <jdelvare@suse.com>
Cc: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20221117162313.3164803-1-pauld@redhat.com
Fixes: 199e0de7f5 ("hwmon: (coretemp) Merge pkgtemp with coretemp")
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2022-12-01 09:20:24 -08:00
Ard Biesheuvel
7572ac3c97 arm64: efi: Revert "Recover from synchronous exceptions ..."
This reverts commit 23715a26c8, which introduced some code in
assembler that manipulates both the ordinary and the shadow call stack
pointer in a way that could potentially be taken advantage of. So let's
revert it, and do a better job the next time around.

Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
2022-12-01 14:48:26 +01:00