renegade-project/linux-next
2
0
Fork 0
mirror of https://github.com/edk2-porting/linux-next.git synced 2024-12-21 03:33:59 +08:00
Code
1,044,188 Commits 41 Branches 2 Tags 3.4 GiB
fadb7ff1a6
Commit Graph

1044188 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Linus Torvalds
f84fc4e36c s390 update for v5.15-rc5 
- Fix potential memory leak on a error path in eBPF.
 
 - Fix handling of zpci device on reserve.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCAAdFiEE3QHqV+H2a8xAv27vjYWKoQLXFBgFAmFg0FoACgkQjYWKoQLX
 FBg3jgf8DLCs6JwK8GOz40CuZsajARwuagZy0udc3GbcZVNUog6GP7hJBU6q8pkm
 JQMTl1C7Pe81p/aTOx2IIplV+owAVRnwdNBmj/psmZrI5P0CvLtTc4gVuCZJHJy4
 9qt83KocgrN4G2K7qZDfiEAv+Ae/F7r20K5ZBX0exZBkOFeXZzUYVwWxM3pV45XB
 Zx5AWmpHGGZFaS3EKW7E5VqswlGYIfUzGaXezN/cIl5HzMqqQMYo77eCJAWr//1z
 s2s+vvEUBLGuHS8pDdXq8qR7Fq93cJSS7eo5zLVgtyZHr3Nn3+IlA0WKmPU3SmPE
 +19I3L5hR0Ap6xh4ASgxciexnXFttQ==
 =bGB2
 -----END PGP SIGNATURE-----

Merge tag 's390-5.15-5' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux

Pull s390 fixes from Vasily Gorbik:

 - Fix potential memory leak on a error path in eBPF

 - Fix handling of zpci device on reserve

* tag 's390-5.15-5' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
  s390/pci: fix zpci_zdev_put() on reserve
  bpf, s390: Fix potential memory leak about jit_data
 2021-10-08 16:46:09 -07:00
Sebastian Andrzej Siewior
1413269086 mqprio: Correct stats in mqprio_dump_class_stats(). 
Introduction of lockless subqueues broke the class statistics.
Before the change stats were accumulated in `bstats' and `qstats'
on the stack which was then copied to struct gnet_dump.

After the change the `bstats' and `qstats' are initialized to 0
and never updated, yet still fed to gnet_dump. The code updates
the global qdisc->cpu_bstats and qdisc->cpu_qstats instead,
clobbering them. Most likely a copy-paste error from the code in
mqprio_dump().

__gnet_stats_copy_basic() and __gnet_stats_copy_queue() accumulate
the values for per-CPU case but for global stats they overwrite
the value, so only stats from the last loop iteration / tc end up
in sch->[bq]stats.

Use the on-stack [bq]stats variables again and add the stats manually
in the global case.

Fixes: ce679e8df7 ("net: sched: add support for TCQ_F_NOLOCK subqueues to sch_mqprio")
Cc: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
https://lore.kernel.org/all/20211007175000.2334713-2-bigeasy@linutronix.de/
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 2021-10-08 16:27:22 -07:00
Jakub Kicinski
bccf56c4cb Merge branch 'dsa-bridge-tx-forwarding-offload-fixes-part-1' 
Vladimir Oltean says:

====================
DSA bridge TX forwarding offload fixes - part 1

This is part 1 of a series of fixes to the bridge TX forwarding offload
feature introduced for v5.15. Sadly, the other fixes are so intrusive
that they cannot be reasonably be sent to the "net" tree, as they also
include API changes. So they are left as part 2 for net-next.
====================

Link: https://lore.kernel.org/r/20211007164711.2897238-1-vladimir.oltean@nxp.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 2021-10-08 15:47:49 -07:00
Vladimir Oltean
5bded8259e net: dsa: mv88e6xxx: isolate the ATU databases of standalone and bridged ports 
Similar to commit 6087175b79 ("net: dsa: mt7530: use independent VLAN
learning on VLAN-unaware bridges"), software forwarding between an
unoffloaded LAG port (a bonding interface with an unsupported policy)
and a mv88e6xxx user port directly under a bridge is broken.

We adopt the same strategy, which is to make the standalone ports not
find any ATU entry learned on a bridge port.

Theory: the mv88e6xxx ATU is looked up by FID and MAC address. There are
as many FIDs as VIDs (4096). The FID is derived from the VID when
possible (the VTU maps a VID to a FID), with a fallback to the port
based default FID value when not (802.1Q Mode is disabled on the port,
or the classified VID isn't present in the VTU).

The mv88e6xxx driver makes the following use of FIDs and VIDs:

- the port's DefaultVID (to which untagged & pvid-tagged packets get
  classified) is 0 and is absent from the VTU, so this kind of packets is
  processed in FID 0, the default FID assigned by mv88e6xxx_setup_port.

- every time a bridge VLAN is created, mv88e6xxx_port_vlan_join() ->
  mv88e6xxx_atu_new() associates a FID with that VID which increases
  linearly starting from 1. Like this:

  bridge vlan add dev lan0 vid 100 # FID 1
  bridge vlan add dev lan1 vid 100 # still FID 1
  bridge vlan add dev lan2 vid 1024 # FID 2

The FID allocation made by the driver is sub-optimal for the following
reasons:

(a) A standalone port has a DefaultPVID of 0 and a default FID of 0 too.
    A VLAN-unaware bridged port has a DefaultPVID of 0 and a default FID
    of 0 too. The difference is that the bridged ports may learn ATU
    entries, while the standalone port has the requirement that it must
    not, and must not find them either. Standalone ports must not use
    the same FID as ports belonging to a bridge. All standalone ports
    can use the same FID, since the ATU will never have an entry in
    that FID.

(b) Multiple VLAN-unaware bridges will all use a DefaultPVID of 0 and a
    default FID of 0 on all their ports. The FDBs will not be isolated
    between these bridges. Every VLAN-unaware bridge must use the same
    FID on all its ports, different from the FID of other bridge ports.

(c) Each bridge VLAN uses a unique FID which is useful for Independent
    VLAN Learning, but the same VLAN ID on multiple VLAN-aware bridges
    will result in the same FID being used by mv88e6xxx_atu_new().
    The correct behavior is for VLAN 1 in br0 to have a different FID
    compared to VLAN 1 in br1.

This patch cannot fix all the above. Traditionally the DSA framework did
not care about this, and the reality is that DSA core involvement is
needed for the aforementioned issues to be solved. The only thing we can
solve here is an issue which does not require API changes, and that is
issue (a), aka use a different FID for standalone ports vs ports under
VLAN-unaware bridges.

The first step is deciding what VID and FID to use for standalone ports,
and what VID and FID for bridged ports. The 0/0 pair for standalone
ports is what they used up till now, let's keep using that. For bridged
ports, there are 2 cases:

- VLAN-aware ports will never end up using the port default FID, because
  packets will always be classified to a VID in the VTU or dropped
  otherwise. The FID is the one associated with the VID in the VTU.

- On VLAN-unaware ports, we _could_ leave their DefaultVID (pvid) at
  zero (just as in the case of standalone ports), and just change the
  port's default FID from 0 to a different number (say 1).

However, Tobias points out that there is one more requirement to cater to:
cross-chip bridging. The Marvell DSA header does not carry the FID in
it, only the VID. So once a packet crosses a DSA link, if it has a VID
of zero it will get classified to the default FID of that cascade port.
Relying on a port default FID for upstream cascade ports results in
contradictions: a default FID of 0 breaks ATU isolation of bridged ports
on the downstream switch, a default FID of 1 breaks standalone ports on
the downstream switch.

So not only must standalone ports have different FIDs compared to
bridged ports, they must also have different DefaultVID values.
IEEE 802.1Q defines two reserved VID values: 0 and 4095. So we simply
choose 4095 as the DefaultVID of ports belonging to VLAN-unaware
bridges, and VID 4095 maps to FID 1.

For the xmit operation to look up the same ATU database, we need to put
VID 4095 in DSA tags sent to ports belonging to VLAN-unaware bridges
too. All shared ports are configured to map this VID to the bridging
FID, because they are members of that VLAN in the VTU. Shared ports
don't need to have 802.1QMode enabled in any way, they always parse the
VID from the DSA header, they don't need to look at the 802.1Q header.

We install VID 4095 to the VTU in mv88e6xxx_setup_port(), with the
mention that mv88e6xxx_vtu_setup() which was located right below that
call was flushing the VTU so those entries wouldn't be preserved.
So we need to relocate the VTU flushing prior to the port initialization
during ->setup(). Also note that this is why it is safe to assume that
VID 4095 will get associated with FID 1: the user ports haven't been
created, so there is no avenue for the user to create a bridge VLAN
which could otherwise race with the creation of another FID which would
otherwise use up the non-reserved FID value of 1.

[ Currently mv88e6xxx_port_vlan_join() doesn't have the option of
  specifying a preferred FID, it always calls mv88e6xxx_atu_new(). ]

mv88e6xxx_port_db_load_purge() is the function to access the ATU for
FDB/MDB entries, and it used to determine the FID to use for
VLAN-unaware FDB entries (VID=0) using mv88e6xxx_port_get_fid().
But the driver only called mv88e6xxx_port_set_fid() once, during probe,
so no surprises, the port FID was always 0, the call to get_fid() was
redundant. As much as I would have wanted to not touch that code, the
logic is broken when we add a new FID which is not the port-based
default. Now the port-based default FID only corresponds to standalone
ports, and FDB/MDB entries belong to the bridging service. So while in
the future, when the DSA API will support FDB isolation, we will have to
figure out the FID based on the bridge number, for now there's a single
bridging FID, so hardcode that.

Lastly, the tagger needs to check, when it is transmitting a VLAN
untagged skb, whether it is sending it towards a bridged or a standalone
port. When we see it is bridged we assume the bridge is VLAN-unaware.
Not because it cannot be VLAN-aware but:

- if we are transmitting from a VLAN-aware bridge we are likely doing so
  using TX forwarding offload. That code path guarantees that skbs have
  a vlan hwaccel tag in them, so we would not enter the "else" branch
  of the "if (skb->protocol == htons(ETH_P_8021Q))" condition.

- if we are transmitting on behalf of a VLAN-aware bridge but with no TX
  forwarding offload (no PVT support, out of space in the PVT, whatever),
  we would indeed be transmitting with VLAN 4095 instead of the bridge
  device's pvid. However we would be injecting a "From CPU" frame, and
  the switch won't learn from that - it only learns from "Forward" frames.
  So it is inconsequential for address learning. And VLAN 4095 is
  absolutely enough for the frame to exit the switch, since we never
  remove that VLAN from any port.

Fixes: 57e661aae6 ("net: dsa: mv88e6xxx: Link aggregation support")
Reported-by: Tobias Waldekranz <tobias@waldekranz.com>
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 2021-10-08 15:47:46 -07:00
Vladimir Oltean
8b6836d824 net: dsa: mv88e6xxx: keep the pvid at 0 when VLAN-unaware 
The VLAN support in mv88e6xxx has a loaded history. Commit 2ea7a679ca
("net: dsa: Don't add vlans when vlan filtering is disabled") noticed
some issues with VLAN and decided the best way to deal with them was to
make the DSA core ignore VLANs added by the bridge while VLAN awareness
is turned off. Those issues were never explained, just presented as
"at least one corner case".

That approach had problems of its own, presented by
commit 54a0ed0df4 ("net: dsa: provide an option for drivers to always
receive bridge VLANs") for the DSA core, followed by
commit 1fb7419198 ("net: dsa: mv88e6xxx: fix vlan setup") which
applied ds->configure_vlan_while_not_filtering = true for mv88e6xxx in
particular.

We still don't know what corner case Andrew saw when he wrote
commit 2ea7a679ca ("net: dsa: Don't add vlans when vlan filtering is
disabled"), but Tobias now reports that when we use TX forwarding
offload, pinging an external station from the bridge device is broken if
the front-facing DSA user port has flooding turned off. The full
description is in the link below, but for short, when a mv88e6xxx port
is under a VLAN-unaware bridge, it inherits that bridge's pvid.
So packets ingressing a user port will be classified to e.g. VID 1
(assuming that value for the bridge_default_pvid), whereas when
tag_dsa.c xmits towards a user port, it always sends packets using a VID
of 0 if that port is standalone or under a VLAN-unaware bridge - or at
least it did so prior to commit d82f8ab0d8 ("net: dsa: tag_dsa:
offload the bridge forwarding process").

In any case, when there is a conversation between the CPU and a station
connected to a user port, the station's MAC address is learned in VID 1
but the CPU tries to transmit through VID 0. The packets reach the
intended station, but via flooding and not by virtue of matching the
existing ATU entry.

DSA has established (and enforced in other drivers: sja1105, felix,
mt7530) that a VLAN-unaware port should use a private pvid, and not
inherit the one from the bridge. The bridge's pvid should only be
inherited when that bridge is VLAN-aware, so all state transitions need
to be handled. On the other hand, all bridge VLANs should sit in the VTU
starting with the moment when the bridge offloads them via switchdev,
they are just not used.

This solves the problem that Tobias sees because packets ingressing on
VLAN-unaware user ports now get classified to VID 0, which is also the
VID used by tag_dsa.c on xmit.

Fixes: d82f8ab0d8 ("net: dsa: tag_dsa: offload the bridge forwarding process")
Link: https://patchwork.kernel.org/project/netdevbpf/patch/20211003222312.284175-2-vladimir.oltean@nxp.com/#24491503
Reported-by: Tobias Waldekranz <tobias@waldekranz.com>
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 2021-10-08 15:47:46 -07:00
Vladimir Oltean
c7709a02c1 net: dsa: tag_dsa: send packets with TX fwd offload from VLAN-unaware bridges using VID 0 
The present code is structured this way due to an incomplete thought
process. In Documentation/networking/switchdev.rst we document that if a
bridge is VLAN-unaware, then the presence or lack of a pvid on a bridge
port (or on the bridge itself, for that matter) should not affect the
ability to receive and transmit tagged or untagged packets.

If the bridge on behalf of which we are sending this packet is
VLAN-aware, then the TX forwarding offload API ensures that the skb will
be VLAN-tagged (if the packet was sent by user space as untagged, it
will get transmitted town to the driver as tagged with the bridge
device's pvid). But if the bridge is VLAN-unaware, it may or may not be
VLAN-tagged. In fact the logic to insert the bridge's PVID came from the
idea that we should emulate what is being done in the VLAN-aware case.
But we shouldn't.

It appears that injecting packets using a VLAN ID of 0 serves the
purpose of forwarding the packets to the egress port with no VLAN tag
added or stripped by the hardware, and no filtering being performed.
So we can simply remove the superfluous logic.

One reason why this logic is broken is that when CONFIG_BRIDGE_VLAN_FILTERING=n,
we call br_vlan_get_pvid_rcu() but that returns an error and we do error
out, dropping all packets on xmit. Not really smart. This is also an
issue when the user deletes the bridge pvid:

$ bridge vlan del dev br0 vid 1 self

As mentioned, in both cases, packets should still flow freely, and they
do just that on any net device where the bridge is not offloaded, but on
mv88e6xxx they don't.

Fixes: d82f8ab0d8 ("net: dsa: tag_dsa: offload the bridge forwarding process")
Reported-by: Andrew Lunn <andrew@lunn.ch>
Link: https://patchwork.kernel.org/project/netdevbpf/patch/20211003155141.2241314-1-andrew@lunn.ch/
Link: https://patchwork.kernel.org/project/netdevbpf/patch/20210928233708.1246774-1-vladimir.oltean@nxp.com/
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 2021-10-08 15:47:45 -07:00
Vladimir Oltean
1bec0f0506 net: dsa: fix bridge_num not getting cleared after ports leaving the bridge 
The dp->bridge_num is zero-based, with -1 being the encoding for an
invalid value. But dsa_bridge_num_put used to check for an invalid value
by comparing bridge_num with 0, which is of course incorrect.

The result is that the bridge_num will never get cleared by
dsa_bridge_num_put, and further port joins to other bridges will get a
bridge_num larger than the previous one, and once all the available
bridges with TX forwarding offload supported by the hardware get
exhausted, the TX forwarding offload feature is simply disabled.

In the case of sja1105, 7 iterations of the loop below are enough to
exhaust the TX forwarding offload bits, and further bridge joins operate
without that feature.

ip link add br0 type bridge vlan_filtering 1

while :; do
        ip link set sw0p2 master br0 && sleep 1
        ip link set sw0p2 nomaster && sleep 1
done

This issue is enough of an indication that having the dp->bridge_num
invalid encoding be a negative number is prone to bugs, so this will be
changed to a one-based value, with the dp->bridge_num of zero being the
indication of no bridge. However, that is material for net-next.

Fixes: f5e165e72b ("net: dsa: track unique bridge numbers across all DSA switch trees")
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 2021-10-08 15:47:45 -07:00
Linus Torvalds
5d6ab0bb40 Xtensa fixes for v5.15: 
- fix build/boot issues caused by CONFIG_OF vs CONFIC_USE_OF usage
 - fix reset handler for xtfpga boards
 -----BEGIN PGP SIGNATURE-----
 
 iQJHBAABCgAxFiEEK2eFS5jlMn3N6xfYUfnMkfg/oEQFAmFgeqATHGpjbXZia2Jj
 QGdtYWlsLmNvbQAKCRBR+cyR+D+gRPi0EACQ+lqEduaubNjfhqHvT7oZG+y/RGVP
 dKB9rnVhlKUqvudsjR0wIPrHbRA8fEL3w+SfN2HW6D/uR08cwB/e4eIUVZPabZxj
 16LUv0mujoAApAPT8Qw+VdbjbbrChlnC8Hc8rpDbbyvs5qBiwc396yunumijGJtu
 iNkgSNziHXdKY8XfchHXMzfLWEdKXk6FEQcSvdzkUVqHUsjmh6HNFm9C146GrMQK
 UC1F29lRTx/kJov/cNn7WeQt14ceeXAIAESSYP3lwCc2/CQ4mq1Nrzh2j/NPBayf
 h2V97wZyOhALgGZcl3lNDfE6nY6nv4YUHidtCI5ZR2nYDmKQinioi6KDy8rIRKb3
 1bNFwUpxVxmH3SZSM6ATNyN68G7whf/zhLY7WXTRQ9g4m63g2uFh3jH+/B2SWGSH
 cpgHWWHbTGNQGtbm/vpudLfgmFDJklg5BiornEXBJDsKfStDr9ZBrTR7Azf2WbPV
 9vdd75ZhRoHX9LeB+EhpI1BpfBfGxpcxmNJ/vwSVW5VAAVi0cXsLY1fCA6gmHNLf
 L6KFGv0mVjy3nwWWfZ5umorsUcz5vyszbgNgfvGjFitAqIhEmd1BatYIsueF0uwE
 vf/iEJS7Tn0Si53lkmSKNTj0Yc7RUKADkMX7nay7wKaDkjZIVv8aqKoYPldCV5ly
 gI8ff7rDKjZBwQ==
 =kGqD
 -----END PGP SIGNATURE-----

Merge tag 'xtensa-20211008' of git://github.com/jcmvbkbc/linux-xtensa

Pull xtensa fixes from Max Filippov:

 - fix build/boot issues caused by CONFIG_OF vs CONFIC_USE_OF usage

 - fix reset handler for xtfpga boards

* tag 'xtensa-20211008' of git://github.com/jcmvbkbc/linux-xtensa:
  xtensa: xtfpga: Try software restart before simulating CPU reset
  xtensa: xtfpga: use CONFIG_USE_OF instead of CONFIG_OF
  xtensa: call irqchip_init only when CONFIG_USE_OF is selected
  xtensa: use CONFIG_USE_OF instead of CONFIG_OF
 2021-10-08 13:05:39 -07:00
Linus Torvalds
3946b46cab xen: branch for v5.15-rc5 
-----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQRTLbB6QfY48x44uB6AXGG7T9hjvgUCYWBSIwAKCRCAXGG7T9hj
 vrXxAP9na1EqRJ+SpWyvxHY1jMaIrbg1bgnOc+GsnWxU5liW5AEA4h1HjHtVtrzL
 3vweIS6u2fanrWlYML/daQ3r6EuLPQc=
 =iXsP
 -----END PGP SIGNATURE-----

Merge tag 'for-linus-5.15b-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip

Pull xen fixes from Juergen Gross:

 - fix two minor issues in the Xen privcmd driver plus a cleanup patch
   for that driver

 - fix multiple issues related to running as PVH guest and some related
   earlyprintk fixes for other Xen guest types

 - fix an issue introduced in 5.15 the Xen balloon driver

* tag 'for-linus-5.15b-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
  xen/balloon: fix cancelled balloon action
  xen/x86: adjust data placement
  x86/PVH: adjust function/data placement
  xen/x86: hook up xen_banner() also for PVH
  xen/x86: generalize preferred console model from PV to PVH Dom0
  xen/x86: make "earlyprintk=xen" work for HVM/PVH DomU
  xen/x86: allow "earlyprintk=xen" to work for PV Dom0
  xen/x86: make "earlyprintk=xen" work better for PVH Dom0
  xen/x86: allow PVH Dom0 without XEN_PV=y
  xen/x86: prevent PVH type from getting clobbered
  xen/privcmd: drop "pages" parameter from xen_remap_pfn()
  xen/privcmd: fix error handling in mmap-resource processing
  xen/privcmd: replace kcalloc() by kvcalloc() when allocating empty pages
 2021-10-08 12:55:23 -07:00
Linus Torvalds
0dcf60d001 asm-generic: build fixes for v5.15 
There is one build fix for Arm platforms that ended up impacting most
 architectures because of the way the drivers/firmware Kconfig file is
 wired up:
 
 The CONFIG_QCOM_SCM dependency have caused a number of randconfig
 regressions over time, and some still remain in v5.15-rc4. The
 fix we agreed on in the end is to make this symbol selected by any
 driver using it, and then building it even for non-Arm platforms with
 CONFIG_COMPILE_TEST.
 
 To make this work on all architectures, the drivers/firmware/Kconfig
 file needs to be included for all architectures to make the symbol
 itself visible.
 
 In a separate discussion, we found that a sound driver patch that is
 pending for v5.16 needs the same change to include this Kconfig file,
 so the easiest solution seems to have my Kconfig rework included in v5.15.
 
 There is a small merge conflict against an earlier partial fix for the
 QCOM_SCM dependency problems.
 
 Finally, the branch also includes a small unrelated build fix for NOMMU
 architectures.
 
 Link: https://lore.kernel.org/all/20210928153508.101208f8@canb.auug.org.au/
 Link: https://lore.kernel.org/all/20210928075216.4193128-1-arnd@kernel.org/
 Link: https://lore.kernel.org/all/20211007151010.333516-1-arnd@kernel.org/
 Signed-off-by: Arnd Bergmann <arnd@arndb.de>
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmFgVp8ACgkQmmx57+YA
 GNlQoA/+O0ljtTy5D0MjRGmFDs11M5AtKNrfys82lm2GeEnc4lnxn722jLk8kR6s
 y6DSOWFs7w1bqhKExQNehZYtJO3sgW/9qiLMV9qfOx1Nc6WwhDPcYM9bMyGlpTmL
 M456nh8NopixV7slanNtfz1e0kbMKoK+4Ub7M5OHepK6x9FKQXQYQpeoBxaXHmWZ
 9eaRiL/CsRHO/cSkvpq1GtL7IVrudvij3FDHzxoDGFFjkCUm9LiN/8yrnVxHA9G7
 3EPyJazI559SsnxXJR32udGPJWZV1HZ7D5gbxDvzr5rZ9EX0JpyPGJsuXUR1wqlS
 UB2Y7AUTSxkwDiZ8UhPoXn6i67WAirzEsP2WmdS4v6NEbxlNloLGTIeGwcwkCRMU
 DBvMtDW8kKusgVu/OkEUgoC6MTRt+Mg+gZcQI/C4sp0MqZGaMY6c7abnYjqwEzBV
 ARS7bUYyME2GL6wNDPFB8esuD9jjdFXy96bGHATmzMxT3012K3X7ufFOzJZ+GOF9
 pan00fgoC17oiI+Xu/sZEHns6KvMTSE11Aw3uk+yhHxYtZbzWi2B5Nk+4tBdsOxF
 PAZdZ5qsyuEcBw+PyfbyZIHWOrlbvZkrmjiIsMJo63cIXuOtgraCjvRRAwe/ZwoU
 PXgPcUmrlAs06WjKhuQAZWt6bww7cEP2XyOYlDqwZ4Vj0dqav6g=
 =187C
 -----END PGP SIGNATURE-----

Merge tag 'asm-generic-fixes-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic

Pull asm-generic fixes from Arnd Bergmann:
 "There is one build fix for Arm platforms that ended up impacting most
  architectures because of the way the drivers/firmware Kconfig file is
  wired up:

  The CONFIG_QCOM_SCM dependency have caused a number of randconfig
  regressions over time, and some still remain in v5.15-rc4. The fix we
  agreed on in the end is to make this symbol selected by any driver
  using it, and then building it even for non-Arm platforms with
  CONFIG_COMPILE_TEST.

  To make this work on all architectures, the drivers/firmware/Kconfig
  file needs to be included for all architectures to make the symbol
  itself visible.

  In a separate discussion, we found that a sound driver patch that is
  pending for v5.16 needs the same change to include this Kconfig file,
  so the easiest solution seems to have my Kconfig rework included in
  v5.15.

  Finally, the branch also includes a small unrelated build fix for
  NOMMU architectures"

Link: https://lore.kernel.org/all/20210928153508.101208f8@canb.auug.org.au/
Link: https://lore.kernel.org/all/20210928075216.4193128-1-arnd@kernel.org/
Link: https://lore.kernel.org/all/20211007151010.333516-1-arnd@kernel.org/

* tag 'asm-generic-fixes-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic:
  asm-generic/io.h: give stub iounmap() on !MMU same prototype as elsewhere
  qcom_scm: hide Kconfig symbol
  firmware: include drivers/firmware/Kconfig unconditionally
 2021-10-08 11:57:54 -07:00
Linus Torvalds
cdc726fb35 ACPI fix for 5.15-rc5 
Fix a recent ACPI-related regression in the PCI subsystem that
 introduced a NULL pointer dereference possible to trigger from
 user space via sysfs on some systems.
 -----BEGIN PGP SIGNATURE-----
 
 iQJGBAABCAAwFiEE4fcc61cGeeHD/fCwgsRv/nhiVHEFAmFgfJoSHHJqd0Byand5
 c29ja2kubmV0AAoJEILEb/54YlRxJv4QAIdPK7ZRujQYf3EF0n+4nVwLRt0wzrZq
 O33t4DS+CUdFKail3LKb++ZmuhQWoMD40f7FkDyuCKH3CVZsI96H7Fs4/6pfjrHj
 y78UcDAJQ28KaJHsDSO1mQv8qcrDj5pn1renzCeWOZG9jxO+oPsXfoVb7s+nG1As
 2WL3vgsVe3APp/IIQKy2eVNb/RsHFHHW+cYV4tFzTOwGKwzF4QAJAM8VQ+F+bLle
 ixOmNdtOY3ttcNFvj0k/wtqbYOlTjXrwQnmGUj9PEgzBmrpp+kqnKCtHxzZnTXRL
 lRaDtIeDipGwVBUOzkfGCGKvNiHnLTipdBlXvjG48fOrYLPawRhYjDH3kquMWVKl
 c8hjITmfJ8z9u0fJ5UcT1MEWjHRzyF0/+kUymvT076LIom+/W27uKmvLzMojotrL
 lWqvWwUwWhyKHPzv7rhMIfyHrfUWEltfhB15EdFSV14dwukMfXgHJFkk3TrA8Mjn
 m3ft3/RhmJsbJVhJR4VpHMCkGvidi0XtjgS5IKpBYJS6Hzp9WgSO1vXkLQUd8YwS
 dKvMTzoDN+zYx2UDm5sPbUTIGcHr4aCZ2kZqo/gnEPyGkhNYHSOjklKuVnPeaZoY
 fEQxIWmtLZs/77jFEkUbMVrJaigsWeAHqPCCjmia4BZQMlOzefxBuwpTJX2zMi3y
 pkAlAU55ugtv
 =H0kg
 -----END PGP SIGNATURE-----

Merge tag 'acpi-5.15-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

Pull ACPI fix from Rafael Wysocki:
 "Fix a recent ACPI-related regression in the PCI subsystem that
  introduced a NULL pointer dereference possible to trigger from
  user space via sysfs on some systems"

* tag 'acpi-5.15-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  PCI: ACPI: Check parent pointer in acpi_pci_find_companion()
 2021-10-08 11:49:30 -07:00
Linus Torvalds
741668ef78 USB fixes for 5.15-rc5 
Here are some small USB fixes for 5.15-rc5 that resolve a number of
 reported issues:
 	- gadget driver fixes
 	- xhci build warning fixes
 	- build configuration fix
 	- cdc-acm tty handling fixes
 	- cdc-wdm fix
 	- typec fixes
 
 All of these have been in linux-next for a while with no reported
 issues.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCYWBsEw8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+yn5KwCfYnVRiMWOqOfbOc3pROB9fV6BrocAoIKyzVoR
 BkEqytEaB/DW/5vPzns6
 =W9cz
 -----END PGP SIGNATURE-----

Merge tag 'usb-5.15-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

Pull USB fixes from Greg KH:
 "Here are some small USB fixes for 5.15-rc5 that resolve a number of
  reported issues:

   - gadget driver fixes

   - xhci build warning fixes

   - build configuration fix

   - cdc-acm tty handling fixes

   - cdc-wdm fix

   - typec fixes

  All of these have been in linux-next for a while with no reported
  issues"

* tag 'usb-5.15-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
  USB: cdc-acm: fix break reporting
  USB: cdc-acm: fix racy tty buffer accesses
  usb: gadget: f_uac2: fixed EP-IN wMaxPacketSize
  usb: cdc-wdm: Fix check for WWAN
  usb: chipidea: ci_hdrc_imx: Also search for 'phys' phandle
  usb: typec: tcpm: handle SRC_STARTUP state if cc changes
  usb: typec: tcpci: don't handle vSafe0V event if it's not enabled
  usb: typec: tipd: Remove dependency on "connector" child fwnode
  Partially revert "usb: Kconfig: using select for USB_COMMON dependency"
  usb: dwc3: gadget: Revert "set gadgets parent to the right controller"
  usb: xhci: tegra: mark PM functions as __maybe_unused
 2021-10-08 10:16:01 -07:00
Linus Torvalds
9c7e7050f8 MMC host: 
- meson-gx: Fix read/write access for dram-access-quirk
  - sdhci-of-at91: Fix calibration sequence
 -----BEGIN PGP SIGNATURE-----
 
 iQJLBAABCgA1FiEEugLDXPmKSktSkQsV/iaEJXNYjCkFAmFgBIAXHHVsZi5oYW5z
 c29uQGxpbmFyby5vcmcACgkQ/iaEJXNYjCk1/g//ZR7WI0uSRRtqh2htCj5aD8nx
 cwYEI3FGlSVP/JClW6QBTUV3zj/9bLtqSWKy78Po57bfdadvb6kcfjnQvC7oBa8P
 lB/+GOAJhZdQLcqwgFSgiy3ODTjFYq7o6BUc35R0S1Po2WEdkIaDYm1aIbsFLTkc
 TDanyrKY/ZkXrrOoUHAgDawwJ2AnPXmkLaVQS+IxNLh1GE+yMECasUUbbB3Ozgzi
 I4tNulcpY7x7ggJAOhLY2imZn9QEKDKZzpd/RMS7Xr+CjPedfWEVxxrZA96hHaen
 hJ4+7CPPB7Uiw02q+Tbutk/qkVPvfjQUcKqk0FOpZ9Phh3VR/EEVHFEbnOkiagX8
 rYnC7h31wQ7pLkt90nlsYIddwr++GkfLQvRIFXtwuEDNVuWS4Q6dROjHoO+wY+/p
 sPQD6MtNd7BTf7rmGGlDxLWQh0xzrruTzSQMh7pct+84LN5RS3pCE5Ul7oym4L/U
 RjVnf7RoCz7a/aHqiMy4JscZNwTV9/XCS7p+yKbySTv7T3pSYbdkIh1t3HP/ykNk
 XNCijsYXnw64yDqo5uEfqEPkoCIlY00Ea8zzoqucolGVAuT3eatyfSDwhV/bc8n9
 NckNvLle3jBJEC7uy2kXalPhy8hCQdf96nCh9zBz4QfCY11Pci9IWpvUyfgiRPAA
 sRwybQyKEdQVU/ny+C4=
 =cqye
 -----END PGP SIGNATURE-----

Merge tag 'mmc-v5.15-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc

Pull MMC fixes from Ulf Hansson:
 "A couple of MMC host fixes:

   - meson-gx: Fix read/write access for dram-access-quirk

   - sdhci-of-at91: Fix calibration sequence"

* tag 'mmc-v5.15-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
  mmc: meson-gx: do not use memcpy_to/fromio for dram-access-quirk
  mmc: sdhci-of-at91: replace while loop with read_poll_timeout
  mmc: sdhci-of-at91: wait for calibration done before proceed
 2021-10-08 10:08:58 -07:00
Linus Torvalds
0068dc8c96 drm fixes for 5.15-rc5 
core:
 - Kconfig fix for fb_simple vs simpledrm.
 
 i915:
 - Fix RKL HDMI audio
 - Fix runtime pm imbalance on i915_gem_shrink() error path
 - Fix Type-C port access before hw/sw state sync
 - Fix VBT backlight struct version/size check
 - Fix VT-d async flip on SKL/BXT with plane stretch workaround
 
 amdgpu:
 - DCN 3.1 DP alt mode fixes
 - S0ix gfxoff fix
 - Fix DRM_AMD_DC_SI dependencies
 - PCIe DPC handling fix
 - DCN 3.1 scaling fix
 - Documentation fix
 
 amdkfd:
 - Fix potential memory leak
 - IOMMUv2 init fixes
 
 vc4:
 - compiler fix
 - (there were some hdmi fixes but things got reverted, sort it out later)
 
 nouveau:
 - Cursor fix
 - Fix ttm buffer moves for ampere gpu's by adding minimal acceleration support.
 - memory leak fixes
 
 rockchip:
 - crtc/clk fixup
 
 panel:
 - ili9341 Fix DT bindings indent
 - y030xx067a - yellow tint init seq fix
 
 gbefb:
 - Fix gbefb when built with COMPILE_TEST.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmFfvUIACgkQDHTzWXnE
 hr7spg/+L8AUrQrP2jkpSCs3RuaQTx1p8uREc0JCi9AGGd8HNFDbqFyzvFwrCQKu
 MmAoQ7oK7sr8qHsSi0jxWEBT8fUKohSUXsYQUIsJ4iSdmkODCyrJLMZhSHQVVNZX
 hh9xEcYkqYJ+2Ne9VtqBdlfFTmrHq9ce+VsUxyt34ex9WdH1i4S132jOg7XwDKB6
 GnC3svlCSl6GlEN/VeDQlGBNbE53MXm/kRyEhAAL0LHL/Ty+LRQUp0qnNTuZlluI
 90hu8WVQAPkOkYd0IXggBeYlrjZq+U0xLFZlArfGzHzrW4GzrwxTh/QS1hH16LR9
 ppq9F048AH2smNTmAAELMjT+/0HjMvbAtt8URmmVzSlk/CMsiCO4i6v7Ys0wC7ct
 KSf5orVKgmJHmd4+rD/3XvyOgERKIV3EcbgyJ6+6JwB8QCXsk7NMKCYGyQn14tIh
 h6/cNFYHdYVabl+nEvC1VJNiR9zGvJ0Cd9FP0kH8XM1/4AIKV+L6sxQh+yL3x6yb
 UNP4mquD9jBaHp5PMyWXhOIhZSzKvzr2/WBfa1b4FG7bovoGtpBISnb+KLS7Cpiz
 cSsVMN3lUDgxjVsq8FOB+fVhql9mzDSW1aR54AEnuMkWtBGUS3AkquLh0glaC9V/
 AoxbOlfiME+DNGuLaCtU+NrxxincJR9h3FwWNAO2Hc3GVuo0nuc=
 =Wbzr
 -----END PGP SIGNATURE-----

Merge tag 'drm-fixes-2021-10-08' of git://anongit.freedesktop.org/drm/drm

Pull drm fixes from Dave Airlie:
 "I've returned from my tropical island retreat, even managed to bring
  one of my kids on a dive with some turtles. Thanks to Daniel for doing
  last week's work.

  Otherwise this is the weekly fixes pull, it's a bit bigger because the
  vc4 reverts in your tree caused some problems with fixes in the
  drm-misc tree so it got left out last week, so this week has the misc
  fixes rebased without the vc4 pieces.

  Otherwise it's i915, amdgpu with the usual fixes and a scattering over
  other drivers.

  I expect things should calm down a bit more next week.

  core:
   - Kconfig fix for fb_simple vs simpledrm.

  i915:
   - Fix RKL HDMI audio
   - Fix runtime pm imbalance on i915_gem_shrink() error path
   - Fix Type-C port access before hw/sw state sync
   - Fix VBT backlight struct version/size check
   - Fix VT-d async flip on SKL/BXT with plane stretch workaround

  amdgpu:
   - DCN 3.1 DP alt mode fixes
   - S0ix gfxoff fix
   - Fix DRM_AMD_DC_SI dependencies
   - PCIe DPC handling fix
   - DCN 3.1 scaling fix
   - Documentation fix

  amdkfd:
   - Fix potential memory leak
   - IOMMUv2 init fixes

  vc4 (there were some hdmi fixes but things got reverted, sort it out
       later):
   - compiler fix

  nouveau:
   - Cursor fix
   - Fix ttm buffer moves for ampere gpu's by adding minimal
     acceleration support.
   - memory leak fixes

  rockchip:
   - crtc/clk fixup

  panel:
   - ili9341 Fix DT bindings indent
   - y030xx067a - yellow tint init seq fix

  gbefb:
   - Fix gbefb when built with COMPILE_TEST"

* tag 'drm-fixes-2021-10-08' of git://anongit.freedesktop.org/drm/drm: (33 commits)
  drm/amd/display: Fix detection of 4 lane for DPALT
  drm/amd/display: Limit display scaling to up to 4k for DCN 3.1
  drm/amd/display: Skip override for preferred link settings during link training
  drm/nouveau/debugfs: fix file release memory leak
  drm/nouveau/kms/nv50-: fix file release memory leak
  drm/nouveau: avoid a use-after-free when BO init fails
  DRM: delete DRM IRQ legacy midlayer docs
  video: fbdev: gbefb: Only instantiate device when built for IP32
  fbdev: simplefb: fix Kconfig dependencies
  drm/panel: abt-y030xx067a: yellow tint fix
  dt-bindings: panel: ili9341: correct indentation
  drm/nouveau/fifo/ga102: initialise chid on return from channel creation
  drm/rockchip: Update crtc fixup to account for fractional clk change
  drm/nouveau/ga102-: support ttm buffer moves via copy engine
  drm/nouveau/kms/tu102-: delay enabling cursor until after assign_windows
  drm/sun4i: dw-hdmi: Fix HDMI PHY clock setup
  drm/vc4: hdmi: Remove unused struct
  drm/kmb: Enable alpha blended second plane
  drm/amdgpu: handle the case of pci_channel_io_frozen only in amdgpu_pci_resume
  drm/amdgpu: init iommu after amdkfd device init
  ...
 2021-10-08 09:58:50 -07:00
Lin Ma
1b1499a817 nfc: nci: fix the UAF of rf_conn_info object 
The nci_core_conn_close_rsp_packet() function will release the conn_info
with given conn_id. However, it needs to set the rf_conn_info to NULL to
prevent other routines like nci_rf_intf_activated_ntf_packet() to trigger
the UAF.

Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Signed-off-by: Lin Ma <linma@zju.edu.cn>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
 2021-10-08 17:24:32 +01:00
Karsten Graul
95f7f3e7dc net/smc: improved fix wait on already cleared link 
Commit 8f3d65c166 ("net/smc: fix wait on already cleared link")
introduced link refcounting to avoid waits on already cleared links.
This patch extents and improves the refcounting to cover all
remaining possible cases for this kind of error situation.

Fixes: 15e1b99aad ("net/smc: no WR buffer wait for terminating link group")
Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
 2021-10-08 17:00:16 +01:00
David S. Miller
097657c9a4 Merge branch 'stmmac-regression-fix' 
Merge branch 'stmmac-regression-fix'

Herve Codina says:

====================
net: stmmac: fix regression on SPEAr3xx SOC

The ethernet driver used on old SPEAr3xx soc was previously supported on old
kernel. Some regressions were introduced during the different updates leading
to a broken driver for this soc.

This series fixes these regressions and brings back ethernet on SPEAr3xx.
Tested on a SPEAr320 board.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
 2021-10-08 16:22:55 +01:00
Herve Codina
6636fec29c ARM: dts: spear3xx: Fix gmac node 
On SPEAr3xx, ethernet driver is not compatible with the SPEAr600
one.
Indeed, SPEAr3xx uses an earlier version of this IP (v3.40) and
needs some driver tuning compare to SPEAr600.

The v3.40 IP support was added to stmmac driver and this patch
fixes this issue and use the correct compatible string for
SPEAr3xx

Signed-off-by: Herve Codina <herve.codina@bootlin.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
 2021-10-08 16:22:39 +01:00
Herve Codina
9cb1d19f47 net: stmmac: add support for dwmac 3.40a 
dwmac 3.40a is an old ip version that can be found on SPEAr3xx soc.

Signed-off-by: Herve Codina <herve.codina@bootlin.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
 2021-10-08 16:22:39 +01:00
Herve Codina
3781b6ad2e dt-bindings: net: snps,dwmac: add dwmac 3.40a IP version 
dwmac 3.40a is an old ip version that can be found on SPEAr3xx soc.

Signed-off-by: Herve Codina <herve.codina@bootlin.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
 2021-10-08 16:22:39 +01:00
Herve Codina
075da584ba net: stmmac: fix get_hw_feature() on old hardware 
Some old IPs do not provide the hardware feature register.
On these IPs, this register is read 0x00000000.

In old driver version, this feature was handled but a regression came
with the commit f10a6a3541 ("stmmac: rework get_hw_feature function").
Indeed, this commit removes the return value in dma->get_hw_feature().
This return value was used to indicate the validity of retrieved
information and used later on in stmmac_hw_init() to override
priv->plat data if this hardware feature were valid.

This patch restores the return code in ->get_hw_feature() in order
to indicate the hardware feature validity and override priv->plat
data only if this hardware feature is valid.

Fixes: f10a6a3541 ("stmmac: rework get_hw_feature function")
Signed-off-by: Herve Codina <herve.codina@bootlin.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
 2021-10-08 16:22:38 +01:00
Paolo Abeni
612f71d732 mptcp: fix possible stall on recvmsg() 
recvmsg() can enter an infinite loop if the caller provides the
MSG_WAITALL, the data present in the receive queue is not sufficient to
fulfill the request, and no more data is received by the peer.

When the above happens, mptcp_wait_data() will always return with
no wait, as the MPTCP_DATA_READY flag checked by such function is
set and never cleared in such code path.

Leveraging the above syzbot was able to trigger an RCU stall:

rcu: INFO: rcu_preempt self-detected stall on CPU
rcu:    0-...!: (10499 ticks this GP) idle=0af/1/0x4000000000000000 softirq=10678/10678 fqs=1
        (t=10500 jiffies g=13089 q=109)
rcu: rcu_preempt kthread starved for 10497 jiffies! g13089 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1
rcu:    Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:R  running task     stack:28696 pid:   14 ppid:     2 flags:0x00004000
Call Trace:
 context_switch kernel/sched/core.c:4955 [inline]
 __schedule+0x940/0x26f0 kernel/sched/core.c:6236
 schedule+0xd3/0x270 kernel/sched/core.c:6315
 schedule_timeout+0x14a/0x2a0 kernel/time/timer.c:1881
 rcu_gp_fqs_loop+0x186/0x810 kernel/rcu/tree.c:1955
 rcu_gp_kthread+0x1de/0x320 kernel/rcu/tree.c:2128
 kthread+0x405/0x4f0 kernel/kthread.c:327
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
rcu: Stack dump where RCU GP kthread last ran:
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 8510 Comm: syz-executor827 Not tainted 5.15.0-rc2-next-20210920-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:bytes_is_nonzero mm/kasan/generic.c:84 [inline]
RIP: 0010:memory_is_nonzero mm/kasan/generic.c:102 [inline]
RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:128 [inline]
RIP: 0010:memory_is_poisoned mm/kasan/generic.c:159 [inline]
RIP: 0010:check_region_inline mm/kasan/generic.c:180 [inline]
RIP: 0010:kasan_check_range+0xc8/0x180 mm/kasan/generic.c:189
Code: 38 00 74 ed 48 8d 50 08 eb 09 48 83 c0 01 48 39 d0 74 7a 80 38 00 74 f2 48 89 c2 b8 01 00 00 00 48 85 d2 75 56 5b 5d 41 5c c3 <48> 85 d2 74 5e 48 01 ea eb 09 48 83 c0 01 48 39 d0 74 50 80 38 00
RSP: 0018:ffffc9000cd676c8 EFLAGS: 00000283
RAX: ffffed100e9a110e RBX: ffffed100e9a110f RCX: ffffffff88ea062a
RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffff888074d08870
RBP: ffffed100e9a110e R08: 0000000000000001 R09: ffff888074d08877
R10: ffffed100e9a110e R11: 0000000000000000 R12: ffff888074d08000
R13: ffff888074d08000 R14: ffff888074d08088 R15: ffff888074d08000
FS:  0000555556d8e300(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
S:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000180 CR3: 0000000068909000 CR4: 00000000001506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
 test_and_clear_bit include/asm-generic/bitops/instrumented-atomic.h:83 [inline]
 mptcp_release_cb+0x14a/0x210 net/mptcp/protocol.c:3016
 release_sock+0xb4/0x1b0 net/core/sock.c:3204
 mptcp_wait_data net/mptcp/protocol.c:1770 [inline]
 mptcp_recvmsg+0xfd1/0x27b0 net/mptcp/protocol.c:2080
 inet6_recvmsg+0x11b/0x5e0 net/ipv6/af_inet6.c:659
 sock_recvmsg_nosec net/socket.c:944 [inline]
 ____sys_recvmsg+0x527/0x600 net/socket.c:2626
 ___sys_recvmsg+0x127/0x200 net/socket.c:2670
 do_recvmmsg+0x24d/0x6d0 net/socket.c:2764
 __sys_recvmmsg net/socket.c:2843 [inline]
 __do_sys_recvmmsg net/socket.c:2866 [inline]
 __se_sys_recvmmsg net/socket.c:2859 [inline]
 __x64_sys_recvmmsg+0x20b/0x260 net/socket.c:2859
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7fc200d2dc39
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc5758e5a8 EFLAGS: 00000246 ORIG_RAX: 000000000000012b
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc200d2dc39
RDX: 0000000000000002 RSI: 00000000200017c0 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000f0b5ff
R10: 0000000000000100 R11: 0000000000000246 R12: 0000000000000003
R13: 00007ffc5758e5d0 R14: 00007ffc5758e5c0 R15: 0000000000000003

Fix the issue by replacing the MPTCP_DATA_READY bit with direct
inspection of the msk receive queue.

Reported-and-tested-by: syzbot+3360da629681aa0d22fe@syzkaller.appspotmail.com
Fixes: 7a6a6cbc3e ("mptcp: recvmsg() can drain data from multiple subflow")
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
 2021-10-08 14:55:54 +01:00
Adam Borowski
2fbc349911 asm-generic/io.h: give stub iounmap() on !MMU same prototype as elsewhere 
It made -Werror sad.

Signed-off-by: Adam Borowski <kilobyte@angband.pl>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
 2021-10-08 15:39:33 +02:00
Borislav Petkov
d298b03506 x86/fpu: Restore the masking out of reserved MXCSR bits 
Ser Olmy reported a boot failure:

  init[1] bad frame in sigreturn frame:(ptrval) ip:b7c9fbe6 sp:bf933310 orax:ffffffff \
	  in libc-2.33.so[b7bed000+156000]
  Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
  CPU: 0 PID: 1 Comm: init Tainted: G        W         5.14.9 #1
  Hardware name: Hewlett-Packard HP PC/HP Board, BIOS  JD.00.06 12/06/2001
  Call Trace:
   dump_stack_lvl
   dump_stack
   panic
   do_exit.cold
   do_group_exit
   get_signal
   arch_do_signal_or_restart
   ? force_sig_info_to_task
   ? force_sig
   exit_to_user_mode_prepare
   syscall_exit_to_user_mode
   do_int80_syscall_32
   entry_INT80_32

on an old 32-bit Intel CPU:

  vendor_id       : GenuineIntel
  cpu family      : 6
  model           : 6
  model name      : Celeron (Mendocino)
  stepping        : 5
  microcode       : 0x3

Ser bisected the problem to the commit in Fixes.

tglx suggested reverting the rejection of invalid MXCSR values which
this commit introduced and replacing it with what the old code did -
simply masking them out to zero.

Further debugging confirmed his suggestion:

  fpu->state.fxsave.mxcsr: 0xb7be13b4, mxcsr_feature_mask: 0xffbf
  WARNING: CPU: 0 PID: 1 at arch/x86/kernel/fpu/signal.c:384 __fpu_restore_sig+0x51f/0x540

so restore the original behavior only for 32-bit kernels where you have
ancient machines with buggy hardware. For 32-bit programs on 64-bit
kernels, user space which supplies wrong MXCSR values is considered
malicious so fail the sigframe restoration there.

Fixes: 6f9866a166 ("x86/fpu/signal: Let xrstor handle the features to init")
Reported-by: Ser Olmy <ser.olmy@protonmail.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Tested-by: Ser Olmy <ser.olmy@protonmail.com>
Cc: <stable@vger.kernel.org>
Link: https://lkml.kernel.org/r/YVtA67jImg3KlBTw@zn.tnic
 2021-10-08 11:12:17 +02:00
Dave Airlie
bf79045e0e Merge tag 'amd-drm-fixes-5.15-2021-10-06' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes 
amd-drm-fixes-5.15-2021-10-06:

amdgpu:
- DCN 3.1 DP alt mode fixes
- S0ix gfxoff fix
- Fix DRM_AMD_DC_SI dependencies
- PCIe DPC handling fix
- DCN 3.1 scaling fix
- Documentation fix

amdkfd:
- Fix potential memory leak
- IOMMUv2 init fixes

Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Alex Deucher <alexander.deucher@amd.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20211006203828.4818-1-alexander.deucher@amd.com
 2021-10-08 11:40:21 +10:00
Dave Airlie
b28a130f0b Rebased drm-misc-fixes for v5.15-rc5: 
- Dropped vc4 patches.
 - Compiler fix for vc4.
 - Cursor fix for nouveau.
 - Fix ttm buffer moves for ampere gpu's by adding minimal acceleration support.
 - Small rockchip fixes.
 - Fix DT bindings indent for ili9341.
 - Fix y030xx067a init sequence to not get a yellow tint.
 - Kconfig fix for fb_simple vs simpledrm.
 - Assorted nouvaeu memory leaks.
 - Fix gbefb when built with COMPILE_TEST.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEuXvWqAysSYEJGuVH/lWMcqZwE8MFAmFdaf0ACgkQ/lWMcqZw
 E8M2kg/9F1uUdU521WcrEbtN2lDuoyDNPR8t08vwXMp/OhqBQKNYH/gBOeu1sFjg
 i/D8IQUetFNuSWeSMTEwgwFaO+1AYXZREngg8MUdEiWEFmXWf714EYVqEKvaT0bS
 rBU0mvSRdAyEbg1PGUwDKhE32tHwV1o7UoZfl50zq3YIwdjjzoGGLWxzo2dysngV
 KgjzAvAMGxG8Ug2vzaF0pNYNAXu0cN41YyRsHze9BB1FAs9MKjdCUVntgxI4pK1h
 pmN2mHhpZn0T31OZFmFoTNUuVo4OB8GmvvS6AdqCtA7Jwdi+rjANFNM04LNKONvd
 FNajibM4sMz9c5kGaSbX4NN4iqRfRTTXKze1AXQiDfiN3jUf84cdBOkO2LRpYllN
 XmHKrOTPbMS1DZvZ4P4coFoLvBNt3CF7LJ0NfOdclrOBBlCNhzs6COY80jxZ/MJF
 g3oV2btUKj+cJsVHXs8XiCzdSRYp0wfvMV34+TOvBSfEMACtfPBsLYGUh6b+4LRi
 0shF/PEv+/pE6B6Xo6PTGpKq6NHOlyi6aOBiVuap20rkPL+3vWSKq1vL4Kv9QDDu
 VW+/v+8yHj3kvMOaq0qfbO+ZEM4kZX0DXWZ7znzf7TEm08mK3ZzG5V9GJ5nXWWV5
 IDNNpbCIHzq3ckfBxRBPWsX48aVaYFa/5ctsR+zRVGLqcCh09F8=
 =+Vsl
 -----END PGP SIGNATURE-----

Merge tag 'drm-misc-fixes-2021-10-06' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes

Rebased drm-misc-fixes for v5.15-rc5:
- Dropped vc4 patches.
- Compiler fix for vc4.
- Cursor fix for nouveau.
- Fix ttm buffer moves for ampere gpu's by adding minimal acceleration support.
- Small rockchip fixes.
- Fix DT bindings indent for ili9341.
- Fix y030xx067a init sequence to not get a yellow tint.
- Kconfig fix for fb_simple vs simpledrm.
- Assorted nouvaeu memory leaks.
- Fix gbefb when built with COMPILE_TEST.

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/3272bf72-2c37-31eb-404e-cf7edd485c7d@linux.intel.com
 2021-10-08 11:34:38 +10:00
Dave Airlie
7d80cc702f Merge tag 'drm-intel-fixes-2021-10-07' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes 
drm/i915 fixes for v5.15-rc5:
- Fix RKL HDMI audio
- Fix runtime pm imbalance on i915_gem_shrink() error path
- Fix Type-C port access before hw/sw state sync
- Fix VBT backlight struct version/size check
- Fix VT-d async flip on SKL/BXT with plane stretch workaround

Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Jani Nikula <jani.nikula@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/87k0ipywo4.fsf@intel.com
 2021-10-08 10:53:12 +10:00
Palmer Dabbelt
3ef6ca4f35
checksyscalls: Unconditionally ignore fstat{,at}64 
These can be replaced by statx().  Since rv32 has a 64-bit time_t we
just never ended up with them in the first place.  This is now an error
due to -Werror.

Suggested-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
 2021-10-07 17:16:28 -07:00
Linus Torvalds
1da38549dd Bug fixes for NFSD error handling paths 
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEKLLlsBKG3yQ88j7+M2qzM29mf5cFAmFfUVQACgkQM2qzM29m
 f5fW9w/+MthSLnUW4edoq45d9pH7jYJrtSo54NavIknXXWYaSnDydFsV/msAsJH8
 kNmwk0JAmhQ6GIkRLm4gZ2cHT+cCtlU/1gJWamvstUGM6XUpmwODdD8nacmXUh4q
 fgh9yJooe2GERIhv2/04XA8dP7UcqyZeWAGOpUZNlYEBF/Pcp1i8fJHkbJ2zEueH
 AtTwQY5atuJVQYeno7hSd38p7whWMPF37pbL8u72fbJkOefAy0/UW3AdUiMkKTOT
 TT/1bgNhOAEo20F9vspVaYAOhC8rAGaWr4j82N1QvgBtJhGt9bayQEIZQ5e+HdCg
 It4d5qtzE0zZQ/ARYsQxfF7AgNitGYEfjVu6F3hxeHFKJQCSQoxuPbBl2FiVUl7I
 JeVgPRRfYLjOjEG2E3NCWQXuzy0MzPFKqnNrvtfTE41vz1Bzrnx9Feu9GEffAn4l
 K59pIWYcVgSaC1nu8ba/sfZTVjpKShsxcTB/GJl9cgCkenZG1bqbqNCwnzcH1s3u
 zXyJZ8CjncLWHkcm2bi/xZ3jdRAyOwVCth37wI5KTBXvEiPG3yKloQifi9yKU0Zi
 a93l7hs1swcj2GfutWVjVwVsi2d1YSRRGpVgmK5pbOAhSFBU+TXOUfGo5VG5JsUW
 LA3enCmuXrcnrsFABf43mwikLw2w8/rwgXANS6LE8vaZ7A/c07Q=
 =CTLP
 -----END PGP SIGNATURE-----

Merge tag 'nfsd-5.15-3' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux

Pull nfsd fixes from Chuck Lever:
 "Bug fixes for NFSD error handling paths"

* tag 'nfsd-5.15-3' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux:
  NFSD: Keep existing listeners on portlist error
  SUNRPC: fix sign error causing rpcsec_gss drops
  nfsd: Fix a warning for nfsd_file_close_inode
  nfsd4: Handle the NFSv4 READDIR 'dircount' hint being zero
  nfsd: fix error handling of register_pernet_subsys() in init_nfsd()
 2021-10-07 14:11:40 -07:00
Linus Torvalds
3e899c7209 ARM: SoC fixes for v5.15 
This is a larger than normal update for Arm SoC specific code, most
 of it in device trees, but also drivers and the omap and at91/sama7
 platforms:
 
  - There are four new entries to the MAINTAINERS file: Sven Peter and
    Alyssa Rosenzweig for Apple M1, Romain Perier for Mstar/sigmastar,
    and Vignesh Raghavendra for TI K3
 
  - Build fixes to address randconfig warnings in sharpsl, dove, omap1,
    and qcom platforms as well as the  scmi and op-tee subsystems
 
  - Regression fixes for missing CONFIG_FB and other options for several
    defconfigs
 
  - Several bug fixes for the newly added Microchip SAMA7 platform,
    mostly regarding power management
 
  - Missing SMP barriers to protect accesses to SCMI virtio device
 
  - Regression fixes for TI OMAP, including a boot-time hang on am335x.
 
  - Lots of bug fixes for NXP i.MX, mostly addressing incorrect settings
    in devicetree files, and one revert for broken suspend.
 
  - Fixes for ARM Juno/Vexpress devicetree files, addressing a couple
    of schema warnings.
 
  - Regression fixes for qualcomm SoC specific drivers and devicetree
    files, reverting an mdt_loader change and at least pastially
    reverting some of the 5.15 DTS changes, plus some minor bugfixes
 
 Signed-off-by: Arnd Bergmann <arnd@arndb.de>
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmFfXRgACgkQmmx57+YA
 GNk2ig//eDxbnQPFbltxAHboSaS7S6S/s3MTLC7vqwlv7n4ypINgKEGTD+kOpQ37
 zPhR+30+qHTPFI2LRFyN+iTaz/D+MP1/pRGKieXlSfQew4FvLW+aQvkhs/LLA6Qr
 jB5GJEqVKbzsfM3+GkxJ3uI44BUOUji7lCJWHDrToa40chz+I1nuORybeLgBtV/7
 D7f047FtB4cgScoZ6ZhLWysjcvIEi2+9PfMbmGPF3bZrjRLESniXqJ4pT6kiv7OF
 +rq+Bg4pkDqL6qUjMwAhIorH1dNXHi5qwr8ET23/mpefxJJQzbEO725j6ANOKHR1
 2neA+Eaghu7jfUdNQe4c8oY4lHnfsWIJInji4Sv0Yc8xivvQF+Mrzc1lzgA8o9VQ
 Tb9+bcE+xjkalwXVdVTp2FfyGh8E/cA87uv1qdprghEHjR07evs/AJZag3CjRqik
 c3FIODyQtG/RlVQxZR6PFOKxO1dQ0Qwqg5FSBTlfdT/rEG5no8KhWJYwLhXCsKGL
 O70LTspSLiaT1Gc93EeC6dWYVrLAkfnStwTF233Sq/apE5ouCEHqF4OSJvh2yaEO
 gVw50MC4BC5mJpzUQZEgZj3cntp4WGqbERYhL0bXyqPp9dGfCrPNaThN8x/CMqrG
 2z/KDKmuY3lhilEnO+s+fZI81Yl+VQsl+v1jh1En6yBqeRFU0Iw=
 =Mrh2
 -----END PGP SIGNATURE-----

Merge tag 'armsoc-fixes-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc

Pull ARM SoC fixes from Arnd Bergmann:
 "This is a larger than normal update for Arm SoC specific code, most of
  it in device trees, but also drivers and the omap and at91/sama7
  platforms:

   - There are four new entries to the MAINTAINERS file: Sven Peter and
     Alyssa Rosenzweig for Apple M1, Romain Perier for Mstar/sigmastar,
     and Vignesh Raghavendra for TI K3

   - Build fixes to address randconfig warnings in sharpsl, dove, omap1,
     and qcom platforms as well as the scmi and op-tee subsystems

   - Regression fixes for missing CONFIG_FB and other options for
     several defconfigs

   - Several bug fixes for the newly added Microchip SAMA7 platform,
     mostly regarding power management

   - Missing SMP barriers to protect accesses to SCMI virtio device

   - Regression fixes for TI OMAP, including a boot-time hang on am335x.

   - Lots of bug fixes for NXP i.MX, mostly addressing incorrect
     settings in devicetree files, and one revert for broken suspend.

   - Fixes for ARM Juno/Vexpress devicetree files, addressing a couple
     of schema warnings.

   - Regression fixes for qualcomm SoC specific drivers and devicetree
     files, reverting an mdt_loader change and at least pastially
     reverting some of the 5.15 DTS changes, plus some minor bugfixes"

* tag 'armsoc-fixes-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (64 commits)
  MAINTAINERS: Add Sven Peter as ARM/APPLE MACHINE maintainer
  MAINTAINERS: Add Alyssa Rosenzweig as M1 reviewer
  firmware: arm_scmi: Add proper barriers to scmi virtio device
  firmware: arm_scmi: Simplify spinlocks in virtio transport
  ARM: dts: omap3430-sdp: Fix NAND device node
  bus: ti-sysc: Use CLKDM_NOAUTO for dra7 dcan1 for errata i893
  ARM: sharpsl_param: work around -Wstringop-overread warning
  ARM: defconfig: gemini: Restore framebuffer
  ARM: dove: mark 'putc' as inline
  ARM: omap1: move omap15xx local bus handling to usb.c
  MAINTAINERS: Add Vignesh to TI K3 platform maintainership
  arm64: dts: imx8m*-venice-gw7902: fix M2_RST# gpio
  ARM: imx6: disable the GIC CPU interface before calling stby-poweroff sequence
  arm64: dts: ls1028a: fix eSDHC2 node
  arm64: dts: imx8mm-kontron-n801x-som: do not allow to switch off buck2
  ARM: dts: at91: sama7g5ek: to not touch slew-rate for SDMMC pins
  ARM: dts: at91: sama7g5ek: use proper slew-rate settings for GMACs
  ARM: at91: pm: preload base address of controllers in tlb
  ARM: at91: pm: group constants and addresses loading
  ARM: dts: at91: sama7g5ek: add suspend voltage for ddr3l rail
  ...
 2021-10-07 14:01:29 -07:00
Josef Bacik
4afb912f43 btrfs: fix abort logic in btrfs_replace_file_extents 
Error injection testing uncovered a case where we'd end up with a
corrupt file system with a missing extent in the middle of a file.  This
occurs because the if statement to decide if we should abort is wrong.

The only way we would abort in this case is if we got a ret !=
-EOPNOTSUPP and we called from the file clone code.  However the
prealloc code uses this path too.  Instead we need to abort if there is
an error, and the only error we _don't_ abort on is -EOPNOTSUPP and only
if we came from the clone file code.

CC: stable@vger.kernel.org # 5.10+
Reviewed-by: Nikolay Borisov <nborisov@suse.com>
Reviewed-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
 2021-10-07 22:08:06 +02:00
Filipe Manana
cfd312695b btrfs: check for error when looking up inode during dir entry replay 
At replay_one_name(), we are treating any error from btrfs_lookup_inode()
as if the inode does not exists. Fix this by checking for an error and
returning it to the caller.

CC: stable@vger.kernel.org # 4.14+
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
 2021-10-07 22:06:34 +02:00
Filipe Manana
8dcbc26194 btrfs: unify lookup return value when dir entry is missing 
btrfs_lookup_dir_index_item() and btrfs_lookup_dir_item() lookup for dir
entries and both are used during log replay or when updating a log tree
during an unlink.

However when the dir item does not exists, btrfs_lookup_dir_item() returns
NULL while btrfs_lookup_dir_index_item() returns PTR_ERR(-ENOENT), and if
the dir item exists but there is no matching entry for a given name or
index, both return NULL. This makes the call sites during log replay to
be more verbose than necessary and it makes it easy to miss this slight
difference. Since we don't need to distinguish between those two cases,
make btrfs_lookup_dir_index_item() always return NULL when there is no
matching directory entry - either because there isn't any dir entry or
because there is one but it does not match the given name and index.

Also rename the argument 'objectid' of btrfs_lookup_dir_index_item() to
'index' since it is supposed to match an index number, and the name
'objectid' is not very good because it can easily be confused with an
inode number (like the inode number a dir entry points to).

CC: stable@vger.kernel.org # 4.14+
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
 2021-10-07 22:06:32 +02:00
Filipe Manana
52db77791f btrfs: deal with errors when adding inode reference during log replay 
At __inode_add_ref(), we treating any error returned from
btrfs_lookup_dir_item() or from btrfs_lookup_dir_index_item() as meaning
that there is no existing directory entry in the fs/subvolume tree.
This is not correct since we can get errors such as, for example, -EIO
when reading extent buffers while searching the fs/subvolume's btree.

So fix that and return the error to the caller when it is not -ENOENT.

CC: stable@vger.kernel.org # 4.14+
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
 2021-10-07 22:06:30 +02:00
Filipe Manana
e15ac64137 btrfs: deal with errors when replaying dir entry during log replay 
At replay_one_one(), we are treating any error returned from
btrfs_lookup_dir_item() or from btrfs_lookup_dir_index_item() as meaning
that there is no existing directory entry in the fs/subvolume tree.
This is not correct since we can get errors such as, for example, -EIO
when reading extent buffers while searching the fs/subvolume's btree.

So fix that and return the error to the caller when it is not -ENOENT.

CC: stable@vger.kernel.org # 4.14+
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
 2021-10-07 22:06:23 +02:00
Filipe Manana
77a5b9e3d1 btrfs: deal with errors when checking if a dir entry exists during log replay 
Currently inode_in_dir() ignores errors returned from
btrfs_lookup_dir_index_item() and from btrfs_lookup_dir_item(), treating
any errors as if the directory entry does not exists in the fs/subvolume
tree, which is obviously not correct, as we can get errors such as -EIO
when reading extent buffers while searching the fs/subvolume's tree.

Fix that by making inode_in_dir() return the errors and making its only
caller, add_inode_ref(), deal with returned errors as well.

Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
 2021-10-07 22:06:22 +02:00
Josef Bacik
d175209be0 btrfs: update refs for any root except tree log roots 
I hit a stuck relocation on btrfs/061 during my overnight testing.  This
turned out to be because we had left over extent entries in our extent
root for a data reloc inode that no longer existed.  This happened
because in btrfs_drop_extents() we only update refs if we have SHAREABLE
set or we are the tree_root.  This regression was introduced by
aeb935a455 ("btrfs: don't set SHAREABLE flag for data reloc tree")
where we stopped setting SHAREABLE for the data reloc tree.

The problem here is we actually do want to update extent references for
data extents in the data reloc tree, in fact we only don't want to
update extent references if the file extents are in the log tree.
Update this check to only skip updating references in the case of the
log tree.

This is relatively rare, because you have to be running scrub at the
same time, which is what btrfs/061 does.  The data reloc inode has its
extents pre-allocated, and then we copy the extent into the
pre-allocated chunks.  We theoretically should never be calling
btrfs_drop_extents() on a data reloc inode.  The exception of course is
with scrub, if our pre-allocated extent falls inside of the block group
we are scrubbing, then the block group will be marked read only and we
will be forced to cow that extent.  This means we will call
btrfs_drop_extents() on that range when we COW that file extent.

This isn't really problematic if we do this, the data reloc inode
requires that our extent lengths match exactly with the extent we are
copying, thankfully we validate the extent is correct with
get_new_location(), so if we happen to COW only part of the extent we
won't link it in when we do the relocation, so we are safe from any
other shenanigans that arise because of this interaction with scrub.

Fixes: aeb935a455 ("btrfs: don't set SHAREABLE flag for data reloc tree")
CC: stable@vger.kernel.org # 5.8+
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: David Sterba <dsterba@suse.com>
 2021-10-07 22:04:36 +02:00
Qu Wenruo
19ea40dddf btrfs: unlock newly allocated extent buffer after error 
[BUG]
There is a bug report that injected ENOMEM error could leave a tree
block locked while we return to user-space:

  BTRFS info (device loop0): enabling ssd optimizations
  FAULT_INJECTION: forcing a failure.
  name failslab, interval 1, probability 0, space 0, times 0
  CPU: 0 PID: 7579 Comm: syz-executor Not tainted 5.15.0-rc1 #16
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
  rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
  Call Trace:
   __dump_stack lib/dump_stack.c:88 [inline]
   dump_stack_lvl+0x8d/0xcf lib/dump_stack.c:106
   fail_dump lib/fault-inject.c:52 [inline]
   should_fail+0x13c/0x160 lib/fault-inject.c:146
   should_failslab+0x5/0x10 mm/slab_common.c:1328
   slab_pre_alloc_hook.constprop.99+0x4e/0xc0 mm/slab.h:494
   slab_alloc_node mm/slub.c:3120 [inline]
   slab_alloc mm/slub.c:3214 [inline]
   kmem_cache_alloc+0x44/0x280 mm/slub.c:3219
   btrfs_alloc_delayed_extent_op fs/btrfs/delayed-ref.h:299 [inline]
   btrfs_alloc_tree_block+0x38c/0x670 fs/btrfs/extent-tree.c:4833
   __btrfs_cow_block+0x16f/0x7d0 fs/btrfs/ctree.c:415
   btrfs_cow_block+0x12a/0x300 fs/btrfs/ctree.c:570
   btrfs_search_slot+0x6b0/0xee0 fs/btrfs/ctree.c:1768
   btrfs_insert_empty_items+0x80/0xf0 fs/btrfs/ctree.c:3905
   btrfs_new_inode+0x311/0xa60 fs/btrfs/inode.c:6530
   btrfs_create+0x12b/0x270 fs/btrfs/inode.c:6783
   lookup_open+0x660/0x780 fs/namei.c:3282
   open_last_lookups fs/namei.c:3352 [inline]
   path_openat+0x465/0xe20 fs/namei.c:3557
   do_filp_open+0xe3/0x170 fs/namei.c:3588
   do_sys_openat2+0x357/0x4a0 fs/open.c:1200
   do_sys_open+0x87/0xd0 fs/open.c:1216
   do_syscall_x64 arch/x86/entry/common.c:50 [inline]
   do_syscall_64+0x34/0xb0 arch/x86/entry/common.c:80
   entry_SYSCALL_64_after_hwframe+0x44/0xae
  RIP: 0033:0x46ae99
  Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48
  89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d
  01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
  RSP: 002b:00007f46711b9c48 EFLAGS: 00000246 ORIG_RAX: 0000000000000055
  RAX: ffffffffffffffda RBX: 000000000078c0a0 RCX: 000000000046ae99
  RDX: 0000000000000000 RSI: 00000000000000a1 RDI: 0000000020005800
  RBP: 00007f46711b9c80 R08: 0000000000000000 R09: 0000000000000000
  R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000017
  R13: 0000000000000000 R14: 000000000078c0a0 R15: 00007ffc129da6e0

  ================================================
  WARNING: lock held when returning to user space!
  5.15.0-rc1 #16 Not tainted
  ------------------------------------------------
  syz-executor/7579 is leaving the kernel with locks still held!
  1 lock held by syz-executor/7579:
   #0: ffff888104b73da8 (btrfs-tree-01/1){+.+.}-{3:3}, at:
  __btrfs_tree_lock+0x2e/0x1a0 fs/btrfs/locking.c:112

[CAUSE]
In btrfs_alloc_tree_block(), after btrfs_init_new_buffer(), the new
extent buffer @buf is locked, but if later operations like adding
delayed tree ref fail, we just free @buf without unlocking it,
resulting above warning.

[FIX]
Unlock @buf in out_free_buf: label.

Reported-by: Hao Sun <sunhao.th@gmail.com>
Link: https://lore.kernel.org/linux-btrfs/CACkBjsZ9O6Zr0KK1yGn=1rQi6Crh1yeCRdTSBxx9R99L4xdn-Q@mail.gmail.com/
CC: stable@vger.kernel.org # 5.4+
Signed-off-by: Qu Wenruo <wqu@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
 2021-10-07 22:04:20 +02:00
Arnd Bergmann
897c2e746c Apple SoC fixes for 5.15; just two MAINTAINERS updates. 
- MAINTAINERS: Add Sven Peter as ARM/APPLE MACHINE maintainer
 - MAINTAINERS: Add Alyssa Rosenzweig as M1 reviewer
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQSU7I7lUkZru3Mt15+lhN6SrnTN2AUCYV8dvQAKCRClhN6SrnTN
 2HufAQDwiOKAu4Vkp5erBM2ffl41qWLef4QRA71ZwQmLI/UoygEA/aodC6rNNnVs
 HyHS6bKgJHL1yF/jRhXYaS6pPpI+nwo=
 =C5Yp
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmFfRwUACgkQmmx57+YA
 GNm32BAAg/qkjMKg2QhUW2BEVAd7+ftREV5Y6Zlz8X9OpqJTu+Z8CF8yEKDN3VZg
 24V0xQJyyDHn/ljiNjPzPItIsxKXiHPnONUB0AXecBCxHkhOgP6qWI2DLCEVKu4O
 gpQqvLF7IDZS6uuopBSZQeIa4UlaMtb+EIZjOxieCm0ItNoY5KMbc4HxnGF5aCTQ
 DTTy66SDcy8ssiXFm1bsLjGpkppt9v4Z48rK0bLsehsJCNI2Dk7eCKxMnOnEeYJV
 D6V2ck5x5XkmVqIzgXkIUvJ7SGAOFYopU/tLk/ee5C0wl/HtfUvmR2tY7HiwkwQ3
 a5DsDveZ0yU65xbPwHuaqBEibYi5gBr/KYiKx5V34VBCbZt2pWQR5LbAF6C7DVkT
 4at+XTb+29qX/wQo3XwRMFUWhFVZOPSPgBQeCdbhGTPP4VLepgdf6sTMM/TArK1u
 QAOYg+lhJs6P7TCgKOkj6s3gQ7DYax5GQhFy6QllTXHeIT605d7UgWIXrdLsPFFr
 Z25gQEfffhb1FHsga7k1psBl9VpzIQh+Un7MEJY8KfMAClB5IhlmjCboCQW9QzrA
 VQU7S6nMPvV6dN22LJNF01TlyOAzrMrhcPSuquJtLuanPZb1bcQ+ES1GtCMCBevg
 iSqHgBavzH+pjXiSCGRmXOLL5jyLcTa4o8ECK7/g84mDxjpCatE=
 =eVNy
 -----END PGP SIGNATURE-----

Merge tag 'asahi-soc-fixes-5.15' of https://github.com/AsahiLinux/linux into arm/fixes

Apple SoC fixes for 5.15; just two MAINTAINERS updates.

- MAINTAINERS: Add Sven Peter as ARM/APPLE MACHINE maintainer
- MAINTAINERS: Add Alyssa Rosenzweig as M1 reviewer

* tag 'asahi-soc-fixes-5.15' of https://github.com/AsahiLinux/linux:
  MAINTAINERS: Add Sven Peter as ARM/APPLE MACHINE maintainer
  MAINTAINERS: Add Alyssa Rosenzweig as M1 reviewer

Link: https://lore.kernel.org/r/a50a9015-0e62-c451-4d0d-668233b35b85@marcan.st
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
 2021-10-07 21:14:13 +02:00
Arnd Bergmann
6aaa843438 SCMI fixes for v5.15 
A few fixes addressing:
 - Kconfig dependency between VIRTIO and ARM_SCMI_PROTOCOL
 - Link-time error with __exit annotation for virtio_scmi_exit
 - Unnecessary nested irqsave/irqrestore spinlocks in virtio transport
 - Missing SMP barriers to protect accesses to SCMI virtio device
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEunHlEgbzHrJD3ZPhAEG6vDF+4pgFAmFdfQ0ACgkQAEG6vDF+
 4piS7g//TS0lhdY7oFWb2XpyQtcY7oudREtfV76pcrtYrdepKrfa3SzfjNVwTmq6
 Tp2W+viRD1fLtqx0tPhO6YurgMFPUke+j7njS/yTMTitPhgzqm93l9Re+TxI7XiU
 qEuSoC+fenQhrhqNTXRaEkGFLWiQrENw5SUjz+ZcE/3QKUv35PU6HG5Od9gywssB
 wQ69Slr4AAHyPBPD3CVj5QUQhRvfp+YwOqSY/DwngjRCg/zDidWBFZ8XVLYRZ1Dl
 rAgdPsnnLTZ9sPgscIHciR/lyQdDqkY6A++U85oDLXjs7vZ27mlq+bFq3Rp6um3M
 WTbw89Fcvu8cQUMjEHFtGblEPgVn/BrK5po6DZA8RbSowcp7AMj87Gi0IhSRakPE
 ALN8qb9W84CbgzwcmCqCZiVzeEgy+uCVqtPIc4feupu4ukrah/+TPlAeM29JPVOO
 D5CtWushTxabRDb+/xGIBuww0qXiXm0he7I0QpVfW7JGBr+Bo62G2OWmNvwMlor0
 Gc0ecz47P+vywra4Spa9w6VzvfDFOk0xmHp07RyyWXdbLL1IqvWW+DBW2E9fJMrf
 b4m65V822fTOv19mUIPzcou5erzL8wtfN9kSR+8gJ9iIlJ+0Xs/UoIT7fY3CAgpu
 xBUhBjcOD/Zjv607tO3XsJyRj5VgU88Dqod3k5oJfqXzg97fAH4=
 =4s/W
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmFfRvwACgkQmmx57+YA
 GNlnGA/+N9u/OQlwfB2kMoV/4iGGFUzQ0gCN+F+uKitS3hNnR8ke6npDV/wjytRC
 EAbUvnecdJvwXCOSRVm+HRZMbHtmeKi+wm9CzOzBlUH6wjDuDQ3aSjMwlDeWNVVS
 EAhvFojqFZQAk2QbnUfWAvM4gTtdY8UOrSXsrFI2y4J5ukzeCWDJ5OlJ3/qs0k/5
 zmAHbgubvQYhg2wFhDx4Z/4YdT2mkZj6gyz7bX2qPJDPQb1mQUYbVYXhbkqXlQ96
 9b76F3x+4/KO6OqM7lZFI1yNBBaRR9clqVQWClCEXTbXLyTG/q56KWGQww3sdY94
 oi+ZfoiK4y+P/0oareBJq1Epp+c8A4RXy04ovV92OvxnM7qcmkNFZskYXhK1wnnc
 2R0UyNWEq9o3V2KT/3q94PSXppFVDe918hMvEq3qPaF/8wTQ/ZrpuLOmCtZi/OmH
 dl3M36lZNbQyvXg9jX2ZKGJgw7j2Ig6aTnpjsbxW4O5KmTLKskDV7PoFNeVnfokI
 7mJ6WWYTFUK0WnyCVI+t1AIKnWBDu80puhna5shWVaIQaxW0AlyA+Rhf5YRHqNga
 GUHNJatzL5iMyplV2TUbDNmFwHt9wYxGUN4hgfK0z0YsATjf6zbtixLVHb4ZBI/M
 bsNMiys5ZCQ+u0Btwk3blXSQwK/Gr6m/9HKWPpDnol4b/LBA2dM=
 =UP9E
 -----END PGP SIGNATURE-----

Merge tag 'scmi-fixes-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into arm/fixes

SCMI fixes for v5.15

A few fixes addressing:
- Kconfig dependency between VIRTIO and ARM_SCMI_PROTOCOL
- Link-time error with __exit annotation for virtio_scmi_exit
- Unnecessary nested irqsave/irqrestore spinlocks in virtio transport
- Missing SMP barriers to protect accesses to SCMI virtio device

* tag 'scmi-fixes-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux:
  firmware: arm_scmi: Add proper barriers to scmi virtio device
  firmware: arm_scmi: Simplify spinlocks in virtio transport
  firmware: arm_scmi: Remove __exit annotation
  firmware: arm_scmi: Fix virtio transport Kconfig dependency

Link: https://lore.kernel.org/r/20211007102822.27886-1-sudeep.holla@arm.com
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
 2021-10-07 21:14:04 +02:00
Arnd Bergmann
3c7f58b353 Fixes for omaps for v5.15 
Few regression fixes for omaps for the v5.15-rc cycle. There is a fix
 for boot time hangs that can happen on some am335x devices that started
 when the pruss devicetree nodes were added. The other fixes are less
 critical:
 
 - Fix compiler warning for sysc_init_soc() that got recently introduced
 
 - Fix external abort for am335x pruss as otherwise some am335x will hang
 
 - Use CLKDM_NOAUTO quirk also for dra7 dcan1
 
 - Fix older NAND device node regression for omap3-sdp
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCAAvFiEEkgNvrZJU/QSQYIcQG9Q+yVyrpXMFAmFe5w4RHHRvbnlAYXRv
 bWlkZS5jb20ACgkQG9Q+yVyrpXPd0g//fcqq4/SaKwsNh5fctk3kLDAuLd11jEda
 d3QqB8l84lu8+VbxQaINYNZy8ktfmA3A2WqKWiWPwwUpQKhOyV6gZB7lWSgKgKg8
 0LF2bFhjCyK2wHNNbfF2qslnJZb1C0eg9JuFmvHxFRgIj9/ROY6xjtPgXylGyMMc
 xourehZosg732fWMeMjq9DkijWHwlim2fa79BW5eMwjCvtqJ1liJM4NWwrDju9jl
 TF8PtriG1C3X65wTsP0WZ3ho62hs82/ZnOR/D5o5IS56BAojibDgXRk7DNMfBgQ/
 BTwWtb5L4sxUXaVVRXQ6aL0FkstG4PXeT7WWCArFz4c1njNKPKC4NOIiD8Pa6TFp
 qw1uHRlbjfvTsC9+Bl2YTZ9q3DRrRpB6wQn/DzlodN40ygruOor1z2vVfFNmuSeP
 2YOZ7Ygs5luSalrFzOMrj8McolGbFlaXw4Ceg1cDZSwMzN7SnffHun44yoBQYx3X
 NaElQfIN89/ws+yZ6xjX31cTOBsP5PotXHz2s+3KgrmQ3J2OOMgkBJWcxTh045yQ
 2PWti2Su6yQ8I3l4wFE1ZSHN39HE72+iXwU2SEeS/jdGSE2XavmeTaoeTnCQ21ue
 vutinSocqYzxgBSuFSde6pL7fUCzbP9V+Q8gZw31ndy9tVnExlCAHjeSX2iqe6Yu
 dPvSpWr8nxQ=
 =2z/N
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmFfRvUACgkQmmx57+YA
 GNn9FA/9GlTM6ROI+JrSCIGMn0LwxhQbTWhRLWtTyYN6rJ02FgVJR2EgvVXZ1wAb
 egbN7mpGMGzTvRUIIcLjeSQwvuPMdkwY9WpiwcDHB8zXAD9khSaWBbJmYAgtYaSt
 uwatqzBwRl2nZM65FVNMa3x9+6FTa9QJGNexSqRLfLzAf1tK5IIDe7d2vN922TLf
 f4hndqimNBTQ90+K1Hhh6S13TahLJJqxWuJGdy+ijBSmW+LAYCGnRBRZ0UwsIzAY
 3tbg1p7fueTDcYvMhiQjGkOmx9H0DYTz3UZgGsX5xUqO4wzriF9SXgrCpv8v6g5i
 8GUgctoRkh9KG4MNvA6ntsSMZLRqflkLlLTc3tJ/tUzRM+4EeyVw0MuKA7HB57f9
 8uMQGJhaYWaA9aNgu5GPqr3i0dFtkgWwAQf4+mvVIEnRXwnSA35Z3/i+TTKwrdoa
 2tcuqIYl0hUcqmcVqJyU0OHlA2BZ5UwMK8Dz48lSsqgM3zbOg1BEgKTmVCinD1xI
 W1AafAusVhCcvLGjLVtiNd0/MDysvSCreDvUgE5wieNLMQd9mOTqzTPIqYAt0d3u
 Mzk83glLj6QggDJyqpyKaKiZsZry6XRD5uGGYQ/igf4Bks9h99IvRy1LT6DcJjll
 gU6TvemlUUqq9qc3/94B2Agwe13I25fszDJtXQV0MYoLqWhOFdM=
 =fI0x
 -----END PGP SIGNATURE-----

Merge tag 'omap-for-v5.15/fixes-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into arm/fixes

Fixes for omaps for v5.15

Few regression fixes for omaps for the v5.15-rc cycle. There is a fix
for boot time hangs that can happen on some am335x devices that started
when the pruss devicetree nodes were added. The other fixes are less
critical:

- Fix compiler warning for sysc_init_soc() that got recently introduced

- Fix external abort for am335x pruss as otherwise some am335x will hang

- Use CLKDM_NOAUTO quirk also for dra7 dcan1

- Fix older NAND device node regression for omap3-sdp

* tag 'omap-for-v5.15/fixes-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap:
  ARM: dts: omap3430-sdp: Fix NAND device node
  bus: ti-sysc: Use CLKDM_NOAUTO for dra7 dcan1 for errata i893
  soc: ti: omap-prm: Fix external abort for am335x pruss
  bus: ti-sysc: Add break in switch statement in sysc_init_soc()

Link: https://lore.kernel.org/r/pull-1633609552-789682@atomide.com
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
 2021-10-07 21:13:57 +02:00
Linus Torvalds
7041503d3a netfslib, cachefiles and afs fixes 
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEqG5UsNXhtOCrfGQP+7dXa6fLC2sFAmFfE4oACgkQ+7dXa6fL
 C2txTBAAnWlEssljz7x09A/I9Js155U2hW9oDSoqkUxqZSe05oBbTPNycURvXAGZ
 wZhNZdD5Xc4ITjLmPQQclgkfWc+deq6UKzw8E58XmjiO1Uq6WcqUsC95M1USAmaM
 nRyhGrYRxJbv5eRDx3Ox3yoLntlSzvX1ZLhWr6DgAnb9uCdIWSGgy34XTd3aOSZa
 OEtPR/tvBZygxMV9wsflD2GNNLe7QDrOMUnvFSlmxBOUolclbHj9uhB/fQXN7frN
 Q/nf5QluBqZK13CIbiKSPy0wfl/hEdSFsOs5jAgMGm4IsZjSpsw2lvzxlfEaI7U/
 QzNHpqAc0ynPI9fbvs2LTkNFR1oe+njOIVvu0QMjOXEdnyOGEbFjX5eDNiKSAih4
 R3cNh2T16yUsx99lVbGkJAwbBQTmdp2yvfugQVX5qDNi+Ln8TFUKUHgruUv/FYJw
 hUjcOL6cjGdWORpWkxSoEariA6zDjKCWiyMu5w2yzSufI+DJ0AI6MQVOeqaX6dm6
 EldlxDO3w7uvXmwpH1RZsHXCqWfyiHn4P5LsSuVy/wM2O/VemaGQuHsxnLtMMJ+q
 HGniSziE6LAvF0RvBrngFGhAY6rqMIGzXK/+S1Z/YwM9+tYnoYhbANDhjmywrcI5
 GWaKePV5giTXlaI/XertjzEpQ2yo8r2HkYoVowV3NaRNrc3qgnQ=
 =X7mM
 -----END PGP SIGNATURE-----

Merge tag 'misc-fixes-20211007' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs

Pull netfslib, cachefiles and afs fixes from David Howells:

 - Fix another couple of oopses in cachefiles tracing stemming from the
   possibility of passing in a NULL object pointer

 - Fix netfs_clear_unread() to set READ on the iov_iter so that source
   it is passed to doesn't do the wrong thing (some drivers look at the
   flag on iov_iter rather than other available information to determine
   the direction)

 - Fix afs_launder_page() to write back at the correct file position on
   the server so as not to corrupt data

* tag 'misc-fixes-20211007' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs:
  afs: Fix afs_launder_page() to set correct start file position
  netfs: Fix READ/WRITE confusion when calling iov_iter_xarray()
  cachefiles: Fix oops with cachefiles_cull() due to NULL object
 2021-10-07 11:20:08 -07:00
Linus Torvalds
14df9235aa perf tools fixes for v5.15: 3rd batch 
- Fix plugin static linking with libopencsd on ARM and ARM64.
 
 - Add missing -lstdc++ when linking with libopencsd.
 
 - Add missing topdown metrics events to 'perf test attr'.
 
 - Plug leak sys_event_tables list after processing JSON vendor events entries.
 
 - Sync sound/asound.h copy with the kernel sources.
 
 Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQR2GiIUctdOfX2qHhGyPKLppCJ+JwUCYV8V0gAKCRCyPKLppCJ+
 JwEKAQCqrmoaUcX3hsrb1GqRNVgVpxztL+GmfK8dL9IEWZxSfgEA6ekSZzSx8bn/
 i7t3ccKYYuDKA0nqtB5hcaXFArqVTQA=
 =AIE3
 -----END PGP SIGNATURE-----

Merge tag 'perf-tools-fixes-for-v5.15-2021-10-07' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux

Pull perf tools fixes from Arnaldo Carvalho de Melo:

 - Fix plugin static linking with libopencsd on ARM and ARM64

 - Add missing -lstdc++ when linking with libopencsd

 - Add missing topdown metrics events to 'perf test attr'

 - Plug leak sys_event_tables list after processing JSON vendor events
   entries

 - Sync sound/asound.h copy with the kernel sources

* tag 'perf-tools-fixes-for-v5.15-2021-10-07' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux:
  perf tests attr: Add missing topdown metrics events
  tools include UAPI: Sync sound/asound.h copy with the kernel sources
  perf build: Fix plugin static linking with libopencsd on ARM and ARM64
  perf build: Add missing -lstdc++ when linking with libopencsd
  perf jevents: Free the sys_event_tables list after processing entries
 2021-10-07 10:58:42 -07:00
Linus Torvalds
4a16df549d Networking fixes for 5.15-rc5, including fixes from xfrm, bpf, 
netfilter, and wireless.
 
 Current release - regressions:
 
  - xfrm: fix XFRM_MSG_MAPPING ABI breakage caused by inserting
    a new value in the middle of an enum
 
  - unix: fix an issue in unix_shutdown causing the other end
    read/write failures
 
  - phy: mdio: fix memory leak
 
 Current release - new code bugs:
 
  - mlx5e: improve MQPRIO resiliency against bad configs
 
 Previous releases - regressions:
 
  - bpf: fix integer overflow leading to OOB access in map element
    pre-allocation
 
  - stmmac: dwmac-rk: fix ethernet on rk3399 based devices
 
  - netfilter: conntrack: fix boot failure with nf_conntrack.enable_hooks=1
 
  - brcmfmac: revert using ISO3166 country code and 0 rev as fallback
 
  - i40e: fix freeing of uninitialized misc IRQ vector
 
  - iavf: fix double unlock of crit_lock
 
 Previous releases - always broken:
 
  - bpf, arm: fix register clobbering in div/mod implementation
 
  - netfilter: nf_tables: correct issues in netlink rule change
    event notifications
 
  - dsa: tag_dsa: fix mask for trunked packets
 
  - usb: r8152: don't resubmit rx immediately to avoid soft lockup
    on device unplug
 
  - i40e: fix endless loop under rtnl if FW fails to correctly
    respond to capability query
 
  - mlx5e: fix rx checksum offload coexistence with ipsec offload
 
  - mlx5: force round second at 1PPS out start time and allow it
    only in supported clock modes
 
  - phy: pcs: xpcs: fix incorrect CL37 AN sequence, EEE disable
    sequence
 
 Misc:
 
  - xfrm: slightly rejig the new policy uAPI to make it less cryptic
 
 Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEE6jPA+I1ugmIBA4hXMUZtbf5SIrsFAmFfEpUACgkQMUZtbf5S
 Iru3vQ//fgm+pdDE860BXmLEgrbJTHU4rq/YD1vwZBcWw/i5wI1vnLr6BzZsdPNX
 DkhcKFGOZUTj+8ctuRDuqrkqoDjva6uRjwM0vcPWh5i9sGqJpKjxB3dFksyxJELR
 SnXM3Jmlk7YiGAw9Bi+66OuIwt2ouRLR/bNIwg8/qCnFI1efIF7IPeCpuvKCw/yd
 SOiSBIfuSPD1qcs5Sy4aHZqA8Xr9qbwDNwWQfFLXgNDKEiY7XOSdo3CoCddSxdR+
 2nmpOiz4w68wspapdZn3GSZHYrQh5kjz7b0Aru0Jvw86M79mKp3b9AfJ9uXTcJhp
 4cQBralLnQvLKanvKi1z5CI6NjXx+r6rXI43N6NjHOtjRUPoFMqxZEH0d7o11aT1
 sN3UDgtFtuE9Pfrhnc5ZHuHqFCCyxA6NWD6nt1dUoSEo0oWt9mOHfeoFT4+45fO0
 5no5+1q3EkYdH4jiJlavnM2DMvVzMd6FbxDzWpXJ2j4W1vM6TLkexEJIK4MLGxPV
 76lxeXzcvbM9a0vq5BabR4QbPIAv+A9qYPmXJwPVrvjo+zynwuWc3gMO5hc4EaOf
 FXF2Ka5Jn97jW8/JS7i7Gj6M8GKdyIxaFHgS4MLtJNs6pt3h7m6bSgcIOQZ5psBZ
 dKRYjM2lxeVkvDDmy5Gztkw2asbofYQP004tgagc+jwXP7DwXaY=
 =xzZg
 -----END PGP SIGNATURE-----

Merge tag 'net-5.15-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull networking fixes from Jakub Kicinski:
 "Including fixes from xfrm, bpf, netfilter, and wireless.

  Current release - regressions:

   - xfrm: fix XFRM_MSG_MAPPING ABI breakage caused by inserting a new
     value in the middle of an enum

   - unix: fix an issue in unix_shutdown causing the other end
     read/write failures

   - phy: mdio: fix memory leak

  Current release - new code bugs:

   - mlx5e: improve MQPRIO resiliency against bad configs

  Previous releases - regressions:

   - bpf: fix integer overflow leading to OOB access in map element
     pre-allocation

   - stmmac: dwmac-rk: fix ethernet on rk3399 based devices

   - netfilter: conntrack: fix boot failure with
     nf_conntrack.enable_hooks=1

   - brcmfmac: revert using ISO3166 country code and 0 rev as fallback

   - i40e: fix freeing of uninitialized misc IRQ vector

   - iavf: fix double unlock of crit_lock

  Previous releases - always broken:

   - bpf, arm: fix register clobbering in div/mod implementation

   - netfilter: nf_tables: correct issues in netlink rule change event
     notifications

   - dsa: tag_dsa: fix mask for trunked packets

   - usb: r8152: don't resubmit rx immediately to avoid soft lockup on
     device unplug

   - i40e: fix endless loop under rtnl if FW fails to correctly respond
     to capability query

   - mlx5e: fix rx checksum offload coexistence with ipsec offload

   - mlx5: force round second at 1PPS out start time and allow it only
     in supported clock modes

   - phy: pcs: xpcs: fix incorrect CL37 AN sequence, EEE disable
     sequence

  Misc:

   - xfrm: slightly rejig the new policy uAPI to make it less cryptic"

* tag 'net-5.15-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (66 commits)
  net: prefer socket bound to interface when not in VRF
  iavf: fix double unlock of crit_lock
  i40e: Fix freeing of uninitialized misc IRQ vector
  i40e: fix endless loop under rtnl
  dt-bindings: net: dsa: marvell: fix compatible in example
  ionic: move filter sync_needed bit set
  gve: report 64bit tx_bytes counter from gve_handle_report_stats()
  gve: fix gve_get_stats()
  rtnetlink: fix if_nlmsg_stats_size() under estimation
  gve: Properly handle errors in gve_assign_qpl
  gve: Avoid freeing NULL pointer
  gve: Correct available tx qpl check
  unix: Fix an issue in unix_shutdown causing the other end read/write failures
  net: stmmac: trigger PCS EEE to turn off on link down
  net: pcs: xpcs: fix incorrect steps on disable EEE
  netlink: annotate data races around nlk->bound
  net: pcs: xpcs: fix incorrect CL37 AN sequence
  net: sfp: Fix typo in state machine debug string
  net/sched: sch_taprio: properly cancel timer from taprio_destroy()
  net: bridge: fix under estimation in br_get_linkxstats_size()
  ...
 2021-10-07 09:50:31 -07:00
Linus Torvalds
52bf8031c0 hyperv-fixes for 5.15 
-----BEGIN PGP SIGNATURE-----
 
 iQFHBAABCAAxFiEEIbPD0id6easf0xsudhRwX5BBoF4FAmFeykwTHHdlaS5saXVA
 a2VybmVsLm9yZwAKCRB2FHBfkEGgXhRLCADXOOSGKk4L1vWssRRhLmMXI45ElocY
 EbZ/mXcQhxKnlVhdMNnupGjz+lU5FQGkCCWlhmt9Ml2O6R+lDx+zIUS8BK3Nkom9
 twWjueMtum6yFwDMGYALhptVLjDqVFG71QcW0incghpnAx4s2FVE8h38md5MuUFY
 Kqqf/dRkppSePldHFrRG/e4c6r0WyTsJ6Z9LTU0UYp5GqJcmUJlx7TxxqzGk5Fti
 GpQ5cFS7JX8xHAkRROk/dvwJte1RRnBAW6lIWxwAaDJ6Gbg7mNfOQe7n+/KRO7ZG
 gC5hbkP9tMv2nthLxaFbpu791U4lMZ2WiTLZvbgCseO3FCmToXWZ6TDd
 =1mdq
 -----END PGP SIGNATURE-----

Merge tag 'hyperv-fixes-signed-20211007' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux

Pull hyperv fixes from Wei Liu:

 - Replace uuid.h with types.h in a header (Andy Shevchenko)

 - Avoid sleeping in atomic context in PCI driver (Long Li)

 - Avoid sending IPI to self when it shouldn't (Vitaly Kuznetsov)

* tag 'hyperv-fixes-signed-20211007' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux:
  x86/hyperv: Avoid erroneously sending IPI to 'self'
  hyper-v: Replace uuid.h with types.h
  PCI: hv: Fix sleep while in non-sleep context when removing child devices from the bus
 2021-10-07 09:44:48 -07:00
Rafael J. Wysocki
3fb937f441 PCI: ACPI: Check parent pointer in acpi_pci_find_companion() 
If acpi_pci_find_companion() is called for a device whose parent
pointer is NULL, it will crash when attempting to get the ACPI
companion of the parent due to a NULL pointer dereference in
the ACPI_COMPANION() macro.

This was not a problem before commit 375553a932 ("PCI: Setup ACPI
fwnode early and at the same time with OF") that made pci_setup_device()
call pci_set_acpi_fwnode() and so it allowed devices with NULL parent
pointers to be passed to acpi_pci_find_companion() which is the case
in pci_iov_add_virtfn(), for instance.

Fix this issue by making acpi_pci_find_companion() check the device's
parent pointer upfront and bail out if it is NULL.

While pci_iov_add_virtfn() can be changed to set the device's parent
pointer before calling pci_setup_device() for it, checking pointers
against NULL before dereferencing them is prudent anyway and looking
for ACPI companions of virtual functions isn't really useful.

Fixes: 375553a932 ("PCI: Setup ACPI fwnode early and at the same time with OF")
Link: https://lore.kernel.org/linux-acpi/8e4bbd5c59de31db71f718556654c0aa077df03d.camel@linux.ibm.com/
Reported-by: Niklas Schnelle <schnelle@linux.ibm.com>
Tested-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Acked-by: Bjorn Helgaas <bhelgaas@google.com>
 2021-10-07 18:42:44 +02:00
Sven Peter
56dd050236 MAINTAINERS: Add Sven Peter as ARM/APPLE MACHINE maintainer 
Hector suggested I should add myself to help him maintain the
platform.

Acked-by: Hector Martin <marcan@marcan.st>
Signed-off-by: Sven Peter <sven@svenpeter.dev>
 2021-10-08 01:16:48 +09:00
Alyssa Rosenzweig
e47e3fa17c MAINTAINERS: Add Alyssa Rosenzweig as M1 reviewer 
Add myself as a reviewer for Asahi Linux (Apple M1) patches.

I would like to be CC'ed on Asahi Linux patches for review and testing.
I am also collecting Asahi Linux patches downstream, rebasing on
linux-next periodically, and would like to be notified of what to
cherry-pick from lists.

Cc: Hector Martin <marcan@marcan.st>
Cc: Sven Peter <sven@svenpeter.dev>
Acked-by: Hector Martin <marcan@marcan.st>
Acked-by: Sven Peter <sven@svenpeter.dev>
Signed-off-by: Alyssa Rosenzweig <alyssa@rosenzweig.io>
 2021-10-08 01:16:34 +09:00
Namjae Jeon
64e7875560 ksmbd: fix oops from fuse driver 
Marios reported kernel oops from fuse driver when ksmbd call
mark_inode_dirty(). This patch directly update ->i_ctime after removing
mark_inode_ditry() and notify_change will put inode to dirty list.

Cc: Tom Talpey <tom@talpey.com>
Cc: Ronnie Sahlberg <ronniesahlberg@gmail.com>
Cc: Ralph Böhme <slow@samba.org>
Cc: Hyunchul Lee <hyc.lee@gmail.com>
Reported-by: Marios Makassikis <mmakassikis@freebox.fr>
Tested-by: Marios Makassikis <mmakassikis@freebox.fr>
Acked-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
 2021-10-07 10:18:36 -05:00
Namjae Jeon
2db72604f3 ksmbd: fix version mismatch with out of tree 
Fix version mismatch with out of tree, This updated version will be
matched with ksmbd-tools.

Cc: Tom Talpey <tom@talpey.com>
Cc: Ronnie Sahlberg <ronniesahlberg@gmail.com>
Cc: Ralph Böhme <slow@samba.org>
Cc: Steve French <smfrench@gmail.com>
Cc: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
 2021-10-07 10:18:34 -05:00