summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2023-04-17arm64/cpufeature: Consistently use symbolic constants for min_field_valueMark Brown
A number of the cpufeatures use raw numbers for the minimum field values specified rather than symbolic constants. In preparation for the use of helper macros replace all these with the appropriate constants. No change in the generated binary. Signed-off-by: Mark Brown <broonie@kernel.org> Link: https://lore.kernel.org/r/20230303-arm64-cpufeature-helpers-v2-2-4c8f28a6f203@kernel.org Signed-off-by: Will Deacon <will@kernel.org>
2023-04-17arm64/cpufeature: Pull out helper for CPUID register definitionsMark Brown
We use the same structure to match hwcaps and CPU features so we can use the same helper to generate the fields required. Pull the portion of the current hwcaps helper that initialises the fields out into a separate define placed earlier in the file so we can use it for cpufeatures. No functional change. Signed-off-by: Mark Brown <broonie@kernel.org> Link: https://lore.kernel.org/r/20230303-arm64-cpufeature-helpers-v2-1-4c8f28a6f203@kernel.org Signed-off-by: Will Deacon <will@kernel.org>
2023-04-17arm64/sysreg: Convert HFGITR_EL2 to automatic generationMark Brown
Automatically generate the Hypervisor Fine-Grained Instruction Trap Register as per DDI0601 2023-03, currently we only have a definition for the register name not any of the contents. No functional change. Signed-off-by: Mark Brown <broonie@kernel.org> Link: https://lore.kernel.org/r/20230306-arm64-fgt-reg-gen-v5-1-516a89cb50f6@kernel.org Signed-off-by: Will Deacon <will@kernel.org>
2023-04-17ACPI: AGDI: Improve error reporting for problems during .remove()Uwe Kleine-König
Returning an error value in a platform driver's remove callback results in a generic error message being emitted by the driver core, but otherwise it doesn't make a difference. The device goes away anyhow. So instead of triggering the generic platform error message, emit a more helpful message if a problem occurs and return 0 to suppress the generic message. This patch is a preparation for making platform remove callbacks return void. Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Reviewed-by: Lorenzo Pieralisi <lpieralisi@kernel.org> Link: https://lore.kernel.org/r/20221014160623.467195-1-u.kleine-koenig@pengutronix.de Signed-off-by: Will Deacon <will@kernel.org>
2023-04-17platform/x86: x86-android-tablets: Add accelerometer support for Yoga Tablet ↵Hans de Goede
2 1050/830 series The Yoga Tablet 2 1050/830 series have a LSM303DA accelerometer + magnetometer (IMU), add this to the list of i2c_clients to instantiate on these models. Signed-off-by: Hans de Goede <hdegoede@redhat.com> Link: https://lore.kernel.org/r/20230416212841.311152-4-hdegoede@redhat.com
2023-04-17platform/x86: x86-android-tablets: Add "yogabook-touch-kbd-digitizer-switch" ↵Hans de Goede
pdev for Lenovo Yoga Book Add a "yogabook-touch-kbd-digitizer-switch" platform-device, for the lenovo-yogabook driver to bind to, to the x86_dev_info for the Lenovo Yoga Book 1 Android models (yb1-x90f/l). Signed-off-by: Hans de Goede <hdegoede@redhat.com> Link: https://lore.kernel.org/r/20230416212841.311152-3-hdegoede@redhat.com
2023-04-17platform/x86: x86-android-tablets: Add Wacom digitizer info for Lenovo Yoga BookHans de Goede
The Lenovo Yoga Book has a wacom digitizer in its keyboard half, add the necessary info to instantiate an i2c_client for the digitizer. Signed-off-by: Hans de Goede <hdegoede@redhat.com> Link: https://lore.kernel.org/r/20230416212841.311152-2-hdegoede@redhat.com
2023-04-17platform/x86: x86-android-tablets: Update Yoga Book HiDeep touchscreen commentHans de Goede
After recent i2c-hid-of changes, the i2c-hid-of driver could be used for the Yoga Book HiDeep touchscreen comment instead of the native hideep driver. Update the comment to reflect this. Signed-off-by: Hans de Goede <hdegoede@redhat.com> Link: https://lore.kernel.org/r/20230416212841.311152-1-hdegoede@redhat.com
2023-04-17netfilter: nf_tables: fix ifdef to also consider nf_tables=mFlorian Westphal
nftables can be built as a module, so fix the preprocessor conditional accordingly. Fixes: 478b360a47b7 ("netfilter: nf_tables: fix nf_trace always-on with XT_TRACE=n") Reported-by: Florian Fainelli <f.fainelli@gmail.com> Reported-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2023-04-17platform/x86: thinkpad_acpi: Fix Embedded Controller access on X380 YogaDaniel Bertalan
On the X380 Yoga, the `ECRD` and `ECWR` ACPI objects cannot be used for accessing the Embedded Controller: instead of a method that reads from the EC's memory, `ECRD` is the name of a location in high memory. This meant that trying to call them would fail with the following message: ACPI: \_SB.PCI0.LPCB.EC.ECRD: 1 arguments were passed to a non-method ACPI object (RegionField) With this commit, it is now possible to access the EC and read temperature and fan speed information. Note that while writes to the HFSP register do go through (as indicated by subsequent reads showing the new value), the fan does not actually change its speed. Signed-off-by: Daniel Bertalan <dani@danielbertalan.dev> Link: https://lore.kernel.org/r/20230414180034.63914-1-dani@danielbertalan.dev Reviewed-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Hans de Goede <hdegoede@redhat.com>
2023-04-17platform/x86/intel/sdsi: Change mailbox timeoutDavid E. Box
On some platforms, it may take up to 400ms for the ready bit to be set in a successful mailbox transaction. Set the timeout to 500ms to cover the worst case. Signed-off-by: David E. Box <david.e.box@linux.intel.com> Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Link: https://lore.kernel.org/r/20230413013230.1521584-1-david.e.box@linux.intel.com Signed-off-by: Hans de Goede <hdegoede@redhat.com>
2023-04-17platform/x86/intel/pmt: Ignore uninitialized entriesDavid E. Box
On Intel Xeon, unused PMT regions will have uninitialized discovery headers containing all 0xF. Instead of returning an error, just skip the region. Signed-off-by: David E. Box <david.e.box@linux.intel.com> Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Link: https://lore.kernel.org/r/20230413012922.1521377-1-david.e.box@linux.intel.com Signed-off-by: Hans de Goede <hdegoede@redhat.com>
2023-04-17dt-bindings: mmc: sdhci-msm: Document the IPQ5018 compatibleSricharan Ramabadhran
Document the compatible for SDHCI on IPQ5018. Signed-off-by: Sricharan Ramabadhran <quic_srichara@quicinc.com> Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Link: https://lore.kernel.org/r/1681468167-11689-8-git-send-email-quic_srichara@quicinc.com Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2023-04-17mmc: vub300: remove unreachable codeBo Liu
The function sched_partition_show cannot execute return, delete the invalid code. Signed-off-by: Bo Liu <liubo03@inspur.com> Link: https://lore.kernel.org/r/20230412084758.2673-1-liubo03@inspur.com Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2023-04-17mmc: sdhci-cadence: Support mmc hardware resetBrad Larson
Add support for mmc hardware reset using a reset-controller that would need to be enabled in the device tree with a supporting driver. The default is disabled for all existing designs. Signed-off-by: Brad Larson <blarson@amd.com> Acked-by: Adrian Hunter <adrian.hunter@intel.com> Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de> Link: https://lore.kernel.org/r/20230410184526.15990-15-blarson@amd.com Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2023-04-17mmc: sdhci-cadence: Add AMD Pensando Elba SoC supportBrad Larson
Add support for AMD Pensando Elba SoC which explicitly controls byte-lane enables on writes. Select MMC_SDHCI_IO_ACCESSORS for MMC_SDHCI_CADENCE which allows Elba SoC sdhci_elba_ops to overwrite the SDHCI IO memory accessors Signed-off-by: Brad Larson <blarson@amd.com> Acked-by: Adrian Hunter <adrian.hunter@intel.com> Link: https://lore.kernel.org/r/20230410184526.15990-14-blarson@amd.com Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2023-04-17mmc: sdhci-cadence: Support device specific init during probeBrad Larson
Move struct sdhci_pltfm_data under new struct sdhci_cdns_drv_data. Add an init() into sdhci_cdns_drv_data for platform specific device initialization in the device probe which is not used for existing devices. Signed-off-by: Brad Larson <blarson@amd.com> Acked-by: Adrian Hunter <adrian.hunter@intel.com> Link: https://lore.kernel.org/r/20230410184526.15990-13-blarson@amd.com Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2023-04-17mmc: sdhci-cadence: Enable device specific override of writel()Brad Larson
SoCs with device specific Cadence implementation, such as setting byte-enables before the write, need to override writel(). Add a callback where the default is writel() for all existing chips. Signed-off-by: Brad Larson <blarson@amd.com> Acked-by: Adrian Hunter <adrian.hunter@intel.com> Link: https://lore.kernel.org/r/20230410184526.15990-12-blarson@amd.com Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2023-04-17dt-bindings: mmc: cdns: Add AMD Pensando Elba SoCBrad Larson
AMD Pensando Elba ARM 64-bit SoC is integrated with this IP and explicitly controls byte-lane enables. Signed-off-by: Brad Larson <blarson@amd.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Link: https://lore.kernel.org/r/20230410184526.15990-3-blarson@amd.com Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2023-04-17drm/rockchip: vop2: fix suspend/resumeSascha Hauer
During a suspend/resume cycle the VO power domain will be disabled and the VOP2 registers will reset to their default values. After that the cached register values will be out of sync and the read/modify/write operations we do on the window registers will result in bogus values written. Fix this by re-initializing the register cache each time we enable the VOP2. With this the VOP2 will show a picture after a suspend/resume cycle whereas without this the screen stays dark. Fixes: 604be85547ce4 ("drm/rockchip: Add VOP2 driver") Cc: stable@vger.kernel.org Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de> Tested-by: Chris Morgan <macromorgan@hotmail.com> Signed-off-by: Heiko Stuebner <heiko@sntech.de> Link: https://patchwork.freedesktop.org/patch/msgid/20230413144347.3506023-1-s.hauer@pengutronix.de
2023-04-17platform/x86: amd: pmc: provide user message where s0ix is not supportedShyam Sundar S K
Some platforms do not support hardware backed s0i3 transitions. When such CPUs are detected, provide a warning message to the user. Suggested-by: Sanket Goswami <Sanket.Goswami@amd.com> Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com> Reviewed-by: Mario Limonciello <mario.limonciello@amd.com> Link: https://lore.kernel.org/r/20230412111500.2602529-1-Shyam-sundar.S-k@amd.com Reviewed-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Hans de Goede <hdegoede@redhat.com>
2023-04-17net/sched: clear actions pointer in miss cookie init failPedro Tammela
Palash reports a UAF when using a modified version of syzkaller[1]. When 'tcf_exts_miss_cookie_base_alloc()' fails in 'tcf_exts_init_ex()' a call to 'tcf_exts_destroy()' is made to free up the tcf_exts resources. In flower, a call to '__fl_put()' when 'tcf_exts_init_ex()' fails is made; Then calling 'tcf_exts_destroy()', which triggers an UAF since the already freed tcf_exts action pointer is lingering in the struct. Before the offending patch, this was not an issue since there was no case where the tcf_exts action pointer could linger. Therefore, restore the old semantic by clearing the action pointer in case of a failure to initialize the miss_cookie. [1] https://github.com/cmu-pasta/linux-kernel-enriched-corpus v1->v2: Fix compilation on configs without tc actions (kernel test robot) Fixes: 80cd22c35c90 ("net/sched: cls_api: Support hardware miss to tc action") Reported-by: Palash Oswal <oswalpalash@gmail.com> Acked-by: Jamal Hadi Salim <jhs@mojatatu.com> Signed-off-by: Pedro Tammela <pctammela@mojatatu.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2023-04-17arm64: dts: rockchip: Add vdd_cpu_big regulators to rk3588-rock-5bCristian Ciocaltea
The RK8602 and RK8603 voltage regulators on the Rock 5B board provide the power lines vdd_cpu_big0 and vdd_cpu_big1, respectively. Add the necessary device tree nodes and bind them to the corresponding CPU big core nodes. Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com> Link: https://lore.kernel.org/r/20230414125425.124994-4-cristian.ciocaltea@collabora.com Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2023-04-17arm64: dts: rockchip: Use generic name for es8316 on Pinebook Pro and Rock 5BCristian Ciocaltea
Use generic 'audio-codec' name for es8316 node on Pinebook Pro and Rock 5B boards. Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com> Link: https://lore.kernel.org/r/20230414125425.124994-3-cristian.ciocaltea@collabora.com Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2023-04-17arm64: dts: rockchip: Drop RTC clock-frequency on rk3588-rock-5bCristian Ciocaltea
The hym8563 RTC driver doesn't handle the 'clock-frequency' property, which is also indicated by the following dtbs_check warning: rk3588-rock-5b.dtb: rtc@51: Unevaluated properties are not allowed ('clock-frequency' was unexpected) From schema: Documentation/devicetree/bindings/rtc/haoyu,hym8563.yaml Drop the unsupported property. Fixes: 1e9c2404d887 ("arm64: dts: rockchip: Enable RTC support for Rock 5B") Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com> Link: https://lore.kernel.org/r/20230414125425.124994-2-cristian.ciocaltea@collabora.com Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2023-04-17arm64: dts: apple: t8112: Add PWM controllerSasha Finkelstein
This patch adds the device tree entries for the PWM controller present on M2 macbooks that is connected to the keyboard backlight. Signed-off-by: Sasha Finkelstein <fnkl.kernel@gmail.com> Signed-off-by: Hector Martin <marcan@marcan.st>
2023-04-17platform/x86/amd: pmc: Fix memory leak in amd_pmc_stb_debugfs_open_v2()Feng Jiang
Function amd_pmc_stb_debugfs_open_v2() may be called when the STB debug mechanism enabled. When amd_pmc_send_cmd() fails, the 'buf' needs to be released. Signed-off-by: Feng Jiang <jiangfeng@kylinos.cn> Link: https://lore.kernel.org/r/20230412093734.1126410-1-jiangfeng@kylinos.cn Reviewed-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Hans de Goede <hdegoede@redhat.com>
2023-04-17arm64: dts: apple: t600x: Add PWM controllerSasha Finkelstein
Adds PWM controller and keyboard backlight bindings for M1 Pro/Max MacBook Pros Signed-off-by: Sasha Finkelstein <fnkl.kernel@gmail.com> Acked-by: Hector Martin <marcan@marcan.st> Signed-off-by: Hector Martin <marcan@marcan.st>
2023-04-17arm64: dts: apple: t8103: Add PWM controllerSasha Finkelstein
Adds PWM controller and keyboard backlight bindings for M1 MacBooks Signed-off-by: Sasha Finkelstein <fnkl.kernel@gmail.com> Acked-by: Sven Peter <sven@svenpeter.dev> Signed-off-by: Hector Martin <marcan@marcan.st>
2023-04-17arm64: dts: rockchip: Add pinctrl gpio-ranges for rk356xJohn Clark
Add gpio-range properties to the pinctrl gpio nodes in rk356x.dtsi Signed-off-by: John Clark <inindev@gmail.com> Link: https://lore.kernel.org/r/20230413170337.6815-1-inindev@gmail.com Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2023-04-17mlxbf-bootctl: Add sysfs file for BlueField boot fifoLiming Sun
This commit adds sysfs file for BlueField boot fifo. The boot fifo is usually used to push boot stream via USB or PCIe. Once OS is up, it can be reused by applications to read data or configuration from external host. Signed-off-by: Liming Sun <limings@nvidia.com> Reviewed-by: David Thompson <davthompson@nvidia.com> Link: https://lore.kernel.org/r/52b0b00dacbc4aad3169dd3667d79c85e334783b.1680657571.git.limings@nvidia.com Reviewed-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Hans de Goede <hdegoede@redhat.com>
2023-04-17drm/exynos: Implement fbdev emulation as in-kernel clientThomas Zimmermann
Move code from ad-hoc fbdev callbacks into DRM client functions and remove the old callbacks. The functions instruct the client to poll for changed output or restore the display. The DRM core calls both, the old callbacks and the new client helpers, from the same places. The new functions perform the same operation as before, so there's no change in functionality. Replace all code that initializes or releases fbdev emulation throughout the driver. Instead initialize the fbdev client by a single call to exynos_fbdev_setup() after exynos has registered its DRM device. As in most drivers, exynos' fbdev emulation now acts like a regular DRM client. The fbdev client setup consists of the initial preparation and the hot-plugging of the display. The latter creates the fbdev device and sets up the fbdev framebuffer. The setup performs display hot-plugging once. If no display can be detected, DRM probe helpers re-run the detection on each hotplug event. A call to drm_dev_unregister() releases the client automatically. No further action is required within exynos. If the fbdev framebuffer has been fully set up, struct fb_ops.fb_destroy implements the release. For partially initialized emulation, the fbdev client reverts the initial setup. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Tested-by: Marek Szyprowski <m.szyprowski@samsung.com> Signed-off-by: Inki Dae <inki.dae@samsung.com>
2023-04-17drm/exynos: Initialize fbdev DRM clientThomas Zimmermann
Initialize the fbdev client in the fbdev code with empty helper functions. Also clean up the client. The helpers will later implement various functionality of the DRM client. No functional changes. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Tested-by: Marek Szyprowski <m.szyprowski@samsung.com> Signed-off-by: Inki Dae <inki.dae@samsung.com>
2023-04-17drm/exynos: Remove fb_helper from struct exynos_drm_privateThomas Zimmermann
The DRM device stores a pointer to the fbdev helper. Remove struct exynos_drm_private.fb_helper, which contains the same value. No functional changes. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Tested-by: Marek Szyprowski <m.szyprowski@samsung.com> Signed-off-by: Inki Dae <inki.dae@samsung.com>
2023-04-17drm/exynos: Remove struct exynos_drm_fbdevThomas Zimmermann
Remove struct exynos_drm_fbdev, which is an empty wrapper around struct drm_fb_helper. Use the latter directly. No functional changes. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Tested-by: Marek Szyprowski <m.szyprowski@samsung.com> Signed-off-by: Inki Dae <inki.dae@samsung.com>
2023-04-17drm/exynos: Remove exynos_gem from struct exynos_drm_fbdevThomas Zimmermann
Fbdev's framebuffer stores a pointer to the GEM object. Remove struct exynos_drm_fbdev.exynos_gem, which contains the same value. No functional changes. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Tested-by: Marek Szyprowski <m.szyprowski@samsung.com> Signed-off-by: Inki Dae <inki.dae@samsung.com>
2023-04-17mmc: core: Remove unused macro mmc_req_rel_wrBean Huo
There is no user for macro mmc_req_rel_wr, so delete it. Signed-off-by: Bean Huo <beanhuo@micron.com> Link: https://lore.kernel.org/r/20230403221754.16168-1-beanhuo@iokpp.de Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2023-04-17mmc: sdhci-of-arasan: Skip setting clock delay for 400KHzSai Krishna Potthuri
Clock delay settings are not defined for 400KHz, so add frequency check to skip calling the clock delay settings when frequency is <=400KHz. Signed-off-by: Sai Krishna Potthuri <sai.krishna.potthuri@amd.com> Acked-by: Adrian Hunter <adrian.hunter@intel.com> Link: https://lore.kernel.org/r/20230403102551.3763054-4-sai.krishna.potthuri@amd.com Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2023-04-17mmc: sdhci-of-arasan: Add support for eMMC5.1 on Xilinx Versal Net platformSwati Agarwal
Add support for eMMC5.1 on Xilinx Versal Net platform - Add new compatible string(xlnx,versal-net-emmc). - Add support for PHY which is part of Host Controller register space. - Add DLL and Delay Chain mode support and corresponding tap delays for all eMMC modes. - Add Strobe select tap for HS400 mode. Signed-off-by: Swati Agarwal <swati.agarwal@amd.com> Co-developed-by: Sai Krishna Potthuri <sai.krishna.potthuri@amd.com> Signed-off-by: Sai Krishna Potthuri <sai.krishna.potthuri@amd.com> Acked-by: Adrian Hunter <adrian.hunter@intel.com> Link: https://lore.kernel.org/r/20230403102551.3763054-3-sai.krishna.potthuri@amd.com Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2023-04-17dt-bindings: mmc: arasan,sdci: Add Xilinx Versal Net compatibleSai Krishna Potthuri
Add Xilinx Versal Net compatible to support eMMC 5.1 PHY. Signed-off-by: Sai Krishna Potthuri <sai.krishna.potthuri@amd.com> Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Link: https://lore.kernel.org/r/20230403102551.3763054-2-sai.krishna.potthuri@amd.com Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2023-04-17drm/i915: Fix fast wake AUX sync lenVille Syrjälä
Fast wake should use 8 SYNC pulses for the preamble and 10-16 SYNC pulses for the precharge. Reduce our fast wake SYNC count to match the maximum value. We also use the maximum precharge length for normal AUX transactions. Cc: stable@vger.kernel.org Cc: Jouni Högander <jouni.hogander@intel.com> Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20230329172434.18744-1-ville.syrjala@linux.intel.com Reviewed-by: Jouni Högander <jouni.hogander@intel.com> (cherry picked from commit 605f7c73133341d4b762cbd9a22174cc22d4c38b) Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2023-04-17sfc: Fix use-after-free due to selftest_workDing Hui
There is a use-after-free scenario that is: When the NIC is down, user set mac address or vlan tag to VF, the xxx_set_vf_mac() or xxx_set_vf_vlan() will invoke efx_net_stop() and efx_net_open(), since netif_running() is false, the port will not start and keep port_enabled false, but selftest_work is scheduled in efx_net_open(). If we remove the device before selftest_work run, the efx_stop_port() will not be called since the NIC is down, and then efx is freed, we will soon get a UAF in run_timer_softirq() like this: [ 1178.907941] ================================================================== [ 1178.907948] BUG: KASAN: use-after-free in run_timer_softirq+0xdea/0xe90 [ 1178.907950] Write of size 8 at addr ff11001f449cdc80 by task swapper/47/0 [ 1178.907950] [ 1178.907953] CPU: 47 PID: 0 Comm: swapper/47 Kdump: loaded Tainted: G O --------- -t - 4.18.0 #1 [ 1178.907954] Hardware name: SANGFOR X620G40/WI2HG-208T1061A, BIOS SPYH051032-U01 04/01/2022 [ 1178.907955] Call Trace: [ 1178.907956] <IRQ> [ 1178.907960] dump_stack+0x71/0xab [ 1178.907963] print_address_description+0x6b/0x290 [ 1178.907965] ? run_timer_softirq+0xdea/0xe90 [ 1178.907967] kasan_report+0x14a/0x2b0 [ 1178.907968] run_timer_softirq+0xdea/0xe90 [ 1178.907971] ? init_timer_key+0x170/0x170 [ 1178.907973] ? hrtimer_cancel+0x20/0x20 [ 1178.907976] ? sched_clock+0x5/0x10 [ 1178.907978] ? sched_clock_cpu+0x18/0x170 [ 1178.907981] __do_softirq+0x1c8/0x5fa [ 1178.907985] irq_exit+0x213/0x240 [ 1178.907987] smp_apic_timer_interrupt+0xd0/0x330 [ 1178.907989] apic_timer_interrupt+0xf/0x20 [ 1178.907990] </IRQ> [ 1178.907991] RIP: 0010:mwait_idle+0xae/0x370 If the NIC is not actually brought up, there is no need to schedule selftest_work, so let's move invoking efx_selftest_async_start() into efx_start_all(), and it will be canceled by broughting down. Fixes: dd40781e3a4e ("sfc: Run event/IRQ self-test asynchronously when interface is brought up") Fixes: e340be923012 ("sfc: add ndo_set_vf_mac() function for EF10") Debugged-by: Huang Cun <huangcun@sangfor.com.cn> Cc: Donglin Peng <pengdonglin@sangfor.com.cn> Suggested-by: Martin Habets <habetsm.xilinx@gmail.com> Signed-off-by: Ding Hui <dinghui@sangfor.com.cn> Signed-off-by: David S. Miller <davem@davemloft.net>
2023-04-17virtio_net: bugfix overflow inside xdp_linearize_page()Xuan Zhuo
Here we copy the data from the original buf to the new page. But we not check that it may be overflow. As long as the size received(including vnethdr) is greater than 3840 (PAGE_SIZE -VIRTIO_XDP_HEADROOM). Then the memcpy will overflow. And this is completely possible, as long as the MTU is large, such as 4096. In our test environment, this will cause crash. Since crash is caused by the written memory, it is meaningless, so I do not include it. Fixes: 72979a6c3590 ("virtio_net: xdp, add slowpath case for non contiguous buffers") Signed-off-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com> Acked-by: Jason Wang <jasowang@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2023-04-17drm/i915: Fix memory leaks in i915 selftestsCong Liu
This patch fixes memory leaks on error escapes in function fake_get_pages Fixes: c3bfba9a2225 ("drm/i915: Check for integer truncation on scatterlist creation") Signed-off-by: Cong Liu <liucong2@kylinos.cn> Reviewed-by: Andrzej Hajda <andrzej.hajda@intel.com> Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com> Signed-off-by: Andi Shyti <andi.shyti@linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20230414224109.1051922-1-andi.shyti@linux.intel.com (cherry picked from commit 8bfbdadce85c4c51689da10f39c805a7106d4567) Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
2023-04-17drm/i915: Make intel_get_crtc_new_encoder() less oopsyVille Syrjälä
The point of the WARN was to print something, not oops straight up. Currently that is precisely what happens if we can't find the connector for the crtc in the atomic state. Get the dev pointer from the atomic state instead of the potentially NULL encoder to avoid that. Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20230413200602.6037-2-ville.syrjala@linux.intel.com Fixes: 3a47ae201e07 ("drm/i915/display: Make WARN* drm specific where encoder ptr is available") Reviewed-by: Jani Nikula <jani.nikula@intel.com> (cherry picked from commit 3b6692357f70498f617ea1b31a0378070a0acf1c) Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
2023-04-17drm/i915/gt: Avoid out-of-bounds access when loading HuCLucas De Marchi
When HuC is loaded by GSC, there is no header definition for the kernel to look at and firmware is just handed to GSC. However when reading the version, it should still check the size of the blob to guarantee it's not incurring into out-of-bounds array access. If firmware is smaller than expected, the following message is now printed: # echo boom > /lib/firmware/i915/dg2_huc_gsc.bin # dmesg | grep -i huc [drm] GT0: HuC firmware i915/dg2_huc_gsc.bin: invalid size: 5 < 184 [drm] *ERROR* GT0: HuC firmware i915/dg2_huc_gsc.bin: fetch failed -ENODATA ... Even without this change the size, header and signature are still checked by GSC when loading, so this only avoids the out-of-bounds array access. Fixes: a7b516bd981f ("drm/i915/huc: Add fetch support for gsc-loaded HuC binary") Cc: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com> Cc: Alan Previn <alan.previn.teres.alexis@intel.com> Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com> Reviewed-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20230413200349.3492571-1-lucas.demarchi@intel.com (cherry picked from commit adfbae9ffe339eed08d54a4eb87c93f4b35f214b) Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
2023-04-17Merge tag 'amd-drm-next-6.4-2023-04-14' of ↵Dave Airlie
https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-next-6.4-2023-04-14: amdgpu: - S4 fixes for APUs - GFX11 fixes - Misc code cleanups - DCN 3.2 fixes - DCN 3.1.4 fixes - FPO/FAMS work to improve display power savings - DP fixes - UMC 8.10 code cleanup - SDMA v4 fix - GPU clock counter fixes - SMU 13 fixes - Sdma v6 invalidation fix for preemption - RAS fixes - S0ix fix - GC 9.4.3 updates amdkfd: - Fix user pointers with IOMMU - Fix coherency flag handling Signed-off-by: Dave Airlie <airlied@redhat.com> From: Alex Deucher <alexander.deucher@amd.com> Link: https://patchwork.freedesktop.org/patch/msgid/20230414204609.7942-1-alexander.deucher@amd.com
2023-04-16cifs: avoid dup prefix path in dfs_get_automount_devname()Paulo Alcantara
@server->origin_fullpath already contains the tree name + optional prefix, so avoid calling __build_path_from_dentry_optional_prefix() as it might end up duplicating prefix path from @cifs_sb->prepath into final full path. Instead, generate DFS full path by simply merging @server->origin_fullpath with dentry's path. This fixes the following case mount.cifs //root/dfs/dir /mnt/ -o ... ls /mnt/link where cifs_dfs_do_automount() will call smb3_parse_devname() with @devname set to "//root/dfs/dir/link" instead of "//root/dfs/dir/dir/link". Fixes: 7ad54b98fc1f ("cifs: use origin fullpath for automounts") Cc: <stable@vger.kernel.org> # 6.2+ Signed-off-by: Paulo Alcantara (SUSE) <pc@manguebit.com> Signed-off-by: Steve French <stfrench@microsoft.com>
2023-04-16Linux 6.3-rc7v6.3-rc7Linus Torvalds
2023-04-16Revert "userfaultfd: don't fail on unrecognized features"Peter Xu
This is a proposal to revert commit 914eedcb9ba0ff53c33808. I found this when writing a simple UFFDIO_API test to be the first unit test in this set. Two things breaks with the commit: - UFFDIO_API check was lost and missing. According to man page, the kernel should reject ioctl(UFFDIO_API) if uffdio_api.api != 0xaa. This check is needed if the api version will be extended in the future, or user app won't be able to identify which is a new kernel. - Feature flags checks were removed, which means UFFDIO_API with a feature that does not exist will also succeed. According to the man page, we should (and it makes sense) to reject ioctl(UFFDIO_API) if unknown features passed in. Link: https://lore.kernel.org/r/20220722201513.1624158-1-axelrasmussen@google.com Link: https://lkml.kernel.org/r/20230412163922.327282-2-peterx@redhat.com Fixes: 914eedcb9ba0 ("userfaultfd: don't fail on unrecognized features") Signed-off-by: Peter Xu <peterx@redhat.com> Acked-by: David Hildenbrand <david@redhat.com> Cc: Axel Rasmussen <axelrasmussen@google.com> Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: Mike Kravetz <mike.kravetz@oracle.com> Cc: Mike Rapoport (IBM) <rppt@kernel.org> Cc: Zach O'Keefe <zokeefe@google.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
generated by cgit (git 2.34.1) at 2025-10-03 10:32:23 +0000