summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2022-10-28Merge tag 'mtd/fixes-for-6.1-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux Pull mtd fixes from Miquel Raynal: "MTD core: - partitions: Add missing of_node_get() in dynamic partitions code Parser drivers: - bcm47xxpart: Fix halfblock reads Raw NAND controller drivers: - marvell: Use correct logic for nand-keep-config - tegra: Fix PM disable depth imbalance in probe - intel: Add missing of_node_put() in ebu_nand_probe() SPI-NOR core changes: - Ignore -ENOTSUPP in spi_nor_init()" * tag 'mtd/fixes-for-6.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: mtd: parsers: bcm47xxpart: Fix halfblock reads mtd: rawnand: marvell: Use correct logic for nand-keep-config mtd: rawnand: tegra: Fix PM disable depth imbalance in probe mtd: rawnand: intel: Add missing of_node_put() in ebu_nand_probe() mtd: core: add missing of_node_get() in dynamic partitions code mtd: spi-nor: core: Ignore -ENOTSUPP in spi_nor_init()
2022-10-28Merge tag 'sound-6.1-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A collection of small fixes: - fixes for regressions by the recent ALSA control hash usages - fixes for UAF with del_timer() at removals in a few drivers - char signedness fixes - a few memory leak fixes in error paths - device-specific fixes / quirks for Intel SOF, AMD, HD-audio, USB-audio, and various ASoC codecs" * tag 'sound-6.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (50 commits) ALSA: aoa: Fix I2S device accounting ALSA: Use del_timer_sync() before freeing timer ALSA: aoa: i2sbus: fix possible memory leak in i2sbus_add_dev() ALSA: rme9652: use explicitly signed char ALSA: au88x0: use explicitly signed char ALSA: hda/realtek: Add another HP ZBook G9 model quirks ALSA: usb-audio: Add quirks for M-Audio Fast Track C400/600 ASoC: SOF: Intel: hda-codec: fix possible memory leak in hda_codec_device_init() ASoC: amd: yc: Add Lenovo Thinkbook 14+ 2022 21D0 to quirks table ASoC: Intel: Skylake: fix possible memory leak in skl_codec_device_init() ALSA: ac97: Use snd_ctl_rename() to rename a control ALSA: ca0106: Use snd_ctl_rename() to rename a control ALSA: emu10k1: Use snd_ctl_rename() to rename a control ALSA: hda/realtek: Use snd_ctl_rename() to rename a control ALSA: usb-audio: Use snd_ctl_rename() to rename a control ALSA: control: add snd_ctl_rename() ALSA: ac97: fix possible memory leak in snd_ac97_dev_register() ASoC: SOF: Intel: pci-tgl: fix ADL-N descriptor ASoC: qcom: lpass-cpu: Mark HDMI TX parity register as volatile ASoC: amd: yc: Adding Lenovo ThinkBook 14 Gen 4+ ARA and Lenovo ThinkBook 16 Gen 4+ ARA to the Quirks List ...
2022-10-28Merge tag 'drm-fixes-2022-10-28' of git://anongit.freedesktop.org/drm/drmLinus Torvalds
Pull drm fixes from Dave Airlie: "Regularly scheduled fixes for drm, live from a Red Hat office for the first time in a while. The core has two fixes, one for scheduler leak and one for aperture uninit read. Otherwise a single bridge fix, and msm, amdgpu/kfd and i915 have a set of fixes each. sched: - Stop leaking fences when killing a sched entity. aperture: - Avoid uninitialized read in aperture_remove_conflicting_pci_device() bridge: - Fix HPD on bridge/ps8640. msm: - Fix shrinker deadlock - Fix crash during suspend after unbind - Fix IRQ lifetime issues - Fix potential memory corruption with too many bridges - Fix memory corruption on GPU state capture amdgpu: - Stable pstate fix - SMU 13.x updates - SR-IOV fixes - PCI AER fix - GC 11.x fixes - Display fixes - Expose IMU firmware version for debugging - Plane modifier fix - S0i3 fix amdkfd: - Fix possible memory leak - Fix GC 10.x cache info reporting i915: - Extend Wa_1607297627 to Alderlake-P - Keep PCI autosuspend control 'on' by default on all dGPU - Reset frl trained flag before restarting FRL training" * tag 'drm-fixes-2022-10-28' of git://anongit.freedesktop.org/drm/drm: (39 commits) fbdev/core: Avoid uninitialized read in aperture_remove_conflicting_pci_device() drm/amdgpu: disallow gfxoff until GC IP blocks complete s2idle resume drm/scheduler: fix fence ref counting drm/amd/display: Revert logic for plane modifiers drm/amdkfd: correct the cache info for gfx1036 drm/amdkfd: update gfx1037 Lx cache setting drm/amdgpu: skip mes self test for gc 11.0.3 in recover drm/amd: Add IMU fw version to fw version queries drm/amd/display: Don't return false if no stream drm/amd/display: Remove wrong pipe control lock drm/amd/pm: allow gfxoff on gc_11_0_3 drm/amdkfd: Fix memory leak in kfd_mem_dmamap_userptr() drm/amdgpu: Remove ATC L2 access for MMHUB 2.1.x drm/i915/dp: Reset frl trained flag before restarting FRL training drm/i915/dgfx: Keep PCI autosuspend control 'on' by default on all dGPU drm/i915: Extend Wa_1607297627 to Alderlake-P drm/amdgpu: Adjust MES polling timeout for sriov drm/amd/pm: update driver-if header for smu_v13_0_10 drm/amdgpu: fix pstate setting issue drm/bridge: ps8640: Add back the 50 ms mystery delay after HPD ...
2022-10-28ACPI: processor: throttling: remove variable countColin Ian King
Variable count is just being incremented and it's never used anywhere else. The variable and the increment are redundant so remove it. Signed-off-by: Colin Ian King <colin.i.king@gmail.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2022-10-28ACPI: processor: idle: Check acpi_fetch_acpi_dev() return valueLi Zhong
The return value of acpi_fetch_acpi_dev() could be NULL, which would cause a NULL pointer dereference to occur in acpi_device_hid(). Signed-off-by: Li Zhong <floridsleeves@gmail.com> [ rjw: Subject and changelog edits, added empty line after if () ] Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2022-10-28Merge tag 'v6.1-p3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fix from Herbert Xu: "Fix an alignment crash in x86/polyval" * tag 'v6.1-p3' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: x86/polyval - Fix crashes when keys are not 16-byte aligned
2022-10-28apei/ghes: Use xchg_release() for updating new cache slot instead of cmpxchg()Ard Biesheuvel
Some documentation first, about how this machinery works: It seems, the intent of the GHES error records cache is to collect already reported errors - see the ghes_estatus_cached() checks. There's even a sentence trying to say what this does: /* * GHES error status reporting throttle, to report more kinds of * errors, instead of just most frequently occurred errors. */ New elements are added to the cache this way: if (!ghes_estatus_cached(estatus)) { if (ghes_print_estatus(NULL, ghes->generic, estatus)) ghes_estatus_cache_add(ghes->generic, estatus); The intent being, once this new error record is reported, it gets cached so that it doesn't get reported for a while due to too many, same-type error records getting reported in burst-like scenarios. I.e., new, unreported error types can have a higher chance of getting reported. Now, the loop in ghes_estatus_cache_add() is trying to pick out the oldest element in there. Meaning, something which got reported already but a long while ago, i.e., a LRU-type scheme. And the cmpxchg() is there presumably to make sure when that selected element slot_cache is removed, it really *is* that element that gets removed and not one which replaced it in the meantime. Now, ghes_estatus_cache_add() selects a slot, and either succeeds in replacing its contents with a pointer to a newly cached item, or it just gives up and frees the new item again, without attempting to select another slot even if one might be available. Since only inserting new items is being done here, the race can only cause a failure if the selected slot was updated with another new item concurrently, which means that it is arbitrary which of those two items gets dropped. And "dropped" here means, the item doesn't get added to the cache so the next time it is seen, it'll get reported again and an insertion attempt will be done again. Eventually, it'll get inserted and all those times when the insertion fails, the item will get reported although the cache is supposed to prevent that and "ratelimit" those repeated error records. Not a big deal in any case. This means the cmpxchg() and the special case are not necessary. Therefore, just drop the existing item unconditionally. Move the xchg_release() and call_rcu() out of rcu_read_lock/unlock section since there is no actually dereferencing the pointer at all. [ bp: - Flesh out and summarize what was discussed on the thread now that that cache contraption is understood; - Touch up code style. ] Co-developed-by: Jia He <justin.he@arm.com> Signed-off-by: Jia He <justin.he@arm.com> Signed-off-by: Ard Biesheuvel <ardb@kernel.org> Signed-off-by: Borislav Petkov <bp@suse.de> Link: https://lore.kernel.org/r/20221010023559.69655-7-justin.he@arm.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2022-10-28MAINTAINERS: Add Manivannan Sadhasivam as Qcom PCIe RC maintainerManivannan Sadhasivam
Stan is moving out of mm-sol and decided not to carry on the maintainership duties of the Qcom PCIe RC driver. Since I'm already maintaining the Qcom PCIe EP driver, I'm volunteering myself to maintain the RC driver also. Link: https://lore.kernel.org/r/20221028160029.44483-1-manivannan.sadhasivam@linaro.org Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Cc: Stanimir Varbanov <svarbanov@mm-sol.com>
2022-10-28ACPI: APEI: Drop unsetting driver data on removeUwe Kleine-König
Since commit 0998d0631001 ("device-core: Ensure drvdata = NULL when no driver is bound") the driver core cares for cleaning driver data, so don't do it in the driver, too. Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2022-10-28spi: tegra210-quad: Don't initialise DMA if not supportedJon Hunter
The following error messages are observed on boot for Tegra234 ... ERR KERN tegra-qspi 3270000.spi: cannot use DMA: -19 ERR KERN tegra-qspi 3270000.spi: falling back to PIO Tegra234 does not support DMA for the QSPI and so initialising the DMA is expected to fail. The above error messages are misleading for devices that don't support DMA and so fix this by skipping the DMA initialisation for devices that don't support DMA. Signed-off-by: Jon Hunter <jonathanh@nvidia.com> Acked-by: Thierry Reding <treding@nvidia.com> Link: https://lore.kernel.org/r/20221026155633.141792-1-jonathanh@nvidia.com Signed-off-by: Mark Brown <broonie@kernel.org>
2022-10-28efi: efivars: Fix variable writes with unsupported query_variable_store()Ard Biesheuvel
Commit 8a254d90a775 ("efi: efivars: Fix variable writes without query_variable_store()") addressed an issue that was introduced during the EFI variable store refactor, where alternative implementations of the efivars layer that lacked query_variable_store() would no longer work. Unfortunately, there is another case to consider here, which was missed: if the efivars layer is backed by the EFI runtime services as usual, but the EFI implementation predates the introduction of QueryVariableInfo(), we will return EFI_UNSUPPORTED, and this is no longer being dealt with correctly. So let's fix this, and while at it, clean up the code a bit, by merging the check_var_size() routines as well as their callers. Cc: <stable@vger.kernel.org> # v6.0 Fixes: bbc6d2c6ef22 ("efi: vars: Switch to new wrapper layer") Signed-off-by: Ard Biesheuvel <ardb@kernel.org> Tested-by: Aditya Garg <gargaditya08@live.com>
2022-10-28ASoC: fsl_asrc fsl_esai fsl_sai: allow CONFIG_PM=NMaarten Zanders
When CONFIG_PM=N, pm_runtime_put_sync() returns -ENOSYS which breaks the probe function of these drivers. Other users of pm_runtime_put_sync() typically don't check the return value. In order to keep the program flow as intended, check for -ENOSYS. This commit is similar to commit 0434d3f (omap-mailbox.c). Fixes: cab04ab5900f ("ASoC: fsl_asrc: Don't use devm_regmap_init_mmio_clk") Fixes: 203773e39347 ("ASoC: fsl_esai: Don't use devm_regmap_init_mmio_clk") Fixes: 2277e7e36b4b ("ASoC: fsl_sai: Don't use devm_regmap_init_mmio_clk") Signed-off-by: Maarten Zanders <maarten.zanders@mind.be> Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com> Link: https://lore.kernel.org/r/20221028141129.100702-1-maarten.zanders@mind.be Signed-off-by: Mark Brown <broonie@kernel.org>
2022-10-28RDMA/qedr: clean up work queue on failure in qedr_alloc_resources()Dan Carpenter
Add a check for if create_singlethread_workqueue() fails and also destroy the work queue on failure paths. Fixes: e411e0587e0d ("RDMA/qedr: Add iWARP connection management functions") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Link: https://lore.kernel.org/r/Y1gBkDucQhhWj5YM@kili Signed-off-by: Leon Romanovsky <leon@kernel.org> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2022-10-28RDMA/core: Fix null-ptr-deref in ib_core_cleanup()Chen Zhongjin
KASAN reported a null-ptr-deref error: KASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f] CPU: 1 PID: 379 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) RIP: 0010:destroy_workqueue+0x2f/0x740 RSP: 0018:ffff888016137df8 EFLAGS: 00000202 ... Call Trace: ib_core_cleanup+0xa/0xa1 [ib_core] __do_sys_delete_module.constprop.0+0x34f/0x5b0 do_syscall_64+0x3a/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fa1a0d221b7 ... It is because the fail of roce_gid_mgmt_init() is ignored: ib_core_init() roce_gid_mgmt_init() gid_cache_wq = alloc_ordered_workqueue # fail ... ib_core_cleanup() roce_gid_mgmt_cleanup() destroy_workqueue(gid_cache_wq) # destroy an unallocated wq Fix this by catching the fail of roce_gid_mgmt_init() in ib_core_init(). Fixes: 03db3a2d81e6 ("IB/core: Add RoCE GID table management") Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com> Link: https://lore.kernel.org/r/20221025024146.109137-1-chenzhongjin@huawei.com Signed-off-by: Leon Romanovsky <leon@kernel.org> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2022-10-28ACPI: x86: Add another system to quirk list for forcing StorageD3EnableMario Limonciello
commit 018d6711c26e4 ("ACPI: x86: Add a quirk for Dell Inspiron 14 2-in-1 for StorageD3Enable") introduced a quirk to allow a system with ambiguous use of _ADR 0 to force StorageD3Enable. Julius Brockmann reports that Inspiron 16 5625 suffers that same symptoms. Add this other system to the list as well. Link: https://bugzilla.kernel.org/show_bug.cgi?id=216440 Reported-and-tested-by: Julius Brockmann <mail@juliusbrockmann.com> Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2022-10-28ACPICA: Finish support for the CDAT tableBob Moore
ACPICA commit 8ac4e5116f59d6f9ba2fbeb9ce22ab58237a278f Finish support for the CDAT table, in both the data table compiler and the disassembler. Link: https://github.com/acpica/acpica/commit/8ac4e511 Signed-off-by: Bob Moore <robert.moore@intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2022-10-28ACPICA: IORT: Update for revision E.eRobin Murphy
ACPICA commit 54b54732c5fc9e0384bcfd531f3c10d3a7b628b5 The latest IORT update makes one small addition to SMMUv3 nodes to describe MSI support independently of wired GSIV support. Link: https://github.com/acpica/acpica/commit/54b54732 Signed-off-by: Robin Murphy <robin.murphy@arm.com> Signed-off-by: Bob Moore <robert.moore@intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2022-10-28ACPICA: Add CXL 3.0 structures (CXIMS & RDPAS) to the CEDT tableAlison Schofield
ACPICA commit 2d8dc0383d3c908389053afbdc329bbd52f009ce The CXL 3.0 Specification [1] adds two new structures to the CXL Early Discovery Table (CEDT). The CEDT may include zero or more entries of these types: CXIMS: CXL XOR Interleave Math Structure Enables the host to find a targets position in an Interleave Target List when XOR Math is used. RDPAS: RCEC Downstream Post Association Structure Enables the host to locate the Downstream Port(s) that report errors to a given Root Complex Event Collector (RCEC). Link: https://www.computeexpresslink.org/spec-landing # [1] Link: https://github.com/acpica/acpica/commit/2d8dc038 Signed-off-by: Alison Schofield <alison.schofield@intel.com> Signed-off-by: Bob Moore <robert.moore@intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2022-10-28ACPICA: Improve warning message for "invalid ACPI name"Bob Moore
ACPICA commit 91bef8bea9cd69c33447ba1bfe2c4273994500fd Added an underscore instead of an (illegal) * Link: https://github.com/acpica/acpica/commit/91bef8be Signed-off-by: Bob Moore <robert.moore@intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2022-10-28ACPICA: Add support for FFH Opregion special context dataSudeep Holla
ACPICA commit fad527b6e76babc7527c41325bfbef6bd1a1132b FFH(Fixed Function Hardware) Opregion is approved to be added in ACPI 6.5 via code first approach [1]. It requires special context data similar to GPIO and Generic Serial Bus as it needs to know platform specific offset and length. Add support for the special context data needed by FFH Opregion. FFH op_region enables advanced use of FFH on some architectures. For example, it could be used to easily proxy AML code to architecture-specific behavior (to ensure it is OS initiated) Actual behavior of FFH is ofcourse architecture specific and depends on the FFH bindings. The offset and length could have arch specific meaning or usage. Link: https://bugzilla.tianocore.org/show_bug.cgi?id=3598 # [1] Link: https://github.com/acpica/acpica/commit/fad527b6 Signed-off-by: Sudeep Holla <sudeep.holla@arm.com> Signed-off-by: Bob Moore <robert.moore@intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2022-10-28ACPICA: Add a couple of new UUIDs to the known UUID listBob Moore
ACPICA commit 2176a750230d5e81b4bedf24ef296da0cd0d7bb3 Link: https://github.com/acpica/acpica/commit/2176a750 Signed-off-by: Bob Moore <robert.moore@intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2022-10-28ACPICA: iASL: Add CCEL table to both compiler/disassemblerKuppuswamy Sathyanarayanan
ACPICA commit 10e4763f155eac0c60295a7e364b0316fc52c4f1 Link: https://github.com/acpica/acpica/commit/10e4763f Signed-off-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com> Signed-off-by: Bob Moore <robert.moore@intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2022-10-28ACPICA: Do not touch VGA memory when EBDA < 1ki_bVit Kabele
ACPICA commit a36eda9631e84f271319c41288889dd5b1329369 The ACPICA code assumes that EBDA region must be at least 1ki_b in size. Because this is not guaranteed, it might happen that while scanning the memory for RSDP pointer, the kernel touches memory above 640ki_b. This is unwanted as the VGA memory range may not be decoded or even present when running under virtualization. Link: https://github.com/acpica/acpica/commit/a36eda96 Signed-off-by: Vit Kabele <vit@kabele.me> Signed-off-by: Bob Moore <robert.moore@intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2022-10-28ACPICA: Check that EBDA pointer is in valid memoryVit Kabele
ACPICA commit cc9e7763ceb2e2649fe3422130416d84a3c6854a If the memory at 0x40e is uninitialized, the retrieved physical_memory address of EBDA may be beyond the low memory (i.e. above 640K). If so, the kernel may unintentionally access the VGA memory, that might not be decoded or even present in case of virtualization. Link: https://github.com/acpica/acpica/commit/cc9e7763 Signed-off-by: Vit Kabele <vit@kabele.me> Signed-off-by: Bob Moore <robert.moore@intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2022-10-28ACPICA: Events: Support fixed PCIe wake eventHuacai Chen
ACPICA commit 32d875705c8ee8f99fd8b78dbed48633486a7640 Some chipsets (such as Loongson's LS7A) support fixed pcie wake event which is defined in the PM1 block(related description can be found in 4.8.4.1.1 PM1 Status Registers, 4.8.4.2.1 PM1 Control Registers and 5.2.9 Fixed ACPI Description Table (FADT)), so we add code to handle it. Link: https://uefi.org/specifications/ACPI/6.4/ Link: https://github.com/acpica/acpica/commit/32d87570 Co-developed-by: Jianmin Lv <lvjianmin@loongson.cn> Signed-off-by: Jianmin Lv <lvjianmin@loongson.cn> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn> Signed-off-by: Bob Moore <robert.moore@intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2022-10-28ACPICA: MADT: Add loong_arch-specific APICs supportHuacai Chen
ACPICA commit 1dc530059a3e6202e941e6a9478cf30f092bfb47 loong_arch-specific interrupt controllers (similar to APIC) are added in the next revision of ACPI Specification (current revision is 6.4), which including CORE_PIC (CPUINTC), LIO_PIC (LIOINTC), EIO_PIC (EIOINTC), HT_PIC (HTVECINTC), BIO_PIC (PCHINTC), LPC_PIC (PCHLPC) and MSI_PIC (PCHMSI). This patch add their definition. ACPI changes of loong_arch-specific interrupt controllers have already been approved in the ECRs, and will be public in the next revision of ACPI Specification. Link: https://github.com/acpica/acpica/commit/1dc53005 Link: https://mantis.uefi.org/mantis/view.php?id=2203 Link: https://mantis.uefi.org/mantis/view.php?id=2313 Co-developed-by: Jianmin Lv <lvjianmin@loongson.cn> Signed-off-by: Jianmin Lv <lvjianmin@loongson.cn> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn> Signed-off-by: Bob Moore <robert.moore@intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2022-10-28ACPICA: Make acpi_ex_load_op() match upstreamRafael J. Wysocki
The acpi_ex_load_op() code has slightly diverged from the upstream implementation, so correct that to make the behavior consistent with the upstream and avoid patch backporting issues going forward. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2022-10-28MAINTAINERS: Change myself to a maintainerMatti Vaittinen
After some off-list discussion with Marek Vasut and Geert Uytterhoeven and finally a kx022a driver related discussion with Joe Perches https://lore.kernel.org/lkml/92c3f72e60bc99bf4a21da259b4d78c1bdca447d.camel@perches.com/ it seems that my status as a reviewer has been wrong. I do look after the ROHM/Kionix drivers I've authored and currently I am also paid to do so as is reflected by the 'S: Supported'. According to Joe, the reviewer entry in MAINTAINERS do not indicate such level of support and having a reviewer supporting an IC is a contradiction. Switch undersigned from a reviewer to a maintainer for IC drivers I am taking care of. Signed-off-by: Matti Vaittinen <mazziesaccount@gmail.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
2022-10-28Merge branches 'acpi-resource', 'acpi-pcc' and 'devprop'Rafael J. Wysocki
Merge an IRQ override quirk, an ACPI PCC code fix and a device properties documentation update for 6.1-rc3: - Make the ACPI device resources code skip IRQ override on Asus Vivobook S5602ZA (Tamim Khan). - Fix a possible integer overflow during multiplication in the ACPI PCC code (Manank Patel). - Fix the documentation of the *_match_string() family of functions to properly cover the return value (Andy Shevchenko). * acpi-resource: ACPI: resource: Skip IRQ override on Asus Vivobook S5602ZA * acpi-pcc: ACPI: PCC: Fix unintentional integer overflow * devprop: device property: Fix documentation for *_match_string() APIs
2022-10-28Merge branches 'pm-sleep', 'pm-domains' and 'pm-tools'Rafael J. Wysocki
Merge a hiberantion-related fix, a generic power domains code fix and a pm-graph update for 6.1-rc1: - Allow hybrid sleep to use suspend-to-idle as a system suspend method if it is the current suspend method of choice (Mario Limonciello). - Fix handling of unavailable/disabled idle states in the generic power domains code (Sudeep Holla). - Update the pm-graph suite of utilities to version 5.10 which is fixes-mostly and does not add any new features (Todd Brandt). * pm-sleep: PM: hibernate: Allow hybrid sleep to work with s2idle * pm-domains: PM: domains: Fix handling of unavailable/disabled idle states * pm-tools: pm-graph v5.10
2022-10-28blk-mq: Properly init requests from blk_mq_alloc_request_hctx()John Garry
Function blk_mq_alloc_request_hctx() is missing zeroing/init of rq->bio, biotail, __sector, and __data_len members, which blk_mq_alloc_request() has, so duplicate what we do in blk_mq_alloc_request(). Fixes: 1f5bd336b9150 ("blk-mq: add blk_mq_alloc_request_hctx") Signed-off-by: John Garry <john.garry@huawei.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Ming Lei <ming.lei@redhat.com> Link: https://lore.kernel.org/r/1666780513-121650-1-git-send-email-john.garry@huawei.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2022-10-28ALSA: hda/realtek: Add quirk for ASUS Zenbook using CS35L41Stefan Binding
This Asus Zenbook laptop use Realtek HDA codec combined with 2xCS35L41 Amplifiers using I2C with Internal Boost. Signed-off-by: Stefan Binding <sbinding@opensource.cirrus.com> Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20221028102742.2588687-1-sbinding@opensource.cirrus.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2022-10-28phy: qcom-qmp-combo: fix NULL-deref on runtime resumeJohan Hovold
Commit fc64623637da ("phy: qcom-qmp-combo,usb: add support for separate PCS_USB region") started treating the PCS_USB registers as potentially separate from the PCS registers but used the wrong base when no PCS_USB offset has been provided. Fix the PCS_USB base used at runtime resume to prevent dereferencing a NULL pointer on platforms that do not provide a PCS_USB offset (e.g. SC7180). Fixes: fc64623637da ("phy: qcom-qmp-combo,usb: add support for separate PCS_USB region") Cc: stable@vger.kernel.org # 5.20 Signed-off-by: Johan Hovold <johan+linaro@kernel.org> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> Reviewed-by: Andrew Halaney <ahalaney@redhat.com> Link: https://lore.kernel.org/r/20221026162116.26462-1-johan+linaro@kernel.org Signed-off-by: Vinod Koul <vkoul@kernel.org>
2022-10-28fuse: add file_modified() to fallocateMiklos Szeredi
Add missing file_modified() call to fuse_file_fallocate(). Without this fallocate on fuse failed to clear privileges. Fixes: 05ba1f082300 ("fuse: add FALLOCATE operation") Cc: <stable@vger.kernel.org> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2022-10-28MAINTAINERS: Update HiSilicon SFC Driver maintainerJay Fang
Add Jay Fang as the maintainer of the HiSilicon SFC Driver, replacing John Garry. Signed-off-by: Jay Fang <f.fangjian@huawei.com> Acked-by: John Garry <john.garry@huawei.com> Link: https://lore.kernel.org/r/20221028023739.4113998-1-f.fangjian@huawei.com Signed-off-by: Mark Brown <broonie@kernel.org>
2022-10-28ASoC: core: Fix use-after-free in snd_soc_exit()Chen Zhongjin
KASAN reports a use-after-free: BUG: KASAN: use-after-free in device_del+0xb5b/0xc60 Read of size 8 at addr ffff888008655050 by task rmmod/387 CPU: 2 PID: 387 Comm: rmmod Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) Call Trace: <TASK> dump_stack_lvl+0x79/0x9a print_report+0x17f/0x47b kasan_report+0xbb/0xf0 device_del+0xb5b/0xc60 platform_device_del.part.0+0x24/0x200 platform_device_unregister+0x2e/0x40 snd_soc_exit+0xa/0x22 [snd_soc_core] __do_sys_delete_module.constprop.0+0x34f/0x5b0 do_syscall_64+0x3a/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd ... </TASK> It's bacause in snd_soc_init(), snd_soc_util_init() is possble to fail, but its ret is ignored, which makes soc_dummy_dev unregistered twice. snd_soc_init() snd_soc_util_init() platform_device_register_simple(soc_dummy_dev) platform_driver_register() # fail platform_device_unregister(soc_dummy_dev) platform_driver_register() # success ... snd_soc_exit() snd_soc_util_exit() # soc_dummy_dev will be unregistered for second time To fix it, handle error and stop snd_soc_init() when util_init() fail. Also clean debugfs when util_init() or driver_register() fail. Fixes: fb257897bf20 ("ASoC: Work around allmodconfig failure") Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com> Link: https://lore.kernel.org/r/20221028031603.59416-1-chenzhongjin@huawei.com Signed-off-by: Mark Brown <broonie@kernel.org>
2022-10-28soundwire: qcom: check for outanding writes before doing a readSrinivas Kandagatla
Reading will increase the fifo count, so check for outstanding cmd wrt. write fifo depth to avoid overflow as read will also increase write fifo cnt. Fixes: a661308c34de ("soundwire: qcom: wait for fifo space to be available before read/write") Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org> Link: https://lore.kernel.org/r/20221026110210.6575-3-srinivas.kandagatla@linaro.org Signed-off-by: Vinod Koul <vkoul@kernel.org>
2022-10-28soundwire: qcom: reinit broadcast completionSrinivas Kandagatla
For some reason we never reinit the broadcast completion, there is a danger that broadcast commands could be treated as completed by driver from previous complete status. Fix this by reinitializing the completion before sending a broadcast command. Fixes: ddea6cf7b619 ("soundwire: qcom: update register read/write routine") Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org> Link: https://lore.kernel.org/r/20221026110210.6575-2-srinivas.kandagatla@linaro.org Signed-off-by: Vinod Koul <vkoul@kernel.org>
2022-10-28soundwire: intel: Initialize clock stop timeoutSjoerd Simons
The bus->clk_stop_timeout member is only initialized to a non-zero value during the codec driver probe. This can lead to corner cases where this value remains pegged at zero when the bus suspends, which results in an endless loop in sdw_bus_wait_for_clk_prep_deprep(). Corner cases include configurations with no codecs described in the firmware, or delays in probing codec drivers. Initializing the default timeout to the smallest non-zero value avoid this problem and allows for the existing logic to be preserved: the bus->clk_stop_timeout is set as the maximum required by all codecs connected on the bus. Fixes: 1f2dcf3a154ac ("soundwire: intel: set dev_num_ida_min") Signed-off-by: Sjoerd Simons <sjoerd@collabora.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com> Reviewed-by: Chao Song <chao.song@intel.com> Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com> Link: https://lore.kernel.org/r/20221020015624.1703950-1-yung-chuan.liao@linux.intel.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2022-10-28KVM: x86/xen: Fix eventfd error handling in kvm_xen_eventfd_assign()Eiichi Tsukata
Should not call eventfd_ctx_put() in case of error. Fixes: 2fd6df2f2b47 ("KVM: x86/xen: intercept EVTCHNOP_send from guests") Reported-by: syzbot+6f0c896c5a9449a10ded@syzkaller.appspotmail.com Signed-off-by: Eiichi Tsukata <eiichi.tsukata@nutanix.com> Message-Id: <20221028092631.117438-1-eiichi.tsukata@nutanix.com> [Introduce new goto target instead. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-10-28capabilities: fix potential memleak on error path from vfs_getxattr_alloc()Gaosheng Cui
In cap_inode_getsecurity(), we will use vfs_getxattr_alloc() to complete the memory allocation of tmpbuf, if we have completed the memory allocation of tmpbuf, but failed to call handler->get(...), there will be a memleak in below logic: |-- ret = (int)vfs_getxattr_alloc(mnt_userns, ...) | /* ^^^ alloc for tmpbuf */ |-- value = krealloc(*xattr_value, error + 1, flags) | /* ^^^ alloc memory */ |-- error = handler->get(handler, ...) | /* error! */ |-- *xattr_value = value | /* xattr_value is &tmpbuf (memory leak!) */ So we will try to free(tmpbuf) after vfs_getxattr_alloc() fails to fix it. Cc: stable@vger.kernel.org Fixes: 8db6c34f1dbc ("Introduce v3 namespaced file capabilities") Signed-off-by: Gaosheng Cui <cuigaosheng1@huawei.com> Acked-by: Serge Hallyn <serge@hallyn.com> [PM: subject line and backtrace tweaks] Signed-off-by: Paul Moore <paul@paul-moore.com>
2022-10-28net: emaclite: update reset_lock member documentationRadhey Shyam Pandey
Instead of generic description, mention what reset_lock actually protects i.e. lock to serialize xmit and tx_timeout execution. Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2022-10-28KVM: x86: smm: number of GPRs in the SMRAM image depends on the image formatMaxim Levitsky
On 64 bit host, if the guest doesn't have X86_FEATURE_LM, KVM will access 16 gprs to 32-bit smram image, causing out-ouf-bound ram access. On 32 bit host, the rsm_load_state_64/enter_smm_save_state_64 is compiled out, thus access overflow can't happen. Fixes: b443183a25ab61 ("KVM: x86: Reduce the number of emulator GPRs to '8' for 32-bit KVM") Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com> Reviewed-by: Sean Christopherson <seanjc@google.com> Message-Id: <20221025124741.228045-15-mlevitsk@redhat.com> Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-10-28KVM: x86: emulator: update the emulation mode after CR0 writeMaxim Levitsky
Update the emulation mode when handling writes to CR0, because toggling CR0.PE switches between Real and Protected Mode, and toggling CR0.PG when EFER.LME=1 switches between Long and Protected Mode. This is likely a benign bug because there is no writeback of state, other than the RIP increment, and when toggling CR0.PE, the CPU has to execute code from a very low memory address. Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com> Message-Id: <20221025124741.228045-14-mlevitsk@redhat.com> Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-10-28KVM: x86: emulator: update the emulation mode after rsmMaxim Levitsky
Update the emulation mode after RSM so that RIP will be correctly written back, because the RSM instruction can switch the CPU mode from 32 bit (or less) to 64 bit. This fixes a guest crash in case the #SMI is received while the guest runs a code from an address > 32 bit. Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com> Message-Id: <20221025124741.228045-13-mlevitsk@redhat.com> Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-10-28KVM: x86: emulator: introduce emulator_recalc_and_set_modeMaxim Levitsky
Some instructions update the cpu execution mode, which needs to update the emulation mode. Extract this code, and make assign_eip_far use it. assign_eip_far now reads CS, instead of getting it via a parameter, which is ok, because callers always assign CS to the same value before calling this function. No functional change is intended. Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com> Message-Id: <20221025124741.228045-12-mlevitsk@redhat.com> Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-10-28KVM: x86: emulator: em_sysexit should update ctxt->modeMaxim Levitsky
SYSEXIT is one of the instructions that can change the processor mode, thus ctxt->mode should be updated after it. Note that this is likely a benign bug, because the only problematic mode change is from 32 bit to 64 bit which can lead to truncation of RIP, and it is not possible to do with sysexit, since sysexit running in 32 bit mode will be limited to 32 bit version. Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com> Message-Id: <20221025124741.228045-11-mlevitsk@redhat.com> Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-10-28KVM: selftests: Mark "guest_saw_irq" as volatile in xen_shinfo_testSean Christopherson
Tag "guest_saw_irq" as "volatile" to ensure that the compiler will never optimize away lookups. Relying on the compiler thinking that the flag is global and thus might change also works, but it's subtle, less robust, and looks like a bug at first glance, e.g. risks being "fixed" and breaking the test. Make the flag "static" as well since convincing the compiler it's global is no longer necessary. Alternatively, the flag could be accessed with {READ,WRITE}_ONCE(), but literally every access would need the wrappers, and eking out performance isn't exactly top priority for selftests. Signed-off-by: Sean Christopherson <seanjc@google.com> Message-Id: <20221013211234.1318131-17-seanjc@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-10-28KVM: selftests: Add tests in xen_shinfo_test to detect lock racesMichal Luczaj
Tests for races between shinfo_cache (de)activation and hypercall+ioctl() processing. KVM has had bugs where activating the shared info cache multiple times and/or with concurrent users results in lock corruption, NULL pointer dereferences, and other fun. For the timer injection testcase (#22), re-arm the timer until the IRQ is successfully injected. If the timer expires while the shared info is deactivated (invalid), KVM will drop the event. Signed-off-by: Michal Luczaj <mhal@rbox.co> Co-developed-by: Sean Christopherson <seanjc@google.com> Signed-off-by: Sean Christopherson <seanjc@google.com> Message-Id: <20221013211234.1318131-16-seanjc@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-10-28net: dsa: Fix possible memory leaks in dsa_loop_init()Chen Zhongjin
kmemleak reported memory leaks in dsa_loop_init(): kmemleak: 12 new suspected memory leaks unreferenced object 0xffff8880138ce000 (size 2048): comm "modprobe", pid 390, jiffies 4295040478 (age 238.976s) backtrace: [<000000006a94f1d5>] kmalloc_trace+0x26/0x60 [<00000000a9c44622>] phy_device_create+0x5d/0x970 [<00000000d0ee2afc>] get_phy_device+0xf3/0x2b0 [<00000000dca0c71f>] __fixed_phy_register.part.0+0x92/0x4e0 [<000000008a834798>] fixed_phy_register+0x84/0xb0 [<0000000055223fcb>] dsa_loop_init+0xa9/0x116 [dsa_loop] ... There are two reasons for memleak in dsa_loop_init(). First, fixed_phy_register() create and register phy_device: fixed_phy_register() get_phy_device() phy_device_create() # freed by phy_device_free() phy_device_register() # freed by phy_device_remove() But fixed_phy_unregister() only calls phy_device_remove(). So the memory allocated in phy_device_create() is leaked. Second, when mdio_driver_register() fail in dsa_loop_init(), it just returns and there is no cleanup for phydevs. Fix the problems by catching the error of mdio_driver_register() in dsa_loop_init(), then calling both fixed_phy_unregister() and phy_device_free() to release phydevs. Also add a function for phydevs cleanup to avoid duplacate. Fixes: 98cd1552ea27 ("net: dsa: Mock-up driver") Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com> Signed-off-by: David S. Miller <davem@davemloft.net>
generated by cgit (git 2.34.1) at 2025-09-23 01:22:15 +0000