summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2024-02-26ARM: dts: nxp: imx6ul: fix touchscreen node nameSebastian Reichel
The canonical node name for touchscreens is "touchscreen", so update the i.MX6UL "tsc" node accordingly. Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Sebastian Reichel <sre@kernel.org> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2024-02-26ARM: dts: nxp: imx6ul: xnur-gpio -> xnur-gpiosSebastian Reichel
Replace all "xnur-gpio" with "xnur-gpios" in the i.MX6UL(L) Touchscreen node, since the -gpio suffix is deprecated. All known implementations of this binding can handle -gpio and -gpios since day 1, so this should be fully backwards compatible. Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Sebastian Reichel <sre@kernel.org> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2024-02-26ARM: dts: imx6ul: Remove fsl,anatop from usbotg1Sebastian Reichel
fsl,anatop should only be added to the usbphy nodes. Signed-off-by: Sebastian Reichel <sre@kernel.org> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2024-02-26ARM: dts: imx6ull: fix pinctrl node nameSebastian Reichel
pinctrl node name must be either pinctrl or pinmux. Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Sebastian Reichel <sre@kernel.org> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2024-02-26ARM: dts: imx1-apf9328: Fix Ethernet node nameFabio Estevam
Per davicom,dm9000.yaml, the Ethernet node name should be 'ethernet'. Change it to fix the following schema warning: imx1-apf9328.dtb: eth@4,c00000: $nodename:0: 'eth@4,c00000' does not match '^ethernet(@.*)?$' from schema $id: http://devicetree.org/schemas/net/davicom,dm9000.yaml# Signed-off-by: Fabio Estevam <festevam@denx.de> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2024-02-26ARM: dts: imx28-evk: Use 'eeprom' as the node nameFabio Estevam
Per at24.yaml, the node name should be 'eeprom'. Change it accordingly to fix the following schema warning: imx28-evk.dtb: at24@51: $nodename:0: 'at24@51' does not match '^eeprom@[0-9a-f]{1,2}$' from schema $id: http://devicetree.org/schemas/eeprom/at24.yaml# Signed-off-by: Fabio Estevam <festevam@denx.de> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2024-02-26ARM: dts: ls1021a: Enable usb3-lpm-capable for usb3 nodeLi Yang
Enable USB3 HW LPM feature. Signed-off-by: Ran Wang <ran.wang_1@nxp.com> Signed-off-by: Li Yang <leoyang.li@nxp.com> Signed-off-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2024-02-25Linux 6.8-rc6v6.8-rc6Linus Torvalds
2024-02-25Merge tag 'bcachefs-2024-02-25' of https://evilpiepirate.org/git/bcachefsLinus Torvalds
Pull bcachefs fixes from Kent Overstreet: "Some more mostly boring fixes, but some not User reported ones: - the BTREE_ITER_FILTER_SNAPSHOTS one fixes a really nasty performance bug; user reported an untar initially taking two seconds and then ~2 minutes - kill a __GFP_NOFAIL in the buffered read path; this was a leftover from the trickier fix to kill __GFP_NOFAIL in readahead, where we can't return errors (and have to silently truncate the read ourselves). bcachefs can't use GFP_NOFAIL for folio state unlike iomap based filesystems because our folio state is just barely too big, 2MB hugepages cause us to exceed the 2 page threshhold for GFP_NOFAIL. additionally, the flags argument was just buggy, we weren't supplying GFP_KERNEL previously (!)" * tag 'bcachefs-2024-02-25' of https://evilpiepirate.org/git/bcachefs: bcachefs: fix bch2_save_backtrace() bcachefs: Fix check_snapshot() memcpy bcachefs: Fix bch2_journal_flush_device_pins() bcachefs: fix iov_iter count underflow on sub-block dio read bcachefs: Fix BTREE_ITER_FILTER_SNAPSHOTS on inodes btree bcachefs: Kill __GFP_NOFAIL in buffered read path bcachefs: fix backpointer_to_text() when dev does not exist
2024-02-25bcachefs: fix bch2_save_backtrace()Kent Overstreet
Missed a call in the previous fix. Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
2024-02-25Merge tag 'docs-6.8-fixes3' of git://git.lwn.net/linuxLinus Torvalds
Pull two documentation build fixes from Jonathan Corbet: - The XFS online fsck documentation uses incredibly deeply nested subsection and list nesting; that broke the PDF docs build. Tweak a parameter to tell LaTeX to allow the deeper nesting. - Fix a 6.8 PDF-build regression * tag 'docs-6.8-fixes3' of git://git.lwn.net/linux: docs: translations: use attribute to store current language docs: Instruct LaTeX to cope with deeper nesting
2024-02-25Merge tag 'usb-6.8-rc6' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are some small USB fixes for 6.8-rc6 to resolve some reported problems. These include: - regression fixes with typec tpcm code as reported by many - cdnsp and cdns3 driver fixes - usb role setting code bugfixes - build fix for uhci driver - ncm gadget driver bugfix - MAINTAINERS entry update All of these have been in linux-next all week with no reported issues and there is at least one fix in here that is in Thorsten's regression list that is being tracked" * tag 'usb-6.8-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: usb: typec: tpcm: Fix issues with power being removed during reset MAINTAINERS: Drop myself as maintainer of TYPEC port controller drivers usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs Revert "usb: typec: tcpm: reset counter when enter into unattached state after try role" usb: gadget: omap_udc: fix USB gadget regression on Palm TE usb: dwc3: gadget: Don't disconnect if not started usb: cdns3: fix memory double free when handle zero packet usb: cdns3: fixed memory use after free at cdns3_gadget_ep_disable() usb: roles: don't get/set_role() when usb_role_switch is unregistered usb: roles: fix NULL pointer issue when put module's reference usb: cdnsp: fixed issue with incorrect detecting CDNSP family controllers usb: cdnsp: blocked some cdns3 specific code usb: uhci-grlib: Explicitly include linux/platform_device.h
2024-02-25Merge tag 'tty-6.8-rc6' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial driver fixes from Greg KH: "Here are three small serial/tty driver fixes for 6.8-rc6 that resolve the following reported errors: - riscv hvc console driver fix that was reported by many - amba-pl011 serial driver fix for RS485 mode - stm32 serial driver fix for RS485 mode All of these have been in linux-next all week with no reported problems" * tag 'tty-6.8-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: serial: amba-pl011: Fix DMA transmission in RS485 mode serial: stm32: do not always set SER_RS485_RX_DURING_TX if RS485 is enabled tty: hvc: Don't enable the RISC-V SBI console by default
2024-02-25Merge tag 'x86_urgent_for_v6.8_rc6' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Borislav Petkov: - Make sure clearing CPU buffers using VERW happens at the latest possible point in the return-to-userspace path, otherwise memory accesses after the VERW execution could cause data to land in CPU buffers again * tag 'x86_urgent_for_v6.8_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: KVM/VMX: Move VERW closer to VMentry for MDS mitigation KVM/VMX: Use BT+JNC, i.e. EFLAGS.CF to select VMRESUME vs. VMLAUNCH x86/bugs: Use ALTERNATIVE() instead of mds_user_clear static key x86/entry_32: Add VERW just before userspace transition x86/entry_64: Add VERW just before userspace transition x86/bugs: Add asm helpers for executing VERW
2024-02-25Merge tag 'irq_urgent_for_v6.8_rc6' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fixes from Borislav Petkov: - Make sure GICv4 always gets initialized to prevent a kexec-ed kernel from silently failing to set it up - Do not call bus_get_dev_root() for the mbigen irqchip as it always returns NULL - use NULL directly - Fix hardware interrupt number truncation when assigning MSI interrupts - Correct sending end-of-interrupt messages to disabled interrupts lines on RISC-V PLIC * tag 'irq_urgent_for_v6.8_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/gic-v3-its: Do not assume vPE tables are preallocated irqchip/mbigen: Don't use bus_get_dev_root() to find the parent PCI/MSI: Prevent MSI hardware interrupt number truncation irqchip/sifive-plic: Enable interrupt if needed before EOI
2024-02-25Merge tag 'erofs-for-6.8-rc6-fixes' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs Pull erofs fix from Gao Xiang: - Fix page refcount leak when looking up specific inodes introduced by metabuf reworking * tag 'erofs-for-6.8-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs: erofs: fix refcount on the metabuf used for inode lookup
2024-02-25Merge tag 'pull-fixes.pathwalk-rcu-2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull RCU pathwalk fixes from Al Viro: "We still have some races in filesystem methods when exposed to RCU pathwalk. This series is a result of code audit (the second round of it) and it should deal with most of that stuff. Still pending: ntfs3 ->d_hash()/->d_compare() and ceph_d_revalidate(). Up to maintainers (a note for NTFS folks - when documentation says that a method may not block, it *does* imply that blocking allocations are to be avoided. Really)" [ More explanations for people who aren't familiar with the vagaries of RCU path walking: most of it is hidden from filesystems, but if a filesystem actively participates in the low-level path walking it needs to make sure the fields involved in that walk are RCU-safe. That "actively participate in low-level path walking" includes things like having its own ->d_hash()/->d_compare() routines, or by having its own directory permission function that doesn't just use the common helpers. Having a ->d_revalidate() function will also have this issue. Note that instead of making everything RCU safe you can also choose to abort the RCU pathwalk if your operation cannot be done safely under RCU, but that obviously comes with a performance penalty. One common pattern is to allow the simple cases under RCU, and abort only if you need to do something more complicated. So not everything needs to be RCU-safe, and things like the inode etc that the VFS itself maintains obviously already are. But these fixes tend to be about properly RCU-delaying things like ->s_fs_info that are maintained by the filesystem and that got potentially released too early. - Linus ] * tag 'pull-fixes.pathwalk-rcu-2' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: ext4_get_link(): fix breakage in RCU mode cifs_get_link(): bail out in unsafe case fuse: fix UAF in rcu pathwalks procfs: make freeing proc_fs_info rcu-delayed procfs: move dropping pde and pid from ->evict_inode() to ->free_inode() nfs: fix UAF on pathwalk running into umount nfs: make nfs_set_verifier() safe for use in RCU pathwalk afs: fix __afs_break_callback() / afs_drop_open_mmap() race hfsplus: switch to rcu-delayed unloading of nls and freeing ->s_fs_info exfat: move freeing sbi, upcase table and dropping nls into rcu-delayed helper affs: free affs_sb_info with kfree_rcu() rcu pathwalk: prevent bogus hard errors from may_lookup() fs/super.c: don't drop ->s_user_ns until we free struct super_block itself
2024-02-25Merge tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfsLinus Torvalds
Pull vfs fixes from Al Viro: "A couple of fixes - revert of regression from this cycle and a fix for erofs failure exit breakage (had been there since way back)" * tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: erofs: fix handling kern_mount() failure Revert "get rid of DCACHE_GENOCIDE"
2024-02-25dt-bindings: arm: add UNI-T UTi260BSebastian Reichel
Add compatible value for i.MX6ULL based UNI-T UTi260B thermal camera. Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Sebastian Reichel <sre@kernel.org> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2024-02-25dt-bindings: vendor-prefixes: add UNI-TSebastian Reichel
Uni-Trend Technology is a manufacturer of measurement and testing tools. Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Sebastian Reichel <sre@kernel.org> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2024-02-25arm64: dts: imx8mp-evk: Fix hdmi@3d nodeLiu Ying
The hdmi@3d node's compatible string is "adi,adv7535" instead of "adi,adv7533" or "adi,adv751*". Fix the hdmi@3d node by means of: * Use default register addresses for "cec", "edid" and "packet", because there is no need to use a non-default address map. * Add missing interrupt related properties. * Drop "adi,input-*" properties which are only valid for adv751*. * Add VEXT_3V3 fixed regulator. * Add "*-supply" properties, since most are required. * Fix label names - s/adv7533/adv7535/. Fixes: 65344b9bed3a ("arm64: dts: imx8mp-evk: Add HDMI support") Signed-off-by: Liu Ying <victor.liu@nxp.com> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2024-02-25arm64: dts: imx93-var-som: Remove phy-supply from eqosFabio Estevam
Per nxp,dwmac-imx.yaml, phy-supply is not a valid property. Remove it to fix the following dt-schema warning: imx93-var-som-symphony.dtb: ethernet@428a0000: Unevaluated properties are not allowed ('phy-supply' was unexpected) from schema $id: http://devicetree.org/schemas/net/nxp,dwmac-imx.yaml# The reg_eqos_phy regulator is marked as 'regulator-always-on', so it is safe to remove the phy-supply property. Signed-off-by: Fabio Estevam <festevam@denx.de> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2024-02-25arm64: dts: imx8mp-phyboard-pollux: Disable pull-up for CD GPIODominik Haller
Removes the pull-up resistor from the pad's settings to keep it consistent for all boards. We have pull-ups in hardware on all boards so we don't need to set the additional one from the iomux controller. Signed-off-by: Dominik Haller <d.haller@phytec.de> Signed-off-by: Benjamin Hahn <B.Hahn@phytec.de> Signed-off-by: Yashwanth Varakala <y.varakala@phytec.de> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2024-02-25arm64: dts: imx8mp-phyboard-pollux: Reduce drive strength for eqos tx linesTeresa Remmet
Reduce drive strength on eqos tx lines for signal quality improvements. Signed-off-by: Teresa Remmet <t.remmet@phytec.de> Signed-off-by: Benjamin Hahn <B.Hahn@phytec.de> Signed-off-by: Yashwanth Varakala <y.varakala@phytec.de> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2024-02-25arm64: dts: imx8mp-phyboard-pollux: Set debug uart muxing to 0x140Yannic Moog
Set Pull Resistors Enable bit to put signal into a defined state. Signed-off-by: Yannic Moog <y.moog@phytec.de> Signed-off-by: Benjamin Hahn <B.Hahn@phytec.de> Signed-off-by: Yashwanth Varakala <y.varakala@phytec.de> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2024-02-25arm64: dts: imx8mp-phyboard-pollux: Add and update rtc devicetree nodeYashwanth Varakala
The interrupt of the RTC is connected on the carrier board phyBOARD-i.MX8MP-Pollux. RTC trickle-charger devicetree property is dependent on the phyboard-pollux design. Signed-off-by: Yashwanth Varakala <y.varakala@phytec.de> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2024-02-25arm64: dts: imx8mm-evk: Add spdif sound card supportShengjiu Wang
Add spdif sound card support, configure the pinmux. This sound card supports recording and playing sound through spdif interface. Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2024-02-25arm64: dts: mba8xx: Add missing #interrupt-cellsAlexander Stein
The GPIO expander is a interrupt-controller, so add the missing #interrupt-cells property as well. Fixes: 71363a485ad0c ("arm64: dts: freescale: add initial device tree for TQMa8Xx") Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2024-02-25arm64: dts: imx8mp: Set SPI NOR to max 40 MHz on Data Modul i.MX8M Plus eDM SBCMarek Vasut
The SPI NOR bus routing on this board cannot go above 50 MHz, set the clock frequency to maximum of 40 MHz to be within a safe margin. Remove the comment as well. Fixes: 562d222f23f0 ("arm64: dts: imx8mp: Add support for Data Modul i.MX8M Plus eDM SBC") Signed-off-by: Marek Vasut <marex@denx.de> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2024-02-25ARM: dts: imx6dl-yapp4: Move the internal switch PHYs under the switch nodeMichal Vokáč
We identified that the PHYs actually do not work since commit 7da7b84fee58 ("ARM: dts: imx6dl-yapp4: Move phy reset into switch node") as a coincidence of several circumstances. The reset signal is kept asserted by a pull-down resistor on the board unless it is deasserted by GPIO from the SoC. This is to keep the switch dead until it is configured properly by the kernel and user space. Prior to the referenced commit the switch was reset by the FEC driver and the reset GPIO was actively deasserted. The mdio-bus was scanned and the attached switch and its PHYs were found and configured. With the referenced commit the switch is reset by the qca8k driver. Because of another bug in the qca8k driver, functionality of the reset pin depends on its pre-kernel configuration. See commit c44fc98f0a8f ("net: dsa: qca8k: fix illegal usage of GPIO") The problem did not appear until we removed support for the switch and configuration of its reset pin from the bootloader. To fix that, properly describe the internal mdio-bus configuration of the qca8334 switch. The PHYs are internal to the switch and sit on its internal mdio-bus. Fixes: 7da7b84fee58 ("ARM: dts: imx6dl-yapp4: Move phy reset into switch node") Signed-off-by: Michal Vokáč <michal.vokac@ysoft.com> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2024-02-25ARM: dts: imx6dl-yapp4: Fix typo in the QCA switch register addressMichal Vokáč
This change does not have any functional effect. The switch works just fine without this patch as it has full access to all the addresses on the bus. This is simply a clean-up to set the node name address and reg address to the same value. Fixes: 15b43e497ffd ("ARM: dts: imx6dl-yapp4: Use correct pseudo PHY address for the switch") Signed-off-by: Michal Vokáč <michal.vokac@ysoft.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2024-02-25arm64: dts: imx8mn: tqma8mqnl-mba8mx: Add USB DR overlayAlexander Stein
imx8mn has only one USB interface. The platform supports using as USB host (default), or switch to USB DR using this overlay. Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2024-02-25arm64: dts: imx8mq: tqma8mq-mba8mx: Add missing USB vbus supplyAlexander Stein
VBUS 5V is statically provided to both USB host and on-bard USB-hub. Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2024-02-25arm64: dts: freescale: imx8mm/imx8mq: mba8mx: Use PCIe clock generatorAlexander Stein
PCIe reference clock is provided by Renesas 9FGV0441. Reference this instead of a fixed-clock. Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2024-02-25ext4_get_link(): fix breakage in RCU modeAl Viro
1) errors from ext4_getblk() should not be propagated to caller unless we are really sure that we would've gotten the same error in non-RCU pathwalk. 2) we leak buffer_heads if ext4_getblk() is successful, but bh is not uptodate. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2024-02-25cifs_get_link(): bail out in unsafe caseAl Viro
->d_revalidate() bails out there, anyway. It's not enough to prevent getting into ->get_link() in RCU mode, but that could happen only in a very contrieved setup. Not worth trying to do anything fancy here unless ->d_revalidate() stops kicking out of RCU mode at least in some cases. Reviewed-by: Christian Brauner <brauner@kernel.org> Acked-by: Miklos Szeredi <mszeredi@redhat.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2024-02-25fuse: fix UAF in rcu pathwalksAl Viro
->permission(), ->get_link() and ->inode_get_acl() might dereference ->s_fs_info (and, in case of ->permission(), ->s_fs_info->fc->user_ns as well) when called from rcu pathwalk. Freeing ->s_fs_info->fc is rcu-delayed; we need to make freeing ->s_fs_info and dropping ->user_ns rcu-delayed too. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2024-02-25procfs: make freeing proc_fs_info rcu-delayedAl Viro
makes proc_pid_ns() safe from rcu pathwalk (put_pid_ns() is still synchronous, but that's not a problem - it does rcu-delay everything that needs to be) Reviewed-by: Christian Brauner <brauner@kernel.org> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2024-02-25procfs: move dropping pde and pid from ->evict_inode() to ->free_inode()Al Viro
that keeps both around until struct inode is freed, making access to them safe from rcu-pathwalk Acked-by: Christian Brauner <brauner@kernel.org> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2024-02-25nfs: fix UAF on pathwalk running into umountAl Viro
NFS ->d_revalidate(), ->permission() and ->get_link() need to access some parts of nfs_server when called in RCU mode: server->flags server->caps *(server->io_stats) and, worst of all, call server->nfs_client->rpc_ops->have_delegation (the last one - as NFS_PROTO(inode)->have_delegation()). We really don't want to RCU-delay the entire nfs_free_server() (it would have to be done with schedule_work() from RCU callback, since it can't be made to run from interrupt context), but actual freeing of nfs_server and ->io_stats can be done via call_rcu() just fine. nfs_client part is handled simply by making nfs_free_client() use kfree_rcu(). Acked-by: Christian Brauner <brauner@kernel.org> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2024-02-25nfs: make nfs_set_verifier() safe for use in RCU pathwalkAl Viro
nfs_set_verifier() relies upon dentry being pinned; if that's the case, grabbing ->d_lock stabilizes ->d_parent and guarantees that ->d_parent points to a positive dentry. For something we'd run into in RCU mode that is *not* true - dentry might've been through dentry_kill() just as we grabbed ->d_lock, with its parent going through the same just as we get to into nfs_set_verifier_locked(). It might get to detaching inode (and zeroing ->d_inode) before nfs_set_verifier_locked() gets to fetching that; we get an oops as the result. That can happen in nfs{,4} ->d_revalidate(); the call chain in question is nfs_set_verifier_locked() <- nfs_set_verifier() <- nfs_lookup_revalidate_delegated() <- nfs{,4}_do_lookup_revalidate(). We have checked that the parent had been positive, but that's done before we get to nfs_set_verifier() and it's possible for memory pressure to pick our dentry as eviction candidate by that time. If that happens, back-to-back attempts to kill dentry and its parent are quite normal. Sure, in case of eviction we'll fail the ->d_seq check in the caller, but we need to survive until we return there... Acked-by: Christian Brauner <brauner@kernel.org> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2024-02-25afs: fix __afs_break_callback() / afs_drop_open_mmap() raceAl Viro
In __afs_break_callback() we might check ->cb_nr_mmap and if it's non-zero do queue_work(&vnode->cb_work). In afs_drop_open_mmap() we decrement ->cb_nr_mmap and do flush_work(&vnode->cb_work) if it reaches zero. The trouble is, there's nothing to prevent __afs_break_callback() from seeing ->cb_nr_mmap before the decrement and do queue_work() after both the decrement and flush_work(). If that happens, we might be in trouble - vnode might get freed before the queued work runs. __afs_break_callback() is always done under ->cb_lock, so let's make sure that ->cb_nr_mmap can change from non-zero to zero while holding ->cb_lock (the spinlock component of it - it's a seqlock and we don't need to mess with the counter). Acked-by: Christian Brauner <brauner@kernel.org> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2024-02-25hfsplus: switch to rcu-delayed unloading of nls and freeing ->s_fs_infoAl Viro
->d_hash() and ->d_compare() use those, so we need to delay freeing them. Reviewed-by: Christian Brauner <brauner@kernel.org> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2024-02-25exfat: move freeing sbi, upcase table and dropping nls into rcu-delayed helperAl Viro
That stuff can be accessed by ->d_hash()/->d_compare(); as it is, we have a hard-to-hit UAF if rcu pathwalk manages to get into ->d_hash() on a filesystem that is in process of getting shut down. Besides, having nls and upcase table cleanup moved from ->put_super() towards the place where sbi is freed makes for simpler failure exits. Acked-by: Christian Brauner <brauner@kernel.org> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2024-02-25affs: free affs_sb_info with kfree_rcu()Al Viro
one of the flags in it is used by ->d_hash()/->d_compare() Reviewed-by: Christian Brauner <brauner@kernel.org> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2024-02-25rcu pathwalk: prevent bogus hard errors from may_lookup()Al Viro
If lazy call of ->permission() returns a hard error, check that try_to_unlazy() succeeds before returning it. That both makes life easier for ->permission() instances and closes the race in ENOTDIR handling - it is possible that positive d_can_lookup() seen in link_path_walk() applies to the state *after* unlink() + mkdir(), while nd->inode matches the state prior to that. Normally seeing e.g. EACCES from permission check in rcu pathwalk means that with some timings non-rcu pathwalk would've run into the same; however, running into a non-executable regular file in the middle of a pathname would not get to permission check - it would fail with ENOTDIR instead. Reviewed-by: Christian Brauner <brauner@kernel.org> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2024-02-25fs/super.c: don't drop ->s_user_ns until we free struct super_block itselfAl Viro
Avoids fun races in RCU pathwalk... Same goes for freeing LSM shite hanging off super_block's arse. Reviewed-by: Christian Brauner <brauner@kernel.org> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2024-02-25arm64: dts: imx8mn-beacon: Remove unnecessary clock configurationAdam Ford
Since commit 8208181fe536 ("clk: imx: composite-8m: Add imx8m_divider_determine_rate") the lcdif controller has had the ability to set the disp_pixel_clk rate which propagates up the tree and sets the video_pll rate automatically. As such, there is no need to define it in the board file. Signed-off-by: Adam Ford <aford173@gmail.com> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2024-02-25arm64: dts: imx8mn: Slow default video_pll clock rateAdam Ford
Since commit 8208181fe536 ("clk: imx: composite-8m: Add imx8m_divider_determine_rate") the lcdif controller has had the ability to set the disp_pixel_clk rate which propagates up the tree and sets the video_pll rate automatically. By setting this value low, it will force the recalculation of video_pll to the lowest rate needed by lcdif instead of dividing a larger clock down to the desired clock speed. This has the advantage of being able to lower the video_pll rate from 594MHz to 148.5MHz when operating at 1080p. It can go even lower when operating at lower resolutions and refresh rates. Signed-off-by: Adam Ford <aford173@gmail.com> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2024-02-25arm64: dts: imx8mp-beacon: Configure multiple queues on eqosAdam Ford
The imx8mp-beacon SOM has an integrated PHY connected to the EQOS ethernet controller which can support up to five queues. Configure these queues in the same manor as done on the imx8mp-evk. Signed-off-by: Adam Ford <aford173@gmail.com> Signed-off-by: Shawn Guo <shawnguo@kernel.org>