summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2023-03-19Merge branch '1GbE' of ↵David S. Miller
git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2023-03-16 (igb, igbvf, igc) This series contains updates to igb, igbvf, and igc drivers. Lin Ma removes rtnl_lock() when disabling SRIOV on remove which was causing deadlock on igb. Akihiko Odaki delays enabling of SRIOV on igb to prevent early messages that could get ignored and clears MAC address when PF returns nack on reset; indicating no MAC address was assigned for igbvf. Gaosheng Cui frees IRQs in error path for igbvf. Akashi Takahiro fixes logic on checking TAPRIO gate support for igc. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2023-03-19xirc2ps_cs: Fix use after free bug in xirc2ps_detachZheng Wang
In xirc2ps_probe, the local->tx_timeout_task was bounded with xirc2ps_tx_timeout_task. When timeout occurs, it will call xirc_tx_timeout->schedule_work to start the work. When we call xirc2ps_detach to remove the driver, there may be a sequence as follows: Stop responding to timeout tasks and complete scheduled tasks before cleanup in xirc2ps_detach, which will fix the problem. CPU0 CPU1 |xirc2ps_tx_timeout_task xirc2ps_detach | free_netdev | kfree(dev); | | | do_reset | //use dev Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Zheng Wang <zyytlz.wz@163.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2023-03-19qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_infoDaniil Tatianin
We have to make sure that the info returned by the helper is valid before using it. Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool. Fixes: f990c82c385b ("qed*: Add support for ndo_set_vf_trust") Fixes: 733def6a04bf ("qed*: IOV link control") Signed-off-by: Daniil Tatianin <d-tatianin@yandex-team.ru> Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2023-03-18Merge tag 'fbdev-for-6.3-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev Pull fbdev fixes from Helge Deller: "The majority of lines changed is due to a code style cleanup in the pnmtologo helper program. Arnd removed the omap1 osk driver and the SIS fb driver is now orphaned. Other than that it's the usual bunch of small fixes and cleanups, e.g. prevent possible divide-by-zero in various fb drivers if the pixclock is zero and various conversions to devm_platform*() and of_property*() functions: - Drop omap1 osk driver - Various potential divide by zero pixclock fixes - Add pixelclock and fb_check_var() to stifb - Code style cleanups and indenting fixes" * tag 'fbdev-for-6.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: fbdev: Use of_property_present() for testing DT property presence fbdev: au1200fb: Fix potential divide by zero fbdev: lxfb: Fix potential divide by zero fbdev: intelfb: Fix potential divide by zero fbdev: nvidia: Fix potential divide by zero fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks fbdev: omapfb: remove omap1 osk driver fbdev: xilinxfb: Use devm_platform_get_and_ioremap_resource() fbdev: wm8505fb: Use devm_platform_ioremap_resource() fbdev: pxa3xx-gcu: Use devm_platform_get_and_ioremap_resource() fbdev: Use of_property_read_bool() for boolean properties fbdev: clps711x-fb: Use devm_platform_get_and_ioremap_resource() fbdev: tgafb: Fix potential divide by zero MAINTAINERS: orphan SIS FRAMEBUFFER DRIVER fbdev: omapfb: cleanup inconsistent indentation drivers: video: logo: add SPDX comment, remove GPL notice in pnmtologo.c drivers: video: logo: fix code style issues in pnmtologo.c
2023-03-18Merge tag 'hwmon-for-v6.3-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: - ltc2992, adm1266: Set missing can_sleep flag - tmp512/tmp513: Drop of_match_ptr for ID table to fix build with !CONFIG_OF - ucd90320: Fix back-to-back access problem - ina3221: Fix bad error return from probe function - xgene: Fix use-after-free bug in remove function - adt7475: Fix hysteresis register bit masks, and fix association of 'smoothing' attributes * tag 'hwmon-for-v6.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (ltc2992) Set `can_sleep` flag for GPIO chip hwmon: (adm1266) Set `can_sleep` flag for GPIO chip hwmon: tmp512: drop of_match_ptr for ID table hwmon: (ucd90320) Add minimum delay between bus accesses hwmon: (ina3221) return prober error code hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition hwmon: (adt7475) Fix masking of hysteresis registers hwmon: (adt7475) Display smoothing attributes in correct order
2023-03-18Merge tag 'ata-6.3-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata Pull ata fixes from Damien Le Moal: - Two fixes from Ondrej for the pata_parport driver to address an issue with error handling during drive connection and to fix memory leaks in case of errors during initialization and when disconnecting a device. * tag 'ata-6.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata: ata: pata_parport: fix memory leaks ata: pata_parport: fix parport release without claim
2023-03-18media: m5mols: fix off-by-one loop termination errorLinus Torvalds
The __find_restype() function loops over the m5mols_default_ffmt[] array, and the termination condition ends up being wrong: instead of stopping when the iterator becomes the size of the array it traverses, it stops after it has already overshot the array. Now, in practice this doesn't likely matter, because the code will always find the entry it looks for, and will thus return early and never hit that last extra iteration. But it turns out that clang will unroll the loop fully, because it has only two iterations (well, three due to the off-by-one bug), and then clang will end up just giving up in the middle of the loop unrolling when it notices that the code walks past the end of the array. And that made 'objtool' very unhappy indeed, because the generated code just falls off the edge of the universe, and ends up falling through to the next function, causing this warning: drivers/media/i2c/m5mols/m5mols.o: warning: objtool: m5mols_set_fmt() falls through to next function m5mols_get_frame_desc() Fix the loop ending condition. Reported-by: Jens Axboe <axboe@kernel.dk> Analyzed-by: Miguel Ojeda <miguel.ojeda.sandonis@gmail.com> Analyzed-by: Nick Desaulniers <ndesaulniers@google.com> Link: https://lore.kernel.org/linux-block/CAHk-=wgTSdKYbmB1JYM5vmHMcD9J9UZr0mn7BOYM_LudrP+Xvw@mail.gmail.com/ Fixes: bc125106f8af ("[media] Add support for M-5MOLS 8 Mega Pixel camera ISP") Cc: HeungJun, Kim <riverful.kim@samsung.com> Cc: Sylwester Nawrocki <s.nawrocki@samsung.com> Cc: Kyungmin Park <kyungmin.park@samsung.com> Cc: Mauro Carvalho Chehab <mchehab@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2023-03-18drm: fix typo in margin connector properties docsSimon Ser
This was pointed out by Ville and Pekka in their replies, but forgot to apply the change properly before pushing. Sorry for the noise! Signed-off-by: Simon Ser <contact@emersion.fr> Fixes: 409f07d353b3 ("drm: document connector margin properties") Cc: Ville Syrjälä <ville.syrjala@linux.intel.com> Cc: Pekka Paalanen <pekka.paalanen@collabora.com> Cc: Maxime Ripard <maxime@cerno.tech> Cc: Dave Stevenson <dave.stevenson@raspberrypi.com> Reviewed-by: Pekka Paalanen <pekka.paalanen@collabora.com> Link: https://patchwork.freedesktop.org/patch/msgid/20230305103503.42619-1-contact@emersion.fr
2023-03-18block: ublk_drv: mark device as LIVE before adding diskMing Lei
IO can be started before add_disk() returns, such as reading parititon table, then the monitor work should work for making forward progress. So mark device as LIVE before adding disk, meantime change to DEAD if add_disk() fails. Fixed: 71f28f3136af ("ublk_drv: add io_uring based userspace block driver") Reviewed-by: Ziyang Zhang <ZiyangZhang@linux.alibaba.com> Signed-off-by: Ming Lei <ming.lei@redhat.com> Link: https://lore.kernel.org/r/20230318141231.55562-1-ming.lei@redhat.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2023-03-18drm/i915: Extract intel_crtc_scanline_offset()Ville Syrjälä
Pull the scanline_offset calculation into its own function. Might have further use for this later with DSB scanline waits. Reviewed-by: Jani Nikula <jani.nikula@intel.com> Reviewed-by: Mitul Golani <mitulkumar.ajitkumar.golani@intel.com> Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20230310235828.17439-4-ville.syrjala@linux.intel.com
2023-03-18drm/i915: Relocate intel_crtc_update_active_timings()Ville Syrjälä
Move intel_crtc_update_active_timings() into intel_vblank.c where it more properly belongs. Also do the s/dev_priv/i915/ modernization rename while at it. Reviewed-by: Jani Nikula <jani.nikula@intel.com> Reviewed-by: Mitul Golani <mitulkumar.ajitkumar.golani@intel.com> Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20230310235828.17439-3-ville.syrjala@linux.intel.com
2023-03-18drm/i915: Add belts and suspenders locking for seamless M/N changesVille Syrjälä
Add some (probably overkill) locking to protect the vblank timestamping constants updates during seamless M/N fastsets. As everything should be naturally aligned I think the individual pieces should probably end up updating atomically enough. So this is only really meant to guarantee everyone sees a consistent whole. All the drm_vblank.c usage is covered by vblank_time_lock, and uncore.lock will take care of __intel_get_crtc_scanline() that can also be called from outside the core vblank functionality. Currently only crtc_clock and framedur_ns can change, but in the future might fastset also across eg. vtotal/vblank_end changes, so let's just grab the locks across the whole thing. Reviewed-by: Jani Nikula <jani.nikula@intel.com> Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20230310235828.17439-2-ville.syrjala@linux.intel.com
2023-03-18drm/i915: Update vblank timestamping stuff on seamless M/N changeVille Syrjälä
When we change the M/N values seamlessly during a fastset we should also update the vblank timestamping stuff to make sure the vblank timestamp corrections/guesstimations come out exact. Note that only crtc_clock and framedur_ns can actually end up changing here during fastsets. Everything else we touch can only change during full modesets. Technically we should try to do this exactly at the start of vblank, but that would require some kind of double buffering scheme. Let's skip that for now and just update things right after the commit has been submitted to the hardware. This means the information will be properly up to date when the vblank irq handler goes to work. Only if someone ends up querying some vblanky stuff in between the commit and start of vblank may we see a slight discrepancy. Also this same problem really exists for the DRRS downclocking stuff. But as that is supposed to be more or less transparent to the user, and it only drops to low gear after a long delay (1 sec currently) we probably don't have to worry about it. Any time something is actively submitting updates DRRS will remain in high gear and so the timestamping constants will match the hardware state. Reviewed-by: Jani Nikula <jani.nikula@intel.com> Reviewed-by: Mitul Golani <mitulkumar.ajitkumar.golani@intel.com> Fixes: e6f29923c048 ("drm/i915: Allow M/N change during fastset on bdw+") Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20230310235828.17439-1-ville.syrjala@linux.intel.com
2023-03-18efi: sysfb_efi: Add quirk for Lenovo Yoga Book X91F/LHans de Goede
Another Lenovo convertable which reports a landscape resolution of 1920x1200 with a pitch of (1920 * 4) bytes, while the actual framebuffer has a resolution of 1200x1920 with a pitch of (1200 * 4) bytes. Signed-off-by: Hans de Goede <hdegoede@redhat.com> Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
2023-03-18efi: sysfb_efi: Fix DMI quirks not working for simpledrmHans de Goede
Commit 8633ef82f101 ("drivers/firmware: consolidate EFI framebuffer setup for all arches") moved the sysfb_apply_efi_quirks() call in sysfb_init() from before the [sysfb_]parse_mode() call to after it. But sysfb_apply_efi_quirks() modifies the global screen_info struct which [sysfb_]parse_mode() parses, so doing it later is too late. This has broken all DMI based quirks for correcting wrong firmware efifb settings when simpledrm is used. To fix this move the sysfb_apply_efi_quirks() call back to its old place and split the new setup of the efifb_fwnode (which requires the platform_device) into its own function and call that at the place of the moved sysfb_apply_efi_quirks(pd) calls. Fixes: 8633ef82f101 ("drivers/firmware: consolidate EFI framebuffer setup for all arches") Cc: stable@vger.kernel.org Cc: Javier Martinez Canillas <javierm@redhat.com> Cc: Thomas Zimmermann <tzimmermann@suse.de> Signed-off-by: Hans de Goede <hdegoede@redhat.com> Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
2023-03-18efi/libstub: smbios: Drop unused 'recsize' parameterArd Biesheuvel
We no longer use the recsize argument for locating the string table in an SMBIOS record, so we can drop it from the internal API. Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
2023-03-18arm64: efi: Use SMBIOS processor version to key off Ampere quirkArd Biesheuvel
Instead of using the SMBIOS type 1 record 'family' field, which is often modified by OEMs, use the type 4 'processor ID' and 'processor version' fields, which are set to a small set of probe-able values on all known Ampere EFI systems in the field. Fixes: 550b33cfd4452968 ("arm64: efi: Force the use of ...") Tested-by: Andrea Righi <andrea.righi@canonical.com> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
2023-03-18efi/libstub: smbios: Use length member instead of record struct sizeArd Biesheuvel
The type 1 SMBIOS record happens to always be the same size, but there are other record types which have been augmented over time, and so we should really use the length field in the header to decide where the string table starts. Fixes: 550b33cfd4452968 ("arm64: efi: Force the use of ...") Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
2023-03-17Merge branch '40GbE' of ↵Jakub Kicinski
git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2023-03-16 (iavf) This series contains updates to iavf driver only. Alex fixes incorrect check against Rx hash feature and corrects payload value for IPv6 UDP packet. Ahmed removes bookkeeping of VLAN 0 filter as it always exists and can cause a false max filter error message. * '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: iavf: do not track VLAN 0 filters iavf: fix non-tunneled IPv6 UDP packet type and hashing iavf: fix inverted Rx hash condition leading to disabled hash ==================== Link: https://lore.kernel.org/r/20230316155316.1554931-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2023-03-17net: ethernet: ti: am65-cpts: reset pps genf adj settings on enableGrygorii Strashko
The CPTS PPS GENf adjustment settings are invalid after it has been disabled for a while, so reset them. Fixes: eb9233ce6751 ("net: ethernet: ti: am65-cpts: adjust pps following ptp changes") Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com> Signed-off-by: Siddharth Vadapalli <s-vadapalli@ti.com> Reviewed-by: Roger Quadros <rogerq@kernel.org> Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com> Link: https://lore.kernel.org/r/20230316095232.2002680-1-s-vadapalli@ti.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2023-03-17net: usb: smsc95xx: Limit packet length to skb->lenSzymon Heidrich
Packet length retrieved from descriptor may be larger than the actual socket buffer length. In such case the cloned skb passed up the network stack will leak kernel memory contents. Fixes: 2f7ca802bdae ("net: Add SMSC LAN9500 USB2.0 10/100 ethernet adapter driver") Signed-off-by: Szymon Heidrich <szymon.heidrich@gmail.com> Reviewed-by: Jakub Kicinski <kuba@kernel.org> Link: https://lore.kernel.org/r/20230316101954.75836-1-szymon.heidrich@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2023-03-17net: dsa: b53: mmap: fix device tree supportÁlvaro Fernández Rojas
CPU port should also be enabled in order to get a working switch. Fixes: a5538a777b73 ("net: dsa: b53: mmap: Add device tree support") Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com> Acked-by: Florian Fainelli <f.fainelli@gmail.com> Link: https://lore.kernel.org/r/20230316172807.460146-1-noltari@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2023-03-17Merge tag 'net-6.3-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from netfilter, wifi and ipsec. A little more changes than usual, but it's pretty normal for us that the rc3/rc4 PRs are oversized as people start testing in earnest. Possibly an extra boost from people deploying the 6.1 LTS but that's more of an unscientific hunch. Current release - regressions: - phy: mscc: fix deadlock in phy_ethtool_{get,set}_wol() - virtio: vsock: don't use skbuff state to account credit - virtio: vsock: don't drop skbuff on copy failure - virtio_net: fix page_to_skb() miscalculating the memory size Current release - new code bugs: - eth: correct xdp_features after device reconfig - wifi: nl80211: fix the puncturing bitmap policy - net/mlx5e: flower: - fix raw counter initialization - fix missing error code - fix cloned flow attribute - ipa: - fix some register validity checks - fix a surprising number of bad offsets - kill FILT_ROUT_CACHE_CFG IPA register Previous releases - regressions: - tcp: fix bind() conflict check for dual-stack wildcard address - veth: fix use after free in XDP_REDIRECT when skb headroom is small - ipv4: fix incorrect table ID in IOCTL path - ipvlan: make skb->skb_iif track skb->dev for l3s mode - mptcp: - fix possible deadlock in subflow_error_report - fix UaFs when destroying unaccepted and listening sockets - dsa: mv88e6xxx: fix max_mtu of 1492 on 6165, 6191, 6220, 6250, 6290 Previous releases - always broken: - tcp: tcp_make_synack() can be called from process context, don't assume preemption is disabled when updating stats - netfilter: correct length for loading protocol registers - virtio_net: add checking sq is full inside xdp xmit - bonding: restore IFF_MASTER/SLAVE flags on bond enslave Ethertype change - phy: nxp-c45-tja11xx: fix MII_BASIC_CONFIG_REV bit number - eth: i40e: fix crash during reboot when adapter is in recovery mode - eth: ice: avoid deadlock on rtnl lock when auxiliary device plug/unplug meets bonding - dsa: mt7530: - remove now incorrect comment regarding port 5 - set PLL frequency and trgmii only when trgmii is used - eth: mtk_eth_soc: reset PCS state when changing interface types Misc: - ynl: another license adjustment - move the TCA_EXT_WARN_MSG attribute for tc action" * tag 'net-6.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (108 commits) selftests: bonding: add tests for ether type changes bonding: restore bond's IFF_SLAVE flag if a non-eth dev enslave fails bonding: restore IFF_MASTER/SLAVE flags on bond enslave ether type change net: renesas: rswitch: Fix GWTSDIE register handling net: renesas: rswitch: Fix the output value of quote from rswitch_rx() ethernet: sun: add check for the mdesc_grab() net: ipa: fix some register validity checks net: ipa: kill FILT_ROUT_CACHE_CFG IPA register net: ipa: add two missing declarations net: ipa: reg: include <linux/bug.h> net: xdp: don't call notifiers during driver init net/sched: act_api: add specific EXT_WARN_MSG for tc action Revert "net/sched: act_api: move TCA_EXT_WARN_MSG to the correct hierarchy" net: dsa: microchip: fix RGMII delay configuration on KSZ8765/KSZ8794/KSZ8795 ynl: make the tooling check the license ynl: broaden the license even more tools: ynl: make definitions optional again hsr: ratelimit only when errors are printed qed/qed_mng_tlv: correctly zero out ->min instead of ->hour selftests: net: devlink_port_split.py: skip test if no suitable device available ...
2023-03-17Merge tag 'block-6.3-2023-03-16' of git://git.kernel.dk/linuxLinus Torvalds
Pull block fixes from Jens Axboe: "A bit bigger than usual, as the NVMe pull request missed last weeks submission. In detail: - NVMe pull request via Christoph: - Avoid potential UAF in nvmet_req_complete (Damien Le Moal) - More quirks (Elmer Miroslav Mosher Golovin, Philipp Geulen) - Fix a memory leak in the nvme-pci probe teardown path (Irvin Cote) - Repair the MAINTAINERS entry (Lukas Bulwahn) - Fix handling single range discard request (Ming Lei) - Show more opcode names in trace events (Minwoo Im) - Fix nvme-tcp timeout reporting (Sagi Grimberg) - MD pull request via Song: - Two fixes for old issues (Neil) - Resource leak in device stopping (Xiao) - Bio based device stats fix (Yu) - Kill unused CONFIG_BLOCK_COMPAT (Lukas) - sunvdc missing mdesc_grab() failure check (Liang) - Fix for reversal of request ordering upon issue for certain cases (Jan) - null_blk timeout fixes (Damien) - Loop use-after-free fix (Bart) - blk-mq SRCU fix for BLK_MQ_F_BLOCKING devices (Chris)" * tag 'block-6.3-2023-03-16' of git://git.kernel.dk/linux: block: remove obsolete config BLOCK_COMPAT md: select BLOCK_LEGACY_AUTOLOAD block: count 'ios' and 'sectors' when io is done for bio-based device block: sunvdc: add check for mdesc_grab() returning NULL nvmet: avoid potential UAF in nvmet_req_complete() nvme-trace: show more opcode names nvme-tcp: add nvme-tcp pdu size build protection nvme-tcp: fix opcode reporting in the timeout handler nvme-pci: add NVME_QUIRK_BOGUS_NID for Lexar NM620 nvme-pci: add NVME_QUIRK_BOGUS_NID for Netac NV3000 nvme-pci: fixing memory leak in probe teardown path nvme: fix handling single range discard request MAINTAINERS: repair malformed T: entries in NVM EXPRESS DRIVERS block: null_blk: cleanup null_queue_rq() block: null_blk: Fix handling of fake timeout request blk-mq: fix "bad unlock balance detected" on q->srcu in __blk_mq_run_dispatch_ops loop: Fix use-after-free issues block: do not reverse request order when flushing plug list md: avoid signed overflow in slot_store() md: Free resources in __md_stop
2023-03-17Merge tag 'pm-6.3-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "These fix an error code path issue in a cpuidle driver and make the sleepgraph utility more robust against unexpected input. Specifics: - Fix the psci_pd_init_topology() failure path in the PSCI cpuidle driver (Shawn Guo) - Modify the sleepgraph utility so it does not crash on binary data in device names (Todd Brandt)" * tag 'pm-6.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: pm-graph: sleepgraph: Avoid crashing on binary data in device names cpuidle: psci: Iterate backwards over list in psci_pd_remove()
2023-03-17Merge tag 'acpi-6.3-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fixes from Rafael Wysocki: "These add some new quirks, fix PPTT handling, fix an ACPI utility and correct a mistake in the ACPI documentation. Specifics: - Fix ACPI PPTT handling to avoid sleep in the atomic context when it is not present (Sudeep Holla) - Add 'backlight=native' DMI quirk for Dell Vostro 15 3535 to the ACPI video driver (Chia-Lin Kao) - Add ACPI quirks for I2C device enumeration on Lenovo Yoga Book X90 and Acer Iconia One 7 B1-750 (Hans de Goede) - Fix handling of invalid command line option values in the ACPI pfrut utility (Chen Yu) - Fix references to I2C device data type in the ACPI documentation for device enumeration (Andy Shevchenko)" * tag 'acpi-6.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: tools: pfrut: Check if the input of level and type is in the right numeric range ACPI: PPTT: Fix to avoid sleep in the atomic context when PPTT is absent ACPI: x86: Add skip i2c clients quirk for Lenovo Yoga Book X90 ACPI: x86: Add skip i2c clients quirk for Acer Iconia One 7 B1-750 ACPI: x86: Introduce an acpi_quirk_skip_gpio_event_handlers() helper ACPI: video: Add backlight=native DMI quirk for Dell Vostro 15 3535 ACPI: docs: enumeration: Correct reference to the I²C device data type
2023-03-17Merge tag 'for-linus-6.3-rc3-tag' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen fixes from Juergen Gross: - cleanup for xen time handling - enable the VGA console in a Xen PVH dom0 - cleanup in the xenfs driver * tag 'for-linus-6.3-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen: remove unnecessary (void*) conversions x86/PVH: obtain VGA console info in Dom0 x86/xen/time: cleanup xen_tsc_safe_clocksource xen: update arch/x86/include/asm/xen/cpuid.h
2023-03-17Merge tag 's390-6.3-3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Vasily Gorbik: - Update defconfigs - Fix early boot code by adding missing intersection check to prevent potential overwriting of the ipl report - Fix a use-after-free issue in s390-specific code related to PCI resources being retained after hot-unplugging individual functions, by removing the resources from the PCI bus's resource list and using the zpci_bar_struct's resource pointer directly * tag 's390-6.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390: update defconfigs PCI: s390: Fix use-after-free of PCI resources with per-function hotplug s390/ipl: add missing intersection check to ipl_report handling
2023-03-17Merge tag 'mmc-v6.3-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC host fixes from Ulf Hansson: - dw_mmc-starfive: Fix initialization of the prev_err variable - sdhci_am654: Lower power-on failed message severity * tag 'mmc-v6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: dw_mmc-starfive: Fix initialization of prev_err mmc: sdhci_am654: lower power-on failed message severity
2023-03-17Merge tag 'drm-fixes-2023-03-17' of git://anongit.freedesktop.org/drm/drmLinus Torvalds
Pull drm fixes from Dave Airlie: "Seems like a pretty regular rc3, i915 and amdgpu with the usual selection of fixes, then a scattering of fixes across misc drivers and other areas: accel: - build fix for accel edid: - fix info leak in edid ttm: - fix NULL ptr deref - reference counting fix i915: - Fix hwmon PL1 power limit enabling - Fix audio ELD handling for DP MST - Fix PSR io and wake line calculations - Fix DG2 HDMI modes with 267.30 and 319.89 MHz pixel clocks - Fix SSEU subslice out-of-bounds access - Fix misuse of non-idle barriers as fence trackers amdgpu: - SMU 13 update - RDNA2 suspend/resume fix when overclocking is enabled - SRIOV VCN fixes - HDCP suspend/resume fix - Fix drm polling splat regression - Fix dirty rectangle tracking for PSR - Fix vangogh regression on certain BIOSes - Misc display fixes - Suspend/resume IOMMU regression fix amdkfd: - Fix BO offset for multi-VMA page migration - Fix a possible double free - Fix potential use after free - Fix process cleanup on module exit bridge: - fix returned array size name documentation fbdev: - ref-counting fix for fbdev deferred I/O virtio: - dma sync fix shmem-helper: - error path fix msm: - shrinker blocking fix panfrost: - shrinker rpm fix chipsfb: - fix error code meson: - fix 1px pink line - fix regulator interaction sun4i: - fix missing component unbind" * tag 'drm-fixes-2023-03-17' of git://anongit.freedesktop.org/drm/drm: (38 commits) drm/ttm: drop extra ttm_bo_put in ttm_bo_cleanup_refs drm/amdgpu: Don't resume IOMMU after incomplete init drm/amdkfd: Fixed kfd_process cleanup on module exit. drm/amd/display: disconnect MPCC only on OTG change drm/amd/display: Fix DP MST sinks removal issue drm/amd/display: Do not set DRR on pipe Commit drm/amd/display: Remove OTG DIV register write for Virtual signals. drm/meson: dw-hdmi: Fix devm_regulator_*get_enable*() conversion again drm/bridge: Fix returned array size name for atomic_get_input_bus_fmts kdoc drm/amdgpu/vcn: Disable indirect SRAM on Vangogh broken BIOSes drm/amdgpu/nv: fix codec array for SR_IOV drm/amd/display: Write to correct dirty_rect drm/amdgpu: move poll enabled/disable into non DC path drm/amd/display: Fix HDCP failing to enable after suspend drm/amdkfd: fix potential kgd_mem UAFs drm/amdgpu/vcn: custom video info caps for sriov drm/amd/pm: Fix sienna cichlid incorrect OD volage after resume drm/amd/pm: bump SMU 13.0.4 driver_if header version drm/amdkfd: fix a potential double free in pqm_create_queue drm/amdkfd: Get prange->offset after svm_range_vram_node_new ...
2023-03-17Merge tag 'scsi-fixes' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Ten patches, eight in drivers and two in the core, which correct a regression from directory removal and add a no VPD size quirk also to fix a regression. All pretty small" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: ufs: mcq: Use active_reqs to check busy in clock scaling scsi: core: Fix a procfs host directory removal regression scsi: core: Add BLIST_NO_VPD_SIZE for some VDASD scsi: mpi3mr: Fix expander node leak in mpi3mr_remove() scsi: mpi3mr: Fix memory leaks in mpi3mr_init_ioc() scsi: mpi3mr: Fix sas_hba.phy memory leak in mpi3mr_remove() scsi: mpi3mr: Fix mpi3mr_hba_port memory leak in mpi3mr_remove() scsi: mpi3mr: Fix config page DMA memory leak scsi: mpi3mr: Fix throttle_groups memory leak scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add()
2023-03-17Merge tag 'scmi-fixes-6.3' of ↵Arnd Bergmann
git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into soc/fixes Arm SCMI fixes for v6.3 Few fixes addressing issues around validation of device tree SCMI node, allowing raw SCMI access even on systems which fail to probe the normal driver stack, duplicate header inclusion, clean up return statement using literal values instead of variable to simplify and use of devm_bitmap_zalloc instead of devm_kcalloc to improve semantic. * tag 'scmi-fixes-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: firmware: arm_scmi: Use the bitmap API to allocate bitmaps firmware: arm_scmi: Fix device node validation for mailbox transport firmware: arm_scmi: Fix raw coexistence mode behaviour on failure path firmware: arm_scmi: Remove duplicate include header inclusion firmware: arm_scmi: Return a literal instead of a variable firmware: arm_scmi: Clean up a return statement in scmi_probe Link: https://lore.kernel.org/r/20230315193557.1709241-1-sudeep.holla@arm.com Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2023-03-17drm/format-helper: Use drm_format_info_min_pitch() in tests helperJavier Martinez Canillas
There's a nice macro to calculate the destination pitch that already takes into account sub-byte pixel formats. Use that instead of open coding it. Suggested-by: Geert Uytterhoeven <geert@linux-m68k.org> Signed-off-by: Javier Martinez Canillas <javierm@redhat.com> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Link: https://patchwork.freedesktop.org/patch/msgid/20230316223404.102806-1-javierm@redhat.com
2023-03-17Merge branch 'pm-cpuidle'Rafael J. Wysocki
Merge a PSCI cpuidle driver fix for 6.3-rc1: - Fix the psci_pd_init_topology() failure path in the PSCI cpuidle driver (Shawn Guo). * pm-cpuidle: cpuidle: psci: Iterate backwards over list in psci_pd_remove()
2023-03-17Merge branches 'acpi-video', 'acpi-x86', 'acpi-tools' and 'acpi-docs'Rafael J. Wysocki
Merge a new ACPI backlight quirk, new ACPI quirks for I2C device enumeration on some platforms, a pfrut utility fix and an ACPI documentation fix for 6.3-rc3: - Add backlight=native DMI quirk for Dell Vostro 15 3535 to the ACPI video driver (Chia-Lin Kao). - Add ACPI quirks for I2C devices enumeration on Lenovo Yoga Book X90 and Acer Iconia One 7 B1-750 (Hans de Goede). - Fix handling of invalid command line option values in the ACPI pfrut utility (Chen Yu). - Fix references to I2C device data type in the ACPI documentation for device enumeration (Andy Shevchenko). * acpi-video: ACPI: video: Add backlight=native DMI quirk for Dell Vostro 15 3535 * acpi-x86: ACPI: x86: Add skip i2c clients quirk for Lenovo Yoga Book X90 ACPI: x86: Add skip i2c clients quirk for Acer Iconia One 7 B1-750 ACPI: x86: Introduce an acpi_quirk_skip_gpio_event_handlers() helper * acpi-tools: ACPI: tools: pfrut: Check if the input of level and type is in the right numeric range * acpi-docs: ACPI: docs: enumeration: Correct reference to the I²C device data type
2023-03-17drm/arm/hdlcd: Use devm_platform_ioremap_resource()Yang Li
According to commit 7945f929f1a7 ("drivers: provide devm_platform_ioremap_resource()"), convert platform_get_resource(), devm_ioremap_resource() to a single call to Use devm_platform_ioremap_resource(), as this is exactly what this function does. Since 'struct platform_device *pdev = to_platform_device(drm->dev)', 'drm->dev' is equivalent to 'pdev->deva'. Signed-off-by: Yang Li <yang.lee@linux.alibaba.com> Acked-by: Liviu Dudau <liviu.dudau@arm.com> Signed-off-by: Liviu Dudau <liviu.dudau@arm.com> Link: https://patchwork.freedesktop.org/patch/msgid/20230314080231.20212-1-yang.lee@linux.alibaba.com
2023-03-17drm/arm/malidp: Use devm_platform_get_and_ioremap_resource()Yang Li
According to commit 890cc39a8799 ("drivers: provide devm_platform_get_and_ioremap_resource()"), convert platform_get_resource(), devm_ioremap_resource() to a single call to devm_platform_get_and_ioremap_resource(), as this is exactly what this function does. Since 'struct platform_device *pdev = to_platform_device(dev)', 'pdev->dev' is equivalent to 'dev'. Signed-off-by: Yang Li <yang.lee@linux.alibaba.com> Acked-by: Liviu Dudau <liviu.dudau@arm.com> Signed-off-by: Liviu Dudau <liviu.dudau@arm.com> Link: https://patchwork.freedesktop.org/patch/msgid/20230314080231.20212-2-yang.lee@linux.alibaba.com
2023-03-17Merge tag 'imx-fixes-6.3' of ↵Arnd Bergmann
git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into soc-fixes i.MX fixes for 6.3: - A couple of i.MX93 fixes from Alexander Stein to correct EQoS Ethernet properties. - Correct clock-names of FlexSPI device in imx8-ss-lsio DT. - Fix EQoS PHY reset GPIO by dropping the deprecated/wrong property and switch to the new bindings. - Fix an issue with imx-weim bus driver that branch condition evaluates to a garbage value. - Correct WM8960 clock name for imx8mm-nitrogen-r2 board. - Fix LCDIF2 clocks for i.MX8MP DT. - Add missing #sound-dai-cells properties to SAI nodes for i.MX8MN DT. - Revert LS1028A DT changes of getting MAC addresses from VPD, as the dependency on NVMEM device is not in place. - A series from Peng Fan to add missing pinctrl property for i.MX6SL based devices. * tag 'imx-fixes-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: arm64: dts: imx93: add missing #address-cells and #size-cells to i2c nodes bus: imx-weim: fix branch condition evaluates to a garbage value arm64: dts: imx8mn: specify #sound-dai-cells for SAI nodes ARM: dts: imx6sl: tolino-shine2hd: fix usbotg1 pinctrl ARM: dts: imx6sll: e60k02: fix usbotg1 pinctrl ARM: dts: imx6sll: e70k02: fix usbotg1 pinctrl arm64: dts: imx93: Fix eqos properties arm64: dts: imx8mp: Fix LCDIF2 node clock order arm64: dts: imx8mm-nitrogen-r2: fix WM8960 clock name arm64: dts: imx8dxl-evk: Fix eqos phy reset gpio Revert "arm64: dts: ls1028a: sl28: get MAC addresses from VPD" arm64: dts: freescale: imx8-ss-lsio: Fix flexspi clock order Link: https://lore.kernel.org/r/20230315132814.GF143566@dragon Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2023-03-17Merge tag 'amdtee-fix-for-v6.3' of ↵Arnd Bergmann
https://git.linaro.org/people/jens.wiklander/linux-tee into soc-fixes AMDTEE fix race condition in amdtee_open_session() * tag 'amdtee-fix-for-v6.3' of https://git.linaro.org/people/jens.wiklander/linux-tee: tee: amdtee: fix race condition in amdtee_open_session Link: https://lore.kernel.org/r/Y/5ZGX0lSTnZz27E@rayden Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2023-03-17drm/i915: Extract intel_sprite_uapi.cVille Syrjälä
Move the sprite colorkey ioctl handler to its own file so that intel_sprite.c becomes all about the low level details of pre-skl sprite planes. And drop a bunch of unnecessary includes while at it. Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20230314130255.23273-10-ville.syrjala@linux.intel.com Reviewed-by: Jouni Högander <jouni.hogander@intel.com>
2023-03-17drm/i915: Relocate intel_plane_check_src_coordinates()Ville Syrjälä
Move intel_plane_check_src_coordinates() from the pre-skl sprite plane specific code to a more suitable place for common plane code. Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20230314130255.23273-9-ville.syrjala@linux.intel.com Reviewed-by: Jouni Högander <jouni.hogander@intel.com>
2023-03-17drm/i915: Clean up skl+ plane alpha bitsVille Syrjälä
Convert a few more skl+ plane registers to REG_BIT() & co. Somehow thse were missed during the earlier cleanup. Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20230314130255.23273-8-ville.syrjala@linux.intel.com Reviewed-by: Jouni Högander <jouni.hogander@intel.com>
2023-03-17drm/i915: Define vlv/chv sprite plane SURFLIVE registersVille Syrjälä
Might as well complete the SURFLIVE register definitions for all platforms/plane types. We are only missing the VLV/CHV sprite planes. Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20230314130255.23273-7-ville.syrjala@linux.intel.com Reviewed-by: Jouni Högander <jouni.hogander@intel.com>
2023-03-17drm/i915: Define skl+ universal plane SURFLIVE registersVille Syrjälä
Add the definitions for the skl+ univerals plane SURFLIVE registers. Despite not being used for anything real these came in suprisingly handy during some DSB debugging recently, so having the defines around can be useful. Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20230314130255.23273-6-ville.syrjala@linux.intel.com Reviewed-by: Jouni Högander <jouni.hogander@intel.com>
2023-03-17drm/i915: Program VLV/CHV PIPE_MSA_MISC registerVille Syrjälä
VLV/CHV have an extra register to configure some stereo3d signalling details via DP MSA. Make sure we reset that register to zero (since we don't do any stereo3d stuff). Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20230314130255.23273-5-ville.syrjala@linux.intel.com Reviewed-by: Jouni Högander <jouni.hogander@intel.com>
2023-03-17drm/i915: Define more pipe timestamp registersVille Syrjälä
Add definitions for various pipe timestamp registers: - frame timestamp (last start of vblank) (g4x+), already had this defined - flip timestamp (when SURF was last written) (g4x+) - flipdone timestamp (when last flipdone was signalled) (tgl+) Note that on pre-tgl the flip related timestamps are only updated for primary plane flips, but on tgl+ we can select which plane updates them (via PIPE_MISC2). Let's define those related bits as well. Curiously VLV/CHV do not have the frame/flip timestamp registers, despite all the other related registers being inherited from g4x. This means we can get rid of the pipe_offsets[] usage for these, and thus the implicit dev_priv is gone as well. Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20230314130255.23273-4-ville.syrjala@linux.intel.com Reviewed-by: Jouni Högander <jouni.hogander@intel.com>
2023-03-17drm/i915: s/PIPEMISC/PIPE_MISC/Ville Syrjälä
This PIPEMISC vs. PIPE_MISC inconsitency is ugly. Unify the naming (PIPE_MISC is also what bspec has always called it). Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20230314130255.23273-3-ville.syrjala@linux.intel.com Reviewed-by: Jouni Högander <jouni.hogander@intel.com>
2023-03-17drm/i915: Stop using pipe_offsets[] for PIPE_MISC*Ville Syrjälä
The PIPE_MISC registers don't exist on pre-bdw hardware, so there is no point in using pipe_offsets[] for them. Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20230314130255.23273-2-ville.syrjala@linux.intel.com Reviewed-by: Jouni Högander <jouni.hogander@intel.com>
2023-03-17drm/ttm/ttm_bo: Provide a missing 'bulk' description and correct misnaming ↵Lee Jones
of 'placement' 'bulk' description taken from another in the same file. Fixes the following W=1 kernel build warning(s): drivers/gpu/drm/ttm/ttm_bo.c:98: warning: Function parameter or member 'bulk' not described in 'ttm_bo_set_bulk_move' drivers/gpu/drm/ttm/ttm_bo.c:768: warning: Function parameter or member 'placement' not described in 'ttm_bo_mem_space' drivers/gpu/drm/ttm/ttm_bo.c:768: warning: Excess function parameter 'proposed_placement' description in 'ttm_bo_mem_space' Signed-off-by: Lee Jones <lee@kernel.org> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Christian König <christian.koenig@amd.com> Link: https://patchwork.freedesktop.org/patch/msgid/20230317081718.2650744-6-lee@kernel.org
2023-03-17bonding: restore bond's IFF_SLAVE flag if a non-eth dev enslave failsNikolay Aleksandrov
syzbot reported a warning[1] where the bond device itself is a slave and we try to enslave a non-ethernet device as the first slave which fails but then in the error path when ether_setup() restores the bond device it also clears all flags. In my previous fix[2] I restored the IFF_MASTER flag, but I didn't consider the case that the bond device itself might also be a slave with IFF_SLAVE set, so we need to restore that flag as well. Use the bond_ether_setup helper which does the right thing and restores the bond's flags properly. Steps to reproduce using a nlmon dev: $ ip l add nlmon0 type nlmon $ ip l add bond1 type bond $ ip l add bond2 type bond $ ip l set bond1 master bond2 $ ip l set dev nlmon0 master bond1 $ ip -d l sh dev bond1 22: bond1: <BROADCAST,MULTICAST,MASTER> mtu 1500 qdisc noqueue master bond2 state DOWN mode DEFAULT group default qlen 1000 (now bond1's IFF_SLAVE flag is gone and we'll hit a warning[3] if we try to delete it) [1] https://syzkaller.appspot.com/bug?id=391c7b1f6522182899efba27d891f1743e8eb3ef [2] commit 7d5cd2ce5292 ("bonding: correctly handle bonding type change on enslave failure") [3] example warning: [ 27.008664] bond1: (slave nlmon0): The slave device specified does not support setting the MAC address [ 27.008692] bond1: (slave nlmon0): Error -95 calling set_mac_address [ 32.464639] bond1 (unregistering): Released all slaves [ 32.464685] ------------[ cut here ]------------ [ 32.464686] WARNING: CPU: 1 PID: 2004 at net/core/dev.c:10829 unregister_netdevice_many+0x72a/0x780 [ 32.464694] Modules linked in: br_netfilter bridge bonding virtio_net [ 32.464699] CPU: 1 PID: 2004 Comm: ip Kdump: loaded Not tainted 5.18.0-rc3+ #47 [ 32.464703] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.1-2.fc37 04/01/2014 [ 32.464704] RIP: 0010:unregister_netdevice_many+0x72a/0x780 [ 32.464707] Code: 99 fd ff ff ba 90 1a 00 00 48 c7 c6 f4 02 66 96 48 c7 c7 20 4d 35 96 c6 05 fa c7 2b 02 01 e8 be 6f 4a 00 0f 0b e9 73 fd ff ff <0f> 0b e9 5f fd ff ff 80 3d e3 c7 2b 02 00 0f 85 3b fd ff ff ba 59 [ 32.464710] RSP: 0018:ffffa006422d7820 EFLAGS: 00010206 [ 32.464712] RAX: ffff8f6e077140a0 RBX: ffffa006422d7888 RCX: 0000000000000000 [ 32.464714] RDX: ffff8f6e12edbe58 RSI: 0000000000000296 RDI: ffffffff96d4a520 [ 32.464716] RBP: ffff8f6e07714000 R08: ffffffff96d63600 R09: ffffa006422d7728 [ 32.464717] R10: 0000000000000ec0 R11: ffffffff9698c988 R12: ffff8f6e12edb140 [ 32.464719] R13: dead000000000122 R14: dead000000000100 R15: ffff8f6e12edb140 [ 32.464723] FS: 00007f297c2f1740(0000) GS:ffff8f6e5d900000(0000) knlGS:0000000000000000 [ 32.464725] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 32.464726] CR2: 00007f297bf1c800 CR3: 00000000115e8000 CR4: 0000000000350ee0 [ 32.464730] Call Trace: [ 32.464763] <TASK> [ 32.464767] rtnl_dellink+0x13e/0x380 [ 32.464776] ? cred_has_capability.isra.0+0x68/0x100 [ 32.464780] ? __rtnl_unlock+0x33/0x60 [ 32.464783] ? bpf_lsm_capset+0x10/0x10 [ 32.464786] ? security_capable+0x36/0x50 [ 32.464790] rtnetlink_rcv_msg+0x14e/0x3b0 [ 32.464792] ? _copy_to_iter+0xb1/0x790 [ 32.464796] ? post_alloc_hook+0xa0/0x160 [ 32.464799] ? rtnl_calcit.isra.0+0x110/0x110 [ 32.464802] netlink_rcv_skb+0x50/0xf0 [ 32.464806] netlink_unicast+0x216/0x340 [ 32.464809] netlink_sendmsg+0x23f/0x480 [ 32.464812] sock_sendmsg+0x5e/0x60 [ 32.464815] ____sys_sendmsg+0x22c/0x270 [ 32.464818] ? import_iovec+0x17/0x20 [ 32.464821] ? sendmsg_copy_msghdr+0x59/0x90 [ 32.464823] ? do_set_pte+0xa0/0xe0 [ 32.464828] ___sys_sendmsg+0x81/0xc0 [ 32.464832] ? mod_objcg_state+0xc6/0x300 [ 32.464835] ? refill_obj_stock+0xa9/0x160 [ 32.464838] ? memcg_slab_free_hook+0x1a5/0x1f0 [ 32.464842] __sys_sendmsg+0x49/0x80 [ 32.464847] do_syscall_64+0x3b/0x90 [ 32.464851] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 32.464865] RIP: 0033:0x7f297bf2e5e7 [ 32.464868] Code: 64 89 02 48 c7 c0 ff ff ff ff eb bb 0f 1f 80 00 00 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 [ 32.464869] RSP: 002b:00007ffd96c824c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 32.464872] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f297bf2e5e7 [ 32.464874] RDX: 0000000000000000 RSI: 00007ffd96c82540 RDI: 0000000000000003 [ 32.464875] RBP: 00000000640f19de R08: 0000000000000001 R09: 000000000000007c [ 32.464876] R10: 00007f297bffabe0 R11: 0000000000000246 R12: 0000000000000001 [ 32.464877] R13: 00007ffd96c82d20 R14: 00007ffd96c82610 R15: 000055bfe38a7020 [ 32.464881] </TASK> [ 32.464882] ---[ end trace 0000000000000000 ]--- Fixes: 7d5cd2ce5292 ("bonding: correctly handle bonding type change on enslave failure") Reported-by: syzbot+9dfc3f3348729cc82277@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?id=391c7b1f6522182899efba27d891f1743e8eb3ef Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org> Reviewed-by: Michal Kubiak <michal.kubiak@intel.com> Acked-by: Jonathan Toppins <jtoppins@redhat.com> Acked-by: Jay Vosburgh <jay.vosburgh@canonical.com> Signed-off-by: David S. Miller <davem@davemloft.net>