September 2022 - Kernel - mailweb.openeuler.org

[PATCH openEuler-5.10 01/38] rbtree: Add generic add and find helpers
by Zheng Zengkai 30 Sep '22

30 Sep '22

From: Peter Zijlstra <peterz(a)infradead.org> mainline inclusion from mainline-v5.12-rc1 commit 2d24dd5798d0474d9bf705bfca8725e7d20f9d54 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I5OOWG CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------------------------------------------------- I've always been bothered by the endless (fragile) boilerplate for rbtree, and I recently wrote some rbtree helpers for objtool and figured I should lift them into the kernel and use them more widely. Provide: partial-order; less() based: - rb_add(): add a new entry to the rbtree - rb_add_cached(): like rb_add(), but for a rb_root_cached total-order; cmp() based: - rb_find(): find an entry in an rbtree - rb_find_add(): find an entry, and add if not found - rb_find_first(): find the first (leftmost) matching entry - rb_next_match(): continue from rb_find_first() - rb_for_each(): iterate a sub-tree using the previous two Inlining and constant propagation should see the compiler inline the whole thing, including the various compare functions. Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Reviewed-by: Michel Lespinasse <walken(a)google.com> Acked-by: Davidlohr Bueso <dbueso(a)suse.de> Conflicts: tools/objtool/elf.c [Feature 3690914ed35e("objtool: Extract elf_symbol_add()")] Signed-off-by: Lin Shengwang <linshengwang1(a)huawei.com> Reviewed-by: lihua <hucool.lihua(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- include/linux/rbtree.h | 190 ++++++++++++++++++++++++++++++++++ tools/include/linux/rbtree.h | 192 ++++++++++++++++++++++++++++++++++- tools/objtool/elf.c | 73 ++----------- 3 files changed, 392 insertions(+), 63 deletions(-) diff --git a/include/linux/rbtree.h b/include/linux/rbtree.h index d7db17996322..e0b300de8f3f 100644 --- a/include/linux/rbtree.h +++ b/include/linux/rbtree.h @@ -158,4 +158,194 @@ static inline void rb_replace_node_cached(struct rb_node *victim, rb_replace_node(victim, new, &root->rb_root); } +/* + * The below helper functions use 2 operators with 3 different + * calling conventions. The operators are related like: + * + * comp(a->key,b) < 0 := less(a,b) + * comp(a->key,b) > 0 := less(b,a) + * comp(a->key,b) == 0 := !less(a,b) && !less(b,a) + * + * If these operators define a partial order on the elements we make no + * guarantee on which of the elements matching the key is found. See + * rb_find(). + * + * The reason for this is to allow the find() interface without requiring an + * on-stack dummy object, which might not be feasible due to object size. + */ + +/** + * rb_add_cached() - insert @node into the leftmost cached tree @tree + * @node: node to insert + * @tree: leftmost cached tree to insert @node into + * @less: operator defining the (partial) node order + */ +static __always_inline void +rb_add_cached(struct rb_node *node, struct rb_root_cached *tree, + bool (*less)(struct rb_node *, const struct rb_node *)) +{ + struct rb_node **link = &tree->rb_root.rb_node; + struct rb_node *parent = NULL; + bool leftmost = true; + + while (*link) { + parent = *link; + if (less(node, parent)) { + link = &parent->rb_left; + } else { + link = &parent->rb_right; + leftmost = false; + } + } + + rb_link_node(node, parent, link); + rb_insert_color_cached(node, tree, leftmost); +} + +/** + * rb_add() - insert @node into @tree + * @node: node to insert + * @tree: tree to insert @node into + * @less: operator defining the (partial) node order + */ +static __always_inline void +rb_add(struct rb_node *node, struct rb_root *tree, + bool (*less)(struct rb_node *, const struct rb_node *)) +{ + struct rb_node **link = &tree->rb_node; + struct rb_node *parent = NULL; + + while (*link) { + parent = *link; + if (less(node, parent)) + link = &parent->rb_left; + else + link = &parent->rb_right; + } + + rb_link_node(node, parent, link); + rb_insert_color(node, tree); +} + +/** + * rb_find_add() - find equivalent @node in @tree, or add @node + * @node: node to look-for / insert + * @tree: tree to search / modify + * @cmp: operator defining the node order + * + * Returns the rb_node matching @node, or NULL when no match is found and @node + * is inserted. + */ +static __always_inline struct rb_node * +rb_find_add(struct rb_node *node, struct rb_root *tree, + int (*cmp)(struct rb_node *, const struct rb_node *)) +{ + struct rb_node **link = &tree->rb_node; + struct rb_node *parent = NULL; + int c; + + while (*link) { + parent = *link; + c = cmp(node, parent); + + if (c < 0) + link = &parent->rb_left; + else if (c > 0) + link = &parent->rb_right; + else + return parent; + } + + rb_link_node(node, parent, link); + rb_insert_color(node, tree); + return NULL; +} + +/** + * rb_find() - find @key in tree @tree + * @key: key to match + * @tree: tree to search + * @cmp: operator defining the node order + * + * Returns the rb_node matching @key or NULL. + */ +static __always_inline struct rb_node * +rb_find(const void *key, const struct rb_root *tree, + int (*cmp)(const void *key, const struct rb_node *)) +{ + struct rb_node *node = tree->rb_node; + + while (node) { + int c = cmp(key, node); + + if (c < 0) + node = node->rb_left; + else if (c > 0) + node = node->rb_right; + else + return node; + } + + return NULL; +} + +/** + * rb_find_first() - find the first @key in @tree + * @key: key to match + * @tree: tree to search + * @cmp: operator defining node order + * + * Returns the leftmost node matching @key, or NULL. + */ +static __always_inline struct rb_node * +rb_find_first(const void *key, const struct rb_root *tree, + int (*cmp)(const void *key, const struct rb_node *)) +{ + struct rb_node *node = tree->rb_node; + struct rb_node *match = NULL; + + while (node) { + int c = cmp(key, node); + + if (c <= 0) { + if (!c) + match = node; + node = node->rb_left; + } else if (c > 0) { + node = node->rb_right; + } + } + + return match; +} + +/** + * rb_next_match() - find the next @key in @tree + * @key: key to match + * @tree: tree to search + * @cmp: operator defining node order + * + * Returns the next node matching @key, or NULL. + */ +static __always_inline struct rb_node * +rb_next_match(const void *key, struct rb_node *node, + int (*cmp)(const void *key, const struct rb_node *)) +{ + node = rb_next(node); + if (node && cmp(key, node)) + node = NULL; + return node; +} + +/** + * rb_for_each() - iterates a subtree matching @key + * @node: iterator + * @key: key to match + * @tree: tree to search + * @cmp: operator defining node order + */ +#define rb_for_each(node, key, tree, cmp) \ + for ((node) = rb_find_first((key), (tree), (cmp)); \ + (node); (node) = rb_next_match((key), (node), (cmp))) + #endif /* _LINUX_RBTREE_H */ diff --git a/tools/include/linux/rbtree.h b/tools/include/linux/rbtree.h index 30dd21f976c3..2680f2edb837 100644 --- a/tools/include/linux/rbtree.h +++ b/tools/include/linux/rbtree.h @@ -152,4 +152,194 @@ static inline void rb_replace_node_cached(struct rb_node *victim, rb_replace_node(victim, new, &root->rb_root); } -#endif /* __TOOLS_LINUX_PERF_RBTREE_H */ +/* + * The below helper functions use 2 operators with 3 different + * calling conventions. The operators are related like: + * + * comp(a->key,b) < 0 := less(a,b) + * comp(a->key,b) > 0 := less(b,a) + * comp(a->key,b) == 0 := !less(a,b) && !less(b,a) + * + * If these operators define a partial order on the elements we make no + * guarantee on which of the elements matching the key is found. See + * rb_find(). + * + * The reason for this is to allow the find() interface without requiring an + * on-stack dummy object, which might not be feasible due to object size. + */ + +/** + * rb_add_cached() - insert @node into the leftmost cached tree @tree + * @node: node to insert + * @tree: leftmost cached tree to insert @node into + * @less: operator defining the (partial) node order + */ +static __always_inline void +rb_add_cached(struct rb_node *node, struct rb_root_cached *tree, + bool (*less)(struct rb_node *, const struct rb_node *)) +{ + struct rb_node **link = &tree->rb_root.rb_node; + struct rb_node *parent = NULL; + bool leftmost = true; + + while (*link) { + parent = *link; + if (less(node, parent)) { + link = &parent->rb_left; + } else { + link = &parent->rb_right; + leftmost = false; + } + } + + rb_link_node(node, parent, link); + rb_insert_color_cached(node, tree, leftmost); +} + +/** + * rb_add() - insert @node into @tree + * @node: node to insert + * @tree: tree to insert @node into + * @less: operator defining the (partial) node order + */ +static __always_inline void +rb_add(struct rb_node *node, struct rb_root *tree, + bool (*less)(struct rb_node *, const struct rb_node *)) +{ + struct rb_node **link = &tree->rb_node; + struct rb_node *parent = NULL; + + while (*link) { + parent = *link; + if (less(node, parent)) + link = &parent->rb_left; + else + link = &parent->rb_right; + } + + rb_link_node(node, parent, link); + rb_insert_color(node, tree); +} + +/** + * rb_find_add() - find equivalent @node in @tree, or add @node + * @node: node to look-for / insert + * @tree: tree to search / modify + * @cmp: operator defining the node order + * + * Returns the rb_node matching @node, or NULL when no match is found and @node + * is inserted. + */ +static __always_inline struct rb_node * +rb_find_add(struct rb_node *node, struct rb_root *tree, + int (*cmp)(struct rb_node *, const struct rb_node *)) +{ + struct rb_node **link = &tree->rb_node; + struct rb_node *parent = NULL; + int c; + + while (*link) { + parent = *link; + c = cmp(node, parent); + + if (c < 0) + link = &parent->rb_left; + else if (c > 0) + link = &parent->rb_right; + else + return parent; + } + + rb_link_node(node, parent, link); + rb_insert_color(node, tree); + return NULL; +} + +/** + * rb_find() - find @key in tree @tree + * @key: key to match + * @tree: tree to search + * @cmp: operator defining the node order + * + * Returns the rb_node matching @key or NULL. + */ +static __always_inline struct rb_node * +rb_find(const void *key, const struct rb_root *tree, + int (*cmp)(const void *key, const struct rb_node *)) +{ + struct rb_node *node = tree->rb_node; + + while (node) { + int c = cmp(key, node); + + if (c < 0) + node = node->rb_left; + else if (c > 0) + node = node->rb_right; + else + return node; + } + + return NULL; +} + +/** + * rb_find_first() - find the first @key in @tree + * @key: key to match + * @tree: tree to search + * @cmp: operator defining node order + * + * Returns the leftmost node matching @key, or NULL. + */ +static __always_inline struct rb_node * +rb_find_first(const void *key, const struct rb_root *tree, + int (*cmp)(const void *key, const struct rb_node *)) +{ + struct rb_node *node = tree->rb_node; + struct rb_node *match = NULL; + + while (node) { + int c = cmp(key, node); + + if (c <= 0) { + if (!c) + match = node; + node = node->rb_left; + } else if (c > 0) { + node = node->rb_right; + } + } + + return match; +} + +/** + * rb_next_match() - find the next @key in @tree + * @key: key to match + * @tree: tree to search + * @cmp: operator defining node order + * + * Returns the next node matching @key, or NULL. + */ +static __always_inline struct rb_node * +rb_next_match(const void *key, struct rb_node *node, + int (*cmp)(const void *key, const struct rb_node *)) +{ + node = rb_next(node); + if (node && cmp(key, node)) + node = NULL; + return node; +} + +/** + * rb_for_each() - iterates a subtree matching @key + * @node: iterator + * @key: key to match + * @tree: tree to search + * @cmp: operator defining node order + */ +#define rb_for_each(node, key, tree, cmp) \ + for ((node) = rb_find_first((key), (tree), (cmp)); \ + (node); (node) = rb_next_match((key), (node), (cmp))) + +#endif /* __TOOLS_LINUX_PERF_RBTREE_H */ diff --git a/tools/objtool/elf.c b/tools/objtool/elf.c index de6e42040d75..a0468ead1ea1 100644 --- a/tools/objtool/elf.c +++ b/tools/objtool/elf.c @@ -43,75 +43,24 @@ static void elf_hash_init(struct hlist_head *table) #define elf_hash_for_each_possible(name, obj, member, key) \ hlist_for_each_entry(obj, &name[hash_min(key, elf_hash_bits())], member) -static void rb_add(struct rb_root *tree, struct rb_node *node, - int (*cmp)(struct rb_node *, const struct rb_node *)) -{ - struct rb_node **link = &tree->rb_node; - struct rb_node *parent = NULL; - - while (*link) { - parent = *link; - if (cmp(node, parent) < 0) - link = &parent->rb_left; - else - link = &parent->rb_right; - } - - rb_link_node(node, parent, link); - rb_insert_color(node, tree); -} - -static struct rb_node *rb_find_first(const struct rb_root *tree, const void *key, - int (*cmp)(const void *key, const struct rb_node *)) -{ - struct rb_node *node = tree->rb_node; - struct rb_node *match = NULL; - - while (node) { - int c = cmp(key, node); - if (c <= 0) { - if (!c) - match = node; - node = node->rb_left; - } else if (c > 0) { - node = node->rb_right; - } - } - - return match; -} - -static struct rb_node *rb_next_match(struct rb_node *node, const void *key, - int (*cmp)(const void *key, const struct rb_node *)) -{ - node = rb_next(node); - if (node && cmp(key, node)) - node = NULL; - return node; -} - -#define rb_for_each(tree, node, key, cmp) \ - for ((node) = rb_find_first((tree), (key), (cmp)); \ - (node); (node) = rb_next_match((node), (key), (cmp))) - -static int symbol_to_offset(struct rb_node *a, const struct rb_node *b) +static bool symbol_to_offset(struct rb_node *a, const struct rb_node *b) { struct symbol *sa = rb_entry(a, struct symbol, node); struct symbol *sb = rb_entry(b, struct symbol, node); if (sa->offset < sb->offset) - return -1; + return true; if (sa->offset > sb->offset) - return 1; + return false; if (sa->len < sb->len) - return -1; + return true; if (sa->len > sb->len) - return 1; + return false; sa->alias = sb; - return 0; + return false; } static int symbol_by_offset(const void *key, const struct rb_node *node) @@ -165,7 +114,7 @@ struct symbol *find_symbol_by_offset(struct section *sec, unsigned long offset) { struct rb_node *node; - rb_for_each(&sec->symbol_tree, node, &offset, symbol_by_offset) { + rb_for_each(node, &offset, &sec->symbol_tree, symbol_by_offset) { struct symbol *s = rb_entry(node, struct symbol, node); if (s->offset == offset && s->type != STT_SECTION) @@ -179,7 +128,7 @@ struct symbol *find_func_by_offset(struct section *sec, unsigned long offset) { struct rb_node *node; - rb_for_each(&sec->symbol_tree, node, &offset, symbol_by_offset) { + rb_for_each(node, &offset, &sec->symbol_tree, symbol_by_offset) { struct symbol *s = rb_entry(node, struct symbol, node); if (s->offset == offset && s->type == STT_FUNC) @@ -193,7 +142,7 @@ struct symbol *find_symbol_containing(const struct section *sec, unsigned long o { struct rb_node *node; - rb_for_each(&sec->symbol_tree, node, &offset, symbol_by_offset) { + rb_for_each(node, &offset, &sec->symbol_tree, symbol_by_offset) { struct symbol *s = rb_entry(node, struct symbol, node); if (s->type != STT_SECTION) @@ -207,7 +156,7 @@ struct symbol *find_func_containing(struct section *sec, unsigned long offset) { struct rb_node *node; - rb_for_each(&sec->symbol_tree, node, &offset, symbol_by_offset) { + rb_for_each(node, &offset, &sec->symbol_tree, symbol_by_offset) { struct symbol *s = rb_entry(node, struct symbol, node); if (s->type == STT_FUNC) @@ -352,7 +301,7 @@ static void elf_add_symbol(struct elf *elf, struct symbol *sym) sym->offset = sym->sym.st_value; sym->len = sym->sym.st_size; - rb_add(&sym->sec->symbol_tree, &sym->node, symbol_to_offset); + rb_add(&sym->node, &sym->sec->symbol_tree, symbol_to_offset); pnode = rb_prev(&sym->node); if (pnode) entry = &rb_entry(pnode, struct symbol, node)->list; -- 2.20.1

1 37

Kernel SIG 申报议题：开源之夏增加rust-for-linux driver支持
by lihongyu 29 Sep '22

29 Sep '22

议题：开源之夏 增加rust-for-linux driver支持简介：主要介绍一下rust-for-linux api支持和新增driver情况。

1 0

[PATCH openEuler-5.10 01/10] mm: Force TLB flush for PFNMAP mappings before unlink_file_vma()
by Zheng Zengkai 29 Sep '22

29 Sep '22

From: Jann Horn <jannh(a)google.com> stable inclusion from stable-v5.10.142 commit 895428ee124ad70b9763259308354877b725c31d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5PE9S CVE: CVE-2022-39188 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit b67fbebd4cf980aecbcc750e1462128bffe8ae15 upstream. Some drivers rely on having all VMAs through which a PFN might be accessible listed in the rmap for correctness. However, on X86, it was possible for a VMA with stale TLB entries to not be listed in the rmap. This was fixed in mainline with commit b67fbebd4cf9 ("mmu_gather: Force tlb-flush VM_PFNMAP vmas"), but that commit relies on preceding refactoring in commit 18ba064e42df3 ("mmu_gather: Let there be one tlb_{start,end}_vma() implementation") and commit 1e9fdf21a4339 ("mmu_gather: Remove per arch tlb_{start,end}_vma()"). This patch provides equivalent protection without needing that refactoring, by forcing a TLB flush between removing PTEs in unmap_vmas() and the call to unlink_file_vma() in free_pgtables(). [This is a stable-specific rewrite of the upstream commit!] Signed-off-by: Jann Horn <jannh(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ze zuo <zuoze1(a)huawei.com> Reviewed-by: Chen Wandun <chenwandun(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- mm/mmap.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/mm/mmap.c b/mm/mmap.c index 5489d70db84e..7fba5d89ecde 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -2962,6 +2962,18 @@ static void unmap_region(struct mm_struct *mm, tlb_gather_mmu(&tlb, mm, start, end); update_hiwater_rss(mm); unmap_vmas(&tlb, vma, start, end); + + /* + * Ensure we have no stale TLB entries by the time this mapping is + * removed from the rmap. + * Note that we don't have to worry about nested flushes here because + * we're holding the mm semaphore for removing the mapping - so any + * concurrent flush in this region has to be coming through the rmap, + * and we synchronize against that using the rmap lock. + */ + if ((vma->vm_flags & (VM_PFNMAP|VM_MIXEDMAP)) != 0) + tlb_flush_mmu(&tlb); + free_pgtables(&tlb, vma, prev ? prev->vm_end : FIRST_USER_ADDRESS, next ? next->vm_start : USER_PGTABLES_CEILING); tlb_finish_mmu(&tlb, start, end); -- 2.20.1

1 9

[PATCH openEuler-5.10 000/427] Backport 5.10.121 LTS
by Zheng Zengkai 29 Sep '22

29 Sep '22

Backport 5.10.121 LTS patches from upstream. git cherry-pick v5.10.120..v5.10.121~1 -s Already merged(-13): 94845fc422f9 inotify: show inotify mask flags in proc fdinfo 9a9dc60da79a fs-writeback: writeback_sb_inodes：Recalculate 'wrote' according skipped pages dd887f83ea54 ext4: fix use-after-free in ext4_rename_dir_prepare adf490083ca5 ext4: fix warning in ext4_handle_inode_extension 1b061af03764 ext4: fix bug_on in ext4_writepages 4fd58b5cf118 ext4: fix bug_on in __es_tree_search 46c2b5f81c9e bcache: improve multithreaded bch_btree_check() 3f686b249b1c bcache: improve multithreaded bch_sectors_dirty_init() 0cf22f234ebc bcache: remove incremental dirty sector counting for bch_sectors_dirty_init() 59afd4f28790 bcache: avoid journal no-space deadlock by reserving 1 journal bucket 893cf5f68a4c xfs: fix chown leaking delalloc quota blocks when fssetxattr fails e3ffe7387c70 xfs: force log and push AIL to clear pinned inodes when aborting mount 47c1680e51ef md: bcache: check the return value of kzalloc() in detached_dev_do_request() Rejected(-3): hinic driver drops related file in the patch: 33411945c9ad net: hinic: add missing destroy_workqueue in hinic_pf_to_mgmt_init dc7753d60097 net: huawei: hinic: Use devm_kcalloc() instead of devm_kzalloc() 8096e2d7c0f9 hinic: Avoid some over memory allocation Context conflict: 643ceee253a4 xfs: sync lazy sb accounting on quiesce of read-only mounts 80b0a2b3dfea bfq: Remove pointless bfq_init_rq() calls a67100f42665 ext4: only allow test_dummy_encryption when supported KABI changed(-2)： 147a376c1afe sched/fair: Fix cfs_rq_clock_pelt() for throttled cfs_rq 61bbbde9b6d2 drm: fix EDID struct for old ARM OABI format 7a55a5159dae scsi: fcoe: Fix Wstringop-overflow warnings in fcoe_wwn_from_mac() KABI fixed(+1): sched/fair: Fix kabi broken in struct cfs_rq Defered(-5): 9834b13e8b96 tty: fix deadlock caused by calling printk() under tty_port->lock 70a7dea84639 bfq: Track whether bfq_group is still online 0285718e2825 bfq: Get rid of __bio_blkcg() usage 51f724bffa34 bfq: Make sure bfqg for which we are queueing requests is online c26ccbaeb8d8 kexec_file: drop weak attribute from arch_kexec_apply_relocations[_add] Total patches: 449 - 13 - 3 - 2 + 1 - 5 = 427 Abhinav Kumar (1): drm/msm/dpu: handle pm_runtime_get_sync() errors in bind path Abhishek Kumar (1): ath10k: skip ath10k_halt during suspend for driver state RESTARTING Aditya Garg (1): efi: Do not import certificates from UEFI Secure Boot for T2 Macs Aidan MacDonald (1): mmc: jz4740: Apply DMA engine limits to maximum segment size Akira Yokosawa (1): docs/conf.py: Cope with removal of language=None in Sphinx 5.0.0 Albert Wang (1): usb: dwc3: gadget: Move null pinter check to proper place Alex Elder (2): net: ipa: fix page free in ipa_endpoint_trans_release() net: ipa: fix page free in ipa_endpoint_replenish_one() Alexander Aring (2): dlm: fix plock invalid read dlm: fix missing lkb refcount handling Alexander Wetzel (1): rtl818x: Prevent using not initialized queues Alexandre Ghiti (1): riscv: Initialize thread pointer before calling C functions Alexandru Elisei (1): arm64: compat: Do not treat syscall number as ESR_ELx for a bad syscall Alexey Dobriyan (1): proc: fix dentry/inode overinstantiating under /proc/${pid}/net Alexey Khoroshilov (1): ASoC: max98090: Move check for invalid values before casting in max98090_put_enab_tlv() Alice Wong (1): drm/amdgpu/ucode: Remove firmware load type check in amdgpu_ucode_free_bo Amadeusz Sławiński (1): ALSA: jack: Access input_dev under mutex Amelie Delaunay (3): dmaengine: stm32-mdma: remove GISR1 register dmaengine: stm32-mdma: rework interrupt handler dmaengine: stm32-mdma: fix chan initialization in stm32_mdma_irq_handler() Amir Goldstein (1): fsnotify: fix wrong lockdep annotations Ammar Faizi (2): x86/MCE/AMD: Fix memory leak when threshold_create_bank() fails x86/delay: Fix the wrong asm constraint in delay_loop() Andre Przywara (1): ARM: dts: suniv: F1C100: fix watchdog compatible Andreas Gruenbacher (1): iomap: iomap_write_failed fix Andrii Nakryiko (2): libbpf: Don't error out on CO-RE relos for overriden weak subprogs libbpf: Fix logic for finding matching program for CO-RE relocation Archie Pusaka (2): Bluetooth: use inclusive language in HCI role comments Bluetooth: use inclusive language when filtering devices Arnd Bergmann (2): drbd: fix duplicate array initializer ARM: pxa: maybe fix gpio lookup tables Baochen Qiang (1): ath11k: Don't check arvif->is_started before sending management frames Bart Van Assche (1): scsi: ufs: qcom: Fix ufs_qcom_resume() Bhaskar Chowdhury (1): Bluetooth: L2CAP: Rudimentary typo fixes Biju Das (1): spi: spi-rspi: Remove setting {src,dst}_{addr,addr_width} based on DMA direction Bjorn Andersson (1): soc: qcom: llcc: Add MODULE_DEVICE_TABLE() Bjorn Helgaas (1): PCI/PM: Fix bridge_d3_blacklist[] Elo i2 overwrite of Gigabyte X299 Björn Ardö (1): mailbox: forward the hrtimer if not queued and under a lock Bob Peterson (1): gfs2: use i_lock spin_lock for inode qadata Borislav Petkov (1): x86/microcode: Add explicit CPU vendor dependency Brian Foster (3): xfs: sync lazy sb accounting on quiesce of read-only mounts xfs: restore shutdown check in mapped write fault path xfs: consider shutdown in bmapbt cursor delete assert Brian Norris (2): PM / devfreq: rk3399_dmc: Disable edev on remove() drm/bridge: analogix_dp: Grab runtime PM reference for DP-AUX Cai Huoqing (1): media: staging: media: rkvdec: Make use of the helper function devm_platform_ioremap_resource() Carl Yin(殷张成) (1): USB: serial: option: add Quectel BG95 modem Chao Yu (7): f2fs: fix to avoid f2fs_bug_on() in dec_valid_node_count() f2fs: fix to do sanity check on block address in f2fs_do_zero_range() f2fs: fix to clear dirty inode in f2fs_evict_inode() f2fs: fix deadloop in foreground GC f2fs: fix to do sanity check on total_data_blocks f2fs: fix fallocate to use file_modified to update permissions consistently f2fs: fix to do sanity check for inline inode Charles Keepax (3): ASoC: tscs454: Add endianness flag in snd_soc_component_driver ASoC: atmel-pdmic: Remove endianness flag on pdmic component ASoC: atmel-classd: Remove endianness flag on class d component Chen-Tsung Hsieh (1): mtd: spi-nor: core: Check written SR value in spi_nor_write_16bit_sr_and_check() Chen-Yu Tsai (1): media: hantro: Empty encoder capture buffers by default Chengming Zhou (1): sched/fair: Fix cfs_rq_clock_pelt() for throttled cfs_rq Christoph Hellwig (2): target: remove an incorrect unmap zeroes data deduction virtio_blk: fix the discard_granularity and discard_alignment queue limits Christophe JAILLET (4): media: aspeed: Fix an error handling path in aspeed_video_probe() memory: samsung: exynos5422-dmc: Avoid some over memory allocation drivers/base/memory: fix an unlikely reference counting issue in __add_memory_block() dmaengine: idxd: Fix the error handling path in idxd_cdev_register() Christophe de Dinechin (1): nodemask.h: fix compilation error with GCC12 Chuanhong Guo (1): arm: mediatek: select arch timer for mt7629 Colin Ian King (2): ALSA: pcm: Check for null pointer of pointer substream before dereferencing it selftests/resctrl: Fix null pointer dereference on open failed Corentin Labbe (3): crypto: marvell/cesa - ECB does not IV crypto: sun8i-ss - rework handling of IV crypto: sun8i-ss - handle zero sized sg Corey Minyard (2): ipmi:ssif: Check for NULL msg when handling events and messages ipmi: Fix pr_fmt to avoid compilation issues Cristian Marussi (1): firmware: arm_scmi: Fix list protocols enumeration in the base protocol Dan Carpenter (5): ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix drm/msm: return an error pointer in msm_gem_prime_get_sg_table() PCI: cadence: Fix find_first_zero_bit() limit PCI: rockchip: Fix find_first_zero_bit() limit OPP: call of_node_put() on error path in _bandwidth_supported() Dan Williams (2): nvdimm: Fix firmware activation deadlock scenarios nvdimm: Allow overwrite in the presence of disabled dimms Daniel Lezcano (2): thermal/drivers/core: Use a char pointer for the cooling device name thermal/core: Fix memory leak in the error path Daniel Thompson (1): irqchip/exiu: Fix acknowledgment of edge triggered interrupts Daniel Vetter (1): fbcon: Consistently protect deferred_takeover with console_lock() Darrick J. Wong (1): xfs: fix incorrect root dquot corruption error when switching group/project quota types Dave Airlie (1): drm/amdgpu/cs: make commands with 0 chunks illegal behaviour. Dave Chinner (1): xfs: assert in xfs_btree_del_cursor should take into account error David Howells (7): rxrpc: Return an error to sendmsg if call failed rxrpc, afs: Fix selection of abort codes rxrpc: Fix listen() setting the bar too high for the prealloc rings rxrpc: Don't try to resend the request if we're receiving the reply rxrpc: Fix overlapping ACK accounting rxrpc: Don't let ack.previousPacket regress rxrpc: Fix decision on when to generate an IDLE ACK Dennis Dalessandro (1): RDMA/hfi1: Fix potential integer multiplication overflow errors Dimitri John Ledkov (1): cfg80211: declare MODULE_FIRMWARE for regulatory.db Dinh Nguyen (1): dt-bindings: gpio: altera: correct interrupt-cells Dmitry Baryshkov (2): drm/msm/dsi: fix error checks and return values for DSI xmit functions drm/msm: add missing include to msm_drv.c Dmitry Torokhov (1): Input: stmfts - do not leave device disabled in stmfts_input_open Dongliang Mu (3): HID: bigben: fix slab-out-of-bounds Write in bigben_probe rtlwifi: Use pr_warn instead of WARN_ONCE media: ov7670: remove ov7670_power_off from ov7670_remove Douglas Miller (2): RDMA/hfi1: Prevent panic when SDMA is disabled RDMA/hfi1: Prevent use of lock before it is initialized Duoming Zhou (1): NFC: hci: fix sleep in atomic context bugs in nfc_hci_hcp_message_tx Emmanuel Grumbach (1): iwlwifi: mvm: fix assert 1F04 upon reconfig Eric Biggers (2): ext4: reject the 'commit' option on ext2 filesystems ext4: only allow test_dummy_encryption when supported Eric Dumazet (2): net: remove two BUG() from skb_checksum_help() sctp: read sk->sk_bound_dev_if once in sctp_rcv() Eric W. Biederman (3): ptrace/um: Replace PT_DTRACE with TIF_SINGLESTEP ptrace/xtensa: Replace PT_SINGLESTEP with TIF_SINGLESTEP ptrace: Reimplement PTRACE_KILL by always sending SIGKILL Eugenio Pérez (1): vdpasim: allow to enable a vq repeatedly Evan Quan (1): drm/amd/pm: fix the compile warning Fabio Estevam (1): net: phy: micrel: Allow probing without .driver_data Felix Fietkau (1): mac80211: upgrade passive scan to active scan on DFS channels after beacon rx Finn Thain (1): macintosh/via-pmu: Fix build failure when CONFIG_INPUT is disabled Francesco Dolcini (1): PCI: imx6: Fix PERST# start-up sequence GUO Zihua (1): ima: remove the IMA_TEMPLATE Kconfig option Geert Uytterhoeven (2): m68k: atari: Make Atari ROM port I/O write macros return void m68k: math-emu: Fix dependencies of math emulation support Gilad Ben-Yossef (1): crypto: ccree - use fine grained DMA mapping dir Guenter Roeck (2): platform/chrome: Re-introduce cros_ec_cmd_xfer and use it for ioctls MIPS: Loongson: Use hwmon_device_register_with_groups() to register hwmon Guo Ren (1): csky: patch_text: Fixup last cpu should be master Gustavo A. R. Silva (1): net: stmmac: selftests: Use kcalloc() instead of kzalloc() Hangyu Hua (3): media: rga: fix possible memory leak in rga_probe drm: msm: fix possible memory leak in mdp5_crtc_cursor_set() misc: ocxl: fix possible double free in ocxl_file_register_afu Hans Verkuil (1): media: cec-adap.c: fix is_configuring state Hans de Goede (1): ASoC: Intel: bytcr_rt5640: Add quirk for the HP Pro Tablet 408 Haowen Bai (4): b43legacy: Fix assigning negative value to unsigned variable b43: Fix assigning negative value to unsigned variable ipw2x00: Fix potential NULL dereference in libipw_xmit() sfc: ef10: Fix assigning negative value to unsigned variable Haren Myneni (1): powerpc/powernv/vas: Assign real address to rx_fifo in vas_rx_win_attr Hari Bathini (2): powerpc/fadump: Fix fadump to work with a different endian capture kernel powerpc/fadump: fix PT_LOAD segment for boot memory area Hari Chandrakanthan (1): ath11k: disable spectral scan during spectral deinit Heiko Carstens (1): s390/preempt: disable __preempt_count_add() optimization for PROFILE_ALL_BRANCHES Helge Deller (2): parisc/stifb: Implement fb_is_primary_device() parisc/stifb: Keep track of hardware path of graphics card Heming Zhao (1): md/bitmap: don't set sb values if can't pass sanity check Howard Chung (1): Bluetooth: Interleave with allowlist scan Jaegeuk Kim (1): f2fs: don't need inode lock for system hidden quota Jagan Teki (1): drm/panel: panel-simple: Fix proper bpc for AM-1280800N3TZQW-T00H Jakob Koschel (1): f2fs: fix dereference of stale list iterator after loop body Jakub Kicinski (2): eth: tg3: silence the GCC 12 array-bounds warning net: stmmac: fix out-of-bounds access in a selftest James Clark (1): perf tools: Use Python devtools for version autodetection rather than runtime James Smart (1): scsi: lpfc: Fix resource leak in lpfc_sli4_send_seq_to_ulp() Jan Kara (8): bfq: Split shared queues on move between cgroups bfq: Update cgroup information before merging bio ext4: verify dir block before splitting it ext4: avoid cycles in directory h-tree bfq: Avoid merging queues with different parents bfq: Drop pointless unlock-lock pair bfq: Remove pointless bfq_init_rq() calls block: fix bio_clone_blkg_association() to associate with proper blkcg_gq Jan Kiszka (1): efi: Add missing prototype for efi_capsule_setup_info Jani Nikula (2): drm/edid: fix invalid EDID extension block filtering drm/i915/dsi: fix VBT send packet port selection for ICL+ Janusz Krzysztofik (1): ARM: OMAP1: clock: Fix UART rate reporting algorithm Jason A. Donenfeld (2): openrisc: start CPU timer early in boot Revert "random: use static branch for crng_ready()" Jeffrey Mitchell (1): xfs: set inode size after creating symlink Jessica Zhang (2): drm/msm/mdp5: Return error code in mdp5_pipe_release when deadlock is detected drm/msm/mdp5: Return error code in mdp5_mixer_release when deadlock is detected Jia-Wei Chang (1): cpufreq: mediatek: Use module_init and add module_exit Jiantao Zhang (1): PCI: dwc: Fix setting error return on MSI DMA mapping failure Jiasheng Jiang (1): drm: mali-dp: potential dereference of null pointer Jiri Slaby (1): serial: pch: don't overwrite xmit->buf[0] by x_char Joerg Roedel (1): iommu/amd: Increase timeout waiting for GA log enablement Johan Hovold (4): PCI: qcom: Fix runtime PM imbalance on probe errors PCI: qcom: Fix unbalanced PHY init on probe errors phy: qcom-qmp: fix struct clk leak on probe errors phy: qcom-qmp: fix reset-controller leak on probe errors Johannes Berg (3): nl80211: show SSID for P2P_GO interfaces wifi: mac80211: fix use-after-free in chanctx code um: chan_user: Fix winch_tramp() return value Jonas Karlman (1): media: rkvdec: h264: Fix bit depth wrap in pps packet Jonathan Bakker (1): ARM: dts: s5pv210: Remove spi-cs-high on panel in Aries Jonathan Teh (1): HID: hid-led: fix maximum brightness for Dream Cheeky Josh Poimboeuf (2): x86/speculation: Add missing prototype for unpriv_ebpf_notify() scripts/faddr2line: Fix overlapping text section failures Junxiao Bi via Ocfs2-devel (1): ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock Kajol Jain (1): powerpc/perf: Fix the threshold compare group constraint for power9 Kan Liang (1): perf/x86/intel: Fix event constraints for ICL Kathiravan T (1): arm64: dts: qcom: ipq8074: fix the sleep clock frequency Keita Suzuki (2): drm/amd/pm: fix double free in si_parse_power_table() tracing: Fix potential double free in create_var_ref() Keith Busch (1): nvme: set dma alignment to dword Kirill A. Shutemov (1): ACPICA: Avoid cache flush inside virtual machines Kishon Vijay Abraham I (1): usb: core: hcd: Add support for deferring roothub registration Kiwoong Kim (1): scsi: ufs: core: Exclude UECxx from SFR dump list Konrad Dybcio (2): arm64: dts: qcom: msm8994: Fix BLSP[12]_DMA channels count regulator: qcom_smd: Fix up PM8950 regulator configuration Krzysztof Kozlowski (6): ARM: dts: ox820: align interrupt controller node name with dtschema ARM: dts: s5pv210: align DMA channels with dtschema ARM: dts: exynos: add atmel,24c128 fallback to Samsung EEPROM irqchip/aspeed-i2c-ic: Fix irq_of_parse_and_map() return value irqchip/aspeed-scu-ic: Fix irq_of_parse_and_map() return value pinctrl: mvebu: Fix irq_of_parse_and_map() return value Kuldeep Singh (1): spi: qcom-qspi: Add minItems to interconnect-names Kuninori Morimoto (2): ASoC: samsung: Use dev_err_probe() helper i2c: rcar: fix PM ref counts in probe error paths Kuogee Hsieh (3): drm/msm/dpu: adjust display_v_end for eDP and DP drm/msm/dp: stop event kernel thread when DP unbind drm/msm/dp: fix event thread stuck in wait_event after kthread_stop() Kuppuswamy Sathyanarayanan (1): PCI/AER: Clear MULTI_ERR_COR/UNCOR_RCV bits Kwanghoon Son (1): media: exynos4-is: Fix compile warning Lai Jiangshan (1): x86/sev: Annotate stack change in the #VC handler Len Brown (1): tools/power turbostat: fix ICX DRAM power numbers Leo Yan (1): perf c2c: Use stdio interface if slang is not supported Lin Ma (2): ASoC: rt5645: Fix errorenous cleanup order NFC: NULL out the dev->rfkill to prevent UAF Liu Zixian (1): drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes Liviu Dudau (1): drm/komeda: return early if drm_universal_plane_init() fails. Luca Weiss (1): media: venus: hfi: avoid null dereference in deinit Lucas Stach (2): drm/bridge: adv7511: clean up CEC adapter when probe fails drm/etnaviv: check for reaped mapping in etnaviv_iommu_unmap_gem Lv Ruyi (7): scsi: megaraid: Fix error check return value of register_chrdev() drm: msm: fix error check return value of irq_of_parse_and_map() powerpc/xics: fix refcount leak in icp_opal_init() powerpc/powernv: fix missing of_node_put in uv_init() drm/msm/dp: fix error check return value of irq_of_parse_and_map() drm/msm/hdmi: fix error check return value of irq_of_parse_and_map() mfd: ipaq-micro: Fix error check return value of platform_get_irq() Maciej W. Rozycki (2): MIPS: IP27: Remove incorrect `cpu_has_fpu' override MIPS: IP30: Remove incorrect `cpu_has_fpu' override Manivannan Sadhasivam (1): scsi: ufs: qcom: Add a readl() to make sure ref_clk gets enabled Mao Jinlong (1): coresight: core: Fix coresight device probe failure issue Marc Kleine-Budde (1): can: xilinx_can: mark bit timing constants as const Marek Vasut (2): drm/panel: simple: Add missing bus flags for Innolux G070Y2-L01 ARM: dts: stm32: Fix PHY post-reset delay on Avenger96 Mario Limonciello (1): ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default Marios Levogiannis (1): ALSA: hda/realtek - Fix microphone noise on ASUS TUF B550M-PLUS Mark Bloch (1): net/mlx5: fs, delete the FTE when there are no rules attached to it Mark Brown (2): ASoC: dapm: Don't fold register value changes into notifications ASoC: rt5514: Fix event generation for "DSP Voice Wake Up" control Mathias Nyman (1): xhci: Allow host runtime PM as default for Intel Alder Lake N xHCI Matthieu Baerts (1): x86/pm: Fix false positive kmemleak report in msr_build_context() Max Filippov (1): irqchip: irq-xtensa-mx: fix initial IRQ affinity Max Krummenacher (1): ARM: dts: imx6dl-colibri: Fix I2C pinmuxing Maxime Ripard (3): drm/vc4: hvs: Reset muxes at probe time drm/vc4: txp: Don't set TXP_VSTART_AT_EOF drm/vc4: txp: Force alpha to be 0xff if it's disabled Miaohe Lin (1): drivers/base/node.c: fix compaction sysfs file leak Miaoqian Lin (20): ASoC: mediatek: Fix error handling in mt8173_max98090_dev_probe ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe spi: spi-ti-qspi: Fix return value handling of wait_for_completion_timeout HID: elan: Fix potential double free in elan_input_configured drm/bridge: Fix error handling in analogix_dp_probe ASoC: fsl: Fix refcount leak in imx_sgtl5000_probe ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt ASoC: samsung: Fix refcount leak in aries_audio_probe media: exynos4-is: Fix PM disable depth imbalance in fimc_is_probe media: st-delta: Fix PM disable depth imbalance in delta_probe media: exynos4-is: Change clk_disable to clk_disable_unprepare ASoC: ti: j721e-evm: Fix refcount leak in j721e_soc_probe_* drm/msm/a6xx: Fix refcount leak in a6xx_gpu_init thermal/drivers/imx_sc_thermal: Fix refcount leak in imx_sc_thermal_probe soc: qcom: smp2p: Fix missing of_node_put() in smp2p_parse_ipc soc: qcom: smsm: Fix missing of_node_put() in smsm_parse_ipc Input: sparcspkr - fix refcount leak in bbc_beep_probe powerpc/fsl_rio: Fix refcount leak in fsl_rio_setup video: fbdev: clcdfb: Fix refcount leak in clcdfb_of_vram_setup Michael Ellerman (1): powerpc/64: Only WARN if __pa()/__va() called with bad addresses Michael Rodin (1): media: vsp1: Fix offset calculation for plane cropping Michael Walle (1): i2c: at91: use dma safe buffers Mike Kravetz (1): hugetlb: fix huge_pmd_unshare address update Mike Travis (1): x86/platform/uv: Update TSC sync state for UV5 Mikulas Patocka (1): dma-debug: change allocation mode from GFP_NOWAIT to GFP_ATIOMIC Miles Chen (1): drm/mediatek: Fix mtk_cec_mask() Minghao Chi (1): scsi: ufs: Use pm_runtime_resume_and_get() instead of pm_runtime_get_sync() Monish Kumar R (1): USB: new quirk for Dell Gen 2 devices Muchun Song (1): dax: fix cache flush on PMD-mapped pages Nathan Chancellor (2): drm/i915: Fix CFI violation with show_dynamic_id() i2c: at91: Initialize dma_buf in at91_twi_xfer() Nico Boehr (1): s390/perf: obtain sie_block from the right address Nicolas Dufresne (3): media: rkvdec: h264: Fix dpb_valid implementation media: coda: Fix reported H264 profile media: coda: Add more H264 levels for CODA960 Nicolas Frattaroli (1): ASoC: rk3328: fix disabling mclk on pclk probe failure Niels Dossche (5): mwifiex: add mutex lock for call in mwifiex_dfs_chan_sw_work_queue ipv6: fix locking issues with loops over idev->addr_list IB/rdmavt: add missing locks in rvt_ruc_loopback ath11k: acquire ab->base_lock in unassign when finding the peer by addr Bluetooth: use hdev lock for accept_list and reject_list in conn req Niklas Cassel (1): binfmt_flat: do not stop relocating GOT entries prematurely on riscv Noralf Trønnes (1): dt-bindings: display: sitronix, st7735r: Fix backlight in example Nuno Sá (1): of: overlay: do not break notify on NOTIFY_{OK|STOP} OGAWA Hirofumi (1): fat: add ratelimit to fat*_ent_bread() Padmanabha Srinivasaiah (1): rcu-tasks: Fix race in schedule and flush work Pali Rohár (1): irqchip/armada-370-xp: Do not touch Performance Counter Overflow on A375, A38x, A39x Patrice Chotard (1): spi: stm32-qspi: Fix wait_cmd timeout in APM mode Paul Cercueil (1): drm/ingenic: Reset pixclock rate when parent clock rate changes Paul E. McKenney (2): rcu: Make TASKS_RUDE_RCU select IRQ_WORK scftorture: Fix distribution of short handler delays Paul Moore (1): lsm,selinux: pass flowi_common instead of flowi to the LSM hooks Pavel Skripkin (1): media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init Peilin Ye (1): Fonts: Make font size unsigned in font_desc Peng Wu (3): ARM: versatile: Add missing of_node_put in dcscb_init ARM: hisi: Add missing of_node_put after of_find_compatible_node powerpc/iommu: Add missing of_node_put in iommu_init_early_dart Petr Machata (2): mlxsw: spectrum_dcb: Do not warn about priority changes mlxsw: Treat LLDP packets as control Phil Auld (1): kselftest/cgroup: fix test_stress.sh to use OUTPUT dir Phil Elwell (3): ARM: dts: bcm2835-rpi-zero-w: Fix GPIO line name for Wifi/BT ARM: dts: bcm2837-rpi-cm3-io3: Fix GPIO line names for SMPS I2C ARM: dts: bcm2837-rpi-3-b-plus: Fix GPIO line name of power LED Philipp Zabel (1): media: coda: limit frame interval enumeration to supported encoder frame sizes Pierre-Louis Bossart (2): ASoC: max98357a: remove dependency on GPIOLIB ASoC: rt1015p: remove dependency on GPIOLIB Qinglang Miao (1): cpufreq: mediatek: add missing platform_driver_unregister() on error in mtk_cpufreq_driver_init QintaoShen (1): soc: ti: ti_sci_pm_domains: Check for null return of devm_kcalloc Qu Wenruo (2): btrfs: add "0x" prefix for unsupported optional features btrfs: repair super block num_devices automatically Randy Dunlap (6): x86: Fix return value of __setup handlers x86/mm: Cleanup the control_va_addr_alignment() __setup handler powerpc/8xx: export 'cpm_setbrg' for modules powerpc/idle: Fix return value of __setup() handler powerpc/4xx/cpm: Fix return value of __setup() handler macintosh: via-pmu and via-cuda need RTC_LIB Ravi Bangoria (2): perf/amd/ibs: Cascade pmu init functions' return value perf/amd/ibs: Use interrupt regs ip for stack unwinding Rei Yamamoto (1): mm, compaction: fast_find_migrateblock() should return pfn in the target zone Rex-BC Chen (1): cpufreq: mediatek: Unregister platform device on exit Rik van der Kemp (1): ALSA: hda/realtek: Enable 4-speaker output for Dell XPS 15 9520 laptop Ronnie Sahlberg (1): cifs: when extending a file with falloc we should make files not-sparse Russell King (Oracle) (1): net: dsa: mt7530: 1G can also support 1000BASE-X link mode Sakari Ailus (1): ACPI: property: Release subnode properties with data nodes Samuel Holland (1): riscv: Fix irq_work when SMP is disabled Sathish Narasimman (1): Bluetooth: LL privacy allow RPA Schspa Shi (1): cpufreq: Fix possible race in cpufreq online error path Sean Christopherson (3): KVM: nVMX: Leave most VM-Exit info fields unmodified on failed VM-Entry KVM: nVMX: Clear IDT vectoring on nested VM-Exit for double/triple fault Kconfig: Add option for asm goto w/ tied outputs to workaround clang-13 bug Sebastian Andrzej Siewior (1): crypto: cryptd - Protect per-CPU resource by disabling BH. Shawn Lin (1): arm64: dts: rockchip: Move drive-impedance-ohm to emmc phy on rk3399 Smith, Kyle Miller (Nimble Kernel) (1): nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags Song Liu (1): ftrace: Clean up hash direct_functions on register failures Stefan Wahren (4): thermal/drivers/bcm2711: Don't clamp temperature at zero ARM: dts: bcm2835-rpi-b: Fix GPIO line names gpiolib: of: Introduce hook for missing gpio-ranges pinctrl: bcm2835: implement hook for missing gpio-ranges Steve French (1): SMB3: EBADF/EIO errors in rename/open caused by race condition in smb2_compound_op Steven Price (1): drm/plane: Move range check for format_count earlier Takashi Iwai (1): ALSA: usb-audio: Cancel pending work at closing a MIDI substream Tali Perry (2): i2c: npcm: Fix timeout calculation i2c: npcm: Handle spurious interrupts Tejas Upadhyay (1): iommu/vt-d: Add RPLS to quirk list to skip TE disabling Tejun Heo (1): blk-iolatency: Fix inflight count imbalances and IO hangs on offline Tetsuo Handa (1): media: imon: reorganize serialization Theodore Ts'o (1): ext4: filter out EXT4_FC_REPLAY from on-disk superblock field s_state Thibaut VARÈNE (1): ath9k: fix QCA9561 PA bias level Thorsten Scherer (1): ARM: dts: ci4x10: Adapt to changes in imx6qdl.dtsi regarding fec clocks Tokunori Ikegami (2): mtd: cfi_cmdset_0002: Move and rename chip_check/chip_ready/chip_good_for_write mtd: cfi_cmdset_0002: Use chip_ready() for write on S29GL064N Tong Tiangen (1): arm64: fix types in copy_highpage() Trond Myklebust (5): NFS: Do not report EINTR/ERESTARTSYS as mapping errors NFS: fsync() should report filesystem errors over EINTR/ERESTARTSYS NFS: Do not report flush errors in nfs_write_end() NFS: Don't report errors from nfs_pageio_complete() more than once NFSv4/pNFS: Do not fail I/O when we fail to allocate the pNFS layout Tyler Hicks (1): EDAC/dmc520: Don't print an error for each unconfigured interrupt line Tyrone Ting (1): i2c: npcm: Correct register access width Tzung-Bi Shih (1): platform/chrome: cros_ec: fix error handling in cros_ec_register() Vasily Averin (1): tracing: incorrect isolate_mote_t cast in mm_vmscan_lru_isolate Vignesh Raghavendra (1): drivers: mmc: sdhci_am654: Add the quirk to set TESTCD bit Vincent Mailhol (1): can: mcp251xfd: silence clang's -Wunaligned-access warning Vincent Whitchurch (1): um: Fix out-of-bounds read in LDT setup Vinod Polimera (1): drm/msm/disp/dpu1: set vbif hw config to NULL to avoid use after memory free during pm runtime resume Viresh Kumar (1): Revert "cpufreq: Fix possible race in cpufreq online error path" Waiman Long (2): ipc/mqueue: use get_tree_nodev() in mqueue_get_tree() kseltest/cgroup: Make test_stress.sh work if run interactively Wenli Looi (1): ath9k: fix ar9003_get_eepmisc Xiao Yang (1): RDMA/rxe: Generate a completion for unsupported/invalid opcode Xiaomeng Tong (11): media: uvcvideo: Fix missing check to determine if element is found in list scsi: dc395x: Fix a missing check on list iterator drm/nouveau/clk: Fix an incorrect NULL check on list iterator drm/nouveau/kms/nv50-: atom: fix an incorrect NULL check on list iterator md: fix an incorrect NULL check in does_sb_need_changing md: fix an incorrect NULL check in md_reload_sb iommu/msm: Fix an incorrect NULL check on list iterator carl9170: tx: fix an incorrect use of list iterator stm: ltdc: fix two incorrect NULL checks on list iterator tilcdc: tilcdc_external: fix an incorrect NULL check on list iterator gma500: fix an incorrect NULL check on list iterator Xie Yongji (1): nbd: Fix hung on disconnect request if socket is closed before Yang Jihong (1): perf tools: Add missing headers needed by util/data.h Yang Yingliang (10): pinctrl: renesas: rzn1: Fix possible null-ptr-deref in sh_pfc_map_resources() mtd: rawnand: cadence: fix possible null-ptr-deref in cadence_nand_dt_probe() drm/msm/hdmi: check return value after calling platform_get_resource_byname() drm/rockchip: vop: fix possible null-ptr-deref in vop_bind() spi: spi-fsl-qspi: check return value after calling platform_get_resource_byname() thermal/core: Fix memory leak in __thermal_cooling_device_register() ASoC: wm2000: fix missing clk_disable_unprepare() on error in wm2000_anc_transition() pinctrl: renesas: core: Fix possible null-ptr-deref in sh_pfc_map_resources() hwrng: omap3-rom - fix using wrong clk_disable() in omap_rom_rng_runtime_resume() mfd: davinci_voicecodec: Fix possible null-ptr-deref davinci_vc_probe() Yi Yang (1): xtensa/simdisk: fix proc_read_simdisk() Yicong Yang (1): PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store() Ying Hsu (1): Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout Yong Wu (1): iommu/mediatek: Add list_del in mtk_iommu_remove Yonghong Song (1): selftests/bpf: fix btf_dump/btf_dump due to recent clang change Yongzhi Liu (1): hv_netvsc: Fix potential dereference of NULL pointer Yuntao Wang (1): bpf: Fix excessive memory allocation in stack_map_alloc() Zev Weiss (1): regulator: core: Fix enable_count imbalance with EXCLUSIVE_GET Zheng Yongjun (2): spi: img-spfi: Fix pm_runtime_get_sync() error checking thermal/drivers/broadcom: Fix potential NULL dereference in sr_thermal_probe Zheng Zengkai (1): sched/fair: Fix kabi broken in struct cfs_rq Zhengjun Xing (1): perf jevents: Fix event syntax error caused by ExtSel Zheyu Ma (3): media: pci: cx23885: Fix the error handling in cx23885_initdev() media: cx25821: Fix the warning when removing the module mtd: rawnand: denali: Use managed device resources Zhou Qingyang (1): drm/komeda: Fix an undefined behavior bug in komeda_plane_add() Zixuan Fu (1): fs: jfs: fix possible NULL pointer dereference in dbFree() Ziyang Xuan (1): thermal/core: fix a UAF bug in __thermal_cooling_device_register() jianghaoran (1): ipv6: Don't send rs packets to the interface of ARPHRD_TUNNEL liuyacan (1): net/smc: postpone sk_refcnt increment in connect() Documentation/conf.py | 2 +- .../bindings/display/sitronix,st7735r.yaml | 1 + .../devicetree/bindings/gpio/gpio-altera.txt | 5 +- .../bindings/spi/qcom,spi-qcom-qspi.yaml | 1 + arch/arm/boot/dts/bcm2835-rpi-b.dts | 13 +- arch/arm/boot/dts/bcm2835-rpi-zero-w.dts | 22 +- arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts | 2 +- arch/arm/boot/dts/bcm2837-rpi-cm3-io3.dts | 4 +- arch/arm/boot/dts/exynos5250-smdk5250.dts | 4 +- arch/arm/boot/dts/imx6dl-eckelmann-ci4x10.dts | 6 +- arch/arm/boot/dts/imx6qdl-colibri.dtsi | 6 +- arch/arm/boot/dts/ox820.dtsi | 2 +- arch/arm/boot/dts/s5pv210-aries.dtsi | 3 +- arch/arm/boot/dts/s5pv210.dtsi | 12 +- .../boot/dts/stm32mp15xx-dhcor-avenger96.dtsi | 1 + arch/arm/boot/dts/suniv-f1c100s.dtsi | 4 +- arch/arm/mach-hisi/platsmp.c | 4 + arch/arm/mach-mediatek/Kconfig | 1 + arch/arm/mach-omap1/clock.c | 2 +- arch/arm/mach-pxa/cm-x300.c | 8 +- arch/arm/mach-pxa/magician.c | 2 +- arch/arm/mach-pxa/tosa.c | 4 +- arch/arm/mach-vexpress/dcscb.c | 1 + arch/arm64/Kconfig.platforms | 1 + arch/arm64/boot/dts/qcom/ipq8074.dtsi | 2 +- arch/arm64/boot/dts/qcom/msm8994.dtsi | 4 +- arch/arm64/boot/dts/rockchip/rk3399.dtsi | 2 +- arch/arm64/kernel/sys_compat.c | 2 +- arch/arm64/mm/copypage.c | 4 +- arch/csky/kernel/probes/kprobes.c | 2 +- arch/m68k/Kconfig.cpu | 2 +- arch/m68k/include/asm/raw_io.h | 6 +- .../asm/mach-ip27/cpu-feature-overrides.h | 1 - .../asm/mach-ip30/cpu-feature-overrides.h | 1 - arch/openrisc/include/asm/timex.h | 1 + arch/openrisc/kernel/head.S | 9 + arch/parisc/include/asm/fb.h | 4 + arch/powerpc/include/asm/page.h | 7 +- arch/powerpc/include/asm/vas.h | 2 +- arch/powerpc/kernel/fadump.c | 8 +- arch/powerpc/kernel/idle.c | 2 +- arch/powerpc/perf/isa207-common.c | 3 +- arch/powerpc/platforms/4xx/cpm.c | 2 +- arch/powerpc/platforms/8xx/cpm1.c | 1 + arch/powerpc/platforms/powernv/opal-fadump.c | 94 ++++---- arch/powerpc/platforms/powernv/opal-fadump.h | 10 +- arch/powerpc/platforms/powernv/ultravisor.c | 1 + arch/powerpc/platforms/powernv/vas-fault.c | 2 +- arch/powerpc/platforms/powernv/vas-window.c | 4 +- arch/powerpc/platforms/powernv/vas.h | 2 +- arch/powerpc/sysdev/dart_iommu.c | 6 +- arch/powerpc/sysdev/fsl_rio.c | 2 + arch/powerpc/sysdev/xics/icp-opal.c | 1 + arch/riscv/include/asm/irq_work.h | 2 +- arch/riscv/kernel/head.S | 1 + arch/s390/include/asm/preempt.h | 15 +- arch/s390/kernel/perf_event.c | 2 +- arch/um/drivers/chan_user.c | 9 +- arch/um/include/asm/thread_info.h | 2 + arch/um/kernel/exec.c | 2 +- arch/um/kernel/process.c | 2 +- arch/um/kernel/ptrace.c | 8 +- arch/um/kernel/signal.c | 4 +- arch/x86/Kconfig | 4 +- arch/x86/entry/entry_64.S | 1 + arch/x86/entry/vdso/vma.c | 2 +- arch/x86/events/amd/ibs.c | 55 ++++- arch/x86/events/intel/core.c | 2 +- arch/x86/include/asm/acenv.h | 14 +- arch/x86/include/asm/suspend_32.h | 2 +- arch/x86/include/asm/suspend_64.h | 12 +- arch/x86/kernel/apic/apic.c | 2 +- arch/x86/kernel/apic/x2apic_uv_x.c | 8 +- arch/x86/kernel/cpu/intel.c | 2 +- arch/x86/kernel/cpu/mce/amd.c | 32 +-- arch/x86/kernel/step.c | 3 +- arch/x86/kernel/sys_x86_64.c | 7 +- arch/x86/kvm/vmx/nested.c | 45 +++- arch/x86/kvm/vmx/vmcs.h | 5 + arch/x86/lib/delay.c | 4 +- arch/x86/mm/pat/memtype.c | 2 +- arch/x86/um/ldt.c | 6 +- arch/xtensa/kernel/ptrace.c | 4 +- arch/xtensa/kernel/signal.c | 4 +- arch/xtensa/platforms/iss/simdisk.c | 18 +- block/bfq-cgroup.c | 36 ++- block/bfq-iosched.c | 36 ++- block/bfq-iosched.h | 1 + block/blk-cgroup.c | 8 +- block/blk-iolatency.c | 122 +++++----- crypto/cryptd.c | 23 +- drivers/acpi/property.c | 18 +- drivers/acpi/sleep.c | 12 + drivers/base/memory.c | 5 +- drivers/base/node.c | 1 + drivers/block/drbd/drbd_main.c | 11 +- drivers/block/nbd.c | 13 +- drivers/block/virtio_blk.c | 7 +- drivers/char/hw_random/omap3-rom-rng.c | 2 +- drivers/char/ipmi/ipmi_msghandler.c | 4 +- drivers/char/ipmi/ipmi_ssif.c | 23 ++ drivers/char/random.c | 12 +- drivers/cpufreq/mediatek-cpufreq.c | 19 +- .../allwinner/sun8i-ss/sun8i-ss-cipher.c | 115 ++++++--- .../crypto/allwinner/sun8i-ss/sun8i-ss-core.c | 30 ++- .../crypto/allwinner/sun8i-ss/sun8i-ss-hash.c | 10 +- drivers/crypto/allwinner/sun8i-ss/sun8i-ss.h | 14 +- drivers/crypto/ccree/cc_buffer_mgr.c | 27 ++- drivers/crypto/marvell/cesa/cipher.c | 1 - drivers/crypto/nx/nx-common-powernv.c | 2 +- drivers/devfreq/rk3399_dmc.c | 2 + drivers/dma/idxd/cdev.c | 8 +- drivers/dma/stm32-mdma.c | 87 ++++--- drivers/edac/dmc520_edac.c | 2 +- drivers/firmware/arm_scmi/base.c | 2 +- drivers/gpio/gpiolib-of.c | 5 + drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c | 3 +- drivers/gpu/drm/amd/pm/powerplay/kv_dpm.c | 14 +- drivers/gpu/drm/amd/pm/powerplay/si_dpm.c | 8 +- .../gpu/drm/arm/display/komeda/komeda_plane.c | 10 +- drivers/gpu/drm/arm/malidp_crtc.c | 5 +- drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 1 + .../drm/bridge/analogix/analogix_dp_core.c | 31 ++- drivers/gpu/drm/drm_edid.c | 6 +- drivers/gpu/drm/drm_plane.c | 14 +- drivers/gpu/drm/etnaviv/etnaviv_mmu.c | 6 + drivers/gpu/drm/gma500/psb_intel_display.c | 7 +- drivers/gpu/drm/i915/display/intel_dsi_vbt.c | 33 ++- drivers/gpu/drm/i915/i915_perf.c | 4 +- drivers/gpu/drm/i915/i915_perf_types.h | 2 +- drivers/gpu/drm/ingenic/ingenic-drm-drv.c | 61 ++++- drivers/gpu/drm/mediatek/mtk_cec.c | 2 +- drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 1 + drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c | 1 + drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 8 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c | 14 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_kms.c | 6 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.c | 15 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.h | 4 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c | 15 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h | 2 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c | 20 +- drivers/gpu/drm/msm/dp/dp_display.c | 55 +++-- drivers/gpu/drm/msm/dsi/dsi_host.c | 21 +- drivers/gpu/drm/msm/hdmi/hdmi.c | 10 +- drivers/gpu/drm/msm/msm_drv.c | 1 + drivers/gpu/drm/msm/msm_gem_prime.c | 2 +- drivers/gpu/drm/nouveau/dispnv50/atom.h | 6 +- drivers/gpu/drm/nouveau/dispnv50/crc.c | 27 ++- .../gpu/drm/nouveau/nvkm/subdev/clk/base.c | 6 +- drivers/gpu/drm/panel/panel-simple.c | 3 +- drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 2 +- drivers/gpu/drm/stm/ltdc.c | 16 +- drivers/gpu/drm/tilcdc/tilcdc_external.c | 8 +- drivers/gpu/drm/vc4/vc4_hvs.c | 26 ++- drivers/gpu/drm/vc4/vc4_txp.c | 8 +- drivers/gpu/drm/virtio/virtgpu_display.c | 2 + drivers/hid/hid-bigbenff.c | 6 + drivers/hid/hid-elan.c | 2 - drivers/hid/hid-led.c | 2 +- drivers/hwtracing/coresight/coresight-core.c | 33 ++- drivers/i2c/busses/i2c-at91-master.c | 11 + drivers/i2c/busses/i2c-npcm7xx.c | 103 +++++--- drivers/i2c/busses/i2c-rcar.c | 15 +- drivers/infiniband/hw/hfi1/file_ops.c | 2 + drivers/infiniband/hw/hfi1/init.c | 2 +- drivers/infiniband/hw/hfi1/sdma.c | 12 +- drivers/infiniband/sw/rdmavt/qp.c | 6 +- drivers/infiniband/sw/rxe/rxe_req.c | 2 +- drivers/input/misc/sparcspkr.c | 1 + drivers/input/touchscreen/stmfts.c | 16 +- drivers/iommu/amd/init.c | 2 +- drivers/iommu/intel/iommu.c | 2 +- drivers/iommu/msm_iommu.c | 11 +- drivers/iommu/mtk_iommu.c | 3 +- drivers/irqchip/irq-armada-370-xp.c | 11 +- drivers/irqchip/irq-aspeed-i2c-ic.c | 4 +- drivers/irqchip/irq-aspeed-scu-ic.c | 4 +- drivers/irqchip/irq-sni-exiu.c | 25 +- drivers/irqchip/irq-xtensa-mx.c | 18 +- drivers/macintosh/Kconfig | 6 + drivers/macintosh/Makefile | 3 +- drivers/macintosh/via-pmu.c | 2 +- drivers/mailbox/mailbox.c | 19 +- drivers/md/md-bitmap.c | 44 ++-- drivers/md/md.c | 18 +- drivers/media/cec/core/cec-adap.c | 6 +- drivers/media/i2c/ov7670.c | 1 - drivers/media/pci/cx23885/cx23885-core.c | 6 +- drivers/media/pci/cx25821/cx25821-core.c | 2 +- drivers/media/platform/aspeed-video.c | 4 +- drivers/media/platform/coda/coda-common.c | 35 ++- drivers/media/platform/exynos4-is/fimc-is.c | 6 +- .../platform/exynos4-is/fimc-isp-video.h | 2 +- drivers/media/platform/qcom/venus/hfi.c | 3 + drivers/media/platform/rockchip/rga/rga.c | 6 +- drivers/media/platform/sti/delta/delta-v4l2.c | 6 +- drivers/media/platform/vsp1/vsp1_rpf.c | 6 +- drivers/media/rc/imon.c | 99 ++++---- drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 7 +- drivers/media/usb/uvc/uvc_v4l2.c | 20 +- drivers/memory/samsung/exynos5422-dmc.c | 5 +- drivers/mfd/davinci_voicecodec.c | 6 +- drivers/mfd/ipaq-micro.c | 2 +- drivers/misc/ocxl/file.c | 2 + drivers/mmc/host/jz4740_mmc.c | 20 ++ drivers/mmc/host/sdhci_am654.c | 23 +- drivers/mtd/chips/cfi_cmdset_0002.c | 103 ++++---- .../mtd/nand/raw/cadence-nand-controller.c | 5 +- drivers/mtd/nand/raw/denali_pci.c | 15 +- drivers/mtd/spi-nor/core.c | 9 + drivers/net/can/spi/mcp251xfd/mcp251xfd.h | 2 +- drivers/net/can/xilinx_can.c | 4 +- drivers/net/dsa/mt7530.c | 14 +- drivers/net/ethernet/broadcom/Makefile | 5 + .../chelsio/inline_crypto/chtls/chtls_cm.c | 2 +- .../net/ethernet/mellanox/mlx5/core/fs_core.c | 10 +- .../ethernet/mellanox/mlxsw/core_thermal.c | 2 +- .../ethernet/mellanox/mlxsw/spectrum_dcb.c | 13 -- .../ethernet/mellanox/mlxsw/spectrum_trap.c | 2 +- drivers/net/ethernet/sfc/ef10.c | 2 +- .../stmicro/stmmac/stmmac_selftests.c | 15 +- drivers/net/hyperv/netvsc_drv.c | 5 +- drivers/net/ipa/ipa_endpoint.c | 4 +- drivers/net/phy/micrel.c | 11 +- drivers/net/wireguard/socket.c | 4 +- drivers/net/wireless/ath/ath10k/mac.c | 20 +- drivers/net/wireless/ath/ath11k/mac.c | 16 +- drivers/net/wireless/ath/ath11k/spectral.c | 17 +- .../net/wireless/ath/ath9k/ar9003_eeprom.c | 2 +- drivers/net/wireless/ath/ath9k/ar9003_phy.h | 2 +- drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 8 + drivers/net/wireless/ath/carl9170/tx.c | 3 + drivers/net/wireless/broadcom/b43/phy_n.c | 2 +- drivers/net/wireless/broadcom/b43legacy/phy.c | 2 +- .../net/wireless/intel/ipw2x00/libipw_tx.c | 2 +- .../net/wireless/intel/iwlwifi/mvm/power.c | 3 + drivers/net/wireless/marvell/mwifiex/11h.c | 2 + .../wireless/realtek/rtl818x/rtl8180/dev.c | 8 +- drivers/net/wireless/realtek/rtlwifi/usb.c | 2 +- drivers/nfc/st21nfca/se.c | 17 +- drivers/nfc/st21nfca/st21nfca.h | 1 + drivers/nvdimm/core.c | 9 - drivers/nvdimm/security.c | 5 - drivers/nvme/host/core.c | 2 +- drivers/nvme/host/pci.c | 1 + drivers/of/overlay.c | 4 +- drivers/opp/of.c | 2 +- .../pci/controller/cadence/pcie-cadence-ep.c | 3 +- drivers/pci/controller/dwc/pci-imx6.c | 23 +- .../pci/controller/dwc/pcie-designware-host.c | 3 +- drivers/pci/controller/dwc/pcie-qcom.c | 9 +- drivers/pci/controller/pcie-rockchip-ep.c | 3 +- drivers/pci/pci.c | 12 +- drivers/pci/pcie/aer.c | 7 +- drivers/phy/qualcomm/phy-qcom-qmp.c | 11 +- drivers/pinctrl/bcm/pinctrl-bcm2835.c | 18 ++ drivers/pinctrl/mvebu/pinctrl-armada-37xx.c | 2 +- drivers/pinctrl/renesas/core.c | 7 +- drivers/pinctrl/renesas/pinctrl-rzn1.c | 10 +- drivers/platform/chrome/cros_ec.c | 16 +- drivers/platform/chrome/cros_ec_chardev.c | 2 +- drivers/platform/chrome/cros_ec_proto.c | 50 +++- drivers/platform/mips/cpu_hwmon.c | 127 ++++------ drivers/regulator/core.c | 7 +- drivers/regulator/pfuze100-regulator.c | 2 + drivers/regulator/qcom_smd-regulator.c | 35 ++- drivers/scsi/dc395x.c | 15 +- drivers/scsi/lpfc/lpfc_sli.c | 6 +- drivers/scsi/megaraid.c | 2 +- drivers/scsi/ufs/ti-j721e-ufs.c | 6 +- drivers/scsi/ufs/ufs-qcom.c | 14 +- drivers/scsi/ufs/ufshcd.c | 7 +- drivers/soc/qcom/llcc-qcom.c | 1 + drivers/soc/qcom/smp2p.c | 1 + drivers/soc/qcom/smsm.c | 1 + drivers/soc/ti/ti_sci_pm_domains.c | 2 + drivers/spi/spi-fsl-qspi.c | 4 + drivers/spi/spi-img-spfi.c | 2 +- drivers/spi/spi-rspi.c | 15 +- drivers/spi/spi-stm32-qspi.c | 3 +- drivers/spi/spi-ti-qspi.c | 5 +- drivers/staging/media/hantro/hantro_v4l2.c | 8 +- drivers/staging/media/rkvdec/rkvdec-h264.c | 37 ++- drivers/staging/media/rkvdec/rkvdec.c | 4 +- drivers/target/target_core_device.c | 1 - drivers/thermal/broadcom/bcm2711_thermal.c | 5 +- drivers/thermal/broadcom/sr-thermal.c | 3 + drivers/thermal/imx_sc_thermal.c | 6 +- drivers/thermal/thermal_core.c | 42 ++-- drivers/tty/serial/pch_uart.c | 27 +-- drivers/usb/core/hcd.c | 29 ++- drivers/usb/core/quirks.c | 3 + drivers/usb/dwc3/gadget.c | 6 +- drivers/usb/host/xhci-pci.c | 2 + drivers/usb/serial/option.c | 2 + drivers/vdpa/vdpa_sim/vdpa_sim.c | 5 +- drivers/video/console/sticon.c | 5 +- drivers/video/console/sticore.c | 32 ++- drivers/video/fbdev/amba-clcd.c | 5 +- drivers/video/fbdev/core/fbcon.c | 5 +- drivers/video/fbdev/sticore.h | 3 + drivers/video/fbdev/stifb.c | 4 +- fs/afs/rxrpc.c | 8 +- fs/binfmt_flat.c | 27 ++- fs/btrfs/disk-io.c | 4 +- fs/btrfs/volumes.c | 8 +- fs/cifs/smb2inode.c | 2 - fs/cifs/smb2ops.c | 2 +- fs/dax.c | 3 +- fs/dlm/lock.c | 11 +- fs/dlm/plock.c | 12 +- fs/ext4/ext4.h | 6 - fs/ext4/namei.c | 54 +++-- fs/ext4/super.c | 24 +- fs/f2fs/f2fs.h | 19 +- fs/f2fs/file.c | 20 +- fs/f2fs/inline.c | 29 ++- fs/f2fs/inode.c | 19 +- fs/f2fs/segment.c | 42 ++-- fs/f2fs/segment.h | 33 ++- fs/f2fs/super.c | 6 +- fs/fat/fatent.c | 7 +- fs/gfs2/quota.c | 32 ++- fs/iomap/buffered-io.c | 3 +- fs/jfs/jfs_dmap.c | 3 +- fs/nfs/file.c | 16 +- fs/nfs/pnfs.c | 2 + fs/nfs/write.c | 11 +- fs/notify/mark.c | 6 +- fs/ocfs2/dlmfs/userdlm.c | 16 +- fs/proc/generic.c | 3 + fs/proc/proc_net.c | 3 + fs/xfs/libxfs/xfs_btree.c | 35 ++- fs/xfs/xfs_dquot.c | 39 +++- fs/xfs/xfs_iomap.c | 3 + fs/xfs/xfs_log.c | 28 ++- fs/xfs/xfs_log.h | 1 + fs/xfs/xfs_mount.c | 3 +- fs/xfs/xfs_symlink.c | 1 + include/linux/bpf.h | 2 + include/linux/efi.h | 2 + include/linux/font.h | 2 +- include/linux/gpio/driver.h | 12 + include/linux/lsm_hook_defs.h | 4 +- include/linux/lsm_hooks.h | 2 +- include/linux/mailbox_controller.h | 1 + include/linux/mtd/cfi.h | 1 + include/linux/nodemask.h | 13 +- include/linux/platform_data/cros_ec_proto.h | 3 + include/linux/ptrace.h | 7 - include/linux/security.h | 23 +- include/linux/thermal.h | 2 +- include/linux/usb/hcd.h | 2 + include/net/bluetooth/hci.h | 16 +- include/net/bluetooth/hci_core.h | 18 +- include/net/flow.h | 10 + include/net/if_inet6.h | 8 + include/net/route.h | 6 +- include/sound/jack.h | 1 + include/trace/events/rxrpc.h | 2 +- include/trace/events/vmscan.h | 4 +- init/Kconfig | 5 + ipc/mqueue.c | 14 ++ kernel/bpf/stackmap.c | 1 - kernel/dma/debug.c | 2 +- kernel/ptrace.c | 5 +- kernel/rcu/Kconfig | 1 + kernel/rcu/tasks.h | 3 + kernel/scftorture.c | 5 +- kernel/sched/fair.c | 8 +- kernel/sched/pelt.h | 4 +- kernel/sched/sched.h | 4 +- kernel/trace/ftrace.c | 5 +- kernel/trace/trace_events_hist.c | 3 + mm/compaction.c | 2 + mm/hugetlb.c | 9 +- net/bluetooth/hci_conn.c | 8 +- net/bluetooth/hci_core.c | 27 ++- net/bluetooth/hci_debugfs.c | 8 +- net/bluetooth/hci_event.c | 91 ++++---- net/bluetooth/hci_request.c | 221 ++++++++++++++---- net/bluetooth/hci_sock.c | 12 +- net/bluetooth/l2cap_core.c | 10 +- net/bluetooth/mgmt.c | 14 +- net/bluetooth/mgmt_config.c | 10 + net/bluetooth/sco.c | 21 +- net/bluetooth/smp.c | 6 +- net/core/dev.c | 8 +- net/dccp/ipv4.c | 2 +- net/dccp/ipv6.c | 6 +- net/ipv4/icmp.c | 4 +- net/ipv4/inet_connection_sock.c | 4 +- net/ipv4/ip_output.c | 2 +- net/ipv4/ping.c | 2 +- net/ipv4/raw.c | 2 +- net/ipv4/syncookies.c | 2 +- net/ipv4/udp.c | 2 +- net/ipv6/addrconf.c | 33 ++- net/ipv6/af_inet6.c | 2 +- net/ipv6/datagram.c | 2 +- net/ipv6/icmp.c | 6 +- net/ipv6/inet6_connection_sock.c | 4 +- net/ipv6/netfilter/nf_reject_ipv6.c | 2 +- net/ipv6/ping.c | 2 +- net/ipv6/raw.c | 2 +- net/ipv6/syncookies.c | 2 +- net/ipv6/tcp_ipv6.c | 4 +- net/ipv6/udp.c | 2 +- net/l2tp/l2tp_ip6.c | 2 +- net/mac80211/chan.c | 7 +- net/mac80211/ieee80211_i.h | 5 + net/mac80211/scan.c | 20 ++ net/netfilter/nf_synproxy_core.c | 2 +- net/nfc/core.c | 1 + net/rxrpc/ar-internal.h | 13 +- net/rxrpc/call_event.c | 7 +- net/rxrpc/conn_object.c | 2 +- net/rxrpc/input.c | 31 ++- net/rxrpc/output.c | 20 +- net/rxrpc/recvmsg.c | 8 +- net/rxrpc/sendmsg.c | 6 + net/rxrpc/sysctl.c | 4 +- net/sctp/input.c | 4 +- net/smc/af_smc.c | 2 +- net/wireless/nl80211.c | 1 + net/wireless/reg.c | 4 + net/xfrm/xfrm_state.c | 6 +- scripts/faddr2line | 150 +++++++----- security/integrity/ima/Kconfig | 14 +- .../platform_certs/keyring_handler.h | 8 + security/integrity/platform_certs/load_uefi.c | 33 +++ security/security.c | 17 +- security/selinux/hooks.c | 4 +- security/selinux/include/xfrm.h | 2 +- security/selinux/xfrm.c | 13 +- sound/core/jack.c | 34 ++- sound/core/pcm_memory.c | 3 +- sound/pci/hda/patch_realtek.c | 11 + sound/soc/atmel/atmel-classd.c | 1 - sound/soc/atmel/atmel-pdmic.c | 1 - sound/soc/codecs/Kconfig | 2 - sound/soc/codecs/max98090.c | 6 +- sound/soc/codecs/rk3328_codec.c | 2 +- sound/soc/codecs/rt5514.c | 2 +- sound/soc/codecs/rt5645.c | 7 +- sound/soc/codecs/tscs454.c | 12 +- sound/soc/codecs/wm2000.c | 6 +- sound/soc/fsl/imx-sgtl5000.c | 14 +- sound/soc/intel/boards/bytcr_rt5640.c | 12 + sound/soc/mediatek/mt2701/mt2701-wm8960.c | 9 +- sound/soc/mediatek/mt8173/mt8173-max98090.c | 5 +- sound/soc/mxs/mxs-saif.c | 1 + sound/soc/samsung/aries_wm8994.c | 17 +- sound/soc/samsung/arndale.c | 5 +- sound/soc/samsung/littlemill.c | 5 +- sound/soc/samsung/lowland.c | 5 +- sound/soc/samsung/odroid.c | 4 +- sound/soc/samsung/smdk_wm8994.c | 4 +- sound/soc/samsung/smdk_wm8994pcm.c | 4 +- sound/soc/samsung/snow.c | 9 +- sound/soc/samsung/speyside.c | 5 +- sound/soc/samsung/tm2_wm5110.c | 3 +- sound/soc/samsung/tobermory.c | 5 +- sound/soc/soc-dapm.c | 2 - sound/soc/ti/j721e-evm.c | 44 +++- sound/usb/midi.c | 3 + tools/lib/bpf/libbpf.c | 20 +- tools/perf/Makefile.config | 39 +++- tools/perf/builtin-c2c.c | 6 +- tools/perf/pmu-events/jevents.c | 2 +- tools/perf/util/data.h | 1 + tools/power/x86/turbostat/turbostat.c | 1 + .../bpf/progs/btf_dump_test_case_syntax.c | 2 +- tools/testing/selftests/cgroup/test_stress.sh | 2 +- tools/testing/selftests/resctrl/fill_buf.c | 4 +- 477 files changed, 3474 insertions(+), 1907 deletions(-) -- 2.20.1

1 427

[PATCH openEuler-1.0-LTS 1/3] mm: sharepool: delete redundant check in __sp_remap_get_pfn
by Yongqiang Liu 29 Sep '22

29 Sep '22

From: Guo Mengqi <guomengqi3(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5QETC CVE: NA -------------------------------- sp_make_share_k2u only supports vmalloc address now. Therefore, delete a backup handle case. Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- mm/share_pool.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/mm/share_pool.c b/mm/share_pool.c index bd021da5a930..d49c066d1229 100644 --- a/mm/share_pool.c +++ b/mm/share_pool.c @@ -2860,11 +2860,11 @@ static int is_vmap_hugepage(unsigned long addr) static unsigned long __sp_remap_get_pfn(unsigned long kva) { - unsigned long pfn; + unsigned long pfn = -EINVAL; + + /* sp_make_share_k2u only support vmalloc address */ if (is_vmalloc_addr((void *)kva)) pfn = vmalloc_to_pfn((void *)kva); - else - pfn = virt_to_pfn(kva); return pfn; } -- 2.25.1

1 2

openEuler Kernel SIG例会
by openEuler conference 29 Sep '22

29 Sep '22

您好！ Kernel SIG 邀请您参加 2022-09-30 14:00 召开的Zoom会议(自动录制) 会议主题：openEuler Kernel SIG例会会议内容： 1.openEuler-22.09内核版本总结； 2.openEuler-22.03-LTS-SP1开始内核需求收集；会议链接：https://us06web.zoom.us/j/83050040350?pwd=eXdPa28zb1orVmRvS0J4c2lPUnhpUT09 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the Zoom conference(auto recording) will be held at 2022-09-30 14:00, The subject of the conference is openEuler Kernel SIG例会, Summary: 1.openEuler-22.09内核版本总结； 2.openEuler-22.03-LTS-SP1开始内核需求收集； You can join the meeting at https://us06web.zoom.us/j/83050040350?pwd=eXdPa28zb1orVmRvS0J4c2lPUnhpUT09. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[PATCH openEuler-22.09] xfrm: Reinject transport-mode packets through workqueue
by Zheng Zengkai 29 Sep '22

29 Sep '22

From: Liu Jian <liujian56(a)huawei.com> maillist inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5K0NK CVE: NA Reference: https://patchwork.kernel.org/project/netdevbpf/patch/20220924080157.247678-… -------------------------------- The following warning is displayed when the tcp6-multi-diffip11 stress test case of the LTP test suite is tested: watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [ns-tcpserver:48198] CPU: 0 PID: 48198 Comm: ns-tcpserver Kdump: loaded Not tainted 6.0.0-rc6+ #39 Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : des3_ede_encrypt+0x27c/0x460 [libdes] lr : 0x3f sp : ffff80000ceaa1b0 x29: ffff80000ceaa1b0 x28: ffff0000df056100 x27: ffff0000e51e5280 x26: ffff80004df75030 x25: ffff0000e51e4600 x24: 000000000000003b x23: 0000000000802080 x22: 000000000000003d x21: 0000000000000038 x20: 0000000080000020 x19: 000000000000000a x18: 0000000000000033 x17: ffff0000e51e4780 x16: ffff80004e2d1448 x15: ffff80004e2d1248 x14: ffff0000e51e4680 x13: ffff80004e2d1348 x12: ffff80004e2d1548 x11: ffff80004e2d1848 x10: ffff80004e2d1648 x9 : ffff80004e2d1748 x8 : ffff80004e2d1948 x7 : 000000000bcaf83d x6 : 000000000000001b x5 : ffff80004e2d1048 x4 : 00000000761bf3bf x3 : 000000007f1dd0a3 x2 : ffff0000e51e4780 x1 : ffff0000e3b9a2f8 x0 : 00000000db44e872 Call trace: des3_ede_encrypt+0x27c/0x460 [libdes] crypto_des3_ede_encrypt+0x1c/0x30 [des_generic] crypto_cbc_encrypt+0x148/0x190 crypto_skcipher_encrypt+0x2c/0x40 crypto_authenc_encrypt+0xc8/0xfc [authenc] crypto_aead_encrypt+0x2c/0x40 echainiv_encrypt+0x144/0x1a0 [echainiv] crypto_aead_encrypt+0x2c/0x40 esp6_output_tail+0x1c8/0x5d0 [esp6] esp6_output+0x120/0x278 [esp6] xfrm_output_one+0x458/0x4ec xfrm_output_resume+0x6c/0x1f0 xfrm_output+0xac/0x4ac __xfrm6_output+0x130/0x270 xfrm6_output+0x60/0xec ip6_xmit+0x2ec/0x5bc inet6_csk_xmit+0xbc/0x10c __tcp_transmit_skb+0x460/0x8c0 tcp_write_xmit+0x348/0x890 __tcp_push_pending_frames+0x44/0x110 tcp_rcv_established+0x3c8/0x720 tcp_v6_do_rcv+0xdc/0x4a0 tcp_v6_rcv+0xc24/0xcb0 ip6_protocol_deliver_rcu+0xf0/0x574 ip6_input_finish+0x48/0x7c ip6_input+0x48/0xc0 ip6_rcv_finish+0x80/0x9c xfrm_trans_reinject+0xb0/0xf4 tasklet_action_common.constprop.0+0xf8/0x134 tasklet_action+0x30/0x3c __do_softirq+0x128/0x368 do_softirq+0xb4/0xc0 __local_bh_enable_ip+0xb0/0xb4 put_cpu_fpsimd_context+0x40/0x70 kernel_neon_end+0x20/0x40 sha1_base_do_update.constprop.0.isra.0+0x11c/0x140 [sha1_ce] sha1_ce_finup+0x94/0x110 [sha1_ce] crypto_shash_finup+0x34/0xc0 hmac_finup+0x48/0xe0 crypto_shash_finup+0x34/0xc0 shash_digest_unaligned+0x74/0x90 crypto_shash_digest+0x4c/0x9c shash_ahash_digest+0xc8/0xf0 shash_async_digest+0x28/0x34 crypto_ahash_digest+0x48/0xcc crypto_authenc_genicv+0x88/0xcc [authenc] crypto_authenc_encrypt+0xd8/0xfc [authenc] crypto_aead_encrypt+0x2c/0x40 echainiv_encrypt+0x144/0x1a0 [echainiv] crypto_aead_encrypt+0x2c/0x40 esp6_output_tail+0x1c8/0x5d0 [esp6] esp6_output+0x120/0x278 [esp6] xfrm_output_one+0x458/0x4ec xfrm_output_resume+0x6c/0x1f0 xfrm_output+0xac/0x4ac __xfrm6_output+0x130/0x270 xfrm6_output+0x60/0xec ip6_xmit+0x2ec/0x5bc inet6_csk_xmit+0xbc/0x10c __tcp_transmit_skb+0x460/0x8c0 tcp_write_xmit+0x348/0x890 __tcp_push_pending_frames+0x44/0x110 tcp_push+0xb4/0x14c tcp_sendmsg_locked+0x71c/0xb64 tcp_sendmsg+0x40/0x6c inet6_sendmsg+0x4c/0x80 sock_sendmsg+0x5c/0x6c __sys_sendto+0x128/0x15c __arm64_sys_sendto+0x30/0x40 invoke_syscall+0x50/0x120 el0_svc_common.constprop.0+0x170/0x194 do_el0_svc+0x38/0x4c el0_svc+0x28/0xe0 el0t_64_sync_handler+0xbc/0x13c el0t_64_sync+0x180/0x184 Get softirq info by bcc tool: ./softirqs -NT 10 Tracing soft irq event time... Hit Ctrl-C to end. 15:34:34 SOFTIRQ TOTAL_nsecs block 158990 timer 20030920 sched 46577080 net_rx 676746820 tasklet 9906067650 15:34:45 SOFTIRQ TOTAL_nsecs block 86100 sched 38849790 net_rx 676532470 timer 1163848790 tasklet 9409019620 15:34:55 SOFTIRQ TOTAL_nsecs sched 58078450 net_rx 475156720 timer 533832410 tasklet 9431333300 The tasklet software interrupt takes too much time. Therefore, the xfrm_trans_reinject executor is changed from tasklet to workqueue. Add add spin lock to protect the queue. This reduces the processing flow of the tcp_sendmsg function in this scenario. Fixes: acf568ee859f0 ("xfrm: Reinject transport-mode packets through tasklet") Signed-off-by: Liu Jian <liujian56(a)huawei.com> Signed-off-by: Steffen Klassert <steffen.klassert(a)secunet.com> Conflicts: net/xfrm/xfrm_input.c Signed-off-by: Liu Jian <liujian56(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- net/xfrm/xfrm_input.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c index 61e6220ddd5a..66e4d3395f82 100644 --- a/net/xfrm/xfrm_input.c +++ b/net/xfrm/xfrm_input.c @@ -24,7 +24,8 @@ #include "xfrm_inout.h" struct xfrm_trans_tasklet { - struct tasklet_struct tasklet; + struct work_struct work; + spinlock_t queue_lock; struct sk_buff_head queue; }; @@ -760,18 +761,22 @@ int xfrm_input_resume(struct sk_buff *skb, int nexthdr) } EXPORT_SYMBOL(xfrm_input_resume); -static void xfrm_trans_reinject(unsigned long data) +static void xfrm_trans_reinject(struct work_struct *work) { - struct xfrm_trans_tasklet *trans = (void *)data; + struct xfrm_trans_tasklet *trans = container_of(work, struct xfrm_trans_tasklet, work); struct sk_buff_head queue; struct sk_buff *skb; __skb_queue_head_init(&queue); + spin_lock_bh(&trans->queue_lock); skb_queue_splice_init(&trans->queue, &queue); + spin_unlock_bh(&trans->queue_lock); + local_bh_disable(); while ((skb = __skb_dequeue(&queue))) XFRM_TRANS_SKB_CB(skb)->finish(XFRM_TRANS_SKB_CB(skb)->net, NULL, skb); + local_bh_enable(); } int xfrm_trans_queue_net(struct net *net, struct sk_buff *skb, @@ -789,8 +794,10 @@ int xfrm_trans_queue_net(struct net *net, struct sk_buff *skb, XFRM_TRANS_SKB_CB(skb)->finish = finish; XFRM_TRANS_SKB_CB(skb)->net = net; + spin_lock_bh(&trans->queue_lock); __skb_queue_tail(&trans->queue, skb); - tasklet_schedule(&trans->tasklet); + spin_unlock_bh(&trans->queue_lock); + schedule_work(&trans->work); return 0; } EXPORT_SYMBOL(xfrm_trans_queue_net); @@ -817,8 +824,8 @@ void __init xfrm_input_init(void) struct xfrm_trans_tasklet *trans; trans = &per_cpu(xfrm_trans_tasklet, i); + spin_lock_init(&trans->queue_lock); __skb_queue_head_init(&trans->queue); - tasklet_init(&trans->tasklet, xfrm_trans_reinject, - (unsigned long)trans); + INIT_WORK(&trans->work, xfrm_trans_reinject); } } -- 2.20.1

1 0

[PATCH openEuler-1.0-LTS] Revert "cifs: fix double free race when mount fails in cifs_get_root()"
by Yongqiang Liu 29 Sep '22

29 Sep '22

From: Luo Meng <luomeng12(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5TMYD CVE: NA -------------------------------- This reverts commit 7959a47042a6c1ec5a97966cf3c04ee972b55348. Commit 2fe0e281f7ad (cifs: fix double free race when mount fails in cifs_get_root()) fixes a double free. However there is no such issue on 4.19 because it will return after cifs_cleanup_volume_info(). Since merge this patch, cifs_cleanup_volume_info() is skipped, leading to a memory leak. Signed-off-by: Luo Meng <luomeng12(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/cifs/cifsfs.c | 1 - 1 file changed, 1 deletion(-) diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c index baa1713d6695..bc906fcf3f6d 100644 --- a/fs/cifs/cifsfs.c +++ b/fs/cifs/cifsfs.c @@ -779,7 +779,6 @@ cifs_smb3_do_mount(struct file_system_type *fs_type, out_super: deactivate_locked_super(sb); - return root; out: cifs_cleanup_volume_info(volume_info); return root; -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 0/3] hisi_sas NCQ enhancement
by Yongqiang Liu 28 Sep '22

28 Sep '22

Xingui Yang (3): scsi: hisi_sas: Modify v3 HW ATA completion process when SATA disk is in error status scsi: hisi_sas: Enable force phy when SATA disk directly connected scsi: hisi_sas: Release resource directly in hisi_sas_abort_task() when NCQ error drivers/scsi/hisi_sas/hisi_sas.h | 1 + drivers/scsi/hisi_sas/hisi_sas_main.c | 20 +++++++++---- drivers/scsi/hisi_sas/hisi_sas_v2_hw.c | 10 +++++-- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 41 ++++++++++++++++++++++++-- 4 files changed, 61 insertions(+), 11 deletions(-) -- 2.25.1

1 3

[PATCH openEuler-1.0-LTS] sched: Fix invalid free for tsk->se.dyn_affi_stats
by Yongqiang Liu 28 Sep '22

28 Sep '22

From: Hui Tang <tanghui20(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5TIOZ CVE: NA -------------------------------- BUG: KASAN: double-free or invalid-free in sched_prefer_cpus_free[...] Freed by task 0: save_stack mm/kasan/kasan.c:448 [inline] set_track mm/kasan/kasan.c:460 [inline] __kasan_slab_free+0x120/0x228 mm/kasan/kasan.c:521 kasan_slab_free+0x10/0x18 mm/kasan/kasan.c:528 slab_free_hook mm/slub.c:1397 [inline] slab_free_freelist_hook mm/slub.c:1425 [inline] slab_free mm/slub.c:3004 [inline] kfree+0x84/0x250 mm/slub.c:3965 sched_prefer_cpus_free+0x58/0x78 kernel/sched/core.c:7219 free_task+0xb0/0xe8 kernel/fork.c:463 __delayed_free_task+0x24/0x30 kernel/fork.c:1716 __rcu_reclaim kernel/rcu/rcu.h:236 [inline] rcu_do_batch+0x200/0x5e0 kernel/rcu/tree.c:2584 invoke_rcu_callbacks kernel/rcu/tree.c:2897 [inline] __rcu_process_callbacks kernel/rcu/tree.c:2864 [inline] rcu_process_callbacks+0x470/0xb60 kernel/rcu/tree.c:2881 __do_softirq+0x2d0/0xba0 kernel/softirq.c:292 Add init of 'tsk->se.dyn_affi_stats == NULL' in dup_task_struct(). Fixes: ebca52abe099c ("sched: Add statistics for scheduler dynamic affinity") Signed-off-by: Hui Tang <tanghui20(a)huawei.com> Reviewed-by: Zhang Qiao <zhangqiao22(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- kernel/fork.c | 1 + 1 file changed, 1 insertion(+) diff --git a/kernel/fork.c b/kernel/fork.c index 4207d5e5958b..b5453a26655e 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -893,6 +893,7 @@ static struct task_struct *dup_task_struct(struct task_struct *orig, int node) #ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY tsk->prefer_cpus = NULL; + tsk->se.dyn_affi_stats = NULL; #endif setup_thread_stack(tsk, orig); -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 1/6] mm: fix missing handler for __GFP_NOWARN
by Yongqiang Liu 28 Sep '22

28 Sep '22

From: Qi Zheng <zhengqi.arch(a)bytedance.com> mainline inclusion from mainline-v5.19-rc1 commit 3f913fc5f9745613088d3c569778c9813ab9c129 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5T8FD CVE: NA -------------------------------- We expect no warnings to be issued when we specify __GFP_NOWARN, but currently in paths like alloc_pages() and kmalloc(), there are still some warnings printed, fix it. But for some warnings that report usage problems, we don't deal with them. If such warnings are printed, then we should fix the usage problems. Such as the following case: WARN_ON_ONCE((gfp_flags & __GFP_NOFAIL) && (order > 1)); [zhengqi.arch(a)bytedance.com: v2] Link: https://lkml.kernel.org/r/20220511061951.1114-1-zhengqi.arch@bytedance.com Link: https://lkml.kernel.org/r/20220510113809.80626-1-zhengqi.arch@bytedance.com Signed-off-by: Qi Zheng <zhengqi.arch(a)bytedance.com> Cc: Akinobu Mita <akinobu.mita(a)gmail.com> Cc: Vlastimil Babka <vbabka(a)suse.cz> Cc: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Cc: Jiri Slaby <jirislaby(a)kernel.org> Cc: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflict: mm/internal.h mm/page_alloc.c Signed-off-by: Ye Weihua <yeweihua4(a)huawei.com> Reviewed-by: Kuohai Xu <xukuohai(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- include/linux/fault-inject.h | 2 ++ lib/fault-inject.c | 3 +++ mm/failslab.c | 3 +++ mm/internal.h | 15 +++++++++++++++ mm/page_alloc.c | 16 +++++++++------- 5 files changed, 32 insertions(+), 7 deletions(-) diff --git a/include/linux/fault-inject.h b/include/linux/fault-inject.h index 7e6c77740413..4f00068354c1 100644 --- a/include/linux/fault-inject.h +++ b/include/linux/fault-inject.h @@ -20,6 +20,7 @@ struct fault_attr { atomic_t space; unsigned long verbose; bool task_filter; + bool no_warn; unsigned long stacktrace_depth; unsigned long require_start; unsigned long require_end; @@ -39,6 +40,7 @@ struct fault_attr { .ratelimit_state = RATELIMIT_STATE_INIT_DISABLED, \ .verbose = 2, \ .dname = NULL, \ + .no_warn = false, \ } #define DECLARE_FAULT_ATTR(name) struct fault_attr name = FAULT_ATTR_INITIALIZER diff --git a/lib/fault-inject.c b/lib/fault-inject.c index cf7b129b0b2b..af8b0ae64a85 100644 --- a/lib/fault-inject.c +++ b/lib/fault-inject.c @@ -40,6 +40,9 @@ EXPORT_SYMBOL_GPL(setup_fault_attr); static void fail_dump(struct fault_attr *attr) { + if (attr->no_warn) + return; + if (attr->verbose > 0 && __ratelimit(&attr->ratelimit_state)) { printk(KERN_NOTICE "FAULT_INJECTION: forcing a failure.\n" "name %pd, interval %lu, probability %lu, " diff --git a/mm/failslab.c b/mm/failslab.c index 215cb1ea169d..f4d829f95454 100644 --- a/mm/failslab.c +++ b/mm/failslab.c @@ -30,6 +30,9 @@ bool __should_failslab(struct kmem_cache *s, gfp_t gfpflags) if (failslab.cache_filter && !(s->flags & SLAB_FAILSLAB)) return false; + if (gfpflags & __GFP_NOWARN) + failslab.attr.no_warn = true; + return should_fail(&failslab.attr, s->object_size); } diff --git a/mm/internal.h b/mm/internal.h index c94de10189eb..1b861446c751 100644 --- a/mm/internal.h +++ b/mm/internal.h @@ -36,6 +36,21 @@ /* Do not use these with a slab allocator */ #define GFP_SLAB_BUG_MASK (__GFP_DMA32|__GFP_HIGHMEM|~__GFP_BITS_MASK) +/* + * Different from WARN_ON_ONCE(), no warning will be issued + * when we specify __GFP_NOWARN. + */ +#define WARN_ON_ONCE_GFP(cond, gfp) ({ \ + static bool __section(".data.once") __warned; \ + int __ret_warn_once = !!(cond); \ + \ + if (unlikely(!(gfp & __GFP_NOWARN) && __ret_warn_once && !__warned)) { \ + __warned = true; \ + WARN_ON(1); \ + } \ + unlikely(__ret_warn_once); \ +}) + void page_writeback_init(void); vm_fault_t do_swap_page(struct vm_fault *vmf); diff --git a/mm/page_alloc.c b/mm/page_alloc.c index 44d286286dbb..cede3ebe7353 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -3253,6 +3253,9 @@ static bool should_fail_alloc_page(gfp_t gfp_mask, unsigned int order) (gfp_mask & __GFP_DIRECT_RECLAIM)) return false; + if (gfp_mask & __GFP_NOWARN) + fail_page_alloc.attr.no_warn = true; + return should_fail(&fail_page_alloc.attr, 1 << order); } @@ -3743,7 +3746,8 @@ __alloc_pages_may_oom(gfp_t gfp_mask, unsigned int order, goto out; /* Exhausted what can be done so it's blame time */ - if (out_of_memory(&oc) || WARN_ON_ONCE(gfp_mask & __GFP_NOFAIL)) { + if (out_of_memory(&oc) || + WARN_ON_ONCE_GFP(gfp_mask & __GFP_NOFAIL, gfp_mask)) { *did_some_progress = 1; /* @@ -4534,7 +4538,7 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order, * All existing users of the __GFP_NOFAIL are blockable, so warn * of any new users that actually require GFP_NOWAIT */ - if (WARN_ON_ONCE(!can_direct_reclaim)) + if (WARN_ON_ONCE_GFP(!can_direct_reclaim, gfp_mask)) goto fail; /* @@ -4542,7 +4546,7 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order, * because we cannot reclaim anything and only can loop waiting * for somebody to do a work for us */ - WARN_ON_ONCE(current->flags & PF_MEMALLOC); + WARN_ON_ONCE_GFP(current->flags & PF_MEMALLOC, gfp_mask); /* * non failing costly orders are a hard requirement which we @@ -4550,7 +4554,7 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order, * so that we can identify them and convert them to something * else. */ - WARN_ON_ONCE(order > PAGE_ALLOC_COSTLY_ORDER); + WARN_ON_ONCE_GFP(order > PAGE_ALLOC_COSTLY_ORDER, gfp_mask); /* * Help non-failing allocations by giving them access to memory @@ -4732,10 +4736,8 @@ __alloc_pages_nodemask(gfp_t gfp_mask, unsigned int order, int preferred_nid, * There are several places where we assume that the order value is sane * so bail out early if the request is out of bound. */ - if (unlikely(order >= MAX_ORDER)) { - WARN_ON_ONCE(!(gfp_mask & __GFP_NOWARN)); + if (WARN_ON_ONCE_GFP(order >= MAX_ORDER, gfp_mask)) return NULL; - } prepare_before_alloc(&gfp_mask); -- 2.25.1

1 5

[PATCH openEuler-5.10-LTS 01/17] mm: Force TLB flush for PFNMAP mappings before unlink_file_vma()
by Zheng Zengkai 27 Sep '22

27 Sep '22

From: Jann Horn <jannh(a)google.com> stable inclusion from stable-v5.10.142 commit 895428ee124ad70b9763259308354877b725c31d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5PE9S CVE: CVE-2022-39188 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit b67fbebd4cf980aecbcc750e1462128bffe8ae15 upstream. Some drivers rely on having all VMAs through which a PFN might be accessible listed in the rmap for correctness. However, on X86, it was possible for a VMA with stale TLB entries to not be listed in the rmap. This was fixed in mainline with commit b67fbebd4cf9 ("mmu_gather: Force tlb-flush VM_PFNMAP vmas"), but that commit relies on preceding refactoring in commit 18ba064e42df3 ("mmu_gather: Let there be one tlb_{start,end}_vma() implementation") and commit 1e9fdf21a4339 ("mmu_gather: Remove per arch tlb_{start,end}_vma()"). This patch provides equivalent protection without needing that refactoring, by forcing a TLB flush between removing PTEs in unmap_vmas() and the call to unlink_file_vma() in free_pgtables(). [This is a stable-specific rewrite of the upstream commit!] Signed-off-by: Jann Horn <jannh(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ze zuo <zuoze1(a)huawei.com> Reviewed-by: Chen Wandun <chenwandun(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- mm/mmap.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/mm/mmap.c b/mm/mmap.c index 5489d70db84e..7fba5d89ecde 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -2962,6 +2962,18 @@ static void unmap_region(struct mm_struct *mm, tlb_gather_mmu(&tlb, mm, start, end); update_hiwater_rss(mm); unmap_vmas(&tlb, vma, start, end); + + /* + * Ensure we have no stale TLB entries by the time this mapping is + * removed from the rmap. + * Note that we don't have to worry about nested flushes here because + * we're holding the mm semaphore for removing the mapping - so any + * concurrent flush in this region has to be coming through the rmap, + * and we synchronize against that using the rmap lock. + */ + if ((vma->vm_flags & (VM_PFNMAP|VM_MIXEDMAP)) != 0) + tlb_flush_mmu(&tlb); + free_pgtables(&tlb, vma, prev ? prev->vm_end : FIRST_USER_ADDRESS, next ? next->vm_start : USER_PGTABLES_CEILING); tlb_finish_mmu(&tlb, start, end); -- 2.20.1

1 16

[PATCH openEuler-5.10-LTS 000/427] Backport 5.10.121 LTS
by Zheng Zengkai 27 Sep '22

27 Sep '22

Backport 5.10.121 LTS patches from upstream. git cherry-pick v5.10.120..v5.10.121~1 -s Already merged(-13): 94845fc422f9 inotify: show inotify mask flags in proc fdinfo 9a9dc60da79a fs-writeback: writeback_sb_inodes：Recalculate 'wrote' according skipped pages dd887f83ea54 ext4: fix use-after-free in ext4_rename_dir_prepare adf490083ca5 ext4: fix warning in ext4_handle_inode_extension 1b061af03764 ext4: fix bug_on in ext4_writepages 4fd58b5cf118 ext4: fix bug_on in __es_tree_search 46c2b5f81c9e bcache: improve multithreaded bch_btree_check() 3f686b249b1c bcache: improve multithreaded bch_sectors_dirty_init() 0cf22f234ebc bcache: remove incremental dirty sector counting for bch_sectors_dirty_init() 59afd4f28790 bcache: avoid journal no-space deadlock by reserving 1 journal bucket 893cf5f68a4c xfs: fix chown leaking delalloc quota blocks when fssetxattr fails e3ffe7387c70 xfs: force log and push AIL to clear pinned inodes when aborting mount 47c1680e51ef md: bcache: check the return value of kzalloc() in detached_dev_do_request() Rejected(-3): hinic driver drops related file in the patch: 33411945c9ad net: hinic: add missing destroy_workqueue in hinic_pf_to_mgmt_init dc7753d60097 net: huawei: hinic: Use devm_kcalloc() instead of devm_kzalloc() 8096e2d7c0f9 hinic: Avoid some over memory allocation Context conflict: 643ceee253a4 xfs: sync lazy sb accounting on quiesce of read-only mounts 80b0a2b3dfea bfq: Remove pointless bfq_init_rq() calls a67100f42665 ext4: only allow test_dummy_encryption when supported KABI changed(-2)： 147a376c1afe sched/fair: Fix cfs_rq_clock_pelt() for throttled cfs_rq 61bbbde9b6d2 drm: fix EDID struct for old ARM OABI format 7a55a5159dae scsi: fcoe: Fix Wstringop-overflow warnings in fcoe_wwn_from_mac() KABI fixed(+1): sched/fair: Fix kabi broken in struct cfs_rq Defered(-5): 9834b13e8b96 tty: fix deadlock caused by calling printk() under tty_port->lock 70a7dea84639 bfq: Track whether bfq_group is still online 0285718e2825 bfq: Get rid of __bio_blkcg() usage 51f724bffa34 bfq: Make sure bfqg for which we are queueing requests is online c26ccbaeb8d8 kexec_file: drop weak attribute from arch_kexec_apply_relocations[_add] Total patches: 449 - 13 - 3 - 2 + 1 - 5 = 427 Abhinav Kumar (1): drm/msm/dpu: handle pm_runtime_get_sync() errors in bind path Abhishek Kumar (1): ath10k: skip ath10k_halt during suspend for driver state RESTARTING Aditya Garg (1): efi: Do not import certificates from UEFI Secure Boot for T2 Macs Aidan MacDonald (1): mmc: jz4740: Apply DMA engine limits to maximum segment size Akira Yokosawa (1): docs/conf.py: Cope with removal of language=None in Sphinx 5.0.0 Albert Wang (1): usb: dwc3: gadget: Move null pinter check to proper place Alex Elder (2): net: ipa: fix page free in ipa_endpoint_trans_release() net: ipa: fix page free in ipa_endpoint_replenish_one() Alexander Aring (2): dlm: fix plock invalid read dlm: fix missing lkb refcount handling Alexander Wetzel (1): rtl818x: Prevent using not initialized queues Alexandre Ghiti (1): riscv: Initialize thread pointer before calling C functions Alexandru Elisei (1): arm64: compat: Do not treat syscall number as ESR_ELx for a bad syscall Alexey Dobriyan (1): proc: fix dentry/inode overinstantiating under /proc/${pid}/net Alexey Khoroshilov (1): ASoC: max98090: Move check for invalid values before casting in max98090_put_enab_tlv() Alice Wong (1): drm/amdgpu/ucode: Remove firmware load type check in amdgpu_ucode_free_bo Amadeusz Sławiński (1): ALSA: jack: Access input_dev under mutex Amelie Delaunay (3): dmaengine: stm32-mdma: remove GISR1 register dmaengine: stm32-mdma: rework interrupt handler dmaengine: stm32-mdma: fix chan initialization in stm32_mdma_irq_handler() Amir Goldstein (1): fsnotify: fix wrong lockdep annotations Ammar Faizi (2): x86/MCE/AMD: Fix memory leak when threshold_create_bank() fails x86/delay: Fix the wrong asm constraint in delay_loop() Andre Przywara (1): ARM: dts: suniv: F1C100: fix watchdog compatible Andreas Gruenbacher (1): iomap: iomap_write_failed fix Andrii Nakryiko (2): libbpf: Don't error out on CO-RE relos for overriden weak subprogs libbpf: Fix logic for finding matching program for CO-RE relocation Archie Pusaka (2): Bluetooth: use inclusive language in HCI role comments Bluetooth: use inclusive language when filtering devices Arnd Bergmann (2): drbd: fix duplicate array initializer ARM: pxa: maybe fix gpio lookup tables Baochen Qiang (1): ath11k: Don't check arvif->is_started before sending management frames Bart Van Assche (1): scsi: ufs: qcom: Fix ufs_qcom_resume() Bhaskar Chowdhury (1): Bluetooth: L2CAP: Rudimentary typo fixes Biju Das (1): spi: spi-rspi: Remove setting {src,dst}_{addr,addr_width} based on DMA direction Bjorn Andersson (1): soc: qcom: llcc: Add MODULE_DEVICE_TABLE() Bjorn Helgaas (1): PCI/PM: Fix bridge_d3_blacklist[] Elo i2 overwrite of Gigabyte X299 Björn Ardö (1): mailbox: forward the hrtimer if not queued and under a lock Bob Peterson (1): gfs2: use i_lock spin_lock for inode qadata Borislav Petkov (1): x86/microcode: Add explicit CPU vendor dependency Brian Foster (3): xfs: sync lazy sb accounting on quiesce of read-only mounts xfs: restore shutdown check in mapped write fault path xfs: consider shutdown in bmapbt cursor delete assert Brian Norris (2): PM / devfreq: rk3399_dmc: Disable edev on remove() drm/bridge: analogix_dp: Grab runtime PM reference for DP-AUX Cai Huoqing (1): media: staging: media: rkvdec: Make use of the helper function devm_platform_ioremap_resource() Carl Yin(殷张成) (1): USB: serial: option: add Quectel BG95 modem Chao Yu (7): f2fs: fix to avoid f2fs_bug_on() in dec_valid_node_count() f2fs: fix to do sanity check on block address in f2fs_do_zero_range() f2fs: fix to clear dirty inode in f2fs_evict_inode() f2fs: fix deadloop in foreground GC f2fs: fix to do sanity check on total_data_blocks f2fs: fix fallocate to use file_modified to update permissions consistently f2fs: fix to do sanity check for inline inode Charles Keepax (3): ASoC: tscs454: Add endianness flag in snd_soc_component_driver ASoC: atmel-pdmic: Remove endianness flag on pdmic component ASoC: atmel-classd: Remove endianness flag on class d component Chen-Tsung Hsieh (1): mtd: spi-nor: core: Check written SR value in spi_nor_write_16bit_sr_and_check() Chen-Yu Tsai (1): media: hantro: Empty encoder capture buffers by default Chengming Zhou (1): sched/fair: Fix cfs_rq_clock_pelt() for throttled cfs_rq Christoph Hellwig (2): target: remove an incorrect unmap zeroes data deduction virtio_blk: fix the discard_granularity and discard_alignment queue limits Christophe JAILLET (4): media: aspeed: Fix an error handling path in aspeed_video_probe() memory: samsung: exynos5422-dmc: Avoid some over memory allocation drivers/base/memory: fix an unlikely reference counting issue in __add_memory_block() dmaengine: idxd: Fix the error handling path in idxd_cdev_register() Christophe de Dinechin (1): nodemask.h: fix compilation error with GCC12 Chuanhong Guo (1): arm: mediatek: select arch timer for mt7629 Colin Ian King (2): ALSA: pcm: Check for null pointer of pointer substream before dereferencing it selftests/resctrl: Fix null pointer dereference on open failed Corentin Labbe (3): crypto: marvell/cesa - ECB does not IV crypto: sun8i-ss - rework handling of IV crypto: sun8i-ss - handle zero sized sg Corey Minyard (2): ipmi:ssif: Check for NULL msg when handling events and messages ipmi: Fix pr_fmt to avoid compilation issues Cristian Marussi (1): firmware: arm_scmi: Fix list protocols enumeration in the base protocol Dan Carpenter (5): ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix drm/msm: return an error pointer in msm_gem_prime_get_sg_table() PCI: cadence: Fix find_first_zero_bit() limit PCI: rockchip: Fix find_first_zero_bit() limit OPP: call of_node_put() on error path in _bandwidth_supported() Dan Williams (2): nvdimm: Fix firmware activation deadlock scenarios nvdimm: Allow overwrite in the presence of disabled dimms Daniel Lezcano (2): thermal/drivers/core: Use a char pointer for the cooling device name thermal/core: Fix memory leak in the error path Daniel Thompson (1): irqchip/exiu: Fix acknowledgment of edge triggered interrupts Daniel Vetter (1): fbcon: Consistently protect deferred_takeover with console_lock() Darrick J. Wong (1): xfs: fix incorrect root dquot corruption error when switching group/project quota types Dave Airlie (1): drm/amdgpu/cs: make commands with 0 chunks illegal behaviour. Dave Chinner (1): xfs: assert in xfs_btree_del_cursor should take into account error David Howells (7): rxrpc: Return an error to sendmsg if call failed rxrpc, afs: Fix selection of abort codes rxrpc: Fix listen() setting the bar too high for the prealloc rings rxrpc: Don't try to resend the request if we're receiving the reply rxrpc: Fix overlapping ACK accounting rxrpc: Don't let ack.previousPacket regress rxrpc: Fix decision on when to generate an IDLE ACK Dennis Dalessandro (1): RDMA/hfi1: Fix potential integer multiplication overflow errors Dimitri John Ledkov (1): cfg80211: declare MODULE_FIRMWARE for regulatory.db Dinh Nguyen (1): dt-bindings: gpio: altera: correct interrupt-cells Dmitry Baryshkov (2): drm/msm/dsi: fix error checks and return values for DSI xmit functions drm/msm: add missing include to msm_drv.c Dmitry Torokhov (1): Input: stmfts - do not leave device disabled in stmfts_input_open Dongliang Mu (3): HID: bigben: fix slab-out-of-bounds Write in bigben_probe rtlwifi: Use pr_warn instead of WARN_ONCE media: ov7670: remove ov7670_power_off from ov7670_remove Douglas Miller (2): RDMA/hfi1: Prevent panic when SDMA is disabled RDMA/hfi1: Prevent use of lock before it is initialized Duoming Zhou (1): NFC: hci: fix sleep in atomic context bugs in nfc_hci_hcp_message_tx Emmanuel Grumbach (1): iwlwifi: mvm: fix assert 1F04 upon reconfig Eric Biggers (2): ext4: reject the 'commit' option on ext2 filesystems ext4: only allow test_dummy_encryption when supported Eric Dumazet (2): net: remove two BUG() from skb_checksum_help() sctp: read sk->sk_bound_dev_if once in sctp_rcv() Eric W. Biederman (3): ptrace/um: Replace PT_DTRACE with TIF_SINGLESTEP ptrace/xtensa: Replace PT_SINGLESTEP with TIF_SINGLESTEP ptrace: Reimplement PTRACE_KILL by always sending SIGKILL Eugenio Pérez (1): vdpasim: allow to enable a vq repeatedly Evan Quan (1): drm/amd/pm: fix the compile warning Fabio Estevam (1): net: phy: micrel: Allow probing without .driver_data Felix Fietkau (1): mac80211: upgrade passive scan to active scan on DFS channels after beacon rx Finn Thain (1): macintosh/via-pmu: Fix build failure when CONFIG_INPUT is disabled Francesco Dolcini (1): PCI: imx6: Fix PERST# start-up sequence GUO Zihua (1): ima: remove the IMA_TEMPLATE Kconfig option Geert Uytterhoeven (2): m68k: atari: Make Atari ROM port I/O write macros return void m68k: math-emu: Fix dependencies of math emulation support Gilad Ben-Yossef (1): crypto: ccree - use fine grained DMA mapping dir Guenter Roeck (2): platform/chrome: Re-introduce cros_ec_cmd_xfer and use it for ioctls MIPS: Loongson: Use hwmon_device_register_with_groups() to register hwmon Guo Ren (1): csky: patch_text: Fixup last cpu should be master Gustavo A. R. Silva (1): net: stmmac: selftests: Use kcalloc() instead of kzalloc() Hangyu Hua (3): media: rga: fix possible memory leak in rga_probe drm: msm: fix possible memory leak in mdp5_crtc_cursor_set() misc: ocxl: fix possible double free in ocxl_file_register_afu Hans Verkuil (1): media: cec-adap.c: fix is_configuring state Hans de Goede (1): ASoC: Intel: bytcr_rt5640: Add quirk for the HP Pro Tablet 408 Haowen Bai (4): b43legacy: Fix assigning negative value to unsigned variable b43: Fix assigning negative value to unsigned variable ipw2x00: Fix potential NULL dereference in libipw_xmit() sfc: ef10: Fix assigning negative value to unsigned variable Haren Myneni (1): powerpc/powernv/vas: Assign real address to rx_fifo in vas_rx_win_attr Hari Bathini (2): powerpc/fadump: Fix fadump to work with a different endian capture kernel powerpc/fadump: fix PT_LOAD segment for boot memory area Hari Chandrakanthan (1): ath11k: disable spectral scan during spectral deinit Heiko Carstens (1): s390/preempt: disable __preempt_count_add() optimization for PROFILE_ALL_BRANCHES Helge Deller (2): parisc/stifb: Implement fb_is_primary_device() parisc/stifb: Keep track of hardware path of graphics card Heming Zhao (1): md/bitmap: don't set sb values if can't pass sanity check Howard Chung (1): Bluetooth: Interleave with allowlist scan Jaegeuk Kim (1): f2fs: don't need inode lock for system hidden quota Jagan Teki (1): drm/panel: panel-simple: Fix proper bpc for AM-1280800N3TZQW-T00H Jakob Koschel (1): f2fs: fix dereference of stale list iterator after loop body Jakub Kicinski (2): eth: tg3: silence the GCC 12 array-bounds warning net: stmmac: fix out-of-bounds access in a selftest James Clark (1): perf tools: Use Python devtools for version autodetection rather than runtime James Smart (1): scsi: lpfc: Fix resource leak in lpfc_sli4_send_seq_to_ulp() Jan Kara (8): bfq: Split shared queues on move between cgroups bfq: Update cgroup information before merging bio ext4: verify dir block before splitting it ext4: avoid cycles in directory h-tree bfq: Avoid merging queues with different parents bfq: Drop pointless unlock-lock pair bfq: Remove pointless bfq_init_rq() calls block: fix bio_clone_blkg_association() to associate with proper blkcg_gq Jan Kiszka (1): efi: Add missing prototype for efi_capsule_setup_info Jani Nikula (2): drm/edid: fix invalid EDID extension block filtering drm/i915/dsi: fix VBT send packet port selection for ICL+ Janusz Krzysztofik (1): ARM: OMAP1: clock: Fix UART rate reporting algorithm Jason A. Donenfeld (2): openrisc: start CPU timer early in boot Revert "random: use static branch for crng_ready()" Jeffrey Mitchell (1): xfs: set inode size after creating symlink Jessica Zhang (2): drm/msm/mdp5: Return error code in mdp5_pipe_release when deadlock is detected drm/msm/mdp5: Return error code in mdp5_mixer_release when deadlock is detected Jia-Wei Chang (1): cpufreq: mediatek: Use module_init and add module_exit Jiantao Zhang (1): PCI: dwc: Fix setting error return on MSI DMA mapping failure Jiasheng Jiang (1): drm: mali-dp: potential dereference of null pointer Jiri Slaby (1): serial: pch: don't overwrite xmit->buf[0] by x_char Joerg Roedel (1): iommu/amd: Increase timeout waiting for GA log enablement Johan Hovold (4): PCI: qcom: Fix runtime PM imbalance on probe errors PCI: qcom: Fix unbalanced PHY init on probe errors phy: qcom-qmp: fix struct clk leak on probe errors phy: qcom-qmp: fix reset-controller leak on probe errors Johannes Berg (3): nl80211: show SSID for P2P_GO interfaces wifi: mac80211: fix use-after-free in chanctx code um: chan_user: Fix winch_tramp() return value Jonas Karlman (1): media: rkvdec: h264: Fix bit depth wrap in pps packet Jonathan Bakker (1): ARM: dts: s5pv210: Remove spi-cs-high on panel in Aries Jonathan Teh (1): HID: hid-led: fix maximum brightness for Dream Cheeky Josh Poimboeuf (2): x86/speculation: Add missing prototype for unpriv_ebpf_notify() scripts/faddr2line: Fix overlapping text section failures Junxiao Bi via Ocfs2-devel (1): ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock Kajol Jain (1): powerpc/perf: Fix the threshold compare group constraint for power9 Kan Liang (1): perf/x86/intel: Fix event constraints for ICL Kathiravan T (1): arm64: dts: qcom: ipq8074: fix the sleep clock frequency Keita Suzuki (2): drm/amd/pm: fix double free in si_parse_power_table() tracing: Fix potential double free in create_var_ref() Keith Busch (1): nvme: set dma alignment to dword Kirill A. Shutemov (1): ACPICA: Avoid cache flush inside virtual machines Kishon Vijay Abraham I (1): usb: core: hcd: Add support for deferring roothub registration Kiwoong Kim (1): scsi: ufs: core: Exclude UECxx from SFR dump list Konrad Dybcio (2): arm64: dts: qcom: msm8994: Fix BLSP[12]_DMA channels count regulator: qcom_smd: Fix up PM8950 regulator configuration Krzysztof Kozlowski (6): ARM: dts: ox820: align interrupt controller node name with dtschema ARM: dts: s5pv210: align DMA channels with dtschema ARM: dts: exynos: add atmel,24c128 fallback to Samsung EEPROM irqchip/aspeed-i2c-ic: Fix irq_of_parse_and_map() return value irqchip/aspeed-scu-ic: Fix irq_of_parse_and_map() return value pinctrl: mvebu: Fix irq_of_parse_and_map() return value Kuldeep Singh (1): spi: qcom-qspi: Add minItems to interconnect-names Kuninori Morimoto (2): ASoC: samsung: Use dev_err_probe() helper i2c: rcar: fix PM ref counts in probe error paths Kuogee Hsieh (3): drm/msm/dpu: adjust display_v_end for eDP and DP drm/msm/dp: stop event kernel thread when DP unbind drm/msm/dp: fix event thread stuck in wait_event after kthread_stop() Kuppuswamy Sathyanarayanan (1): PCI/AER: Clear MULTI_ERR_COR/UNCOR_RCV bits Kwanghoon Son (1): media: exynos4-is: Fix compile warning Lai Jiangshan (1): x86/sev: Annotate stack change in the #VC handler Len Brown (1): tools/power turbostat: fix ICX DRAM power numbers Leo Yan (1): perf c2c: Use stdio interface if slang is not supported Lin Ma (2): ASoC: rt5645: Fix errorenous cleanup order NFC: NULL out the dev->rfkill to prevent UAF Liu Zixian (1): drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes Liviu Dudau (1): drm/komeda: return early if drm_universal_plane_init() fails. Luca Weiss (1): media: venus: hfi: avoid null dereference in deinit Lucas Stach (2): drm/bridge: adv7511: clean up CEC adapter when probe fails drm/etnaviv: check for reaped mapping in etnaviv_iommu_unmap_gem Lv Ruyi (7): scsi: megaraid: Fix error check return value of register_chrdev() drm: msm: fix error check return value of irq_of_parse_and_map() powerpc/xics: fix refcount leak in icp_opal_init() powerpc/powernv: fix missing of_node_put in uv_init() drm/msm/dp: fix error check return value of irq_of_parse_and_map() drm/msm/hdmi: fix error check return value of irq_of_parse_and_map() mfd: ipaq-micro: Fix error check return value of platform_get_irq() Maciej W. Rozycki (2): MIPS: IP27: Remove incorrect `cpu_has_fpu' override MIPS: IP30: Remove incorrect `cpu_has_fpu' override Manivannan Sadhasivam (1): scsi: ufs: qcom: Add a readl() to make sure ref_clk gets enabled Mao Jinlong (1): coresight: core: Fix coresight device probe failure issue Marc Kleine-Budde (1): can: xilinx_can: mark bit timing constants as const Marek Vasut (2): drm/panel: simple: Add missing bus flags for Innolux G070Y2-L01 ARM: dts: stm32: Fix PHY post-reset delay on Avenger96 Mario Limonciello (1): ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default Marios Levogiannis (1): ALSA: hda/realtek - Fix microphone noise on ASUS TUF B550M-PLUS Mark Bloch (1): net/mlx5: fs, delete the FTE when there are no rules attached to it Mark Brown (2): ASoC: dapm: Don't fold register value changes into notifications ASoC: rt5514: Fix event generation for "DSP Voice Wake Up" control Mathias Nyman (1): xhci: Allow host runtime PM as default for Intel Alder Lake N xHCI Matthieu Baerts (1): x86/pm: Fix false positive kmemleak report in msr_build_context() Max Filippov (1): irqchip: irq-xtensa-mx: fix initial IRQ affinity Max Krummenacher (1): ARM: dts: imx6dl-colibri: Fix I2C pinmuxing Maxime Ripard (3): drm/vc4: hvs: Reset muxes at probe time drm/vc4: txp: Don't set TXP_VSTART_AT_EOF drm/vc4: txp: Force alpha to be 0xff if it's disabled Miaohe Lin (1): drivers/base/node.c: fix compaction sysfs file leak Miaoqian Lin (20): ASoC: mediatek: Fix error handling in mt8173_max98090_dev_probe ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe spi: spi-ti-qspi: Fix return value handling of wait_for_completion_timeout HID: elan: Fix potential double free in elan_input_configured drm/bridge: Fix error handling in analogix_dp_probe ASoC: fsl: Fix refcount leak in imx_sgtl5000_probe ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt ASoC: samsung: Fix refcount leak in aries_audio_probe media: exynos4-is: Fix PM disable depth imbalance in fimc_is_probe media: st-delta: Fix PM disable depth imbalance in delta_probe media: exynos4-is: Change clk_disable to clk_disable_unprepare ASoC: ti: j721e-evm: Fix refcount leak in j721e_soc_probe_* drm/msm/a6xx: Fix refcount leak in a6xx_gpu_init thermal/drivers/imx_sc_thermal: Fix refcount leak in imx_sc_thermal_probe soc: qcom: smp2p: Fix missing of_node_put() in smp2p_parse_ipc soc: qcom: smsm: Fix missing of_node_put() in smsm_parse_ipc Input: sparcspkr - fix refcount leak in bbc_beep_probe powerpc/fsl_rio: Fix refcount leak in fsl_rio_setup video: fbdev: clcdfb: Fix refcount leak in clcdfb_of_vram_setup Michael Ellerman (1): powerpc/64: Only WARN if __pa()/__va() called with bad addresses Michael Rodin (1): media: vsp1: Fix offset calculation for plane cropping Michael Walle (1): i2c: at91: use dma safe buffers Mike Kravetz (1): hugetlb: fix huge_pmd_unshare address update Mike Travis (1): x86/platform/uv: Update TSC sync state for UV5 Mikulas Patocka (1): dma-debug: change allocation mode from GFP_NOWAIT to GFP_ATIOMIC Miles Chen (1): drm/mediatek: Fix mtk_cec_mask() Minghao Chi (1): scsi: ufs: Use pm_runtime_resume_and_get() instead of pm_runtime_get_sync() Monish Kumar R (1): USB: new quirk for Dell Gen 2 devices Muchun Song (1): dax: fix cache flush on PMD-mapped pages Nathan Chancellor (2): drm/i915: Fix CFI violation with show_dynamic_id() i2c: at91: Initialize dma_buf in at91_twi_xfer() Nico Boehr (1): s390/perf: obtain sie_block from the right address Nicolas Dufresne (3): media: rkvdec: h264: Fix dpb_valid implementation media: coda: Fix reported H264 profile media: coda: Add more H264 levels for CODA960 Nicolas Frattaroli (1): ASoC: rk3328: fix disabling mclk on pclk probe failure Niels Dossche (5): mwifiex: add mutex lock for call in mwifiex_dfs_chan_sw_work_queue ipv6: fix locking issues with loops over idev->addr_list IB/rdmavt: add missing locks in rvt_ruc_loopback ath11k: acquire ab->base_lock in unassign when finding the peer by addr Bluetooth: use hdev lock for accept_list and reject_list in conn req Niklas Cassel (1): binfmt_flat: do not stop relocating GOT entries prematurely on riscv Noralf Trønnes (1): dt-bindings: display: sitronix, st7735r: Fix backlight in example Nuno Sá (1): of: overlay: do not break notify on NOTIFY_{OK|STOP} OGAWA Hirofumi (1): fat: add ratelimit to fat*_ent_bread() Padmanabha Srinivasaiah (1): rcu-tasks: Fix race in schedule and flush work Pali Rohár (1): irqchip/armada-370-xp: Do not touch Performance Counter Overflow on A375, A38x, A39x Patrice Chotard (1): spi: stm32-qspi: Fix wait_cmd timeout in APM mode Paul Cercueil (1): drm/ingenic: Reset pixclock rate when parent clock rate changes Paul E. McKenney (2): rcu: Make TASKS_RUDE_RCU select IRQ_WORK scftorture: Fix distribution of short handler delays Paul Moore (1): lsm,selinux: pass flowi_common instead of flowi to the LSM hooks Pavel Skripkin (1): media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init Peilin Ye (1): Fonts: Make font size unsigned in font_desc Peng Wu (3): ARM: versatile: Add missing of_node_put in dcscb_init ARM: hisi: Add missing of_node_put after of_find_compatible_node powerpc/iommu: Add missing of_node_put in iommu_init_early_dart Petr Machata (2): mlxsw: spectrum_dcb: Do not warn about priority changes mlxsw: Treat LLDP packets as control Phil Auld (1): kselftest/cgroup: fix test_stress.sh to use OUTPUT dir Phil Elwell (3): ARM: dts: bcm2835-rpi-zero-w: Fix GPIO line name for Wifi/BT ARM: dts: bcm2837-rpi-cm3-io3: Fix GPIO line names for SMPS I2C ARM: dts: bcm2837-rpi-3-b-plus: Fix GPIO line name of power LED Philipp Zabel (1): media: coda: limit frame interval enumeration to supported encoder frame sizes Pierre-Louis Bossart (2): ASoC: max98357a: remove dependency on GPIOLIB ASoC: rt1015p: remove dependency on GPIOLIB Qinglang Miao (1): cpufreq: mediatek: add missing platform_driver_unregister() on error in mtk_cpufreq_driver_init QintaoShen (1): soc: ti: ti_sci_pm_domains: Check for null return of devm_kcalloc Qu Wenruo (2): btrfs: add "0x" prefix for unsupported optional features btrfs: repair super block num_devices automatically Randy Dunlap (6): x86: Fix return value of __setup handlers x86/mm: Cleanup the control_va_addr_alignment() __setup handler powerpc/8xx: export 'cpm_setbrg' for modules powerpc/idle: Fix return value of __setup() handler powerpc/4xx/cpm: Fix return value of __setup() handler macintosh: via-pmu and via-cuda need RTC_LIB Ravi Bangoria (2): perf/amd/ibs: Cascade pmu init functions' return value perf/amd/ibs: Use interrupt regs ip for stack unwinding Rei Yamamoto (1): mm, compaction: fast_find_migrateblock() should return pfn in the target zone Rex-BC Chen (1): cpufreq: mediatek: Unregister platform device on exit Rik van der Kemp (1): ALSA: hda/realtek: Enable 4-speaker output for Dell XPS 15 9520 laptop Ronnie Sahlberg (1): cifs: when extending a file with falloc we should make files not-sparse Russell King (Oracle) (1): net: dsa: mt7530: 1G can also support 1000BASE-X link mode Sakari Ailus (1): ACPI: property: Release subnode properties with data nodes Samuel Holland (1): riscv: Fix irq_work when SMP is disabled Sathish Narasimman (1): Bluetooth: LL privacy allow RPA Schspa Shi (1): cpufreq: Fix possible race in cpufreq online error path Sean Christopherson (3): KVM: nVMX: Leave most VM-Exit info fields unmodified on failed VM-Entry KVM: nVMX: Clear IDT vectoring on nested VM-Exit for double/triple fault Kconfig: Add option for asm goto w/ tied outputs to workaround clang-13 bug Sebastian Andrzej Siewior (1): crypto: cryptd - Protect per-CPU resource by disabling BH. Shawn Lin (1): arm64: dts: rockchip: Move drive-impedance-ohm to emmc phy on rk3399 Smith, Kyle Miller (Nimble Kernel) (1): nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags Song Liu (1): ftrace: Clean up hash direct_functions on register failures Stefan Wahren (4): thermal/drivers/bcm2711: Don't clamp temperature at zero ARM: dts: bcm2835-rpi-b: Fix GPIO line names gpiolib: of: Introduce hook for missing gpio-ranges pinctrl: bcm2835: implement hook for missing gpio-ranges Steve French (1): SMB3: EBADF/EIO errors in rename/open caused by race condition in smb2_compound_op Steven Price (1): drm/plane: Move range check for format_count earlier Takashi Iwai (1): ALSA: usb-audio: Cancel pending work at closing a MIDI substream Tali Perry (2): i2c: npcm: Fix timeout calculation i2c: npcm: Handle spurious interrupts Tejas Upadhyay (1): iommu/vt-d: Add RPLS to quirk list to skip TE disabling Tejun Heo (1): blk-iolatency: Fix inflight count imbalances and IO hangs on offline Tetsuo Handa (1): media: imon: reorganize serialization Theodore Ts'o (1): ext4: filter out EXT4_FC_REPLAY from on-disk superblock field s_state Thibaut VARÈNE (1): ath9k: fix QCA9561 PA bias level Thorsten Scherer (1): ARM: dts: ci4x10: Adapt to changes in imx6qdl.dtsi regarding fec clocks Tokunori Ikegami (2): mtd: cfi_cmdset_0002: Move and rename chip_check/chip_ready/chip_good_for_write mtd: cfi_cmdset_0002: Use chip_ready() for write on S29GL064N Tong Tiangen (1): arm64: fix types in copy_highpage() Trond Myklebust (5): NFS: Do not report EINTR/ERESTARTSYS as mapping errors NFS: fsync() should report filesystem errors over EINTR/ERESTARTSYS NFS: Do not report flush errors in nfs_write_end() NFS: Don't report errors from nfs_pageio_complete() more than once NFSv4/pNFS: Do not fail I/O when we fail to allocate the pNFS layout Tyler Hicks (1): EDAC/dmc520: Don't print an error for each unconfigured interrupt line Tyrone Ting (1): i2c: npcm: Correct register access width Tzung-Bi Shih (1): platform/chrome: cros_ec: fix error handling in cros_ec_register() Vasily Averin (1): tracing: incorrect isolate_mote_t cast in mm_vmscan_lru_isolate Vignesh Raghavendra (1): drivers: mmc: sdhci_am654: Add the quirk to set TESTCD bit Vincent Mailhol (1): can: mcp251xfd: silence clang's -Wunaligned-access warning Vincent Whitchurch (1): um: Fix out-of-bounds read in LDT setup Vinod Polimera (1): drm/msm/disp/dpu1: set vbif hw config to NULL to avoid use after memory free during pm runtime resume Viresh Kumar (1): Revert "cpufreq: Fix possible race in cpufreq online error path" Waiman Long (2): ipc/mqueue: use get_tree_nodev() in mqueue_get_tree() kseltest/cgroup: Make test_stress.sh work if run interactively Wenli Looi (1): ath9k: fix ar9003_get_eepmisc Xiao Yang (1): RDMA/rxe: Generate a completion for unsupported/invalid opcode Xiaomeng Tong (11): media: uvcvideo: Fix missing check to determine if element is found in list scsi: dc395x: Fix a missing check on list iterator drm/nouveau/clk: Fix an incorrect NULL check on list iterator drm/nouveau/kms/nv50-: atom: fix an incorrect NULL check on list iterator md: fix an incorrect NULL check in does_sb_need_changing md: fix an incorrect NULL check in md_reload_sb iommu/msm: Fix an incorrect NULL check on list iterator carl9170: tx: fix an incorrect use of list iterator stm: ltdc: fix two incorrect NULL checks on list iterator tilcdc: tilcdc_external: fix an incorrect NULL check on list iterator gma500: fix an incorrect NULL check on list iterator Xie Yongji (1): nbd: Fix hung on disconnect request if socket is closed before Yang Jihong (1): perf tools: Add missing headers needed by util/data.h Yang Yingliang (10): pinctrl: renesas: rzn1: Fix possible null-ptr-deref in sh_pfc_map_resources() mtd: rawnand: cadence: fix possible null-ptr-deref in cadence_nand_dt_probe() drm/msm/hdmi: check return value after calling platform_get_resource_byname() drm/rockchip: vop: fix possible null-ptr-deref in vop_bind() spi: spi-fsl-qspi: check return value after calling platform_get_resource_byname() thermal/core: Fix memory leak in __thermal_cooling_device_register() ASoC: wm2000: fix missing clk_disable_unprepare() on error in wm2000_anc_transition() pinctrl: renesas: core: Fix possible null-ptr-deref in sh_pfc_map_resources() hwrng: omap3-rom - fix using wrong clk_disable() in omap_rom_rng_runtime_resume() mfd: davinci_voicecodec: Fix possible null-ptr-deref davinci_vc_probe() Yi Yang (1): xtensa/simdisk: fix proc_read_simdisk() Yicong Yang (1): PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store() Ying Hsu (1): Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout Yong Wu (1): iommu/mediatek: Add list_del in mtk_iommu_remove Yonghong Song (1): selftests/bpf: fix btf_dump/btf_dump due to recent clang change Yongzhi Liu (1): hv_netvsc: Fix potential dereference of NULL pointer Yuntao Wang (1): bpf: Fix excessive memory allocation in stack_map_alloc() Zev Weiss (1): regulator: core: Fix enable_count imbalance with EXCLUSIVE_GET Zheng Yongjun (2): spi: img-spfi: Fix pm_runtime_get_sync() error checking thermal/drivers/broadcom: Fix potential NULL dereference in sr_thermal_probe Zheng Zengkai (1): sched/fair: Fix kabi broken in struct cfs_rq Zhengjun Xing (1): perf jevents: Fix event syntax error caused by ExtSel Zheyu Ma (3): media: pci: cx23885: Fix the error handling in cx23885_initdev() media: cx25821: Fix the warning when removing the module mtd: rawnand: denali: Use managed device resources Zhou Qingyang (1): drm/komeda: Fix an undefined behavior bug in komeda_plane_add() Zixuan Fu (1): fs: jfs: fix possible NULL pointer dereference in dbFree() Ziyang Xuan (1): thermal/core: fix a UAF bug in __thermal_cooling_device_register() jianghaoran (1): ipv6: Don't send rs packets to the interface of ARPHRD_TUNNEL liuyacan (1): net/smc: postpone sk_refcnt increment in connect() Documentation/conf.py | 2 +- .../bindings/display/sitronix,st7735r.yaml | 1 + .../devicetree/bindings/gpio/gpio-altera.txt | 5 +- .../bindings/spi/qcom,spi-qcom-qspi.yaml | 1 + arch/arm/boot/dts/bcm2835-rpi-b.dts | 13 +- arch/arm/boot/dts/bcm2835-rpi-zero-w.dts | 22 +- arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts | 2 +- arch/arm/boot/dts/bcm2837-rpi-cm3-io3.dts | 4 +- arch/arm/boot/dts/exynos5250-smdk5250.dts | 4 +- arch/arm/boot/dts/imx6dl-eckelmann-ci4x10.dts | 6 +- arch/arm/boot/dts/imx6qdl-colibri.dtsi | 6 +- arch/arm/boot/dts/ox820.dtsi | 2 +- arch/arm/boot/dts/s5pv210-aries.dtsi | 3 +- arch/arm/boot/dts/s5pv210.dtsi | 12 +- .../boot/dts/stm32mp15xx-dhcor-avenger96.dtsi | 1 + arch/arm/boot/dts/suniv-f1c100s.dtsi | 4 +- arch/arm/mach-hisi/platsmp.c | 4 + arch/arm/mach-mediatek/Kconfig | 1 + arch/arm/mach-omap1/clock.c | 2 +- arch/arm/mach-pxa/cm-x300.c | 8 +- arch/arm/mach-pxa/magician.c | 2 +- arch/arm/mach-pxa/tosa.c | 4 +- arch/arm/mach-vexpress/dcscb.c | 1 + arch/arm64/Kconfig.platforms | 1 + arch/arm64/boot/dts/qcom/ipq8074.dtsi | 2 +- arch/arm64/boot/dts/qcom/msm8994.dtsi | 4 +- arch/arm64/boot/dts/rockchip/rk3399.dtsi | 2 +- arch/arm64/kernel/sys_compat.c | 2 +- arch/arm64/mm/copypage.c | 4 +- arch/csky/kernel/probes/kprobes.c | 2 +- arch/m68k/Kconfig.cpu | 2 +- arch/m68k/include/asm/raw_io.h | 6 +- .../asm/mach-ip27/cpu-feature-overrides.h | 1 - .../asm/mach-ip30/cpu-feature-overrides.h | 1 - arch/openrisc/include/asm/timex.h | 1 + arch/openrisc/kernel/head.S | 9 + arch/parisc/include/asm/fb.h | 4 + arch/powerpc/include/asm/page.h | 7 +- arch/powerpc/include/asm/vas.h | 2 +- arch/powerpc/kernel/fadump.c | 8 +- arch/powerpc/kernel/idle.c | 2 +- arch/powerpc/perf/isa207-common.c | 3 +- arch/powerpc/platforms/4xx/cpm.c | 2 +- arch/powerpc/platforms/8xx/cpm1.c | 1 + arch/powerpc/platforms/powernv/opal-fadump.c | 94 ++++---- arch/powerpc/platforms/powernv/opal-fadump.h | 10 +- arch/powerpc/platforms/powernv/ultravisor.c | 1 + arch/powerpc/platforms/powernv/vas-fault.c | 2 +- arch/powerpc/platforms/powernv/vas-window.c | 4 +- arch/powerpc/platforms/powernv/vas.h | 2 +- arch/powerpc/sysdev/dart_iommu.c | 6 +- arch/powerpc/sysdev/fsl_rio.c | 2 + arch/powerpc/sysdev/xics/icp-opal.c | 1 + arch/riscv/include/asm/irq_work.h | 2 +- arch/riscv/kernel/head.S | 1 + arch/s390/include/asm/preempt.h | 15 +- arch/s390/kernel/perf_event.c | 2 +- arch/um/drivers/chan_user.c | 9 +- arch/um/include/asm/thread_info.h | 2 + arch/um/kernel/exec.c | 2 +- arch/um/kernel/process.c | 2 +- arch/um/kernel/ptrace.c | 8 +- arch/um/kernel/signal.c | 4 +- arch/x86/Kconfig | 4 +- arch/x86/entry/entry_64.S | 1 + arch/x86/entry/vdso/vma.c | 2 +- arch/x86/events/amd/ibs.c | 55 ++++- arch/x86/events/intel/core.c | 2 +- arch/x86/include/asm/acenv.h | 14 +- arch/x86/include/asm/suspend_32.h | 2 +- arch/x86/include/asm/suspend_64.h | 12 +- arch/x86/kernel/apic/apic.c | 2 +- arch/x86/kernel/apic/x2apic_uv_x.c | 8 +- arch/x86/kernel/cpu/intel.c | 2 +- arch/x86/kernel/cpu/mce/amd.c | 32 +-- arch/x86/kernel/step.c | 3 +- arch/x86/kernel/sys_x86_64.c | 7 +- arch/x86/kvm/vmx/nested.c | 45 +++- arch/x86/kvm/vmx/vmcs.h | 5 + arch/x86/lib/delay.c | 4 +- arch/x86/mm/pat/memtype.c | 2 +- arch/x86/um/ldt.c | 6 +- arch/xtensa/kernel/ptrace.c | 4 +- arch/xtensa/kernel/signal.c | 4 +- arch/xtensa/platforms/iss/simdisk.c | 18 +- block/bfq-cgroup.c | 36 ++- block/bfq-iosched.c | 36 ++- block/bfq-iosched.h | 1 + block/blk-cgroup.c | 8 +- block/blk-iolatency.c | 122 +++++----- crypto/cryptd.c | 23 +- drivers/acpi/property.c | 18 +- drivers/acpi/sleep.c | 12 + drivers/base/memory.c | 5 +- drivers/base/node.c | 1 + drivers/block/drbd/drbd_main.c | 11 +- drivers/block/nbd.c | 13 +- drivers/block/virtio_blk.c | 7 +- drivers/char/hw_random/omap3-rom-rng.c | 2 +- drivers/char/ipmi/ipmi_msghandler.c | 4 +- drivers/char/ipmi/ipmi_ssif.c | 23 ++ drivers/char/random.c | 12 +- drivers/cpufreq/mediatek-cpufreq.c | 19 +- .../allwinner/sun8i-ss/sun8i-ss-cipher.c | 115 ++++++--- .../crypto/allwinner/sun8i-ss/sun8i-ss-core.c | 30 ++- .../crypto/allwinner/sun8i-ss/sun8i-ss-hash.c | 10 +- drivers/crypto/allwinner/sun8i-ss/sun8i-ss.h | 14 +- drivers/crypto/ccree/cc_buffer_mgr.c | 27 ++- drivers/crypto/marvell/cesa/cipher.c | 1 - drivers/crypto/nx/nx-common-powernv.c | 2 +- drivers/devfreq/rk3399_dmc.c | 2 + drivers/dma/idxd/cdev.c | 8 +- drivers/dma/stm32-mdma.c | 87 ++++--- drivers/edac/dmc520_edac.c | 2 +- drivers/firmware/arm_scmi/base.c | 2 +- drivers/gpio/gpiolib-of.c | 5 + drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c | 3 +- drivers/gpu/drm/amd/pm/powerplay/kv_dpm.c | 14 +- drivers/gpu/drm/amd/pm/powerplay/si_dpm.c | 8 +- .../gpu/drm/arm/display/komeda/komeda_plane.c | 10 +- drivers/gpu/drm/arm/malidp_crtc.c | 5 +- drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 1 + .../drm/bridge/analogix/analogix_dp_core.c | 31 ++- drivers/gpu/drm/drm_edid.c | 6 +- drivers/gpu/drm/drm_plane.c | 14 +- drivers/gpu/drm/etnaviv/etnaviv_mmu.c | 6 + drivers/gpu/drm/gma500/psb_intel_display.c | 7 +- drivers/gpu/drm/i915/display/intel_dsi_vbt.c | 33 ++- drivers/gpu/drm/i915/i915_perf.c | 4 +- drivers/gpu/drm/i915/i915_perf_types.h | 2 +- drivers/gpu/drm/ingenic/ingenic-drm-drv.c | 61 ++++- drivers/gpu/drm/mediatek/mtk_cec.c | 2 +- drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 1 + drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c | 1 + drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 8 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c | 14 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_kms.c | 6 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.c | 15 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.h | 4 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c | 15 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h | 2 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c | 20 +- drivers/gpu/drm/msm/dp/dp_display.c | 55 +++-- drivers/gpu/drm/msm/dsi/dsi_host.c | 21 +- drivers/gpu/drm/msm/hdmi/hdmi.c | 10 +- drivers/gpu/drm/msm/msm_drv.c | 1 + drivers/gpu/drm/msm/msm_gem_prime.c | 2 +- drivers/gpu/drm/nouveau/dispnv50/atom.h | 6 +- drivers/gpu/drm/nouveau/dispnv50/crc.c | 27 ++- .../gpu/drm/nouveau/nvkm/subdev/clk/base.c | 6 +- drivers/gpu/drm/panel/panel-simple.c | 3 +- drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 2 +- drivers/gpu/drm/stm/ltdc.c | 16 +- drivers/gpu/drm/tilcdc/tilcdc_external.c | 8 +- drivers/gpu/drm/vc4/vc4_hvs.c | 26 ++- drivers/gpu/drm/vc4/vc4_txp.c | 8 +- drivers/gpu/drm/virtio/virtgpu_display.c | 2 + drivers/hid/hid-bigbenff.c | 6 + drivers/hid/hid-elan.c | 2 - drivers/hid/hid-led.c | 2 +- drivers/hwtracing/coresight/coresight-core.c | 33 ++- drivers/i2c/busses/i2c-at91-master.c | 11 + drivers/i2c/busses/i2c-npcm7xx.c | 103 +++++--- drivers/i2c/busses/i2c-rcar.c | 15 +- drivers/infiniband/hw/hfi1/file_ops.c | 2 + drivers/infiniband/hw/hfi1/init.c | 2 +- drivers/infiniband/hw/hfi1/sdma.c | 12 +- drivers/infiniband/sw/rdmavt/qp.c | 6 +- drivers/infiniband/sw/rxe/rxe_req.c | 2 +- drivers/input/misc/sparcspkr.c | 1 + drivers/input/touchscreen/stmfts.c | 16 +- drivers/iommu/amd/init.c | 2 +- drivers/iommu/intel/iommu.c | 2 +- drivers/iommu/msm_iommu.c | 11 +- drivers/iommu/mtk_iommu.c | 3 +- drivers/irqchip/irq-armada-370-xp.c | 11 +- drivers/irqchip/irq-aspeed-i2c-ic.c | 4 +- drivers/irqchip/irq-aspeed-scu-ic.c | 4 +- drivers/irqchip/irq-sni-exiu.c | 25 +- drivers/irqchip/irq-xtensa-mx.c | 18 +- drivers/macintosh/Kconfig | 6 + drivers/macintosh/Makefile | 3 +- drivers/macintosh/via-pmu.c | 2 +- drivers/mailbox/mailbox.c | 19 +- drivers/md/md-bitmap.c | 44 ++-- drivers/md/md.c | 18 +- drivers/media/cec/core/cec-adap.c | 6 +- drivers/media/i2c/ov7670.c | 1 - drivers/media/pci/cx23885/cx23885-core.c | 6 +- drivers/media/pci/cx25821/cx25821-core.c | 2 +- drivers/media/platform/aspeed-video.c | 4 +- drivers/media/platform/coda/coda-common.c | 35 ++- drivers/media/platform/exynos4-is/fimc-is.c | 6 +- .../platform/exynos4-is/fimc-isp-video.h | 2 +- drivers/media/platform/qcom/venus/hfi.c | 3 + drivers/media/platform/rockchip/rga/rga.c | 6 +- drivers/media/platform/sti/delta/delta-v4l2.c | 6 +- drivers/media/platform/vsp1/vsp1_rpf.c | 6 +- drivers/media/rc/imon.c | 99 ++++---- drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 7 +- drivers/media/usb/uvc/uvc_v4l2.c | 20 +- drivers/memory/samsung/exynos5422-dmc.c | 5 +- drivers/mfd/davinci_voicecodec.c | 6 +- drivers/mfd/ipaq-micro.c | 2 +- drivers/misc/ocxl/file.c | 2 + drivers/mmc/host/jz4740_mmc.c | 20 ++ drivers/mmc/host/sdhci_am654.c | 23 +- drivers/mtd/chips/cfi_cmdset_0002.c | 103 ++++---- .../mtd/nand/raw/cadence-nand-controller.c | 5 +- drivers/mtd/nand/raw/denali_pci.c | 15 +- drivers/mtd/spi-nor/core.c | 9 + drivers/net/can/spi/mcp251xfd/mcp251xfd.h | 2 +- drivers/net/can/xilinx_can.c | 4 +- drivers/net/dsa/mt7530.c | 14 +- drivers/net/ethernet/broadcom/Makefile | 5 + .../chelsio/inline_crypto/chtls/chtls_cm.c | 2 +- .../net/ethernet/mellanox/mlx5/core/fs_core.c | 10 +- .../ethernet/mellanox/mlxsw/core_thermal.c | 2 +- .../ethernet/mellanox/mlxsw/spectrum_dcb.c | 13 -- .../ethernet/mellanox/mlxsw/spectrum_trap.c | 2 +- drivers/net/ethernet/sfc/ef10.c | 2 +- .../stmicro/stmmac/stmmac_selftests.c | 15 +- drivers/net/hyperv/netvsc_drv.c | 5 +- drivers/net/ipa/ipa_endpoint.c | 4 +- drivers/net/phy/micrel.c | 11 +- drivers/net/wireguard/socket.c | 4 +- drivers/net/wireless/ath/ath10k/mac.c | 20 +- drivers/net/wireless/ath/ath11k/mac.c | 16 +- drivers/net/wireless/ath/ath11k/spectral.c | 17 +- .../net/wireless/ath/ath9k/ar9003_eeprom.c | 2 +- drivers/net/wireless/ath/ath9k/ar9003_phy.h | 2 +- drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 8 + drivers/net/wireless/ath/carl9170/tx.c | 3 + drivers/net/wireless/broadcom/b43/phy_n.c | 2 +- drivers/net/wireless/broadcom/b43legacy/phy.c | 2 +- .../net/wireless/intel/ipw2x00/libipw_tx.c | 2 +- .../net/wireless/intel/iwlwifi/mvm/power.c | 3 + drivers/net/wireless/marvell/mwifiex/11h.c | 2 + .../wireless/realtek/rtl818x/rtl8180/dev.c | 8 +- drivers/net/wireless/realtek/rtlwifi/usb.c | 2 +- drivers/nfc/st21nfca/se.c | 17 +- drivers/nfc/st21nfca/st21nfca.h | 1 + drivers/nvdimm/core.c | 9 - drivers/nvdimm/security.c | 5 - drivers/nvme/host/core.c | 2 +- drivers/nvme/host/pci.c | 1 + drivers/of/overlay.c | 4 +- drivers/opp/of.c | 2 +- .../pci/controller/cadence/pcie-cadence-ep.c | 3 +- drivers/pci/controller/dwc/pci-imx6.c | 23 +- .../pci/controller/dwc/pcie-designware-host.c | 3 +- drivers/pci/controller/dwc/pcie-qcom.c | 9 +- drivers/pci/controller/pcie-rockchip-ep.c | 3 +- drivers/pci/pci.c | 12 +- drivers/pci/pcie/aer.c | 7 +- drivers/phy/qualcomm/phy-qcom-qmp.c | 11 +- drivers/pinctrl/bcm/pinctrl-bcm2835.c | 18 ++ drivers/pinctrl/mvebu/pinctrl-armada-37xx.c | 2 +- drivers/pinctrl/renesas/core.c | 7 +- drivers/pinctrl/renesas/pinctrl-rzn1.c | 10 +- drivers/platform/chrome/cros_ec.c | 16 +- drivers/platform/chrome/cros_ec_chardev.c | 2 +- drivers/platform/chrome/cros_ec_proto.c | 50 +++- drivers/platform/mips/cpu_hwmon.c | 127 ++++------ drivers/regulator/core.c | 7 +- drivers/regulator/pfuze100-regulator.c | 2 + drivers/regulator/qcom_smd-regulator.c | 35 ++- drivers/scsi/dc395x.c | 15 +- drivers/scsi/lpfc/lpfc_sli.c | 6 +- drivers/scsi/megaraid.c | 2 +- drivers/scsi/ufs/ti-j721e-ufs.c | 6 +- drivers/scsi/ufs/ufs-qcom.c | 14 +- drivers/scsi/ufs/ufshcd.c | 7 +- drivers/soc/qcom/llcc-qcom.c | 1 + drivers/soc/qcom/smp2p.c | 1 + drivers/soc/qcom/smsm.c | 1 + drivers/soc/ti/ti_sci_pm_domains.c | 2 + drivers/spi/spi-fsl-qspi.c | 4 + drivers/spi/spi-img-spfi.c | 2 +- drivers/spi/spi-rspi.c | 15 +- drivers/spi/spi-stm32-qspi.c | 3 +- drivers/spi/spi-ti-qspi.c | 5 +- drivers/staging/media/hantro/hantro_v4l2.c | 8 +- drivers/staging/media/rkvdec/rkvdec-h264.c | 37 ++- drivers/staging/media/rkvdec/rkvdec.c | 4 +- drivers/target/target_core_device.c | 1 - drivers/thermal/broadcom/bcm2711_thermal.c | 5 +- drivers/thermal/broadcom/sr-thermal.c | 3 + drivers/thermal/imx_sc_thermal.c | 6 +- drivers/thermal/thermal_core.c | 42 ++-- drivers/tty/serial/pch_uart.c | 27 +-- drivers/usb/core/hcd.c | 29 ++- drivers/usb/core/quirks.c | 3 + drivers/usb/dwc3/gadget.c | 6 +- drivers/usb/host/xhci-pci.c | 2 + drivers/usb/serial/option.c | 2 + drivers/vdpa/vdpa_sim/vdpa_sim.c | 5 +- drivers/video/console/sticon.c | 5 +- drivers/video/console/sticore.c | 32 ++- drivers/video/fbdev/amba-clcd.c | 5 +- drivers/video/fbdev/core/fbcon.c | 5 +- drivers/video/fbdev/sticore.h | 3 + drivers/video/fbdev/stifb.c | 4 +- fs/afs/rxrpc.c | 8 +- fs/binfmt_flat.c | 27 ++- fs/btrfs/disk-io.c | 4 +- fs/btrfs/volumes.c | 8 +- fs/cifs/smb2inode.c | 2 - fs/cifs/smb2ops.c | 2 +- fs/dax.c | 3 +- fs/dlm/lock.c | 11 +- fs/dlm/plock.c | 12 +- fs/ext4/ext4.h | 6 - fs/ext4/namei.c | 54 +++-- fs/ext4/super.c | 24 +- fs/f2fs/f2fs.h | 19 +- fs/f2fs/file.c | 20 +- fs/f2fs/inline.c | 29 ++- fs/f2fs/inode.c | 19 +- fs/f2fs/segment.c | 42 ++-- fs/f2fs/segment.h | 33 ++- fs/f2fs/super.c | 6 +- fs/fat/fatent.c | 7 +- fs/gfs2/quota.c | 32 ++- fs/iomap/buffered-io.c | 3 +- fs/jfs/jfs_dmap.c | 3 +- fs/nfs/file.c | 16 +- fs/nfs/pnfs.c | 2 + fs/nfs/write.c | 11 +- fs/notify/mark.c | 6 +- fs/ocfs2/dlmfs/userdlm.c | 16 +- fs/proc/generic.c | 3 + fs/proc/proc_net.c | 3 + fs/xfs/libxfs/xfs_btree.c | 35 ++- fs/xfs/xfs_dquot.c | 39 +++- fs/xfs/xfs_iomap.c | 3 + fs/xfs/xfs_log.c | 28 ++- fs/xfs/xfs_log.h | 1 + fs/xfs/xfs_mount.c | 3 +- fs/xfs/xfs_symlink.c | 1 + include/linux/bpf.h | 2 + include/linux/efi.h | 2 + include/linux/font.h | 2 +- include/linux/gpio/driver.h | 12 + include/linux/lsm_hook_defs.h | 4 +- include/linux/lsm_hooks.h | 2 +- include/linux/mailbox_controller.h | 1 + include/linux/mtd/cfi.h | 1 + include/linux/nodemask.h | 13 +- include/linux/platform_data/cros_ec_proto.h | 3 + include/linux/ptrace.h | 7 - include/linux/security.h | 23 +- include/linux/thermal.h | 2 +- include/linux/usb/hcd.h | 2 + include/net/bluetooth/hci.h | 16 +- include/net/bluetooth/hci_core.h | 18 +- include/net/flow.h | 10 + include/net/if_inet6.h | 8 + include/net/route.h | 6 +- include/sound/jack.h | 1 + include/trace/events/rxrpc.h | 2 +- include/trace/events/vmscan.h | 4 +- init/Kconfig | 5 + ipc/mqueue.c | 14 ++ kernel/bpf/stackmap.c | 1 - kernel/dma/debug.c | 2 +- kernel/ptrace.c | 5 +- kernel/rcu/Kconfig | 1 + kernel/rcu/tasks.h | 3 + kernel/scftorture.c | 5 +- kernel/sched/fair.c | 8 +- kernel/sched/pelt.h | 4 +- kernel/sched/sched.h | 4 +- kernel/trace/ftrace.c | 5 +- kernel/trace/trace_events_hist.c | 3 + mm/compaction.c | 2 + mm/hugetlb.c | 9 +- net/bluetooth/hci_conn.c | 8 +- net/bluetooth/hci_core.c | 27 ++- net/bluetooth/hci_debugfs.c | 8 +- net/bluetooth/hci_event.c | 91 ++++---- net/bluetooth/hci_request.c | 221 ++++++++++++++---- net/bluetooth/hci_sock.c | 12 +- net/bluetooth/l2cap_core.c | 10 +- net/bluetooth/mgmt.c | 14 +- net/bluetooth/mgmt_config.c | 10 + net/bluetooth/sco.c | 21 +- net/bluetooth/smp.c | 6 +- net/core/dev.c | 8 +- net/dccp/ipv4.c | 2 +- net/dccp/ipv6.c | 6 +- net/ipv4/icmp.c | 4 +- net/ipv4/inet_connection_sock.c | 4 +- net/ipv4/ip_output.c | 2 +- net/ipv4/ping.c | 2 +- net/ipv4/raw.c | 2 +- net/ipv4/syncookies.c | 2 +- net/ipv4/udp.c | 2 +- net/ipv6/addrconf.c | 33 ++- net/ipv6/af_inet6.c | 2 +- net/ipv6/datagram.c | 2 +- net/ipv6/icmp.c | 6 +- net/ipv6/inet6_connection_sock.c | 4 +- net/ipv6/netfilter/nf_reject_ipv6.c | 2 +- net/ipv6/ping.c | 2 +- net/ipv6/raw.c | 2 +- net/ipv6/syncookies.c | 2 +- net/ipv6/tcp_ipv6.c | 4 +- net/ipv6/udp.c | 2 +- net/l2tp/l2tp_ip6.c | 2 +- net/mac80211/chan.c | 7 +- net/mac80211/ieee80211_i.h | 5 + net/mac80211/scan.c | 20 ++ net/netfilter/nf_synproxy_core.c | 2 +- net/nfc/core.c | 1 + net/rxrpc/ar-internal.h | 13 +- net/rxrpc/call_event.c | 7 +- net/rxrpc/conn_object.c | 2 +- net/rxrpc/input.c | 31 ++- net/rxrpc/output.c | 20 +- net/rxrpc/recvmsg.c | 8 +- net/rxrpc/sendmsg.c | 6 + net/rxrpc/sysctl.c | 4 +- net/sctp/input.c | 4 +- net/smc/af_smc.c | 2 +- net/wireless/nl80211.c | 1 + net/wireless/reg.c | 4 + net/xfrm/xfrm_state.c | 6 +- scripts/faddr2line | 150 +++++++----- security/integrity/ima/Kconfig | 14 +- .../platform_certs/keyring_handler.h | 8 + security/integrity/platform_certs/load_uefi.c | 33 +++ security/security.c | 17 +- security/selinux/hooks.c | 4 +- security/selinux/include/xfrm.h | 2 +- security/selinux/xfrm.c | 13 +- sound/core/jack.c | 34 ++- sound/core/pcm_memory.c | 3 +- sound/pci/hda/patch_realtek.c | 11 + sound/soc/atmel/atmel-classd.c | 1 - sound/soc/atmel/atmel-pdmic.c | 1 - sound/soc/codecs/Kconfig | 2 - sound/soc/codecs/max98090.c | 6 +- sound/soc/codecs/rk3328_codec.c | 2 +- sound/soc/codecs/rt5514.c | 2 +- sound/soc/codecs/rt5645.c | 7 +- sound/soc/codecs/tscs454.c | 12 +- sound/soc/codecs/wm2000.c | 6 +- sound/soc/fsl/imx-sgtl5000.c | 14 +- sound/soc/intel/boards/bytcr_rt5640.c | 12 + sound/soc/mediatek/mt2701/mt2701-wm8960.c | 9 +- sound/soc/mediatek/mt8173/mt8173-max98090.c | 5 +- sound/soc/mxs/mxs-saif.c | 1 + sound/soc/samsung/aries_wm8994.c | 17 +- sound/soc/samsung/arndale.c | 5 +- sound/soc/samsung/littlemill.c | 5 +- sound/soc/samsung/lowland.c | 5 +- sound/soc/samsung/odroid.c | 4 +- sound/soc/samsung/smdk_wm8994.c | 4 +- sound/soc/samsung/smdk_wm8994pcm.c | 4 +- sound/soc/samsung/snow.c | 9 +- sound/soc/samsung/speyside.c | 5 +- sound/soc/samsung/tm2_wm5110.c | 3 +- sound/soc/samsung/tobermory.c | 5 +- sound/soc/soc-dapm.c | 2 - sound/soc/ti/j721e-evm.c | 44 +++- sound/usb/midi.c | 3 + tools/lib/bpf/libbpf.c | 20 +- tools/perf/Makefile.config | 39 +++- tools/perf/builtin-c2c.c | 6 +- tools/perf/pmu-events/jevents.c | 2 +- tools/perf/util/data.h | 1 + tools/power/x86/turbostat/turbostat.c | 1 + .../bpf/progs/btf_dump_test_case_syntax.c | 2 +- tools/testing/selftests/cgroup/test_stress.sh | 2 +- tools/testing/selftests/resctrl/fill_buf.c | 4 +- 477 files changed, 3474 insertions(+), 1907 deletions(-) -- 2.20.1

1 427

[PATCH 1/4] perf/core: Provide a kernel-internal interface to recalibrate event period
by Laibin Qiu 27 Sep '22

27 Sep '22

From: Like Xu <like.xu(a)linux.intel.com> mainline inclusion from mainline-v5.4 commit 3ca270fc9edb258d5bfa271bcf851614e9e6e7d4 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I5SDUS CVE: NA ------------- Currently, perf_event_period() is used by user tools via ioctl. Based on naming convention, exporting perf_event_period() for kernel users (such as KVM) who may recalibrate the event period for their assigned counter according to their requirements. The perf_event_period() is an external accessor, just like the perf_event_{en,dis}able() and should thus use perf_event_ctx_lock(). Suggested-by: Kan Liang <kan.liang(a)linux.intel.com> Signed-off-by: Like Xu <like.xu(a)linux.intel.com> Acked-by: Peter Zijlstra <peterz(a)infradead.org> Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> Signed-off-by: Yanan Wang <wangyanan55(a)huawei.com> Reviewed-by: Zenghui Yu <yuzenghui(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> --- include/linux/perf_event.h | 5 +++++ kernel/events/core.c | 28 +++++++++++++++++++++------- 2 files changed, 26 insertions(+), 7 deletions(-) diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h index 41bc1d3b311f..514962a49c62 100644 --- a/include/linux/perf_event.h +++ b/include/linux/perf_event.h @@ -1336,6 +1336,7 @@ extern void perf_event_disable_local(struct perf_event *event); extern void perf_event_disable_inatomic(struct perf_event *event); extern void perf_event_task_tick(void); extern int perf_event_account_interrupt(struct perf_event *event); +extern int perf_event_period(struct perf_event *event, u64 value); #else /* !CONFIG_PERF_EVENTS: */ static inline void * perf_aux_output_begin(struct perf_output_handle *handle, @@ -1408,6 +1409,10 @@ static inline void perf_event_disable(struct perf_event *event) { } static inline int __perf_event_disable(void *info) { return -1; } static inline void perf_event_task_tick(void) { } static inline int perf_event_release_kernel(struct perf_event *event) { return 0; } +static inline int perf_event_period(struct perf_event *event, u64 value) +{ + return -EINVAL; +} #endif #if defined(CONFIG_PERF_EVENTS) && defined(CONFIG_CPU_SUP_INTEL) diff --git a/kernel/events/core.c b/kernel/events/core.c index 616cccf9c835..b1e4beb6931c 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -5034,16 +5034,11 @@ static int perf_event_check_period(struct perf_event *event, u64 value) return event->pmu->check_period(event, value); } -static int perf_event_period(struct perf_event *event, u64 __user *arg) +static int _perf_event_period(struct perf_event *event, u64 value) { - u64 value; - if (!is_sampling_event(event)) return -EINVAL; - if (copy_from_user(&value, arg, sizeof(value))) - return -EFAULT; - if (!value) return -EINVAL; @@ -5058,6 +5053,19 @@ static int perf_event_period(struct perf_event *event, u64 __user *arg) return 0; } +int perf_event_period(struct perf_event *event, u64 value) +{ + struct perf_event_context *ctx; + int ret; + + ctx = perf_event_ctx_lock(event); + ret = _perf_event_period(event, value); + perf_event_ctx_unlock(event, ctx); + + return ret; +} +EXPORT_SYMBOL_GPL(perf_event_period); + static const struct file_operations perf_fops; static inline int perf_fget_light(int fd, struct fd *p) @@ -5101,8 +5109,14 @@ static long _perf_ioctl(struct perf_event *event, unsigned int cmd, unsigned lon return _perf_event_refresh(event, arg); case PERF_EVENT_IOC_PERIOD: - return perf_event_period(event, (u64 __user *)arg); + { + u64 value; + + if (copy_from_user(&value, (u64 __user *)arg, sizeof(value))) + return -EFAULT; + return _perf_event_period(event, value); + } case PERF_EVENT_IOC_ID: { u64 id = primary_event_id(event); -- 2.25.1

1 3

[PATCH openEuler-1.0-LTS] media: em28xx: initialize refcount before kref_get
by Yongqiang Liu 27 Sep '22

27 Sep '22

From: Dongliang Mu <mudongliangabcd(a)gmail.com> stable inclusion from stable-v4.19.238 commit 0113fa98a49a8e46a19b0ad80f29c904c6feec23 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5RX5X CVE: CVE-2022-3239 --------------------------- [ Upstream commit c08eadca1bdfa099e20a32f8fa4b52b2f672236d ] The commit 47677e51e2a4("[media] em28xx: Only deallocate struct em28xx after finishing all extensions") adds kref_get to many init functions (e.g., em28xx_audio_init). However, kref_init is called too late in em28xx_usb_probe, since em28xx_init_dev before will invoke those init functions and call kref_get function. Then refcount bug occurs in my local syzkaller instance. Fix it by moving kref_init before em28xx_init_dev. This issue occurs not only in dev but also dev->dev_next. Fixes: 47677e51e2a4 ("[media] em28xx: Only deallocate struct em28xx after finishing all extensions") Reported-by: syzkaller <syzkaller(a)googlegroups.com> Signed-off-by: Dongliang Mu <mudongliangabcd(a)gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/media/usb/em28xx/em28xx-cards.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c index 3f59a98dbf9a..00a3b5768b9a 100644 --- a/drivers/media/usb/em28xx/em28xx-cards.c +++ b/drivers/media/usb/em28xx/em28xx-cards.c @@ -3816,6 +3816,8 @@ static int em28xx_usb_probe(struct usb_interface *intf, goto err_free; } + kref_init(&dev->ref); + dev->devno = nr; dev->model = id->driver_info; dev->alt = -1; @@ -3916,6 +3918,8 @@ static int em28xx_usb_probe(struct usb_interface *intf, } if (dev->board.has_dual_ts && em28xx_duplicate_dev(dev) == 0) { + kref_init(&dev->dev_next->ref); + dev->dev_next->ts = SECONDARY_TS; dev->dev_next->alt = -1; dev->dev_next->is_audio_only = has_vendor_audio && @@ -3970,12 +3974,8 @@ static int em28xx_usb_probe(struct usb_interface *intf, em28xx_write_reg(dev, 0x0b, 0x82); mdelay(100); } - - kref_init(&dev->dev_next->ref); } - kref_init(&dev->ref); - request_modules(dev); /* -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 1/6] efi: capsule-loader: Fix use-after-free in efi_capsule_write
by Yongqiang Liu 26 Sep '22

26 Sep '22

From: Hyunwoo Kim <imv4bel(a)gmail.com> mainline inclusion from mainline-v6.0-rc5 commit 9cb636b5f6a8cc6d1b50809ec8f8d33ae0c84c95 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5QI0W CVE: CVE-2022-40307 --------------------------- A race condition may occur if the user calls close() on another thread during a write() operation on the device node of the efi capsule. This is a race condition that occurs between the efi_capsule_write() and efi_capsule_flush() functions of efi_capsule_fops, which ultimately results in UAF. So, the page freeing process is modified to be done in efi_capsule_release() instead of efi_capsule_flush(). Cc: <stable(a)vger.kernel.org> # v4.9+ Signed-off-by: Hyunwoo Kim <imv4bel(a)gmail.com> Link: https://lore.kernel.org/all/20220907102920.GA88602@ubuntu/ Signed-off-by: Ard Biesheuvel <ardb(a)kernel.org> Signed-off-by: Xia Longlong <xialonglong1(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/firmware/efi/capsule-loader.c | 31 ++++++--------------------- 1 file changed, 7 insertions(+), 24 deletions(-) diff --git a/drivers/firmware/efi/capsule-loader.c b/drivers/firmware/efi/capsule-loader.c index 96688986da56..94aae1e67c99 100644 --- a/drivers/firmware/efi/capsule-loader.c +++ b/drivers/firmware/efi/capsule-loader.c @@ -243,29 +243,6 @@ static ssize_t efi_capsule_write(struct file *file, const char __user *buff, return ret; } -/** - * efi_capsule_flush - called by file close or file flush - * @file: file pointer - * @id: not used - * - * If a capsule is being partially uploaded then calling this function - * will be treated as upload termination and will free those completed - * buffer pages and -ECANCELED will be returned. - **/ -static int efi_capsule_flush(struct file *file, fl_owner_t id) -{ - int ret = 0; - struct capsule_info *cap_info = file->private_data; - - if (cap_info->index > 0) { - pr_err("capsule upload not complete\n"); - efi_free_all_buff_pages(cap_info); - ret = -ECANCELED; - } - - return ret; -} - /** * efi_capsule_release - called by file close * @inode: not used @@ -278,6 +255,13 @@ static int efi_capsule_release(struct inode *inode, struct file *file) { struct capsule_info *cap_info = file->private_data; + if (cap_info->index > 0 && + (cap_info->header.headersize == 0 || + cap_info->count < cap_info->total_size)) { + pr_err("capsule upload not complete\n"); + efi_free_all_buff_pages(cap_info); + } + kfree(cap_info->pages); kfree(cap_info->phys); kfree(file->private_data); @@ -325,7 +309,6 @@ static const struct file_operations efi_capsule_fops = { .owner = THIS_MODULE, .open = efi_capsule_open, .write = efi_capsule_write, - .flush = efi_capsule_flush, .release = efi_capsule_release, .llseek = no_llseek, }; -- 2.25.1

1 5

[PATCH] Memory model: Fix the memory model issues for Linux kernel
by Hanjun Guo 24 Sep '22

24 Sep '22

From: Jonas Oberhauser <jonas.oberhauser(a)huawei.com> This is the update and fixes for memory model, simplify the model by removing redundancies, making semantics of seq-cst explicit, making ppo a subset of po, making ppo locally computable, as well as eliminating several spurious bugs in qspinlock and litmus tests, and ensuring correct compilation to the official power model. These issues were detected by Jonas Oberhauser, Viktor Vafeiadis, and the authors of "Verifying and Optimizing Compact NUMA-Aware Locks on Weak Memory Models", and the solutions are proposed by Jonas Oberhauser and Viktor Vafeiadis. Please refer to this link on the web: https://static.sched.com/hosted_files/osseu2022/e1/oss-eu22-jonas.pdf Signed-off-by: Jonas Oberhauser <jonas.oberhauser(a)huawei.com> Signed-off-by: Hanjun Guo <guohanjun(a)huawei.com> --- tools/memory-model/linux-kernel.bell | 9 ++-- tools/memory-model/linux-kernel.cat | 100 +++++++++++++++++++---------------- tools/memory-model/linux-kernel.def | 34 ++++++------ 3 files changed, 77 insertions(+), 66 deletions(-) diff --git a/tools/memory-model/linux-kernel.bell b/tools/memory-model/linux-kernel.bell index 5be86b1..880b28b 100644 --- a/tools/memory-model/linux-kernel.bell +++ b/tools/memory-model/linux-kernel.bell @@ -4,6 +4,8 @@ * Copyright (C) 2016 Luc Maranget <luc.maranget(a)inria.fr> for Inria * Copyright (C) 2017 Alan Stern <stern(a)rowland.harvard.edu>, * Andrea Parri <parri.andrea(a)gmail.com> + * Copyright (C) 2022 Jonas Oberhauser <jonas.oberhauser(a)huawei.com> + * Viktor Vafeiadis <viktor(a)mpi-sws.org> * * An earlier version of this file appeared in the companion webpage for * "Frightening small children and disconcerting grown-ups: Concurrency @@ -16,10 +18,11 @@ enum Accesses = 'once (*READ_ONCE,WRITE_ONCE*) || 'release (*smp_store_release*) || 'acquire (*smp_load_acquire*) || + 'seq-cst (*smp_load, xchg...*) || 'noreturn (* R of non-return RMW *) -instructions R[{'once,'acquire,'noreturn}] -instructions W[{'once,'release}] -instructions RMW[{'once,'acquire,'release}] +instructions R[{'seq-cst, 'once,'acquire,'noreturn}] +instructions W[{'seq-cst, 'once,'release}] +instructions RMW[{'seq-cst, 'once,'acquire,'release}] enum Barriers = 'wmb (*smp_wmb*) || 'rmb (*smp_rmb*) || diff --git a/tools/memory-model/linux-kernel.cat b/tools/memory-model/linux-kernel.cat index d70315f..9f14d31 100644 --- a/tools/memory-model/linux-kernel.cat +++ b/tools/memory-model/linux-kernel.cat @@ -4,6 +4,8 @@ * Copyright (C) 2016 Luc Maranget <luc.maranget(a)inria.fr> for Inria * Copyright (C) 2017 Alan Stern <stern(a)rowland.harvard.edu>, * Andrea Parri <parri.andrea(a)gmail.com> + * Copyright (C) 2022 Jonas Oberhauser <jonas.oberhauser(a)huawei.com>, + * Viktor Vafeiadis <viktor(a)mpi-sws.org> * * An earlier version of this file appeared in the companion webpage for * "Frightening small children and disconcerting grown-ups: Concurrency @@ -25,25 +27,33 @@ include "lock.cat" (*******************) (* Release Acquire *) + let acq-po = [Acquire] ; po ; [M] let po-rel = [M] ; po ; [Release] let po-unlock-lock-po = po ; [UL] ; (po|rf) ; [LKR] ; po (* Fences *) -let R4rmb = R \ Noreturn (* Reads for which rmb works *) -let rmb = [R4rmb] ; fencerel(Rmb) ; [R4rmb] -let wmb = [W] ; fencerel(Wmb) ; [W] -let mb = ([M] ; fencerel(Mb) ; [M]) | - ([M] ; fencerel(Before-atomic) ; [RMW] ; po? ; [M]) | - ([M] ; po? ; [RMW] ; fencerel(After-atomic) ; [M]) | - ([M] ; po? ; [LKW] ; fencerel(After-spinlock) ; [M]) | - ([M] ; po ; [UL] ; (co | po) ; [LKW] ; - fencerel(After-unlock-lock) ; [M]) -let gp = po ; [Sync-rcu | Sync-srcu] ; po? -let strong-fence = mb | gp - +let R4rmb = R \ Noreturn +let rmb = [R4rmb] ; po ; [Rmb] ; po ; [R4rmb] +let wmb = [W] ; po ; [Wmb] ; po ; [W] + +let rmb-plain = [R \ Noreturn] ; po ; [Rmb] ; po \ ( po ; [W] ; po-loc) ; [R \ Noreturn] +let plain-wmb = [W] ; po \ (po-loc ; [W] ; po) ; [Wmb] ; po ; [W] +let strong-fence = + [M] ; po ; [Mb] ; po ; [M] + | [M] ; po ; [Before-atomic] ; po ; [RMW] ; po? ; [M] + | [M] ; po? ; [RMW] ; po ; [After-atomic] ; po ; [M] + | [M] ; po? ; [LKW] ; po ; [After-spinlock] ; po ; [M] + | [M] ; po ; [UL] ; po ; [LKR] ; po ; [After-unlock-lock] ; po ; [M] + | [M] ; po? ; [SC] ; po ; [M] + | [M] ; po ; [SC] ; po? ; [M] + | po ; [Sync-rcu | Sync-srcu] ; po? +let strong-sync = strong-fence + | ([M] ; po-unlock-lock-po ; [After-unlock-lock] ; po ; [M]) let nonrw-fence = strong-fence | po-rel | acq-po let fence = nonrw-fence | wmb | rmb + + let barrier = fencerel(Barrier | Rmb | Wmb | Mb | Sync-rcu | Sync-srcu | Before-atomic | After-atomic | Acquire | Release | Rcu-lock | Rcu-unlock | Srcu-lock | Srcu-unlock) | @@ -64,35 +74,33 @@ empty rmw & (fre ; coe) as atomic (* Instruction execution ordering *) (**********************************) + (* Preserved Program Order *) -let dep = addr | data -let rwdep = (dep | ctrl) ; [W] -let overwrite = co | fr -let to-w = rwdep | (overwrite & int) | (addr ; [Plain] ; wmb) -let to-r = addr | (dep ; [Marked] ; rfi) -let ppo = to-r | to-w | fence | (po-unlock-lock-po & int) +let dop = rmb-plain? ; (addr | data | ctrl | rfi)+; plain-wmb? +let to-w = (dop | po-loc) ; [W] +let lrs = ([W] ; po-loc ; [R]) \ (po-loc ; [W] ; po-loc) +let to-r = addr | ((addr | data) ; lrs) +let ppo = to-r | to-w | fence | (po ; [UL] ; po ; [LKR] ; po) (* Propagation: Ordering from release operations and strong fences. *) -let A-cumul(r) = (rfe ; [Marked])? ; r -let cumul-fence = [Marked] ; (A-cumul(strong-fence | po-rel) | wmb | - po-unlock-lock-po) ; [Marked] -let prop = [Marked] ; (overwrite & ext)? ; cumul-fence* ; - [Marked] ; rfe? ; [Marked] +let cumul-fence = [Marked] ; (rfe? ; (po-rel ; (rfe ; rmw)*) | wmb | po-unlock-lock-po) ; [Marked] +let prop = [Marked] ; ((co | fr) & ext) ; cumul-fence* ; [Marked] ; rfe? ; [Marked] + (* * Happens Before: Ordering from the passage of time. - * No fences needed here for prop because relation confined to one process. *) -let hb = [Marked] ; (ppo | rfe | ((prop \ id) & int)) ; [Marked] -acyclic hb as happens-before +let hb = [Marked] ; (ppo | rfe | prop ; strong-sync) ; [Marked] +acyclic hb + +(* No fences needed here for prop because relation confined to one process. *) +irreflexive (prop ; ppo*) + + + + -(****************************************) -(* Write and fence propagation ordering *) -(****************************************) -(* Propagation: Each non-rf link needs a strong fence. *) -let pb = prop ; strong-fence ; hb* ; [Marked] -acyclic pb as propagation (*******) (* RCU *) @@ -118,7 +126,7 @@ let srcu-rscsi = srcu-rscs^-1 * one but two non-rf relations, but only in conjunction with an RCU * read-side critical section. *) -let rcu-link = po? ; hb* ; pb* ; prop ; po +let rcu-link = po? ; hb* ; prop? ; po (* * Any sequence containing at least as many grace periods as RCU read-side @@ -139,20 +147,20 @@ let rec rcu-order = rcu-gp | srcu-gp | ((srcu-rscsi ; rcu-link ; rcu-order ; rcu-link ; srcu-gp) & loc) | (rcu-order ; rcu-link ; rcu-order) let rcu-fence = po ; rcu-order ; po? -let fence = fence | rcu-fence -let strong-fence = strong-fence | rcu-fence +let fence-rcu = fence | rcu-fence +let strong-sync-rcu = strong-sync | rcu-fence -(* rb orders instructions just as pb does *) -let rb = prop ; rcu-fence ; hb* ; pb* ; [Marked] +(* rb orders instructions just as hb does *) +let rb = prop? ; rcu-fence ; hb* ; [Marked] irreflexive rb as rcu (* - * The happens-before, propagation, and rcu constraints are all + * The happens-before and rcu constraints are all * expressions of temporal ordering. They could be replaced by * a single constraint on an "executes-before" relation, xb: * - * let xb = hb | pb | rb + * let xb = hb | rb * acyclic xb as executes-before *) @@ -166,24 +174,24 @@ let mixed-accesses = ([Plain & W] ; (po-loc \ barrier) ; [Marked]) | flag ~empty mixed-accesses as mixed-accesses (* Executes-before and visibility *) -let xbstar = (hb | pb | rb)* +let xbstar = (hb | rb)* let vis = cumul-fence* ; rfe? ; [Marked] ; - ((strong-fence ; [Marked] ; xbstar) | (xbstar & int)) + ((strong-sync-rcu ; [Marked] ; xbstar) | (xbstar & int)) (* Boundaries for lifetimes of plain accesses *) -let w-pre-bounded = [Marked] ; (addr | fence)? +let w-pre-bounded = [Marked] ; (addr | fence-rcu)? let r-pre-bounded = [Marked] ; (addr | nonrw-fence | ([R4rmb] ; fencerel(Rmb) ; [~Noreturn]))? -let w-post-bounded = fence? ; [Marked] +let w-post-bounded = fence-rcu? ; [Marked] let r-post-bounded = (nonrw-fence | ([~Noreturn] ; fencerel(Rmb) ; [R4rmb]))? ; [Marked] (* Visibility and executes-before for plain accesses *) -let ww-vis = fence | (strong-fence ; xbstar ; w-pre-bounded) | +let ww-vis = (strong-sync-rcu ; xbstar ; w-pre-bounded) | (w-post-bounded ; vis ; w-pre-bounded) -let wr-vis = fence | (strong-fence ; xbstar ; r-pre-bounded) | +let wr-vis = (strong-sync-rcu ; xbstar ; r-pre-bounded) | (w-post-bounded ; vis ; r-pre-bounded) -let rw-xbstar = fence | (r-post-bounded ; xbstar ; w-pre-bounded) +let rw-xbstar = (r-post-bounded ; xbstar ; w-pre-bounded) (* Potential races *) let pre-race = ext & ((Plain * M) | ((M \ IW) * Plain)) diff --git a/tools/memory-model/linux-kernel.def b/tools/memory-model/linux-kernel.def index ef0f3c1..df239c2 100644 --- a/tools/memory-model/linux-kernel.def +++ b/tools/memory-model/linux-kernel.def @@ -14,7 +14,7 @@ smp_store_release(X,V) { __store{release}(*X,V); } smp_load_acquire(X) __load{acquire}(*X) rcu_assign_pointer(X,V) { __store{release}(X,V); } rcu_dereference(X) __load{once}(X) -smp_store_mb(X,V) { __store{once}(X,V); __fence{mb}; } +smp_store_mb(X,V) { __store{seq-cst}(X,V); } // Fences smp_mb() { __fence{mb}; } @@ -27,11 +27,11 @@ smp_mb__after_unlock_lock() { __fence{after-unlock-lock}; } barrier() { __fence{barrier}; } // Exchange -xchg(X,V) __xchg{mb}(X,V) +xchg(X,V) __xchg{seq-cst}(X,V) xchg_relaxed(X,V) __xchg{once}(X,V) xchg_release(X,V) __xchg{release}(X,V) xchg_acquire(X,V) __xchg{acquire}(X,V) -cmpxchg(X,V,W) __cmpxchg{mb}(X,V,W) +cmpxchg(X,V,W) __cmpxchg{seq-cst}(X,V,W) cmpxchg_relaxed(X,V,W) __cmpxchg{once}(X,V,W) cmpxchg_acquire(X,V,W) __cmpxchg{acquire}(X,V,W) cmpxchg_release(X,V,W) __cmpxchg{release}(X,V,W) @@ -65,52 +65,52 @@ atomic_sub(V,X) { __atomic_op(X,-,V); } atomic_inc(X) { __atomic_op(X,+,1); } atomic_dec(X) { __atomic_op(X,-,1); } -atomic_add_return(V,X) __atomic_op_return{mb}(X,+,V) +atomic_add_return(V,X) __atomic_op_return{seq-cst}(X,+,V) atomic_add_return_relaxed(V,X) __atomic_op_return{once}(X,+,V) atomic_add_return_acquire(V,X) __atomic_op_return{acquire}(X,+,V) atomic_add_return_release(V,X) __atomic_op_return{release}(X,+,V) -atomic_fetch_add(V,X) __atomic_fetch_op{mb}(X,+,V) +atomic_fetch_add(V,X) __atomic_fetch_op{seq-cst}(X,+,V) atomic_fetch_add_relaxed(V,X) __atomic_fetch_op{once}(X,+,V) atomic_fetch_add_acquire(V,X) __atomic_fetch_op{acquire}(X,+,V) atomic_fetch_add_release(V,X) __atomic_fetch_op{release}(X,+,V) -atomic_inc_return(X) __atomic_op_return{mb}(X,+,1) +atomic_inc_return(X) __atomic_op_return{seq-cst}(X,+,1) atomic_inc_return_relaxed(X) __atomic_op_return{once}(X,+,1) atomic_inc_return_acquire(X) __atomic_op_return{acquire}(X,+,1) atomic_inc_return_release(X) __atomic_op_return{release}(X,+,1) -atomic_fetch_inc(X) __atomic_fetch_op{mb}(X,+,1) +atomic_fetch_inc(X) __atomic_fetch_op{seq-cst}(X,+,1) atomic_fetch_inc_relaxed(X) __atomic_fetch_op{once}(X,+,1) atomic_fetch_inc_acquire(X) __atomic_fetch_op{acquire}(X,+,1) atomic_fetch_inc_release(X) __atomic_fetch_op{release}(X,+,1) -atomic_sub_return(V,X) __atomic_op_return{mb}(X,-,V) +atomic_sub_return(V,X) __atomic_op_return{seq-cst}(X,-,V) atomic_sub_return_relaxed(V,X) __atomic_op_return{once}(X,-,V) atomic_sub_return_acquire(V,X) __atomic_op_return{acquire}(X,-,V) atomic_sub_return_release(V,X) __atomic_op_return{release}(X,-,V) -atomic_fetch_sub(V,X) __atomic_fetch_op{mb}(X,-,V) +atomic_fetch_sub(V,X) __atomic_fetch_op{seq-cst}(X,-,V) atomic_fetch_sub_relaxed(V,X) __atomic_fetch_op{once}(X,-,V) atomic_fetch_sub_acquire(V,X) __atomic_fetch_op{acquire}(X,-,V) atomic_fetch_sub_release(V,X) __atomic_fetch_op{release}(X,-,V) -atomic_dec_return(X) __atomic_op_return{mb}(X,-,1) +atomic_dec_return(X) __atomic_op_return{seq-cst}(X,-,1) atomic_dec_return_relaxed(X) __atomic_op_return{once}(X,-,1) atomic_dec_return_acquire(X) __atomic_op_return{acquire}(X,-,1) atomic_dec_return_release(X) __atomic_op_return{release}(X,-,1) -atomic_fetch_dec(X) __atomic_fetch_op{mb}(X,-,1) +atomic_fetch_dec(X) __atomic_fetch_op{seq-cst}(X,-,1) atomic_fetch_dec_relaxed(X) __atomic_fetch_op{once}(X,-,1) atomic_fetch_dec_acquire(X) __atomic_fetch_op{acquire}(X,-,1) atomic_fetch_dec_release(X) __atomic_fetch_op{release}(X,-,1) -atomic_xchg(X,V) __xchg{mb}(X,V) +atomic_xchg(X,V) __xchg{seq-cst}(X,V) atomic_xchg_relaxed(X,V) __xchg{once}(X,V) atomic_xchg_release(X,V) __xchg{release}(X,V) atomic_xchg_acquire(X,V) __xchg{acquire}(X,V) -atomic_cmpxchg(X,V,W) __cmpxchg{mb}(X,V,W) +atomic_cmpxchg(X,V,W) __cmpxchg{seq-cst}(X,V,W) atomic_cmpxchg_relaxed(X,V,W) __cmpxchg{once}(X,V,W) atomic_cmpxchg_acquire(X,V,W) __cmpxchg{acquire}(X,V,W) atomic_cmpxchg_release(X,V,W) __cmpxchg{release}(X,V,W) -atomic_sub_and_test(V,X) __atomic_op_return{mb}(X,-,V) == 0 -atomic_dec_and_test(X) __atomic_op_return{mb}(X,-,1) == 0 -atomic_inc_and_test(X) __atomic_op_return{mb}(X,+,1) == 0 -atomic_add_negative(V,X) __atomic_op_return{mb}(X,+,V) < 0 +atomic_sub_and_test(V,X) __atomic_op_return{seq-cst}(X,-,V) == 0 +atomic_dec_and_test(X) __atomic_op_return{seq-cst}(X,-,1) == 0 +atomic_inc_and_test(X) __atomic_op_return{seq-cst}(X,+,1) == 0 +atomic_add_negative(V,X) __atomic_op_return{seq-cst}(X,+,V) < 0 -- 1.7.12.4

1 0

[PATCH openEuler-1.0-LTS 1/4] mm: mem_reliable: Start fallback if no suitable zone found
by Yongqiang Liu 24 Sep '22

24 Sep '22

From: Ma Wupeng <mawupeng1(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4SK3S CVE: NA -------------------------------- For reliable memory allocation bind to nodes which do not hvve any reliable zones, its memory allocation will fail and then warn message will be produced at the end of __alloc_pages_slowpath(). Though this memory allocation can fallback to movable zone in check_after_alloc() if fallback is enabled, something should be done to prevent this pointless warn log. To solve this problem, fallback to movable zone if no suitable zone found. Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- mm/page_alloc.c | 30 ++++++++++++++++++++++++++++-- 1 file changed, 28 insertions(+), 2 deletions(-) diff --git a/mm/page_alloc.c b/mm/page_alloc.c index 1e59761354e1..44d286286dbb 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -4272,6 +4272,25 @@ check_retry_cpuset(int cpuset_mems_cookie, struct alloc_context *ac) } #ifdef CONFIG_MEMORY_RELIABLE +/* + * if fallback is enabled, fallback to movable zone if no dma/normal zone + * found + */ +static inline struct zone *mem_reliable_fallback_zone(gfp_t gfp_mask, + struct alloc_context *ac) +{ + if (!reliable_allow_fb_enabled()) + return NULL; + + if (!(gfp_mask & ___GFP_RELIABILITY)) + return NULL; + + ac->high_zoneidx = gfp_zone(gfp_mask & ~___GFP_RELIABILITY); + ac->preferred_zoneref = first_zones_zonelist( + ac->zonelist, ac->high_zoneidx, ac->nodemask); + return ac->preferred_zoneref->zone; +} + static inline void mem_reliable_fallback_slowpath(gfp_t gfp_mask, struct alloc_context *ac) { @@ -4290,6 +4309,11 @@ static inline void mem_reliable_fallback_slowpath(gfp_t gfp_mask, } } #else +static inline struct zone *mem_reliable_fallback_zone(gfp_t gfp_mask, + struct alloc_context *ac) +{ + return NULL; +} static inline void mem_reliable_fallback_slowpath(gfp_t gfp_mask, struct alloc_context *ac) {} #endif @@ -4339,8 +4363,10 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order, */ ac->preferred_zoneref = first_zones_zonelist(ac->zonelist, ac->high_zoneidx, ac->nodemask); - if (!ac->preferred_zoneref->zone) - goto nopage; + if (!ac->preferred_zoneref->zone) { + if (!mem_reliable_fallback_zone(gfp_mask, ac)) + goto nopage; + } if (gfp_mask & __GFP_KSWAPD_RECLAIM) wake_all_kswapds(order, gfp_mask, ac); -- 2.25.1

1 3

[PATCH for openEuler 22.09] Memory model: Fix the memory model issues for Linux kernel
by Hanjun Guo 24 Sep '22

24 Sep '22

From: Jonas Oberhauser <jonas.oberhauser(a)huawei.com> This the update and fixes for memory model, simplify the model by removing redundancies, making semantics of seq-cst explicit, making ppo a subset of po, making ppo locally computable, as well as eliminating several spurious bugs in qspinlock and litmus tests, and ensuring correct compilation to the official power model. These issues were detected by Jonas Oberhauser, Viktor Vafeiadis, and the authors of "Verifying and Optimizing Compact NUMA-Aware Locks on Weak Memory Models", and the solutions are proposed by Jonas Oberhauser and Viktor Vafeiadis. Signed-off-by: Jonas Oberhauser <jonas.oberhauser(a)huawei.com> Signed-off-by: Hanjun Guo <guohanjun(a)huawei.com> --- tools/memory-model/linux-kernel.bell | 9 ++-- tools/memory-model/linux-kernel.cat | 100 +++++++++++++++++++---------------- 2 files changed, 60 insertions(+), 49 deletions(-) diff --git a/tools/memory-model/linux-kernel.bell b/tools/memory-model/linux-kernel.bell index 5be86b1..880b28b 100644 --- a/tools/memory-model/linux-kernel.bell +++ b/tools/memory-model/linux-kernel.bell @@ -4,6 +4,8 @@ * Copyright (C) 2016 Luc Maranget <luc.maranget(a)inria.fr> for Inria * Copyright (C) 2017 Alan Stern <stern(a)rowland.harvard.edu>, * Andrea Parri <parri.andrea(a)gmail.com> + * Copyright (C) 2022 Jonas Oberhauser <jonas.oberhauser(a)huawei.com> + * Viktor Vafeiadis <viktor(a)mpi-sws.org> * * An earlier version of this file appeared in the companion webpage for * "Frightening small children and disconcerting grown-ups: Concurrency @@ -16,10 +18,11 @@ enum Accesses = 'once (*READ_ONCE,WRITE_ONCE*) || 'release (*smp_store_release*) || 'acquire (*smp_load_acquire*) || + 'seq-cst (*smp_load, xchg...*) || 'noreturn (* R of non-return RMW *) -instructions R[{'once,'acquire,'noreturn}] -instructions W[{'once,'release}] -instructions RMW[{'once,'acquire,'release}] +instructions R[{'seq-cst, 'once,'acquire,'noreturn}] +instructions W[{'seq-cst, 'once,'release}] +instructions RMW[{'seq-cst, 'once,'acquire,'release}] enum Barriers = 'wmb (*smp_wmb*) || 'rmb (*smp_rmb*) || diff --git a/tools/memory-model/linux-kernel.cat b/tools/memory-model/linux-kernel.cat index d70315f..9f14d31 100644 --- a/tools/memory-model/linux-kernel.cat +++ b/tools/memory-model/linux-kernel.cat @@ -4,6 +4,8 @@ * Copyright (C) 2016 Luc Maranget <luc.maranget(a)inria.fr> for Inria * Copyright (C) 2017 Alan Stern <stern(a)rowland.harvard.edu>, * Andrea Parri <parri.andrea(a)gmail.com> + * Copyright (C) 2022 Jonas Oberhauser <jonas.oberhauser(a)huawei.com>, + * Viktor Vafeiadis <viktor(a)mpi-sws.org> * * An earlier version of this file appeared in the companion webpage for * "Frightening small children and disconcerting grown-ups: Concurrency @@ -25,25 +27,33 @@ include "lock.cat" (*******************) (* Release Acquire *) + let acq-po = [Acquire] ; po ; [M] let po-rel = [M] ; po ; [Release] let po-unlock-lock-po = po ; [UL] ; (po|rf) ; [LKR] ; po (* Fences *) -let R4rmb = R \ Noreturn (* Reads for which rmb works *) -let rmb = [R4rmb] ; fencerel(Rmb) ; [R4rmb] -let wmb = [W] ; fencerel(Wmb) ; [W] -let mb = ([M] ; fencerel(Mb) ; [M]) | - ([M] ; fencerel(Before-atomic) ; [RMW] ; po? ; [M]) | - ([M] ; po? ; [RMW] ; fencerel(After-atomic) ; [M]) | - ([M] ; po? ; [LKW] ; fencerel(After-spinlock) ; [M]) | - ([M] ; po ; [UL] ; (co | po) ; [LKW] ; - fencerel(After-unlock-lock) ; [M]) -let gp = po ; [Sync-rcu | Sync-srcu] ; po? -let strong-fence = mb | gp - +let R4rmb = R \ Noreturn +let rmb = [R4rmb] ; po ; [Rmb] ; po ; [R4rmb] +let wmb = [W] ; po ; [Wmb] ; po ; [W] + +let rmb-plain = [R \ Noreturn] ; po ; [Rmb] ; po \ ( po ; [W] ; po-loc) ; [R \ Noreturn] +let plain-wmb = [W] ; po \ (po-loc ; [W] ; po) ; [Wmb] ; po ; [W] +let strong-fence = + [M] ; po ; [Mb] ; po ; [M] + | [M] ; po ; [Before-atomic] ; po ; [RMW] ; po? ; [M] + | [M] ; po? ; [RMW] ; po ; [After-atomic] ; po ; [M] + | [M] ; po? ; [LKW] ; po ; [After-spinlock] ; po ; [M] + | [M] ; po ; [UL] ; po ; [LKR] ; po ; [After-unlock-lock] ; po ; [M] + | [M] ; po? ; [SC] ; po ; [M] + | [M] ; po ; [SC] ; po? ; [M] + | po ; [Sync-rcu | Sync-srcu] ; po? +let strong-sync = strong-fence + | ([M] ; po-unlock-lock-po ; [After-unlock-lock] ; po ; [M]) let nonrw-fence = strong-fence | po-rel | acq-po let fence = nonrw-fence | wmb | rmb + + let barrier = fencerel(Barrier | Rmb | Wmb | Mb | Sync-rcu | Sync-srcu | Before-atomic | After-atomic | Acquire | Release | Rcu-lock | Rcu-unlock | Srcu-lock | Srcu-unlock) | @@ -64,35 +74,33 @@ empty rmw & (fre ; coe) as atomic (* Instruction execution ordering *) (**********************************) + (* Preserved Program Order *) -let dep = addr | data -let rwdep = (dep | ctrl) ; [W] -let overwrite = co | fr -let to-w = rwdep | (overwrite & int) | (addr ; [Plain] ; wmb) -let to-r = addr | (dep ; [Marked] ; rfi) -let ppo = to-r | to-w | fence | (po-unlock-lock-po & int) +let dop = rmb-plain? ; (addr | data | ctrl | rfi)+; plain-wmb? +let to-w = (dop | po-loc) ; [W] +let lrs = ([W] ; po-loc ; [R]) \ (po-loc ; [W] ; po-loc) +let to-r = addr | ((addr | data) ; lrs) +let ppo = to-r | to-w | fence | (po ; [UL] ; po ; [LKR] ; po) (* Propagation: Ordering from release operations and strong fences. *) -let A-cumul(r) = (rfe ; [Marked])? ; r -let cumul-fence = [Marked] ; (A-cumul(strong-fence | po-rel) | wmb | - po-unlock-lock-po) ; [Marked] -let prop = [Marked] ; (overwrite & ext)? ; cumul-fence* ; - [Marked] ; rfe? ; [Marked] +let cumul-fence = [Marked] ; (rfe? ; (po-rel ; (rfe ; rmw)*) | wmb | po-unlock-lock-po) ; [Marked] +let prop = [Marked] ; ((co | fr) & ext) ; cumul-fence* ; [Marked] ; rfe? ; [Marked] + (* * Happens Before: Ordering from the passage of time. - * No fences needed here for prop because relation confined to one process. *) -let hb = [Marked] ; (ppo | rfe | ((prop \ id) & int)) ; [Marked] -acyclic hb as happens-before +let hb = [Marked] ; (ppo | rfe | prop ; strong-sync) ; [Marked] +acyclic hb + +(* No fences needed here for prop because relation confined to one process. *) +irreflexive (prop ; ppo*) + + + + -(****************************************) -(* Write and fence propagation ordering *) -(****************************************) -(* Propagation: Each non-rf link needs a strong fence. *) -let pb = prop ; strong-fence ; hb* ; [Marked] -acyclic pb as propagation (*******) (* RCU *) @@ -118,7 +126,7 @@ let srcu-rscsi = srcu-rscs^-1 * one but two non-rf relations, but only in conjunction with an RCU * read-side critical section. *) -let rcu-link = po? ; hb* ; pb* ; prop ; po +let rcu-link = po? ; hb* ; prop? ; po (* * Any sequence containing at least as many grace periods as RCU read-side @@ -139,20 +147,20 @@ let rec rcu-order = rcu-gp | srcu-gp | ((srcu-rscsi ; rcu-link ; rcu-order ; rcu-link ; srcu-gp) & loc) | (rcu-order ; rcu-link ; rcu-order) let rcu-fence = po ; rcu-order ; po? -let fence = fence | rcu-fence -let strong-fence = strong-fence | rcu-fence +let fence-rcu = fence | rcu-fence +let strong-sync-rcu = strong-sync | rcu-fence -(* rb orders instructions just as pb does *) -let rb = prop ; rcu-fence ; hb* ; pb* ; [Marked] +(* rb orders instructions just as hb does *) +let rb = prop? ; rcu-fence ; hb* ; [Marked] irreflexive rb as rcu (* - * The happens-before, propagation, and rcu constraints are all + * The happens-before and rcu constraints are all * expressions of temporal ordering. They could be replaced by * a single constraint on an "executes-before" relation, xb: * - * let xb = hb | pb | rb + * let xb = hb | rb * acyclic xb as executes-before *) @@ -166,24 +174,24 @@ let mixed-accesses = ([Plain & W] ; (po-loc \ barrier) ; [Marked]) | flag ~empty mixed-accesses as mixed-accesses (* Executes-before and visibility *) -let xbstar = (hb | pb | rb)* +let xbstar = (hb | rb)* let vis = cumul-fence* ; rfe? ; [Marked] ; - ((strong-fence ; [Marked] ; xbstar) | (xbstar & int)) + ((strong-sync-rcu ; [Marked] ; xbstar) | (xbstar & int)) (* Boundaries for lifetimes of plain accesses *) -let w-pre-bounded = [Marked] ; (addr | fence)? +let w-pre-bounded = [Marked] ; (addr | fence-rcu)? let r-pre-bounded = [Marked] ; (addr | nonrw-fence | ([R4rmb] ; fencerel(Rmb) ; [~Noreturn]))? -let w-post-bounded = fence? ; [Marked] +let w-post-bounded = fence-rcu? ; [Marked] let r-post-bounded = (nonrw-fence | ([~Noreturn] ; fencerel(Rmb) ; [R4rmb]))? ; [Marked] (* Visibility and executes-before for plain accesses *) -let ww-vis = fence | (strong-fence ; xbstar ; w-pre-bounded) | +let ww-vis = (strong-sync-rcu ; xbstar ; w-pre-bounded) | (w-post-bounded ; vis ; w-pre-bounded) -let wr-vis = fence | (strong-fence ; xbstar ; r-pre-bounded) | +let wr-vis = (strong-sync-rcu ; xbstar ; r-pre-bounded) | (w-post-bounded ; vis ; r-pre-bounded) -let rw-xbstar = fence | (r-post-bounded ; xbstar ; w-pre-bounded) +let rw-xbstar = (r-post-bounded ; xbstar ; w-pre-bounded) (* Potential races *) let pre-race = ext & ((Plain * M) | ((M \ IW) * Plain)) -- 1.7.12.4

1 0

[PATCH openEuler-22.09] mm: reliable: Fix ret errno to EACCES
by Zheng Zengkai 24 Sep '22

24 Sep '22

From: Ma Wupeng <mawupeng1(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4SK3S CVE: NA -------------------------------- Commit bc25b3081709 ("mm: reliable: Use EINVAL in reliable_check") update EPERM to EINVAL try to pass LTP's proc01 test, however LTP only treat EACCESS as whitelist in the scenario. To solve this problem, update EINVAL to EACCESS. Fixes: bc25b3081709 ("mm: reliable: Use EINVAL in reliable_check") Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> Reviewed-by: Chen Wandun <chenwandun(a)huawei.com> --- fs/proc/base.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/proc/base.c b/fs/proc/base.c index 0c3a2eb61726..2d1af92653bb 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -1264,7 +1264,7 @@ static const struct file_operations proc_oom_score_adj_operations = { static inline int reliable_check(struct task_struct *task, struct pid *pid) { if (!mem_reliable_is_enabled()) - return -EINVAL; + return -EACCES; if (is_global_init(task)) return -EINVAL; -- 2.20.1

1 0

[PATCH openEuler-22.09] mm: reliable: Use EINVAL in reliable_check
by Zheng Zengkai 24 Sep '22

24 Sep '22

From: Ma Wupeng <mawupeng1(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4SK3S CVE: NA -------------------------------- LTP's proc01 test was failing be because this ret code (1): proc01 1 TFAIL : proc01.c:400: read failed: /proc/self/task/1406366/reliable: errno=EPERM(1): Operation not permitted To slove this problem, replace EPERM with EINVAL in reliable_check(). Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- fs/proc/base.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/fs/proc/base.c b/fs/proc/base.c index 8ae7c2be70c2..0c3a2eb61726 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -1264,14 +1264,14 @@ static const struct file_operations proc_oom_score_adj_operations = { static inline int reliable_check(struct task_struct *task, struct pid *pid) { if (!mem_reliable_is_enabled()) - return -EPERM; + return -EINVAL; if (is_global_init(task)) - return -EPERM; + return -EINVAL; if (!task->mm || (task->flags & PF_KTHREAD) || (task->flags & PF_EXITING)) - return -EPERM; + return -EINVAL; return 0; } -- 2.20.1

1 0

[PATCH openEuler-22.09] Revert "net: af_key: add check for pfkey_broadcast in function pfkey_process"
by Zheng Zengkai 22 Sep '22

22 Sep '22

From: Michal Kubecek <mkubecek(a)suse.cz> stable inclusion from stable-v5.10.122 commit 7fa8312879f78d255a63b372473a7016d4c29d67 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5L6D4 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9c90c9b3e50e16d03c7f87d63e9db373974781e0 ] This reverts commit 4dc2a5a8f6754492180741facf2a8787f2c415d7. A non-zero return value from pfkey_broadcast() does not necessarily mean an error occurred as this function returns -ESRCH when no registered listener received the message. In particular, a call with BROADCAST_PROMISC_ONLY flag and null one_sk argument can never return zero so that this commit in fact prevents processing any PF_KEY message. One visible effect is that racoon daemon fails to find encryption algorithms like aes and refuses to start. Excluding -ESRCH return value would fix this but it's not obvious that we really want to bail out here and most other callers of pfkey_broadcast() also ignore the return value. Also, as pointed out by Steffen Klassert, PF_KEY is kind of deprecated and newer userspace code should use netlink instead so that we should only disturb the code for really important fixes. v2: add a comment explaining why is the return value ignored Signed-off-by: Michal Kubecek <mkubecek(a)suse.cz> Signed-off-by: Steffen Klassert <steffen.klassert(a)secunet.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- net/key/af_key.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/net/key/af_key.c b/net/key/af_key.c index dca264844be4..aa3b1e0cd311 100644 --- a/net/key/af_key.c +++ b/net/key/af_key.c @@ -2833,10 +2833,12 @@ static int pfkey_process(struct sock *sk, struct sk_buff *skb, const struct sadb void *ext_hdrs[SADB_EXT_MAX]; int err; - err = pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL, - BROADCAST_PROMISC_ONLY, NULL, sock_net(sk)); - if (err) - return err; + /* Non-zero return value of pfkey_broadcast() does not always signal + * an error and even on an actual error we may still want to process + * the message so rather ignore the return value. + */ + pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL, + BROADCAST_PROMISC_ONLY, NULL, sock_net(sk)); memset(ext_hdrs, 0, sizeof(ext_hdrs)); err = parse_exthdrs(skb, hdr, ext_hdrs); -- 2.20.1

1 0

[PATCH 1/2] net: hns3: fix error resume keep alive when remove hclgevf
by Laibin Qiu 22 Sep '22

22 Sep '22

From: Yonglong Liu <liuyonglong(a)huawei.com> driver inclusion category: https://gitee.com/openeuler/kernel/issues/I5S7WZ bugzilla: NA CVE: NA ---------------------------- When enable lots of vf, remove the driver of vf will call keep alive wrong resume. Fixes: 6a804d0a6068 ("net: hns3: fix keep alive can not resume problem when system busy") Signed-off-by: Yonglong Liu <liuyonglong(a)huawei.com> Reviewed-by: li yongxin <liyongxin1(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> --- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 2 ++ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h | 1 + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c | 3 ++- 3 files changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c index 41a12df725b3..b4b1e440fba4 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c @@ -7096,6 +7096,7 @@ int hclge_vport_start(struct hclge_vport *vport) struct hclge_dev *hdev = vport->back; vport->last_active_jiffies = jiffies; + set_bit(HCLGE_VPORT_STATE_START, &vport->state); set_bit(HCLGE_VPORT_STATE_ALIVE, &vport->state); if (test_bit(vport->vport_id, hdev->vport_config_block)) { @@ -7113,6 +7114,7 @@ int hclge_vport_start(struct hclge_vport *vport) void hclge_vport_stop(struct hclge_vport *vport) { + clear_bit(HCLGE_VPORT_STATE_START, &vport->state); clear_bit(HCLGE_VPORT_STATE_ALIVE, &vport->state); } diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h index 8477dc343a40..99a55fa74cd4 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h +++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h @@ -926,6 +926,7 @@ enum HCLGE_VPORT_STATE { HCLGE_VPORT_STATE_MAC_TBL_CHANGE, HCLGE_VPORT_STATE_PROMISC_CHANGE, HCLGE_VPORT_STATE_VLAN_FLTR_CHANGE, + HCLGE_VPORT_STATE_START, HCLGE_VPORT_STATE_MAX }; diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c index 45f94cd33524..893f6e0ce473 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c @@ -644,7 +644,8 @@ static void hclge_vf_keep_alive(struct hclge_vport *vport) vport->last_active_jiffies = jiffies; - if (!test_bit(HCLGE_VPORT_STATE_ALIVE, &vport->state)) { + if (test_bit(HCLGE_VPORT_STATE_START, &vport->state) && + !test_bit(HCLGE_VPORT_STATE_ALIVE, &vport->state)) { set_bit(HCLGE_VPORT_STATE_ALIVE, &vport->state); dev_info(&hdev->pdev->dev, "VF %u keep alive resume!", -- 2.25.1

1 1

[PATCH 1/2] net: hns3: fix keep alive can not resume problem when system busy
by Laibin Qiu 22 Sep '22

22 Sep '22

From: Yonglong Liu <liuyonglong(a)huawei.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5S7WZ CVE: NA ---------------------------- Currently, VF send keep alive to PF every 2s, and PF detect the keep alive for 8s, some case, the work queue may schedule late, cause keep alive lost, then the mac setting from PF may not affect to the VF, and the keep alive can not resume, only reset VF or reload VF driver can resume. This patch adds keep alive resume mechanism, and adds some debug print for this case. When link status change between keep alive lost and resume, the link status of VF may not the same as the PF, so adds push link status to VF to avoid this case. Signed-off-by: Yonglong Liu <liuyonglong(a)huawei.com> Reviewed-by: li yongxin <liyongxin1(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> --- .../hisilicon/hns3/hns3pf/hclge_main.c | 9 ++++++-- .../hisilicon/hns3/hns3pf/hclge_mbx.c | 22 +++++++++++++++++++ 2 files changed, 29 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c index 7e5e58470017..41a12df725b3 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c @@ -4046,7 +4046,12 @@ static void hclge_update_vport_alive(struct hclge_dev *hdev) * receive a vf's alive msg for 8s, regards the vf is offline */ if (time_after(jiffies, vport->last_active_jiffies + 8 * HZ)) - clear_bit(HCLGE_VPORT_STATE_ALIVE, &vport->state); + if (test_and_clear_bit(HCLGE_VPORT_STATE_ALIVE, + &vport->state)) + dev_info(&hdev->pdev->dev, + "VF %u keep alive lost!", + vport->vport_id - + HCLGE_VF_VPORT_START_NUM); /* If vf is not alive, set to default value */ if (!test_bit(HCLGE_VPORT_STATE_ALIVE, &vport->state)) @@ -7090,8 +7095,8 @@ int hclge_vport_start(struct hclge_vport *vport) { struct hclge_dev *hdev = vport->back; - set_bit(HCLGE_VPORT_STATE_ALIVE, &vport->state); vport->last_active_jiffies = jiffies; + set_bit(HCLGE_VPORT_STATE_ALIVE, &vport->state); if (test_bit(vport->vport_id, hdev->vport_config_block)) { if (vport->vport_id) { diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c index b1b59c1f5cc6..45f94cd33524 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c @@ -639,7 +639,29 @@ static int hclge_reset_vf(struct hclge_vport *vport) static void hclge_vf_keep_alive(struct hclge_vport *vport) { + struct hclge_dev *hdev = vport->back; + int ret; + vport->last_active_jiffies = jiffies; + + if (!test_bit(HCLGE_VPORT_STATE_ALIVE, &vport->state)) { + set_bit(HCLGE_VPORT_STATE_ALIVE, &vport->state); + + dev_info(&hdev->pdev->dev, "VF %u keep alive resume!", + vport->vport_id - HCLGE_VF_VPORT_START_NUM); + + /* if vf support push link, need to push link status after keep + * alive restore, because the vf will not fetch the link status + * of it's own. + */ + ret = hclge_push_vf_link_status(vport); + if (ret) { + dev_err(&hdev->pdev->dev, + "failed to push link status to vf%u, ret=%d\n", + vport->vport_id - HCLGE_VF_VPORT_START_NUM, + ret); + } + } } static int hclge_set_vf_mtu(struct hclge_vport *vport, -- 2.25.1

1 1

[PATCH openEuler-5.10 01/16] blk-mq: fix io hung due to missing commit_rqs
by Zheng Zengkai 21 Sep '22

21 Sep '22

From: Yu Kuai <yukuai3(a)huawei.com> hulk inclusion category: bugfix bugzilla: 186851, https://gitee.com/openeuler/kernel/issues/I5L01G CVE: NA -------------------------------- Currently, in virtio_scsi, if 'bd->last' is not set to true while dispatching request, such io will stay in driver's queue, and driver will wait for block layer to dispatch more rqs. However, if block layer failed to dispatch more rq, it should trigger commit_rqs to inform driver. There is a problem in blk_mq_try_issue_list_directly() that commit_rqs won't be called: // assume that queue_depth is set to 1, list contains two rq blk_mq_try_issue_list_directly blk_mq_request_issue_directly // dispatch first rq // last is false __blk_mq_try_issue_directly blk_mq_get_dispatch_budget // succeed to get first budget __blk_mq_issue_directly scsi_queue_rq cmd->flags |= SCMD_LAST virtscsi_queuecommand kick = (sc->flags & SCMD_LAST) != 0 // kick is false, first rq won't issue to disk queued++ blk_mq_request_issue_directly // dispatch second rq __blk_mq_try_issue_directly blk_mq_get_dispatch_budget // failed to get second budget ret == BLK_STS_RESOURCE blk_mq_request_bypass_insert // errors is still 0 if (!list_empty(list) || errors && ...) // won't pass, commit_rqs won't be called In this situation, first rq relied on second rq to dispatch, while second rq relied on first rq to complete, thus they will both hung. Fix the problem by also treat 'BLK_STS_*RESOURCE' as 'errors' since it means that request is not queued successfully. Same problem exists in blk_mq_dispatch_rq_list(), 'BLK_STS_*RESOURCE' can't be treated as 'errors' here, fix the problem by calling commit_rqs if queue_rq return 'BLK_STS_*RESOURCE'. Fixes: d666ba98f849 ("blk-mq: add mq_ops->commit_rqs()") Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Link: https://lore.kernel.org/all/20220726122224.1790882-1-yukuai1@huaweicloud.co… Reviewed-by: Ming Lei <ming.lei(a)redhat.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- block/blk-mq.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/block/blk-mq.c b/block/blk-mq.c index 1941ffc4db85..b9827b3d3f63 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -1484,7 +1484,8 @@ bool blk_mq_dispatch_rq_list(struct blk_mq_hw_ctx *hctx, struct list_head *list, /* If we didn't flush the entire list, we could have told the driver * there was more coming, but that turned out to be a lie. */ - if ((!list_empty(list) || errors) && q->mq_ops->commit_rqs && queued) + if ((!list_empty(list) || errors || needs_resource || + ret == BLK_STS_DEV_RESOURCE) && q->mq_ops->commit_rqs && queued) q->mq_ops->commit_rqs(hctx); /* * Any items that need requeuing? Stuff them into hctx->dispatch, @@ -2224,6 +2225,7 @@ void blk_mq_try_issue_list_directly(struct blk_mq_hw_ctx *hctx, list_del_init(&rq->queuelist); ret = blk_mq_request_issue_directly(rq, list_empty(list)); if (ret != BLK_STS_OK) { + errors++; if (ret == BLK_STS_RESOURCE || ret == BLK_STS_DEV_RESOURCE) { blk_mq_request_bypass_insert(rq, false, @@ -2231,7 +2233,6 @@ void blk_mq_try_issue_list_directly(struct blk_mq_hw_ctx *hctx, break; } blk_mq_end_request(rq, ret); - errors++; } else queued++; } -- 2.20.1

1 15