- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] hwrng: core - Fix page fault dead lock on mmap-ed hwrng
by Yi Yang 19 Mar '24

19 Mar '24

From: Herbert Xu <herbert(a)gondor.apana.org.au> stable inclusion from stable-v4.19.307 commit eafd83b92f6c044007a3591cbd476bcf90455990 category: bugfix bugzilla: 189694 CVE: CVE-2023-52615 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 78aafb3884f6bc6636efcc1760c891c8500b9922 upstream. There is a dead-lock in the hwrng device read path. This triggers when the user reads from /dev/hwrng into memory also mmap-ed from /dev/hwrng. The resulting page fault triggers a recursive read which then dead-locks. Fix this by using a stack buffer when calling copy_to_user. Reported-by: Edward Adam Davis <eadavis(a)qq.com> Reported-by: syzbot+c52ab18308964d248092(a)syzkaller.appspotmail.com Fixes: 9996508b3353 ("hwrng: core - Replace u32 in driver API with byte array") Cc: <stable(a)vger.kernel.org> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/char/hw_random/core.c | 34 +++++++++++++++++++++------------- 1 file changed, 21 insertions(+), 13 deletions(-) diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c index 0ef7cb0448e8..e33b71659215 100644 --- a/drivers/char/hw_random/core.c +++ b/drivers/char/hw_random/core.c @@ -23,10 +23,13 @@ #include <linux/random.h> #include <linux/sched.h> #include <linux/slab.h> +#include <linux/string.h> #include <linux/uaccess.h> #define RNG_MODULE_NAME "hw_random" +#define RNG_BUFFER_SIZE (SMP_CACHE_BYTES < 32 ? 32 : SMP_CACHE_BYTES) + static struct hwrng *current_rng; /* the current rng has been explicitly chosen by user via sysfs */ static int cur_rng_set_by_user; @@ -58,7 +61,7 @@ static inline int rng_get_data(struct hwrng *rng, u8 *buffer, size_t size, static size_t rng_buffer_size(void) { - return SMP_CACHE_BYTES < 32 ? 32 : SMP_CACHE_BYTES; + return RNG_BUFFER_SIZE; } static void add_early_randomness(struct hwrng *rng) @@ -201,6 +204,7 @@ static inline int rng_get_data(struct hwrng *rng, u8 *buffer, size_t size, static ssize_t rng_dev_read(struct file *filp, char __user *buf, size_t size, loff_t *offp) { + u8 buffer[RNG_BUFFER_SIZE]; ssize_t ret = 0; int err = 0; int bytes_read, len; @@ -228,34 +232,37 @@ static ssize_t rng_dev_read(struct file *filp, char __user *buf, if (bytes_read < 0) { err = bytes_read; goto out_unlock_reading; + } else if (bytes_read == 0 && + (filp->f_flags & O_NONBLOCK)) { + err = -EAGAIN; + goto out_unlock_reading; } + data_avail = bytes_read; } - if (!data_avail) { - if (filp->f_flags & O_NONBLOCK) { - err = -EAGAIN; - goto out_unlock_reading; - } - } else { - len = data_avail; + len = data_avail; + if (len) { if (len > size) len = size; data_avail -= len; - if (copy_to_user(buf + ret, rng_buffer + data_avail, - len)) { + memcpy(buffer, rng_buffer + data_avail, len); + } + mutex_unlock(&reading_mutex); + put_rng(rng); + + if (len) { + if (copy_to_user(buf + ret, buffer, len)) { err = -EFAULT; - goto out_unlock_reading; + goto out; } size -= len; ret += len; } - mutex_unlock(&reading_mutex); - put_rng(rng); if (need_resched()) schedule_timeout_interruptible(1); @@ -266,6 +273,7 @@ static ssize_t rng_dev_read(struct file *filp, char __user *buf, } } out: + memzero_explicit(buffer, sizeof(buffer)); return ret ? : err; out_unlock_reading: -- 2.25.1

2 1

[PATCH OLK-6.6 000/470] Backport 6.6.9~6.6.13 LTS patches
by Peng Zhang 19 Mar '24

19 Mar '24

From: ZhangPeng <zhangpeng362(a)huawei.com> Backport linux-6.6.9 linux-6.6.13 LTS patches from upstream. git cherry-pick v6.6.8..v6.6.9~1 -s git cherry-pick v6.6.9..v6.6.10~1 -s git cherry-pick v6.6.10..v6.6.11~1 -s git cherry-pick v6.6.11..v6.6.12~1 -s git cherry-pick v6.6.12..v6.6.13~1 -s There are only 1 simple context conflicts: block: warn once for each partition in bio_check_ro() Build and boot test passed for arm64 & x86. Aabish Malik (1): ALSA: hda/realtek: enable SND_PCI_QUIRK for hp pavilion 14-ec1xxx series Adrian Cinal (1): net: bcmgenet: Fix FCS generation for fragmented skbuffs Alex Bee (1): clk: rockchip: rk3128: Fix SCLK_SDMMC's clock name Alex Deucher (3): drm/amd/display: Increase frame warning limit with KASAN or KCSAN in dml drm/amdgpu: skip gpu_info fw loading on navi12 drm/amd/display: add nv12 bounding box Alex Lu (1): Bluetooth: Add more enc key size check Alex Williamson (1): vfio/mtty: Overhaul mtty interrupt handling Alexander Atanasov (1): scsi: core: Always send batch on reset or error handling command Alexis Lothoré (1): pinctrl: at91-pio4: use dedicated lock class for IRQ Alison Schofield (3): cxl/core: Always hold region_rwsem while reading poison lists kernel/resource: Increment by align value in get_free_mem_region() cxl/memdev: Hold region_rwsem during inject and clear poison ops Alper Ak (1): USB: serial: option: add Quectel EG912Y module support Alvin Lee (1): drm/amd/display: Increase num voltage states to 40 Andrew Davis (2): ARM: dts: dra7: Fix DRA7 L3 NoC node register size phy: ti: gmii-sel: Fix register offset when parent is not a syscon node Andrii Staikov (1): i40e: Restore VF MSI-X state during PCI reset Andy Chi (1): ALSA: hda/realtek: fix mute/micmute LEDs for a HP ZBook Andy Gospodarek (1): bnxt_en: do not map packet buffers twice Armin Wolf (1): hwmon: (corsair-psu) Fix probe when built-in Arnd Bergmann (4): Bluetooth: hci_event: shut up a false-positive warning x86/xen: add CPU dependencies for 32-bit build kexec: fix KEXEC_FILE dependencies kexec: select CRYPTO from KEXEC_FILE instead of depending on it Avraham Stern (1): wifi: iwlwifi: pcie: avoid a NULL pointer dereference Baokun Li (1): mm/filemap: avoid buffered read/write race to read inconsistent data Ben Greear (1): wifi: mac80211: handle 320 MHz in ieee80211_ht_cap_ie_to_sta_ht_cap Benjamin Bara (1): i2c: core: Fix atomic xfer check for non-preempt config Benjamin Bigler (1): spi: spi-imx: correctly configure burst length when using dma Bitao Hu (1): nvme: fix deadlock between reset and scan Bjorn Helgaas (1): Revert "PCI/ASPM: Remove pcie_aspm_pm_state_change()" Boris Burkov (1): btrfs: free qgroup pertrans reserve on transaction abort Brad Cowie (1): netfilter: nf_nat: fix action not being set for all ct states Bryan O'Donoghue (3): media: qcom: camss: Fix V4L2 async notifier error path media: qcom: camss: Fix genpd cleanup media: qcom: camss: Comment CSID dt_id field Cameron Williams (2): parport: parport_serial: Add Brainboxes BAR details parport: parport_serial: Add Brainboxes device IDs and geometry Can Guo (1): scsi: ufs: core: Let the sq_lock protect sq_tail_slot access Carlos Llamas (5): binder: use EPOLLERR from eventpoll.h binder: fix use-after-free in shinker's callback binder: fix trivial typo of binder_free_buf_locked() binder: fix comment on binder_alloc_new_buf() return value scripts/decode_stacktrace.sh: optionally use LLVM utilities Carolina Jubran (1): net/mlx5e: XDP, Drop fragmented packets larger than MTU size ChanWoo Lee (1): scsi: ufs: qcom: Return ufs_qcom_clk_scale_*() errors in ufs_qcom_clk_scale_notify() Chancel Liu (1): ASoC: fsl_rpmsg: Fix error handler with pm_runtime_enable Chao Song (1): soundwire: intel_ace2x: fix AC timing setting for ACE2.x Charan Teja Kalla (1): mm: migrate high-order folios in swap cache correctly Charlene Liu (1): drm/amd/display: get dprefclk ss info from integration info table Charles Keepax (2): pinctrl: lochnagar: Don't build on MIPS ASoC: wm8974: Correct boost mixer inputs Chen Ni (1): asix: Add check for usbnet_get_endpoints Chen-Yu Tsai (1): wifi: cfg80211: Add my certificate Cheng-Han Wu (1): ksmbd: Remove unused field in ksmbd_user struct Chester Lin (1): pinctrl: s32cc: Avoid possible string truncation Chris Mi (1): net/mlx5e: Decrease num_block_tc when unblock tc offload Chris Morgan (1): clk: rockchip: rk3568: Add PLL rate for 292.5MHz Christoffer Sandberg (1): Input: soc_button_array - add mapping for airplane mode button Christoph Hellwig (1): block: renumber QUEUE_FLAG_HW_WC Chuck Lever (1): SUNRPC: Revert 5f7fc5d69f6e92ec0b38774c387f5cf7812c5806 Chukun Pan (1): arm64: dts: allwinner: h616: update emac for Orange Pi Zero 3 Claudio Imbrenda (1): KVM: s390: vsie: fix wrong VIR 37 when MSO is used Claudiu Beznea (1): net: ravb: Wait for operating mode to be applied Clément Villeret (1): ALSA: hda/realtek: Add quirk for ASUS ROG GV302XA Dan Carpenter (4): net/mlx5e: Fix error code in mlx5e_tc_action_miss_mapping_get() net/mlx5e: Fix error codes in alloc_branch_attr() usb: fotg210-hcd: delete an incorrect bounds test ACPI: thermal: Fix acpi_thermal_unregister_thermal_zone() cleanup Dan Williams (1): driver core: Add a guard() definition for the device_lock() Daniel Golle (1): net: phy: skip LED triggers on PHYs on SFP modules Dave Airlie (1): nouveau/tu102: flush all pdbs on vmm flush Dave Ertman (1): ice: alter feature support check for SRIOV and LAG Dave Jiang (3): cxl: Add cxl_decoders_committed() helper cxl: Add cxl_num_decoders_committed() usage to cxl_test cxl/hdm: Fix a benign lockdep splat David Ahern (1): net/ipv6: Revert remove expired routes with a separated list of routes David E. Box (3): platform/x86/intel/pmc: Add suspend callback platform/x86/intel/pmc: Allow reenabling LTRs platform/x86/intel/pmc: Move GBE LTR ignore to suspend callback David Howells (5): afs: Fix the dynamic root's d_delete to always delete unused dentries afs: Fix dynamic root lookup DNS check keys, dns: Allow key types (eg. DNS) to be reclaimed immediately on expiry afs: Fix overwriting of result of DNS query afs: Fix use-after-free due to get/remove race in volume tree David Lechner (1): iio: triggered-buffer: prevent possible freeing of wrong buffer David Lin (1): ASoC: nau8822: Fix incorrect type in assignment and cast to restricted __be16 David Rau (1): ASoC: da7219: Support low DC impedance headset David Thompson (1): mlxbf_gige: fix receive packet race condition Denys Zagorui (1): bpftool: Fix -Wcast-qual warning Dinghao Liu (2): net/mlx5e: fix a potential double-free in fs_udp_create_groups net/qla3xxx: fix potential memleak in ql_alloc_buffer_queues Dmitry Antipov (1): smb: client, common: fix fortify warnings Dmytro Laktyushkin (1): drm/amd/display: update dcn315 lpddr pstate latency Douglas Anderson (3): drm/bridge: parade-ps8640: Never store more than msg->size bytes in AUX xfer drm/bridge: ti-sn65dsi86: Never store more than msg->size bytes in AUX xfer drm/bridge: ps8640: Fix size mismatch warning w/ len Edward Adam Davis (3): wifi: mac80211: check if the existing link config remains unchanged keys, dns: Fix missing size check of V1 server-list header mptcp: fix uninit-value in mptcp_incoming_options Eric Biggers (1): crypto: xts - use 'spawn' for underlying single-block cipher Eric Dumazet (7): net: sched: ife: fix potential use-after-free net/rose: fix races in rose_kill_by_device() net: check dev->gso_max_size in gso_features_check() virtio_net: avoid data-races on dev->stats fields tcp: derive delack_max from rto_min net: prevent mss overflow in skb_segment() net: constify sk_dst_get() and __sk_dst_get() argument Esther Shimanovich (1): Input: i8042 - add nomux quirk for Acer P459-G2-M Eugen Hristev (1): ASoC: mediatek: mt8186: fix AUD_PAD_TOP register and offset Fabio Estevam (1): dt-bindings: nvmem: mxs-ocotp: Document fsl,ocotp Fedor Pchelkin (2): net: 9p: avoid freeing uninit memory in p9pdu_vreadf ksmbd: free ppace array on error in parse_dacl Felix Fietkau (1): wifi: mt76: fix crash with WED rx support enabled Finley Xiao (1): clk: rockchip: rk3128: Fix aclk_peri_src's parent Florian Eckert (1): leds: ledtrig-tty: Free allocated ttyname buffer on deactivate Frederic Weisbecker (3): rcu: Introduce rcu_cpu_online() rcu/tasks: Handle new PF_IDLE semantics rcu/tasks-trace: Handle new PF_IDLE semantics Frédéric Danis (1): Bluetooth: L2CAP: Send reject on command corrupted request Geert Uytterhoeven (2): reset: Fix crash when freeing non-existent optional resets mmc: core: Cancel delayed work before releasing host Geliang Tang (1): selftests: mptcp: join: fix subflow_send_ack lookup George Stark (1): iio: adc: meson: add separate config for axg SoC family Gergo Koteles (5): ALSA: hda/tas2781: select program 0, conf 0 by default ASoC: tas2781: check the validity of prm_no/cfg_no ALSA: hda/tas2781: do not use regcache ALSA: hda/tas2781: move set_drv_data outside tasdevice_init ALSA: hda/tas2781: remove sound controls in unbind Ghanshyam Agrawal (1): kselftest: alsa: fixed a print formatting warning Guanghui Feng (1): uio: Fix use-after-free in uio_open Guanjun (1): dmaengine: idxd: Protect int_handle field in hw descriptor Guilherme G. Piccoli (1): HID: nintendo: Prevent divide-by-zero on code Haibo Chen (1): iio: adc: imx93: add four channels for imx93 adc Hamza Mahfooz (1): drm/amd/display: fix hw rotated modes when PSR-SU is enabled Hangbin Liu (1): selftests: bonding: do not set port down when adding to bond Hangyu Hua (1): net: sched: em_text: fix possible memory leak in em_text_destroy() Hans de Goede (5): platform/x86: intel-vbtn: Fix missing tablet-mode-switch events Input: atkbd - skip ATKBD_CMD_GETID in translated mode ASoC: Intel: bytcr_rt5640: Add quirk for the Medion Lifetab S10346 ASoC: Intel: bytcr_rt5640: Add new swapped-speakers quirk ACPI: resource: Add another DMI match for the TongFang GMxXGxx Haoran Liu (1): Input: ipaq-micro-keys - add error handling for devm_kmemdup Haren Myneni (1): powerpc/pseries/vas: Migration suspend waits for no in-progress open windows Hawking Zhang (1): drm/amdgpu: Do not issue gpu reset from nbio v7_9 bif interrupt Heiko Carstens (1): s390/vx: fix save/restore of fpu kernel context Heiko Stuebner (1): arm64: dts: rockchip: fix rk356x pcie msg interrupt name Helge Deller (2): linux/export: Fix alignment for 64-bit ksymtab entries linux/export: Ensure natural alignment of kcrctab array Hengqi Chen (1): LoongArch: Preserve syscall nr across execve() Herve Codina (1): lib/vsprintf: Fix %pfwf when current node refcount == 0 Hyunwoo Kim (1): Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg Ian Rogers (1): bpftool: Align output skeleton ELF code Imre Deak (1): drm/i915/mtl: Fix HDMI/DP PLL clock selection Inki Dae (1): drm/exynos: fix a wrong error checking Ira Weiny (1): cxl/pmu: Ensure put_device on pmu devices Ivan Lipski (1): drm/amd/display: Add monitor patch for specific eDP Ivan Orlov (1): ALSA: pcmtest: stop timer before buffer is released JP Kobryn (1): 9p: prevent read overrun in protocol dump tracepoint Jacob Keller (1): ice: stop trashing VF VSI aggregator node ID information Jai Luthra (1): dmaengine: ti: k3-psil-am62a: Fix SPI PDMA data James Clark (1): coresight: etm4x: Fix width of CCITMIN field Jani Nikula (2): drm/i915/edp: don't write to DP_LINK_BW_SET when using rate select drm/crtc: fix uninitialized variable use Javier Carrasco (2): iio: common: ms_sensors: ms_sensors_i2c: fix humidity conversion time table iio: tmag5273: fix temperature offset Jeff Layton (3): fs: new accessor methods for atime and mtime client: convert to new timestamp accessors nfsd: drop the nfsd_put helper Jeffrey Hugo (1): accel/qaic: Implement quirk for SOC_HW_VERSION Jens Axboe (1): io_uring: use fget/fput consistently Jensen Huang (1): i2c: rk3x: fix potential spinlock recursion on poll Jeremie Knuesel (1): ALSA: usb-audio: Increase delay in MOTU M quirk Jeremy Soller (1): ASoC: amd: yc: Add DMI entry to support System76 Pangolin 13 Jerome Brunet (1): ASoC: hdmi-codec: fix missing report for jack initial status Jiajun Xie (1): mm: fix unmap_mapping_range high bits shift bug Jianbo Liu (1): net/mlx5e: Fix overrun reported by coverity Jinghao Jia (1): x86/kprobes: fix incorrect return address calculation in kprobe_emulate_call_indirect Jinyang He (1): LoongArch: Set unwind stack type to unknown rather than set error flag Jiri Olsa (1): bpf: Fix prog_array_map_poke_run map poke update Jisheng Zhang (1): riscv: don't probe unaligned access speed if already done Jocelyn Falempe (1): drm/mgag200: Fix gamma lut not initialized for G200ER, G200EV, G200SE Johan Hovold (1): usb: typec: ucsi: fix gpio-based orientation detection Johannes Berg (11): wifi: ieee80211: don't require protected vendor action frames wifi: iwlwifi: pcie: add another missing bh-disable for rxq->lock wifi: mac80211: don't re-add debugfs during reconfig wifi: mac80211: check defragmentation succeeded wifi: mac80211: mesh: check element parsing succeeded wifi: mac80211: mesh_plink: fix matches_local logic wifi: cfg80211: fix certs build to not depend on file order wifi: cfg80211: fix CQM for non-range use wifi: iwlwifi: pcie: don't synchronize IRQs from IRQ wifi: cfg80211: lock wiphy mutex for rfkill poll debugfs: fix automount d_fsdata usage John Fastabend (1): bpf: syzkaller found null ptr deref in unix_bpf proto add John Johansen (1): apparmor: Fix move_mount mediation by detecting if source is detached Jorge Ramirez-Ortiz (1): mmc: rpmb: fixes pause retune on all RPMB partitions. Jose Ignacio Tornos Martinez (1): net: usb: ax88179_178a: avoid failed operations when device is disconnected Joshua Ashton (1): drm/amd/display: Fix sending VSC (+ colorimetry) packets for DP/eDP displays without PSR José Pekkarinen (1): Input: psmouse - enable Synaptics InterTouch for ThinkPad L14 G1 Judy Hsiao (1): neighbour: Don't let neigh_forced_gc() disable preemption for long Jörn-Thorben Hinz (1): net: Implement missing getsockopt(SO_TIMESTAMPING_NEW) Kai-Heng Feng (1): r8169: Fix PCI error on system resume Kamil Duljas (3): ASoC: Intel: Skylake: Fix mem leak in few functions ASoC: SOF: topology: Fix mem leak in sof_dai_load() ASoC: Intel: Skylake: mem leak in skl register function Kangjing Huang (1): ksmbd: fix missing RDMA-capable flag for IPoIB device in ksmbd_rdma_capable_netdev() Karthik Poosa (1): drm/i915/hwmon: Fix static analysis tool reported issues Katarzyna Wieczerzycka (1): ice: Fix link_down_on_close message Ke Xiao (1): i40e: fix use-after-free in i40e_aqc_add_filters() Keith Busch (5): Revert "nvme-fc: fix race between error recovery and creating association" nvme-core: check for too small lba shift nvme: introduce helper function to get ctrl state nvme: ensure reset state check ordering nvme-ioctl: move capable() admin check to the end Kent Gibson (1): gpiolib: cdev: add gpio_device locking wrapper around gpio_ioctl() Khaled Almahallawy (1): drm/i915/dp: Fix passing the correct DPCD_REV for drm_dp_set_phy_test_pattern Konrad Dybcio (1): interconnect: qcom: sm8250: Enable sync_state Krzysztof Kozlowski (3): stmmac: dwmac-loongson: drop useless check for compatible fallback MIPS: dts: loongson: drop incorrect dwmac fallback compatible reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning Kunwu Chan (1): ARM: OMAP2+: Fix null pointer dereference and memory leak in omap_soc_device_init Kurt Kanzenbach (3): igc: Report VLAN EtherType matching back to user igc: Check VLAN TCI mask igc: Check VLAN EtherType mask Lai Peter Jun Ann (1): net: stmmac: fix incorrect flag check in timestamp interrupt Larysa Zaremba (1): ice: Fix PF with enabled XDP going no-carrier after reset LeoLiuoc (1): PCI: Add ACS quirk for more Zhaoxin Root Ports Lewis Huang (1): drm/amd/display: Pass pwrseq inst for backlight and ABM Lijo Lazar (2): drm/amdgpu: Use another offset for GC 9.4.3 remap drm/amdgpu: Add NULL checks for function pointers Lingkai Dong (1): drm: Fix FD ownership check in drm_master_check_perm() Linus Torvalds (2): posix-timers: Get rid of [COMPAT_]SYS_NI() uses x86/csum: clean up `csum_partial' further Liu Jian (1): net: check vlan filter feature in vlan_vids_add_by_dev() and vlan_vids_del_by_dev() Lorenzo Bianconi (1): net: ethernet: mtk_wed: fix possible NULL pointer dereference in mtk_wed_wo_queue_tx_clean() Louis Chauvet (1): spi: atmel: Fix clock issue when using devices with different polarities Lu Yao (1): drm/amdgpu: Fix cat debugfs amdgpu_regs_didt causes kernel null pointer Luca Weiss (1): Input: xpad - add Razer Wolverine V2 support Luiz Augusto von Dentz (3): Bluetooth: Fix not notifying when connection encryption changes Bluetooth: hci_core: Fix hci_conn_hash_lookup_cis Bluetooth: hci_event: Fix not checking if HCI_OP_INQUIRY has been sent Léo Lam (1): wifi: nl80211: fix deadlock in nl80211_set_cqm_rssi (6.6.x) Maciej Strozek (2): ASoC: cs43130: Fix the position of const qualifier ASoC: cs43130: Fix incorrect frame delay configuration Marc Dionne (1): net: Save and restore msg_namelen in sock_sendmsg Marc Zyngier (3): KVM: arm64: vgic: Simplify kvm_vgic_destroy() KVM: arm64: vgic: Add a non-locking primitive for kvm_vgic_vcpu_destroy() KVM: arm64: vgic: Force vcpu vgic teardown on vcpu destroy Marek Vasut (1): clk: si521xx: Increase stack based print buffer size in probe Mario Limonciello (5): pinctrl: amd: Mask non-wake source pins with interrupt enabled at suspend platform/x86/amd/pmc: Move platform defines to header platform/x86/amd/pmc: Only run IRQ1 firmware version check on Cezanne platform/x86/amd/pmc: Move keyboard wakeup disablement detection to pmc-quirks platform/x86/amd/pmc: Disable keyboard wakeup on AMD Framework 13 Mark Brown (4): ASoC: meson: g12a-toacodec: Validate written enum values ASoC: meson: g12a-tohdmitx: Validate written enum values ASoC: meson: g12a-toacodec: Fix event generation ASoC: meson: g12a-tohdmitx: Fix event generation for S/PDIF mux Mark Glover (1): USB: serial: ftdi_sio: update Actisense PIDs constant names Martin K. Petersen (1): Revert "scsi: aacraid: Reply queue mapping to CPUs based on IRQ affinity" Mathieu Desnoyers (1): ring-buffer: Fix 32-bit rb_time_read() race with rb_time_cmpxchg() Matthew Wilcox (Oracle) (5): mm/memory-failure: cast index to loff_t before shifting it mm/memory-failure: check the mapcount of the precise page mm: convert DAX lock/unlock page to lock/unlock folio mm/memory-failure: pass the folio and the page to collect_procs() ida: Fix crash in ida_free when the bitmap is empty Matti Vaittinen (1): iio: kx022a: Fix acceleration value scaling Matus Malych (1): ASoC: amd: yc: Add HP 255 G10 into quirk table Maurizio Lombardi (2): nvme-pci: fix sleeping function called from interrupt context nvme-core: fix a memory leak in nvme_ns_info_from_identify() Maxime Ripard (1): kunit: Warn if tests are slow Michael Chan (1): bnxt_en: Remove mis-applied code from bnxt_cfg_ntp_filters() Michael Walle (1): phy: mediatek: mipi: mt8183: fix minimal supported frequency Michael-CY Lee (1): wifi: avoid offset calculation on NULL pointer Michal Schmidt (1): ice: fix theoretical out-of-bounds access in ethtool link modes Michal Wajdeczko (1): kunit: Reset suite counter right before running tests Mike Snitzer (1): dm audit: fix Kconfig so DM_AUDIT depends on BLK_DEV_DM Mike Tipton (1): interconnect: Treat xlate() returning NULL node as an error Mikulas Patocka (1): dm-integrity: don't modify bio's immutable bio_vec in integrity_metadata() Ming Lei (1): blk-mq: don't count completed flush data request as inflight in case of quiesce Miquel Raynal (2): spi: atmel: Do not cancel a transfer upon any signal spi: atmel: Prevent spi transfers from being killed Moshe Shemesh (2): net/mlx5: Fix fw tracer first block check RDMA/mlx5: Fix mkey cache WQ flush Muhammad Usama Anjum (1): selftests: secretmem: floor the memory size to the multiple of page_size Mukul Joshi (1): drm/amdkfd: Use common function for IP version check Nam Cao (3): pinctrl: starfive: jh7110: ignore disabled device tree nodes pinctrl: starfive: jh7100: ignore disabled device tree nodes spi: cadence: revert "Add SPI transfer delays" Namjae Jeon (17): ksmbd: reorganize ksmbd_iov_pin_rsp() ksmbd: fix kernel-doc comment of ksmbd_vfs_setxattr() ksmbd: add support for surrogate pair conversion ksmbd: no need to wait for binded connection termination at logoff ksmbd: fix kernel-doc comment of ksmbd_vfs_kern_path_locked() ksmbd: separately allocate ci per dentry ksmbd: move oplock handling after unlock parent dir ksmbd: release interim response after sending status pending response ksmbd: move setting SMB2_FLAGS_ASYNC_COMMAND and AsyncId ksmbd: don't update ->op_state as OPLOCK_STATE_NONE on error ksmbd: set epoch in create context v2 lease ksmbd: set v2 lease capability ksmbd: downgrade RWH lease caching state to RH for directory ksmbd: send v2 lease break notification for directory ksmbd: lazy v2 lease break on smb2_write() ksmbd: avoid duplicate opinfo_put() call on error of smb21_lease_break_ack() ksmbd: don't allow O_TRUNC open on read-only share Naveen Mamindlapalli (2): octeontx2-af: Always configure NIX TX link credits based on max frame size octeontx2-af: Re-enable MAC TX in otx2_stop processing NeilBrown (1): nfsd: call nfsd_last_thread() before final nfsd_put() Ngai-Mint Kwan (1): ice: Shut down VSI with "link-down-on-close" enabled Nitesh Shetty (1): nvme: prevent potential spectre v1 gadget Noah Goldstein (1): x86/csum: Remove unnecessary odd handling Nuno Sa (2): iio: imu: adis16475: add spi_device_id table iio: imu: adis16475: use bit numbers in assign_bit() Pablo Neira Ayuso (3): netfilter: nf_tables: skip set commit for deleted/destroyed sets netfilter: nf_tables: set transport offset from mac header for netdev/egress netfilter: nft_immediate: drop chain reference counter on error Paolo Abeni (4): mptcp: refactor sndbuf auto-tuning mptcp: fix possible NULL pointer dereference on close mptcp: fix inconsistent state on fastopen race mptcp: prevent tcp diag from closing listener subflows Paolo Bonzini (1): KVM: x86/pmu: fix masking logic for MSR_CORE_PERF_GLOBAL_CTRL Patrick Rudolph (3): pinctrl: cy8c95x0: Fix typo pinctrl: cy8c95x0: Fix regression pinctrl: cy8c95x0: Fix get_pincfg Paulo Alcantara (5): smb: client: fix OOB in cifsd when receiving compounded resps smb: client: fix potential OOB in cifs_dump_detail() smb: client: fix OOB in SMB2_query_info_init() smb: client: fix OOB in smbCalcSize() smb: client: fix potential OOB in smb2_dump_detail() Peter Ujfalusi (6): ALSA: hda: intel-nhlt: Ignore vbps when looking for DMIC 32 bps format ASoC: Intel: skl_hda_dsp_generic: Drop HDMI routes when HDMI is not available ASoC: hdac_hda: Conditionally register dais for HDMI and Analog ASoC: SOF: ipc4-topology: Correct data structures for the SRC module ASoC: SOF: ipc4-topology: Correct data structures for the GAIN module ASoC: SOF: Intel: hda-codec: Delay the codec device registration Peter Zijlstra (1): rcu: Break rcu_node_0 --> &rq->__lock order Philip Yang (1): drm/amdkfd: svm range always mapped flag not working on APU Pranjal Ramajor Asha Kanojiya (1): accel/qaic: Fix GEM import path code Qu Wenruo (2): btrfs: qgroup: iterate qgroups without memory allocation for qgroup_reserve() btrfs: qgroup: use qgroup_iterator in qgroup_convert_meta() Quan Nguyen (1): i2c: aspeed: Handle the coalesced stop conditions with the start conditions. Rafał Miłecki (1): nvmem: brcm_nvram: store a copy of NVRAM content Rahul Rameshbabu (2): net/mlx5e: Correct snprintf truncation handling for fw_version buffer net/mlx5e: Correct snprintf truncation handling for fw_version buffer used by representors Rajvi Jingar (1): platform/x86/intel/pmc: Fix hang in pmc_core_send_ltr_ignore() Ranjani Sridharan (2): ASoC: SOF: ipc4-topology: Add core_mask in struct snd_sof_pipeline ASoC: SOF: sof-audio: Modify logic for enabling/disabling topology cores Reinhard Speyerer (1): USB: serial: option: add Quectel RM500Q R13 firmware support Ricardo Rivera-Matos (3): ASoC: cs35l45: Use modern pm_ops ASoC: cs35l45: Prevent IRQ handling when suspending/resuming ASoC: cs35l45: Prevents spinning during runtime suspend Rob Herring (1): arm64: dts: rockchip: Fix PCI node addresses on rk3399-gru Rodrigo Cataldo (1): igc: Fix hicredit calculation Ronald Wahl (2): net: ks8851: Fix TX stall caused by TX buffer overrun dmaengine: ti: k3-psil-am62: Fix SPI PDMA data Rouven Czerwinski (1): net: rfkill: gpio: set GPIO direction Ryan McClelland (1): HID: nintendo: fix initializer element is not constant error Sarannya S (1): net: qrtr: ns: Return 0 if server port is not present SeongJae Park (2): mm/damon/core: use number of passed access sampling as a timer mm/damon/core: make damon_start() waits until kdamond_fn() starts Shannon Nelson (3): pds_vdpa: fix up format-truncation complaint pds_vdpa: clear config callback when status goes to 0 pds_vdpa: set features order Shengjiu Wang (3): ASoC: fsl_sai: Fix channel swap issue on i.MX8MP ASoC: fsl_xcvr: Enable 2 * TX bit clock for spdif only case ASoC: fsl_xcvr: refine the requested phy clock frequency Shifeng Li (2): net/mlx5e: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list() net/mlx5e: Fix a race in command alloc flow Shigeru Yoshida (1): net: Return error from sk_stream_wait_connect() if sk_wait_event() fails Shin'ichiro Kawasaki (2): platform/x86: p2sb: Allow p2sb_bar() calls during PCI device probe Revert "platform/x86: p2sb: Allow p2sb_bar() calls during PCI device probe" Shuming Fan (1): ASoC: rt5650: add mutex to avoid the jack detection failure Shyam Prasad N (2): cifs: cifs_chan_is_iface_active should be called with chan_lock held cifs: do not depend on release_iface for maintaining iface_list Siddh Raman Pant (2): nfc: llcp_core: Hold a ref to llcp_local->dev when holding a ref to llcp_local nfc: Do not send datagram if socket state isn't LLCP_BOUND Siddhesh Dharme (1): ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP ProBook 440 G6 Sidhartha Kumar (1): maple_tree: do not preallocate nodes for slot stores Sjoerd Simons (2): bus: moxtet: Mark the irq as shared bus: moxtet: Add spi device table Slark Xiao (1): USB: serial: option: add Foxconn T99W265 with new baseline Stefan Binding (1): ALSA: hda/realtek: Add quirks for ASUS Zenbook 2022 Models Stefan Hajnoczi (1): virtio_blk: fix snprintf truncation compiler warning Stefan Wahren (2): ARM: sun9i: smp: Fix array-index-out-of-bounds read in sunxi_mc_smp_init ARM: sun9i: smp: fix return code check of of_property_match_string Steven Rostedt (Google) (9): ring-buffer: Remove useless update to write_stamp in rb_try_to_discard() ring-buffer: Fix slowpath of interrupted event tracing / synthetic: Disable events after testing in synth_event_gen_test_init() ring-buffer: Fix wake ups when buffer_percent is set to 100 ftrace: Fix modification of direct_function hash while in use tracing: Fix blocked reader of snapshot buffer tracing: Have large events show up as '[LINE TOO BIG]' instead of nothing tracing: Add size check when printing trace_marker output ring-buffer: Do not record in NMI if the arch does not support cmpxchg in NMI Su Hui (2): iio: imu: inv_mpu6050: fix an error code problem in inv_mpu6050_read_raw phy: sunplus: return negative error code in sp_usb_phy_probe Sudheer Mogilappagari (1): i40e: Fix filter input checks to prevent config with invalid values Suman Ghosh (2): octeontx2-pf: Fix graceful exit during PFC configuration failure octeontx2-af: Fix marking couple of structure as __packed Sumanth Korikkar (1): mm/memory_hotplug: fix memmap_on_memory sysfs value retrieval Svyatoslav Pankratov (1): crypto: qat - fix double free during reset Takashi Sakamoto (1): firewire: ohci: suppress unexpected system reboot in AMD Ryzen machines and ASM108x/VT630x PCIe cards Tasos Sahanidis (1): usb-storage: Add quirk for incorrect WP on Kingston DT Ultimate 3.0 G3 Thinh Tran (1): net/tg3: fix race condition in tg3_reset_task() Thomas Gleixner (3): x86/alternatives: Sync core before enabling interrupts x86/alternatives: Disable interrupts and sync when optimizing NOPs in place x86/smpboot/64: Handle X2APIC BIOS inconsistency gracefully Thomas Lange (1): net: Implement missing SO_TIMESTAMPING_NEW cmsg support Thomas Weißschuh (1): net: avoid build bug in skb extension length calculation Tirthendu Sarkar (1): xsk: add multi-buffer support for sockets sharing umem Tom Jason Schwanke (1): ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP Envy X360 13-ay0xxx Tony Lindgren (2): ARM: dts: Fix occasional boot hang for am3 usb bus: ti-sysc: Flush posted write only after srst_udelay Tvrtko Ursulin (1): drm: Update file owner during use Umesh Nerlige Ramappa (1): drm/i915/perf: Update handling of MMIO triggered reports Vasiliy Kovalev (1): ALSA: hda - Fix speaker and headset mic pin config for CHUWI CoreBook XPro Ville Syrjälä (5): drm/i915: Fix FEC state dump drm/i915: Introduce crtc_state->enhanced_framing drm/i915: Reject async flips with bigjoiner drm/i915/dmc: Don't enable any pipe DMC events drm/i915: Call intel_pre_plane_updates() also for pipes getting enabled Vineet Gupta (2): ARC: fix spare error ARC: fix smatch warning Vineeth Vijayan (1): s390/scm: fix virtual vs physical address confusion Vishnu Sankar (1): platform/x86: thinkpad_acpi: fix for incorrect fan reporting on some ThinkPad systems Vlad Buslov (3): Revert "net/mlx5e: fix double free of encap_header in update funcs" Revert "net/mlx5e: fix double free of encap_header" net/mlx5: Refactor mlx5_flow_destination->rep pointer to vport num Vladimir Oltean (2): net: mscc: ocelot: fix eMAC TX RMON stats for bucket 256-511 and above net: mscc: ocelot: fix pMAC TX RMON stats for bucket 256-511 and above WANG Rui (1): LoongArch: Apply dynamic relocations for LLD Wadim Egorov (1): iio: adc: ti_am335x_adc: Fix return value check of tiadc_request_dma() Wang Yao (1): efi/loongarch: Use load address to calculate kernel entry address Wayne Lin (2): drm/amd/display: pbn_div need be updated for hotplug event drm/amd/display: Add case for dcn35 to support usb4 dmub hpd event Wei Yongjun (1): scsi: bnx2fc: Fix skb double free in bnx2fc_rcv() Weihao Li (1): clk: rockchip: rk3128: Fix HCLK_OTG gate register Wen Gu (1): net/smc: fix invalid link access in dumping SMC-R connections Wenchao Chen (1): mmc: sdhci-sprd: Fix eMMC init failure after hw reset Xiang Yang (1): drm/exynos: fix a potential error pointer dereference Xiao Yao (1): Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE Xiaolei Wang (2): dmaengine: fsl-edma: Do not suspend and resume the masked dma channel when the system is sleeping dmaengine: fsl-edma: Add judgment on enabling round robin arbitration Xuan Zhuo (2): virtio_ring: fix syncs DMA memory with different direction virtio_net: fix missing dma unmap for resize Yang Yingliang (2): i2c: qcom-geni: fix missing clk_disable_unprepare() and geni_se_resources_off() dmaengine: fsl-edma: fix wrong pointer check in fsl_edma3_attach_pd() Yaxiong Tian (1): thunderbolt: Fix memory leak in margining_port_remove() Ye Bin (1): jbd2: fix soft lockup in journal_finish_inode_data_buffers() Ying Hsu (1): Bluetooth: Fix deadlock in vhci_send_frame Yong-Xuan Wang (1): RISCV: KVM: update external interrupt atomically for IMSIC swfile Yu Kuai (1): block: warn once for each partition in bio_check_ro() Yu Zhao (1): mm/mglru: skip special VMAs in lru_gen_look_around() Yury Norov (1): net: mana: select PAGE_POOL Zhang Yi (2): jbd2: correct the printing of write_flags in jbd2_write_superblock() jbd2: increase the journal IO's priority ZhenGuo Yin (2): drm/amdgpu: re-create idle bo's PTE during VM state machine reset drm/amdkfd: Free gang_ctx_bo and wptr_bo in pqm_uninit Zheng Yejian (1): tracing: Fix uaf issue when open the hist or hist_debug file Zhipeng Lu (2): ethernet: atheros: fix a memleak in atl1e_setup_ring_resources sfc: fix a double-free bug in efx_probe_filters Ziqi Zhao (1): drm/crtc: Fix uninit-value bug in drm_mode_setcrtc Ziyang Huang (1): mmc: meson-mx-sdhc: Fix initialization frozen issue Zizhi Wo (1): fs: cifs: Fix atime update check Zongmin Zhou (1): ksmbd: prevent memory leak on error return wangkeqi (1): connector: Fix proc_event_num_listeners count not cleared xiongxin (1): gpio: dwapb: mask/unmask IRQ when disable/enale it .../devicetree/bindings/nvmem/mxs-ocotp.yaml | 10 +- arch/arc/kernel/setup.c | 4 +- arch/arc/kernel/signal.c | 6 +- arch/arm/boot/dts/ti/omap/am33xx.dtsi | 1 + arch/arm/boot/dts/ti/omap/dra7.dtsi | 2 +- arch/arm/mach-omap2/id.c | 5 + arch/arm/mach-sunxi/mc_smp.c | 8 +- .../allwinner/sun50i-h616-orangepi-zero.dtsi | 3 - .../allwinner/sun50i-h616-orangepi-zero2.dts | 3 + .../allwinner/sun50i-h618-orangepi-zero3.dts | 2 + .../dts/rockchip/rk3399-gru-chromebook.dtsi | 3 +- .../dts/rockchip/rk3399-gru-scarlet-dumo.dts | 4 +- arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi | 1 + arch/arm64/boot/dts/rockchip/rk356x.dtsi | 2 +- arch/arm64/include/asm/syscall_wrapper.h | 4 - arch/arm64/kvm/arm.c | 2 +- arch/arm64/kvm/vgic/vgic-init.c | 47 ++-- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 2 +- arch/arm64/kvm/vgic/vgic.h | 1 + arch/loongarch/Makefile | 2 +- arch/loongarch/include/asm/efi.h | 2 +- arch/loongarch/include/asm/elf.h | 2 +- arch/loongarch/kernel/stacktrace.c | 2 +- arch/loongarch/kernel/unwind.c | 1 - arch/loongarch/kernel/unwind_prologue.c | 2 +- .../boot/dts/loongson/loongson64-2k1000.dtsi | 3 +- arch/mips/boot/dts/loongson/ls7a-pch.dtsi | 3 +- arch/powerpc/Kconfig | 4 +- arch/powerpc/platforms/pseries/vas.c | 51 +++- arch/powerpc/platforms/pseries/vas.h | 2 + arch/riscv/Kconfig | 4 +- arch/riscv/include/asm/syscall_wrapper.h | 5 - arch/riscv/kernel/cpufeature.c | 4 + arch/riscv/kvm/aia_imsic.c | 13 + arch/s390/Kconfig | 4 +- arch/s390/include/asm/fpu/api.h | 2 +- arch/s390/include/asm/syscall_wrapper.h | 13 +- arch/s390/kvm/vsie.c | 4 - arch/x86/Kconfig | 4 +- arch/x86/events/intel/core.c | 7 +- arch/x86/include/asm/syscall_wrapper.h | 34 +-- arch/x86/kernel/alternative.c | 14 +- arch/x86/kernel/head_64.S | 16 ++ arch/x86/kernel/kprobes/core.c | 3 +- arch/x86/lib/csum-partial_64.c | 105 +++----- arch/x86/net/bpf_jit_comp.c | 46 ++++ arch/x86/xen/Kconfig | 1 + block/blk-core.c | 14 +- block/blk-mq.c | 14 +- crypto/xts.c | 23 +- drivers/accel/qaic/mhi_controller.c | 15 +- drivers/accel/qaic/qaic_data.c | 6 +- drivers/acpi/resource.c | 7 + drivers/acpi/thermal.c | 4 +- drivers/android/binder.c | 2 +- drivers/android/binder_alloc.c | 10 +- drivers/block/virtio_blk.c | 8 +- drivers/bluetooth/hci_vhci.c | 10 +- drivers/bus/moxtet.c | 9 +- drivers/bus/ti-sysc.c | 18 +- drivers/clk/clk-si521xx.c | 4 +- drivers/clk/rockchip/clk-rk3128.c | 24 +- drivers/clk/rockchip/clk-rk3568.c | 1 + drivers/connector/cn_proc.c | 5 +- drivers/crypto/intel/qat/qat_common/adf_aer.c | 3 +- drivers/cxl/core/hdm.c | 9 +- drivers/cxl/core/mbox.c | 2 +- drivers/cxl/core/memdev.c | 31 ++- drivers/cxl/core/pmu.c | 2 +- drivers/cxl/core/port.c | 7 + drivers/cxl/core/region.c | 5 - drivers/cxl/cxl.h | 1 + drivers/dma/fsl-edma-main.c | 12 +- drivers/dma/idxd/submit.c | 14 +- drivers/dma/ti/k3-psil-am62.c | 12 +- drivers/dma/ti/k3-psil-am62a.c | 12 +- drivers/firewire/ohci.c | 51 ++++ drivers/firmware/efi/libstub/loongarch-stub.c | 4 +- drivers/firmware/efi/libstub/loongarch.c | 6 +- drivers/gpio/gpio-dwapb.c | 12 +- drivers/gpio/gpiolib-cdev.c | 16 +- drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 6 + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 1 + drivers/gpu/drm/amd/amdgpu/nbio_v7_9.c | 5 - drivers/gpu/drm/amd/amdgpu/soc15.c | 17 +- drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 2 +- .../amd/amdkfd/kfd_process_queue_manager.c | 54 ++-- drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 18 +- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 14 +- .../amd/display/amdgpu_dm/amdgpu_dm_helpers.c | 6 + .../drm/amd/display/dc/bios/bios_parser2.c | 23 +- .../drm/amd/display/dc/bios/command_table2.c | 12 +- .../drm/amd/display/dc/bios/command_table2.h | 2 +- .../dc/clk_mgr/dcn315/dcn315_clk_mgr.c | 8 +- drivers/gpu/drm/amd/display/dc/core/dc.c | 26 +- .../gpu/drm/amd/display/dc/dc_bios_types.h | 2 +- drivers/gpu/drm/amd/display/dc/dc_hw_types.h | 1 + drivers/gpu/drm/amd/display/dc/dce/dmub_abm.c | 8 +- .../gpu/drm/amd/display/dc/dce/dmub_abm_lcd.c | 7 +- .../gpu/drm/amd/display/dc/dce/dmub_abm_lcd.h | 2 +- .../display/dc/dce110/dce110_hw_sequencer.c | 16 +- .../amd/display/dc/dcn10/dcn10_hw_sequencer.c | 3 +- .../gpu/drm/amd/display/dc/dcn20/dcn20_hubp.c | 12 +- .../drm/amd/display/dc/dcn21/dcn21_hwseq.c | 36 ++- .../amd/display/dc/dcn31/dcn31_panel_cntl.c | 5 +- drivers/gpu/drm/amd/display/dc/dml/Makefile | 4 + .../gpu/drm/amd/display/dc/dml/dc_features.h | 2 +- .../drm/amd/display/dc/dml/dcn20/dcn20_fpu.c | 110 +++++++- drivers/gpu/drm/amd/display/dc/inc/hw/abm.h | 3 +- .../drm/amd/display/dc/inc/hw/panel_cntl.h | 2 + .../drm/amd/display/dc/link/link_factory.c | 56 ++-- .../gpu/drm/amd/display/dmub/inc/dmub_cmd.h | 14 +- .../display/include/grph_object_ctrl_defs.h | 2 + .../display/modules/info_packet/info_packet.c | 13 +- drivers/gpu/drm/bridge/parade-ps8640.c | 7 +- drivers/gpu/drm/bridge/ti-sn65dsi86.c | 4 +- drivers/gpu/drm/drm_auth.c | 3 +- drivers/gpu/drm/drm_crtc.c | 8 +- drivers/gpu/drm/drm_debugfs.c | 10 +- drivers/gpu/drm/drm_file.c | 40 ++- drivers/gpu/drm/drm_ioctl.c | 3 + drivers/gpu/drm/exynos/exynos_drm_dma.c | 8 +- drivers/gpu/drm/exynos/exynos_hdmi.c | 2 + drivers/gpu/drm/i915/display/g4x_dp.c | 10 +- drivers/gpu/drm/i915/display/intel_crt.c | 2 + .../drm/i915/display/intel_crtc_state_dump.c | 3 + drivers/gpu/drm/i915/display/intel_cx0_phy.c | 3 +- drivers/gpu/drm/i915/display/intel_ddi.c | 22 +- drivers/gpu/drm/i915/display/intel_display.c | 15 +- .../drm/i915/display/intel_display_types.h | 2 + drivers/gpu/drm/i915/display/intel_dmc.c | 43 ++- drivers/gpu/drm/i915/display/intel_dp.c | 5 +- .../drm/i915/display/intel_dp_link_training.c | 35 ++- drivers/gpu/drm/i915/i915_hwmon.c | 4 +- drivers/gpu/drm/i915/i915_perf.c | 39 ++- drivers/gpu/drm/mgag200/mgag200_drv.h | 5 + drivers/gpu/drm/mgag200/mgag200_g200er.c | 5 + drivers/gpu/drm/mgag200/mgag200_g200ev.c | 5 + drivers/gpu/drm/mgag200/mgag200_g200se.c | 5 + drivers/gpu/drm/mgag200/mgag200_mode.c | 10 +- drivers/gpu/drm/nouveau/nouveau_drm.c | 5 +- .../drm/nouveau/nvkm/subdev/mmu/vmmtu102.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_gem.c | 6 +- drivers/hid/hid-nintendo.c | 71 ++--- drivers/hwmon/corsair-psu.c | 18 +- drivers/hwtracing/coresight/coresight-etm4x.h | 2 +- drivers/i2c/busses/i2c-aspeed.c | 48 ++-- drivers/i2c/busses/i2c-qcom-geni.c | 8 +- drivers/i2c/busses/i2c-rk3x.c | 13 +- drivers/i2c/i2c-core.h | 4 +- drivers/iio/accel/kionix-kx022a.c | 37 ++- drivers/iio/adc/imx93_adc.c | 4 + drivers/iio/adc/meson_saradc.c | 16 +- drivers/iio/adc/ti_am335x_adc.c | 4 +- .../buffer/industrialio-triggered-buffer.c | 10 + .../iio/common/ms_sensors/ms_sensors_i2c.c | 4 +- drivers/iio/imu/adis16475.c | 121 +++++---- drivers/iio/imu/inv_mpu6050/inv_mpu_core.c | 4 +- drivers/iio/magnetometer/tmag5273.c | 2 +- drivers/infiniband/hw/mlx5/mr.c | 2 + drivers/input/joystick/xpad.c | 1 + drivers/input/keyboard/atkbd.c | 46 +++- drivers/input/keyboard/ipaq-micro-keys.c | 3 + drivers/input/misc/soc_button_array.c | 5 + drivers/input/mouse/synaptics.c | 1 + drivers/input/serio/i8042-acpipnpio.h | 8 + drivers/interconnect/core.c | 3 + drivers/interconnect/qcom/sm8250.c | 1 + drivers/leds/trigger/ledtrig-tty.c | 4 + drivers/md/Kconfig | 1 + drivers/md/dm-integrity.c | 11 +- .../platform/qcom/camss/camss-csid-gen2.c | 14 +- drivers/media/platform/qcom/camss/camss.c | 45 ++-- drivers/mmc/core/block.c | 7 +- drivers/mmc/core/host.c | 1 + drivers/mmc/host/meson-mx-sdhc-mmc.c | 26 +- drivers/mmc/host/sdhci-sprd.c | 10 +- .../net/ethernet/atheros/atl1e/atl1e_main.c | 5 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 +- drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 11 +- .../net/ethernet/broadcom/genet/bcmgenet.c | 4 +- drivers/net/ethernet/broadcom/tg3.c | 11 +- drivers/net/ethernet/intel/i40e/i40e_main.c | 11 +- .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 34 ++- .../ethernet/intel/i40e/i40e_virtchnl_pf.h | 3 + drivers/net/ethernet/intel/ice/ice_ethtool.c | 4 +- drivers/net/ethernet/intel/ice/ice_lag.c | 2 + drivers/net/ethernet/intel/ice/ice_lib.c | 7 +- drivers/net/ethernet/intel/ice/ice_main.c | 12 +- drivers/net/ethernet/intel/igc/igc.h | 1 + drivers/net/ethernet/intel/igc/igc_ethtool.c | 42 ++- drivers/net/ethernet/intel/igc/igc_tsn.c | 2 +- .../net/ethernet/marvell/octeontx2/af/npc.h | 4 +- .../net/ethernet/marvell/octeontx2/af/rvu.h | 1 + .../ethernet/marvell/octeontx2/af/rvu_cgx.c | 17 ++ .../ethernet/marvell/octeontx2/af/rvu_nix.c | 118 +-------- .../marvell/octeontx2/nic/otx2_dcbnl.c | 17 +- drivers/net/ethernet/mediatek/mtk_wed_wo.c | 3 + drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 12 +- .../mellanox/mlx5/core/diag/fw_tracer.c | 2 +- .../mellanox/mlx5/core/en/fs_tt_redirect.c | 1 + .../mellanox/mlx5/core/en/tc/act/mirred.c | 5 +- .../ethernet/mellanox/mlx5/core/en/tc_tun.c | 30 ++- .../mellanox/mlx5/core/en/tc_tun_encap.c | 3 +- .../net/ethernet/mellanox/mlx5/core/en/xdp.c | 4 +- .../mellanox/mlx5/core/en_accel/ipsec_fs.c | 2 +- .../ethernet/mellanox/mlx5/core/en_ethtool.c | 2 +- .../net/ethernet/mellanox/mlx5/core/en_rep.c | 2 +- .../net/ethernet/mellanox/mlx5/core/en_tc.c | 10 +- .../net/ethernet/mellanox/mlx5/core/eswitch.h | 3 +- .../mellanox/mlx5/core/eswitch_offloads.c | 31 ++- .../mlx5/core/eswitch_offloads_termtbl.c | 4 +- .../net/ethernet/mellanox/mlx5/core/vport.c | 2 +- .../mellanox/mlxbf_gige/mlxbf_gige_rx.c | 9 +- drivers/net/ethernet/micrel/ks8851.h | 3 + drivers/net/ethernet/micrel/ks8851_common.c | 20 +- drivers/net/ethernet/micrel/ks8851_spi.c | 42 +-- drivers/net/ethernet/microsoft/Kconfig | 1 + drivers/net/ethernet/mscc/ocelot_stats.c | 16 +- drivers/net/ethernet/qlogic/qla3xxx.c | 2 + drivers/net/ethernet/realtek/r8169_main.c | 2 +- drivers/net/ethernet/renesas/ravb_main.c | 65 +++-- drivers/net/ethernet/sfc/rx_common.c | 4 +- .../ethernet/stmicro/stmmac/dwmac-loongson.c | 5 - .../ethernet/stmicro/stmmac/stmmac_hwtstamp.c | 2 +- drivers/net/phy/phy_device.c | 6 +- drivers/net/usb/ax88172a.c | 4 +- drivers/net/usb/ax88179_178a.c | 23 +- drivers/net/virtio_net.c | 90 +++---- .../wireless/intel/iwlwifi/pcie/internal.h | 4 +- drivers/net/wireless/intel/iwlwifi/pcie/rx.c | 10 +- .../net/wireless/intel/iwlwifi/pcie/trans.c | 21 +- drivers/net/wireless/mediatek/mt76/dma.c | 10 +- drivers/nvme/host/core.c | 67 +++-- drivers/nvme/host/fc.c | 27 +- drivers/nvme/host/ioctl.c | 21 +- drivers/nvme/host/nvme.h | 6 + drivers/nvme/host/pci.c | 14 +- drivers/nvme/host/rdma.c | 23 +- drivers/nvme/host/tcp.c | 27 +- drivers/nvme/target/configfs.c | 3 + drivers/nvmem/brcm_nvram.c | 134 +++++++--- drivers/parport/parport_serial.c | 64 +++++ drivers/pci/pci.c | 6 + drivers/pci/pci.h | 2 + drivers/pci/pcie/aspm.c | 19 ++ drivers/pci/quirks.c | 8 +- .../phy/mediatek/phy-mtk-mipi-dsi-mt8183.c | 2 +- drivers/phy/sunplus/phy-sunplus-usb2.c | 2 +- drivers/phy/ti/phy-gmii-sel.c | 5 +- drivers/pinctrl/cirrus/Kconfig | 3 +- drivers/pinctrl/nxp/pinctrl-s32cc.c | 4 +- drivers/pinctrl/pinctrl-amd.c | 9 + drivers/pinctrl/pinctrl-amd.h | 5 + drivers/pinctrl/pinctrl-at91-pio4.c | 8 + drivers/pinctrl/pinctrl-cy8c95x0.c | 14 +- .../starfive/pinctrl-starfive-jh7100.c | 4 +- .../starfive/pinctrl-starfive-jh7110.c | 4 +- drivers/platform/x86/amd/pmc/pmc-quirks.c | 20 ++ drivers/platform/x86/amd/pmc/pmc.c | 33 +-- drivers/platform/x86/amd/pmc/pmc.h | 12 + drivers/platform/x86/intel/pmc/adl.c | 9 +- drivers/platform/x86/intel/pmc/cnp.c | 26 +- drivers/platform/x86/intel/pmc/core.c | 14 +- drivers/platform/x86/intel/pmc/core.h | 7 +- drivers/platform/x86/intel/pmc/mtl.c | 9 +- drivers/platform/x86/intel/pmc/tgl.c | 9 +- drivers/platform/x86/intel/vbtn.c | 19 +- drivers/platform/x86/thinkpad_acpi.c | 98 ++++++- drivers/reset/core.c | 8 +- drivers/reset/hisilicon/hi6220_reset.c | 2 +- drivers/s390/block/scm_blk.c | 7 +- drivers/scsi/aacraid/aacraid.h | 1 - drivers/scsi/aacraid/commsup.c | 6 +- drivers/scsi/aacraid/linit.c | 14 - drivers/scsi/aacraid/src.c | 25 +- drivers/scsi/bnx2fc/bnx2fc_fcoe.c | 9 +- drivers/scsi/scsi_error.c | 2 + drivers/soundwire/intel_ace2x.c | 3 +- drivers/spi/spi-atmel.c | 92 ++++++- drivers/spi/spi-cadence.c | 1 - drivers/spi/spi-imx.c | 15 +- drivers/thunderbolt/debugfs.c | 2 +- drivers/ufs/core/ufshcd.c | 3 +- drivers/ufs/host/ufs-qcom.c | 6 +- drivers/uio/uio.c | 7 +- drivers/usb/fotg210/fotg210-hcd.c | 3 - drivers/usb/serial/ftdi_sio.c | 6 +- drivers/usb/serial/ftdi_sio_ids.h | 6 +- drivers/usb/serial/option.c | 5 + drivers/usb/storage/unusual_devs.h | 11 + drivers/usb/typec/ucsi/ucsi_glink.c | 2 +- drivers/vdpa/pds/debugfs.c | 2 +- drivers/vdpa/pds/vdpa_dev.c | 7 +- drivers/virtio/virtio_ring.c | 6 +- fs/afs/cell.c | 6 +- fs/afs/dynroot.c | 31 ++- fs/afs/internal.h | 2 + fs/afs/volume.c | 26 +- fs/btrfs/disk-io.c | 28 ++ fs/btrfs/qgroup.c | 96 +++---- fs/btrfs/qgroup.h | 9 + fs/btrfs/transaction.c | 2 - fs/btrfs/transaction.h | 3 + fs/dax.c | 24 +- fs/debugfs/file.c | 8 + fs/debugfs/inode.c | 27 +- fs/debugfs/internal.h | 10 +- fs/jbd2/commit.c | 10 +- fs/jbd2/journal.c | 24 +- fs/libfs.c | 41 ++- fs/nfsd/nfsctl.c | 32 ++- fs/nfsd/nfsd.h | 8 +- fs/nfsd/nfssvc.c | 2 +- fs/smb/client/cifs_debug.c | 12 +- fs/smb/client/cifsglob.h | 4 +- fs/smb/client/cifspdu.h | 24 +- fs/smb/client/cifssmb.c | 6 +- fs/smb/client/connect.c | 14 +- fs/smb/client/file.c | 18 +- fs/smb/client/fscache.h | 6 +- fs/smb/client/inode.c | 17 +- fs/smb/client/misc.c | 4 + fs/smb/client/smb2misc.c | 30 +-- fs/smb/client/smb2ops.c | 65 +++-- fs/smb/client/smb2pdu.c | 37 ++- fs/smb/client/smb2pdu.h | 16 +- fs/smb/common/smb2pdu.h | 18 +- fs/smb/server/connection.c | 16 -- fs/smb/server/ksmbd_work.c | 51 ++-- fs/smb/server/mgmt/user_config.h | 1 - fs/smb/server/oplock.c | 118 ++++++++- fs/smb/server/oplock.h | 8 +- fs/smb/server/smb2ops.c | 9 +- fs/smb/server/smb2pdu.c | 179 +++++++------ fs/smb/server/smbacl.c | 11 +- fs/smb/server/transport_rdma.c | 40 ++- fs/smb/server/unicode.c | 187 ++++++++++---- fs/smb/server/vfs.c | 14 +- fs/smb/server/vfs_cache.c | 30 ++- fs/smb/server/vfs_cache.h | 9 +- include/drm/drm_file.h | 13 +- include/linux/blk_types.h | 2 + include/linux/blkdev.h | 2 +- include/linux/bpf.h | 3 + include/linux/damon.h | 16 +- include/linux/dax.h | 10 +- include/linux/device.h | 2 + include/linux/export-internal.h | 6 +- include/linux/fs.h | 85 +++++- include/linux/ieee80211.h | 7 +- include/linux/jbd2.h | 3 + include/linux/key-type.h | 1 + include/net/bluetooth/hci_core.h | 9 +- include/net/ip6_fib.h | 64 +---- include/net/netfilter/nf_tables_ipv4.h | 2 +- include/net/sock.h | 9 +- include/net/tcp.h | 2 + include/net/xdp_sock.h | 2 + include/trace/events/9p.h | 11 +- io_uring/cancel.c | 11 +- io_uring/io_uring.c | 36 +-- kernel/Kconfig.kexec | 2 + kernel/bpf/arraymap.c | 58 +---- kernel/rcu/rcu.h | 2 + kernel/rcu/tasks.h | 32 ++- kernel/rcu/tree.c | 43 ++- kernel/resource.c | 4 +- kernel/sys_ni.c | 14 + kernel/time/posix-stubs.c | 45 ---- kernel/trace/ftrace.c | 100 ++++--- kernel/trace/ring_buffer.c | 148 ++++------- kernel/trace/synth_event_gen_test.c | 11 + kernel/trace/trace.c | 32 ++- kernel/trace/trace.h | 1 + kernel/trace/trace_events_hist.c | 12 +- kernel/trace/trace_output.c | 6 +- lib/idr.c | 2 +- lib/kunit/test.c | 42 ++- lib/maple_tree.c | 11 + lib/test_ida.c | 40 +++ lib/vsprintf.c | 11 +- mm/damon/core.c | 102 ++++---- mm/filemap.c | 9 + mm/memory-failure.c | 60 ++--- mm/memory.c | 4 +- mm/memory_hotplug.c | 8 +- mm/migrate.c | 9 +- mm/vmscan.c | 13 +- net/8021q/vlan_core.c | 9 +- net/9p/protocol.c | 17 +- net/bluetooth/af_bluetooth.c | 7 +- net/bluetooth/hci_event.c | 30 ++- net/bluetooth/l2cap_core.c | 21 +- net/bluetooth/mgmt.c | 25 +- net/bluetooth/smp.c | 7 + net/core/dev.c | 3 + net/core/neighbour.c | 9 +- net/core/skbuff.c | 5 +- net/core/sock.c | 12 +- net/core/sock_map.c | 2 + net/core/stream.c | 2 +- net/dns_resolver/dns_key.c | 25 +- net/ife/ife.c | 1 + net/ipv4/tcp.c | 3 +- net/ipv4/tcp_output.c | 16 +- net/ipv6/ip6_fib.c | 55 +--- net/ipv6/route.c | 6 +- net/mac80211/cfg.c | 4 +- net/mac80211/driver-ops.c | 6 +- net/mac80211/ht.c | 1 + net/mac80211/mesh_plink.c | 16 +- net/mac80211/mlme.c | 4 +- net/mptcp/options.c | 1 + net/mptcp/protocol.c | 27 +- net/mptcp/protocol.h | 63 ++++- net/mptcp/sockopt.c | 5 +- net/mptcp/subflow.c | 42 ++- net/netfilter/nf_nat_ovs.c | 3 +- net/netfilter/nf_tables_api.c | 2 +- net/netfilter/nf_tables_core.c | 2 +- net/netfilter/nft_immediate.c | 2 +- net/nfc/llcp_core.c | 39 ++- net/nfc/llcp_sock.c | 5 + net/qrtr/ns.c | 4 +- net/rfkill/rfkill-gpio.c | 8 + net/rose/af_rose.c | 39 ++- net/sched/em_text.c | 4 +- net/smc/smc_diag.c | 3 +- net/socket.c | 2 + net/sunrpc/svc_xprt.c | 5 +- net/wireless/certs/wens.hex | 87 +++++++ net/wireless/core.c | 2 + net/wireless/core.h | 1 + net/wireless/nl80211.c | 56 ++-- net/xdp/xsk.c | 2 +- net/xdp/xsk_buff_pool.c | 3 + samples/vfio-mdev/mtty.c | 239 +++++++++++------ scripts/decode_stacktrace.sh | 19 +- security/apparmor/apparmorfs.c | 1 + security/apparmor/mount.c | 4 + security/keys/gc.c | 31 ++- security/keys/internal.h | 11 +- security/keys/key.c | 15 +- security/keys/proc.c | 2 +- sound/drivers/pcmtest.c | 13 +- sound/hda/intel-nhlt.c | 33 ++- sound/pci/hda/patch_realtek.c | 20 +- sound/pci/hda/tas2781_hda_i2c.c | 244 ++++++++++-------- sound/soc/amd/yc/acp6x-mach.c | 14 + sound/soc/codecs/cs35l45-i2c.c | 2 +- sound/soc/codecs/cs35l45-spi.c | 2 +- sound/soc/codecs/cs35l45.c | 56 +++- sound/soc/codecs/cs43130.c | 6 +- sound/soc/codecs/da7219-aad.c | 2 +- sound/soc/codecs/hdac_hda.c | 23 +- sound/soc/codecs/hdmi-codec.c | 12 +- sound/soc/codecs/nau8822.c | 9 +- sound/soc/codecs/rt5645.c | 10 +- sound/soc/codecs/tas2781-comlib.c | 4 +- sound/soc/codecs/tas2781-fmwlib.c | 14 +- sound/soc/codecs/tas2781-i2c.c | 2 + sound/soc/codecs/wm8974.c | 6 +- sound/soc/fsl/fsl_rpmsg.c | 10 +- sound/soc/fsl/fsl_sai.c | 3 + sound/soc/fsl/fsl_xcvr.c | 14 +- sound/soc/intel/boards/bytcr_rt5640.c | 31 ++- sound/soc/intel/boards/skl_hda_dsp_generic.c | 2 + sound/soc/intel/skylake/skl-pcm.c | 9 +- sound/soc/intel/skylake/skl-sst-ipc.c | 4 +- sound/soc/mediatek/mt8186/mt8186-dai-adda.c | 2 +- sound/soc/meson/g12a-toacodec.c | 5 +- sound/soc/meson/g12a-tohdmitx.c | 8 +- sound/soc/sof/intel/hda-codec.c | 18 +- sound/soc/sof/ipc3-topology.c | 2 + sound/soc/sof/ipc4-control.c | 20 +- sound/soc/sof/ipc4-topology.c | 61 +++-- sound/soc/sof/ipc4-topology.h | 34 ++- sound/soc/sof/sof-audio.c | 65 +++-- sound/soc/sof/sof-audio.h | 2 + sound/soc/sof/topology.c | 4 +- sound/usb/quirks.c | 4 +- tools/bpf/bpftool/gen.c | 15 +- tools/testing/cxl/Kbuild | 1 + tools/testing/cxl/cxl_core_exports.c | 7 + tools/testing/cxl/test/cxl.c | 5 +- tools/testing/radix-tree/maple.c | 2 +- tools/testing/selftests/alsa/mixer-test.c | 2 +- .../bonding/bond-arp-interval-causes-panic.sh | 6 +- tools/testing/selftests/mm/memfd_secret.c | 3 + .../testing/selftests/net/mptcp/mptcp_join.sh | 8 +- 493 files changed, 5473 insertions(+), 2775 deletions(-) create mode 100644 net/wireless/certs/wens.hex create mode 100644 tools/testing/cxl/cxl_core_exports.c -- 2.25.1

2 471

[PATCH openEuler-1.0-LTS v4 0/5] CVE-2023-52595
by Pu Lehui 19 Mar '24

19 Mar '24

Shiji Yang (1): wifi: rt2x00: restart beacon queue when hardware reset Stanislaw Gruszka (4): rt2800: do not nullify initialization vector data rt2800: add pre_reset_hw callback rt2x00: clear IV's on start to fix AP mode regression rt2x00: clear up IV's on key removal .../net/wireless/ralink/rt2x00/rt2800lib.c | 52 +++++++++++++++---- .../net/wireless/ralink/rt2x00/rt2800lib.h | 1 + .../net/wireless/ralink/rt2x00/rt2800pci.c | 1 + .../net/wireless/ralink/rt2x00/rt2800soc.c | 1 + .../net/wireless/ralink/rt2x00/rt2800usb.c | 1 + drivers/net/wireless/ralink/rt2x00/rt2x00.h | 2 + .../net/wireless/ralink/rt2x00/rt2x00dev.c | 26 +++++++--- .../net/wireless/ralink/rt2x00/rt2x00mac.c | 11 ++++ 8 files changed, 78 insertions(+), 17 deletions(-) -- 2.34.1

2 6

[PATCH openEuler-22.03-LTS-SP1 6/6] scsi: mpt3sas: Perform additional retries if doorbell read returns 0
by Baogen Shang 19 Mar '24

19 Mar '24

From: Ranjan Kumar <ranjan.kumar(a)broadcom.com> stable inclusion from stable-v5.10.195 commit ffed0c8fcf043946f2bf09bd2a9caa1ca5289959 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 4ca10f3e31745d35249a727ecd108eb58f0a8c5e upstream. The driver retries certain register reads 3 times if the returned value is 0. This was done because the controller could return 0 for certain registers if other registers were being accessed concurrently by the BMC. In certain systems with increased BMC interactions, the register values returned can be 0 for longer than 3 retries. Change the retry count from 3 to 30 for the affected registers to prevent problems with out-of-band management. Fixes: b899202901a8 ("scsi: mpt3sas: Add separate function for aero doorbell reads") Cc: stable(a)vger.kernel.org Signed-off-by: Ranjan Kumar <ranjan.kumar(a)broadcom.com> Link: https://lore.kernel.org/r/20230829090020.5417-2-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_base.c | 46 +++++++++++++++++++++-------- drivers/scsi/mpt3sas/mpt3sas_base.h | 1 + 2 files changed, 34 insertions(+), 13 deletions(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index b7bb3a1c1428..1b9b266b2b54 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -131,6 +131,9 @@ _base_get_ioc_facts(struct MPT3SAS_ADAPTER *ioc); static void _base_clear_outstanding_commands(struct MPT3SAS_ADAPTER *ioc); +static u32 +_base_readl_ext_retry(const volatile void __iomem *addr); + /** * mpt3sas_base_check_cmd_timeout - Function * to check timeout and command termination due @@ -206,6 +209,20 @@ _base_readl_aero(const volatile void __iomem *addr) return ret_val; } +static u32 +_base_readl_ext_retry(const volatile void __iomem *addr) +{ + u32 i, ret_val; + + for (i = 0 ; i < 30 ; i++) { + ret_val = readl(addr); + if (ret_val == 0) + continue; + } + + return ret_val; +} + static inline u32 _base_readl(const volatile void __iomem *addr) { @@ -861,7 +878,7 @@ mpt3sas_halt_firmware(struct MPT3SAS_ADAPTER *ioc) dump_stack(); - doorbell = ioc->base_readl(&ioc->chip->Doorbell); + doorbell = ioc->base_readl_ext_retry(&ioc->chip->Doorbell); if ((doorbell & MPI2_IOC_STATE_MASK) == MPI2_IOC_STATE_FAULT) { mpt3sas_print_fault_code(ioc, doorbell & MPI2_DOORBELL_DATA_MASK); @@ -5667,7 +5684,7 @@ mpt3sas_base_get_iocstate(struct MPT3SAS_ADAPTER *ioc, int cooked) { u32 s, sc; - s = ioc->base_readl(&ioc->chip->Doorbell); + s = ioc->base_readl_ext_retry(&ioc->chip->Doorbell); sc = s & MPI2_IOC_STATE_MASK; return cooked ? sc : s; } @@ -5812,7 +5829,7 @@ _base_wait_for_doorbell_ack(struct MPT3SAS_ADAPTER *ioc, int timeout) __func__, count, timeout)); return 0; } else if (int_status & MPI2_HIS_IOC2SYS_DB_STATUS) { - doorbell = ioc->base_readl(&ioc->chip->Doorbell); + doorbell = ioc->base_readl_ext_retry(&ioc->chip->Doorbell); if ((doorbell & MPI2_IOC_STATE_MASK) == MPI2_IOC_STATE_FAULT) { mpt3sas_print_fault_code(ioc, doorbell); @@ -5852,7 +5869,7 @@ _base_wait_for_doorbell_not_used(struct MPT3SAS_ADAPTER *ioc, int timeout) count = 0; cntdn = 1000 * timeout; do { - doorbell_reg = ioc->base_readl(&ioc->chip->Doorbell); + doorbell_reg = ioc->base_readl_ext_retry(&ioc->chip->Doorbell); if (!(doorbell_reg & MPI2_DOORBELL_USED)) { dhsprintk(ioc, ioc_info(ioc, "%s: successful count(%d), timeout(%d)\n", @@ -5989,7 +6006,7 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, __le32 *mfp; /* make sure doorbell is not in use */ - if ((ioc->base_readl(&ioc->chip->Doorbell) & MPI2_DOORBELL_USED)) { + if ((ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_USED)) { ioc_err(ioc, "doorbell is in use (line=%d)\n", __LINE__); return -EFAULT; } @@ -6038,7 +6055,7 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, } /* read the first two 16-bits, it gives the total length of the reply */ - reply[0] = le16_to_cpu(ioc->base_readl(&ioc->chip->Doorbell) + reply[0] = le16_to_cpu(ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_DATA_MASK); writel(0, &ioc->chip->HostInterruptStatus); if ((_base_wait_for_doorbell_int(ioc, 5))) { @@ -6046,7 +6063,7 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, __LINE__); return -EFAULT; } - reply[1] = le16_to_cpu(ioc->base_readl(&ioc->chip->Doorbell) + reply[1] = le16_to_cpu(ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_DATA_MASK); writel(0, &ioc->chip->HostInterruptStatus); @@ -6057,10 +6074,10 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, return -EFAULT; } if (i >= reply_bytes/2) /* overflow case */ - ioc->base_readl(&ioc->chip->Doorbell); + ioc->base_readl_ext_retry(&ioc->chip->Doorbell); else reply[i] = le16_to_cpu( - ioc->base_readl(&ioc->chip->Doorbell) + ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_DATA_MASK); writel(0, &ioc->chip->HostInterruptStatus); } @@ -6906,7 +6923,7 @@ _base_diag_reset(struct MPT3SAS_ADAPTER *ioc) goto out; } - host_diagnostic = ioc->base_readl(&ioc->chip->HostDiagnostic); + host_diagnostic = ioc->base_readl_ext_retry(&ioc->chip->HostDiagnostic); drsprintk(ioc, ioc_info(ioc, "wrote magic sequence: count(%d), host_diagnostic(0x%08x)\n", count, host_diagnostic)); @@ -6926,7 +6943,7 @@ _base_diag_reset(struct MPT3SAS_ADAPTER *ioc) for (count = 0; count < (300000000 / MPI2_HARD_RESET_PCIE_SECOND_READ_DELAY_MICRO_SEC); count++) { - host_diagnostic = ioc->base_readl(&ioc->chip->HostDiagnostic); + host_diagnostic = ioc->base_readl_ext_retry(&ioc->chip->HostDiagnostic); if (host_diagnostic == 0xFFFFFFFF) { ioc_info(ioc, @@ -7313,10 +7330,13 @@ mpt3sas_base_attach(struct MPT3SAS_ADAPTER *ioc) ioc->rdpq_array_enable_assigned = 0; ioc->use_32bit_dma = false; ioc->dma_mask = 64; - if (ioc->is_aero_ioc) + if (ioc->is_aero_ioc) { ioc->base_readl = &_base_readl_aero; - else + ioc->base_readl_ext_retry = &_base_readl_ext_retry; + } else { ioc->base_readl = &_base_readl; + ioc->base_readl_ext_retry = &_base_readl; + } r = mpt3sas_base_map_resources(ioc); if (r) goto out_free_resources; diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.h b/drivers/scsi/mpt3sas/mpt3sas_base.h index 0f5db94e0ccd..7c8dabfa1036 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.h +++ b/drivers/scsi/mpt3sas/mpt3sas_base.h @@ -1469,6 +1469,7 @@ struct MPT3SAS_ADAPTER { u8 diag_trigger_active; u8 atomic_desc_capable; BASE_READ_REG base_readl; + BASE_READ_REG base_readl_ext_retry; struct SL_WH_MASTER_TRIGGER_T diag_trigger_master; struct SL_WH_EVENT_TRIGGERS_T diag_trigger_event; struct SL_WH_SCSI_TRIGGERS_T diag_trigger_scsi; -- 2.33.0

1 0

[PATCH openEuler-22.03-LTS-SP1 5/6] scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add()
by Baogen Shang 19 Mar '24

19 Mar '24

From: Wenchao Hao <haowenchao2(a)huawei.com> stable inclusion from stable-v5.10.176 commit 6f0c2f70d9929208d8427ec72c3ed91e2251e289 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit d3c57724f1569311e4b81e98fad0931028b9bdcd ] Port is allocated by sas_port_alloc_num() and rphy is allocated by either sas_end_device_alloc() or sas_expander_alloc(), all of which may return NULL. So we need to check the rphy to avoid possible NULL pointer access. If sas_rphy_add() returned with failure, rphy is set to NULL. We would access the rphy in the following lines which would also result NULL pointer access. Fixes: 78316e9dfc24 ("scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()") Signed-off-by: Wenchao Hao <haowenchao2(a)huawei.com> Link: https://lore.kernel.org/r/20230225100135.2109330-1-haowenchao2@huawei.com Acked-by: Sathya Prakash Veerichetty <sathya.prakash(a)broadcom.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_transport.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c index b58f4d9c296a..326265fd7f91 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_transport.c +++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c @@ -670,7 +670,7 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, goto out_fail; } port = sas_port_alloc_num(sas_node->parent_dev); - if ((sas_port_add(port))) { + if (!port || (sas_port_add(port))) { ioc_err(ioc, "failure at %s:%d/%s()!\n", __FILE__, __LINE__, __func__); goto out_fail; @@ -695,6 +695,12 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, rphy = sas_expander_alloc(port, mpt3sas_port->remote_identify.device_type); + if (!rphy) { + ioc_err(ioc, "failure at %s:%d/%s()!\n", + __FILE__, __LINE__, __func__); + goto out_delete_port; + } + rphy->identify = mpt3sas_port->remote_identify; if (mpt3sas_port->remote_identify.device_type == SAS_END_DEVICE) { @@ -714,6 +720,7 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, __FILE__, __LINE__, __func__); sas_rphy_free(rphy); rphy = NULL; + goto out_delete_port; } if (mpt3sas_port->remote_identify.device_type == SAS_END_DEVICE) { @@ -740,7 +747,10 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, rphy_to_expander_device(rphy)); return mpt3sas_port; - out_fail: +out_delete_port: + sas_port_delete(port); + +out_fail: list_for_each_entry_safe(mpt3sas_phy, next, &mpt3sas_port->phy_list, port_siblings) list_del(&mpt3sas_phy->port_siblings); -- 2.33.0

1 0

[PATCH openEuler-22.03-LTS-SP1 4/6] scsi: mpt3sas: Remove usage of dma_get_required_mask() API
by Baogen Shang 19 Mar '24

19 Mar '24

From: Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> stable inclusion from stable-v5.10.173 commit 1dfc0a52f768d481de6bb672904cd382ead7ca0e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 06e472acf964649a58b7de35fc9cdc3151acb970 upstream. Remove the usage of dma_get_required_mask() API. Directly set the DMA mask to 63/64 if the system is a 64bit machine. Signed-off-by: Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> Link: https://lore.kernel.org/r/20221028091655.17741-2-sreekanth.reddy@broadcom.c… Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Salvatore Bonaccorso <carnil(a)debian.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_base.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index 222c5cf344c8..b7bb3a1c1428 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -2824,8 +2824,7 @@ _base_config_dma_addressing(struct MPT3SAS_ADAPTER *ioc, struct pci_dev *pdev) struct sysinfo s; u64 coherent_dma_mask, dma_mask; - if (ioc->is_mcpu_endpoint || sizeof(dma_addr_t) == 4 || - dma_get_required_mask(&pdev->dev) <= DMA_BIT_MASK(32)) { + if (ioc->is_mcpu_endpoint || sizeof(dma_addr_t) == 4) { ioc->dma_mask = 32; coherent_dma_mask = dma_mask = DMA_BIT_MASK(32); /* Set 63 bit DMA mask for all SAS3 and SAS35 controllers */ -- 2.33.0

1 0

[PATCH openEuler-22.03-LTS-SP1 3/6] scsi: mpt3sas: Don't change DMA mask while reallocating pools
by Baogen Shang 19 Mar '24

19 Mar '24

From: Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> stable inclusion from stable-v5.10.173 commit 2392303df240e7d036df8872ada176734e108036 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 9df650963bf6d6c2c3fcd325d8c44ca2b99554fe upstream. When a pool crosses the 4GB boundary region then before reallocating pools change the coherent DMA mask to 32 bits and keep the normal DMA mask set to 63/64 bits. Link: https://lore.kernel.org/r/20220825075457.16422-2-sreekanth.reddy@broadcom.c… Signed-off-by: Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Salvatore Bonaccorso <carnil(a)debian.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> Signed-off-by: Siyu Zhang <Siyu.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_base.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index 55902825ecb5..222c5cf344c8 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -2822,19 +2822,26 @@ static int _base_config_dma_addressing(struct MPT3SAS_ADAPTER *ioc, struct pci_dev *pdev) { struct sysinfo s; + u64 coherent_dma_mask, dma_mask; - if (ioc->is_mcpu_endpoint || - sizeof(dma_addr_t) == 4 || ioc->use_32bit_dma || - dma_get_required_mask(&pdev->dev) <= DMA_BIT_MASK(32)) + if (ioc->is_mcpu_endpoint || sizeof(dma_addr_t) == 4 || + dma_get_required_mask(&pdev->dev) <= DMA_BIT_MASK(32)) { ioc->dma_mask = 32; + coherent_dma_mask = dma_mask = DMA_BIT_MASK(32); /* Set 63 bit DMA mask for all SAS3 and SAS35 controllers */ - else if (ioc->hba_mpi_version_belonged > MPI2_VERSION) + } else if (ioc->hba_mpi_version_belonged > MPI2_VERSION) { ioc->dma_mask = 63; - else + coherent_dma_mask = dma_mask = DMA_BIT_MASK(63); + } else { ioc->dma_mask = 64; + coherent_dma_mask = dma_mask = DMA_BIT_MASK(64); + } + + if (ioc->use_32bit_dma) + coherent_dma_mask = DMA_BIT_MASK(32); - if (dma_set_mask(&pdev->dev, DMA_BIT_MASK(ioc->dma_mask)) || - dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(ioc->dma_mask))) + if (dma_set_mask(&pdev->dev, dma_mask) || + dma_set_coherent_mask(&pdev->dev, coherent_dma_mask)) return -ENODEV; if (ioc->dma_mask > 32) { -- 2.33.0

1 0

[PATCH openEuler-22.03-LTS-SP1 2/6] scsi: mpt3sas: Fix a memory leak
by Baogen Shang 19 Mar '24

19 Mar '24

From: Tomas Henzl <thenzl(a)redhat.com> stable inclusion from stable-v5.10.173 commit 30c7c72b6cf9d8c95f9b219c9d2e4e31b15bebe5 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 54dd96015e8d7a2a07359e2dfebf05b529d1780c ] Add a forgotten kfree(). Fixes: dbec4c9040ed ("scsi: mpt3sas: lockless command submission") Link: https://lore.kernel.org/r/20230207152159.18627-1-thenzl@redhat.com Signed-off-by: Tomas Henzl <thenzl(a)redhat.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_base.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index 320dc1091cc7..55902825ecb5 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -4905,6 +4905,9 @@ _base_release_memory_pools(struct MPT3SAS_ADAPTER *ioc) } dma_pool_destroy(ioc->pcie_sgl_dma_pool); } + kfree(ioc->pcie_sg_lookup); + ioc->pcie_sg_lookup = NULL; + if (ioc->config_page) { dexitprintk(ioc, ioc_info(ioc, "config_page(0x%p): free\n", -- 2.33.0

1 0

[PATCH openEuler-22.03-LTS-SP1 1/6] scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()
by Baogen Shang 19 Mar '24

19 Mar '24

From: Yang Yingliang <yangyingliang(a)huawei.com> stable inclusion from stable-v5.10.163 commit ce1a69cc85006b494353911b35171da195d79e25 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 78316e9dfc24906dd474630928ed1d3c562b568e ] In mpt3sas_transport_port_add(), if sas_rphy_add() returns error, sas_rphy_free() needs be called to free the resource allocated in sas_end_device_alloc(). Otherwise a kernel crash will happen: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000108 CPU: 45 PID: 37020 Comm: bash Kdump: loaded Tainted: G W 6.1.0-rc1+ #189 pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : device_del+0x54/0x3d0 lr : device_del+0x37c/0x3d0 Call trace: device_del+0x54/0x3d0 attribute_container_class_device_del+0x28/0x38 transport_remove_classdev+0x6c/0x80 attribute_container_device_trigger+0x108/0x110 transport_remove_device+0x28/0x38 sas_rphy_remove+0x50/0x78 [scsi_transport_sas] sas_port_delete+0x30/0x148 [scsi_transport_sas] do_sas_phy_delete+0x78/0x80 [scsi_transport_sas] device_for_each_child+0x68/0xb0 sas_remove_children+0x30/0x50 [scsi_transport_sas] sas_rphy_remove+0x38/0x78 [scsi_transport_sas] sas_port_delete+0x30/0x148 [scsi_transport_sas] do_sas_phy_delete+0x78/0x80 [scsi_transport_sas] device_for_each_child+0x68/0xb0 sas_remove_children+0x30/0x50 [scsi_transport_sas] sas_remove_host+0x20/0x38 [scsi_transport_sas] scsih_remove+0xd8/0x420 [mpt3sas] Because transport_add_device() is not called when sas_rphy_add() fails, the device is not added. When sas_rphy_remove() is subsequently called to remove the device in the remove() path, a NULL pointer dereference happens. Fixes: f92363d12359 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS") Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Link: https://lore.kernel.org/r/20221109032403.1636422-1-yangyingliang@huawei.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_transport.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c index 6ec5b7f33dfd..b58f4d9c296a 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_transport.c +++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c @@ -712,6 +712,8 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, if ((sas_rphy_add(rphy))) { ioc_err(ioc, "failure at %s:%d/%s()!\n", __FILE__, __LINE__, __func__); + sas_rphy_free(rphy); + rphy = NULL; } if (mpt3sas_port->remote_identify.device_type == SAS_END_DEVICE) { -- 2.33.0

1 0

[PATCH openEuler-22.03-LTS-SP1 0/6] mpt3sas bugfix
by Baogen Shang 19 Mar '24

19 Mar '24

From: Baogen Shang <baogen.shang(a)windriver.com> Run sync from the openEuler-22.03-LTS fail, so create a new PR. Just remove 3 patches from the openEuler-22.03-LTS PR, since they have been applied on SP1. Ranjan Kumar (1): scsi: mpt3sas: Perform additional retries if doorbell read returns 0 Sreekanth Reddy (2): scsi: mpt3sas: Don't change DMA mask while reallocating pools scsi: mpt3sas: Remove usage of dma_get_required_mask() API Tomas Henzl (1): scsi: mpt3sas: Fix a memory leak Wenchao Hao (1): scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add() Yang Yingliang (1): scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add() drivers/scsi/mpt3sas/mpt3sas_base.c | 69 +++++++++++++++++------- drivers/scsi/mpt3sas/mpt3sas_base.h | 1 + drivers/scsi/mpt3sas/mpt3sas_transport.c | 16 +++++- 3 files changed, 64 insertions(+), 22 deletions(-) -- 2.33.0

1 0