2398 Commits

Author	SHA1	Message	Date
Greg Kroah-Hartman	3ca4271578	Reapply "Merge tag 'android14-6.1.75_r00' into android14-6.1" ... This reverts commit 6bad1052c2, it is the LTS merge that had to previously get reverted due to being merged too early. Cc: Todd Kjos <tkjos@google.com> Change-Id: I31b7d660bd833cf022ac4870f6d01e723fda5182 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-04-02 19:49:12 +00:00
Todd Kjos	6bad1052c2	Revert "Merge tag 'android14-6.1.75_r00' into android14-6.1" ... This reverts commit 1dbafe61e3. Reason for revert: Too early. Needs to wait until 2024-03-27 Change-Id: I769b944bd089aa2278659ec87f7ba4ac4e74ee4a Signed-off-by: Todd Kjos <tkjos@google.com>	2024-03-07 21:18:27 +00:00
Greg Kroah-Hartman	c16bb76a0c	This is the 6.1.75 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmWy7o0ACgkQONu9yGCS aT76JA/9Gh3VNSLG35LaLyq3xGd827N6DPsMzeFHi+MGSyPVg0auE77QkHD/gZl9 KynmBmz2+9DSoFxymWAS9oEPM8d/vw87AMuSTTct3GKkjEeUcj9lbeOEzgZydXX8 cJSXvcCeKE3FESU/YbQKxo0N+r7tUDmnCR0edss5/FpYni3jPdg7jdESzGhiCHXj r5rjrTE6h7Z/d+2kaKqlheL4o4OkV0YwnFnU2gC3MOOvLmgvXdOVQQsyaZ+WgSAN 0JS0Q6Xk1xyYWx8iFaLGWIs1pUsQPKxIiRG3N/1KmXITopf2Pu68Yy7ST+YryDkO nLcNrr3gsQxrM6MYnEhLzlxs3H1KuAVxJ4Y/dNqJnDxn0OJjcY3repwempz5Sxtk 0OLDOsCICAiMHeF8rYIGhm09WdowLz0EH+sqadIGqWKzW/BcXqD+r9mpF1lwk1ZL FJLgLmtOaG4amI46lEUHQ6ujN7Oad3gLYzudq2zKLeqonSIjm1TuDoMRvHWFsspO 5i9I0x7Vlo3PqCl7kkKVL9PvVHx6BXJGFShABJqa9ao/oHxkOWuIt26pxUoLUN3P 7Wa5WnfdlDd9nR3VGHcVe2ncuRmEfuriYpXvItJ7/KJKyIPkGoPehAh+vbZMoEy0 DwhtD9PPsTlnUufbcZdHavYA1E4y/uXDMOIGB+ERpsTdXh9DwEo= =2XHn -----END PGP SIGNATURE----- Merge 6.1.75 into android14-6.1-lts Changes in 6.1.75 x86/lib: Fix overflow when counting digits x86/mce/inject: Clear test status value EDAC/thunderx: Fix possible out-of-bounds string access powerpc: remove checks for binutils older than 2.25 powerpc: add crtsavres.o to always-y instead of extra-y powerpc/44x: select I2C for CURRITUCK powerpc/pseries/memhp: Fix access beyond end of drmem array selftests/powerpc: Fix error handling in FPU/VMX preemption tests powerpc/powernv: Add a null pointer check to scom_debug_init_one() powerpc/powernv: Add a null pointer check in opal_event_init() powerpc/powernv: Add a null pointer check in opal_powercap_init() powerpc/imc-pmu: Add a null pointer check in update_events_in_group() spi: spi-zynqmp-gqspi: fix driver kconfig dependencies mtd: rawnand: Increment IFC_TIMEOUT_MSECS for nand controller response ACPI: video: check for error while searching for backlight device parent ACPI: LPIT: Avoid u32 multiplication overflow KEYS: encrypted: Add check for strsep platform/x86/intel/vsec: Enhance and Export intel_vsec_add_aux() platform/x86/intel/vsec: Support private data platform/x86/intel/vsec: Use mutex for ida_alloc() and ida_free() platform/x86/intel/vsec: Fix xa_alloc memory leak of: Add of_property_present() helper cpufreq: Use of_property_present() for testing DT property presence cpufreq: scmi: process the result of devm_of_clk_add_hw_provider() calipso: fix memory leak in netlbl_calipso_add_pass() efivarfs: force RO when remounting if SetVariable is not supported efivarfs: Free s_fs_info on unmount spi: sh-msiof: Enforce fixed DTDL for R-Car H3 ACPI: LPSS: Fix the fractional clock divider flags ACPI: extlog: Clear Extended Error Log status when RAS_CEC handled the error kunit: debugfs: Fix unchecked dereference in debugfs_print_results() mtd: Fix gluebi NULL pointer dereference caused by ftl notifier selinux: Fix error priority for bind with AF_UNSPEC on PF_INET6 socket crypto: virtio - Handle dataq logic with tasklet crypto: sa2ul - Return crypto_aead_setkey to transfer the error crypto: ccp - fix memleak in ccp_init_dm_workarea crypto: af_alg - Disallow multiple in-flight AIO requests crypto: safexcel - Add error handling for dma_map_sg() calls crypto: sahara - remove FLAGS_NEW_KEY logic crypto: sahara - fix cbc selftest failure crypto: sahara - fix ahash selftest failure crypto: sahara - fix processing requests with cryptlen < sg->length crypto: sahara - fix error handling in sahara_hw_descriptor_create() crypto: hisilicon/qm - save capability registers in qm init process crypto: hisilicon/zip - add zip comp high perf mode configuration crypto: hisilicon/qm - add a function to set qm algs crypto: hisilicon/hpre - save capability registers in probe process crypto: hisilicon/sec2 - save capability registers in probe process crypto: hisilicon/zip - save capability registers in probe process pstore: ram_core: fix possible overflow in persistent_ram_init_ecc() erofs: fix memory leak on short-lived bounced pages fs: indicate request originates from old mount API gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump crypto: virtio - Wait for tasklet to complete on device remove crypto: sahara - avoid skcipher fallback code duplication crypto: sahara - handle zero-length aes requests crypto: sahara - fix ahash reqsize crypto: sahara - fix wait_for_completion_timeout() error handling crypto: sahara - improve error handling in sahara_sha_process() crypto: sahara - fix processing hash requests with req->nbytes < sg->length crypto: sahara - do not resize req->src when doing hash operations crypto: scomp - fix req->dst buffer overflow csky: fix arch_jump_label_transform_static override blocklayoutdriver: Fix reference leak of pnfs_device_node NFSv4.1/pnfs: Ensure we handle the error NFS4ERR_RETURNCONFLICT SUNRPC: fix _xprt_switch_find_current_entry logic pNFS: Fix the pnfs block driver's calculation of layoutget size wifi: plfxlc: check for allocation failure in plfxlc_usb_wreq_async() wifi: rtw88: fix RX filter in FIF_ALLMULTI flag bpf, lpm: Fix check prefixlen before walking trie bpf: Add crosstask check to __bpf_get_stack wifi: ath11k: Defer on rproc_get failure wifi: libertas: stop selecting wext ARM: dts: qcom: apq8064: correct XOADC register address net/ncsi: Fix netlink major/minor version numbers firmware: ti_sci: Fix an off-by-one in ti_sci_debugfs_create() firmware: meson_sm: populate platform devices from sm device tree data wifi: rtlwifi: rtl8821ae: phy: fix an undefined bitwise shift behavior arm64: dts: ti: k3-am62a-main: Fix GPIO pin count in DT nodes arm64: dts: ti: k3-am65-main: Fix DSS irq trigger type selftests/bpf: Fix erroneous bitmask operation md: synchronize flush io with array reconfiguration bpf: enforce precision of R0 on callback return ARM: dts: qcom: sdx65: correct SPMI node name arm64: dts: qcom: sc7180: Make watchdog bark interrupt edge triggered arm64: dts: qcom: sc7280: Mark some nodes as 'reserved' arm64: dts: qcom: sc7280: Make watchdog bark interrupt edge triggered arm64: dts: qcom: sdm845: Make watchdog bark interrupt edge triggered arm64: dts: qcom: sm8150: Make watchdog bark interrupt edge triggered arm64: dts: qcom: sm8250: Make watchdog bark interrupt edge triggered arm64: dts: qcom: sc8280xp: Make watchdog bark interrupt edge triggered arm64: dts: qcom: sm6350: Make watchdog bark interrupt edge triggered rcu-tasks: Provide rcu_trace_implies_rcu_gp() bpf: add percpu stats for bpf_map elements insertions/deletions bpf: Add map and need_defer parameters to .map_fd_put_ptr() bpf: Defer the free of inner map when necessary selftests/net: specify the interface when do arping bpf: fix check for attempt to corrupt spilled pointer scsi: fnic: Return error if vmalloc() failed arm64: dts: qcom: qrb5165-rb5: correct LED panic indicator arm64: dts: qcom: sdm845-db845c: correct LED panic indicator arm64: dts: qcom: sm8350: Fix DMA0 address arm64: dts: qcom: sc7280: Fix up GPU SIDs arm64: dts: qcom: sc7280: Mark Adreno SMMU as DMA coherent arm64: dts: qcom: sc7280: fix usb_2 wakeup interrupt types wifi: mt76: mt7921s: fix workqueue problem causes STA association fail bpf: Fix verification of indirect var-off stack access arm64: dts: hisilicon: hikey970-pmic: fix regulator cells properties dt-bindings: media: mediatek: mdp3: correct RDMA and WROT node with generic names arm64: dts: mediatek: mt8183: correct MDP3 DMA-related nodes wifi: mt76: mt7921: fix country count limitation for CLC selftests/bpf: Relax time_tai test for equal timestamps in tai_forward block: Set memalloc_noio to false on device_add_disk() error path arm64: dts: renesas: white-hawk-cpu: Fix missing serial console pin control arm64: dts: imx8mm: Reduce GPU to nominal speed scsi: hisi_sas: Replace with standard error code return value scsi: hisi_sas: Rollback some operations if FLR failed scsi: hisi_sas: Correct the number of global debugfs registers ARM: dts: stm32: don't mix SCMI and non-SCMI board compatibles selftests/net: fix grep checking for fib_nexthop_multiprefix ipmr: support IP_PKTINFO on cache report IGMP msg virtio/vsock: fix logic which reduces credit update messages dma-mapping: clear dev->dma_mem to NULL after freeing it soc: qcom: llcc: Fix dis_cap_alloc and retain_on_pc configuration arm64: dts: qcom: sm8150-hdk: fix SS USB regulators block: add check of 'minors' and 'first_minor' in device_add_disk() arm64: dts: qcom: sc7280: Mark SDHCI hosts as cache-coherent arm64: dts: qcom: ipq6018: fix clock rates for GCC_USB0_MOCK_UTMI_CLK arm64: dts: qcom: ipq6018: improve pcie phy pcs reg table arm64: dts: qcom: ipq6018: Use lowercase hex arm64: dts: qcom: ipq6018: Pad addresses to 8 hex digits arm64: dts: qcom: ipq6018: Fix up indentation wifi: rtlwifi: add calculate_bit_shift() wifi: rtlwifi: rtl8188ee: phy: using calculate_bit_shift() wifi: rtlwifi: rtl8192c: using calculate_bit_shift() wifi: rtlwifi: rtl8192cu: using calculate_bit_shift() wifi: rtlwifi: rtl8192ce: using calculate_bit_shift() wifi: rtlwifi: rtl8192de: using calculate_bit_shift() wifi: rtlwifi: rtl8192ee: using calculate_bit_shift() wifi: rtlwifi: rtl8192se: using calculate_bit_shift() wifi: iwlwifi: mvm: set siso/mimo chains to 1 in FW SMPS request wifi: iwlwifi: mvm: send TX path flush in rfkill netfilter: nf_tables: mark newset as dead on transaction abort Bluetooth: Fix bogus check for re-auth no supported with non-ssp Bluetooth: btmtkuart: fix recv_buf() return value block: make BLK_DEF_MAX_SECTORS unsigned null_blk: don't cap max_hw_sectors to BLK_DEF_MAX_SECTORS bpf: sockmap, fix proto update hook to avoid dup calls sctp: support MSG_ERRQUEUE flag in recvmsg() sctp: fix busy polling net/sched: act_ct: fix skb leak and crash on ooo frags mlxbf_gige: Fix intermittent no ip issue mlxbf_gige: Enable the GigE port in mlxbf_gige_open ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() ARM: davinci: always select CONFIG_CPU_ARM926T Revert "drm/tidss: Annotate dma-fence critical section in commit path" Revert "drm/omapdrm: Annotate dma-fence critical section in commit path" drm/panfrost: Really power off GPU cores in panfrost_gpu_power_off() RDMA/usnic: Silence uninitialized symbol smatch warnings RDMA/hns: Fix inappropriate err code for unsupported operations drm/panel-elida-kd35t133: hold panel in reset for unprepare drm/nouveau/fence:: fix warning directly dereferencing a rcu pointer drm/bridge: tpd12s015: Drop buggy __exit annotation for remove function drm/tilcdc: Fix irq free on unload media: pvrusb2: fix use after free on context disconnection media: mtk-jpegdec: export jpeg decoder functions media: mtk-jpeg: Remove cancel worker in mtk_jpeg_remove to avoid the crash of multi-core JPEG devices media: verisilicon: Hook the (TRY_)DECODER_CMD stateless ioctls media: rkvdec: Hook the (TRY_)DECODER_CMD stateless ioctls drm/bridge: Fix typo in post_disable() description f2fs: fix to avoid dirent corruption drm/radeon/r600_cs: Fix possible int overflows in r600_cs_check_reg() drm/radeon/r100: Fix integer overflow issues in r100_cs_track_check() drm/radeon: check return value of radeon_ring_lock() drm/tidss: Move reset to the end of dispc_init() drm/tidss: Return error value from from softreset drm/tidss: Check for K2G in in dispc_softreset() drm/tidss: Fix dss reset ASoC: cs35l33: Fix GPIO name and drop legacy include ASoC: cs35l34: Fix GPIO name and drop legacy include drm/msm/mdp4: flush vblank event on disable drm/msm/dsi: Use pm_runtime_resume_and_get to prevent refcnt leaks drm/drv: propagate errors from drm_modeset_register_all() ASoC: Intel: glk_rt5682_max98357a: fix board id mismatch drm/panfrost: Ignore core_mask for poweroff and disable PWRTRANS irq drm/radeon: check the alloc_workqueue return value in radeon_crtc_init() drm/radeon/dpm: fix a memleak in sumo_parse_power_table drm/radeon/trinity_dpm: fix a memleak in trinity_parse_power_table drm/bridge: cdns-mhdp8546: Fix use of uninitialized variable drm/bridge: tc358767: Fix return value on error case media: cx231xx: fix a memleak in cx231xx_init_isoc RDMA/hns: Fix memory leak in free_mr_init() clk: qcom: gpucc-sm8150: Update the gpu_cc_pll1 config media: imx-mipi-csis: Fix clock handling in remove() media: dt-bindings: media: rkisp1: Fix the port description for the parallel interface media: rkisp1: Fix media device memory leak drm/panel: st7701: Fix AVCL calculation f2fs: fix to wait on block writeback for post_read case f2fs: fix to check compress file in f2fs_move_file_range() f2fs: fix to update iostat correctly in f2fs_filemap_fault() media: dvbdev: drop refcount on error path in dvb_device_open() media: dvb-frontends: m88ds3103: Fix a memory leak in an error handling path of m88ds3103_probe() clk: renesas: rzg2l-cpg: Reuse code in rzg2l_cpg_reset() clk: renesas: rzg2l: Check reset monitor registers drm/msm/dpu: Set input_sel bit for INTF drm/msm/dpu: Drop enable and frame_count parameters from dpu_hw_setup_misr() drm/mediatek: Return error if MDP RDMA failed to enable the clock drm/mediatek: Fix underrun in VDO1 when switches off the layer drm/amdgpu/debugfs: fix error code when smc register accessors are NULL drm/amd/pm: fix a double-free in si_dpm_init drivers/amd/pm: fix a use-after-free in kv_parse_power_table gpu/drm/radeon: fix two memleaks in radeon_vm_init drm/amd/pm: fix a double-free in amdgpu_parse_extended_power_table f2fs: fix to check return value of f2fs_recover_xattr_data dt-bindings: clock: Update the videocc resets for sm8150 clk: qcom: videocc-sm8150: Update the videocc resets clk: qcom: videocc-sm8150: Add missing PLL config property drivers: clk: zynqmp: calculate closest mux rate drivers: clk: zynqmp: update divider round rate logic watchdog: set cdev owner before adding watchdog/hpwdt: Only claim UNKNOWN NMI if from iLO watchdog: bcm2835_wdt: Fix WDIOC_SETTIMEOUT handling watchdog: rti_wdt: Drop runtime pm reference count when watchdog is unused clk: si5341: fix an error code problem in si5341_output_clk_set_rate drm/mediatek: dp: Add phy_mtk_dp module as pre-dependency accel/habanalabs: fix information leak in sec_attest_info() clk: fixed-rate: fix clk_hw_register_fixed_rate_with_accuracy_parent_hw pwm: stm32: Use regmap_clear_bits and regmap_set_bits where applicable pwm: stm32: Use hweight32 in stm32_pwm_detect_channels pwm: stm32: Fix enable count for clk in .probe() ASoC: rt5645: Drop double EF20 entry from dmi_platform_data[] ALSA: scarlett2: Add missing error check to scarlett2_config_save() ALSA: scarlett2: Add missing error check to scarlett2_usb_set_config() ALSA: scarlett2: Allow passing any output to line_out_remap() ALSA: scarlett2: Add missing error checks to *_ctl_get() ALSA: scarlett2: Add clamp() in scarlett2_mixer_ctl_put() mmc: sdhci_am654: Fix TI SoC dependencies mmc: sdhci_omap: Fix TI SoC dependencies IB/iser: Prevent invalidating wrong MR drm/amdkfd: Confirm list is non-empty before utilizing list_first_entry in kfd_topology.c drm/amd/pm/smu7: fix a memleak in smu7_hwmgr_backend_init kselftest/alsa - mixer-test: fix the number of parameters to ksft_exit_fail_msg() kselftest/alsa - mixer-test: Fix the print format specifier warning ksmbd: validate the zero field of packet header of: Fix double free in of_parse_phandle_with_args_map fbdev: imxfb: fix left margin setting of: unittest: Fix of_count_phandle_with_args() expected value message selftests/bpf: Add assert for user stacks in test_task_stack keys, dns: Fix size check of V1 server-list header binder: fix async space check for 0-sized buffers binder: fix unused alloc->free_async_space mips/smp: Call rcutree_report_cpu_starting() earlier Input: atkbd - use ab83 as id when skipping the getid command xen-netback: don't produce zero-size SKB frags binder: fix race between mmput() and do_exit() clocksource/drivers/timer-ti-dm: Fix make W=n kerneldoc warnings powerpc/64s: Increase default stack size to 32KB tick-sched: Fix idle and iowait sleeptime accounting vs CPU hotplug usb: phy: mxs: remove CONFIG_USB_OTG condition for mxs_phy_is_otg_host() usb: dwc: ep0: Update request status in dwc3_ep0_stall_restart Revert "usb: dwc3: Soft reset phy on probe for host" Revert "usb: dwc3: don't reset device side if dwc3 was configured as host-only" usb: chipidea: wait controller resume finished for wakeup irq usb: cdns3: fix uvc failure work since sg support enabled usb: cdns3: fix iso transfer error when mult is not zero usb: cdns3: Fix uvc fail when DMA cross 4k boundery since sg enabled Revert "usb: typec: class: fix typec_altmode_put_partner to put plugs" usb: typec: class: fix typec_altmode_put_partner to put plugs usb: mon: Fix atomicity violation in mon_bin_vma_fault serial: core: fix sanitizing check for RTS settings serial: core: make sure RS485 cannot be enabled when it is not supported serial: 8250_bcm2835aux: Restore clock error handling serial: core, imx: do not set RS485 enabled if it is not supported serial: imx: Ensure that imx_uart_rs485_config() is called with enabled clock serial: 8250_exar: Set missing rs485_supported flag serial: omap: do not override settings for RS485 support drm/vmwgfx: Fix possible invalid drm gem put calls drm/vmwgfx: Keep a gem reference to user bos in surfaces ALSA: oxygen: Fix right channel of capture volume mixer ALSA: hda/relatek: Enable Mute LED on HP Laptop 15s-fq2xxx ALSA: hda/realtek: Enable mute/micmute LEDs and limit mic boost on HP ZBook ALSA: hda/realtek: Enable headset mic on Lenovo M70 Gen5 ksmbd: validate mech token in session setup ksmbd: fix UAF issue in ksmbd_tcp_new_connection() ksmbd: only v2 leases handle the directory io_uring/rw: ensure io->bytes_done is always initialized fbdev: flush deferred work in fb_deferred_io_fsync() fbdev: flush deferred IO before closing scsi: ufs: core: Simplify power management during async scan scsi: target: core: add missing file_{start,end}_write() scsi: mpi3mr: Refresh sdev queue depth after controller reset scsi: mpi3mr: Block PEL Enable Command on Controller Reset and Unrecoverable State drm/amd: Enable PCIe PME from D3 block: add check that partition length needs to be aligned with block size block: Fix iterating over an empty bio with bio_for_each_folio_all netfilter: nf_tables: check if catch-all set element is active in next generation pwm: jz4740: Don't use dev_err_probe() in .request() pwm: Fix out-of-bounds access in of_pwm_single_xlate() md/raid1: Use blk_opf_t for read and write operations rootfs: Fix support for rootfstype= when root= is given Bluetooth: Fix atomicity violation in {min,max}_key_size_set bpf: Fix re-attachment branch in bpf_tracing_prog_attach LoongArch: Fix and simplify fcsr initialization on execve() iommu/arm-smmu-qcom: Add missing GMU entry to match table iommu/dma: Trace bounce buffer usage when mapping buffers wifi: mt76: fix broken precal loading from MTD for mt7915 wifi: rtlwifi: Remove bogus and dangerous ASPM disable/enable code wifi: rtlwifi: Convert LNKCTL change to PCIe cap RMW accessors wifi: mwifiex: configure BSSID consistently when starting AP Revert "net: rtnetlink: Enslave device before bringing it up" cxl/port: Fix decoder initialization when nr_targets > interleave_ways PCI/P2PDMA: Remove reference to pci_p2pdma_map_sg() PCI: dwc: endpoint: Fix dw_pcie_ep_raise_msix_irq() alignment support PCI: mediatek: Clear interrupt status before dispatching handler x86/kvm: Do not try to disable kvmclock if it was not enabled KVM: arm64: vgic-v4: Restore pending state on host userspace write KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache iio: adc: ad7091r: Pass iio_dev to event handler HID: wacom: Correct behavior when processing some confidence == false touches serial: sc16is7xx: add check for unsupported SPI modes during probe serial: sc16is7xx: set safe default SPI clock frequency ARM: 9330/1: davinci: also select PINCTRL mfd: syscon: Fix null pointer dereference in of_syscon_register() leds: aw2013: Select missing dependency REGMAP_I2C mfd: intel-lpss: Fix the fractional clock divider flags mips: dmi: Fix early remap on MIPS32 mips: Fix incorrect max_low_pfn adjustment riscv: Check if the code to patch lies in the exit section riscv: Fix module_alloc() that did not reset the linear mapping permissions riscv: Fix set_memory_XX() and set_direct_map_XX() by splitting huge linear mappings riscv: Fix set_direct_map_default_noflush() to reset _PAGE_EXEC riscv: Fixed wrong register in XIP_FIXUP_FLASH_OFFSET macro MIPS: Alchemy: Fix an out-of-bound access in db1200_dev_setup() MIPS: Alchemy: Fix an out-of-bound access in db1550_dev_setup() power: supply: cw2015: correct time_to_empty units in sysfs power: supply: bq256xx: fix some problem in bq256xx_hw_init serial: 8250: omap: Don't skip resource freeing if pm_runtime_resume_and_get() failed libapi: Add missing linux/types.h header to get the __u64 type on io.h base/node.c: initialize the accessor list before registering acpi: property: Let args be NULL in __acpi_node_get_property_reference software node: Let args be NULL in software_node_get_reference_args serial: imx: fix tx statemachine deadlock selftests/sgx: Fix uninitialized pointer dereference in error path selftests/sgx: Fix uninitialized pointer dereferences in encl_get_entry selftests/sgx: Include memory clobber for inline asm in test enclave selftests/sgx: Skip non X86_64 platform iio: adc: ad9467: fix reset gpio handling iio: adc: ad9467: don't ignore error codes iio: adc: ad9467: fix scale setting perf header: Fix one memory leakage in perf_event__fprintf_event_update() perf hisi-ptt: Fix one memory leakage in hisi_ptt_process_auxtrace_event() perf genelf: Set ELF program header addresses properly tty: change tty_write_lock()'s ndelay parameter to bool tty: early return from send_break() on TTY_DRIVER_HARDWARE_BREAK tty: don't check for signal_pending() in send_break() tty: use 'if' in send_break() instead of 'goto' usb: cdc-acm: return correct error code on unsupported break spmi: mtk-pmif: Serialize PMIF status check and command submission vdpa: Fix an error handling path in eni_vdpa_probe() nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length nvmet-tcp: fix a crash in nvmet_req_complete() perf env: Avoid recursively taking env->bpf_progs.lock cxl/region: fix x9 interleave typo apparmor: avoid crash when parsed profile name is empty usb: xhci-mtk: fix a short packet issue of gen1 isoc-in transfer serial: imx: Correct clock error message in function probe() nvmet: re-fix tracing strncpy() warning nvme: trace: avoid memcpy overflow warning nvmet-tcp: Fix the H2C expected PDU len calculation PCI: keystone: Fix race condition when initializing PHYs PCI: mediatek-gen3: Fix translation window size calculation ASoC: mediatek: sof-common: Add NULL check for normal_link string s390/pci: fix max size calculation in zpci_memcpy_toio() net: qualcomm: rmnet: fix global oob in rmnet_policy net: ethernet: ti: am65-cpsw: Fix max mtu to fit ethernet frames amt: do not use overwrapped cb area net: phy: micrel: populate .soft_reset for KSZ9131 mptcp: mptcp_parse_option() fix for MPTCPOPT_MP_JOIN mptcp: strict validation before using mp_opt->hmac mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() mptcp: use OPTION_MPTCP_MPJ_SYN in subflow_check_req() mptcp: refine opt_mp_capable determination block: ensure we hold a queue reference when using queue limits udp: annotate data-races around up->pending net: ravb: Fix dma_addr_t truncation in error case dt-bindings: gpio: xilinx: Fix node address in gpio drm/amdkfd: Use resource_size() helper function drm/amdkfd: fixes for HMM mem allocation net: stmmac: ethtool: Fixed calltrace caused by unbalanced disable_irq_wake calls bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS net: dsa: vsc73xx: Add null pointer check to vsc73xx_gpio_probe LoongArch: BPF: Prevent out-of-bounds memory access mptcp: relax check on MPC passive fallback netfilter: nf_tables: reject invalid set policy netfilter: nft_limit: do not ignore unsupported flags netfilter: nfnetlink_log: use proper helper for fetching physinif netfilter: nf_queue: remove excess nf_bridge variable netfilter: propagate net to nf_bridge_get_physindev netfilter: bridge: replace physindev with physinif in nf_bridge_info netfilter: nf_tables: do not allow mismatch field size and set key length netfilter: nf_tables: skip dead set elements in netlink dump netfilter: nf_tables: reject NFT_SET_CONCAT with not field length description ipvs: avoid stat macros calls from preemptible context kdb: Fix a potential buffer overflow in kdb_local() ethtool: netlink: Add missing ethnl_ops_begin/complete loop: fix the the direct I/O support check when used on top of block devices mlxsw: spectrum_acl_erp: Fix error flow of pool allocation failure selftests: mlxsw: qos_pfc: Adjust the test to support 8 lanes ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work i2c: s3c24xx: fix read transfers in polling mode i2c: s3c24xx: fix transferring more than one message in polling mode block: Remove special-casing of compound pages riscv: Fix wrong usage of lm_alias() when splitting a huge linear mapping Revert "KEYS: encrypted: Add check for strsep" arm64: dts: armada-3720-turris-mox: set irq type for RTC Revert "Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d"" Linux 6.1.75 Change-Id: I60398ecc9a2e50206fd9d25c0d6c9ad6e1ca71a0 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-02-19 20:16:38 +00:00
Amir Goldstein	3378333263	scsi: target: core: add missing file_{start,end}_write() ... commit 0db1d53937fafa8bb96e077375691e16902f4899 upstream. The callers of vfs_iter_write() are required to hold file_start_write(). file_start_write() is a no-op for the S_ISBLK() case, but it is really needed when the backing file is a regular file. We are going to move file_{start,end}_write() into vfs_iter_write(), but we need to fix this first, so that the fix could be backported to stable kernels. Suggested-by: Christoph Hellwig <hch@lst.de> Link: https://lore.kernel.org/r/ZV8ETIpM+wZa33B5@infradead.org/ Cc: <stable@vger.kernel.org> Signed-off-by: Amir Goldstein <amir73il@gmail.com> Link: https://lore.kernel.org/r/20231123092000.2665902-1-amir73il@gmail.com Acked-by: Martin K. Petersen <martin.petersen@oracle.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Christian Brauner <brauner@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2024-01-25 15:27:42 -08:00
Greg Kroah-Hartman	c259cc9cb4	This is the 6.1.57 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmUlrb4ACgkQONu9yGCS aT4b+hAAgvFC6P+XmyyNXJ9ISHLkgSlcIAdatb+qeOCUtdiWHqfxIha13FdnCdhL WS2c/O9ORfAzjFwnYWF6LBwH8ArxRSkAXrGCMuCkEFBP3cG/j2HD+XLAAYEuBjjb sf1fw8e8VSgaPEOnwXie5rTfAY4VnZKEtZjAxjyIQnJKVVKfxQRb8CyaWDPzPD0Z tL/iABt7UWNHZayHTHsh0YhF2UhXtOjHinWigEarcZQEvOB2qRQtFl71cnqosi+t 3ZRZzepH7/Fx3v6/H/6PNq+GSI/ZzhOiCQolVV5YcMGHXsW9cP6arjLUxco5pzpk pEg0vdMq47JOZYQ2pIewG4t7+NLmFIxCRFnKQVbxeFNSY9c1jhd8g5lhx9YEXwjT BzMtV5DnZoaoMdq2P1STw/+RVYrDI1Lm6jqfgw/D27b7LzQ13VsGM9BJ1rCs8Hm7 UhWyjwFcgo0vhpfML1RF0RtT9Mo5SOnpGPfpbFdjg8jdXlGknNH0QsH+EY/BpF8l h77P5BvoNIjsIN3B1YunfXtFXhx3h0sI8zZrqHR+zhOeWGsXcqQ5mZ/lYdYKkKuH R8LRB7shPndF4xdRX0uRXwomcXhs+60eA5xEvE9u0CqqdpXfQN5oTwixfCm2C8MS O5Fc7hfvK11XtR3ja+y3KRhiNG3YsfW2PXnlOfZxMZ6iPqXtA/o= =5/pn -----END PGP SIGNATURE----- Merge 6.1.57 into android14-6.1-lts Changes in 6.1.57 spi: zynqmp-gqspi: fix clock imbalance on probe failure ASoC: soc-utils: Export snd_soc_dai_is_dummy() symbol ASoC: tegra: Fix redundant PLLA and PLLA_OUT0 updates mptcp: rename timer related helper to less confusing names mptcp: fix dangling connection hang-up mptcp: annotate lockless accesses to sk->sk_err mptcp: move __mptcp_error_report in protocol.c mptcp: process pending subflow error on close ata,scsi: do not issue START STOP UNIT on resume scsi: sd: Differentiate system and runtime start/stop management scsi: sd: Do not issue commands to suspended disks on shutdown scsi: core: Improve type safety of scsi_rescan_device() scsi: Do not attempt to rescan suspended devices ata: libata-scsi: Fix delayed scsi_rescan_device() execution NFS: Cleanup unused rpc_clnt variable NFS: rename nfs_client_kset to nfs_kset NFSv4: Fix a state manager thread deadlock regression mm/memory: add vm_normal_folio() mm/mempolicy: convert queue_pages_pmd() to queue_folios_pmd() mm/mempolicy: convert queue_pages_pte_range() to queue_folios_pte_range() mm/mempolicy: convert migrate_page_add() to migrate_folio_add() mm: mempolicy: keep VMA walk if both MPOL_MF_STRICT and MPOL_MF_MOVE are specified mm/page_alloc: always remove pages from temporary list mm/page_alloc: leave IRQs enabled for per-cpu page allocations mm: page_alloc: fix CMA and HIGHATOMIC landing on the wrong buddy list ring-buffer: remove obsolete comment for free_buffer_page() ring-buffer: Fix bytes info in per_cpu buffer stats btrfs: use struct qstr instead of name and namelen pairs btrfs: setup qstr from dentrys using fscrypt helper btrfs: use struct fscrypt_str instead of struct qstr Revert "NFSv4: Retry LOCK on OLD_STATEID during delegation return" arm64: Avoid repeated AA64MMFR1_EL1 register read on pagefault path net: add sysctl accept_ra_min_rtr_lft net: change accept_ra_min_rtr_lft to affect all RA lifetimes net: release reference to inet6_dev pointer arm64: cpufeature: Fix CLRBHB and BC detection drm/amd/display: Adjust the MST resume flow iommu/arm-smmu-v3: Set TTL invalidation hint better iommu/arm-smmu-v3: Avoid constructing invalid range commands rbd: move rbd_dev_refresh() definition rbd: decouple header read-in from updating rbd_dev->header rbd: decouple parent info read-in from updating rbd_dev rbd: take header_rwsem in rbd_dev_refresh() only when updating block: fix use-after-free of q->q_usage_counter hwmon: (nzxt-smart2) Add device id hwmon: (nzxt-smart2) add another USB ID i40e: fix the wrong PTP frequency calculation scsi: zfcp: Fix a double put in zfcp_port_enqueue() iommu/vt-d: Avoid memory allocation in iommu_suspend() vringh: don't use vringh_kiov_advance() in vringh_iov_xfer() net: ethernet: mediatek: disable irq before schedule napi mptcp: userspace pm allow creating id 0 subflow qed/red_ll2: Fix undefined behavior bug in struct qed_ll2_info Bluetooth: hci_codec: Fix leaking content of local_codecs Bluetooth: hci_sync: Fix handling of HCI_QUIRK_STRICT_DUPLICATE_FILTER wifi: mwifiex: Fix tlv_buf_left calculation md/raid5: release batch_last before waiting for another stripe_head PCI: qcom: Fix IPQ8074 enumeration net: replace calls to sock->ops->connect() with kernel_connect() net: prevent rewrite of msg_name in sock_sendmsg() drm/amd: Fix detection of _PR3 on the PCIe root port drm/amd: Fix logic error in sienna_cichlid_update_pcie_parameters() arm64: Add Cortex-A520 CPU part definition arm64: errata: Add Cortex-A520 speculative unprivileged load workaround HID: sony: Fix a potential memory leak in sony_probe() ubi: Refuse attaching if mtd's erasesize is 0 erofs: fix memory leak of LZMA global compressed deduplication wifi: iwlwifi: dbg_ini: fix structure packing wifi: iwlwifi: mvm: Fix a memory corruption issue wifi: cfg80211: hold wiphy lock in auto-disconnect wifi: cfg80211: move wowlan disable under locks wifi: cfg80211: add a work abstraction with special semantics wifi: cfg80211: fix cqm_config access race wifi: cfg80211: add missing kernel-doc for cqm_rssi_work wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet leds: Drop BUG_ON check for LED_COLOR_ID_MULTI bpf: Fix tr dereferencing regulator: mt6358: Drop *_SSHUB regulators regulator: mt6358: Use linear voltage helpers for single range regulators regulator: mt6358: split ops for buck and linear range LDO regulators Bluetooth: Delete unused hci_req_prepare_suspend() declaration Bluetooth: ISO: Fix handling of listen for unicast drivers/net: process the result of hdlc_open() and add call of hdlc_close() in uhdlc_close() wifi: mt76: mt76x02: fix MT76x0 external LNA gain handling perf/x86/amd/core: Fix overflow reset on hotplug regmap: rbtree: Fix wrong register marked as in-cache when creating new node wifi: mac80211: fix potential key use-after-free perf/x86/amd: Do not WARN() on every IRQ iommu/mediatek: Fix share pgtable for iova over 4GB regulator/core: regulator_register: set device->class earlier ima: Finish deprecation of IMA_TRUSTED_KEYRING Kconfig scsi: target: core: Fix deadlock due to recursive locking ima: rework CONFIG_IMA dependency block NFSv4: Fix a nfs4_state_manager() race bpf: tcp_read_skb needs to pop skb regardless of seq bpf, sockmap: Do not inc copied_seq when PEEK flag set bpf, sockmap: Reject sk_msg egress redirects to non-TCP sockets modpost: add missing else to the "of" check net: fix possible store tearing in neigh_periodic_work() bpf: Add BPF_FIB_LOOKUP_SKIP_NEIGH for bpf_fib_lookup neighbour: annotate lockless accesses to n->nud_state neighbour: switch to standard rcu, instead of rcu_bh neighbour: fix data-races around n->output ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data() ptp: ocp: Fix error handling in ptp_ocp_device_init net: dsa: mv88e6xxx: Avoid EEPROM timeout when EEPROM is absent ipv6: tcp: add a missing nf_reset_ct() in 3WHS handling net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg net: nfc: llcp: Add lock when modifying device list net: ethernet: ti: am65-cpsw: Fix error code in am65_cpsw_nuss_init_tx_chns() ibmveth: Remove condition to recompute TCP header checksum. netfilter: handle the connecting collision properly in nf_conntrack_proto_sctp selftests: netfilter: Test nf_tables audit logging selftests: netfilter: Extend nft_audit.sh netfilter: nf_tables: Deduplicate nft_register_obj audit logs netfilter: nf_tables: nft_set_rbtree: fix spurious insertion failure ipv4: Set offload_failed flag in fibmatch results net: stmmac: dwmac-stm32: fix resume on STM32 MCU tipc: fix a potential deadlock on &tx->lock tcp: fix quick-ack counting to count actual ACKs of new data tcp: fix delayed ACKs for MSS boundary condition sctp: update transport state when processing a dupcook packet sctp: update hb timer immediately after users change hb_interval netlink: split up copies in the ack construction netlink: Fix potential skb memleak in netlink_ack netlink: annotate data-races around sk->sk_err HID: sony: remove duplicate NULL check before calling usb_free_urb() HID: intel-ish-hid: ipc: Disable and reenable ACPI GPE bit intel_idle: add Emerald Rapids Xeon support smb: use kernel_connect() and kernel_bind() parisc: Fix crash with nr_cpus=1 option dm zoned: free dmz->ddev array in dmz_put_zoned_devices RDMA/core: Require admin capabilities to set system parameters of: dynamic: Fix potential memory leak in of_changeset_action() IB/mlx4: Fix the size of a buffer in add_port_entries() gpio: aspeed: fix the GPIO number passed to pinctrl_gpio_set_config() gpio: pxa: disable pinctrl calls for MMP_GPIO RDMA/cma: Initialize ib_sa_multicast structure to 0 when join RDMA/cma: Fix truncation compilation warning in make_cma_ports RDMA/uverbs: Fix typo of sizeof argument RDMA/srp: Do not call scsi_done() from srp_abort() RDMA/siw: Fix connection failure handling RDMA/mlx5: Fix mutex unlocking on error flow for steering anchor creation RDMA/mlx5: Fix NULL string error x86/sev: Use the GHCB protocol when available for SNP CPUID requests ksmbd: fix race condition between session lookup and expire ksmbd: fix uaf in smb20_oplock_break_ack parisc: Restore __ldcw_align for PA-RISC 2.0 processors ipv6: remove nexthop_fib6_nh_bh() vrf: Fix lockdep splat in output path btrfs: fix an error handling path in btrfs_rename() btrfs: fix fscrypt name leak after failure to join log transaction netlink: remove the flex array from struct nlmsghdr btrfs: file_remove_privs needs an exclusive lock in direct io write ipv6: remove one read_lock()/read_unlock() pair in rt6_check_neigh() xen/events: replace evtchn_rwlock with RCU Linux 6.1.57 Change-Id: I2c200264df72a9043d91d31479c91b0d7f94863e Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-11-02 07:05:54 +00:00
Greg Kroah-Hartman	1c5ec1e54d	Merge 6.1.55 into android14-6.1-lts ... Changes in 6.1.55 autofs: fix memory leak of waitqueues in autofs_catatonic_mode btrfs: output extra debug info if we failed to find an inline backref locks: fix KASAN: use-after-free in trace_event_raw_event_filelock_lock ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer kernel/fork: beware of __put_task_struct() calling context rcuscale: Move rcu_scale_writer() schedule_timeout_uninterruptible() to _idle() scftorture: Forgive memory-allocation failure if KASAN ACPI: video: Add backlight=native DMI quirk for Lenovo Ideapad Z470 perf/smmuv3: Enable HiSilicon Erratum 162001900 quirk for HIP08/09 perf/imx_ddr: speed up overflow frequency of cycle hw_breakpoint: fix single-stepping when using bpf_overflow_handler ACPI: x86: s2idle: Catch multiple ACPI_TYPE_PACKAGE objects selftests/nolibc: fix up kernel parameters support devlink: remove reload failed checks in params get/set callbacks crypto: lrw,xts - Replace strlcpy with strscpy ice: Don't tx before switchdev is fully configured wifi: ath9k: fix fortify warnings wifi: ath9k: fix printk specifier wifi: mwifiex: fix fortify warning mt76: mt7921: don't assume adequate headroom for SDIO headers wifi: wil6210: fix fortify warnings can: sun4i_can: Add acceptance register quirk can: sun4i_can: Add support for the Allwinner D1 net: Use sockaddr_storage for getsockopt(SO_PEERNAME). net/ipv4: return the real errno instead of -EINVAL crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() Bluetooth: Fix hci_suspend_sync crash netlink: convert nlk->flags to atomic flags tpm_tis: Resend command to recover from data transfer errors mmc: sdhci-esdhc-imx: improve ESDHC_FLAG_ERR010450 alx: fix OOB-read compiler warning wifi: mac80211: check S1G action frame size netfilter: ebtables: fix fortify warnings in size_entry_mwt() wifi: cfg80211: reject auth/assoc to AP with our address wifi: cfg80211: ocb: don't leave if not joined wifi: mac80211: check for station first in client probe wifi: mac80211_hwsim: drop short frames libbpf: Free btf_vmlinux when closing bpf_object drm/bridge: tc358762: Instruct DSI host to generate HSE packets drm/edid: Add quirk for OSVR HDK 2.0 arm64: dts: qcom: sm6125-pdx201: correct ramoops pmsg-size arm64: dts: qcom: sm6350: correct ramoops pmsg-size arm64: dts: qcom: sm8150-kumano: correct ramoops pmsg-size arm64: dts: qcom: sm8250-edo: correct ramoops pmsg-size samples/hw_breakpoint: Fix kernel BUG 'invalid opcode: 0000' drm/amd/display: Fix underflow issue on 175hz timing ASoC: SOF: topology: simplify code to prevent static analysis warnings ASoC: Intel: sof_sdw: Update BT offload config for soundwire config ALSA: hda: intel-dsp-cfg: add LunarLake support drm/amd/display: Use DTBCLK as refclk instead of DPREFCLK drm/amd/display: Blocking invalid 420 modes on HDMI TMDS for DCN31 drm/amd/display: Blocking invalid 420 modes on HDMI TMDS for DCN314 drm/exynos: fix a possible null-pointer dereference due to data race in exynos_drm_crtc_atomic_disable() drm/mediatek: dp: Change logging to dev for mtk_dp_aux_transfer() bus: ti-sysc: Configure uart quirks for k3 SoC md: raid1: fix potential OOB in raid1_remove_disk() ext2: fix datatype of block number in ext2_xattr_set2() fs/jfs: prevent double-free in dbUnmount() after failed jfs_remount() jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount PCI: dwc: Provide deinit callback for i.MX ARM: 9317/1: kexec: Make smp stop calls asynchronous powerpc/pseries: fix possible memory leak in ibmebus_bus_init() PCI: vmd: Disable bridge window for domain reset PCI: fu740: Set the number of MSI vectors media: mdp3: Fix resource leaks in of_find_device_by_node media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer() media: af9005: Fix null-ptr-deref in af9005_i2c_xfer media: anysee: fix null-ptr-deref in anysee_master_xfer media: az6007: Fix null-ptr-deref in az6007_i2c_xfer() media: dvb-usb-v2: gl861: Fix null-ptr-deref in gl861_i2c_master_xfer scsi: lpfc: Abort outstanding ELS cmds when mailbox timeout error is detected media: tuners: qt1010: replace BUG_ON with a regular error media: pci: cx23885: replace BUG with error return usb: cdns3: Put the cdns set active part outside the spin lock usb: gadget: fsl_qe_udc: validate endpoint index for ch9 udc tools: iio: iio_generic_buffer: Fix some integer type and calculation scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() serial: cpm_uart: Avoid suspicious locking misc: open-dice: make OPEN_DICE depend on HAS_IOMEM usb: ehci: add workaround for chipidea PORTSC.PEC bug usb: chipidea: add workaround for chipidea PEC bug media: pci: ipu3-cio2: Initialise timing struct to avoid a compiler warning kobject: Add sanity check for kset->kobj.ktype in kset_register() interconnect: Fix locking for runpm vs reclaim printk: Keep non-panic-CPUs out of console lock printk: Consolidate console deferred printing dma-buf: Add unlocked variant of attachment-mapping functions misc: fastrpc: Prepare to dynamic dma-buf locking specification misc: fastrpc: Fix incorrect DMA mapping unmap request MIPS: Use "grep -E" instead of "egrep" btrfs: add a helper to read the superblock metadata_uuid btrfs: compare the correct fsid/metadata_uuid in btrfs_validate_super block: factor out a bvec_set_page helper nvmet: use bvec_set_page to initialize bvecs nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() drm: gm12u320: Fix the timeout usage for usb_bulk_msg() scsi: qla2xxx: Fix NULL vs IS_ERR() bug for debugfs_create_dir() selftests: tracing: Fix to unmount tracefs for recovering environment x86/ibt: Suppress spurious ENDBR riscv: kexec: Align the kexeced kernel entry scsi: target: core: Fix target_cmd_counter leak scsi: lpfc: Fix the NULL vs IS_ERR() bug for debugfs_create_file() panic: Reenable preemption in WARN slowpath x86/boot/compressed: Reserve more memory for page tables x86/purgatory: Remove LTO flags samples/hw_breakpoint: fix building without module unloading md/raid1: fix error: ISO C90 forbids mixed declarations Revert "SUNRPC: Fail faster on bad verifier" attr: block mode changes of symlinks ovl: fix failed copyup of fileattr on a symlink ovl: fix incorrect fdput() on aio completion io_uring/net: fix iter retargeting for selected buf nvme: avoid bogus CRTO values md: Put the right device in md_seq_next Revert "drm/amd: Disable S/G for APUs when 64GB or more host memory" dm: don't attempt to queue IO under RCU protection btrfs: fix lockdep splat and potential deadlock after failure running delayed items btrfs: fix a compilation error if DEBUG is defined in btree_dirty_folio btrfs: release path before inode lookup during the ino lookup ioctl btrfs: check for BTRFS_FS_ERROR in pending ordered assert tracing: Have tracing_max_latency inc the trace array ref count tracing: Have event inject files inc the trace array ref count tracing: Increase trace array ref count on enable and filter files tracing: Have current_trace inc the trace array ref count tracing: Have option files inc the trace array ref count selinux: fix handling of empty opts in selinux_fs_context_submount() nfsd: fix change_info in NFSv4 RENAME replies tracefs: Add missing lockdown check to tracefs_create_dir() i2c: aspeed: Reset the i2c controller when timeout occurs ata: libata: disallow dev-initiated LPM transitions to unsupported states ata: libahci: clear pending interrupt status scsi: megaraid_sas: Fix deadlock on firmware crashdump scsi: pm8001: Setup IRQs on resume ext4: fix rec_len verify error drm/amd/display: fix the white screen issue when >= 64GB DRAM Revert "memcg: drop kmem.limit_in_bytes" drm/amdgpu: fix amdgpu_cs_p1_user_fence net/sched: Retire rsvp classifier interconnect: Teach lockdep about icc_bw_lock order Linux 6.1.55 Change-Id: I95193a57879a13b04b5ac8647a24e6d8304fcb0e Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-10-26 18:58:32 +00:00
Junxiao Bi	6c5d7f5416	scsi: target: core: Fix deadlock due to recursive locking ... [ Upstream commit a154f5f643c6ecddd44847217a7a3845b4350003 ] The following call trace shows a deadlock issue due to recursive locking of mutex "device_mutex". First lock acquire is in target_for_each_device() and second in target_free_device(). PID: 148266 TASK: ffff8be21ffb5d00 CPU: 10 COMMAND: "iscsi_ttx" #0 [ffffa2bfc9ec3b18] __schedule at ffffffffa8060e7f #1 [ffffa2bfc9ec3ba0] schedule at ffffffffa8061224 #2 [ffffa2bfc9ec3bb8] schedule_preempt_disabled at ffffffffa80615ee #3 [ffffa2bfc9ec3bc8] __mutex_lock at ffffffffa8062fd7 #4 [ffffa2bfc9ec3c40] __mutex_lock_slowpath at ffffffffa80631d3 #5 [ffffa2bfc9ec3c50] mutex_lock at ffffffffa806320c #6 [ffffa2bfc9ec3c68] target_free_device at ffffffffc0935998 [target_core_mod] #7 [ffffa2bfc9ec3c90] target_core_dev_release at ffffffffc092f975 [target_core_mod] #8 [ffffa2bfc9ec3ca0] config_item_put at ffffffffa79d250f #9 [ffffa2bfc9ec3cd0] config_item_put at ffffffffa79d2583 #10 [ffffa2bfc9ec3ce0] target_devices_idr_iter at ffffffffc0933f3a [target_core_mod] #11 [ffffa2bfc9ec3d00] idr_for_each at ffffffffa803f6fc #12 [ffffa2bfc9ec3d60] target_for_each_device at ffffffffc0935670 [target_core_mod] #13 [ffffa2bfc9ec3d98] transport_deregister_session at ffffffffc0946408 [target_core_mod] #14 [ffffa2bfc9ec3dc8] iscsit_close_session at ffffffffc09a44a6 [iscsi_target_mod] #15 [ffffa2bfc9ec3df0] iscsit_close_connection at ffffffffc09a4a88 [iscsi_target_mod] #16 [ffffa2bfc9ec3df8] finish_task_switch at ffffffffa76e5d07 #17 [ffffa2bfc9ec3e78] iscsit_take_action_for_connection_exit at ffffffffc0991c23 [iscsi_target_mod] #18 [ffffa2bfc9ec3ea0] iscsi_target_tx_thread at ffffffffc09a403b [iscsi_target_mod] #19 [ffffa2bfc9ec3f08] kthread at ffffffffa76d8080 #20 [ffffa2bfc9ec3f50] ret_from_fork at ffffffffa8200364 Fixes: 36d4cb460b ("scsi: target: Avoid that EXTENDED COPY commands trigger lock inversion") Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com> Link: https://lore.kernel.org/r/20230918225848.66463-1-junxiao.bi@oracle.com Reviewed-by: Mike Christie <michael.christie@oracle.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-10-10 22:00:41 +02:00
David Disseldorp	1cd41d1669	scsi: target: core: Fix target_cmd_counter leak ... [ Upstream commit d14e3e553e05cb763964c991fe6acb0a6a1c6f9c ] The target_cmd_counter struct allocated via target_alloc_cmd_counter() is never freed, resulting in leaks across various transport types, e.g.: unreferenced object 0xffff88801f920120 (size 96): comm "sh", pid 102, jiffies 4294892535 (age 713.412s) hex dump (first 32 bytes): 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 38 01 92 1f 80 88 ff ff ........8....... backtrace: [<00000000e58a6252>] kmalloc_trace+0x11/0x20 [<0000000043af4b2f>] target_alloc_cmd_counter+0x17/0x90 [target_core_mod] [<000000007da2dfa7>] target_setup_session+0x2d/0x140 [target_core_mod] [<0000000068feef86>] tcm_loop_tpg_nexus_store+0x19b/0x350 [tcm_loop] [<000000006a80e021>] configfs_write_iter+0xb1/0x120 [<00000000e9f4d860>] vfs_write+0x2e4/0x3c0 [<000000008143433b>] ksys_write+0x80/0xb0 [<00000000a7df29b2>] do_syscall_64+0x42/0x90 [<0000000053f45fb8>] entry_SYSCALL_64_after_hwframe+0x6e/0xd8 Free the structure alongside the corresponding iscsit_conn / se_sess parent. Signed-off-by: David Disseldorp <ddiss@suse.de> Link: https://lore.kernel.org/r/20230831183459.6938-1-ddiss@suse.de Fixes: becd9be6069e ("scsi: target: Move sess cmd counter to new struct") Reviewed-by: Mike Christie <michael.christie@oracle.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-09-23 11:11:09 +02:00
Konstantin Shelekhin	4738bf8b2d	scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() ... [ Upstream commit 801f287c93ff95582b0a2d2163f12870a2f076d4 ] The function lio_target_nacl_info_show() uses sprintf() in a loop to print details for every iSCSI connection in a session without checking for the buffer length. With enough iSCSI connections it's possible to overflow the buffer provided by configfs and corrupt the memory. This patch replaces sprintf() with sysfs_emit_at() that checks for buffer boundries. Signed-off-by: Konstantin Shelekhin <k.shelekhin@yadro.com> Link: https://lore.kernel.org/r/20230722152657.168859-2-k.shelekhin@yadro.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-09-23 11:11:07 +02:00
Greg Kroah-Hartman	a09603eb2f	This is the 6.1.36 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmSb+ZMACgkQONu9yGCS aT7qORAAmbYIAtIdWp+3wAM8g9TihQAeknz6f7Q8sxUB1EkZKJ9TgnFdR1IPPcBI BWMUNutyUtHY90XTlZbVM04P070FafWjyT23+sdNG+pZGv+sOJkTHO6NgvkFlt0m doOq9ojOe6hXS5oqK+8grfbwBG0VDUv7HHuUKsGBLhlDAHP58sVqtkrpiK2EiJpx WGIR1t7gPd7jIxsnWTSurdjGfrAUw3SmE07K6sjwGgHsc2Mvd5vluQ+ljnmlz2qd 3WMyHymIhNP69/HY5Zz6sqCNGJ0eglp6IP8VPw9a7eGDu1UNp2Gu+P5ZB4FR7ABg Rbsvrkr/08S9on0OSFiYJ11sfbzdIb4AfGdSHnUpeuqBp5ak1JS5jE6eSiy9YZU/ V9wDFdlDDwwORCWTMJzcTvhtlzWI+BkKq0bZEiYSxeCZ6m5RKi0i6X/lOPFt/ihA PfEHGZVZ12atEEnYm5iich8Frqyp3nOYJKR972/zeKkkcWoYslFA6KuA3PA3eV7S rdbz3hK6T3kZTe7FUvmghdi1lGgIKYy8IOiqY9tbMHWa3YQ7k5ZA2BZOiCEri0RF tfzT1wI4DknbEXv5fs5PQ8c8eYMXaFKxdZ4+ndfB7f/jPn6IEK2xb5VtbnLe/NIE qeRtanzccoKh8P7CmnwWqQ4CaqVeZTFrQ3jiadptSbpTnt3qzlM= =oSd/ -----END PGP SIGNATURE----- Merge 6.1.36 into android14-6.1-lts Changes in 6.1.36 drm/amd/display: Use dc_update_planes_and_stream drm/amd/display: Add wrapper to call planes and stream update drm/amd/display: fix the system hang while disable PSR tty: serial: fsl_lpuart: make rx_watermark configurable for different platforms tty: serial: fsl_lpuart: reduce RX watermark to 0 on LS1028A ata: libata-scsi: Avoid deadlock on rescan after device resume mm: Fix copy_from_user_nofault(). tpm, tpm_tis: Claim locality in interrupt handler tpm_crb: Add support for CRB devices based on Pluton ksmbd: validate command payload size ksmbd: fix out-of-bound read in smb2_write ksmbd: validate session id and tree id in the compound request tick/common: Align tick period during sched_timer setup selftests: mptcp: remove duplicated entries in usage selftests: mptcp: join: fix ShellCheck warnings selftests: mptcp: lib: skip if missing symbol selftests: mptcp: connect: skip transp tests if not supported selftests: mptcp: connect: skip disconnect tests if not supported selftests: mptcp: pm nl: remove hardcoded default limits selftests: mptcp: pm nl: skip fullmesh flag checks if not supported selftests: mptcp: sockopt: relax expected returned size selftests: mptcp: sockopt: skip getsockopt checks if not supported selftests: mptcp: userspace pm: skip if 'ip' tool is unavailable selftests: mptcp: userspace pm: skip if not supported selftests: mptcp: lib: skip if not below kernel version selftests: mptcp: join: use 'iptables-legacy' if available selftests: mptcp: join: helpers to skip tests selftests: mptcp: join: skip check if MIB counter not supported selftests: mptcp: join: support local endpoint being tracked or not selftests: mptcp: join: skip Fastclose tests if not supported selftests: mptcp: join: support RM_ADDR for used endpoints or not selftests: mptcp: join: skip implicit tests if not supported selftests: mptcp: join: skip backup if set flag on ID not supported selftests: mptcp: join: skip fullmesh flag tests if not supported selftests: mptcp: join: skip MPC backups tests if not supported selftests/mount_setattr: fix redefine struct mount_attr build error selftests: mptcp: diag: skip listen tests if not supported selftests: mptcp: sockopt: skip TCP_INQ checks if not supported selftests: mptcp: join: skip test if iptables/tc cmds fail selftests: mptcp: join: skip userspace PM tests if not supported selftests: mptcp: join: skip fail tests if not supported selftests: mptcp: join: fix "userspace pm add & remove address" writeback: fix dereferencing NULL mapping->host on writeback_page_template scripts: fix the gfp flags header path in gfp-translate nilfs2: fix buffer corruption due to concurrent device reads ACPI: sleep: Avoid breaking S3 wakeup due to might_sleep() KVM: Avoid illegal stage2 mapping on invalid memory slot Drivers: hv: vmbus: Call hv_synic_free() if hv_synic_alloc() fails Drivers: hv: vmbus: Fix vmbus_wait_for_unload() to scan present CPUs PCI: hv: Fix a race condition bug in hv_pci_query_relations() Revert "PCI: hv: Fix a timing issue which causes kdump to fail occasionally" PCI: hv: Remove the useless hv_pcichild_state from struct hv_pci_dev PCI: hv: Fix a race condition in hv_irq_unmask() that can cause panic PCI: hv: Add a per-bus mutex state_lock io_uring/net: clear msg_controllen on partial sendmsg retry io_uring/net: disable partial retries for recvmsg with cmsg mptcp: handle correctly disconnect() failures mptcp: fix possible divide by zero in recvmsg() mptcp: fix possible list corruption on passive MPJ mptcp: consolidate fallback and non fallback state machine cgroup: Do not corrupt task iteration when rebinding subsystem cgroup,freezer: hold cpu_hotplug_lock before freezer_mutex in freezer_css_{online,offline}() mmc: litex_mmc: set PROBE_PREFER_ASYNCHRONOUS mmc: sdhci-msm: Disable broken 64-bit DMA on MSM8916 mmc: meson-gx: remove redundant mmc_request_done() call from irq context mmc: mmci: stm32: fix max busy timeout calculation mmc: sdhci-spear: fix deferred probing mmc: bcm2835: fix deferred probing mmc: sunxi: fix deferred probing bpf: ensure main program has an extable wifi: iwlwifi: pcie: Handle SO-F device for PCI id 0x7AF0 spi: spi-geni-qcom: correctly handle -EPROBE_DEFER from dma_request_chan() regulator: pca9450: Fix LDO3OUT and LDO4OUT MASK regmap: spi-avmm: Fix regmap_bus max_raw_write arm64: dts: rockchip: Fix rk356x PCIe register and range mappings io_uring/poll: serialize poll linked timer start with poll removal nilfs2: prevent general protection fault in nilfs_clear_dirty_page() x86/mm: Avoid using set_pgd() outside of real PGD pages memfd: check for non-NULL file_seals in memfd_create() syscall mmc: meson-gx: fix deferred probing ieee802154: hwsim: Fix possible memory leaks xfrm: Treat already-verified secpath entries as optional xfrm: interface: rename xfrm_interface.c to xfrm_interface_core.c xfrm: Ensure policies always checked on XFRM-I input path KVM: arm64: PMU: Restore the host's PMUSERENR_EL0 bpf: track immediate values written to stack by BPF_ST instruction bpf: Fix verifier id tracking of scalars on spill xfrm: fix inbound ipv4/udp/esp packets to UDPv6 dualstack sockets bpf: Fix a bpf_jit_dump issue for x86_64 with sysctl bpf_jit_enable. selftests: net: tls: check if FIPS mode is enabled selftests: net: vrf-xfrm-tests: change authentication and encryption algos selftests: net: fcnal-test: check if FIPS mode is enabled xfrm: Linearize the skb after offloading if needed. net/mlx5: DR, Fix wrong action data allocation in decap action sfc: use budget for TX completions net: qca_spi: Avoid high load if QCA7000 is not available mmc: mtk-sd: fix deferred probing mmc: mvsdio: fix deferred probing mmc: omap: fix deferred probing mmc: omap_hsmmc: fix deferred probing mmc: owl: fix deferred probing mmc: sdhci-acpi: fix deferred probing mmc: sh_mmcif: fix deferred probing mmc: usdhi60rol0: fix deferred probing ipvs: align inner_mac_header for encapsulation net: dsa: mt7530: fix trapping frames on non-MT7621 SoC MT7530 switch net: dsa: mt7530: fix handling of BPDUs on MT7530 switch net: dsa: mt7530: fix handling of LLDP frames be2net: Extend xmit workaround to BE3 chip netfilter: nf_tables: fix chain binding transaction logic netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain netfilter: nf_tables: drop map element references from preparation phase netfilter: nft_set_pipapo: .walk does not deal with generations netfilter: nf_tables: disallow element updates of bound anonymous sets netfilter: nf_tables: reject unbound anonymous set before commit phase netfilter: nf_tables: reject unbound chain set before commit phase netfilter: nf_tables: disallow updates of anonymous sets netfilter: nfnetlink_osf: fix module autoload Revert "net: phy: dp83867: perform soft reset and retain established link" bpf/btf: Accept function names that contain dots bpf: Force kprobe multi expected_attach_type for kprobe_multi link io_uring/net: use the correct msghdr union member in io_sendmsg_copy_hdr selftests: forwarding: Fix race condition in mirror installation platform/x86/amd/pmf: Register notify handler only if SPS is enabled sch_netem: acquire qdisc lock in netem_change() revert "net: align SO_RCVMARK required privileges with SO_MARK" arm64: dts: rockchip: Enable GPU on SOQuartz CM4 arm64: dts: rockchip: fix nEXTRST on SOQuartz gpiolib: Fix GPIO chip IRQ initialization restriction gpio: sifive: add missing check for platform_get_irq gpiolib: Fix irq_domain resource tracking for gpiochip_irqchip_add_domain() scsi: target: iscsi: Prevent login threads from racing between each other HID: wacom: Add error check to wacom_parse_and_register() arm64: Add missing Set/Way CMO encodings smb3: missing null check in SMB2_change_notify media: cec: core: disable adapter in cec_devnode_unregister media: cec: core: don't set last_initiator if tx in progress nfcsim.c: Fix error checking for debugfs_create_dir btrfs: fix an uninitialized variable warning in btrfs_log_inode usb: gadget: udc: fix NULL dereference in remove() nvme: double KA polling frequency to avoid KATO with TBKAS on nvme: check IO start time when deciding to defer KA nvme: improve handling of long keep alives Input: soc_button_array - add invalid acpi_index DMI quirk handling arm64: dts: qcom: sc7280-idp: drop incorrect dai-cells from WCD938x SDW arm64: dts: qcom: sc7280-qcard: drop incorrect dai-cells from WCD938x SDW s390/cio: unregister device when the only path is gone spi: lpspi: disable lpspi module irq in DMA mode ASoC: codecs: wcd938x-sdw: do not set can_multi_write flag ASoC: simple-card: Add missing of_node_put() in case of error soundwire: dmi-quirks: add new mapping for HP Spectre x360 soundwire: qcom: add proper error paths in qcom_swrm_startup() ASoC: nau8824: Add quirk to active-high jack-detect ASoC: amd: yc: Add Thinkpad Neo14 to quirks list for acp6x gfs2: Don't get stuck writing page onto itself under direct I/O s390/purgatory: disable branch profiling ASoC: fsl_sai: Enable BCI bit if SAI works on synchronous mode with BYP asserted ALSA: hda/realtek: Add "Intel Reference board" and "NUC 13" SSID in the ALC256 i2c: mchp-pci1xxxx: Avoid cast to incompatible function type ARM: dts: Fix erroneous ADS touchscreen polarities null_blk: Fix: memory release when memory_backed=1 drm/exynos: vidi: fix a wrong error return drm/exynos: fix race condition UAF in exynos_g2d_exec_ioctl drm/radeon: fix race condition UAF in radeon_gem_set_domain_ioctl vhost_vdpa: tell vqs about the negotiated vhost_net: revert upend_idx only on retriable error KVM: arm64: Restore GICv2-on-GICv3 functionality x86/apic: Fix kernel panic when booting with intremap=off and x2apic_phys i2c: imx-lpi2c: fix type char overflow issue when calculating the clock cycle smb: move client and server files to common directory fs/smb Linux 6.1.36 Note, this "merges away" commit: 679354bea0 ("KVM: arm64: Restore GICv2-on-GICv3 functionality") because of the merge conflicts were too complex to resolve. If this is needed in the android tree it should be brought back as an individual change in the future. Change-Id: Iafee89e3fb40c8bd631e6cc22eaaf7453b82f727 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-06-28 10:19:08 +00:00
Maurizio Lombardi	aaa50510ad	scsi: target: iscsi: Prevent login threads from racing between each other ... [ Upstream commit 2a737d3b8c792400118d6cf94958f559de9c5e59 ] The tpg->np_login_sem is a semaphore that is used to serialize the login process when multiple login threads run concurrently against the same target portal group. The iscsi_target_locate_portal() function finds the tpg, calls iscsit_access_np() against the np_login_sem semaphore and saves the tpg pointer in conn->tpg; If iscsi_target_locate_portal() fails, the caller will check for the conn->tpg pointer and, if it's not NULL, then it will assume that iscsi_target_locate_portal() called iscsit_access_np() on the semaphore. Make sure that conn->tpg gets initialized only if iscsit_access_np() was successful, otherwise iscsit_deaccess_np() may end up being called against a semaphore we never took, allowing more than one thread to access the same tpg. Signed-off-by: Maurizio Lombardi <mlombard@redhat.com> Link: https://lore.kernel.org/r/20230508162219.1731964-4-mlombard@redhat.com Reviewed-by: Mike Christie <michael.christie@oracle.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-06-28 11:12:35 +02:00
Greg Kroah-Hartman	1e4b07ffa3	This is the 6.1.35 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmSTArUACgkQONu9yGCS aT7L1w//S9q9UHGxXd4awCjyj3doC4UMaMjH0b/BT8GmDM5lpbqqvWBgWe7zrvnK L/VOGj6pkgBuH7uBLmRVZKkRwnyFcxKnW+BwVxn3WFE5UjCBrxqjry228Wp9FCR9 i/4C/6ls+vA+Ll2GkvSVogPkTwtC1A8hsI6r4qQMbNyeTySd9SF6nfo3uR2olBW6 UN3NdIY6Lzo7t/Jbn+4zLhgDbQ28bn3IymS8jPAFQBoRHNOeKh6UFEu7Mzjbn6Nb YrcHxr4/xAjnof7JV1JZOVVA2BoUCIStB4INv6Ke9XucIs8Y0UzU7MeeqPLh1lBO aKhGADdO3shj0OGsLfmzfYlGu5+5lQ3yFN8ZVTzQTYTZUFLnddUjB3a/DwKR0Nza A6LjUID2jRmoNtMWDHlX9Wqyv5iuIzl2hqs2jGc3o/EHAQ2IFlMMee+mjkEqmalO iRyCt5Ekr/P8MrTQHPcJ26uPh+TGvcooBSGSKu6WNFozNQ7sxSl7QJONLMs0tUtk JzcTxw7cAtbxcsfDX0k3z2Mp6d1YuQvwo22mVYioO7+nhB6MaRNVPkhbVf3koMeD lB/ISmr8Lv4CZLS4xYUlYHQyPGT+YTkLpbncV+WQe4+9ounbuz71tKpoB7XbBVgY 52Qc9aLAAKi8yyFbNRoxWo98RXx5fWTzQMMqM2N2KExsF75EW/k= =/x/n -----END PGP SIGNATURE----- Merge 6.1.35 into android14-6.1-lts Changes in 6.1.35 x86/head/64: Switch to KERNEL_CS as soon as new GDT is installed test_firmware: Use kstrtobool() instead of strtobool() test_firmware: prevent race conditions by a correct implementation of locking cgroup: bpf: use cgroup_lock()/cgroup_unlock() wrappers cgroup: always put cset in cgroup_css_set_put_fork cgroup: fix missing cpus_read_{lock,unlock}() in cgroup_transfer_tasks() qcom: llcc/edac: Fix the base address used for accessing LLCC banks EDAC/qcom: Get rid of hardcoded register offsets ksmbd: validate smb request protocol id of: overlay: Fix missing of_node_put() in error case of init_overlay_changeset() power: supply: ab8500: Fix external_power_changed race power: supply: sc27xx: Fix external_power_changed race power: supply: bq27xxx: Use mod_delayed_work() instead of cancel() + schedule() ARM: dts: vexpress: add missing cache properties tools: gpio: fix debounce_period_us output of lsgpio selftests: gpio: gpio-sim: Fix BUG: test FAILED due to recent change power: supply: Ratelimit no data debug output PCI/DPC: Quirk PIO log size for Intel Ice Lake Root Ports platform/x86: asus-wmi: Ignore WMI events with codes 0x7B, 0xC0 regulator: Fix error checking for debugfs_create_dir irqchip/gic-v3: Disable pseudo NMIs on Mediatek devices w/ firmware issues irqchip/meson-gpio: Mark OF related data as maybe unused power: supply: Fix logic checking if system is running from battery drm: panel-orientation-quirks: Change Air's quirk to support Air Plus btrfs: scrub: try harder to mark RAID56 block groups read-only btrfs: handle memory allocation failure in btrfs_csum_one_bio ASoC: soc-pcm: test if a BE can be prepared ASoC: Intel: avs: Account for UID of ACPI device ASoC: Intel: avs: Add missing checks on FE startup parisc: Improve cache flushing for PCXL in arch_sync_dma_for_cpu() parisc: Flush gatt writes and adjust gatt mask in parisc_agp_mask_memory() MIPS: unhide PATA_PLATFORM MIPS: Restore Au1300 support MIPS: Alchemy: fix dbdma2 mips: Move initrd_start check after initrd address sanitisation. ASoC: cs35l41: Fix default regmap values for some registers ASoC: dwc: move DMA init to snd_soc_dai_driver probe() xen/blkfront: Only check REQ_FUA for writes drm:amd:amdgpu: Fix missing buffer object unlock in failure path io_uring: unlock sqd->lock before sq thread release CPU NVMe: Add MAXIO 1602 to bogus nid list. irqchip/gic: Correctly validate OF quirk descriptors wifi: cfg80211: fix locking in regulatory disconnect wifi: cfg80211: fix double lock bug in reg_wdev_chan_valid() epoll: ep_autoremove_wake_function should use list_del_init_careful ocfs2: fix use-after-free when unmounting read-only filesystem ocfs2: check new file size on fallocate call zswap: do not shrink if cgroup may not zswap nios2: dts: Fix tse_mac "max-frame-size" property nilfs2: fix incomplete buffer cleanup in nilfs_btnode_abort_change_key() nilfs2: fix possible out-of-bounds segment allocation in resize ioctl nilfs2: reject devices with insufficient block count LoongArch: Fix perf event id calculation io_uring/net: save msghdr->msg_control for retries kexec: support purgatories with .text.hot sections x86/purgatory: remove PGO flags riscv/purgatory: remove PGO flags powerpc/purgatory: remove PGO flags btrfs: do not ASSERT() on duplicated global roots btrfs: fix iomap_begin length for nocow writes btrfs: can_nocow_file_extent should pass down args->strict from callers ALSA: usb-audio: Fix broken resume due to UAC3 power state ALSA: usb-audio: Add quirk flag for HEM devices to enable native DSD playback dm thin metadata: check fail_io before using data_sm dm thin: fix issue_discard to pass GFP_NOIO to __blkdev_issue_discard net: ethernet: stmicro: stmmac: fix possible memory leak in __stmmac_open nouveau: fix client work fence deletion race RDMA/uverbs: Restrict usage of privileged QKEYs drm/amdgpu: vcn_4_0 set instance 0 init sched score to 1 net: usb: qmi_wwan: add support for Compal RXM-G1 drm/amd/display: edp do not add non-edid timings drm/amd: Make sure image is written to trigger VBIOS image update flow drm/amd: Tighten permissions on VBIOS flashing attributes drm/amd/pm: workaround for compute workload type on some skus drm/amdgpu: add missing radeon secondary PCI ID ALSA: hda/realtek: Add a quirk for Compaq N14JP6 thunderbolt: Do not touch CL state configuration during discovery thunderbolt: dma_test: Use correct value for absent rings when creating paths thunderbolt: Mask ring interrupt on Intel hardware as well clk: pxa: fix NULL pointer dereference in pxa3xx_clk_update_accr USB: serial: option: add Quectel EM061KGL series serial: lantiq: add missing interrupt ack usb: typec: ucsi: Fix command cancellation usb: typec: Fix fast_role_swap_current show function usb: gadget: udc: core: Offload usb_udc_vbus_handler processing usb: gadget: udc: core: Prevent soft_connect_store() race USB: dwc3: qcom: fix NULL-deref on suspend USB: dwc3: fix use-after-free on core driver unbind usb: dwc3: gadget: Reset num TRBs before giving back the request RDMA/rtrs: Fix the last iu->buf leak in err path RDMA/rtrs: Fix rxe_dealloc_pd warning RDMA/rxe: Fix packet length checks RDMA/rxe: Fix ref count error in check_rkey() spi: cadence-quadspi: Add missing check for dma_set_mask spi: fsl-dspi: avoid SCK glitches with continuous transfers netfilter: nf_tables: integrate pipapo into commit protocol netfilter: nfnetlink: skip error delivery on batch in case of ENOMEM ice: Fix XDP memory leak when NIC is brought up and down netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE net: enetc: correct the indexes of highest and 2nd highest TCs ping6: Fix send to link-local addresses with VRF. igb: Fix extts capture value format for 82580/i354/i350 net/sched: simplify tcf_pedit_act net/sched: act_pedit: remove extra check for key type net/sched: act_pedit: Parse L3 Header for L4 offset octeontx2-af: Fix promiscuous mode net/sched: cls_u32: Fix reference counter leak leading to overflow wifi: mac80211: fix link activation settings order wifi: cfg80211: fix link del callback to call correct handler wifi: mac80211: take lock before setting vif links RDMA/rxe: Removed unused name from rxe_task struct RDMA/rxe: Fix the use-before-initialization error of resp_pkts iavf: remove mask from iavf_irq_enable_queues() octeontx2-af: fixed resource availability check octeontx2-af: fix lbk link credits on cn10k RDMA/mlx5: Initiate dropless RQ for RAW Ethernet functions RDMA/mlx5: Create an indirect flow table for steering anchor RDMA/cma: Always set static rate to 0 for RoCE IB/uverbs: Fix to consider event queue closing also upon non-blocking mode RDMA/mlx5: Fix affinity assignment IB/isert: Fix dead lock in ib_isert IB/isert: Fix possible list corruption in CMA handler IB/isert: Fix incorrect release of isert connection net: ethtool: correct MAX attribute value for stats ipvlan: fix bound dev checking for IPv6 l3s mode sctp: fix an error code in sctp_sf_eat_auth() igc: Clean the TX buffer and TX descriptor ring igc: Fix possible system crash when loading module igb: fix nvm.ops.read() error handling net: phylink: report correct max speed for QUSGMII net: phylink: use a dedicated helper to parse usgmii control word drm/nouveau: don't detect DSM for non-NVIDIA device drm/bridge: ti-sn65dsi86: Avoid possible buffer overflow drm/nouveau/dp: check for NULL nv_connector->native_mode drm/nouveau: add nv_encoder pointer check for NULL selftests/tc-testing: Fix Error: Specified qdisc kind is unknown. selftests/tc-testing: Fix Error: failed to find target LOG selftests/tc-testing: Fix SFB db test sched: add new attr TCA_EXT_WARN_MSG to report tc extact message net/sched: Refactor qdisc_graft() for ingress and clsact Qdiscs net/sched: qdisc_destroy() old ingress and clsact Qdiscs before grafting selftests: forwarding: hw_stats_l3: Set addrgenmode in a separate step cifs: fix lease break oops in xfstest generic/098 ext4: drop the call to ext4_error() from ext4_get_group_info() net/sched: cls_api: Fix lockup on flushing explicitly created chain net: dsa: felix: fix taprio guard band overflow at 10Mbps with jumbo frames net: lapbether: only support ethernet devices net: macsec: fix double free of percpu stats sfc: fix XDP queues mode with legacy IRQ dm: don't lock fs when the map is NULL during suspend or resume net: tipc: resize nlattr array to correct size selftests/ptp: Fix timestamp printf format for PTP_SYS_OFFSET octeon_ep: Add missing check for ioremap afs: Fix vlserver probe RTT handling parisc: Delete redundant register definitions in <asm/assembly.h> rcu/kvfree: Avoid freeing new kfree_rcu() memory after old grace period drm/amdgpu: Don't set struct drm_driver.output_poll_changed net/sched: act_api: move TCA_EXT_WARN_MSG to the correct hierarchy Revert "net/sched: act_api: move TCA_EXT_WARN_MSG to the correct hierarchy" net/sched: act_api: add specific EXT_WARN_MSG for tc action neighbour: delete neigh_lookup_nodev as not used scsi: target: core: Fix error path in target_setup_session() x86/boot/compressed: prefer cc-option for CFLAGS additions MIPS: Move '-Wa,-msoft-float' check from as-option to cc-option MIPS: Prefer cc-option for additions to cflags kbuild: Update assembler calls to use proper flags and language target Linux 6.1.35 Change-Id: Ib27a87c9bcf16c70a0f4dd567551c2ae44702a4b Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-06-21 18:23:46 +00:00
Bob Pearson	bdd22f2aa1	scsi: target: core: Fix error path in target_setup_session() ... commit 91271699228bfc66f1bc8abc0327169dc156d854 upstream. In the error exits in target_setup_session(), if a branch is taken to free_sess: transport_free_session() may call to target_free_cmd_counter() and then fall through to call target_free_cmd_counter() a second time. This can, and does, sometimes cause seg faults since the data field in cmd_cnt->refcnt has been freed in the first call. Fix this problem by simply returning after the call to transport_free_session(). The second call is redundant for those cases. Fixes: 4edba7e4a8f3 ("scsi: target: Move cmd counter allocation") Signed-off-by: Bob Pearson <rpearsonhpe@gmail.com> Link: https://lore.kernel.org/r/20230613144259.12890-1-rpearsonhpe@gmail.com Reviewed-by: Mike Christie <michael.christie@oracle.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-06-21 16:01:03 +02:00
Greg Kroah-Hartman	26c1cc6858	This is the 6.1.30 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmRuPHsACgkQONu9yGCS aT6USxAAx2uklTRE3mmIS9qytOjb8Z3gsA8LVaaQ3f25CWNiuverNj0mFyNtI9KX 84ZBS/G8aHA6z0dtdyMupHznHehQp7pVo0LOeVMz2bR+CjkpRQei2NimG8bGRcFK W6c40w99lD9dYpaal3yajs+k+LF3BktmBNc0SynCjjyEy4YA5RbWOhtGX6P4VRqs sPXcmmAHsqDPLfqsgsHiBNsiw+dCP7jY1a17rTxz1g49/4zS6BEGtxxpU4UZNbph rKrX0sgF8UM15IfdFc0CiOXhAcL7QQfUbucJ/94180gclF4j6QqAMueAr6mLWkFd Pj7vLn/KD2wA2dzTBekHZ9SYp31xcXomkzfdLoMMnazfy3RL4sO7WhJks0k0T2En 3LIlsRZx/C2ztf3SLq2z2Bw/ExaefrydLI9cWJBi7CQ5yUVO15edcv40W4pxoMOL xFDZhCksC+JNc74HPYKTmg+SJQsxtYeLrwb6zW43aJByY+rls70crfhdS5fORvmH G8qDS2PCNAqpulxyxQtYxiIcRiM4SqPskves+3nu7gBFGfsv2AJU1gNCorIpZuW8 DS2jrMwPv7gH+eUvqrnrtdA+Vk4TYWslg0mPlVNavX98i9/dC9Vjss3yXCYh7Q6u 0+BpSBLtKM4pahaMgKpYv/V/r+GKvIt7Npki8o/bs1nuykF04aw= =hAQM -----END PGP SIGNATURE----- Merge 6.1.30 into android14-6.1-lts Changes in 6.1.30 drm/fbdev-generic: prohibit potential out-of-bounds access drm/mipi-dsi: Set the fwnode for mipi_dsi_device ARM: 9296/1: HP Jornada 7XX: fix kernel-doc warnings net: skb_partial_csum_set() fix against transport header magic value net: mdio: mvusb: Fix an error handling path in mvusb_mdio_probe() scsi: ufs: core: Fix I/O hang that occurs when BKOPS fails in W-LUN suspend tick/broadcast: Make broadcast device replacement work correctly linux/dim: Do nothing if no time delta between samples net: stmmac: Initialize MAC_ONEUS_TIC_COUNTER register net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs(). net: phy: bcm7xx: Correct read from expansion register netfilter: nf_tables: always release netdev hooks from notifier netfilter: conntrack: fix possible bug_on with enable_hooks=1 bonding: fix send_peer_notif overflow netlink: annotate accesses to nlk->cb_running net: annotate sk->sk_err write from do_recvmmsg() net: deal with most data-races in sk_wait_event() net: add vlan_get_protocol_and_depth() helper tcp: add annotations around sk->sk_shutdown accesses gve: Remove the code of clearing PBA bit ipvlan:Fix out-of-bounds caused by unclear skb->cb net: mscc: ocelot: fix stat counter register values net: datagram: fix data-races in datagram_poll() af_unix: Fix a data race of sk->sk_receive_queue->qlen. af_unix: Fix data races around sk->sk_shutdown. drm/i915/guc: Don't capture Gen8 regs on Xe devices drm/i915: Fix NULL ptr deref by checking new_crtc_state drm/i915/dp: prevent potential div-by-zero drm/i915: Expand force_probe to block probe of devices as well. drm/i915: taint kernel when force probing unsupported devices fbdev: arcfb: Fix error handling in arcfb_probe() ext4: reflect error codes from ext4_multi_mount_protect() to its callers ext4: don't clear SB_RDONLY when remounting r/w until quota is re-enabled ext4: allow to find by goal if EXT4_MB_HINT_GOAL_ONLY is set ext4: allow ext4_get_group_info() to fail refscale: Move shutdown from wait_event() to wait_event_idle() selftests: cgroup: Add 'malloc' failures checks in test_memcontrol rcu: Protect rcu_print_task_exp_stall() ->exp_tasks access open: return EINVAL for O_DIRECTORY | O_CREAT fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode() drm/displayid: add displayid_get_header() and check bounds better drm/amd/display: populate subvp cmd info only for the top pipe drm/amd/display: Correct DML calculation to align HW formula platform/x86: x86-android-tablets: Add Acer Iconia One 7 B1-750 data drm/amd/display: Enable HostVM based on rIOMMU active drm/amd/display: Use DC_LOG_DC in the trasform pixel function regmap: cache: Return error in cache sync operations for REGCACHE_NONE remoteproc: imx_dsp_rproc: Add custom memory copy implementation for i.MX DSP Cores arm64: dts: qcom: msm8996: Add missing DWC3 quirks media: cx23885: Fix a null-ptr-deref bug in buffer_prepare() and buffer_finish() media: pci: tw68: Fix null-ptr-deref bug in buf prepare and finish media: pvrusb2: VIDEO_PVRUSB2 depends on DVB_CORE to use dvb_* symbols ACPI: processor: Check for null return of devm_kzalloc() in fch_misc_setup() drm/rockchip: dw_hdmi: cleanup drm encoder during unbind memstick: r592: Fix UAF bug in r592_remove due to race condition arm64: dts: imx8mq-librem5: Remove dis_u3_susphy_quirk from usb_dwc3_0 firmware: arm_sdei: Fix sleep from invalid context BUG ACPI: EC: Fix oops when removing custom query handlers drm/amd/display: fixed dcn30+ underflow issue remoteproc: stm32_rproc: Add mutex protection for workqueue drm/tegra: Avoid potential 32-bit integer overflow drm/msm/dp: Clean up handling of DP AUX interrupts ACPICA: Avoid undefined behavior: applying zero offset to null pointer ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in acpi_db_display_objects arm64: dts: qcom: sdm845-polaris: Drop inexistent properties irqchip/gicv3: Workaround for NVIDIA erratum T241-FABRIC-4 ACPI: video: Remove desktops without backlight DMI quirks drm/amd/display: Correct DML calculation to follow HW SPEC drm/amd: Fix an out of bounds error in BIOS parser drm/amdgpu: Fix sdma v4 sw fini error media: Prefer designated initializers over memset for subdev pad ops media: mediatek: vcodec: Fix potential array out-of-bounds in decoder queue_setup wifi: ath: Silence memcpy run-time false positive warning bpf: Annotate data races in bpf_local_storage wifi: brcmfmac: pcie: Provide a buffer of random bytes to the device wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex ext2: Check block size validity during mount scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow scsi: lpfc: Correct used_rpi count when devloss tmo fires with no recovery bnxt: avoid overflow in bnxt_get_nvram_directory() net: pasemi: Fix return type of pasemi_mac_start_tx() net: Catch invalid index in XPS mapping netdev: Enforce index cap in netdev_get_tx_queue scsi: target: iscsit: Free cmds before session free lib: cpu_rmap: Avoid use after free on rmap->obj array entries scsi: message: mptlan: Fix use after free bug in mptlan_remove() due to race condition gfs2: Fix inode height consistency check scsi: ufs: ufs-pci: Add support for Intel Lunar Lake ext4: set goal start correctly in ext4_mb_normalize_request ext4: Fix best extent lstart adjustment logic in ext4_mb_new_inode_pa() crypto: jitter - permanent and intermittent health errors f2fs: Fix system crash due to lack of free space in LFS f2fs: fix to drop all dirty pages during umount() if cp_error is set f2fs: fix to check readonly condition correctly samples/bpf: Fix fout leak in hbm's run_bpf_prog bpf: Add preempt_count_{sub,add} into btf id deny list md: fix soft lockup in status_resync wifi: iwlwifi: pcie: fix possible NULL pointer dereference wifi: iwlwifi: add a new PCI device ID for BZ device wifi: iwlwifi: pcie: Fix integer overflow in iwl_write_to_user_buf wifi: iwlwifi: mvm: fix ptk_pn memory leak block, bfq: Fix division by zero error on zero wsum wifi: ath11k: Ignore frags from uninitialized peer in dp. wifi: iwlwifi: fix iwl_mvm_max_amsdu_size() for MLO null_blk: Always check queue mode setting from configfs wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace wifi: ath11k: Fix SKB corruption in REO destination ring nbd: fix incomplete validation of ioctl arg ipvs: Update width of source for ip_vs_sync_conn_options Bluetooth: btusb: Add new PID/VID 04ca:3801 for MT7663 Bluetooth: Add new quirk for broken local ext features page 2 Bluetooth: btrtl: add support for the RTL8723CS Bluetooth: Improve support for Actions Semi ATS2851 based devices Bluetooth: btrtl: check for NULL in btrtl_set_quirks() Bluetooth: btintel: Add LE States quirk support Bluetooth: hci_bcm: Fall back to getting bdaddr from EFI if not set Bluetooth: Add new quirk for broken set random RPA timeout for ATS2851 Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp Bluetooth: btrtl: Add the support for RTL8851B staging: rtl8192e: Replace macro RTL_PCI_DEVICE with PCI_DEVICE HID: apple: Set the tilde quirk flag on the Geyser 4 and later staging: axis-fifo: initialize timeouts in init only ASoC: amd: yc: Add DMI entries to support HP OMEN 16-n0xxx (8A42) HID: logitech-hidpp: Don't use the USB serial for USB devices HID: logitech-hidpp: Reconcile USB and Unifying serials spi: spi-imx: fix MX51_ECSPI_* macros when cs > 3 usb: typec: ucsi: acpi: add quirk for ASUS Zenbook UM325 ALSA: hda: LNL: add HD Audio PCI ID ASoC: amd: Add Dell G15 5525 to quirks list ASoC: amd: yc: Add ThinkBook 14 G5+ ARP to quirks list for acp6x HID: apple: Set the tilde quirk flag on the Geyser 3 HID: Ignore battery for ELAN touchscreen on ROG Flow X13 GV301RA HID: wacom: generic: Set battery quirk only when we see battery data usb: typec: tcpm: fix multiple times discover svids error serial: 8250: Reinit port->pm on port specific driver unbind mcb-pci: Reallocate memory region to avoid memory overlapping sched: Fix KCSAN noinstr violation lkdtm/stackleak: Fix noinstr violation recordmcount: Fix memory leaks in the uwrite function soundwire: dmi-quirks: add remapping for Intel 'Rooks County' NUC M15 phy: st: miphy28lp: use _poll_timeout functions for waits soundwire: qcom: gracefully handle too many ports in DT soundwire: bus: Fix unbalanced pm_runtime_put() causing usage count underflow mfd: intel_soc_pmic_chtwc: Add Lenovo Yoga Book X90F to intel_cht_wc_models mfd: dln2: Fix memory leak in dln2_probe() mfd: intel-lpss: Add Intel Meteor Lake PCH-S LPSS PCI IDs parisc: Replace regular spinlock with spin_trylock on panic path platform/x86: Move existing HP drivers to a new hp subdir platform/x86: hp-wmi: add micmute to hp_wmi_keymap struct drm/amdgpu: drop gfx_v11_0_cp_ecc_error_irq_funcs xfrm: don't check the default policy if the policy allows the packet Revert "Fix XFRM-I support for nested ESP tunnels" drm/msm/dp: unregister audio driver during unbind drm/msm/dpu: Assign missing writeback log_mask drm/msm/dpu: Move non-MDP_TOP INTF_INTR offsets out of hwio header drm/msm/dpu: Remove duplicate register defines from INTF dt-bindings: display/msm: dsi-controller-main: Document qcom, master-dsi and qcom, sync-dual-dsi platform: Provide a remove callback that returns no value ASoC: fsl_micfil: Fix error handler with pm_runtime_enable cpupower: Make TSC read per CPU for Mperf monitor xfrm: Reject optional tunnel/BEET mode templates in outbound policies af_key: Reject optional tunnel/BEET mode templates in outbound policies drm/msm: Fix submit error-path leaks selftests: seg6: disable DAD on IPv6 router cfg for srv6_end_dt4_l3vpn_test selftets: seg6: disable rp_filter by default in srv6_end_dt4_l3vpn_test net: fec: Better handle pm_runtime_get() failing in .remove() net: phy: dp83867: add w/a for packet errors seen with short cables ALSA: firewire-digi00x: prevent potential use after free wifi: mt76: connac: fix stats->tx_bytes calculation ALSA: hda/realtek: Apply HP B&O top speaker profile to Pavilion 15 sfc: disable RXFCS and RXALL features by default vsock: avoid to close connected socket after the timeout tcp: fix possible sk_priority leak in tcp_v4_send_reset() serial: arc_uart: fix of_iomap leak in `arc_serial_probe` serial: 8250_bcm7271: balance clk_enable calls serial: 8250_bcm7271: fix leak in `brcmuart_probe` erspan: get the proto with the md version for collect_md net: dsa: rzn1-a5psw: enable management frames for CPU port net: dsa: rzn1-a5psw: fix STP states handling net: dsa: rzn1-a5psw: disable learning for standalone ports net: hns3: fix output information incomplete for dumping tx queue info with debugfs net: hns3: fix sending pfc frames after reset issue net: hns3: fix reset delay time to avoid configuration timeout net: hns3: fix reset timeout when enable full VF media: netup_unidvb: fix use-after-free at del_timer() SUNRPC: double free xprt_ctxt while still in use SUNRPC: always free ctxt when freeing deferred request SUNRPC: Fix trace_svc_register() call site ASoC: mediatek: mt8186: Fix use-after-free in driver remove path ASoC: SOF: topology: Fix logic for copying tuples drm/exynos: fix g2d_open/close helper function definitions net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() virtio-net: Maintain reverse cleanup order virtio_net: Fix error unwinding of XDP initialization tipc: add tipc_bearer_min_mtu to calculate min mtu tipc: do not update mtu if msg_max is too small in mtu negotiation tipc: check the bearer min mtu properly when setting it by netlink s390/cio: include subchannels without devices also for evaluation can: dev: fix missing CAN XL support in can_put_echo_skb() net: bcmgenet: Remove phy_stop() from bcmgenet_netif_stop() net: bcmgenet: Restore phy_stop() depending upon suspend/close ice: introduce clear_reset_state operation ice: Fix ice VF reset during iavf initialization wifi: cfg80211: Drop entries with invalid BSSIDs in RNR wifi: mac80211: fortify the spinlock against deadlock by interrupt wifi: mac80211: fix min center freq offset tracing wifi: mac80211: Abort running color change when stopping the AP wifi: iwlwifi: mvm: fix cancel_delayed_work_sync() deadlock wifi: iwlwifi: fw: fix DBGI dump wifi: iwlwifi: fix OEM's name in the ppag approved list wifi: iwlwifi: mvm: fix OEM's name in the tas approved list wifi: iwlwifi: mvm: don't trust firmware n_channels scsi: storvsc: Don't pass unused PFNs to Hyper-V host net: tun: rebuild error handling in tun_get_user tun: Fix memory leak for detached NAPI queue. cassini: Fix a memory leak in the error handling path of cas_init_one() net: dsa: mv88e6xxx: Fix mv88e6393x EPC write command offset igb: fix bit_shift to be in [1..8] range vlan: fix a potential uninit-value in vlan_dev_hard_start_xmit() net: wwan: iosm: fix NULL pointer dereference when removing device net: pcs: xpcs: fix C73 AN not getting enabled net: selftests: Fix optstring netfilter: nf_tables: fix nft_trans type confusion netfilter: nft_set_rbtree: fix null deref on element insertion bridge: always declare tunnel functions ALSA: usb-audio: Add a sample rate workaround for Line6 Pod Go USB: usbtmc: Fix direction for 0-length ioctl control messages usb-storage: fix deadlock when a scsi command timeouts more than once USB: UHCI: adjust zhaoxin UHCI controllers OverCurrent bit value usb: dwc3: gadget: Improve dwc3_gadget_suspend() and dwc3_gadget_resume() usb: dwc3: debugfs: Resume dwc3 before accessing registers usb: gadget: u_ether: Fix host MAC address case usb: typec: altmodes/displayport: fix pin_assignment_show Revert "usb: gadget: udc: core: Prevent redundant calls to pullup" Revert "usb: gadget: udc: core: Invoke usb_gadget_connect only when started" xhci-pci: Only run d3cold avoidance quirk for s2idle xhci: Fix incorrect tracking of free space on transfer rings ALSA: hda: Fix Oops by 9.1 surround channel names ALSA: hda: Add NVIDIA codec IDs a3 through a7 to patch table ALSA: hda/realtek: Add quirk for Clevo L140AU ALSA: hda/realtek: Add a quirk for HP EliteDesk 805 ALSA: hda/realtek: Add quirk for 2nd ASUS GU603 ALSA: hda/realtek: Add quirk for HP EliteBook G10 laptops ALSA: hda/realtek: Fix mute and micmute LEDs for yet another HP laptop can: j1939: recvmsg(): allow MSG_CMSG_COMPAT flag can: isotp: recvmsg(): allow MSG_CMSG_COMPAT flag can: kvaser_pciefd: Set CAN_STATE_STOPPED in kvaser_pciefd_stop() can: kvaser_pciefd: Call request_irq() before enabling interrupts can: kvaser_pciefd: Empty SRB buffer in probe can: kvaser_pciefd: Clear listen-only bit if not explicitly requested can: kvaser_pciefd: Do not send EFLUSH command on TFD interrupt can: kvaser_pciefd: Disable interrupts in probe error path wifi: rtw88: use work to update rate to avoid RCU warning SMB3: Close all deferred handles of inode in case of handle lease break SMB3: drop reference to cfile before sending oplock break ksmbd: smb2: Allow messages padded to 8byte boundary ksmbd: allocate one more byte for implied bcc[0] ksmbd: fix wrong UserName check in session_user ksmbd: fix global-out-of-bounds in smb2_find_context_vals KVM: Fix vcpu_array[0] races statfs: enforce statfs[64] structure initialization maple_tree: make maple state reusable after mas_empty_area() mm: fix zswap writeback race condition serial: Add support for Advantech PCI-1611U card serial: 8250_exar: Add support for USR298x PCI Modems serial: qcom-geni: fix enabling deactivated interrupt thunderbolt: Clear registers properly when auto clear isn't in use vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF ceph: force updating the msg pointer in non-split case drm/amd/pm: fix possible power mode mismatch between driver and PMFW drm/amdgpu/gmc11: implement get_vbios_fb_size() drm/amdgpu/gfx10: Disable gfxoff before disabling powergating. drm/amdgpu/gfx11: Adjust gfxoff before powergating on gfx11 as well drm/amdgpu: refine get gpu clock counter method drm/amdgpu/gfx11: update gpu_clock_counter logic dt-bindings: ata: ahci-ceva: Cover all 4 iommus entries powerpc/iommu: DMA address offset is incorrectly calculated with 2MB TCEs powerpc/iommu: Incorrect DDW Table is referenced for SR-IOV device tpm/tpm_tis: Disable interrupts for more Lenovo devices powerpc/64s/radix: Fix soft dirty tracking nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode() s390/dasd: fix command reject error on ESE devices s390/crypto: use vector instructions only if available for ChaCha20 s390/qdio: fix do_sqbs() inline assembly constraint arm64: mte: Do not set PG_mte_tagged if tags were not initialized rethook: use preempt_{disable, enable}_notrace in rethook_trampoline_handler rethook, fprobe: do not trace rethook related functions remoteproc: imx_dsp_rproc: Fix kernel test robot sparse warning crypto: testmgr - fix RNG performance in fuzz tests drm/amdgpu: declare firmware for new MES 11.0.4 drm/amd/amdgpu: introduce gc_*_mes_2.bin v2 drm/amdgpu: reserve the old gc_11_0_*_mes.bin Linux 6.1.30 Change-Id: I411885affcf017410aab34bf3fba2dde96df6593 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-06-12 20:48:03 +00:00
Greg Kroah-Hartman	ef75a88787	Merge 6.1.28 into android14-6.1-lts ... Changes in 6.1.28 ASOC: Intel: sof_sdw: add quirk for Intel 'Rooks County' NUC M15 ASoC: Intel: soc-acpi: add table for Intel 'Rooks County' NUC M15 ASoC: soc-pcm: fix hw->formats cleared by soc_pcm_hw_init() for dpcm x86/hyperv: Block root partition functionality in a Confidential VM ASoC: amd: yc: Add DMI entries to support Victus by HP Laptop 16-e1xxx (8A22) iio: adc: palmas_gpadc: fix NULL dereference on rmmod ASoC: Intel: bytcr_rt5640: Add quirk for the Acer Iconia One 7 B1-750 ASoC: da7213.c: add missing pm_runtime_disable() net: wwan: t7xx: do not compile with -Werror selftests mount: Fix mount_setattr_test builds failed scsi: mpi3mr: Handle soft reset in progress fault code (0xF002) net: sfp: add quirk enabling 2500Base-x for HG MXPD-483II platform/x86: thinkpad_acpi: Add missing T14s Gen1 type to s2idle quirk list wifi: ath11k: reduce the MHI timeout to 20s tracing: Error if a trace event has an array for a __field() asm-generic/io.h: suppress endianness warnings for readq() and writeq() x86/cpu: Add model number for Intel Arrow Lake processor wireguard: timers: cast enum limits members to int in prints wifi: mt76: mt7921e: Set memory space enable in PCI_COMMAND if unset ASoC: amd: fix ACP version typo mistake ASoC: amd: ps: update the acp clock source. arm64: Always load shadow stack pointer directly from the task struct arm64: Stash shadow stack pointer in the task struct on interrupt powerpc/boot: Fix boot wrapper code generation with CONFIG_POWER10_CPU PCI: kirin: Select REGMAP_MMIO PCI: pciehp: Fix AB-BA deadlock between reset_lock and device_lock PCI: qcom: Fix the incorrect register usage in v2.7.0 config phy: qcom-qmp-pcie: sc8180x PCIe PHY has 2 lanes IMA: allow/fix UML builds usb: gadget: udc: core: Invoke usb_gadget_connect only when started usb: gadget: udc: core: Prevent redundant calls to pullup usb: dwc3: gadget: Stall and restart EP0 if host is unresponsive USB: dwc3: fix runtime pm imbalance on probe errors USB: dwc3: fix runtime pm imbalance on unbind hwmon: (k10temp) Check range scale when CUR_TEMP register is read-write hwmon: (adt7475) Use device_property APIs when configuring polarity tpm: Add !tpm_amd_is_rng_defective() to the hwrng_unregister() call site posix-cpu-timers: Implement the missing timer_wait_running callback media: ov8856: Do not check for for module version blk-stat: fix QUEUE_FLAG_STATS clear blk-crypto: don't use struct request_queue for public interfaces blk-crypto: add a blk_crypto_config_supported_natively helper blk-crypto: move internal only declarations to blk-crypto-internal.h blk-crypto: Add a missing include directive blk-mq: release crypto keyslot before reporting I/O complete blk-crypto: make blk_crypto_evict_key() return void blk-crypto: make blk_crypto_evict_key() more robust staging: iio: resolver: ads1210: fix config mode tty: Prevent writing chars during tcsetattr TCSADRAIN/FLUSH xhci: fix debugfs register accesses while suspended serial: fix TIOCSRS485 locking serial: 8250: Fix serial8250_tx_empty() race with DMA Tx serial: max310x: fix IO data corruption in batched operations tick/nohz: Fix cpu_is_hotpluggable() by checking with nohz subsystem fs: fix sysctls.c built MIPS: fw: Allow firmware to pass a empty env ipmi:ssif: Add send_retries increment ipmi: fix SSIF not responding under certain cond. iio: addac: stx104: Fix race condition when converting analog-to-digital iio: addac: stx104: Fix race condition for stx104_write_raw() kheaders: Use array declaration instead of char wifi: mt76: add missing locking to protect against concurrent rx/status calls pwm: meson: Fix axg ao mux parents pwm: meson: Fix g12a ao clk81 name soundwire: qcom: correct setting ignore bit on v1.5.1 pinctrl: qcom: lpass-lpi: set output value before enabling output ring-buffer: Ensure proper resetting of atomic variables in ring_buffer_reset_online_cpus ring-buffer: Sync IRQ works before buffer destruction crypto: api - Demote BUG_ON() in crypto_unregister_alg() to a WARN_ON() crypto: safexcel - Cleanup ring IRQ workqueues on load failure crypto: arm64/aes-neonbs - fix crash with CFI enabled crypto: ccp - Don't initialize CCP for PSP 0x1649 rcu: Avoid stack overflow due to __rcu_irq_enter_check_tick() being kprobe-ed reiserfs: Add security prefix to xattr name in reiserfs_security_write() KVM: nVMX: Emulate NOPs in L2, and PAUSE if it's not intercepted KVM: arm64: Avoid vcpu->mutex v. kvm->lock inversion in CPU_ON KVM: arm64: Avoid lock inversion when setting the VM register width KVM: arm64: Use config_lock to protect data ordered against KVM_RUN KVM: arm64: Use config_lock to protect vgic state KVM: arm64: vgic: Don't acquire its_lock before config_lock relayfs: fix out-of-bounds access in relay_file_read drm/amd/display: Remove stutter only configurations drm/amd/display: limit timing for single dimm memory drm/amd/display: fix PSR-SU/DSC interoperability support drm/amd/display: fix a divided-by-zero error KVM: RISC-V: Retry fault if vma_lookup() results become invalid ksmbd: fix racy issue under cocurrent smb2 tree disconnect ksmbd: call rcu_barrier() in ksmbd_server_exit() ksmbd: fix NULL pointer dereference in smb2_get_info_filesystem() ksmbd: fix memleak in session setup ksmbd: not allow guest user on multichannel ksmbd: fix deadlock in ksmbd_find_crypto_ctx() ACPI: video: Remove acpi_backlight=video quirk for Lenovo ThinkPad W530 i2c: omap: Fix standard mode false ACK readings riscv: mm: remove redundant parameter of create_fdt_early_page_table tracing: Fix permissions for the buffer_percent file swsmu/amdgpu_smu: Fix the wrong if-condition drm/amd/pm: re-enable the gfx imu when smu resume iommu/amd: Fix "Guest Virtual APIC Table Root Pointer" configuration in IRTE RISC-V: Align SBI probe implementation with spec Revert "ubifs: dirty_cow_znode: Fix memleak in error handling path" ubifs: Fix memleak when insert_old_idx() failed ubi: Fix return value overwrite issue in try_write_vid_and_data() ubifs: Free memory for tmpfile name ubifs: Fix memory leak in do_rename ceph: fix potential use-after-free bug when trimming caps xfs: don't consider future format versions valid cxl/hdm: Fail upon detecting 0-sized decoders bus: mhi: host: Remove duplicate ee check for syserr bus: mhi: host: Use mhi_tryset_pm_state() for setting fw error state bus: mhi: host: Range check CHDBOFF and ERDBOFF ASoC: dt-bindings: qcom,lpass-rx-macro: correct minItems for clocks kunit: improve KTAP compliance of KUnit test output kunit: fix bug in the order of lines in debugfs logs rcu: Fix missing TICK_DEP_MASK_RCU_EXP dependency check selftests/resctrl: Return NULL if malloc_and_init_memory() did not alloc mem selftests/resctrl: Move ->setup() call outside of test specific branches selftests/resctrl: Allow ->setup() to return errors selftests/resctrl: Check for return value after write_schemata() selinux: fix Makefile dependencies of flask.h selinux: ensure av_permissions.h is built when needed tpm, tpm_tis: Do not skip reset of original interrupt vector tpm, tpm_tis: Claim locality before writing TPM_INT_ENABLE register tpm, tpm_tis: Disable interrupts if tpm_tis_probe_irq() failed tpm, tpm_tis: Claim locality before writing interrupt registers tpm, tpm: Implement usage counter for locality tpm, tpm_tis: Claim locality when interrupts are reenabled on resume erofs: stop parsing non-compact HEAD index if clusterofs is invalid erofs: initialize packed inode after root inode is assigned erofs: fix potential overflow calculating xattr_isize drm/rockchip: Drop unbalanced obj unref drm/i915/dg2: Drop one PCI ID drm/vgem: add missing mutex_destroy drm/probe-helper: Cancel previous job before starting new one drm/amdgpu: register a vga_switcheroo client for MacBooks with apple-gmux tools/x86/kcpuid: Fix avx512bw and avx512lvl fields in Fn00000007 soc: ti: pm33xx: Fix refcount leak in am33xx_pm_probe arm64: dts: renesas: r8a77990: Remove bogus voltages from OPP table arm64: dts: renesas: r8a774c0: Remove bogus voltages from OPP table arm64: dts: renesas: r9a07g044: Update IRQ numbers for SSI channels arm64: dts: renesas: r9a07g054: Update IRQ numbers for SSI channels arm64: dts: renesas: r9a07g043: Introduce SOC_PERIPHERAL_IRQ() macro to specify interrupt property arm64: dts: renesas: r9a07g043: Update IRQ numbers for SSI channels drm/mediatek: dp: Only trigger DRM HPD events if bridge is attached drm/msm/disp/dpu: check for crtc enable rather than crtc active to release shared resources EDAC/skx: Fix overflows on the DRAM row address mapping arrays ARM: dts: qcom-apq8064: Fix opp table child name regulator: core: Shorten off-on-delay-us for always-on/boot-on by time since booted arm64: dts: ti: k3-am62-main: Fix GPIO numbers in DT arm64: dts: ti: k3-am62a7-sk: Fix DDR size to full 4GB arm64: dts: ti: k3-j721e-main: Remove ti,strobe-sel property arm64: dts: broadcom: bcmbca: bcm4908: fix NAND interrupt name arm64: dts: broadcom: bcmbca: bcm4908: fix LED nodenames arm64: dts: broadcom: bcmbca: bcm4908: fix procmon nodename arm64: dts: qcom: msm8998: Fix stm-stimulus-base reg name arm64: dts: qcom: sc7280: fix EUD port properties arm64: dts: qcom: sdm845: correct dynamic power coefficients arm64: dts: qcom: sdm845: Fix the PCI I/O port range arm64: dts: qcom: msm8998: Fix the PCI I/O port range arm64: dts: qcom: sc7280: Fix the PCI I/O port range arm64: dts: qcom: ipq8074: Fix the PCI I/O port range arm64: dts: qcom: ipq6018: Fix the PCI I/O port range arm64: dts: qcom: msm8996: Fix the PCI I/O port range arm64: dts: qcom: sm8250: Fix the PCI I/O port range arm64: dts: qcom: sm8150: Fix the PCI I/O port range arm64: dts: qcom: sm8450: Fix the PCI I/O port range ARM: dts: qcom: ipq4019: Fix the PCI I/O port range ARM: dts: qcom: ipq8064: Fix the PCI I/O port range ARM: dts: qcom: sdx55: Fix the unit address of PCIe EP node x86/MCE/AMD: Use an u64 for bank_map media: bdisp: Add missing check for create_workqueue media: platform: mtk-mdp3: Add missing check and free for ida_alloc media: amphion: decoder implement display delay enable media: av7110: prevent underflow in write_ts_to_decoder() firmware: qcom_scm: Clear download bit during reboot drm/bridge: adv7533: Fix adv7533_mode_valid for adv7533 and adv7535 media: max9286: Free control handler arm64: dts: ti: k3-am625: Correct L2 cache size to 512KB arm64: dts: ti: k3-am62a7: Correct L2 cache size to 512KB drm/msm/adreno: drop bogus pm_runtime_set_active() drm: msm: adreno: Disable preemption on Adreno 510 virt/coco/sev-guest: Double-buffer messages arm64: dts: qcom: sm8350-microsoft-surface: fix USB dual-role mode property drm/amd/display/dc/dce60/Makefile: Fix previous attempt to silence known override-init warnings ACPI: processor: Fix evaluating _PDC method when running as Xen dom0 mmc: sdhci-of-esdhc: fix quirk to ignore command inhibit for data arm64: dts: qcom: sm8450: fix pcie1 gpios properties name drm: rcar-du: Fix a NULL vs IS_ERR() bug ARM: dts: gta04: fix excess dma channel usage firmware: arm_scmi: Fix xfers allocation on Rx channel perf/arm-cmn: Move overlapping wp_combine field ARM: dts: stm32: fix spi1 pin assignment on stm32mp15 arm64: dts: apple: t8103: Disable unused PCIe ports cpufreq: mediatek: fix passing zero to 'PTR_ERR' cpufreq: mediatek: fix KP caused by handler usage after regulator_put/clk_put cpufreq: mediatek: raise proc/sram max voltage for MT8516 cpufreq: mediatek: Raise proc and sram max voltage for MT7622/7623 cpufreq: qcom-cpufreq-hw: Revert adding cpufreq qos arm64: dts: mediatek: mt8192-asurada: Fix voltage constraint for Vgpu ACPI: VIOT: Initialize the correct IOMMU fwspec drm/lima/lima_drv: Add missing unwind goto in lima_pdev_probe() drm/mediatek: dp: Change the aux retries times when receiving AUX_DEFER mailbox: mpfs: switch to txdone_poll soc: bcm: brcmstb: biuctrl: fix of_iomap leak soc: renesas: renesas-soc: Release 'chipid' from ioremap() gpu: host1x: Fix potential double free if IOMMU is disabled gpu: host1x: Fix memory leak of device names arm64: dts: qcom: sc7280-herobrine-villager: correct trackpad supply arm64: dts: qcom: sc7180-trogdor-lazor: correct trackpad supply arm64: dts: qcom: sc7180-trogdor-pazquel: correct trackpad supply arm64: dts: qcom: msm8994-kitakami: drop unit address from PMI8994 regulator arm64: dts: qcom: msm8994-msft-lumia-octagon: drop unit address from PMI8994 regulator arm64: dts: qcom: apq8096-db820c: drop unit address from PMI8994 regulator drm/ttm: optimize pool allocations a bit v2 drm/ttm/pool: Fix ttm_pool_alloc error path regulator: core: Consistently set mutex_owner when using ww_mutex_lock_slow() regulator: core: Avoid lockdep reports when resolving supplies x86/apic: Fix atomic update of offset in reserve_eilvt_offset() arm64: dts: qcom: msm8994-angler: Fix cont_splash_mem mapping arm64: dts: qcom: msm8994-angler: removed clash with smem_region arm64: dts: sc7180: Rename qspi data12 as data23 arm64: dts: sc7280: Rename qspi data12 as data23 media: mediatek: vcodec: Use 4K frame size when supported by stateful decoder media: mediatek: vcodec: Make MM21 the default capture format media: mediatek: vcodec: Force capture queue format to MM21 media: mediatek: vcodec: add params to record lat and core lat_buf count media: mediatek: vcodec: using each instance lat_buf count replace core ready list media: mediatek: vcodec: move lat_buf to the top of core list media: mediatek: vcodec: add core decode done event media: mediatek: vcodec: remove unused lat_buf media: mediatek: vcodec: making sure queue_work successfully media: mediatek: vcodec: change lat thread decode error condition media: cedrus: fix use after free bug in cedrus_remove due to race condition media: rkvdec: fix use after free bug in rkvdec_remove platform/x86/amd/pmf: Move out of BIOS SMN pair for driver probe platform/x86/amd: pmc: Don't try to read SMU version on Picasso platform/x86/amd: pmc: Hide SMU version and program attributes for Picasso platform/x86/amd: pmc: Don't dump data after resume from s0i3 on picasso platform/x86/amd: pmc: Move idlemask check into `amd_pmc_idlemask_read` platform/x86/amd: pmc: Utilize SMN index 0 for driver probe platform/x86/amd: pmc: Move out of BIOS SMN pair for STB init media: dm1105: Fix use after free bug in dm1105_remove due to race condition media: saa7134: fix use after free bug in saa7134_finidev due to race condition media: platform: mtk-mdp3: fix potential frame size overflow in mdp_try_fmt_mplane() media: rcar_fdp1: Fix refcount leak in probe and remove function media: v4l: async: Return async sub-devices to subnotifier list media: hi846: Fix memleak in hi846_init_controls() drm/amd/display: Fix potential null dereference media: rc: gpio-ir-recv: Fix support for wake-up media: venus: dec: Fix handling of the start cmd media: venus: dec: Fix capture formats enumeration order regulator: stm32-pwr: fix of_iomap leak x86/ioapic: Don't return 0 from arch_dynirq_lower_bound() arm64: kgdb: Set PSTATE.SS to 1 to re-enable single-step perf/arm-cmn: Fix port detection for CMN-700 media: mediatek: vcodec: fix decoder disable pm crash media: mediatek: vcodec: add remove function for decoder platform driver debugobject: Prevent init race with static objects drm/i915: Make intel_get_crtc_new_encoder() less oopsy tick/common: Align tick period with the HZ tick. ACPI: bus: Ensure that notify handlers are not running after removal cpufreq: use correct unit when verify cur freq rpmsg: glink: Propagate TX failures in intentless mode as well hwmon: (pmbus/fsp-3y) Fix functionality bitmask in FSP-3Y YM-2151E platform/chrome: cros_typec_switch: Add missing fwnode_handle_put() wifi: ath6kl: minor fix for allocation size wifi: ath9k: hif_usb: fix memory leak of remain_skbs wifi: ath11k: Use platform_get_irq() to get the interrupt wifi: ath5k: Use platform_get_irq() to get the interrupt wifi: ath5k: fix an off by one check in ath5k_eeprom_read_freq_list() wifi: ath11k: fix SAC bug on peer addition with sta band migration wifi: brcmfmac: support CQM RSSI notification with older firmware wifi: ath6kl: reduce WARN to dev_dbg() in callback tools: bpftool: Remove invalid \' json escape wifi: rtw88: mac: Return the original error from rtw_pwr_seq_parser() wifi: rtw88: mac: Return the original error from rtw_mac_power_switch() bpf: take into account liveness when propagating precision bpf: fix precision propagation verbose logging crypto: qat - fix concurrency issue when device state changes scm: fix MSG_CTRUNC setting condition for SO_PASSSEC wifi: ath11k: fix deinitialization of firmware resources selftests/bpf: Fix a fd leak in an error path in network_helpers.c bpf: Remove misleading spec_v1 check on var-offset stack read net: pcs: xpcs: remove double-read of link state when using AN vlan: partially enable SIOCSHWTSTAMP in container net/packet: annotate accesses to po->xmit net/packet: convert po->origdev to an atomic flag net/packet: convert po->auxdata to an atomic flag libbpf: Fix ld_imm64 copy logic for ksym in light skeleton. net: dsa: qca8k: remove assignment of an_enabled in pcs_get_state() netfilter: keep conntrack reference until IPsecv6 policy checks are done bpf: Fix __reg_bound_offset 64->32 var_off subreg propagation scsi: target: core: Change the way target_xcopy_do_work() sets restiction on max I/O scsi: target: Move sess cmd counter to new struct scsi: target: Move cmd counter allocation scsi: target: Pass in cmd counter to use during cmd setup scsi: target: iscsit: isert: Alloc per conn cmd counter scsi: target: iscsit: Stop/wait on cmds during conn close scsi: target: Fix multiple LUN_RESET handling scsi: target: iscsit: Fix TAS handling during conn cleanup scsi: megaraid: Fix mega_cmd_done() CMDID_INT_CMDS net: sunhme: Fix uninitialized return code f2fs: handle dqget error in f2fs_transfer_project_quota() f2fs: fix uninitialized skipped_gc_rwsem f2fs: apply zone capacity to all zone type f2fs: compress: fix to call f2fs_wait_on_page_writeback() in f2fs_write_raw_pages() f2fs: fix scheduling while atomic in decompression path crypto: caam - Clear some memory in instantiate_rng crypto: sa2ul - Select CRYPTO_DES wifi: rtlwifi: fix incorrect error codes in rtl_debugfs_set_write_rfreg() wifi: rtlwifi: fix incorrect error codes in rtl_debugfs_set_write_reg() scsi: libsas: Add sas_ata_device_link_abort() scsi: hisi_sas: Handle NCQ error when IPTT is valid wifi: rt2x00: Fix memory leak when handling surveys f2fs: fix iostat lock protection net: qrtr: correct types of trace event parameters selftests: xsk: Use correct UMEM size in testapp_invalid_desc selftests: xsk: Disable IPv6 on VETH1 selftests: xsk: Deflakify STATS_RX_DROPPED test selftests/bpf: Wait for receive in cg_storage_multi test bpftool: Fix bug for long instructions in program CFG dumps crypto: drbg - Only fail when jent is unavailable in FIPS mode xsk: Fix unaligned descriptor validation f2fs: fix to avoid use-after-free for cached IPU bio wifi: iwlwifi: fix duplicate entry in iwl_dev_info_table bpf/btf: Fix is_int_ptr() scsi: lpfc: Fix ioremap issues in lpfc_sli4_pci_mem_setup() net: ethernet: stmmac: dwmac-rk: rework optional clock handling net: ethernet: stmmac: dwmac-rk: fix optional phy regulator handling wifi: ath11k: fix writing to unintended memory region bpf, sockmap: fix deadlocks in the sockhash and sockmap nvmet: fix error handling in nvmet_execute_identify_cns_cs_ns() nvmet: fix Identify Namespace handling nvmet: fix Identify Controller handling nvmet: fix Identify Active Namespace ID list handling nvmet: fix I/O Command Set specific Identify Controller nvme: fix async event trace event nvme-fcloop: fix "inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage" selftests/bpf: Use read_perf_max_sample_freq() in perf_event_stackmap selftests/bpf: Fix leaked bpf_link in get_stackid_cannot_attach blk-mq: don't plug for head insertions in blk_execute_rq_nowait wifi: iwlwifi: debug: fix crash in __iwl_err() wifi: iwlwifi: trans: don't trigger d3 interrupt twice wifi: iwlwifi: mvm: don't set CHECKSUM_COMPLETE for unsupported protocols bpf, sockmap: Revert buggy deadlock fix in the sockhash and sockmap f2fs: fix to check return value of f2fs_do_truncate_blocks() f2fs: fix to check return value of inc_valid_block_count() md/raid10: fix task hung in raid10d md/raid10: fix leak of 'r10bio->remaining' for recovery md/raid10: fix memleak for 'conf->bio_split' md/raid10: fix memleak of md thread md/raid10: don't call bio_start_io_acct twice for bio which experienced read error wifi: iwlwifi: mvm: don't drop unencrypted MCAST frames wifi: iwlwifi: yoyo: skip dump correctly on hw error wifi: iwlwifi: yoyo: Fix possible division by zero wifi: iwlwifi: mvm: initialize seq variable wifi: iwlwifi: fw: move memset before early return jdb2: Don't refuse invalidation of already invalidated buffers io_uring/rsrc: use nospec'ed indexes wifi: iwlwifi: make the loop for card preparation effective wifi: mt76: mt7915: expose device tree match table wifi: mt76: handle failure of vzalloc in mt7615_coredump_work wifi: mt76: add flexible polling wait-interval support wifi: mt76: mt7921e: fix probe timeout after reboot wifi: mt76: fix 6GHz high channel not be scanned mt76: mt7921: fix kernel panic by accessing unallocated eeprom.data wifi: mt76: mt7921: fix missing unwind goto in `mt7921u_probe` wifi: mt76: mt7921e: improve reliability of dma reset wifi: mt76: mt7921e: stop chip reset worker in unregister hook wifi: mt76: connac: fix txd multicast rate setting wifi: iwlwifi: mvm: check firmware response size netfilter: conntrack: restore IPS_CONFIRMED out of nf_conntrack_hash_check_insert() netfilter: conntrack: fix wrong ct->timeout value wifi: iwlwifi: fw: fix memory leak in debugfs ixgbe: Allow flow hash to be set via ethtool ixgbe: Enable setting RSS table to default values net/mlx5e: Don't clone flow post action attributes second time net/mlx5: E-switch, Create per vport table based on devlink encap mode net/mlx5: E-switch, Don't destroy indirect table in split rule net/mlx5e: Fix error flow in representor failing to add vport rx rule net/mlx5: Remove "recovery" arg from mlx5_load_one() function net/mlx5: Suspend auxiliary devices only in case of PCI device suspend Revert "net/mlx5: Remove "recovery" arg from mlx5_load_one() function" net/mlx5: Use recovery timeout on sync reset flow net/mlx5e: Nullify table pointer when failing to create net: stmmac:fix system hang when setting up tag_8021q VLAN for DSA ports bpf: Fix race between btf_put and btf_idr walk. bpf: Don't EFAULT for getsockopt with optval=NULL netfilter: nf_tables: don't write table validation state without mutex net: dpaa: Fix uninitialized variable in dpaa_stop() net/sched: sch_fq: fix integer overflow of "credit" ipv4: Fix potential uninit variable access bug in __ip_make_skb() Revert "Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work" netlink: Use copy_to_user() for optval in netlink_getsockopt(). net: amd: Fix link leak when verifying config failed tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp. ipmi: ASPEED_BT_IPMI_BMC: select REGMAP_MMIO instead of depending on it ASoC: cs35l41: Only disable internal boost drivers: staging: rtl8723bs: Fix locking in _rtw_join_timeout_handler() drivers: staging: rtl8723bs: Fix locking in rtw_scan_timeout_handler() pstore: Revert pmsg_lock back to a normal mutex usb: host: xhci-rcar: remove leftover quirk handling usb: dwc3: gadget: Change condition for processing suspend event serial: stm32: Re-assert RTS/DE GPIO in RS485 mode only if more data are transmitted fpga: bridge: fix kernel-doc parameter description iio: light: max44009: add missing OF device matching serial: 8250_bcm7271: Fix arbitration handling spi: atmel-quadspi: Don't leak clk enable count in pm resume spi: atmel-quadspi: Free resources even if runtime resume failed in .remove() spi: imx: Don't skip cleanup in remove's error path usb: gadget: udc: renesas_usb3: Fix use after free bug in renesas_usb3_remove due to race condition ASoC: soc-compress: Inherit atomicity from DAI link for Compress FE PCI: imx6: Install the fault handler only on compatible match ASoC: es8316: Handle optional IRQ assignment linux/vt_buffer.h: allow either builtin or modular for macros spi: qup: Don't skip cleanup in remove's error path interconnect: qcom: rpm: drop bogus pm domain attach spi: fsl-spi: Fix CPM/QE mode Litte Endian vmci_host: fix a race condition in vmci_host_poll() causing GPF of: Fix modalias string generation PCI/EDR: Clear Device Status after EDR error recovery ia64: mm/contig: fix section mismatch warning/error ia64: salinfo: placate defined-but-not-used warning scripts/gdb: bail early if there are no clocks scripts/gdb: bail early if there are no generic PD HID: amd_sfh: Correct the structure fields HID: amd_sfh: Correct the sensor enable and disable command HID: amd_sfh: Fix illuminance value HID: amd_sfh: Add support for shutdown operation HID: amd_sfh: Correct the stop all command HID: amd_sfh: Increase sensor command timeout for SFH1.1 HID: amd_sfh: Handle "no sensors" enabled for SFH1.1 cacheinfo: Check sib_leaf in cache_leaves_are_shared() coresight: etm_pmu: Set the module field drm/panel: novatek-nt35950: Improve error handling ASoC: fsl_mqs: move of_node_put() to the correct location PCI/PM: Extend D3hot delay for NVIDIA HDA controllers drm/panel: novatek-nt35950: Only unregister DSI1 if it exists spi: cadence-quadspi: fix suspend-resume implementations i2c: cadence: cdns_i2c_master_xfer(): Fix runtime PM leak on error path i2c: xiic: xiic_xfer(): Fix runtime PM leak on error path scripts/gdb: raise error with reduced debugging information uapi/linux/const.h: prefer ISO-friendly __typeof__ sh: sq: Fix incorrect element size for allocating bitmap buffer usb: gadget: tegra-xudc: Fix crash in vbus_draw usb: chipidea: fix missing goto in `ci_hdrc_probe` usb: mtu3: fix kernel panic at qmu transfer done irq handler firmware: stratix10-svc: Fix an NULL vs IS_ERR() bug in probe tty: serial: fsl_lpuart: adjust buffer length to the intended size serial: 8250: Add missing wakeup event reporting spi: cadence-quadspi: use macro DEFINE_SIMPLE_DEV_PM_OPS staging: rtl8192e: Fix W_DISABLE# does not work after stop/start spmi: Add a check for remove callback when removing a SPMI driver virtio_ring: don't update event idx on get_buf fbdev: mmp: Fix deferred clk handling in mmphw_probe() selftests/powerpc/pmu: Fix sample field check in the mmcra_thresh_marked_sample_test macintosh/windfarm_smu_sat: Add missing of_node_put() powerpc/perf: Properly detect mpc7450 family powerpc/mpc512x: fix resource printk format warning powerpc/wii: fix resource printk format warnings powerpc/sysdev/tsi108: fix resource printk format warnings macintosh: via-pmu-led: requires ATA to be set powerpc/rtas: use memmove for potentially overlapping buffer copy sched/fair: Fix inaccurate tally of ttwu_move_affine perf/core: Fix hardlockup failure caused by perf throttle Revert "objtool: Support addition to set CFA base" riscv: Fix ptdump when KASAN is enabled sched/rt: Fix bad task migration for rt tasks tracing/user_events: Ensure write index cannot be negative clk: at91: clk-sam9x60-pll: fix return value check IB/hifi1: add a null check of kzalloc_node in hfi1_ipoib_txreq_init RDMA/siw: Fix potential page_array out of range access clk: mediatek: mt2712: Add error handling to clk_mt2712_apmixed_probe() clk: mediatek: Consistently use GATE_MTK() macro clk: mediatek: mt7622: Properly use CLK_IS_CRITICAL flag clk: mediatek: mt8135: Properly use CLK_IS_CRITICAL flag RDMA/rdmavt: Delete unnecessary NULL check clk: qcom: gcc-qcm2290: Fix up gcc_sdcc2_apps_clk_src workqueue: Fix hung time report of worker pools rtc: omap: include header for omap_rtc_power_off_program prototype RDMA/mlx4: Prevent shift wrapping in set_user_sq_size() rtc: meson-vrtc: Use ktime_get_real_ts64() to get the current time rtc: k3: handle errors while enabling wake irq RDMA/erdma: Use fixed hardware page size fs/ntfs3: Fix memory leak if ntfs_read_mft failed fs/ntfs3: Add check for kmemdup fs/ntfs3: Fix OOB read in indx_insert_into_buffer fs/ntfs3: Fix slab-out-of-bounds read in hdr_delete_de() iommu/mediatek: Set dma_mask for PGTABLE_PA_35_EN power: supply: generic-adc-battery: fix unit scaling clk: add missing of_node_put() in "assigned-clocks" property parsing RDMA/siw: Remove namespace check from siw_netdev_event() clk: qcom: gcc-sm6115: Mark RCGs shared where applicable power: supply: rk817: Fix low SOC bugs RDMA/cm: Trace icm_send_rej event before the cm state is reset RDMA/srpt: Add a check for valid 'mad_agent' pointer IB/hfi1: Fix SDMA mmu_rb_node not being evicted in LRU order IB/hfi1: Fix bugs with non-PAGE_SIZE-end multi-iovec user SDMA requests clk: imx: fracn-gppll: fix the rate table clk: imx: fracn-gppll: disable hardware select control clk: imx: imx8ulp: Fix XBAR_DIVBUS and AD_SLOW clock parents NFSv4.1: Always send a RECLAIM_COMPLETE after establishing lease iommu/amd: Set page size bitmap during V2 domain allocation clk: qcom: lpasscc-sc7280: Skip qdsp6ss clock registration clk: qcom: lpassaudiocc-sc7280: Add required gdsc power domain clks in lpass_cc_sc7280_desc clk: qcom: gcc-sm8350: fix PCIe PIPE clocks handling clk: qcom: dispcc-qcm2290: get rid of test clock clk: qcom: dispcc-qcm2290: Remove inexistent DSI1PHY clk Input: raspberrypi-ts - fix refcount leak in rpi_ts_probe swiotlb: relocate PageHighMem test away from rmem_swiotlb_setup swiotlb: fix debugfs reporting of reserved memory pools RDMA/mlx5: Check pcie_relaxed_ordering_enabled() in UMR RDMA/mlx5: Fix flow counter query via DEVX SUNRPC: remove the maximum number of retries in call_bind_status RDMA/mlx5: Use correct device num_ports when modify DC clocksource/drivers/davinci: Fix memory leak in davinci_timer_register when init fails openrisc: Properly store r31 to pt_regs on unhandled exceptions timekeeping: Fix references to nonexistent ktime_get_fast_ns() SMB3: Add missing locks to protect deferred close file list SMB3: Close deferred file handles in case of handle lease break ext4: fix i_disksize exceeding i_size problem in paritally written case ext4: fix use-after-free read in ext4_find_extent for bigalloc + inline pinctrl: renesas: r8a779a0: Remove incorrect AVB[01] pinmux configuration pinctrl: renesas: r8a779f0: Fix tsn1_avtp_pps pin group pinctrl: renesas: r8a779g0: Fix Group 4/5 pin functions pinctrl: renesas: r8a779g0: Fix Group 6/7 pin functions pinctrl: renesas: r8a779g0: Fix ERROROUTC function names leds: TI_LMU_COMMON: select REGMAP instead of depending on it pinctrl: ralink: reintroduce ralink,rt2880-pinmux compatible string dmaengine: mv_xor_v2: Fix an error code. leds: tca6507: Fix error handling of using fwnode_property_read_string pwm: mtk-disp: Disable shadow registers before setting backlight values pwm: mtk-disp: Configure double buffering before reading in .get_state() soundwire: cadence: rename sdw_cdns_dai_dma_data as sdw_cdns_dai_runtime soundwire: intel: don't save hw_params for use in prepare phy: tegra: xusb: Add missing tegra_xusb_port_unregister for usb2_port and ulpi_port phy: ti: j721e-wiz: Fix unreachable code in wiz_mode_select() dma: gpi: remove spurious unlock in gpi_ch_init dmaengine: dw-edma: Fix to change for continuous transfer dmaengine: dw-edma: Fix to enable to issue dma request on DMA processing dmaengine: at_xdmac: do not enable all cyclic channels pinctrl-bcm2835.c: fix race condition when setting gpio dir thermal/drivers/mediatek: Use devm_of_iomap to avoid resource leak in mtk_thermal_probe mfd: tqmx86: Do not access I2C_DETECT register through io_base mfd: tqmx86: Specify IO port register range more precisely mfd: tqmx86: Correct board names for TQMxE39x mfd: ocelot-spi: Fix unsupported bulk read mfd: arizona-spi: Add missing MODULE_DEVICE_TABLE hte: tegra: fix 'struct of_device_id' build error hte: tegra-194: Fix off by one in tegra_hte_map_to_line_id() ACPI: PM: Do not turn of unused power resources on the Toshiba Click Mini PM: hibernate: Turn snapshot_test into global variable PM: hibernate: Do not get block device exclusively in test_resume mode afs: Fix updating of i_size with dv jump from server afs: Fix getattr to report server i_size on dirs, not local size afs: Avoid endless loop if file is larger than expected parisc: Fix argument pointer in real64_call_asm() parisc: Ensure page alignment in flush functions ALSA: usb-audio: Add quirk for Pioneer DDJ-800 ALSA: hda/realtek: Add quirk for ThinkPad P1 Gen 6 ALSA: hda/realtek: Add quirk for ASUS UM3402YAR using CS35L41 ALSA: hda/realtek: support HP Pavilion Aero 13-be0xxx Mute LED ALSA: hda/realtek: Fix mute and micmute LEDs for an HP laptop nilfs2: do not write dirty data after degenerating to read-only nilfs2: fix infinite loop in nilfs_mdt_get_block() mm: do not reclaim private data from pinned page drbd: correctly submit flush bio on barrier md/raid10: fix null-ptr-deref in raid10_sync_request md/raid5: Improve performance for sequential IO kasan: hw_tags: avoid invalid virt_to_page() mtd: core: provide unique name for nvmem device, take two mtd: core: fix nvmem error reporting mtd: core: fix error path for nvmem provider mtd: spi-nor: core: Update flash's current address mode when changing address mode mailbox: zynqmp: Fix IPI isr handling kcsan: Avoid READ_ONCE() in read_instrumented_memory() mailbox: zynqmp: Fix typo in IPI documentation wifi: rtl8xxxu: RTL8192EU always needs full init wifi: rtw89: fix potential race condition between napi_init and napi_enable clk: microchip: fix potential UAF in auxdev release callback clk: rockchip: rk3399: allow clk_cifout to force clk_cifout_src to reparent scripts/gdb: fix lx-timerlist for Python3 btrfs: scrub: reject unsupported scrub flags s390/dasd: fix hanging blockdevice after request requeue ia64: fix an addr to taddr in huge_pte_offset() mm/mempolicy: correctly update prev when policy is equal on mbind vhost_vdpa: fix unmap process in no-batch mode dm verity: fix error handling for check_at_most_once on FEC dm clone: call kmem_cache_destroy() in dm_clone_init() error path dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path dm flakey: fix a crash with invalid table line dm ioctl: fix nested locking in table_clear() to remove deadlock concern dm: don't lock fs when the map is NULL in process of resume blk-iocost: avoid 64-bit division in ioc_timer_fn cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname cifs: protect session status check in smb2_reconnect() thunderbolt: Use correct type in tb_port_is_clx_enabled() prototype bonding (gcc13): synchronize bond_{a,t}lb_xmit() types wifi: ath11k: synchronize ath11k_mac_he_gi_to_nl80211_he_gi()'s return type perf auxtrace: Fix address filter entire kernel size perf intel-pt: Fix CYC timestamps after standalone CBR block/blk-iocost (gcc13): keep large values in a new enum sfc (gcc13): synchronize ef100_enqueue_skb()'s return type i40e: Remove unused i40e status codes i40e: Remove string printing for i40e_status i40e: use int for i40e_status drm/amd/display (gcc13): fix enum mismatch debugobject: Ensure pool refill (again) scsi: libsas: Grab the ATA port lock in sas_ata_device_link_abort() netfilter: nf_tables: deactivate anonymous set from preparation phase Linux 6.1.28 Change-Id: I61b5133e2d051cc2aa39b8c7c1be3fc25da40210 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-06-09 20:20:52 +00:00
Suren Baghdasaryan	5dd0547a3e	UPSTREAM: mm: replace vma->vm_flags direct modifications with modifier calls ... Replace direct modifications to vma->vm_flags with calls to modifier functions to be able to track flag changes and to keep vma locking correctness. [akpm@linux-foundation.org: fix drivers/misc/open-dice.c, per Hyeonggon Yoo] Link: https://lkml.kernel.org/r/20230126193752.297968-5-surenb@google.com Signed-off-by: Suren Baghdasaryan <surenb@google.com> Acked-by: Michal Hocko <mhocko@suse.com> Acked-by: Mel Gorman <mgorman@techsingularity.net> Acked-by: Mike Rapoport (IBM) <rppt@kernel.org> Acked-by: Sebastian Reichel <sebastian.reichel@collabora.com> Reviewed-by: Liam R. Howlett <Liam.Howlett@Oracle.com> Reviewed-by: Hyeonggon Yoo <42.hyeyoo@gmail.com> Cc: Andy Lutomirski <luto@kernel.org> Cc: Arjun Roy <arjunroy@google.com> Cc: Axel Rasmussen <axelrasmussen@google.com> Cc: David Hildenbrand <david@redhat.com> Cc: David Howells <dhowells@redhat.com> Cc: Davidlohr Bueso <dave@stgolabs.net> Cc: David Rientjes <rientjes@google.com> Cc: Eric Dumazet <edumazet@google.com> Cc: Greg Thelen <gthelen@google.com> Cc: Hugh Dickins <hughd@google.com> Cc: Ingo Molnar <mingo@redhat.com> Cc: Jann Horn <jannh@google.com> Cc: Joel Fernandes <joelaf@google.com> Cc: Johannes Weiner <hannes@cmpxchg.org> Cc: Kent Overstreet <kent.overstreet@linux.dev> Cc: Laurent Dufour <ldufour@linux.ibm.com> Cc: Lorenzo Stoakes <lstoakes@gmail.com> Cc: Matthew Wilcox <willy@infradead.org> Cc: Minchan Kim <minchan@google.com> Cc: Paul E. McKenney <paulmck@kernel.org> Cc: Peter Oskolkov <posk@google.com> Cc: Peter Xu <peterx@redhat.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Punit Agrawal <punit.agrawal@bytedance.com> Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Cc: Shakeel Butt <shakeelb@google.com> Cc: Soheil Hassas Yeganeh <soheil@google.com> Cc: Song Liu <songliubraving@fb.com> Cc: Vlastimil Babka <vbabka@suse.cz> Cc: Will Deacon <will@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> (cherry picked from commit 1c71222e5f2393b5ea1a41795c67589eea7e3490) Bug: 161210518 Change-Id: Ifc352b487db109adab17dd33a83f5c7e68c0bbc6 Signed-off-by: Suren Baghdasaryan <surenb@google.com>	2023-06-07 14:24:57 +00:00
Dmitry Bogdanov	a7a4def6c7	scsi: target: iscsit: Free cmds before session free ... [ Upstream commit d8990b5a4d065f38f35d69bcd627ec5a7f8330ca ] Commands from recovery entries are freed after session has been closed. That leads to use-after-free at command free or NPE with such call trace: Time2Retain timer expired for SID: 1, cleaning up iSCSI session. BUG: kernel NULL pointer dereference, address: 0000000000000140 RIP: 0010:sbitmap_queue_clear+0x3a/0xa0 Call Trace: target_release_cmd_kref+0xd1/0x1f0 [target_core_mod] transport_generic_free_cmd+0xd1/0x180 [target_core_mod] iscsit_free_cmd+0x53/0xd0 [iscsi_target_mod] iscsit_free_connection_recovery_entries+0x29d/0x320 [iscsi_target_mod] iscsit_close_session+0x13a/0x140 [iscsi_target_mod] iscsit_check_post_dataout+0x440/0x440 [iscsi_target_mod] call_timer_fn+0x24/0x140 Move cleanup of recovery enrties to before session freeing. Reported-by: Forza <forza@tnonline.net> Signed-off-by: Dmitry Bogdanov <d.bogdanov@yadro.com> Signed-off-by: Mike Christie <michael.christie@oracle.com> Link: https://lore.kernel.org/r/20230319015620.96006-7-michael.christie@oracle.com Reviewed-by: Maurizio Lombardi <mlombard@redhat.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-05-24 17:32:37 +01:00
Mike Christie	770c3fd4d7	scsi: target: iscsit: Fix TAS handling during conn cleanup ... [ Upstream commit cc79da306ebb2edb700c3816b90219223182ac3c ] Fix a bug added in commit f36199355c ("scsi: target: iscsi: Fix cmd abort fabric stop race"). If CMD_T_TAS is set on the se_cmd we must call iscsit_free_cmd() to do the last put on the cmd and free it, because the connection is down and we will not up sending the response and doing the put from the normal I/O path. Add a check for CMD_T_TAS in iscsit_release_commands_from_conn() so we now detect this case and run iscsit_free_cmd(). Fixes: f36199355c ("scsi: target: iscsi: Fix cmd abort fabric stop race") Signed-off-by: Mike Christie <michael.christie@oracle.com> Link: https://lore.kernel.org/r/20230319015620.96006-9-michael.christie@oracle.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-05-11 23:03:19 +09:00
Mike Christie	eacfe32c36	scsi: target: Fix multiple LUN_RESET handling ... [ Upstream commit 673db054d7a2b5a470d7a25baf65956d005ad729 ] This fixes a bug where an initiator thinks a LUN_RESET has cleaned up running commands when it hasn't. The bug was added in commit 51ec502a32 ("target: Delete tmr from list before processing"). The problem occurs when: 1. We have N I/O cmds running in the target layer spread over 2 sessions. 2. The initiator sends a LUN_RESET for each session. 3. session1's LUN_RESET loops over all the running commands from both sessions and moves them to its local drain_task_list. 4. session2's LUN_RESET does not see the LUN_RESET from session1 because the commit above has it remove itself. session2 also does not see any commands since the other reset moved them off the state lists. 5. sessions2's LUN_RESET will then complete with a successful response. 6. sessions2's inititor believes the running commands on its session are now cleaned up due to the successful response and cleans up the running commands from its side. It then restarts them. 7. The commands do eventually complete on the backend and the target starts to return aborted task statuses for them. The initiator will either throw a invalid ITT error or might accidentally lookup a new task if the ITT has been reallocated already. Fix the bug by reverting the patch, and serialize the execution of LUN_RESETs and Preempt and Aborts. Also prevent us from waiting on LUN_RESETs in core_tmr_drain_tmr_list, because it turns out the original patch fixed a bug that was not mentioned. For LUN_RESET1 core_tmr_drain_tmr_list can see a second LUN_RESET and wait on it. Then the second reset will run core_tmr_drain_tmr_list and see the first reset and wait on it resulting in a deadlock. Fixes: 51ec502a32 ("target: Delete tmr from list before processing") Signed-off-by: Mike Christie <michael.christie@oracle.com> Link: https://lore.kernel.org/r/20230319015620.96006-8-michael.christie@oracle.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-05-11 23:03:19 +09:00
Mike Christie	cc84bbdde9	scsi: target: iscsit: Stop/wait on cmds during conn close ... [ Upstream commit 395cee83d02de3073211b04fc85724f4abc663ad ] This fixes a bug added in commit f36199355c ("scsi: target: iscsi: Fix cmd abort fabric stop race"). If we have multiple sessions to the same se_device we can hit a race where a LUN_RESET on one session cleans up the se_cmds from under another session which is being closed. This results in the closing session freeing its conn/session structs while they are still in use. The bug is: 1. Session1 has IO se_cmd1. 2. Session2 can also have se_cmds for I/O and optionally TMRs for ABORTS but then gets a LUN_RESET. 3. The LUN_RESET on session2 sees the se_cmds on session1 and during the drain stages marks them all with CMD_T_ABORTED. 4. session1 is now closed so iscsit_release_commands_from_conn() only sees se_cmds with the CMD_T_ABORTED bit set and returns immediately even though we have outstanding commands. 5. session1's connection and session are freed. 6. The backend request for se_cmd1 completes and it accesses the freed connection/session. This hooks the iscsit layer into the cmd counter code, so we can wait for all outstanding se_cmds before freeing the connection. Fixes: f36199355c ("scsi: target: iscsi: Fix cmd abort fabric stop race") Signed-off-by: Mike Christie <michael.christie@oracle.com> Link: https://lore.kernel.org/r/20230319015620.96006-6-michael.christie@oracle.com Reviewed-by: Maurizio Lombardi <mlombard@redhat.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-05-11 23:03:19 +09:00
Mike Christie	edd9002071	scsi: target: iscsit: isert: Alloc per conn cmd counter ... [ Upstream commit 6d256bee602b131bd4fbc92863b6a1210bcf6325 ] This has iscsit allocate a per conn cmd counter and converts iscsit/isert to use it instead of the per session one. Signed-off-by: Mike Christie <michael.christie@oracle.com> Link: https://lore.kernel.org/r/20230319015620.96006-5-michael.christie@oracle.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Stable-dep-of: 395cee83d02d ("scsi: target: iscsit: Stop/wait on cmds during conn close") Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-05-11 23:03:19 +09:00
Mike Christie	b7ca8ded37	scsi: target: Pass in cmd counter to use during cmd setup ... [ Upstream commit 8e288be8606ad87c1726618eacfb8fbd3ab4b806 ] Allow target_get_sess_cmd() users to pass in the cmd counter they want to use. Right now we pass in the session's cmd counter but in a subsequent commit iSCSI will switch from per session to per conn. Signed-off-by: Mike Christie <michael.christie@oracle.com> Link: https://lore.kernel.org/r/20230319015620.96006-4-michael.christie@oracle.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Stable-dep-of: 395cee83d02d ("scsi: target: iscsit: Stop/wait on cmds during conn close") Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-05-11 23:03:19 +09:00
Mike Christie	741443436e	scsi: target: Move cmd counter allocation ... [ Upstream commit 4edba7e4a8f39112398d3cda94128a8e13a7d527 ] iSCSI needs to allocate its cmd counter per connection for MCS support where we need to stop and wait on commands running on a connection instead of per session. This moves the cmd counter allocation to target_setup_session() which is used by drivers that need the stop+wait behavior per session. xcopy doesn't need stop+wait at all, so we will be OK moving the cmd counter allocation outside of transport_init_session(). Signed-off-by: Mike Christie <michael.christie@oracle.com> Link: https://lore.kernel.org/r/20230319015620.96006-3-michael.christie@oracle.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Stable-dep-of: 395cee83d02d ("scsi: target: iscsit: Stop/wait on cmds during conn close") Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-05-11 23:03:19 +09:00
Mike Christie	76b77646f1	scsi: target: Move sess cmd counter to new struct ... [ Upstream commit becd9be6069e7b183c084f460f0eb363e43cc487 ] iSCSI needs to wait on outstanding commands like how SRP and the FC/FCoE drivers do. It can't use target_stop_session() because for MCS support we can't stop the entire session during recovery because if other connections are OK then we want to be able to continue to execute I/O on them. Move the per session cmd counters to a new struct so iSCSI can allocate them per connection. The xcopy code can also just not allocate in the future since it doesn't need to track commands. Signed-off-by: Mike Christie <michael.christie@oracle.com> Link: https://lore.kernel.org/r/20230319015620.96006-2-michael.christie@oracle.com Reviewed-by: Maurizio Lombardi <mlombard@redhat.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Stable-dep-of: 395cee83d02d ("scsi: target: iscsit: Stop/wait on cmds during conn close") Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-05-11 23:03:19 +09:00
Anastasia Kovaleva	87ee7227cc	scsi: target: core: Change the way target_xcopy_do_work() sets restiction on max I/O ... [ Upstream commit 689d94ec208cfdf95101d99319cb4bdc5f55774d ] To determine how many blocks sends in one command, the minimum value is selected from the hw_max_sectors of both devices. In target_xcopy_do_work, hw_max_sectors are used as blocks, not sectors; it also ignores the fact that sectors can be of different sizes, for example 512 and 4096 bytes. Because of this, a number of blocks can be transmitted that the device will not be able to accept. Change the selection of max transmission size into bytes. Reviewed-by: Konstantin Shelekhin <k.shelekhin@yadro.com> Reviewed-by: Dmitriy Bogdanov <d.bogdanov@yadro.com> Signed-off-by: Anastasia Kovaleva <a.kovaleva@yadro.com> Link: https://lore.kernel.org/r/20221114102500.88892-4-a.kovaleva@yadro.com Reviewed-by: Mike Christie <michael.christie@oracle.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Stable-dep-of: 395cee83d02d ("scsi: target: iscsit: Stop/wait on cmds during conn close") Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-05-11 23:03:19 +09:00
Greg Kroah-Hartman	db50ac4d0a	Merge 6.1.22 into android14-6.1 ... Changes in 6.1.22 interconnect: qcom: osm-l3: fix icc_onecell_data allocation interconnect: qcom: sm8450: switch to qcom_icc_rpmh_* function interconnect: qcom: qcm2290: Fix MASTER_SNOC_BIMC_NRT perf/core: Fix perf_output_begin parameter is incorrectly invoked in perf_event_bpf_output perf: fix perf_event_context->time tracing/hwlat: Replace sched_setaffinity with set_cpus_allowed_ptr drm/amd/display: Include virtual signal to set k1 and k2 values drm/amd/display: fix k1 k2 divider programming for phantom streams drm/amd/display: Remove OTG DIV register write for Virtual signals. mptcp: refactor passive socket initialization mptcp: use the workqueue to destroy unaccepted sockets mptcp: fix UaF in listener shutdown drm/amd/display: Fix DP MST sinks removal issue arm64: dts: qcom: sm8450: Mark UFS controller as cache coherent power: supply: bq24190: Fix use after free bug in bq24190_remove due to race condition power: supply: da9150: Fix use after free bug in da9150_charger_remove due to race condition arm64: dts: imx8dxl-evk: Disable hibernation mode of AR8031 for EQOS arm64: dts: imx8dxl-evk: Fix eqos phy reset gpio ARM: dts: imx6sll: e70k02: fix usbotg1 pinctrl ARM: dts: imx6sll: e60k02: fix usbotg1 pinctrl ARM: dts: imx6sl: tolino-shine2hd: fix usbotg1 pinctrl arm64: dts: imx8mn: specify #sound-dai-cells for SAI nodes arm64: dts: imx93: add missing #address-cells and #size-cells to i2c nodes NFS: Fix /proc/PID/io read_bytes for buffered reads xsk: Add missing overflow check in xdp_umem_reg iavf: fix inverted Rx hash condition leading to disabled hash iavf: fix non-tunneled IPv6 UDP packet type and hashing iavf: do not track VLAN 0 filters intel/igbvf: free irq on the error path in igbvf_request_msix() igbvf: Regard vf reset nack as success igc: fix the validation logic for taprio's gate list i2c: imx-lpi2c: check only for enabled interrupt flags i2c: mxs: ensure that DMA buffers are safe for DMA i2c: hisi: Only use the completion interrupt to finish the transfer scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate() nfsd: don't replace page in rq_pages if it's a continuation of last page net: dsa: b53: mmap: fix device tree support net: usb: smsc95xx: Limit packet length to skb->len efi/libstub: smbios: Use length member instead of record struct size qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info xirc2ps_cs: Fix use after free bug in xirc2ps_detach net: phy: Ensure state transitions are processed from phy_stop() net: mdio: fix owner field for mdio buses registered using device-tree net: mdio: fix owner field for mdio buses registered using ACPI net: stmmac: Fix for mismatched host/device DMA address width thermal/drivers/mellanox: Use generic thermal_zone_get_trip() function mlxsw: core_thermal: Fix fan speed in maximum cooling state drm/i915: Print return value on error drm/i915/fbdev: lock the fbdev obj before vma pin drm/i915/guc: Rename GuC register state capture node to be more obvious drm/i915/guc: Fix missing ecodes drm/i915/gt: perform uc late init after probe error injection net: qcom/emac: Fix use after free bug in emac_remove due to race condition net: usb: lan78xx: Limit packet length to skb->len net/ps3_gelic_net: Fix RX sk_buff length net/ps3_gelic_net: Use dma_mapping_error octeontx2-vf: Add missing free for alloc_percpu bootconfig: Fix testcase to increase max node keys: Do not cache key in task struct if key is requested from kernel thread ice: check if VF exists before mode check iavf: fix hang on reboot with ice i40e: fix flow director packet filter programming bpf: Adjust insufficient default bpf_jit_limit net/mlx5e: Set uplink rep as NETNS_LOCAL net/mlx5e: Block entering switchdev mode with ns inconsistency net/mlx5: Fix steering rules cleanup net/mlx5e: Overcome slow response for first macsec ASO WQE net/mlx5: Read the TC mapping of all priorities on ETS query net/mlx5: E-Switch, Fix an Oops in error handling code net: dsa: tag_brcm: legacy: fix daisy-chained switches atm: idt77252: fix kmemleak when rmmod idt77252 erspan: do not use skb_mac_header() in ndo_start_xmit() net/sonic: use dma_mapping_error() for error check nvme-tcp: fix nvme_tcp_term_pdu to match spec mlxsw: spectrum_fid: Fix incorrect local port type hvc/xen: prevent concurrent accesses to the shared ring ksmbd: add low bound validation to FSCTL_SET_ZERO_DATA ksmbd: add low bound validation to FSCTL_QUERY_ALLOCATED_RANGES ksmbd: fix possible refcount leak in smb2_open() Bluetooth: hci_sync: Resume adv with no RPA when active scan Bluetooth: hci_core: Detect if an ACL packet is in fact an ISO packet Bluetooth: btusb: Remove detection of ISO packets over bulk Bluetooth: ISO: fix timestamped HCI ISO data packet parsing Bluetooth: Remove "Power-on" check from Mesh feature gve: Cache link_speed value from device net: asix: fix modprobe "sysfs: cannot create duplicate filename" net: dsa: mt7530: move enabling disabling core clock to mt7530_pll_setup() net: dsa: mt7530: move lowering TRGMII driving to mt7530_setup() net: dsa: mt7530: move setting ssc_delta to PHY_INTERFACE_MODE_TRGMII case net: mdio: thunder: Add missing fwnode_handle_put() drm/amd/display: Set dcn32 caps.seamless_odm Bluetooth: btqcomsmd: Fix command timeout after setting BD address Bluetooth: L2CAP: Fix responding with wrong PDU type Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work Bluetooth: mgmt: Fix MGMT add advmon with RSSI command Bluetooth: HCI: Fix global-out-of-bounds platform/chrome: cros_ec_chardev: fix kernel data leak from ioctl entry: Fix noinstr warning in __enter_from_user_mode() perf/x86/amd/core: Always clear status for idx entry/rcu: Check TIF_RESCHED _after_ delayed RCU wake-up hwmon: fix potential sensor registration fail if of_node is missing hwmon (it87): Fix voltage scaling for chips with 10.9mV ADCs scsi: qla2xxx: Synchronize the IOCB count to be in order scsi: qla2xxx: Perform lockless command completion in abort path smb3: lower default deferred close timeout to address perf regression smb3: fix unusable share after force unmount failure uas: Add US_FL_NO_REPORT_OPCODES for JMicron JMS583Gen 2 thunderbolt: Use scale field when allocating USB3 bandwidth thunderbolt: Call tb_check_quirks() after initializing adapters thunderbolt: Add quirk to disable CLx thunderbolt: Fix memory leak in margining thunderbolt: Disable interrupt auto clear for rings thunderbolt: Add missing UNSET_INBOUND_SBTX for retimer access thunderbolt: Use const qualifier for `ring_interrupt_index` thunderbolt: Rename shadowed variables bit to interrupt_bit and auto_clear_bit ASoC: amd: yp: Add OMEN by HP Gaming Laptop 16z-n000 to quirks ASoC: amd: yc: Add DMI entries to support HP OMEN 16-n0xxx (8A43) ACPI: x86: Drop quirk for HP Elitebook ACPI: x86: utils: Add Cezanne to the list for forcing StorageD3Enable riscv: Bump COMMAND_LINE_SIZE value to 1024 drm/cirrus: NULL-check pipe->plane.state->fb in cirrus_pipe_update() HID: cp2112: Fix driver not registering GPIO IRQ chip as threaded ca8210: fix mac_len negative array access HID: logitech-hidpp: Add support for Logitech MX Master 3S mouse HID: intel-ish-hid: ipc: Fix potential use-after-free in work function m68k: mm: Fix systems with memory at end of 32-bit address space m68k: Only force 030 bus error if PC not in exception table selftests/bpf: check that modifier resolves after pointer scsi: target: iscsi: Fix an error message in iscsi_check_key() scsi: qla2xxx: Add option to disable FC2 Target support scsi: hisi_sas: Check devm_add_action() return value scsi: ufs: core: Add soft dependency on governor_simpleondemand scsi: lpfc: Check kzalloc() in lpfc_sli4_cgn_params_read() scsi: lpfc: Avoid usage of list iterator variable after loop scsi: mpi3mr: Driver unload crashes host when enhanced logging is enabled scsi: mpi3mr: Wait for diagnostic save during controller init scsi: mpi3mr: NVMe command size greater than 8K fails scsi: mpi3mr: Bad drive in topology results kernel crash scsi: storvsc: Handle BlockSize change in Hyper-V VHD/VHDX file platform/x86: int3472: Add GPIOs to Surface Go 3 Board data net: usb: cdc_mbim: avoid altsetting toggling for Telit FE990 net: usb: qmi_wwan: add Telit 0x1080 composition drm/amd/display: Update clock table to include highest clock setting sh: sanitize the flags on sigreturn drm/amdgpu: Fix call trace warning and hang when removing amdgpu device drm/amd: Fix initialization mistake for NBIO 7.3.0 net/sched: act_mirred: better wording on protection against excessive stack growth act_mirred: use the backlog for nested calls to mirred ingress cifs: lock chan_lock outside match_session cifs: append path to open_enter trace event cifs: do not poll server interfaces too regularly cifs: empty interface list when server doesn't support query interfaces cifs: dump pending mids for all channels in DebugData cifs: print session id while listing open files cifs: fix dentry lookups in directory handle cache x86/fpu/xstate: Prevent false-positive warning in __copy_xstate_uabi_buf() selftests/x86/amx: Add a ptrace test scsi: core: Add BLIST_SKIP_VPD_PAGES for SKhynix H28U74301AMR usb: misc: onboard-hub: add support for Microchip USB2517 USB 2.0 hub usb: dwc2: drd: fix inconsistent mode if role-switch-default-mode="host" usb: dwc2: fix a devres leak in hw_enable upon suspend resume usb: gadget: u_audio: don't let userspace block driver unbind btrfs: zoned: fix btrfs_can_activate_zone() to support DUP profile Bluetooth: Fix race condition in hci_cmd_sync_clear efi: sysfb_efi: Fix DMI quirks not working for simpledrm mm/slab: Fix undefined init_cache_node_node() for NUMA and !SMP fscrypt: destroy keyring after security_sb_delete() fsverity: Remove WQ_UNBOUND from fsverity read workqueue lockd: set file_lock start and end when decoding nlm4 testargs arm64: dts: imx8mm-nitrogen-r2: fix WM8960 clock name igb: revert rtnl_lock() that causes deadlock dm thin: fix deadlock when swapping to thin device usb: typec: tcpm: fix create duplicate source-capabilities file usb: typec: tcpm: fix warning when handle discover_identity message usb: cdns3: Fix issue with using incorrect PCI device function usb: cdnsp: Fixes issue with redundant Status Stage usb: cdnsp: changes PCI Device ID to fix conflict with CNDS3 driver usb: chipdea: core: fix return -EINVAL if request role is the same with current role usb: chipidea: core: fix possible concurrent when switch role usb: dwc3: gadget: Add 1ms delay after end transfer command without IOC usb: ucsi: Fix NULL pointer deref in ucsi_connector_change() usb: ucsi_acpi: Increase the command completion timeout mm: kfence: fix using kfence_metadata without initialization in show_object() kfence: avoid passing -g for test io_uring/net: avoid sending -ECONNABORTED on repeated connection requests io_uring/rsrc: fix null-ptr-deref in io_file_bitmap_get() Revert "kasan: drop skip_kasan_poison variable in free_pages_prepare" test_maple_tree: add more testing for mas_empty_area() maple_tree: fix mas_skip_node() end slot detection ksmbd: fix wrong signingkey creation when encryption is AES256 ksmbd: set FILE_NAMED_STREAMS attribute in FS_ATTRIBUTE_INFORMATION ksmbd: don't terminate inactive sessions after a few seconds ksmbd: return STATUS_NOT_SUPPORTED on unsupported smb2.0 dialect ksmbd: return unsupported error on smb1 mount wifi: mac80211: fix qos on mesh interfaces nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy() drm/bridge: lt8912b: return EPROBE_DEFER if bridge is not found drm/amd/display: fix wrong index used in dccg32_set_dpstreamclk drm/meson: fix missing component unbind on bind errors drm/amdgpu/nv: Apply ASPM quirk on Intel ADL + AMD Navi drm/i915/active: Fix missing debug object activation drm/i915: Preserve crtc_state->inherited during state clearing drm/amdgpu: skip ASIC reset for APUs when go to S4 drm/amdgpu: reposition the gpu reset checking for reuse riscv: mm: Fix incorrect ASID argument when flushing TLB riscv: Handle zicsr/zifencei issues between clang and binutils tee: amdtee: fix race condition in amdtee_open_session firmware: arm_scmi: Fix device node validation for mailbox transport arm64: dts: qcom: sc7280: Mark PCIe controller as cache coherent arm64: dts: qcom: sm8150: Fix the iommu mask used for PCIe controllers soc: qcom: llcc: Fix slice configuration values for SC8280XP mm/ksm: fix race with VMA iteration and mm_struct teardown bus: imx-weim: fix branch condition evaluates to a garbage value i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer() dm stats: check for and propagate alloc_percpu failure dm crypt: add cond_resched() to dmcrypt_write() dm crypt: avoid accessing uninitialized tasklet sched/fair: sanitize vruntime of entity being placed sched/fair: Sanitize vruntime of entity being migrated drm/amdkfd: introduce dummy cache info for property asic drm/amdkfd: Fix the warning of array-index-out-of-bounds drm/amdkfd: add GC 11.0.4 KFD support drm/amdkfd: Fix the memory overrun Linux 6.1.22 Change-Id: Id13b4655dbfb59c29a0b8953e5e0cda3703f1879 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-03-31 08:15:39 +00:00
Maurizio Lombardi	27f6579f3c	scsi: target: iscsi: Fix an error message in iscsi_check_key() ... [ Upstream commit 6cc55c969b7ce8d85e09a636693d4126c3676c11 ] The first half of the error message is printed by pr_err(), the second half is printed by pr_debug(). The user will therefore see only the first part of the message and will miss some useful information. Link: https://lore.kernel.org/r/20230214141556.762047-1-mlombard@redhat.com Signed-off-by: Maurizio Lombardi <mlombard@redhat.com> Reviewed-by: Mike Christie <michael.christie@oracle.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-03-30 12:49:17 +02:00
Mike Christie	20048acc7b	UPSTREAM: scsi: target: target_core_pscsi: Convert to scsi_execute_cmd() ... scsi_execute_req() is going to be removed. Convert pscsi to scsi_execute_cmd(). Change-Id: I5136c1ec0394c9e4c361eb48fae3d1ad162d6097 Signed-off-by: Mike Christie <michael.christie@oracle.com> Reviewed-by: John Garry <john.g.garry@oracle.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Bug: 267974767 (cherry picked from commit e335795f27d0ab5260e4681f14be8f8c915ac1a7) Signed-off-by: Bart Van Assche <bvanassche@google.com>	2023-03-15 16:17:14 +00:00
Maurizio Lombardi	f6c8f682e5	scsi: target: core: Fix warning on RT kernels ... [ Upstream commit 84ed64b1a7a7fcd507598dee7708c1f225123711 ] Calling spin_lock_irqsave() does not disable the interrupts on realtime kernels, remove the warning and replace assert_spin_locked() with lockdep_assert_held(). Signed-off-by: Maurizio Lombardi <mlombard@redhat.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Link: https://lore.kernel.org/r/20230110125310.55884-1-mlombard@redhat.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-02-09 11:28:12 +01:00
Al Viro	5a19095103	use less confusing names for iov_iter direction initializers ... [ Upstream commit de4eda9de2d957ef2d6a8365a01e26a435e958cb ] READ/WRITE proved to be actively confusing - the meanings are "data destination, as used with read(2)" and "data source, as used with write(2)", but people keep interpreting those as "we read data from it" and "we write data to it", i.e. exactly the wrong way. Call them ITER_DEST and ITER_SOURCE - at least that is harder to misinterpret... Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Stable-dep-of: 6dd88fd59da8 ("vhost-scsi: unbreak any layout for response") Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-02-09 11:28:04 +01:00
Al Viro	02f719be2f	fix iov_iter_bvec() "direction" argument ... [ Upstream commit b676668d99155e6859d99bbf2df18b3f03851902 ] Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Stable-dep-of: 6dd88fd59da8 ("vhost-scsi: unbreak any layout for response") Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-02-09 11:28:03 +01:00
Maurizio Lombardi	3ecdca49ca	scsi: target: iscsi: Fix a race condition between login_work and the login thread ... [ Upstream commit fec1b2fa62c162d03f5dcd7b03e3c89d3116d49f ] In case a malicious initiator sends some random data immediately after a login PDU; the iscsi_target_sk_data_ready() callback will schedule the login_work and, at the same time, the negotiation may end without clearing the LOGIN_FLAGS_INITIAL_PDU flag (because no additional PDU exchanges are required to complete the login). The login has been completed but the login_work function will find the LOGIN_FLAGS_INITIAL_PDU flag set and will never stop from rescheduling itself; at this point, if the initiator drops the connection, the iscsit_conn structure will be freed, login_work will dereference a released socket structure and the kernel crashes. BUG: kernel NULL pointer dereference, address: 0000000000000230 PF: supervisor write access in kernel mode PF: error_code(0x0002) - not-present page Workqueue: events iscsi_target_do_login_rx [iscsi_target_mod] RIP: 0010:_raw_read_lock_bh+0x15/0x30 Call trace: iscsi_target_do_login_rx+0x75/0x3f0 [iscsi_target_mod] process_one_work+0x1e8/0x3c0 Fix this bug by forcing login_work to stop after the login has been completed and the socket callbacks have been restored. Add a comment to clearify the return values of iscsi_target_do_login() Signed-off-by: Maurizio Lombardi <mlombard@redhat.com> Link: https://lore.kernel.org/r/20221115125638.102517-1-mlombard@redhat.com Reviewed-by: Mike Christie <michael.christie@oracle.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-12-31 13:33:06 +01:00
Yang Yingliang	bc68e428d4	scsi: target: tcm_loop: Fix possible name leak in tcm_loop_setup_hba_bus() ... If device_register() fails in tcm_loop_setup_hba_bus(), the name allocated by dev_set_name() need be freed. As comment of device_register() says, it should use put_device() to give up the reference in the error path. So fix this by calling put_device(), then the name can be freed in kobject_cleanup(). The 'tl_hba' will be freed in tcm_loop_release_adapter(), so it don't need goto error label in this case. Fixes: 3703b2c5d0 ("[SCSI] tcm_loop: Add multi-fabric Linux/SCSI LLD fabric module") Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> Link: https://lore.kernel.org/r/20221115015042.3652261-1-yangyingliang@huawei.com Reviewed-by: Mike Christie <michael.chritie@oracle.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>	2022-11-17 17:46:16 +00:00
Martin K. Petersen	47eee861fa	Merge branch '6.1/scsi-queue' into 6.1/scsi-fixes ... Include the patches that weren't included in the 6.1 pull request. Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>	2022-10-21 01:10:34 +00:00
Jason A. Donenfeld	a251c17aa5	treewide: use get_random_u32() when possible ... The prandom_u32() function has been a deprecated inline wrapper around get_random_u32() for several releases now, and compiles down to the exact same code. Replace the deprecated wrapper with a direct call to the real function. The same also applies to get_random_int(), which is just a wrapper around get_random_u32(). This was done as a basic find and replace. Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Reviewed-by: Kees Cook <keescook@chromium.org> Reviewed-by: Yury Norov <yury.norov@gmail.com> Reviewed-by: Jan Kara <jack@suse.cz> # for ext4 Acked-by: Toke Høiland-Jørgensen <toke@toke.dk> # for sch_cake Acked-by: Chuck Lever <chuck.lever@oracle.com> # for nfsd Acked-by: Jakub Kicinski <kuba@kernel.org> Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com> # for thunderbolt Acked-by: Darrick J. Wong <djwong@kernel.org> # for xfs Acked-by: Helge Deller <deller@gmx.de> # for parisc Acked-by: Heiko Carstens <hca@linux.ibm.com> # for s390 Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>	2022-10-11 17:42:58 -06:00
Linus Torvalds	62e6e5940c	SCSI misc on 20221007 ... Updates to the usual drivers (qla2xxx, lpfc, ufs, hisi_sas, mpi3mr, mpt3sas, target); the biggest change (from my biased viewpoint) being that the mpi3mr now attached to the SAS transport class, making it the first fusion type device to do so. Beyond the usual bug fixing and security class reworks, there aren't a huge number of core changes. Signed-off-by: James E.J. Bottomley <jejb@linux.ibm.com> -----BEGIN PGP SIGNATURE----- iJwEABMIAEQWIQTnYEDbdso9F2cI+arnQslM7pishQUCY0B74yYcamFtZXMuYm90 dG9tbGV5QGhhbnNlbnBhcnRuZXJzaGlwLmNvbQAKCRDnQslM7pishW2NAP9CPp2R 7NRmSyxcyVYvtCNUW3WxXh65Gn+KgArmg8XucgEAhUBX1fSjOzpERWEU+UaXitbE Rb+FbjxSc5YxR+nJ/Qc= =0Wlp -----END PGP SIGNATURE----- Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI updates from James Bottomley: "Updates to the usual drivers (qla2xxx, lpfc, ufs, hisi_sas, mpi3mr, mpt3sas, target). The biggest change (from my biased viewpoint) being that the mpi3mr now attached to the SAS transport class, making it the first fusion type device to do so. Beyond the usual bug fixing and security class reworks, there aren't a huge number of core changes" * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (141 commits) scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername() scsi: mpi3mr: Remove unnecessary cast scsi: stex: Properly zero out the passthrough command structure scsi: mpi3mr: Update driver version to 8.2.0.3.0 scsi: mpi3mr: Fix scheduling while atomic type bug scsi: mpi3mr: Scan the devices during resume time scsi: mpi3mr: Free enclosure objects during driver unload scsi: mpi3mr: Handle 0xF003 Fault Code scsi: mpi3mr: Graceful handling of surprise removal of PCIe HBA scsi: mpi3mr: Schedule IRQ kthreads only on non-RT kernels scsi: mpi3mr: Support new power management framework scsi: mpi3mr: Update mpi3 header files scsi: mpt3sas: Revert "scsi: mpt3sas: Fix ioc->base_readl() use" scsi: mpt3sas: Revert "scsi: mpt3sas: Fix writel() use" scsi: wd33c93: Remove dead code related to the long-gone config WD33C93_PIO scsi: core: Add I/O timeout count for SCSI device scsi: qedf: Populate sysfs attributes for vport scsi: pm8001: Replace one-element array with flexible-array member scsi: 3w-xxxx: Replace one-element array with flexible-array member scsi: hptiop: Replace one-element array with flexible-array member in struct hpt_iop_request_ioctl_command() ...	2022-10-07 12:33:18 -07:00
Linus Torvalds	7c989b1da3	for-6.1/passthrough-2022-10-04 ... -----BEGIN PGP SIGNATURE----- iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmM8rp4QHGF4Ym9lQGtl cm5lbC5kawAKCRD301j7KXHgpjTHD/9eeWwaG7oSSu5J1YzkKn+hptaDzZwreL98 Mh8euiQScUVpvHGkNowBhjBZ5cIAAcYaH17rjW7dWu6A7tv/iqygWd/YvIbs1JOe STSD9yf0RV4dI0MG6Wu2w6YxObaLvE5BTRxqb/WuFWNTgsYf2HEp4PM9sTio71+H WwWdRvsIxsRxVYemds3vBxd+BcM8vm26EoUTSaCwRhfopaJwBNceCYIIrM7VHUNM 5G6+DJkm3mB1a8nsdguYZQC/y8F/9P5Ch9CdxA12yOZEryr3wzsyRNGdm7oRmFGM bAkjFcddhwk5+SuTzGX6t4/Z3ODIjeCXbMBg4p7AShHws4Yx1trJePiqoNQ8xd5A PkMfxhQpBPlDFKLmwtObPLInyzMpp5P8KYMIZfyymKD/+XjmqAlR6TXbFUTihzBU lHSFhwG8ysT2cAVrFBMDJu4UPIThIHqfkkF/nTkHePTSArJ/k5rGV7v5sQpZ+jtY R0gvoNHTq2IvgKGEEbTgDjpwVcCn5ERVorZuGjVN2nMdLj35kXpo7YNgyYMaD5LJ 9SOR5a8iQjjudAfdGyZCGzNaOecizVFjABozUYc1XJi/boNuFTsq4XCE/tCLTixc V4sElRpgrlXxNXkiVdbuWIPuYo4sDw5gqZQynpVNH5PkmX/NqmpWYVEWJ20o+pwg 3ag39nZQVQ== =nwLk -----END PGP SIGNATURE----- Merge tag 'for-6.1/passthrough-2022-10-04' of git://git.kernel.dk/linux Pull passthrough updates from Jens Axboe: "With these changes, passthrough NVMe support over io_uring now performs at the same level as block device O_DIRECT, and in many cases 6-8% better. This contains: - Add support for fixed buffers for passthrough (Anuj, Kanchan) - Enable batched allocations and freeing on passthrough, similarly to what we support on the normal storage path (me) - Fix from Geert fixing an issue with !CONFIG_IO_URING" * tag 'for-6.1/passthrough-2022-10-04' of git://git.kernel.dk/linux: io_uring: Add missing inline to io_uring_cmd_import_fixed() dummy nvme: wire up fixed buffer support for nvme passthrough nvme: pass ubuffer as an integer block: extend functionality to map bvec iterator block: factor out blk_rq_map_bio_alloc helper block: rename bio_map_put to blk_mq_map_bio_put nvme: refactor nvme_alloc_request nvme: refactor nvme_add_user_metadata nvme: Use blk_rq_map_user_io helper scsi: Use blk_rq_map_user_io helper block: add blk_rq_map_user_io io_uring: introduce fixed buffer support for io_uring_cmd io_uring: add io_uring_cmd_import_fixed nvme: enable batched completions of passthrough IO nvme: split out metadata vs non metadata end_io uring_cmd completions block: allow end_io based requests in the completion batch handling block: change request end_io handler to pass back a return value block: enable batched allocation for blk_mq_alloc_request() block: kill deprecated BUG_ON() in the flush handling	2022-10-07 09:35:50 -07:00
Christoph Hellwig	f915f58e38	scsi: target: iblock: Fold iblock_emulate_read_cap_with_block_size() into iblock_get_blocks() ... Fold iblock_emulate_read_cap_with_block_size() into its only caller. Link: https://lore.kernel.org/r/20220927082225.271975-1-hch@lst.de Reviewed-by: Mike Christie <michael.christie@oracle.com> Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>	2022-10-01 05:51:47 -04:00
Dmitry Bogdanov	6290e23f3b	scsi: target: core: UA on all LUNs after reset ... Allocate UNIT ATTENTION "BUS DEVICE RESET OCCURRED" on all LUNs on all target ports of the device upon reception of TMF LUN RESET. This change passes libiscsi test SCSI.MultipathIO.Reset. Link: https://lore.kernel.org/r/20220913163602.20597-1-d.bogdanov@yadro.com Signed-off-by: Dmitry Bogdanov <d.bogdanov@yadro.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>	2022-10-01 05:06:53 -04:00
Dmitry Bogdanov	3e2deba7aa	scsi: target: core: New key must be used for moved PR ... According to SPC4 5.12.8: e) Retain the reservation key specified in the SERVICE ACTION RESERVATION KEY field and associated information; But currently sa_res_key is only used for the not existing I_T nexus. Add a changing of the key for the existing I_T nexus the PR moved to. Link: https://lore.kernel.org/r/20220909090425.14479-5-d.bogdanov@yadro.com Reviewed-by: Mike Christie <michael.christie@oracle.com> Signed-off-by: Dmitry Bogdanov <d.bogdanov@yadro.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>	2022-10-01 05:03:57 -04:00
Dmitry Bogdanov	49790e6a58	scsi: target: core: Abort all preempted regs if requested ... According to SPC the preempted commands shall be always aborted. SPC-4: 5.12.11.2.6 Preempting and aborting c) all commands from the I_T nexus(es) associated with the persistent reservations or registrations being preempted (i.e., preempted commands) except the PERSISTENT RESERVE OUT command itself shall be aborted as defined in SAM-5; Link: https://lore.kernel.org/r/20220909090425.14479-4-d.bogdanov@yadro.com Reviewed-by: Mike Christie <michael.christie@oracle.com> Signed-off-by: Dmitry Bogdanov <d.bogdanov@yadro.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>	2022-10-01 05:03:57 -04:00
Dmitry Bogdanov	f050a7c66c	scsi: target: core: Fix memory leak in preempt_and_abort ... Always release preempt_and_abort_list to avoid memory leak of t10_pr_registration objects in it. Link: https://lore.kernel.org/r/20220909090425.14479-3-d.bogdanov@yadro.com Reviewed-by: Mike Christie <michael.christie@oracle.com> Signed-off-by: Dmitry Bogdanov <d.bogdanov@yadro.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>	2022-10-01 05:03:57 -04:00
Dmitry Bogdanov	1f1009ea8c	scsi: target: core: Fix preempt and abort for allreg res ... Match a key only if SARK is not zero according to SPC-4 and the comment above the code: If an all registrants persistent reservation is present and the SERVICE ACTION RESERVATION KEY field is set to zero, then all registrations shall be removed except for that of the I_T nexus that is being used for the PERSISTENT RESERVE OUT command; Without this patch in case of SARK==0 no registrants will be removed. Link: https://lore.kernel.org/r/20220909090425.14479-2-d.bogdanov@yadro.com Reviewed-by: Mike Christie <michael.christie@oracle.com> Signed-off-by: Dmitry Bogdanov <d.bogdanov@yadro.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>	2022-10-01 05:03:56 -04:00
Jens Axboe	de671d6116	block: change request end_io handler to pass back a return value ... Everything is just converted to returning RQ_END_IO_NONE, and there should be no functional changes with this patch. In preparation for allowing the end_io handler to pass ownership back to the block layer, rather than retain ownership of the request. Reviewed-by: Keith Busch <kbusch@kernel.org> Signed-off-by: Jens Axboe <axboe@kernel.dk>	2022-09-30 07:49:09 -06:00
Gaosheng Cui	4663509304	scsi: target: Remove unused se_tmr_req_cache declaration ... se_tmr_req_cache has been removed since commit c8e31f26fe ("target: Add SCF_SCSI_TMR_CDB usage and drop se_tmr_req_cache"). Remove extern. Link: https://lore.kernel.org/r/20220913023722.547249-3-cuigaosheng1@huawei.com Signed-off-by: Gaosheng Cui <cuigaosheng1@huawei.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>	2022-09-15 21:46:46 -04:00
Dmitry Bogdanov	f04e47e770	scsi: target: alua: Do not report emtpy port group ... The default target port group is always returned in the list of port groups, even if the behaviour is unwanted, i.e. it has no members and non-default port groups are primary port groups. That violates SPC-4 "6.37 REPORT TARGET PORT GROUPS command": Every target port group shall contain at least one target port. The target port group descriptor shall include one target port descriptor for each target port in the target port group. This patch hides port groups with no ports in REPORT TARGET PORT GROUPS response. Link: https://lore.kernel.org/r/20220912214549.27882-1-d.bogdanov@yadro.com Signed-off-by: Dmitry Bogdanov <d.bogdanov@yadro.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>	2022-09-15 21:42:44 -04:00
Dmitry Bogdanov	5bdd4a8e5c	scsi: target: core: Set MULTIP bit for se_device with multiple ports ... SAM-5 4.8.3 (SCSI target device with multiple SCSI ports structure) obligates to set MULTIP bit when there's multiple SCSI target ports: Each device server shall indicate the presence of multiple SCSI target ports by setting the MULTIP bit to one in its standard INQUIRY data (see SPC-4). Set MULTIP bit automatically to indicate the presence of multiple SCSI target ports within standard inquiry response data if there are multiple target ports in all target port groups of the se_device. Link: https://lore.kernel.org/r/20220912125457.22573-2-d.bogdanov@yadro.com Reviewed-by: Mike Christie <michael.christie@oracle.com> Co-developed-by: Roman Bolshakov <r.bolshakov@yadro.com> Signed-off-by: Roman Bolshakov <r.bolshakov@yadro.com> Signed-off-by: Dmitry Bogdanov <d.bogdanov@yadro.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>	2022-09-15 21:40:58 -04:00
Shaomin Deng	e699bb9765	scsi: target: pscsi: Remove repeated word "calling" ... There is repeated word, remove it. Link: https://lore.kernel.org/r/20220811153923.17278-1-dengshaomin@cdjrlc.com Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com> Signed-off-by: Shaomin Deng <dengshaomin@cdjrlc.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>	2022-09-01 00:47:52 -04:00
Jakub Kicinski	9c5d03d362	genetlink: start to validate reserved header bytes ... We had historically not checked that genlmsghdr.reserved is 0 on input which prevents us from using those precious bytes in the future. One use case would be to extend the cmd field, which is currently just 8 bits wide and 256 is not a lot of commands for some core families. To make sure that new families do the right thing by default put the onus of opting out of validation on existing families. Signed-off-by: Jakub Kicinski <kuba@kernel.org> Acked-by: Paul Moore <paul@paul-moore.com> (NetLabel) Signed-off-by: David S. Miller <davem@davemloft.net>	2022-08-29 12:47:15 +01:00
Linus Torvalds	e140f731f9	SCSI misc on 20220813 ... Mostly small bug fixes and trivial updates. The major new core update is a change to the way device, target and host reference counting is done to try to make it more robust (this change has soaked for a while to try to winkle out any bugs). Signed-off-by: James E.J. Bottomley <jejb@linux.ibm.com> -----BEGIN PGP SIGNATURE----- iJwEABMIAEQWIQTnYEDbdso9F2cI+arnQslM7pishQUCYveemSYcamFtZXMuYm90 dG9tbGV5QGhhbnNlbnBhcnRuZXJzaGlwLmNvbQAKCRDnQslM7pisheaiAP9DPQ70 7hEdak6evXUwlWwlVBvEFAfZlzpHN+uNzUCvpgD+N61RSPhHV1hXu12sVMmjMNEb pow+ee47Mc0t/OO68jA= =1yQh -----END PGP SIGNATURE----- Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull more SCSI updates from James Bottomley: "Mostly small bug fixes and trivial updates. The major new core update is a change to the way device, target and host reference counting is done to try to make it more robust (this change has soaked for a while to try to winkle out any bugs)" * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: pm8001: Fix typo 'the the' in comment scsi: megaraid_sas: Remove redundant variable cmd_type scsi: FlashPoint: Remove redundant variable bm_int_st scsi: zfcp: Fix missing auto port scan and thus missing target ports scsi: core: Call blk_mq_free_tag_set() earlier scsi: core: Simplify LLD module reference counting scsi: core: Make sure that hosts outlive targets scsi: core: Make sure that targets outlive devices scsi: ufs: ufs-pci: Correct check for RESET DSM scsi: target: core: De-RCU of se_lun and se_lun acl scsi: target: core: Fix race during ACL removal scsi: ufs: core: Correct ufshcd_shutdown() flow scsi: ufs: core: Increase the maximum data buffer size scsi: lpfc: Check the return value of alloc_workqueue()	2022-08-13 13:41:48 -07:00