Commit Graph

9233 Commits

Author SHA1 Message Date
Greg Kroah-Hartman
50874c58d8 Merge 6.1.47 into android14-6.1-lts
Changes in 6.1.47
	mmc: sdhci-f-sdh30: Replace with sdhci_pltfm
	cpuidle: psci: Extend information in log about OSI/PC mode
	cpuidle: psci: Move enabling OSI mode after power domains creation
	zsmalloc: consolidate zs_pool's migrate_lock and size_class's locks
	zsmalloc: fix races between modifications of fullness and isolated
	selftests: forwarding: tc_actions: cleanup temporary files when test is aborted
	selftests: forwarding: tc_actions: Use ncat instead of nc
	net/smc: replace mutex rmbs_lock and sndbufs_lock with rw_semaphore
	net/smc: Fix setsockopt and sysctl to specify same buffer size again
	net: phy: at803x: Use devm_regulator_get_enable_optional()
	net: phy: at803x: fix the wol setting functions
	drm/amdgpu: fix calltrace warning in amddrm_buddy_fini
	drm/amdgpu: Fix integer overflow in amdgpu_cs_pass1
	drm/amdgpu: fix memory leak in mes self test
	ASoC: Intel: sof_sdw: add quirk for MTL RVP
	ASoC: Intel: sof_sdw: add quirk for LNL RVP
	PCI: tegra194: Fix possible array out of bounds access
	ASoC: SOF: amd: Add pci revision id check
	drm/stm: ltdc: fix late dereference check
	drm: rcar-du: remove R-Car H3 ES1.* workarounds
	ASoC: amd: vangogh: Add check for acp config flags in vangogh platform
	ARM: dts: imx6dl: prtrvt, prtvt7, prti6q, prtwd2: fix USB related warnings
	ASoC: Intel: sof_sdw_rt_sdca_jack_common: test SOF_JACK_JDSRC in _exit
	ASoC: Intel: sof_sdw: Add support for Rex soundwire
	iopoll: Call cpu_relax() in busy loops
	ASoC: SOF: Intel: fix SoundWire/HDaudio mutual exclusion
	dma-remap: use kvmalloc_array/kvfree for larger dma memory remap
	accel/habanalabs: add pci health check during heartbeat
	HID: logitech-hidpp: Add USB and Bluetooth IDs for the Logitech G915 TKL Keyboard
	iommu/amd: Introduce Disable IRTE Caching Support
	drm/amdgpu: install stub fence into potential unused fence pointers
	drm/amd/display: Apply 60us prefetch for DCFCLK <= 300Mhz
	RDMA/mlx5: Return the firmware result upon destroying QP/RQ
	drm/amd/display: Skip DPP DTO update if root clock is gated
	drm/amd/display: Enable dcn314 DPP RCO
	ASoC: SOF: core: Free the firmware trace before calling snd_sof_shutdown()
	HID: intel-ish-hid: ipc: Add Arrow Lake PCI device ID
	ALSA: hda/realtek: Add quirks for ROG ALLY CS35l41 audio
	smb: client: fix warning in cifs_smb3_do_mount()
	cifs: fix session state check in reconnect to avoid use-after-free issue
	serial: stm32: Ignore return value of uart_remove_one_port() in .remove()
	led: qcom-lpg: Fix resource leaks in for_each_available_child_of_node() loops
	media: v4l2-mem2mem: add lock to protect parameter num_rdy
	media: camss: set VFE bpl_alignment to 16 for sdm845 and sm8250
	usb: gadget: u_serial: Avoid spinlock recursion in __gs_console_push
	usb: gadget: uvc: queue empty isoc requests if no video buffer is available
	media: platform: mediatek: vpu: fix NULL ptr dereference
	thunderbolt: Read retimer NVM authentication status prior tb_retimer_set_inbound_sbtx()
	usb: chipidea: imx: don't request QoS for imx8ulp
	usb: chipidea: imx: add missing USB PHY DPDM wakeup setting
	gfs2: Fix possible data races in gfs2_show_options()
	pcmcia: rsrc_nonstatic: Fix memory leak in nonstatic_release_resource_db()
	thunderbolt: Add Intel Barlow Ridge PCI ID
	thunderbolt: Limit Intel Barlow Ridge USB3 bandwidth
	firewire: net: fix use after free in fwnet_finish_incoming_packet()
	watchdog: sp5100_tco: support Hygon FCH/SCH (Server Controller Hub)
	Bluetooth: L2CAP: Fix use-after-free
	Bluetooth: btusb: Add MT7922 bluetooth ID for the Asus Ally
	ceph: try to dump the msgs when decoding fails
	drm/amdgpu: Fix potential fence use-after-free v2
	fs/ntfs3: Enhance sanity check while generating attr_list
	fs: ntfs3: Fix possible null-pointer dereferences in mi_read()
	fs/ntfs3: Mark ntfs dirty when on-disk struct is corrupted
	ALSA: hda/realtek: Add quirks for Unis H3C Desktop B760 & Q760
	ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync()
	ALSA: hda/realtek: Add quirk for ASUS ROG GX650P
	ALSA: hda/realtek: Add quirk for ASUS ROG GA402X
	ALSA: hda/realtek: Add quirk for ASUS ROG GZ301V
	powerpc/kasan: Disable KCOV in KASAN code
	Bluetooth: MGMT: Use correct address for memcpy()
	ring-buffer: Do not swap cpu_buffer during resize process
	igc: read before write to SRRCTL register
	drm/amd/display: save restore hdcp state when display is unplugged from mst hub
	drm/amd/display: phase3 mst hdcp for multiple displays
	drm/amd/display: fix access hdcp_workqueue assert
	KVM: arm64: vgic-v4: Make the doorbell request robust w.r.t preemption
	ARM: dts: nxp/imx6sll: fix wrong property name in usbphy node
	fbdev/hyperv-fb: Do not set struct fb_info.apertures
	video/aperture: Only remove sysfb on the default vga pci device
	btrfs: move out now unused BG from the reclaim list
	btrfs: convert btrfs_block_group::needs_free_space to runtime flag
	btrfs: convert btrfs_block_group::seq_zone to runtime flag
	btrfs: fix use-after-free of new block group that became unused
	virtio-mmio: don't break lifecycle of vm_dev
	vduse: Use proper spinlock for IRQ injection
	vdpa/mlx5: Fix mr->initialized semantics
	vdpa/mlx5: Delete control vq iotlb in destroy_mr only when necessary
	cifs: fix potential oops in cifs_oplock_break
	i2c: bcm-iproc: Fix bcm_iproc_i2c_isr deadlock issue
	i2c: hisi: Only handle the interrupt of the driver's transfer
	i2c: tegra: Fix i2c-tegra DMA config option processing
	fbdev: mmp: fix value check in mmphw_probe()
	powerpc/rtas_flash: allow user copy to flash block cache objects
	vdpa: Add features attr to vdpa_nl_policy for nlattr length check
	vdpa: Add queue index attr to vdpa_nl_policy for nlattr length check
	vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check
	vdpa: Enable strict validation for netlinks ops
	tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux
	tty: serial: fsl_lpuart: Clear the error flags by writing 1 for lpuart32 platforms
	btrfs: fix incorrect splitting in btrfs_drop_extent_map_range
	btrfs: fix BUG_ON condition in btrfs_cancel_balance
	i2c: designware: Correct length byte validation logic
	i2c: designware: Handle invalid SMBus block data response length value
	net: xfrm: Fix xfrm_address_filter OOB read
	net: af_key: fix sadb_x_filter validation
	net: xfrm: Amend XFRMA_SEC_CTX nla_policy structure
	xfrm: fix slab-use-after-free in decode_session6
	ip6_vti: fix slab-use-after-free in decode_session6
	ip_vti: fix potential slab-use-after-free in decode_session6
	xfrm: add NULL check in xfrm_update_ae_params
	xfrm: add forgotten nla_policy for XFRMA_MTIMER_THRESH
	virtio_net: notify MAC address change on device initialization
	virtio-net: set queues after driver_ok
	net: pcs: Add missing put_device call in miic_create
	net: phy: fix IRQ-based wake-on-lan over hibernate / power off
	selftests: mirror_gre_changes: Tighten up the TTL test match
	drm/panel: simple: Fix AUO G121EAN01 panel timings according to the docs
	net: macb: In ZynqMP resume always configure PS GTR for non-wakeup source
	octeon_ep: cancel tx_timeout_task later in remove sequence
	netfilter: nf_tables: fix false-positive lockdep splat
	netfilter: nf_tables: deactivate catchall elements in next generation
	ipvs: fix racy memcpy in proc_do_sync_threshold
	netfilter: nft_dynset: disallow object maps
	net: phy: broadcom: stub c45 read/write for 54810
	team: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves
	net: openvswitch: reject negative ifindex
	iavf: fix FDIR rule fields masks validation
	i40e: fix misleading debug logs
	net: dsa: mv88e6xxx: Wait for EEPROM done before HW reset
	sfc: don't unregister flow_indr if it was never registered
	sock: Fix misuse of sk_under_memory_pressure()
	net: do not allow gso_size to be set to GSO_BY_FRAGS
	qede: fix firmware halt over suspend and resume
	ice: Block switchdev mode when ADQ is active and vice versa
	bus: ti-sysc: Flush posted write on enable before reset
	arm64: dts: qcom: qrb5165-rb5: fix thermal zone conflict
	arm64: dts: rockchip: Disable HS400 for eMMC on ROCK Pi 4
	arm64: dts: rockchip: Disable HS400 for eMMC on ROCK 4C+
	ARM: dts: imx: align LED node names with dtschema
	ARM: dts: imx6: phytec: fix RTC interrupt level
	arm64: dts: imx8mm: Drop CSI1 PHY reference clock configuration
	ARM: dts: imx: Set default tuning step for imx6sx usdhc
	arm64: dts: imx93: Fix anatop node size
	ASoC: rt5665: add missed regulator_bulk_disable
	ASoC: meson: axg-tdm-formatter: fix channel slot allocation
	ALSA: hda/realtek: Add quirks for HP G11 Laptops
	soc: aspeed: uart-routing: Use __sysfs_match_string
	soc: aspeed: socinfo: Add kfree for kstrdup
	ALSA: hda/realtek - Remodified 3k pull low procedure
	riscv: uaccess: Return the number of bytes effectively not copied
	serial: 8250: Fix oops for port->pm on uart_change_pm()
	ALSA: usb-audio: Add support for Mythware XA001AU capture and playback interfaces.
	cifs: Release folio lock on fscache read hit.
	virtio-net: Zero max_tx_vq field for VIRTIO_NET_CTRL_MQ_HASH_CONFIG case
	arm64: dts: rockchip: Fix Wifi/Bluetooth on ROCK Pi 4 boards
	blk-crypto: dynamically allocate fallback profile
	mmc: wbsd: fix double mmc_free_host() in wbsd_init()
	mmc: block: Fix in_flight[issue_type] value error
	drm/qxl: fix UAF on handle creation
	drm/i915/sdvo: fix panel_type initialization
	drm/amd: flush any delayed gfxoff on suspend entry
	drm/amdgpu: skip fence GFX interrupts disable/enable for S0ix
	drm/amdgpu/pm: fix throttle_status for other than MP1 11.0.7
	ASoC: amd: vangogh: select CONFIG_SND_AMD_ACP_CONFIG
	drm/amd/display: disable RCO for DCN314
	zsmalloc: allow only one active pool compaction context
	sched/fair: unlink misfit task from cpu overutilized
	sched/fair: Remove capacity inversion detection
	drm/amd/display: Implement workaround for writing to OTG_PIXEL_RATE_DIV register
	hugetlb: do not clear hugetlb dtor until allocating vmemmap
	netfilter: set default timeout to 3 secs for sctp shutdown send and recv state
	arm64/ptrace: Ensure that SME is set up for target when writing SSVE state
	drm/amd/pm: skip the RLC stop when S0i3 suspend for SMU v13.0.4/11
	drm/amdgpu: keep irq count in amdgpu_irq_disable_all
	af_unix: Fix null-ptr-deref in unix_stream_sendpage().
	drm/nouveau/disp: fix use-after-free in error handling of nouveau_connector_create
	net: fix the RTO timer retransmitting skb every 1ms if linear option is enabled
	mmc: f-sdh30: fix order of function calls in sdhci_f_sdh30_remove
	Linux 6.1.47

Change-Id: I7c55c71f43f88a1d44d39c835e3f6e58d4c86279
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-09-13 19:35:46 +00:00
Thomas Zimmermann
47636d32a0 backlight/lv5207lp: Compare against struct fb_info.device
commit 1ca8819320fd84e7d95b04e7668efc5f9fe9fa5c upstream.

Struct lv5207lp_platform_data refers to a platform device within
the Linux device hierarchy. The test in lv5207lp_backlight_check_fb()
compares it against the fbdev device in struct fb_info.dev, which
is different. Fix the test by comparing to struct fb_info.device.

Fixes a bug in the backlight driver and prepares fbdev for making
struct fb_info.dev optional.

v2:
	* move renames into separate patch (Javier, Sam, Michael)

Fixes: 82e5c40d88 ("backlight: Add Sanyo LV5207LP backlight driver")
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Cc: Yoshinori Sato <ysato@users.sourceforge.jp>
Cc: Rich Felker <dalias@libc.org>
Cc: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Cc: Lee Jones <lee@kernel.org>
Cc: Daniel Thompson <daniel.thompson@linaro.org>
Cc: Jingoo Han <jingoohan1@gmail.com>
Cc: linux-sh@vger.kernel.org
Cc: dri-devel@lists.freedesktop.org
Cc: <stable@vger.kernel.org> # v3.12+
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Reviewed-by: Sam Ravnborg <sam@ravnborg.org>
Reviewed-by: Daniel Thompson <daniel.thompson@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20230613110953.24176-6-tzimmermann@suse.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-09-13 09:43:01 +02:00
Thomas Zimmermann
83166d03a5 backlight/bd6107: Compare against struct fb_info.device
commit 992bdddaabfba19bdc77c1c7a4977b2aa41ec891 upstream.

Struct bd6107_platform_data refers to a platform device within
the Linux device hierarchy. The test in bd6107_backlight_check_fb()
compares it against the fbdev device in struct fb_info.dev, which
is different. Fix the test by comparing to struct fb_info.device.

Fixes a bug in the backlight driver and prepares fbdev for making
struct fb_info.dev optional.

v2:
	* move renames into separate patch (Javier, Sam, Michael)

Fixes: 67b43e5904 ("backlight: Add ROHM BD6107 backlight driver")
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Cc: Lee Jones <lee@kernel.org>
Cc: Daniel Thompson <daniel.thompson@linaro.org>
Cc: Jingoo Han <jingoohan1@gmail.com>
Cc: dri-devel@lists.freedesktop.org
Cc: <stable@vger.kernel.org> # v3.12+
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Reviewed-by: Sam Ravnborg <sam@ravnborg.org>
Reviewed-by: Daniel Thompson <daniel.thompson@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20230613110953.24176-2-tzimmermann@suse.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-09-13 09:43:00 +02:00
Thomas Zimmermann
b4ab337aad backlight/gpio_backlight: Compare against struct fb_info.device
commit 7b91d017f77c1bda56f27c2f4bbb70de7c6eca08 upstream.

Struct gpio_backlight_platform_data refers to a platform device within
the Linux device hierarchy. The test in gpio_backlight_check_fb()
compares it against the fbdev device in struct fb_info.dev, which
is different. Fix the test by comparing to struct fb_info.device.

Fixes a bug in the backlight driver and prepares fbdev for making
struct fb_info.dev optional.

v2:
	* move renames into separate patch (Javier, Sam, Michael)

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Fixes: 8b770e3c98 ("backlight: Add GPIO-based backlight driver")
Cc: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Cc: Rich Felker <dalias@libc.org>
Cc: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Cc: Lee Jones <lee@kernel.org>
Cc: Daniel Thompson <daniel.thompson@linaro.org>
Cc: Jingoo Han <jingoohan1@gmail.com>
Cc: linux-sh@vger.kernel.org
Cc: dri-devel@lists.freedesktop.org
Cc: <stable@vger.kernel.org> # v3.12+
Reviewed-by: Sam Ravnborg <sam@ravnborg.org>
Reviewed-by: Daniel Thompson <daniel.thompson@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20230613110953.24176-4-tzimmermann@suse.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-09-13 09:43:00 +02:00
Greg Kroah-Hartman
8976ff249f Merge 6.1.42 into android14-6.1-lts
Changes in 6.1.42
	io_uring: treat -EAGAIN for REQ_F_NOWAIT as final for io-wq
	ALSA: hda/realtek - remove 3k pull low procedure
	ALSA: hda/realtek: Add quirk for Clevo NS70AU
	ALSA: hda/realtek: Enable Mute LED on HP Laptop 15s-eq2xxx
	maple_tree: set the node limit when creating a new root node
	maple_tree: fix node allocation testing on 32 bit
	keys: Fix linking a duplicate key to a keyring's assoc_array
	perf probe: Add test for regression introduced by switch to die_get_decl_file()
	btrfs: fix warning when putting transaction with qgroups enabled after abort
	fuse: revalidate: don't invalidate if interrupted
	fuse: Apply flags2 only when userspace set the FUSE_INIT_EXT
	btrfs: set_page_extent_mapped after read_folio in btrfs_cont_expand
	btrfs: zoned: fix memory leak after finding block group with super blocks
	fuse: ioctl: translate ENOSYS in outarg
	btrfs: fix race between balance and cancel/pause
	selftests: tc: set timeout to 15 minutes
	selftests: tc: add 'ct' action kconfig dep
	regmap: Drop initial version of maximum transfer length fixes
	of: Preserve "of-display" device name for compatibility
	regmap: Account for register length in SMBus I/O limits
	arm64/fpsimd: Ensure SME storage is allocated after SVE VL changes
	can: mcp251xfd: __mcp251xfd_chip_set_mode(): increase poll timeout
	can: bcm: Fix UAF in bcm_proc_show()
	can: gs_usb: gs_can_open(): improve error handling
	selftests: tc: add ConnTrack procfs kconfig
	dma-buf/dma-resv: Stop leaking on krealloc() failure
	drm/amdgpu/vkms: relax timer deactivation by hrtimer_try_to_cancel
	drm/amdgpu/pm: make gfxclock consistent for sienna cichlid
	drm/amdgpu/pm: make mclk consistent for smu 13.0.7
	drm/client: Fix memory leak in drm_client_target_cloned
	drm/client: Fix memory leak in drm_client_modeset_probe
	drm/amd/display: only accept async flips for fast updates
	drm/amd/display: Disable MPC split by default on special asic
	drm/amd/display: check TG is non-null before checking if enabled
	drm/amd/display: Keep PHY active for DP displays on DCN31
	ASoC: fsl_sai: Disable bit clock with transmitter
	ASoC: fsl_sai: Revert "ASoC: fsl_sai: Enable MCTL_MCLK_EN bit for master mode"
	ASoC: tegra: Fix ADX byte map
	ASoC: rt5640: Fix sleep in atomic context
	ASoC: cs42l51: fix driver to properly autoload with automatic module loading
	ASoC: codecs: wcd938x: fix missing clsh ctrl error handling
	ASoC: codecs: wcd-mbhc-v2: fix resource leaks on component remove
	ASoC: qdsp6: audioreach: fix topology probe deferral
	ASoC: tegra: Fix AMX byte map
	ASoC: codecs: wcd938x: fix resource leaks on component remove
	ASoC: codecs: wcd938x: fix missing mbhc init error handling
	ASoC: codecs: wcd934x: fix resource leaks on component remove
	ASoC: codecs: wcd938x: fix codec initialisation race
	ASoC: codecs: wcd938x: fix soundwire initialisation race
	ext4: correct inline offset when handling xattrs in inode body
	drm/radeon: Fix integer overflow in radeon_cs_parser_init
	ALSA: emu10k1: roll up loops in DSP setup code for Audigy
	quota: Properly disable quotas when add_dquot_ref() fails
	quota: fix warning in dqgrab()
	HID: add quirk for 03f0:464a HP Elite Presenter Mouse
	ovl: check type and offset of struct vfsmount in ovl_entry
	udf: Fix uninitialized array access for some pathnames
	fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev
	MIPS: dec: prom: Address -Warray-bounds warning
	FS: JFS: Fix null-ptr-deref Read in txBegin
	FS: JFS: Check for read-only mounted filesystem in txBegin
	ACPI: video: Add backlight=native DMI quirk for Dell Studio 1569
	rcu-tasks: Avoid pr_info() with spin lock in cblist_init_generic()
	rcu: Mark additional concurrent load from ->cpu_no_qs.b.exp
	sched/fair: Don't balance task to its current running CPU
	wifi: ath11k: fix registration of 6Ghz-only phy without the full channel range
	bpf: Print a warning only if writing to unprivileged_bpf_disabled.
	bpf: Address KCSAN report on bpf_lru_list
	bpf: tcp: Avoid taking fast sock lock in iterator
	wifi: ath11k: add support default regdb while searching board-2.bin for WCN6855
	wifi: mac80211_hwsim: Fix possible NULL dereference
	spi: dw: Add compatible for Intel Mount Evans SoC
	wifi: ath11k: fix memory leak in WMI firmware stats
	net: ethernet: litex: add support for 64 bit stats
	devlink: report devlink_port_type_warn source device
	wifi: wext-core: Fix -Wstringop-overflow warning in ioctl_standard_iw_point()
	wifi: iwlwifi: Add support for new PCI Id
	wifi: iwlwifi: mvm: avoid baid size integer overflow
	wifi: iwlwifi: pcie: add device id 51F1 for killer 1675
	igb: Fix igb_down hung on surprise removal
	net: hns3: fix strncpy() not using dest-buf length as length issue
	ASoC: amd: acp: fix for invalid dai id handling in acp_get_byte_count()
	ASoC: codecs: wcd938x: fix mbhc impedance loglevel
	ASoC: codecs: wcd938x: fix dB range for HPHL and HPHR
	ASoC: qcom: q6apm: do not close GPR port before closing graph
	sched/fair: Use recent_used_cpu to test p->cpus_ptr
	sched/psi: Fix avgs_work re-arm in psi_avgs_work()
	sched/psi: Rearrange polling code in preparation
	sched/psi: Rename existing poll members in preparation
	sched/psi: Extract update_triggers side effect
	sched/psi: Allow unprivileged polling of N*2s period
	sched/psi: use kernfs polling functions for PSI trigger polling
	pinctrl: renesas: rzv2m: Handle non-unique subnode names
	pinctrl: renesas: rzg2l: Handle non-unique subnode names
	spi: bcm63xx: fix max prepend length
	fbdev: imxfb: warn about invalid left/right margin
	fbdev: imxfb: Removed unneeded release_mem_region
	perf build: Fix library not found error when using CSLIBS
	btrfs: be a bit more careful when setting mirror_num_ret in btrfs_map_block
	spi: s3c64xx: clear loopback bit after loopback test
	kallsyms: Improve the performance of kallsyms_lookup_name()
	kallsyms: Correctly sequence symbols when CONFIG_LTO_CLANG=y
	kallsyms: strip LTO-only suffixes from promoted global functions
	dsa: mv88e6xxx: Do a final check before timing out
	net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field()/cpsw_ale_set_field()
	bridge: Add extack warning when enabling STP in netns.
	net: ethernet: mtk_eth_soc: handle probe deferral
	cifs: fix mid leak during reconnection after timeout threshold
	ASoC: SOF: ipc3-dtrace: uninitialized data in dfsentry_trace_filter_write()
	net: sched: cls_matchall: Undo tcf_bind_filter in case of failure after mall_set_parms
	net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode
	net: sched: cls_u32: Undo refcount decrement in case update failed
	net: sched: cls_bpf: Undo tcf_bind_filter in case of an error
	net: dsa: microchip: ksz8: Separate static MAC table operations for code reuse
	net: dsa: microchip: ksz8: Make ksz8_r_sta_mac_table() static
	net: dsa: microchip: ksz8_r_sta_mac_table(): Avoid using error code for empty entries
	net: dsa: microchip: correct KSZ8795 static MAC table access
	iavf: Fix use-after-free in free_netdev
	iavf: Fix out-of-bounds when setting channels on remove
	iavf: use internal state to free traffic IRQs
	iavf: Move netdev_update_features() into watchdog task
	iavf: send VLAN offloading caps once after VFR
	iavf: make functions static where possible
	iavf: Wait for reset in callbacks which trigger it
	iavf: fix a deadlock caused by rtnl and driver's lock circular dependencies
	iavf: fix reset task race with iavf_remove()
	security: keys: Modify mismatched function name
	octeontx2-pf: Dont allocate BPIDs for LBK interfaces
	bpf: Fix subprog idx logic in check_max_stack_depth
	bpf: Repeat check_max_stack_depth for async callbacks
	bpf, arm64: Fix BTI type used for freplace attached functions
	igc: Avoid transmit queue timeout for XDP
	igc: Prevent garbled TX queue with XDP ZEROCOPY
	net: ipv4: use consistent txhash in TIME_WAIT and SYN_RECV
	tcp: annotate data-races around tcp_rsk(req)->txhash
	tcp: annotate data-races around tcp_rsk(req)->ts_recent
	net: ipv4: Use kfree_sensitive instead of kfree
	net:ipv6: check return value of pskb_trim()
	Revert "tcp: avoid the lookup process failing to get sk in ehash table"
	fbdev: au1200fb: Fix missing IRQ check in au1200fb_drv_probe
	llc: Don't drop packet from non-root netns.
	ALSA: hda/realtek: Fix generic fixup definition for cs35l41 amp
	netfilter: nf_tables: fix spurious set element insertion failure
	netfilter: nf_tables: can't schedule in nft_chain_validate
	netfilter: nft_set_pipapo: fix improper element removal
	netfilter: nf_tables: skip bound chain in netns release path
	netfilter: nf_tables: skip bound chain on rule flush
	Bluetooth: use RCU for hci_conn_params and iterate safely in hci_sync
	Bluetooth: hci_event: call disconnect callback before deleting conn
	Bluetooth: ISO: fix iso_conn related locking and validity issues
	Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor()
	tcp: annotate data-races around tp->tcp_tx_delay
	tcp: annotate data-races around tp->tsoffset
	tcp: annotate data-races around tp->keepalive_time
	tcp: annotate data-races around tp->keepalive_intvl
	tcp: annotate data-races around tp->keepalive_probes
	tcp: annotate data-races around icsk->icsk_syn_retries
	tcp: annotate data-races around tp->linger2
	tcp: annotate data-races around rskq_defer_accept
	tcp: annotate data-races around tp->notsent_lowat
	tcp: annotate data-races around icsk->icsk_user_timeout
	tcp: annotate data-races around fastopenq.max_qlen
	net: phy: prevent stale pointer dereference in phy_init()
	jbd2: recheck chechpointing non-dirty buffer
	tracing/histograms: Return an error if we fail to add histogram to hist_vars list
	drm/ttm: fix bulk_move corruption when adding a entry
	spi: dw: Remove misleading comment for Mount Evans SoC
	kallsyms: add kallsyms_seqs_of_names to list of special symbols
	scripts/kallsyms.c Make the comment up-to-date with current implementation
	scripts/kallsyms: update the usage in the comment block
	bpf: allow precision tracking for programs with subprogs
	bpf: stop setting precise in current state
	bpf: aggressively forget precise markings during state checkpointing
	selftests/bpf: make test_align selftest more robust
	selftests/bpf: Workaround verification failure for fexit_bpf2bpf/func_replace_return_code
	selftests/bpf: Fix sk_assign on s390x
	drm/amd/display: use max_dsc_bpp in amdgpu_dm
	drm/amd/display: fix some coding style issues
	drm/dp_mst: Clear MSG_RDY flag before sending new message
	drm/amd/display: force connector state when bpc changes during compliance
	drm/amd/display: Clean up errors & warnings in amdgpu_dm.c
	drm/amd/display: fix linux dp link lost handled only one time
	drm/amd/display: Add polling method to handle MST reply packet
	Revert "drm/amd/display: edp do not add non-edid timings"
	Linux 6.1.42

Change-Id: I6b7257a16f9a025d0c23dfd3eb43317c1c164a93
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-09-06 10:23:12 +00:00
Greg Kroah-Hartman
b435525822 This is the 6.1.39 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmS38qMACgkQONu9yGCS
 aT56yQ//ZuDuw8Ev3HISVgZhE9FpuXC1RSYXiMCAvwA9rH3KnJ4wKVPEhEWLy9P4
 jdJaatSLbLOvA7ME7JnwZxz2qahjBxo1tpx6u2S3zrzz4UlAPNLwCxTxxp4X07VI
 3fBNvsmucqFSayCrA8t9xgkaJizuCvHZm7eSoyVIigPwbB5igc2b+bNSRcx1Zo+j
 SHl4Y4nGK8a47XU9RSlDLVKow0/6rrQLHQ9DLpxACArRHw3h451vD0DMcgOuU/Uv
 6qq9u3COcdVw3oc5VENu9XklPmvQkxo3RaCUHyRadVstuc0H/BBUDvEhPn5PcVOV
 EdBWlTjmhsQo0aUziK4kotLNeX1VRgKa+rrIUBJn68OHv1SRRPZU/eJ8hkL81dCi
 FDPzXDOszixO7pPv1jj7O9kNcwKPuiHPmdaNPCY6jviOHhZnAEub44DpQamxWvU/
 kb5MZRRY72wt9iWeI3kscCCSbf6eyjlmDMoYIeLuYn10n7gIDU80eUOBl9bqEsz/
 X+OUxaY+XuKbCoucpNmSHHLmynJ5D0CXhl/5qnlgMoSo4UJ5BUIMj2e3ZqsKLfrR
 e/09MCRX79y9J+TxUunnQZfq5vBlH1tRsvUyhIfYfW4AaC9BrkOL2XZviQldKY6x
 FUmsxh62O3iGRtLOWDKQA5MwoJuD54qVcHr1iidWkO2G8T3ctCc=
 =kyUh
 -----END PGP SIGNATURE-----

Merge 6.1.39 into android14-6.1-lts

Changes in 6.1.39
	drm: use mgr->dev in drm_dbg_kms in drm_dp_add_payload_part2
	fs: pipe: reveal missing function protoypes
	block: Fix the type of the second bdev_op_is_zoned_write() argument
	erofs: clean up cached I/O strategies
	erofs: avoid tagged pointers to mark sync decompression
	erofs: remove tagged pointer helpers
	erofs: move zdata.h into zdata.c
	erofs: kill hooked chains to avoid loops on deduplicated compressed images
	x86/resctrl: Only show tasks' pid in current pid namespace
	blk-iocost: use spin_lock_irqsave in adjust_inuse_and_calc_cost
	x86/sev: Fix calculation of end address based on number of pages
	virt: sevguest: Add CONFIG_CRYPTO dependency
	blk-mq: fix potential io hang by wrong 'wake_batch'
	lockd: drop inappropriate svc_get() from locked_get()
	nvme-auth: rename __nvme_auth_[reset|free] to nvme_auth[reset|free]_dhchap
	nvme-auth: rename authentication work elements
	nvme-auth: remove symbol export from nvme_auth_reset
	nvme-auth: no need to reset chap contexts on re-authentication
	nvme-core: fix memory leak in dhchap_secret_store
	nvme-core: fix memory leak in dhchap_ctrl_secret
	nvme-auth: don't ignore key generation failures when initializing ctrl keys
	nvme-core: add missing fault-injection cleanup
	nvme-core: fix dev_pm_qos memleak
	md/raid10: check slab-out-of-bounds in md_bitmap_get_counter
	md/raid10: fix overflow of md/safe_mode_delay
	md/raid10: fix wrong setting of max_corr_read_errors
	md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request
	md/raid10: fix io loss while replacement replace rdev
	md/raid1-10: factor out a helper to add bio to plug
	md/raid1-10: factor out a helper to submit normal write
	md/raid1-10: submit write io directly if bitmap is not enabled
	block: fix blktrace debugfs entries leakage
	irqchip/stm32-exti: Fix warning on initialized field overwritten
	irqchip/jcore-aic: Fix missing allocation of IRQ descriptors
	svcrdma: Prevent page release when nothing was received
	erofs: simplify iloc()
	erofs: fix compact 4B support for 16k block size
	posix-timers: Prevent RT livelock in itimer_delete()
	tick/rcu: Fix bogus ratelimit condition
	tracing/timer: Add missing hrtimer modes to decode_hrtimer_mode().
	clocksource/drivers/cadence-ttc: Fix memory leak in ttc_timer_probe
	PM: domains: fix integer overflow issues in genpd_parse_state()
	perf/arm-cmn: Fix DTC reset
	x86/mm: Allow guest.enc_status_change_prepare() to fail
	x86/tdx: Fix race between set_memory_encrypted() and load_unaligned_zeropad()
	drivers/perf: hisi: Don't migrate perf to the CPU going to teardown
	powercap: RAPL: Fix CONFIG_IOSF_MBI dependency
	PM: domains: Move the verification of in-params from genpd_add_device()
	ARM: 9303/1: kprobes: avoid missing-declaration warnings
	cpufreq: intel_pstate: Fix energy_performance_preference for passive
	thermal/drivers/sun8i: Fix some error handling paths in sun8i_ths_probe()
	rcu: Make rcu_cpu_starting() rely on interrupts being disabled
	rcu-tasks: Stop rcu_tasks_invoke_cbs() from using never-onlined CPUs
	rcutorture: Correct name of use_softirq module parameter
	rcuscale: Move shutdown from wait_event() to wait_event_idle()
	rcu/rcuscale: Move rcu_scale_*() after kfree_scale_cleanup()
	rcu/rcuscale: Stop kfree_scale_thread thread(s) after unloading rcuscale
	kselftest: vDSO: Fix accumulation of uninitialized ret when CLOCK_REALTIME is undefined
	perf/ibs: Fix interface via core pmu events
	x86/mm: Fix __swp_entry_to_pte() for Xen PV guests
	locking/atomic: arm: fix sync ops
	evm: Complete description of evm_inode_setattr()
	evm: Fix build warnings
	ima: Fix build warnings
	pstore/ram: Add check for kstrdup
	igc: Enable and fix RX hash usage by netstack
	wifi: ath9k: fix AR9003 mac hardware hang check register offset calculation
	wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx
	libbpf: btf_dump_type_data_check_overflow needs to consider BTF_MEMBER_BITFIELD_SIZE
	samples/bpf: Fix buffer overflow in tcp_basertt
	spi: spi-geni-qcom: Correct CS_TOGGLE bit in SPI_TRANS_CFG
	wifi: wilc1000: fix for absent RSN capabilities WFA testcase
	wifi: mwifiex: Fix the size of a memory allocation in mwifiex_ret_802_11_scan()
	sctp: add bpf_bypass_getsockopt proto callback
	libbpf: fix offsetof() and container_of() to work with CO-RE
	bpf: Don't EFAULT for {g,s}setsockopt with wrong optlen
	spi: dw: Round of n_bytes to power of 2
	nfc: llcp: fix possible use of uninitialized variable in nfc_llcp_send_connect()
	bpftool: JIT limited misreported as negative value on aarch64
	bpf: Remove bpf trampoline selector
	bpf: Fix memleak due to fentry attach failure
	selftests/bpf: Do not use sign-file as testcase
	regulator: core: Fix more error checking for debugfs_create_dir()
	regulator: core: Streamline debugfs operations
	wifi: orinoco: Fix an error handling path in spectrum_cs_probe()
	wifi: orinoco: Fix an error handling path in orinoco_cs_probe()
	wifi: atmel: Fix an error handling path in atmel_probe()
	wifi: wl3501_cs: Fix an error handling path in wl3501_probe()
	wifi: ray_cs: Fix an error handling path in ray_probe()
	wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes
	samples/bpf: xdp1 and xdp2 reduce XDPBUFSIZE to 60
	wifi: ath10k: Trigger STA disconnect after reconfig complete on hardware restart
	wifi: mac80211: recalc min chandef for new STA links
	selftests/bpf: Fix check_mtu using wrong variable type
	wifi: rsi: Do not configure WoWlan in shutdown hook if not enabled
	wifi: rsi: Do not set MMC_PM_KEEP_POWER in shutdown
	ice: handle extts in the miscellaneous interrupt thread
	selftests: cgroup: fix unexpected failure on test_memcg_low
	watchdog/perf: define dummy watchdog_update_hrtimer_threshold() on correct config
	watchdog/perf: more properly prevent false positives with turbo modes
	kexec: fix a memory leak in crash_shrink_memory()
	mmc: mediatek: Avoid ugly error message when SDIO wakeup IRQ isn't used
	memstick r592: make memstick_debug_get_tpc_name() static
	wifi: ath9k: Fix possible stall on ath9k_txq_list_has_key()
	wifi: mac80211: Fix permissions for valid_links debugfs entry
	rtnetlink: extend RTEXT_FILTER_SKIP_STATS to IFLA_VF_INFO
	wifi: ath11k: Add missing check for ioremap
	wifi: iwlwifi: pull from TXQs with softirqs disabled
	wifi: iwlwifi: pcie: fix NULL pointer dereference in iwl_pcie_irq_rx_msix_handler()
	wifi: mac80211: Remove "Missing iftype sband data/EHT cap" spam
	wifi: cfg80211: rewrite merging of inherited elements
	wifi: cfg80211: drop incorrect nontransmitted BSS update code
	wifi: cfg80211: fix regulatory disconnect with OCB/NAN
	wifi: cfg80211/mac80211: Fix ML element common size calculation
	wifi: ieee80211: Fix the common size calculation for reconfiguration ML
	mmc: Add MMC_QUIRK_BROKEN_SD_CACHE for Kingston Canvas Go Plus from 11/2019
	wifi: iwlwifi: mvm: indicate HW decrypt for beacon protection
	wifi: ath9k: convert msecs to jiffies where needed
	bpf: Factor out socket lookup functions for the TC hookpoint.
	bpf: Call __bpf_sk_lookup()/__bpf_skc_lookup() directly via TC hookpoint
	bpf: Fix bpf socket lookup from tc/xdp to respect socket VRF bindings
	can: length: fix bitstuffing count
	can: kvaser_pciefd: Add function to set skb hwtstamps
	can: kvaser_pciefd: Set hardware timestamp on transmitted packets
	net: stmmac: fix double serdes powerdown
	netlink: fix potential deadlock in netlink_set_err()
	netlink: do not hard code device address lenth in fdb dumps
	bonding: do not assume skb mac_header is set
	selftests: rtnetlink: remove netdevsim device after ipsec offload test
	gtp: Fix use-after-free in __gtp_encap_destroy().
	net: axienet: Move reset before 64-bit DMA detection
	ocfs2: Fix use of slab data with sendpage
	sfc: fix crash when reading stats while NIC is resetting
	net: nfc: Fix use-after-free caused by nfc_llcp_find_local
	lib/ts_bm: reset initial match offset for every block of text
	netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one
	netfilter: nf_conntrack_sip: fix the ct_sip_parse_numerical_param() return value.
	ipvlan: Fix return value of ipvlan_queue_xmit()
	netlink: Add __sock_i_ino() for __netlink_diag_dump().
	drm/amd/display: Add logging for display MALL refresh setting
	radeon: avoid double free in ci_dpm_init()
	drm/amd/display: Explicitly specify update type per plane info change
	drm/bridge: it6505: Move a variable assignment behind a null pointer check in receive_timing_debugfs_show()
	Input: drv260x - sleep between polling GO bit
	drm/bridge: ti-sn65dsi83: Fix enable error path
	drm/bridge: tc358768: always enable HS video mode
	drm/bridge: tc358768: fix PLL parameters computation
	drm/bridge: tc358768: fix PLL target frequency
	drm/bridge: tc358768: fix TCLK_ZEROCNT computation
	drm/bridge: tc358768: Add atomic_get_input_bus_fmts() implementation
	drm/bridge: tc358768: fix TCLK_TRAILCNT computation
	drm/bridge: tc358768: fix THS_ZEROCNT computation
	drm/bridge: tc358768: fix TXTAGOCNT computation
	drm/bridge: tc358768: fix THS_TRAILCNT computation
	drm/vram-helper: fix function names in vram helper doc
	ARM: dts: BCM5301X: Drop "clock-names" from the SPI node
	ARM: dts: meson8b: correct uart_B and uart_C clock references
	mm: call arch_swap_restore() from do_swap_page()
	clk: vc5: Use `clamp()` to restrict PLL range
	bootmem: remove the vmemmap pages from kmemleak in free_bootmem_page
	clk: vc5: Fix .driver_data content in i2c_device_id
	clk: vc7: Fix .driver_data content in i2c_device_id
	clk: rs9: Fix .driver_data content in i2c_device_id
	Input: adxl34x - do not hardcode interrupt trigger type
	drm: sun4i_tcon: use devm_clk_get_enabled in `sun4i_tcon_init_clocks`
	drm/panel: sharp-ls043t1le01: adjust mode settings
	driver: soc: xilinx: use _safe loop iterator to avoid a use after free
	ASoC: Intel: sof_sdw: remove SOF_SDW_TGL_HDMI for MeteorLake devices
	drm/vkms: isolate pixel conversion functionality
	drm: Add fixed-point helper to get rounded integer values
	drm/vkms: Fix RGB565 pixel conversion
	ARM: dts: stm32: Move ethernet MAC EEPROM from SoM to carrier boards
	bus: ti-sysc: Fix dispc quirk masking bool variables
	arm64: dts: microchip: sparx5: do not use PSCI on reference boards
	drm/bridge: tc358767: Switch to devm MIPI-DSI helpers
	clk: imx: scu: use _safe list iterator to avoid a use after free
	hwmon: (f71882fg) prevent possible division by zero
	RDMA/bnxt_re: Disable/kill tasklet only if it is enabled
	RDMA/bnxt_re: Fix to remove unnecessary return labels
	RDMA/bnxt_re: Use unique names while registering interrupts
	RDMA/bnxt_re: Remove a redundant check inside bnxt_re_update_gid
	RDMA/bnxt_re: Fix to remove an unnecessary log
	drm/msm/dsi: don't allow enabling 14nm VCO with unprogrammed rate
	drm/msm/disp/dpu: get timing engine status from intf status register
	drm/msm/dpu: Set DPU_DATA_HCTL_EN for in INTF_SC7180_MASK
	iommu/virtio: Detach domain on endpoint release
	iommu/virtio: Return size mapped for a detached domain
	clk: renesas: rzg2l: Fix CPG_SIPLL5_CLK1 register write
	ARM: dts: gta04: Move model property out of pinctrl node
	drm/bridge: anx7625: Convert to i2c's .probe_new()
	drm/bridge: anx7625: Prevent endless probe loop
	ARM: dts: qcom: msm8974: do not use underscore in node name (again)
	arm64: dts: qcom: msm8916: correct camss unit address
	arm64: dts: qcom: msm8916: correct MMC unit address
	arm64: dts: qcom: msm8994: correct SPMI unit address
	arm64: dts: qcom: msm8996: correct camss unit address
	arm64: dts: qcom: sdm630: correct camss unit address
	arm64: dts: qcom: sdm845: correct camss unit address
	arm64: dts: qcom: sm8350: Add GPI DMA compatible fallback
	arm64: dts: qcom: sm8350: correct DMA controller unit address
	arm64: dts: qcom: sdm845-polaris: add missing touchscreen child node reg
	arm64: dts: qcom: apq8016-sbc: Fix regulator constraints
	arm64: dts: qcom: apq8016-sbc: Fix 1.8V power rail on LS expansion
	drm/bridge: Introduce pre_enable_prev_first to alter bridge init order
	drm/bridge: ti-sn65dsi83: Fix enable/disable flow to meet spec
	drm/panel: simple: fix active size for Ampire AM-480272H3TMQW-T01H
	ARM: ep93xx: fix missing-prototype warnings
	ARM: omap2: fix missing tick_broadcast() prototype
	arm64: dts: qcom: pm7250b: add missing spmi-vadc include
	arm64: dts: qcom: apq8096: fix fixed regulator name property
	arm64: dts: mediatek: mt8183: Add mediatek,broken-save-restore-fw to kukui
	ARM: dts: stm32: Shorten the AV96 HDMI sound card name
	memory: brcmstb_dpfe: fix testing array offset after use
	ARM: dts: qcom: apq8074-dragonboard: Set DMA as remotely controlled
	ASoC: es8316: Increment max value for ALC Capture Target Volume control
	ASoC: es8316: Do not set rate constraints for unsupported MCLKs
	ARM: dts: meson8: correct uart_B and uart_C clock references
	soc/fsl/qe: fix usb.c build errors
	RDMA/irdma: avoid fortify-string warning in irdma_clr_wqes
	IB/hfi1: Fix wrong mmu_node used for user SDMA packet after invalidate
	RDMA/hns: Fix hns_roce_table_get return value
	ARM: dts: iwg20d-q7-common: Fix backlight pwm specifier
	arm64: dts: renesas: ulcb-kf: Remove flow control for SCIF1
	drm/msm/dpu: set DSC flush bit correctly at MDP CTL flush register
	fbdev: omapfb: lcd_mipid: Fix an error handling path in mipid_spi_probe()
	arm64: dts: ti: k3-j7200: Fix physical address of pin
	Input: pm8941-powerkey - fix debounce on gen2+ PMICs
	ARM: dts: stm32: Fix audio routing on STM32MP15xx DHCOM PDK2
	ARM: dts: stm32: fix i2s endpoint format property for stm32mp15xx-dkx
	hwmon: (gsc-hwmon) fix fan pwm temperature scaling
	hwmon: (pmbus/adm1275) Fix problems with temperature monitoring on ADM1272
	ARM: dts: BCM5301X: fix duplex-full => full-duplex
	clk: Export clk_hw_forward_rate_request()
	drm/amd/display: Fix a test CalculatePrefetchSchedule()
	drm/amd/display: Fix a test dml32_rq_dlg_get_rq_reg()
	drm/amdkfd: Fix potential deallocation of previously deallocated memory.
	soc: mediatek: SVS: Fix MT8192 GPU node name
	drm/amd/display: Fix artifacting on eDP panels when engaging freesync video mode
	drm/radeon: fix possible division-by-zero errors
	HID: uclogic: Modular KUnit tests should not depend on KUNIT=y
	RDMA/rxe: Add ibdev_dbg macros for rxe
	RDMA/rxe: Replace pr_xxx by rxe_dbg_xxx in rxe_mw.c
	RDMA/rxe: Fix access checks in rxe_check_bind_mw
	amdgpu: validate offset_in_bo of drm_amdgpu_gem_va
	drm/msm/a5xx: really check for A510 in a5xx_gpu_init
	RDMA/bnxt_re: wraparound mbox producer index
	RDMA/bnxt_re: Avoid calling wake_up threads from spin_lock context
	clk: imx: clk-imxrt1050: fix memory leak in imxrt1050_clocks_probe
	clk: imx: clk-imx8mn: fix memory leak in imx8mn_clocks_probe
	clk: imx93: fix memory leak and missing unwind goto in imx93_clocks_probe
	clk: imx: clk-imx8mp: improve error handling in imx8mp_clocks_probe()
	arm64: dts: qcom: sdm845: Flush RSC sleep & wake votes
	arm64: dts: qcom: sm8250-edo: Panel framebuffer is 2.5k instead of 4k
	clk: bcm: rpi: Fix off by one in raspberrypi_discover_clocks()
	clk: clocking-wizard: Fix Oops in clk_wzrd_register_divider()
	clk: tegra: tegra124-emc: Fix potential memory leak
	ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer
	drm/msm/dpu: do not enable color-management if DSPPs are not available
	drm/msm/dpu: Fix slice_last_group_size calculation
	drm/msm/dsi: Use DSC slice(s) packet size to compute word count
	drm/msm/dsi: Flip greater-than check for slice_count and slice_per_intf
	drm/msm/dsi: Remove incorrect references to slice_count
	drm/msm/dp: Free resources after unregistering them
	arm64: dts: mediatek: Add cpufreq nodes for MT8192
	arm64: dts: mediatek: mt8192: Fix CPUs capacity-dmips-mhz
	drm/amdgpu: Fix memcpy() in sienna_cichlid_append_powerplay_table function.
	drm/amdgpu: Fix usage of UMC fill record in RAS
	drm/msm/dpu: correct MERGE_3D length
	clk: vc5: check memory returned by kasprintf()
	clk: cdce925: check return value of kasprintf()
	clk: si5341: return error if one synth clock registration fails
	clk: si5341: check return value of {devm_}kasprintf()
	clk: si5341: free unused memory on probe failure
	clk: keystone: sci-clk: check return value of kasprintf()
	clk: ti: clkctrl: check return value of kasprintf()
	drivers: meson: secure-pwrc: always enable DMA domain
	ovl: update of dentry revalidate flags after copy up
	ASoC: imx-audmix: check return value of devm_kasprintf()
	clk: Fix memory leak in devm_clk_notifier_register()
	ARM: dts: lan966x: kontron-d10: fix board reset
	ARM: dts: lan966x: kontron-d10: fix SPI CS
	ASoC: amd: acp: clear pdm dma interrupt mask
	PCI: cadence: Fix Gen2 Link Retraining process
	PCI: vmd: Reset VMD config register between soft reboots
	scsi: qedf: Fix NULL dereference in error handling
	pinctrl: bcm2835: Handle gpiochip_add_pin_range() errors
	platform/x86: lenovo-yogabook: Fix work race on remove()
	platform/x86: lenovo-yogabook: Reprobe devices on remove()
	platform/x86: lenovo-yogabook: Set default keyboard backligh brightness on probe()
	PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free
	scsi: 3w-xxxx: Add error handling for initialization failure in tw_probe()
	PCI: pciehp: Cancel bringup sequence if card is not present
	PCI: ftpci100: Release the clock resources
	pinctrl: sunplus: Add check for kmalloc
	PCI: Add pci_clear_master() stub for non-CONFIG_PCI
	scsi: lpfc: Revise NPIV ELS unsol rcv cmpl logic to drop ndlp based on nlp_state
	perf bench: Add missing setlocale() call to allow usage of %'d style formatting
	pinctrl: cherryview: Return correct value if pin in push-pull mode
	platform/x86: think-lmi: mutex protection around multiple WMI calls
	platform/x86: think-lmi: Correct System password interface
	platform/x86: think-lmi: Correct NVME password handling
	pinctrl:sunplus: Add check for kmalloc
	pinctrl: npcm7xx: Add missing check for ioremap
	kcsan: Don't expect 64 bits atomic builtins from 32 bits architectures
	powerpc/interrupt: Don't read MSR from interrupt_exit_kernel_prepare()
	powerpc/signal32: Force inlining of __unsafe_save_user_regs() and save_tm_user_regs_unsafe()
	perf script: Fix allocation of evsel->priv related to per-event dump files
	platform/x86: thinkpad_acpi: Fix lkp-tests warnings for platform profiles
	perf dwarf-aux: Fix off-by-one in die_get_varname()
	platform/x86/dell/dell-rbtn: Fix resources leaking on error path
	perf tool x86: Consolidate is_amd check into single function
	perf tool x86: Fix perf_env memory leak
	powerpc/64s: Fix VAS mm use after free
	pinctrl: microchip-sgpio: check return value of devm_kasprintf()
	pinctrl: at91-pio4: check return value of devm_kasprintf()
	powerpc/powernv/sriov: perform null check on iov before dereferencing iov
	powerpc: simplify ppc_save_regs
	powerpc: update ppc_save_regs to save current r1 in pt_regs
	PCI: qcom: Remove PCIE20_ prefix from register definitions
	PCI: qcom: Sort and group registers and bitfield definitions
	PCI: qcom: Use lower case for hex
	PCI: qcom: Use DWC helpers for modifying the read-only DBI registers
	PCI: qcom: Disable write access to read only registers for IP v2.9.0
	riscv: uprobes: Restore thread.bad_cause
	powerpc/book3s64/mm: Fix DirectMap stats in /proc/meminfo
	powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary
	PCI: endpoint: Fix Kconfig indent style
	PCI: endpoint: Fix a Kconfig prompt of vNTB driver
	PCI: endpoint: functions/pci-epf-test: Fix dma_chan direction
	PCI: vmd: Fix uninitialized variable usage in vmd_enable_domain()
	vfio/mdev: Move the compat_class initialization to module init
	hwrng: virtio - Fix race on data_avail and actual data
	modpost: remove broken calculation of exception_table_entry size
	crypto: nx - fix build warnings when DEBUG_FS is not enabled
	modpost: fix section mismatch message for R_ARM_ABS32
	modpost: fix section mismatch message for R_ARM_{PC24,CALL,JUMP24}
	crypto: marvell/cesa - Fix type mismatch warning
	crypto: jitter - correct health test during initialization
	modpost: fix off by one in is_executable_section()
	ARC: define ASM_NL and __ALIGN(_STR) outside #ifdef __ASSEMBLY__ guard
	crypto: kpp - Add helper to set reqsize
	crypto: qat - Use helper to set reqsize
	crypto: qat - unmap buffer before free for DH
	crypto: qat - unmap buffers before free for RSA
	NFSv4.2: fix wrong shrinker_id
	NFSv4.1: freeze the session table upon receiving NFS4ERR_BADSESSION
	SMB3: Do not send lease break acknowledgment if all file handles have been closed
	dax: Fix dax_mapping_release() use after free
	dax: Introduce alloc_dev_dax_id()
	dax/kmem: Pass valid argument to memory_group_register_static
	hwrng: st - keep clock enabled while hwrng is registered
	kbuild: Disable GCOV for *.mod.o
	efi/libstub: Disable PCI DMA before grabbing the EFI memory map
	cifs: prevent use-after-free by freeing the cfile later
	cifs: do all necessary checks for credits within or before locking
	smb: client: fix broken file attrs with nodfs mounts
	ksmbd: avoid field overflow warning
	arm64: sme: Use STR P to clear FFR context field in streaming SVE mode
	x86/efi: Make efi_set_virtual_address_map IBT safe
	md/raid1-10: fix casting from randomized structure in raid1_submit_write()
	USB: serial: option: add LARA-R6 01B PIDs
	usb: dwc3: gadget: Propagate core init errors to UDC during pullup
	phy: tegra: xusb: Clear the driver reference in usb-phy dev
	iio: adc: ad7192: Fix null ad7192_state pointer access
	iio: adc: ad7192: Fix internal/external clock selection
	iio: accel: fxls8962af: errata bug only applicable for FXLS8962AF
	iio: accel: fxls8962af: fixup buffer scan element type
	Revert "drm/amd/display: edp do not add non-edid timings"
	mm/mmap: Fix VM_LOCKED check in do_vmi_align_munmap()
	ALSA: hda/realtek: Enable mute/micmute LEDs and limit mic boost on EliteBook
	ALSA: hda/realtek: Add quirk for Clevo NPx0SNx
	ALSA: jack: Fix mutex call in snd_jack_report()
	ALSA: pcm: Fix potential data race at PCM memory allocation helpers
	block: fix signed int overflow in Amiga partition support
	block: add overflow checks for Amiga partition support
	block: change all __u32 annotations to __be32 in affs_hardblocks.h
	block: increment diskseq on all media change events
	btrfs: fix race when deleting free space root from the dirty cow roots list
	SUNRPC: Fix UAF in svc_tcp_listen_data_ready()
	w1: w1_therm: fix locking behavior in convert_t
	w1: fix loop in w1_fini()
	dt-bindings: power: reset: qcom-pon: Only allow reboot-mode pre-pmk8350
	f2fs: do not allow to defragment files have FI_COMPRESS_RELEASED
	sh: j2: Use ioremap() to translate device tree address into kernel memory
	usb: dwc2: platform: Improve error reporting for problems during .remove()
	usb: dwc2: Fix some error handling paths
	serial: 8250: omap: Fix freeing of resources on failed register
	clk: qcom: mmcc-msm8974: remove oxili_ocmemgx_clk
	clk: qcom: camcc-sc7180: Add parent dependency to all camera GDSCs
	clk: qcom: gcc-ipq6018: Use floor ops for sdcc clocks
	clk: qcom: gcc-qcm2290: Mark RCGs shared where applicable
	media: usb: Check az6007_read() return value
	media: amphion: drop repeated codec data for vc1l format
	media: amphion: drop repeated codec data for vc1g format
	media: amphion: initiate a drain of the capture queue in dynamic resolution change
	media: videodev2.h: Fix struct v4l2_input tuner index comment
	media: usb: siano: Fix warning due to null work_func_t function pointer
	media: i2c: Correct format propagation for st-mipid02
	media: hi846: fix usage of pm_runtime_get_if_in_use()
	media: mediatek: vcodec: using decoder status instead of core work count
	clk: qcom: reset: support resetting multiple bits
	clk: qcom: ipq6018: fix networking resets
	clk: qcom: dispcc-qcm2290: Fix BI_TCXO_AO handling
	clk: qcom: dispcc-qcm2290: Fix GPLL0_OUT_DIV handling
	clk: qcom: mmcc-msm8974: use clk_rcg2_shared_ops for mdp_clk_src clock
	staging: vchiq_arm: mark vchiq_platform_init() static
	usb: dwc3: qcom: Fix potential memory leak
	usb: gadget: u_serial: Add null pointer check in gserial_suspend
	extcon: Fix kernel doc of property fields to avoid warnings
	extcon: Fix kernel doc of property capability fields to avoid warnings
	usb: phy: phy-tahvo: fix memory leak in tahvo_usb_probe()
	usb: hide unused usbfs_notify_suspend/resume functions
	usb: misc: eud: Fix eud sysfs path (use 'qcom_eud')
	serial: core: lock port for stop_rx() in uart_suspend_port()
	serial: 8250: lock port for stop_rx() in omap8250_irq()
	serial: core: lock port for start_rx() in uart_resume_port()
	serial: 8250: lock port for UART_IER access in omap8250_irq()
	kernfs: fix missing kernfs_idr_lock to remove an ID from the IDR
	lkdtm: replace ll_rw_block with submit_bh
	i3c: master: svc: fix cpu schedule in spin lock
	coresight: Fix loss of connection info when a module is unloaded
	mfd: rt5033: Drop rt5033-battery sub-device
	media: venus: helpers: Fix ALIGN() of non power of two
	media: atomisp: gmin_platform: fix out_len in gmin_get_config_dsm_var()
	sh: Avoid using IRQ0 on SH3 and SH4
	gfs2: Fix duplicate should_fault_in_pages() call
	f2fs: fix potential deadlock due to unpaired node_write lock use
	f2fs: fix to avoid NULL pointer dereference f2fs_write_end_io()
	KVM: s390: fix KVM_S390_GET_CMMA_BITS for GFNs in memslot holes
	usb: dwc3: qcom: Release the correct resources in dwc3_qcom_remove()
	usb: dwc3: qcom: Fix an error handling path in dwc3_qcom_probe()
	usb: common: usb-conn-gpio: Set last role to unknown before initial detection
	usb: dwc3-meson-g12a: Fix an error handling path in dwc3_meson_g12a_probe()
	mfd: wcd934x: Fix an error handling path in wcd934x_slim_probe()
	mfd: intel-lpss: Add missing check for platform_get_resource
	Revert "usb: common: usb-conn-gpio: Set last role to unknown before initial detection"
	serial: 8250_omap: Use force_suspend and resume for system suspend
	device property: Fix documentation for fwnode_get_next_parent()
	device property: Clarify description of returned value in some functions
	drivers: fwnode: fix fwnode_irq_get[_byname]()
	nvmem: sunplus-ocotp: release otp->clk before return
	nvmem: rmem: Use NVMEM_DEVID_AUTO
	bus: fsl-mc: don't assume child devices are all fsl-mc devices
	mfd: stmfx: Fix error path in stmfx_chip_init
	mfd: stmfx: Nullify stmfx->vdd in case of error
	KVM: s390: vsie: fix the length of APCB bitmap
	KVM: s390/diag: fix racy access of physical cpu number in diag 9c handler
	cpufreq: mediatek: correct voltages for MT7622 and MT7623
	misc: fastrpc: check return value of devm_kasprintf()
	clk: qcom: mmcc-msm8974: fix MDSS_GDSC power flags
	hwtracing: hisi_ptt: Fix potential sleep in atomic context
	mfd: stmpe: Only disable the regulators if they are enabled
	phy: tegra: xusb: check return value of devm_kzalloc()
	lib/bitmap: drop optimization of bitmap_{from,to}_arr64
	pwm: imx-tpm: force 'real_period' to be zero in suspend
	pwm: sysfs: Do not apply state to already disabled PWMs
	pwm: ab8500: Fix error code in probe()
	pwm: mtk_disp: Fix the disable flow of disp_pwm
	md/raid10: fix the condition to call bio_end_io_acct()
	rtc: st-lpc: Release some resources in st_rtc_probe() in case of error
	drm/i915/psr: Use hw.adjusted mode when calculating io/fast wake times
	drm/i915/guc/slpc: Apply min softlimit correctly
	f2fs: check return value of freeze_super()
	media: cec: i2c: ch7322: also select REGMAP
	sctp: fix potential deadlock on &net->sctp.addr_wq_lock
	net/sched: act_ipt: add sanity checks on table name and hook locations
	net: add a couple of helpers for iph tot_len
	net/sched: act_ipt: add sanity checks on skb before calling target
	spi: spi-geni-qcom: enable SPI_CONTROLLER_MUST_TX for GPI DMA mode
	net: mscc: ocelot: don't report that RX timestamping is enabled by default
	net: mscc: ocelot: don't keep PTP configuration of all ports in single structure
	net: dsa: felix: don't drop PTP frames with tag_8021q when RX timestamping is disabled
	net: dsa: sja1105: always enable the INCL_SRCPT option
	net: dsa: tag_sja1105: always prefer source port information from INCL_SRCPT
	Add MODULE_FIRMWARE() for FIRMWARE_TG357766.
	Bluetooth: fix invalid-bdaddr quirk for non-persistent setup
	Bluetooth: ISO: use hci_sync for setting CIG parameters
	Bluetooth: MGMT: add CIS feature bits to controller information
	Bluetooth: MGMT: Use BIT macro when defining bitfields
	Bluetooth: MGMT: Fix marking SCAN_RSP as not connectable
	ibmvnic: Do not reset dql stats on NON_FATAL err
	net: dsa: vsc73xx: fix MTU configuration
	mlxsw: minimal: fix potential memory leak in mlxsw_m_linecards_init
	spi: bcm-qspi: return error if neither hif_mspi nor mspi is available
	drm/amdgpu: fix number of fence calculations
	drm/amd: Don't try to enable secure display TA multiple times
	mailbox: ti-msgmgr: Fill non-message tx data fields with 0x0
	f2fs: fix error path handling in truncate_dnode()
	octeontx2-af: Fix mapping for NIX block from CGX connection
	octeontx2-af: Add validation before accessing cgx and lmac
	ntfs: Fix panic about slab-out-of-bounds caused by ntfs_listxattr()
	powerpc: allow PPC_EARLY_DEBUG_CPM only when SERIAL_CPM=y
	powerpc: dts: turris1x.dts: Fix PCIe MEM size for pci2 node
	net: bridge: keep ports without IFF_UNICAST_FLT in BR_PROMISC mode
	net: dsa: tag_sja1105: fix source port decoding in vlan_filtering=0 bridge mode
	net: fix net_dev_start_xmit trace event vs skb_transport_offset()
	tcp: annotate data races in __tcp_oow_rate_limited()
	bpf, btf: Warn but return no error for NULL btf from __register_btf_kfunc_id_set()
	xsk: Honor SO_BINDTODEVICE on bind
	net/sched: act_pedit: Add size check for TCA_PEDIT_PARMS_EX
	fanotify: disallow mount/sb marks on kernel internal pseudo fs
	riscv: move memblock_allow_resize() after linear mapping is ready
	pptp: Fix fib lookup calls.
	net: dsa: tag_sja1105: fix MAC DA patching from meta frames
	net: dsa: sja1105: always enable the send_meta options
	octeontx-af: fix hardware timestamp configuration
	afs: Fix accidental truncation when storing data
	s390/qeth: Fix vipa deletion
	sh: dma: Fix DMA channel offset calculation
	apparmor: fix missing error check for rhashtable_insert_fast
	i2c: xiic: Don't try to handle more interrupt events after error
	dm: fix undue/missing spaces
	dm: avoid split of quoted strings where possible
	dm ioctl: have constant on the right side of the test
	dm ioctl: Avoid double-fetch of version
	extcon: usbc-tusb320: Convert to i2c's .probe_new()
	extcon: usbc-tusb320: Unregister typec port on driver removal
	btrfs: do not BUG_ON() on tree mod log failure at balance_level()
	i2c: qup: Add missing unwind goto in qup_i2c_probe()
	irqchip/loongson-pch-pic: Fix potential incorrect hwirq assignment
	NFSD: add encoding of op_recall flag for write delegation
	irqchip/loongson-pch-pic: Fix initialization of HT vector register
	io_uring: wait interruptibly for request completions on exit
	mmc: core: disable TRIM on Kingston EMMC04G-M627
	mmc: core: disable TRIM on Micron MTFC4GACAJCN-1M
	mmc: mmci: Set PROBE_PREFER_ASYNCHRONOUS
	mmc: sdhci: fix DMA configure compatibility issue when 64bit DMA mode is used.
	wifi: cfg80211: fix regulatory disconnect for non-MLO
	wifi: ath10k: Serialize wake_tx_queue ops
	wifi: mt76: mt7921e: fix init command fail with enabled device
	bcache: fixup btree_cache_wait list damage
	bcache: Remove unnecessary NULL point check in node allocations
	bcache: Fix __bch_btree_node_alloc to make the failure behavior consistent
	watch_queue: prevent dangling pipe pointer
	um: Use HOST_DIR for mrproper
	integrity: Fix possible multiple allocation in integrity_inode_get()
	autofs: use flexible array in ioctl structure
	mm/damon/ops-common: atomically test and clear young on ptes and pmds
	shmem: use ramfs_kill_sb() for kill_sb method of ramfs-based tmpfs
	jffs2: reduce stack usage in jffs2_build_xattr_subsystem()
	fs: avoid empty option when generating legacy mount string
	ext4: Remove ext4 locking of moved directory
	Revert "f2fs: fix potential corruption when moving a directory"
	fs: Establish locking order for unrelated directories
	fs: Lock moved directories
	i2c: nvidia-gpu: Add ACPI property to align with device-tree
	i2c: nvidia-gpu: Remove ccgx,firmware-build property
	usb: typec: ucsi: Mark dGPUs as DEVICE scope
	ipvs: increase ip_vs_conn_tab_bits range for 64BIT
	btrfs: add handling for RAID1C23/DUP to btrfs_reduce_alloc_profile
	btrfs: delete unused BGs while reclaiming BGs
	btrfs: bail out reclaim process if filesystem is read-only
	btrfs: add block-group tree to lockdep classes
	btrfs: reinsert BGs failed to reclaim
	btrfs: fix race when deleting quota root from the dirty cow roots list
	btrfs: fix extent buffer leak after tree mod log failure at split_node()
	btrfs: do not BUG_ON() on tree mod log failure at __btrfs_cow_block()
	ASoC: mediatek: mt8173: Fix irq error path
	ASoC: mediatek: mt8173: Fix snd_soc_component_initialize error path
	regulator: tps65219: Fix matching interrupts for their regulators
	ARM: dts: qcom: ipq4019: fix broken NAND controller properties override
	ARM: orion5x: fix d2net gpio initialization
	leds: trigger: netdev: Recheck NETDEV_LED_MODE_LINKUP on dev rename
	blktrace: use inline function for blk_trace_remove() while blktrace is disabled
	fs: no need to check source
	xfs: explicitly specify cpu when forcing inodegc delayed work to run immediately
	xfs: check that per-cpu inodegc workers actually run on that cpu
	xfs: disable reaping in fscounters scrub
	xfs: fix xfs_inodegc_stop racing with mod_delayed_work
	mm/mmap: Fix extra maple tree write
	drm/i915: Fix TypeC mode initialization during system resume
	drm/i915/tc: Fix TC port link ref init for DP MST during HW readout
	drm/i915/tc: Fix system resume MST mode restore for DP-alt sinks
	mtd: parsers: refer to ARCH_BCMBCA instead of ARCH_BCM4908
	netfilter: nf_tables: unbind non-anonymous set if rule construction fails
	netfilter: conntrack: Avoid nf_ct_helper_hash uses after free
	netfilter: nf_tables: do not ignore genmask when looking up chain by id
	netfilter: nf_tables: prevent OOB access in nft_byteorder_eval
	wireguard: queueing: use saner cpu selection wrapping
	wireguard: netlink: send staged packets when setting initial private key
	tty: serial: fsl_lpuart: add earlycon for imx8ulp platform
	block/partition: fix signedness issue for Amiga partitions
	sh: mach-r2d: Handle virq offset in cascaded IRL demux
	sh: mach-highlander: Handle virq offset in cascaded IRL demux
	sh: mach-dreamcast: Handle virq offset in cascaded IRQ demux
	sh: hd64461: Handle virq offset for offchip IRQ base and HD64461 IRQ
	io_uring: Use io_schedule* in cqring wait
	Linux 6.1.39

Change-Id: I5867c943c99c157fa599ecd08da961c632e58302
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-09-02 19:41:42 +00:00
Daniel Vetter
28916927b7 video/aperture: Move vga handling to pci function
[ Upstream commit f1d599d315fb7b7343cddaf365e671aaa8453aca ]

A few reasons for this:

- It's really the only one where this matters. I tried looking around,
  and I didn't find any non-pci vga-compatible controllers for x86
  (since that's the only platform where we had this until a few
  patches ago), where a driver participating in the aperture claim
  dance would interfere.

- I also don't expect that any future bus anytime soon will
  not just look like pci towards the OS, that's been the case for like
  25+ years by now for practically everything (even non non-x86).

- Also it's a bit funny if we have one part of the vga removal in the
  pci function, and the other in the generic one.

v2: Rebase.

v4:
- fix Daniel's S-o-b address

v5:
- add back an S-o-b tag with Daniel's Intel address

Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Javier Martinez Canillas <javierm@redhat.com>
Cc: Helge Deller <deller@gmx.de>
Cc: linux-fbdev@vger.kernel.org
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230406132109.32050-6-tzimmermann@suse.de
Stable-dep-of: 5ae3716cfdcd ("video/aperture: Only remove sysfb on the default vga pci device")
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-08-30 16:10:58 +02:00
Daniel Vetter
4aad3b82b9 video/aperture: Only kick vgacon when the pdev is decoding vga
[ Upstream commit 7450cd235b45d43ee6f3c235f89e92623458175d ]

Otherwise it's a bit silly, and we might throw out the driver for the
screen the user is actually looking at. I haven't found a bug report
for this case yet, but we did get bug reports for the analog case
where we're throwing out the efifb driver.

v2: Flip the check around to make it clear it's a special case for
kicking out the vgacon driver only (Thomas)

v4:
- fixes to commit message
- fix Daniel's S-o-b address

v5:
- add back an S-o-b tag with Daniel's Intel address

Link: https://bugzilla.kernel.org/show_bug.cgi?id=216303
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Javier Martinez Canillas <javierm@redhat.com>
Cc: Helge Deller <deller@gmx.de>
Cc: linux-fbdev@vger.kernel.org
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230406132109.32050-5-tzimmermann@suse.de
Stable-dep-of: 5ae3716cfdcd ("video/aperture: Only remove sysfb on the default vga pci device")
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-08-30 16:10:57 +02:00
Daniel Vetter
6db53af154 fbdev/radeon: use pci aperture helpers
[ Upstream commit 9b539c4d1b921bc9c8c578d4d50f0a7e7874d384 ]

It's not exactly the same since the open coded version doesn't set
primary correctly. But that's a bugfix, so shouldn't hurt really.

Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: linux-fbdev@vger.kernel.org
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20230111154112.90575-7-daniel.vetter@ffwll.ch
Stable-dep-of: 5ae3716cfdcd ("video/aperture: Only remove sysfb on the default vga pci device")
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-08-30 16:10:57 +02:00
Greg Kroah-Hartman
8b02e8901d Merge branch 'android14-6.1' into 'android14-6.1-lts'
Catches the android14-6.1-lts branch up with the android14-6.1 branch
which has had a lot of changes that are needed here to resolve future
LTS merges and to ensure that the ABI is kept stable.

It contains the following commits:

* 9fd41ac172 ANDROID: Delete build.config.gki.aarch64.16k.
* 073df44c36 FROMGIT: usb: typec: tcpm: Refactor the PPS APDO selection
* 078410e73f UPSTREAM: usb: typec: tcpm: Fix response to vsafe0V event
* 722f6cc09c ANDROID: Revert "ANDROID: allmodconfig: disable WERROR"
* c2611a04b9 ANDROID: GKI: update symbol list file for xiaomi
* 34fde9ec08 FROMGIT: usb: typec: tcpm: not sink vbus if operational current is 0mA
* 3ebafb7b46 BACKPORT: FROMGIT: mm: handle faults that merely update the accessed bit under the VMA lock
* 9e066d4b35 FROMLIST: mm: Allow fault_dirty_shared_page() to be called under the VMA lock
* 83ab986324 FROMGIT: mm: handle swap and NUMA PTE faults under the VMA lock
* ffcebdef16 FROMGIT: mm: run the fault-around code under the VMA lock
* 072c35fb69 FROMGIT: mm: move FAULT_FLAG_VMA_LOCK check down from do_fault()
* fa9a8adff0 FROMGIT: mm: move FAULT_FLAG_VMA_LOCK check down in handle_pte_fault()
* dd621869c1 BACKPORT: FROMGIT: mm: handle some PMD faults under the VMA lock
* 8594d6a30f BACKPORT: FROMGIT: mm: handle PUD faults under the VMA lock
* 66cbbe6b31 FROMGIT: mm: move FAULT_FLAG_VMA_LOCK check from handle_mm_fault()
* e26044769f BACKPORT: FROMGIT: mm: allow per-VMA locks on file-backed VMAs
* 4cb518a06f FROMGIT: mm: remove CONFIG_PER_VMA_LOCK ifdefs
* f4b32b7f15 FROMGIT: mm: fix a lockdep issue in vma_assert_write_locked
* 250f19771f FROMGIT: mm: handle userfaults under VMA lock
* e704d0e4f9 FROMGIT: mm: handle swap page faults under per-VMA lock
* f8a65b694b FROMGIT: mm: change folio_lock_or_retry to use vm_fault directly
* 693d905ec0 BACKPORT: FROMGIT: mm: drop per-VMA lock when returning VM_FAULT_RETRY or VM_FAULT_COMPLETED
* 939d4b1ccc BACKPORT: FROMGIT: mm: move vma locking out of vma_prepare and dup_anon_vma
* 0f0b09c02c BACKPORT: FROMGIT: mm: always lock new vma before inserting into vma tree
* a8a479ed96 FROMGIT: mm: lock vma explicitly before doing vm_flags_reset and vm_flags_reset_once
* ad18923856 FROMGIT: mm: replace mmap with vma write lock assertions when operating on a vma
* 5f0ca924aa FROMGIT: mm: for !CONFIG_PER_VMA_LOCK equate write lock assertion for vma and mmap
* abb0f2767e FROMGIT: mm: don't drop VMA locks in mm_drop_all_locks()
* 365af746f5 BACKPORT: riscv: mm: try VMA lock-based page fault handling first
* 3c187b4a12 BACKPORT: FROMGIT: mm: enable page walking API to lock vmas during the walk
* b6093c47fe BACKPORT: mm: lock VMA in dup_anon_vma() before setting ->anon_vma
* 0ee0062c94 UPSTREAM: mm: fix memory ordering for mm_lock_seq and vm_lock_seq
* 3378cbd264 FROMGIT: usb: host: ehci-sched: try to turn on io watchdog as long as periodic_count > 0
* 2d3351bd5e FROMGIT: BACKPORT: usb: ehci: add workaround for chipidea PORTSC.PEC bug
* 7fa8861130 UPSTREAM: tty: n_gsm: fix UAF in gsm_cleanup_mux
* 683966ac69 UPSTREAM: mm/mmap: Fix extra maple tree write
* f86c79eb86 FROMGIT: Multi-gen LRU: skip CMA pages when they are not eligible
* 7ae1e02abb UPSTREAM: mm: skip CMA pages when they are not available
* 7666325265 UPSTREAM: dma-buf: fix an error pointer vs NULL bug
* e61d76121f UPSTREAM: dma-buf: keep the signaling time of merged fences v3
* fda157ce15 UPSTREAM: netfilter: nf_tables: skip bound chain on rule flush
* 110a26edd1 UPSTREAM: net/sched: sch_qfq: account for stab overhead in qfq_enqueue
* 9db1437238 UPSTREAM: net/sched: sch_qfq: refactor parsing of netlink parameters
* 7688102949 UPSTREAM: netfilter: nft_set_pipapo: fix improper element removal
* 37f4509407 ANDROID: Add checkpatch target.
* d7dacaa439 UPSTREAM: USB: Gadget: core: Help prevent panic during UVC unconfigure
* 4dc009c3a8 ANDROID: GKI: Update symbols to symbol list
* fadc35923d ANDROID: vendor_hook: fix the error record position of mutex
* 3fc69d3f70 ANDROID: ABI: add allowed list for galaxy
* a5a662187f ANDROID: gfp: add __GFP_CMA in gfpflag_names
* b520b90913 ANDROID: ABI: Update to fix slab-out-of-bounds in xhci_vendor_get_ops
* c2cbb3cc24 ANDROID: usb: host: fix slab-out-of-bounds in xhci_vendor_get_ops
* 64787ee451 ANDROID: GKI: update pixel symbol list for xhci
* b0c06048a8 FROMGIT: fs: drop_caches: draining pages before dropping caches
* 2f76bb83b1 ANDROID: GKI: update symbol list file for xiaomi
* 8e86825eec ANDROID: uid_sys_stats: Use a single work for deferred updates
* 960d9828ee ANDROID: ABI: Update symbol for Exynos SoC
* 3926cc6ef8 ANDROID: GKI: Add symbols to symbol list for vivo
* dbb09068c1 ANDROID: vendor_hooks: Add tune scan type hook in get_scan_count()
* 5e1d25ac2a FROMGIT: BACKPORT: Multi-gen LRU: Fix can_swap in lru_gen_look_around()
* addf1a9a65 FROMGIT: Multi-gen LRU: Avoid race in inc_min_seq()
* a7adb98897 FROMGIT: Multi-gen LRU: Fix per-zone reclaim
* 03812b904e ANDROID: ABI: update symbol list for galaxy
* b283f9b41f ANDROID: oplus: Update the ABI xml and symbol list
* c3d26e2b5a ANDROID: vendor_hooks: Add hooks for lookaround
* 29e2f3e3d1 ANDROID: ABI: Update STG ABI to format version 2
* 3bd3d13701 ANDROID: ABI: Update symbol list for imx
* ad0b008167 FROMGIT: erofs: fix wrong primary bvec selection on deduplicated extents
* 126ef64cba UPSTREAM: media: Add ABGR64_12 video format
* 86e2e8fd05 BACKPORT: media: Add BGR48_12 video format
* 892293272c UPSTREAM: media: Add YUV48_12 video format
* b2cf7e4268 UPSTREAM: media: Add Y212 v4l2 format info
* 0f3f7a21af UPSTREAM: media: Add Y210, Y212 and Y216 formats
* ca7b45b128 UPSTREAM: media: Add Y012 video format
* 343b85ecad UPSTREAM: media: Add P012 and P012M video format
* 7beed73af0 ANDROID: GKI: Create symbol files in include/config
* 295e779e8f ANDROID: fuse-bpf: Use stored bpf for create_open
* 74d9daa59a ANDROID: fuse-bpf: Add bpf to negative fuse_dentry
* 6aef06abba ANDROID: fuse-bpf: Check inode not null
* 4bbda90bd8 ANDROID: fuse-bpf: Fix flock test compile error
* 84ac22a0d3 ANDROID: fuse-bpf: Add partial ioctl support
* e341d2312c ANDROID: ABI: Update oplus symbol list
* f5c707dc65 UPSTREAM: mm/mempolicy: Take VMA lock before replacing policy
* 890b1aabb1 BACKPORT: mm: lock_vma_under_rcu() must check vma->anon_vma under vma lock
* d3b37a712a BACKPORT: FROMGIT: irqchip/gic-v3: Workaround for GIC-700 erratum 2941627
* a89e2cbbc0 ANDROID: GKI: update xiaomi symbol list
* 371f8d901a UPSTREAM: mm: lock newly mapped VMA with corrected ordering
* 0d9960403c UPSTREAM: fork: lock VMAs of the parent process when forking
* e3601b25ae UPSTREAM: mm: lock newly mapped VMA which can be modified after it becomes visible
* 05f7c7fe72 UPSTREAM: mm: lock a vma before stack expansion
* c0ba567af1 ANDROID: GKI: bring back find_extend_vma()
* 188ce9572f BACKPORT: mm: always expand the stack with the mmap write lock held
* 74efdc0966 BACKPORT: execve: expand new process stack manually ahead of time
* c8ad906849 ANDROID: abi_gki_aarch64_qcom: ufshcd_mcq_poll_cqe_lock
* 1afccd4255 UPSTREAM: mm: make find_extend_vma() fail if write lock not held
* 4087cac574 UPSTREAM: powerpc/mm: convert coprocessor fault to lock_mm_and_find_vma()
* 6c33246824 UPSTREAM: mm/fault: convert remaining simple cases to lock_mm_and_find_vma()
* add0a1ea04 UPSTREAM: arm/mm: Convert to using lock_mm_and_find_vma()
* 9f136450af UPSTREAM: riscv/mm: Convert to using lock_mm_and_find_vma()
* 053053fc68 UPSTREAM: mips/mm: Convert to using lock_mm_and_find_vma()
* 9cdce804c0 UPSTREAM: powerpc/mm: Convert to using lock_mm_and_find_vma()
* 1016faf509 BACKPORT: arch/arm64/mm/fault: Fix undeclared variable error in do_page_fault()
* 89298b8b3c BACKPORT: arm64/mm: Convert to using lock_mm_and_find_vma()
* cf70cb4f1f UPSTREAM: mm: make the page fault mmap locking killable
* 544ae28cf6 ANDROID: Inherit "user-aware property" across rtmutex.
* 5e4a5dc820 BACKPORT: blk-crypto: use dynamic lock class for blk_crypto_profile::lock
* db2c29e53d ANDROID: ABI: update symbol list for Xclipse GPU
* 7edb035c79 ANDROID: drm/ttm: export ttm_tt_unpopulate()
* b61f298c0d ANDROID: GKI: Add ABI symbol list(devlink) for MTK
* ec419af28f ANDROID: devlink: Select CONFIG_NET_DEVLINK in Kconfig.gki
* 1e114e6efa ANDROID: KVM: arm64: Fix memory ordering for pKVM module callbacks
* 3803ae4a28 BACKPORT: mm: introduce new 'lock_mm_and_find_vma()' page fault helper
* 66b5ad3507 BACKPORT: maple_tree: fix potential out-of-bounds access in mas_wr_end_piv()
* 19dd4101e0 UPSTREAM: x86/smp: Cure kexec() vs. mwait_play_dead() breakage
* 26260c4bd1 UPSTREAM: x86/smp: Use dedicated cache-line for mwait_play_dead()
* d8cb0365cb UPSTREAM: x86/smp: Remove pointless wmb()s from native_stop_other_cpus()
* 6744547e95 UPSTREAM: x86/smp: Dont access non-existing CPUID leaf
* ba2ccba863 UPSTREAM: x86/smp: Make stop_other_cpus() more robust
* 5c9836e66d UPSTREAM: x86/microcode/AMD: Load late on both threads too
* 53048f151c BACKPORT: mm, hwpoison: when copy-on-write hits poison, take page offline
* a2dff37b0c UPSTREAM: mm, hwpoison: try to recover from copy-on write faults
* 466448f55f BACKPORT: mm/mmap: Fix error return in do_vmi_align_munmap()
* 41b30362e9 BACKPORT: mm/mmap: Fix error path in do_vmi_align_munmap()
* d45a054f9c UPSTREAM: HID: logitech-hidpp: add HIDPP_QUIRK_DELAYED_INIT for the T651.
* 0e477a82e6 UPSTREAM: HID: hidraw: fix data race on device refcount
* af2d741bf3 UPSTREAM: can: isotp: isotp_sendmsg(): fix return error fix on TX path
* 5887040491 UPSTREAM: fbdev: fix potential OOB read in fast_imageblit()
* 6c48edb9c9 ANDROID: GKI: add function symbols for unisoc
* 342aff08ae ANDROID: cgroup: Cleanup android_rvh_cgroup_force_kthread_migration
* fcdea346bb UPSTREAM: net/sched: cls_fw: Fix improper refcount update leads to use-after-free
* f091cc7434 UPSTREAM: netfilter: nf_tables: fix chain binding transaction logic
* 1bb5e7fb37 ANDROID: abi_gki_aarch64_qcom: update abi

Change-Id: I6f86301f218a60c00d03e09a4e3bfebe42bad0d5
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-08-23 18:31:43 +00:00
Yuanjun Gong
9fedcd07ab fbdev: mmp: fix value check in mmphw_probe()
commit 0872b2c0abc0e84ac82472959c8e14e35277549c upstream.

in mmphw_probe(), check the return value of clk_prepare_enable()
and return the error code if clk_prepare_enable() returns an
unexpected value.

Fixes: d63028c389 ("video: mmp display controller support")
Signed-off-by: Yuanjun Gong <ruc_gongyuanjun@163.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-08-23 17:52:30 +02:00
Daniel Vetter
485ec8f8e1 video/aperture: Only remove sysfb on the default vga pci device
[ Upstream commit 5ae3716cfdcd286268133867f67d0803847acefc ]

Instead of calling aperture_remove_conflicting_devices() to remove the
conflicting devices, just call to aperture_detach_devices() to detach
the device that matches the same PCI BAR / aperture range. Since the
former is just a wrapper of the latter plus a sysfb_disable() call,
and now that's done in this function but only for the primary devices.

This fixes a regression introduced by commit ee7a69aa38 ("fbdev:
Disable sysfb device registration when removing conflicting FBs"),
where we remove the sysfb when loading a driver for an unrelated pci
device, resulting in the user losing their efifb console or similar.

Note that in practice this only is a problem with the nvidia blob,
because that's the only gpu driver people might install which does not
come with an fbdev driver of it's own. For everyone else the real gpu
driver will restore a working console.

Also note that in the referenced bug there's confusion that this same
bug also happens on amdgpu. But that was just another amdgpu specific
regression, which just happened to happen at roughly the same time and
with the same user-observable symptoms. That bug is fixed now, see
https://bugzilla.kernel.org/show_bug.cgi?id=216331#c15

Note that we should not have any such issues on non-pci multi-gpu
issues, because I could only find two such cases:
- SoC with some external panel over spi or similar. These panel
  drivers do not use drm_aperture_remove_conflicting_framebuffers(),
  so no problem.
- vga+mga, which is a direct console driver and entirely bypasses all
  this.

For the above reasons the cc: stable is just notionally, this patch
will need a backport and that's up to nvidia if they care enough.

v2:
- Explain a bit better why other multi-gpu that aren't pci shouldn't
  have any issues with making all this fully pci specific.

v3
- polish commit message (Javier)

v4:
- Fix commit message style (i.e., commit 1234 ("..."))
- fix Daniel's S-o-b address

v5:
- add back an S-o-b tag with Daniel's Intel address

Fixes: ee7a69aa38 ("fbdev: Disable sysfb device registration when removing conflicting FBs")
Tested-by: Aaron Plattner <aplattner@nvidia.com>
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Link: https://bugzilla.kernel.org/show_bug.cgi?id=216303#c28
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Aaron Plattner <aplattner@nvidia.com>
Cc: Javier Martinez Canillas <javierm@redhat.com>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Helge Deller <deller@gmx.de>
Cc: Sam Ravnborg <sam@ravnborg.org>
Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: <stable@vger.kernel.org> # v5.19+ (if someone else does the backport)
Link: https://patchwork.freedesktop.org/patch/msgid/20230406132109.32050-8-tzimmermann@suse.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-08-23 17:52:28 +02:00
Thomas Zimmermann
f83ab817ef fbdev/hyperv-fb: Do not set struct fb_info.apertures
[ Upstream commit 81d2393485f0990cf6566b0c9e0697c199f68ae5 ]

Generic fbdev drivers use the apertures field in struct fb_info to
control ownership of the framebuffer memory and graphics device. Do
not set the values in hyperv-fb.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Reviewed-by: Michael Kelley <mikelley@microsoft.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20221219160516.23436-9-tzimmermann@suse.de
Stable-dep-of: 5ae3716cfdcd ("video/aperture: Only remove sysfb on the default vga pci device")
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-08-23 17:52:28 +02:00
Zhang Shurong
50e4b32d2e fbdev: au1200fb: Fix missing IRQ check in au1200fb_drv_probe
[ Upstream commit 4e88761f5f8c7869f15a2046b1a1116f4fab4ac8 ]

This func misses checking for platform_get_irq()'s call and may passes the
negative error codes to request_irq(), which takes unsigned IRQ #,
causing it to fail with -EINVAL, overriding an original error code.

Fix this by stop calling request_irq() with invalid IRQ #s.

Fixes: 1630d85a83 ("au1200fb: fix hardcoded IRQ")
Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-07-27 08:50:45 +02:00
Yangtao Li
6aa851f627 fbdev: imxfb: Removed unneeded release_mem_region
[ Upstream commit 45fcc058a75bf5d65cf4c32da44a252fbe873cd4 ]

Remove unnecessary release_mem_region from the error path to prevent
mem region from being released twice, which could avoid resource leak
or other unexpected issues.

Fixes: b083c22d51 ("video: fbdev: imxfb: Convert request_mem_region + ioremap to devm_ioremap_resource")
Signed-off-by: Yangtao Li <frank.li@vivo.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-07-27 08:50:39 +02:00
Martin Kaiser
e7bb9436ea fbdev: imxfb: warn about invalid left/right margin
[ Upstream commit 4e47382fbca916d7db95cbf9e2d7ca2e9d1ca3fe ]

Warn about invalid var->left_margin or var->right_margin. Their values
are read from the device tree.

We store var->left_margin-3 and var->right_margin-1 in register
fields. These fields should be >= 0.

Fixes: 7e8549bcee ("imxfb: Fix margin settings")
Signed-off-by: Martin Kaiser <martin@kaiser.cx>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-07-27 08:50:38 +02:00
Zhang Shurong
5887040491 UPSTREAM: fbdev: fix potential OOB read in fast_imageblit()
commit c2d22806aecb24e2de55c30a06e5d6eb297d161d upstream.

There is a potential OOB read at fast_imageblit, for
"colortab[(*src >> 4)]" can become a negative value due to
"const char *s = image->data, *src".
This change makes sure the index for colortab always positive
or zero.

Similar commit:
https://patchwork.kernel.org/patch/11746067

Potential bug report:
https://groups.google.com/g/syzkaller-bugs/c/9ubBXKeKXf4/m/k-QXy4UgAAAJ

Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Change-Id: I8ae18dbee926cc8dcf5bac4dec584071e7bdb739
(cherry picked from commit c2d22806aecb24e2de55c30a06e5d6eb297d161d)
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-07-26 09:56:38 +00:00
Christophe JAILLET
3b4c218040 fbdev: omapfb: lcd_mipid: Fix an error handling path in mipid_spi_probe()
[ Upstream commit 79a3908d1ea6c35157a6d907b1a9d8ec06015e7a ]

If 'mipid_detect()' fails, we must free 'md' to avoid a memory leak.

Fixes: 66d2f99d0b ("omapfb: add support for MIPI-DCS compatible LCDs")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-07-19 16:21:26 +02:00
jianzhou
603ba47616 Merge keystone/android14-6.1-keystone-qcom-release.6.1.25 (8823053) into qcom-6.1
* refs/heads/tmp-8823053:
  Revert "Merge remote-tracking branch into HEAD"
  UPSTREAM: memstick: r592: Fix UAF bug in r592_remove due to race condition
  UPSTREAM: xfs: verify buffer contents when we skip log replay
  UPSTREAM: bluetooth: Perform careful capability checks in hci_sock_ioctl()
  FROMLIST: maple_tree: Adjust node allocation on mas_rebalance()
  FROMLIST: maple_tree: Reduce resets during store setup
  FROMLIST: BACKPORT: maple_tree: Refine mas_preallocate() node calculations
  Revert "FROMLIST: BACKPORT: maple_tree: Refine mas_preallocate() node calculations"
  ANDROID: GKI: Include kheaders in gki_system_dlkm_modules
  ANDROID: 6/16/2023 KMI update
  ANDROID: sched: Add parameter to android_rvh_schedule.
  ANDROID: GKI: provide more padding for struct usb_phy
  ANDROID: GKI enable CONFIG_NETFILTER_XT_MATCH_CONNBYTES=y
  FROMGIT: arm64: set __exception_irq_entry with __irq_entry as a default
  ANDROID: GKI: update symbol list file for xiaomi
  ANDROID: Remove all but top-level OWNERS
  ANDROID: Enable GKI Dr. No Enforcement
  ANDROID: 6/16/2023 KMI update
  ANDROID: virt: gunyah: Sync with latest platform ops
  FROMGIT: usb: gadget: udc: core: Prevent soft_connect_store() race
  FROMGIT: usb: gadget: udc: core: Offload usb_udc_vbus_handler processing
  UPSTREAM: Bluetooth: fix debugfs registration
  UPSTREAM: Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER
  UPSTREAM: net/ipv6: fix bool/int mismatch for skip_notify_on_dev_down
  UPSTREAM: neighbour: fix unaligned access to pneigh_entry
  UPSTREAM: tcp: deny tcp_disconnect() when threads are waiting
  ANDROID: sound: usb: Add vendor's hooking interface
  ANDROID: GKI: USB: XHCI: add Android ABI padding to struct xhci_driver_overrides
  ANDROID: usb: host: add address_device to xhci overrides
  UPSTREAM: bpf, sockmap: Avoid potential NULL dereference in sk_psock_verdict_data_ready()
  UPSTREAM: bpf, sockmap: Incorrectly handling copied_seq
  UPSTREAM: bpf, sockmap: Wake up polling after data copy
  UPSTREAM: bpf, sockmap: TCP data stall on recv before accept
  UPSTREAM: bpf, sockmap: Handle fin correctly
  UPSTREAM: bpf, sockmap: Improved check for empty queue
  UPSTREAM: bpf, sockmap: Reschedule is now done through backlog
  UPSTREAM: bpf, sockmap: Convert schedule_work into delayed_work
  UPSTREAM: bpf, sockmap: Pass skb ownership through read_skb
  Revert "ANDROID: virt: gunyah: Delta between v13 and v14"
  ANDROID: virt: gunyah: Sync with latest Gunyah patches
  ANDROID: virt: gunyah: Sync with latest documentation and sample
  FROMLIST: usb: xhci-plat: add xhci_plat_priv_overwrite
  ANDROID: usb: host: export symbols for xhci hooks usage
  ANDROID: usb: host: add xhci hooks for USB offload
  ANDROID: 6/16/2023 KMI update
  UPSTREAM: binder: fix UAF of alloc->vma in race with munmap()
  UPSTREAM: binder: add lockless binder_alloc_(set|get)_vma()
  UPSTREAM: Revert "android: binder: stop saving a pointer to the VMA"
  UPSTREAM: Revert "binder_alloc: add missing mmap_lock calls when using the VMA"
  UPSTREAM: tipc: check the bearer min mtu properly when setting it by netlink
  UPSTREAM: tipc: do not update mtu if msg_max is too small in mtu negotiation
  UPSTREAM: tipc: add tipc_bearer_min_mtu to calculate min mtu
  UPSTREAM: Revert "usb: gadget: udc: core: Invoke usb_gadget_connect only when started"
  UPSTREAM: ASoC: fsl_micfil: Fix error handler with pm_runtime_enable
  UPSTREAM: platform: Provide a remove callback that returns no value
  UPSTREAM: firmware: arm_sdei: Fix sleep from invalid context BUG
  UPSTREAM: uapi/linux/const.h: prefer ISO-friendly __typeof__
  UPSTREAM: posix-cpu-timers: Implement the missing timer_wait_running callback
  ANDROID: GKI: reserve extra arm64 cpucaps for ABI preservation
  ANDROID: arm64: errata: Add WORKAROUND_NXP_ERR050104 cpucaps
  ANDROID: KVM: arm64: Allow setting {P,U}XN in stage-2 PTEs
  ANDROID: KVM: arm64: Restrict host-to-hyp MMIO donations
  ANDROID: KVM: arm64: Allow state changes of MMIO pages
  ANDROID: KVM: arm64: Allow MMIO perm changes from modules
  ANDROID: KVM: arm64: Don't allocate from handle_host_mem_abort
  ANDROID: KVM: arm64: Donate IOMMU regions to pKVM
  ANDROID: KVM: arm64: Map MMIO donation as device at EL2
  ANDROID: KVM: arm64: Don't recycle pages from host mem abort
  ANDROID: KVM: arm64: Pin host stage-2 tables
  ANDROID: KVM: arm64: Move kvm_pte_follow() to header
  ANDROID: KVM: arm64: Pre-populate host stage2
  ANDROID: KVM: arm64: Fix the host ownership later
  ANDROID: KVM: arm64: Don't recycle non-default PTEs
  ANDROID: KVM: arm64: Introduce kvm_pgtable_stage2_reclaim_leaves
  ANDROID: GKI: enable CONFIG_BLK_CGROUP_IOCOST
  BACKPORT: FROMGIT: usb: core: add sysfs entry for usb device state
  ANDROID: GKI: Update symbols to symbol list
  ANDROID: HID; Over-ride default maximum buffer size when using UHID
  UPSTREAM: maple_tree: make maple state reusable after mas_empty_area()
  Revert "Revert "mm/mmap: regression fix for unmapped_area{_topdown}""
  FROMLIST: scsi: ufs: ufs-mediatek: Set UFSHCD_QUIRK_MCQ_BROKEN_RTC quirk
  FROMLIST: scsi: ufs: ufs-mediatek: Set UFSHCD_QUIRK_MCQ_BROKEN_INTR quirk
  FROMLIST: scsi: ufs: core: Add host quirk UFSHCD_QUIRK_MCQ_BROKEN_RTC
  FROMLIST: scsi: ufs: core: Add host quirk UFSHCD_QUIRK_MCQ_BROKEN_INTR
  ANDROID: GKI: Add symbols and update symbol list for Unisoc
  UPSTREAM: mailbox: mailbox-test: fix a locking issue in mbox_test_message_write()
  UPSTREAM: mailbox: mailbox-test: Fix potential double-free in mbox_test_message_write()
  ANDROID: dma-buf: support users to change dma_buf.name
  ANDROID: set CONFIG_IKHEADERS=m for gki_defconfig.
  ANDROID: mm: Avoid merging cma with others
  ANDROID: cpufreq: times: record fast switch frequency transitions
  ANDROID: fix kernelci build failure in vmscan.c
  ANDROID: ABI: Update symbol list for Exynos SoC
  ANDROID: gki_defconfig: enable NVME
  ANDROID: ABI: Update symbols to unisoc whitelist for the scheduler
  UPSTREAM: usb: gadget: uvc: queue empty isoc requests if no video buffer is available
  ANDROID: GKI: Update symbol list for xiaomi
  ANDROID: vendor_hooks:vendor hook for madvise_cold_or_pageout_pte_range.
  ANDROID: ABI: Update pixel symbol list
  ANDROID: KVM: arm64: iommu: Erase pvmfw from EL1 if possible
  ANDROID: ABI: Update oplus symbol list
  ANDROID: Allow vendor module to reclaim a memcg
  ANDROID: Export memcg functions to allow module to add new files
  ANDROID: vendor_hooks: add hooks in mem_cgroup subsystem
  ANDROID: GKI: Update symbols to symbol list
  ANDROID: block: export tracepoints
  ANDROID: vendor_hook: Avoid clearing protect-flag before waking waiters
  ANDROID: KVM: arm64: Deprecate late pKVM module loading
  ANDROID: ABI: Update symbol for Exynos SoC
  ANDROID: 6/7/2023 KMI update
  ANDROID: db845c: Update symbol list
  FROMLIST: ufs: core: Add error handling for MCQ mode
  FROMLIST: ufs: mcq: Use ufshcd_mcq_poll_cqe_lock() in mcq mode
  FROMLIST: ufs: mcq: Added ufshcd_mcq_abort()
  FROMLIST: ufs: mcq: Add support for clean up mcq resources
  FROMLIST: ufs: mcq: Add supporting functions for mcq abort
  FROMLIST: ufs: core: Update the ufshcd_clear_cmds() functionality
  FROMLIST: ufs: core: Combine 32-bit command_desc_base_addr_lo/hi
  ANDROID: GKI: Add OEM data to mutex/rwsem
  BACKPORT: mm: Multi-gen LRU: remove wait_event_killable()
  FROMGIT: Binder: Add async from to transaction record
  BACKPORT: FROMGIT: Binder: Add timestamp to transaction record
  ANDROID: GKI: add ANDROID_OEM_DATA() in struct request_queue
  ANDROID: GKI: Add ANDROID_OEM_DATA() in struct ufs_hba
  ANDROID: GKI: add ANDROID_OEM_DATA in struct bio
  ANDROID: GKI: Add ANDROID_OEM_DATA() in struct queue_limits
  ANDROID: GKI: Add ANDROID_OEM_DATA in struct ufs_dev_info
  ANDROID: sched: Add oem data in struct rq
  ANDROID: nl80211: reserve UAPI attributes to support backporting after KMI freeze
  ANDROID: GKI: mm: Add Android ABI padding to MGLRU structures
  ANDROID: abi_gki_aarch64_qcom: Add secure hibernation APIs
  ANDROID: abi_gki_aarch64_qcom: Add hibernation APIs
  ANDROID: vendor hooks: Encrypt snapshot for bootloader based hibernation
  UPSTREAM: tty: serial: qcom-geni-serial: Add support for Hibernation feature
  ANDROID: abi_gki_aarch64_qcom: Add clk_restore_context and clk_save_context
  ANDROID: vendor hooks: Add hooks to support bootloader based hibernation
  ANDROID: gki_defconfig: Enable CONFIG_HIBERNATION flag
  ANDROID: vendor hooks: Export symbols for bootloader based hibernation
  ANDROID: gki_defconfig: enable CONFIG_LED_TRIGGER_PHY
  ANDROID: add vendor fields to swap_info_struct to record swap stats
  ANDROID: add vendor fields to swap_slots_cache to support multiple swap devices
  ANDROID: add vendor fields to lruvec to record refault stats
  ANDROID: vendor_hooks: add a field in mem_cgroup
  ANDROID: vendor_hooks: add a field in pglist_data
  ANDROID: GKI: Update db845c symbol list for down_write
  ANDROID: fix atomisp driver missing in 6.4 kernel
  BACKPORT: mm: do not increment pgfault stats when page fault handler retries
  ANDROID: GKI: enable per-vma lock stats
  UPSTREAM: mm: change per-VMA lock statistics to be disabled by default
  UPSTREAM: s390/mm: try VMA lock-based page fault handling first
  UPSTREAM: mm: separate vma->lock from vm_area_struct
  UPSTREAM: mm/mmap: free vm_area_struct without call_rcu in exit_mmap
  UPSTREAM: powerc/mm: try VMA lock-based page fault handling first
  UPSTREAM: arm64/mm: try VMA lock-based page fault handling first
  UPSTREAM: x86/mm: try VMA lock-based page fault handling first
  UPSTREAM: mm: introduce per-VMA lock statistics
  UPSTREAM: mm: prevent userfaults to be handled under per-vma lock
  UPSTREAM: mm: prevent do_swap_page from handling page faults under VMA lock
  UPSTREAM: mm: add FAULT_FLAG_VMA_LOCK flag
  UPSTREAM: mm: fall back to mmap_lock if vma->anon_vma is not yet set
  UPSTREAM: mm: introduce lock_vma_under_rcu to be used from arch-specific code
  BACKPORT: mm: introduce vma detached flag
  UPSTREAM: mm/mmap: prevent pagefault handler from racing with mmu_notifier registration
  UPSTREAM: kernel/fork: assert no VMA readers during its destruction
  UPSTREAM: mm: conditionally write-lock VMA in free_pgtables
  UPSTREAM: mm: write-lock VMAs before removing them from VMA tree
  UPSTREAM: mm/mremap: write-lock VMA while remapping it to a new address range
  FROMLIST: mm/mmap: write-lock VMAs affected by VMA expansion
  FROMLIST: mm/mmap: write-lock VMAs in vma_adjust
  FROMLIST: mm/mmap: write-lock VMAs before merging, splitting or expanding them
  UPSTREAM: mm/khugepaged: write-lock VMA while collapsing a huge page
  FROMLIST: mm/mmap: move VMA locking before vma_adjust_trans_huge call
  UPSTREAM: mm: mark VMA as being written when changing vm_flags
  UPSTREAM: mm: add per-VMA lock and helper functions to control it
  UPSTREAM: mm: move mmap_lock assert function definitions
  UPSTREAM: mm: rcu safe VMA freeing
  UPSTREAM: mm: introduce CONFIG_PER_VMA_LOCK
  UPSTREAM: mm: introduce vm_flags_reset_once to replace WRITE_ONCE vm_flags updates
  UPSTREAM: mm: export dump_mm()
  UPSTREAM: mm: introduce __vm_flags_mod and use it in untrack_pfn
  UPSTREAM: mm: replace vma->vm_flags indirect modification in ksm_madvise
  UPSTREAM: mm: replace vma->vm_flags direct modifications with modifier calls
  UPSTREAM: mm: replace VM_LOCKED_CLEAR_MASK with VM_LOCKED_MASK
  UPSTREAM: mm: introduce vma->vm_flags wrapper functions
  UPSTREAM: kernel/fork: convert vma assignment to a memcpy
  ANDROID: GKI: dentry: add Android ABI padding to some structures
  ANDROID: GKI: sched: add Android ABI padding to some structures
  ANDROID: GKI: elevator: add Android ABI padding to some structures
  ANDROID: GKI: phy: add Android ABI padding to some structures
  ANDROID: GKI: workqueue.h: add Android ABI padding to some structures
  ANDROID: GKI: scsi: add Android ABI padding to some structures
  ANDROID: GKI: device.h: add Android ABI padding to some structures
  ANDROID: GKI: timer.h: add Android ABI padding to a structure
  ANDROID: GKI: USB: add Android ABI padding to some structures
  ANDROID: GKI: sched.h: add Android ABI padding to some structures
  ANDROID: GKI: module.h: add Android ABI padding to some structures
  ANDROID: GKI: sock.h: add Android ABI padding to some structures
  ANDROID: GKI: sched: add Android ABI padding to some structures
  ANDROID: GKI: mount.h: add Android ABI padding to some structures
  ANDROID: GKI: mm: add Android ABI padding to some structures
  ANDROID: GKI: add some padding to some driver core structures
  ANDROID: GKI: add padding to struct HID structures
  ANDROID: GKI: USB: XHCI: add Android ABI padding to lots of xhci structures
  ANDROID: GKI: dwc3: add Android ABI padding to some structures
  ANDROID: GKI: sound/usb/card.h: add Android ABI padding to struct snd_usb_endpoint
  ANDROID: GKI: user_namespace.h: add Android ABI padding to a structure
  ANDROID: GKI: quota.h: add Android ABI padding to some structures
  ANDROID: GKI: mmu_notifier.h: add Android ABI padding to some structures
  ANDROID: GKI: mm.h: add Android ABI padding to a structure
  ANDROID: GKI: kobject.h: add Android ABI padding to some structures
  ANDROID: GKI: kernfs.h: add Android ABI padding to some structures
  ANDROID: GKI: irqdomain.h: add Android ABI padding to a structure
  ANDROID: GKI: ioport.h: add Android ABI padding to a structure
  ANDROID: GKI: iomap.h: add Android ABI padding to a structure
  ANDROID: GKI: hrtimer.h: add Android ABI padding to a structure
  ANDROID: GKI: genhd.h: add Android ABI padding to some structures
  ANDROID: GKI: ethtool.h: add Android ABI padding to a structure
  ANDROID: GKI: dma-mapping.h: add Android ABI padding to a structure
  ANDROID: GKI: networking: add Android ABI padding to a lot of networking structures
  ANDROID: GKI: blk_types.h: add Android ABI padding to a structure
  ANDROID: GKI: scsi.h: add Android ABI padding to a structure
  ANDROID: GKI: pci: add Android ABI padding to some structures
  ANDROID: GKI: add Android ABI padding to struct nf_conn
  ANDROID: GKI: add kabi padding for structures for the android14 release
  UPSTREAM: ipv{4,6}/raw: fix output xfrm lookup wrt protocol
  UPSTREAM: inet: Add IP_LOCAL_PORT_RANGE socket option
  UPSTREAM: sched/fair: Fixes for capacity inversion detection
  UPSTREAM: sched/fair: Consider capacity inversion in util_fits_cpu()
  UPSTREAM: sched/fair: Detect capacity inversion
  ANDROID: KVM: arm64: Initialize hfgwtr_el2 correctly
  UPSTREAM: net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize
  ANDROID: GKI: Add symbols and update symbol list for Unisoc(2nd)
  ANDROID: ABI: update symbol list related to meminfo for galaxy
  ANDROID: vendor_hooks: add hooks for extra memory
  BACKPORT: FROMLIST: ovl: get_acl: Fix null pointer dereference at realinode in rcu-walk mode
  BACKPORT: FROMLIST: ovl: ovl_permission: Fix null pointer dereference at realinode in rcu-walk mode
  BACKPORT: FROMLIST: ovl: Let helper ovl_i_path_real() return the realinode
  ANDROID: GKI: Update symbol list for xiaomi
  ANDROID: vendor_hooks:vendor hook for control memory dirty rate
  ANDROID: f2fs: enable cleancache
  FROMGIT: userfaultfd: fix regression in userfaultfd_unmap_prep()
  FROMGIT: BACKPORT: mm: avoid rewalk in mmap_region
  FROMGIT: maple_tree: clear up index and last setting in single entry tree
  FROMGIT: maple_tree: add mas_prev_range() and mas_find_range_rev interface
  FROMGIT: maple_tree: introduce mas_prev_slot() interface
  FROMGIT: maple_tree: relocate mas_rewalk() and mas_rewalk_if_dead()
  FROMGIT: maple_tree: add mas_next_range() and mas_find_range() interfaces
  FROMGIT: maple_tree: introduce mas_next_slot() interface
  FROMGIT: maple_tree: try harder to keep active node with mas_prev()
  FROMGIT: maple_tree: try harder to keep active node after mas_next()
  FROMGIT: BACKPORT: mm/mmap: change do_vmi_align_munmap() for maple tree iterator changes
  FROMLIST: BACKPORT: maple_tree: Refine mas_preallocate() node calculations
  ANDROID: maple_tree: Move mas_wr_modify node size calculation to mas_wr_node_size()
  FROMLIST: BACKPORT: maple_tree: Move mas_wr_end_piv() below mas_wr_extend_null()
  ANDROID: mm: Fix __vma_adjust() writes for the maple tree
  FROMLIST: BACKPORT: mm: Set up vma iterator for vma_iter_prealloc() calls
  FROMGIT: maple_tree: avoid unnecessary ascending
  FROMLIST: BACKPORT: mm: Change do_vmi_align_munmap() side tree index
  UPSTREAM: mm/mmap: remove preallocation from do_mas_align_munmap()
  ANDROID: abi_gki_aarch64_qcom: Update QCOM symbol list
  ANDROID: GKI: Update symbol list for xiaomi
  ANDROID: vendor_hooks:vendor hook for mmput
  ANDROID: ABI: update symbol list for galaxy
  ANDROID: task_mmu: add vendor hook for swap entry
  ANDROID: mm: add vendor hooks in madvise for swap entry
  BACKPORT: FROMLIST: arm64: mte: Simplify swap tag restoration logic
  FROMLIST: mm: Call arch_swap_restore() from unuse_pte()
  FROMLIST: mm: Call arch_swap_restore() from do_swap_page()
  ANDROID: abi_gki_aarch64_qcom: Update symbol list
  ANDROID: GKI: Update symbol list for xiaomi
  ANDROID: vendor_hooks:vendor hook for __alloc_pages_slowpath.
  ANDROID: ABI: Update honor symbol list
  ANDROID: mm: create vendor hooks for memory reclaim
  UPSTREAM: kcsan: Avoid READ_ONCE() in read_instrumented_memory()
  ANDROID: abi_gki_aarch64_qcom: update symbol list
  ANDROID: Update ABI as part of crash fix
  ANDROID: Fix incorrect hook declaration
  ANDROID: abi_gki_aarch64_qcom: Add GIC and hibernation APIs
  ANDROID: gic-v3: Export gic_v3_resume() for vendor GIC enhancements
  ANDROID: irqchip/irq-gic-v3: Add vendor hook for gic suspend
  ANDROID: abi_gki_aarch64_qcom: Update abi_gki_aarch64_qcom for DMA

 Conflicts:
	drivers/ufs/host/ufs-qcom.c

Change-Id: I9479fd1209d3769cd3c098554ddaceb31267f368
Signed-off-by: jianzhou <quic_jianzhou@quicinc.com>
2023-07-09 23:53:47 -07:00
Zhang Shurong
cae8542495 fbdev: fix potential OOB read in fast_imageblit()
commit c2d22806aecb24e2de55c30a06e5d6eb297d161d upstream.

There is a potential OOB read at fast_imageblit, for
"colortab[(*src >> 4)]" can become a negative value due to
"const char *s = image->data, *src".
This change makes sure the index for colortab always positive
or zero.

Similar commit:
https://patchwork.kernel.org/patch/11746067

Potential bug report:
https://groups.google.com/g/syzkaller-bugs/c/9ubBXKeKXf4/m/k-QXy4UgAAAJ

Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-07-01 13:16:25 +02:00
Greg Kroah-Hartman
2a77668d45 This is the 6.1.33 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmSC5VIACgkQONu9yGCS
 aT5RPhAAiVFNzTuQT4DtPzXUzl9hpNtdtZPVa/z28+SbOZyf2YgyDGXLHvnGbJ/2
 8DWDV9uSsxdX2InNqzD/IbRSiHjXprpDssthq3Qr5aPH7FO76uICWndrCk0dhZsK
 kI/+J7BqS1vgtaxsZeo/IHmMQJ5oEzx/JzvcyK5po0rykNDCxWNnh8cK4YtFOVtk
 eRD8cPWXvJGn88pdPPlQuS75MKBGcAUZLodN//tP+x2bcWzocaTZUCEHL36eLcVc
 0CxPykCpFOcLFLIJWQ+pY2/HR2ynTBxYoaXsTpscR+FKbS+Lz9B6PUoXCvqaV2/e
 lriLjg22lbqxBbBhEk5NLBVozajtU/gNq6pptp/EnZahwjjyavuToZviWf8NWfs0
 2u+zQlolinCKnm+8o18dRn24kI7LbUSD2w+V8FydSQNHMikvu/xHgDdLgzmj2XAf
 ZIAkHdGjRzKL2euDPrp28D5vPfCqDjqT2wUE2vUsc+Ax4k6ewFCPs3cweWD8hoFS
 fAjTC3Q/oNp6eEbWuWJPxl+DW/tD3ezRGeqrRCXQwubcgwB5iaS5ItdCCfG/lfiJ
 PNHf4kpg4FlyBf8aPD+R3QA6KOuS1owNNk3cx72zHs8zPusosHWj9hDrXeYVn06G
 gj1SIoC+jC/L5nbYH9WFLnKm9+EQ28lcp9j7f1PdlDhkcJmzBRY=
 =Qjnb
 -----END PGP SIGNATURE-----

Merge 6.1.33 into android14-6.1-lts

Changes in 6.1.33
	RDMA/bnxt_re: Fix the page_size used during the MR creation
	phy: amlogic: phy-meson-g12a-mipi-dphy-analog: fix CNTL2_DIF_TX_CTL0 value
	RDMA/efa: Fix unsupported page sizes in device
	RDMA/hns: Fix timeout attr in query qp for HIP08
	RDMA/hns: Fix base address table allocation
	RDMA/hns: Modify the value of long message loopback slice
	dmaengine: at_xdmac: fix potential Oops in at_xdmac_prep_interleaved()
	RDMA/bnxt_re: Fix a possible memory leak
	RDMA/bnxt_re: Fix return value of bnxt_re_process_raw_qp_pkt_rx
	iommu/rockchip: Fix unwind goto issue
	iommu/amd: Don't block updates to GATag if guest mode is on
	iommu/amd: Handle GALog overflows
	iommu/amd: Fix up merge conflict resolution
	nfsd: make a copy of struct iattr before calling notify_change
	dmaengine: pl330: rename _start to prevent build error
	riscv: Fix unused variable warning when BUILTIN_DTB is set
	net/mlx5: Drain health before unregistering devlink
	net/mlx5: SF, Drain health before removing device
	net/mlx5: fw_tracer, Fix event handling
	net/mlx5e: Don't attach netdev profile while handling internal error
	net: mellanox: mlxbf_gige: Fix skb_panic splat under memory pressure
	netrom: fix info-leak in nr_write_internal()
	af_packet: Fix data-races of pkt_sk(sk)->num.
	tls: improve lockless access safety of tls_err_abort()
	amd-xgbe: fix the false linkup in xgbe_phy_status
	perf ftrace latency: Remove unnecessary "--" from --use-nsec option
	mtd: rawnand: ingenic: fix empty stub helper definitions
	RDMA/irdma: Prevent QP use after free
	RDMA/irdma: Fix Local Invalidate fencing
	af_packet: do not use READ_ONCE() in packet_bind()
	tcp: deny tcp_disconnect() when threads are waiting
	tcp: Return user_mss for TCP_MAXSEG in CLOSE/LISTEN state if user_mss set
	net/smc: Scan from current RMB list when no position specified
	net/smc: Don't use RMBs not mapped to new link in SMCRv2 ADD LINK
	net/sched: sch_ingress: Only create under TC_H_INGRESS
	net/sched: sch_clsact: Only create under TC_H_CLSACT
	net/sched: Reserve TC_H_INGRESS (TC_H_CLSACT) for ingress (clsact) Qdiscs
	net/sched: Prohibit regrafting ingress or clsact Qdiscs
	net: sched: fix NULL pointer dereference in mq_attach
	net/netlink: fix NETLINK_LIST_MEMBERSHIPS length report
	udp6: Fix race condition in udp6_sendmsg & connect
	nfsd: fix double fget() bug in __write_ports_addfd()
	nvme: fix the name of Zone Append for verbose logging
	net/mlx5e: Fix error handling in mlx5e_refresh_tirs
	net/mlx5: Read embedded cpu after init bit cleared
	iommu/mediatek: Flush IOTLB completely only if domain has been attached
	net/sched: flower: fix possible OOB write in fl_set_geneve_opt()
	tcp: fix mishandling when the sack compression is deferred.
	net: dsa: mv88e6xxx: Increase wait after reset deactivation
	mtd: rawnand: marvell: ensure timing values are written
	mtd: rawnand: marvell: don't set the NAND frequency select
	rtnetlink: call validate_linkmsg in rtnl_create_link
	mptcp: avoid unneeded __mptcp_nmpc_socket() usage
	mptcp: add annotations around msk->subflow accesses
	mptcp: avoid unneeded address copy
	mptcp: simplify subflow_syn_recv_sock()
	mptcp: consolidate passive msk socket initialization
	mptcp: fix data race around msk->first access
	mptcp: add annotations around sk->sk_shutdown accesses
	drm/amdgpu: release gpu full access after "amdgpu_device_ip_late_init"
	watchdog: menz069_wdt: fix watchdog initialisation
	ALSA: hda: Glenfly: add HD Audio PCI IDs and HDMI Codec Vendor IDs.
	ASoC: Intel: soc-acpi-cht: Add quirk for Nextbook Ares 8A tablet
	drm/amdgpu: Use the default reset when loading or reloading the driver
	mailbox: mailbox-test: Fix potential double-free in mbox_test_message_write()
	drm/ast: Fix ARM compatibility
	btrfs: abort transaction when sibling keys check fails for leaves
	ARM: 9295/1: unwind:fix unwind abort for uleb128 case
	hwmon: (k10temp) Add PCI ID for family 19, model 78h
	media: rcar-vin: Select correct interrupt mode for V4L2_FIELD_ALTERNATE
	platform/x86: intel_scu_pcidrv: Add back PCI ID for Medfield
	platform/mellanox: fix potential race in mlxbf-tmfifo driver
	gfs2: Don't deref jdesc in evict
	drm/amdgpu: set gfx9 onwards APU atomics support to be true
	fbdev: imsttfb: Fix use after free bug in imsttfb_probe
	fbdev: modedb: Add 1920x1080 at 60 Hz video mode
	fbdev: stifb: Fix info entry in sti_struct on error path
	nbd: Fix debugfs_create_dir error checking
	block/rnbd: replace REQ_OP_FLUSH with REQ_OP_WRITE
	nvme-pci: add NVME_QUIRK_BOGUS_NID for HS-SSD-FUTURE 2048G
	nvme-pci: add quirk for missing secondary temperature thresholds
	ASoC: amd: yc: Add DMI entry to support System76 Pangolin 12
	ASoC: dwc: limit the number of overrun messages
	um: harddog: fix modular build
	xfrm: Check if_id in inbound policy/secpath match
	ASoC: dt-bindings: Adjust #sound-dai-cells on TI's single-DAI codecs
	ALSA: hda/realtek: Add quirks for ASUS GU604V and GU603V
	ASoC: ssm2602: Add workaround for playback distortions
	media: dvb_demux: fix a bug for the continuity counter
	media: dvb-usb: az6027: fix three null-ptr-deref in az6027_i2c_xfer()
	media: dvb-usb-v2: ec168: fix null-ptr-deref in ec168_i2c_xfer()
	media: dvb-usb-v2: ce6230: fix null-ptr-deref in ce6230_i2c_master_xfer()
	media: dvb-usb-v2: rtl28xxu: fix null-ptr-deref in rtl28xxu_i2c_xfer
	media: dvb-usb: digitv: fix null-ptr-deref in digitv_i2c_xfer()
	media: dvb-usb: dw2102: fix uninit-value in su3000_read_mac_address
	media: netup_unidvb: fix irq init by register it at the end of probe
	media: dvb_ca_en50221: fix a size write bug
	media: ttusb-dec: fix memory leak in ttusb_dec_exit_dvb()
	media: mn88443x: fix !CONFIG_OF error by drop of_match_ptr from ID table
	media: dvb-core: Fix use-after-free due on race condition at dvb_net
	media: dvb-core: Fix use-after-free due to race at dvb_register_device()
	media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*()
	media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221
	ASoC: SOF: debug: conditionally bump runtime_pm counter on exceptions
	ASoC: SOF: pcm: fix pm_runtime imbalance in error handling
	ASoC: SOF: sof-client-probes: fix pm_runtime imbalance in error handling
	ASoC: SOF: pm: save io region state in case of errors in resume
	s390/pkey: zeroize key blobs
	s390/topology: honour nr_cpu_ids when adding CPUs
	ACPI: resource: Add IRQ override quirk for LG UltraPC 17U70P
	wifi: rtl8xxxu: fix authentication timeout due to incorrect RCR value
	ARM: dts: stm32: add pin map for CAN controller on stm32f7
	arm64/mm: mark private VM_FAULT_X defines as vm_fault_t
	arm64: vdso: Pass (void *) to virt_to_page()
	wifi: mac80211: simplify chanctx allocation
	wifi: mac80211: consider reserved chanctx for mindef
	wifi: mac80211: recalc chanctx mindef before assigning
	wifi: iwlwifi: mvm: Add locking to the rate read flow
	scsi: core: Decrease scsi_device's iorequest_cnt if dispatch failed
	wifi: b43: fix incorrect __packed annotation
	net: wwan: t7xx: Ensure init is completed before system sleep
	netfilter: conntrack: define variables exp_nat_nla_policy and any_addr with CONFIG_NF_NAT
	nvme-multipath: don't call blk_mark_disk_dead in nvme_mpath_remove_disk
	nvme: do not let the user delete a ctrl before a complete initialization
	ALSA: oss: avoid missing-prototype warnings
	drm/msm: Be more shouty if per-process pgtables aren't working
	atm: hide unused procfs functions
	ceph: silence smatch warning in reconnect_caps_cb()
	drm/amdgpu: skip disabling fence driver src_irqs when device is unplugged
	ublk: fix AB-BA lockdep warning
	nvme-pci: Add quirk for Teamgroup MP33 SSD
	block: Deny writable memory mapping if block is read-only
	KVM: arm64: vgic: Fix a circular locking issue
	KVM: arm64: vgic: Wrap vgic_its_create() with config_lock
	KVM: arm64: vgic: Fix locking comment
	media: mediatek: vcodec: Only apply 4K frame sizes on decoder formats
	mailbox: mailbox-test: fix a locking issue in mbox_test_message_write()
	drivers: base: cacheinfo: Fix shared_cpu_map changes in event of CPU hotplug
	media: uvcvideo: Don't expose unsupported formats to userspace
	iio: accel: st_accel: Fix invalid mount_matrix on devices without ACPI _ONT method
	iio: adc: mxs-lradc: fix the order of two cleanup operations
	HID: google: add jewel USB id
	HID: wacom: avoid integer overflow in wacom_intuos_inout()
	iio: imu: inv_icm42600: fix timestamp reset
	dt-bindings: iio: adc: renesas,rcar-gyroadc: Fix adi,ad7476 compatible value
	iio: light: vcnl4035: fixed chip ID check
	iio: adc: stm32-adc: skip adc-channels setup if none is present
	iio: adc: ad_sigma_delta: Fix IRQ issue by setting IRQ_DISABLE_UNLAZY flag
	iio: dac: mcp4725: Fix i2c_master_send() return value handling
	iio: addac: ad74413: fix resistance input processing
	iio: adc: ad7192: Change "shorted" channels to differential
	iio: adc: stm32-adc: skip adc-diff-channels setup if none is present
	iio: dac: build ad5758 driver when AD5758 is selected
	net: usb: qmi_wwan: Set DTR quirk for BroadMobi BM818
	dt-bindings: usb: snps,dwc3: Fix "snps,hsphy_interface" type
	usb: cdns3: fix NCM gadget RX speed 20x slow than expection at iMX8QM
	usb: gadget: f_fs: Add unbind event before functionfs_unbind
	md/raid5: fix miscalculation of 'end_sector' in raid5_read_one_chunk()
	misc: fastrpc: return -EPIPE to invocations on device removal
	misc: fastrpc: reject new invocations during device removal
	scsi: stex: Fix gcc 13 warnings
	ata: libata-scsi: Use correct device no in ata_find_dev()
	drm/amdgpu: enable tmz by default for GC 11.0.1
	drm/amd/pm: reverse mclk and fclk clocks levels for SMU v13.0.4
	drm/amd/pm: reverse mclk and fclk clocks levels for vangogh
	drm/amd/pm: resolve reboot exception for si oland
	drm/amd/pm: reverse mclk clocks levels for SMU v13.0.5
	drm/amd/pm: reverse mclk and fclk clocks levels for yellow carp
	drm/amd/pm: reverse mclk and fclk clocks levels for renoir
	x86/mtrr: Revert 90b926e68f50 ("x86/pat: Fix pat_x_mtrr_type() for MTRR disabled case")
	mmc: vub300: fix invalid response handling
	mmc: pwrseq: sd8787: Fix WILC CHIP_EN and RESETN toggling order
	tty: serial: fsl_lpuart: use UARTCTRL_TXINV to send break instead of UARTCTRL_SBK
	btrfs: fix csum_tree_block page iteration to avoid tripping on -Werror=array-bounds
	phy: qcom-qmp-combo: fix init-count imbalance
	phy: qcom-qmp-pcie-msm8996: fix init-count imbalance
	block: fix revalidate performance regression
	powerpc/iommu: Limit number of TCEs to 512 for H_STUFF_TCE hcall
	iommu/amd: Fix domain flush size when syncing iotlb
	tpm, tpm_tis: correct tpm_tis_flags enumeration values
	riscv: perf: Fix callchain parse error with kernel tracepoint events
	io_uring: undeprecate epoll_ctl support
	selinux: don't use make's grouped targets feature yet
	mtdchar: mark bits of ioctl handler noinline
	tracing/timerlat: Always wakeup the timerlat thread
	tracing/histograms: Allow variables to have some modifiers
	tracing/probe: trace_probe_primary_from_call(): checked list_first_entry
	selftests: mptcp: connect: skip if MPTCP is not supported
	selftests: mptcp: pm nl: skip if MPTCP is not supported
	selftests: mptcp: join: skip if MPTCP is not supported
	selftests: mptcp: sockopt: skip if MPTCP is not supported
	selftests: mptcp: userspace pm: skip if MPTCP is not supported
	mptcp: fix connect timeout handling
	mptcp: fix active subflow finalization
	ext4: add EA_INODE checking to ext4_iget()
	ext4: set lockdep subclass for the ea_inode in ext4_xattr_inode_cache_find()
	ext4: disallow ea_inodes with extended attributes
	ext4: add lockdep annotations for i_data_sem for ea_inode's
	fbcon: Fix null-ptr-deref in soft_cursor
	serial: 8250_tegra: Fix an error handling path in tegra_uart_probe()
	serial: cpm_uart: Fix a COMPILE_TEST dependency
	powerpc/xmon: Use KSYM_NAME_LEN in array size
	test_firmware: fix a memory leak with reqs buffer
	test_firmware: fix the memory leak of the allocated firmware buffer
	KVM: arm64: Populate fault info for watchpoint
	KVM: x86: Account fastpath-only VM-Exits in vCPU stats
	ksmbd: fix credit count leakage
	ksmbd: fix UAF issue from opinfo->conn
	ksmbd: fix incorrect AllocationSize set in smb2_get_info
	ksmbd: fix slab-out-of-bounds read in smb2_handle_negotiate
	ksmbd: fix multiple out-of-bounds read during context decoding
	KEYS: asymmetric: Copy sig and digest in public_key_verify_signature()
	fs/ntfs3: Validate MFT flags before replaying logs
	regmap: Account for register length when chunking
	tpm, tpm_tis: Request threaded interrupt handler
	iommu/amd/pgtbl_v2: Fix domain max address
	drm/amd/display: Have Payload Properly Created After Resume
	xfs: verify buffer contents when we skip log replay
	tls: rx: strp: don't use GFP_KERNEL in softirq context
	arm64: efi: Use SMBIOS processor version to key off Ampere quirk
	selftests: mptcp: diag: skip if MPTCP is not supported
	selftests: mptcp: simult flows: skip if MPTCP is not supported
	selftests: mptcp: join: avoid using 'cmp --bytes'
	ext4: enable the lazy init thread when remounting read/write
	Linux 6.1.33

Note, the following commits were reverted from this merge, due to
conflicts with other KVM patches.  If they are needed later, they can be
brought back in a way that enables them to actually build properly:
	bafe94ac99 ("KVM: arm64: vgic: Fix locking comment")
	150a5f74a5 ("KVM: arm64: vgic: Wrap vgic_its_create() with config_lock")
	4129d71e5b ("KVM: arm64: vgic: Fix a circular locking issue")

Change-Id: I3c4183fbe22b22914ee8985bd6add545abded9d0
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-06-14 19:17:01 +00:00
Greg Kroah-Hartman
03c3264a15 Merge 6.1.31 into android14-6.1-lts
Changes in 6.1.31
	usb: dwc3: fix gadget mode suspend interrupt handler issue
	tpm, tpm_tis: Avoid cache incoherency in test for interrupts
	tpm, tpm_tis: Only handle supported interrupts
	tpm_tis: Use tpm_chip_{start,stop} decoration inside tpm_tis_resume
	tpm, tpm_tis: startup chip before testing for interrupts
	tpm: Re-enable TPM chip boostrapping non-tpm_tis TPM drivers
	tpm: Prevent hwrng from activating during resume
	watchdog: sp5100_tco: Immediately trigger upon starting.
	drm/amd/amdgpu: update mes11 api def
	drm/amdgpu/mes11: enable reg active poll
	skbuff: Proactively round up to kmalloc bucket size
	platform/x86: hp-wmi: Fix cast to smaller integer type warning
	net: dsa: mv88e6xxx: Add RGMII delay to 88E6320
	drm/amd/display: hpd rx irq not working with eDP interface
	ocfs2: Switch to security_inode_init_security()
	arm64: Also reset KASAN tag if page is not PG_mte_tagged
	x86/mm: Avoid incomplete Global INVLPG flushes
	platform/x86/intel/ifs: Annotate work queue on stack so object debug does not complain
	ALSA: hda/ca0132: add quirk for EVGA X299 DARK
	ALSA: hda: Fix unhandled register update during auto-suspend period
	ALSA: hda/realtek: Enable headset onLenovo M70/M90
	SUNRPC: Don't change task->tk_status after the call to rpc_exit_task
	mmc: sdhci-esdhc-imx: make "no-mmc-hs400" works
	mmc: block: ensure error propagation for non-blk
	power: supply: axp288_fuel_gauge: Fix external_power_changed race
	power: supply: bq25890: Fix external_power_changed race
	ASoC: rt5682: Disable jack detection interrupt during suspend
	net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize
	m68k: Move signal frame following exception on 68020/030
	xtensa: fix signal delivery to FDPIC process
	xtensa: add __bswap{si,di}2 helpers
	parisc: Use num_present_cpus() in alternative patching code
	parisc: Handle kgdb breakpoints only in kernel context
	parisc: Fix flush_dcache_page() for usage from irq context
	parisc: Allow to reboot machine after system halt
	parisc: Enable LOCKDEP support
	parisc: Handle kprobes breakpoints only in kernel context
	gpio: mockup: Fix mode of debugfs files
	btrfs: use nofs when cleaning up aborted transactions
	dt-binding: cdns,usb3: Fix cdns,on-chip-buff-size type
	drm/mgag200: Fix gamma lut not initialized.
	drm/radeon: reintroduce radeon_dp_work_func content
	drm/amd/pm: add missing NotifyPowerSource message mapping for SMU13.0.7
	drm/amd/pm: Fix output of pp_od_clk_voltage
	Revert "binder_alloc: add missing mmap_lock calls when using the VMA"
	Revert "android: binder: stop saving a pointer to the VMA"
	binder: add lockless binder_alloc_(set|get)_vma()
	binder: fix UAF caused by faulty buffer cleanup
	binder: fix UAF of alloc->vma in race with munmap()
	selftests/memfd: Fix unknown type name build failure
	drm/amd/amdgpu: limit one queue per gang
	perf/x86/uncore: Correct the number of CHAs on SPR
	x86/topology: Fix erroneous smp_num_siblings on Intel Hybrid platforms
	irqchip/mips-gic: Don't touch vl_map if a local interrupt is not routable
	irqchip/mips-gic: Use raw spinlock for gic_lock
	debugobjects: Don't wake up kswapd from fill_pool()
	fbdev: udlfb: Fix endpoint check
	net: fix stack overflow when LRO is disabled for virtual interfaces
	udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated().
	USB: core: Add routines for endpoint checks in old drivers
	USB: sisusbvga: Add endpoint checks
	media: radio-shark: Add endpoint checks
	ASoC: lpass: Fix for KASAN use_after_free out of bounds
	net: fix skb leak in __skb_tstamp_tx()
	drm: fix drmm_mutex_init()
	selftests: fib_tests: mute cleanup error message
	octeontx2-pf: Fix TSOv6 offload
	bpf: Fix mask generation for 32-bit narrow loads of 64-bit fields
	bpf: fix a memory leak in the LRU and LRU_PERCPU hash maps
	lan966x: Fix unloading/loading of the driver
	ipv6: Fix out-of-bounds access in ipv6_find_tlv()
	cifs: mapchars mount option ignored
	power: supply: leds: Fix blink to LED on transition
	power: supply: mt6360: add a check of devm_work_autocancel in mt6360_charger_probe
	power: supply: bq27xxx: Fix bq27xxx_battery_update() race condition
	power: supply: bq27xxx: Fix I2C IRQ race on remove
	power: supply: bq27xxx: Fix poll_interval handling and races on remove
	power: supply: bq27xxx: Add cache parameter to bq27xxx_battery_current_and_status()
	power: supply: bq27xxx: Move bq27xxx_battery_update() down
	power: supply: bq27xxx: Ensure power_supply_changed() is called on current sign changes
	power: supply: bq27xxx: After charger plug in/out wait 0.5s for things to stabilize
	power: supply: bq25890: Call power_supply_changed() after updating input current or voltage
	power: supply: bq24190: Call power_supply_changed() after updating input current
	power: supply: sbs-charger: Fix INHIBITED bit for Status reg
	optee: fix uninited async notif value
	firmware: arm_ffa: Check if ffa_driver remove is present before executing
	firmware: arm_ffa: Fix FFA device names for logical partitions
	fs: fix undefined behavior in bit shift for SB_NOUSER
	regulator: pca9450: Fix BUCK2 enable_mask
	platform/x86: ISST: Remove 8 socket limit
	coresight: Fix signedness bug in tmc_etr_buf_insert_barrier_packet()
	ARM: dts: imx6qdl-mba6: Add missing pvcie-supply regulator
	x86/pci/xen: populate MSI sysfs entries
	xen/pvcalls-back: fix double frees with pvcalls_new_active_socket()
	x86/show_trace_log_lvl: Ensure stack pointer is aligned, again
	ASoC: Intel: Skylake: Fix declaration of enum skl_ch_cfg
	ASoC: Intel: avs: Fix declaration of enum avs_channel_config
	ASoC: Intel: avs: Access path components under lock
	cxl: Wait Memory_Info_Valid before access memory related info
	sctp: fix an issue that plpmtu can never go to complete state
	forcedeth: Fix an error handling path in nv_probe()
	platform/mellanox: mlxbf-pmc: fix sscanf() error checking
	net/mlx5e: Fix SQ wake logic in ptp napi_poll context
	net/mlx5e: Fix deadlock in tc route query code
	net/mlx5e: Use correct encap attribute during invalidation
	net/mlx5e: do as little as possible in napi poll when budget is 0
	net/mlx5: DR, Fix crc32 calculation to work on big-endian (BE) CPUs
	net/mlx5: Handle pairing of E-switch via uplink un/load APIs
	net/mlx5: DR, Check force-loopback RC QP capability independently from RoCE
	net/mlx5: Fix error message when failing to allocate device memory
	net/mlx5: Collect command failures data only for known commands
	net/mlx5: Devcom, fix error flow in mlx5_devcom_register_device
	net/mlx5: Devcom, serialize devcom registration
	arm64: dts: imx8mn-var-som: fix PHY detection bug by adding deassert delay
	firmware: arm_ffa: Set reserved/MBZ fields to zero in the memory descriptors
	regulator: mt6359: add read check for PMIC MT6359
	net/smc: Reset connection when trying to use SMCRv2 fails.
	3c589_cs: Fix an error handling path in tc589_probe()
	net: phy: mscc: add VSC8502 to MODULE_DEVICE_TABLE
	Linux 6.1.31

Change-Id: I1043b7dd190672829baaf093f690e70a07c7a6dd
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-06-13 20:43:51 +00:00
Greg Kroah-Hartman
26c1cc6858 This is the 6.1.30 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmRuPHsACgkQONu9yGCS
 aT6USxAAx2uklTRE3mmIS9qytOjb8Z3gsA8LVaaQ3f25CWNiuverNj0mFyNtI9KX
 84ZBS/G8aHA6z0dtdyMupHznHehQp7pVo0LOeVMz2bR+CjkpRQei2NimG8bGRcFK
 W6c40w99lD9dYpaal3yajs+k+LF3BktmBNc0SynCjjyEy4YA5RbWOhtGX6P4VRqs
 sPXcmmAHsqDPLfqsgsHiBNsiw+dCP7jY1a17rTxz1g49/4zS6BEGtxxpU4UZNbph
 rKrX0sgF8UM15IfdFc0CiOXhAcL7QQfUbucJ/94180gclF4j6QqAMueAr6mLWkFd
 Pj7vLn/KD2wA2dzTBekHZ9SYp31xcXomkzfdLoMMnazfy3RL4sO7WhJks0k0T2En
 3LIlsRZx/C2ztf3SLq2z2Bw/ExaefrydLI9cWJBi7CQ5yUVO15edcv40W4pxoMOL
 xFDZhCksC+JNc74HPYKTmg+SJQsxtYeLrwb6zW43aJByY+rls70crfhdS5fORvmH
 G8qDS2PCNAqpulxyxQtYxiIcRiM4SqPskves+3nu7gBFGfsv2AJU1gNCorIpZuW8
 DS2jrMwPv7gH+eUvqrnrtdA+Vk4TYWslg0mPlVNavX98i9/dC9Vjss3yXCYh7Q6u
 0+BpSBLtKM4pahaMgKpYv/V/r+GKvIt7Npki8o/bs1nuykF04aw=
 =hAQM
 -----END PGP SIGNATURE-----

Merge 6.1.30 into android14-6.1-lts

Changes in 6.1.30
	drm/fbdev-generic: prohibit potential out-of-bounds access
	drm/mipi-dsi: Set the fwnode for mipi_dsi_device
	ARM: 9296/1: HP Jornada 7XX: fix kernel-doc warnings
	net: skb_partial_csum_set() fix against transport header magic value
	net: mdio: mvusb: Fix an error handling path in mvusb_mdio_probe()
	scsi: ufs: core: Fix I/O hang that occurs when BKOPS fails in W-LUN suspend
	tick/broadcast: Make broadcast device replacement work correctly
	linux/dim: Do nothing if no time delta between samples
	net: stmmac: Initialize MAC_ONEUS_TIC_COUNTER register
	net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs().
	net: phy: bcm7xx: Correct read from expansion register
	netfilter: nf_tables: always release netdev hooks from notifier
	netfilter: conntrack: fix possible bug_on with enable_hooks=1
	bonding: fix send_peer_notif overflow
	netlink: annotate accesses to nlk->cb_running
	net: annotate sk->sk_err write from do_recvmmsg()
	net: deal with most data-races in sk_wait_event()
	net: add vlan_get_protocol_and_depth() helper
	tcp: add annotations around sk->sk_shutdown accesses
	gve: Remove the code of clearing PBA bit
	ipvlan:Fix out-of-bounds caused by unclear skb->cb
	net: mscc: ocelot: fix stat counter register values
	net: datagram: fix data-races in datagram_poll()
	af_unix: Fix a data race of sk->sk_receive_queue->qlen.
	af_unix: Fix data races around sk->sk_shutdown.
	drm/i915/guc: Don't capture Gen8 regs on Xe devices
	drm/i915: Fix NULL ptr deref by checking new_crtc_state
	drm/i915/dp: prevent potential div-by-zero
	drm/i915: Expand force_probe to block probe of devices as well.
	drm/i915: taint kernel when force probing unsupported devices
	fbdev: arcfb: Fix error handling in arcfb_probe()
	ext4: reflect error codes from ext4_multi_mount_protect() to its callers
	ext4: don't clear SB_RDONLY when remounting r/w until quota is re-enabled
	ext4: allow to find by goal if EXT4_MB_HINT_GOAL_ONLY is set
	ext4: allow ext4_get_group_info() to fail
	refscale: Move shutdown from wait_event() to wait_event_idle()
	selftests: cgroup: Add 'malloc' failures checks in test_memcontrol
	rcu: Protect rcu_print_task_exp_stall() ->exp_tasks access
	open: return EINVAL for O_DIRECTORY | O_CREAT
	fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode()
	drm/displayid: add displayid_get_header() and check bounds better
	drm/amd/display: populate subvp cmd info only for the top pipe
	drm/amd/display: Correct DML calculation to align HW formula
	platform/x86: x86-android-tablets: Add Acer Iconia One 7 B1-750 data
	drm/amd/display: Enable HostVM based on rIOMMU active
	drm/amd/display: Use DC_LOG_DC in the trasform pixel function
	regmap: cache: Return error in cache sync operations for REGCACHE_NONE
	remoteproc: imx_dsp_rproc: Add custom memory copy implementation for i.MX DSP Cores
	arm64: dts: qcom: msm8996: Add missing DWC3 quirks
	media: cx23885: Fix a null-ptr-deref bug in buffer_prepare() and buffer_finish()
	media: pci: tw68: Fix null-ptr-deref bug in buf prepare and finish
	media: pvrusb2: VIDEO_PVRUSB2 depends on DVB_CORE to use dvb_* symbols
	ACPI: processor: Check for null return of devm_kzalloc() in fch_misc_setup()
	drm/rockchip: dw_hdmi: cleanup drm encoder during unbind
	memstick: r592: Fix UAF bug in r592_remove due to race condition
	arm64: dts: imx8mq-librem5: Remove dis_u3_susphy_quirk from usb_dwc3_0
	firmware: arm_sdei: Fix sleep from invalid context BUG
	ACPI: EC: Fix oops when removing custom query handlers
	drm/amd/display: fixed dcn30+ underflow issue
	remoteproc: stm32_rproc: Add mutex protection for workqueue
	drm/tegra: Avoid potential 32-bit integer overflow
	drm/msm/dp: Clean up handling of DP AUX interrupts
	ACPICA: Avoid undefined behavior: applying zero offset to null pointer
	ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in acpi_db_display_objects
	arm64: dts: qcom: sdm845-polaris: Drop inexistent properties
	irqchip/gicv3: Workaround for NVIDIA erratum T241-FABRIC-4
	ACPI: video: Remove desktops without backlight DMI quirks
	drm/amd/display: Correct DML calculation to follow HW SPEC
	drm/amd: Fix an out of bounds error in BIOS parser
	drm/amdgpu: Fix sdma v4 sw fini error
	media: Prefer designated initializers over memset for subdev pad ops
	media: mediatek: vcodec: Fix potential array out-of-bounds in decoder queue_setup
	wifi: ath: Silence memcpy run-time false positive warning
	bpf: Annotate data races in bpf_local_storage
	wifi: brcmfmac: pcie: Provide a buffer of random bytes to the device
	wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex
	ext2: Check block size validity during mount
	scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow
	scsi: lpfc: Correct used_rpi count when devloss tmo fires with no recovery
	bnxt: avoid overflow in bnxt_get_nvram_directory()
	net: pasemi: Fix return type of pasemi_mac_start_tx()
	net: Catch invalid index in XPS mapping
	netdev: Enforce index cap in netdev_get_tx_queue
	scsi: target: iscsit: Free cmds before session free
	lib: cpu_rmap: Avoid use after free on rmap->obj array entries
	scsi: message: mptlan: Fix use after free bug in mptlan_remove() due to race condition
	gfs2: Fix inode height consistency check
	scsi: ufs: ufs-pci: Add support for Intel Lunar Lake
	ext4: set goal start correctly in ext4_mb_normalize_request
	ext4: Fix best extent lstart adjustment logic in ext4_mb_new_inode_pa()
	crypto: jitter - permanent and intermittent health errors
	f2fs: Fix system crash due to lack of free space in LFS
	f2fs: fix to drop all dirty pages during umount() if cp_error is set
	f2fs: fix to check readonly condition correctly
	samples/bpf: Fix fout leak in hbm's run_bpf_prog
	bpf: Add preempt_count_{sub,add} into btf id deny list
	md: fix soft lockup in status_resync
	wifi: iwlwifi: pcie: fix possible NULL pointer dereference
	wifi: iwlwifi: add a new PCI device ID for BZ device
	wifi: iwlwifi: pcie: Fix integer overflow in iwl_write_to_user_buf
	wifi: iwlwifi: mvm: fix ptk_pn memory leak
	block, bfq: Fix division by zero error on zero wsum
	wifi: ath11k: Ignore frags from uninitialized peer in dp.
	wifi: iwlwifi: fix iwl_mvm_max_amsdu_size() for MLO
	null_blk: Always check queue mode setting from configfs
	wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace
	wifi: ath11k: Fix SKB corruption in REO destination ring
	nbd: fix incomplete validation of ioctl arg
	ipvs: Update width of source for ip_vs_sync_conn_options
	Bluetooth: btusb: Add new PID/VID 04ca:3801 for MT7663
	Bluetooth: Add new quirk for broken local ext features page 2
	Bluetooth: btrtl: add support for the RTL8723CS
	Bluetooth: Improve support for Actions Semi ATS2851 based devices
	Bluetooth: btrtl: check for NULL in btrtl_set_quirks()
	Bluetooth: btintel: Add LE States quirk support
	Bluetooth: hci_bcm: Fall back to getting bdaddr from EFI if not set
	Bluetooth: Add new quirk for broken set random RPA timeout for ATS2851
	Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp
	Bluetooth: btrtl: Add the support for RTL8851B
	staging: rtl8192e: Replace macro RTL_PCI_DEVICE with PCI_DEVICE
	HID: apple: Set the tilde quirk flag on the Geyser 4 and later
	staging: axis-fifo: initialize timeouts in init only
	ASoC: amd: yc: Add DMI entries to support HP OMEN 16-n0xxx (8A42)
	HID: logitech-hidpp: Don't use the USB serial for USB devices
	HID: logitech-hidpp: Reconcile USB and Unifying serials
	spi: spi-imx: fix MX51_ECSPI_* macros when cs > 3
	usb: typec: ucsi: acpi: add quirk for ASUS Zenbook UM325
	ALSA: hda: LNL: add HD Audio PCI ID
	ASoC: amd: Add Dell G15 5525 to quirks list
	ASoC: amd: yc: Add ThinkBook 14 G5+ ARP to quirks list for acp6x
	HID: apple: Set the tilde quirk flag on the Geyser 3
	HID: Ignore battery for ELAN touchscreen on ROG Flow X13 GV301RA
	HID: wacom: generic: Set battery quirk only when we see battery data
	usb: typec: tcpm: fix multiple times discover svids error
	serial: 8250: Reinit port->pm on port specific driver unbind
	mcb-pci: Reallocate memory region to avoid memory overlapping
	sched: Fix KCSAN noinstr violation
	lkdtm/stackleak: Fix noinstr violation
	recordmcount: Fix memory leaks in the uwrite function
	soundwire: dmi-quirks: add remapping for Intel 'Rooks County' NUC M15
	phy: st: miphy28lp: use _poll_timeout functions for waits
	soundwire: qcom: gracefully handle too many ports in DT
	soundwire: bus: Fix unbalanced pm_runtime_put() causing usage count underflow
	mfd: intel_soc_pmic_chtwc: Add Lenovo Yoga Book X90F to intel_cht_wc_models
	mfd: dln2: Fix memory leak in dln2_probe()
	mfd: intel-lpss: Add Intel Meteor Lake PCH-S LPSS PCI IDs
	parisc: Replace regular spinlock with spin_trylock on panic path
	platform/x86: Move existing HP drivers to a new hp subdir
	platform/x86: hp-wmi: add micmute to hp_wmi_keymap struct
	drm/amdgpu: drop gfx_v11_0_cp_ecc_error_irq_funcs
	xfrm: don't check the default policy if the policy allows the packet
	Revert "Fix XFRM-I support for nested ESP tunnels"
	drm/msm/dp: unregister audio driver during unbind
	drm/msm/dpu: Assign missing writeback log_mask
	drm/msm/dpu: Move non-MDP_TOP INTF_INTR offsets out of hwio header
	drm/msm/dpu: Remove duplicate register defines from INTF
	dt-bindings: display/msm: dsi-controller-main: Document qcom, master-dsi and qcom, sync-dual-dsi
	platform: Provide a remove callback that returns no value
	ASoC: fsl_micfil: Fix error handler with pm_runtime_enable
	cpupower: Make TSC read per CPU for Mperf monitor
	xfrm: Reject optional tunnel/BEET mode templates in outbound policies
	af_key: Reject optional tunnel/BEET mode templates in outbound policies
	drm/msm: Fix submit error-path leaks
	selftests: seg6: disable DAD on IPv6 router cfg for srv6_end_dt4_l3vpn_test
	selftets: seg6: disable rp_filter by default in srv6_end_dt4_l3vpn_test
	net: fec: Better handle pm_runtime_get() failing in .remove()
	net: phy: dp83867: add w/a for packet errors seen with short cables
	ALSA: firewire-digi00x: prevent potential use after free
	wifi: mt76: connac: fix stats->tx_bytes calculation
	ALSA: hda/realtek: Apply HP B&O top speaker profile to Pavilion 15
	sfc: disable RXFCS and RXALL features by default
	vsock: avoid to close connected socket after the timeout
	tcp: fix possible sk_priority leak in tcp_v4_send_reset()
	serial: arc_uart: fix of_iomap leak in `arc_serial_probe`
	serial: 8250_bcm7271: balance clk_enable calls
	serial: 8250_bcm7271: fix leak in `brcmuart_probe`
	erspan: get the proto with the md version for collect_md
	net: dsa: rzn1-a5psw: enable management frames for CPU port
	net: dsa: rzn1-a5psw: fix STP states handling
	net: dsa: rzn1-a5psw: disable learning for standalone ports
	net: hns3: fix output information incomplete for dumping tx queue info with debugfs
	net: hns3: fix sending pfc frames after reset issue
	net: hns3: fix reset delay time to avoid configuration timeout
	net: hns3: fix reset timeout when enable full VF
	media: netup_unidvb: fix use-after-free at del_timer()
	SUNRPC: double free xprt_ctxt while still in use
	SUNRPC: always free ctxt when freeing deferred request
	SUNRPC: Fix trace_svc_register() call site
	ASoC: mediatek: mt8186: Fix use-after-free in driver remove path
	ASoC: SOF: topology: Fix logic for copying tuples
	drm/exynos: fix g2d_open/close helper function definitions
	net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment()
	virtio-net: Maintain reverse cleanup order
	virtio_net: Fix error unwinding of XDP initialization
	tipc: add tipc_bearer_min_mtu to calculate min mtu
	tipc: do not update mtu if msg_max is too small in mtu negotiation
	tipc: check the bearer min mtu properly when setting it by netlink
	s390/cio: include subchannels without devices also for evaluation
	can: dev: fix missing CAN XL support in can_put_echo_skb()
	net: bcmgenet: Remove phy_stop() from bcmgenet_netif_stop()
	net: bcmgenet: Restore phy_stop() depending upon suspend/close
	ice: introduce clear_reset_state operation
	ice: Fix ice VF reset during iavf initialization
	wifi: cfg80211: Drop entries with invalid BSSIDs in RNR
	wifi: mac80211: fortify the spinlock against deadlock by interrupt
	wifi: mac80211: fix min center freq offset tracing
	wifi: mac80211: Abort running color change when stopping the AP
	wifi: iwlwifi: mvm: fix cancel_delayed_work_sync() deadlock
	wifi: iwlwifi: fw: fix DBGI dump
	wifi: iwlwifi: fix OEM's name in the ppag approved list
	wifi: iwlwifi: mvm: fix OEM's name in the tas approved list
	wifi: iwlwifi: mvm: don't trust firmware n_channels
	scsi: storvsc: Don't pass unused PFNs to Hyper-V host
	net: tun: rebuild error handling in tun_get_user
	tun: Fix memory leak for detached NAPI queue.
	cassini: Fix a memory leak in the error handling path of cas_init_one()
	net: dsa: mv88e6xxx: Fix mv88e6393x EPC write command offset
	igb: fix bit_shift to be in [1..8] range
	vlan: fix a potential uninit-value in vlan_dev_hard_start_xmit()
	net: wwan: iosm: fix NULL pointer dereference when removing device
	net: pcs: xpcs: fix C73 AN not getting enabled
	net: selftests: Fix optstring
	netfilter: nf_tables: fix nft_trans type confusion
	netfilter: nft_set_rbtree: fix null deref on element insertion
	bridge: always declare tunnel functions
	ALSA: usb-audio: Add a sample rate workaround for Line6 Pod Go
	USB: usbtmc: Fix direction for 0-length ioctl control messages
	usb-storage: fix deadlock when a scsi command timeouts more than once
	USB: UHCI: adjust zhaoxin UHCI controllers OverCurrent bit value
	usb: dwc3: gadget: Improve dwc3_gadget_suspend() and dwc3_gadget_resume()
	usb: dwc3: debugfs: Resume dwc3 before accessing registers
	usb: gadget: u_ether: Fix host MAC address case
	usb: typec: altmodes/displayport: fix pin_assignment_show
	Revert "usb: gadget: udc: core: Prevent redundant calls to pullup"
	Revert "usb: gadget: udc: core: Invoke usb_gadget_connect only when started"
	xhci-pci: Only run d3cold avoidance quirk for s2idle
	xhci: Fix incorrect tracking of free space on transfer rings
	ALSA: hda: Fix Oops by 9.1 surround channel names
	ALSA: hda: Add NVIDIA codec IDs a3 through a7 to patch table
	ALSA: hda/realtek: Add quirk for Clevo L140AU
	ALSA: hda/realtek: Add a quirk for HP EliteDesk 805
	ALSA: hda/realtek: Add quirk for 2nd ASUS GU603
	ALSA: hda/realtek: Add quirk for HP EliteBook G10 laptops
	ALSA: hda/realtek: Fix mute and micmute LEDs for yet another HP laptop
	can: j1939: recvmsg(): allow MSG_CMSG_COMPAT flag
	can: isotp: recvmsg(): allow MSG_CMSG_COMPAT flag
	can: kvaser_pciefd: Set CAN_STATE_STOPPED in kvaser_pciefd_stop()
	can: kvaser_pciefd: Call request_irq() before enabling interrupts
	can: kvaser_pciefd: Empty SRB buffer in probe
	can: kvaser_pciefd: Clear listen-only bit if not explicitly requested
	can: kvaser_pciefd: Do not send EFLUSH command on TFD interrupt
	can: kvaser_pciefd: Disable interrupts in probe error path
	wifi: rtw88: use work to update rate to avoid RCU warning
	SMB3: Close all deferred handles of inode in case of handle lease break
	SMB3: drop reference to cfile before sending oplock break
	ksmbd: smb2: Allow messages padded to 8byte boundary
	ksmbd: allocate one more byte for implied bcc[0]
	ksmbd: fix wrong UserName check in session_user
	ksmbd: fix global-out-of-bounds in smb2_find_context_vals
	KVM: Fix vcpu_array[0] races
	statfs: enforce statfs[64] structure initialization
	maple_tree: make maple state reusable after mas_empty_area()
	mm: fix zswap writeback race condition
	serial: Add support for Advantech PCI-1611U card
	serial: 8250_exar: Add support for USR298x PCI Modems
	serial: qcom-geni: fix enabling deactivated interrupt
	thunderbolt: Clear registers properly when auto clear isn't in use
	vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF
	ceph: force updating the msg pointer in non-split case
	drm/amd/pm: fix possible power mode mismatch between driver and PMFW
	drm/amdgpu/gmc11: implement get_vbios_fb_size()
	drm/amdgpu/gfx10: Disable gfxoff before disabling powergating.
	drm/amdgpu/gfx11: Adjust gfxoff before powergating on gfx11 as well
	drm/amdgpu: refine get gpu clock counter method
	drm/amdgpu/gfx11: update gpu_clock_counter logic
	dt-bindings: ata: ahci-ceva: Cover all 4 iommus entries
	powerpc/iommu: DMA address offset is incorrectly calculated with 2MB TCEs
	powerpc/iommu: Incorrect DDW Table is referenced for SR-IOV device
	tpm/tpm_tis: Disable interrupts for more Lenovo devices
	powerpc/64s/radix: Fix soft dirty tracking
	nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode()
	s390/dasd: fix command reject error on ESE devices
	s390/crypto: use vector instructions only if available for ChaCha20
	s390/qdio: fix do_sqbs() inline assembly constraint
	arm64: mte: Do not set PG_mte_tagged if tags were not initialized
	rethook: use preempt_{disable, enable}_notrace in rethook_trampoline_handler
	rethook, fprobe: do not trace rethook related functions
	remoteproc: imx_dsp_rproc: Fix kernel test robot sparse warning
	crypto: testmgr - fix RNG performance in fuzz tests
	drm/amdgpu: declare firmware for new MES 11.0.4
	drm/amd/amdgpu: introduce gc_*_mes_2.bin v2
	drm/amdgpu: reserve the old gc_11_0_*_mes.bin
	Linux 6.1.30

Change-Id: I411885affcf017410aab34bf3fba2dde96df6593
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-06-12 20:48:03 +00:00
Greg Kroah-Hartman
ef75a88787 Merge 6.1.28 into android14-6.1-lts
Changes in 6.1.28
	ASOC: Intel: sof_sdw: add quirk for Intel 'Rooks County' NUC M15
	ASoC: Intel: soc-acpi: add table for Intel 'Rooks County' NUC M15
	ASoC: soc-pcm: fix hw->formats cleared by soc_pcm_hw_init() for dpcm
	x86/hyperv: Block root partition functionality in a Confidential VM
	ASoC: amd: yc: Add DMI entries to support Victus by HP Laptop 16-e1xxx (8A22)
	iio: adc: palmas_gpadc: fix NULL dereference on rmmod
	ASoC: Intel: bytcr_rt5640: Add quirk for the Acer Iconia One 7 B1-750
	ASoC: da7213.c: add missing pm_runtime_disable()
	net: wwan: t7xx: do not compile with -Werror
	selftests mount: Fix mount_setattr_test builds failed
	scsi: mpi3mr: Handle soft reset in progress fault code (0xF002)
	net: sfp: add quirk enabling 2500Base-x for HG MXPD-483II
	platform/x86: thinkpad_acpi: Add missing T14s Gen1 type to s2idle quirk list
	wifi: ath11k: reduce the MHI timeout to 20s
	tracing: Error if a trace event has an array for a __field()
	asm-generic/io.h: suppress endianness warnings for readq() and writeq()
	x86/cpu: Add model number for Intel Arrow Lake processor
	wireguard: timers: cast enum limits members to int in prints
	wifi: mt76: mt7921e: Set memory space enable in PCI_COMMAND if unset
	ASoC: amd: fix ACP version typo mistake
	ASoC: amd: ps: update the acp clock source.
	arm64: Always load shadow stack pointer directly from the task struct
	arm64: Stash shadow stack pointer in the task struct on interrupt
	powerpc/boot: Fix boot wrapper code generation with CONFIG_POWER10_CPU
	PCI: kirin: Select REGMAP_MMIO
	PCI: pciehp: Fix AB-BA deadlock between reset_lock and device_lock
	PCI: qcom: Fix the incorrect register usage in v2.7.0 config
	phy: qcom-qmp-pcie: sc8180x PCIe PHY has 2 lanes
	IMA: allow/fix UML builds
	usb: gadget: udc: core: Invoke usb_gadget_connect only when started
	usb: gadget: udc: core: Prevent redundant calls to pullup
	usb: dwc3: gadget: Stall and restart EP0 if host is unresponsive
	USB: dwc3: fix runtime pm imbalance on probe errors
	USB: dwc3: fix runtime pm imbalance on unbind
	hwmon: (k10temp) Check range scale when CUR_TEMP register is read-write
	hwmon: (adt7475) Use device_property APIs when configuring polarity
	tpm: Add !tpm_amd_is_rng_defective() to the hwrng_unregister() call site
	posix-cpu-timers: Implement the missing timer_wait_running callback
	media: ov8856: Do not check for for module version
	blk-stat: fix QUEUE_FLAG_STATS clear
	blk-crypto: don't use struct request_queue for public interfaces
	blk-crypto: add a blk_crypto_config_supported_natively helper
	blk-crypto: move internal only declarations to blk-crypto-internal.h
	blk-crypto: Add a missing include directive
	blk-mq: release crypto keyslot before reporting I/O complete
	blk-crypto: make blk_crypto_evict_key() return void
	blk-crypto: make blk_crypto_evict_key() more robust
	staging: iio: resolver: ads1210: fix config mode
	tty: Prevent writing chars during tcsetattr TCSADRAIN/FLUSH
	xhci: fix debugfs register accesses while suspended
	serial: fix TIOCSRS485 locking
	serial: 8250: Fix serial8250_tx_empty() race with DMA Tx
	serial: max310x: fix IO data corruption in batched operations
	tick/nohz: Fix cpu_is_hotpluggable() by checking with nohz subsystem
	fs: fix sysctls.c built
	MIPS: fw: Allow firmware to pass a empty env
	ipmi:ssif: Add send_retries increment
	ipmi: fix SSIF not responding under certain cond.
	iio: addac: stx104: Fix race condition when converting analog-to-digital
	iio: addac: stx104: Fix race condition for stx104_write_raw()
	kheaders: Use array declaration instead of char
	wifi: mt76: add missing locking to protect against concurrent rx/status calls
	pwm: meson: Fix axg ao mux parents
	pwm: meson: Fix g12a ao clk81 name
	soundwire: qcom: correct setting ignore bit on v1.5.1
	pinctrl: qcom: lpass-lpi: set output value before enabling output
	ring-buffer: Ensure proper resetting of atomic variables in ring_buffer_reset_online_cpus
	ring-buffer: Sync IRQ works before buffer destruction
	crypto: api - Demote BUG_ON() in crypto_unregister_alg() to a WARN_ON()
	crypto: safexcel - Cleanup ring IRQ workqueues on load failure
	crypto: arm64/aes-neonbs - fix crash with CFI enabled
	crypto: ccp - Don't initialize CCP for PSP 0x1649
	rcu: Avoid stack overflow due to __rcu_irq_enter_check_tick() being kprobe-ed
	reiserfs: Add security prefix to xattr name in reiserfs_security_write()
	KVM: nVMX: Emulate NOPs in L2, and PAUSE if it's not intercepted
	KVM: arm64: Avoid vcpu->mutex v. kvm->lock inversion in CPU_ON
	KVM: arm64: Avoid lock inversion when setting the VM register width
	KVM: arm64: Use config_lock to protect data ordered against KVM_RUN
	KVM: arm64: Use config_lock to protect vgic state
	KVM: arm64: vgic: Don't acquire its_lock before config_lock
	relayfs: fix out-of-bounds access in relay_file_read
	drm/amd/display: Remove stutter only configurations
	drm/amd/display: limit timing for single dimm memory
	drm/amd/display: fix PSR-SU/DSC interoperability support
	drm/amd/display: fix a divided-by-zero error
	KVM: RISC-V: Retry fault if vma_lookup() results become invalid
	ksmbd: fix racy issue under cocurrent smb2 tree disconnect
	ksmbd: call rcu_barrier() in ksmbd_server_exit()
	ksmbd: fix NULL pointer dereference in smb2_get_info_filesystem()
	ksmbd: fix memleak in session setup
	ksmbd: not allow guest user on multichannel
	ksmbd: fix deadlock in ksmbd_find_crypto_ctx()
	ACPI: video: Remove acpi_backlight=video quirk for Lenovo ThinkPad W530
	i2c: omap: Fix standard mode false ACK readings
	riscv: mm: remove redundant parameter of create_fdt_early_page_table
	tracing: Fix permissions for the buffer_percent file
	swsmu/amdgpu_smu: Fix the wrong if-condition
	drm/amd/pm: re-enable the gfx imu when smu resume
	iommu/amd: Fix "Guest Virtual APIC Table Root Pointer" configuration in IRTE
	RISC-V: Align SBI probe implementation with spec
	Revert "ubifs: dirty_cow_znode: Fix memleak in error handling path"
	ubifs: Fix memleak when insert_old_idx() failed
	ubi: Fix return value overwrite issue in try_write_vid_and_data()
	ubifs: Free memory for tmpfile name
	ubifs: Fix memory leak in do_rename
	ceph: fix potential use-after-free bug when trimming caps
	xfs: don't consider future format versions valid
	cxl/hdm: Fail upon detecting 0-sized decoders
	bus: mhi: host: Remove duplicate ee check for syserr
	bus: mhi: host: Use mhi_tryset_pm_state() for setting fw error state
	bus: mhi: host: Range check CHDBOFF and ERDBOFF
	ASoC: dt-bindings: qcom,lpass-rx-macro: correct minItems for clocks
	kunit: improve KTAP compliance of KUnit test output
	kunit: fix bug in the order of lines in debugfs logs
	rcu: Fix missing TICK_DEP_MASK_RCU_EXP dependency check
	selftests/resctrl: Return NULL if malloc_and_init_memory() did not alloc mem
	selftests/resctrl: Move ->setup() call outside of test specific branches
	selftests/resctrl: Allow ->setup() to return errors
	selftests/resctrl: Check for return value after write_schemata()
	selinux: fix Makefile dependencies of flask.h
	selinux: ensure av_permissions.h is built when needed
	tpm, tpm_tis: Do not skip reset of original interrupt vector
	tpm, tpm_tis: Claim locality before writing TPM_INT_ENABLE register
	tpm, tpm_tis: Disable interrupts if tpm_tis_probe_irq() failed
	tpm, tpm_tis: Claim locality before writing interrupt registers
	tpm, tpm: Implement usage counter for locality
	tpm, tpm_tis: Claim locality when interrupts are reenabled on resume
	erofs: stop parsing non-compact HEAD index if clusterofs is invalid
	erofs: initialize packed inode after root inode is assigned
	erofs: fix potential overflow calculating xattr_isize
	drm/rockchip: Drop unbalanced obj unref
	drm/i915/dg2: Drop one PCI ID
	drm/vgem: add missing mutex_destroy
	drm/probe-helper: Cancel previous job before starting new one
	drm/amdgpu: register a vga_switcheroo client for MacBooks with apple-gmux
	tools/x86/kcpuid: Fix avx512bw and avx512lvl fields in Fn00000007
	soc: ti: pm33xx: Fix refcount leak in am33xx_pm_probe
	arm64: dts: renesas: r8a77990: Remove bogus voltages from OPP table
	arm64: dts: renesas: r8a774c0: Remove bogus voltages from OPP table
	arm64: dts: renesas: r9a07g044: Update IRQ numbers for SSI channels
	arm64: dts: renesas: r9a07g054: Update IRQ numbers for SSI channels
	arm64: dts: renesas: r9a07g043: Introduce SOC_PERIPHERAL_IRQ() macro to specify interrupt property
	arm64: dts: renesas: r9a07g043: Update IRQ numbers for SSI channels
	drm/mediatek: dp: Only trigger DRM HPD events if bridge is attached
	drm/msm/disp/dpu: check for crtc enable rather than crtc active to release shared resources
	EDAC/skx: Fix overflows on the DRAM row address mapping arrays
	ARM: dts: qcom-apq8064: Fix opp table child name
	regulator: core: Shorten off-on-delay-us for always-on/boot-on by time since booted
	arm64: dts: ti: k3-am62-main: Fix GPIO numbers in DT
	arm64: dts: ti: k3-am62a7-sk: Fix DDR size to full 4GB
	arm64: dts: ti: k3-j721e-main: Remove ti,strobe-sel property
	arm64: dts: broadcom: bcmbca: bcm4908: fix NAND interrupt name
	arm64: dts: broadcom: bcmbca: bcm4908: fix LED nodenames
	arm64: dts: broadcom: bcmbca: bcm4908: fix procmon nodename
	arm64: dts: qcom: msm8998: Fix stm-stimulus-base reg name
	arm64: dts: qcom: sc7280: fix EUD port properties
	arm64: dts: qcom: sdm845: correct dynamic power coefficients
	arm64: dts: qcom: sdm845: Fix the PCI I/O port range
	arm64: dts: qcom: msm8998: Fix the PCI I/O port range
	arm64: dts: qcom: sc7280: Fix the PCI I/O port range
	arm64: dts: qcom: ipq8074: Fix the PCI I/O port range
	arm64: dts: qcom: ipq6018: Fix the PCI I/O port range
	arm64: dts: qcom: msm8996: Fix the PCI I/O port range
	arm64: dts: qcom: sm8250: Fix the PCI I/O port range
	arm64: dts: qcom: sm8150: Fix the PCI I/O port range
	arm64: dts: qcom: sm8450: Fix the PCI I/O port range
	ARM: dts: qcom: ipq4019: Fix the PCI I/O port range
	ARM: dts: qcom: ipq8064: Fix the PCI I/O port range
	ARM: dts: qcom: sdx55: Fix the unit address of PCIe EP node
	x86/MCE/AMD: Use an u64 for bank_map
	media: bdisp: Add missing check for create_workqueue
	media: platform: mtk-mdp3: Add missing check and free for ida_alloc
	media: amphion: decoder implement display delay enable
	media: av7110: prevent underflow in write_ts_to_decoder()
	firmware: qcom_scm: Clear download bit during reboot
	drm/bridge: adv7533: Fix adv7533_mode_valid for adv7533 and adv7535
	media: max9286: Free control handler
	arm64: dts: ti: k3-am625: Correct L2 cache size to 512KB
	arm64: dts: ti: k3-am62a7: Correct L2 cache size to 512KB
	drm/msm/adreno: drop bogus pm_runtime_set_active()
	drm: msm: adreno: Disable preemption on Adreno 510
	virt/coco/sev-guest: Double-buffer messages
	arm64: dts: qcom: sm8350-microsoft-surface: fix USB dual-role mode property
	drm/amd/display/dc/dce60/Makefile: Fix previous attempt to silence known override-init warnings
	ACPI: processor: Fix evaluating _PDC method when running as Xen dom0
	mmc: sdhci-of-esdhc: fix quirk to ignore command inhibit for data
	arm64: dts: qcom: sm8450: fix pcie1 gpios properties name
	drm: rcar-du: Fix a NULL vs IS_ERR() bug
	ARM: dts: gta04: fix excess dma channel usage
	firmware: arm_scmi: Fix xfers allocation on Rx channel
	perf/arm-cmn: Move overlapping wp_combine field
	ARM: dts: stm32: fix spi1 pin assignment on stm32mp15
	arm64: dts: apple: t8103: Disable unused PCIe ports
	cpufreq: mediatek: fix passing zero to 'PTR_ERR'
	cpufreq: mediatek: fix KP caused by handler usage after regulator_put/clk_put
	cpufreq: mediatek: raise proc/sram max voltage for MT8516
	cpufreq: mediatek: Raise proc and sram max voltage for MT7622/7623
	cpufreq: qcom-cpufreq-hw: Revert adding cpufreq qos
	arm64: dts: mediatek: mt8192-asurada: Fix voltage constraint for Vgpu
	ACPI: VIOT: Initialize the correct IOMMU fwspec
	drm/lima/lima_drv: Add missing unwind goto in lima_pdev_probe()
	drm/mediatek: dp: Change the aux retries times when receiving AUX_DEFER
	mailbox: mpfs: switch to txdone_poll
	soc: bcm: brcmstb: biuctrl: fix of_iomap leak
	soc: renesas: renesas-soc: Release 'chipid' from ioremap()
	gpu: host1x: Fix potential double free if IOMMU is disabled
	gpu: host1x: Fix memory leak of device names
	arm64: dts: qcom: sc7280-herobrine-villager: correct trackpad supply
	arm64: dts: qcom: sc7180-trogdor-lazor: correct trackpad supply
	arm64: dts: qcom: sc7180-trogdor-pazquel: correct trackpad supply
	arm64: dts: qcom: msm8994-kitakami: drop unit address from PMI8994 regulator
	arm64: dts: qcom: msm8994-msft-lumia-octagon: drop unit address from PMI8994 regulator
	arm64: dts: qcom: apq8096-db820c: drop unit address from PMI8994 regulator
	drm/ttm: optimize pool allocations a bit v2
	drm/ttm/pool: Fix ttm_pool_alloc error path
	regulator: core: Consistently set mutex_owner when using ww_mutex_lock_slow()
	regulator: core: Avoid lockdep reports when resolving supplies
	x86/apic: Fix atomic update of offset in reserve_eilvt_offset()
	arm64: dts: qcom: msm8994-angler: Fix cont_splash_mem mapping
	arm64: dts: qcom: msm8994-angler: removed clash with smem_region
	arm64: dts: sc7180: Rename qspi data12 as data23
	arm64: dts: sc7280: Rename qspi data12 as data23
	media: mediatek: vcodec: Use 4K frame size when supported by stateful decoder
	media: mediatek: vcodec: Make MM21 the default capture format
	media: mediatek: vcodec: Force capture queue format to MM21
	media: mediatek: vcodec: add params to record lat and core lat_buf count
	media: mediatek: vcodec: using each instance lat_buf count replace core ready list
	media: mediatek: vcodec: move lat_buf to the top of core list
	media: mediatek: vcodec: add core decode done event
	media: mediatek: vcodec: remove unused lat_buf
	media: mediatek: vcodec: making sure queue_work successfully
	media: mediatek: vcodec: change lat thread decode error condition
	media: cedrus: fix use after free bug in cedrus_remove due to race condition
	media: rkvdec: fix use after free bug in rkvdec_remove
	platform/x86/amd/pmf: Move out of BIOS SMN pair for driver probe
	platform/x86/amd: pmc: Don't try to read SMU version on Picasso
	platform/x86/amd: pmc: Hide SMU version and program attributes for Picasso
	platform/x86/amd: pmc: Don't dump data after resume from s0i3 on picasso
	platform/x86/amd: pmc: Move idlemask check into `amd_pmc_idlemask_read`
	platform/x86/amd: pmc: Utilize SMN index 0 for driver probe
	platform/x86/amd: pmc: Move out of BIOS SMN pair for STB init
	media: dm1105: Fix use after free bug in dm1105_remove due to race condition
	media: saa7134: fix use after free bug in saa7134_finidev due to race condition
	media: platform: mtk-mdp3: fix potential frame size overflow in mdp_try_fmt_mplane()
	media: rcar_fdp1: Fix refcount leak in probe and remove function
	media: v4l: async: Return async sub-devices to subnotifier list
	media: hi846: Fix memleak in hi846_init_controls()
	drm/amd/display: Fix potential null dereference
	media: rc: gpio-ir-recv: Fix support for wake-up
	media: venus: dec: Fix handling of the start cmd
	media: venus: dec: Fix capture formats enumeration order
	regulator: stm32-pwr: fix of_iomap leak
	x86/ioapic: Don't return 0 from arch_dynirq_lower_bound()
	arm64: kgdb: Set PSTATE.SS to 1 to re-enable single-step
	perf/arm-cmn: Fix port detection for CMN-700
	media: mediatek: vcodec: fix decoder disable pm crash
	media: mediatek: vcodec: add remove function for decoder platform driver
	debugobject: Prevent init race with static objects
	drm/i915: Make intel_get_crtc_new_encoder() less oopsy
	tick/common: Align tick period with the HZ tick.
	ACPI: bus: Ensure that notify handlers are not running after removal
	cpufreq: use correct unit when verify cur freq
	rpmsg: glink: Propagate TX failures in intentless mode as well
	hwmon: (pmbus/fsp-3y) Fix functionality bitmask in FSP-3Y YM-2151E
	platform/chrome: cros_typec_switch: Add missing fwnode_handle_put()
	wifi: ath6kl: minor fix for allocation size
	wifi: ath9k: hif_usb: fix memory leak of remain_skbs
	wifi: ath11k: Use platform_get_irq() to get the interrupt
	wifi: ath5k: Use platform_get_irq() to get the interrupt
	wifi: ath5k: fix an off by one check in ath5k_eeprom_read_freq_list()
	wifi: ath11k: fix SAC bug on peer addition with sta band migration
	wifi: brcmfmac: support CQM RSSI notification with older firmware
	wifi: ath6kl: reduce WARN to dev_dbg() in callback
	tools: bpftool: Remove invalid \' json escape
	wifi: rtw88: mac: Return the original error from rtw_pwr_seq_parser()
	wifi: rtw88: mac: Return the original error from rtw_mac_power_switch()
	bpf: take into account liveness when propagating precision
	bpf: fix precision propagation verbose logging
	crypto: qat - fix concurrency issue when device state changes
	scm: fix MSG_CTRUNC setting condition for SO_PASSSEC
	wifi: ath11k: fix deinitialization of firmware resources
	selftests/bpf: Fix a fd leak in an error path in network_helpers.c
	bpf: Remove misleading spec_v1 check on var-offset stack read
	net: pcs: xpcs: remove double-read of link state when using AN
	vlan: partially enable SIOCSHWTSTAMP in container
	net/packet: annotate accesses to po->xmit
	net/packet: convert po->origdev to an atomic flag
	net/packet: convert po->auxdata to an atomic flag
	libbpf: Fix ld_imm64 copy logic for ksym in light skeleton.
	net: dsa: qca8k: remove assignment of an_enabled in pcs_get_state()
	netfilter: keep conntrack reference until IPsecv6 policy checks are done
	bpf: Fix __reg_bound_offset 64->32 var_off subreg propagation
	scsi: target: core: Change the way target_xcopy_do_work() sets restiction on max I/O
	scsi: target: Move sess cmd counter to new struct
	scsi: target: Move cmd counter allocation
	scsi: target: Pass in cmd counter to use during cmd setup
	scsi: target: iscsit: isert: Alloc per conn cmd counter
	scsi: target: iscsit: Stop/wait on cmds during conn close
	scsi: target: Fix multiple LUN_RESET handling
	scsi: target: iscsit: Fix TAS handling during conn cleanup
	scsi: megaraid: Fix mega_cmd_done() CMDID_INT_CMDS
	net: sunhme: Fix uninitialized return code
	f2fs: handle dqget error in f2fs_transfer_project_quota()
	f2fs: fix uninitialized skipped_gc_rwsem
	f2fs: apply zone capacity to all zone type
	f2fs: compress: fix to call f2fs_wait_on_page_writeback() in f2fs_write_raw_pages()
	f2fs: fix scheduling while atomic in decompression path
	crypto: caam - Clear some memory in instantiate_rng
	crypto: sa2ul - Select CRYPTO_DES
	wifi: rtlwifi: fix incorrect error codes in rtl_debugfs_set_write_rfreg()
	wifi: rtlwifi: fix incorrect error codes in rtl_debugfs_set_write_reg()
	scsi: libsas: Add sas_ata_device_link_abort()
	scsi: hisi_sas: Handle NCQ error when IPTT is valid
	wifi: rt2x00: Fix memory leak when handling surveys
	f2fs: fix iostat lock protection
	net: qrtr: correct types of trace event parameters
	selftests: xsk: Use correct UMEM size in testapp_invalid_desc
	selftests: xsk: Disable IPv6 on VETH1
	selftests: xsk: Deflakify STATS_RX_DROPPED test
	selftests/bpf: Wait for receive in cg_storage_multi test
	bpftool: Fix bug for long instructions in program CFG dumps
	crypto: drbg - Only fail when jent is unavailable in FIPS mode
	xsk: Fix unaligned descriptor validation
	f2fs: fix to avoid use-after-free for cached IPU bio
	wifi: iwlwifi: fix duplicate entry in iwl_dev_info_table
	bpf/btf: Fix is_int_ptr()
	scsi: lpfc: Fix ioremap issues in lpfc_sli4_pci_mem_setup()
	net: ethernet: stmmac: dwmac-rk: rework optional clock handling
	net: ethernet: stmmac: dwmac-rk: fix optional phy regulator handling
	wifi: ath11k: fix writing to unintended memory region
	bpf, sockmap: fix deadlocks in the sockhash and sockmap
	nvmet: fix error handling in nvmet_execute_identify_cns_cs_ns()
	nvmet: fix Identify Namespace handling
	nvmet: fix Identify Controller handling
	nvmet: fix Identify Active Namespace ID list handling
	nvmet: fix I/O Command Set specific Identify Controller
	nvme: fix async event trace event
	nvme-fcloop: fix "inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage"
	selftests/bpf: Use read_perf_max_sample_freq() in perf_event_stackmap
	selftests/bpf: Fix leaked bpf_link in get_stackid_cannot_attach
	blk-mq: don't plug for head insertions in blk_execute_rq_nowait
	wifi: iwlwifi: debug: fix crash in __iwl_err()
	wifi: iwlwifi: trans: don't trigger d3 interrupt twice
	wifi: iwlwifi: mvm: don't set CHECKSUM_COMPLETE for unsupported protocols
	bpf, sockmap: Revert buggy deadlock fix in the sockhash and sockmap
	f2fs: fix to check return value of f2fs_do_truncate_blocks()
	f2fs: fix to check return value of inc_valid_block_count()
	md/raid10: fix task hung in raid10d
	md/raid10: fix leak of 'r10bio->remaining' for recovery
	md/raid10: fix memleak for 'conf->bio_split'
	md/raid10: fix memleak of md thread
	md/raid10: don't call bio_start_io_acct twice for bio which experienced read error
	wifi: iwlwifi: mvm: don't drop unencrypted MCAST frames
	wifi: iwlwifi: yoyo: skip dump correctly on hw error
	wifi: iwlwifi: yoyo: Fix possible division by zero
	wifi: iwlwifi: mvm: initialize seq variable
	wifi: iwlwifi: fw: move memset before early return
	jdb2: Don't refuse invalidation of already invalidated buffers
	io_uring/rsrc: use nospec'ed indexes
	wifi: iwlwifi: make the loop for card preparation effective
	wifi: mt76: mt7915: expose device tree match table
	wifi: mt76: handle failure of vzalloc in mt7615_coredump_work
	wifi: mt76: add flexible polling wait-interval support
	wifi: mt76: mt7921e: fix probe timeout after reboot
	wifi: mt76: fix 6GHz high channel not be scanned
	mt76: mt7921: fix kernel panic by accessing unallocated eeprom.data
	wifi: mt76: mt7921: fix missing unwind goto in `mt7921u_probe`
	wifi: mt76: mt7921e: improve reliability of dma reset
	wifi: mt76: mt7921e: stop chip reset worker in unregister hook
	wifi: mt76: connac: fix txd multicast rate setting
	wifi: iwlwifi: mvm: check firmware response size
	netfilter: conntrack: restore IPS_CONFIRMED out of nf_conntrack_hash_check_insert()
	netfilter: conntrack: fix wrong ct->timeout value
	wifi: iwlwifi: fw: fix memory leak in debugfs
	ixgbe: Allow flow hash to be set via ethtool
	ixgbe: Enable setting RSS table to default values
	net/mlx5e: Don't clone flow post action attributes second time
	net/mlx5: E-switch, Create per vport table based on devlink encap mode
	net/mlx5: E-switch, Don't destroy indirect table in split rule
	net/mlx5e: Fix error flow in representor failing to add vport rx rule
	net/mlx5: Remove "recovery" arg from mlx5_load_one() function
	net/mlx5: Suspend auxiliary devices only in case of PCI device suspend
	Revert "net/mlx5: Remove "recovery" arg from mlx5_load_one() function"
	net/mlx5: Use recovery timeout on sync reset flow
	net/mlx5e: Nullify table pointer when failing to create
	net: stmmac:fix system hang when setting up tag_8021q VLAN for DSA ports
	bpf: Fix race between btf_put and btf_idr walk.
	bpf: Don't EFAULT for getsockopt with optval=NULL
	netfilter: nf_tables: don't write table validation state without mutex
	net: dpaa: Fix uninitialized variable in dpaa_stop()
	net/sched: sch_fq: fix integer overflow of "credit"
	ipv4: Fix potential uninit variable access bug in __ip_make_skb()
	Revert "Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work"
	netlink: Use copy_to_user() for optval in netlink_getsockopt().
	net: amd: Fix link leak when verifying config failed
	tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp.
	ipmi: ASPEED_BT_IPMI_BMC: select REGMAP_MMIO instead of depending on it
	ASoC: cs35l41: Only disable internal boost
	drivers: staging: rtl8723bs: Fix locking in _rtw_join_timeout_handler()
	drivers: staging: rtl8723bs: Fix locking in rtw_scan_timeout_handler()
	pstore: Revert pmsg_lock back to a normal mutex
	usb: host: xhci-rcar: remove leftover quirk handling
	usb: dwc3: gadget: Change condition for processing suspend event
	serial: stm32: Re-assert RTS/DE GPIO in RS485 mode only if more data are transmitted
	fpga: bridge: fix kernel-doc parameter description
	iio: light: max44009: add missing OF device matching
	serial: 8250_bcm7271: Fix arbitration handling
	spi: atmel-quadspi: Don't leak clk enable count in pm resume
	spi: atmel-quadspi: Free resources even if runtime resume failed in .remove()
	spi: imx: Don't skip cleanup in remove's error path
	usb: gadget: udc: renesas_usb3: Fix use after free bug in renesas_usb3_remove due to race condition
	ASoC: soc-compress: Inherit atomicity from DAI link for Compress FE
	PCI: imx6: Install the fault handler only on compatible match
	ASoC: es8316: Handle optional IRQ assignment
	linux/vt_buffer.h: allow either builtin or modular for macros
	spi: qup: Don't skip cleanup in remove's error path
	interconnect: qcom: rpm: drop bogus pm domain attach
	spi: fsl-spi: Fix CPM/QE mode Litte Endian
	vmci_host: fix a race condition in vmci_host_poll() causing GPF
	of: Fix modalias string generation
	PCI/EDR: Clear Device Status after EDR error recovery
	ia64: mm/contig: fix section mismatch warning/error
	ia64: salinfo: placate defined-but-not-used warning
	scripts/gdb: bail early if there are no clocks
	scripts/gdb: bail early if there are no generic PD
	HID: amd_sfh: Correct the structure fields
	HID: amd_sfh: Correct the sensor enable and disable command
	HID: amd_sfh: Fix illuminance value
	HID: amd_sfh: Add support for shutdown operation
	HID: amd_sfh: Correct the stop all command
	HID: amd_sfh: Increase sensor command timeout for SFH1.1
	HID: amd_sfh: Handle "no sensors" enabled for SFH1.1
	cacheinfo: Check sib_leaf in cache_leaves_are_shared()
	coresight: etm_pmu: Set the module field
	drm/panel: novatek-nt35950: Improve error handling
	ASoC: fsl_mqs: move of_node_put() to the correct location
	PCI/PM: Extend D3hot delay for NVIDIA HDA controllers
	drm/panel: novatek-nt35950: Only unregister DSI1 if it exists
	spi: cadence-quadspi: fix suspend-resume implementations
	i2c: cadence: cdns_i2c_master_xfer(): Fix runtime PM leak on error path
	i2c: xiic: xiic_xfer(): Fix runtime PM leak on error path
	scripts/gdb: raise error with reduced debugging information
	uapi/linux/const.h: prefer ISO-friendly __typeof__
	sh: sq: Fix incorrect element size for allocating bitmap buffer
	usb: gadget: tegra-xudc: Fix crash in vbus_draw
	usb: chipidea: fix missing goto in `ci_hdrc_probe`
	usb: mtu3: fix kernel panic at qmu transfer done irq handler
	firmware: stratix10-svc: Fix an NULL vs IS_ERR() bug in probe
	tty: serial: fsl_lpuart: adjust buffer length to the intended size
	serial: 8250: Add missing wakeup event reporting
	spi: cadence-quadspi: use macro DEFINE_SIMPLE_DEV_PM_OPS
	staging: rtl8192e: Fix W_DISABLE# does not work after stop/start
	spmi: Add a check for remove callback when removing a SPMI driver
	virtio_ring: don't update event idx on get_buf
	fbdev: mmp: Fix deferred clk handling in mmphw_probe()
	selftests/powerpc/pmu: Fix sample field check in the mmcra_thresh_marked_sample_test
	macintosh/windfarm_smu_sat: Add missing of_node_put()
	powerpc/perf: Properly detect mpc7450 family
	powerpc/mpc512x: fix resource printk format warning
	powerpc/wii: fix resource printk format warnings
	powerpc/sysdev/tsi108: fix resource printk format warnings
	macintosh: via-pmu-led: requires ATA to be set
	powerpc/rtas: use memmove for potentially overlapping buffer copy
	sched/fair: Fix inaccurate tally of ttwu_move_affine
	perf/core: Fix hardlockup failure caused by perf throttle
	Revert "objtool: Support addition to set CFA base"
	riscv: Fix ptdump when KASAN is enabled
	sched/rt: Fix bad task migration for rt tasks
	tracing/user_events: Ensure write index cannot be negative
	clk: at91: clk-sam9x60-pll: fix return value check
	IB/hifi1: add a null check of kzalloc_node in hfi1_ipoib_txreq_init
	RDMA/siw: Fix potential page_array out of range access
	clk: mediatek: mt2712: Add error handling to clk_mt2712_apmixed_probe()
	clk: mediatek: Consistently use GATE_MTK() macro
	clk: mediatek: mt7622: Properly use CLK_IS_CRITICAL flag
	clk: mediatek: mt8135: Properly use CLK_IS_CRITICAL flag
	RDMA/rdmavt: Delete unnecessary NULL check
	clk: qcom: gcc-qcm2290: Fix up gcc_sdcc2_apps_clk_src
	workqueue: Fix hung time report of worker pools
	rtc: omap: include header for omap_rtc_power_off_program prototype
	RDMA/mlx4: Prevent shift wrapping in set_user_sq_size()
	rtc: meson-vrtc: Use ktime_get_real_ts64() to get the current time
	rtc: k3: handle errors while enabling wake irq
	RDMA/erdma: Use fixed hardware page size
	fs/ntfs3: Fix memory leak if ntfs_read_mft failed
	fs/ntfs3: Add check for kmemdup
	fs/ntfs3: Fix OOB read in indx_insert_into_buffer
	fs/ntfs3: Fix slab-out-of-bounds read in hdr_delete_de()
	iommu/mediatek: Set dma_mask for PGTABLE_PA_35_EN
	power: supply: generic-adc-battery: fix unit scaling
	clk: add missing of_node_put() in "assigned-clocks" property parsing
	RDMA/siw: Remove namespace check from siw_netdev_event()
	clk: qcom: gcc-sm6115: Mark RCGs shared where applicable
	power: supply: rk817: Fix low SOC bugs
	RDMA/cm: Trace icm_send_rej event before the cm state is reset
	RDMA/srpt: Add a check for valid 'mad_agent' pointer
	IB/hfi1: Fix SDMA mmu_rb_node not being evicted in LRU order
	IB/hfi1: Fix bugs with non-PAGE_SIZE-end multi-iovec user SDMA requests
	clk: imx: fracn-gppll: fix the rate table
	clk: imx: fracn-gppll: disable hardware select control
	clk: imx: imx8ulp: Fix XBAR_DIVBUS and AD_SLOW clock parents
	NFSv4.1: Always send a RECLAIM_COMPLETE after establishing lease
	iommu/amd: Set page size bitmap during V2 domain allocation
	clk: qcom: lpasscc-sc7280: Skip qdsp6ss clock registration
	clk: qcom: lpassaudiocc-sc7280: Add required gdsc power domain clks in lpass_cc_sc7280_desc
	clk: qcom: gcc-sm8350: fix PCIe PIPE clocks handling
	clk: qcom: dispcc-qcm2290: get rid of test clock
	clk: qcom: dispcc-qcm2290: Remove inexistent DSI1PHY clk
	Input: raspberrypi-ts - fix refcount leak in rpi_ts_probe
	swiotlb: relocate PageHighMem test away from rmem_swiotlb_setup
	swiotlb: fix debugfs reporting of reserved memory pools
	RDMA/mlx5: Check pcie_relaxed_ordering_enabled() in UMR
	RDMA/mlx5: Fix flow counter query via DEVX
	SUNRPC: remove the maximum number of retries in call_bind_status
	RDMA/mlx5: Use correct device num_ports when modify DC
	clocksource/drivers/davinci: Fix memory leak in davinci_timer_register when init fails
	openrisc: Properly store r31 to pt_regs on unhandled exceptions
	timekeeping: Fix references to nonexistent ktime_get_fast_ns()
	SMB3: Add missing locks to protect deferred close file list
	SMB3: Close deferred file handles in case of handle lease break
	ext4: fix i_disksize exceeding i_size problem in paritally written case
	ext4: fix use-after-free read in ext4_find_extent for bigalloc + inline
	pinctrl: renesas: r8a779a0: Remove incorrect AVB[01] pinmux configuration
	pinctrl: renesas: r8a779f0: Fix tsn1_avtp_pps pin group
	pinctrl: renesas: r8a779g0: Fix Group 4/5 pin functions
	pinctrl: renesas: r8a779g0: Fix Group 6/7 pin functions
	pinctrl: renesas: r8a779g0: Fix ERROROUTC function names
	leds: TI_LMU_COMMON: select REGMAP instead of depending on it
	pinctrl: ralink: reintroduce ralink,rt2880-pinmux compatible string
	dmaengine: mv_xor_v2: Fix an error code.
	leds: tca6507: Fix error handling of using fwnode_property_read_string
	pwm: mtk-disp: Disable shadow registers before setting backlight values
	pwm: mtk-disp: Configure double buffering before reading in .get_state()
	soundwire: cadence: rename sdw_cdns_dai_dma_data as sdw_cdns_dai_runtime
	soundwire: intel: don't save hw_params for use in prepare
	phy: tegra: xusb: Add missing tegra_xusb_port_unregister for usb2_port and ulpi_port
	phy: ti: j721e-wiz: Fix unreachable code in wiz_mode_select()
	dma: gpi: remove spurious unlock in gpi_ch_init
	dmaengine: dw-edma: Fix to change for continuous transfer
	dmaengine: dw-edma: Fix to enable to issue dma request on DMA processing
	dmaengine: at_xdmac: do not enable all cyclic channels
	pinctrl-bcm2835.c: fix race condition when setting gpio dir
	thermal/drivers/mediatek: Use devm_of_iomap to avoid resource leak in mtk_thermal_probe
	mfd: tqmx86: Do not access I2C_DETECT register through io_base
	mfd: tqmx86: Specify IO port register range more precisely
	mfd: tqmx86: Correct board names for TQMxE39x
	mfd: ocelot-spi: Fix unsupported bulk read
	mfd: arizona-spi: Add missing MODULE_DEVICE_TABLE
	hte: tegra: fix 'struct of_device_id' build error
	hte: tegra-194: Fix off by one in tegra_hte_map_to_line_id()
	ACPI: PM: Do not turn of unused power resources on the Toshiba Click Mini
	PM: hibernate: Turn snapshot_test into global variable
	PM: hibernate: Do not get block device exclusively in test_resume mode
	afs: Fix updating of i_size with dv jump from server
	afs: Fix getattr to report server i_size on dirs, not local size
	afs: Avoid endless loop if file is larger than expected
	parisc: Fix argument pointer in real64_call_asm()
	parisc: Ensure page alignment in flush functions
	ALSA: usb-audio: Add quirk for Pioneer DDJ-800
	ALSA: hda/realtek: Add quirk for ThinkPad P1 Gen 6
	ALSA: hda/realtek: Add quirk for ASUS UM3402YAR using CS35L41
	ALSA: hda/realtek: support HP Pavilion Aero 13-be0xxx Mute LED
	ALSA: hda/realtek: Fix mute and micmute LEDs for an HP laptop
	nilfs2: do not write dirty data after degenerating to read-only
	nilfs2: fix infinite loop in nilfs_mdt_get_block()
	mm: do not reclaim private data from pinned page
	drbd: correctly submit flush bio on barrier
	md/raid10: fix null-ptr-deref in raid10_sync_request
	md/raid5: Improve performance for sequential IO
	kasan: hw_tags: avoid invalid virt_to_page()
	mtd: core: provide unique name for nvmem device, take two
	mtd: core: fix nvmem error reporting
	mtd: core: fix error path for nvmem provider
	mtd: spi-nor: core: Update flash's current address mode when changing address mode
	mailbox: zynqmp: Fix IPI isr handling
	kcsan: Avoid READ_ONCE() in read_instrumented_memory()
	mailbox: zynqmp: Fix typo in IPI documentation
	wifi: rtl8xxxu: RTL8192EU always needs full init
	wifi: rtw89: fix potential race condition between napi_init and napi_enable
	clk: microchip: fix potential UAF in auxdev release callback
	clk: rockchip: rk3399: allow clk_cifout to force clk_cifout_src to reparent
	scripts/gdb: fix lx-timerlist for Python3
	btrfs: scrub: reject unsupported scrub flags
	s390/dasd: fix hanging blockdevice after request requeue
	ia64: fix an addr to taddr in huge_pte_offset()
	mm/mempolicy: correctly update prev when policy is equal on mbind
	vhost_vdpa: fix unmap process in no-batch mode
	dm verity: fix error handling for check_at_most_once on FEC
	dm clone: call kmem_cache_destroy() in dm_clone_init() error path
	dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path
	dm flakey: fix a crash with invalid table line
	dm ioctl: fix nested locking in table_clear() to remove deadlock concern
	dm: don't lock fs when the map is NULL in process of resume
	blk-iocost: avoid 64-bit division in ioc_timer_fn
	cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname
	cifs: protect session status check in smb2_reconnect()
	thunderbolt: Use correct type in tb_port_is_clx_enabled() prototype
	bonding (gcc13): synchronize bond_{a,t}lb_xmit() types
	wifi: ath11k: synchronize ath11k_mac_he_gi_to_nl80211_he_gi()'s return type
	perf auxtrace: Fix address filter entire kernel size
	perf intel-pt: Fix CYC timestamps after standalone CBR
	block/blk-iocost (gcc13): keep large values in a new enum
	sfc (gcc13): synchronize ef100_enqueue_skb()'s return type
	i40e: Remove unused i40e status codes
	i40e: Remove string printing for i40e_status
	i40e: use int for i40e_status
	drm/amd/display (gcc13): fix enum mismatch
	debugobject: Ensure pool refill (again)
	scsi: libsas: Grab the ATA port lock in sas_ata_device_link_abort()
	netfilter: nf_tables: deactivate anonymous set from preparation phase
	Linux 6.1.28

Change-Id: I61b5133e2d051cc2aa39b8c7c1be3fc25da40210
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-06-09 20:20:52 +00:00
Helge Deller
3270095f6e fbcon: Fix null-ptr-deref in soft_cursor
commit d78bd6cc68276bd57f766f7cb98bfe32c23ab327 upstream.

syzbot repored this bug in the softcursor code:

BUG: KASAN: null-ptr-deref in soft_cursor+0x384/0x6b4 drivers/video/fbdev/core/softcursor.c:70
Read of size 16 at addr 0000000000000200 by task kworker/u4:1/12

CPU: 0 PID: 12 Comm: kworker/u4:1 Not tainted 6.4.0-rc3-syzkaller-geb0f1697d729 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
Workqueue: events_power_efficient fb_flashcursor
Call trace:
 dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:233
 show_stack+0x2c/0x44 arch/arm64/kernel/stacktrace.c:240
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xd0/0x124 lib/dump_stack.c:106
 print_report+0xe4/0x514 mm/kasan/report.c:465
 kasan_report+0xd4/0x130 mm/kasan/report.c:572
 kasan_check_range+0x264/0x2a4 mm/kasan/generic.c:187
 __asan_memcpy+0x3c/0x84 mm/kasan/shadow.c:105
 soft_cursor+0x384/0x6b4 drivers/video/fbdev/core/softcursor.c:70
 bit_cursor+0x113c/0x1a64 drivers/video/fbdev/core/bitblit.c:377
 fb_flashcursor+0x35c/0x54c drivers/video/fbdev/core/fbcon.c:380
 process_one_work+0x788/0x12d4 kernel/workqueue.c:2405
 worker_thread+0x8e0/0xfe8 kernel/workqueue.c:2552
 kthread+0x288/0x310 kernel/kthread.c:379
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:853

This fix let bit_cursor() bail out early when a font bitmap
isn't available yet.

Signed-off-by: Helge Deller <deller@gmx.de>
Reported-by: syzbot+d910bd780e6efac35869@syzkaller.appspotmail.com
Acked-by: Sam Ravnborg <sam@ravnborg.org>
Cc: stable@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-06-09 10:34:26 +02:00
Helge Deller
f83c32ed05 fbdev: stifb: Fix info entry in sti_struct on error path
[ Upstream commit 0bdf1ad8d10bd4e50a8b1a2c53d15984165f7fea ]

Minor fix to reset the info field to NULL in case of error.

Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-06-09 10:34:09 +02:00
Helge Deller
be2aefa202 fbdev: modedb: Add 1920x1080 at 60 Hz video mode
[ Upstream commit c8902258b2b8ecaa1b8d88c312853c5b14c2553d ]

Add typical resolution for Full-HD monitors.

Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-06-09 10:34:09 +02:00
Zheng Wang
c6c0a9f619 fbdev: imsttfb: Fix use after free bug in imsttfb_probe
[ Upstream commit c75f5a55061091030a13fef71b9995b89bc86213 ]

A use-after-free bug may occur if init_imstt invokes framebuffer_release
and free the info ptr. The caller, imsttfb_probe didn't notice that and
still keep the ptr as private data in pdev.

If we remove the driver which will call imsttfb_remove to make cleanup,
UAF happens.

Fix it by return error code if bad case happens in init_imstt.

Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-06-09 10:34:09 +02:00
Suren Baghdasaryan
5dd0547a3e UPSTREAM: mm: replace vma->vm_flags direct modifications with modifier calls
Replace direct modifications to vma->vm_flags with calls to modifier
functions to be able to track flag changes and to keep vma locking
correctness.

[akpm@linux-foundation.org: fix drivers/misc/open-dice.c, per Hyeonggon Yoo]
Link: https://lkml.kernel.org/r/20230126193752.297968-5-surenb@google.com
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Acked-by: Mel Gorman <mgorman@techsingularity.net>
Acked-by: Mike Rapoport (IBM) <rppt@kernel.org>
Acked-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Reviewed-by: Liam R. Howlett <Liam.Howlett@Oracle.com>
Reviewed-by: Hyeonggon Yoo <42.hyeyoo@gmail.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Arjun Roy <arjunroy@google.com>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: David Hildenbrand <david@redhat.com>
Cc: David Howells <dhowells@redhat.com>
Cc: Davidlohr Bueso <dave@stgolabs.net>
Cc: David Rientjes <rientjes@google.com>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Greg Thelen <gthelen@google.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jann Horn <jannh@google.com>
Cc: Joel Fernandes <joelaf@google.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Kent Overstreet <kent.overstreet@linux.dev>
Cc: Laurent Dufour <ldufour@linux.ibm.com>
Cc: Lorenzo Stoakes <lstoakes@gmail.com>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Minchan Kim <minchan@google.com>
Cc: Paul E. McKenney <paulmck@kernel.org>
Cc: Peter Oskolkov <posk@google.com>
Cc: Peter Xu <peterx@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Punit Agrawal <punit.agrawal@bytedance.com>
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: Shakeel Butt <shakeelb@google.com>
Cc: Soheil Hassas Yeganeh <soheil@google.com>
Cc: Song Liu <songliubraving@fb.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Will Deacon <will@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

(cherry picked from commit 1c71222e5f2393b5ea1a41795c67589eea7e3490)

Bug: 161210518
Change-Id: Ifc352b487db109adab17dd33a83f5c7e68c0bbc6
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
2023-06-07 14:24:57 +00:00
Rakesh Kota
491ec24294 backlight: qcom-spmi-wled: Add support for QCOM SPMI WLED driver
qcom-spmi-wled driver adds support for controlling backlight for
LCD panels that uses QTI PMICs like pmi8998, PM8150L and PM6150L.

This snapshot is taken as of msm-5.10
commit fb8a0b80c4 ("bus: brcmstb_gisb: Add support
for breakpoint interrupts").

Also, replace the iio_channel_get with devm_iio_channel_get.

Change-Id: I4a7c247201cc0ad6ddbe12e6a9be762c87dca4dc
Signed-off-by: Rakesh Kota <quic_kotarake@quicinc.com>
2023-05-31 14:15:31 +05:30
Alan Stern
c8fdf7feca fbdev: udlfb: Fix endpoint check
commit ed9de4ed39875706607fb08118a58344ae6c5f42 upstream.

The syzbot fuzzer detected a problem in the udlfb driver, caused by an
endpoint not having the expected type:

usb 1-1: Read EDID byte 0 failed: -71
usb 1-1: Unable to get valid EDID from device/display
------------[ cut here ]------------
usb 1-1: BOGUS urb xfer, pipe 3 != type 1
WARNING: CPU: 0 PID: 9 at drivers/usb/core/urb.c:504 usb_submit_urb+0xed6/0x1880
drivers/usb/core/urb.c:504
Modules linked in:
CPU: 0 PID: 9 Comm: kworker/0:1 Not tainted
6.4.0-rc1-syzkaller-00016-ga4422ff22142 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google
04/28/2023
Workqueue: usb_hub_wq hub_event
RIP: 0010:usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504
...
Call Trace:
 <TASK>
 dlfb_submit_urb+0x92/0x180 drivers/video/fbdev/udlfb.c:1980
 dlfb_set_video_mode+0x21f0/0x2950 drivers/video/fbdev/udlfb.c:315
 dlfb_ops_set_par+0x2a7/0x8d0 drivers/video/fbdev/udlfb.c:1111
 dlfb_usb_probe+0x149a/0x2710 drivers/video/fbdev/udlfb.c:1743

The current approach for this issue failed to catch the problem
because it only checks for the existence of a bulk-OUT endpoint; it
doesn't check whether this endpoint is the one that the driver will
actually use.

We can fix the problem by instead checking that the endpoint used by
the driver does exist and is bulk-OUT.

Reported-and-tested-by: syzbot+0e22d63dcebb802b9bc8@syzkaller.appspotmail.com
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
CC: Pavel Skripkin <paskripkin@gmail.com>
Fixes: aaf7dbe073 ("video: fbdev: udlfb: properly check endpoint type")
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-05-30 14:03:20 +01:00
Zongjie Li
5a08a72da3 fbdev: arcfb: Fix error handling in arcfb_probe()
[ Upstream commit 5a6bef734247c7a8c19511664ff77634ab86f45b ]

Smatch complains that:
arcfb_probe() warn: 'irq' from request_irq() not released on lines: 587.

Fix error handling in the arcfb_probe() function. If IO addresses are
not provided or framebuffer registration fails, the code will jump to
the err_addr or err_register_fb label to release resources.
If IRQ request fails, previously allocated resources will be freed.

Fixes: 1154ea7dcd ("[PATCH] Framebuffer driver for Arc LCD board")
Signed-off-by: Zongjie Li <u202112089@hust.edu.cn>
Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-05-24 17:32:33 +01:00
Christophe JAILLET
ae69d36d46 fbdev: mmp: Fix deferred clk handling in mmphw_probe()
[ Upstream commit b3a7a9ab65ae2f2626c7222fb79cdd433f8c5252 ]

When dev_err_probe() is called, 'ret' holds the value of the previous
successful devm_request_irq() call.
'ret' should be assigned with a meaningful value before being used in
dev_err_probe().

While at it, use and return "PTR_ERR(ctrl->clk)" instead of a hard-coded
"-ENOENT" so that -EPROBE_DEFER is handled and propagated correctly.

Fixes: 81b6342056 ("fbdev: mmp: Make use of the helper function dev_err_probe()")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-05-11 23:03:31 +09:00
Daniel Vetter
b15df140fe fbcon: set_con2fb_map needs to set con2fb_map!
commit fffb0b52d5258554c645c966c6cbef7de50b851d upstream.

I got really badly confused in d443d93864 ("fbcon: move more common
code into fb_open()") because we set the con2fb_map before the failure
points, which didn't look good.

But in trying to fix that I moved the assignment into the wrong path -
we need to do it for _all_ vc we take over, not just the first one
(which additionally requires the call to con2fb_acquire_newinfo).

I've figured this out because of a KASAN bug report, where the
fbcon_registered_fb and fbcon_display arrays went out of sync in
fbcon_mode_deleted() because the con2fb_map pointed at the old
fb_info, but the modes and everything was updated for the new one.

Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Acked-by: Helge Deller <deller@gmx.de>
Tested-by: Xingyuan Mo <hdthky0@gmail.com>
Fixes: d443d93864 ("fbcon: move more common code into fb_open()")
Reported-by: Xingyuan Mo <hdthky0@gmail.com>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Sam Ravnborg <sam@ravnborg.org>
Cc: Xingyuan Mo <hdthky0@gmail.com>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Helge Deller <deller@gmx.de>
Cc: <stable@vger.kernel.org> # v5.19+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-04-20 12:35:07 +02:00
Daniel Vetter
93aa242f59 fbcon: Fix error paths in set_con2fb_map
commit edf79dd2172233452ff142dcc98b19d955fc8974 upstream.

This is a regressoin introduced in b07db39584 ("fbcon: Ditch error
handling for con2fb_release_oldinfo"). I failed to realize what the if
(!err) checks. The mentioned commit was dropping the
con2fb_release_oldinfo() return value but the if (!err) was also
checking whether the con2fb_acquire_newinfo() function call above
failed or not.

Fix this with an early return statement.

Note that there's still a difference compared to the orginal state of
the code, the below lines are now also skipped on error:

	if (!search_fb_in_map(info_idx))
		info_idx = newidx;

These are only needed when we've actually thrown out an old fb_info
from the console mappings, which only happens later on.

Also move the fbcon_add_cursor_work() call into the same if block,
it's all protected by console_lock so doesn't matter when we set up
the blinking cursor delayed work anyway. This further simplifies the
control flow and allows us to ditch the found local variable.

v2: Clarify commit message (Javier)

Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Acked-by: Helge Deller <deller@gmx.de>
Tested-by: Xingyuan Mo <hdthky0@gmail.com>
Fixes: b07db39584 ("fbcon: Ditch error handling for con2fb_release_oldinfo")
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Sam Ravnborg <sam@ravnborg.org>
Cc: Xingyuan Mo <hdthky0@gmail.com>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Helge Deller <deller@gmx.de>
Cc: <stable@vger.kernel.org> # v5.19+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-04-20 12:35:07 +02:00
Daniel Vetter
d5392c1c64 fbmem: Reject FB_ACTIVATE_KD_TEXT from userspace
commit 6fd33a3333c7916689b8f051a185defe4dd515b0 upstream.

This is an oversight from dc5bdb68b5 ("drm/fb-helper: Fix vt
restore") - I failed to realize that nasty userspace could set this.

It's not pretty to mix up kernel-internal and userspace uapi flags
like this, but since the entire fb_var_screeninfo structure is uapi
we'd need to either add a new parameter to the ->fb_set_par callback
and fb_set_par() function, which has a _lot_ of users. Or some other
fairly ugly side-channel int fb_info. Neither is a pretty prospect.

Instead just correct the issue at hand by filtering out this
kernel-internal flag in the ioctl handling code.

Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Acked-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
Fixes: dc5bdb68b5 ("drm/fb-helper: Fix vt restore")
Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: shlomo@fastmail.com
Cc: Michel Dänzer <michel@daenzer.net>
Cc: Noralf Trønnes <noralf@tronnes.org>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Daniel Vetter <daniel.vetter@intel.com>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Maxime Ripard <mripard@kernel.org>
Cc: David Airlie <airlied@linux.ie>
Cc: Daniel Vetter <daniel@ffwll.ch>
Cc: dri-devel@lists.freedesktop.org
Cc: <stable@vger.kernel.org> # v5.7+
Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: Nathan Chancellor <natechancellor@gmail.com>
Cc: Qiujun Huang <hqjagain@gmail.com>
Cc: Peter Rosin <peda@axentia.se>
Cc: linux-fbdev@vger.kernel.org
Cc: Helge Deller <deller@gmx.de>
Cc: Sam Ravnborg <sam@ravnborg.org>
Cc: Geert Uytterhoeven <geert+renesas@glider.be>
Cc: Samuel Thibault <samuel.thibault@ens-lyon.org>
Cc: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Cc: Shigeru Yoshida <syoshida@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230404193934.472457-1-daniel.vetter@ffwll.ch
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-04-20 12:35:06 +02:00
Wei Chen
2a3562ea9d fbdev: au1200fb: Fix potential divide by zero
[ Upstream commit 44a3b36b42acfc433aaaf526191dd12fbb919fdb ]

var->pixclock can be assigned to zero by user. Without
proper check, divide by zero would occur when invoking
macro PICOS2KHZ in au1200fb_fb_check_var.

Error out if var->pixclock is zero.

Signed-off-by: Wei Chen <harperchen1110@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-04-06 12:10:41 +02:00
Wei Chen
9f2a69d5e6 fbdev: lxfb: Fix potential divide by zero
[ Upstream commit 61ac4b86a4c047c20d5cb423ddd87496f14d9868 ]

var->pixclock can be assigned to zero by user. Without proper
check, divide by zero would occur in lx_set_clock.

Error out if var->pixclock is zero.

Signed-off-by: Wei Chen <harperchen1110@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-04-06 12:10:41 +02:00
Wei Chen
8ab9eada22 fbdev: intelfb: Fix potential divide by zero
[ Upstream commit d823685486a3446d061fed7c7d2f80af984f119a ]

Variable var->pixclock is controlled by user and can be assigned
to zero. Without proper check, divide by zero would occur in
intelfbhw_validate_mode and intelfbhw_mode_to_hw.

Error out if var->pixclock is zero.

Signed-off-by: Wei Chen <harperchen1110@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-04-06 12:10:41 +02:00
Wei Chen
c8d8810797 fbdev: nvidia: Fix potential divide by zero
[ Upstream commit 92e2a00f2987483e1f9253625828622edd442e61 ]

variable var->pixclock can be set by user. In case it
equals to zero, divide by zero would occur in nvidiafb_set_par.

Similar crashes have happened in other fbdev drivers. There
is no check and modification on var->pixclock along the call
chain to nvidia_check_var and nvidiafb_set_par. We believe it
could also be triggered in driver nvidia from user site.

Signed-off-by: Wei Chen <harperchen1110@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-04-06 12:10:41 +02:00
Wei Chen
b8b7d5eac5 fbdev: tgafb: Fix potential divide by zero
[ Upstream commit f90bd245de82c095187d8c2cabb8b488a39eaecc ]

fb_set_var would by called when user invokes ioctl with cmd
FBIOPUT_VSCREENINFO. User-provided data would finally reach
tgafb_check_var. In case var->pixclock is assigned to zero,
divide by zero would occur when checking whether reciprocal
of var->pixclock is too high.

Similar crashes have happened in other fbdev drivers. There
is no check and modification on var->pixclock along the call
chain to tgafb_check_var. We believe it could also be triggered
in driver tgafb from user site.

Signed-off-by: Wei Chen <harperchen1110@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-04-06 12:10:40 +02:00
Takashi Iwai
1ea3e18e53 fbdev: Fix incorrect page mapping clearance at fb_deferred_io_release()
commit fe9ae05cfbe587dda724fcf537c00bc2f287da62 upstream.

The recent fix for the deferred I/O by the commit
  3efc61d95259 ("fbdev: Fix invalid page access after closing deferred I/O devices")
caused a regression when the same fb device is opened/closed while
it's being used.  It resulted in a frozen screen even if something
is redrawn there after the close.  The breakage is because the patch
was made under a wrong assumption of a single open; in the current
code, fb_deferred_io_release() cleans up the page mapping of the
pageref list and it calls cancel_delayed_work_sync() unconditionally,
where both are no correct behavior for multiple opens.

This patch adds a refcount for the opens of the device, and applies
the cleanup only when all files get closed.

As both fb_deferred_io_open() and _close() are called always in the
fb_info lock (mutex), it's safe to use the normal int for the
refcounting.

Also, a useless BUG_ON() is dropped.

Fixes: 3efc61d95259 ("fbdev: Fix invalid page access after closing deferred I/O devices")
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Reviewed-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20230308105012.1845-1-tiwai@suse.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-03-22 13:34:04 +01:00
Helge Deller
15f6110abd fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks
commit 203873a535d627c668f293be0cb73e26c30f9cc7 upstream.

Find a valid modeline depending on the machine graphic card
configuration and add the fb_check_var() function to validate
Xorg provided graphics settings.

Signed-off-by: Helge Deller <deller@gmx.de>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-03-22 13:34:03 +01:00
Dan Carpenter
59f750e5d2 fbdev: chipsfb: Fix error codes in chipsfb_pci_init()
[ Upstream commit 77bc762451c2dc72bdbea07b857c916c9e7f4952 ]

The error codes are not set on these error paths.

Fixes: 145eed48de ("fbdev: Remove conflicting devices on PCI bus")
Signed-off-by: Dan Carpenter <error27@gmail.com>
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patchwork.freedesktop.org/patch/msgid/Y/yG+sm2mhdJeTZW@kili
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-22 13:33:39 +01:00
Thomas Zimmermann
17d6499670 Revert "fbcon: don't lose the console font across generic->chip driver switch"
[ Upstream commit 12d5796d55f9fd9e4b621003127c99e176665064 ]

This reverts commit ae1287865f.

Always free the console font when deinitializing the framebuffer
console. Subsequent framebuffer consoles will then use the default
font. Rely on userspace to load any user-configured font for these
consoles.

Commit ae1287865f ("fbcon: don't lose the console font across
generic->chip driver switch") was introduced to work around losing
the font during graphics-device handover. [1][2] It kept a dangling
pointer with the font data between loading the two consoles, which is
fairly adventurous hack. It also never covered cases when the other
consoles, such as VGA text mode, where involved.

The problem has meanwhile been solved in userspace. Systemd comes
with a udev rule that re-installs the configured font when a console
comes up. [3] So the kernel workaround can be removed.

This also removes one of the two special cases triggered by setting
FBINFO_MISC_FIRMWARE in an fbdev driver.

Tested during device handover from efifb and simpledrm to radeon. Udev
reloads the configured console font for the new driver's terminal.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://bugzilla.redhat.com/show_bug.cgi?id=892340 # 1
Link: https://bugzilla.redhat.com/show_bug.cgi?id=1074624 # 2
Link: https://cgit.freedesktop.org/systemd/systemd/tree/src/vconsole/90-vconsole.rules.in?h=v222 # 3
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20221219160516.23436-3-tzimmermann@suse.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-10 09:33:56 +01:00
Takashi Iwai
f1d91f0e9d fbdev: Fix invalid page access after closing deferred I/O devices
commit 3efc61d95259956db25347e2a9562c3e54546e20 upstream.

When a fbdev with deferred I/O is once opened and closed, the dirty
pages still remain queued in the pageref list, and eventually later
those may be processed in the delayed work.  This may lead to a
corruption of pages, hitting an Oops.

This patch makes sure to cancel the delayed work and clean up the
pageref list at closing the device for addressing the bug.  A part of
the cleanup code is factored out as a new helper function that is
called from the common fb_release().

Reviewed-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Tested-by: Miko Larsson <mikoxyzzz@gmail.com>
Fixes: 56c134f7f1 ("fbdev: Track deferred-I/O pages in pageref struct")
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20230129082856.22113-1-tiwai@suse.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-02-22 12:59:46 +01:00
Dave Airlie
437f8892ec nvidiafb: detect the hardware support before removing console.
[ Upstream commit 04119ab1a49fc41cb70f0472be5455af268fa260 ]

This driver removed the console, but hasn't yet decided if it could
take over the console yet. Instead of doing that, probe the hw for
support and then remove the console afterwards.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=216859
Fixes: 145eed48de ("fbdev: Remove conflicting devices on PCI bus")
Reported-by: Zeno Davatz <zdavatz@gmail.com>
Tested-by: Zeno Davatz <zdavatz@gmail.com>
Tested-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230205210751.3842103-1-airlied@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-02-14 19:11:45 +01:00
Dongliang Mu
1b4c088446 fbdev: smscufx: fix error handling code in ufx_usb_probe
commit b76449ee75e21acfe9fa4c653d8598f191ed7d68 upstream.

The current error handling code in ufx_usb_probe have many unmatching
issues, e.g., missing ufx_free_usb_list, destroy_modedb label should
only include framebuffer_release, fb_dealloc_cmap only matches
fb_alloc_cmap.

My local syzkaller reports a memory leak bug:

memory leak in ufx_usb_probe

BUG: memory leak
unreferenced object 0xffff88802f879580 (size 128):
  comm "kworker/0:7", pid 17416, jiffies 4295067474 (age 46.710s)
  hex dump (first 32 bytes):
    80 21 7c 2e 80 88 ff ff 18 d0 d0 0c 80 88 ff ff  .!|.............
    00 d0 d0 0c 80 88 ff ff e0 ff ff ff 0f 00 00 00  ................
  backtrace:
    [<ffffffff814c99a0>] kmalloc_trace+0x20/0x90 mm/slab_common.c:1045
    [<ffffffff824d219c>] kmalloc include/linux/slab.h:553 [inline]
    [<ffffffff824d219c>] kzalloc include/linux/slab.h:689 [inline]
    [<ffffffff824d219c>] ufx_alloc_urb_list drivers/video/fbdev/smscufx.c:1873 [inline]
    [<ffffffff824d219c>] ufx_usb_probe+0x11c/0x15a0 drivers/video/fbdev/smscufx.c:1655
    [<ffffffff82d17927>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396
    [<ffffffff82712f0d>] call_driver_probe drivers/base/dd.c:560 [inline]
    [<ffffffff82712f0d>] really_probe+0x12d/0x390 drivers/base/dd.c:639
    [<ffffffff8271322f>] __driver_probe_device+0xbf/0x140 drivers/base/dd.c:778
    [<ffffffff827132da>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:808
    [<ffffffff82713c27>] __device_attach_driver+0xf7/0x150 drivers/base/dd.c:936
    [<ffffffff82710137>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427
    [<ffffffff827136b5>] __device_attach+0x105/0x2d0 drivers/base/dd.c:1008
    [<ffffffff82711d36>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:487
    [<ffffffff8270e242>] device_add+0x642/0xdc0 drivers/base/core.c:3517
    [<ffffffff82d14d5f>] usb_set_configuration+0x8ef/0xb80 drivers/usb/core/message.c:2170
    [<ffffffff82d2576c>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238
    [<ffffffff82d16ffc>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293
    [<ffffffff82712f0d>] call_driver_probe drivers/base/dd.c:560 [inline]
    [<ffffffff82712f0d>] really_probe+0x12d/0x390 drivers/base/dd.c:639
    [<ffffffff8271322f>] __driver_probe_device+0xbf/0x140 drivers/base/dd.c:778

Fix this bug by rewriting the error handling code in ufx_usb_probe.

Reported-by: syzkaller <syzkaller@googlegroups.com>
Tested-by: Dongliang Mu <dzm91@hust.edu.cn>
Signed-off-by: Dongliang Mu <dzm91@hust.edu.cn>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-02-09 11:28:27 +01:00
Samuel Thibault
5e7f6e2ade fbcon: Check font dimension limits
commit 2b09d5d364986f724f17001ccfe4126b9b43a0be upstream.

blit_x and blit_y are u32, so fbcon currently cannot support fonts
larger than 32x32.

The 32x32 case also needs shifting an unsigned int, to properly set bit
31, otherwise we get "UBSAN: shift-out-of-bounds in fbcon_set_font",
as reported on:

http://lore.kernel.org/all/IA1PR07MB98308653E259A6F2CE94A4AFABCE9@IA1PR07MB9830.namprd07.prod.outlook.com
Kernel Branch: 6.2.0-rc5-next-20230124
Kernel config: https://drive.google.com/file/d/1F-LszDAizEEH0ZX0HcSR06v5q8FPl2Uv/view?usp=sharing
Reproducer: https://drive.google.com/file/d/1mP1jcLBY7vWCNM60OMf-ogw-urQRjNrm/view?usp=sharing

Reported-by: Sanan Hasanov <sanan.hasanov@Knights.ucf.edu>
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Fixes: 2d2699d984 ("fbcon: font setting should check limitation of driver")
Cc: stable@vger.kernel.org
Tested-by: Miko Larsson <mikoxyzzz@gmail.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-02-09 11:28:15 +01:00
Arnd Bergmann
4e18618ced fbdev: omapfb: avoid stack overflow warning
[ Upstream commit 634cf6ead93988b0da9ac054521ab63a3ba189db ]

The dsi_irq_stats structure is a little too big to fit on the
stack of a 32-bit task, depending on the specific gcc options:

fbdev/omap2/omapfb/dss/dsi.c: In function 'dsi_dump_dsidev_irqs':
fbdev/omap2/omapfb/dss/dsi.c:1621:1: error: the frame size of 1064 bytes is larger than 1024 bytes [-Werror=frame-larger-than=]

Since this is only a debugfs file, performance is not critical,
so just dynamically allocate it, and print an error message
in there in place of a failure code when the allocation fails.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-01-24 07:24:32 +01:00
Paul Menzel
a3fb152c2f fbdev: matroxfb: G200eW: Increase max memory from 1 MB to 16 MB
commit f685dd7a8025f2554f73748cfdb8143a21fb92c7 upstream.

Commit 62d89a7d49 ("video: fbdev: matroxfb: set maxvram of vbG200eW to
the same as vbG200 to avoid black screen") accidently decreases the
maximum memory size for the Matrox G200eW (102b:0532) from 8 MB to 1 MB
by missing one zero. This caused the driver initialization to fail with
the messages below, as the minimum required VRAM size is 2 MB:

     [    9.436420] matroxfb: Matrox MGA-G200eW (PCI) detected
     [    9.444502] matroxfb: cannot determine memory size
     [    9.449316] matroxfb: probe of 0000:0a:03.0 failed with error -1

So, add the missing 0 to make it the intended 16 MB. Successfully tested on
the Dell PowerEdge R910/0KYD3D, BIOS 2.10.0 08/29/2013, that the warning is
gone.

While at it, add a leading 0 to the maxdisplayable entry, so it’s aligned
properly. The value could probably also be increased from 8 MB to 16 MB, as
the G200 uses the same values, but I have not checked any datasheet.

Note, matroxfb is obsolete and superseded by the maintained DRM driver
mga200, which is used by default on most systems where both drivers are
available. Therefore, on most systems it was only a cosmetic issue.

Fixes: 62d89a7d49 ("video: fbdev: matroxfb: set maxvram of vbG200eW to the same as vbG200 to avoid black screen")
Link: https://lore.kernel.org/linux-fbdev/972999d3-b75d-5680-fcef-6e6905c52ac5@suse.de/T/#mb6953a9995ebd18acc8552f99d6db39787aec775
Cc: it+linux-fbdev@molgen.mpg.de
Cc: Z. Liu <liuzx@knownsec.com>
Cc: Rich Felker <dalias@libc.org>
Cc: stable@vger.kernel.org
Signed-off-by: Paul Menzel <pmenzel@molgen.mpg.de>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-01-12 12:02:44 +01:00
Tetsuo Handa
a609bfc1e6 fbdev: fbcon: release buffer when fbcon_do_set_font() failed
commit 3c3bfb8586f848317ceba5d777e11204ba3e5758 upstream.

syzbot is reporting memory leak at fbcon_do_set_font() [1], for
commit a5a923038d ("fbdev: fbcon: Properly revert changes when
vc_resize() failed") missed that the buffer might be newly allocated
by fbcon_set_font().

Link: https://syzkaller.appspot.com/bug?extid=25bdb7b1703639abd498 [1]
Reported-by: syzbot <syzbot+25bdb7b1703639abd498@syzkaller.appspotmail.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Tested-by: syzbot <syzbot+25bdb7b1703639abd498@syzkaller.appspotmail.com>
Fixes: a5a923038d ("fbdev: fbcon: Properly revert changes when vc_resize() failed")
CC: stable@vger.kernel.org # 5.15+
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-12-31 13:33:11 +01:00
Guilherme G. Piccoli
16fed31153 video: hyperv_fb: Avoid taking busy spinlock on panic path
[ Upstream commit 1d044ca035dc22df0d3b39e56f2881071d9118bd ]

The Hyper-V framebuffer code registers a panic notifier in order
to try updating its fbdev if the kernel crashed. The notifier
callback is straightforward, but it calls the vmbus_sendpacket()
routine eventually, and such function takes a spinlock for the
ring buffer operations.

Panic path runs in atomic context, with local interrupts and
preemption disabled, and all secondary CPUs shutdown. That said,
taking a spinlock might cause a lockup if a secondary CPU was
disabled with such lock taken. Fix it here by checking if the
ring buffer spinlock is busy on Hyper-V framebuffer panic notifier;
if so, bail-out avoiding the potential lockup scenario.

Cc: Andrea Parri (Microsoft) <parri.andrea@gmail.com>
Cc: Dexuan Cui <decui@microsoft.com>
Cc: Haiyang Zhang <haiyangz@microsoft.com>
Cc: "K. Y. Srinivasan" <kys@microsoft.com>
Cc: Michael Kelley <mikelley@microsoft.com>
Cc: Stephen Hemminger <sthemmin@microsoft.com>
Cc: Tianyu Lan <Tianyu.Lan@microsoft.com>
Cc: Wei Liu <wei.liu@kernel.org>
Tested-by: Fabio A M Martins <fabiomirmar@gmail.com>
Signed-off-by: Guilherme G. Piccoli <gpiccoli@igalia.com>
Reviewed-by: Michael Kelley <mikelley@microsoft.com>
Link: https://lore.kernel.org/r/20220819221731.480795-10-gpiccoli@igalia.com
Signed-off-by: Wei Liu <wei.liu@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-12-31 13:32:56 +01:00
Christophe JAILLET
7aca1cea8f fbdev: uvesafb: Fixes an error handling path in uvesafb_probe()
[ Upstream commit a94371040712031ba129c7e9d8ff04a06a2f8207 ]

If an error occurs after a successful uvesafb_init_mtrr() call, it must be
undone by a corresponding arch_phys_wc_del() call, as already done in the
remove function.

This has been added in the remove function in commit 63e28a7a5f
("uvesafb: Clean up MTRR code")

Fixes: 8bdb3a2d7d ("uvesafb: the driver core")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-12-31 13:32:43 +01:00
Randy Dunlap
5976889098 fbdev: uvesafb: don't build on UML
[ Upstream commit 35b4f4d4a725cf8f8c10649163cd12aed509b953 ]

The uvesafb fbdev driver uses memory management information that is not
available on ARCH=um, so don't allow this driver to be built on UML.

Prevents these build errors:

../drivers/video/fbdev/uvesafb.c: In function ‘uvesafb_vbe_init’:
../drivers/video/fbdev/uvesafb.c:807:21: error: ‘__supported_pte_mask’ undeclared (first use in this function)
  807 |                 if (__supported_pte_mask & _PAGE_NX) {
../drivers/video/fbdev/uvesafb.c:807:44: error: ‘_PAGE_NX’ undeclared (first use in this function)
  807 |                 if (__supported_pte_mask & _PAGE_NX) {

Fixes: 68f5d3f3b6 ("um: add PCI over virtio emulation driver")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: Johannes Berg <johannes@sipsolutions.net>
Cc: Richard Weinberger <richard@nod.at>
Cc: linux-um@lists.infradead.org
Cc: Daniel Vetter <daniel@ffwll.ch>
Cc: Helge Deller <deller@gmx.de>
Cc: linux-fbdev@vger.kernel.org
Cc: dri-devel@lists.freedesktop.org
Cc: Michal Januszewski <spock@gentoo.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-12-31 13:32:43 +01:00
Randy Dunlap
e268a57925 fbdev: geode: don't build on UML
[ Upstream commit 71c53e19226b0166ba387d3c590d0509f541a0a1 ]

The geode fbdev driver uses struct cpuinfo fields that are not present
on ARCH=um, so don't allow this driver to be built on UML.

Prevents these build errors:

In file included from ../arch/x86/include/asm/olpc.h:7:0,
                 from ../drivers/mfd/cs5535-mfd.c:17:
../arch/x86/include/asm/geode.h: In function ‘is_geode_gx’:
../arch/x86/include/asm/geode.h:16:24: error: ‘struct cpuinfo_um’ has no member named ‘x86_vendor’
  return ((boot_cpu_data.x86_vendor == X86_VENDOR_NSC) &&
../arch/x86/include/asm/geode.h:16:39: error: ‘X86_VENDOR_NSC’ undeclared (first use in this function); did you mean ‘X86_VENDOR_ANY’?
  return ((boot_cpu_data.x86_vendor == X86_VENDOR_NSC) &&
../arch/x86/include/asm/geode.h:17:17: error: ‘struct cpuinfo_um’ has no member named ‘x86’
   (boot_cpu_data.x86 == 5) &&
../arch/x86/include/asm/geode.h:18:17: error: ‘struct cpuinfo_um’ has no member named ‘x86_model’
   (boot_cpu_data.x86_model == 5));
../arch/x86/include/asm/geode.h: In function ‘is_geode_lx’:
../arch/x86/include/asm/geode.h:23:24: error: ‘struct cpuinfo_um’ has no member named ‘x86_vendor’
  return ((boot_cpu_data.x86_vendor == X86_VENDOR_AMD) &&
../arch/x86/include/asm/geode.h:23:39: error: ‘X86_VENDOR_AMD’ undeclared (first use in this function); did you mean ‘X86_VENDOR_ANY’?
  return ((boot_cpu_data.x86_vendor == X86_VENDOR_AMD) &&
../arch/x86/include/asm/geode.h:24:17: error: ‘struct cpuinfo_um’ has no member named ‘x86’
   (boot_cpu_data.x86 == 5) &&
../arch/x86/include/asm/geode.h:25:17: error: ‘struct cpuinfo_um’ has no member named ‘x86_model’
   (boot_cpu_data.x86_model == 10));

Fixes: 68f5d3f3b6 ("um: add PCI over virtio emulation driver")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: Johannes Berg <johannes@sipsolutions.net>
Cc: Richard Weinberger <richard@nod.at>
Cc: linux-um@lists.infradead.org
Cc: Daniel Vetter <daniel@ffwll.ch>
Cc: Helge Deller <deller@gmx.de>
Cc: linux-fbdev@vger.kernel.org
Cc: dri-devel@lists.freedesktop.org
Cc: Andres Salomon <dilinger@queued.net>
Cc: linux-geode@lists.infradead.org
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-12-31 13:32:43 +01:00
Gaosheng Cui
4c0d613d79 fbdev: ep93xx-fb: Add missing clk_disable_unprepare in ep93xxfb_probe()
[ Upstream commit c84bf485a5aaf9aa0764a58832b7ef4375c29f03 ]

The clk_disable_unprepare() should be called in the error handling
of register_framebuffer(), fix it.

Fixes: 0937a7b362 ("video: ep93xx: Prepare clock before using it")
Signed-off-by: Gaosheng Cui <cuigaosheng1@huawei.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-12-31 13:32:43 +01:00
Xiongfeng Wang
1fb436db9c fbdev: vermilion: decrease reference count in error path
[ Upstream commit 001f2cdb952a9566c77fb4b5470cc361db5601bb ]

pci_get_device() will increase the reference count for the returned
pci_dev. For the error path, we need to use pci_dev_put() to decrease
the reference count.

Fixes: dbe7e429fe ("vmlfb: framebuffer driver for Intel Vermilion Range")
Signed-off-by: Xiongfeng Wang <wangxiongfeng2@huawei.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-12-31 13:32:43 +01:00
Shang XiaoJing
e94ae434f6 fbdev: via: Fix error in via_core_init()
[ Upstream commit 5886b130de953cfb8826f7771ec8640a79934a7f ]

via_core_init() won't exit the driver when pci_register_driver() failed.
Exit the viafb-i2c and the viafb-gpio in failed path to prevent error.

VIA Graphics Integration Chipset framebuffer 2.4 initializing
Error: Driver 'viafb-i2c' is already registered, aborting...
Error: Driver 'viafb-gpio' is already registered, aborting...

Fixes: 7582eb9be8 ("viafb: Turn GPIO and i2c into proper platform devices")
Signed-off-by: Shang XiaoJing <shangxiaojing@huawei.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-12-31 13:32:43 +01:00
Yang Yingliang
85255669ce fbdev: pm2fb: fix missing pci_disable_device()
[ Upstream commit ed359a464846b48f76ea6cc5cd8257e545ac97f4 ]

Add missing pci_disable_device() in error path of probe() and remove() path.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-12-31 13:32:43 +01:00
Andy Shevchenko
3be1f75453 fbdev: ssd1307fb: Drop optional dependency
[ Upstream commit 025e3b507a3a8e1ee96a3112bb67495c77d6cdb6 ]

Only a single out of three devices need a PWM, so from driver it's
optional. Moreover it's a single driver in the entire kernel that
currently selects PWM. Unfortunately this selection is a root cause
of the circular dependencies when we want to enable optional PWM
for some other drivers that select GPIOLIB.

Fixes: a2ed00da50 ("drivers/video: add support for the Solomon SSD1307 OLED Controller")
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-12-31 13:32:43 +01:00
Dave Airlie
9e2c5c651a Merge tag 'drm-misc-fixes-2022-11-24' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes
drm-misc-fixes for v6.1-rc7:
- Another amdgpu gang submit fix.
- Use dma_fence_unwrap_for_each when importing sync files.
- Fix race in dma_heap_add().
- Fix use of uninitialized memory in logo.

Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/a5721505-4823-98ef-7d6f-0ea478221391@linux.intel.com
2022-11-25 09:21:11 +10:00
Tetsuo Handa
a6a00d7e8f fbcon: Use kzalloc() in fbcon_prepare_logo()
A kernel built with syzbot's config file reported that

  scr_memcpyw(q, save, array3_size(logo_lines, new_cols, 2))

causes uninitialized "save" to be copied.

  ----------
  [drm] Initialized vgem 1.0.0 20120112 for vgem on minor 0
  [drm] Initialized vkms 1.0.0 20180514 for vkms on minor 1
  Console: switching to colour frame buffer device 128x48
  =====================================================
  BUG: KMSAN: uninit-value in do_update_region+0x4b8/0xba0
   do_update_region+0x4b8/0xba0
   update_region+0x40d/0x840
   fbcon_switch+0x3364/0x35e0
   redraw_screen+0xae3/0x18a0
   do_bind_con_driver+0x1cb3/0x1df0
   do_take_over_console+0x11cb/0x13f0
   fbcon_fb_registered+0xacc/0xfd0
   register_framebuffer+0x1179/0x1320
   __drm_fb_helper_initial_config_and_unlock+0x23ad/0x2b40
   drm_fbdev_client_hotplug+0xbea/0xda0
   drm_fbdev_generic_setup+0x65e/0x9d0
   vkms_init+0x9f3/0xc76
   (...snipped...)

  Uninit was stored to memory at:
   fbcon_prepare_logo+0x143b/0x1940
   fbcon_init+0x2c1b/0x31c0
   visual_init+0x3e7/0x820
   do_bind_con_driver+0x14a4/0x1df0
   do_take_over_console+0x11cb/0x13f0
   fbcon_fb_registered+0xacc/0xfd0
   register_framebuffer+0x1179/0x1320
   __drm_fb_helper_initial_config_and_unlock+0x23ad/0x2b40
   drm_fbdev_client_hotplug+0xbea/0xda0
   drm_fbdev_generic_setup+0x65e/0x9d0
   vkms_init+0x9f3/0xc76
   (...snipped...)

  Uninit was created at:
   __kmem_cache_alloc_node+0xb69/0x1020
   __kmalloc+0x379/0x680
   fbcon_prepare_logo+0x704/0x1940
   fbcon_init+0x2c1b/0x31c0
   visual_init+0x3e7/0x820
   do_bind_con_driver+0x14a4/0x1df0
   do_take_over_console+0x11cb/0x13f0
   fbcon_fb_registered+0xacc/0xfd0
   register_framebuffer+0x1179/0x1320
   __drm_fb_helper_initial_config_and_unlock+0x23ad/0x2b40
   drm_fbdev_client_hotplug+0xbea/0xda0
   drm_fbdev_generic_setup+0x65e/0x9d0
   vkms_init+0x9f3/0xc76
   (...snipped...)

  CPU: 2 PID: 1 Comm: swapper/0 Not tainted 6.1.0-rc4-00356-g8f2975c2bb4c #924
  Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
  ----------

Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/cad03d25-0ea0-32c4-8173-fd1895314bce@I-love.SAKURA.ne.jp
2022-11-22 15:48:02 +01:00
Linus Torvalds
b72018ab82 fbdev fixes for kernel 6.1-rc3:
A use-after-free bugfix in the smscufx driver and various minor
 error path fixes, smaller build fixes, sysfs fixes and
 typos in comments in the stifb, sisfb, da8xxfb, xilinxfb, sm501fb,
 gbefb and cyber2000fb drivers.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQS86RI+GtKfB8BJu973ErUQojoPXwUCY16ulQAKCRD3ErUQojoP
 XyvDAP9ZhF0SjbnRBwHAU9ZYC7XpCwcoqBRWFCCU7mmmbkXrJAD9F1LcEwZPGyn/
 5/hiTwzM8ioJz6HB3r04M88bl4b1cwI=
 =SnCh
 -----END PGP SIGNATURE-----

Merge tag 'fbdev-for-6.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev

Pull fbdev fixes from Helge Deller:
 "A use-after-free bugfix in the smscufx driver and various minor error
  path fixes, smaller build fixes, sysfs fixes and typos in comments in
  the stifb, sisfb, da8xxfb, xilinxfb, sm501fb, gbefb and cyber2000fb
  drivers"

* tag 'fbdev-for-6.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev:
  fbdev: cyber2000fb: fix missing pci_disable_device()
  fbdev: sisfb: use explicitly signed char
  fbdev: smscufx: Fix several use-after-free bugs
  fbdev: xilinxfb: Make xilinxfb_release() return void
  fbdev: sisfb: fix repeated word in comment
  fbdev: gbefb: Convert sysfs snprintf to sysfs_emit
  fbdev: sm501fb: Convert sysfs snprintf to sysfs_emit
  fbdev: stifb: Fall back to cfb_fillrect() on 32-bit HCRX cards
  fbdev: da8xx-fb: Fix error handling in .remove()
  fbdev: MIPS supports iomem addresses
2022-10-30 11:31:14 -07:00
Yang Yingliang
3c6bf6bddc fbdev: cyber2000fb: fix missing pci_disable_device()
Add missing pci_disable_device() in error path of probe() and remove() path.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: Helge Deller <deller@gmx.de>
2022-10-27 20:29:59 +02:00
Michał Mirosław
e0ba1a39b8 fbdev/core: Avoid uninitialized read in aperture_remove_conflicting_pci_device()
Return on error directly from the BAR-iterating loop instead of
break+return.

This is actually a cosmetic fix, since it would be highly unusual to
have this called for a PCI device without any memory BARs.

Fixes: 9d69ef1838 ("fbdev/core: Remove remove_conflicting_pci_framebuffers()")
Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patchwork.freedesktop.org/patch/msgid/e75323732bedc46d613d72ecb40f97e3bc75eea8.1666829073.git.mirq-linux@rere.qmqm.pl
2022-10-27 09:20:05 +02:00
Jason A. Donenfeld
835bed1b83 fbdev: sisfb: use explicitly signed char
With char becoming unsigned by default, and with `char` alone being
ambiguous and based on architecture, signed chars need to be marked
explicitly as such. This fixes warnings like:

drivers/video/fbdev/sis/init301.c:3549 SiS_GetCRT2Data301() warn: 'SiS_Pr->SiS_EModeIDTable[ModeIdIndex]->ROMMODEIDX661' is unsigned

Cc: Thomas Winischhofer <thomas@winischhofer.net>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Helge Deller <deller@gmx.de>
Cc: linux-usb@vger.kernel.org
Cc: linux-fbdev@vger.kernel.org
Cc: dri-devel@lists.freedesktop.org
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Helge Deller <deller@gmx.de>
2022-10-24 20:28:41 +02:00
Hyunwoo Kim
cc67482c9e fbdev: smscufx: Fix several use-after-free bugs
Several types of UAFs can occur when physically removing a USB device.

Adds ufx_ops_destroy() function to .fb_destroy of fb_ops, and
in this function, there is kref_put() that finally calls ufx_free().

This fix prevents multiple UAFs.

Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Link: https://lore.kernel.org/linux-fbdev/20221011153436.GA4446@ubuntu/
Cc: <stable@vger.kernel.org>
Signed-off-by: Helge Deller <deller@gmx.de>
2022-10-21 07:36:32 +02:00
Uwe Kleine-König
70281592bf fbdev: xilinxfb: Make xilinxfb_release() return void
The function xilinxfb_release() returns zero unconditionally. Make it
return void. There is no semantic change, the only effect is that it
becomes obvious that the driver's .remove() callback always returns zero.

This is a preparation for making platform remove callbacks return void.

Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Helge Deller <deller@gmx.de>
2022-10-20 08:36:41 +02:00
Jilin Yuan
a4f7fcd702 fbdev: sisfb: fix repeated word in comment
Signed-off-by: Jilin Yuan <yuanjilin@cdjrlc.com>
Signed-off-by: Helge Deller <deller@gmx.de>
2022-10-20 08:34:22 +02:00
Xuezhi Zhang
0a974e6ae4 fbdev: gbefb: Convert sysfs snprintf to sysfs_emit
Follow the advice of the Documentation/filesystems/sysfs.rst
and show() should only use sysfs_emit() or sysfs_emit_at()
when formatting the value to be returned to user space.

Signed-off-by: Xuezhi Zhang <zhangxuezhi1@coolpad.com>
Signed-off-by: Helge Deller <deller@gmx.de>
2022-10-18 10:28:41 +02:00
Xuezhi Zhang
9750737130 fbdev: sm501fb: Convert sysfs snprintf to sysfs_emit
Follow the advice of the Documentation/filesystems/sysfs.rst
and show() should only use sysfs_emit() or sysfs_emit_at()
when formatting the value to be returned to user space.

Signed-off-by: Xuezhi Zhang <zhangxuezhi1@coolpad.com>
Signed-off-by: Helge Deller <deller@gmx.de>
2022-10-18 10:22:28 +02:00
Helge Deller
776d875fd4 fbdev: stifb: Fall back to cfb_fillrect() on 32-bit HCRX cards
When the text console is scrolling text upwards it calls the fillrect()
function to empty the new line. The current implementation doesn't seem
to work correctly on HCRX cards in 32-bit mode and leave garbage in that
line instead. Fix it by falling back to standard cfb_fillrect() in that
case.

Signed-off-by: Helge Deller <deller@gmx.de>
Cc: <stable@vger.kernel.org>
2022-10-18 10:22:28 +02:00
Uwe Kleine-König
3c6174f9ff fbdev: da8xx-fb: Fix error handling in .remove()
Even in the presence of problems (here: regulator_disable() might fail),
it's important to unregister all resources acquired during .probe() and
disable the device (i.e. DMA activity) because even if .remove() returns
an error code, the device is removed and the .remove() callback is never
called again later to catch up.

This is a preparation for making platform remove callbacks return void.

Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Helge Deller <deller@gmx.de>
Fixes: 611097d5da ("fbdev: da8xx: add support for a regulator")
2022-10-18 10:22:28 +02:00
Linus Torvalds
f1947d7c8a Random number generator fixes for Linux 6.1-rc1.
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEq5lC5tSkz8NBJiCnSfxwEqXeA64FAmNHYD0ACgkQSfxwEqXe
 A655AA//dJK0PdRghqrKQsl18GOCffV5TUw5i1VbJQbI9d8anfxNjVUQiNGZi4et
 qUwZ8OqVXxYx1Z1UDgUE39PjEDSG9/cCvOpMUWqN20/+6955WlNZjwA7Fk6zjvlM
 R30fz5CIJns9RFvGT4SwKqbVLXIMvfg/wDENUN+8sxt36+VD2gGol7J2JJdngEhM
 lW+zqzi0ABqYy5so4TU2kixpKmpC08rqFvQbD1GPid+50+JsOiIqftDErt9Eg1Mg
 MqYivoFCvbAlxxxRh3+UHBd7ZpJLtp1UFEOl2Rf00OXO+ZclLCAQAsTczucIWK9M
 8LCZjb7d4lPJv9RpXFAl3R1xvfc+Uy2ga5KeXvufZtc5G3aMUKPuIU7k28ZyblVS
 XXsXEYhjTSd0tgi3d0JlValrIreSuj0z2QGT5pVcC9utuAqAqRIlosiPmgPlzXjr
 Us4jXaUhOIPKI+Musv/fqrxsTQziT0jgVA3Njlt4cuAGm/EeUbLUkMWwKXjZLTsv
 vDsBhEQFmyZqxWu4pYo534VX2mQWTaKRV1SUVVhQEHm57b00EAiZohoOvweB09SR
 4KiJapikoopmW4oAUFotUXUL1PM6yi+MXguTuc1SEYuLz/tCFtK8DJVwNpfnWZpE
 lZKvXyJnHq2Sgod/hEZq58PMvT6aNzTzSg7YzZy+VabxQGOO5mc=
 =M+mV
 -----END PGP SIGNATURE-----

Merge tag 'random-6.1-rc1-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/crng/random

Pull more random number generator updates from Jason Donenfeld:
 "This time with some large scale treewide cleanups.

  The intent of this pull is to clean up the way callers fetch random
  integers. The current rules for doing this right are:

   - If you want a secure or an insecure random u64, use get_random_u64()

   - If you want a secure or an insecure random u32, use get_random_u32()

     The old function prandom_u32() has been deprecated for a while
     now and is just a wrapper around get_random_u32(). Same for
     get_random_int().

   - If you want a secure or an insecure random u16, use get_random_u16()

   - If you want a secure or an insecure random u8, use get_random_u8()

   - If you want secure or insecure random bytes, use get_random_bytes().

     The old function prandom_bytes() has been deprecated for a while
     now and has long been a wrapper around get_random_bytes()

   - If you want a non-uniform random u32, u16, or u8 bounded by a
     certain open interval maximum, use prandom_u32_max()

     I say "non-uniform", because it doesn't do any rejection sampling
     or divisions. Hence, it stays within the prandom_*() namespace, not
     the get_random_*() namespace.

     I'm currently investigating a "uniform" function for 6.2. We'll see
     what comes of that.

  By applying these rules uniformly, we get several benefits:

   - By using prandom_u32_max() with an upper-bound that the compiler
     can prove at compile-time is ≤65536 or ≤256, internally
     get_random_u16() or get_random_u8() is used, which wastes fewer
     batched random bytes, and hence has higher throughput.

   - By using prandom_u32_max() instead of %, when the upper-bound is
     not a constant, division is still avoided, because
     prandom_u32_max() uses a faster multiplication-based trick instead.

   - By using get_random_u16() or get_random_u8() in cases where the
     return value is intended to indeed be a u16 or a u8, we waste fewer
     batched random bytes, and hence have higher throughput.

  This series was originally done by hand while I was on an airplane
  without Internet. Later, Kees and I worked on retroactively figuring
  out what could be done with Coccinelle and what had to be done
  manually, and then we split things up based on that.

  So while this touches a lot of files, the actual amount of code that's
  hand fiddled is comfortably small"

* tag 'random-6.1-rc1-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/crng/random:
  prandom: remove unused functions
  treewide: use get_random_bytes() when possible
  treewide: use get_random_u32() when possible
  treewide: use get_random_{u8,u16}() when possible, part 2
  treewide: use get_random_{u8,u16}() when possible, part 1
  treewide: use prandom_u32_max() when possible, part 2
  treewide: use prandom_u32_max() when possible, part 1
2022-10-16 15:27:07 -07:00
Linus Torvalds
f2e44139f3 parisc architecture fixes and updates for kernel v6.1-rc1:
* Convert the PDC console to an early console
 * Unbreak mmap() of graphics card memory due to PAGE_SPECIAL pgtable flag
 * Reduce the size of the alternative tables
 * Align stifb graphics card memory size to 4MB
 * Spelling fixes
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQS86RI+GtKfB8BJu973ErUQojoPXwUCY0mnYAAKCRD3ErUQojoP
 X1z3AQC204Pq725WM3rgEomIqFjk8QaU2UFcNQ74a52V3AUiiQD8C0DFmWDbssUv
 ZE5uC+ySlNd1hLkL3QYxrbbwuL+y+Q0=
 =YvFZ
 -----END PGP SIGNATURE-----

Merge tag 'parisc-for-6.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux

Pull parisc updates from Helge Deller:
 "Fixes:

   - When we added basic vDSO support in kernel 5.18 we introduced a bug
     which prevented a mmap() of graphic card memory. This is because we
     used the DMB (data memory break trap bit) page flag as special-bit,
     but missed to clear that bit when loading the TLB.

   - Graphics card memory size was not correctly aligned

   - Spelling fixes (from Colin Ian King)

  Enhancements:

   - PDC console (which uses firmware calls) now rewritten as early
     console

   - Reduced size of alternative tables"

* tag 'parisc-for-6.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux:
  parisc: Fix spelling mistake "mis-match" -> "mismatch" in eisa driver
  parisc: Fix userspace graphics card breakage due to pgtable special bit
  parisc: fbdev/stifb: Align graphics memory size to 4MB
  parisc: Convert PDC console to an early console
  parisc: Reduce kernel size by packing alternative tables
2022-10-14 12:10:01 -07:00
Helge Deller
aca7c13d3b parisc: fbdev/stifb: Align graphics memory size to 4MB
Independend of the current graphics resolution, adjust the reported
graphics card memory size to the next 4MB boundary.
This fixes the fbtest program which expects a naturally aligned size.

Signed-off-by: Helge Deller <deller@gmx.de>
Cc: <stable@vger.kernel.org>
2022-10-14 10:45:12 +02:00
Jason A. Donenfeld
a251c17aa5 treewide: use get_random_u32() when possible
The prandom_u32() function has been a deprecated inline wrapper around
get_random_u32() for several releases now, and compiles down to the
exact same code. Replace the deprecated wrapper with a direct call to
the real function. The same also applies to get_random_int(), which is
just a wrapper around get_random_u32(). This was done as a basic find
and replace.

Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Yury Norov <yury.norov@gmail.com>
Reviewed-by: Jan Kara <jack@suse.cz> # for ext4
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk> # for sch_cake
Acked-by: Chuck Lever <chuck.lever@oracle.com> # for nfsd
Acked-by: Jakub Kicinski <kuba@kernel.org>
Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com> # for thunderbolt
Acked-by: Darrick J. Wong <djwong@kernel.org> # for xfs
Acked-by: Helge Deller <deller@gmx.de> # for parisc
Acked-by: Heiko Carstens <hca@linux.ibm.com> # for s390
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2022-10-11 17:42:58 -06:00
Christophe Leroy
29926f1cd3 fbdev: mb862xx: Fix check of return value from irq_of_parse_and_map()
NO_IRQ is used to check the return of irq_of_parse_and_map().
On some architecture NO_IRQ is 0, on other architectures it is -1.
irq_of_parse_and_map() returns 0 on error, independent of NO_IRQ.
So use 0 instead of using NO_IRQ.

Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Helge Deller <deller@gmx.de>
2022-10-08 15:20:09 +02:00
Zeng Heng
3b29f36efc fbdev: vga16fb: Add missing MODULE_DEVICE_TABLE() entry
This patch adds missing MODULE_DEVICE_TABLE definition
which generates correct modalias for automatic loading
of this driver when it is built as an external module.

Signed-off-by: Zeng Heng <zengheng4@huawei.com>
Signed-off-by: Helge Deller <deller@gmx.de>
2022-10-08 15:20:09 +02:00
Ruan Jinjie
e82b0c3ea5 fbdev: tridentfb: Fix missing pci_disable_device() in probe and remove
Replace pci_enable_device() with pcim_enable_device(), pci_disable_device() and
pci_release_regions() will be called in release automatically.

Signed-off-by: ruanjinjie <ruanjinjie@huawei.com>
Signed-off-by: Helge Deller <deller@gmx.de>
2022-10-08 15:20:09 +02:00
Hyunwoo Kim
5610bcfe86 fbdev: smscufx: Fix use-after-free in ufx_ops_open()
A race condition may occur if the user physically removes the
USB device while calling open() for this device node.

This is a race condition between the ufx_ops_open() function and
the ufx_usb_disconnect() function, which may eventually result in UAF.

So, add a mutex to the ufx_ops_open() and ufx_usb_disconnect() functions
to avoid race contidion of krefs.

Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Helge Deller <deller@gmx.de>
2022-10-08 15:20:09 +02:00
Jiasheng Jiang
e69dade8a4 fbdev: gbefb: Convert to use dev_groups
The driver core supports the ability to handle the creation and removal
of device-specific sysfs files in a race-free manner. Moreover, it can
guarantee the success of creation. Therefore, it should be better to
convert to use dev_groups.

Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
Signed-off-by: Helge Deller <deller@gmx.de>
2022-10-08 15:20:09 +02:00
Shang XiaoJing
d13189badc fbdev: imxfb: Remove redundant dev_err() call
devm_ioremap_resource() prints error message in itself. Remove the
dev_err call to avoid redundant error message.

Signed-off-by: Shang XiaoJing <shangxiaojing@huawei.com>
Signed-off-by: Helge Deller <deller@gmx.de>
2022-10-08 15:20:08 +02:00
Zhang Qilong
b0e0706007 fbdev: omapfb/dss: Use pm_runtime_resume_and_get() instead of pm_runtime_get_sync()
Using the newest pm_runtime_resume_and_get is more appropriate
for simplifing code here.

Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Signed-off-by: Helge Deller <deller@gmx.de>
2022-10-08 15:20:08 +02:00
Jules Irenge
2559f17ec8 fbdev: uvesafb: Convert snprintf to scnprintf
Coccinelle reports: WARNING: use scnprintf or sprintf

Adding to that, there has also been some slow migration from snprintf to
scnprintf. This article explains the rationale for this change:
https: //lwn.net/Articles/69419/

Signed-off-by: Jules Irenge <jbi.octave@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
2022-10-08 15:20:08 +02:00
Jiapeng Chong
851e0986d9 fbdev: arkfb: Remove the unused function dac_read_reg()
The function dac_read_reg() is defined in the arkfb.c file, but not
called elsewhere, so delete this unused function.

drivers/video/fbdev/arkfb.c:322:18: warning: unused function 'dac_read_reg'.

Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=2155
Reported-by: Abaci Robot <abaci@linux.alibaba.com>
Signed-off-by: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
Signed-off-by: Helge Deller <deller@gmx.de>
2022-10-08 15:20:08 +02:00
Jiapeng Chong
eec5190fc0 fbdev: tridentfb: Remove the unused function shadowmode_off()
The function shadowmode_off() is defined in the tridentfb.c file, but not
called elsewhere, so delete this unused function.

drivers/video/fbdev/tridentfb.c:1131:20: warning: unused function 'shadowmode_off'.

Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=2154
Reported-by: Abaci Robot <abaci@linux.alibaba.com>
Signed-off-by: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
Signed-off-by: Helge Deller <deller@gmx.de>
2022-10-08 15:20:08 +02:00
Jiapeng Chong
83434cc0ae fbdev: controlfb: Remove the unused function VAR_MATCH()
The function VAR_MATCH is defined in the controlfb.c file, but not
called elsewhere, so delete this unused function.

drivers/video/fbdev/controlfb.c:111:19: warning: unused function 'VAR_MATCH'.

Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=2153
Reported-by: Abaci Robot <abaci@linux.alibaba.com>
Signed-off-by: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
Signed-off-by: Helge Deller <deller@gmx.de>
2022-10-08 15:20:08 +02:00
Colin Ian King
5994521688 fbdev: udlfb: Remove redundant initialization to variable identical
The variable identical is being initialized with a value that is never
read. The variable is being re-assigned later on. The initialization is
redundant and can be removed.

Cleans up clang scan-build warning:
drivers/video/fbdev/udlfb.c:373:6: warning: Value stored to 'identical'
during its initialization is never read [deadcode.DeadStores]

Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
2022-10-08 15:20:08 +02:00
Linus Torvalds
7e6739b933 drm pull for 6.1-rc1
core:
 - convert selftests to kunit
 - managed init for more objects
 - move to idr_init_base
 - rename fb and gem cma helpers to dma
 - hide unregistered connectors from getconnector ioctl
 - DSC passthrough aux support
 - backlight handling improvements
 - add dma_resv_assert_held to vmap/vunmap
 
 edid:
 - move luminance calculation to core
 
 fbdev:
 - fix aperture helper usage
 
 fourcc:
 - add more format helpers
 - add DRM_FORMAT_Cxx, DRM_FORMAT_Rxx, DRM_FORMAT_Dxx
 - add packed AYUV8888, XYUV8888
 - add some kunit tests
 
 ttm:
 - allow bos without backing store
 - rewrite placement to use intersect/compatible functions
 
 dma-buf:
 - docs update
 - improve signalling when debugging
 
 udmabuf:
 - fix failure path GPF
 
 dp:
 - drop dp/mst legacy code
 - atomic mst state support
 - audio infoframe packing
 
 panel:
 - Samsung LTL101AL01
 - B120XAN01.0
 - R140NWF5 RH
 - DMT028VGHMCMI-1A T
 - AUO B133UAN02.1
 - IVO M133NW4J-R3
 - Innolux N120ACA-EA1
 
 amdgpu:
 - Gang submit support
 - Mode2 reset for RDNA2
 - New IP support:
   DCN 3.1.4, 3.2
   SMU 13.x
   NBIO 7.7
   GC 11.x
   PSP 13.x
   SDMA 6.x
   GMC 11.x
 - DSC passthrough support
 - PSP fixes for TA support
 - vangogh GFXOFF stats
 - clang fixes
 - gang submit CS cleanup prep work
 - fix VRAM eviction issues
 
 amdkfd:
 - GC 10.3 IP ISA fixes
 - fix CRIU regression
 - CPU fault on COW mapping fixes
 
 i915:
 - align fw versioning with kernel practices
 - add display substruct to i915 private
 - add initial runtime info to driver info
 - split out HDCP and backlight registers
 - MEI XeHP SDV GSC support
 - add per-gt sysfs defaults
 - TLB invalidation improvements
 - Disable PCI BAR resize on 32-bit
 - GuC firmware updates and compat changes
 - GuC log timestamp translation
 - DG2 preemption workaround changes
 - DG2 improved HDMI pixel clocks support
 - PCI BAR sanity checks
 - Enable DC5 on DG2
 - DG2 DMC fw bumped
 - ADL-S PCI ID added
 - Meteorlake enablement
 - Rename ggtt_view to gtt_view
 - host RPS fixes
 - release mmaps on rpm suspend on discrete
 - clocking and dpll refactoring
 - VBT definitions and parsing updates
 - SKL watermark code extracted to separate file
 - allow seamless M/N changes on eDP panels
 - BUG_ON removal and cleanups
 
 msm:
 - DPU: simplified VBIF configuration
 -      cleanup CTL interfaces
 - DSI: removed unused msm_display_dsc_config struct
 -      switch regulator calls to new API
 -      switched to PANEL_BRIDGE for direct attached panels
 - DSI_PHY: convert drivers to parent_hws
 - DP: cleanup pixel_rate handling
 - HDMI: turned hdmi-phy-8996 into OF clk provider
 - misc dt-bindings fixes
 - choose eDP as primary display if it's available
 - support getting interconnects from either the mdss or the mdp5/dpu
   device nodes
 - gem: Shrinker + LRU re-work:
 - adds a shared GEM LRU+shrinker helper and moves msm over to that
 - reduces lock contention between retire and submit by avoiding the
   need to acquire obj lock in retire path (and instead using resv
   seeing obj's busyness in the shrinker
 - fix reclaim vs submit issues
 - GEM fault injection for triggering userspace error paths
 - Map/unmap optimization
 - Improved robustness for a6xx GPU recovery
 
 virtio:
 - Improve error and edge conditions handling
 - Convert to use managed helpers
 - stop exposing LINEAR modifier
 
 mgag200:
 - split modeset handling per model
 
 udl:
 - suspend/disconnect handling improvements
 
 vc4:
 - rework HDMI power up
 - depend on PM
 - better unplugging support
 
 ast:
 - resolution handling improvements
 
 ingenic:
 - Add JZ4760(B) support
 - avoid a modeset when sharpness property is unchanged
 - use the new PM ops
 
 it6505:
 - power seq and clock updates
 
 ssd130x:
 - regmap bulk write
 - use atomic helpers instead of simple helpers
 
 via:
 - rename via_drv to via_dri1, consolidate all code.
 
 radeon:
 - drop DP MST experimental support
 - delayed work flush fix
 - use time_after
 
 ti-sn65dsi86:
 - DP support
 
 mediatek:
 - MT8195 DP support
 - drop of_gpio header
 - remove unneeded result
 - small DP code improvements
 
 vkms:
 - RGB565, XRGB64 and ARGB64 support
 
 sun4i:
 - tv: convert to atomic
 
 rcar-du:
 - Synopsys DW HDMI bridge DT bindings update
 
 exynos:
 - use drm_display_info.is_hdmi
 - correct return of mixer_mode_valid and hdmi_mode_valid
 
 omap:
 - refcounting fix
 
 rockchip:
 - RK3568 support
 - RK3399 gamma support
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmM894sACgkQDHTzWXnE
 hr7EYw//WdVe69TNauCAQiOYdmPp1twmr2o5gDOFLoo4IZw5v+qK0HL/nTrDkBq6
 xIu1GLTScOh0AItW1rhFmrtKhO/u/QPQ15P6cO7x8AzlUIhVOYqM79+OA0X6zIV8
 IZjpc6EEWPSKJTCRud9HdzsV06DIa+QlwShLCaOFxRiGSuUqsxzacIHUqnFekRnV
 PBG7RzcmdWwe6Gy/7T2wegsFjw1mh4S4FypEGs53emru3PGvcau5dwXcE5Jro7Br
 k4BFFknuXahVJ2ynVfIFn3QUQRMLgAKRWflqxo7McLeKVQEt4gfB6+PaMwGpSiRQ
 iC9QPy69TWEx6X015q2DvvlQDewnCbPOlzyoj9O991QDGLPIim8srPblr8DPeeOz
 Y7IW1PRVnPdKReMJvTyrIVED/XT9fUoR7N+F9sfPnEee5HsvjXNGumEHbOE8avFf
 rB6CFdby+Ecd9cSeINXowFy4ss0d5zCHMiKEVyQWTZOJysp29vLyKezNqU5m37FK
 LAQHtsRdn1+V3o22H5y1PJyqssbOMImMV1ffqW/urRLLefPVHIKCKI8Ycgh0qxqc
 B+gebHMgF8j6RR0DHAcQby+PIVi/Pn36TAMI3lPsVjFWGS5s5EQwpKlMNj46H0Cr
 yE2Vr4w29+Nsv0b4Uz16AZ0mHcauqx4bvWMyT0frJfNcE86x8MI=
 =u/MJ
 -----END PGP SIGNATURE-----

Merge tag 'drm-next-2022-10-05' of git://anongit.freedesktop.org/drm/drm

Pull drm updates from Dave Airlie:
 "Lots of stuff all over, some new AMD IP support and gang submit
  support. i915 has further DG2 and Meteorlake pieces, and a bunch of
  i915 display refactoring. msm has a shrinker rework. There are also a
  bunch of conversions to use kunit.

  This has two external pieces, some MEI changes needed for future Intel
  discrete GPUs. These should be acked by Greg. There is also a cross
  maintainer shared tree with some backlight rework from Hans in here.

  Core:
   - convert selftests to kunit
   - managed init for more objects
   - move to idr_init_base
   - rename fb and gem cma helpers to dma
   - hide unregistered connectors from getconnector ioctl
   - DSC passthrough aux support
   - backlight handling improvements
   - add dma_resv_assert_held to vmap/vunmap

  edid:
   - move luminance calculation to core

  fbdev:
   - fix aperture helper usage

  fourcc:
   - add more format helpers
   - add DRM_FORMAT_Cxx, DRM_FORMAT_Rxx, DRM_FORMAT_Dxx
   - add packed AYUV8888, XYUV8888
   - add some kunit tests

  ttm:
   - allow bos without backing store
   - rewrite placement to use intersect/compatible functions

  dma-buf:
   - docs update
   - improve signalling when debugging

  udmabuf:
   - fix failure path GPF

  dp:
   - drop dp/mst legacy code
   - atomic mst state support
   - audio infoframe packing

  panel:
   - Samsung LTL101AL01
   - B120XAN01.0
   - R140NWF5 RH
   - DMT028VGHMCMI-1A T
   - AUO B133UAN02.1
   - IVO M133NW4J-R3
   - Innolux N120ACA-EA1

  amdgpu:
   - Gang submit support
   - Mode2 reset for RDNA2
   - New IP support:
        DCN 3.1.4, 3.2
        SMU 13.x
        NBIO 7.7
        GC 11.x
        PSP 13.x
        SDMA 6.x
        GMC 11.x
   - DSC passthrough support
   - PSP fixes for TA support
   - vangogh GFXOFF stats
   - clang fixes
   - gang submit CS cleanup prep work
   - fix VRAM eviction issues

  amdkfd:
   - GC 10.3 IP ISA fixes
   - fix CRIU regression
   - CPU fault on COW mapping fixes

  i915:
   - align fw versioning with kernel practices
   - add display substruct to i915 private
   - add initial runtime info to driver info
   - split out HDCP and backlight registers
   - MEI XeHP SDV GSC support
   - add per-gt sysfs defaults
   - TLB invalidation improvements
   - Disable PCI BAR resize on 32-bit
   - GuC firmware updates and compat changes
   - GuC log timestamp translation
   - DG2 preemption workaround changes
   - DG2 improved HDMI pixel clocks support
   - PCI BAR sanity checks
   - Enable DC5 on DG2
   - DG2 DMC fw bumped
   - ADL-S PCI ID added
   - Meteorlake enablement
   - Rename ggtt_view to gtt_view
   - host RPS fixes
   - release mmaps on rpm suspend on discrete
   - clocking and dpll refactoring
   - VBT definitions and parsing updates
   - SKL watermark code extracted to separate file
   - allow seamless M/N changes on eDP panels
   - BUG_ON removal and cleanups

  msm:
   - DPU:
       simplified VBIF configuration
       cleanup CTL interfaces
   - DSI:
       removed unused msm_display_dsc_config struct
       switch regulator calls to new API
       switched to PANEL_BRIDGE for direct attached panels
   - DSI_PHY: convert drivers to parent_hws
   - DP: cleanup pixel_rate handling
   - HDMI: turned hdmi-phy-8996 into OF clk provider
   - misc dt-bindings fixes
   - choose eDP as primary display if it's available
   - support getting interconnects from either the mdss or the mdp5/dpu
     device nodes
   - gem: Shrinker + LRU re-work:
   - adds a shared GEM LRU+shrinker helper and moves msm over to that
   - reduce lock contention between retire and submit by avoiding the
     need to acquire obj lock in retire path (and instead using resv
     seeing obj's busyness in the shrinker
   - fix reclaim vs submit issues
   - GEM fault injection for triggering userspace error paths
   - Map/unmap optimization
   - Improved robustness for a6xx GPU recovery

  virtio:
   - improve error and edge conditions handling
   - convert to use managed helpers
   - stop exposing LINEAR modifier

  mgag200:
   - split modeset handling per model

  udl:
   - suspend/disconnect handling improvements

  vc4:
   - rework HDMI power up
   - depend on PM
   - better unplugging support

  ast:
   - resolution handling improvements

  ingenic:
   - add JZ4760(B) support
   - avoid a modeset when sharpness property is unchanged
   - use the new PM ops

  it6505:
   - power seq and clock updates

  ssd130x:
   - regmap bulk write
   - use atomic helpers instead of simple helpers

  via:
   - rename via_drv to via_dri1, consolidate all code.

  radeon:
   - drop DP MST experimental support
   - delayed work flush fix
   - use time_after

  ti-sn65dsi86:
   - DP support

  mediatek:
   - MT8195 DP support
   - drop of_gpio header
   - remove unneeded result
   - small DP code improvements

  vkms:
   - RGB565, XRGB64 and ARGB64 support

  sun4i:
   - tv: convert to atomic

  rcar-du:
   - Synopsys DW HDMI bridge DT bindings update

  exynos:
   - use drm_display_info.is_hdmi
   - correct return of mixer_mode_valid and hdmi_mode_valid

  omap:
   - refcounting fix

  rockchip:
   - RK3568 support
   - RK3399 gamma support"

* tag 'drm-next-2022-10-05' of git://anongit.freedesktop.org/drm/drm: (1374 commits)
  drm/amdkfd: Fix UBSAN shift-out-of-bounds warning
  drm/amdkfd: Track unified memory when switching xnack mode
  drm/amdgpu: Enable sram on vcn_4_0_2
  drm/amdgpu: Enable VCN DPG for GC11_0_1
  drm/msm: Fix build break with recent mm tree
  drm/panel: simple: Use dev_err_probe() to simplify code
  drm/panel: panel-edp: Use dev_err_probe() to simplify code
  drm/panel: simple: Add Multi-Inno Technology MI0800FT-9
  dt-bindings: display: simple: Add Multi-Inno Technology MI0800FT-9 panel
  drm/amdgpu: correct the memcpy size for ip discovery firmware
  drm/amdgpu: Skip put_reset_domain if it doesn't exist
  drm/amdgpu: remove switch from amdgpu_gmc_noretry_set
  drm/amdgpu: Fix mc_umc_status used uninitialized warning
  drm/amd/display: Prevent OTG shutdown during PSR SU
  drm/amdgpu: add page retirement handling for CPU RAS
  drm/amdgpu: use RAS error address convert api in mca notifier
  drm/amdgpu: support to convert dedicated umc mca address
  drm/amdgpu: export umc error address convert interface
  drm/amdgpu: fix sdma v4 init microcode error
  drm/amd/display: fix array-bounds error in dc_stream_remove_writeback()
  ...
2022-10-05 11:24:12 -07:00
Linus Torvalds
a47e60729d - New Drivers
- Add support for MediaTek MT6370 Backlight
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEdrbJNaO+IJqU8IdIUa+KL4f8d2EFAmM9exUACgkQUa+KL4f8
 d2FZlg//fl0+TbyZMFh9pXgoaNeZKTOQXpKKQLBwOnZ438eC01s1OrfwmRkVxiOm
 PhUzwwG0qV83DO4jYRcjZxic2qfi2ZzRUK6mZuV6h4f1aFEDezoBneIVSKv97gTO
 sY4kYG1FxLd/bYfqjfMVcgenxBPbHuZcv1kPwA3d/x/r+feuy95cEj5hCG+4cKbU
 Qw7Gfc5isao8Vz/gStTISZADl/+5h9fYlQF5cZUJYLvUjHX8Z21YimFo3A5wYaEE
 eISn3Pg8d2AzKMeCEiosXI7AOQ0LQpfNmM7/R/WY8f691wmWndpe0FeCt2nH3s/1
 EWL6IltzSU20xqfM6BRQ7dO8dHXaokle+gTxTwmTGYyKLrcBXuUA9gez3q7IQeGA
 2M32bEpxOXEA7opQB4l5sNs/zYnMvafp1BD0Ln2S/UXftLgsdsroxsYJGfrDa0x/
 JOOplca0v6sNTWWoLebjx2+CMxgMfP3A6X+e1F8msqL37UFUD0xzWv2livUdw545
 aaYHKJIDCfeCz/vafzv/bsT5OXb75buGz/8qzNLDC/An+W34ewSBbA2+uQWbu1xS
 I9/lz1Ffts/rYIy9B2+IDfGwzd7H5KkokNq9lbvwURyUy5MllHcvIbcerdLdxI1x
 0VqC9wHWhb833NjHpmPjsUY5nM8Fy33I3EB1tFULdvbycY6qqCc=
 =JlQW
 -----END PGP SIGNATURE-----

Merge tag 'backlight-next-6.1' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight

Pull backlight update from Lee Jones:

 - Add support for MediaTek MT6370 Backlight

* tag 'backlight-next-6.1' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight:
  video: backlight: mt6370: Add MediaTek MT6370 support
  dt-bindings: backlight: Add MediaTek MT6370 backlight
2022-10-05 10:45:15 -07:00
Wolfram Sang
85f17d677f Merge branch 'master' into i2c/for-mergewindow 2022-09-27 21:33:37 +02:00
Wolfram Sang
d819524d31 Merge tag 'v6.0-rc5' into i2c/for-mergewindow
Linux 6.0-rc5
2022-09-16 20:42:18 +01:00
Linus Torvalds
e839a75601 hyperv-fixes for v6.0-rc6
-----BEGIN PGP SIGNATURE-----
 
 iQFHBAABCAAxFiEEIbPD0id6easf0xsudhRwX5BBoF4FAmMfrHUTHHdlaS5saXVA
 a2VybmVsLm9yZwAKCRB2FHBfkEGgXhocCAC7OUoyEeZxSkrX7FJbPj1XA7b2ansi
 bJX6onBOCaJalswQ83b+GU8IrmAHMMv8V7fa/v3dFf0pvKoBPR9WxizyV9hSLAmx
 3WGuj1Wzr3oJb+bWfVIzE3qpWezNtNsIiP6oKT9Q07wmUkN4877Ikm6JhgkDP94C
 20fZZouhaYV4njkM/w7QBYxTueQHSWYxjJDBiBc31CN5ChwY/2gkrAHfM9vq7krX
 MNtaGy75d2EQYKc4OlAjxHseFo6wnMThibZ3JStX/KASV/e02DlRTU3UYUpIrNCQ
 gbU+bbeeLN3BdCrMkZlFvXtGmTQJEBGaEBGd8qsT6pM6jsZT49tlYdz+
 =e1dD
 -----END PGP SIGNATURE-----

Merge tag 'hyperv-fixes-signed-20220912' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux

Pull hyperv fixes from Wei Liu:

 - Fix an error handling issue in DRM driver (Christophe JAILLET)

 - Fix some issues in framebuffer driver (Vitaly Kuznetsov)

 - Two typo fixes (Jason Wang, Shaomin Deng)

 - Drop unnecessary casting in kvp tool (Zhou Jie)

* tag 'hyperv-fixes-signed-20220912' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux:
  Drivers: hv: Never allocate anything besides framebuffer from framebuffer memory region
  Drivers: hv: Always reserve framebuffer region for Gen1 VMs
  PCI: Move PCI_VENDOR_ID_MICROSOFT/PCI_DEVICE_ID_HYPERV_VIDEO definitions to pci_ids.h
  tools: hv: kvp: remove unnecessary (void*) conversions
  Drivers: hv: remove duplicate word in a comment
  tools: hv: Remove an extraneous "the"
  drm/hyperv: Fix an error handling path in hyperv_vmbus_probe()
2022-09-12 18:33:55 -04:00
Dave Airlie
fb34d8a04e Merge tag 'drm-misc-next-2022-09-09' of git://anongit.freedesktop.org/drm/drm-misc into drm-next
drm-misc-next for v6.1-rc1:

[airlied - fix sun4i_tv build]

UAPI Changes:
- Hide unregistered connectors from GETCONNECTOR ioctl.
- drm/virtio no longer advertises LINEAR modifier, as it doesn't work.
-

Cross-subsystem Changes:
- Fix GPF in udmabuf failure path.

Core Changes:
- Rework TTM placement to use intersect/compatible functions.
- Drop legacy DP-MST support.
- More DP-MST related fixes, and move all state into atomic.
- Make DRM_MIPI_DBI select DRM_KMS_HELPER.
- Add audio_infoframe packing for DP.
- Add logging when some atomic check functions fail.
- Assorted documentation updates and fixes.

Driver Changes:
- Assorted cleanups and fixes in msm, lcdif, nouveau, virtio,
  panel/ilitek, bridge/icn6211, tve200, gma500, bridge/*, panfrost, via,
  bochs, qxl, sun4i.
- Add add AUO B133UAN02.1, IVO M133NW4J-R3, Innolux N120ACA-EA1 eDP panels.
- Improve DP-MST modeset state handling in amdgpu, nouveau, i915.
- Drop DP-MST from radeon driver, it was broken and only user of legacy
  DP-MST.
- Handle unplugging better in vc4.
- Simplify drm cmdparser tests.
- Add DP support to ti-sn65dsi86.
- Add MT8195 DP support to mediatek.
- Support RGB565, XRGB64, and ARGB64 formats in vkms.
- Convert sun4i tv support to atomic.
- Refactor vc4/vec TV Modesetting, and fix timings.
- Use atomic helpers instead of simple display helpers in ssd130x.

Maintainer changes:
- Add Douglas Anderson as reviewer for panel-edp.

Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/a489485b-3ebc-c734-0f80-aed963d89efe@linux.intel.com
2022-09-11 22:03:07 +10:00
ChiaEn Wu
e7647de058 video: backlight: mt6370: Add MediaTek MT6370 support
MediaTek MT6370 is a SubPMIC consisting of a single cell battery charger
with ADC monitoring, RGB LEDs, dual channel flashlight, WLED backlight
driver, display bias voltage supply, one general purpose LDO, and the
USB Type-C & PD controller complies with the latest USB Type-C and PD
standards.

Add support for the MediaTek MT6370 backlight driver.
It controls 4 channels of 8 series WLEDs in
2048 (only for MT6370/MT6371) / 16384 (only for MT6372)
current steps (30 mA) in exponential or linear mapping curves.

Reviewed-by: Daniel Thompson <daniel.thompson@linaro.org>
Signed-off-by: ChiaEn Wu <chiaen_wu@richtek.com>
Signed-off-by: Lee Jones <lee@kernel.org>
Link: https://lore.kernel.org/r/20220830034042.9354-11-peterwu.pub@gmail.com
2022-09-08 08:50:57 +01:00
Daniel Vetter
8284bae723 drm-misc-next for v6.1:
UAPI Changes:
 
 Cross-subsystem Changes:
 - DMA-buf: documentation updates.
 - Assorted small fixes to vga16fb
 - Fix fbdev drivers to use the aperture helpers.
 - Make removal of conflicting drivers work correctly without fbdev enabled.
 
 Core Changes:
 - bridge, scheduler, dp-mst: Assorted small fixes.
 - Add more format helpers to fourcc, and use it to replace the cpp usage.
 - Add DRM_FORMAT_Cxx, DRM_FORMAT_Rxx (single channel), and DRM_FORMAT_Dxx
   ("darkness", inverted single channel)
 - Add packed AYUV8888 and XYUV8888 formats.
 - Assorted documentation updates.
 - Rename ttm_bo_init to ttm_bo_init_validate.
 - Allow TTM bo's to exist without backing store.
 - Convert drm selftests to kunit.
 - Add managed init functions for (panel) bridge, crtc, encoder and connector.
 - Fix endianness handling in various format conversion helpers.
 - Make tests pass on big-endian platforms, and add test for rgb888 -> rgb565
 - Move DRM_PLANE_HELPER_NO_SCALING to atomic helpers and rename, so
   drm_plane_helper is no longer needed in most drivers.
 - Use idr_init_base instead of idr_init.
 - Rename FB and GEM CMA helpers to DMA helpers.
 - Rework XRGB8888 related conversion helpers, and add drm_fb_blit() that
   takes a iosys_map. Make drm_fb_memcpy take an iosys_map too.
 - Move edid luminance calculation to core, and use it in i915.
 
 Driver Changes:
 - bridge/{adv7511,ti-sn65dsi86,parade-ps8640}, panel/{simple,nt35510,tc358767},
   nouveau, sun4i, mipi-dsi, mgag200, bochs, arm, komeda, vmwgfx, pl111:
   Assorted small fixes and doc updates.
 - vc4: Rework hdmi power up, and depend on PM.
 - panel/simple: Add Samsung LTL101AL01.
 - ingenic: Add JZ4760(B) support, avoid a modeset when sharpness property
   is unchanged, and use the new PM ops.
 - Revert some amdgpu commits that cause garbaged graphics when starting
   X, and reapply them with the real problem fixed.
 - Completely rework vc4 init to use managed helpers.
 - Rename via_drv to via_dri1, and move all stuff there only used by the
   dri1 implementation in preperation for atomic modeset.
 - Use regmap bulk write in ssd130x.
 - Power sequence and clock updates to it6505.
 - Split panel-sitrox-st7701  init sequence and rework mode programming code.
 - virtio: Improve error and edge conditions handling, and convert to use managed
   helpers.
 - Add Samsung LTL101AL01, B120XAN01.0, R140NWF5 RH, DMT028VGHMCMI-1A T, panels.
 - Add generic fbdev support to komeda.
 - Split mgag200 modeset handling to make it more model-specific.
 - Convert simpledrm to use atomic helpers.
 - Improve udl suspend/disconnect handling.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEuXvWqAysSYEJGuVH/lWMcqZwE8MFAmMA59MACgkQ/lWMcqZw
 E8MBihAAtttSIF8fvRIgnoFeswteB5HlXtrSOVRns+0h7mNzcmUL3yp/jV9betND
 NEfBCERRIRk5vqkzm2o9P/rTG+KMYCyyCNdcvvh+rVn+HU2V9MwtJdowZqLu7Rxi
 Qn59SaL6fMQanJwF8yHcii1ikqelU8TfsMXcFXt2d/yjn5D/h80tNOULEB74zIDH
 Vey/xTawcqEz3Qbj2mL4VihEnzU1cziGTpZvAWU2GTdWLxxN88uA4RD2JDyvGaXG
 oO6oilYT9TW+2C+0jfMUysu7RcNYuo4KD8dSVLvec+UKDKdO1pSqn40vgTZp0MBw
 V0VGg/Lqg6+u33UQkxeRpdzTboD4cMjoeP0/IJdHQVMYYH449tXDgZEjXqVHdz2c
 Ea8JIm36CHjqA0Ua3DT8y1qRtdrjuATJauoB6MXW8RpguqMzVuI4e9Dio77WRNYe
 Lg/V5AlQEKcwxeqe6v+8K7aB4lvHZ9g0WSMFHoxYz28d2cFWDVeKgK/GCW3WWMKo
 AQigRS84z3QBqK+IeTjbfZREoRFtx7NzQpzU9jQdL06XGWExhGOs8yU2OCoDNN8+
 iFMBStEPHLPg27HrLV5JYeMRUBPJMnwQhAEnrSv9KqIfPD3/g2jonoGm3J57p+OI
 Ag7pwg88spzP1DC7M6+UvzUnH76Dhf4hdnfQjz10c6BfS1ODPbA=
 =kU/l
 -----END PGP SIGNATURE-----

Merge tag 'drm-misc-next-2022-08-20-1' of git://anongit.freedesktop.org/drm/drm-misc into drm-next

drm-misc-next for v6.1:

UAPI Changes:

Cross-subsystem Changes:
- DMA-buf: documentation updates.
- Assorted small fixes to vga16fb
- Fix fbdev drivers to use the aperture helpers.
- Make removal of conflicting drivers work correctly without fbdev enabled.

Core Changes:
- bridge, scheduler, dp-mst: Assorted small fixes.
- Add more format helpers to fourcc, and use it to replace the cpp usage.
- Add DRM_FORMAT_Cxx, DRM_FORMAT_Rxx (single channel), and DRM_FORMAT_Dxx
  ("darkness", inverted single channel)
- Add packed AYUV8888 and XYUV8888 formats.
- Assorted documentation updates.
- Rename ttm_bo_init to ttm_bo_init_validate.
- Allow TTM bo's to exist without backing store.
- Convert drm selftests to kunit.
- Add managed init functions for (panel) bridge, crtc, encoder and connector.
- Fix endianness handling in various format conversion helpers.
- Make tests pass on big-endian platforms, and add test for rgb888 -> rgb565
- Move DRM_PLANE_HELPER_NO_SCALING to atomic helpers and rename, so
  drm_plane_helper is no longer needed in most drivers.
- Use idr_init_base instead of idr_init.
- Rename FB and GEM CMA helpers to DMA helpers.
- Rework XRGB8888 related conversion helpers, and add drm_fb_blit() that
  takes a iosys_map. Make drm_fb_memcpy take an iosys_map too.
- Move edid luminance calculation to core, and use it in i915.

Driver Changes:
- bridge/{adv7511,ti-sn65dsi86,parade-ps8640}, panel/{simple,nt35510,tc358767},
  nouveau, sun4i, mipi-dsi, mgag200, bochs, arm, komeda, vmwgfx, pl111:
  Assorted small fixes and doc updates.
- vc4: Rework hdmi power up, and depend on PM.
- panel/simple: Add Samsung LTL101AL01.
- ingenic: Add JZ4760(B) support, avoid a modeset when sharpness property
  is unchanged, and use the new PM ops.
- Revert some amdgpu commits that cause garbaged graphics when starting
  X, and reapply them with the real problem fixed.
- Completely rework vc4 init to use managed helpers.
- Rename via_drv to via_dri1, and move all stuff there only used by the
  dri1 implementation in preperation for atomic modeset.
- Use regmap bulk write in ssd130x.
- Power sequence and clock updates to it6505.
- Split panel-sitrox-st7701  init sequence and rework mode programming code.
- virtio: Improve error and edge conditions handling, and convert to use managed
  helpers.
- Add Samsung LTL101AL01, B120XAN01.0, R140NWF5 RH, DMT028VGHMCMI-1A T, panels.
- Add generic fbdev support to komeda.
- Split mgag200 modeset handling to make it more model-specific.
- Convert simpledrm to use atomic helpers.
- Improve udl suspend/disconnect handling.

Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/f0c71766-61e8-19b7-763a-5fbcdefc633d@linux.intel.com
2022-09-06 10:56:04 +02:00
Vitaly Kuznetsov
8409fe92d8 PCI: Move PCI_VENDOR_ID_MICROSOFT/PCI_DEVICE_ID_HYPERV_VIDEO definitions to pci_ids.h
There are already three places in kernel which define
PCI_VENDOR_ID_MICROSOFT and two for PCI_DEVICE_ID_HYPERV_VIDEO and
there's a need to use these from core VMBus code. Move the defines where
they belong.

No functional change.

Reviewed-by: Michael Kelley <mikelley@microsoft.com>
Acked-by: Bjorn Helgaas <bhelgaas@google.com> # pci_ids.h
Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Link: https://lore.kernel.org/r/20220827130345.1320254-2-vkuznets@redhat.com
Signed-off-by: Wei Liu <wei.liu@kernel.org>
2022-09-05 17:00:54 +00:00
Markus Schneider-Pargmann
f89aa0b6db video/hdmi: Add audio_infoframe packing for DP
Similar to HDMI, DP uses audio infoframes as well which are structured
very similar to the HDMI ones.

This patch adds a helper function to pack the HDMI audio infoframe for
DP, called hdmi_audio_infoframe_pack_for_dp().
hdmi_audio_infoframe_pack_only() is split into two parts. One of them
packs the payload only and can be used for HDMI and DP.

Also constify the frame parameter in hdmi_audio_infoframe_check() as
it is passed to hdmi_audio_infoframe_check_only() which expects a const.

Signed-off-by: Markus Schneider-Pargmann <msp@baylibre.com>
Signed-off-by: Guillaume Ranquet <granquet@baylibre.com>
Signed-off-by: Bo-Chen Chen <rex-bc.chen@mediatek.com>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20220901044149.16782-3-rex-bc.chen@mediatek.com
2022-09-04 15:31:59 +03:00