Commit Graph

23543 Commits

Author SHA1 Message Date
Greg Kroah-Hartman
55e4f0c551 This is the 6.1.25 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmRBFW0ACgkQONu9yGCS
 aT7Jew//Ytw9+JQ71LT1TuJnQ1GayJOL1BW5hgxoYgnBFasWDwsGA9rzHs6KHqHb
 0Vjk7MX7VZB+6zWakOxY5CFVM33J4fS7wY8WE2bj8X3QQhD/J0HQDMdELvSBi3qF
 7xI6sghEQEwOuwAj2+CBqm/q7rA5FTnO1QgJuk/AKJ6PHGRiQeZ7q1zGpFvSaj7S
 cyKvY99RsjnUN+PYk4LE2+u/6DVCqiWYVDQrdjalb9zsrXg4+nmPH6ZJzZX8+bbM
 eM0xAR675V8TXqDi+8bj7tWmiS52XyjYF3Q/bu9BmU67DqslH9FFyVQxhgTHUZpN
 qWXkojEU2djIc3qt7T/bpZS/vD8Kg3Px1CgyIRN8Y5SlZfhZyqVdTZ4AQCtJuLQJ
 wDIdQCLlGzzDNFvbD+LdfJSjZt7Ig1sM/HwtPZhUA9yF0FN1XV3dcESzCOeI0/S7
 ohRh8cs1sidnxrbvVwiVNENSqbJD7G9/9vVjIfyfcnt57q+fs6xCBhpOyNoVOp74
 I5i6ALMcVZoAB50vDjnoGZsSRe9W2AmOV6UMIkVCvRCWYFqBpgVftMTAACNyljni
 UlXmO7aDQj+nbHD/auclFtU02oHQbk62FSrwoWMFS090zWztQqUhgRY7Qnl13yCM
 poEvrKlskXhvunsNtdVmI5O3N2GANWKgGwkyFIiXvgxKkw1qpUo=
 =zeN9
 -----END PGP SIGNATURE-----

Merge 6.1.25 into android14-6.1

Changes in 6.1.25
	Revert "pinctrl: amd: Disable and mask interrupts on resume"
	drm/amd/display: Pass the right info to drm_dp_remove_payload
	ALSA: emu10k1: fix capture interrupt handler unlinking
	ALSA: hda/sigmatel: add pin overrides for Intel DP45SG motherboard
	ALSA: i2c/cs8427: fix iec958 mixer control deactivation
	ALSA: hda: patch_realtek: add quirk for Asus N7601ZM
	ALSA: hda/realtek: Add quirks for Lenovo Z13/Z16 Gen2
	ALSA: firewire-tascam: add missing unwind goto in snd_tscm_stream_start_duplex()
	ALSA: emu10k1: don't create old pass-through playback device on Audigy
	ALSA: hda/sigmatel: fix S/PDIF out on Intel D*45* motherboards
	ALSA: hda/hdmi: disable KAE for Intel DG2
	Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}
	Bluetooth: Fix race condition in hidp_session_thread
	bluetooth: btbcm: Fix logic error in forming the board name.
	Bluetooth: Free potentially unfreed SCO connection
	Bluetooth: hci_conn: Fix possible UAF
	btrfs: restore the thread_pool= behavior in remount for the end I/O workqueues
	btrfs: fix fast csum implementation detection
	fbmem: Reject FB_ACTIVATE_KD_TEXT from userspace
	mtdblock: tolerate corrected bit-flips
	mtd: rawnand: meson: fix bitmask for length in command word
	mtd: rawnand: stm32_fmc2: remove unsupported EDO mode
	mtd: rawnand: stm32_fmc2: use timings.mode instead of checking tRC_min
	KVM: arm64: PMU: Restore the guest's EL0 event counting after migration
	fbcon: Fix error paths in set_con2fb_map
	fbcon: set_con2fb_map needs to set con2fb_map!
	drm/i915/dsi: fix DSS CTL register offsets for TGL+
	clk: sprd: set max_register according to mapping range
	RDMA/irdma: Do not generate SW completions for NOPs
	RDMA/irdma: Fix memory leak of PBLE objects
	RDMA/irdma: Increase iWARP CM default rexmit count
	RDMA/irdma: Add ipv4 check to irdma_find_listener()
	IB/mlx5: Add support for 400G_8X lane speed
	RDMA/erdma: Update default EQ depth to 4096 and max_send_wr to 8192
	RDMA/erdma: Inline mtt entries into WQE if supported
	RDMA/erdma: Defer probing if netdevice can not be found
	clk: rs9: Fix suspend/resume
	RDMA/cma: Allow UD qp_type to join multicast only
	bpf: tcp: Use sock_gen_put instead of sock_put in bpf_iter_tcp
	LoongArch, bpf: Fix jit to skip speculation barrier opcode
	dmaengine: apple-admac: Handle 'global' interrupt flags
	dmaengine: apple-admac: Set src_addr_widths capability
	dmaengine: apple-admac: Fix 'current_tx' not getting freed
	9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition
	bpf, arm64: Fixed a BTI error on returning to patched function
	KVM: arm64: Initialise hypervisor copies of host symbols unconditionally
	KVM: arm64: Advertise ID_AA64PFR0_EL1.CSV2/3 to protected VMs
	niu: Fix missing unwind goto in niu_alloc_channels()
	tcp: restrict net.ipv4.tcp_app_win
	bonding: fix ns validation on backup slaves
	iavf: refactor VLAN filter states
	iavf: remove active_cvlans and active_svlans bitmaps
	net: openvswitch: fix race on port output
	Bluetooth: hci_conn: Fix not cleaning up on LE Connection failure
	Bluetooth: Fix printing errors if LE Connection times out
	Bluetooth: SCO: Fix possible circular locking dependency sco_sock_getsockopt
	Bluetooth: Set ISO Data Path on broadcast sink
	drm/armada: Fix a potential double free in an error handling path
	qlcnic: check pci_reset_function result
	net: wwan: iosm: Fix error handling path in ipc_pcie_probe()
	cgroup,freezer: hold cpu_hotplug_lock before freezer_mutex
	net: qrtr: Fix an uninit variable access bug in qrtr_tx_resume()
	sctp: fix a potential overflow in sctp_ifwdtsn_skip
	RDMA/core: Fix GID entry ref leak when create_ah fails
	selftests: openvswitch: adjust datapath NL message declaration
	udp6: fix potential access to stale information
	net: macb: fix a memory corruption in extended buffer descriptor mode
	skbuff: Fix a race between coalescing and releasing SKBs
	libbpf: Fix single-line struct definition output in btf_dump
	ARM: 9290/1: uaccess: Fix KASAN false-positives
	ARM: dts: qcom: apq8026-lg-lenok: add missing reserved memory
	power: supply: rk817: Fix unsigned comparison with less than zero
	power: supply: cros_usbpd: reclassify "default case!" as debug
	power: supply: axp288_fuel_gauge: Added check for negative values
	selftests/bpf: Fix progs/find_vma_fail1.c build error.
	wifi: mwifiex: mark OF related data as maybe unused
	i2c: imx-lpi2c: clean rx/tx buffers upon new message
	i2c: hisi: Avoid redundant interrupts
	efi: sysfb_efi: Add quirk for Lenovo Yoga Book X91F/L
	block: ublk_drv: mark device as LIVE before adding disk
	ACPI: video: Add backlight=native DMI quirk for Acer Aspire 3830TG
	drm: panel-orientation-quirks: Add quirk for Lenovo Yoga Book X90F
	hwmon: (peci/cputemp) Fix miscalculated DTS for SKX
	hwmon: (xgene) Fix ioremap and memremap leak
	verify_pefile: relax wrapper length check
	asymmetric_keys: log on fatal failures in PE/pkcs7
	nvme: send Identify with CNS 06h only to I/O controllers
	wifi: iwlwifi: mvm: fix mvmtxq->stopped handling
	wifi: iwlwifi: mvm: protect TXQ list manipulation
	drm/amdgpu: add mes resume when do gfx post soft reset
	drm/amdgpu: Force signal hw_fences that are embedded in non-sched jobs
	drm/amdgpu/gfx: set cg flags to enter/exit safe mode
	ACPI: resource: Add Medion S17413 to IRQ override quirk
	x86/hyperv: Move VMCB enlightenment definitions to hyperv-tlfs.h
	KVM: selftests: Move "struct hv_enlightenments" to x86_64/svm.h
	KVM: SVM: Add a proper field for Hyper-V VMCB enlightenments
	x86/hyperv: KVM: Rename "hv_enlightenments" to "hv_vmcb_enlightenments"
	KVM: SVM: Flush Hyper-V TLB when required
	tracing: Add trace_array_puts() to write into instance
	tracing: Have tracing_snapshot_instance_cond() write errors to the appropriate instance
	maple_tree: fix write memory barrier of nodes once dead for RCU mode
	ksmbd: avoid out of bounds access in decode_preauth_ctxt()
	riscv: add icache flush for nommu sigreturn trampoline
	HID: intel-ish-hid: Fix kernel panic during warm reset
	net: sfp: initialize sfp->i2c_block_size at sfp allocation
	net: phy: nxp-c45-tja11xx: add remove callback
	net: phy: nxp-c45-tja11xx: fix unsigned long multiplication overflow
	scsi: ses: Handle enclosure with just a primary component gracefully
	x86/PCI: Add quirk for AMD XHCI controller that loses MSI-X state in D3hot
	cgroup: fix display of forceidle time at root
	cgroup/cpuset: Fix partition root's cpuset.cpus update bug
	cgroup/cpuset: Wake up cpuset_attach_wq tasks in cpuset_cancel_attach()
	drm/amd/pm: correct SMU13.0.7 pstate profiling clock settings
	drm/amd/pm: correct SMU13.0.7 max shader clock reporting
	mptcp: use mptcp_schedule_work instead of open-coding it
	mptcp: stricter state check in mptcp_worker
	ubi: Fix failure attaching when vid_hdr offset equals to (sub)page size
	ubi: Fix deadlock caused by recursively holding work_sem
	i2c: mchp-pci1xxxx: Update Timing registers
	powerpc/papr_scm: Update the NUMA distance table for the target node
	sched/fair: Fix imbalance overflow
	x86/rtc: Remove __init for runtime functions
	i2c: ocores: generate stop condition after timeout in polling mode
	cifs: fix negotiate context parsing
	nvme-pci: mark Lexar NM760 as IGNORE_DEV_SUBNQN
	nvme-pci: add NVME_QUIRK_BOGUS_NID for T-FORCE Z330 SSD
	cgroup/cpuset: Skip spread flags update on v2
	cgroup/cpuset: Make cpuset_fork() handle CLONE_INTO_CGROUP properly
	cgroup/cpuset: Add cpuset_can_fork() and cpuset_cancel_fork() methods
	Linux 6.1.25

Change-Id: Ib4d2c49ea9bacb8d8dbdb7b3a4eecce937016427
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-04-26 13:13:19 +00:00
Greg Kroah-Hartman
0fff48d6fe Merge 6.1.24 into android14-6.1
Changes in 6.1.24
	dm cache: Add some documentation to dm-cache-background-tracker.h
	dm integrity: Remove bi_sector that's only used by commented debug code
	dm: change "unsigned" to "unsigned int"
	dm: fix improper splitting for abnormal bios
	KVM: arm64: PMU: Align chained counter implementation with architecture pseudocode
	KVM: arm64: PMU: Distinguish between 64bit counter and 64bit overflow
	KVM: arm64: PMU: Sanitise PMCR_EL0.LP on first vcpu run
	KVM: arm64: PMU: Don't save PMCR_EL0.{C,P} for the vCPU
	gpio: GPIO_REGMAP: select REGMAP instead of depending on it
	Drivers: vmbus: Check for channel allocation before looking up relids
	ASoC: SOF: ipc4: Ensure DSP is in D0I0 during sof_ipc4_set_get_data()
	pwm: Make .get_state() callback return an error code
	pwm: hibvt: Explicitly set .polarity in .get_state()
	pwm: cros-ec: Explicitly set .polarity in .get_state()
	pwm: iqs620a: Explicitly set .polarity in .get_state()
	pwm: sprd: Explicitly set .polarity in .get_state()
	pwm: meson: Explicitly set .polarity in .get_state()
	ASoC: codecs: lpass: fix the order or clks turn off during suspend
	KVM: s390: pv: fix external interruption loop not always detected
	wifi: mac80211: fix the size calculation of ieee80211_ie_len_eht_cap()
	wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta
	net: qrtr: Fix a refcount bug in qrtr_recvmsg()
	net: phylink: add phylink_expects_phy() method
	net: stmmac: check if MAC needs to attach to a PHY
	net: stmmac: remove redundant fixup to support fixed-link mode
	l2tp: generate correct module alias strings
	wifi: brcmfmac: Fix SDIO suspend/resume regression
	NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL
	nfsd: call op_release, even when op_func returns an error
	icmp: guard against too small mtu
	ALSA: hda/hdmi: Preserve the previous PCM device upon re-enablement
	net: don't let netpoll invoke NAPI if in xmit context
	net: dsa: mv88e6xxx: Reset mv88e6393x force WD event bit
	sctp: check send stream number after wait_for_sndbuf
	net: qrtr: Do not do DEL_SERVER broadcast after DEL_CLIENT
	ipv6: Fix an uninit variable access bug in __ip6_make_skb()
	platform/x86: think-lmi: Fix memory leak when showing current settings
	platform/x86: think-lmi: Fix memory leaks when parsing ThinkStation WMI strings
	platform/x86: think-lmi: Clean up display of current_value on Thinkstation
	gpio: davinci: Do not clear the bank intr enable bit in save_context
	gpio: davinci: Add irq chip flag to skip set wake
	net: ethernet: ti: am65-cpsw: Fix mdio cleanup in probe
	net: stmmac: fix up RX flow hash indirection table when setting channels
	sunrpc: only free unix grouplist after RCU settles
	NFSD: callback request does not use correct credential for AUTH_SYS
	ice: fix wrong fallback logic for FDIR
	ice: Reset FDIR counter in FDIR init stage
	raw: use net_hash_mix() in hash function
	raw: Fix NULL deref in raw_get_next().
	ping: Fix potentail NULL deref for /proc/net/icmp.
	ethtool: reset #lanes when lanes is omitted
	netlink: annotate lockless accesses to nlk->max_recvmsg_len
	gve: Secure enough bytes in the first TX desc for all TCP pkts
	arm64: compat: Work around uninitialized variable warning
	net: stmmac: check fwnode for phy device before scanning for phy
	cxl/pci: Fix CDAT retrieval on big endian
	cxl/pci: Handle truncated CDAT header
	cxl/pci: Handle truncated CDAT entries
	cxl/pci: Handle excessive CDAT length
	PCI/DOE: Silence WARN splat with CONFIG_DEBUG_OBJECTS=y
	PCI/DOE: Fix memory leak with CONFIG_DEBUG_OBJECTS=y
	usb: xhci: tegra: fix sleep in atomic call
	xhci: Free the command allocated for setting LPM if we return early
	xhci: also avoid the XHCI_ZERO_64B_REGS quirk with a passthrough iommu
	usb: cdnsp: Fixes error: uninitialized symbol 'len'
	usb: dwc3: pci: add support for the Intel Meteor Lake-S
	USB: serial: cp210x: add Silicon Labs IFS-USB-DATACABLE IDs
	usb: typec: altmodes/displayport: Fix configure initial pin assignment
	USB: serial: option: add Telit FE990 compositions
	USB: serial: option: add Quectel RM500U-CN modem
	drivers: iio: adc: ltc2497: fix LSB shift
	iio: adis16480: select CONFIG_CRC32
	iio: adc: qcom-spmi-adc5: Fix the channel name
	iio: adc: ti-ads7950: Set `can_sleep` flag for GPIO chip
	iio: dac: cio-dac: Fix max DAC write value check for 12-bit
	iio: buffer: correctly return bytes written in output buffers
	iio: buffer: make sure O_NONBLOCK is respected
	iio: light: cm32181: Unregister second I2C client if present
	tty: serial: sh-sci: Fix transmit end interrupt handler
	tty: serial: sh-sci: Fix Rx on RZ/G2L SCI
	tty: serial: fsl_lpuart: avoid checking for transfer complete when UARTCTRL_SBK is asserted in lpuart32_tx_empty
	nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread()
	nilfs2: fix sysfs interface lifetime
	dt-bindings: serial: renesas,scif: Fix 4th IRQ for 4-IRQ SCIFs
	serial: 8250: Prevent starting up DMA Rx on THRI interrupt
	ksmbd: do not call kvmalloc() with __GFP_NORETRY | __GFP_NO_WARN
	ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr
	ALSA: hda/realtek: Add quirk for Clevo X370SNW
	ALSA: hda/realtek: fix mute/micmute LEDs for a HP ProBook
	x86/acpi/boot: Correct acpi_is_processor_usable() check
	x86/ACPI/boot: Use FADT version to check support for online capable
	KVM: x86: Clear "has_error_code", not "error_code", for RM exception injection
	KVM: nVMX: Do not report error code when synthesizing VM-Exit from Real Mode
	mm: kfence: fix PG_slab and memcg_data clearing
	mm: kfence: fix handling discontiguous page
	coresight: etm4x: Do not access TRCIDR1 for identification
	coresight-etm4: Fix for() loop drvdata->nr_addr_cmp range bug
	counter: 104-quad-8: Fix race condition between FLAG and CNTR reads
	counter: 104-quad-8: Fix Synapse action reported for Index signals
	blk-mq: directly poll requests
	iio: adc: ad7791: fix IRQ flags
	io_uring: fix return value when removing provided buffers
	io_uring: fix memory leak when removing provided buffers
	scsi: qla2xxx: Fix memory leak in qla2x00_probe_one()
	scsi: iscsi_tcp: Check that sock is valid before iscsi_set_param()
	nvme: fix discard support without oncs
	cifs: sanitize paths in cifs_update_super_prepath.
	block: ublk: make sure that block size is set correctly
	block: don't set GD_NEED_PART_SCAN if scan partition failed
	perf/core: Fix the same task check in perf_event_set_output
	ftrace: Mark get_lock_parent_ip() __always_inline
	ftrace: Fix issue that 'direct->addr' not restored in modify_ftrace_direct()
	fs: drop peer group ids under namespace lock
	can: j1939: j1939_tp_tx_dat_new(): fix out-of-bounds memory access
	can: isotp: fix race between isotp_sendsmg() and isotp_release()
	can: isotp: isotp_ops: fix poll() to not report false EPOLLOUT events
	can: isotp: isotp_recvmsg(): use sock_recv_cmsgs() to get SOCK_RXQ_OVFL infos
	ACPI: video: Add auto_detect arg to __acpi_video_get_backlight_type()
	ACPI: video: Make acpi_backlight=video work independent from GPU driver
	ACPI: video: Add acpi_backlight=video quirk for Apple iMac14,1 and iMac14,2
	ACPI: video: Add acpi_backlight=video quirk for Lenovo ThinkPad W530
	net: stmmac: Add queue reset into stmmac_xdp_open() function
	tracing/synthetic: Fix races on freeing last_cmd
	tracing/timerlat: Notify new max thread latency
	tracing/osnoise: Fix notify new tracing_max_latency
	tracing: Free error logs of tracing instances
	ASoC: hdac_hdmi: use set_stream() instead of set_tdm_slots()
	tracing/synthetic: Make lastcmd_mutex static
	zsmalloc: document freeable stats
	mm: vmalloc: avoid warn_alloc noise caused by fatal signal
	wifi: mt76: ignore key disable commands
	ublk: read any SQE values upfront
	drm/panfrost: Fix the panfrost_mmu_map_fault_addr() error path
	drm/nouveau/disp: Support more modes by checking with lower bpc
	drm/i915: Fix context runtime accounting
	drm/i915: fix race condition UAF in i915_perf_add_config_ioctl
	ring-buffer: Fix race while reader and writer are on the same page
	mm/swap: fix swap_info_struct race between swapoff and get_swap_pages()
	mm/hugetlb: fix uffd wr-protection for CoW optimization path
	maple_tree: fix get wrong data_end in mtree_lookup_walk()
	maple_tree: fix a potential concurrency bug in RCU mode
	blk-throttle: Fix that bps of child could exceed bps limited in parent
	drm/amd/display: Clear MST topology if it fails to resume
	drm/amdgpu: for S0ix, skip SDMA 5.x+ suspend/resume
	drm/amdgpu: skip psp suspend for IMU enabled ASICs mode2 reset
	drm/display/dp_mst: Handle old/new payload states in drm_dp_remove_payload()
	drm/i915/dp_mst: Fix payload removal during output disabling
	drm/bridge: lt9611: Fix PLL being unable to lock
	drm/i915: Use _MMIO_PIPE() for SKL_BOTTOM_COLOR
	drm/i915: Split icl_color_commit_noarm() from skl_color_commit_noarm()
	mm: take a page reference when removing device exclusive entries
	maple_tree: remove GFP_ZERO from kmem_cache_alloc() and kmem_cache_alloc_bulk()
	maple_tree: fix potential rcu issue
	maple_tree: reduce user error potential
	maple_tree: fix handle of invalidated state in mas_wr_store_setup()
	maple_tree: fix mas_prev() and mas_find() state handling
	maple_tree: be more cautious about dead nodes
	maple_tree: refine ma_state init from mas_start()
	maple_tree: detect dead nodes in mas_start()
	maple_tree: fix freeing of nodes in rcu mode
	maple_tree: remove extra smp_wmb() from mas_dead_leaves()
	maple_tree: add smp_rmb() to dead node detection
	maple_tree: add RCU lock checking to rcu callback functions
	mm: enable maple tree RCU mode by default.
	bpftool: Print newline before '}' for struct with padding only fields
	Linux 6.1.24

Change-Id: I475408e1166927565c7788e7095bdf2cb236c4b2
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-04-22 08:52:25 +00:00
Jiri Kosina
f8e702c544 scsi: ses: Handle enclosure with just a primary component gracefully
commit c8e22b7a1694bb8d025ea636816472739d859145 upstream.

This reverts commit 3fe97ff3d949 ("scsi: ses: Don't attach if enclosure
has no components") and introduces proper handling of case where there are
no detected secondary components, but primary component (enumerated in
num_enclosures) does exist. That fix was originally proposed by Ding Hui
<dinghui@sangfor.com.cn>.

Completely ignoring devices that have one primary enclosure and no
secondary one results in ses_intf_add() bailing completely

	scsi 2:0:0:254: enclosure has no enumerated components
        scsi 2:0:0:254: Failed to bind enclosure -12ven in valid configurations such

even on valid configurations with 1 primary and 0 secondary enclosures as
below:

	# sg_ses /dev/sg0
	  3PARdata  SES               3321
	Supported diagnostic pages:
	  Supported Diagnostic Pages [sdp] [0x0]
	  Configuration (SES) [cf] [0x1]
	  Short Enclosure Status (SES) [ses] [0x8]
	# sg_ses -p cf /dev/sg0
	  3PARdata  SES               3321
	Configuration diagnostic page:
	  number of secondary subenclosures: 0
	  generation code: 0x0
	  enclosure descriptor list
	    Subenclosure identifier: 0 [primary]
	      relative ES process id: 0, number of ES processes: 1
	      number of type descriptor headers: 1
	      enclosure logical identifier (hex): 20000002ac02068d
	      enclosure vendor: 3PARdata  product: VV                rev: 3321
	  type descriptor header and text list
	    Element type: Unspecified, subenclosure id: 0
	      number of possible elements: 1

The changelog for the original fix follows

=====
We can get a crash when disconnecting the iSCSI session,
the call trace like this:

  [ffff00002a00fb70] kfree at ffff00000830e224
  [ffff00002a00fba0] ses_intf_remove at ffff000001f200e4
  [ffff00002a00fbd0] device_del at ffff0000086b6a98
  [ffff00002a00fc50] device_unregister at ffff0000086b6d58
  [ffff00002a00fc70] __scsi_remove_device at ffff00000870608c
  [ffff00002a00fca0] scsi_remove_device at ffff000008706134
  [ffff00002a00fcc0] __scsi_remove_target at ffff0000087062e4
  [ffff00002a00fd10] scsi_remove_target at ffff0000087064c0
  [ffff00002a00fd70] __iscsi_unbind_session at ffff000001c872c4
  [ffff00002a00fdb0] process_one_work at ffff00000810f35c
  [ffff00002a00fe00] worker_thread at ffff00000810f648
  [ffff00002a00fe70] kthread at ffff000008116e98

In ses_intf_add, components count could be 0, and kcalloc 0 size scomp,
but not saved in edev->component[i].scratch

In this situation, edev->component[0].scratch is an invalid pointer,
when kfree it in ses_intf_remove_enclosure, a crash like above would happen
The call trace also could be other random cases when kfree cannot catch
the invalid pointer

We should not use edev->component[] array when the components count is 0
We also need check index when use edev->component[] array in
ses_enclosure_data_process
=====

Reported-by: Michal Kolar <mich.k@seznam.cz>
Originally-by: Ding Hui <dinghui@sangfor.com.cn>
Cc: stable@vger.kernel.org
Fixes: 3fe97ff3d949 ("scsi: ses: Don't attach if enclosure has no components")
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Link: https://lore.kernel.org/r/nycvar.YFH.7.76.2304042122270.29760@cbobk.fhfr.pm
Tested-by: Michal Kolar <mich.k@seznam.cz>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-04-20 12:35:13 +02:00
Zhong Jinghua
6e06a68fbb scsi: iscsi_tcp: Check that sock is valid before iscsi_set_param()
[ Upstream commit 48b19b79cfa37b1e50da3b5a8af529f994c08901 ]

The validity of sock should be checked before assignment to avoid incorrect
values. Commit 57569c37f0 ("scsi: iscsi: iscsi_tcp: Fix null-ptr-deref
while calling getpeername()") introduced this change which may lead to
inconsistent values of tcp_sw_conn->sendpage and conn->datadgst_en.

Fix the issue by moving the position of the assignment.

Fixes: 57569c37f0 ("scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername()")
Signed-off-by: Zhong Jinghua <zhongjinghua@huawei.com>
Link: https://lore.kernel.org/r/20230329071739.2175268-1-zhongjinghua@huaweicloud.com
Reviewed-by: Mike Christie <michael.christie@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-04-13 16:55:31 +02:00
Li Zetao
44374911ac scsi: qla2xxx: Fix memory leak in qla2x00_probe_one()
[ Upstream commit 85ade4010e13ef152ea925c74d94253db92e5428 ]

There is a memory leak reported by kmemleak:

  unreferenced object 0xffffc900003f0000 (size 12288):
    comm "modprobe", pid 19117, jiffies 4299751452 (age 42490.264s)
    hex dump (first 32 bytes):
      00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
      00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    backtrace:
      [<00000000629261a8>] __vmalloc_node_range+0xe56/0x1110
      [<0000000001906886>] __vmalloc_node+0xbd/0x150
      [<000000005bb4dc34>] vmalloc+0x25/0x30
      [<00000000a2dc1194>] qla2x00_create_host+0x7a0/0xe30 [qla2xxx]
      [<0000000062b14b47>] qla2x00_probe_one+0x2eb8/0xd160 [qla2xxx]
      [<00000000641ccc04>] local_pci_probe+0xeb/0x1a0

The root cause is traced to an error-handling path in qla2x00_probe_one()
when the adapter "base_vha" initialize failed. The fab_scan_rp "scan.l" is
used to record the port information and it is allocated in
qla2x00_create_host(). However, it is not released in the error handling
path "probe_failed".

Fix this by freeing the memory of "scan.l" when an error occurs in the
adapter initialization process.

Fixes: a4239945b8 ("scsi: qla2xxx: Add switch command to simplify fabric discovery")
Signed-off-by: Li Zetao <lizetao1@huawei.com>
Link: https://lore.kernel.org/r/20230325110004.363898-1-lizetao1@huawei.com
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-04-13 16:55:31 +02:00
Greg Kroah-Hartman
a0f3313ef9 This is the 6.1.23 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmQumsIACgkQONu9yGCS
 aT4yfBAAwaDPXomEa+DY6pkQEE7WPVtIkeO+sQIo7bWHunTDilTLRFeDUJ4THydT
 CnhhlGsBUt8KGeWgSR6hHeTl/c+b+AcBan5k5BBufUGrsDn/XV8QIEyKWhbLIEja
 qWehpogs7BJLg2dFRqTfHQEOhLht1jCmC99tfEozEG4zRudmdS3Z2DbRypfEHshc
 oGOC1Jzg4MLPfB+lCwKNrVMBlR2n/73P7mTUCu/Dc9+DUbm+GtqvsPuGT2LxVyY7
 kkNgGzvdxQQCqtK5X6zyoU61gepsobf6c6kHjBucn8mhaYURT5ndfV9VqLWkDYE7
 71iH0oY5fg2NgbMtQpbA10MokjijFp46I4QxzG/RVl2ZN2pbCFNm5aNIBCwBbF2k
 lN6hwJc1nbTi696o29o1osm+yju3347HCAWC8s+DAszXiquihiUeJBwuCfa1c+Gy
 GhdATa3nNQ/8D0gWULr/kl7DvlgpSpYrbEQGVG2gH6tdsAZt2iKYUtGLFjvDN+fw
 CoMpq2OZTX5afM7AxTX00f5lGmbXhD+T9a+pS9AXhPqKcGv1tt0Gso8dn7cpWpj5
 LxhIE9dK5F1/tI+wPE+8t80CukqQHfoCQ24YO8mfUKmlInwjGd1Hque+ihKJo7ZW
 W5CXlZJJVvpVk9BxMNaYHKfSE+U6G7hYabEAzJXR3fz9vGfoTII=
 =rz/i
 -----END PGP SIGNATURE-----

Merge 6.1.23 into android14-6.1

Changes in 6.1.23
	thunderbolt: Limit USB3 bandwidth of certain Intel USB4 host routers
	cifs: update ip_addr for ses only for primary chan setup
	cifs: prevent data race in cifs_reconnect_tcon()
	cifs: avoid race conditions with parallel reconnects
	zonefs: Reorganize code
	zonefs: Simplify IO error handling
	zonefs: Reduce struct zonefs_inode_info size
	zonefs: Separate zone information from inode information
	zonefs: Fix error message in zonefs_file_dio_append()
	fsverity: don't drop pagecache at end of FS_IOC_ENABLE_VERITY
	kernel: kcsan: kcsan_test: build without structleak plugin
	kcsan: avoid passing -g for test
	btrfs: rename BTRFS_FS_NO_OVERCOMMIT to BTRFS_FS_ACTIVE_ZONE_TRACKING
	btrfs: zoned: count fresh BG region as zone unusable
	net: ethernet: ti: am65-cpsw/cpts: Fix CPTS release action
	riscv: ftrace: Fixup panic by disabling preemption
	ARM: dts: aspeed: p10bmc: Update battery node name
	drm/msm/dpu: Refactor sc7280_pp location
	drm/msm/dpu: correct sm8250 and sm8350 scaler
	drm/msm/disp/dpu: fix sc7280_pp base offset
	tty: serial: fsl_lpuart: switch to new dmaengine_terminate_* API
	tty: serial: fsl_lpuart: fix race on RX DMA shutdown
	tracing: Add .percent suffix option to histogram values
	tracing: Add .graph suffix option to histogram value
	tracing: Do not let histogram values have some modifiers
	net: mscc: ocelot: fix stats region batching
	arm64: efi: Set NX compat flag in PE/COFF header
	cifs: fix missing unload_nls() in smb2_reconnect()
	xfrm: Zero padding when dumping algos and encap
	ASoC: codecs: tx-macro: Fix for KASAN: slab-out-of-bounds
	ASoC: Intel: avs: max98357a: Explicitly define codec format
	ASoC: Intel: avs: da7219: Explicitly define codec format
	ASoC: Intel: avs: ssm4567: Remove nau8825 bits
	ASoC: Intel: avs: nau8825: Adjust clock control
	zstd: Fix definition of assert()
	ACPI: video: Add backlight=native DMI quirk for Dell Vostro 15 3535
	ASoC: SOF: ipc3: Check for upper size limit for the received message
	ASoC: SOF: ipc4-topology: Fix incorrect sample rate print unit
	ASoC: SOF: Intel: pci-tng: revert invalid bar size setting
	ASoC: SOF: IPC4: update gain ipc msg definition to align with fw
	md: avoid signed overflow in slot_store()
	x86/PVH: obtain VGA console info in Dom0
	drm/amdkfd: Fix BO offset for multi-VMA page migration
	drm/amdkfd: fix a potential double free in pqm_create_queue
	drm/amdkfd: fix potential kgd_mem UAFs
	net: hsr: Don't log netdev_err message on unknown prp dst node
	ALSA: asihpi: check pao in control_message()
	ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set()
	fbdev: tgafb: Fix potential divide by zero
	ACPI: tools: pfrut: Check if the input of level and type is in the right numeric range
	sched_getaffinity: don't assume 'cpumask_size()' is fully initialized
	nvme-pci: add NVME_QUIRK_BOGUS_NID for Lexar NM620
	drm/amdkfd: Fixed kfd_process cleanup on module exit.
	net/mlx5e: Lower maximum allowed MTU in XSK to match XDP prerequisites
	fbdev: nvidia: Fix potential divide by zero
	fbdev: intelfb: Fix potential divide by zero
	fbdev: lxfb: Fix potential divide by zero
	fbdev: au1200fb: Fix potential divide by zero
	tools/power turbostat: Fix /dev/cpu_dma_latency warnings
	tools/power turbostat: fix decoding of HWP_STATUS
	tracing: Fix wrong return in kprobe_event_gen_test.c
	btrfs: fix uninitialized variable warning in btrfs_update_block_group
	btrfs: use temporary variable for space_info in btrfs_update_block_group
	mtd: rawnand: meson: initialize struct with zeroes
	mtd: nand: mxic-ecc: Fix mxic_ecc_data_xfer_wait_for_completion() when irq is used
	ca8210: Fix unsigned mac_len comparison with zero in ca8210_skb_tx()
	riscv/kvm: Fix VM hang in case of timer delta being zero.
	mips: bmips: BCM6358: disable RAC flush for TP1
	ALSA: usb-audio: Fix recursive locking at XRUN during syncing
	PCI: dwc: Fix PORT_LINK_CONTROL update when CDM check enabled
	platform/x86: think-lmi: add missing type attribute
	platform/x86: think-lmi: use correct possible_values delimiters
	platform/x86: think-lmi: only display possible_values if available
	platform/x86: think-lmi: Add possible_values for ThinkStation
	platform/surface: aggregator: Add missing fwnode_handle_put()
	mtd: rawnand: meson: invalidate cache on polling ECC bit
	SUNRPC: fix shutdown of NFS TCP client socket
	sfc: ef10: don't overwrite offload features at NIC reset
	scsi: megaraid_sas: Fix crash after a double completion
	scsi: mpt3sas: Don't print sense pool info twice
	net: dsa: realtek: fix out-of-bounds access
	ptp_qoriq: fix memory leak in probe()
	net: dsa: microchip: ksz8: fix ksz8_fdb_dump()
	net: dsa: microchip: ksz8: fix ksz8_fdb_dump() to extract all 1024 entries
	net: dsa: microchip: ksz8: fix offset for the timestamp filed
	net: dsa: microchip: ksz8: ksz8_fdb_dump: avoid extracting ghost entry from empty dynamic MAC table.
	net: dsa: microchip: ksz8863_smi: fix bulk access
	net: dsa: microchip: ksz8: fix MDB configuration with non-zero VID
	r8169: fix RTL8168H and RTL8107E rx crc error
	regulator: Handle deferred clk
	net/net_failover: fix txq exceeding warning
	net: stmmac: don't reject VLANs when IFF_PROMISC is set
	drm/i915/tc: Fix the ICL PHY ownership check in TC-cold state
	platform/x86/intel/pmc: Alder Lake PCH slp_s0_residency fix
	can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write
	s390/vfio-ap: fix memory leak in vfio_ap device driver
	ACPI: bus: Rework system-level device notification handling
	loop: LOOP_CONFIGURE: send uevents for partitions
	net: mvpp2: classifier flow fix fragmentation flags
	net: mvpp2: parser fix QinQ
	net: mvpp2: parser fix PPPoE
	smsc911x: avoid PHY being resumed when interface is not up
	ice: Fix ice_cfg_rdma_fltr() to only update relevant fields
	ice: add profile conflict check for AVF FDIR
	ice: fix invalid check for empty list in ice_sched_assoc_vsi_to_agg()
	ALSA: ymfpci: Create card with device-managed snd_devm_card_new()
	ALSA: ymfpci: Fix BUG_ON in probe function
	net: ipa: compute DMA pool size properly
	i40e: fix registers dump after run ethtool adapter self test
	bnxt_en: Fix reporting of test result in ethtool selftest
	bnxt_en: Fix typo in PCI id to device description string mapping
	bnxt_en: Add missing 200G link speed reporting
	net: dsa: mv88e6xxx: Enable IGMP snooping on user ports only
	net: ethernet: mtk_eth_soc: fix flow block refcounting logic
	net: ethernet: mtk_eth_soc: add missing ppe cache flush when deleting a flow
	pinctrl: ocelot: Fix alt mode for ocelot
	Input: xpad - fix incorrectly applied patch for MAP_PROFILE_BUTTON
	iommu/vt-d: Allow zero SAGAW if second-stage not supported
	Input: i8042 - add TUXEDO devices to i8042 quirk tables for partial fix
	Input: alps - fix compatibility with -funsigned-char
	Input: focaltech - use explicitly signed char type
	cifs: prevent infinite recursion in CIFSGetDFSRefer()
	cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL
	Input: i8042 - add quirk for Fujitsu Lifebook A574/H
	Input: goodix - add Lenovo Yoga Book X90F to nine_bytes_report DMI table
	btrfs: fix deadlock when aborting transaction during relocation with scrub
	btrfs: fix race between quota disable and quota assign ioctls
	btrfs: scan device in non-exclusive mode
	zonefs: Do not propagate iomap_dio_rw() ENOTBLK error to user space
	block/io_uring: pass in issue_flags for uring_cmd task_work handling
	io_uring/poll: clear single/double poll flags on poll arming
	io_uring/rsrc: fix rogue rsrc node grabbing
	io_uring: fix poll/netmsg alloc caches
	vmxnet3: use gro callback when UPT is enabled
	zonefs: Always invalidate last cached page on append write
	dm: fix __send_duplicate_bios() to always allow for splitting IO
	can: j1939: prevent deadlock by moving j1939_sk_errqueue()
	xen/netback: don't do grant copy across page boundary
	net: phy: dp83869: fix default value for tx-/rx-internal-delay
	modpost: Fix processing of CRCs on 32-bit build machines
	pinctrl: amd: Disable and mask interrupts on resume
	pinctrl: at91-pio4: fix domain name assignment
	platform/x86: ideapad-laptop: Stop sending KEY_TOUCHPAD_TOGGLE
	powerpc: Don't try to copy PPR for task with NULL pt_regs
	powerpc/pseries/vas: Ignore VAS update for DLPAR if copy/paste is not enabled
	powerpc/64s: Fix __pte_needs_flush() false positive warning
	NFSv4: Fix hangs when recovering open state after a server reboot
	ALSA: hda/conexant: Partial revert of a quirk for Lenovo
	ALSA: usb-audio: Fix regression on detection of Roland VS-100
	ALSA: hda/realtek: Add quirks for some Clevo laptops
	ALSA: hda/realtek: Add quirk for Lenovo ZhaoYang CF4620Z
	xtensa: fix KASAN report for show_stack
	rcu: Fix rcu_torture_read ftrace event
	dt-bindings: mtd: jedec,spi-nor: Document CPOL/CPHA support
	s390/uaccess: add missing earlyclobber annotations to __clear_user()
	s390: reintroduce expoline dependence to scripts
	drm/etnaviv: fix reference leak when mmaping imported buffer
	drm/amdgpu: allow more APUs to do mode2 reset when go to S4
	drm/amd/display: Add DSC Support for Synaptics Cascaded MST Hub
	drm/amd/display: Take FEC Overhead into Timeslot Calculation
	drm/i915/gem: Flush lmem contents after construction
	drm/i915/dpt: Treat the DPT BO as a framebuffer
	drm/i915: Disable DC states for all commits
	drm/i915: Move CSC load back into .color_commit_arm() when PSR is enabled on skl/glk
	KVM: arm64: PMU: Fix GET_ONE_REG for vPMC regs to return the current value
	KVM: arm64: Disable interrupts while walking userspace PTs
	net: dsa: mv88e6xxx: read FID when handling ATU violations
	net: dsa: mv88e6xxx: replace ATU violation prints with trace points
	net: dsa: mv88e6xxx: replace VTU violation prints with trace points
	selftests/bpf: Test btf dump for struct with padding only fields
	libbpf: Fix BTF-to-C converter's padding logic
	selftests/bpf: Add few corner cases to test padding handling of btf_dump
	libbpf: Fix btf_dump's packed struct determination
	usb: ucsi: Fix ucsi->connector race
	drm/amdkfd: Get prange->offset after svm_range_vram_node_new
	hsr: ratelimit only when errors are printed
	x86/PVH: avoid 32-bit build warning when obtaining VGA console info
	Revert "cpuidle, intel_idle: Fix CPUIDLE_FLAG_IRQ_ENABLE *again*"
	Linux 6.1.23

Change-Id: I15af3697170567c4678bcc9c2380d80e7cef5bc9
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-04-06 14:14:07 +00:00
Jerry Snitselaar
089e6318e1 scsi: mpt3sas: Don't print sense pool info twice
[ Upstream commit d684a7a26f7d2c7122a4581ac966ed64e88fb29c ]

_base_allocate_sense_dma_pool() already prints out the sense pool
information, so don't print it a second time after calling it in
_base_allocate_memory_pools(). In addition the version in
_base_allocate_memory_pools() was using the wrong size value, sz, which was
last assigned when doing some nvme calculations instead of sense_sz to
determine the pool size in kilobytes.

Cc: Sathya Prakash <sathya.prakash@broadcom.com>
Cc: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
Cc: Suganath Prabu Subramani <suganath-prabu.subramani@broadcom.com>
Cc: MPT-FusionLinux.pdl@broadcom.com
Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
Cc: "James E.J. Bottomley" <jejb@linux.ibm.com>
Fixes: 970ac2bb70 ("scsi: mpt3sas: Force sense buffer allocations to be within same 4 GB region")
Signed-off-by: Jerry Snitselaar <jsnitsel@redhat.com>
Link: https://lore.kernel.org/r/20230324193204.567932-1-jsnitsel@redhat.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-04-06 12:10:44 +02:00
Tomas Henzl
9526222c1a scsi: megaraid_sas: Fix crash after a double completion
[ Upstream commit 2309df27111a51734cb9240b4d3c25f2f3c6ab06 ]

When a physical disk is attached directly "without JBOD MAP support" (see
megasas_get_tm_devhandle()) then there is no real error handling in the
driver.  Return FAILED instead of SUCCESS.

Fixes: 18365b1385 ("megaraid_sas: Task management support")
Signed-off-by: Tomas Henzl <thenzl@redhat.com>
Link: https://lore.kernel.org/r/20230324150134.14696-1-thenzl@redhat.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-04-06 12:10:44 +02:00
Greg Kroah-Hartman
db50ac4d0a Merge 6.1.22 into android14-6.1
Changes in 6.1.22
	interconnect: qcom: osm-l3: fix icc_onecell_data allocation
	interconnect: qcom: sm8450: switch to qcom_icc_rpmh_* function
	interconnect: qcom: qcm2290: Fix MASTER_SNOC_BIMC_NRT
	perf/core: Fix perf_output_begin parameter is incorrectly invoked in perf_event_bpf_output
	perf: fix perf_event_context->time
	tracing/hwlat: Replace sched_setaffinity with set_cpus_allowed_ptr
	drm/amd/display: Include virtual signal to set k1 and k2 values
	drm/amd/display: fix k1 k2 divider programming for phantom streams
	drm/amd/display: Remove OTG DIV register write for Virtual signals.
	mptcp: refactor passive socket initialization
	mptcp: use the workqueue to destroy unaccepted sockets
	mptcp: fix UaF in listener shutdown
	drm/amd/display: Fix DP MST sinks removal issue
	arm64: dts: qcom: sm8450: Mark UFS controller as cache coherent
	power: supply: bq24190: Fix use after free bug in bq24190_remove due to race condition
	power: supply: da9150: Fix use after free bug in da9150_charger_remove due to race condition
	arm64: dts: imx8dxl-evk: Disable hibernation mode of AR8031 for EQOS
	arm64: dts: imx8dxl-evk: Fix eqos phy reset gpio
	ARM: dts: imx6sll: e70k02: fix usbotg1 pinctrl
	ARM: dts: imx6sll: e60k02: fix usbotg1 pinctrl
	ARM: dts: imx6sl: tolino-shine2hd: fix usbotg1 pinctrl
	arm64: dts: imx8mn: specify #sound-dai-cells for SAI nodes
	arm64: dts: imx93: add missing #address-cells and #size-cells to i2c nodes
	NFS: Fix /proc/PID/io read_bytes for buffered reads
	xsk: Add missing overflow check in xdp_umem_reg
	iavf: fix inverted Rx hash condition leading to disabled hash
	iavf: fix non-tunneled IPv6 UDP packet type and hashing
	iavf: do not track VLAN 0 filters
	intel/igbvf: free irq on the error path in igbvf_request_msix()
	igbvf: Regard vf reset nack as success
	igc: fix the validation logic for taprio's gate list
	i2c: imx-lpi2c: check only for enabled interrupt flags
	i2c: mxs: ensure that DMA buffers are safe for DMA
	i2c: hisi: Only use the completion interrupt to finish the transfer
	scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate()
	nfsd: don't replace page in rq_pages if it's a continuation of last page
	net: dsa: b53: mmap: fix device tree support
	net: usb: smsc95xx: Limit packet length to skb->len
	efi/libstub: smbios: Use length member instead of record struct size
	qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info
	xirc2ps_cs: Fix use after free bug in xirc2ps_detach
	net: phy: Ensure state transitions are processed from phy_stop()
	net: mdio: fix owner field for mdio buses registered using device-tree
	net: mdio: fix owner field for mdio buses registered using ACPI
	net: stmmac: Fix for mismatched host/device DMA address width
	thermal/drivers/mellanox: Use generic thermal_zone_get_trip() function
	mlxsw: core_thermal: Fix fan speed in maximum cooling state
	drm/i915: Print return value on error
	drm/i915/fbdev: lock the fbdev obj before vma pin
	drm/i915/guc: Rename GuC register state capture node to be more obvious
	drm/i915/guc: Fix missing ecodes
	drm/i915/gt: perform uc late init after probe error injection
	net: qcom/emac: Fix use after free bug in emac_remove due to race condition
	net: usb: lan78xx: Limit packet length to skb->len
	net/ps3_gelic_net: Fix RX sk_buff length
	net/ps3_gelic_net: Use dma_mapping_error
	octeontx2-vf: Add missing free for alloc_percpu
	bootconfig: Fix testcase to increase max node
	keys: Do not cache key in task struct if key is requested from kernel thread
	ice: check if VF exists before mode check
	iavf: fix hang on reboot with ice
	i40e: fix flow director packet filter programming
	bpf: Adjust insufficient default bpf_jit_limit
	net/mlx5e: Set uplink rep as NETNS_LOCAL
	net/mlx5e: Block entering switchdev mode with ns inconsistency
	net/mlx5: Fix steering rules cleanup
	net/mlx5e: Overcome slow response for first macsec ASO WQE
	net/mlx5: Read the TC mapping of all priorities on ETS query
	net/mlx5: E-Switch, Fix an Oops in error handling code
	net: dsa: tag_brcm: legacy: fix daisy-chained switches
	atm: idt77252: fix kmemleak when rmmod idt77252
	erspan: do not use skb_mac_header() in ndo_start_xmit()
	net/sonic: use dma_mapping_error() for error check
	nvme-tcp: fix nvme_tcp_term_pdu to match spec
	mlxsw: spectrum_fid: Fix incorrect local port type
	hvc/xen: prevent concurrent accesses to the shared ring
	ksmbd: add low bound validation to FSCTL_SET_ZERO_DATA
	ksmbd: add low bound validation to FSCTL_QUERY_ALLOCATED_RANGES
	ksmbd: fix possible refcount leak in smb2_open()
	Bluetooth: hci_sync: Resume adv with no RPA when active scan
	Bluetooth: hci_core: Detect if an ACL packet is in fact an ISO packet
	Bluetooth: btusb: Remove detection of ISO packets over bulk
	Bluetooth: ISO: fix timestamped HCI ISO data packet parsing
	Bluetooth: Remove "Power-on" check from Mesh feature
	gve: Cache link_speed value from device
	net: asix: fix modprobe "sysfs: cannot create duplicate filename"
	net: dsa: mt7530: move enabling disabling core clock to mt7530_pll_setup()
	net: dsa: mt7530: move lowering TRGMII driving to mt7530_setup()
	net: dsa: mt7530: move setting ssc_delta to PHY_INTERFACE_MODE_TRGMII case
	net: mdio: thunder: Add missing fwnode_handle_put()
	drm/amd/display: Set dcn32 caps.seamless_odm
	Bluetooth: btqcomsmd: Fix command timeout after setting BD address
	Bluetooth: L2CAP: Fix responding with wrong PDU type
	Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work
	Bluetooth: mgmt: Fix MGMT add advmon with RSSI command
	Bluetooth: HCI: Fix global-out-of-bounds
	platform/chrome: cros_ec_chardev: fix kernel data leak from ioctl
	entry: Fix noinstr warning in __enter_from_user_mode()
	perf/x86/amd/core: Always clear status for idx
	entry/rcu: Check TIF_RESCHED _after_ delayed RCU wake-up
	hwmon: fix potential sensor registration fail if of_node is missing
	hwmon (it87): Fix voltage scaling for chips with 10.9mV ADCs
	scsi: qla2xxx: Synchronize the IOCB count to be in order
	scsi: qla2xxx: Perform lockless command completion in abort path
	smb3: lower default deferred close timeout to address perf regression
	smb3: fix unusable share after force unmount failure
	uas: Add US_FL_NO_REPORT_OPCODES for JMicron JMS583Gen 2
	thunderbolt: Use scale field when allocating USB3 bandwidth
	thunderbolt: Call tb_check_quirks() after initializing adapters
	thunderbolt: Add quirk to disable CLx
	thunderbolt: Fix memory leak in margining
	thunderbolt: Disable interrupt auto clear for rings
	thunderbolt: Add missing UNSET_INBOUND_SBTX for retimer access
	thunderbolt: Use const qualifier for `ring_interrupt_index`
	thunderbolt: Rename shadowed variables bit to interrupt_bit and auto_clear_bit
	ASoC: amd: yp: Add OMEN by HP Gaming Laptop 16z-n000 to quirks
	ASoC: amd: yc: Add DMI entries to support HP OMEN 16-n0xxx (8A43)
	ACPI: x86: Drop quirk for HP Elitebook
	ACPI: x86: utils: Add Cezanne to the list for forcing StorageD3Enable
	riscv: Bump COMMAND_LINE_SIZE value to 1024
	drm/cirrus: NULL-check pipe->plane.state->fb in cirrus_pipe_update()
	HID: cp2112: Fix driver not registering GPIO IRQ chip as threaded
	ca8210: fix mac_len negative array access
	HID: logitech-hidpp: Add support for Logitech MX Master 3S mouse
	HID: intel-ish-hid: ipc: Fix potential use-after-free in work function
	m68k: mm: Fix systems with memory at end of 32-bit address space
	m68k: Only force 030 bus error if PC not in exception table
	selftests/bpf: check that modifier resolves after pointer
	scsi: target: iscsi: Fix an error message in iscsi_check_key()
	scsi: qla2xxx: Add option to disable FC2 Target support
	scsi: hisi_sas: Check devm_add_action() return value
	scsi: ufs: core: Add soft dependency on governor_simpleondemand
	scsi: lpfc: Check kzalloc() in lpfc_sli4_cgn_params_read()
	scsi: lpfc: Avoid usage of list iterator variable after loop
	scsi: mpi3mr: Driver unload crashes host when enhanced logging is enabled
	scsi: mpi3mr: Wait for diagnostic save during controller init
	scsi: mpi3mr: NVMe command size greater than 8K fails
	scsi: mpi3mr: Bad drive in topology results kernel crash
	scsi: storvsc: Handle BlockSize change in Hyper-V VHD/VHDX file
	platform/x86: int3472: Add GPIOs to Surface Go 3 Board data
	net: usb: cdc_mbim: avoid altsetting toggling for Telit FE990
	net: usb: qmi_wwan: add Telit 0x1080 composition
	drm/amd/display: Update clock table to include highest clock setting
	sh: sanitize the flags on sigreturn
	drm/amdgpu: Fix call trace warning and hang when removing amdgpu device
	drm/amd: Fix initialization mistake for NBIO 7.3.0
	net/sched: act_mirred: better wording on protection against excessive stack growth
	act_mirred: use the backlog for nested calls to mirred ingress
	cifs: lock chan_lock outside match_session
	cifs: append path to open_enter trace event
	cifs: do not poll server interfaces too regularly
	cifs: empty interface list when server doesn't support query interfaces
	cifs: dump pending mids for all channels in DebugData
	cifs: print session id while listing open files
	cifs: fix dentry lookups in directory handle cache
	x86/fpu/xstate: Prevent false-positive warning in __copy_xstate_uabi_buf()
	selftests/x86/amx: Add a ptrace test
	scsi: core: Add BLIST_SKIP_VPD_PAGES for SKhynix H28U74301AMR
	usb: misc: onboard-hub: add support for Microchip USB2517 USB 2.0 hub
	usb: dwc2: drd: fix inconsistent mode if role-switch-default-mode="host"
	usb: dwc2: fix a devres leak in hw_enable upon suspend resume
	usb: gadget: u_audio: don't let userspace block driver unbind
	btrfs: zoned: fix btrfs_can_activate_zone() to support DUP profile
	Bluetooth: Fix race condition in hci_cmd_sync_clear
	efi: sysfb_efi: Fix DMI quirks not working for simpledrm
	mm/slab: Fix undefined init_cache_node_node() for NUMA and !SMP
	fscrypt: destroy keyring after security_sb_delete()
	fsverity: Remove WQ_UNBOUND from fsverity read workqueue
	lockd: set file_lock start and end when decoding nlm4 testargs
	arm64: dts: imx8mm-nitrogen-r2: fix WM8960 clock name
	igb: revert rtnl_lock() that causes deadlock
	dm thin: fix deadlock when swapping to thin device
	usb: typec: tcpm: fix create duplicate source-capabilities file
	usb: typec: tcpm: fix warning when handle discover_identity message
	usb: cdns3: Fix issue with using incorrect PCI device function
	usb: cdnsp: Fixes issue with redundant Status Stage
	usb: cdnsp: changes PCI Device ID to fix conflict with CNDS3 driver
	usb: chipdea: core: fix return -EINVAL if request role is the same with current role
	usb: chipidea: core: fix possible concurrent when switch role
	usb: dwc3: gadget: Add 1ms delay after end transfer command without IOC
	usb: ucsi: Fix NULL pointer deref in ucsi_connector_change()
	usb: ucsi_acpi: Increase the command completion timeout
	mm: kfence: fix using kfence_metadata without initialization in show_object()
	kfence: avoid passing -g for test
	io_uring/net: avoid sending -ECONNABORTED on repeated connection requests
	io_uring/rsrc: fix null-ptr-deref in io_file_bitmap_get()
	Revert "kasan: drop skip_kasan_poison variable in free_pages_prepare"
	test_maple_tree: add more testing for mas_empty_area()
	maple_tree: fix mas_skip_node() end slot detection
	ksmbd: fix wrong signingkey creation when encryption is AES256
	ksmbd: set FILE_NAMED_STREAMS attribute in FS_ATTRIBUTE_INFORMATION
	ksmbd: don't terminate inactive sessions after a few seconds
	ksmbd: return STATUS_NOT_SUPPORTED on unsupported smb2.0 dialect
	ksmbd: return unsupported error on smb1 mount
	wifi: mac80211: fix qos on mesh interfaces
	nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy()
	drm/bridge: lt8912b: return EPROBE_DEFER if bridge is not found
	drm/amd/display: fix wrong index used in dccg32_set_dpstreamclk
	drm/meson: fix missing component unbind on bind errors
	drm/amdgpu/nv: Apply ASPM quirk on Intel ADL + AMD Navi
	drm/i915/active: Fix missing debug object activation
	drm/i915: Preserve crtc_state->inherited during state clearing
	drm/amdgpu: skip ASIC reset for APUs when go to S4
	drm/amdgpu: reposition the gpu reset checking for reuse
	riscv: mm: Fix incorrect ASID argument when flushing TLB
	riscv: Handle zicsr/zifencei issues between clang and binutils
	tee: amdtee: fix race condition in amdtee_open_session
	firmware: arm_scmi: Fix device node validation for mailbox transport
	arm64: dts: qcom: sc7280: Mark PCIe controller as cache coherent
	arm64: dts: qcom: sm8150: Fix the iommu mask used for PCIe controllers
	soc: qcom: llcc: Fix slice configuration values for SC8280XP
	mm/ksm: fix race with VMA iteration and mm_struct teardown
	bus: imx-weim: fix branch condition evaluates to a garbage value
	i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer()
	dm stats: check for and propagate alloc_percpu failure
	dm crypt: add cond_resched() to dmcrypt_write()
	dm crypt: avoid accessing uninitialized tasklet
	sched/fair: sanitize vruntime of entity being placed
	sched/fair: Sanitize vruntime of entity being migrated
	drm/amdkfd: introduce dummy cache info for property asic
	drm/amdkfd: Fix the warning of array-index-out-of-bounds
	drm/amdkfd: add GC 11.0.4 KFD support
	drm/amdkfd: Fix the memory overrun
	Linux 6.1.22

Change-Id: Id13b4655dbfb59c29a0b8953e5e0cda3703f1879
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-03-31 08:15:39 +00:00
Greg Kroah-Hartman
d9e00246e0 Revert "Revert "scsi: core: Add BLIST_NO_VPD_SIZE for some VDASD""
This reverts commit ad8dbd4420.

It was perserving the ABI, but that is not needed anymore at this point
in time.

Change-Id: If9e034122448b199c0c98b689c6e6d0e52d388fd
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-03-30 12:23:03 +01:00
Joel Selvaraj
b03b85ec82 scsi: core: Add BLIST_SKIP_VPD_PAGES for SKhynix H28U74301AMR
commit a204b490595de71016b2360a1886ec8c12d0afac upstream.

Xiaomi Poco F1 (qcom/sdm845-xiaomi-beryllium*.dts) comes with a SKhynix
H28U74301AMR UFS. The sd_read_cpr() operation leads to a 120 second
timeout, making the device bootup very slow:

[  121.457736] sd 0:0:0:1: [sdb] tag#23 timing out command, waited 120s

Setting the BLIST_SKIP_VPD_PAGES allows the device to skip the failing
sd_read_cpr operation and boot normally.

Signed-off-by: Joel Selvaraj <joelselvaraj.oss@gmail.com>
Link: https://lore.kernel.org/r/20230313041402.39330-1-joelselvaraj.oss@gmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-03-30 12:49:21 +02:00
Michael Kelley
4a7d64d385 scsi: storvsc: Handle BlockSize change in Hyper-V VHD/VHDX file
[ Upstream commit 11d9874c4204a785f43d899a1ab12f9dc8d9de3e ]

Hyper-V uses a VHD or VHDX file on the host as the underlying storage for a
virtual disk.  The VHD/VHDX file format is a sparse format where real disk
space on the host is assigned in chunks that the VHD/VHDX file format calls
the BlockSize.  This BlockSize is not to be confused with the 512-byte (or
4096-byte) sector size of the underlying storage device.  The default block
size for a new VHD/VHDX file is 32 Mbytes.  When a guest VM touches any
disk space within a 32 Mbyte chunk of the VHD/VHDX file, Hyper-V allocates
32 Mbytes of real disk space for that section of the VHD/VHDX. Similarly,
if a discard operation is done that covers an entire 32 Mbyte chunk,
Hyper-V will free the real disk space for that portion of the VHD/VHDX.
This BlockSize is surfaced in Linux as the "discard_granularity" in
/sys/block/sd<x>/queue, which makes sense.

Hyper-V also has differencing disks that can overlay a VHD/VHDX file to
capture changes to the VHD/VHDX while preserving the original VHD/VHDX.
One example of this differencing functionality is for VM snapshots.  When a
snapshot is created, a differencing disk is created.  If the snapshot is
rolled back, Hyper-V can just delete the differencing disk, and the VM will
see the original disk contents at the time the snapshot was taken.
Differencing disks are used in other scenarios as well.

The BlockSize for a differencing disk defaults to 2 Mbytes, not 32 Mbytes.
The smaller default is used because changes to differencing disks are
typically scattered all over, and Hyper-V doesn't want to allocate 32
Mbytes of real disk space for a stray write here or there.  The smaller
BlockSize provides more efficient use of real disk space.

When a differencing disk is added to a VHD/VHDX, Hyper-V reports
UNIT_ATTENTION with a sense code indicating "Operating parameters have
changed", because the value of discard_granularity should be changed to 2
Mbytes. When the differencing disk is removed, discard_granularity should
be changed back to 32 Mbytes.  However, current code simply reports a
message from scsi_report_sense() and the value of
/sys/block/sd<x>/queue/discard_granularity is not updated. The message
isn't very actionable by a sysadmin.

Fix this by having the storvsc driver check for the sense code indicating
that the underly VHD/VHDX block size has changed, and do a rescan of the
device to pick up the new discard_granularity.  With this change the entire
transition to/from differencing disks is handled automatically and
transparently, with no confusing messages being output.

Link: https://lore.kernel.org/r/1677516514-86060-1-git-send-email-mikelley@microsoft.com
Signed-off-by: Michael Kelley <mikelley@microsoft.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-30 12:49:19 +02:00
Ranjan Kumar
1f822ae8fb scsi: mpi3mr: Bad drive in topology results kernel crash
[ Upstream commit 8e45183978d64699df639e795235433a60f35047 ]

When the SAS Transport Layer support is enabled and a device exposed to
the OS by the driver fails INQUIRY commands, the driver frees up the memory
allocated for an internal HBA port data structure. However, in some places,
the reference to the freed memory is not cleared. When the firmware sends
the Device Info change event for the same device again, the freed memory is
accessed and that leads to memory corruption and OS crash.

Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com>
Signed-off-by: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
Link: https://lore.kernel.org/r/20230228140835.4075-7-ranjan.kumar@broadcom.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-30 12:49:18 +02:00
Ranjan Kumar
a0b33e1d8d scsi: mpi3mr: NVMe command size greater than 8K fails
[ Upstream commit 4f297e856a7b5da2f2c66a12e739666e23943560 ]

A wrong variable is checked while populating PRP entries in the PRP page
and this results in failure. No PRP entries in the PRP page were
successfully created and any NVMe Encapsulated commands with PRP of size
greater than 8K failed.

Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com>
Signed-off-by: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
Link: https://lore.kernel.org/r/20230228140835.4075-6-ranjan.kumar@broadcom.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-30 12:49:18 +02:00
Ranjan Kumar
92548801f0 scsi: mpi3mr: Wait for diagnostic save during controller init
[ Upstream commit 0a319f1629495d27879b7ebf6eee62b8cf6e4c37 ]

If a controller reset operation is triggered to recover the controller from
a fault state, then wait for the snapdump to be saved in the firmware
region before proceeding to reset the controller.

Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com>
Signed-off-by: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
Link: https://lore.kernel.org/r/20230228140835.4075-4-ranjan.kumar@broadcom.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-30 12:49:18 +02:00
Ranjan Kumar
88f7fb47e0 scsi: mpi3mr: Driver unload crashes host when enhanced logging is enabled
[ Upstream commit 5b06a7169c59ce0c77ef8b9c82aa07c478f82aac ]

Prevent driver from trying to dereference a NULL pointer in a debug print
while removing a device during driver unload.

Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com>
Signed-off-by: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
Link: https://lore.kernel.org/r/20230228140835.4075-3-ranjan.kumar@broadcom.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-30 12:49:18 +02:00
Jakob Koschel
ec3a119c30 scsi: lpfc: Avoid usage of list iterator variable after loop
[ Upstream commit 2850b23e9f9ae3696e472d2883ea1b43aafa884e ]

If the &epd_pool->list is empty when executing
lpfc_get_io_buf_from_expedite_pool() the function would return an invalid
pointer. Even in the case if the list is guaranteed to be populated, the
iterator variable should not be used after the loop to be more robust for
future changes.

Linus proposed to avoid any use of the list iterator variable after the
loop, in the attempt to move the list iterator variable declaration into
the macro to avoid any potential misuse after the loop [1].

Link: https://lore.kernel.org/all/CAHk-=wgRr_D8CB-D9Kg-c=EHreAsk5SqXPwr9Y7k9sA6cWXJ6w@mail.gmail.com/ [1]
Signed-off-by: Jakob Koschel <jkl820.git@gmail.com>
Link: https://lore.kernel.org/r/20230301-scsi-lpfc-avoid-list-iterator-after-loop-v1-1-325578ae7561@gmail.com
Reviewed-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-30 12:49:18 +02:00
Justin Tee
4829a1e117 scsi: lpfc: Check kzalloc() in lpfc_sli4_cgn_params_read()
[ Upstream commit 312320b0e0ec21249a17645683fe5304d796aec1 ]

If kzalloc() fails in lpfc_sli4_cgn_params_read(), then we rely on
lpfc_read_object()'s routine to NULL check pdata.

Currently, an early return error is thrown from lpfc_read_object() to
protect us from NULL ptr dereference, but the errno code is -ENODEV.

Change the errno code to a more appropriate -ENOMEM.

Reported-by: Kang Chen <void0red@gmail.com>
Link: https://lore.kernel.org/all/20230226102338.3362585-1-void0red@gmail.com
Signed-off-by: Justin Tee <justin.tee@broadcom.com>
Link: https://lore.kernel.org/r/20230228044336.5195-1-justintee8345@gmail.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-30 12:49:18 +02:00
Kang Chen
d92460985d scsi: hisi_sas: Check devm_add_action() return value
[ Upstream commit 06d1a90de60208054cca15ef200138cfdbb642a9 ]

In case devm_add_action() fails, check it in the caller of
interrupt_preinit_v3_hw().

Link: https://lore.kernel.org/r/20230227031030.893324-1-void0red@gmail.com
Signed-off-by: Kang Chen <void0red@gmail.com>
Acked-by: Xiang Chen <chenxiang66@hisilicon.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-30 12:49:17 +02:00
Daniel Wagner
b139678fb1 scsi: qla2xxx: Add option to disable FC2 Target support
[ Upstream commit 877b03795fcf29ff2e2351f7e574ecc9b9c51732 ]

Commit 44c57f2058 ("scsi: qla2xxx: Changes to support FCP2 Target") added
support for FC2 Targets. Unfortunately, there are older setups which break
with this new feature enabled.

Allow to disable it via module option.

Link: https://lore.kernel.org/r/20230208152014.109214-1-dwagner@suse.de
Signed-off-by: Daniel Wagner <dwagner@suse.de>
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-30 12:49:17 +02:00
Nilesh Javali
cd0a1804ac scsi: qla2xxx: Perform lockless command completion in abort path
commit 0367076b0817d5c75dfb83001ce7ce5c64d803a9 upstream.

While adding and removing the controller, the following call trace was
observed:

WARNING: CPU: 3 PID: 623596 at kernel/dma/mapping.c:532 dma_free_attrs+0x33/0x50
CPU: 3 PID: 623596 Comm: sh Kdump: loaded Not tainted 5.14.0-96.el9.x86_64 #1
RIP: 0010:dma_free_attrs+0x33/0x50

Call Trace:
   qla2x00_async_sns_sp_done+0x107/0x1b0 [qla2xxx]
   qla2x00_abort_srb+0x8e/0x250 [qla2xxx]
   ? ql_dbg+0x70/0x100 [qla2xxx]
   __qla2x00_abort_all_cmds+0x108/0x190 [qla2xxx]
   qla2x00_abort_all_cmds+0x24/0x70 [qla2xxx]
   qla2x00_abort_isp_cleanup+0x305/0x3e0 [qla2xxx]
   qla2x00_remove_one+0x364/0x400 [qla2xxx]
   pci_device_remove+0x36/0xa0
   __device_release_driver+0x17a/0x230
   device_release_driver+0x24/0x30
   pci_stop_bus_device+0x68/0x90
   pci_stop_and_remove_bus_device_locked+0x16/0x30
   remove_store+0x75/0x90
   kernfs_fop_write_iter+0x11c/0x1b0
   new_sync_write+0x11f/0x1b0
   vfs_write+0x1eb/0x280
   ksys_write+0x5f/0xe0
   do_syscall_64+0x5c/0x80
   ? do_user_addr_fault+0x1d8/0x680
   ? do_syscall_64+0x69/0x80
   ? exc_page_fault+0x62/0x140
   ? asm_exc_page_fault+0x8/0x30
   entry_SYSCALL_64_after_hwframe+0x44/0xae

The command was completed in the abort path during driver unload with a
lock held, causing the warning in abort path. Hence complete the command
without any lock held.

Reported-by: Lin Li <lilin@redhat.com>
Tested-by: Lin Li <lilin@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Link: https://lore.kernel.org/r/20230313043711.13500-2-njavali@marvell.com
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Reviewed-by: John Meneghini <jmeneghi@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-03-30 12:49:13 +02:00
Quinn Tran
6d57b77d73 scsi: qla2xxx: Synchronize the IOCB count to be in order
commit d3affdeb400f3adc925bd996f3839481f5291839 upstream.

A system hang was observed with the following call trace:

BUG: kernel NULL pointer dereference, address: 0000000000000000
PGD 0 P4D 0
Oops: 0000 [#1] PREEMPT SMP NOPTI
CPU: 15 PID: 86747 Comm: nvme Kdump: loaded Not tainted 6.2.0+ #1
Hardware name: Dell Inc. PowerEdge R6515/04F3CJ, BIOS 2.7.3 03/31/2022
RIP: 0010:__wake_up_common+0x55/0x190
Code: 41 f6 01 04 0f 85 b2 00 00 00 48 8b 43 08 4c 8d
      40 e8 48 8d 43 08 48 89 04 24 48 89 c6\
      49 8d 40 18 48 39 c6 0f 84 e9 00 00 00 <49> 8b 40 18 89 6c 24 14 31
      ed 4c 8d 60 e8 41 8b 18 f6 c3 04 75 5d
RSP: 0018:ffffb05a82afbba0 EFLAGS: 00010082
RAX: 0000000000000000 RBX: ffff8f9b83a00018 RCX: 0000000000000000
RDX: 0000000000000001 RSI: ffff8f9b83a00020 RDI: ffff8f9b83a00018
RBP: 0000000000000001 R08: ffffffffffffffe8 R09: ffffb05a82afbbf8
R10: 70735f7472617473 R11: 5f30307832616c71 R12: 0000000000000001
R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000000000
FS:  00007f815cf4c740(0000) GS:ffff8f9eeed80000(0000)
	knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000010633a000 CR4: 0000000000350ee0
Call Trace:
    <TASK>
    __wake_up_common_lock+0x83/0xd0
    qla_nvme_ls_req+0x21b/0x2b0 [qla2xxx]
    __nvme_fc_send_ls_req+0x1b5/0x350 [nvme_fc]
    nvme_fc_xmt_disconnect_assoc+0xca/0x110 [nvme_fc]
    nvme_fc_delete_association+0x1bf/0x220 [nvme_fc]
    ? nvme_remove_namespaces+0x9f/0x140 [nvme_core]
    nvme_do_delete_ctrl+0x5b/0xa0 [nvme_core]
    nvme_sysfs_delete+0x5f/0x70 [nvme_core]
    kernfs_fop_write_iter+0x12b/0x1c0
    vfs_write+0x2a3/0x3b0
    ksys_write+0x5f/0xe0
    do_syscall_64+0x5c/0x90
    ? syscall_exit_work+0x103/0x130
    ? syscall_exit_to_user_mode+0x12/0x30
    ? do_syscall_64+0x69/0x90
    ? exit_to_user_mode_loop+0xd0/0x130
    ? exit_to_user_mode_prepare+0xec/0x100
    ? syscall_exit_to_user_mode+0x12/0x30
    ? do_syscall_64+0x69/0x90
    ? syscall_exit_to_user_mode+0x12/0x30
    ? do_syscall_64+0x69/0x90
    entry_SYSCALL_64_after_hwframe+0x72/0xdc
    RIP: 0033:0x7f815cd3eb97

The IOCB counts are out of order and that would block any commands from
going out and subsequently hang the system. Synchronize the IOCB count to
be in correct order.

Fixes: 5f63a163ed2f ("scsi: qla2xxx: Fix exchange oversubscription for management commands")
Cc: stable@vger.kernel.org
Signed-off-by: Quinn Tran <qutran@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Link: https://lore.kernel.org/r/20230313043711.13500-3-njavali@marvell.com
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Reviewed-by: John Meneghini <jmeneghi@redhat.com>
Tested-by: Lin Li <lilin@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-03-30 12:49:13 +02:00
Yu Kuai
1c55982beb scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate()
[ Upstream commit a13faca032acbf2699293587085293bdfaafc8ae ]

If alua_rtpg_queue() failed from alua_activate(), then 'qdata' is not
freed, which will cause following memleak:

unreferenced object 0xffff88810b2c6980 (size 32):
  comm "kworker/u16:2", pid 635322, jiffies 4355801099 (age 1216426.076s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    40 39 24 c1 ff ff ff ff 00 f8 ea 0a 81 88 ff ff  @9$.............
  backtrace:
    [<0000000098f3a26d>] alua_activate+0xb0/0x320
    [<000000003b529641>] scsi_dh_activate+0xb2/0x140
    [<000000007b296db3>] activate_path_work+0xc6/0xe0 [dm_multipath]
    [<000000007adc9ace>] process_one_work+0x3c5/0x730
    [<00000000c457a985>] worker_thread+0x93/0x650
    [<00000000cb80e628>] kthread+0x1ba/0x210
    [<00000000a1e61077>] ret_from_fork+0x22/0x30

Fix the problem by freeing 'qdata' in error path.

Fixes: 625fe857e4 ("scsi: scsi_dh_alua: Check scsi_device_get() return value")
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Link: https://lore.kernel.org/r/20230315062154.668812-1-yukuai1@huaweicloud.com
Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-30 12:49:03 +02:00
Greg Kroah-Hartman
ad8dbd4420 Revert "scsi: core: Add BLIST_NO_VPD_SIZE for some VDASD"
This reverts commit d2112b18b5.

It breaks the ABI right now, but will be brought back at the next ABI
break as it will be needed for Android systems.

Bug: 161946584
Change-Id: I26711f5fc537c34fe6e9af2fa6cbb64fd62cb681
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-03-24 16:51:25 +00:00
Greg Kroah-Hartman
d14ac9ddc6 Merge 6.1.21 into android14-6.1
Changes in 6.1.21
	xfrm: Allow transport-mode states with AF_UNSPEC selector
	drm/virtio: Pass correct device to dma_sync_sgtable_for_device()
	drm/msm/gem: Prevent blocking within shrinker loop
	drm/panfrost: Don't sync rpm suspension after mmu flushing
	fbdev: chipsfb: Fix error codes in chipsfb_pci_init()
	cifs: Move the in_send statistic to __smb_send_rqst()
	drm/meson: fix 1px pink line on GXM when scaling video overlay
	clk: HI655X: select REGMAP instead of depending on it
	ASoC: SOF: Intel: MTL: Fix the device description
	ASoC: SOF: Intel: HDA: Fix device description
	ASoC: SOF: Intel: SKL: Fix device description
	ASOC: SOF: Intel: pci-tgl: Fix device description
	ASoC: SOF: ipc4-topology: set dmic dai index from copier
	docs: Correct missing "d_" prefix for dentry_operations member d_weak_revalidate
	scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add()
	scsi: mpi3mr: Fix throttle_groups memory leak
	scsi: mpi3mr: Fix config page DMA memory leak
	scsi: mpi3mr: Fix mpi3mr_hba_port memory leak in mpi3mr_remove()
	scsi: mpi3mr: Fix sas_hba.phy memory leak in mpi3mr_remove()
	scsi: mpi3mr: Return proper values for failures in firmware init path
	scsi: mpi3mr: Fix memory leaks in mpi3mr_init_ioc()
	scsi: mpi3mr: ioctl timeout when disabling/enabling interrupt
	scsi: mpi3mr: Fix expander node leak in mpi3mr_remove()
	ALSA: hda: Match only Intel devices with CONTROLLER_IN_GPU()
	netfilter: nft_nat: correct length for loading protocol registers
	netfilter: nft_masq: correct length for loading protocol registers
	netfilter: nft_redir: correct length for loading protocol registers
	netfilter: nft_redir: correct value of inet type `.maxattrs`
	scsi: core: Add BLIST_NO_VPD_SIZE for some VDASD
	scsi: core: Fix a procfs host directory removal regression
	ftrace,kcfi: Define ftrace_stub_graph conditionally
	tcp: tcp_make_synack() can be called from process context
	vdpa/mlx5: should not activate virtq object when suspended
	wifi: nl80211: fix NULL-ptr deref in offchan check
	wifi: cfg80211: fix MLO connection ownership
	selftests: fix LLVM build for i386 and x86_64
	nfc: pn533: initialize struct pn533_out_arg properly
	ipvlan: Make skb->skb_iif track skb->dev for l3s mode
	i40e: Fix kernel crash during reboot when adapter is in recovery mode
	vhost-vdpa: free iommu domain after last use during cleanup
	vdpa_sim: not reset state in vdpasim_queue_ready
	vdpa_sim: set last_used_idx as last_avail_idx in vdpasim_queue_ready
	PCI: s390: Fix use-after-free of PCI resources with per-function hotplug
	drm/i915/psr: Use calculated io and fast wake lines
	drm/i915/sseu: fix max_subslices array-index-out-of-bounds access
	net/smc: fix NULL sndbuf_desc in smc_cdc_tx_handler()
	qed/qed_dev: guard against a possible division by zero
	net: dsa: mt7530: remove now incorrect comment regarding port 5
	net: dsa: mt7530: set PLL frequency and trgmii only when trgmii is used
	block: do not reverse request order when flushing plug list
	loop: Fix use-after-free issues
	net: tunnels: annotate lockless accesses to dev->needed_headroom
	net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails
	tcp: Fix bind() conflict check for dual-stack wildcard address.
	nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition
	mlxsw: spectrum: Fix incorrect parsing depth after reload
	net/smc: fix deadlock triggered by cancel_delayed_work_syn()
	net: usb: smsc75xx: Limit packet length to skb->len
	drm/bridge: Fix returned array size name for atomic_get_input_bus_fmts kdoc
	powerpc/mm: Fix false detection of read faults
	block: null_blk: Fix handling of fake timeout request
	nvme: fix handling single range discard request
	nvmet: avoid potential UAF in nvmet_req_complete()
	block: sunvdc: add check for mdesc_grab() returning NULL
	net/mlx5e: Fix macsec ASO context alignment
	net/mlx5e: Don't cache tunnel offloads capability
	net/mlx5: Fix setting ec_function bit in MANAGE_PAGES
	net/mlx5: Disable eswitch before waiting for VF pages
	net/mlx5e: Support Geneve and GRE with VF tunnel offload
	net/mlx5: E-switch, Fix wrong usage of source port rewrite in split rules
	net/mlx5: E-switch, Fix missing set of split_count when forward to ovs internal port
	net/mlx5e: Fix cleanup null-ptr deref on encap lock
	net/mlx5: Set BREAK_FW_WAIT flag first when removing driver
	veth: Fix use after free in XDP_REDIRECT
	ice: xsk: disable txq irq before flushing hw
	net: dsa: don't error out when drivers return ETH_DATA_LEN in .port_max_mtu()
	net: dsa: mv88e6xxx: fix max_mtu of 1492 on 6165, 6191, 6220, 6250, 6290
	ravb: avoid PHY being resumed when interface is not up
	sh_eth: avoid PHY being resumed when interface is not up
	ipv4: Fix incorrect table ID in IOCTL path
	net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull
	net: atlantic: Fix crash when XDP is enabled but no program is loaded
	net/iucv: Fix size of interrupt data
	i825xx: sni_82596: use eth_hw_addr_set()
	selftests: net: devlink_port_split.py: skip test if no suitable device available
	qed/qed_mng_tlv: correctly zero out ->min instead of ->hour
	net: dsa: microchip: fix RGMII delay configuration on KSZ8765/KSZ8794/KSZ8795
	ethernet: sun: add check for the mdesc_grab()
	bonding: restore IFF_MASTER/SLAVE flags on bond enslave ether type change
	bonding: restore bond's IFF_SLAVE flag if a non-eth dev enslave fails
	hwmon: (adt7475) Display smoothing attributes in correct order
	hwmon: (adt7475) Fix masking of hysteresis registers
	hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition
	hwmon: (ina3221) return prober error code
	hwmon: (ucd90320) Add minimum delay between bus accesses
	hwmon: tmp512: drop of_match_ptr for ID table
	kconfig: Update config changed flag before calling callback
	hwmon: (adm1266) Set `can_sleep` flag for GPIO chip
	hwmon: (ltc2992) Set `can_sleep` flag for GPIO chip
	media: m5mols: fix off-by-one loop termination error
	mmc: atmel-mci: fix race between stop command and start of next command
	soc: mediatek: mtk-svs: keep svs alive if CONFIG_DEBUG_FS not supported
	jffs2: correct logic when creating a hole in jffs2_write_begin
	rust: arch/um: Disable FP/SIMD instruction to match x86
	ext4: fail ext4_iget if special inode unallocated
	ext4: update s_journal_inum if it changes after journal replay
	ext4: fix task hung in ext4_xattr_delete_inode
	drm/amdkfd: Fix an illegal memory access
	net/9p: fix bug in client create for .L
	LoongArch: Only call get_timer_irq() once in constant_clockevent_init()
	sh: intc: Avoid spurious sizeof-pointer-div warning
	drm/amdgpu: fix ttm_bo calltrace warning in psp_hw_fini
	drm/amd/display: fix shift-out-of-bounds in CalculateVMAndRowBytes
	ext4: fix possible double unlock when moving a directory
	Revert "tty: serial: fsl_lpuart: adjust SERIAL_FSL_LPUART_CONSOLE config dependency"
	tty: serial: fsl_lpuart: skip waiting for transmission complete when UARTCTRL_SBK is asserted
	serial: 8250_em: Fix UART port type
	serial: 8250_fsl: fix handle_irq locking
	serial: 8250: ASPEED_VUART: select REGMAP instead of depending on it
	firmware: xilinx: don't make a sleepable memory allocation from an atomic context
	memory: tegra: fix interconnect registration race
	memory: tegra20-emc: fix interconnect registration race
	memory: tegra124-emc: fix interconnect registration race
	memory: tegra30-emc: fix interconnect registration race
	drm/ttm: Fix a NULL pointer dereference
	s390/ipl: add missing intersection check to ipl_report handling
	interconnect: fix icc_provider_del() error handling
	interconnect: fix provider registration API
	interconnect: imx: fix registration race
	interconnect: fix mem leak when freeing nodes
	interconnect: qcom: osm-l3: fix registration race
	interconnect: qcom: rpm: fix probe child-node error handling
	interconnect: qcom: rpm: fix registration race
	interconnect: qcom: rpmh: fix probe child-node error handling
	interconnect: qcom: rpmh: fix registration race
	interconnect: qcom: msm8974: fix registration race
	interconnect: exynos: fix node leak in probe PM QoS error path
	interconnect: exynos: fix registration race
	md: select BLOCK_LEGACY_AUTOLOAD
	cifs: generate signkey for the channel that's reconnecting
	tracing: Make splice_read available again
	tracing: Check field value in hist_field_name()
	tracing: Make tracepoint lockdep check actually test something
	cifs: Fix smb2_set_path_size()
	KVM: SVM: Fix a benign off-by-one bug in AVIC physical table mask
	KVM: SVM: Modify AVIC GATag to support max number of 512 vCPUs
	KVM: nVMX: add missing consistency checks for CR0 and CR4
	ALSA: hda: intel-dsp-config: add MTL PCI id
	ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book2 Pro
	ALSA: hda/realtek: fix speaker, mute/micmute LEDs not work on a HP platform
	Revert "riscv: mm: notify remote harts about mmu cache updates"
	riscv: asid: Fixup stale TLB entry cause application crash
	drm/shmem-helper: Remove another errant put in error path
	drm/sun4i: fix missing component unbind on bind errors
	drm/i915/active: Fix misuse of non-idle barriers as fence trackers
	drm/i915/dg2: Add HDMI pixel clock frequencies 267.30 and 319.89 MHz
	drm/amdgpu: Don't resume IOMMU after incomplete init
	drm/amd/pm: Fix sienna cichlid incorrect OD volage after resume
	drm/amd/pm: bump SMU 13.0.4 driver_if header version
	drm/amd/display: Do not set DRR on pipe Commit
	drm/amd/display: disconnect MPCC only on OTG change
	mptcp: fix possible deadlock in subflow_error_report
	mptcp: add ro_after_init for tcp{,v6}_prot_override
	mptcp: avoid setting TCP_CLOSE state twice
	mptcp: fix lockdep false positive in mptcp_pm_nl_create_listen_socket()
	ftrace: Fix invalid address access in lookup_rec() when index is 0
	ocfs2: fix data corruption after failed write
	nvme-pci: add NVME_QUIRK_BOGUS_NID for Netac NV3000
	ice: avoid bonding causing auxiliary plug/unplug under RTNL lock
	vp_vdpa: fix the crash in hot unplug with vp_vdpa
	mm/userfaultfd: propagate uffd-wp bit when PTE-mapping the huge zeropage
	mm: teach mincore_hugetlb about pte markers
	powerpc/64: Set default CPU in Kconfig
	powerpc/boot: Don't always pass -mcpu=powerpc when building 32-bit uImage
	mmc: sdhci_am654: lower power-on failed message severity
	fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks
	trace/hwlat: Do not wipe the contents of per-cpu thread data
	trace/hwlat: Do not start per-cpu thread if it is already running
	ACPI: PPTT: Fix to avoid sleep in the atomic context when PPTT is absent
	net: phy: nxp-c45-tja11xx: fix MII_BASIC_CONFIG_REV bit
	fbdev: Fix incorrect page mapping clearance at fb_deferred_io_release()
	cpuidle: psci: Iterate backwards over list in psci_pd_remove()
	ASoC: Intel: soc-acpi: fix copy-paste issue in topology names
	ASoC: qcom: q6prm: fix incorrect clk_root passed to ADSP
	x86/mce: Make sure logged MCEs are processed after sysfs update
	x86/mm: Fix use of uninitialized buffer in sme_enable()
	x86/resctrl: Clear staged_config[] before and after it is used
	powerpc: Pass correct CPU reference to assembler
	virt/coco/sev-guest: Check SEV_SNP attribute at probe time
	virt/coco/sev-guest: Simplify extended guest request handling
	virt/coco/sev-guest: Remove the disable_vmpck label in handle_guest_request()
	virt/coco/sev-guest: Carve out the request issuing logic into a helper
	virt/coco/sev-guest: Do some code style cleanups
	virt/coco/sev-guest: Convert the sw_exit_info_2 checking to a switch-case
	virt/coco/sev-guest: Add throttling awareness
	io_uring/msg_ring: let target know allocated index
	perf: Fix check before add_event_to_groups() in perf_group_detach()
	powerpc: Disable CPU unknown by CLANG when CC_IS_CLANG
	powerpc/64: Replace -mcpu=e500mc64 by -mcpu=e5500
	Linux 6.1.21

Change-Id: I4b7f6e01381c0c121c9e89e51071ea60f1f7e29a
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-03-24 08:47:17 +00:00
Greg Kroah-Hartman
a22c3a8790 Merge 6.1.20 into android14-6.1
Changes in 6.1.20
	fs: prevent out-of-bounds array speculation when closing a file descriptor
	btrfs: fix unnecessary increment of read error stat on write error
	btrfs: fix percent calculation for bg reclaim message
	io_uring/uring_cmd: ensure that device supports IOPOLL
	erofs: fix wrong kunmap when using LZMA on HIGHMEM platforms
	perf inject: Fix --buildid-all not to eat up MMAP2
	fork: allow CLONE_NEWTIME in clone3 flags
	RISC-V: Stop emitting attributes
	x86/CPU/AMD: Disable XSAVES on AMD family 0x17
	drm/amdgpu: fix error checking in amdgpu_read_mm_registers for soc15
	drm/amdgpu: fix error checking in amdgpu_read_mm_registers for soc21
	drm/amdgpu: fix error checking in amdgpu_read_mm_registers for nv
	drm/display: Don't block HDR_OUTPUT_METADATA on unknown EOTF
	drm/connector: print max_requested_bpc in state debugfs
	staging: rtl8723bs: Fix key-store index handling
	staging: rtl8723bs: Pass correct parameters to cfg80211_get_bss()
	ext4: fix cgroup writeback accounting with fs-layer encryption
	ext4: fix RENAME_WHITEOUT handling for inline directories
	ext4: fix another off-by-one fsmap error on 1k block filesystems
	ext4: move where set the MAY_INLINE_DATA flag is set
	ext4: fix WARNING in ext4_update_inline_data
	ext4: zero i_disksize when initializing the bootloader inode
	HID: core: Provide new max_buffer_size attribute to over-ride the default
	HID: uhid: Over-ride the default maximum data buffer value with our own
	nfc: change order inside nfc_se_io error path
	KVM: VMX: Reset eVMCS controls in VP assist page during hardware disabling
	KVM: VMX: Don't bother disabling eVMCS static key on module exit
	KVM: x86: Move guts of kvm_arch_init() to standalone helper
	KVM: VMX: Do _all_ initialization before exposing /dev/kvm to userspace
	fs: dlm: fix log of lowcomms vs midcomms
	fs: dlm: add midcomms init/start functions
	fs: dlm: start midcomms before scand
	fs: dlm: remove send repeat remove handling
	fs: dlm: use packet in dlm_mhandle
	fd: dlm: trace send/recv of dlm message and rcom
	fs: dlm: fix use after free in midcomms commit
	fs: dlm: use WARN_ON_ONCE() instead of WARN_ON()
	fs: dlm: be sure to call dlm_send_queue_flush()
	fs: dlm: fix race setting stop tx flag
	udf: Fix off-by-one error when discarding preallocation
	bus: mhi: ep: Power up/down MHI stack during MHI RESET
	bus: mhi: ep: Change state_lock to mutex
	Input: exc3000 - properly stop timer on shutdown
	ipmi:ssif: Remove rtc_us_timer
	ipmi:ssif: Increase the message retry time
	ipmi:ssif: Add a timer between request retries
	spi: intel: Check number of chip selects after reading the descriptor
	drm/i915: Introduce intel_panel_init_alloc()
	drm/i915: Do panel VBT init early if the VBT declares an explicit panel type
	drm/i915: Populate encoder->devdata for DSI on icl+
	block: Revert "block: Do not reread partition table on exclusively open device"
	block: fix scan partition for exclusively open device again
	riscv: Add header include guards to insn.h
	scsi: core: Remove the /proc/scsi/${proc_name} directory earlier
	ext4: Fix possible corruption when moving a directory
	cifs: improve checking of DFS links over STATUS_OBJECT_NAME_INVALID
	drm/nouveau/kms/nv50: fix nv50_wndw_new_ prototype
	drm/msm: Fix potential invalid ptr free
	drm/msm/a5xx: fix setting of the CP_PREEMPT_ENABLE_LOCAL register
	drm/msm/a5xx: fix highest bank bit for a530
	drm/msm/a5xx: fix the emptyness check in the preempt code
	drm/msm/a5xx: fix context faults during ring switch
	bgmac: fix *initial* chip reset to support BCM5358
	nfc: fdp: add null check of devm_kmalloc_array in fdp_nci_i2c_read_device_properties
	powerpc: dts: t1040rdb: fix compatible string for Rev A boards
	tls: rx: fix return value for async crypto
	drm/msm/dpu: disable features unsupported by QCM2290
	ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping()
	net: lan966x: Fix port police support using tc-matchall
	selftests: nft_nat: ensuring the listening side is up before starting the client
	netfilter: nft_last: copy content when cloning expression
	netfilter: nft_quota: copy content when cloning expression
	net: tls: fix possible race condition between do_tls_getsockopt_conf() and do_tls_setsockopt_conf()
	net: use indirect calls helpers for sk_exit_memory_pressure()
	perf stat: Fix counting when initial delay configured
	net: lan78xx: fix accessing the LAN7800's internal phy specific registers from the MAC driver
	net: caif: Fix use-after-free in cfusbl_device_notify()
	ice: copy last block omitted in ice_get_module_eeprom()
	bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser()
	drm/msm/dpu: fix len of sc7180 ctl blocks
	drm/msm/dpu: drop DPU_DIM_LAYER from MIXER_MSM8998_MASK
	drm/msm/dpu: fix clocks settings for msm8998 SSPP blocks
	drm/msm/dpu: clear DSPP reservations in rm release
	net: stmmac: add to set device wake up flag when stmmac init phy
	net: phylib: get rid of unnecessary locking
	bnxt_en: Avoid order-5 memory allocation for TPA data
	netfilter: ctnetlink: revert to dumping mark regardless of event type
	netfilter: tproxy: fix deadlock due to missing BH disable
	m68k: mm: Move initrd phys_to_virt handling after paging_init()
	btrfs: fix extent map logging bit not cleared for split maps after dropping range
	bpf, test_run: fix &xdp_frame misplacement for LIVE_FRAMES
	btf: fix resolving BTF_KIND_VAR after ARRAY, STRUCT, UNION, PTR
	net: phy: smsc: fix link up detection in forced irq mode
	net: ethernet: mtk_eth_soc: fix RX data corruption issue
	net: tls: fix device-offloaded sendpage straddling records
	scsi: megaraid_sas: Update max supported LD IDs to 240
	scsi: sd: Fix wrong zone_write_granularity value during revalidate
	netfilter: conntrack: adopt safer max chain length
	platform: mellanox: select REGMAP instead of depending on it
	platform: x86: MLX_PLATFORM: select REGMAP instead of depending on it
	block: fix wrong mode for blkdev_put() from disk_scan_partitions()
	NFSD: Protect against filesystem freezing
	ice: Fix DSCP PFC TLV creation
	ethernet: ice: avoid gcc-9 integer overflow warning
	net/smc: fix fallback failed while sendmsg with fastopen
	octeontx2-af: Unlock contexts in the queue context cache in case of fault detection
	SUNRPC: Fix a server shutdown leak
	net: dsa: mt7530: permit port 5 to work without port 6 on MT7621 SoC
	af_unix: fix struct pid leaks in OOB support
	erofs: Revert "erofs: fix kvcalloc() misuse with __GFP_NOFAIL"
	riscv: Use READ_ONCE_NOCHECK in imprecise unwinding stack mode
	RISC-V: Don't check text_mutex during stop_machine
	drm/amdgpu: fix return value check in kfd
	ext4: Fix deadlock during directory rename
	drm/amdgpu/soc21: don't expose AV1 if VCN0 is harvested
	drm/amdgpu/soc21: Add video cap query support for VCN_4_0_4
	adreno: Shutdown the GPU properly
	drm/msm/adreno: fix runtime PM imbalance at unbind
	watch_queue: fix IOC_WATCH_QUEUE_SET_SIZE alloc error paths
	tpm/eventlog: Don't abort tpm_read_log on faulty ACPI address
	MIPS: Fix a compilation issue
	powerpc/64: Don't recurse irq replay
	powerpc/iommu: fix memory leak with using debugfs_lookup()
	clk: renesas: rcar-gen3: Disable R-Car H3 ES1.*
	powerpc/bpf/32: Only set a stack frame when necessary
	powerpc/64: Fix task_cpu in early boot when booting non-zero cpuid
	powerpc/64: Move paca allocation to early_setup()
	powerpc/kcsan: Exclude udelay to prevent recursive instrumentation
	alpha: fix R_ALPHA_LITERAL reloc for large modules
	macintosh: windfarm: Use unsigned type for 1-bit bitfields
	PCI: Add SolidRun vendor ID
	scripts: handle BrokenPipeError for python scripts
	media: ov5640: Fix analogue gain control
	media: rc: gpio-ir-recv: add remove function
	drm/amd/display: Allow subvp on vactive pipes that are 2560x1440@60
	drm/amd/display: adjust MALL size available for DCN32 and DCN321
	filelocks: use mount idmapping for setlease permission check
	Revert "bpf, test_run: fix &xdp_frame misplacement for LIVE_FRAMES"
	UML: define RUNTIME_DISCARD_EXIT
	Linux 6.1.20

Change-Id: I2f92629ce02bc07295fea17b16f9bb567916a285
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-03-23 08:23:43 +00:00
Bart Van Assche
7e0ae8667f scsi: core: Fix a procfs host directory removal regression
[ Upstream commit be03df3d4bfe7e8866d4aa43d62e648ffe884f5f ]

scsi_proc_hostdir_rm() decreases a reference counter and hence must only be
called once per host that is removed. This change does not require a
scsi_add_host_with_dma() change since scsi_add_host_with_dma() will return
0 (success) if scsi_proc_host_add() is called.

Fixes: fc663711b944 ("scsi: core: Remove the /proc/scsi/${proc_name} directory earlier")
Cc: John Garry <john.g.garry@oracle.com>
Reported-by: John Garry <john.g.garry@oracle.com>
Link: https://lore.kernel.org/all/ed6b8027-a9d9-1b45-be8e-df4e8c6c4605@oracle.com/
Reported-by: syzbot+645a4616b87a2f10e398@syzkaller.appspotmail.com
Link: https://lore.kernel.org/linux-scsi/000000000000890fab05f65342b6@google.com/
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Link: https://lore.kernel.org/r/20230307214428.3703498-1-bvanassche@acm.org
Tested-by: John Garry <john.g.garry@oracle.com>
Tested-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-22 13:33:43 +01:00
Lee Duncan
d2112b18b5 scsi: core: Add BLIST_NO_VPD_SIZE for some VDASD
[ Upstream commit 4b1a2c2a8e0ddcb89c5f6c5003bd9b53142f69e3 ]

Some storage, such as AIX VDASD (virtual storage) and IBM 2076 (front
end), fail as a result of commit c92a6b5d63 ("scsi: core: Query VPD
size before getting full page").

That commit changed getting SCSI VPD pages so that we now read just
enough of the page to get the actual page size, then read the whole
page in a second read. The problem is that the above mentioned
hardware returns zero for the page size, because of a firmware
error. In such cases, until the firmware is fixed, this new blacklist
flag says to revert to the original method of reading the VPD pages,
i.e. try to read a whole buffer's worth on the first try.

[mkp: reworked somewhat]

Fixes: c92a6b5d63 ("scsi: core: Query VPD size before getting full page")
Reported-by: Martin Wilck <mwilck@suse.com>
Suggested-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Lee Duncan <lduncan@suse.com>
Link: https://lore.kernel.org/r/20220928181350.9948-1-leeman.duncan@gmail.com
Tested-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-22 13:33:43 +01:00
Tomas Henzl
0023972a75 scsi: mpi3mr: Fix expander node leak in mpi3mr_remove()
[ Upstream commit ce756daa36e1ba271bb3334267295e447aa57a5c ]

Add a missing resource clean up in .remove.

Fixes: e22bae3066 ("scsi: mpi3mr: Add expander devices to STL")
Signed-off-by: Tomas Henzl <thenzl@redhat.com>
Link: https://lore.kernel.org/r/20230302234336.25456-7-thenzl@redhat.com
Acked-by: Sathya Prakash Veerichetty <sathya.prakash@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-22 13:33:42 +01:00
Ranjan Kumar
c6260ceea4 scsi: mpi3mr: ioctl timeout when disabling/enabling interrupt
[ Upstream commit 02ca7da2919ada525fb424640205110e24646b50 ]

As part of Task Management handling, the driver will disable and enable the
MSIx index zero which belongs to the Admin reply queue. During this
transition the driver loses some interrupts and this leads to Admin request
and ioctl timeouts.

After enabling the interrupts, poll the Admin reply queue to avoid
timeouts.

Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com>
Signed-off-by: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
Link: https://lore.kernel.org/r/20230228140835.4075-2-ranjan.kumar@broadcom.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Stable-dep-of: ce756daa36e1 ("scsi: mpi3mr: Fix expander node leak in mpi3mr_remove()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-22 13:33:41 +01:00
Tomas Henzl
5aab9342f1 scsi: mpi3mr: Fix memory leaks in mpi3mr_init_ioc()
[ Upstream commit c798304470cab88723d895726d17fcb96472e0e9 ]

Don't allocate memory again when IOC is being reinitialized.

Fixes: fe6db61515 ("scsi: mpi3mr: Handle offline FW activation in graceful manner")
Signed-off-by: Tomas Henzl <thenzl@redhat.com>
Link: https://lore.kernel.org/r/20230302234336.25456-6-thenzl@redhat.com
Acked-by: Sathya Prakash Veerichetty <sathya.prakash@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-22 13:33:41 +01:00
Ranjan Kumar
705097d52a scsi: mpi3mr: Return proper values for failures in firmware init path
[ Upstream commit ba8a9ba41fbde250fd8b0ed1e5dad0dc9318df46 ]

Return proper non-zero return values for all the cases when the controller
initialization and re-initialization fails.

Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com>
Signed-off-by: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
Link: https://lore.kernel.org/r/20230228140835.4075-5-ranjan.kumar@broadcom.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Stable-dep-of: c798304470ca ("scsi: mpi3mr: Fix memory leaks in mpi3mr_init_ioc()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-22 13:33:41 +01:00
Tomas Henzl
480aae2f30 scsi: mpi3mr: Fix sas_hba.phy memory leak in mpi3mr_remove()
[ Upstream commit d4caa1a4255cc44be56bcab3db2c97c632e6cc10 ]

Free mrioc->sas_hba.phy at .remove.

Fixes: 42fc9fee11 ("scsi: mpi3mr: Add helper functions to manage device's port")
Signed-off-by: Tomas Henzl <thenzl@redhat.com>
Link: https://lore.kernel.org/r/20230302234336.25456-5-thenzl@redhat.com
Acked-by: Sathya Prakash Veerichetty <sathya.prakash@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-22 13:33:41 +01:00
Tomas Henzl
f28bdab9e2 scsi: mpi3mr: Fix mpi3mr_hba_port memory leak in mpi3mr_remove()
[ Upstream commit d0f3c3728da8af76dfe435f7f0cfa2b9d9e43ef0 ]

Free mpi3mr_hba_port at .remove.

Fixes: 42fc9fee11 ("scsi: mpi3mr: Add helper functions to manage device's port")
Signed-off-by: Tomas Henzl <thenzl@redhat.com>
Link: https://lore.kernel.org/r/20230302234336.25456-4-thenzl@redhat.com
Acked-by: Sathya Prakash Veerichetty <sathya.prakash@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-22 13:33:41 +01:00
Tomas Henzl
dca06ccf13 scsi: mpi3mr: Fix config page DMA memory leak
[ Upstream commit 7d2b02172b6a2ae6aecd7ef6480b9c4bf3dc59f4 ]

A fix for:

DMA-API: pci 0000:83:00.0: device driver has pending DMA allocations while released from device [count=1]

Fixes: 32d457d5a2 ("scsi: mpi3mr: Add framework to issue config requests")
Signed-off-by: Tomas Henzl <thenzl@redhat.com>
Link: https://lore.kernel.org/r/20230302234336.25456-3-thenzl@redhat.com
Acked-by: Sathya Prakash Veerichetty <sathya.prakash@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-22 13:33:41 +01:00
Tomas Henzl
574cc10eda scsi: mpi3mr: Fix throttle_groups memory leak
[ Upstream commit f305a7b6ca21a665e8d0cf70b5936991a298c93c ]

Add a missing kfree().

Fixes: f10af05732 ("scsi: mpi3mr: Resource Based Metering")
Signed-off-by: Tomas Henzl <thenzl@redhat.com>
Link: https://lore.kernel.org/r/20230302234336.25456-2-thenzl@redhat.com
Acked-by: Sathya Prakash Veerichetty <sathya.prakash@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-22 13:33:41 +01:00
Wenchao Hao
b5e5bbb3fa scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add()
[ Upstream commit d3c57724f1569311e4b81e98fad0931028b9bdcd ]

Port is allocated by sas_port_alloc_num() and rphy is allocated by either
sas_end_device_alloc() or sas_expander_alloc(), all of which may return
NULL. So we need to check the rphy to avoid possible NULL pointer access.

If sas_rphy_add() returned with failure, rphy is set to NULL. We would
access the rphy in the following lines which would also result NULL pointer
access.

Fixes: 78316e9dfc24 ("scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()")
Signed-off-by: Wenchao Hao <haowenchao2@huawei.com>
Link: https://lore.kernel.org/r/20230225100135.2109330-1-haowenchao2@huawei.com
Acked-by: Sathya Prakash Veerichetty <sathya.prakash@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-22 13:33:41 +01:00
Greg Kroah-Hartman
d956976040 Merge 6.1.18 into android14-6.1
Changes in 6.1.18
	net/sched: Retire tcindex classifier
	auxdisplay: hd44780: Fix potential memory leak in hd44780_remove()
	fs/jfs: fix shift exponent db_agl2size negative
	driver: soc: xilinx: fix memory leak in xlnx_add_cb_for_notify_event()
	f2fs: don't rely on F2FS_MAP_* in f2fs_iomap_begin
	f2fs: fix to avoid potential deadlock
	objtool: Fix memory leak in create_static_call_sections()
	soc: mediatek: mtk-pm-domains: Allow mt8186 ADSP default power on
	memory: renesas-rpc-if: Split-off private data from struct rpcif
	memory: renesas-rpc-if: Move resource acquisition to .probe()
	soc: mediatek: mtk-svs: Enable the IRQ later
	pwm: sifive: Always let the first pwm_apply_state succeed
	pwm: stm32-lp: fix the check on arr and cmp registers update
	f2fs: introduce trace_f2fs_replace_atomic_write_block
	f2fs: correct i_size change for atomic writes
	f2fs: clear atomic_write_task in f2fs_abort_atomic_write()
	soc: mediatek: mtk-svs: restore default voltages when svs_init02() fail
	soc: mediatek: mtk-svs: reset svs when svs_resume() fail
	soc: mediatek: mtk-svs: Use pm_runtime_resume_and_get() in svs_init01()
	fs: f2fs: initialize fsdata in pagecache_write()
	f2fs: allow set compression option of files without blocks
	f2fs: fix to abort atomic write only during do_exist()
	um: vector: Fix memory leak in vector_config
	ubi: ensure that VID header offset + VID header size <= alloc, size
	ubifs: Fix build errors as symbol undefined
	ubifs: Fix memory leak in ubifs_sysfs_init()
	ubifs: Rectify space budget for ubifs_symlink() if symlink is encrypted
	ubifs: Rectify space budget for ubifs_xrename()
	ubifs: Fix wrong dirty space budget for dirty inode
	ubifs: do_rename: Fix wrong space budget when target inode's nlink > 1
	ubifs: Reserve one leb for each journal head while doing budget
	ubi: Fix use-after-free when volume resizing failed
	ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume()
	ubifs: Fix memory leak in alloc_wbufs()
	ubi: Fix possible null-ptr-deref in ubi_free_volume()
	ubifs: Re-statistic cleaned znode count if commit failed
	ubifs: dirty_cow_znode: Fix memleak in error handling path
	ubifs: ubifs_writepage: Mark page dirty after writing inode failed
	ubifs: ubifs_releasepage: Remove ubifs_assert(0) to valid this process
	ubi: fastmap: Fix missed fm_anchor PEB in wear-leveling after disabling fastmap
	ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show()
	ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed
	f2fs: fix to avoid potential memory corruption in __update_iostat_latency()
	soc: qcom: stats: Populate all subsystem debugfs files
	ext4: use ext4_fc_tl_mem in fast-commit replay path
	ext4: don't show commit interval if it is zero
	netfilter: nf_tables: allow to fetch set elements when table has an owner
	x86: um: vdso: Add '%rcx' and '%r11' to the syscall clobber list
	um: virtio_uml: free command if adding to virtqueue failed
	um: virtio_uml: mark device as unregistered when breaking it
	um: virtio_uml: move device breaking into workqueue
	um: virt-pci: properly remove PCI device from bus
	f2fs: synchronize atomic write aborts
	watchdog: rzg2l_wdt: Issue a reset before we put the PM clocks
	watchdog: rzg2l_wdt: Handle TYPE-B reset for RZ/V2M
	watchdog: at91sam9_wdt: use devm_request_irq to avoid missing free_irq() in error path
	watchdog: Fix kmemleak in watchdog_cdev_register
	watchdog: pcwd_usb: Fix attempting to access uninitialized memory
	watchdog: sbsa_wdog: Make sure the timeout programming is within the limits
	netfilter: ctnetlink: fix possible refcount leak in ctnetlink_create_conntrack()
	netfilter: conntrack: fix rmmod double-free race
	netfilter: ip6t_rpfilter: Fix regression with VRF interfaces
	netfilter: ebtables: fix table blob use-after-free
	netfilter: xt_length: use skb len to match in length_mt6
	netfilter: ctnetlink: make event listener tracking global
	netfilter: x_tables: fix percpu counter block leak on error path when creating new netns
	ptp: vclock: use mutex to fix "sleep on atomic" bug
	drm/i915: move a Kconfig symbol to unbreak the menu presentation
	ipv6: Add lwtunnel encap size of all siblings in nexthop calculation
	octeontx2-pf: Recalculate UDP checksum for ptp 1-step sync packet
	net: sunhme: Fix region request
	sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop
	octeontx2-pf: Use correct struct reference in test condition
	net: fix __dev_kfree_skb_any() vs drop monitor
	9p/xen: fix version parsing
	9p/xen: fix connection sequence
	9p/rdma: unmap receive dma buffer in rdma_request()/post_recv()
	spi: tegra210-quad: Fix validate combined sequence
	mlx5: fix skb leak while fifo resync and push
	mlx5: fix possible ptp queue fifo use-after-free
	net/mlx5: ECPF, wait for VF pages only after disabling host PFs
	net/mlx5e: Verify flow_source cap before using it
	net/mlx5: Geneve, Fix handling of Geneve object id as error code
	ext4: fix incorrect options show of original mount_opt and extend mount_opt2
	nfc: fix memory leak of se_io context in nfc_genl_se_io
	net/sched: transition act_pedit to rcu and percpu stats
	net/sched: act_pedit: fix action bind logic
	net/sched: act_mpls: fix action bind logic
	net/sched: act_sample: fix action bind logic
	net: dsa: seville: ignore mscc-miim read errors from Lynx PCS
	net: dsa: felix: fix internal MDIO controller resource length
	ARM: dts: spear320-hmi: correct STMPE GPIO compatible
	tcp: tcp_check_req() can be called from process context
	vc_screen: modify vcs_size() handling in vcs_read()
	spi: tegra210-quad: Fix iterator outside loop
	rtc: sun6i: Always export the internal oscillator
	genirq/ipi: Fix NULL pointer deref in irq_data_get_affinity_mask()
	scsi: ipr: Work around fortify-string warning
	scsi: mpi3mr: Fix an issue found by KASAN
	scsi: mpi3mr: Use number of bits to manage bitmap sizes
	rtc: allow rtc_read_alarm without read_alarm callback
	io_uring: fix size calculation when registering buf ring
	loop: loop_set_status_from_info() check before assignment
	ASoC: adau7118: don't disable regulators on device unbind
	ASoC: apple: mca: Fix final status read on SERDES reset
	ASoC: apple: mca: Fix SERDES reset sequence
	ASoC: apple: mca: Improve handling of unavailable DMA channels
	nvme: bring back auto-removal of deleted namespaces during sequential scan
	nvme-tcp: don't access released socket during error recovery
	nvme-fabrics: show well known discovery name
	ASoC: zl38060 add gpiolib dependency
	ASoC: mediatek: mt8195: add missing initialization
	thermal: intel: quark_dts: fix error pointer dereference
	thermal: intel: BXT_PMIC: select REGMAP instead of depending on it
	tracing: Add NULL checks for buffer in ring_buffer_free_read_page()
	kernel/printk/index.c: fix memory leak with using debugfs_lookup()
	firmware/efi sysfb_efi: Add quirk for Lenovo IdeaPad Duet 3
	bootconfig: Increase max nodes of bootconfig from 1024 to 8192 for DCC support
	mfd: arizona: Use pm_runtime_resume_and_get() to prevent refcnt leak
	IB/hfi1: Update RMT size calculation
	iommu/amd: Fix error handling for pdev_pri_ats_enable()
	PCI/ACPI: Account for _S0W of the target bridge in acpi_pci_bridge_d3()
	media: uvcvideo: Remove format descriptions
	media: uvcvideo: Handle cameras with invalid descriptors
	media: uvcvideo: Handle errors from calls to usb_string
	media: uvcvideo: Quirk for autosuspend in Logitech B910 and C910
	media: uvcvideo: Silence memcpy() run-time false positive warnings
	USB: fix memory leak with using debugfs_lookup()
	cacheinfo: Fix shared_cpu_map to handle shared caches at different levels
	staging: emxx_udc: Add checks for dma_alloc_coherent()
	tty: fix out-of-bounds access in tty_driver_lookup_tty()
	tty: serial: fsl_lpuart: disable the CTS when send break signal
	serial: sc16is7xx: setup GPIO controller later in probe
	mei: bus-fixup:upon error print return values of send and receive
	tools/iio/iio_utils:fix memory leak
	bus: mhi: ep: Fix the debug message for MHI_PKT_TYPE_RESET_CHAN_CMD cmd
	iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_status_word()
	iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_config_word()
	media: uvcvideo: Add GUID for BGRA/X 8:8:8:8
	soundwire: bus_type: Avoid lockdep assert in sdw_drv_probe()
	PCI: loongson: Prevent LS7A MRRS increases
	staging: pi433: fix memory leak with using debugfs_lookup()
	USB: dwc3: fix memory leak with using debugfs_lookup()
	USB: chipidea: fix memory leak with using debugfs_lookup()
	USB: ULPI: fix memory leak with using debugfs_lookup()
	USB: uhci: fix memory leak with using debugfs_lookup()
	USB: sl811: fix memory leak with using debugfs_lookup()
	USB: fotg210: fix memory leak with using debugfs_lookup()
	USB: isp116x: fix memory leak with using debugfs_lookup()
	USB: isp1362: fix memory leak with using debugfs_lookup()
	USB: gadget: gr_udc: fix memory leak with using debugfs_lookup()
	USB: gadget: bcm63xx_udc: fix memory leak with using debugfs_lookup()
	USB: gadget: lpc32xx_udc: fix memory leak with using debugfs_lookup()
	USB: gadget: pxa25x_udc: fix memory leak with using debugfs_lookup()
	USB: gadget: pxa27x_udc: fix memory leak with using debugfs_lookup()
	usb: host: xhci: mvebu: Iterate over array indexes instead of using pointer math
	USB: ene_usb6250: Allocate enough memory for full object
	usb: uvc: Enumerate valid values for color matching
	usb: gadget: uvc: Make bSourceID read/write
	PCI: Align extra resources for hotplug bridges properly
	PCI: Take other bus devices into account when distributing resources
	PCI: Distribute available resources for root buses, too
	tty: pcn_uart: fix memory leak with using debugfs_lookup()
	misc: vmw_balloon: fix memory leak with using debugfs_lookup()
	drivers: base: component: fix memory leak with using debugfs_lookup()
	drivers: base: dd: fix memory leak with using debugfs_lookup()
	kernel/fail_function: fix memory leak with using debugfs_lookup()
	PCI: loongson: Add more devices that need MRRS quirk
	PCI: Add ACS quirk for Wangxun NICs
	PCI: pciehp: Add Qualcomm quirk for Command Completed erratum
	phy: rockchip-typec: Fix unsigned comparison with less than zero
	RDMA/cma: Distinguish between sockaddr_in and sockaddr_in6 by size
	iommu: Attach device group to old domain in error path
	soundwire: cadence: Remove wasted space in response_buf
	soundwire: cadence: Drain the RX FIFO after an IO timeout
	net: tls: avoid hanging tasks on the tx_lock
	x86/resctl: fix scheduler confusion with 'current'
	vDPA/ifcvf: decouple hw features manipulators from the adapter
	vDPA/ifcvf: decouple config space ops from the adapter
	vDPA/ifcvf: alloc the mgmt_dev before the adapter
	vDPA/ifcvf: decouple vq IRQ releasers from the adapter
	vDPA/ifcvf: decouple config IRQ releaser from the adapter
	vDPA/ifcvf: decouple vq irq requester from the adapter
	vDPA/ifcvf: decouple config/dev IRQ requester and vectors allocator from the adapter
	vDPA/ifcvf: ifcvf_request_irq works on ifcvf_hw
	vDPA/ifcvf: manage ifcvf_hw in the mgmt_dev
	vDPA/ifcvf: allocate the adapter in dev_add()
	drm/display/dp_mst: Add drm_atomic_get_old_mst_topology_state()
	drm/display/dp_mst: Fix down/up message handling after sink disconnect
	drm/display/dp_mst: Fix down message handling after a packet reception error
	drm/display/dp_mst: Fix payload addition on a disconnected sink
	drm/i915/dp_mst: Add the MST topology state for modesetted CRTCs
	drm/i915: Fix system suspend without fbdev being initialized
	media: uvcvideo: Fix race condition with usb_kill_urb
	io_uring: fix two assignments in if conditions
	io_uring/poll: allow some retries for poll triggering spuriously
	arm64: efi: Make efi_rt_lock a raw_spinlock
	arm64: mte: Fix/clarify the PG_mte_tagged semantics
	arm64: Reset KASAN tag in copy_highpage with HW tags only
	usb: gadget: uvc: fix missing mutex_unlock() if kstrtou8() fails
	Linux 6.1.18

Change-Id: Icb8e56528d481a17780bdd517c69efa9e76b94c0
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-03-21 08:22:15 +00:00
Shin'ichiro Kawasaki
b26b85b184 scsi: sd: Fix wrong zone_write_granularity value during revalidate
[ Upstream commit 288b3271d920c9ba949c3bab0f749f4cecc70e09 ]

When the sd driver revalidates host-managed SMR disks, it calls
disk_set_zoned() which changes the zone_write_granularity attribute value
to the logical block size regardless of the device type. After that, the sd
driver overwrites the value in sd_zbc_read_zone() with the physical block
size, since ZBC/ZAC requires this for host-managed disks. Between the calls
to disk_set_zoned() and sd_zbc_read_zone(), there exists a window where the
attribute shows the logical block size as the zone_write_granularity value,
which is wrong for host-managed disks. The duration of the window is from
20ms to 200ms, depending on report zone command execution time.

To avoid the wrong zone_write_granularity value between disk_set_zoned()
and sd_zbc_read_zone(), modify the value not in sd_zbc_read_zone() but
just after disk_set_zoned() call.

Fixes: a805a4fa4f ("block: introduce zone_write_granularity limit")
Signed-off-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
Link: https://lore.kernel.org/r/20230306063024.3376959-1-shinichiro.kawasaki@wdc.com
Reviewed-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-17 08:50:27 +01:00
Chandrakanth Patil
8f45d2f32c scsi: megaraid_sas: Update max supported LD IDs to 240
[ Upstream commit bfa659177dcba48cf13f2bd88c1972f12a60bf1c ]

The firmware only supports Logical Disk IDs up to 240 and LD ID 255 (0xFF)
is reserved for deleted LDs. However, in some cases, firmware was assigning
LD ID 254 (0xFE) to deleted LDs and this was causing the driver to mark the
wrong disk as deleted. This in turn caused the wrong disk device to be
taken offline by the SCSI midlayer.

To address this issue, limit the LD ID range from 255 to 240. This ensures
the deleted LD ID is properly identified and removed by the driver without
accidently deleting any valid LDs.

Fixes: ae6874ba4b ("scsi: megaraid_sas: Early detection of VD deletion through RaidMap update")
Reported-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Chandrakanth Patil <chandrakanth.patil@broadcom.com>
Signed-off-by: Sumit Saxena <sumit.saxena@broadcom.com>
Link: https://lore.kernel.org/r/20230302105342.34933-2-chandrakanth.patil@broadcom.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-17 08:50:27 +01:00
Bart Van Assche
17e98a5ede scsi: core: Remove the /proc/scsi/${proc_name} directory earlier
[ Upstream commit fc663711b94468f4e1427ebe289c9f05669699c9 ]

Remove the /proc/scsi/${proc_name} directory earlier to fix a race
condition between unloading and reloading kernel modules. This fixes a bug
introduced in 2009 by commit 77c019768f ("[SCSI] fix /proc memory leak in
the SCSI core").

Fix the following kernel warning:

proc_dir_entry 'scsi/scsi_debug' already registered
WARNING: CPU: 19 PID: 27986 at fs/proc/generic.c:376 proc_register+0x27d/0x2e0
Call Trace:
 proc_mkdir+0xb5/0xe0
 scsi_proc_hostdir_add+0xb5/0x170
 scsi_host_alloc+0x683/0x6c0
 sdebug_driver_probe+0x6b/0x2d0 [scsi_debug]
 really_probe+0x159/0x540
 __driver_probe_device+0xdc/0x230
 driver_probe_device+0x4f/0x120
 __device_attach_driver+0xef/0x180
 bus_for_each_drv+0xe5/0x130
 __device_attach+0x127/0x290
 device_initial_probe+0x17/0x20
 bus_probe_device+0x110/0x130
 device_add+0x673/0xc80
 device_register+0x1e/0x30
 sdebug_add_host_helper+0x1a7/0x3b0 [scsi_debug]
 scsi_debug_init+0x64f/0x1000 [scsi_debug]
 do_one_initcall+0xd7/0x470
 do_init_module+0xe7/0x330
 load_module+0x122a/0x12c0
 __do_sys_finit_module+0x124/0x1a0
 __x64_sys_finit_module+0x46/0x50
 do_syscall_64+0x38/0x80
 entry_SYSCALL_64_after_hwframe+0x46/0xb0

Link: https://lore.kernel.org/r/20230210205200.36973-3-bvanassche@acm.org
Cc: Alan Stern <stern@rowland.harvard.edu>
Cc: Yi Zhang <yi.zhang@redhat.com>
Cc: stable@vger.kernel.org
Fixes: 77c019768f ("[SCSI] fix /proc memory leak in the SCSI core")
Reported-by: Yi Zhang <yi.zhang@redhat.com>
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-17 08:50:21 +01:00
Bart Van Assche
815c633905 UPSTREAM: scsi: core: Extend struct scsi_exec_args
Allow SCSI LLDs to specify SCMD_* flags.

Link: https://lore.kernel.org/r/20230210193258.4004923-2-bvanassche@acm.org
Cc: Mike Christie <michael.christie@oracle.com>
Cc: John Garry <john.g.garry@oracle.com>
Reviewed-by: John Garry <john.g.garry@oracle.com>
Change-Id: I28215cedc9e4f5686d5f6ba802830bb12c144b51
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Bug: 267974767
(cherry picked from commit 35cd2f5542df569122d48caf606b972642012c50)
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2023-03-15 16:17:14 +00:00
Mike Christie
59c7d1f081 UPSTREAM: scsi: cxlflash: Convert to scsi_execute_cmd()
scsi_execute() is going to be removed. Convert cxlflash to use
scsi_execute_cmd().

[mkp: roll in fix for issue reported by sfr]

Change-Id: Id365f87ef9acc61930c782e0ed614f9ab9eec46a
Signed-off-by: Mike Christie <michael.christie@oracle.com>
Reviewed-by: John Garry <john.g.garry@oracle.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit 1035c9893f15e801456dddd547ea52ae8f6a1e1f)
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2023-03-15 16:17:14 +00:00
Mike Christie
9eba6a6249 UPSTREAM: scsi: virtio_scsi: Convert to scsi_execute_cmd()
scsi_execute_req() is going to be removed. Convert virtio_scsi to
scsi_execute_cmd().

Change-Id: Icc3a3efedcdc2907628491a51dc2d5ee03b54c98
Signed-off-by: Mike Christie <michael.christie@oracle.com>
Reviewed-by: John Garry <john.g.garry@oracle.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Bug: 267974767
(cherry picked from commit 5314ce761fbf3bef2b5aae5e5562e782a5026e7c)
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2023-03-15 16:17:14 +00:00
Mike Christie
ea6129a8ea UPSTREAM: scsi: sr: Convert to scsi_execute_cmd()
scsi_execute*() is going to be removed. Convert sr to scsi_execute_cmd().

Change-Id: I3049c213efafb6ca549013ca680d647c9939a7c0
Signed-off-by: Mike Christie <michael.christie@oracle.com>
Reviewed-by: John Garry <john.g.garry@oracle.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Bug: 267974767
(cherry picked from commit 49d33b6245d91a2ca20755cd4edf86dd0e49649e)
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2023-03-15 16:17:14 +00:00
Mike Christie
2c2df7e407 UPSTREAM: scsi: ses: Convert to scsi_execute_cmd()
scsi_execute_req() is going to be removed. Convert ses to
scsi_execute_cmd().

Change-Id: I250f75f61f6393f10552b40d90c4fa1453b99e8a
Signed-off-by: Mike Christie <michael.christie@oracle.com>
Reviewed-by: John Garry <john.g.garry@oracle.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Bug: 267974767
(cherry picked from commit ae4145a5f25e56b0248b38f913c5cc370cde723a)
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2023-03-15 16:17:14 +00:00
Mike Christie
ae1dc46256 UPSTREAM: scsi: zbc: Convert to scsi_execute_cmd()
scsi_execute_req() is going to be removed. Conver zbc to
scsi_execute_cmd().

Change-Id: Ie1dbd3aa3e703ee8ac570f5c91c5222bf9bb4355
Signed-off-by: Mike Christie <michael.christie@oracle.com>
Reviewed-by: John Garry <john.g.garry@oracle.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Bug: 267974767
(cherry picked from commit 6ff236e847aa7817a985122ccef7e0f422eb8564)
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2023-03-15 16:17:14 +00:00
Mike Christie
b99bb6eefb UPSTREAM: scsi: sd: Convert to scsi_execute_cmd()
scsi_execute*() is going to be removed. Convert sd_mod to use
scsi_execute_cmd().

Change-Id: Ib5c52dff6d96fb2e0d1355b4c1e0065e1b2bebeb
Signed-off-by: Mike Christie <michael.christie@oracle.com>
Reviewed-by: John Garry <john.g.garry@oracle.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Bug: 267974767
(cherry picked from commit af16cd63d9d3b790ecfce3c053595a98f181e025)
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2023-03-15 16:17:14 +00:00
Mike Christie
7634111c5e UPSTREAM: scsi: spi: Convert to scsi_execute_cmd()
scsi_execute() is going to be removed. Convert to the SPI class to
scsi_execute_cmd().

Change-Id: I4947e5681e82586206187f485d99384719dd67b3
Signed-off-by: Mike Christie <michael.christie@oracle.com>
Reviewed-by: John Garry <john.g.garry@oracle.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Bug: 267974767
(cherry picked from commit c9ee828aad6919b7eee7ef2059489c7221edf68a)
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2023-03-15 16:17:14 +00:00
Mike Christie
2aafdd0d89 UPSTREAM: scsi: core: Convert to scsi_execute_cmd()
scsi_execute_req() is going to be removed. Convert SCSI midlayer to
scsi_execute_cmd().

Change-Id: Ic2449be3b1c8ceae13c7913c717f380902f73150
Signed-off-by: Mike Christie <michael.christie@oracle.com>
Reviewed-by: John Garry <john.g.garry@oracle.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Bug: 267974767
(cherry picked from commit 7dfe0b5e7ca67c659475883712c1d0449f900f9c)
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2023-03-15 16:17:14 +00:00