6985c9f4e3
23543 Commits
Author | SHA1 | Message | Date | |
---|---|---|---|---|
|
55e4f0c551 |
This is the 6.1.25 stable release
-----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmRBFW0ACgkQONu9yGCS aT7Jew//Ytw9+JQ71LT1TuJnQ1GayJOL1BW5hgxoYgnBFasWDwsGA9rzHs6KHqHb 0Vjk7MX7VZB+6zWakOxY5CFVM33J4fS7wY8WE2bj8X3QQhD/J0HQDMdELvSBi3qF 7xI6sghEQEwOuwAj2+CBqm/q7rA5FTnO1QgJuk/AKJ6PHGRiQeZ7q1zGpFvSaj7S cyKvY99RsjnUN+PYk4LE2+u/6DVCqiWYVDQrdjalb9zsrXg4+nmPH6ZJzZX8+bbM eM0xAR675V8TXqDi+8bj7tWmiS52XyjYF3Q/bu9BmU67DqslH9FFyVQxhgTHUZpN qWXkojEU2djIc3qt7T/bpZS/vD8Kg3Px1CgyIRN8Y5SlZfhZyqVdTZ4AQCtJuLQJ wDIdQCLlGzzDNFvbD+LdfJSjZt7Ig1sM/HwtPZhUA9yF0FN1XV3dcESzCOeI0/S7 ohRh8cs1sidnxrbvVwiVNENSqbJD7G9/9vVjIfyfcnt57q+fs6xCBhpOyNoVOp74 I5i6ALMcVZoAB50vDjnoGZsSRe9W2AmOV6UMIkVCvRCWYFqBpgVftMTAACNyljni UlXmO7aDQj+nbHD/auclFtU02oHQbk62FSrwoWMFS090zWztQqUhgRY7Qnl13yCM poEvrKlskXhvunsNtdVmI5O3N2GANWKgGwkyFIiXvgxKkw1qpUo= =zeN9 -----END PGP SIGNATURE----- Merge 6.1.25 into android14-6.1 Changes in 6.1.25 Revert "pinctrl: amd: Disable and mask interrupts on resume" drm/amd/display: Pass the right info to drm_dp_remove_payload ALSA: emu10k1: fix capture interrupt handler unlinking ALSA: hda/sigmatel: add pin overrides for Intel DP45SG motherboard ALSA: i2c/cs8427: fix iec958 mixer control deactivation ALSA: hda: patch_realtek: add quirk for Asus N7601ZM ALSA: hda/realtek: Add quirks for Lenovo Z13/Z16 Gen2 ALSA: firewire-tascam: add missing unwind goto in snd_tscm_stream_start_duplex() ALSA: emu10k1: don't create old pass-through playback device on Audigy ALSA: hda/sigmatel: fix S/PDIF out on Intel D*45* motherboards ALSA: hda/hdmi: disable KAE for Intel DG2 Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} Bluetooth: Fix race condition in hidp_session_thread bluetooth: btbcm: Fix logic error in forming the board name. Bluetooth: Free potentially unfreed SCO connection Bluetooth: hci_conn: Fix possible UAF btrfs: restore the thread_pool= behavior in remount for the end I/O workqueues btrfs: fix fast csum implementation detection fbmem: Reject FB_ACTIVATE_KD_TEXT from userspace mtdblock: tolerate corrected bit-flips mtd: rawnand: meson: fix bitmask for length in command word mtd: rawnand: stm32_fmc2: remove unsupported EDO mode mtd: rawnand: stm32_fmc2: use timings.mode instead of checking tRC_min KVM: arm64: PMU: Restore the guest's EL0 event counting after migration fbcon: Fix error paths in set_con2fb_map fbcon: set_con2fb_map needs to set con2fb_map! drm/i915/dsi: fix DSS CTL register offsets for TGL+ clk: sprd: set max_register according to mapping range RDMA/irdma: Do not generate SW completions for NOPs RDMA/irdma: Fix memory leak of PBLE objects RDMA/irdma: Increase iWARP CM default rexmit count RDMA/irdma: Add ipv4 check to irdma_find_listener() IB/mlx5: Add support for 400G_8X lane speed RDMA/erdma: Update default EQ depth to 4096 and max_send_wr to 8192 RDMA/erdma: Inline mtt entries into WQE if supported RDMA/erdma: Defer probing if netdevice can not be found clk: rs9: Fix suspend/resume RDMA/cma: Allow UD qp_type to join multicast only bpf: tcp: Use sock_gen_put instead of sock_put in bpf_iter_tcp LoongArch, bpf: Fix jit to skip speculation barrier opcode dmaengine: apple-admac: Handle 'global' interrupt flags dmaengine: apple-admac: Set src_addr_widths capability dmaengine: apple-admac: Fix 'current_tx' not getting freed 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition bpf, arm64: Fixed a BTI error on returning to patched function KVM: arm64: Initialise hypervisor copies of host symbols unconditionally KVM: arm64: Advertise ID_AA64PFR0_EL1.CSV2/3 to protected VMs niu: Fix missing unwind goto in niu_alloc_channels() tcp: restrict net.ipv4.tcp_app_win bonding: fix ns validation on backup slaves iavf: refactor VLAN filter states iavf: remove active_cvlans and active_svlans bitmaps net: openvswitch: fix race on port output Bluetooth: hci_conn: Fix not cleaning up on LE Connection failure Bluetooth: Fix printing errors if LE Connection times out Bluetooth: SCO: Fix possible circular locking dependency sco_sock_getsockopt Bluetooth: Set ISO Data Path on broadcast sink drm/armada: Fix a potential double free in an error handling path qlcnic: check pci_reset_function result net: wwan: iosm: Fix error handling path in ipc_pcie_probe() cgroup,freezer: hold cpu_hotplug_lock before freezer_mutex net: qrtr: Fix an uninit variable access bug in qrtr_tx_resume() sctp: fix a potential overflow in sctp_ifwdtsn_skip RDMA/core: Fix GID entry ref leak when create_ah fails selftests: openvswitch: adjust datapath NL message declaration udp6: fix potential access to stale information net: macb: fix a memory corruption in extended buffer descriptor mode skbuff: Fix a race between coalescing and releasing SKBs libbpf: Fix single-line struct definition output in btf_dump ARM: 9290/1: uaccess: Fix KASAN false-positives ARM: dts: qcom: apq8026-lg-lenok: add missing reserved memory power: supply: rk817: Fix unsigned comparison with less than zero power: supply: cros_usbpd: reclassify "default case!" as debug power: supply: axp288_fuel_gauge: Added check for negative values selftests/bpf: Fix progs/find_vma_fail1.c build error. wifi: mwifiex: mark OF related data as maybe unused i2c: imx-lpi2c: clean rx/tx buffers upon new message i2c: hisi: Avoid redundant interrupts efi: sysfb_efi: Add quirk for Lenovo Yoga Book X91F/L block: ublk_drv: mark device as LIVE before adding disk ACPI: video: Add backlight=native DMI quirk for Acer Aspire 3830TG drm: panel-orientation-quirks: Add quirk for Lenovo Yoga Book X90F hwmon: (peci/cputemp) Fix miscalculated DTS for SKX hwmon: (xgene) Fix ioremap and memremap leak verify_pefile: relax wrapper length check asymmetric_keys: log on fatal failures in PE/pkcs7 nvme: send Identify with CNS 06h only to I/O controllers wifi: iwlwifi: mvm: fix mvmtxq->stopped handling wifi: iwlwifi: mvm: protect TXQ list manipulation drm/amdgpu: add mes resume when do gfx post soft reset drm/amdgpu: Force signal hw_fences that are embedded in non-sched jobs drm/amdgpu/gfx: set cg flags to enter/exit safe mode ACPI: resource: Add Medion S17413 to IRQ override quirk x86/hyperv: Move VMCB enlightenment definitions to hyperv-tlfs.h KVM: selftests: Move "struct hv_enlightenments" to x86_64/svm.h KVM: SVM: Add a proper field for Hyper-V VMCB enlightenments x86/hyperv: KVM: Rename "hv_enlightenments" to "hv_vmcb_enlightenments" KVM: SVM: Flush Hyper-V TLB when required tracing: Add trace_array_puts() to write into instance tracing: Have tracing_snapshot_instance_cond() write errors to the appropriate instance maple_tree: fix write memory barrier of nodes once dead for RCU mode ksmbd: avoid out of bounds access in decode_preauth_ctxt() riscv: add icache flush for nommu sigreturn trampoline HID: intel-ish-hid: Fix kernel panic during warm reset net: sfp: initialize sfp->i2c_block_size at sfp allocation net: phy: nxp-c45-tja11xx: add remove callback net: phy: nxp-c45-tja11xx: fix unsigned long multiplication overflow scsi: ses: Handle enclosure with just a primary component gracefully x86/PCI: Add quirk for AMD XHCI controller that loses MSI-X state in D3hot cgroup: fix display of forceidle time at root cgroup/cpuset: Fix partition root's cpuset.cpus update bug cgroup/cpuset: Wake up cpuset_attach_wq tasks in cpuset_cancel_attach() drm/amd/pm: correct SMU13.0.7 pstate profiling clock settings drm/amd/pm: correct SMU13.0.7 max shader clock reporting mptcp: use mptcp_schedule_work instead of open-coding it mptcp: stricter state check in mptcp_worker ubi: Fix failure attaching when vid_hdr offset equals to (sub)page size ubi: Fix deadlock caused by recursively holding work_sem i2c: mchp-pci1xxxx: Update Timing registers powerpc/papr_scm: Update the NUMA distance table for the target node sched/fair: Fix imbalance overflow x86/rtc: Remove __init for runtime functions i2c: ocores: generate stop condition after timeout in polling mode cifs: fix negotiate context parsing nvme-pci: mark Lexar NM760 as IGNORE_DEV_SUBNQN nvme-pci: add NVME_QUIRK_BOGUS_NID for T-FORCE Z330 SSD cgroup/cpuset: Skip spread flags update on v2 cgroup/cpuset: Make cpuset_fork() handle CLONE_INTO_CGROUP properly cgroup/cpuset: Add cpuset_can_fork() and cpuset_cancel_fork() methods Linux 6.1.25 Change-Id: Ib4d2c49ea9bacb8d8dbdb7b3a4eecce937016427 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
|
0fff48d6fe |
Merge 6.1.24 into android14-6.1
Changes in 6.1.24 dm cache: Add some documentation to dm-cache-background-tracker.h dm integrity: Remove bi_sector that's only used by commented debug code dm: change "unsigned" to "unsigned int" dm: fix improper splitting for abnormal bios KVM: arm64: PMU: Align chained counter implementation with architecture pseudocode KVM: arm64: PMU: Distinguish between 64bit counter and 64bit overflow KVM: arm64: PMU: Sanitise PMCR_EL0.LP on first vcpu run KVM: arm64: PMU: Don't save PMCR_EL0.{C,P} for the vCPU gpio: GPIO_REGMAP: select REGMAP instead of depending on it Drivers: vmbus: Check for channel allocation before looking up relids ASoC: SOF: ipc4: Ensure DSP is in D0I0 during sof_ipc4_set_get_data() pwm: Make .get_state() callback return an error code pwm: hibvt: Explicitly set .polarity in .get_state() pwm: cros-ec: Explicitly set .polarity in .get_state() pwm: iqs620a: Explicitly set .polarity in .get_state() pwm: sprd: Explicitly set .polarity in .get_state() pwm: meson: Explicitly set .polarity in .get_state() ASoC: codecs: lpass: fix the order or clks turn off during suspend KVM: s390: pv: fix external interruption loop not always detected wifi: mac80211: fix the size calculation of ieee80211_ie_len_eht_cap() wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta net: qrtr: Fix a refcount bug in qrtr_recvmsg() net: phylink: add phylink_expects_phy() method net: stmmac: check if MAC needs to attach to a PHY net: stmmac: remove redundant fixup to support fixed-link mode l2tp: generate correct module alias strings wifi: brcmfmac: Fix SDIO suspend/resume regression NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL nfsd: call op_release, even when op_func returns an error icmp: guard against too small mtu ALSA: hda/hdmi: Preserve the previous PCM device upon re-enablement net: don't let netpoll invoke NAPI if in xmit context net: dsa: mv88e6xxx: Reset mv88e6393x force WD event bit sctp: check send stream number after wait_for_sndbuf net: qrtr: Do not do DEL_SERVER broadcast after DEL_CLIENT ipv6: Fix an uninit variable access bug in __ip6_make_skb() platform/x86: think-lmi: Fix memory leak when showing current settings platform/x86: think-lmi: Fix memory leaks when parsing ThinkStation WMI strings platform/x86: think-lmi: Clean up display of current_value on Thinkstation gpio: davinci: Do not clear the bank intr enable bit in save_context gpio: davinci: Add irq chip flag to skip set wake net: ethernet: ti: am65-cpsw: Fix mdio cleanup in probe net: stmmac: fix up RX flow hash indirection table when setting channels sunrpc: only free unix grouplist after RCU settles NFSD: callback request does not use correct credential for AUTH_SYS ice: fix wrong fallback logic for FDIR ice: Reset FDIR counter in FDIR init stage raw: use net_hash_mix() in hash function raw: Fix NULL deref in raw_get_next(). ping: Fix potentail NULL deref for /proc/net/icmp. ethtool: reset #lanes when lanes is omitted netlink: annotate lockless accesses to nlk->max_recvmsg_len gve: Secure enough bytes in the first TX desc for all TCP pkts arm64: compat: Work around uninitialized variable warning net: stmmac: check fwnode for phy device before scanning for phy cxl/pci: Fix CDAT retrieval on big endian cxl/pci: Handle truncated CDAT header cxl/pci: Handle truncated CDAT entries cxl/pci: Handle excessive CDAT length PCI/DOE: Silence WARN splat with CONFIG_DEBUG_OBJECTS=y PCI/DOE: Fix memory leak with CONFIG_DEBUG_OBJECTS=y usb: xhci: tegra: fix sleep in atomic call xhci: Free the command allocated for setting LPM if we return early xhci: also avoid the XHCI_ZERO_64B_REGS quirk with a passthrough iommu usb: cdnsp: Fixes error: uninitialized symbol 'len' usb: dwc3: pci: add support for the Intel Meteor Lake-S USB: serial: cp210x: add Silicon Labs IFS-USB-DATACABLE IDs usb: typec: altmodes/displayport: Fix configure initial pin assignment USB: serial: option: add Telit FE990 compositions USB: serial: option: add Quectel RM500U-CN modem drivers: iio: adc: ltc2497: fix LSB shift iio: adis16480: select CONFIG_CRC32 iio: adc: qcom-spmi-adc5: Fix the channel name iio: adc: ti-ads7950: Set `can_sleep` flag for GPIO chip iio: dac: cio-dac: Fix max DAC write value check for 12-bit iio: buffer: correctly return bytes written in output buffers iio: buffer: make sure O_NONBLOCK is respected iio: light: cm32181: Unregister second I2C client if present tty: serial: sh-sci: Fix transmit end interrupt handler tty: serial: sh-sci: Fix Rx on RZ/G2L SCI tty: serial: fsl_lpuart: avoid checking for transfer complete when UARTCTRL_SBK is asserted in lpuart32_tx_empty nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread() nilfs2: fix sysfs interface lifetime dt-bindings: serial: renesas,scif: Fix 4th IRQ for 4-IRQ SCIFs serial: 8250: Prevent starting up DMA Rx on THRI interrupt ksmbd: do not call kvmalloc() with __GFP_NORETRY | __GFP_NO_WARN ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr ALSA: hda/realtek: Add quirk for Clevo X370SNW ALSA: hda/realtek: fix mute/micmute LEDs for a HP ProBook x86/acpi/boot: Correct acpi_is_processor_usable() check x86/ACPI/boot: Use FADT version to check support for online capable KVM: x86: Clear "has_error_code", not "error_code", for RM exception injection KVM: nVMX: Do not report error code when synthesizing VM-Exit from Real Mode mm: kfence: fix PG_slab and memcg_data clearing mm: kfence: fix handling discontiguous page coresight: etm4x: Do not access TRCIDR1 for identification coresight-etm4: Fix for() loop drvdata->nr_addr_cmp range bug counter: 104-quad-8: Fix race condition between FLAG and CNTR reads counter: 104-quad-8: Fix Synapse action reported for Index signals blk-mq: directly poll requests iio: adc: ad7791: fix IRQ flags io_uring: fix return value when removing provided buffers io_uring: fix memory leak when removing provided buffers scsi: qla2xxx: Fix memory leak in qla2x00_probe_one() scsi: iscsi_tcp: Check that sock is valid before iscsi_set_param() nvme: fix discard support without oncs cifs: sanitize paths in cifs_update_super_prepath. block: ublk: make sure that block size is set correctly block: don't set GD_NEED_PART_SCAN if scan partition failed perf/core: Fix the same task check in perf_event_set_output ftrace: Mark get_lock_parent_ip() __always_inline ftrace: Fix issue that 'direct->addr' not restored in modify_ftrace_direct() fs: drop peer group ids under namespace lock can: j1939: j1939_tp_tx_dat_new(): fix out-of-bounds memory access can: isotp: fix race between isotp_sendsmg() and isotp_release() can: isotp: isotp_ops: fix poll() to not report false EPOLLOUT events can: isotp: isotp_recvmsg(): use sock_recv_cmsgs() to get SOCK_RXQ_OVFL infos ACPI: video: Add auto_detect arg to __acpi_video_get_backlight_type() ACPI: video: Make acpi_backlight=video work independent from GPU driver ACPI: video: Add acpi_backlight=video quirk for Apple iMac14,1 and iMac14,2 ACPI: video: Add acpi_backlight=video quirk for Lenovo ThinkPad W530 net: stmmac: Add queue reset into stmmac_xdp_open() function tracing/synthetic: Fix races on freeing last_cmd tracing/timerlat: Notify new max thread latency tracing/osnoise: Fix notify new tracing_max_latency tracing: Free error logs of tracing instances ASoC: hdac_hdmi: use set_stream() instead of set_tdm_slots() tracing/synthetic: Make lastcmd_mutex static zsmalloc: document freeable stats mm: vmalloc: avoid warn_alloc noise caused by fatal signal wifi: mt76: ignore key disable commands ublk: read any SQE values upfront drm/panfrost: Fix the panfrost_mmu_map_fault_addr() error path drm/nouveau/disp: Support more modes by checking with lower bpc drm/i915: Fix context runtime accounting drm/i915: fix race condition UAF in i915_perf_add_config_ioctl ring-buffer: Fix race while reader and writer are on the same page mm/swap: fix swap_info_struct race between swapoff and get_swap_pages() mm/hugetlb: fix uffd wr-protection for CoW optimization path maple_tree: fix get wrong data_end in mtree_lookup_walk() maple_tree: fix a potential concurrency bug in RCU mode blk-throttle: Fix that bps of child could exceed bps limited in parent drm/amd/display: Clear MST topology if it fails to resume drm/amdgpu: for S0ix, skip SDMA 5.x+ suspend/resume drm/amdgpu: skip psp suspend for IMU enabled ASICs mode2 reset drm/display/dp_mst: Handle old/new payload states in drm_dp_remove_payload() drm/i915/dp_mst: Fix payload removal during output disabling drm/bridge: lt9611: Fix PLL being unable to lock drm/i915: Use _MMIO_PIPE() for SKL_BOTTOM_COLOR drm/i915: Split icl_color_commit_noarm() from skl_color_commit_noarm() mm: take a page reference when removing device exclusive entries maple_tree: remove GFP_ZERO from kmem_cache_alloc() and kmem_cache_alloc_bulk() maple_tree: fix potential rcu issue maple_tree: reduce user error potential maple_tree: fix handle of invalidated state in mas_wr_store_setup() maple_tree: fix mas_prev() and mas_find() state handling maple_tree: be more cautious about dead nodes maple_tree: refine ma_state init from mas_start() maple_tree: detect dead nodes in mas_start() maple_tree: fix freeing of nodes in rcu mode maple_tree: remove extra smp_wmb() from mas_dead_leaves() maple_tree: add smp_rmb() to dead node detection maple_tree: add RCU lock checking to rcu callback functions mm: enable maple tree RCU mode by default. bpftool: Print newline before '}' for struct with padding only fields Linux 6.1.24 Change-Id: I475408e1166927565c7788e7095bdf2cb236c4b2 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
|
f8e702c544 |
scsi: ses: Handle enclosure with just a primary component gracefully
commit c8e22b7a1694bb8d025ea636816472739d859145 upstream. This reverts commit 3fe97ff3d949 ("scsi: ses: Don't attach if enclosure has no components") and introduces proper handling of case where there are no detected secondary components, but primary component (enumerated in num_enclosures) does exist. That fix was originally proposed by Ding Hui <dinghui@sangfor.com.cn>. Completely ignoring devices that have one primary enclosure and no secondary one results in ses_intf_add() bailing completely scsi 2:0:0:254: enclosure has no enumerated components scsi 2:0:0:254: Failed to bind enclosure -12ven in valid configurations such even on valid configurations with 1 primary and 0 secondary enclosures as below: # sg_ses /dev/sg0 3PARdata SES 3321 Supported diagnostic pages: Supported Diagnostic Pages [sdp] [0x0] Configuration (SES) [cf] [0x1] Short Enclosure Status (SES) [ses] [0x8] # sg_ses -p cf /dev/sg0 3PARdata SES 3321 Configuration diagnostic page: number of secondary subenclosures: 0 generation code: 0x0 enclosure descriptor list Subenclosure identifier: 0 [primary] relative ES process id: 0, number of ES processes: 1 number of type descriptor headers: 1 enclosure logical identifier (hex): 20000002ac02068d enclosure vendor: 3PARdata product: VV rev: 3321 type descriptor header and text list Element type: Unspecified, subenclosure id: 0 number of possible elements: 1 The changelog for the original fix follows ===== We can get a crash when disconnecting the iSCSI session, the call trace like this: [ffff00002a00fb70] kfree at ffff00000830e224 [ffff00002a00fba0] ses_intf_remove at ffff000001f200e4 [ffff00002a00fbd0] device_del at ffff0000086b6a98 [ffff00002a00fc50] device_unregister at ffff0000086b6d58 [ffff00002a00fc70] __scsi_remove_device at ffff00000870608c [ffff00002a00fca0] scsi_remove_device at ffff000008706134 [ffff00002a00fcc0] __scsi_remove_target at ffff0000087062e4 [ffff00002a00fd10] scsi_remove_target at ffff0000087064c0 [ffff00002a00fd70] __iscsi_unbind_session at ffff000001c872c4 [ffff00002a00fdb0] process_one_work at ffff00000810f35c [ffff00002a00fe00] worker_thread at ffff00000810f648 [ffff00002a00fe70] kthread at ffff000008116e98 In ses_intf_add, components count could be 0, and kcalloc 0 size scomp, but not saved in edev->component[i].scratch In this situation, edev->component[0].scratch is an invalid pointer, when kfree it in ses_intf_remove_enclosure, a crash like above would happen The call trace also could be other random cases when kfree cannot catch the invalid pointer We should not use edev->component[] array when the components count is 0 We also need check index when use edev->component[] array in ses_enclosure_data_process ===== Reported-by: Michal Kolar <mich.k@seznam.cz> Originally-by: Ding Hui <dinghui@sangfor.com.cn> Cc: stable@vger.kernel.org Fixes: 3fe97ff3d949 ("scsi: ses: Don't attach if enclosure has no components") Signed-off-by: Jiri Kosina <jkosina@suse.cz> Link: https://lore.kernel.org/r/nycvar.YFH.7.76.2304042122270.29760@cbobk.fhfr.pm Tested-by: Michal Kolar <mich.k@seznam.cz> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|
6e06a68fbb |
scsi: iscsi_tcp: Check that sock is valid before iscsi_set_param()
[ Upstream commit 48b19b79cfa37b1e50da3b5a8af529f994c08901 ] The validity of sock should be checked before assignment to avoid incorrect values. Commit |
||
|
44374911ac |
scsi: qla2xxx: Fix memory leak in qla2x00_probe_one()
[ Upstream commit 85ade4010e13ef152ea925c74d94253db92e5428 ]
There is a memory leak reported by kmemleak:
unreferenced object 0xffffc900003f0000 (size 12288):
comm "modprobe", pid 19117, jiffies 4299751452 (age 42490.264s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<00000000629261a8>] __vmalloc_node_range+0xe56/0x1110
[<0000000001906886>] __vmalloc_node+0xbd/0x150
[<000000005bb4dc34>] vmalloc+0x25/0x30
[<00000000a2dc1194>] qla2x00_create_host+0x7a0/0xe30 [qla2xxx]
[<0000000062b14b47>] qla2x00_probe_one+0x2eb8/0xd160 [qla2xxx]
[<00000000641ccc04>] local_pci_probe+0xeb/0x1a0
The root cause is traced to an error-handling path in qla2x00_probe_one()
when the adapter "base_vha" initialize failed. The fab_scan_rp "scan.l" is
used to record the port information and it is allocated in
qla2x00_create_host(). However, it is not released in the error handling
path "probe_failed".
Fix this by freeing the memory of "scan.l" when an error occurs in the
adapter initialization process.
Fixes:
|
||
|
a0f3313ef9 |
This is the 6.1.23 stable release
-----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmQumsIACgkQONu9yGCS aT4yfBAAwaDPXomEa+DY6pkQEE7WPVtIkeO+sQIo7bWHunTDilTLRFeDUJ4THydT CnhhlGsBUt8KGeWgSR6hHeTl/c+b+AcBan5k5BBufUGrsDn/XV8QIEyKWhbLIEja qWehpogs7BJLg2dFRqTfHQEOhLht1jCmC99tfEozEG4zRudmdS3Z2DbRypfEHshc oGOC1Jzg4MLPfB+lCwKNrVMBlR2n/73P7mTUCu/Dc9+DUbm+GtqvsPuGT2LxVyY7 kkNgGzvdxQQCqtK5X6zyoU61gepsobf6c6kHjBucn8mhaYURT5ndfV9VqLWkDYE7 71iH0oY5fg2NgbMtQpbA10MokjijFp46I4QxzG/RVl2ZN2pbCFNm5aNIBCwBbF2k lN6hwJc1nbTi696o29o1osm+yju3347HCAWC8s+DAszXiquihiUeJBwuCfa1c+Gy GhdATa3nNQ/8D0gWULr/kl7DvlgpSpYrbEQGVG2gH6tdsAZt2iKYUtGLFjvDN+fw CoMpq2OZTX5afM7AxTX00f5lGmbXhD+T9a+pS9AXhPqKcGv1tt0Gso8dn7cpWpj5 LxhIE9dK5F1/tI+wPE+8t80CukqQHfoCQ24YO8mfUKmlInwjGd1Hque+ihKJo7ZW W5CXlZJJVvpVk9BxMNaYHKfSE+U6G7hYabEAzJXR3fz9vGfoTII= =rz/i -----END PGP SIGNATURE----- Merge 6.1.23 into android14-6.1 Changes in 6.1.23 thunderbolt: Limit USB3 bandwidth of certain Intel USB4 host routers cifs: update ip_addr for ses only for primary chan setup cifs: prevent data race in cifs_reconnect_tcon() cifs: avoid race conditions with parallel reconnects zonefs: Reorganize code zonefs: Simplify IO error handling zonefs: Reduce struct zonefs_inode_info size zonefs: Separate zone information from inode information zonefs: Fix error message in zonefs_file_dio_append() fsverity: don't drop pagecache at end of FS_IOC_ENABLE_VERITY kernel: kcsan: kcsan_test: build without structleak plugin kcsan: avoid passing -g for test btrfs: rename BTRFS_FS_NO_OVERCOMMIT to BTRFS_FS_ACTIVE_ZONE_TRACKING btrfs: zoned: count fresh BG region as zone unusable net: ethernet: ti: am65-cpsw/cpts: Fix CPTS release action riscv: ftrace: Fixup panic by disabling preemption ARM: dts: aspeed: p10bmc: Update battery node name drm/msm/dpu: Refactor sc7280_pp location drm/msm/dpu: correct sm8250 and sm8350 scaler drm/msm/disp/dpu: fix sc7280_pp base offset tty: serial: fsl_lpuart: switch to new dmaengine_terminate_* API tty: serial: fsl_lpuart: fix race on RX DMA shutdown tracing: Add .percent suffix option to histogram values tracing: Add .graph suffix option to histogram value tracing: Do not let histogram values have some modifiers net: mscc: ocelot: fix stats region batching arm64: efi: Set NX compat flag in PE/COFF header cifs: fix missing unload_nls() in smb2_reconnect() xfrm: Zero padding when dumping algos and encap ASoC: codecs: tx-macro: Fix for KASAN: slab-out-of-bounds ASoC: Intel: avs: max98357a: Explicitly define codec format ASoC: Intel: avs: da7219: Explicitly define codec format ASoC: Intel: avs: ssm4567: Remove nau8825 bits ASoC: Intel: avs: nau8825: Adjust clock control zstd: Fix definition of assert() ACPI: video: Add backlight=native DMI quirk for Dell Vostro 15 3535 ASoC: SOF: ipc3: Check for upper size limit for the received message ASoC: SOF: ipc4-topology: Fix incorrect sample rate print unit ASoC: SOF: Intel: pci-tng: revert invalid bar size setting ASoC: SOF: IPC4: update gain ipc msg definition to align with fw md: avoid signed overflow in slot_store() x86/PVH: obtain VGA console info in Dom0 drm/amdkfd: Fix BO offset for multi-VMA page migration drm/amdkfd: fix a potential double free in pqm_create_queue drm/amdkfd: fix potential kgd_mem UAFs net: hsr: Don't log netdev_err message on unknown prp dst node ALSA: asihpi: check pao in control_message() ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set() fbdev: tgafb: Fix potential divide by zero ACPI: tools: pfrut: Check if the input of level and type is in the right numeric range sched_getaffinity: don't assume 'cpumask_size()' is fully initialized nvme-pci: add NVME_QUIRK_BOGUS_NID for Lexar NM620 drm/amdkfd: Fixed kfd_process cleanup on module exit. net/mlx5e: Lower maximum allowed MTU in XSK to match XDP prerequisites fbdev: nvidia: Fix potential divide by zero fbdev: intelfb: Fix potential divide by zero fbdev: lxfb: Fix potential divide by zero fbdev: au1200fb: Fix potential divide by zero tools/power turbostat: Fix /dev/cpu_dma_latency warnings tools/power turbostat: fix decoding of HWP_STATUS tracing: Fix wrong return in kprobe_event_gen_test.c btrfs: fix uninitialized variable warning in btrfs_update_block_group btrfs: use temporary variable for space_info in btrfs_update_block_group mtd: rawnand: meson: initialize struct with zeroes mtd: nand: mxic-ecc: Fix mxic_ecc_data_xfer_wait_for_completion() when irq is used ca8210: Fix unsigned mac_len comparison with zero in ca8210_skb_tx() riscv/kvm: Fix VM hang in case of timer delta being zero. mips: bmips: BCM6358: disable RAC flush for TP1 ALSA: usb-audio: Fix recursive locking at XRUN during syncing PCI: dwc: Fix PORT_LINK_CONTROL update when CDM check enabled platform/x86: think-lmi: add missing type attribute platform/x86: think-lmi: use correct possible_values delimiters platform/x86: think-lmi: only display possible_values if available platform/x86: think-lmi: Add possible_values for ThinkStation platform/surface: aggregator: Add missing fwnode_handle_put() mtd: rawnand: meson: invalidate cache on polling ECC bit SUNRPC: fix shutdown of NFS TCP client socket sfc: ef10: don't overwrite offload features at NIC reset scsi: megaraid_sas: Fix crash after a double completion scsi: mpt3sas: Don't print sense pool info twice net: dsa: realtek: fix out-of-bounds access ptp_qoriq: fix memory leak in probe() net: dsa: microchip: ksz8: fix ksz8_fdb_dump() net: dsa: microchip: ksz8: fix ksz8_fdb_dump() to extract all 1024 entries net: dsa: microchip: ksz8: fix offset for the timestamp filed net: dsa: microchip: ksz8: ksz8_fdb_dump: avoid extracting ghost entry from empty dynamic MAC table. net: dsa: microchip: ksz8863_smi: fix bulk access net: dsa: microchip: ksz8: fix MDB configuration with non-zero VID r8169: fix RTL8168H and RTL8107E rx crc error regulator: Handle deferred clk net/net_failover: fix txq exceeding warning net: stmmac: don't reject VLANs when IFF_PROMISC is set drm/i915/tc: Fix the ICL PHY ownership check in TC-cold state platform/x86/intel/pmc: Alder Lake PCH slp_s0_residency fix can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write s390/vfio-ap: fix memory leak in vfio_ap device driver ACPI: bus: Rework system-level device notification handling loop: LOOP_CONFIGURE: send uevents for partitions net: mvpp2: classifier flow fix fragmentation flags net: mvpp2: parser fix QinQ net: mvpp2: parser fix PPPoE smsc911x: avoid PHY being resumed when interface is not up ice: Fix ice_cfg_rdma_fltr() to only update relevant fields ice: add profile conflict check for AVF FDIR ice: fix invalid check for empty list in ice_sched_assoc_vsi_to_agg() ALSA: ymfpci: Create card with device-managed snd_devm_card_new() ALSA: ymfpci: Fix BUG_ON in probe function net: ipa: compute DMA pool size properly i40e: fix registers dump after run ethtool adapter self test bnxt_en: Fix reporting of test result in ethtool selftest bnxt_en: Fix typo in PCI id to device description string mapping bnxt_en: Add missing 200G link speed reporting net: dsa: mv88e6xxx: Enable IGMP snooping on user ports only net: ethernet: mtk_eth_soc: fix flow block refcounting logic net: ethernet: mtk_eth_soc: add missing ppe cache flush when deleting a flow pinctrl: ocelot: Fix alt mode for ocelot Input: xpad - fix incorrectly applied patch for MAP_PROFILE_BUTTON iommu/vt-d: Allow zero SAGAW if second-stage not supported Input: i8042 - add TUXEDO devices to i8042 quirk tables for partial fix Input: alps - fix compatibility with -funsigned-char Input: focaltech - use explicitly signed char type cifs: prevent infinite recursion in CIFSGetDFSRefer() cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL Input: i8042 - add quirk for Fujitsu Lifebook A574/H Input: goodix - add Lenovo Yoga Book X90F to nine_bytes_report DMI table btrfs: fix deadlock when aborting transaction during relocation with scrub btrfs: fix race between quota disable and quota assign ioctls btrfs: scan device in non-exclusive mode zonefs: Do not propagate iomap_dio_rw() ENOTBLK error to user space block/io_uring: pass in issue_flags for uring_cmd task_work handling io_uring/poll: clear single/double poll flags on poll arming io_uring/rsrc: fix rogue rsrc node grabbing io_uring: fix poll/netmsg alloc caches vmxnet3: use gro callback when UPT is enabled zonefs: Always invalidate last cached page on append write dm: fix __send_duplicate_bios() to always allow for splitting IO can: j1939: prevent deadlock by moving j1939_sk_errqueue() xen/netback: don't do grant copy across page boundary net: phy: dp83869: fix default value for tx-/rx-internal-delay modpost: Fix processing of CRCs on 32-bit build machines pinctrl: amd: Disable and mask interrupts on resume pinctrl: at91-pio4: fix domain name assignment platform/x86: ideapad-laptop: Stop sending KEY_TOUCHPAD_TOGGLE powerpc: Don't try to copy PPR for task with NULL pt_regs powerpc/pseries/vas: Ignore VAS update for DLPAR if copy/paste is not enabled powerpc/64s: Fix __pte_needs_flush() false positive warning NFSv4: Fix hangs when recovering open state after a server reboot ALSA: hda/conexant: Partial revert of a quirk for Lenovo ALSA: usb-audio: Fix regression on detection of Roland VS-100 ALSA: hda/realtek: Add quirks for some Clevo laptops ALSA: hda/realtek: Add quirk for Lenovo ZhaoYang CF4620Z xtensa: fix KASAN report for show_stack rcu: Fix rcu_torture_read ftrace event dt-bindings: mtd: jedec,spi-nor: Document CPOL/CPHA support s390/uaccess: add missing earlyclobber annotations to __clear_user() s390: reintroduce expoline dependence to scripts drm/etnaviv: fix reference leak when mmaping imported buffer drm/amdgpu: allow more APUs to do mode2 reset when go to S4 drm/amd/display: Add DSC Support for Synaptics Cascaded MST Hub drm/amd/display: Take FEC Overhead into Timeslot Calculation drm/i915/gem: Flush lmem contents after construction drm/i915/dpt: Treat the DPT BO as a framebuffer drm/i915: Disable DC states for all commits drm/i915: Move CSC load back into .color_commit_arm() when PSR is enabled on skl/glk KVM: arm64: PMU: Fix GET_ONE_REG for vPMC regs to return the current value KVM: arm64: Disable interrupts while walking userspace PTs net: dsa: mv88e6xxx: read FID when handling ATU violations net: dsa: mv88e6xxx: replace ATU violation prints with trace points net: dsa: mv88e6xxx: replace VTU violation prints with trace points selftests/bpf: Test btf dump for struct with padding only fields libbpf: Fix BTF-to-C converter's padding logic selftests/bpf: Add few corner cases to test padding handling of btf_dump libbpf: Fix btf_dump's packed struct determination usb: ucsi: Fix ucsi->connector race drm/amdkfd: Get prange->offset after svm_range_vram_node_new hsr: ratelimit only when errors are printed x86/PVH: avoid 32-bit build warning when obtaining VGA console info Revert "cpuidle, intel_idle: Fix CPUIDLE_FLAG_IRQ_ENABLE *again*" Linux 6.1.23 Change-Id: I15af3697170567c4678bcc9c2380d80e7cef5bc9 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
|
089e6318e1 |
scsi: mpt3sas: Don't print sense pool info twice
[ Upstream commit d684a7a26f7d2c7122a4581ac966ed64e88fb29c ]
_base_allocate_sense_dma_pool() already prints out the sense pool
information, so don't print it a second time after calling it in
_base_allocate_memory_pools(). In addition the version in
_base_allocate_memory_pools() was using the wrong size value, sz, which was
last assigned when doing some nvme calculations instead of sense_sz to
determine the pool size in kilobytes.
Cc: Sathya Prakash <sathya.prakash@broadcom.com>
Cc: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
Cc: Suganath Prabu Subramani <suganath-prabu.subramani@broadcom.com>
Cc: MPT-FusionLinux.pdl@broadcom.com
Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
Cc: "James E.J. Bottomley" <jejb@linux.ibm.com>
Fixes:
|
||
|
9526222c1a |
scsi: megaraid_sas: Fix crash after a double completion
[ Upstream commit 2309df27111a51734cb9240b4d3c25f2f3c6ab06 ]
When a physical disk is attached directly "without JBOD MAP support" (see
megasas_get_tm_devhandle()) then there is no real error handling in the
driver. Return FAILED instead of SUCCESS.
Fixes:
|
||
|
db50ac4d0a |
Merge 6.1.22 into android14-6.1
Changes in 6.1.22 interconnect: qcom: osm-l3: fix icc_onecell_data allocation interconnect: qcom: sm8450: switch to qcom_icc_rpmh_* function interconnect: qcom: qcm2290: Fix MASTER_SNOC_BIMC_NRT perf/core: Fix perf_output_begin parameter is incorrectly invoked in perf_event_bpf_output perf: fix perf_event_context->time tracing/hwlat: Replace sched_setaffinity with set_cpus_allowed_ptr drm/amd/display: Include virtual signal to set k1 and k2 values drm/amd/display: fix k1 k2 divider programming for phantom streams drm/amd/display: Remove OTG DIV register write for Virtual signals. mptcp: refactor passive socket initialization mptcp: use the workqueue to destroy unaccepted sockets mptcp: fix UaF in listener shutdown drm/amd/display: Fix DP MST sinks removal issue arm64: dts: qcom: sm8450: Mark UFS controller as cache coherent power: supply: bq24190: Fix use after free bug in bq24190_remove due to race condition power: supply: da9150: Fix use after free bug in da9150_charger_remove due to race condition arm64: dts: imx8dxl-evk: Disable hibernation mode of AR8031 for EQOS arm64: dts: imx8dxl-evk: Fix eqos phy reset gpio ARM: dts: imx6sll: e70k02: fix usbotg1 pinctrl ARM: dts: imx6sll: e60k02: fix usbotg1 pinctrl ARM: dts: imx6sl: tolino-shine2hd: fix usbotg1 pinctrl arm64: dts: imx8mn: specify #sound-dai-cells for SAI nodes arm64: dts: imx93: add missing #address-cells and #size-cells to i2c nodes NFS: Fix /proc/PID/io read_bytes for buffered reads xsk: Add missing overflow check in xdp_umem_reg iavf: fix inverted Rx hash condition leading to disabled hash iavf: fix non-tunneled IPv6 UDP packet type and hashing iavf: do not track VLAN 0 filters intel/igbvf: free irq on the error path in igbvf_request_msix() igbvf: Regard vf reset nack as success igc: fix the validation logic for taprio's gate list i2c: imx-lpi2c: check only for enabled interrupt flags i2c: mxs: ensure that DMA buffers are safe for DMA i2c: hisi: Only use the completion interrupt to finish the transfer scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate() nfsd: don't replace page in rq_pages if it's a continuation of last page net: dsa: b53: mmap: fix device tree support net: usb: smsc95xx: Limit packet length to skb->len efi/libstub: smbios: Use length member instead of record struct size qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info xirc2ps_cs: Fix use after free bug in xirc2ps_detach net: phy: Ensure state transitions are processed from phy_stop() net: mdio: fix owner field for mdio buses registered using device-tree net: mdio: fix owner field for mdio buses registered using ACPI net: stmmac: Fix for mismatched host/device DMA address width thermal/drivers/mellanox: Use generic thermal_zone_get_trip() function mlxsw: core_thermal: Fix fan speed in maximum cooling state drm/i915: Print return value on error drm/i915/fbdev: lock the fbdev obj before vma pin drm/i915/guc: Rename GuC register state capture node to be more obvious drm/i915/guc: Fix missing ecodes drm/i915/gt: perform uc late init after probe error injection net: qcom/emac: Fix use after free bug in emac_remove due to race condition net: usb: lan78xx: Limit packet length to skb->len net/ps3_gelic_net: Fix RX sk_buff length net/ps3_gelic_net: Use dma_mapping_error octeontx2-vf: Add missing free for alloc_percpu bootconfig: Fix testcase to increase max node keys: Do not cache key in task struct if key is requested from kernel thread ice: check if VF exists before mode check iavf: fix hang on reboot with ice i40e: fix flow director packet filter programming bpf: Adjust insufficient default bpf_jit_limit net/mlx5e: Set uplink rep as NETNS_LOCAL net/mlx5e: Block entering switchdev mode with ns inconsistency net/mlx5: Fix steering rules cleanup net/mlx5e: Overcome slow response for first macsec ASO WQE net/mlx5: Read the TC mapping of all priorities on ETS query net/mlx5: E-Switch, Fix an Oops in error handling code net: dsa: tag_brcm: legacy: fix daisy-chained switches atm: idt77252: fix kmemleak when rmmod idt77252 erspan: do not use skb_mac_header() in ndo_start_xmit() net/sonic: use dma_mapping_error() for error check nvme-tcp: fix nvme_tcp_term_pdu to match spec mlxsw: spectrum_fid: Fix incorrect local port type hvc/xen: prevent concurrent accesses to the shared ring ksmbd: add low bound validation to FSCTL_SET_ZERO_DATA ksmbd: add low bound validation to FSCTL_QUERY_ALLOCATED_RANGES ksmbd: fix possible refcount leak in smb2_open() Bluetooth: hci_sync: Resume adv with no RPA when active scan Bluetooth: hci_core: Detect if an ACL packet is in fact an ISO packet Bluetooth: btusb: Remove detection of ISO packets over bulk Bluetooth: ISO: fix timestamped HCI ISO data packet parsing Bluetooth: Remove "Power-on" check from Mesh feature gve: Cache link_speed value from device net: asix: fix modprobe "sysfs: cannot create duplicate filename" net: dsa: mt7530: move enabling disabling core clock to mt7530_pll_setup() net: dsa: mt7530: move lowering TRGMII driving to mt7530_setup() net: dsa: mt7530: move setting ssc_delta to PHY_INTERFACE_MODE_TRGMII case net: mdio: thunder: Add missing fwnode_handle_put() drm/amd/display: Set dcn32 caps.seamless_odm Bluetooth: btqcomsmd: Fix command timeout after setting BD address Bluetooth: L2CAP: Fix responding with wrong PDU type Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work Bluetooth: mgmt: Fix MGMT add advmon with RSSI command Bluetooth: HCI: Fix global-out-of-bounds platform/chrome: cros_ec_chardev: fix kernel data leak from ioctl entry: Fix noinstr warning in __enter_from_user_mode() perf/x86/amd/core: Always clear status for idx entry/rcu: Check TIF_RESCHED _after_ delayed RCU wake-up hwmon: fix potential sensor registration fail if of_node is missing hwmon (it87): Fix voltage scaling for chips with 10.9mV ADCs scsi: qla2xxx: Synchronize the IOCB count to be in order scsi: qla2xxx: Perform lockless command completion in abort path smb3: lower default deferred close timeout to address perf regression smb3: fix unusable share after force unmount failure uas: Add US_FL_NO_REPORT_OPCODES for JMicron JMS583Gen 2 thunderbolt: Use scale field when allocating USB3 bandwidth thunderbolt: Call tb_check_quirks() after initializing adapters thunderbolt: Add quirk to disable CLx thunderbolt: Fix memory leak in margining thunderbolt: Disable interrupt auto clear for rings thunderbolt: Add missing UNSET_INBOUND_SBTX for retimer access thunderbolt: Use const qualifier for `ring_interrupt_index` thunderbolt: Rename shadowed variables bit to interrupt_bit and auto_clear_bit ASoC: amd: yp: Add OMEN by HP Gaming Laptop 16z-n000 to quirks ASoC: amd: yc: Add DMI entries to support HP OMEN 16-n0xxx (8A43) ACPI: x86: Drop quirk for HP Elitebook ACPI: x86: utils: Add Cezanne to the list for forcing StorageD3Enable riscv: Bump COMMAND_LINE_SIZE value to 1024 drm/cirrus: NULL-check pipe->plane.state->fb in cirrus_pipe_update() HID: cp2112: Fix driver not registering GPIO IRQ chip as threaded ca8210: fix mac_len negative array access HID: logitech-hidpp: Add support for Logitech MX Master 3S mouse HID: intel-ish-hid: ipc: Fix potential use-after-free in work function m68k: mm: Fix systems with memory at end of 32-bit address space m68k: Only force 030 bus error if PC not in exception table selftests/bpf: check that modifier resolves after pointer scsi: target: iscsi: Fix an error message in iscsi_check_key() scsi: qla2xxx: Add option to disable FC2 Target support scsi: hisi_sas: Check devm_add_action() return value scsi: ufs: core: Add soft dependency on governor_simpleondemand scsi: lpfc: Check kzalloc() in lpfc_sli4_cgn_params_read() scsi: lpfc: Avoid usage of list iterator variable after loop scsi: mpi3mr: Driver unload crashes host when enhanced logging is enabled scsi: mpi3mr: Wait for diagnostic save during controller init scsi: mpi3mr: NVMe command size greater than 8K fails scsi: mpi3mr: Bad drive in topology results kernel crash scsi: storvsc: Handle BlockSize change in Hyper-V VHD/VHDX file platform/x86: int3472: Add GPIOs to Surface Go 3 Board data net: usb: cdc_mbim: avoid altsetting toggling for Telit FE990 net: usb: qmi_wwan: add Telit 0x1080 composition drm/amd/display: Update clock table to include highest clock setting sh: sanitize the flags on sigreturn drm/amdgpu: Fix call trace warning and hang when removing amdgpu device drm/amd: Fix initialization mistake for NBIO 7.3.0 net/sched: act_mirred: better wording on protection against excessive stack growth act_mirred: use the backlog for nested calls to mirred ingress cifs: lock chan_lock outside match_session cifs: append path to open_enter trace event cifs: do not poll server interfaces too regularly cifs: empty interface list when server doesn't support query interfaces cifs: dump pending mids for all channels in DebugData cifs: print session id while listing open files cifs: fix dentry lookups in directory handle cache x86/fpu/xstate: Prevent false-positive warning in __copy_xstate_uabi_buf() selftests/x86/amx: Add a ptrace test scsi: core: Add BLIST_SKIP_VPD_PAGES for SKhynix H28U74301AMR usb: misc: onboard-hub: add support for Microchip USB2517 USB 2.0 hub usb: dwc2: drd: fix inconsistent mode if role-switch-default-mode="host" usb: dwc2: fix a devres leak in hw_enable upon suspend resume usb: gadget: u_audio: don't let userspace block driver unbind btrfs: zoned: fix btrfs_can_activate_zone() to support DUP profile Bluetooth: Fix race condition in hci_cmd_sync_clear efi: sysfb_efi: Fix DMI quirks not working for simpledrm mm/slab: Fix undefined init_cache_node_node() for NUMA and !SMP fscrypt: destroy keyring after security_sb_delete() fsverity: Remove WQ_UNBOUND from fsverity read workqueue lockd: set file_lock start and end when decoding nlm4 testargs arm64: dts: imx8mm-nitrogen-r2: fix WM8960 clock name igb: revert rtnl_lock() that causes deadlock dm thin: fix deadlock when swapping to thin device usb: typec: tcpm: fix create duplicate source-capabilities file usb: typec: tcpm: fix warning when handle discover_identity message usb: cdns3: Fix issue with using incorrect PCI device function usb: cdnsp: Fixes issue with redundant Status Stage usb: cdnsp: changes PCI Device ID to fix conflict with CNDS3 driver usb: chipdea: core: fix return -EINVAL if request role is the same with current role usb: chipidea: core: fix possible concurrent when switch role usb: dwc3: gadget: Add 1ms delay after end transfer command without IOC usb: ucsi: Fix NULL pointer deref in ucsi_connector_change() usb: ucsi_acpi: Increase the command completion timeout mm: kfence: fix using kfence_metadata without initialization in show_object() kfence: avoid passing -g for test io_uring/net: avoid sending -ECONNABORTED on repeated connection requests io_uring/rsrc: fix null-ptr-deref in io_file_bitmap_get() Revert "kasan: drop skip_kasan_poison variable in free_pages_prepare" test_maple_tree: add more testing for mas_empty_area() maple_tree: fix mas_skip_node() end slot detection ksmbd: fix wrong signingkey creation when encryption is AES256 ksmbd: set FILE_NAMED_STREAMS attribute in FS_ATTRIBUTE_INFORMATION ksmbd: don't terminate inactive sessions after a few seconds ksmbd: return STATUS_NOT_SUPPORTED on unsupported smb2.0 dialect ksmbd: return unsupported error on smb1 mount wifi: mac80211: fix qos on mesh interfaces nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy() drm/bridge: lt8912b: return EPROBE_DEFER if bridge is not found drm/amd/display: fix wrong index used in dccg32_set_dpstreamclk drm/meson: fix missing component unbind on bind errors drm/amdgpu/nv: Apply ASPM quirk on Intel ADL + AMD Navi drm/i915/active: Fix missing debug object activation drm/i915: Preserve crtc_state->inherited during state clearing drm/amdgpu: skip ASIC reset for APUs when go to S4 drm/amdgpu: reposition the gpu reset checking for reuse riscv: mm: Fix incorrect ASID argument when flushing TLB riscv: Handle zicsr/zifencei issues between clang and binutils tee: amdtee: fix race condition in amdtee_open_session firmware: arm_scmi: Fix device node validation for mailbox transport arm64: dts: qcom: sc7280: Mark PCIe controller as cache coherent arm64: dts: qcom: sm8150: Fix the iommu mask used for PCIe controllers soc: qcom: llcc: Fix slice configuration values for SC8280XP mm/ksm: fix race with VMA iteration and mm_struct teardown bus: imx-weim: fix branch condition evaluates to a garbage value i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer() dm stats: check for and propagate alloc_percpu failure dm crypt: add cond_resched() to dmcrypt_write() dm crypt: avoid accessing uninitialized tasklet sched/fair: sanitize vruntime of entity being placed sched/fair: Sanitize vruntime of entity being migrated drm/amdkfd: introduce dummy cache info for property asic drm/amdkfd: Fix the warning of array-index-out-of-bounds drm/amdkfd: add GC 11.0.4 KFD support drm/amdkfd: Fix the memory overrun Linux 6.1.22 Change-Id: Id13b4655dbfb59c29a0b8953e5e0cda3703f1879 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
|
d9e00246e0 |
Revert "Revert "scsi: core: Add BLIST_NO_VPD_SIZE for some VDASD""
This reverts commit
|
||
|
b03b85ec82 |
scsi: core: Add BLIST_SKIP_VPD_PAGES for SKhynix H28U74301AMR
commit a204b490595de71016b2360a1886ec8c12d0afac upstream. Xiaomi Poco F1 (qcom/sdm845-xiaomi-beryllium*.dts) comes with a SKhynix H28U74301AMR UFS. The sd_read_cpr() operation leads to a 120 second timeout, making the device bootup very slow: [ 121.457736] sd 0:0:0:1: [sdb] tag#23 timing out command, waited 120s Setting the BLIST_SKIP_VPD_PAGES allows the device to skip the failing sd_read_cpr operation and boot normally. Signed-off-by: Joel Selvaraj <joelselvaraj.oss@gmail.com> Link: https://lore.kernel.org/r/20230313041402.39330-1-joelselvaraj.oss@gmail.com Cc: stable@vger.kernel.org Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|
4a7d64d385 |
scsi: storvsc: Handle BlockSize change in Hyper-V VHD/VHDX file
[ Upstream commit 11d9874c4204a785f43d899a1ab12f9dc8d9de3e ] Hyper-V uses a VHD or VHDX file on the host as the underlying storage for a virtual disk. The VHD/VHDX file format is a sparse format where real disk space on the host is assigned in chunks that the VHD/VHDX file format calls the BlockSize. This BlockSize is not to be confused with the 512-byte (or 4096-byte) sector size of the underlying storage device. The default block size for a new VHD/VHDX file is 32 Mbytes. When a guest VM touches any disk space within a 32 Mbyte chunk of the VHD/VHDX file, Hyper-V allocates 32 Mbytes of real disk space for that section of the VHD/VHDX. Similarly, if a discard operation is done that covers an entire 32 Mbyte chunk, Hyper-V will free the real disk space for that portion of the VHD/VHDX. This BlockSize is surfaced in Linux as the "discard_granularity" in /sys/block/sd<x>/queue, which makes sense. Hyper-V also has differencing disks that can overlay a VHD/VHDX file to capture changes to the VHD/VHDX while preserving the original VHD/VHDX. One example of this differencing functionality is for VM snapshots. When a snapshot is created, a differencing disk is created. If the snapshot is rolled back, Hyper-V can just delete the differencing disk, and the VM will see the original disk contents at the time the snapshot was taken. Differencing disks are used in other scenarios as well. The BlockSize for a differencing disk defaults to 2 Mbytes, not 32 Mbytes. The smaller default is used because changes to differencing disks are typically scattered all over, and Hyper-V doesn't want to allocate 32 Mbytes of real disk space for a stray write here or there. The smaller BlockSize provides more efficient use of real disk space. When a differencing disk is added to a VHD/VHDX, Hyper-V reports UNIT_ATTENTION with a sense code indicating "Operating parameters have changed", because the value of discard_granularity should be changed to 2 Mbytes. When the differencing disk is removed, discard_granularity should be changed back to 32 Mbytes. However, current code simply reports a message from scsi_report_sense() and the value of /sys/block/sd<x>/queue/discard_granularity is not updated. The message isn't very actionable by a sysadmin. Fix this by having the storvsc driver check for the sense code indicating that the underly VHD/VHDX block size has changed, and do a rescan of the device to pick up the new discard_granularity. With this change the entire transition to/from differencing disks is handled automatically and transparently, with no confusing messages being output. Link: https://lore.kernel.org/r/1677516514-86060-1-git-send-email-mikelley@microsoft.com Signed-off-by: Michael Kelley <mikelley@microsoft.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org> |
||
|
1f822ae8fb |
scsi: mpi3mr: Bad drive in topology results kernel crash
[ Upstream commit 8e45183978d64699df639e795235433a60f35047 ] When the SAS Transport Layer support is enabled and a device exposed to the OS by the driver fails INQUIRY commands, the driver frees up the memory allocated for an internal HBA port data structure. However, in some places, the reference to the freed memory is not cleared. When the firmware sends the Device Info change event for the same device again, the freed memory is accessed and that leads to memory corruption and OS crash. Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com> Signed-off-by: Sreekanth Reddy <sreekanth.reddy@broadcom.com> Link: https://lore.kernel.org/r/20230228140835.4075-7-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org> |
||
|
a0b33e1d8d |
scsi: mpi3mr: NVMe command size greater than 8K fails
[ Upstream commit 4f297e856a7b5da2f2c66a12e739666e23943560 ] A wrong variable is checked while populating PRP entries in the PRP page and this results in failure. No PRP entries in the PRP page were successfully created and any NVMe Encapsulated commands with PRP of size greater than 8K failed. Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com> Signed-off-by: Sreekanth Reddy <sreekanth.reddy@broadcom.com> Link: https://lore.kernel.org/r/20230228140835.4075-6-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org> |
||
|
92548801f0 |
scsi: mpi3mr: Wait for diagnostic save during controller init
[ Upstream commit 0a319f1629495d27879b7ebf6eee62b8cf6e4c37 ] If a controller reset operation is triggered to recover the controller from a fault state, then wait for the snapdump to be saved in the firmware region before proceeding to reset the controller. Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com> Signed-off-by: Sreekanth Reddy <sreekanth.reddy@broadcom.com> Link: https://lore.kernel.org/r/20230228140835.4075-4-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org> |
||
|
88f7fb47e0 |
scsi: mpi3mr: Driver unload crashes host when enhanced logging is enabled
[ Upstream commit 5b06a7169c59ce0c77ef8b9c82aa07c478f82aac ] Prevent driver from trying to dereference a NULL pointer in a debug print while removing a device during driver unload. Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com> Signed-off-by: Sreekanth Reddy <sreekanth.reddy@broadcom.com> Link: https://lore.kernel.org/r/20230228140835.4075-3-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org> |
||
|
ec3a119c30 |
scsi: lpfc: Avoid usage of list iterator variable after loop
[ Upstream commit 2850b23e9f9ae3696e472d2883ea1b43aafa884e ] If the &epd_pool->list is empty when executing lpfc_get_io_buf_from_expedite_pool() the function would return an invalid pointer. Even in the case if the list is guaranteed to be populated, the iterator variable should not be used after the loop to be more robust for future changes. Linus proposed to avoid any use of the list iterator variable after the loop, in the attempt to move the list iterator variable declaration into the macro to avoid any potential misuse after the loop [1]. Link: https://lore.kernel.org/all/CAHk-=wgRr_D8CB-D9Kg-c=EHreAsk5SqXPwr9Y7k9sA6cWXJ6w@mail.gmail.com/ [1] Signed-off-by: Jakob Koschel <jkl820.git@gmail.com> Link: https://lore.kernel.org/r/20230301-scsi-lpfc-avoid-list-iterator-after-loop-v1-1-325578ae7561@gmail.com Reviewed-by: Justin Tee <justin.tee@broadcom.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org> |
||
|
4829a1e117 |
scsi: lpfc: Check kzalloc() in lpfc_sli4_cgn_params_read()
[ Upstream commit 312320b0e0ec21249a17645683fe5304d796aec1 ] If kzalloc() fails in lpfc_sli4_cgn_params_read(), then we rely on lpfc_read_object()'s routine to NULL check pdata. Currently, an early return error is thrown from lpfc_read_object() to protect us from NULL ptr dereference, but the errno code is -ENODEV. Change the errno code to a more appropriate -ENOMEM. Reported-by: Kang Chen <void0red@gmail.com> Link: https://lore.kernel.org/all/20230226102338.3362585-1-void0red@gmail.com Signed-off-by: Justin Tee <justin.tee@broadcom.com> Link: https://lore.kernel.org/r/20230228044336.5195-1-justintee8345@gmail.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org> |
||
|
d92460985d |
scsi: hisi_sas: Check devm_add_action() return value
[ Upstream commit 06d1a90de60208054cca15ef200138cfdbb642a9 ] In case devm_add_action() fails, check it in the caller of interrupt_preinit_v3_hw(). Link: https://lore.kernel.org/r/20230227031030.893324-1-void0red@gmail.com Signed-off-by: Kang Chen <void0red@gmail.com> Acked-by: Xiang Chen <chenxiang66@hisilicon.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org> |
||
|
b139678fb1 |
scsi: qla2xxx: Add option to disable FC2 Target support
[ Upstream commit 877b03795fcf29ff2e2351f7e574ecc9b9c51732 ]
Commit
|
||
|
cd0a1804ac |
scsi: qla2xxx: Perform lockless command completion in abort path
commit 0367076b0817d5c75dfb83001ce7ce5c64d803a9 upstream. While adding and removing the controller, the following call trace was observed: WARNING: CPU: 3 PID: 623596 at kernel/dma/mapping.c:532 dma_free_attrs+0x33/0x50 CPU: 3 PID: 623596 Comm: sh Kdump: loaded Not tainted 5.14.0-96.el9.x86_64 #1 RIP: 0010:dma_free_attrs+0x33/0x50 Call Trace: qla2x00_async_sns_sp_done+0x107/0x1b0 [qla2xxx] qla2x00_abort_srb+0x8e/0x250 [qla2xxx] ? ql_dbg+0x70/0x100 [qla2xxx] __qla2x00_abort_all_cmds+0x108/0x190 [qla2xxx] qla2x00_abort_all_cmds+0x24/0x70 [qla2xxx] qla2x00_abort_isp_cleanup+0x305/0x3e0 [qla2xxx] qla2x00_remove_one+0x364/0x400 [qla2xxx] pci_device_remove+0x36/0xa0 __device_release_driver+0x17a/0x230 device_release_driver+0x24/0x30 pci_stop_bus_device+0x68/0x90 pci_stop_and_remove_bus_device_locked+0x16/0x30 remove_store+0x75/0x90 kernfs_fop_write_iter+0x11c/0x1b0 new_sync_write+0x11f/0x1b0 vfs_write+0x1eb/0x280 ksys_write+0x5f/0xe0 do_syscall_64+0x5c/0x80 ? do_user_addr_fault+0x1d8/0x680 ? do_syscall_64+0x69/0x80 ? exc_page_fault+0x62/0x140 ? asm_exc_page_fault+0x8/0x30 entry_SYSCALL_64_after_hwframe+0x44/0xae The command was completed in the abort path during driver unload with a lock held, causing the warning in abort path. Hence complete the command without any lock held. Reported-by: Lin Li <lilin@redhat.com> Tested-by: Lin Li <lilin@redhat.com> Cc: stable@vger.kernel.org Signed-off-by: Nilesh Javali <njavali@marvell.com> Link: https://lore.kernel.org/r/20230313043711.13500-2-njavali@marvell.com Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com> Reviewed-by: John Meneghini <jmeneghi@redhat.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|
6d57b77d73 |
scsi: qla2xxx: Synchronize the IOCB count to be in order
commit d3affdeb400f3adc925bd996f3839481f5291839 upstream. A system hang was observed with the following call trace: BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 15 PID: 86747 Comm: nvme Kdump: loaded Not tainted 6.2.0+ #1 Hardware name: Dell Inc. PowerEdge R6515/04F3CJ, BIOS 2.7.3 03/31/2022 RIP: 0010:__wake_up_common+0x55/0x190 Code: 41 f6 01 04 0f 85 b2 00 00 00 48 8b 43 08 4c 8d 40 e8 48 8d 43 08 48 89 04 24 48 89 c6\ 49 8d 40 18 48 39 c6 0f 84 e9 00 00 00 <49> 8b 40 18 89 6c 24 14 31 ed 4c 8d 60 e8 41 8b 18 f6 c3 04 75 5d RSP: 0018:ffffb05a82afbba0 EFLAGS: 00010082 RAX: 0000000000000000 RBX: ffff8f9b83a00018 RCX: 0000000000000000 RDX: 0000000000000001 RSI: ffff8f9b83a00020 RDI: ffff8f9b83a00018 RBP: 0000000000000001 R08: ffffffffffffffe8 R09: ffffb05a82afbbf8 R10: 70735f7472617473 R11: 5f30307832616c71 R12: 0000000000000001 R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000000000 FS: 00007f815cf4c740(0000) GS:ffff8f9eeed80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000010633a000 CR4: 0000000000350ee0 Call Trace: <TASK> __wake_up_common_lock+0x83/0xd0 qla_nvme_ls_req+0x21b/0x2b0 [qla2xxx] __nvme_fc_send_ls_req+0x1b5/0x350 [nvme_fc] nvme_fc_xmt_disconnect_assoc+0xca/0x110 [nvme_fc] nvme_fc_delete_association+0x1bf/0x220 [nvme_fc] ? nvme_remove_namespaces+0x9f/0x140 [nvme_core] nvme_do_delete_ctrl+0x5b/0xa0 [nvme_core] nvme_sysfs_delete+0x5f/0x70 [nvme_core] kernfs_fop_write_iter+0x12b/0x1c0 vfs_write+0x2a3/0x3b0 ksys_write+0x5f/0xe0 do_syscall_64+0x5c/0x90 ? syscall_exit_work+0x103/0x130 ? syscall_exit_to_user_mode+0x12/0x30 ? do_syscall_64+0x69/0x90 ? exit_to_user_mode_loop+0xd0/0x130 ? exit_to_user_mode_prepare+0xec/0x100 ? syscall_exit_to_user_mode+0x12/0x30 ? do_syscall_64+0x69/0x90 ? syscall_exit_to_user_mode+0x12/0x30 ? do_syscall_64+0x69/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7f815cd3eb97 The IOCB counts are out of order and that would block any commands from going out and subsequently hang the system. Synchronize the IOCB count to be in correct order. Fixes: 5f63a163ed2f ("scsi: qla2xxx: Fix exchange oversubscription for management commands") Cc: stable@vger.kernel.org Signed-off-by: Quinn Tran <qutran@marvell.com> Signed-off-by: Nilesh Javali <njavali@marvell.com> Link: https://lore.kernel.org/r/20230313043711.13500-3-njavali@marvell.com Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com> Reviewed-by: John Meneghini <jmeneghi@redhat.com> Tested-by: Lin Li <lilin@redhat.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|
1c55982beb |
scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate()
[ Upstream commit a13faca032acbf2699293587085293bdfaafc8ae ]
If alua_rtpg_queue() failed from alua_activate(), then 'qdata' is not
freed, which will cause following memleak:
unreferenced object 0xffff88810b2c6980 (size 32):
comm "kworker/u16:2", pid 635322, jiffies 4355801099 (age 1216426.076s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
40 39 24 c1 ff ff ff ff 00 f8 ea 0a 81 88 ff ff @9$.............
backtrace:
[<0000000098f3a26d>] alua_activate+0xb0/0x320
[<000000003b529641>] scsi_dh_activate+0xb2/0x140
[<000000007b296db3>] activate_path_work+0xc6/0xe0 [dm_multipath]
[<000000007adc9ace>] process_one_work+0x3c5/0x730
[<00000000c457a985>] worker_thread+0x93/0x650
[<00000000cb80e628>] kthread+0x1ba/0x210
[<00000000a1e61077>] ret_from_fork+0x22/0x30
Fix the problem by freeing 'qdata' in error path.
Fixes:
|
||
|
ad8dbd4420 |
Revert "scsi: core: Add BLIST_NO_VPD_SIZE for some VDASD"
This reverts commit
|
||
|
d14ac9ddc6 |
Merge 6.1.21 into android14-6.1
Changes in 6.1.21 xfrm: Allow transport-mode states with AF_UNSPEC selector drm/virtio: Pass correct device to dma_sync_sgtable_for_device() drm/msm/gem: Prevent blocking within shrinker loop drm/panfrost: Don't sync rpm suspension after mmu flushing fbdev: chipsfb: Fix error codes in chipsfb_pci_init() cifs: Move the in_send statistic to __smb_send_rqst() drm/meson: fix 1px pink line on GXM when scaling video overlay clk: HI655X: select REGMAP instead of depending on it ASoC: SOF: Intel: MTL: Fix the device description ASoC: SOF: Intel: HDA: Fix device description ASoC: SOF: Intel: SKL: Fix device description ASOC: SOF: Intel: pci-tgl: Fix device description ASoC: SOF: ipc4-topology: set dmic dai index from copier docs: Correct missing "d_" prefix for dentry_operations member d_weak_revalidate scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add() scsi: mpi3mr: Fix throttle_groups memory leak scsi: mpi3mr: Fix config page DMA memory leak scsi: mpi3mr: Fix mpi3mr_hba_port memory leak in mpi3mr_remove() scsi: mpi3mr: Fix sas_hba.phy memory leak in mpi3mr_remove() scsi: mpi3mr: Return proper values for failures in firmware init path scsi: mpi3mr: Fix memory leaks in mpi3mr_init_ioc() scsi: mpi3mr: ioctl timeout when disabling/enabling interrupt scsi: mpi3mr: Fix expander node leak in mpi3mr_remove() ALSA: hda: Match only Intel devices with CONTROLLER_IN_GPU() netfilter: nft_nat: correct length for loading protocol registers netfilter: nft_masq: correct length for loading protocol registers netfilter: nft_redir: correct length for loading protocol registers netfilter: nft_redir: correct value of inet type `.maxattrs` scsi: core: Add BLIST_NO_VPD_SIZE for some VDASD scsi: core: Fix a procfs host directory removal regression ftrace,kcfi: Define ftrace_stub_graph conditionally tcp: tcp_make_synack() can be called from process context vdpa/mlx5: should not activate virtq object when suspended wifi: nl80211: fix NULL-ptr deref in offchan check wifi: cfg80211: fix MLO connection ownership selftests: fix LLVM build for i386 and x86_64 nfc: pn533: initialize struct pn533_out_arg properly ipvlan: Make skb->skb_iif track skb->dev for l3s mode i40e: Fix kernel crash during reboot when adapter is in recovery mode vhost-vdpa: free iommu domain after last use during cleanup vdpa_sim: not reset state in vdpasim_queue_ready vdpa_sim: set last_used_idx as last_avail_idx in vdpasim_queue_ready PCI: s390: Fix use-after-free of PCI resources with per-function hotplug drm/i915/psr: Use calculated io and fast wake lines drm/i915/sseu: fix max_subslices array-index-out-of-bounds access net/smc: fix NULL sndbuf_desc in smc_cdc_tx_handler() qed/qed_dev: guard against a possible division by zero net: dsa: mt7530: remove now incorrect comment regarding port 5 net: dsa: mt7530: set PLL frequency and trgmii only when trgmii is used block: do not reverse request order when flushing plug list loop: Fix use-after-free issues net: tunnels: annotate lockless accesses to dev->needed_headroom net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails tcp: Fix bind() conflict check for dual-stack wildcard address. nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition mlxsw: spectrum: Fix incorrect parsing depth after reload net/smc: fix deadlock triggered by cancel_delayed_work_syn() net: usb: smsc75xx: Limit packet length to skb->len drm/bridge: Fix returned array size name for atomic_get_input_bus_fmts kdoc powerpc/mm: Fix false detection of read faults block: null_blk: Fix handling of fake timeout request nvme: fix handling single range discard request nvmet: avoid potential UAF in nvmet_req_complete() block: sunvdc: add check for mdesc_grab() returning NULL net/mlx5e: Fix macsec ASO context alignment net/mlx5e: Don't cache tunnel offloads capability net/mlx5: Fix setting ec_function bit in MANAGE_PAGES net/mlx5: Disable eswitch before waiting for VF pages net/mlx5e: Support Geneve and GRE with VF tunnel offload net/mlx5: E-switch, Fix wrong usage of source port rewrite in split rules net/mlx5: E-switch, Fix missing set of split_count when forward to ovs internal port net/mlx5e: Fix cleanup null-ptr deref on encap lock net/mlx5: Set BREAK_FW_WAIT flag first when removing driver veth: Fix use after free in XDP_REDIRECT ice: xsk: disable txq irq before flushing hw net: dsa: don't error out when drivers return ETH_DATA_LEN in .port_max_mtu() net: dsa: mv88e6xxx: fix max_mtu of 1492 on 6165, 6191, 6220, 6250, 6290 ravb: avoid PHY being resumed when interface is not up sh_eth: avoid PHY being resumed when interface is not up ipv4: Fix incorrect table ID in IOCTL path net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull net: atlantic: Fix crash when XDP is enabled but no program is loaded net/iucv: Fix size of interrupt data i825xx: sni_82596: use eth_hw_addr_set() selftests: net: devlink_port_split.py: skip test if no suitable device available qed/qed_mng_tlv: correctly zero out ->min instead of ->hour net: dsa: microchip: fix RGMII delay configuration on KSZ8765/KSZ8794/KSZ8795 ethernet: sun: add check for the mdesc_grab() bonding: restore IFF_MASTER/SLAVE flags on bond enslave ether type change bonding: restore bond's IFF_SLAVE flag if a non-eth dev enslave fails hwmon: (adt7475) Display smoothing attributes in correct order hwmon: (adt7475) Fix masking of hysteresis registers hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition hwmon: (ina3221) return prober error code hwmon: (ucd90320) Add minimum delay between bus accesses hwmon: tmp512: drop of_match_ptr for ID table kconfig: Update config changed flag before calling callback hwmon: (adm1266) Set `can_sleep` flag for GPIO chip hwmon: (ltc2992) Set `can_sleep` flag for GPIO chip media: m5mols: fix off-by-one loop termination error mmc: atmel-mci: fix race between stop command and start of next command soc: mediatek: mtk-svs: keep svs alive if CONFIG_DEBUG_FS not supported jffs2: correct logic when creating a hole in jffs2_write_begin rust: arch/um: Disable FP/SIMD instruction to match x86 ext4: fail ext4_iget if special inode unallocated ext4: update s_journal_inum if it changes after journal replay ext4: fix task hung in ext4_xattr_delete_inode drm/amdkfd: Fix an illegal memory access net/9p: fix bug in client create for .L LoongArch: Only call get_timer_irq() once in constant_clockevent_init() sh: intc: Avoid spurious sizeof-pointer-div warning drm/amdgpu: fix ttm_bo calltrace warning in psp_hw_fini drm/amd/display: fix shift-out-of-bounds in CalculateVMAndRowBytes ext4: fix possible double unlock when moving a directory Revert "tty: serial: fsl_lpuart: adjust SERIAL_FSL_LPUART_CONSOLE config dependency" tty: serial: fsl_lpuart: skip waiting for transmission complete when UARTCTRL_SBK is asserted serial: 8250_em: Fix UART port type serial: 8250_fsl: fix handle_irq locking serial: 8250: ASPEED_VUART: select REGMAP instead of depending on it firmware: xilinx: don't make a sleepable memory allocation from an atomic context memory: tegra: fix interconnect registration race memory: tegra20-emc: fix interconnect registration race memory: tegra124-emc: fix interconnect registration race memory: tegra30-emc: fix interconnect registration race drm/ttm: Fix a NULL pointer dereference s390/ipl: add missing intersection check to ipl_report handling interconnect: fix icc_provider_del() error handling interconnect: fix provider registration API interconnect: imx: fix registration race interconnect: fix mem leak when freeing nodes interconnect: qcom: osm-l3: fix registration race interconnect: qcom: rpm: fix probe child-node error handling interconnect: qcom: rpm: fix registration race interconnect: qcom: rpmh: fix probe child-node error handling interconnect: qcom: rpmh: fix registration race interconnect: qcom: msm8974: fix registration race interconnect: exynos: fix node leak in probe PM QoS error path interconnect: exynos: fix registration race md: select BLOCK_LEGACY_AUTOLOAD cifs: generate signkey for the channel that's reconnecting tracing: Make splice_read available again tracing: Check field value in hist_field_name() tracing: Make tracepoint lockdep check actually test something cifs: Fix smb2_set_path_size() KVM: SVM: Fix a benign off-by-one bug in AVIC physical table mask KVM: SVM: Modify AVIC GATag to support max number of 512 vCPUs KVM: nVMX: add missing consistency checks for CR0 and CR4 ALSA: hda: intel-dsp-config: add MTL PCI id ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book2 Pro ALSA: hda/realtek: fix speaker, mute/micmute LEDs not work on a HP platform Revert "riscv: mm: notify remote harts about mmu cache updates" riscv: asid: Fixup stale TLB entry cause application crash drm/shmem-helper: Remove another errant put in error path drm/sun4i: fix missing component unbind on bind errors drm/i915/active: Fix misuse of non-idle barriers as fence trackers drm/i915/dg2: Add HDMI pixel clock frequencies 267.30 and 319.89 MHz drm/amdgpu: Don't resume IOMMU after incomplete init drm/amd/pm: Fix sienna cichlid incorrect OD volage after resume drm/amd/pm: bump SMU 13.0.4 driver_if header version drm/amd/display: Do not set DRR on pipe Commit drm/amd/display: disconnect MPCC only on OTG change mptcp: fix possible deadlock in subflow_error_report mptcp: add ro_after_init for tcp{,v6}_prot_override mptcp: avoid setting TCP_CLOSE state twice mptcp: fix lockdep false positive in mptcp_pm_nl_create_listen_socket() ftrace: Fix invalid address access in lookup_rec() when index is 0 ocfs2: fix data corruption after failed write nvme-pci: add NVME_QUIRK_BOGUS_NID for Netac NV3000 ice: avoid bonding causing auxiliary plug/unplug under RTNL lock vp_vdpa: fix the crash in hot unplug with vp_vdpa mm/userfaultfd: propagate uffd-wp bit when PTE-mapping the huge zeropage mm: teach mincore_hugetlb about pte markers powerpc/64: Set default CPU in Kconfig powerpc/boot: Don't always pass -mcpu=powerpc when building 32-bit uImage mmc: sdhci_am654: lower power-on failed message severity fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks trace/hwlat: Do not wipe the contents of per-cpu thread data trace/hwlat: Do not start per-cpu thread if it is already running ACPI: PPTT: Fix to avoid sleep in the atomic context when PPTT is absent net: phy: nxp-c45-tja11xx: fix MII_BASIC_CONFIG_REV bit fbdev: Fix incorrect page mapping clearance at fb_deferred_io_release() cpuidle: psci: Iterate backwards over list in psci_pd_remove() ASoC: Intel: soc-acpi: fix copy-paste issue in topology names ASoC: qcom: q6prm: fix incorrect clk_root passed to ADSP x86/mce: Make sure logged MCEs are processed after sysfs update x86/mm: Fix use of uninitialized buffer in sme_enable() x86/resctrl: Clear staged_config[] before and after it is used powerpc: Pass correct CPU reference to assembler virt/coco/sev-guest: Check SEV_SNP attribute at probe time virt/coco/sev-guest: Simplify extended guest request handling virt/coco/sev-guest: Remove the disable_vmpck label in handle_guest_request() virt/coco/sev-guest: Carve out the request issuing logic into a helper virt/coco/sev-guest: Do some code style cleanups virt/coco/sev-guest: Convert the sw_exit_info_2 checking to a switch-case virt/coco/sev-guest: Add throttling awareness io_uring/msg_ring: let target know allocated index perf: Fix check before add_event_to_groups() in perf_group_detach() powerpc: Disable CPU unknown by CLANG when CC_IS_CLANG powerpc/64: Replace -mcpu=e500mc64 by -mcpu=e5500 Linux 6.1.21 Change-Id: I4b7f6e01381c0c121c9e89e51071ea60f1f7e29a Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
|
a22c3a8790 |
Merge 6.1.20 into android14-6.1
Changes in 6.1.20 fs: prevent out-of-bounds array speculation when closing a file descriptor btrfs: fix unnecessary increment of read error stat on write error btrfs: fix percent calculation for bg reclaim message io_uring/uring_cmd: ensure that device supports IOPOLL erofs: fix wrong kunmap when using LZMA on HIGHMEM platforms perf inject: Fix --buildid-all not to eat up MMAP2 fork: allow CLONE_NEWTIME in clone3 flags RISC-V: Stop emitting attributes x86/CPU/AMD: Disable XSAVES on AMD family 0x17 drm/amdgpu: fix error checking in amdgpu_read_mm_registers for soc15 drm/amdgpu: fix error checking in amdgpu_read_mm_registers for soc21 drm/amdgpu: fix error checking in amdgpu_read_mm_registers for nv drm/display: Don't block HDR_OUTPUT_METADATA on unknown EOTF drm/connector: print max_requested_bpc in state debugfs staging: rtl8723bs: Fix key-store index handling staging: rtl8723bs: Pass correct parameters to cfg80211_get_bss() ext4: fix cgroup writeback accounting with fs-layer encryption ext4: fix RENAME_WHITEOUT handling for inline directories ext4: fix another off-by-one fsmap error on 1k block filesystems ext4: move where set the MAY_INLINE_DATA flag is set ext4: fix WARNING in ext4_update_inline_data ext4: zero i_disksize when initializing the bootloader inode HID: core: Provide new max_buffer_size attribute to over-ride the default HID: uhid: Over-ride the default maximum data buffer value with our own nfc: change order inside nfc_se_io error path KVM: VMX: Reset eVMCS controls in VP assist page during hardware disabling KVM: VMX: Don't bother disabling eVMCS static key on module exit KVM: x86: Move guts of kvm_arch_init() to standalone helper KVM: VMX: Do _all_ initialization before exposing /dev/kvm to userspace fs: dlm: fix log of lowcomms vs midcomms fs: dlm: add midcomms init/start functions fs: dlm: start midcomms before scand fs: dlm: remove send repeat remove handling fs: dlm: use packet in dlm_mhandle fd: dlm: trace send/recv of dlm message and rcom fs: dlm: fix use after free in midcomms commit fs: dlm: use WARN_ON_ONCE() instead of WARN_ON() fs: dlm: be sure to call dlm_send_queue_flush() fs: dlm: fix race setting stop tx flag udf: Fix off-by-one error when discarding preallocation bus: mhi: ep: Power up/down MHI stack during MHI RESET bus: mhi: ep: Change state_lock to mutex Input: exc3000 - properly stop timer on shutdown ipmi:ssif: Remove rtc_us_timer ipmi:ssif: Increase the message retry time ipmi:ssif: Add a timer between request retries spi: intel: Check number of chip selects after reading the descriptor drm/i915: Introduce intel_panel_init_alloc() drm/i915: Do panel VBT init early if the VBT declares an explicit panel type drm/i915: Populate encoder->devdata for DSI on icl+ block: Revert "block: Do not reread partition table on exclusively open device" block: fix scan partition for exclusively open device again riscv: Add header include guards to insn.h scsi: core: Remove the /proc/scsi/${proc_name} directory earlier ext4: Fix possible corruption when moving a directory cifs: improve checking of DFS links over STATUS_OBJECT_NAME_INVALID drm/nouveau/kms/nv50: fix nv50_wndw_new_ prototype drm/msm: Fix potential invalid ptr free drm/msm/a5xx: fix setting of the CP_PREEMPT_ENABLE_LOCAL register drm/msm/a5xx: fix highest bank bit for a530 drm/msm/a5xx: fix the emptyness check in the preempt code drm/msm/a5xx: fix context faults during ring switch bgmac: fix *initial* chip reset to support BCM5358 nfc: fdp: add null check of devm_kmalloc_array in fdp_nci_i2c_read_device_properties powerpc: dts: t1040rdb: fix compatible string for Rev A boards tls: rx: fix return value for async crypto drm/msm/dpu: disable features unsupported by QCM2290 ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping() net: lan966x: Fix port police support using tc-matchall selftests: nft_nat: ensuring the listening side is up before starting the client netfilter: nft_last: copy content when cloning expression netfilter: nft_quota: copy content when cloning expression net: tls: fix possible race condition between do_tls_getsockopt_conf() and do_tls_setsockopt_conf() net: use indirect calls helpers for sk_exit_memory_pressure() perf stat: Fix counting when initial delay configured net: lan78xx: fix accessing the LAN7800's internal phy specific registers from the MAC driver net: caif: Fix use-after-free in cfusbl_device_notify() ice: copy last block omitted in ice_get_module_eeprom() bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser() drm/msm/dpu: fix len of sc7180 ctl blocks drm/msm/dpu: drop DPU_DIM_LAYER from MIXER_MSM8998_MASK drm/msm/dpu: fix clocks settings for msm8998 SSPP blocks drm/msm/dpu: clear DSPP reservations in rm release net: stmmac: add to set device wake up flag when stmmac init phy net: phylib: get rid of unnecessary locking bnxt_en: Avoid order-5 memory allocation for TPA data netfilter: ctnetlink: revert to dumping mark regardless of event type netfilter: tproxy: fix deadlock due to missing BH disable m68k: mm: Move initrd phys_to_virt handling after paging_init() btrfs: fix extent map logging bit not cleared for split maps after dropping range bpf, test_run: fix &xdp_frame misplacement for LIVE_FRAMES btf: fix resolving BTF_KIND_VAR after ARRAY, STRUCT, UNION, PTR net: phy: smsc: fix link up detection in forced irq mode net: ethernet: mtk_eth_soc: fix RX data corruption issue net: tls: fix device-offloaded sendpage straddling records scsi: megaraid_sas: Update max supported LD IDs to 240 scsi: sd: Fix wrong zone_write_granularity value during revalidate netfilter: conntrack: adopt safer max chain length platform: mellanox: select REGMAP instead of depending on it platform: x86: MLX_PLATFORM: select REGMAP instead of depending on it block: fix wrong mode for blkdev_put() from disk_scan_partitions() NFSD: Protect against filesystem freezing ice: Fix DSCP PFC TLV creation ethernet: ice: avoid gcc-9 integer overflow warning net/smc: fix fallback failed while sendmsg with fastopen octeontx2-af: Unlock contexts in the queue context cache in case of fault detection SUNRPC: Fix a server shutdown leak net: dsa: mt7530: permit port 5 to work without port 6 on MT7621 SoC af_unix: fix struct pid leaks in OOB support erofs: Revert "erofs: fix kvcalloc() misuse with __GFP_NOFAIL" riscv: Use READ_ONCE_NOCHECK in imprecise unwinding stack mode RISC-V: Don't check text_mutex during stop_machine drm/amdgpu: fix return value check in kfd ext4: Fix deadlock during directory rename drm/amdgpu/soc21: don't expose AV1 if VCN0 is harvested drm/amdgpu/soc21: Add video cap query support for VCN_4_0_4 adreno: Shutdown the GPU properly drm/msm/adreno: fix runtime PM imbalance at unbind watch_queue: fix IOC_WATCH_QUEUE_SET_SIZE alloc error paths tpm/eventlog: Don't abort tpm_read_log on faulty ACPI address MIPS: Fix a compilation issue powerpc/64: Don't recurse irq replay powerpc/iommu: fix memory leak with using debugfs_lookup() clk: renesas: rcar-gen3: Disable R-Car H3 ES1.* powerpc/bpf/32: Only set a stack frame when necessary powerpc/64: Fix task_cpu in early boot when booting non-zero cpuid powerpc/64: Move paca allocation to early_setup() powerpc/kcsan: Exclude udelay to prevent recursive instrumentation alpha: fix R_ALPHA_LITERAL reloc for large modules macintosh: windfarm: Use unsigned type for 1-bit bitfields PCI: Add SolidRun vendor ID scripts: handle BrokenPipeError for python scripts media: ov5640: Fix analogue gain control media: rc: gpio-ir-recv: add remove function drm/amd/display: Allow subvp on vactive pipes that are 2560x1440@60 drm/amd/display: adjust MALL size available for DCN32 and DCN321 filelocks: use mount idmapping for setlease permission check Revert "bpf, test_run: fix &xdp_frame misplacement for LIVE_FRAMES" UML: define RUNTIME_DISCARD_EXIT Linux 6.1.20 Change-Id: I2f92629ce02bc07295fea17b16f9bb567916a285 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
|
7e0ae8667f |
scsi: core: Fix a procfs host directory removal regression
[ Upstream commit be03df3d4bfe7e8866d4aa43d62e648ffe884f5f ] scsi_proc_hostdir_rm() decreases a reference counter and hence must only be called once per host that is removed. This change does not require a scsi_add_host_with_dma() change since scsi_add_host_with_dma() will return 0 (success) if scsi_proc_host_add() is called. Fixes: fc663711b944 ("scsi: core: Remove the /proc/scsi/${proc_name} directory earlier") Cc: John Garry <john.g.garry@oracle.com> Reported-by: John Garry <john.g.garry@oracle.com> Link: https://lore.kernel.org/all/ed6b8027-a9d9-1b45-be8e-df4e8c6c4605@oracle.com/ Reported-by: syzbot+645a4616b87a2f10e398@syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-scsi/000000000000890fab05f65342b6@google.com/ Signed-off-by: Bart Van Assche <bvanassche@acm.org> Link: https://lore.kernel.org/r/20230307214428.3703498-1-bvanassche@acm.org Tested-by: John Garry <john.g.garry@oracle.com> Tested-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org> |
||
|
d2112b18b5 |
scsi: core: Add BLIST_NO_VPD_SIZE for some VDASD
[ Upstream commit 4b1a2c2a8e0ddcb89c5f6c5003bd9b53142f69e3 ] Some storage, such as AIX VDASD (virtual storage) and IBM 2076 (front end), fail as a result of commit |
||
|
0023972a75 |
scsi: mpi3mr: Fix expander node leak in mpi3mr_remove()
[ Upstream commit ce756daa36e1ba271bb3334267295e447aa57a5c ]
Add a missing resource clean up in .remove.
Fixes:
|
||
|
c6260ceea4 |
scsi: mpi3mr: ioctl timeout when disabling/enabling interrupt
[ Upstream commit 02ca7da2919ada525fb424640205110e24646b50 ] As part of Task Management handling, the driver will disable and enable the MSIx index zero which belongs to the Admin reply queue. During this transition the driver loses some interrupts and this leads to Admin request and ioctl timeouts. After enabling the interrupts, poll the Admin reply queue to avoid timeouts. Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com> Signed-off-by: Sreekanth Reddy <sreekanth.reddy@broadcom.com> Link: https://lore.kernel.org/r/20230228140835.4075-2-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Stable-dep-of: ce756daa36e1 ("scsi: mpi3mr: Fix expander node leak in mpi3mr_remove()") Signed-off-by: Sasha Levin <sashal@kernel.org> |
||
|
5aab9342f1 |
scsi: mpi3mr: Fix memory leaks in mpi3mr_init_ioc()
[ Upstream commit c798304470cab88723d895726d17fcb96472e0e9 ]
Don't allocate memory again when IOC is being reinitialized.
Fixes:
|
||
|
705097d52a |
scsi: mpi3mr: Return proper values for failures in firmware init path
[ Upstream commit ba8a9ba41fbde250fd8b0ed1e5dad0dc9318df46 ] Return proper non-zero return values for all the cases when the controller initialization and re-initialization fails. Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com> Signed-off-by: Sreekanth Reddy <sreekanth.reddy@broadcom.com> Link: https://lore.kernel.org/r/20230228140835.4075-5-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Stable-dep-of: c798304470ca ("scsi: mpi3mr: Fix memory leaks in mpi3mr_init_ioc()") Signed-off-by: Sasha Levin <sashal@kernel.org> |
||
|
480aae2f30 |
scsi: mpi3mr: Fix sas_hba.phy memory leak in mpi3mr_remove()
[ Upstream commit d4caa1a4255cc44be56bcab3db2c97c632e6cc10 ]
Free mrioc->sas_hba.phy at .remove.
Fixes:
|
||
|
f28bdab9e2 |
scsi: mpi3mr: Fix mpi3mr_hba_port memory leak in mpi3mr_remove()
[ Upstream commit d0f3c3728da8af76dfe435f7f0cfa2b9d9e43ef0 ]
Free mpi3mr_hba_port at .remove.
Fixes:
|
||
|
dca06ccf13 |
scsi: mpi3mr: Fix config page DMA memory leak
[ Upstream commit 7d2b02172b6a2ae6aecd7ef6480b9c4bf3dc59f4 ]
A fix for:
DMA-API: pci 0000:83:00.0: device driver has pending DMA allocations while released from device [count=1]
Fixes:
|
||
|
574cc10eda |
scsi: mpi3mr: Fix throttle_groups memory leak
[ Upstream commit f305a7b6ca21a665e8d0cf70b5936991a298c93c ]
Add a missing kfree().
Fixes:
|
||
|
b5e5bbb3fa |
scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add()
[ Upstream commit d3c57724f1569311e4b81e98fad0931028b9bdcd ] Port is allocated by sas_port_alloc_num() and rphy is allocated by either sas_end_device_alloc() or sas_expander_alloc(), all of which may return NULL. So we need to check the rphy to avoid possible NULL pointer access. If sas_rphy_add() returned with failure, rphy is set to NULL. We would access the rphy in the following lines which would also result NULL pointer access. Fixes: 78316e9dfc24 ("scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()") Signed-off-by: Wenchao Hao <haowenchao2@huawei.com> Link: https://lore.kernel.org/r/20230225100135.2109330-1-haowenchao2@huawei.com Acked-by: Sathya Prakash Veerichetty <sathya.prakash@broadcom.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org> |
||
|
d956976040 |
Merge 6.1.18 into android14-6.1
Changes in 6.1.18 net/sched: Retire tcindex classifier auxdisplay: hd44780: Fix potential memory leak in hd44780_remove() fs/jfs: fix shift exponent db_agl2size negative driver: soc: xilinx: fix memory leak in xlnx_add_cb_for_notify_event() f2fs: don't rely on F2FS_MAP_* in f2fs_iomap_begin f2fs: fix to avoid potential deadlock objtool: Fix memory leak in create_static_call_sections() soc: mediatek: mtk-pm-domains: Allow mt8186 ADSP default power on memory: renesas-rpc-if: Split-off private data from struct rpcif memory: renesas-rpc-if: Move resource acquisition to .probe() soc: mediatek: mtk-svs: Enable the IRQ later pwm: sifive: Always let the first pwm_apply_state succeed pwm: stm32-lp: fix the check on arr and cmp registers update f2fs: introduce trace_f2fs_replace_atomic_write_block f2fs: correct i_size change for atomic writes f2fs: clear atomic_write_task in f2fs_abort_atomic_write() soc: mediatek: mtk-svs: restore default voltages when svs_init02() fail soc: mediatek: mtk-svs: reset svs when svs_resume() fail soc: mediatek: mtk-svs: Use pm_runtime_resume_and_get() in svs_init01() fs: f2fs: initialize fsdata in pagecache_write() f2fs: allow set compression option of files without blocks f2fs: fix to abort atomic write only during do_exist() um: vector: Fix memory leak in vector_config ubi: ensure that VID header offset + VID header size <= alloc, size ubifs: Fix build errors as symbol undefined ubifs: Fix memory leak in ubifs_sysfs_init() ubifs: Rectify space budget for ubifs_symlink() if symlink is encrypted ubifs: Rectify space budget for ubifs_xrename() ubifs: Fix wrong dirty space budget for dirty inode ubifs: do_rename: Fix wrong space budget when target inode's nlink > 1 ubifs: Reserve one leb for each journal head while doing budget ubi: Fix use-after-free when volume resizing failed ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume() ubifs: Fix memory leak in alloc_wbufs() ubi: Fix possible null-ptr-deref in ubi_free_volume() ubifs: Re-statistic cleaned znode count if commit failed ubifs: dirty_cow_znode: Fix memleak in error handling path ubifs: ubifs_writepage: Mark page dirty after writing inode failed ubifs: ubifs_releasepage: Remove ubifs_assert(0) to valid this process ubi: fastmap: Fix missed fm_anchor PEB in wear-leveling after disabling fastmap ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show() ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed f2fs: fix to avoid potential memory corruption in __update_iostat_latency() soc: qcom: stats: Populate all subsystem debugfs files ext4: use ext4_fc_tl_mem in fast-commit replay path ext4: don't show commit interval if it is zero netfilter: nf_tables: allow to fetch set elements when table has an owner x86: um: vdso: Add '%rcx' and '%r11' to the syscall clobber list um: virtio_uml: free command if adding to virtqueue failed um: virtio_uml: mark device as unregistered when breaking it um: virtio_uml: move device breaking into workqueue um: virt-pci: properly remove PCI device from bus f2fs: synchronize atomic write aborts watchdog: rzg2l_wdt: Issue a reset before we put the PM clocks watchdog: rzg2l_wdt: Handle TYPE-B reset for RZ/V2M watchdog: at91sam9_wdt: use devm_request_irq to avoid missing free_irq() in error path watchdog: Fix kmemleak in watchdog_cdev_register watchdog: pcwd_usb: Fix attempting to access uninitialized memory watchdog: sbsa_wdog: Make sure the timeout programming is within the limits netfilter: ctnetlink: fix possible refcount leak in ctnetlink_create_conntrack() netfilter: conntrack: fix rmmod double-free race netfilter: ip6t_rpfilter: Fix regression with VRF interfaces netfilter: ebtables: fix table blob use-after-free netfilter: xt_length: use skb len to match in length_mt6 netfilter: ctnetlink: make event listener tracking global netfilter: x_tables: fix percpu counter block leak on error path when creating new netns ptp: vclock: use mutex to fix "sleep on atomic" bug drm/i915: move a Kconfig symbol to unbreak the menu presentation ipv6: Add lwtunnel encap size of all siblings in nexthop calculation octeontx2-pf: Recalculate UDP checksum for ptp 1-step sync packet net: sunhme: Fix region request sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop octeontx2-pf: Use correct struct reference in test condition net: fix __dev_kfree_skb_any() vs drop monitor 9p/xen: fix version parsing 9p/xen: fix connection sequence 9p/rdma: unmap receive dma buffer in rdma_request()/post_recv() spi: tegra210-quad: Fix validate combined sequence mlx5: fix skb leak while fifo resync and push mlx5: fix possible ptp queue fifo use-after-free net/mlx5: ECPF, wait for VF pages only after disabling host PFs net/mlx5e: Verify flow_source cap before using it net/mlx5: Geneve, Fix handling of Geneve object id as error code ext4: fix incorrect options show of original mount_opt and extend mount_opt2 nfc: fix memory leak of se_io context in nfc_genl_se_io net/sched: transition act_pedit to rcu and percpu stats net/sched: act_pedit: fix action bind logic net/sched: act_mpls: fix action bind logic net/sched: act_sample: fix action bind logic net: dsa: seville: ignore mscc-miim read errors from Lynx PCS net: dsa: felix: fix internal MDIO controller resource length ARM: dts: spear320-hmi: correct STMPE GPIO compatible tcp: tcp_check_req() can be called from process context vc_screen: modify vcs_size() handling in vcs_read() spi: tegra210-quad: Fix iterator outside loop rtc: sun6i: Always export the internal oscillator genirq/ipi: Fix NULL pointer deref in irq_data_get_affinity_mask() scsi: ipr: Work around fortify-string warning scsi: mpi3mr: Fix an issue found by KASAN scsi: mpi3mr: Use number of bits to manage bitmap sizes rtc: allow rtc_read_alarm without read_alarm callback io_uring: fix size calculation when registering buf ring loop: loop_set_status_from_info() check before assignment ASoC: adau7118: don't disable regulators on device unbind ASoC: apple: mca: Fix final status read on SERDES reset ASoC: apple: mca: Fix SERDES reset sequence ASoC: apple: mca: Improve handling of unavailable DMA channels nvme: bring back auto-removal of deleted namespaces during sequential scan nvme-tcp: don't access released socket during error recovery nvme-fabrics: show well known discovery name ASoC: zl38060 add gpiolib dependency ASoC: mediatek: mt8195: add missing initialization thermal: intel: quark_dts: fix error pointer dereference thermal: intel: BXT_PMIC: select REGMAP instead of depending on it tracing: Add NULL checks for buffer in ring_buffer_free_read_page() kernel/printk/index.c: fix memory leak with using debugfs_lookup() firmware/efi sysfb_efi: Add quirk for Lenovo IdeaPad Duet 3 bootconfig: Increase max nodes of bootconfig from 1024 to 8192 for DCC support mfd: arizona: Use pm_runtime_resume_and_get() to prevent refcnt leak IB/hfi1: Update RMT size calculation iommu/amd: Fix error handling for pdev_pri_ats_enable() PCI/ACPI: Account for _S0W of the target bridge in acpi_pci_bridge_d3() media: uvcvideo: Remove format descriptions media: uvcvideo: Handle cameras with invalid descriptors media: uvcvideo: Handle errors from calls to usb_string media: uvcvideo: Quirk for autosuspend in Logitech B910 and C910 media: uvcvideo: Silence memcpy() run-time false positive warnings USB: fix memory leak with using debugfs_lookup() cacheinfo: Fix shared_cpu_map to handle shared caches at different levels staging: emxx_udc: Add checks for dma_alloc_coherent() tty: fix out-of-bounds access in tty_driver_lookup_tty() tty: serial: fsl_lpuart: disable the CTS when send break signal serial: sc16is7xx: setup GPIO controller later in probe mei: bus-fixup:upon error print return values of send and receive tools/iio/iio_utils:fix memory leak bus: mhi: ep: Fix the debug message for MHI_PKT_TYPE_RESET_CHAN_CMD cmd iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_status_word() iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_config_word() media: uvcvideo: Add GUID for BGRA/X 8:8:8:8 soundwire: bus_type: Avoid lockdep assert in sdw_drv_probe() PCI: loongson: Prevent LS7A MRRS increases staging: pi433: fix memory leak with using debugfs_lookup() USB: dwc3: fix memory leak with using debugfs_lookup() USB: chipidea: fix memory leak with using debugfs_lookup() USB: ULPI: fix memory leak with using debugfs_lookup() USB: uhci: fix memory leak with using debugfs_lookup() USB: sl811: fix memory leak with using debugfs_lookup() USB: fotg210: fix memory leak with using debugfs_lookup() USB: isp116x: fix memory leak with using debugfs_lookup() USB: isp1362: fix memory leak with using debugfs_lookup() USB: gadget: gr_udc: fix memory leak with using debugfs_lookup() USB: gadget: bcm63xx_udc: fix memory leak with using debugfs_lookup() USB: gadget: lpc32xx_udc: fix memory leak with using debugfs_lookup() USB: gadget: pxa25x_udc: fix memory leak with using debugfs_lookup() USB: gadget: pxa27x_udc: fix memory leak with using debugfs_lookup() usb: host: xhci: mvebu: Iterate over array indexes instead of using pointer math USB: ene_usb6250: Allocate enough memory for full object usb: uvc: Enumerate valid values for color matching usb: gadget: uvc: Make bSourceID read/write PCI: Align extra resources for hotplug bridges properly PCI: Take other bus devices into account when distributing resources PCI: Distribute available resources for root buses, too tty: pcn_uart: fix memory leak with using debugfs_lookup() misc: vmw_balloon: fix memory leak with using debugfs_lookup() drivers: base: component: fix memory leak with using debugfs_lookup() drivers: base: dd: fix memory leak with using debugfs_lookup() kernel/fail_function: fix memory leak with using debugfs_lookup() PCI: loongson: Add more devices that need MRRS quirk PCI: Add ACS quirk for Wangxun NICs PCI: pciehp: Add Qualcomm quirk for Command Completed erratum phy: rockchip-typec: Fix unsigned comparison with less than zero RDMA/cma: Distinguish between sockaddr_in and sockaddr_in6 by size iommu: Attach device group to old domain in error path soundwire: cadence: Remove wasted space in response_buf soundwire: cadence: Drain the RX FIFO after an IO timeout net: tls: avoid hanging tasks on the tx_lock x86/resctl: fix scheduler confusion with 'current' vDPA/ifcvf: decouple hw features manipulators from the adapter vDPA/ifcvf: decouple config space ops from the adapter vDPA/ifcvf: alloc the mgmt_dev before the adapter vDPA/ifcvf: decouple vq IRQ releasers from the adapter vDPA/ifcvf: decouple config IRQ releaser from the adapter vDPA/ifcvf: decouple vq irq requester from the adapter vDPA/ifcvf: decouple config/dev IRQ requester and vectors allocator from the adapter vDPA/ifcvf: ifcvf_request_irq works on ifcvf_hw vDPA/ifcvf: manage ifcvf_hw in the mgmt_dev vDPA/ifcvf: allocate the adapter in dev_add() drm/display/dp_mst: Add drm_atomic_get_old_mst_topology_state() drm/display/dp_mst: Fix down/up message handling after sink disconnect drm/display/dp_mst: Fix down message handling after a packet reception error drm/display/dp_mst: Fix payload addition on a disconnected sink drm/i915/dp_mst: Add the MST topology state for modesetted CRTCs drm/i915: Fix system suspend without fbdev being initialized media: uvcvideo: Fix race condition with usb_kill_urb io_uring: fix two assignments in if conditions io_uring/poll: allow some retries for poll triggering spuriously arm64: efi: Make efi_rt_lock a raw_spinlock arm64: mte: Fix/clarify the PG_mte_tagged semantics arm64: Reset KASAN tag in copy_highpage with HW tags only usb: gadget: uvc: fix missing mutex_unlock() if kstrtou8() fails Linux 6.1.18 Change-Id: Icb8e56528d481a17780bdd517c69efa9e76b94c0 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
|
b26b85b184 |
scsi: sd: Fix wrong zone_write_granularity value during revalidate
[ Upstream commit 288b3271d920c9ba949c3bab0f749f4cecc70e09 ]
When the sd driver revalidates host-managed SMR disks, it calls
disk_set_zoned() which changes the zone_write_granularity attribute value
to the logical block size regardless of the device type. After that, the sd
driver overwrites the value in sd_zbc_read_zone() with the physical block
size, since ZBC/ZAC requires this for host-managed disks. Between the calls
to disk_set_zoned() and sd_zbc_read_zone(), there exists a window where the
attribute shows the logical block size as the zone_write_granularity value,
which is wrong for host-managed disks. The duration of the window is from
20ms to 200ms, depending on report zone command execution time.
To avoid the wrong zone_write_granularity value between disk_set_zoned()
and sd_zbc_read_zone(), modify the value not in sd_zbc_read_zone() but
just after disk_set_zoned() call.
Fixes:
|
||
|
8f45d2f32c |
scsi: megaraid_sas: Update max supported LD IDs to 240
[ Upstream commit bfa659177dcba48cf13f2bd88c1972f12a60bf1c ]
The firmware only supports Logical Disk IDs up to 240 and LD ID 255 (0xFF)
is reserved for deleted LDs. However, in some cases, firmware was assigning
LD ID 254 (0xFE) to deleted LDs and this was causing the driver to mark the
wrong disk as deleted. This in turn caused the wrong disk device to be
taken offline by the SCSI midlayer.
To address this issue, limit the LD ID range from 255 to 240. This ensures
the deleted LD ID is properly identified and removed by the driver without
accidently deleting any valid LDs.
Fixes:
|
||
|
17e98a5ede |
scsi: core: Remove the /proc/scsi/${proc_name} directory earlier
[ Upstream commit fc663711b94468f4e1427ebe289c9f05669699c9 ] Remove the /proc/scsi/${proc_name} directory earlier to fix a race condition between unloading and reloading kernel modules. This fixes a bug introduced in 2009 by commit |
||
|
815c633905 |
UPSTREAM: scsi: core: Extend struct scsi_exec_args
Allow SCSI LLDs to specify SCMD_* flags. Link: https://lore.kernel.org/r/20230210193258.4004923-2-bvanassche@acm.org Cc: Mike Christie <michael.christie@oracle.com> Cc: John Garry <john.g.garry@oracle.com> Reviewed-by: John Garry <john.g.garry@oracle.com> Change-Id: I28215cedc9e4f5686d5f6ba802830bb12c144b51 Signed-off-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Bug: 267974767 (cherry picked from commit 35cd2f5542df569122d48caf606b972642012c50) Signed-off-by: Bart Van Assche <bvanassche@google.com> |
||
|
59c7d1f081 |
UPSTREAM: scsi: cxlflash: Convert to scsi_execute_cmd()
scsi_execute() is going to be removed. Convert cxlflash to use scsi_execute_cmd(). [mkp: roll in fix for issue reported by sfr] Change-Id: Id365f87ef9acc61930c782e0ed614f9ab9eec46a Signed-off-by: Mike Christie <michael.christie@oracle.com> Reviewed-by: John Garry <john.g.garry@oracle.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> (cherry picked from commit 1035c9893f15e801456dddd547ea52ae8f6a1e1f) Signed-off-by: Bart Van Assche <bvanassche@google.com> |
||
|
9eba6a6249 |
UPSTREAM: scsi: virtio_scsi: Convert to scsi_execute_cmd()
scsi_execute_req() is going to be removed. Convert virtio_scsi to scsi_execute_cmd(). Change-Id: Icc3a3efedcdc2907628491a51dc2d5ee03b54c98 Signed-off-by: Mike Christie <michael.christie@oracle.com> Reviewed-by: John Garry <john.g.garry@oracle.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Bug: 267974767 (cherry picked from commit 5314ce761fbf3bef2b5aae5e5562e782a5026e7c) Signed-off-by: Bart Van Assche <bvanassche@google.com> |
||
|
ea6129a8ea |
UPSTREAM: scsi: sr: Convert to scsi_execute_cmd()
scsi_execute*() is going to be removed. Convert sr to scsi_execute_cmd(). Change-Id: I3049c213efafb6ca549013ca680d647c9939a7c0 Signed-off-by: Mike Christie <michael.christie@oracle.com> Reviewed-by: John Garry <john.g.garry@oracle.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Bug: 267974767 (cherry picked from commit 49d33b6245d91a2ca20755cd4edf86dd0e49649e) Signed-off-by: Bart Van Assche <bvanassche@google.com> |
||
|
2c2df7e407 |
UPSTREAM: scsi: ses: Convert to scsi_execute_cmd()
scsi_execute_req() is going to be removed. Convert ses to scsi_execute_cmd(). Change-Id: I250f75f61f6393f10552b40d90c4fa1453b99e8a Signed-off-by: Mike Christie <michael.christie@oracle.com> Reviewed-by: John Garry <john.g.garry@oracle.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Bug: 267974767 (cherry picked from commit ae4145a5f25e56b0248b38f913c5cc370cde723a) Signed-off-by: Bart Van Assche <bvanassche@google.com> |
||
|
ae1dc46256 |
UPSTREAM: scsi: zbc: Convert to scsi_execute_cmd()
scsi_execute_req() is going to be removed. Conver zbc to scsi_execute_cmd(). Change-Id: Ie1dbd3aa3e703ee8ac570f5c91c5222bf9bb4355 Signed-off-by: Mike Christie <michael.christie@oracle.com> Reviewed-by: John Garry <john.g.garry@oracle.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Bug: 267974767 (cherry picked from commit 6ff236e847aa7817a985122ccef7e0f422eb8564) Signed-off-by: Bart Van Assche <bvanassche@google.com> |
||
|
b99bb6eefb |
UPSTREAM: scsi: sd: Convert to scsi_execute_cmd()
scsi_execute*() is going to be removed. Convert sd_mod to use scsi_execute_cmd(). Change-Id: Ib5c52dff6d96fb2e0d1355b4c1e0065e1b2bebeb Signed-off-by: Mike Christie <michael.christie@oracle.com> Reviewed-by: John Garry <john.g.garry@oracle.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Bug: 267974767 (cherry picked from commit af16cd63d9d3b790ecfce3c053595a98f181e025) Signed-off-by: Bart Van Assche <bvanassche@google.com> |
||
|
7634111c5e |
UPSTREAM: scsi: spi: Convert to scsi_execute_cmd()
scsi_execute() is going to be removed. Convert to the SPI class to scsi_execute_cmd(). Change-Id: I4947e5681e82586206187f485d99384719dd67b3 Signed-off-by: Mike Christie <michael.christie@oracle.com> Reviewed-by: John Garry <john.g.garry@oracle.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Bug: 267974767 (cherry picked from commit c9ee828aad6919b7eee7ef2059489c7221edf68a) Signed-off-by: Bart Van Assche <bvanassche@google.com> |
||
|
2aafdd0d89 |
UPSTREAM: scsi: core: Convert to scsi_execute_cmd()
scsi_execute_req() is going to be removed. Convert SCSI midlayer to scsi_execute_cmd(). Change-Id: Ic2449be3b1c8ceae13c7913c717f380902f73150 Signed-off-by: Mike Christie <michael.christie@oracle.com> Reviewed-by: John Garry <john.g.garry@oracle.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Bug: 267974767 (cherry picked from commit 7dfe0b5e7ca67c659475883712c1d0449f900f9c) Signed-off-by: Bart Van Assche <bvanassche@google.com> |