kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-14 05:55:17 +00:00
Code Issues Releases Packages Activity
1,171,272 commits 116 branches 5,791 tags 5.6 GiB
Commit graph

1,171,272 commits

This branch
This branch
All branches
Author SHA1 Message Date
Ruihan Li
1a261a6e10 scripts: Remove ICC-related dead code 
Intel compiler support has already been completely removed in commit
95207db816 ("Remove Intel compiler support").  However, it appears
that there is still some ICC-related code in scripts/cc-version.sh.
There is no harm in leaving the code as it is, but removing the dead
code makes the codebase a bit cleaner.

Hopefully all ICC-related stuff in the build scripts will be removed
after this commit, given the grep output as below:

	(linux/scripts) $ grep -i -w -R 'icc'
	cc-version.sh:ICC)
	cc-version.sh:	min_version=$($min_tool_version icc)
	dtc/include-prefixes/arm64/qcom/sm6350.dtsi:#include <dt-bindings/interconnect/qcom,icc.h>

Fixes: 95207db816 ("Remove Intel compiler support")
Signed-off-by: Ruihan Li <lrh2000@pku.edu.cn>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Reviewed-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
 2023-04-24 10:18:32 -07:00
Linus Torvalds
457391b038 Linux 6.3 v6.3 2023-04-23 12:02:52 -07:00
Linus Torvalds
0da6e5fd6c gcc: disable '-Warray-bounds' for gcc-13 too 
We started disabling '-Warray-bounds' for gcc-12 originally on s390,
because it resulted in some warnings that weren't realistically fixable
(commit 8b202ee218: "s390: disable -Warray-bounds").

That s390-specific issue was then found to be less common elsewhere, but
generic (see f0be87c42c: "gcc-12: disable '-Warray-bounds' universally
for now"), and then later expanded the version check was expanded to
gcc-11 (5a41237ad1: "gcc: disable -Warray-bounds for gcc-11 too").

And it turns out that I was much too optimistic in thinking that it's
all going to go away, and here we are with gcc-13 showing all the same
issues.  So instead of expanding this one version at a time, let's just
disable it for gcc-11+, and put an end limit to it only when we actually
find a solution.

Yes, I'm sure some of this is because the kernel just does odd things
(like our "container_of()" use, but also knowingly playing games with
things like linker tables and array layouts).

And yes, some of the warnings are likely signs of real bugs, but when
there are hundreds of false positives, that doesn't really help.

Oh well.

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
 2023-04-23 09:56:20 -07:00
Linus Torvalds
8296ac9256 Kbuild fixes for v6.3 (4th) 
- Fix the prefix in the kernel source tarball
 
  - Fix a typo in the copyright file in Debian package
 -----BEGIN PGP SIGNATURE-----
 
 iQJJBAABCgAzFiEEbmPs18K1szRHjPqEPYsBB53g2wYFAmRFJkAVHG1hc2FoaXJv
 eUBrZXJuZWwub3JnAAoJED2LAQed4NsGD2MP/jj9Ct+0Bw7hnahOtACVfF7+Vgnp
 E5RljzGA27ltSJP3WVq2zTofRVFpELWaOjsCITptMxbBOQ/eYy40gnG8TrVLsRw3
 Vf0bDJphNNrzR2OLhpSzBsOEDMY76TL7uDFx6I6QMftrmBMeSVYnCHg1uvQSwsNq
 5c473yNYimPQHtcy+UT40BPyE+bBuBw1f2OSGE2KeSXYw/56emICS5DkfkygWAqB
 6qZeifGlde1gu2FOmiuAAORsp7utMxDSR/2bfTRUbW3SFfBB9k7q3OhRIpe8QwRB
 BsQ4wGwwclA5YYbaNEMhXyUj1xs6dQuyPCDicGNSG2F+l1R/6baFOfzSHUtb/YNX
 N7fGFuq50y7P/FdHO74YdKnhfkJ2ZtakyqiGvrfAYSfGKEQUn0lUqy96mo6kv2Ec
 cZn+CJIZB1B04ZCjkyw2g0mnmHRw7XGOBi70IadNfFXbB7XTFF7J/M7NslgyXHkV
 97khKv9wdliW7dChcaDXa2TeWFPK6NDZDelUrkobzFPv4x/MbjfnTJmS2wIf2a7F
 b03/hr1/fLg2jrZw5z+uF566uaDBTi7l12x/fNLvCM8XnejTJk8Z7uVgZl3RNT6y
 bYZFRLqHTZfnGVha42Tc9DqiZvX3Hiv0U1Mv8WmIB0Niris++z4SBV8h3NjOOFzf
 R+yzggvF28pjxX3c
 =CqGk
 -----END PGP SIGNATURE-----

Merge tag 'kbuild-fixes-v6.3-4' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild

Pull Kbuild fixes from Masahiro Yamada:

 - Fix the prefix in the kernel source tarball

 - Fix a typo in the copyright file in Debian package

* tag 'kbuild-fixes-v6.3-4' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild:
  kbuild: use proper prefix for tarballs to fix rpm-pkg build error
  kbuild: deb-pkg: Fix a spell typo in mkdebian script
 2023-04-23 08:22:25 -07:00
Linus Torvalds
5ad250f1fe - Remove an over-zealous sanity check of the array of MSI-X vectors to 
be allocated for a device
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmRFBfsACgkQEsHwGGHe
 VUrwug//Q3850CPw+Sm+DuAL6LNFr8GXDigD/nkhJqPzm2cj7yIr8L4QmFVQAhXt
 2ikyaZtBTVoTmCr2UsdaX5z11wYWxzMBaZGKQS7tUXnKwiIntzadpC7/0F/69y6I
 DMHsCkPrxxOCScriEcH6Tt70SPXBp1zsO7fKFRnGOQiuesoRcBVJz8t9thpUrzfH
 G18BmeIYGd4NoAJg+WOp4EXGLix0uy/ghb03bUCs1UGFAUIy+C7AZFWK4LcXhhS8
 fOiJl1hcvV98RUwO3PWNtxB2c9/E62t9Xc/rAKMjgCCM7dbHxCY0Ftiw0dmcX8ne
 T+7IBTHlsk7iywXCB5xrj52YJoIUI+dgmtvUwMZVwRPK27KjQCZsb9x6sSgmULCz
 ObGWU1ZUPNE9n1NhMD4U2F9avznONeiJhfC7HhP+5TkIr3pIUz7ZdUCsFYUuQ1N6
 nVjndY92ja0WVSxth4uOs2PSsf4o0IbP9owcABdOHvPPFt+CR7szSOYoQ2dXBHZl
 R06h/ZOoKz4bMG/n8JOcjK1IKokx/pU1vt3YAJo6RSR/9VdcZIEt/XuQftLT5A0F
 EzNzBRvsywytvU7X13/ZIEPz7/6Anp78CisrgYcUIbQFhNmQ2ae+9ns48GLBzrx8
 Mf+amryuHA+g+5duDFXi5f0jGH4rTD8PMTYv92nhPtrXyvJtiOw=
 =Vg8O
 -----END PGP SIGNATURE-----

Merge tag 'irq_urgent_for_v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull irq fix from Borislav Petkov:

 - Remove an over-zealous sanity check of the array of MSI-X vectors to
   be allocated for a device

* tag 'irq_urgent_for_v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  PCI/MSI: Remove over-zealous hardware size check in pci_msix_validate_entries()
 2023-04-23 08:15:33 -07:00
Linus Torvalds
97249f05b2 - Fix for older binutils which do not support C-syntax constant suffixes 
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmRFAOwACgkQEsHwGGHe
 VUolgQ/8CNUX+kQPZf+IucQx/YWiY2fNtGjJ+mQ1jlYWZYFVicm9S4LLxyAK/lZf
 usr6pDEHLHDI2LYbLUQAVCM+GDmkxD9mQYC/vJ6REXD4lW8eTAq3Bgmkxbn80fMR
 wRxO5HHRHU9ZypMstjmaoLiuAJ7OFH7DtHmQqhlcxV/5IIFu72DLssg9XCNhfODR
 Usr4B2ADTc1v87RBLx61X5yk8sam7KSj/ehkJvp5Z8TgvJQczLGha3R7MNC+/oXd
 O7oT2+9Py49nmzJhMrzjmdPgxVipVLxvfG/Lo0GbdVm6rSrvip1tPef+CgTPvca9
 jGuyU451yKaWpS5xwvXja0/SOoqGqbBWN9Xx9MqoZHsJIRIeDcohp1GeK7TOAodw
 0TSD1RfpZUlxLeASpFYNAZYnAEHpuHAxnSMfNQV/bJjXqGYAVXJIZ8NIx6nemkSG
 U8dBGMox8N+kjJe+A5MY8fQXqbE/SUA6+jA+wZ1OIZvQ4iwLSlrgnACquNVR7xSP
 0y+p3g+vhFdObsV1zJ16rlU3jgm7Ijcy5+whbpY/NKxIldXbFCUPKecfXP8ey4Zu
 Agb1dZVR3Af92Tn2JNFeKQP0p2iclLm38Tl/6z5F4+ewYj2N6acWVjr2mahoUOQL
 6N/cisWEZSlGGUhLSarxjEpf6XE7R0EhhjxSyIerRF55Bx28OEg=
 =C7ft
 -----END PGP SIGNATURE-----

Merge tag 'x86_urgent_for_v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull x86 fix from Borislav Petkov

 - Fix for older binutils which do not support C-syntax constant
   suffixes

* tag 'x86_urgent_for_v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/alternatives: Do not use integer constant suffixes in inline asm
 2023-04-23 08:03:57 -07:00
Linus Torvalds
d6b78224c6 Input updates for v6.3-rc7 
- a check in pegasus-notetaker driver to validate the type of pipe
   when probing a new device
 
 - a fix for Cypress touch controller to correctly parse maximum
   number of touches.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQST2eWILY88ieB2DOtAj56VGEWXnAUCZES2XAAKCRBAj56VGEWX
 nAp4AP9zjIdcs9G0d+1Peo8oS82ef2Fo0MJIAvelmRqc972a6AEA+t3yjwzjphmA
 2A7cSw3H3n82oQvdN9pjDPHCbBg7uQ0=
 =Yv1r
 -----END PGP SIGNATURE-----

Merge tag 'input-for-v6.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input

Pull input fixes from Dmitry Torokhov:

 - a check in pegasus-notetaker driver to validate the type of pipe when
   probing a new device

 - a fix for Cypress touch controller to correctly parse maximum number
   of touches.

* tag 'input-for-v6.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: cyttsp5 - fix sensing configuration data structure
  Input: pegasus-notetaker - check pipe type when probing
 2023-04-23 07:46:52 -07:00
Masahiro Yamada
9cedc5e89a kbuild: use proper prefix for tarballs to fix rpm-pkg build error 
Since commit f8d94c4e40 ("kbuild: do not create intermediate *.tar
for source tarballs"), 'make rpm-pkg' fails because the prefix of the
source tarball is 'linux.tar/' instead of 'linux/'. $(basename $@)
strips only '.gz' from the filename linux.tar.gz.

You need to strip two suffixes from compressed tarballs and one suffix
from uncompressed tarballs (for example 'perf-6.3.0.tar' generated by
'make perf-tar-src-pkg').

One tricky fix might be --prefix=$(firstword $(subst .tar, ,$@))/
but I think it is better to hard-code the prefix.

Fixes: f8d94c4e40 ("kbuild: do not create intermediate *.tar for source tarballs")
Reported-by: Jiwei Sun <sunjw10@lenovo.com>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Reviewed-by: Nicolas Schier <nicolas@fjasle.eu>
 2023-04-23 21:23:10 +09:00
Woody Suwalski
8b824220bd kbuild: deb-pkg: Fix a spell typo in mkdebian script 
Signed-off-by: Woody Suwalski <terraluna977@gmail.com>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
 2023-04-23 21:23:10 +09:00
Linus Torvalds
622322f53c Fix for link errors 
-----BEGIN PGP SIGNATURE-----
 
 iQJOBAABCAA4FiEEbt46xwy6kEcDOXoUeZbBVTGwZHAFAmRET60aHHRzYm9nZW5k
 QGFscGhhLmZyYW5rZW4uZGUACgkQeZbBVTGwZHBE3Q//Qyy4dfHcP1gwZCzg1DbG
 Y5pqMk3a605dMdLTmpN3nmdpXXt/D1gP2vgU0vjJkbVfN3j6ugFE+i8gvDwBT2VT
 uSXoFgABAyofT/WOa74HfpEcY0gCcS5kRrPTVm7xYFM8asGM7xGyKClgoYzsUB+X
 zFI6OChMFe+cgPwDilJ1BTmXqjO1BU/AqjfhGg+vuj9ZlM/mfVBx0wkFqnXYC6O6
 RLCQgzPrziLFqmn+2ItPVZ5cbO6sypijtaALUHEFdL9Ssg5APhFonkGM9XQspZpk
 vZcTf/XFUrudWZnrmN7D9qdlNruWZ71UyHOARc2Wu9iEGyOc5/rWyfDcZHNu6zfh
 qgkNADUp0O5XvMgw4FrPiWQDArSXXj4hMxY7/SyIGkd/jWHV3t3H+SYz13d2sujA
 jAz4MxrNuuwRy4y3Y9terGEkXaS3MpFBm6kHKpiNSV9hKWZJdiTeGWP4mpqttnel
 +maLxuypEjYGICAH57jh/q+zceTzukB+XDutqXfNtFFYMcvNCPut8mZ+E5SQJ7Kj
 e3nx/GTP2uA49jEKslb74fO4wqDU4u64/Vah3csJUO+41DuJ1tZJ/hN0s4oafFlm
 8pSuHjP7z3mtbFGePP5aVoVCjMp5hRTj7jHNAB6TeQ4ZlPb8zelHwLRqTmnk4JPt
 FyllW3ZKi3M51jasDg+JRNY=
 =oY9Y
 -----END PGP SIGNATURE-----

Merge tag 'mips-fixes_6.3_2' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux

Pull MIPS fix from Thomas Bogendoerfer:
 "Fix for link errors"

* tag 'mips-fixes_6.3_2' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux:
  MIPS: Define RUNTIME_DISCARD_EXIT in LD script
 2023-04-22 19:11:47 -07:00
Linus Torvalds
2caeeb9d4a Two serious ARM fixes: 
* Plug a buffer overflow due to the use of the user-provided register
   width for firmware regs. Outright reject accesses where the
   user register width does not match the kernel representation.
 
 * Protect non-atomic RMW operations on vCPU flags against preemption,
   as an update to the flags by an intervening preemption could be lost.
 -----BEGIN PGP SIGNATURE-----
 
 iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmRDIaMUHHBib256aW5p
 QHJlZGhhdC5jb20ACgkQv/vSX3jHroN7Hwf+Pjf7eQ6YZJdmG/4ySbEHJwml1MoW
 KxZn6aODWlxhSj7AtQMpvw0+HoGOoOPE0dV4GOMOqh9P/i0gwFOHtmhFczssyxgY
 WwjoW3JEuYZYJ7v1uhUVR0aQvKsTplNsW2tnD6WvneV+YbGgSDc7QRH3FbP7wOow
 /tsCerEuNLr7aQP5PdYnnbGQ/YyVKCX/Z0iuENa1tNn9T4/fVlzzMXNzCnrUAFp4
 bOEDmgZNDfJRT626Yg8HiLsVB2Dwkbxo1u1d4JP2x+/7Gl38RPSSX7y6e3EQ1rdO
 Ttb/2JD5iLhtNShCY0JbPR/rsGd8cTFZn1odpnXd+PRu+OOvStSEFcdx3g==
 =XhSQ
 -----END PGP SIGNATURE-----

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm

Pull kvm fixes from Paolo Bonzini:
 "Two serious ARM fixes:

   - Plug a buffer overflow due to the use of the user-provided register
     width for firmware regs. Outright reject accesses where the user
     register width does not match the kernel representation.

   - Protect non-atomic RMW operations on vCPU flags against preemption,
     as an update to the flags by an intervening preemption could be
     lost"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
  KVM: arm64: Fix buffer overflow in kvm_arm_set_fw_reg()
  KVM: arm64: Make vcpu flag updates non-preemptible
 2023-04-22 09:27:46 -07:00
Linus Torvalds
84ebdb8e0d three small smb3 client fixes 
-----BEGIN PGP SIGNATURE-----
 
 iQGzBAABCgAdFiEE6fsu8pdIjtWE/DpLiiy9cAdyT1EFAmRDSFEACgkQiiy9cAdy
 T1FUiQwAr0/Di4S4U5XDZNDdW9/4qFqI95ciShsIFb6cXtMQeauTImOp5zDEaW2x
 mn31RZSIMDK+Ljximh4W2phH+5k47K51tVXetWCVOHIPBc1h4AUAz5XmhChtirJ9
 seqhPx2wIi+4TH3gvKkc8xxmZ6HMfZ+F7nuc72eZ1rnO91VoLRywpACItKO2Q8Vu
 XSGMgjiaP0KshyxIcBwKXxHjnaOBF6nBBENU/sHkNZNRngzi/+Xcr371eijbs8Ay
 hk7RPnH04uOYwkFs+9gFpSyYtkdn9iTaPScYWE9UDTeZl8xuQJnGlGXQ1CEZHfkh
 OBzb2/UCX77ggnuFyukP8e5ZsrdGEaotjYgmsb7s7BO9eqAcBRp31SKhIbvIZvTG
 IBLBtWFNSvdoKk1EUvu2iKHxcGcZ3EFjLTmx5pwcAwmBLp+UM/i+IcxvS+b2uPif
 mVIzsXPRI6yi9uJ7PPqtBlkhNrwNk4cfs1hkeXOqN7XGBaQjx89wydMGJDF9otse
 BsNDDXmF
 =KXCn
 -----END PGP SIGNATURE-----

Merge tag '6.3-rc7-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6

Pull cifs fixes from Steve French:
 "Three small smb3 client fixes:

   - two important fixes for unbuffered read regression with the
     iov_iter changes (e.g. read soon after mount in some multichannel
     scenarios)

   - DFS prefix path fix (also for stable)"

* tag '6.3-rc7-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6:
  cifs: Reapply lost fix from commit 30b2b2196d
  cifs: Fix unbuffered read
  cifs: avoid dup prefix path in dfs_get_automount_devname()
 2023-04-22 09:18:35 -07:00
Paolo Bonzini
265b97cbc2 KVM/arm64 fixes for 6.3, part #4 
- Plug a buffer overflow due to the use of the user-provided register
    width for firmware regs. Outright reject accesses where the
    user register width does not match the kernel representation.
 
  - Protect non-atomic RMW operations on vCPU flags against preemption,
    as an update to the flags by an intervening preemption could be lost.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQSNXHjWXuzMZutrKNKivnWIJHzdFgUCZEALwAAKCRCivnWIJHzd
 Fq2nAQDPwWpuMOrQYZCM5RF5/8yai5OPKB0NcvK00UDM4f6E1AEAxDud/KT9i15c
 dmBfGn1zDzW4XAENrOkxjQWuBqi/tQg=
 =Lxvf
 -----END PGP SIGNATURE-----

Merge tag 'kvmarm-fixes-6.3-4' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD

KVM/arm64 fixes for 6.3, part #4

 - Plug a buffer overflow due to the use of the user-provided register
   width for firmware regs. Outright reject accesses where the
   user register width does not match the kernel representation.

 - Protect non-atomic RMW operations on vCPU flags against preemption,
   as an update to the flags by an intervening preemption could be lost.
 2023-04-21 19:19:02 -04:00
Jiaxun Yang
6dcbd0a69c MIPS: Define RUNTIME_DISCARD_EXIT in LD script 
MIPS's exit sections are discarded at runtime as well.

Fixes link error:
`.exit.text' referenced in section `__jump_table' of fs/fuse/inode.o:
defined in discarded section `.exit.text' of fs/fuse/inode.o

Fixes: 99cb0d917f ("arch: fix broken BuildID for arm64 and riscv")
Reported-by: "kernelci.org bot" <bot@kernelci.org>
Signed-off-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
 2023-04-21 23:59:43 +02:00
Linus Torvalds
8e41e0a575 Revert "ACPICA: Events: Support fixed PCIe wake event" 
This reverts commit 5c62d5aab8.

This broke wake-on-lan for multiple people, and for much too long.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=217069
Link: https://lore.kernel.org/all/754225a2-95a9-2c36-1886-7da1a78308c2@loongson.cn/
Link: https://github.com/acpica/acpica/pull/866
Cc: Rafael J. Wysocki <rafael@kernel.org>
Cc: Jianmin Lv <lvjianmin@loongson.cn>
Cc: Huacai Chen <chenhuacai@loongson.cn>
Cc: Bob Moore <robert.moore@intel.com>
Cc: stable@kernel.org # 6.2
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
 2023-04-21 13:39:10 -07:00
Linus Torvalds
c337b23f32 for-6.3-rc7-tag 
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE8rQSAMVO+zA4DBdWxWXV+ddtWDsFAmRCmhgACgkQxWXV+ddt
 WDsHrA/+KaCgixD0Z/8f2tMu2Kd5KQ6vQGMlydZzr0OvTYh3skAjTbAfTGAUHiXF
 6qZOpYYEilE+xhdcTegB4fV1OPJQw8+rvRrPps9ugZEShQhHlUbIuuiSCtrILKmK
 424wkllNc7NDbz5CHbbBpNNGdc6Xgyr3zy4nKZf/Sezmj+aK/nRL/JmazzUaEnxM
 NC8hBq+Nrpz0ucyStiLp4jfdp5geo4hcfpXVEBuH2ZpzhBPV4usLBWwsEj6uBcTy
 mpvMNHTFw/8H/k9w6GS+E/hrU5Rs5tWHTlEIz+xD1kK8DoPoE1arcgdLCzS0yC81
 8MyjB2qgMp3XutVlQGwyWAalY04UfzKvQ4yUYwTKT24pToc0TmQq8YV2Sy7c7SeA
 SDy+Ev1wgteeaPskhS9vMbJvnKVSzOMovt0oNR6VoPivXZ0OjVRDkC3fT2l497JL
 jZB3H7JaUGxJ/du1kUQkhL2c6YnjkWsqbl1YoOUBilNXkY/Mbz8NCZZdLJia0Q41
 P14w4aeD8HAYBNkOvSrDwfBQB5fR31GQq3QH/dGfJ4i41eJlNAposcOWQkV115Ib
 eILV3kFxJNSCpUI7eaE2biacGxJLdiWPQDv5Oo5AETyqcoiFqjCDerZWCTgH54H2
 YzzJiY/1BH8RgYbrCUyoPmyGOhoovYSVG9gLK3nXk1jqWltJgD0=
 =mGL5
 -----END PGP SIGNATURE-----

Merge tag 'for-6.3-rc7-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux

Pull btrfs fixes from David Sterba:
 "Two patches fixing the problem with aync discard.

  The default settings had a low IOPS limit and processing a large batch
  to discard would take a long time. On laptops this can cause increased
  power consumption due to disk activity.

  As async discard has been on by default since 6.2 this likely affects
  a lot of users.

  Summary:

   - increase the default IOPS limit 10x which reportedly helped

   - setting the sysfs IOPS value to 0 now does not throttle anymore
     allowing the discards to be processed at full speed. Previously
     there was an arbitrary 6 hour target for processing the pending
     batch"

* tag 'for-6.3-rc7-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
  btrfs: reinterpret async discard iops_limit=0 as no delay
  btrfs: set default discard iops_limit to 1000
 2023-04-21 10:47:21 -07:00
Linus Torvalds
334e5a8206 block-6.3-2023-04-21 
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmRCpRkQHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgpnAhEADO9oOtBP5cyQpJ1lm1nQeJVGk3cqHb2tfX
 yp2rziMAz3w8a8S/Y8FSBu2eXFG7ebf7QR30rQIXGW/VpxlDlYGaHIB4ti4n1ye9
 t+jP4CDrL4Wz+XJlCeirM9jpyxJJBFyVoGdB9y3owRIKtMP/o8KD+KvTN0ji7FG9
 /pmWAQCzQAuKoayWgqZ6qPHvttXXQ3A7FZjKKmUpIe1bMV0LBCbywqABLN87yKd8
 MhuDoewNO0bO+Dnxs8x4Od11arTQwYlGmKK+OKPBa3Z/9+jLF6xwj6f99ixv4FJZ
 7vt9G6VpcPfWaMdakIiZvCzx4t6loAS1/7/3VDsUh8aCwn/nuH47VkfdFIqWzGiK
 AWJdTDEYOkpwfEN49aJsvejVxfuHTpeUe+Y0YSba2mM5e8aMbRjJwSw+85g4Fq+0
 rEcKns1VEl6cYyz8R6nTqy8ubABxkZqL7G+900wLu6HegdI6KwrqPi6JXnahN8CZ
 sjApsHQ7F2K5c5znzOg/8BWT9tJ8CdoSw/ZYoOp9VRiw447DopX0SA3BYoJkKQbO
 LpSpuam/5LWRpA7HKAfR1O3Yus+ecua8dvq1KkSKoBr/8o8/9ma6biOtv1QjtLpD
 FiGRyPVmcdNrqbU4MMBcG7x4MWssc4fS0SyWla69n3LWxDazp/vTsCoPeKrxTFxK
 HbjuTrlQnQ==
 =j3nf
 -----END PGP SIGNATURE-----

Merge tag 'block-6.3-2023-04-21' of git://git.kernel.dk/linux

Pull block fix from Jens Axboe:
 "Just a single revert of a patch from the 6.3 series"

* tag 'block-6.3-2023-04-21' of git://git.kernel.dk/linux:
  Revert "block: Merge bio before checking ->cached_rq"
 2023-04-21 10:05:52 -07:00
Linus Torvalds
8fd06d441e Char/Misc driver fixes for 6.3-final 
Here are some last-minute tiny driver fixes for 6.3-final.  They
 include fixes for some fpga and iio drivers:
   - fpga bridge driver fix
   - fpga dfl error reporting fix
   - fpga m10bmc driver fix
   - fpga xilinx driver fix
   - iio light driver fix
   - iio dac fwhandle leak fix
   - iio adc driver fix
 
 All of these have been in linux-next for a few weeks with no reported
 problems.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCZEKElg8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+ylu9ACdGnBPgW7sZaIELlJXSL0n4zUAvM0AoNiOldn1
 5ZjCjkAgyITm0rxSM32X
 =Q/Mx
 -----END PGP SIGNATURE-----

Merge tag 'char-misc-6.3-final' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

Pull char/misc driver fixes from Greg KH:
 "Here are some last-minute tiny driver fixes for 6.3-final. They
  include fixes for some fpga and iio drivers:

   - fpga bridge driver fix

   - fpga dfl error reporting fix

   - fpga m10bmc driver fix

   - fpga xilinx driver fix

   - iio light driver fix

   - iio dac fwhandle leak fix

   - iio adc driver fix

  All of these have been in linux-next for a few weeks with no reported
  problems"

* tag 'char-misc-6.3-final' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
  iio: light: tsl2772: fix reading proximity-diodes from device tree
  fpga: bridge: properly initialize bridge device before populating children
  iio: dac: ad5755: Add missing fwnode_handle_put()
  iio: adc: at91-sama5d2_adc: fix an error code in at91_adc_allocate_trigger()
  fpga: xilinx-pr-decoupler: Use readl wrapper instead of pure readl
  fpga: dfl-pci: Drop redundant pci_enable_pcie_error_reporting()
  fpga: m10bmc-sec: Fix rsu_send_data() to return FW_UPLOAD_ERR_HW_ERROR
 2023-04-21 10:00:18 -07:00
Linus Torvalds
bdc83e00f0 gpio fixes for v6.3 
- use raw_spinlocks in regmaps that are used in interrupt context in
   gpio-104-idi-48 and gpio-104-dio-48e
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEFp3rbAvDxGAT0sefEacuoBRx13IFAmRCWnoACgkQEacuoBRx
 13J/7Q/+IMwRVgDzDJsHUk0+psR3lqj2fcc/K5q4vAF850dCmvfai1acJb/l0Lnw
 OhQX05zgI1vvKEsrEuyzFLwzTGyUMvP0Y6YypgVlewqWflbPKCdjb/NLDpF5D57c
 zdkStjXbk8lV+N5hIwh5ZE6dwecbNKj8avk7+roLdOB+ML+KYjGGOiWx9NkG7PE5
 BQMktlH6vQzzd37P61CO3anqVhLKXJKg6XXKoI2k4h2Dcy3FUgEgHyeYXb5R5EJj
 EeMKUOKAn+2fw3lmpOdI9A+l8wUFqRheBVnYVNKngiBaWDQgxas8EqHK945pIJDG
 UipVmZ58o3FR65xECRTQsBibZHHzihEOQU7SG5gduk7I/OuPkcbUHO36aTkYSb3X
 dXZj26xJbOshBb77IkELKGEDy3FCrI2do5u2bGEiD+V9SfBLWl4cncr/PpUcRDy2
 AuR2Ad6rfRFc8qCyCvE/Ow39o4mnJkUjOUzzU3BBzDLrd4xh6eTnOfBF3wo/lxpd
 BMn3LJd8GiNtfBf1dTx5M+efMclQk3m7cA5DaWrXSMo9vjTGTY9PIgKG8hgGOKTS
 FB6trgSUWfitXn5p1qjhtTE8Np0xkSevtKe9vlx/hM27DVmuWg3FjY+UAVm6so9M
 RxNgtjZj2YFDHJhmyxdttxV//a2UGP0GmtiLLPhL5yb6dPso8OM=
 =SCgE
 -----END PGP SIGNATURE-----

Merge tag 'gpio-fixes-for-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux

Pull gpio fixes from Bartosz Golaszewski:

 - use raw_spinlocks in regmaps that are used in interrupt context in
   gpio-104-idi-48 and gpio-104-dio-48e

* tag 'gpio-fixes-for-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
  gpio: 104-idi-48: Enable use_raw_spinlock for idi48_regmap_config
  gpio: 104-dio-48e: Enable use_raw_spinlock for dio48e_regmap_config
 2023-04-21 09:50:47 -07:00
Linus Torvalds
a14e151910 sound fixes for 6.3-final 
Just a few fixes: all small and device-specific (ASoC FSL, SOF, and
 HD-audio quirks), should be safe to apply at the last minute.
 -----BEGIN PGP SIGNATURE-----
 
 iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAmRBYSAOHHRpd2FpQHN1
 c2UuZGUACgkQLtJE4w1nLE/XgA/+Jt2LbYSJhgJlibMR73UxLZJeTvcUnGcvY75F
 arKeYYCcNVqHMJ6kxE+7tAqclVxOqVxLx8EEv3SBmx/xs+aV7r0qLACKAf6SRLHc
 b+hDa328lmj+OPUuam4WrlUR7guVDt1Q1nbBfuJo28x/aOyDbMyAH+6mjZaNXPpw
 NYOD6zusw9RRXLdK0aIlv+M/7FCY1NRJGsLHfP6tJr8TW2rGZvbo30tyDdLyKueT
 zZBhkQZtKAQ3yvyEgziJpZZq1Fvz2VkxZnauQIj49IggCNGojBBQnSVV8ZSii0qa
 vEiE2amcrNeHK6BuV+ClfCCXtv0/lxM1EOoIqFEoYPlNksQtHFAU95JkqYT7M4rL
 XmtdizEdCXN2UGq7StFhgkHt/f8xaJJ56SzmkBTL3BtrqcgNCn5rwKH+tDfJZxOT
 93BTL0dyXaWBX159iGikxrFBIvpCmMD68R8c00jnmtZAZujYEQuquG8920o56Ymp
 1awDBQu7KXLhD6L4raabMZNBSz9X9qF/pLOJORPAXcKM0nXQ0oaS7f5PCtJ+X7sQ
 O9CJ6qQLMdOv95f5LH0OwAl6eZjdGc7OvxAICPciZpiAEsV8yxPsWuijzMNit3Cr
 Y6Wo2UXVMpgGUPS0oVlMkSqVwak2dU5ResAftJpoCNu2TpVOC+/VzTvlD2HDEjd1
 gZe6K0A=
 =vCeN
 -----END PGP SIGNATURE-----

Merge tag 'sound-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound fixes from Takashi Iwai:
 "Just a few fixes: all small and device-specific (ASoC FSL, SOF, and
  HD-audio quirks), should be safe to apply at the last minute"

* tag 'sound-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
  ALSA: hda/realtek: fix mute/micmute LEDs for a HP ProBook
  ASoC: fsl_asrc_dma: fix potential null-ptr-deref
  ASoC: fsl_sai: Fix pins setting for i.MX8QM platform
  ALSA: hda/realtek: Remove specific patch for Dell Precision 3260
  ASoC: max98373: change power down sequence for smart amp
  ASoC: SOF: pm: Tear down pipelines only if DSP was active
  ASoC: SOF: ipc4-topology: Clarify bind failure caused by missing fw_module
 2023-04-21 09:34:49 -07:00
Ekaterina Orlova
5a43001c01 ASN.1: Fix check for strdup() success 
It seems there is a misprint in the check of strdup() return code that
can lead to NULL pointer dereference.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 4520c6a49a ("X.509: Add simple ASN.1 grammar compiler")
Signed-off-by: Ekaterina Orlova <vorobushek.ok@gmail.com>
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: James Bottomley <jejb@linux.ibm.com>
Cc: Jarkko Sakkinen <jarkko@kernel.org>
Cc: keyrings@vger.kernel.org
Cc: linux-kbuild@vger.kernel.org
Link: https://lore.kernel.org/r/20230315172130.140-1-vorobushek.ok@gmail.com/
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
 2023-04-21 08:58:00 -07:00
Linus Torvalds
2af3e53a4d drm fixes for 6.3 final 
nouveau:
 - fix dma-resv timeout
 
 rockchip:
 - fix suspend/resume
 
 sched:
 - fix timeout handling
 
 i915:
 - Fix fast wake AUX sync len
 
 amdgpu:
 - GPU reset fix
 - DCN 3.1.5 line buffer fix
 - Display fix for single channel memory configs
 - Fix a possible divide by 0
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmRB5goACgkQDHTzWXnE
 hr61CQ//WErknR7CmIA4JOSRwULsh4MnfVTa7qEf4adHg33TvKG4XgzxBc7Z03FU
 8nblFCYTFu98w1uFGn3f/z8Qy4xsJw5zaBZo9Yul26IEjbjGmr0s2ex/SZoeLzuh
 5j53jDl4uFEL4ckiQrSn/n4qC8yj5oMoszZ5m97ZMj3rb7Z21HKYPBrmJAZKXt+d
 +4ZfE9pNEek3JhVkdgwr52aEIgu2PLQJIiLVHWd8x+oHbNrDkG7NxhbzcG8ETAf0
 o9H5NO0nn89ec3olBXk8eIwgmReatwEWmnZYW26uJVB6MGsOsw3Uga74zsv07FBe
 uyMBGIpTAA8DveTuMpBdw9LAiXshsM5c8kG1cmM+0t3r3IJBfzJTwn4RrbMgmVcl
 1QBYg+MVagYYvhxgWJym4KbvGKfnq72nc/vUiQyBh1CqN4usZede2CO6sp1lN25G
 BMo9Tr4Rd6/5LOiF0watYgSFiVNCYP8OmGMEtAgPc/iWWZtgWhI+m5BcKnNVkuNK
 OWzER9mynVpKCNZ+wuMxcHdzMo2RqeuHWU4+1BoZtsBGnR+iCI2QfZYsP1v7q7K5
 O1FAQfgV2K86gO1UGqZEzenVIusx7H8ahtrCpbOEqOahPUC0hcEI6LxxmWBk8Hm4
 OAC9L4LE7jIG98HqibjuynGIoX4+EEpmIErHe7ZBRrQv8tIDSZE=
 =VIeS
 -----END PGP SIGNATURE-----

Merge tag 'drm-fixes-2023-04-21' of git://anongit.freedesktop.org/drm/drm

Pull drm fixes from Dave Airlie:
 "This is the regular and hopefully last round of fixes for 6.3.

  Pretty small, a few amdgpu, one i915, one nouveau, one rockchip and
  one gpu scheduler fix:

  nouveau:
   - fix dma-resv timeout

  rockchip:
   - fix suspend/resume

  sched:
   - fix timeout handling

  i915:
   - Fix fast wake AUX sync len

  amdgpu:
   - GPU reset fix
   - DCN 3.1.5 line buffer fix
   - Display fix for single channel memory configs
   - Fix a possible divide by 0"

* tag 'drm-fixes-2023-04-21' of git://anongit.freedesktop.org/drm/drm:
  drm/amd/display: fix a divided-by-zero error
  drm/amd/display: limit timing for single dimm memory
  drm/amd/display: set dcn315 lb bpp to 48
  drm/amdgpu: Fix desktop freezed after gpu-reset
  drm/rockchip: vop2: Use regcache_sync() to fix suspend/resume
  drm/nouveau: fix incorrect conversion to dma_resv_wait_timeout()
  drm/rockchip: vop2: fix suspend/resume
  drm/i915: Fix fast wake AUX sync len
  drm/sched: Check scheduler ready before calling timeout handling
 2023-04-20 19:15:58 -07:00
Dave Airlie
00a4bd000e Merge tag 'amd-drm-fixes-6.3-2023-04-19' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes 
amd-drm-fixes-6.3-2023-04-19:

amdgpu:
- GPU reset fix
- DCN 3.1.5 line buffer fix
- Display fix for single channel memory configs
- Fix a possible divide by 0

Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Alex Deucher <alexander.deucher@amd.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230420031717.7790-1-alexander.deucher@amd.com
 2023-04-21 11:13:25 +10:00
Dave Airlie
3b1f2be527 Merge tag 'drm-intel-fixes-2023-04-19' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes 
drm/i915 fixes for v6.3 final:
- Fix fast wake AUX sync len

Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Jani Nikula <jani.nikula@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/87354w1b76.fsf@intel.com
 2023-04-21 10:37:23 +10:00
Dave Airlie
f126f41cec Short summary of fixes pull: 
* nouveau: fix dma-resv timeout
  * rockchip: fix suspend/resume
  * sched: fix timeout handling
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCAAdFiEEchf7rIzpz2NEoWjlaA3BHVMLeiMFAmRA+BIACgkQaA3BHVML
 eiMiRAf+Lt9t9b4+xUfFdRb9X8iuv3Ufhj7JaMYmmBM6CFLxeB9GNvCiGbxS8/y9
 96/YnQIvoV7/YGSM+l8Vi2DmNFedtHww1dkepRYHY/M/kx5O/RHFQ/r/S7Du7IdT
 bLvSxxpMnvXkSss6hoAAJsbxT13RizWbaka/LqToYPIW9v2rUINp+o7+z9AuaXF7
 jBGsSAtlqUlyk8kyTRj8GAb7NM+BfXNTMqPNU9aGnBqzvxMcYrWphqiMI+nydA74
 zja+aSW7CpSPquqs0Xh8uN0IdhCel8cwvilk1fwSXQu4JMsyZ/9kcCUAVBhzmRIU
 9Yp2T5ps2LY+cMw3BIjhMAPBt2LPNQ==
 =lHAb
 -----END PGP SIGNATURE-----

Merge tag 'drm-misc-fixes-2023-04-20-2' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes

Short summary of fixes pull:

 * nouveau: fix dma-resv timeout
 * rockchip: fix suspend/resume
 * sched: fix timeout handling

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20230420083114.GA17651@linux-uq9g
 2023-04-21 09:59:01 +10:00
Linus Torvalds
b7bc77e2f2 pci-v6.3-fixes-3 
-----BEGIN PGP SIGNATURE-----
 
 iQJIBAABCgAyFiEEgMe7l+5h9hnxdsnuWYigwDrT+vwFAmRBmroUHGJoZWxnYWFz
 QGdvb2dsZS5jb20ACgkQWYigwDrT+vwtuA/+LsoJ0ohzhtph5SbVFR45tTYxr1uT
 3cUDhRmzEy5m7CPBogETTCn18r0VyPtjj2lgsDL7yubQJzCaQN5Sy8TkL43G/VhL
 kEPoP2KedWiaDHpzneLG0QAeRtA9nuZSzLokI1aHAjkFJ7KWlPyrNrBFDSMfxdiF
 N47o63q6UaREceM0jRF12FVB7OWLgr2Bx7spI093j3+KiVzC5EpdUveq4DyppNk2
 RjertZyWfVlzlV3DZ4yWSGDrya1IDRuCa7U6dNTq2vraEuT1sxCmdgblQJw6VClk
 irUF3xPnHZ4f/f2o443e70RV46gUqt8p639ONPm86bQtTPYxFbRGK0NZE5s/xDya
 fX0AmCx5/GcIcULxn76aSMTqOGRvzi5ainXdyEKNglxIVLJHqq2JronGVsbJlgjo
 QnUwVCThTz/xsRn2VNPV9kdwSgDZeIQ9xyQp8vSXSoQ1o1Yp13oEh02Adds0rFlM
 OULN4tEt9kuvR3rSTTPjeFzEd9JPS5DLawlLJemDAJYrerO3Hf3sKHK67mGL3vVu
 5PN9YztYeVc/0BMBl2H7aM9w4ISIH8admctGGvPn/3WpxCP4kztmXrD/1FzhWVxm
 NojwvRvMWcZJ7mPVXfzdbJ/RBoVxbur+FEKvuGlzgNDMlkwtTbiGFJG+reVoPHHz
 MoFc9Y47HNdiK44=
 =agMG
 -----END PGP SIGNATURE-----

Merge tag 'pci-v6.3-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci

Pull pci fix from Bjorn Helgaas:

 - Previously we ignored PCI devices if the DT "status" property or the
   ACPI _STA method said it was not present.

   Per spec, _STA cannot be used for that purpose, and using it that way
   caused regressions, so skip the _STA check (Rob Herring)

* tag 'pci-v6.3-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci:
  PCI: Restrict device disabled status check to DT
 2023-04-20 15:36:23 -07:00
Boris Burkov
ef9cddfe57 btrfs: reinterpret async discard iops_limit=0 as no delay 
Currently, a limit of 0 results in a hard coded metering over 6 hours.
Since the default is a set limit, I suspect no one truly depends on this
rather arbitrary setting. Repurpose it for an arguably more useful
"unlimited" mode, where the delay is 0.

Note that if block groups are too new, or go fully empty, there is still
a delay associated with those conditions. Those delays implement
heuristics for not trimming a region we are relatively likely to fully
overwrite soon.

CC: stable@vger.kernel.org # 6.2+
Reviewed-by: Neal Gompa <neal@gompa.dev>
Signed-off-by: Boris Burkov <boris@bur.io>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
 2023-04-21 00:28:23 +02:00
Boris Burkov
e9f59429b8 btrfs: set default discard iops_limit to 1000 
Previously, the default was a relatively conservative 10. This results
in a 100ms delay, so with ~300 discards in a commit, it takes the full
30s till the next commit to finish the discards. On a workstation, this
results in the disk never going idle, wasting power/battery, etc.

Set the default to 1000, which results in using the smallest possible
delay, currently, which is 1ms. This has shown to not pathologically
keep the disk busy by the original reporter.

Link: https://lore.kernel.org/linux-btrfs/Y%2F+n1wS%2F4XAH7X1p@nz/
Link: https://bugzilla.redhat.com/show_bug.cgi?id=2182228
CC: stable@vger.kernel.org # 6.2+
Reviewed-by: Neal Gompa <neal@gompa.dev
Signed-off-by: Boris Burkov <boris@bur.io>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
 2023-04-21 00:28:20 +02:00
Toke Høiland-Jørgensen
0f2a4af27b wifi: ath9k: Don't mark channelmap stack variable read-only in ath9k_mci_update_wlan_channels() 
This partially reverts commit e161d4b60a.

Turns out the channelmap variable is not actually read-only, it's modified
through the MCI_GPM_CLR_CHANNEL_BIT() macro further down in the function,
so making it read-only causes page faults when that code is hit.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=217183
Link: https://lore.kernel.org/r/20230413214118.153781-1-toke@toke.dk
Fixes: e161d4b60a ("wifi: ath9k: Make arrays prof_prio and channelmap static const")
Cc: stable@vger.kernel.org
Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
 2023-04-20 15:26:37 -07:00
Linus Torvalds
6a66fdd29e Rust fixes for v6.3 
- Build: Rust + GCC build fix and 'grep' warning fix.
 
  - Code: Missing 'extern "C"' fix.
 
  - Scripts: 'is_rust_module.sh' and 'generate_rust_analyzer.py' fixes.
 
  - A couple trivial fixes.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEPjU5OPd5QIZ9jqqOGXyLc2htIW0FAmRAKacACgkQGXyLc2ht
 IW33VRAAglNS0O0ErOmHRdlwLx2kZXhXGAPtgLe6w0BSe46zdfBs/Y2dEqQZWzSX
 pfYDjLfVlmrObgOA9HkXR22gYaWfTPc0qCIhIKmkkQgF4q/VjMLl5QaU6fBAzz6k
 J7OqJmg5NeKMQW9G6CGJdkk9XldeIlEBi9C0P+YsaU/8N6PO0BNhYTaenbKRbusC
 kcjFMjekQlYEHsaX4flTXNKGSbg+tBi4igiBwcbQE/uy7l75mECHIUeQbXZMyp4b
 lWGMl8CdlYFLJRB4oxxvOQ3JgTdq9thVXu3WTK+ETs7tBNu9VB8zKuP+iOcpPjrX
 3Djt5QBL2+O3jPIrUKQfMK1Ejxh/BIHTy5643hSgppQg4+Y33RW8xKp1YHqSof46
 SNVJ9taQ9nnLNviNbtxXEN2Zj00jGgOa2qqXfycJwJvWPFI+VVgHvkbfvhKYJzJ/
 swVDCuYmdh74DgdwvOb4dwZqEpLwC+V8T4ll2EUpR/CLYf4FGyRAmbaxSVKzP/JT
 M/R7tDq10xvVB4rJsqwHri3nB0rmSM6+7fYiQHlwEGt6wImDSy0N9y1BcCZ+ckHW
 TmEjx93e6SjXiQKr98suBVC0W+GnHk+MN39rDhZbNJB74EBwGFEmrMweRTeFv9ya
 OuXkQOa3xOFt9E/eb26sPN0/sEJexnMu4vXEzCGBl51HcDqxQGQ=
 =zdCa
 -----END PGP SIGNATURE-----

Merge tag 'rust-fixes-6.3' of https://github.com/Rust-for-Linux/linux

Pull Rust fixes from Miguel Ojeda:
 "Most of these are straightforward.

  The last one is more complex, but it only touches Rust + GCC builds
  which are for the moment best-effort.

   - Code: Missing 'extern "C"' fix.

   - Scripts: 'is_rust_module.sh' and 'generate_rust_analyzer.py' fixes.

   - A couple trivial fixes

   - Build: Rust + GCC build fix and 'grep' warning fix"

* tag 'rust-fixes-6.3' of https://github.com/Rust-for-Linux/linux:
  rust: allow to use INIT_STACK_ALL_ZERO
  rust: fix regexp in scripts/is_rust_module.sh
  rust: build: Fix grep warning
  scripts: generate_rust_analyzer: Handle sub-modules with no Makefile
  rust: kernel: Mark rust_fmt_argument as extern "C"
  rust: sort uml documentation arch support table
  rust: str: fix requierments->requirements typo
 2023-04-20 12:46:18 -07:00
Rob Herring
0d21e71a91 PCI: Restrict device disabled status check to DT 
Commit 6fffbc7ae1 ("PCI: Honor firmware's device disabled status")
checked the firmware device status for both DT and ACPI devices. That
caused a regression in some ACPI systems. The exact reason isn't clear.
It's possibly a firmware bug. For now, at least, refactor the check to
be for DT based systems only.

Note that the original implementation leaked a refcount which is now
correctly handled.

[bhelgaas: Per ACPI r6.5, sec 6.3.7, for devices on an enumerable bus, _STA
must return with bit[0] ("device is present") set]

Link: https://lore.kernel.org/all/m2fs9lgndw.fsf@gmail.com/
Fixes: 6fffbc7ae1 ("PCI: Honor firmware's device disabled status")
Link: https://lore.kernel.org/r/20230419193513.708818-1-robh@kernel.org
Link: https://bugzilla.kernel.org/show_bug.cgi?id=217317
Reported-by: Donald Hunter <donald.hunter@gmail.com>
Reported-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Tested-by: Donald Hunter <donald.hunter@gmail.com>
Tested-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Signed-off-by: Rob Herring <robh@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: Binbin Zhou <zhoubinbin@loongson.cn>
Cc: Liu Peibao <liupeibao@loongson.cn>
Cc: Huacai Chen <chenhuacai@loongson.cn>
 2023-04-20 13:30:14 -05:00
Linus Torvalds
23309d600d Networking fixes for 6.3-rc8, including fixes from netfilter and bpf 
Current release - regressions:
 
   - sched: clear actions pointer in miss cookie init fail
 
   - mptcp: fix accept vs worker race
 
   - bpf: fix bpf_arch_text_poke() with new_addr == NULL on s390
 
   - eth: bnxt_en: fix a possible NULL pointer dereference in unload path
 
   - eth: veth: take into account peer device for NETDEV_XDP_ACT_NDO_XMIT xdp_features flag
 
 Current release - new code bugs:
 
   - eth: revert "net/mlx5: Enable management PF initialization"
 
 Previous releases - regressions:
 
   - netfilter: fix recent physdev match breakage
 
   - bpf: fix incorrect verifier pruning due to missing register precision taints
 
   - eth: virtio_net: fix overflow inside xdp_linearize_page()
 
   - eth: cxgb4: fix use after free bugs caused by circular dependency problem
 
   - eth: mlxsw: pci: fix possible crash during initialization
 
 Previous releases - always broken:
 
   - sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg
 
   - netfilter: validate catch-all set elements
 
   - bridge: don't notify FDB entries with "master dynamic"
 
   - eth: bonding: fix memory leak when changing bond type to ethernet
 
   - eth: i40e: fix accessing vsi->active_filters without holding lock
 
 Misc:
 
   - Mat is back as MPTCP co-maintainer
 
 Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 -----BEGIN PGP SIGNATURE-----
 
 iQJGBAABCAAwFiEEg1AjqC77wbdLX2LbKSR5jcyPE6QFAmRBF5ISHHBhYmVuaUBy
 ZWRoYXQuY29tAAoJECkkeY3MjxOkj5sP/itK7DeAzufFIe1SUY+WYdbhAj7XTJso
 q5bpF09wmLW9RLPxZ/hLMnCUniCSBBoJ/3oeBD8SgRBQJKSLjh1WTLYgFxfEZEeY
 DvydMxiurH13pxgMBpCUSTlqDbiLkZ51Sy2sSGJcoJK8XRfA265/D7ZEBFJRIJS9
 wr2prLspZmlN/5dnt8WIXubf83o5mkJ7DneSMBGuJXE2akJ7VBROz10pK1HVMALq
 c6p/Kt92iffEiZZYCnqogrQOu3hLcSCLRTM7Wb3giIX9jaE84Hr9fV+zfG/JDeCJ
 kgjEiKOExnusd8Nq91cClDt92ceRWU5s1M1UxJ5r4Mxjnq0Ug+I3ayItS9bXcEqH
 0PmDql4bKFUue7QiJZkCsusKjlf5R1XxE0Zt+lANn+FWr8THKxvnrbpCjT0ZUvQv
 7kI+Q4g7AFSNoWgM9SwtiTMQmxI8BUo7kgaBLz2IvFDzau4T+yDLKZ+3gyewwp0e
 RN4pac8YyChuuMBmVrZGxVHPA3fKu7C7jCc/xGaMHcQSgFCsQtPpKZVa1SxLR/ZZ
 efMB/J2+GIGv2i5YecH4DItNUd0QhZnXgBjLEaDmEGk4rHIlc9JDy3frD5Qrs4pW
 Dq2zvveRVT30b52sOjkYzEvTU5R/s1nio3RGklUE4hDCV1DkehThAFaX68cIcgeR
 63uRXDpogRs+
 =xUNa
 -----END PGP SIGNATURE-----

Merge tag 'net-6.3-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull networking fixes from Paolo Abeni:
 "Including fixes from netfilter and bpf.

  There are a few fixes for new code bugs, including the Mellanox one
  noted in the last networking pull. No known regressions outstanding.

  Current release - regressions:

   - sched: clear actions pointer in miss cookie init fail

   - mptcp: fix accept vs worker race

   - bpf: fix bpf_arch_text_poke() with new_addr == NULL on s390

   - eth: bnxt_en: fix a possible NULL pointer dereference in unload
     path

   - eth: veth: take into account peer device for
     NETDEV_XDP_ACT_NDO_XMIT xdp_features flag

  Current release - new code bugs:

   - eth: revert "net/mlx5: Enable management PF initialization"

  Previous releases - regressions:

   - netfilter: fix recent physdev match breakage

   - bpf: fix incorrect verifier pruning due to missing register
     precision taints

   - eth: virtio_net: fix overflow inside xdp_linearize_page()

   - eth: cxgb4: fix use after free bugs caused by circular dependency
     problem

   - eth: mlxsw: pci: fix possible crash during initialization

  Previous releases - always broken:

   - sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg

   - netfilter: validate catch-all set elements

   - bridge: don't notify FDB entries with "master dynamic"

   - eth: bonding: fix memory leak when changing bond type to ethernet

   - eth: i40e: fix accessing vsi->active_filters without holding lock

  Misc:

   - Mat is back as MPTCP co-maintainer"

* tag 'net-6.3-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (33 commits)
  net: bridge: switchdev: don't notify FDB entries with "master dynamic"
  Revert "net/mlx5: Enable management PF initialization"
  MAINTAINERS: Resume MPTCP co-maintainer role
  mailmap: add entries for Mat Martineau
  e1000e: Disable TSO on i219-LM card to increase speed
  bnxt_en: fix free-runnig PHC mode
  net: dsa: microchip: ksz8795: Correctly handle huge frame configuration
  bpf: Fix incorrect verifier pruning due to missing register precision taints
  hamradio: drop ISA_DMA_API dependency
  mlxsw: pci: Fix possible crash during initialization
  mptcp: fix accept vs worker race
  mptcp: stops worker on unaccepted sockets at listener close
  net: rpl: fix rpl header size calculation
  net: vmxnet3: Fix NULL pointer dereference in vmxnet3_rq_rx_complete()
  bonding: Fix memory leak when changing bond type to Ethernet
  veth: take into account peer device for NETDEV_XDP_ACT_NDO_XMIT xdp_features flag
  mlxfw: fix null-ptr-deref in mlxfw_mfa2_tlv_next()
  bnxt_en: Fix a possible NULL pointer dereference in unload path
  bnxt_en: Do not initialize PTP on older P3/P4 chips
  netfilter: nf_tables: tighten netlink attribute requirements for catch-all elements
  ...
 2023-04-20 11:03:51 -07:00
Ming Lei
81ea1222f2 Revert "block: Merge bio before checking ->cached_rq" 
This reverts commit 23f3e3272e.

blk-mq sched bio merge still needs request to grab queue usage counter,
so we can't simply call blk_mq_attempt_bio_merge() when queue usage
counter isn't held.

Fixes: 23f3e3272e ("block: Merge bio before checking ->cached_rq")
Cc: Xiao Ni <xni@redhat.com>
Reported-by: Yi Zhang <yi.zhang@redhat.com>
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Link: https://lore.kernel.org/r/20230420112018.1108058-1-ming.lei@redhat.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
 2023-04-20 06:54:17 -06:00
Vladimir Oltean
927cdea5d2 net: bridge: switchdev: don't notify FDB entries with "master dynamic" 
There is a structural problem in switchdev, where the flag bits in
struct switchdev_notifier_fdb_info (added_by_user, is_local etc) only
represent a simplified / denatured view of what's in struct
net_bridge_fdb_entry :: flags (BR_FDB_ADDED_BY_USER, BR_FDB_LOCAL etc).
Each time we want to pass more information about struct
net_bridge_fdb_entry :: flags to struct switchdev_notifier_fdb_info
(here, BR_FDB_STATIC), we find that FDB entries were already notified to
switchdev with no regard to this flag, and thus, switchdev drivers had
no indication whether the notified entries were static or not.

For example, this command:

ip link add br0 type bridge && ip link set swp0 master br0
bridge fdb add dev swp0 00:01:02:03:04:05 master dynamic

has never worked as intended with switchdev. It causes a struct
net_bridge_fdb_entry to be passed to br_switchdev_fdb_notify() which has
a single flag set: BR_FDB_ADDED_BY_USER.

This is further passed to the switchdev notifier chain, where interested
drivers have no choice but to assume this is a static (does not age) and
sticky (does not migrate) FDB entry. So currently, all drivers offload
it to hardware as such, as can be seen below ("offload" is set).

bridge fdb get 00:01:02:03:04:05 dev swp0 master
00:01:02:03:04:05 dev swp0 offload master br0

The software FDB entry expires $ageing_time centiseconds after the
kernel last sees a packet with this MAC SA, and the bridge notifies its
deletion as well, so it eventually disappears from hardware too.

This is a problem, because it is actually desirable to start offloading
"master dynamic" FDB entries correctly - they should expire $ageing_time
centiseconds after the *hardware* port last sees a packet with this
MAC SA - and this is how the current incorrect behavior was discovered.
With an offloaded data plane, it can be expected that software only sees
exception path packets, so an otherwise active dynamic FDB entry would
be aged out by software sooner than it should.

With the change in place, these FDB entries are no longer offloaded:

bridge fdb get 00:01:02:03:04:05 dev swp0 master
00:01:02:03:04:05 dev swp0 master br0

and this also constitutes a better way (assuming a backport to stable
kernels) for user space to determine whether the kernel has the
capability of doing something sane with these or not.

As opposed to "master dynamic" FDB entries, on the current behavior of
which no one currently depends on (which can be deduced from the lack of
kselftests), Ido Schimmel explains that entries with the "extern_learn"
flag (BR_FDB_ADDED_BY_EXT_LEARN) should still be notified to switchdev,
since the spectrum driver listens to them (and this is kind of okay,
because although they are treated identically to "static", they are
expected to not age, and to roam).

Fixes: 6b26b51b1d ("net: bridge: Add support for notifying devices about FDB add/del")
Link: https://lore.kernel.org/netdev/20230327115206.jk5q5l753aoelwus@skbuf/
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Tested-by: Ido Schimmel <idosch@nvidia.com>
Link: https://lore.kernel.org/r/20230418155902.898627-1-vladimir.oltean@nxp.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 2023-04-20 09:20:14 +02:00
Andy Chi
2ae147d643 ALSA: hda/realtek: fix mute/micmute LEDs for a HP ProBook 
There is a HP ProBook 455 G10 which using ALC236 codec and need the
ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF quirk to make mute LED and
micmute LED work.

Signed-off-by: Andy Chi <andy.chi@canonical.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20230420035942.66817-1-andy.chi@canonical.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
 2023-04-20 07:13:12 +02:00
Takashi Iwai
990cbca002 ASoC: Fixes for v6.3 
A few remaining small fixes for v6.3, all small driver specific ones.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmRATGwACgkQJNaLcl1U
 h9B1eQf+Miu2/EzjXoZ5nW3yxU3zJmu7BINhvb3pLlUxkNNxz/FG6chZgO+K17F4
 VlaOc8UkhjXPe2BRZljF34qHPLMdyUlX4bi4NmCMikzC8h7xDvpIONYt66v4y2Du
 bMEYbmbrVjkK83ZKjnHaSX9iC/qXkV/WQKyMTe7gR/pz2M5epwK6Q8iCtxITfYZt
 tlKnp4MjdFiEbzvVcylaJi0sDHozRYtT5kFpKrJQNVLjgnISUbkR03wME3wYG69m
 wlQbdDlkU+JOyiwLCkt+U5z4nLmPIgFHnb8frZTBUpSu4iqFesY69Jbh7XUWQyHi
 dwiDoyR80CKV5ILmoeIzzzBgDXQV2g==
 =EK/5
 -----END PGP SIGNATURE-----

Merge tag 'asoc-fix-v6.3-rc7' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus

ASoC: Fixes for v6.3

A few remaining small fixes for v6.3, all small driver specific ones.
 2023-04-20 07:11:30 +02:00
Jakub Kicinski
f52cc627b8 Revert "net/mlx5: Enable management PF initialization" 
This reverts commit fe998a3c77.

Paul reports that it causes a regression with IB on CX4
and FW 12.18.1000. In addition I think that the concept
of "management PF" is not fully accepted and requires
a discussion.

Fixes: fe998a3c77 ("net/mlx5: Enable management PF initialization")
Reported-by: Paul Moore <paul@paul-moore.com>
Link: https://lore.kernel.org/all/CAHC9VhQ7A4+msL38WpbOMYjAqLp0EtOjeLh4Dc6SQtD6OUvCQg@mail.gmail.com/
Link: https://lore.kernel.org/r/20230413222547.56901-1-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 2023-04-19 18:51:28 -07:00
Jakub Kicinski
9d94769081 bpf-for-netdev 
-----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQTFp0I1jqZrAX+hPRXbK58LschIgwUCZEBFUAAKCRDbK58LschI
 g1i4AQCuuuxCHdFUSiEpJfKVObeYMpFzSMXzduuKTWW/03XDEgEAvLihZKfRlM3z
 OxA/2ERQjjPIYeGrXBQ7xk2xpJN3Wgs=
 =G6DS
 -----END PGP SIGNATURE-----

Merge tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

Daniel Borkmann says:

====================
bpf 2023-04-19

We've added 3 non-merge commits during the last 6 day(s) which contain
a total of 3 files changed, 34 insertions(+), 9 deletions(-).

The main changes are:

1) Fix a crash on s390's bpf_arch_text_poke() under a NULL new_addr,
   from Ilya Leoshkevich.

2) Fix a bug in BPF verifier's precision tracker, from Daniel Borkmann
   and Andrii Nakryiko.

3) Fix a regression in veth's xdp_features which led to a broken BPF CI
   selftest, from Lorenzo Bianconi.

* tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:
  bpf: Fix incorrect verifier pruning due to missing register precision taints
  veth: take into account peer device for NETDEV_XDP_ACT_NDO_XMIT xdp_features flag
  s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL
====================

Link: https://lore.kernel.org/r/20230419195847.27060-1-daniel@iogearbox.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 2023-04-19 18:22:18 -07:00
Mat Martineau
52b37ae8aa MAINTAINERS: Resume MPTCP co-maintainer role 
I'm returning to the MPTCP maintainer role I held for most of the
subsytem's history. This time I'm using my kernel.org email address.

Acked-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Link: https://lore.kernel.org/mptcp/af85e467-8d0a-4eba-b5f8-e2f2c5d24984@tessares.net/
Signed-off-by: Mat Martineau <martineau@kernel.org>
Link: https://lore.kernel.org/r/20230418231318.115331-1-martineau@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 2023-04-19 18:10:24 -07:00
Matthieu Baerts
7b3aba7ea3 mailmap: add entries for Mat Martineau 
Map Mat's old corporate addresses to his kernel.org one.

Reviewed-by: Mat Martineau <martineau@kernel.org>
Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Link: https://lore.kernel.org/r/20230418-upstream-net-20230418-mailmap-mat-v1-1-13ca5dc83037@tessares.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 2023-04-19 18:08:53 -07:00
Jakub Kicinski
7b97174d0e Merge branch '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue 
Tony Nguyen says:

====================
Intel Wired LAN Driver Updates 2023-04-17 (i40e)

This series contains updates to i40e only.

Alex moves setting of active filters to occur under lock and checks/takes
error path in rebuild if re-initializing the misc interrupt vector
failed.

* '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue:
  i40e: fix i40e_setup_misc_vector() error handling
  i40e: fix accessing vsi->active_filters without holding lock
====================

Reviewed-by: Simon Horman <simon.horman@corigine.com>
Link: https://lore.kernel.org/r/20230417205245.1030733-1-anthony.l.nguyen@intel.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 2023-04-19 18:00:04 -07:00
Linus Torvalds
cb0856346a 22 hotfixes. 
19 are cc:stable and the remainder address issues which were introduced
 during this merge cycle, or aren't considered suitable for -stable
 backporting.
 
 19 are for MM and the remainder are for other subsystems.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCZEB7GgAKCRDdBJ7gKXxA
 jl4zAP9LxKisY8L29qrZG/SKoYbMMSM33ASOGZJRAuRRaOYL6QEAvS14pg/c22rL
 4GCZbzvENY4xPRbz/6kc/s2Jnuww4wA=
 =Kh/V
 -----END PGP SIGNATURE-----

Merge tag 'mm-hotfixes-stable-2023-04-19-16-36' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Pull misc fixes from Andrew Morton:
 "22 hotfixes.

  19 are cc:stable and the remainder address issues which were
  introduced during this merge cycle, or aren't considered suitable for
  -stable backporting.

  19 are for MM and the remainder are for other subsystems"

* tag 'mm-hotfixes-stable-2023-04-19-16-36' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (22 commits)
  nilfs2: initialize unused bytes in segment summary blocks
  mm: page_alloc: skip regions with hugetlbfs pages when allocating 1G pages
  mm/mmap: regression fix for unmapped_area{_topdown}
  maple_tree: fix mas_empty_area() search
  maple_tree: make maple state reusable after mas_empty_area_rev()
  mm: kmsan: handle alloc failures in kmsan_ioremap_page_range()
  mm: kmsan: handle alloc failures in kmsan_vmap_pages_range_noflush()
  tools/Makefile: do missed s/vm/mm/
  mm: fix memory leak on mm_init error handling
  mm/page_alloc: fix potential deadlock on zonelist_update_seq seqlock
  kernel/sys.c: fix and improve control flow in __sys_setres[ug]id()
  Revert "userfaultfd: don't fail on unrecognized features"
  writeback, cgroup: fix null-ptr-deref write in bdi_split_work_to_wbs
  maple_tree: fix a potential memory leak, OOB access, or other unpredictable bug
  tools/mm/page_owner_sort.c: fix TGID output when cull=tg is used
  mailmap: update jtoppins' entry to reference correct email
  mm/mempolicy: fix use-after-free of VMA iterator
  mm/huge_memory.c: warn with pr_warn_ratelimited instead of VM_WARN_ON_ONCE_FOLIO
  mm/mprotect: fix do_mprotect_pkey() return on error
  mm/khugepaged: check again on anon uffd-wp during isolation
  ...
 2023-04-19 17:55:45 -07:00
Sebastian Basierski
67d47b9511 e1000e: Disable TSO on i219-LM card to increase speed 
While using i219-LM card currently it was only possible to achieve
about 60% of maximum speed due to regression introduced in Linux 5.8.
This was caused by TSO not being disabled by default despite commit
f29801030a ("e1000e: Disable TSO for buffer overrun workaround").
Fix that by disabling TSO during driver probe.

Fixes: f29801030a ("e1000e: Disable TSO for buffer overrun workaround")
Signed-off-by: Sebastian Basierski <sebastianx.basierski@intel.com>
Signed-off-by: Mateusz Palczewski <mateusz.palczewski@intel.com>
Tested-by: Naama Meir <naamax.meir@linux.intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Link: https://lore.kernel.org/r/20230417205345.1030801-1-anthony.l.nguyen@intel.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 2023-04-19 17:54:12 -07:00
Vadim Fedorenko
8c154d272c bnxt_en: fix free-runnig PHC mode 
The patch in fixes changed the way real-time mode is chosen for PHC on
the NIC. Apparently there is one more use case of the check outside of
ptp part of the driver which was not converted to the new macro and is
making a lot of noise in free-running mode.

Fixes: 131db49916 ("bnxt_en: reset PHC frequency in free-running mode")
Signed-off-by: Vadim Fedorenko <vadfed@meta.com>
Reviewed-by: Michael Chan <michael.chan@broadcom.com>
Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
Link: https://lore.kernel.org/r/20230418202511.1544735-1-vadfed@meta.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 2023-04-19 17:43:07 -07:00
Linus Torvalds
23990b1aff spi: One small fix for v6.3 
A small fix in the error handling for the rockchip driver, ensuring we
 don't leak clock enables if we fail to request the interrupt for the
 device.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmRATd4ACgkQJNaLcl1U
 h9ApHAf/UdN/irP26Nyn2kyrZxxO2S7Ix22PR5uDaD5+YvCTUCPYVzRbSq5T3LQZ
 Znm124tdz3Fwppmw06q7V1AAu4jtzdOKwiocdUn+KV1XH/WMdOOy7El7Fp71QVu1
 8i8Dqt35KwRN1z1d/ts0ubDUFa+s6tEFaYIMtlcDLVSAJMwGEz9YCNBAMDqlINGc
 jSccxA1vIm3xyVOhoAN/W0grivW6oEBVfaG5OlkX2MS+PZQUGy+IMHjVPCIxT5P4
 s/eKrcQXOhuUS3WmIsvF1ynKsb7kSk2x4NgX2vZB+t2NIK9Z5P5sHlnpcuZXhF/t
 peo8lR03e5okSDoL1x5vgej0hwFjQQ==
 =eeQQ
 -----END PGP SIGNATURE-----

Merge tag 'spi-fix-v6.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi

Pull spi fix from Mark Brown:
 "A small fix in the error handling for the rockchip driver, ensuring we
  don't leak clock enables if we fail to request the interrupt for the
  device"

* tag 'spi-fix-v6.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
  spi: spi-rockchip: Fix missing unwind goto in rockchip_sfc_probe()
 2023-04-19 13:49:31 -07:00
Linus Torvalds
72b4fb4c88 regulator: Fixes for v6.3 
A few driver specific fixes, one build coverage issue and a couple of
 "someone typed in the wrong number" style errors in describing devices
 to the subsystem.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmRATRkACgkQJNaLcl1U
 h9DMXgf/VAjqftEWEhODJdw0YJ/trLc+eLOQckCmFnanE4dZSaEz+jCNedkBnI5n
 Nx/seqHfnjCfnLOem6U7fhSxB65R2dTYoNn9KtrTd04vWgeFVJ1Njku5yjgDVz4m
 vyY9/yG+KPsxFU41MPp94K6FVstHGRVW6AEpN+FPSCU7lRIwUZx4Dn4lzz/wLDn0
 ZFqetWRQx6oZ2jSZI0yzjUs+A6l4Itd2Envo88qdjDrZYXadbjGt2UwKshCEmVFs
 ovwPxZjyS7DWJpyJeGz5aLaaQfUQhh9OOQfllhSbd3Gmy5CCMw8FJmW7ZMN0mmOJ
 pGQKmGVod3RFobb0aroT/dLwDZ8Jrg==
 =hcUh
 -----END PGP SIGNATURE-----

Merge tag 'regulator-fix-v6.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator

Pull regulator fixes from Mark Brown:
 "A few driver specific fixes, one build coverage issue and a couple of
  'someone typed in the wrong number' style errors in describing devices
  to the subsystem"

* tag 'regulator-fix-v6.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
  regulator: sm5703: Fix missing n_voltages for fixed regulators
  regulator: fan53555: Fix wrong TCS_SLEW_MASK
  regulator: fan53555: Explicitly include bits header
 2023-04-19 13:35:48 -07:00
Christophe JAILLET
3d2f8f1f18 net: dsa: microchip: ksz8795: Correctly handle huge frame configuration 
Because of the logic in place, SW_HUGE_PACKET can never be set.
(If the first condition is true, then the 2nd one is also true, but is not
executed)

Change the logic and update each bit individually.

Fixes: 29d1e85f45 ("net: dsa: microchip: ksz8: add MTU configuration support")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Reviewed-by: Oleksij Rempel <o.rempel@pengutronix.de>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Link: https://lore.kernel.org/r/43107d9e8b5b8b05f0cbd4e1f47a2bb88c8747b2.1681755535.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 2023-04-19 11:28:49 -07:00
Andrea Righi
d966c3cab9 rust: allow to use INIT_STACK_ALL_ZERO 
With CONFIG_INIT_STACK_ALL_ZERO enabled, bindgen passes
-ftrivial-auto-var-init=zero to clang, that triggers the following
error:

 error: '-ftrivial-auto-var-init=zero' hasn't been enabled; enable it at your own peril for benchmarking purpose only with '-enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang'

However, this additional option that is currently required by clang is
deprecated since clang-16 and going to be removed in the future,
likely with clang-18.

So, make sure bindgen is using this extra option if the major version of
the libclang used by bindgen is < 16.

In this way we can enable CONFIG_INIT_STACK_ALL_ZERO with CONFIG_RUST
without triggering any build error.

Link: https://github.com/llvm/llvm-project/issues/44842
Link: https://github.com/llvm/llvm-project/blob/llvmorg-16.0.0-rc2/clang/docs/ReleaseNotes.rst#deprecated-compiler-flags
Signed-off-by: Andrea Righi <andrea.righi@canonical.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
[Changed to < 16, added link and reworded]
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
 2023-04-19 19:34:43 +02:00
Andrea Righi
ccc4505454 rust: fix regexp in scripts/is_rust_module.sh 
nm can use "R" or "r" to show read-only data sections, but
scripts/is_rust_module.sh can only recognize "r", so with some versions
of binutils it can fail to detect if a module is a Rust module or not.

Right now we're using this script only to determine if we need to skip
BTF generation (that is disabled globally if CONFIG_RUST is enabled),
but it's still nice to fix this script to do the proper job.

Moreover, with this patch applied I can also relax the constraint of
"RUST depends on !DEBUG_INFO_BTF" and build a kernel with Rust and BTF
enabled at the same time (of course BTF generation is still skipped for
Rust modules).

[ Miguel: The actual reason is likely to be a change on the Rust
  compiler between 1.61.0 and 1.62.0:

    echo '#[used] static S: () = ();' |
        rustup run 1.61.0 rustc --emit=obj --crate-type=lib - &&
        nm rust_out.o

    echo '#[used] static S: () = ();' |
        rustup run 1.62.0 rustc --emit=obj --crate-type=lib - &&
        nm rust_out.o

  Gives:

    0000000000000000 r _ZN8rust_out1S17h48027ce0da975467E
    0000000000000000 R _ZN8rust_out1S17h58e1f3d9c0e97cefE

  See https://godbolt.org/z/KE6jneoo4. ]

Signed-off-by: Andrea Righi <andrea.righi@canonical.com>
Reviewed-by: Vincenzo Palazzo <vincenzopalazzodev@gmail.com>
Reviewed-by: Eric Curtin <ecurtin@redhat.com>
Reviewed-by: Martin Rodriguez Reboredo <yakoyoku@gmail.com>
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
 2023-04-19 19:28:49 +02:00
Daniel Borkmann
71b547f561 bpf: Fix incorrect verifier pruning due to missing register precision taints 
Juan Jose et al reported an issue found via fuzzing where the verifier's
pruning logic prematurely marks a program path as safe.

Consider the following program:

   0: (b7) r6 = 1024
   1: (b7) r7 = 0
   2: (b7) r8 = 0
   3: (b7) r9 = -2147483648
   4: (97) r6 %= 1025
   5: (05) goto pc+0
   6: (bd) if r6 <= r9 goto pc+2
   7: (97) r6 %= 1
   8: (b7) r9 = 0
   9: (bd) if r6 <= r9 goto pc+1
  10: (b7) r6 = 0
  11: (b7) r0 = 0
  12: (63) *(u32 *)(r10 -4) = r0
  13: (18) r4 = 0xffff888103693400 // map_ptr(ks=4,vs=48)
  15: (bf) r1 = r4
  16: (bf) r2 = r10
  17: (07) r2 += -4
  18: (85) call bpf_map_lookup_elem#1
  19: (55) if r0 != 0x0 goto pc+1
  20: (95) exit
  21: (77) r6 >>= 10
  22: (27) r6 *= 8192
  23: (bf) r1 = r0
  24: (0f) r0 += r6
  25: (79) r3 = *(u64 *)(r0 +0)
  26: (7b) *(u64 *)(r1 +0) = r3
  27: (95) exit

The verifier treats this as safe, leading to oob read/write access due
to an incorrect verifier conclusion:

  func#0 @0
  0: R1=ctx(off=0,imm=0) R10=fp0
  0: (b7) r6 = 1024                     ; R6_w=1024
  1: (b7) r7 = 0                        ; R7_w=0
  2: (b7) r8 = 0                        ; R8_w=0
  3: (b7) r9 = -2147483648              ; R9_w=-2147483648
  4: (97) r6 %= 1025                    ; R6_w=scalar()
  5: (05) goto pc+0
  6: (bd) if r6 <= r9 goto pc+2         ; R6_w=scalar(umin=18446744071562067969,var_off=(0xffffffff00000000; 0xffffffff)) R9_w=-2147483648
  7: (97) r6 %= 1                       ; R6_w=scalar()
  8: (b7) r9 = 0                        ; R9=0
  9: (bd) if r6 <= r9 goto pc+1         ; R6=scalar(umin=1) R9=0
  10: (b7) r6 = 0                       ; R6_w=0
  11: (b7) r0 = 0                       ; R0_w=0
  12: (63) *(u32 *)(r10 -4) = r0
  last_idx 12 first_idx 9
  regs=1 stack=0 before 11: (b7) r0 = 0
  13: R0_w=0 R10=fp0 fp-8=0000????
  13: (18) r4 = 0xffff8ad3886c2a00      ; R4_w=map_ptr(off=0,ks=4,vs=48,imm=0)
  15: (bf) r1 = r4                      ; R1_w=map_ptr(off=0,ks=4,vs=48,imm=0) R4_w=map_ptr(off=0,ks=4,vs=48,imm=0)
  16: (bf) r2 = r10                     ; R2_w=fp0 R10=fp0
  17: (07) r2 += -4                     ; R2_w=fp-4
  18: (85) call bpf_map_lookup_elem#1   ; R0=map_value_or_null(id=1,off=0,ks=4,vs=48,imm=0)
  19: (55) if r0 != 0x0 goto pc+1       ; R0=0
  20: (95) exit

  from 19 to 21: R0=map_value(off=0,ks=4,vs=48,imm=0) R6=0 R7=0 R8=0 R9=0 R10=fp0 fp-8=mmmm????
  21: (77) r6 >>= 10                    ; R6_w=0
  22: (27) r6 *= 8192                   ; R6_w=0
  23: (bf) r1 = r0                      ; R0=map_value(off=0,ks=4,vs=48,imm=0) R1_w=map_value(off=0,ks=4,vs=48,imm=0)
  24: (0f) r0 += r6
  last_idx 24 first_idx 19
  regs=40 stack=0 before 23: (bf) r1 = r0
  regs=40 stack=0 before 22: (27) r6 *= 8192
  regs=40 stack=0 before 21: (77) r6 >>= 10
  regs=40 stack=0 before 19: (55) if r0 != 0x0 goto pc+1
  parent didn't have regs=40 stack=0 marks: R0_rw=map_value_or_null(id=1,off=0,ks=4,vs=48,imm=0) R6_rw=P0 R7=0 R8=0 R9=0 R10=fp0 fp-8=mmmm????
  last_idx 18 first_idx 9
  regs=40 stack=0 before 18: (85) call bpf_map_lookup_elem#1
  regs=40 stack=0 before 17: (07) r2 += -4
  regs=40 stack=0 before 16: (bf) r2 = r10
  regs=40 stack=0 before 15: (bf) r1 = r4
  regs=40 stack=0 before 13: (18) r4 = 0xffff8ad3886c2a00
  regs=40 stack=0 before 12: (63) *(u32 *)(r10 -4) = r0
  regs=40 stack=0 before 11: (b7) r0 = 0
  regs=40 stack=0 before 10: (b7) r6 = 0
  25: (79) r3 = *(u64 *)(r0 +0)         ; R0_w=map_value(off=0,ks=4,vs=48,imm=0) R3_w=scalar()
  26: (7b) *(u64 *)(r1 +0) = r3         ; R1_w=map_value(off=0,ks=4,vs=48,imm=0) R3_w=scalar()
  27: (95) exit

  from 9 to 11: R1=ctx(off=0,imm=0) R6=0 R7=0 R8=0 R9=0 R10=fp0
  11: (b7) r0 = 0                       ; R0_w=0
  12: (63) *(u32 *)(r10 -4) = r0
  last_idx 12 first_idx 11
  regs=1 stack=0 before 11: (b7) r0 = 0
  13: R0_w=0 R10=fp0 fp-8=0000????
  13: (18) r4 = 0xffff8ad3886c2a00      ; R4_w=map_ptr(off=0,ks=4,vs=48,imm=0)
  15: (bf) r1 = r4                      ; R1_w=map_ptr(off=0,ks=4,vs=48,imm=0) R4_w=map_ptr(off=0,ks=4,vs=48,imm=0)
  16: (bf) r2 = r10                     ; R2_w=fp0 R10=fp0
  17: (07) r2 += -4                     ; R2_w=fp-4
  18: (85) call bpf_map_lookup_elem#1
  frame 0: propagating r6
  last_idx 19 first_idx 11
  regs=40 stack=0 before 18: (85) call bpf_map_lookup_elem#1
  regs=40 stack=0 before 17: (07) r2 += -4
  regs=40 stack=0 before 16: (bf) r2 = r10
  regs=40 stack=0 before 15: (bf) r1 = r4
  regs=40 stack=0 before 13: (18) r4 = 0xffff8ad3886c2a00
  regs=40 stack=0 before 12: (63) *(u32 *)(r10 -4) = r0
  regs=40 stack=0 before 11: (b7) r0 = 0
  parent didn't have regs=40 stack=0 marks: R1=ctx(off=0,imm=0) R6_r=P0 R7=0 R8=0 R9=0 R10=fp0
  last_idx 9 first_idx 9
  regs=40 stack=0 before 9: (bd) if r6 <= r9 goto pc+1
  parent didn't have regs=40 stack=0 marks: R1=ctx(off=0,imm=0) R6_rw=Pscalar() R7_w=0 R8_w=0 R9_rw=0 R10=fp0
  last_idx 8 first_idx 0
  regs=40 stack=0 before 8: (b7) r9 = 0
  regs=40 stack=0 before 7: (97) r6 %= 1
  regs=40 stack=0 before 6: (bd) if r6 <= r9 goto pc+2
  regs=40 stack=0 before 5: (05) goto pc+0
  regs=40 stack=0 before 4: (97) r6 %= 1025
  regs=40 stack=0 before 3: (b7) r9 = -2147483648
  regs=40 stack=0 before 2: (b7) r8 = 0
  regs=40 stack=0 before 1: (b7) r7 = 0
  regs=40 stack=0 before 0: (b7) r6 = 1024
  19: safe
  frame 0: propagating r6
  last_idx 9 first_idx 0
  regs=40 stack=0 before 6: (bd) if r6 <= r9 goto pc+2
  regs=40 stack=0 before 5: (05) goto pc+0
  regs=40 stack=0 before 4: (97) r6 %= 1025
  regs=40 stack=0 before 3: (b7) r9 = -2147483648
  regs=40 stack=0 before 2: (b7) r8 = 0
  regs=40 stack=0 before 1: (b7) r7 = 0
  regs=40 stack=0 before 0: (b7) r6 = 1024

  from 6 to 9: safe
  verification time 110 usec
  stack depth 4
  processed 36 insns (limit 1000000) max_states_per_insn 0 total_states 3 peak_states 3 mark_read 2

The verifier considers this program as safe by mistakenly pruning unsafe
code paths. In the above func#0, code lines 0-10 are of interest. In line
0-3 registers r6 to r9 are initialized with known scalar values. In line 4
the register r6 is reset to an unknown scalar given the verifier does not
track modulo operations. Due to this, the verifier can also not determine
precisely which branches in line 6 and 9 are taken, therefore it needs to
explore them both.

As can be seen, the verifier starts with exploring the false/fall-through
paths first. The 'from 19 to 21' path has both r6=0 and r9=0 and the pointer
arithmetic on r0 += r6 is therefore considered safe. Given the arithmetic,
r6 is correctly marked for precision tracking where backtracking kicks in
where it walks back the current path all the way where r6 was set to 0 in
the fall-through branch.

Next, the pruning logics pops the path 'from 9 to 11' from the stack. Also
here, the state of the registers is the same, that is, r6=0 and r9=0, so
that at line 19 the path can be pruned as it is considered safe. It is
interesting to note that the conditional in line 9 turned r6 into a more
precise state, that is, in the fall-through path at the beginning of line
10, it is R6=scalar(umin=1), and in the branch-taken path (which is analyzed
here) at the beginning of line 11, r6 turned into a known const r6=0 as
r9=0 prior to that and therefore (unsigned) r6 <= 0 concludes that r6 must
be 0 (**):

  [...]                                 ; R6_w=scalar()
  9: (bd) if r6 <= r9 goto pc+1         ; R6=scalar(umin=1) R9=0
  [...]

  from 9 to 11: R1=ctx(off=0,imm=0) R6=0 R7=0 R8=0 R9=0 R10=fp0
  [...]

The next path is 'from 6 to 9'. The verifier considers the old and current
state equivalent, and therefore prunes the search incorrectly. Looking into
the two states which are being compared by the pruning logic at line 9, the
old state consists of R6_rwD=Pscalar() R9_rwD=0 R10=fp0 and the new state
consists of R1=ctx(off=0,imm=0) R6_w=scalar(umax=18446744071562067968)
R7_w=0 R8_w=0 R9_w=-2147483648 R10=fp0. While r6 had the reg->precise flag
correctly set in the old state, r9 did not. Both r6'es are considered as
equivalent given the old one is a superset of the current, more precise one,
however, r9's actual values (0 vs 0x80000000) mismatch. Given the old r9
did not have reg->precise flag set, the verifier does not consider the
register as contributing to the precision state of r6, and therefore it
considered both r9 states as equivalent. However, for this specific pruned
path (which is also the actual path taken at runtime), register r6 will be
0x400 and r9 0x80000000 when reaching line 21, thus oob-accessing the map.

The purpose of precision tracking is to initially mark registers (including
spilled ones) as imprecise to help verifier's pruning logic finding equivalent
states it can then prune if they don't contribute to the program's safety
aspects. For example, if registers are used for pointer arithmetic or to pass
constant length to a helper, then the verifier sets reg->precise flag and
backtracks the BPF program instruction sequence and chain of verifier states
to ensure that the given register or stack slot including their dependencies
are marked as precisely tracked scalar. This also includes any other registers
and slots that contribute to a tracked state of given registers/stack slot.
This backtracking relies on recorded jmp_history and is able to traverse
entire chain of parent states. This process ends only when all the necessary
registers/slots and their transitive dependencies are marked as precise.

The backtrack_insn() is called from the current instruction up to the first
instruction, and its purpose is to compute a bitmask of registers and stack
slots that need precision tracking in the parent's verifier state. For example,
if a current instruction is r6 = r7, then r6 needs precision after this
instruction and r7 needs precision before this instruction, that is, in the
parent state. Hence for the latter r7 is marked and r6 unmarked.

For the class of jmp/jmp32 instructions, backtrack_insn() today only looks
at call and exit instructions and for all other conditionals the masks
remain as-is. However, in the given situation register r6 has a dependency
on r9 (as described above in **), so also that one needs to be marked for
precision tracking. In other words, if an imprecise register influences a
precise one, then the imprecise register should also be marked precise.
Meaning, in the parent state both dest and src register need to be tracked
for precision and therefore the marking must be more conservative by setting
reg->precise flag for both. The precision propagation needs to cover both
for the conditional: if the src reg was marked but not the dst reg and vice
versa.

After the fix the program is correctly rejected:

  func#0 @0
  0: R1=ctx(off=0,imm=0) R10=fp0
  0: (b7) r6 = 1024                     ; R6_w=1024
  1: (b7) r7 = 0                        ; R7_w=0
  2: (b7) r8 = 0                        ; R8_w=0
  3: (b7) r9 = -2147483648              ; R9_w=-2147483648
  4: (97) r6 %= 1025                    ; R6_w=scalar()
  5: (05) goto pc+0
  6: (bd) if r6 <= r9 goto pc+2         ; R6_w=scalar(umin=18446744071562067969,var_off=(0xffffffff80000000; 0x7fffffff),u32_min=-2147483648) R9_w=-2147483648
  7: (97) r6 %= 1                       ; R6_w=scalar()
  8: (b7) r9 = 0                        ; R9=0
  9: (bd) if r6 <= r9 goto pc+1         ; R6=scalar(umin=1) R9=0
  10: (b7) r6 = 0                       ; R6_w=0
  11: (b7) r0 = 0                       ; R0_w=0
  12: (63) *(u32 *)(r10 -4) = r0
  last_idx 12 first_idx 9
  regs=1 stack=0 before 11: (b7) r0 = 0
  13: R0_w=0 R10=fp0 fp-8=0000????
  13: (18) r4 = 0xffff9290dc5bfe00      ; R4_w=map_ptr(off=0,ks=4,vs=48,imm=0)
  15: (bf) r1 = r4                      ; R1_w=map_ptr(off=0,ks=4,vs=48,imm=0) R4_w=map_ptr(off=0,ks=4,vs=48,imm=0)
  16: (bf) r2 = r10                     ; R2_w=fp0 R10=fp0
  17: (07) r2 += -4                     ; R2_w=fp-4
  18: (85) call bpf_map_lookup_elem#1   ; R0=map_value_or_null(id=1,off=0,ks=4,vs=48,imm=0)
  19: (55) if r0 != 0x0 goto pc+1       ; R0=0
  20: (95) exit

  from 19 to 21: R0=map_value(off=0,ks=4,vs=48,imm=0) R6=0 R7=0 R8=0 R9=0 R10=fp0 fp-8=mmmm????
  21: (77) r6 >>= 10                    ; R6_w=0
  22: (27) r6 *= 8192                   ; R6_w=0
  23: (bf) r1 = r0                      ; R0=map_value(off=0,ks=4,vs=48,imm=0) R1_w=map_value(off=0,ks=4,vs=48,imm=0)
  24: (0f) r0 += r6
  last_idx 24 first_idx 19
  regs=40 stack=0 before 23: (bf) r1 = r0
  regs=40 stack=0 before 22: (27) r6 *= 8192
  regs=40 stack=0 before 21: (77) r6 >>= 10
  regs=40 stack=0 before 19: (55) if r0 != 0x0 goto pc+1
  parent didn't have regs=40 stack=0 marks: R0_rw=map_value_or_null(id=1,off=0,ks=4,vs=48,imm=0) R6_rw=P0 R7=0 R8=0 R9=0 R10=fp0 fp-8=mmmm????
  last_idx 18 first_idx 9
  regs=40 stack=0 before 18: (85) call bpf_map_lookup_elem#1
  regs=40 stack=0 before 17: (07) r2 += -4
  regs=40 stack=0 before 16: (bf) r2 = r10
  regs=40 stack=0 before 15: (bf) r1 = r4
  regs=40 stack=0 before 13: (18) r4 = 0xffff9290dc5bfe00
  regs=40 stack=0 before 12: (63) *(u32 *)(r10 -4) = r0
  regs=40 stack=0 before 11: (b7) r0 = 0
  regs=40 stack=0 before 10: (b7) r6 = 0
  25: (79) r3 = *(u64 *)(r0 +0)         ; R0_w=map_value(off=0,ks=4,vs=48,imm=0) R3_w=scalar()
  26: (7b) *(u64 *)(r1 +0) = r3         ; R1_w=map_value(off=0,ks=4,vs=48,imm=0) R3_w=scalar()
  27: (95) exit

  from 9 to 11: R1=ctx(off=0,imm=0) R6=0 R7=0 R8=0 R9=0 R10=fp0
  11: (b7) r0 = 0                       ; R0_w=0
  12: (63) *(u32 *)(r10 -4) = r0
  last_idx 12 first_idx 11
  regs=1 stack=0 before 11: (b7) r0 = 0
  13: R0_w=0 R10=fp0 fp-8=0000????
  13: (18) r4 = 0xffff9290dc5bfe00      ; R4_w=map_ptr(off=0,ks=4,vs=48,imm=0)
  15: (bf) r1 = r4                      ; R1_w=map_ptr(off=0,ks=4,vs=48,imm=0) R4_w=map_ptr(off=0,ks=4,vs=48,imm=0)
  16: (bf) r2 = r10                     ; R2_w=fp0 R10=fp0
  17: (07) r2 += -4                     ; R2_w=fp-4
  18: (85) call bpf_map_lookup_elem#1
  frame 0: propagating r6
  last_idx 19 first_idx 11
  regs=40 stack=0 before 18: (85) call bpf_map_lookup_elem#1
  regs=40 stack=0 before 17: (07) r2 += -4
  regs=40 stack=0 before 16: (bf) r2 = r10
  regs=40 stack=0 before 15: (bf) r1 = r4
  regs=40 stack=0 before 13: (18) r4 = 0xffff9290dc5bfe00
  regs=40 stack=0 before 12: (63) *(u32 *)(r10 -4) = r0
  regs=40 stack=0 before 11: (b7) r0 = 0
  parent didn't have regs=40 stack=0 marks: R1=ctx(off=0,imm=0) R6_r=P0 R7=0 R8=0 R9=0 R10=fp0
  last_idx 9 first_idx 9
  regs=40 stack=0 before 9: (bd) if r6 <= r9 goto pc+1
  parent didn't have regs=240 stack=0 marks: R1=ctx(off=0,imm=0) R6_rw=Pscalar() R7_w=0 R8_w=0 R9_rw=P0 R10=fp0
  last_idx 8 first_idx 0
  regs=240 stack=0 before 8: (b7) r9 = 0
  regs=40 stack=0 before 7: (97) r6 %= 1
  regs=40 stack=0 before 6: (bd) if r6 <= r9 goto pc+2
  regs=240 stack=0 before 5: (05) goto pc+0
  regs=240 stack=0 before 4: (97) r6 %= 1025
  regs=240 stack=0 before 3: (b7) r9 = -2147483648
  regs=40 stack=0 before 2: (b7) r8 = 0
  regs=40 stack=0 before 1: (b7) r7 = 0
  regs=40 stack=0 before 0: (b7) r6 = 1024
  19: safe

  from 6 to 9: R1=ctx(off=0,imm=0) R6_w=scalar(umax=18446744071562067968) R7_w=0 R8_w=0 R9_w=-2147483648 R10=fp0
  9: (bd) if r6 <= r9 goto pc+1
  last_idx 9 first_idx 0
  regs=40 stack=0 before 6: (bd) if r6 <= r9 goto pc+2
  regs=240 stack=0 before 5: (05) goto pc+0
  regs=240 stack=0 before 4: (97) r6 %= 1025
  regs=240 stack=0 before 3: (b7) r9 = -2147483648
  regs=40 stack=0 before 2: (b7) r8 = 0
  regs=40 stack=0 before 1: (b7) r7 = 0
  regs=40 stack=0 before 0: (b7) r6 = 1024
  last_idx 9 first_idx 0
  regs=200 stack=0 before 6: (bd) if r6 <= r9 goto pc+2
  regs=240 stack=0 before 5: (05) goto pc+0
  regs=240 stack=0 before 4: (97) r6 %= 1025
  regs=240 stack=0 before 3: (b7) r9 = -2147483648
  regs=40 stack=0 before 2: (b7) r8 = 0
  regs=40 stack=0 before 1: (b7) r7 = 0
  regs=40 stack=0 before 0: (b7) r6 = 1024
  11: R6=scalar(umax=18446744071562067968) R9=-2147483648
  11: (b7) r0 = 0                       ; R0_w=0
  12: (63) *(u32 *)(r10 -4) = r0
  last_idx 12 first_idx 11
  regs=1 stack=0 before 11: (b7) r0 = 0
  13: R0_w=0 R10=fp0 fp-8=0000????
  13: (18) r4 = 0xffff9290dc5bfe00      ; R4_w=map_ptr(off=0,ks=4,vs=48,imm=0)
  15: (bf) r1 = r4                      ; R1_w=map_ptr(off=0,ks=4,vs=48,imm=0) R4_w=map_ptr(off=0,ks=4,vs=48,imm=0)
  16: (bf) r2 = r10                     ; R2_w=fp0 R10=fp0
  17: (07) r2 += -4                     ; R2_w=fp-4
  18: (85) call bpf_map_lookup_elem#1   ; R0_w=map_value_or_null(id=3,off=0,ks=4,vs=48,imm=0)
  19: (55) if r0 != 0x0 goto pc+1       ; R0_w=0
  20: (95) exit

  from 19 to 21: R0=map_value(off=0,ks=4,vs=48,imm=0) R6=scalar(umax=18446744071562067968) R7=0 R8=0 R9=-2147483648 R10=fp0 fp-8=mmmm????
  21: (77) r6 >>= 10                    ; R6_w=scalar(umax=18014398507384832,var_off=(0x0; 0x3fffffffffffff))
  22: (27) r6 *= 8192                   ; R6_w=scalar(smax=9223372036854767616,umax=18446744073709543424,var_off=(0x0; 0xffffffffffffe000),s32_max=2147475456,u32_max=-8192)
  23: (bf) r1 = r0                      ; R0=map_value(off=0,ks=4,vs=48,imm=0) R1_w=map_value(off=0,ks=4,vs=48,imm=0)
  24: (0f) r0 += r6
  last_idx 24 first_idx 21
  regs=40 stack=0 before 23: (bf) r1 = r0
  regs=40 stack=0 before 22: (27) r6 *= 8192
  regs=40 stack=0 before 21: (77) r6 >>= 10
  parent didn't have regs=40 stack=0 marks: R0_rw=map_value(off=0,ks=4,vs=48,imm=0) R6_r=Pscalar(umax=18446744071562067968) R7=0 R8=0 R9=-2147483648 R10=fp0 fp-8=mmmm????
  last_idx 19 first_idx 11
  regs=40 stack=0 before 19: (55) if r0 != 0x0 goto pc+1
  regs=40 stack=0 before 18: (85) call bpf_map_lookup_elem#1
  regs=40 stack=0 before 17: (07) r2 += -4
  regs=40 stack=0 before 16: (bf) r2 = r10
  regs=40 stack=0 before 15: (bf) r1 = r4
  regs=40 stack=0 before 13: (18) r4 = 0xffff9290dc5bfe00
  regs=40 stack=0 before 12: (63) *(u32 *)(r10 -4) = r0
  regs=40 stack=0 before 11: (b7) r0 = 0
  parent didn't have regs=40 stack=0 marks: R1=ctx(off=0,imm=0) R6_rw=Pscalar(umax=18446744071562067968) R7_w=0 R8_w=0 R9_w=-2147483648 R10=fp0
  last_idx 9 first_idx 0
  regs=40 stack=0 before 9: (bd) if r6 <= r9 goto pc+1
  regs=240 stack=0 before 6: (bd) if r6 <= r9 goto pc+2
  regs=240 stack=0 before 5: (05) goto pc+0
  regs=240 stack=0 before 4: (97) r6 %= 1025
  regs=240 stack=0 before 3: (b7) r9 = -2147483648
  regs=40 stack=0 before 2: (b7) r8 = 0
  regs=40 stack=0 before 1: (b7) r7 = 0
  regs=40 stack=0 before 0: (b7) r6 = 1024
  math between map_value pointer and register with unbounded min value is not allowed
  verification time 886 usec
  stack depth 4
  processed 49 insns (limit 1000000) max_states_per_insn 1 total_states 5 peak_states 5 mark_read 2

Fixes: b5dc0163d8 ("bpf: precise scalar_value tracking")
Reported-by: Juan Jose Lopez Jaimez <jjlopezjaimez@google.com>
Reported-by: Meador Inge <meadori@google.com>
Reported-by: Simon Scannell <simonscannell@google.com>
Reported-by: Nenad Stojanovski <thenenadx@google.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Co-developed-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Reviewed-by: John Fastabend <john.fastabend@gmail.com>
Reviewed-by: Juan Jose Lopez Jaimez <jjlopezjaimez@google.com>
Reviewed-by: Meador Inge <meadori@google.com>
Reviewed-by: Simon Scannell <simonscannell@google.com>
 2023-04-19 10:18:18 -07:00